Add MIT LICENSE (+ cross-platform release build workflow)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
docs: add v3.5.1 release notes to RELEASE.md
2026-08-15 14:10:22 +02:00 · 2026-07-01 17:21:12 -03:00 · 2026-06-25 09:28:16 -03:00 · 2026-06-25 09:26:09 -03:00 · 2026-06-25 00:41:22 -03:00 · 2026-06-24 23:59:25 -03:00
72 changed files with 7143 additions and 367 deletions
@@ -1,188 +1,52 @@
-# NeuroSploit v3 Environment Variables
+# NeuroSploit v3.5.1 — environment / API keys (optional)
-# =====================================
+# ------------------------------------------------------------------
-# Copy this file to .env and configure your API keys
+# You only need this for the API-key auth path. If you log in with a
 # local subscription CLI instead (--subscription with Claude / Codex /
 # Gemini / Grok), you don't need any key here.
 #
-# IMPORTANT: You MUST set at least one LLM API key for the AI agent to work!
+# Set the key(s) for the providers you use, then load and run:
 #   set -a; . ./.env; set +a
 #   neurosploit run http://target --model anthropic:claude-opus-4-8 -v
 #
 # Provider prefix -> env var (use as `--model <prefix>:<model>`).
-# =============================================================================
+# anthropic:   https://console.anthropic.com/
 # LLM API Keys (REQUIRED - at least one must be set)
 # =============================================================================
 # Get your Claude API key at: https://console.anthropic.com/
 ANTHROPIC_API_KEY=
-# OpenAI: https://platform.openai.com/api-keys
+# openai:      https://platform.openai.com/api-keys
 OPENAI_API_KEY=
-# Google Gemini: https://aistudio.google.com/app/apikey
+# gemini:      https://aistudio.google.com/app/apikey
 GEMINI_API_KEY=
-# OpenRouter (multi-model): https://openrouter.ai/keys
+# xai:         https://console.x.ai/
 OPENROUTER_API_KEY=
 # xAI Grok: https://console.x.ai/  (used by the Grok CLI backend)
 XAI_API_KEY=
-# NVIDIA NIM (PR #28): https://build.nvidia.com/  — keys look like `nvapi-...`
+# nvidia_nim:  https://build.nvidia.com/   (keys look like nvapi-...)
 # OpenAI-compatible endpoint at https://integrate.api.nvidia.com/v1
 NVIDIA_NIM_API_KEY=
-# Together AI: https://api.together.xyz/settings/api-keys
+# deepseek:    https://platform.deepseek.com/
 DEEPSEEK_API_KEY=
 # mistral:     https://console.mistral.ai/
 MISTRAL_API_KEY=
 # qwen:        https://dashscope-intl.aliyuncs.com/  (Alibaba DashScope)
 DASHSCOPE_API_KEY=
 # groq:        https://console.groq.com/keys
 GROQ_API_KEY=
 # together:    https://api.together.xyz/settings/api-keys
 TOGETHER_API_KEY=
-# Fireworks AI: https://fireworks.ai/account/api-keys
+# openrouter:  https://openrouter.ai/keys
-FIREWORKS_API_KEY=
+OPENROUTER_API_KEY=
-# Azure OpenAI: https://portal.azure.com/
+# ollama:      local, no key needed. Override the endpoint if not default:
-#AZURE_OPENAI_API_KEY=
+#OLLAMA_BASE_URL=http://localhost:11434/v1
 #AZURE_OPENAI_ENDPOINT=https://your-resource.openai.azure.com/
 #AZURE_OPENAI_API_VERSION=2024-02-01
 #AZURE_OPENAI_DEPLOYMENT=gpt-4o
-# =============================================================================
+# litellm:     point at your LiteLLM proxy (OpenAI-compatible). Route any
-# Local LLM (optional - no API key needed)
+#              model through it as `--model litellm:<model>`.
-# =============================================================================
+#LITELLM_BASE_URL=http://localhost:4000/v1
-# Ollama: https://ollama.ai
+LITELLM_API_KEY=
 #OLLAMA_BASE_URL=http://localhost:11434
 # LM Studio: https://lmstudio.ai
 #LMSTUDIO_BASE_URL=http://localhost:1234
 # =============================================================================
 # LLM Configuration
 # =============================================================================
 # Max output tokens (up to 64000 for Claude). Comment out for profile defaults.
 #MAX_OUTPUT_TOKENS=64000
 # Select specific model name (e.g., claude-sonnet-4-20250514, gpt-4o, llama3.2, qwen2.5)
 # Leave empty for provider default
 #DEFAULT_LLM_MODEL=
 # Enable task-type model routing (routes to different LLM profiles per task)
 ENABLE_MODEL_ROUTING=false
 # =============================================================================
 # Feature Flags
 # =============================================================================
 # Bug bounty dataset cognitive augmentation
 ENABLE_KNOWLEDGE_AUGMENTATION=false
 # Playwright browser-based validation + screenshot capture
 ENABLE_BROWSER_VALIDATION=false
 # =============================================================================
 # Agent Autonomy (Phase 1-5 modules)
 # =============================================================================
 # Token budget per scan (limits total LLM tokens). Comment out for unlimited.
 #TOKEN_BUDGET=100000
 # Enable AI reasoning engine (think/plan/reflect at checkpoints)
 ENABLE_REASONING=true
 # Enable CVE/exploit search (NVD API + GitHub)
 ENABLE_CVE_HUNT=true
 # NVD API key for higher rate limits: https://nvd.nist.gov/developers/request-an-api-key
 #NVD_API_KEY=
 # NVIDIA NIM API key for free 40 RPM endpoint
 NIM_API_KEY=
 # NVIDIA NIM Model (optional - defaults to openai/gpt-oss-120b)
 #NIM_MODEL=
 # GitHub token for exploit search (optional, increases rate limit)
 #GITHUB_TOKEN=
 # Enable multi-agent orchestration (replaces default 3-stream architecture)
 # WARNING: Experimental - uses specialist agents instead of parallel streams
 ENABLE_MULTI_AGENT=false
 # Enable AI Researcher agent (0-day discovery with Kali sandbox)
 # Requires enable_kali_sandbox=true per scan (frontend checkbox)
 ENABLE_RESEARCHER_AI=true
 # CLI Agent (AI CLI tools inside Kali sandbox)
 # Runs Claude Code / Gemini CLI / Codex CLI inside Kali container as pentest engine
 #ENABLE_CLI_AGENT=true
 #CLI_AGENT_MAX_RUNTIME=1800
 #CLI_AGENT_DEFAULT_PROVIDER=claude_code
 # Kali sandbox Docker image name
 #KALI_SANDBOX_IMAGE=neurosploit-kali:latest
 # =============================================================================
 # Smart Router (OAuth + API provider routing)
 # =============================================================================
 # Enable Smart Router for automatic provider failover and CLI OAuth token reuse
 #ENABLE_SMART_ROUTER=true
 # =============================================================================
 # RAG System (Retrieval-Augmented Generation)
 # =============================================================================
 # Enable RAG for semantic search over vuln knowledge, bug bounty data, etc.
 ENABLE_RAG=true
 # RAG backend: auto (best available), chromadb, tfidf, bm25
 RAG_BACKEND=auto
 # =============================================================================
 # Methodology File (deep injection into agent prompts)
 # =============================================================================
 # Path to .md methodology file (FASE-based pentest methodology)
 #METHODOLOGY_FILE=/opt/Prompts-PenTest/pentestcompleto_en.md
 # =============================================================================
 # Vuln Type Agents (per-vuln parallel orchestration)
 # =============================================================================
 # Enable parallel per-vuln-type specialist agents
 ENABLE_VULN_AGENTS=false
 # =============================================================================
 # Notifications (multi-channel scan alerts)
 # =============================================================================
 #ENABLE_NOTIFICATIONS=false
 #NOTIFICATION_SEVERITY_FILTER=critical,high
 # Discord webhook for scan alerts
 #DISCORD_WEBHOOK_URL=
 # Telegram bot alerts
 #TELEGRAM_BOT_TOKEN=
 #TELEGRAM_CHAT_ID=
 # WhatsApp/Twilio alerts
 #TWILIO_ACCOUNT_SID=
 #TWILIO_AUTH_TOKEN=
 #TWILIO_FROM_NUMBER=
 #TWILIO_TO_NUMBER=
 # =============================================================================
 # Database (default is SQLite - no config needed)
 # =============================================================================
 DATABASE_URL=sqlite+aiosqlite:///./data/neurosploit.db
 # =============================================================================
 # Server Configuration
 # =============================================================================
 HOST=0.0.0.0
 PORT=8000
 DEBUG=false
 # =============================================================================
 # NeuroSploit v3.3.0 — Autonomous MD-Agent Engine
 # =============================================================================
 # The engine delegates execution to a locally-installed agentic CLI backend.
 # Default backend (claude | codex | grok). First installed is used if unset.
 NEUROSPLOIT_BACKEND=claude
 # Default provider/model (see neurosploit_agent/models.py)
 NEUROSPLOIT_PROVIDER=anthropic
 NEUROSPLOIT_MODEL=claude-opus-4-8
 # OOB collaborator host for blind/SSRF/XXE proof (optional)
 NEUROSPLOIT_COLLABORATOR=
 # Reinforcement-learning loop (1=on). State persists to data/rl_state.json
 NEUROSPLOIT_RL=1
 # Playwright MCP for browser-based proof of execution (1=on; needs npx)
 NEUROSPLOIT_MCP=1
 # OpenAI-compatible base URL override (set automatically per provider)
 #OPENAI_BASE_URL=
@@ -0,0 +1,96 @@
 name: Release builds
 # Builds self-contained NeuroSploit binaries for every OS/arch and uploads them
 # to the matching GitHub Release. Fires automatically on a pushed `v*` tag, or
 # manually via "Run workflow" (provide the tag).
 on:
  push:
    tags: ["v*"]
  workflow_dispatch:
    inputs:
      tag:
        description: "Release tag to build & attach (e.g. v3.5.2)"
        required: true
 permissions:
  contents: write
 jobs:
  build:
    name: ${{ matrix.label }}
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        include:
          - { os: ubuntu-22.04,      label: linux-x64,    ext: tar.gz, target: "" }
          - { os: ubuntu-24.04-arm,  label: linux-arm64,  ext: tar.gz, target: "" }
          # macOS x64 is cross-built on an Apple-Silicon runner (no scarce Intel runner).
          - { os: macos-14,          label: macos-x64,    ext: tar.gz, target: x86_64-apple-darwin }
          - { os: macos-14,          label: macos-arm64,  ext: tar.gz, target: "" }
          - { os: windows-latest,    label: windows-x64,  ext: zip,    target: "" }
    steps:
      - uses: actions/checkout@v4
      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          targets: ${{ matrix.target }}
      - name: Cache cargo
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            neurosploit-rs/target
          key: ${{ matrix.label }}-cargo-${{ hashFiles('neurosploit-rs/Cargo.lock') }}
      - name: Build (release)
        working-directory: neurosploit-rs
        shell: bash
        run: |
          if [ -n "${{ matrix.target }}" ]; then
            cargo build --release --target "${{ matrix.target }}"
          else
            cargo build --release
          fi
      - name: Resolve tag
        id: tag
        shell: bash
        run: echo "tag=${{ github.event.inputs.tag || github.ref_name }}" >> "$GITHUB_OUTPUT"
      - name: Package
        shell: bash
        run: |
          set -e
          TAG="${{ steps.tag.outputs.tag }}"
          NAME="neurosploit-${TAG}-${{ matrix.label }}"
          mkdir -p "dist/$NAME"
          cp -R agents_md "dist/$NAME/"
          cat > "dist/$NAME/README.txt" <<EOF
          NeuroSploit ${TAG} — ${{ matrix.label }}
          Run from inside this folder so it finds agents_md/, e.g.:
            ./neurosploit --version
            ./neurosploit run http://testphp.vulnweb.com/ --model anthropic:claude-opus-4-8 -v
          Or set NEUROSPLOIT_BASE to this folder and run neurosploit from anywhere.
          EOF
          BINDIR="neurosploit-rs/target/release"
          if [ -n "${{ matrix.target }}" ]; then BINDIR="neurosploit-rs/target/${{ matrix.target }}/release"; fi
          if [ "${{ runner.os }}" = "Windows" ]; then
            cp "$BINDIR/neurosploit.exe" "dist/$NAME/"
            (cd dist && 7z a "${NAME}.zip" "$NAME" >/dev/null)
          else
            cp "$BINDIR/neurosploit" "dist/$NAME/"
            (cd dist && tar -czf "${NAME}.tar.gz" "$NAME")
          fi
      - name: Upload to release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          TAG="${{ steps.tag.outputs.tag }}"
          gh release upload "$TAG" dist/neurosploit-*.${{ matrix.ext }} --clobber
@@ -100,3 +100,7 @@ runs/
 data/rl_state_rs.json
 neurosploit-rs/runs/
 v34_gui.png
 data/repl_runs.json
 data/repl_history.txt
 .neurosploit/
 /tmp/*
@@ -0,0 +1,21 @@
 MIT License
 Copyright (c) 2026 Joas A Santos & Red Team Leaders
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights
 to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 copies of the Software, and to permit persons to whom the Software is
 furnished to do so, subject to the following conditions:
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
@@ -1,4 +1,4 @@
-<h1 align="center">NeuroSploit v3.4.1 🦀</h1>
+<h1 align="center">🧠 NeuroSploit v3.5.1</h1>
 <p align="center">
  <a href="https://github.com/JoasASantos/NeuroSploit/stargazers"><img src="https://img.shields.io/github/stars/JoasASantos/NeuroSploit?style=for-the-badge&logo=github&color=8b5cf6" alt="Stars"></a>
@@ -8,11 +8,12 @@
 </p>
 <p align="center">
-  <img src="https://img.shields.io/badge/Version-3.4.1-blue?style=flat-square">
+  <img src="https://img.shields.io/badge/Version-3.5.1-blue?style=flat-square">
  <img src="https://img.shields.io/badge/Harness-Rust%20%7C%20tokio-e6b673?style=flat-square">
  <img src="https://img.shields.io/badge/License-MIT-green?style=flat-square">
-  <img src="https://img.shields.io/badge/MD%20Agents-303-red?style=flat-square">
+  <img src="https://img.shields.io/badge/MD%20Agents-329-red?style=flat-square">
  <img src="https://img.shields.io/badge/Models-12%20providers-success?style=flat-square">
  <img src="https://img.shields.io/badge/Modes-Black%20%7C%20White%20%7C%20Grey%20%7C%20Host-9cf?style=flat-square">
  <img src="https://img.shields.io/badge/Auth-API%20key%20%7C%20Subscription-orange?style=flat-square">
 </p>
@@ -20,36 +21,123 @@
 <i>by Joas A Santos &amp; Red Team Leaders</i></p>
 > ⭐ If this is useful, **star the repo** — it helps a lot.
 >
 > 📖 **New here? Read the [full Tutorial & User Guide →](TUTORIAL.md)** — every mode, flag, config and example explained.
 ---
-**Autonomous, multi-model penetration-testing harness — Rust, CLI-only.**
+**NeuroSploit** turns a URL, a source repository, a running app, or a host/IP into
 an autonomous security engagement. A Rust harness (`tokio`) drives a **pool of
 LLMs** — via **API key** or local **subscription** (Claude Code / Codex / Gemini /
 Grok) — recons the target, **intelligently selects only the agents that match the
 discovered surface**, runs them in parallel, **chains** findings into deeper
 impact, and **validates every claim by cross-model voting + tool-receipt
 grounding** before reporting. It ships **329 markdown agents** and a **Mission
 Control TUI**.
-This branch is the **slim, Rust-only** distribution: the `neurosploit-rs/` workspace
+### Engagement modes
 plus the `agents_md/` agent library. It turns a URL (black-box) or a code
 repository (white-box) into an autonomous engagement that drives a pool of LLMs
 — via **API key** or local **subscription** (Claude Code / Codex / Gemini / Grok)
 — recons the target, **intelligently selects only the agents matching the
 discovered surface**, runs them in parallel, then validates every finding by
 **cross-model voting** before reporting.
-> The full project (Python engine, web GUIs, history) lives on the `main` branch.
+| Mode | Command | What it does |
 |------|---------|-------------|
 | **Black-box** | `neurosploit run <url>` | recon → select → exploit → vote → report |
 | **White-box** | `neurosploit whitebox <repo>` | source/SAST review (file:line evidence) |
 | **Grey-box** | `neurosploit greybox <repo> --url <app>` | code review **+** live exploitation together |
 | **Host/Infra** | `neurosploit host <ip> --creds creds.yaml` | Linux / Windows / Active Directory testing |
 | **Mission Control** | `neurosploit tui <url>` | live TUI panels + composer during the run |
 | **Interactive** | `neurosploit` | persistent REPL session (resumes per project) |
 ### Highlights
 - 🧠 **POMDP belief + value-of-information** — the target is partially observable,
  so findings aren't booleans: a property-graph **belief** carries probabilities,
  and "scan more vs exploit now" falls out of belief entropy. The `may_assert`
  gate is a **mathematical anti-hallucination rule** (don't claim exploitability
  while the belief is diffuse).
 - 🧾 **Grounding** — hard rule: **no claim without a tool receipt** (raw tool
  output, not paraphrase). Empirical for black-box, symbolic (`file:line`) for
  white-box; ungrounded claims are demoted.
 - 🔗 **Attack chaining** — 12 multi-stage chain agents (SQLi→RCE→LPE, SSRF→AWS
  creds, upload→LFI→RCE→LPE, default-creds→domain, …); each stage proven before
  advancing.
 - 🗺️ **Attack graph & kill chain** — findings mapped to OWASP / CWE / MITRE
  ATT&CK / stage; rendered as a Mermaid graph in the report.
 - ✅ **Cross-model validation** — a different model adjudicates each finding;
  RL-weighted, recon-aware agent selection.
 - 🛰️ **Mission Control TUI** — live header/feed/findings/targets panels + a
  composer you can type in *while the run streams* (`summary`, `pause`, …).
 - 💾 **Per-project memory** — `<cwd>/.neurosploit/` keeps session, run history and
  command history; the REPL **resumes** on reopen. No database required.
 - 🪙 **Token/cost telemetry**, per-agent attribution, graceful Ctrl-C → report or
  discard, Typst/HTML/JSON/MD reports.
 > This is the **slim, Rust-only** distribution (`neurosploit-rs/` + `agents_md/`).
 > The earlier Python engine and web GUIs live on the older `v3.4.0` branch.
 ---
 ## 📦 Install (one line)
 **Linux / macOS** (x64 & arm64):
 ```bash
 curl -fsSL https://raw.githubusercontent.com/JoasASantos/NeuroSploit/main/setup.sh | bash
 ```
 **Windows** (PowerShell, x64 & arm64):
 ```powershell
 irm https://raw.githubusercontent.com/JoasASantos/NeuroSploit/main/install.ps1 | iex
 ```
 ### Supported platforms
 | OS | x64 | arm64 |
 |----|-----|-------|
 | **Linux** (Kali recommended) | ✅ | ✅ |
 | **macOS** | ✅ | ✅ (Apple Silicon) |
 | **Windows** | ✅ | ✅ |
 Pure Rust + stdlib, so it builds natively everywhere a stable Rust toolchain runs.
 The installer auto-detects OS/arch and installs Rust if missing. On native Windows
 use `install.ps1`; under WSL2 / Git Bash the `setup.sh` one-liner also works.
 The installer auto-installs Rust if needed, clones the repo to `~/.neurosploit`,
 builds the release binary, and links `neurosploit` into `~/.local/bin`. Re-run it
 any time to update. Tweak with env vars: `NEUROSPLOIT_REF` (branch/tag),
 `NEUROSPLOIT_DIR`, `PREFIX`.
 Prefer to build by hand?
 ```bash
 git clone https://github.com/JoasASantos/NeuroSploit && cd NeuroSploit/neurosploit-rs
 cargo build --release      # → target/release/neurosploit
 ```
 ## ⚡ Quick start (60 seconds)
 ```bash
-# 1. build
+# easiest path — just run it; the interactive session asks everything:
-cd neurosploit-rs && cargo build --release
+neurosploit
-# 2. easiest path — just run it, the wizard asks everything:
+# or one-liner (subscription login, no API key needed):
-./target/release/neurosploit
+neurosploit run http://testphp.vulnweb.com/ --subscription --model anthropic:claude-opus-4-8 -v
-# 3. or one-liner (subscription login, no API key needed):
+# white-box — review a source repository (SAST agents, file:line evidence):
-./target/release/neurosploit run http://testphp.vulnweb.com/ --subscription --model anthropic:claude-opus-4-8 -v
+git clone https://github.com/digininja/DVWA /tmp/DVWA
 neurosploit whitebox /tmp/DVWA --subscription --model anthropic:claude-opus-4-8 -v
 # grey-box — review the code AND exploit the running app together:
 neurosploit greybox /tmp/DVWA --url http://localhost:8080/ --creds creds.yaml \
  --subscription --model anthropic:claude-opus-4-8 --mcp -v
 # host / infra — Linux / Windows / Active Directory (SSH/Win creds in creds.yaml):
 neurosploit host 10.0.0.10 --creds creds.yaml --subscription --model anthropic:claude-opus-4-8 -v
 # 🛰  Mission Control TUI — live panels (header/feed/findings/targets) + a composer
 #    you can type in WHILE the run streams (summary · pause · errors · notes):
 neurosploit tui http://testphp.vulnweb.com/ --subscription --model anthropic:claude-opus-4-8 --mcp
 ```
 > Full step-by-step for every mode (black/white/grey/host) is in **[TUTORIAL.md](TUTORIAL.md)**.
 No login? Use an **API key** instead — see [Authentication](#authentication--run-via-api-key-or-subscription).
 ---
@@ -1,3 +1,90 @@
 # NeuroSploit v3.5.1 — Release Notes
 **Release Date:** June 2026
 **Codename:** Interactive POMDP Harness
 **License:** MIT
 **Credits:** Joas A Santos & Red Team Leaders
 ---
 ## TL;DR
 The 3.5.x line turns the Rust harness into a full **interactive REPL** (Claude
 Code / Codex / Cursor-CLI style) on top of the multi-model engine: pick models
 with arrow-keys, configure API keys per provider, set target/repo/auth/creds and
 free-text instructions that steer the agents, then `/run` engagements **in the
 background** while you keep typing. v3.5.1 adds a **POMDP belief spine** with
 anti-hallucination grounding ("no claim without a tool receipt"), **infra/host**
 testing (IP + SSH + Windows/AD) with Linux/Windows/AD agents, **attack-chain
 agents**, a **Mission-Control TUI**, structured **Typst** reports, and resilient
 run control (live checkpointing, pause-on-quota, instant stop).
 ## Highlights
 - **Interactive REPL** (`neurosploit` with no subcommand): real line editing
  (history ↑/↓, Ctrl-A/E/K, multiline), Tab-completion of `/commands` and
  `@filesystem-paths` (Claude-Code-style file menu), arrow-key model multi-select,
  per-provider API-key config, and a live context bar (`model · cwd · mode▸target`).
 - **Engagement modes**: **black-box** (`run`), **white-box** SAST (`whitebox`,
  set `/repo`), **grey-box** (`greybox`, `/repo` + `/target`), **host/infra**
  (`/target <ip>` + `/creds` for SSH / Windows / AD), plus the **TUI** dashboard.
 - **POMDP belief state** (`belief.rs`, `pomdp.rs`): a property-graph with
  probabilities + Bayesian update + Shannon-entropy uncertainty, a
  value-of-information planner, and a **grounding gate** (`grounding.rs`,
  `may_assert`) — findings must carry an empirical/symbolic **tool receipt**.
 - **Infra / credentials** (`creds.rs`): multi-block YAML (jwt/header/cookie,
  HTTP login, SSH, Windows/AD); real automated login; Linux/Windows/AD agents.
 - **Attack-chain agents**: sqli→rce→lpe, ssrf→aws, upload→lfi→rce, and more —
  injected as chain recipes during exploitation.
 - **App-stack & CVE hunting**: IIS/.NET (tilde shortname, WebDAV, ViewState),
  CMS (WordPress/Joomla/Drupal), app-server consoles, known-CVE exploitation.
 - **13 providers** incl. **LiteLLM** proxy and Gemini/xAI alongside the existing
  OpenAI-compatible set; **subscription mode** drives local agentic CLIs
  (claude/codex/gemini/grok) via stream-json.
 - **Mission-Control TUI** (`ratatui`): concurrent activity/findings/targets panels
  with a non-blocking composer active during the run.
 - **Structured Typst report**: executive summary, vulnerability-summary table,
  and per-finding sections (criticality, CVSS, OWASP/CWE, PoC, evidence,
  remediation) + an attack-graph / kill-chain mapping (OWASP/CWE/MITRE).
 - **Per-project persistence** (`.neurosploit/`, no database): `session.json`,
  `runs.json`, `history.txt` — resumes automatically on reopen.
 ## Run control (new in 3.5.1)
 - **Background `/run`** with a live progress bar, severity-colored findings, and
  the full `file://` report URL on completion/stop.
 - **3-way `/stop`**: **[1]** validate findings so far → report · **[2]** raw
  report **now** without validating · **[3]** discard. Raw/discard abort
  in-flight agents immediately (running CLI children are killed via
  `kill_on_drop`); validate soft-stops so the validator still runs.
 - **Crash/quit recovery**: every finding is checkpointed live to
  `.neurosploit/active_run.json`; an interrupted run is recovered into `/runs`
  on the next launch, so `/results`, `/finding` and `/report` keep working.
 - **Pause-on-exhaustion**: when all models are rate-limited / out of quota the
  run **parks** (state kept) and prints `⏸ token/quota exhausted … PAUSED`.
  Resume with **`/continue`** when your quota renews, or switch with
  **`/model <provider:model>`** (or the `/model` selector) then **`/continue`**.
 - **Inspection**: `/results` (live findings), `/finding` (pick one → full
  command + PoC + evidence), `/expand` / Ctrl-O (full untruncated commands),
  `/status`, `/diff`, `/retest`.
 ## Usage
 ```bash
 cd neurosploit-rs && cargo build --release
 ./target/release/neurosploit                              # interactive REPL
 ./target/release/neurosploit run http://target -v --model anthropic:claude-opus-4-8
 ./target/release/neurosploit whitebox --repo /path/to/code   # white-box SAST
 ./target/release/neurosploit greybox  --repo /path --target http://target  # grey-box
 ./target/release/neurosploit run <ip> --creds creds.yaml     # host / infra
 ./target/release/neurosploit tui http://target --subscription --mcp
 ```
 Cross-platform install (Linux / macOS / Windows, x64 + arm64) via `setup.sh` and
 `install.ps1`. See **README.md** and **TUTORIAL.md** for the full walkthrough.
 ---
 # NeuroSploit v3.4.0 — Release Notes
 **Release Date:** June 2026
@@ -0,0 +1,544 @@
 # NeuroSploit — Tutorial & User Guide (v3.5.1)
 A complete, hands-on guide to installing, configuring and running NeuroSploit —
 the autonomous, multi-model penetration-testing harness.
 > ⚠️ **Authorized testing only.** Every agent is instructed to stay in scope and
 > never run destructive/DoS actions. You are responsible for having written
 > permission for any target you point it at.
 ---
 ## Table of contents
 1. [Concepts in 60 seconds](#1-concepts-in-60-seconds)
 2. [Install](#2-install)
 3. [Authentication: API key vs subscription](#3-authentication-api-key-vs-subscription)
 4. [Choosing models](#4-choosing-models)
 5. [Engagement modes](#5-engagement-modes)
   - [Black-box (URL)](#51-black-box-url)
   - [White-box (source repo)](#52-white-box-source-repo)
   - [Grey-box (code + live app)](#53-grey-box-code--live-app)
   - [Host / Infra (Linux / Windows / AD)](#54-host--infra-linux--windows--ad)
 6. [The interactive REPL](#6-the-interactive-repl)
 7. [Mission Control TUI](#7-mission-control-tui)
 8. [Credentials (`creds.yaml`)](#8-credentials-credsyaml)
 9. [Steering the tests (focus & instructions)](#9-steering-the-tests)
 10. [Outputs, reports & artifacts](#10-outputs-reports--artifacts)
 11. [Per-project memory & resume](#11-per-project-memory--resume)
 12. [How it decides: POMDP, grounding, chaining](#12-how-it-decides)
 13. [The agent library](#13-the-agent-library)
 14. [Playwright MCP & extra tools](#14-playwright-mcp--extra-tools)
 15. [Tips, tuning & troubleshooting](#15-tips-tuning--troubleshooting)
 16. [Command & flag reference](#16-command--flag-reference)
 ---
 ## 1. Concepts in 60 seconds
 You give NeuroSploit a **target** (URL, repo, app, or host/IP). It:
 1. **Recons** the target with real tools (curl/nmap/…).
 2. **Intelligently selects** only the agents whose preconditions match the recon
   (it does *not* blindly run all 329).
 3. **Exploits** in parallel — each agent works in a ReAct loop and must prove its
   claim with a **tool receipt** (raw output).
 4. **Validates** every candidate by **cross-model voting** (a different model
   adjudicates) and a **grounding gate** (no claim without a receipt).
 5. **Chains** confirmed findings into deeper impact (SQLi→RCE→LPE, SSRF→cloud…).
 6. **Reports** — HTML + Typst PDF + JSON/MD, with an attack-graph / kill-chain
   mapped to OWASP / CWE / MITRE ATT&CK.
 It runs on a **pool of LLMs** you choose, authenticated either by **API key** or
 your local **subscription** (Claude Code / Codex / Gemini / Grok CLI).
 ---
 ## 2. Install
 ### One-liner
 **Linux / macOS** (x64 & arm64):
 ```bash
 curl -fsSL https://raw.githubusercontent.com/JoasASantos/NeuroSploit/main/setup.sh | bash
 ```
 **Windows** (PowerShell, x64 & arm64):
 ```powershell
 irm https://raw.githubusercontent.com/JoasASantos/NeuroSploit/main/install.ps1 | iex
 ```
 The installer detects your OS/arch, installs the Rust toolchain if needed, clones
 the repo, builds the release binary and puts `neurosploit` on your PATH. Re-run it
 any time to update. Env knobs: `NEUROSPLOIT_REF` (branch/tag), `NEUROSPLOIT_DIR`,
 `PREFIX`.
 ### Manual build
 ```bash
 git clone https://github.com/JoasASantos/NeuroSploit
 cd NeuroSploit/neurosploit-rs
 cargo build --release        # → target/release/neurosploit
 ```
 ### Recommended runtime
 Run inside **Kali Linux** (or the Docker image) so the offensive tools the agents
 use are already present:
 ```bash
 docker run -it --rm kalilinux/kali-rolling
 apt update && apt install -y curl nmap ffuf nodejs npm
 # optional: cargo install rustscan ; cargo install typst-cli
 ```
 Agents **degrade gracefully**: if `rustscan` is absent they use `nmap`; if neither,
 `curl`. With Playwright MCP present they drive a real browser; otherwise `curl`.
 ### Verify
 ```bash
 neurosploit --version          # neurosploit 3.5.1
 neurosploit agents             # {"vulns":196,...,"chains":12,"total":329}
 neurosploit models             # all providers & models
 ```
 ---
 ## 3. Authentication: API key vs subscription
 You pick **per run**. They're independent.
 ### A) Via API key
 Export the key for each provider you'll use, then run **without** `--subscription`:
 ```bash
 export ANTHROPIC_API_KEY=sk-ant-...      # anthropic:claude-*
 export OPENAI_API_KEY=sk-...             # openai:gpt-*
 export GEMINI_API_KEY=AIza...            # gemini:gemini-*
 export XAI_API_KEY=xai-...               # xai:grok-*
 export NVIDIA_NIM_API_KEY=nvapi-...      # nvidia_nim:*
 export DEEPSEEK_API_KEY=...              # deepseek:*
 export MISTRAL_API_KEY=...               # mistral:*
 export DASHSCOPE_API_KEY=...             # qwen:*  (Alibaba DashScope)
 export GROQ_API_KEY=...                  # groq:*
 export TOGETHER_API_KEY=...              # together:*
 export OPENROUTER_API_KEY=...            # openrouter:*
 # ollama: no key (local)
 # LiteLLM proxy: point at your gateway and route any model through it:
 export LITELLM_BASE_URL=http://localhost:4000/v1   # your LiteLLM proxy
 export LITELLM_API_KEY=sk-...                       # litellm:<model the proxy routes>
 neurosploit run http://testphp.vulnweb.com/ --model anthropic:claude-opus-4-8 --vote-n 3 -v
 ```
 Or put them in a `.env` and source it (`cp .env.example .env`; edit; `set -a; . ./.env; set +a`).
 In the REPL you can also run `/key anthropic sk-ant-...` (it lists which providers
 your selected models need).
 ### B) Via subscription (no API key)
 Install and log into a local agentic CLI, then pass `--subscription`:
 | `--model` prefix | CLI | Login |
 |------------------|-----|-------|
 | `anthropic:` | Claude Code (`claude`) | `claude` → `/login` |
 | `openai:` | Codex (`codex`) | codex login |
 | `gemini:` | Gemini (`gemini`) | gemini login |
 | `xai:` | Grok (`grok`) | grok login |
 ```bash
 neurosploit run http://testphp.vulnweb.com/ --subscription --model anthropic:claude-opus-4-8 --mcp -v
 ```
 ---
 ## 4. Choosing models
 `--model provider:model` is **repeatable**. The **first** model is the primary
 (does recon & exploitation); the **rest fail over** if it errors **and** form the
 **validator voting jury** (a different model adjudicates each finding → fewer false
 positives).
 ```bash
 # single model
 --model anthropic:claude-opus-4-8
 # voting panel (Opus finds, GPT-5.5 + Gemini-3 adjudicate)
 --model anthropic:claude-opus-4-8 --model openai:gpt-5.5 --model gemini:gemini-3-pro
 ```
 A built-in **router** sends fast/cheap models to recon & triage and the strongest
 to exploitation, to save tokens. See `neurosploit models` for the full list
 (Claude 4.x, GPT-5.x incl. Codex, Gemini 3/2.5, Grok, NVIDIA NIM, DeepSeek,
 Mistral, Qwen, Groq, Together, OpenRouter, Ollama).
 ---
 ## 5. Engagement modes
 ### 5.1 Black-box (URL)
 ```bash
 neurosploit run http://testphp.vulnweb.com/ \
  --subscription --model anthropic:claude-opus-4-8 \
  --focus "injection and broken access control" --mcp -v
 ```
 ### 5.2 White-box (source repo)
 Reviews a **local code repository** with the 78 source-review (SAST) agents:
 SQLi, command injection, SSRF, XSS, path traversal, insecure deserialization,
 hardcoded secrets, weak crypto, auth/IDOR, XXE, SSTI, language-specific sinks
 (PHP/Java/.NET/Go/Node/Python), and more.
 ```bash
 # 1. clone or point at the code you own
 git clone https://github.com/digininja/DVWA /tmp/DVWA
 # 2. review it (subscription or --model with an API key)
 neurosploit whitebox /tmp/DVWA --subscription --model anthropic:claude-opus-4-8 -v
 # focus a specific class, cap agents, raise the voting bar:
 neurosploit whitebox /tmp/DVWA --focus "injection and access control" \
  --max-agents 8 --vote-n 2 --model openai:gpt-5.5
 ```
 **How it works**
 1. **Collects source context** — walks the repo (skips `.git/node_modules/target/
   vendor`), reads supported source files into a bounded review context.
 2. **Selects code agents** for the languages/frameworks it sees.
 3. Each agent traces **source → sink** dataflow and must quote the **exact
   vulnerable lines as `file:line`**.
 4. **Grounding is symbolic**: a finding is only kept if its `file:line` / quoted
   code actually exists in the reviewed source (no hallucinated locations).
 5. **Validated** by cross-model voting, then reported with the code reference,
   CWE/OWASP, PoC and remediation.
 **Tips**
 - No `--mcp` is used in white-box (there's no live app to browse).
 - For huge repos, narrow with `--focus` or point at a subdirectory.
 - Each finding's `endpoint` field is the `file:line`; `evidence` quotes the code;
  `payload` is the PoC / vulnerable snippet — view it all with `/finding`.
 ### 5.3 Grey-box (code + live app)
 The strongest mode: review the **source** *and* exploit the **running app**
 together. Code-review findings become **leads** that the live agents confirm
 against the deployed application (so a SQLi spotted in code is proven exploitable
 on the running endpoint).
 ```bash
 # code repo + the URL where that code is actually running
 neurosploit greybox /tmp/DVWA --url http://localhost:8080/ \
  --creds creds.yaml --focus "auth and IDOR" \
  --subscription --model anthropic:claude-opus-4-8 --mcp -v
 ```
 **How it works**
 1. **Recon** the live app (`--url`).
 2. **Review the source** with the code agents → produces a list of *leads*
   (suspected vulns with file:line).
 3. **Live exploitation** runs with those leads injected as context, so agents go
   straight for the proven-in-code weaknesses and **prove them on the live app**
   (empirical receipt: real request/response).
 4. Validate (cross-model) → chain → report.
 **Notes**
 - Pass `--creds creds.yaml` so agents test **authenticated** flows (login / JWT /
  cookie) — essential for IDOR/BOLA/auth findings.
 - `--mcp` enables the Playwright browser for client-side proof (e.g. XSS firing).
 - In the REPL: set **both** `/repo <path>` and `/target <url>` → grey-box is
  auto-selected; `/show` displays `mode: greybox (code + live)`.
 ### 5.4 Host / Infra (Linux / Windows / AD)
 Target an IP/host with SSH or Windows/AD credentials from `creds.yaml`:
 ```bash
 neurosploit host 10.0.0.10 --creds creds.yaml \
  --focus "privilege escalation and AD" --subscription --model anthropic:claude-opus-4-8 -v
 ```
 Runs infra agents: port/service scan, SMB enum, Linux privesc/sudo/cron/SSH,
 Windows privesc/SMB-signing/WinRM, and AD kerberoasting / AS-REP / ACL abuse /
 DCSync / default-creds.
 ---
 ## 6. The interactive REPL
 Run with **no arguments** for a persistent session:
 ```bash
 neurosploit
 ```
 A context bar shows `model auth · cwd · mode▸target`. Key commands:
 ```
 /model [a:b,..]     set models (no arg → arrow-key multi-select)
 /key [prov key]     configure API keys for your models (no arg → guided)
 /sub on|off         use subscription login instead of API key
 /target <url>       black-box target           /repo <path>   add a repo (repo+target = greybox)
 /auth <value>       send an auth header         /creds <file>  load creds.yaml
 /focus <text>       steer the tests (or just type the instruction)
@path  @dir  @f:1-20   attach a file/folder/line-range to context (Tab → menu)
 /mcp on|off   /offline on|off   /votes <n>   /agents <n>   /theme color|mono
 /run                launch the engagement
 /runs   /results [n]   /report [n]   /status [n]
 /diff               what changed vs the previous run
 /retest [n]         re-verify a past run's findings
 /quit
 ```
 Line editing: **↑/↓** history, **Tab** completes commands & `@paths`, **Ctrl-A/E/K**,
 end a line with **`\`** for multiline.
 ### Runs are non-blocking
 `/run` launches the engagement **in the background** and immediately returns the
 prompt — you keep typing while it streams live above the prompt. While it runs:
 - **`/status`** — live phase, a **progress bar** (agents done / total), elapsed
  time, token/cost and the possible findings so far.
 - **`/stop`** — stop with a 3-way choice: **[1]** validate the findings found so
  far, then report · **[2]** raw report **now** without validating · **[3]**
  discard. Choices 2 and 3 abort in-flight agents immediately (running commands
  are killed); choice 1 stops launching new agents but lets validation finish.
 - Findings are color-coded by severity (Critical = red … Info = grey), and a
  confirmed vote shows green ✓.
 - When it finishes you get `◀ run #n done — N validated finding(s) · /results n · /report n`.
 **Findings survive a crash/quit.** Every finding is checkpointed live to
 `.neurosploit/active_run.json`. If the REPL is closed (or crashes) mid-run, the
 next launch recovers them into `/runs` automatically (`↻ recovered interrupted
 run …`), so `/results`, `/finding` and `/report` still work.
 **If your tokens/quota run out, the run pauses instead of dying.** When every
 candidate model is rate-limited/out of quota, the run **parks** (keeping all
 state) and prints `⏸ token/quota exhausted … PAUSED`. Then either:
 - wait for your quota to renew and type **`/continue`** to retry the same model, or
 - switch model first — **`/model <provider:model>`** (or `/model` for the
  arrow-select menu) — then **`/continue`** to resume on the new model.
 (When stdin is piped/non-interactive, `/run` falls back to blocking mode.)
 ---
 ## 7. Mission Control TUI
 A live dashboard with concurrent panels and a composer you can type in **while the
 run streams**:
 ```bash
 neurosploit tui http://testphp.vulnweb.com/ --subscription --model anthropic:claude-opus-4-8 --mcp
 # greybox: add --repo /path/to/repo
 ```
 - **Header**: target · mode · model · phase · elapsed · 🪙 tokens/cost · findings · ⏸
 - **Activity feed** (color-coded), **Findings** panel (live), **Targets** map
 - **Composer** (non-blocking): `summary` (partial summary), `pause` (graceful
  stop), `errors` (filter), `clear`, or a free-text note
 - **Esc / Ctrl-C** → graceful stop; the report is generated on exit
 ---
 ## 8. Credentials (`creds.yaml`)
 One file covers web auth, SSH and Windows/AD. See `neurosploit-rs/creds.example.yaml`.
 ```yaml
 # --- web auth (pick one) ---
 jwt: eyJhbGciOi...                 # → Authorization: Bearer <jwt>
 # header: "X-Api-Key: abc123"
 # cookie: "session=deadbeef"
 # --- OR an automated login the harness performs to capture a live session ---
 login:
  url: http://localhost:8080/login
  method: POST
  username_field: username
  password_field: password
  username: admin
  password: password
  success: Logout                  # text shown on a successful login
 # --- Linux host (SSH) ---
 ssh:
  host: 10.0.0.5
  port: 22
  user: ubuntu
  password: s3cret                 # or:
  key: /home/op/id_ed25519
 # --- Windows / Active Directory ---
 windows:
  host: 10.0.0.10
  domain: CORP
  user: jdoe
  password: Winter2026!            # or pass-the-hash:
  hash: aad3b435b51404eeaad3b435b51404ee:NThashhere
 ```
 - `jwt`/`header`/`cookie` are used as-is.
 - A `login:` block is **executed** (real HTTP) to capture a live session
  cookie/token; if it fails, agents are told to authenticate themselves.
 - `ssh:` / `windows:` tell host agents how to authenticate.
 Use with `--creds creds.yaml` on `run` / `greybox` / `host`, or `/creds` in the REPL.
 ---
 ## 9. Steering the tests
 Tell the harness what to prioritise — it biases both agent **selection** and
 **execution**:
 ```bash
 --focus "find injection and broken access control"
 ```
 In the REPL just type the instruction (no slash) or use `/focus`. Attach scope or a
 stack trace with `@file`, `@folder`, or `@file:10-40`.
 ---
 ## 10. Outputs, reports & artifacts
 Every run writes a self-contained folder `runs/ns-<ts>-<target>/`:
 | File | Contents |
 |------|----------|
 | `status.json` | `running` → `complete`/`stopped` with a summary |
 | `recon.json` / `recon.md` | mapped attack surface |
 | `exploitation.md` | raw per-agent transcript (the receipts) |
 | `findings.json` / `findings.md` | validated findings (reuse by other tools/AIs) |
 | `report.html` | HTML report **+ Mermaid attack-graph / kill-chain** |
 | `report.typ` / `report.pdf` | Typst source + compiled PDF (if `typst` installed) |
 The CLI prints a severity summary, an ASCII kill-chain, and the token/cost total.
 ---
 ## 11. Per-project memory & resume
 When you launch the REPL in a project directory, NeuroSploit creates
 `<cwd>/.neurosploit/`:
 ```
 .neurosploit/
  session.json     # your config (models, target, repo, auth, focus)
  runs.json        # run history (for /runs, /results, /report, /diff, /retest)
  active_run.json  # live checkpoint of an in-flight run (auto-recovered if interrupted)
  history.txt      # command history (↑/↓)
 ```
 Close and reopen in the same folder → it **resumes** automatically
 (`↻ resumed project session`). If a run was interrupted mid-flight, its
 checkpointed findings are recovered into `/runs` (`↻ recovered interrupted run`).
 No database needed — it's structured state.
 ---
 ## 12. How it decides
 NeuroSploit treats the target as **partially observable** (a POMDP):
 - **Belief world model** — a property graph whose nodes (host/service/vuln/
  exploit/credential) carry *probabilities*, updated by observations.
 - **Value-of-information** — "scan more vs exploit now" falls out of belief
  entropy: when a node's belief is diffuse, recon is worth more than exploiting.
 - **Anti-hallucination gate** (`may_assert`) — the agent may **not** claim
  exploitability while the belief is diffuse; it must observe more first.
 - **Grounding** — **no claim without a tool receipt**: empirical for black-box
  (real HTTP/OOB/error output), symbolic (`file:line`) for white-box. Ungrounded
  claims are demoted and flagged.
 - **Chaining** — confirmed findings are chained into deeper impact, each stage
  proven before advancing.
 White-box collapses the POMDP toward a near-deterministic MDP (the world model is
 built from SAST/dataflow), so uncertainty becomes *path reachability*, not state.
 ---
 ## 13. The agent library
 `agents_md/` holds **329** markdown agents in categories:
 | Category | Dir | Count | Purpose |
 |----------|-----|-------|---------|
 | Vulnerability specialists | `vulns/` | 196 | exploit a specific class |
 | Recon | `recon/` | 12 | information gathering |
 | Code (SAST) | `code/` | 78 | white-box source review |
 | Infra | `infra/` | 14 | Linux / Windows / AD host testing |
 | Chains | `chains/` | 12 | multi-stage exploitation chains |
 | Meta | `meta/` | 17 | orchestrator, validator, scorers, reporter, RL |
 Each agent is a self-contained playbook (`## User Prompt` methodology + `## System
 Prompt` strict anti-false-positive rules). **Add your own** by dropping a `.md` into
 the matching folder — it's picked up automatically.
 ---
 ## 14. Playwright MCP & extra tools
 `--mcp` (subscription path) drives a real **Playwright** browser for JS-heavy pages
 and to *prove* client-side issues (XSS firing, DOM, screenshots). It's
 auto-provisioned via `npx` when available; backends that don't support MCP fall
 back to `curl`. You can add more MCP servers by placing a `mcp.servers.json`
 (`{ "mcpServers": { ... } }`) in the project root — they're merged into the run.
 ---
 ## 15. Tips, tuning & troubleshooting
 - **No findings on a live target?** It may be unreachable from your network, or the
  app is genuinely static — the harness refuses to fabricate. Check `recon.md`.
 - **Quick smoke test:** `neurosploit run http://x --offline` exercises the pipeline
  without calling any model.
 - **Cost control:** start with `--max-agents 4 --vote-n 1`; scale up later. The
  router already routes cheap models to recon.
 - **Rate limits (subscription):** the harness retries with backoff and caps
  parallel CLI processes; if you hit your 5-hour quota, add more models to the
  panel or switch to an API key.
 - **Run as root:** the harness sets `IS_SANDBOX=1` so Claude Code's autonomy works.
 - **Stuck?** Ctrl-C once for a graceful stop (→ keep/discard report); twice aborts.
 ---
 ## 16. Command & flag reference
 ```
 neurosploit                       # interactive REPL (resumes per project)
 neurosploit run <url>             # black-box
 neurosploit whitebox <repo>       # white-box source review
 neurosploit greybox <repo> --url <app>   # code + live
 neurosploit host <ip>             # Linux/Windows/AD (with --creds)
 neurosploit tui <url>             # Mission Control TUI (--repo for greybox)
 neurosploit agents                # library counts
 neurosploit models                # providers & models
 neurosploit --help                # full help
 ```
 Common flags (run / greybox / host / tui):
 ```
 --model provider:model   repeatable; 1st = primary, rest = failover + voting jury
 --subscription           use local CLI login instead of an API key
 --mcp                    enable Playwright MCP browser (subscription path)
 --creds <file.yaml>      jwt/header/cookie/login + ssh/windows credentials
 --focus "<text>"         steer agent selection & execution
 --vote-n <n>             validator votes per finding (default 3)
 --max-agents <n>         cap agents (0 = all matching)
 --offline                pipeline self-test, no model calls
 -v, --verbose            log each agent, recon, votes
 ```
 ---
 *NeuroSploit — by Joas A Santos & Red Team Leaders. MIT licensed. Authorized testing only.*
@@ -0,0 +1,42 @@
 # Default Creds → Foothold → Domain Compromise Chain Agent
 ## User Prompt
 You are executing a multi-stage ATTACK CHAIN against **{target}**: default/weak creds → host foothold → AD escalation → domain dominance.
 **Recon Context / prior findings:**
 {recon_json}
 **GOAL:** Chain an exposed credential into Active Directory domain compromise.
 **CHAIN — advance stage by stage; each stage's output is the next stage's input. Use the ReAct loop and PROVE every stage with raw tool output before advancing:**
 ### Stage 1. Get the foothold
 - Authenticate with the default/weak/reused credential (SSH/WinRM/SMB/web)
 ### Stage 2. Enumerate AD
 - From the foothold, run BloodHound/netexec; map attack paths, roastable accounts, ACLs
 ### Stage 3. Escalate in AD
 - Kerberoast/AS-REP-roast, abuse an ACL edge, or relay — recover higher-priv creds
 ### Stage 4. Reach domain dominance
 - Demonstrate DCSync or DA-equivalent access (single test account) proving the path
 ### 5. Report Format
 Report the chain as ONE finding (plus per-stage evidence):
 ```
 FINDING:
 - Title: Default Creds → Foothold → Domain Compromise Chain
 - Severity: Critical
 - CWE: CWE-798
 - Endpoint: [entry point]
 - Vector: [the full chain, stage by stage]
 - Payload: [the key payloads/commands per stage]
 - Evidence: [raw output proving EACH stage actually executed]
 - Impact: Domain compromise from a single weak/default credential
 - Remediation: Rotate defaults; unique strong passwords; tiered admin; monitor
 - chains_from: [ids of the prerequisite findings this builds on]
 ```
 ## System Prompt
 You are an exploit-chaining specialist. Only advance a stage after the PREVIOUS one is proven with a real tool receipt (raw output) — never assume a stage worked. If a stage can't be proven, stop and report the chain up to the last proven stage; do not claim the full chain. AUTHORIZED engagement; no destructive/DoS actions. Each reported stage must carry its own evidence. Credits: Joas A Santos & Red Team Leaders.
@@ -0,0 +1,42 @@
 # Insecure Deserialization → RCE Chain Agent
 ## User Prompt
 You are executing a multi-stage ATTACK CHAIN against **{target}**: untrusted deserialization → gadget chain → remote code execution.
 **Recon Context / prior findings:**
 {recon_json}
 **GOAL:** Turn a deserialization sink into reliable code execution.
 **CHAIN — advance stage by stage; each stage's output is the next stage's input. Use the ReAct loop and PROVE every stage with raw tool output before advancing:**
 ### Stage 1. Locate the sink
 - Identify where attacker data is deserialized (cookie/param/file/RPC); fingerprint the format/library
 ### Stage 2. Build the gadget
 - Select a working gadget chain (ysoserial/ysoserial.net/PyYAML/pickle) for the target stack
 ### Stage 3. Execute
 - Deliver the payload to the sink
 ### Stage 4. Confirm
 - Prove execution via OOB callback or command output with a unique marker
 ### 5. Report Format
 Report the chain as ONE finding (plus per-stage evidence):
 ```
 FINDING:
 - Title: Insecure Deserialization → RCE Chain
 - Severity: Critical
 - CWE: CWE-502
 - Endpoint: [entry point]
 - Vector: [the full chain, stage by stage]
 - Payload: [the key payloads/commands per stage]
 - Evidence: [raw output proving EACH stage actually executed]
 - Impact: Remote code execution via unsafe object deserialization
 - Remediation: Never deserialize untrusted data; allowlist types; safe formats
 - chains_from: [ids of the prerequisite findings this builds on]
 ```
 ## System Prompt
 You are an exploit-chaining specialist. Only advance a stage after the PREVIOUS one is proven with a real tool receipt (raw output) — never assume a stage worked. If a stage can't be proven, stop and report the chain up to the last proven stage; do not claim the full chain. AUTHORIZED engagement; no destructive/DoS actions. Each reported stage must carry its own evidence. Credits: Joas A Santos & Red Team Leaders.
@@ -0,0 +1,42 @@
 # Exposed .git/.env → Secret → RCE Chain Agent
 ## User Prompt
 You are executing a multi-stage ATTACK CHAIN against **{target}**: exposed source/secrets → recovered credentials → authenticated RCE.
 **Recon Context / prior findings:**
 {recon_json}
 **GOAL:** Chain leaked source/secrets into authenticated code execution.
 **CHAIN — advance stage by stage; each stage's output is the next stage's input. Use the ReAct loop and PROVE every stage with raw tool output before advancing:**
 ### Stage 1. Recover the source/secrets
 - Dump exposed `.git` (git-dumper) or read `.env`/config; extract keys/creds/tokens
 ### Stage 2. Validate the secrets
 - Confirm a recovered credential/key is live (admin panel, cloud, DB, CI)
 ### Stage 3. Gain execution
 - Use the access to deploy code / run a CI job / write a webshell / exec via admin feature
 ### Stage 4. Confirm RCE
 - Prove command execution with output
 ### 5. Report Format
 Report the chain as ONE finding (plus per-stage evidence):
 ```
 FINDING:
 - Title: Exposed .git/.env → Secret → RCE Chain
 - Severity: High
 - CWE: CWE-527
 - Endpoint: [entry point]
 - Vector: [the full chain, stage by stage]
 - Payload: [the key payloads/commands per stage]
 - Evidence: [raw output proving EACH stage actually executed]
 - Impact: Code execution using credentials recovered from exposed source/secrets
 - Remediation: Block dotfiles from web; rotate leaked secrets; vault storage
 - chains_from: [ids of the prerequisite findings this builds on]
 ```
 ## System Prompt
 You are an exploit-chaining specialist. Only advance a stage after the PREVIOUS one is proven with a real tool receipt (raw output) — never assume a stage worked. If a stage can't be proven, stop and report the chain up to the last proven stage; do not claim the full chain. AUTHORIZED engagement; no destructive/DoS actions. Each reported stage must carry its own evidence. Credits: Joas A Santos & Red Team Leaders.
@@ -0,0 +1,42 @@
 # IDOR → Mass Account Takeover Chain Agent
 ## User Prompt
 You are executing a multi-stage ATTACK CHAIN against **{target}**: IDOR → cross-account data → credential/role manipulation → takeover.
 **Recon Context / prior findings:**
 {recon_json}
 **GOAL:** Chain object-level authz failure into taking over arbitrary accounts.
 **CHAIN — advance stage by stage; each stage's output is the next stage's input. Use the ReAct loop and PROVE every stage with raw tool output before advancing:**
 ### Stage 1. Confirm the IDOR
 - Access another user's object with your session, proven by their data
 ### Stage 2. Find a state-changing IDOR
 - Locate IDOR on email/password/role/API-key endpoints
 ### Stage 3. Manipulate the victim account
 - Change a victim's email or reset token / elevate role via the IDOR
 ### Stage 4. Confirm takeover
 - Log in as / act as the victim; demonstrate control
 ### 5. Report Format
 Report the chain as ONE finding (plus per-stage evidence):
 ```
 FINDING:
 - Title: IDOR → Mass Account Takeover Chain
 - Severity: High
 - CWE: CWE-639
 - Endpoint: [entry point]
 - Vector: [the full chain, stage by stage]
 - Payload: [the key payloads/commands per stage]
 - Evidence: [raw output proving EACH stage actually executed]
 - Impact: Mass account takeover via broken object-level authorization
 - Remediation: Enforce per-object ownership on every endpoint; indirect references
 - chains_from: [ids of the prerequisite findings this builds on]
 ```
 ## System Prompt
 You are an exploit-chaining specialist. Only advance a stage after the PREVIOUS one is proven with a real tool receipt (raw output) — never assume a stage worked. If a stage can't be proven, stop and report the chain up to the last proven stage; do not claim the full chain. AUTHORIZED engagement; no destructive/DoS actions. Each reported stage must carry its own evidence. Credits: Joas A Santos & Red Team Leaders.
@@ -0,0 +1,45 @@
 # SQLi → RCE → Local PrivEsc Chain Agent
 ## User Prompt
 You are executing a multi-stage ATTACK CHAIN against **{target}**: SQL injection → command execution → local privilege escalation.
 **Recon Context / prior findings:**
 {recon_json}
 **GOAL:** Turn a database-layer injection into root/SYSTEM on the host.
 **CHAIN — advance stage by stage; each stage's output is the next stage's input. Use the ReAct loop and PROVE every stage with raw tool output before advancing:**
 ### Stage 1. Exploit the SQL injection
 - Confirm injection (error/boolean/time); identify DBMS and privileges
 - Enumerate whether stacked queries / FILE / xp_cmdshell / INTO OUTFILE are available
 ### Stage 2. Pivot SQLi → RCE
 - MSSQL: enable & use `xp_cmdshell`; MySQL: `INTO OUTFILE` a webshell to a known web path; PostgreSQL: `COPY ... PROGRAM`
 - Confirm OS command execution with `id`/`whoami` output
 ### Stage 3. Establish a foothold
 - Drop/upgrade to a stable shell as the web/db service user
 ### Stage 4. Local privilege escalation
 - Enumerate SUID/sudo/cron/kernel (Linux) or token/service/unquoted-path (Windows)
 - Escalate to root/SYSTEM and prove with a privileged command output
 ### 5. Report Format
 Report the chain as ONE finding (plus per-stage evidence):
 ```
 FINDING:
 - Title: SQLi → RCE → Local PrivEsc Chain
 - Severity: Critical
 - CWE: CWE-89
 - Endpoint: [entry point]
 - Vector: [the full chain, stage by stage]
 - Payload: [the key payloads/commands per stage]
 - Evidence: [raw output proving EACH stage actually executed]
 - Impact: Full host compromise originating from a web injection
 - Remediation: Parameterize queries; least-privilege DB account; harden host; patch local vectors
 - chains_from: [ids of the prerequisite findings this builds on]
 ```
 ## System Prompt
 You are an exploit-chaining specialist. Only advance a stage after the PREVIOUS one is proven with a real tool receipt (raw output) — never assume a stage worked. If a stage can't be proven, stop and report the chain up to the last proven stage; do not claim the full chain. AUTHORIZED engagement; no destructive/DoS actions. Each reported stage must carry its own evidence. Credits: Joas A Santos & Red Team Leaders.
@@ -0,0 +1,45 @@
 # SSRF → AWS Credential Compromise Chain Agent
 ## User Prompt
 You are executing a multi-stage ATTACK CHAIN against **{target}**: SSRF → cloud metadata → IAM credentials → cloud account access.
 **Recon Context / prior findings:**
 {recon_json}
 **GOAL:** Convert a server-side request forgery into valid AWS credentials and account access.
 **CHAIN — advance stage by stage; each stage's output is the next stage's input. Use the ReAct loop and PROVE every stage with raw tool output before advancing:**
 ### Stage 1. Confirm the SSRF primitive
 - Find a server-side fetch you control (url/webhook/import/pdf/image param)
 - Prove it reaches an attacker-controlled / internal host
 ### Stage 2. Reach the metadata service
 - IMDSv2: PUT `/latest/api/token` then GET with the token header; else IMDSv1 GET
 - Retrieve `/latest/meta-data/iam/security-credentials/<role>`
 ### Stage 3. Harvest IAM credentials
 - Capture AccessKeyId/SecretAccessKey/Token from the metadata response
 ### Stage 4. Use the credentials (in scope)
 - `aws sts get-caller-identity` to confirm; enumerate permitted actions read-only
 - Prove access to at least one resource the role can reach
 ### 5. Report Format
 Report the chain as ONE finding (plus per-stage evidence):
 ```
 FINDING:
 - Title: SSRF → AWS Credential Compromise Chain
 - Severity: Critical
 - CWE: CWE-918
 - Endpoint: [entry point]
 - Vector: [the full chain, stage by stage]
 - Payload: [the key payloads/commands per stage]
 - Evidence: [raw output proving EACH stage actually executed]
 - Impact: Cloud account compromise via stolen IAM role credentials
 - Remediation: Enforce IMDSv2 hop-limit=1; egress allowlists; SSRF input validation; scoped IAM roles
 - chains_from: [ids of the prerequisite findings this builds on]
 ```
 ## System Prompt
 You are an exploit-chaining specialist. Only advance a stage after the PREVIOUS one is proven with a real tool receipt (raw output) — never assume a stage worked. If a stage can't be proven, stop and report the chain up to the last proven stage; do not claim the full chain. AUTHORIZED engagement; no destructive/DoS actions. Each reported stage must carry its own evidence. Credits: Joas A Santos & Red Team Leaders.
@@ -0,0 +1,43 @@
 # SSRF → RCE Chain Agent
 ## User Prompt
 You are executing a multi-stage ATTACK CHAIN against **{target}**: SSRF → internal service abuse → remote code execution.
 **Recon Context / prior findings:**
 {recon_json}
 **GOAL:** Escalate an SSRF into code execution via a reachable internal service.
 **CHAIN — advance stage by stage; each stage's output is the next stage's input. Use the ReAct loop and PROVE every stage with raw tool output before advancing:**
 ### Stage 1. Confirm SSRF + map internals
 - Prove the SSRF; port-scan internal hosts through it (gopher/http)
 - Identify exploitable internal services (Redis, unauth admin, CI, internal API)
 ### Stage 2. Weaponize the internal service
 - e.g. Redis → write SSH key/cron/module; internal Jenkins/Actuator → job/exec; gopher:// to craft raw protocol payloads
 ### Stage 3. Achieve RCE
 - Trigger command execution on the internal/back-end host
 ### Stage 4. Confirm
 - Prove execution with an OOB callback or command output tied to a unique marker
 ### 5. Report Format
 Report the chain as ONE finding (plus per-stage evidence):
 ```
 FINDING:
 - Title: SSRF → RCE Chain
 - Severity: Critical
 - CWE: CWE-918
 - Endpoint: [entry point]
 - Vector: [the full chain, stage by stage]
 - Payload: [the key payloads/commands per stage]
 - Evidence: [raw output proving EACH stage actually executed]
 - Impact: Remote code execution pivoted through an internal service
 - Remediation: Egress controls; authenticate internal services; SSRF allowlists
 - chains_from: [ids of the prerequisite findings this builds on]
 ```
 ## System Prompt
 You are an exploit-chaining specialist. Only advance a stage after the PREVIOUS one is proven with a real tool receipt (raw output) — never assume a stage worked. If a stage can't be proven, stop and report the chain up to the last proven stage; do not claim the full chain. AUTHORIZED engagement; no destructive/DoS actions. Each reported stage must carry its own evidence. Credits: Joas A Santos & Red Team Leaders.
@@ -0,0 +1,42 @@
 # SSTI → RCE → Cloud Pivot Chain Agent
 ## User Prompt
 You are executing a multi-stage ATTACK CHAIN against **{target}**: template injection → RCE → host creds → cloud/lateral movement.
 **Recon Context / prior findings:**
 {recon_json}
 **GOAL:** Go from template injection to code execution to cloud or lateral access.
 **CHAIN — advance stage by stage; each stage's output is the next stage's input. Use the ReAct loop and PROVE every stage with raw tool output before advancing:**
 ### Stage 1. Confirm SSTI → RCE
 - Fingerprint the engine (`{{7*7}}` etc.); use the gadget to execute a command; prove with output
 ### Stage 2. Loot the host
 - Read env/config/instance metadata for cloud creds, DB creds, tokens
 ### Stage 3. Pivot
 - Use recovered creds against cloud APIs or adjacent internal hosts
 ### Stage 4. Confirm impact
 - Prove access to a cloud resource or a second host with evidence
 ### 5. Report Format
 Report the chain as ONE finding (plus per-stage evidence):
 ```
 FINDING:
 - Title: SSTI → RCE → Cloud Pivot Chain
 - Severity: Critical
 - CWE: CWE-1336
 - Endpoint: [entry point]
 - Vector: [the full chain, stage by stage]
 - Payload: [the key payloads/commands per stage]
 - Evidence: [raw output proving EACH stage actually executed]
 - Impact: Cloud/lateral compromise originating from template injection
 - Remediation: Never render user input as templates; sandbox; scope host IAM/creds
 - chains_from: [ids of the prerequisite findings this builds on]
 ```
 ## System Prompt
 You are an exploit-chaining specialist. Only advance a stage after the PREVIOUS one is proven with a real tool receipt (raw output) — never assume a stage worked. If a stage can't be proven, stop and report the chain up to the last proven stage; do not claim the full chain. AUTHORIZED engagement; no destructive/DoS actions. Each reported stage must carry its own evidence. Credits: Joas A Santos & Red Team Leaders.
@@ -0,0 +1,42 @@
 # Subdomain Takeover → Trusted Phishing/Cookie Chain Agent
 ## User Prompt
 You are executing a multi-stage ATTACK CHAIN against **{target}**: dangling DNS → subdomain takeover → trusted-origin abuse.
 **Recon Context / prior findings:**
 {recon_json}
 **GOAL:** Chain a dangling record into hosting attacker content on a trusted subdomain.
 **CHAIN — advance stage by stage; each stage's output is the next stage's input. Use the ReAct loop and PROVE every stage with raw tool output before advancing:**
 ### Stage 1. Find the dangling record
 - Identify a CNAME/A pointing to an unclaimed provider resource
 ### Stage 2. Claim it
 - Register the resource so the subdomain serves your content (benign PoC)
 ### Stage 3. Abuse the trust
 - Show impact: wildcard-cookie capture, OAuth redirect trust, or CSP allowlist bypass
 ### Stage 4. Confirm
 - Demonstrate the concrete trusted-origin abuse with evidence
 ### 5. Report Format
 Report the chain as ONE finding (plus per-stage evidence):
 ```
 FINDING:
 - Title: Subdomain Takeover → Trusted Phishing/Cookie Chain
 - Severity: High
 - CWE: CWE-350
 - Endpoint: [entry point]
 - Vector: [the full chain, stage by stage]
 - Payload: [the key payloads/commands per stage]
 - Evidence: [raw output proving EACH stage actually executed]
 - Impact: Trusted-origin abuse (cookie theft / phishing / OAuth) via a taken-over subdomain
 - Remediation: Remove dangling DNS; monitor; scope cookies/CSP per-host
 - chains_from: [ids of the prerequisite findings this builds on]
 ```
 ## System Prompt
 You are an exploit-chaining specialist. Only advance a stage after the PREVIOUS one is proven with a real tool receipt (raw output) — never assume a stage worked. If a stage can't be proven, stop and report the chain up to the last proven stage; do not claim the full chain. AUTHORIZED engagement; no destructive/DoS actions. Each reported stage must carry its own evidence. Credits: Joas A Santos & Red Team Leaders.
@@ -0,0 +1,42 @@
 # Upload → LFI → RCE → LPE Chain Agent
 ## User Prompt
 You are executing a multi-stage ATTACK CHAIN against **{target}**: file upload + local file inclusion → log/session poisoning → RCE → privilege escalation.
 **Recon Context / prior findings:**
 {recon_json}
 **GOAL:** Chain a benign upload and an LFI into code execution and then root.
 **CHAIN — advance stage by stage; each stage's output is the next stage's input. Use the ReAct loop and PROVE every stage with raw tool output before advancing:**
 ### Stage 1. Confirm the LFI
 - Prove local file inclusion (read /etc/passwd or app config); identify wrappers (php://, data://, zip://)
 ### Stage 2. Plant controllable content via upload
 - Upload a file whose path/content you can later include (image with PHP, zip for zip:// , or use the LFI to read your uploaded file)
 ### Stage 3. LFI → RCE
 - Include the planted file, or poison logs/session/`/proc/self/environ` then include it to execute code
 ### Stage 4. Confirm RCE then escalate
 - Prove command execution; then enumerate and perform local privilege escalation to root/SYSTEM
 ### 5. Report Format
 Report the chain as ONE finding (plus per-stage evidence):
 ```
 FINDING:
 - Title: Upload → LFI → RCE → LPE Chain
 - Severity: Critical
 - CWE: CWE-98
 - Endpoint: [entry point]
 - Vector: [the full chain, stage by stage]
 - Payload: [the key payloads/commands per stage]
 - Evidence: [raw output proving EACH stage actually executed]
 - Impact: Host compromise from a non-executable upload chained through LFI
 - Remediation: Fix LFI (allowlist includes); validate uploads; harden host
 - chains_from: [ids of the prerequisite findings this builds on]
 ```
 ## System Prompt
 You are an exploit-chaining specialist. Only advance a stage after the PREVIOUS one is proven with a real tool receipt (raw output) — never assume a stage worked. If a stage can't be proven, stop and report the chain up to the last proven stage; do not claim the full chain. AUTHORIZED engagement; no destructive/DoS actions. Each reported stage must carry its own evidence. Credits: Joas A Santos & Red Team Leaders.
@@ -0,0 +1,43 @@
 # File Upload → RCE Chain Agent
 ## User Prompt
 You are executing a multi-stage ATTACK CHAIN against **{target}**: insecure file upload → webshell → remote code execution.
 **Recon Context / prior findings:**
 {recon_json}
 **GOAL:** Turn an unrestricted/insecure upload into code execution.
 **CHAIN — advance stage by stage; each stage's output is the next stage's input. Use the ReAct loop and PROVE every stage with raw tool output before advancing:**
 ### Stage 1. Probe the upload
 - Map accepted types/extensions, storage path, and how files are served
 - Test bypasses: double extension, content-type spoof, magic-byte prefix, null byte, .htaccess/.phar
 ### Stage 2. Upload a payload
 - Place a minimal webshell/handler in a web-served, executable location
 ### Stage 3. Locate & trigger
 - Find the served URL of the upload; request it to execute
 ### Stage 4. Confirm RCE
 - Run `id`/`whoami`; capture output proving execution
 ### 5. Report Format
 Report the chain as ONE finding (plus per-stage evidence):
 ```
 FINDING:
 - Title: File Upload → RCE Chain
 - Severity: Critical
 - CWE: CWE-434
 - Endpoint: [entry point]
 - Vector: [the full chain, stage by stage]
 - Payload: [the key payloads/commands per stage]
 - Evidence: [raw output proving EACH stage actually executed]
 - Impact: Remote code execution via uploaded executable content
 - Remediation: Validate type by content; randomize names; store outside webroot; non-exec storage
 - chains_from: [ids of the prerequisite findings this builds on]
 ```
 ## System Prompt
 You are an exploit-chaining specialist. Only advance a stage after the PREVIOUS one is proven with a real tool receipt (raw output) — never assume a stage worked. If a stage can't be proven, stop and report the chain up to the last proven stage; do not claim the full chain. AUTHORIZED engagement; no destructive/DoS actions. Each reported stage must carry its own evidence. Credits: Joas A Santos & Red Team Leaders.
@@ -0,0 +1,42 @@
 # XSS → Session/Account Takeover Chain Agent
 ## User Prompt
 You are executing a multi-stage ATTACK CHAIN against **{target}**: stored/reflected XSS → session or token theft → account takeover.
 **Recon Context / prior findings:**
 {recon_json}
 **GOAL:** Escalate XSS into full takeover of a victim (incl. admin) account.
 **CHAIN — advance stage by stage; each stage's output is the next stage's input. Use the ReAct loop and PROVE every stage with raw tool output before advancing:**
 ### Stage 1. Prove execution
 - Confirm the payload executes in the victim's browser context (Playwright: alert/DOM), not just reflects
 ### Stage 2. Steal the session
 - Exfiltrate the session cookie/JWT/CSRF token to a collaborator, or perform actions in-context if HttpOnly
 ### Stage 3. Take over the account
 - Replay the stolen session, or change email/password/MFA via in-context requests
 ### Stage 4. Confirm + escalate
 - Prove control of the victim account; target an admin for privilege escalation
 ### 5. Report Format
 Report the chain as ONE finding (plus per-stage evidence):
 ```
 FINDING:
 - Title: XSS → Session/Account Takeover Chain
 - Severity: High
 - CWE: CWE-79
 - Endpoint: [entry point]
 - Vector: [the full chain, stage by stage]
 - Payload: [the key payloads/commands per stage]
 - Evidence: [raw output proving EACH stage actually executed]
 - Impact: Account takeover (incl. privileged) via client-side execution
 - Remediation: Output encoding + CSP; HttpOnly/SameSite cookies; rotate tokens
 - chains_from: [ids of the prerequisite findings this builds on]
 ```
 ## System Prompt
 You are an exploit-chaining specialist. Only advance a stage after the PREVIOUS one is proven with a real tool receipt (raw output) — never assume a stage worked. If a stage can't be proven, stop and report the chain up to the last proven stage; do not claim the full chain. AUTHORIZED engagement; no destructive/DoS actions. Each reported stage must carry its own evidence. Credits: Joas A Santos & Red Team Leaders.
@@ -0,0 +1,35 @@
 # AD ACL / DACL Abuse Agent
 ## User Prompt
 You are testing **{target}** (a host/infrastructure target) for dangerous Active Directory ACLs.
 **Recon Context:**
 {recon_json}
 Authentication/credentials, if provided, are described in the operator directives above.
 **METHODOLOGY:**
 ### 1. Map
 - Collect with bloodhound-python/SharpHound; find GenericAll/WriteDACL/ForceChangePassword edges
 ### 2. Confirm
 - Demonstrate one safe, reversible control step (e.g. shadow-cred / targeted password reset in a lab) proving the path
 ### 3. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: AD ACL / DACL Abuse on [host]
 - Severity: High
 - CWE: CWE-269
 - Endpoint: [host/service]
 - Vector: [how]
 - Payload: [command/PoC]
 - Evidence: [raw tool output proving it]
 - Impact: Domain privilege escalation
 - Remediation: Tighten ACLs; tiered admin model
 ```
 ## System Prompt
 You are an infrastructure pentest specialist for dangerous Active Directory ACLs. AUTHORIZED engagement. Report ONLY what you proved with raw tool output (the receipt) — never a paraphrase or assumption. If you lack access/observation to confirm, say so and gather more first. Stay in scope; never run destructive or DoS actions. Credits: Joas A Santos & Red Team Leaders.
@@ -0,0 +1,35 @@
 # AD AS-REP Roasting Agent
 ## User Prompt
 You are testing **{target}** (a host/infrastructure target) for accounts with Kerberos pre-auth disabled.
 **Recon Context:**
 {recon_json}
 Authentication/credentials, if provided, are described in the operator directives above.
 **METHODOLOGY:**
 ### 1. Enumerate
 - impacket GetNPUsers / `netexec ldap {target} --asreproast out.txt` for DONT_REQ_PREAUTH accounts
 ### 2. Crack & confirm
 - Crack the AS-REP (hashcat -m 18200); confirm a recovered password
 ### 3. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: AD AS-REP Roasting on [host]
 - Severity: High
 - CWE: CWE-522
 - Endpoint: [host/service]
 - Vector: [how]
 - Payload: [command/PoC]
 - Evidence: [raw tool output proving it]
 - Impact: Account compromise
 - Remediation: Require Kerberos pre-auth; strong passwords
 ```
 ## System Prompt
 You are an infrastructure pentest specialist for accounts with Kerberos pre-auth disabled. AUTHORIZED engagement. Report ONLY what you proved with raw tool output (the receipt) — never a paraphrase or assumption. If you lack access/observation to confirm, say so and gather more first. Stay in scope; never run destructive or DoS actions. Credits: Joas A Santos & Red Team Leaders.
@@ -0,0 +1,35 @@
 # AD DCSync Exposure Agent
 ## User Prompt
 You are testing **{target}** (a host/infrastructure target) for replication rights enabling DCSync.
 **Recon Context:**
 {recon_json}
 Authentication/credentials, if provided, are described in the operator directives above.
 **METHODOLOGY:**
 ### 1. Check rights
 - Identify principals with DS-Replication-Get-Changes(-All) via BloodHound/ACL review
 ### 2. Confirm
 - With authorized creds, prove replication right (e.g. impacket secretsdump -just-dc-user for a single test account)
 ### 3. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: AD DCSync Exposure on [host]
 - Severity: Critical
 - CWE: CWE-269
 - Endpoint: [host/service]
 - Vector: [how]
 - Payload: [command/PoC]
 - Evidence: [raw tool output proving it]
 - Impact: Full domain credential compromise
 - Remediation: Remove replication rights from non-DC principals
 ```
 ## System Prompt
 You are an infrastructure pentest specialist for replication rights enabling DCSync. AUTHORIZED engagement. Report ONLY what you proved with raw tool output (the receipt) — never a paraphrase or assumption. If you lack access/observation to confirm, say so and gather more first. Stay in scope; never run destructive or DoS actions. Credits: Joas A Santos & Red Team Leaders.
@@ -0,0 +1,35 @@
 # AD/Host Default & Reused Credentials Agent
 ## User Prompt
 You are testing **{target}** (a host/infrastructure target) for default or reused credentials across the domain.
 **Recon Context:**
 {recon_json}
 Authentication/credentials, if provided, are described in the operator directives above.
 **METHODOLOGY:**
 ### 1. Spray (authorized, throttled)
 - With supplied account list, `netexec smb {target} -u users -p pass --continue-on-success` within ROE
 ### 2. Confirm
 - Show a successful authentication that should not have worked (reused/default cred)
 ### 3. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: AD/Host Default & Reused Credentials on [host]
 - Severity: High
 - CWE: CWE-798
 - Endpoint: [host/service]
 - Vector: [how]
 - Payload: [command/PoC]
 - Evidence: [raw tool output proving it]
 - Impact: Lateral movement, domain access
 - Remediation: Rotate defaults; enforce unique strong passwords; lockout
 ```
 ## System Prompt
 You are an infrastructure pentest specialist for default or reused credentials across the domain. AUTHORIZED engagement. Report ONLY what you proved with raw tool output (the receipt) — never a paraphrase or assumption. If you lack access/observation to confirm, say so and gather more first. Stay in scope; never run destructive or DoS actions. Credits: Joas A Santos & Red Team Leaders.
@@ -0,0 +1,35 @@
 # AD Kerberoasting Agent
 ## User Prompt
 You are testing **{target}** (a host/infrastructure target) for service accounts with crackable SPNs.
 **Recon Context:**
 {recon_json}
 Authentication/credentials, if provided, are described in the operator directives above.
 **METHODOLOGY:**
 ### 1. Request
 - `netexec ldap {target} -u <user> -p <pass> --kerberoasting out.txt` or impacket GetUserSPNs
 ### 2. Crack & confirm
 - Crack the TGS hash offline (hashcat -m 13100); confirm a recovered service-account password
 ### 3. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: AD Kerberoasting on [host]
 - Severity: High
 - CWE: CWE-522
 - Endpoint: [host/service]
 - Vector: [how]
 - Payload: [command/PoC]
 - Evidence: [raw tool output proving it]
 - Impact: Service-account compromise, lateral movement
 - Remediation: Strong/long service-account passwords; gMSA
 ```
 ## System Prompt
 You are an infrastructure pentest specialist for service accounts with crackable SPNs. AUTHORIZED engagement. Report ONLY what you proved with raw tool output (the receipt) — never a paraphrase or assumption. If you lack access/observation to confirm, say so and gather more first. Stay in scope; never run destructive or DoS actions. Credits: Joas A Santos & Red Team Leaders.
@@ -0,0 +1,37 @@
 # Host Port & Service Scan Agent
 ## User Prompt
 You are testing **{target}** (a host/infrastructure target) for open ports and service/version discovery.
 **Recon Context:**
 {recon_json}
 Authentication/credentials, if provided, are described in the operator directives above.
 **METHODOLOGY:**
 ### 1. Scan
 - `rustscan -a {target} -- -sV` if present, else `nmap -sV -sC -Pn {target}`
 - Identify open TCP/UDP ports, service banners and versions
 ### 2. Triage
 - Flag risky services (SMB, RDP, SSH, WinRM, LDAP, databases) and outdated versions
 - Correlate versions to known CVEs for downstream agents
 ### 3. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: Host Port & Service Scan on [host]
 - Severity: Info
 - CWE: CWE-200
 - Endpoint: [host/service]
 - Vector: [how]
 - Payload: [command/PoC]
 - Evidence: [raw tool output proving it]
 - Impact: Attack-surface mapping
 - Remediation: Close/patch exposed services; restrict by firewall
 ```
 ## System Prompt
 You are an infrastructure pentest specialist for open ports and service/version discovery. AUTHORIZED engagement. Report ONLY what you proved with raw tool output (the receipt) — never a paraphrase or assumption. If you lack access/observation to confirm, say so and gather more first. Stay in scope; never run destructive or DoS actions. Credits: Joas A Santos & Red Team Leaders.
@@ -0,0 +1,36 @@
 # SMB/NetBIOS Enumeration Agent
 ## User Prompt
 You are testing **{target}** (a host/infrastructure target) for SMB shares, sessions and misconfigurations.
 **Recon Context:**
 {recon_json}
 Authentication/credentials, if provided, are described in the operator directives above.
 **METHODOLOGY:**
 ### 1. Enumerate
 - `netexec smb {target}` / `crackmapexec smb {target}` for hosts, signing, null sessions
 - `smbclient -L //{target}/ -N` to list shares; check anonymous read/write
 ### 2. Assess
 - Flag SMB signing disabled (relay risk), guest/anonymous access, writable shares
 ### 3. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: SMB/NetBIOS Enumeration on [host]
 - Severity: Medium
 - CWE: CWE-200
 - Endpoint: [host/service]
 - Vector: [how]
 - Payload: [command/PoC]
 - Evidence: [raw tool output proving it]
 - Impact: Lateral movement, credential relay
 - Remediation: Require SMB signing; disable guest; restrict shares
 ```
 ## System Prompt
 You are an infrastructure pentest specialist for SMB shares, sessions and misconfigurations. AUTHORIZED engagement. Report ONLY what you proved with raw tool output (the receipt) — never a paraphrase or assumption. If you lack access/observation to confirm, say so and gather more first. Stay in scope; never run destructive or DoS actions. Credits: Joas A Santos & Red Team Leaders.
@@ -0,0 +1,35 @@
 # Writable Cron / Service Abuse Agent
 ## User Prompt
 You are testing **{target}** (a host/infrastructure target) for world-writable cron jobs or unit files.
 **Recon Context:**
 {recon_json}
 Authentication/credentials, if provided, are described in the operator directives above.
 **METHODOLOGY:**
 ### 1. Find
 - Inspect /etc/cron*, systemd units, and scripts they call for writable paths
 ### 2. Confirm
 - Plant a benign marker that the privileged job executes, proving control
 ### 3. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: Writable Cron / Service Abuse on [host]
 - Severity: High
 - CWE: CWE-732
 - Endpoint: [host/service]
 - Vector: [how]
 - Payload: [command/PoC]
 - Evidence: [raw tool output proving it]
 - Impact: Privilege escalation
 - Remediation: Fix permissions on jobs and their targets
 ```
 ## System Prompt
 You are an infrastructure pentest specialist for world-writable cron jobs or unit files. AUTHORIZED engagement. Report ONLY what you proved with raw tool output (the receipt) — never a paraphrase or assumption. If you lack access/observation to confirm, say so and gather more first. Stay in scope; never run destructive or DoS actions. Credits: Joas A Santos & Red Team Leaders.
@@ -0,0 +1,36 @@
 # Linux Privilege Escalation Agent
 ## User Prompt
 You are testing **{target}** (a host/infrastructure target) for local privilege-escalation paths on a Linux host.
 **Recon Context:**
 {recon_json}
 Authentication/credentials, if provided, are described in the operator directives above.
 **METHODOLOGY:**
 ### 1. Enumerate (authenticated via SSH)
 - Run linpeas/`sudo -l`, SUID/SGID (`find / -perm -4000`), cron, capabilities, writable PATH
 - Check kernel version for known local exploits
 ### 2. Confirm
 - Demonstrate an actual escalation to root (or a clear, reachable path) with command output
 ### 3. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: Linux Privilege Escalation on [host]
 - Severity: High
 - CWE: CWE-269
 - Endpoint: [host/service]
 - Vector: [how]
 - Payload: [command/PoC]
 - Evidence: [raw tool output proving it]
 - Impact: Full host compromise
 - Remediation: Patch kernel; fix sudo/SUID/cron/permission issues
 ```
 ## System Prompt
 You are an infrastructure pentest specialist for local privilege-escalation paths on a Linux host. AUTHORIZED engagement. Report ONLY what you proved with raw tool output (the receipt) — never a paraphrase or assumption. If you lack access/observation to confirm, say so and gather more first. Stay in scope; never run destructive or DoS actions. Credits: Joas A Santos & Red Team Leaders.
@@ -0,0 +1,36 @@
 # SSH Weak Authentication Agent
 ## User Prompt
 You are testing **{target}** (a host/infrastructure target) for weak/guessable SSH credentials or misconfig.
 **Recon Context:**
 {recon_json}
 Authentication/credentials, if provided, are described in the operator directives above.
 **METHODOLOGY:**
 ### 1. Assess
 - Check allowed auth methods; test provided creds with `ssh`/`sshpass`
 - Only test supplied credentials — never brute force out of scope
 ### 2. Confirm
 - Show authenticated shell access with the credentials, capturing the session banner
 ### 3. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: SSH Weak Authentication on [host]
 - Severity: High
 - CWE: CWE-1391
 - Endpoint: [host/service]
 - Vector: [how]
 - Payload: [command/PoC]
 - Evidence: [raw tool output proving it]
 - Impact: Unauthorized host access
 - Remediation: Key-only auth; strong passwords; fail2ban
 ```
 ## System Prompt
 You are an infrastructure pentest specialist for weak/guessable SSH credentials or misconfig. AUTHORIZED engagement. Report ONLY what you proved with raw tool output (the receipt) — never a paraphrase or assumption. If you lack access/observation to confirm, say so and gather more first. Stay in scope; never run destructive or DoS actions. Credits: Joas A Santos & Red Team Leaders.
@@ -0,0 +1,35 @@
 # Linux Sudo Misconfiguration Agent
 ## User Prompt
 You are testing **{target}** (a host/infrastructure target) for exploitable sudo rules.
 **Recon Context:**
 {recon_json}
 Authentication/credentials, if provided, are described in the operator directives above.
 **METHODOLOGY:**
 ### 1. Enumerate
 - `sudo -l`; look for NOPASSWD binaries and GTFObins-exploitable entries
 ### 2. Confirm
 - Escalate via a permitted binary and show `id`=root output
 ### 3. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: Linux Sudo Misconfiguration on [host]
 - Severity: High
 - CWE: CWE-250
 - Endpoint: [host/service]
 - Vector: [how]
 - Payload: [command/PoC]
 - Evidence: [raw tool output proving it]
 - Impact: Privilege escalation to root
 - Remediation: Restrict sudo to least privilege; avoid shell-capable binaries
 ```
 ## System Prompt
 You are an infrastructure pentest specialist for exploitable sudo rules. AUTHORIZED engagement. Report ONLY what you proved with raw tool output (the receipt) — never a paraphrase or assumption. If you lack access/observation to confirm, say so and gather more first. Stay in scope; never run destructive or DoS actions. Credits: Joas A Santos & Red Team Leaders.
@@ -0,0 +1,35 @@
 # Windows Privilege Escalation Agent
 ## User Prompt
 You are testing **{target}** (a host/infrastructure target) for local privilege escalation on a Windows host.
 **Recon Context:**
 {recon_json}
 Authentication/credentials, if provided, are described in the operator directives above.
 **METHODOLOGY:**
 ### 1. Enumerate (authenticated)
 - Run winPEAS/`whoami /priv`; check unquoted service paths, weak service perms, AlwaysInstallElevated, token privileges (SeImpersonate)
 ### 2. Confirm
 - Demonstrate escalation to SYSTEM/admin with command output (e.g. via a Potato technique where applicable)
 ### 3. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: Windows Privilege Escalation on [host]
 - Severity: High
 - CWE: CWE-269
 - Endpoint: [host/service]
 - Vector: [how]
 - Payload: [command/PoC]
 - Evidence: [raw tool output proving it]
 - Impact: Full host compromise
 - Remediation: Patch; fix service perms; remove dangerous privileges
 ```
 ## System Prompt
 You are an infrastructure pentest specialist for local privilege escalation on a Windows host. AUTHORIZED engagement. Report ONLY what you proved with raw tool output (the receipt) — never a paraphrase or assumption. If you lack access/observation to confirm, say so and gather more first. Stay in scope; never run destructive or DoS actions. Credits: Joas A Santos & Red Team Leaders.
@@ -0,0 +1,35 @@
 # SMB Signing & Relay Exposure Agent
 ## User Prompt
 You are testing **{target}** (a host/infrastructure target) for SMB signing not required (NTLM relay risk).
 **Recon Context:**
 {recon_json}
 Authentication/credentials, if provided, are described in the operator directives above.
 **METHODOLOGY:**
 ### 1. Detect
 - `netexec smb {target}` — note `signing:False`
 ### 2. Assess
 - Explain the NTLM-relay exposure; confirm a coercible auth path only if in scope
 ### 3. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: SMB Signing & Relay Exposure on [host]
 - Severity: Medium
 - CWE: CWE-294
 - Endpoint: [host/service]
 - Vector: [how]
 - Payload: [command/PoC]
 - Evidence: [raw tool output proving it]
 - Impact: Credential relay, lateral movement
 - Remediation: Enforce SMB signing; disable NTLM where possible
 ```
 ## System Prompt
 You are an infrastructure pentest specialist for SMB signing not required (NTLM relay risk). AUTHORIZED engagement. Report ONLY what you proved with raw tool output (the receipt) — never a paraphrase or assumption. If you lack access/observation to confirm, say so and gather more first. Stay in scope; never run destructive or DoS actions. Credits: Joas A Santos & Red Team Leaders.
@@ -0,0 +1,35 @@
 # WinRM Authenticated Access Agent
 ## User Prompt
 You are testing **{target}** (a host/infrastructure target) for remote management access via WinRM.
 **Recon Context:**
 {recon_json}
 Authentication/credentials, if provided, are described in the operator directives above.
 **METHODOLOGY:**
 ### 1. Connect
 - `evil-winrm -i {target} -u <user> -p <pass>` (or -H <hash>) with supplied creds/hash
 ### 2. Confirm
 - Show an authenticated remote shell and the host context (`whoami`, hostname)
 ### 3. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: WinRM Authenticated Access on [host]
 - Severity: Medium
 - CWE: CWE-287
 - Endpoint: [host/service]
 - Vector: [how]
 - Payload: [command/PoC]
 - Evidence: [raw tool output proving it]
 - Impact: Remote host control
 - Remediation: Restrict WinRM; strong creds; network segmentation
 ```
 ## System Prompt
 You are an infrastructure pentest specialist for remote management access via WinRM. AUTHORIZED engagement. Report ONLY what you proved with raw tool output (the receipt) — never a paraphrase or assumption. If you lack access/observation to confirm, say so and gather more first. Stay in scope; never run destructive or DoS actions. Credits: Joas A Santos & Red Team Leaders.
@@ -0,0 +1,36 @@
 # App-Server Console Exposure Agent
 ## User Prompt
 You are testing **{target}** for exposed Tomcat/JBoss/Jenkins/Actuator consoles.
 **Recon Context:**
 {recon_json}
 **METHODOLOGY:**
 ### 1. Discover
 - Probe `/manager/html`, `/jmx-console`, `/jenkins`, `/actuator`, `/console`, `/admin`
 ### 2. Assess
 - Test default/weak creds (in scope); check unauth-exposed management endpoints
 ### 3. Confirm
 - Demonstrate a management action / deploy / info-leak proving exposure (→ often RCE)
 ### 4. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: App-Server Console Exposure at [endpoint]
 - Severity: High
 - CWE: CWE-1188
 - Endpoint: [full URL]
 - Vector: [what/where]
 - Payload: [exact payload/command]
 - Evidence: [raw tool output proving it]
 - Impact: Remote code execution / takeover
 - Remediation: Authenticate & network-restrict consoles; remove defaults
 ```
 ## System Prompt
 You are a specialist in exposed Tomcat/JBoss/Jenkins/Actuator consoles. AUTHORIZED engagement. Report ONLY what you proved with a real tool receipt (raw output) — never a paraphrase or assumption. Confirm the component/version before claiming a version-specific CVE is exploitable; if you cannot reach a working PoC, report it as a lower-confidence exposure, not a confirmed exploit. No destructive/DoS actions. Credits: Joas A Santos and Red Team Leaders.
@@ -0,0 +1,36 @@
 # ASP.NET Debug/Trace Exposure Agent
 ## User Prompt
 You are testing **{target}** for debug/trace enabled in production ASP.NET.
 **Recon Context:**
 {recon_json}
 **METHODOLOGY:**
 ### 1. Probe
 - Request `trace.axd`; send `DEBUG` verb; check `<compilation debug=...>` leakage via errors
 ### 2. Assess
 - Harvest request/session data, stack traces, app internals from trace output
 ### 3. Confirm
 - Show sensitive runtime data exposed
 ### 4. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: ASP.NET Debug/Trace Exposure at [endpoint]
 - Severity: Medium
 - CWE: CWE-489
 - Endpoint: [full URL]
 - Vector: [what/where]
 - Payload: [exact payload/command]
 - Evidence: [raw tool output proving it]
 - Impact: Information disclosure
 - Remediation: Disable debug/trace; custom errors
 ```
 ## System Prompt
 You are a specialist in debug/trace enabled in production ASP.NET. AUTHORIZED engagement. Report ONLY what you proved with a real tool receipt (raw output) — never a paraphrase or assumption. Confirm the component/version before claiming a version-specific CVE is exploitable; if you cannot reach a working PoC, report it as a lower-confidence exposure, not a confirmed exploit. No destructive/DoS actions. Credits: Joas A Santos and Red Team Leaders.
@@ -0,0 +1,36 @@
 # ASP.NET ViewState Deserialization Agent
 ## User Prompt
 You are testing **{target}** for unprotected/known-key __VIEWSTATE deserialization.
 **Recon Context:**
 {recon_json}
 **METHODOLOGY:**
 ### 1. Inspect
 - Capture __VIEWSTATE; check if MAC is disabled (enableViewStateMac=false) or a known/leaked machineKey is in play
 ### 2. Weaponize
 - With a known/guessed machineKey, craft a ysoserial.net ViewState gadget
 ### 3. Confirm
 - Prove code execution via OOB callback or command output tied to a unique marker
 ### 4. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: ASP.NET ViewState Deserialization at [endpoint]
 - Severity: Critical
 - CWE: CWE-502
 - Endpoint: [full URL]
 - Vector: [what/where]
 - Payload: [exact payload/command]
 - Evidence: [raw tool output proving it]
 - Impact: Remote code execution
 - Remediation: Enable ViewState MAC; rotate machineKey; patch
 ```
 ## System Prompt
 You are a specialist in unprotected/known-key __VIEWSTATE deserialization. AUTHORIZED engagement. Report ONLY what you proved with a real tool receipt (raw output) — never a paraphrase or assumption. Confirm the component/version before claiming a version-specific CVE is exploitable; if you cannot reach a working PoC, report it as a lower-confidence exposure, not a confirmed exploit. No destructive/DoS actions. Credits: Joas A Santos and Red Team Leaders.
@@ -0,0 +1,36 @@
 # CMS Admin Panel & Default Creds Agent
 ## User Prompt
 You are testing **{target}** for exposed CMS admin with weak/default credentials.
 **Recon Context:**
 {recon_json}
 **METHODOLOGY:**
 ### 1. Locate
 - Find admin (`/wp-admin`, `/administrator`, `/user/login`, `/admin`)
 ### 2. Test (in scope)
 - Try supplied/default credentials; respect lockout/ROE — no out-of-scope brute force
 ### 3. Confirm
 - Show authenticated admin access
 ### 4. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: CMS Admin Panel & Default Creds at [endpoint]
 - Severity: High
 - CWE: CWE-1392
 - Endpoint: [full URL]
 - Vector: [what/where]
 - Payload: [exact payload/command]
 - Evidence: [raw tool output proving it]
 - Impact: Full CMS compromise
 - Remediation: Remove defaults; strong creds + MFA; restrict admin
 ```
 ## System Prompt
 You are a specialist in exposed CMS admin with weak/default credentials. AUTHORIZED engagement. Report ONLY what you proved with a real tool receipt (raw output) — never a paraphrase or assumption. Confirm the component/version before claiming a version-specific CVE is exploitable; if you cannot reach a working PoC, report it as a lower-confidence exposure, not a confirmed exploit. No destructive/DoS actions. Credits: Joas A Santos and Red Team Leaders.
@@ -0,0 +1,37 @@
 # CMS Fingerprint & Version Agent
 ## User Prompt
 You are testing **{target}** for CMS identification and version disclosure.
 **Recon Context:**
 {recon_json}
 **METHODOLOGY:**
 ### 1. Identify
 - Detect CMS via meta generator, paths (`/wp-`, `/sites/`, `/administrator/`), headers, favicon hash
 - Run whatweb/wpscan-style detection without auth
 ### 2. Version
 - Pin exact version from readme/changelog/asset hashes
 ### 3. Map
 - List plugins/themes/modules and their versions for CVE correlation
 ### 4. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: CMS Fingerprint & Version at [endpoint]
 - Severity: Info
 - CWE: CWE-200
 - Endpoint: [full URL]
 - Vector: [what/where]
 - Payload: [exact payload/command]
 - Evidence: [raw tool output proving it]
 - Impact: Targeted exploitation surface
 - Remediation: Hide version/generator; keep components updated
 ```
 ## System Prompt
 You are a specialist in CMS identification and version disclosure. AUTHORIZED engagement. Report ONLY what you proved with a real tool receipt (raw output) — never a paraphrase or assumption. Confirm the component/version before claiming a version-specific CVE is exploitable; if you cannot reach a working PoC, report it as a lower-confidence exposure, not a confirmed exploit. No destructive/DoS actions. Credits: Joas A Santos and Red Team Leaders.
@@ -0,0 +1,40 @@
 # Known-CVE Exploitation Specialist Agent
 ## User Prompt
 You are testing **{target}** for exploiting known CVEs for the detected stack.
 **Recon Context:**
 {recon_json}
 **METHODOLOGY:**
 ### 1. Identify versions
 - From recon, list each component + exact version (server, framework, CMS, plugins, libs)
 ### 2. Map to CVEs
 - Match versions to known CVEs; prioritise unauth RCE/SQLi/auth-bypass; note CVE id + CVSS
 - Prefer issues with a reliable, non-destructive PoC
 ### 3. Reproduce safely
 - Run a benign PoC (e.g. a version/echo check or OOB callback) to confirm the CVE is actually present and exploitable — never a destructive payload
 ### 4. Confirm
 - Report the CVE only when the PoC produced concrete proof (output/OOB); otherwise report it as 'potentially vulnerable (version match, unconfirmed)'
 ### 5. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: Known-CVE Exploitation Specialist at [endpoint]
 - Severity: Critical
 - CWE: CWE-1395
 - Endpoint: [full URL]
 - Vector: [what/where]
 - Payload: [exact payload/command]
 - Evidence: [raw tool output proving it]
 - Impact: Depends on CVE — up to full compromise
 - Remediation: Patch/upgrade the affected components; apply vendor advisories
 ```
 ## System Prompt
 You are a specialist in exploiting known CVEs for the detected stack. AUTHORIZED engagement. Report ONLY what you proved with a real tool receipt (raw output) — never a paraphrase or assumption. Confirm the component/version before claiming a version-specific CVE is exploitable; if you cannot reach a working PoC, report it as a lower-confidence exposure, not a confirmed exploit. No destructive/DoS actions. Credits: Joas A Santos and Red Team Leaders.
@@ -0,0 +1,36 @@
 # Drupal Security Audit Agent
 ## User Prompt
 You are testing **{target}** for Drupal core/module weaknesses (e.g. Drupalgeddon class).
 **Recon Context:**
 {recon_json}
 **METHODOLOGY:**
 ### 1. Enumerate
 - Version (CHANGELOG, headers), enabled modules
 ### 2. Correlate CVEs
 - Map to known Drupal RCE/SQLi (e.g. SA-CORE highly-critical classes)
 ### 3. Confirm
 - Reproduce with an OOB/output proof where applicable
 ### 4. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: Drupal Security Audit at [endpoint]
 - Severity: Critical
 - CWE: CWE-1395
 - Endpoint: [full URL]
 - Vector: [what/where]
 - Payload: [exact payload/command]
 - Evidence: [raw tool output proving it]
 - Impact: Remote code execution
 - Remediation: Patch core/modules promptly
 ```
 ## System Prompt
 You are a specialist in Drupal core/module weaknesses (e.g. Drupalgeddon class). AUTHORIZED engagement. Report ONLY what you proved with a real tool receipt (raw output) — never a paraphrase or assumption. Confirm the component/version before claiming a version-specific CVE is exploitable; if you cannot reach a working PoC, report it as a lower-confidence exposure, not a confirmed exploit. No destructive/DoS actions. Credits: Joas A Santos and Red Team Leaders.
@@ -0,0 +1,36 @@
 # Exposed VCS / Build Artifacts Agent
 ## User Prompt
 You are testing **{target}** for exposed .git/.svn/CI artifacts on the app host.
 **Recon Context:**
 {recon_json}
 **METHODOLOGY:**
 ### 1. Probe
 - Request `/.git/HEAD`, `/.svn/entries`, `/.env`, build/CI artifact paths
 ### 2. Recover
 - Dump source (git-dumper) / read secrets
 ### 3. Confirm
 - Show recovered source or live secret
 ### 4. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: Exposed VCS / Build Artifacts at [endpoint]
 - Severity: High
 - CWE: CWE-527
 - Endpoint: [full URL]
 - Vector: [what/where]
 - Payload: [exact payload/command]
 - Evidence: [raw tool output proving it]
 - Impact: Source/secret disclosure → RCE
 - Remediation: Block VCS/dotfiles from web; rotate secrets
 ```
 ## System Prompt
 You are a specialist in exposed .git/.svn/CI artifacts on the app host. AUTHORIZED engagement. Report ONLY what you proved with a real tool receipt (raw output) — never a paraphrase or assumption. Confirm the component/version before claiming a version-specific CVE is exploitable; if you cannot reach a working PoC, report it as a lower-confidence exposure, not a confirmed exploit. No destructive/DoS actions. Credits: Joas A Santos and Red Team Leaders.
@@ -0,0 +1,36 @@
 # IIS Handler/Extension Bypass Agent
 ## User Prompt
 You are testing **{target}** for auth or filter bypass via IIS handler quirks.
 **Recon Context:**
 {recon_json}
 **METHODOLOGY:**
 ### 1. Probe
 - Test path/extension tricks: `;.asp`, `::$DATA`, trailing dot, `%20`, case, `/admin/.`/`..%2f`
 ### 2. Bypass
 - Reach a protected handler/endpoint via a normalization or handler-mapping quirk
 ### 3. Confirm
 - Show access to a resource that should be blocked
 ### 4. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: IIS Handler/Extension Bypass at [endpoint]
 - Severity: High
 - CWE: CWE-288
 - Endpoint: [full URL]
 - Vector: [what/where]
 - Payload: [exact payload/command]
 - Evidence: [raw tool output proving it]
 - Impact: Auth/control bypass
 - Remediation: Consistent normalization; patch; tighten ACLs
 ```
 ## System Prompt
 You are a specialist in auth or filter bypass via IIS handler quirks. AUTHORIZED engagement. Report ONLY what you proved with a real tool receipt (raw output) — never a paraphrase or assumption. Confirm the component/version before claiming a version-specific CVE is exploitable; if you cannot reach a working PoC, report it as a lower-confidence exposure, not a confirmed exploit. No destructive/DoS actions. Credits: Joas A Santos and Red Team Leaders.
@@ -0,0 +1,37 @@
 # IIS Tilde (~) Short-Name Enumeration Agent
 ## User Prompt
 You are testing **{target}** for IIS 8.3 short-name disclosure.
 **Recon Context:**
 {recon_json}
 **METHODOLOGY:**
 ### 1. Detect
 - Probe `GET /*~1*/.aspx` style requests; a 404-vs-error differential reveals 8.3 short names
 - Confirm IIS version from Server header
 ### 2. Enumerate
 - Brute the short names char by char to reveal hidden files/dirs
 ### 3. Confirm
 - Show recovered short names mapping to real sensitive files
 ### 4. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: IIS Tilde (~) Short-Name Enumeration at [endpoint]
 - Severity: Medium
 - CWE: CWE-200
 - Endpoint: [full URL]
 - Vector: [what/where]
 - Payload: [exact payload/command]
 - Evidence: [raw tool output proving it]
 - Impact: Discovery of hidden files/backups/configs
 - Remediation: Disable 8.3 name creation; patch IIS
 ```
 ## System Prompt
 You are a specialist in IIS 8.3 short-name disclosure. AUTHORIZED engagement. Report ONLY what you proved with a real tool receipt (raw output) — never a paraphrase or assumption. Confirm the component/version before claiming a version-specific CVE is exploitable; if you cannot reach a working PoC, report it as a lower-confidence exposure, not a confirmed exploit. No destructive/DoS actions. Credits: Joas A Santos and Red Team Leaders.
@@ -0,0 +1,36 @@
 # IIS WebDAV Misconfiguration Agent
 ## User Prompt
 You are testing **{target}** for exposed/unsafe WebDAV on IIS.
 **Recon Context:**
 {recon_json}
 **METHODOLOGY:**
 ### 1. Detect
 - `OPTIONS /` — look for DAV header / PUT/MOVE/COPY allowed
 ### 2. Test write
 - Attempt PUT of a benign file; if blocked, try `.txt`→MOVE→`.asp` trick
 ### 3. Confirm
 - Show an uploaded file is served (and if executable → RCE)
 ### 4. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: IIS WebDAV Misconfiguration at [endpoint]
 - Severity: High
 - CWE: CWE-650
 - Endpoint: [full URL]
 - Vector: [what/where]
 - Payload: [exact payload/command]
 - Evidence: [raw tool output proving it]
 - Impact: Arbitrary upload, potential RCE
 - Remediation: Disable WebDAV or restrict methods/authn
 ```
 ## System Prompt
 You are a specialist in exposed/unsafe WebDAV on IIS. AUTHORIZED engagement. Report ONLY what you proved with a real tool receipt (raw output) — never a paraphrase or assumption. Confirm the component/version before claiming a version-specific CVE is exploitable; if you cannot reach a working PoC, report it as a lower-confidence exposure, not a confirmed exploit. No destructive/DoS actions. Credits: Joas A Santos and Red Team Leaders.
@@ -0,0 +1,36 @@
 # Joomla Security Audit Agent
 ## User Prompt
 You are testing **{target}** for Joomla core/extension weaknesses.
 **Recon Context:**
 {recon_json}
 **METHODOLOGY:**
 ### 1. Enumerate
 - Version (`administrator/manifests/files/joomla.xml`), components/extensions + versions
 ### 2. Correlate CVEs
 - Map to known Joomla/extension CVEs (SQLi, LFI, object injection)
 ### 3. Confirm
 - Reproduce one with proof
 ### 4. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: Joomla Security Audit at [endpoint]
 - Severity: High
 - CWE: CWE-1395
 - Endpoint: [full URL]
 - Vector: [what/where]
 - Payload: [exact payload/command]
 - Evidence: [raw tool output proving it]
 - Impact: Site takeover / data breach
 - Remediation: Update core/extensions; harden admin
 ```
 ## System Prompt
 You are a specialist in Joomla core/extension weaknesses. AUTHORIZED engagement. Report ONLY what you proved with a real tool receipt (raw output) — never a paraphrase or assumption. Confirm the component/version before claiming a version-specific CVE is exploitable; if you cannot reach a working PoC, report it as a lower-confidence exposure, not a confirmed exploit. No destructive/DoS actions. Credits: Joas A Santos and Red Team Leaders.
@@ -0,0 +1,36 @@
 # Outdated Component CVE Specialist Agent
 ## User Prompt
 You are testing **{target}** for outdated front-end/back-end components with known CVEs.
 **Recon Context:**
 {recon_json}
 **METHODOLOGY:**
 ### 1. Inventory
 - Extract JS libs (jQuery, Angular, etc.), server modules, framework versions from responses/JS/headers
 ### 2. Correlate
 - Map each to known CVEs; flag the exploitable, reachable ones
 ### 3. Confirm
 - Prove exploitability where a safe PoC exists; else report as version-based exposure
 ### 4. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: Outdated Component CVE Specialist at [endpoint]
 - Severity: High
 - CWE: CWE-1104
 - Endpoint: [full URL]
 - Vector: [what/where]
 - Payload: [exact payload/command]
 - Evidence: [raw tool output proving it]
 - Impact: Varies — XSS/RCE/info-leak
 - Remediation: Upgrade components; dependency scanning in CI
 ```
 ## System Prompt
 You are a specialist in outdated front-end/back-end components with known CVEs. AUTHORIZED engagement. Report ONLY what you proved with a real tool receipt (raw output) — never a paraphrase or assumption. Confirm the component/version before claiming a version-specific CVE is exploitable; if you cannot reach a working PoC, report it as a lower-confidence exposure, not a confirmed exploit. No destructive/DoS actions. Credits: Joas A Santos and Red Team Leaders.
@@ -0,0 +1,36 @@
 # WordPress Security Audit Agent
 ## User Prompt
 You are testing **{target}** for WordPress core/plugin/theme weaknesses.
 **Recon Context:**
 {recon_json}
 **METHODOLOGY:**
 ### 1. Enumerate
 - Users (`/?author=`, REST `/wp-json/wp/v2/users`), plugins/themes + versions, `xmlrpc.php`
 ### 2. Correlate CVEs
 - Map plugin/theme versions to known vulns (arbitrary upload, SQLi, auth bypass, LFI)
 ### 3. Confirm
 - Reproduce one concrete issue (e.g. unauth arbitrary file upload) with proof
 ### 4. Report Format
 For each CONFIRMED finding:
 ```
 FINDING:
 - Title: WordPress Security Audit at [endpoint]
 - Severity: High
 - CWE: CWE-1395
 - Endpoint: [full URL]
 - Vector: [what/where]
 - Payload: [exact payload/command]
 - Evidence: [raw tool output proving it]
 - Impact: Site takeover / RCE
 - Remediation: Update core/plugins/themes; harden; disable xmlrpc
 ```
 ## System Prompt
 You are a specialist in WordPress core/plugin/theme weaknesses. AUTHORIZED engagement. Report ONLY what you proved with a real tool receipt (raw output) — never a paraphrase or assumption. Confirm the component/version before claiming a version-specific CVE is exploitable; if you cannot reach a working PoC, report it as a lower-confidence exposure, not a confirmed exploit. No destructive/DoS actions. Credits: Joas A Santos and Red Team Leaders.
@@ -0,0 +1,61 @@
 # NeuroSploit installer for Windows (PowerShell) — by Joas A Santos & Red Team Leaders
 #
 #   irm https://raw.githubusercontent.com/JoasASantos/NeuroSploit/main/install.ps1 | iex
 #
 # Installs the Rust toolchain if needed, clones the repo, builds the release
 # binary, and adds it to your PATH. Works on x64 and arm64.
 $ErrorActionPreference = "Stop"
 function Say($m) { Write-Host "  > $m" -ForegroundColor Magenta }
 function Ok ($m) { Write-Host "  + $m" -ForegroundColor Green }
 function Warn($m){ Write-Host "  ! $m" -ForegroundColor Yellow }
 Write-Host ""
 Write-Host "  NeuroSploit installer (Windows) — v3.5.1" -ForegroundColor Cyan
 $arch = $env:PROCESSOR_ARCHITECTURE
 Say "Platform: Windows / $arch"
 $dir    = if ($env:NEUROSPLOIT_DIR) { $env:NEUROSPLOIT_DIR } else { Join-Path $HOME ".neurosploit-src" }
 $ref    = if ($env:NEUROSPLOIT_REF) { $env:NEUROSPLOIT_REF } else { "main" }
 # 1) git
 if (-not (Get-Command git -ErrorAction SilentlyContinue)) { throw "git is required (install Git for Windows) and re-run." }
 # 2) Rust (rustup) — winget if available, else the rustup-init bootstrap
 if (-not (Get-Command cargo -ErrorAction SilentlyContinue)) {
  Say "Rust not found — installing rustup..."
  if (Get-Command winget -ErrorAction SilentlyContinue) {
    winget install -e --id Rustlang.Rustup --accept-source-agreements --accept-package-agreements
  } else {
    $ri = Join-Path $env:TEMP "rustup-init.exe"
    Invoke-WebRequest "https://win.rustup.rs/$arch" -OutFile $ri
    & $ri -y --default-toolchain stable --profile minimal
  }
  $env:Path = "$HOME\.cargo\bin;$env:Path"
 }
 Ok ("Rust: " + (cargo --version))
 # 3) clone or update
 if (Test-Path (Join-Path $dir ".git")) {
  Say "Updating $dir..."; git -C $dir fetch --depth 1 origin $ref; git -C $dir reset --hard "origin/$ref"
 } else {
  Say "Cloning to $dir..."; git clone --depth 1 --branch $ref "https://github.com/JoasASantos/NeuroSploit.git" $dir
 }
 # 4) build
 Say "Building release binary (first build downloads crates)..."
 Push-Location (Join-Path $dir "neurosploit-rs"); cargo build --release; Pop-Location
 $bin = Join-Path $dir "neurosploit-rs\target\release\neurosploit.exe"
 if (-not (Test-Path $bin)) { throw "build did not produce $bin" }
 Ok ("Built: " + (& $bin --version))
 # 5) add to PATH (user)
 $binDir = Split-Path $bin
 $userPath = [Environment]::GetEnvironmentVariable("Path", "User")
 if ($userPath -notlike "*$binDir*") {
  [Environment]::SetEnvironmentVariable("Path", "$userPath;$binDir", "User")
  Ok "Added $binDir to your PATH (open a new terminal)."
 }
 Write-Host ""
 Ok "Done. Launch:  neurosploit"
 Write-Host "      neurosploit run http://testphp.vulnweb.com/ --subscription --model anthropic:claude-opus-4-8 -v"
@@ -11,6 +11,12 @@ dependencies = [
 "memchr",
 ]
 [[package]]
 name = "allocator-api2"
 version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
 [[package]]
 name = "anstream"
 version = "1.0.0"
@@ -97,6 +103,21 @@ version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ae3f5d315924270530207e2a68396c3cc547f6dca3fbdca317cfb1a51edb593"
 [[package]]
 name = "cassowary"
 version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df8670b8c7b9dae1793364eafadf7239c40d669904660c5960d74cfd80b46a53"
 [[package]]
 name = "castaway"
 version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dec551ab6e7578819132c713a93c022a05d60159dc86e7a7050223577484c55a"
 dependencies = [
 "rustversion",
 ]
 [[package]]
 name = "cc"
 version = "1.2.65"
@@ -113,6 +134,12 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 [[package]]
 name = "cfg_aliases"
 version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fd16c4719339c4530435d38e511904438d07cce7950afa3718a84ac36c10e89e"
 [[package]]
 name = "cfg_aliases"
 version = "0.2.1"
@@ -159,12 +186,120 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
 [[package]]
 name = "clipboard-win"
 version = "5.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bde03770d3df201d4fb868f2c9c59e66a3e4e2bd06692a0fe701e7103c7e84d4"
 dependencies = [
 "error-code",
 ]
 [[package]]
 name = "colorchoice"
 version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
 [[package]]
 name = "compact_str"
 version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7fd622ebbb56a5b2ccb651b32b911cdeb2a9b4b11776b2473bf26a26a286244e"
 dependencies = [
 "castaway",
 "cfg-if",
 "itoa",
 "rustversion",
 "ryu",
 "static_assertions",
 ]
 [[package]]
 name = "console"
 version = "0.15.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "054ccb5b10f9f2cbf51eb355ca1d05c2d279ce1804688d0db74b4733a5aeafd8"
 dependencies = [
 "encode_unicode",
 "libc",
 "once_cell",
 "unicode-width 0.2.2",
 "windows-sys 0.59.0",
 ]
 [[package]]
 name = "crossterm"
 version = "0.28.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "829d955a0bb380ef178a640b91779e3987da38c9aea133b20614cfed8cdea9c6"
 dependencies = [
 "bitflags",
 "crossterm_winapi",
 "mio",
 "parking_lot",
 "rustix 0.38.44",
 "signal-hook",
 "signal-hook-mio",
 "winapi",
 ]
 [[package]]
 name = "crossterm_winapi"
 version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "acdd7c62a3665c7f6830a51635d9ac9b23ed385797f70a83bb8bafe9c572ab2b"
 dependencies = [
 "winapi",
 ]
 [[package]]
 name = "darling"
 version = "0.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
 dependencies = [
 "darling_core",
 "darling_macro",
 ]
 [[package]]
 name = "darling_core"
 version = "0.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0"
 dependencies = [
 "ident_case",
 "proc-macro2",
 "quote",
 "strsim",
 "syn",
 ]
 [[package]]
 name = "darling_macro"
 version = "0.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
 dependencies = [
 "darling_core",
 "quote",
 "syn",
 ]
 [[package]]
 name = "dialoguer"
 version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "658bce805d770f407bc62102fca7c2c64ceef2fbcb2b8bd19d2765ce093980de"
 dependencies = [
 "console",
 "shell-words",
 "tempfile",
 "thiserror 1.0.69",
 "zeroize",
 ]
 [[package]]
 name = "displaydoc"
 version = "0.2.6"
@@ -176,6 +311,30 @@ dependencies = [
 "syn",
 ]
 [[package]]
 name = "either"
 version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
 [[package]]
 name = "encode_unicode"
 version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
 [[package]]
 name = "endian-type"
 version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c34f04666d835ff5d62e058c3995147c06f42fe86ff053337632bca83e42702d"
 [[package]]
 name = "equivalent"
 version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 [[package]]
 name = "errno"
 version = "0.3.14"
@@ -186,12 +345,41 @@ dependencies = [
 "windows-sys 0.61.2",
 ]
 [[package]]
 name = "error-code"
 version = "3.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dea2df4cf52843e0452895c455a1a2cfbb842a1e7329671acf418fdc53ed4c59"
 [[package]]
 name = "fastrand"
 version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
 [[package]]
 name = "fd-lock"
 version = "4.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ce92ff622d6dadf7349484f42c93271a0d49b7cc4d466a936405bacbe10aa78"
 dependencies = [
 "cfg-if",
 "rustix 1.1.4",
 "windows-sys 0.59.0",
 ]
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 [[package]]
 name = "foldhash"
 version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
 [[package]]
 name = "form_urlencoded"
 version = "1.2.2"
@@ -316,12 +504,32 @@ dependencies = [
 "wasm-bindgen",
 ]
 [[package]]
 name = "hashbrown"
 version = "0.15.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
 dependencies = [
 "allocator-api2",
 "equivalent",
 "foldhash",
 ]
 [[package]]
 name = "heck"
 version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 [[package]]
 name = "home"
 version = "0.5.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
 dependencies = [
 "windows-sys 0.61.2",
 ]
 [[package]]
 name = "http"
 version = "1.4.2"
@@ -502,6 +710,12 @@ dependencies = [
 "zerovec",
 ]
 [[package]]
 name = "ident_case"
 version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
 [[package]]
 name = "idna"
 version = "1.1.0"
@@ -523,6 +737,28 @@ dependencies = [
 "icu_properties",
 ]
 [[package]]
 name = "indoc"
 version = "2.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "79cf5c93f93228cf8efb3ba362535fb11199ac548a09ce117c9b1adc3030d706"
 dependencies = [
 "rustversion",
 ]
 [[package]]
 name = "instability"
 version = "0.3.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5eb2d60ef19920a3a9193c3e371f726ec1dafc045dac788d0fb3704272458971"
 dependencies = [
 "darling",
 "indoc",
 "proc-macro2",
 "quote",
 "syn",
 ]
 [[package]]
 name = "ipnet"
 version = "2.12.0"
@@ -535,6 +771,15 @@ version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
 [[package]]
 name = "itertools"
 version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186"
 dependencies = [
 "either",
 ]
 [[package]]
 name = "itoa"
 version = "1.0.18"
@@ -558,6 +803,18 @@ version = "0.2.186"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
 [[package]]
 name = "linux-raw-sys"
 version = "0.4.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
 [[package]]
 name = "linux-raw-sys"
 version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 [[package]]
 name = "litemap"
 version = "0.8.2"
@@ -579,6 +836,15 @@ version = "0.4.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
 [[package]]
 name = "lru"
 version = "0.12.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "234cf4f4a04dc1f57e24b96cc0cd600cf2af460d4161ac5ecdd0af8e1f3b2a38"
 dependencies = [
 "hashbrown",
 ]
 [[package]]
 name = "lru-slab"
 version = "0.1.2"
@@ -598,18 +864,23 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "02bd0af71c67b473010cbbc60715ee815645a4dc942899111f494b4b737d6fda"
 dependencies = [
 "libc",
 "log",
 "wasi",
 "windows-sys 0.61.2",
 ]
 [[package]]
 name = "neurosploit"
-version = "3.4.1"
+version = "3.5.1"
 dependencies = [
 "anyhow",
 "clap",
 "crossterm",
 "dialoguer",
 "futures",
 "neurosploit-harness",
 "ratatui",
 "rustyline",
 "serde",
 "serde_json",
 "tokio",
@@ -617,7 +888,7 @@ dependencies = [
 [[package]]
 name = "neurosploit-harness"
-version = "3.4.1"
+version = "3.5.1"
 dependencies = [
 "anyhow",
 "futures",
@@ -629,6 +900,27 @@ dependencies = [
 "walkdir",
 ]
 [[package]]
 name = "nibble_vec"
 version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77a5d83df9f36fe23f0c3648c6bbb8b0298bb5f1939c8f2704431371f4b84d43"
 dependencies = [
 "smallvec",
 ]
 [[package]]
 name = "nix"
 version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ab2156c4fce2f8df6c499cc1c763e4394b7482525bf2a9701c9d79d215f519e4"
 dependencies = [
 "bitflags",
 "cfg-if",
 "cfg_aliases 0.1.1",
 "libc",
 ]
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -664,6 +956,12 @@ dependencies = [
 "windows-link",
 ]
 [[package]]
 name = "paste"
 version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
 [[package]]
 name = "percent-encoding"
 version = "2.3.2"
@@ -710,14 +1008,14 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
 dependencies = [
 "bytes",
- "cfg_aliases",
+ "cfg_aliases 0.2.1",
 "pin-project-lite",
 "quinn-proto",
 "quinn-udp",
 "rustc-hash",
 "rustls",
 "socket2",
- "thiserror",
+ "thiserror 2.0.18",
 "tokio",
 "tracing",
 "web-time",
@@ -738,7 +1036,7 @@ dependencies = [
 "rustls",
 "rustls-pki-types",
 "slab",
- "thiserror",
+ "thiserror 2.0.18",
 "tinyvec",
 "tracing",
 "web-time",
@@ -750,7 +1048,7 @@ version = "0.5.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
 dependencies = [
- "cfg_aliases",
+ "cfg_aliases 0.2.1",
 "libc",
 "once_cell",
 "socket2",
@@ -773,6 +1071,16 @@ version = "5.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 [[package]]
 name = "radix_trie"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c069c179fcdc6a2fe24d8d18305cf085fdbd4f922c041943e203685d6a1c58fd"
 dependencies = [
 "endian-type",
 "nibble_vec",
 ]
 [[package]]
 name = "rand"
 version = "0.9.4"
@@ -802,6 +1110,27 @@ dependencies = [
 "getrandom 0.3.4",
 ]
 [[package]]
 name = "ratatui"
 version = "0.28.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fdef7f9be5c0122f890d58bdf4d964349ba6a6161f705907526d891efabba57d"
 dependencies = [
 "bitflags",
 "cassowary",
 "compact_str",
 "crossterm",
 "instability",
 "itertools",
 "lru",
 "paste",
 "strum",
 "strum_macros",
 "unicode-segmentation",
 "unicode-truncate",
 "unicode-width 0.1.14",
 ]
 [[package]]
 name = "redox_syscall"
 version = "0.5.18"
@@ -898,6 +1227,32 @@ version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
 [[package]]
 name = "rustix"
 version = "0.38.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
 dependencies = [
 "bitflags",
 "errno",
 "libc",
 "linux-raw-sys 0.4.15",
 "windows-sys 0.59.0",
 ]
 [[package]]
 name = "rustix"
 version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
 "bitflags",
 "errno",
 "libc",
 "linux-raw-sys 0.12.1",
 "windows-sys 0.61.2",
 ]
 [[package]]
 name = "rustls"
 version = "0.23.40"
@@ -939,6 +1294,28 @@ version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 [[package]]
 name = "rustyline"
 version = "14.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7803e8936da37efd9b6d4478277f4b2b9bb5cdb37a113e8d63222e58da647e63"
 dependencies = [
 "bitflags",
 "cfg-if",
 "clipboard-win",
 "fd-lock",
 "home",
 "libc",
 "log",
 "memchr",
 "nix",
 "radix_trie",
 "unicode-segmentation",
 "unicode-width 0.1.14",
 "utf8parse",
 "windows-sys 0.52.0",
 ]
 [[package]]
 name = "ryu"
 version = "1.0.23"
@@ -1015,12 +1392,39 @@ dependencies = [
 "serde",
 ]
 [[package]]
 name = "shell-words"
 version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc6fe69c597f9c37bfeeeeeb33da3530379845f10be461a66d16d03eca2ded77"
 [[package]]
 name = "shlex"
 version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 [[package]]
 name = "signal-hook"
 version = "0.3.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d881a16cf4426aa584979d30bd82cb33429027e42122b169753d6ef1085ed6e2"
 dependencies = [
 "libc",
 "signal-hook-registry",
 ]
 [[package]]
 name = "signal-hook-mio"
 version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b75a19a7a740b25bc7944bdee6172368f988763b744e3d4dfe753f6b4ece40cc"
 dependencies = [
 "libc",
 "mio",
 "signal-hook",
 ]
 [[package]]
 name = "signal-hook-registry"
 version = "1.4.8"
@@ -1059,12 +1463,40 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 [[package]]
 name = "static_assertions"
 version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
 [[package]]
 name = "strsim"
 version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 [[package]]
 name = "strum"
 version = "0.26.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8fec0f0aef304996cf250b31b5a10dee7980c85da9d759361292b8bca5a18f06"
 dependencies = [
 "strum_macros",
 ]
 [[package]]
 name = "strum_macros"
 version = "0.26.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c6bee85a5a24955dc440386795aa378cd9cf82acd5f764469152d2270e581be"
 dependencies = [
 "heck",
 "proc-macro2",
 "quote",
 "rustversion",
 "syn",
 ]
 [[package]]
 name = "subtle"
 version = "2.6.1"
@@ -1102,13 +1534,46 @@ dependencies = [
 "syn",
 ]
 [[package]]
 name = "tempfile"
 version = "3.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
 "fastrand",
 "getrandom 0.3.4",
 "once_cell",
 "rustix 1.1.4",
 "windows-sys 0.61.2",
 ]
 [[package]]
 name = "thiserror"
 version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
 dependencies = [
 "thiserror-impl 1.0.69",
 ]
 [[package]]
 name = "thiserror"
 version = "2.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
 dependencies = [
- "thiserror-impl",
+ "thiserror-impl 2.0.18",
 ]
 [[package]]
 name = "thiserror-impl"
 version = "1.0.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
 "proc-macro2",
 "quote",
 "syn",
 ]
 [[package]]
@@ -1261,6 +1726,35 @@ version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 [[package]]
 name = "unicode-segmentation"
 version = "1.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
 [[package]]
 name = "unicode-truncate"
 version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b3644627a5af5fa321c95b9b235a72fd24cd29c648c2c379431e6628655627bf"
 dependencies = [
 "itertools",
 "unicode-segmentation",
 "unicode-width 0.1.14",
 ]
 [[package]]
 name = "unicode-width"
 version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"
 [[package]]
 name = "unicode-width"
 version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
 [[package]]
 name = "untrusted"
 version = "0.9.0"
@@ -1409,6 +1903,22 @@ dependencies = [
 "rustls-pki-types",
 ]
 [[package]]
 name = "winapi"
 version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
 dependencies = [
 "winapi-i686-pc-windows-gnu",
 "winapi-x86_64-pc-windows-gnu",
 ]
 [[package]]
 name = "winapi-i686-pc-windows-gnu"
 version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 [[package]]
 name = "winapi-util"
 version = "0.1.11"
@@ -1418,6 +1928,12 @@ dependencies = [
 "windows-sys 0.61.2",
 ]
 [[package]]
 name = "winapi-x86_64-pc-windows-gnu"
 version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 [[package]]
 name = "windows-link"
 version = "0.2.1"
@@ -1433,6 +1949,15 @@ dependencies = [
 "windows-targets 0.52.6",
 ]
 [[package]]
 name = "windows-sys"
 version = "0.59.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
 dependencies = [
 "windows-targets 0.52.6",
 ]
 [[package]]
 name = "windows-sys"
 version = "0.60.2"
@@ -3,7 +3,7 @@ members = ["crates/harness", "app"]
 resolver = "2"
 [workspace.package]
-version = "3.4.1"
+version = "3.5.1"
 edition = "2021"
 license = "MIT"
 repository = "https://github.com/JoasASantos/NeuroSploit"
@@ -16,3 +16,7 @@ tokio.workspace = true
 anyhow.workspace = true
 futures.workspace = true
 clap = { version = "4", features = ["derive"] }
 rustyline = "14"
 dialoguer = "0.11"
 ratatui = "0.28"
 crossterm = "0.28"
@@ -1,4 +1,7 @@
-//! NeuroSploit v3.4.1 — CLI: `run` (black-box) / `whitebox` (source) / `agents` / `models`.
+//! NeuroSploit v3.5.1 — interactive harness + CLI (`run` / `whitebox` / `agents` / `models`).
 mod repl;
 mod tui;
 use clap::{Parser, Subcommand};
 use harness::{agents, models::ModelRef, pool::ModelPool, types::RunConfig, RunOutput};
@@ -8,8 +11,8 @@ use std::path::{Path, PathBuf};
 #[command(
    name = "neurosploit",
    version,
-    about = "NeuroSploit v3.4.1 — multi-model autonomous pentest harness",
+    about = "NeuroSploit v3.5.1 — multi-model autonomous pentest harness",
-    long_about = "NeuroSploit v3.4.1 — a Rust multi-model harness that drives a pool of LLMs \
+    long_about = "NeuroSploit v3.5.1 — a Rust multi-model harness that drives a pool of LLMs \
 (API key or local subscription: Claude/Codex/Gemini/Grok) to autonomously test a target. \
 After recon it INTELLIGENTLY selects only the agents matching the discovered surface, runs \
 them in parallel, then validates every finding by cross-model voting before reporting.\n\n\
@@ -52,6 +55,12 @@ enum Cmd {
        /// support MCP fall back to their built-in tools).
        #[arg(long)]
        mcp: bool,
        /// Credentials YAML for authenticated testing (jwt/header/cookie/login).
        #[arg(long)]
        creds: Option<String>,
        /// Free-text focus, e.g. "injection and broken access control".
        #[arg(long)]
        focus: Option<String>,
        /// Verbose: log each agent as it launches, recon, and votes.
        #[arg(short, long)]
        verbose: bool,
@@ -72,6 +81,78 @@ enum Cmd {
        #[arg(short, long)]
        verbose: bool,
    },
    /// Greybox: review a repo's source AND exploit the running app together.
    Greybox {
        /// Path to the source repository.
        repo: String,
        /// URL of the running application.
        #[arg(long)]
        url: String,
        #[arg(long = "model")]
        models: Vec<String>,
        /// Credentials YAML for authenticated testing (jwt/header/cookie/login).
        #[arg(long)]
        creds: Option<String>,
        /// Free-text focus, e.g. "injection and broken access control".
        #[arg(long)]
        focus: Option<String>,
        #[arg(long, default_value_t = 0)]
        max_agents: usize,
        #[arg(long, default_value_t = 3)]
        vote_n: usize,
        #[arg(long)]
        offline: bool,
        #[arg(long)]
        subscription: bool,
        #[arg(long)]
        mcp: bool,
        #[arg(short, long)]
        verbose: bool,
    },
    /// Mission Control TUI: concurrent panels (header/feed/findings/targets) with
    /// a composer active during the run. Black-box (URL) or, with --repo, greybox.
    Tui {
        url: String,
        #[arg(long = "model")]
        models: Vec<String>,
        #[arg(long)]
        repo: Option<String>,
        #[arg(long)]
        creds: Option<String>,
        #[arg(long)]
        focus: Option<String>,
        #[arg(long, default_value_t = 0)]
        max_agents: usize,
        #[arg(long, default_value_t = 3)]
        vote_n: usize,
        #[arg(long)]
        subscription: bool,
        #[arg(long)]
        mcp: bool,
    },
    /// Infra/host: scan an IP/host and run Linux/Windows/AD agents. SSH/Windows
    /// credentials come from --creds (creds.yaml ssh:/windows: blocks).
    Host {
        /// Target host or IP.
        target: String,
        #[arg(long = "model")]
        models: Vec<String>,
        /// Credentials YAML (ssh / windows / ad blocks).
        #[arg(long)]
        creds: Option<String>,
        #[arg(long)]
        focus: Option<String>,
        #[arg(long, default_value_t = 0)]
        max_agents: usize,
        #[arg(long, default_value_t = 3)]
        vote_n: usize,
        #[arg(long)]
        offline: bool,
        #[arg(long)]
        subscription: bool,
        #[arg(short, long)]
        verbose: bool,
    },
    /// Show agent library counts.
    Agents,
    /// List providers and models.
@@ -107,17 +188,21 @@ async fn main() -> anyhow::Result<()> {
    let cli = Cli::parse();
    let base = find_base();
    // No subcommand → launch the Claude-Code-style interactive session.
    let cmd = match cli.cmd {
        Some(c) => c,
-        None => interactive(&base).await?, // no args → wizard
+        None => {
            repl::repl(&base).await?;
            return Ok(());
        }
    };
    match cmd {
        Cmd::Agents => {
            let lib = agents::load(&base);
            println!(
-                "{{\"vulns\":{},\"recon\":{},\"code\":{},\"meta\":{},\"total\":{}}}",
+                "{{\"vulns\":{},\"recon\":{},\"code\":{},\"infra\":{},\"chains\":{},\"meta\":{},\"total\":{}}}",
-                lib.vulns.len(), lib.recon.len(), lib.code.len(), lib.meta.len(), lib.total()
+                lib.vulns.len(), lib.recon.len(), lib.code.len(), lib.infra.len(), lib.chains.len(), lib.meta.len(), lib.total()
            );
        }
        Cmd::Models => {
@@ -128,7 +213,7 @@ async fn main() -> anyhow::Result<()> {
                }
            }
        }
-        Cmd::Run { url, models, max_agents, vote_n, offline, subscription, mcp, verbose } => {
+        Cmd::Run { url, models, max_agents, vote_n, offline, subscription, mcp, creds, focus, verbose } => {
            let url = if url.starts_with("http") { url } else { format!("https://{url}") };
            let mut cfg = RunConfig::new(&url);
            cfg.max_agents = max_agents;
@@ -136,9 +221,11 @@ async fn main() -> anyhow::Result<()> {
            cfg.offline = offline;
            cfg.subscription = subscription;
            cfg.verbose = verbose;
            cfg.instructions = focus;
            if !models.is_empty() {
                cfg.models = models;
            }
            apply_creds(&mut cfg, creds.as_deref()).await;
            let out = run_engagement(&base, cfg, mcp, false).await?;
            print_findings(&out);
        }
@@ -155,15 +242,136 @@ async fn main() -> anyhow::Result<()> {
            let out = run_engagement(&base, cfg, false, true).await?;
            print_findings(&out);
        }
        Cmd::Greybox { repo, url, models, creds, focus, max_agents, vote_n, offline, subscription, mcp, verbose } => {
            let url = if url.starts_with("http") { url } else { format!("https://{url}") };
            let mut cfg = RunConfig::new(&url);
            cfg.repo = Some(repo);
            cfg.max_agents = max_agents;
            cfg.vote_n = vote_n;
            cfg.offline = offline;
            cfg.subscription = subscription;
            cfg.verbose = verbose;
            cfg.instructions = focus;
            if !models.is_empty() {
                cfg.models = models;
            }
            apply_creds(&mut cfg, creds.as_deref()).await;
            let out = run_greybox_engagement(&base, cfg, mcp).await?;
            print_findings(&out);
        }
        Cmd::Tui { url, models, repo, creds, focus, max_agents, vote_n, subscription, mcp } => {
            let url = if url.starts_with("http") { url } else { format!("https://{url}") };
            let mut cfg = RunConfig::new(&url);
            cfg.max_agents = max_agents;
            cfg.vote_n = vote_n;
            cfg.subscription = subscription;
            cfg.instructions = focus;
            cfg.repo = repo.clone();
            if !models.is_empty() {
                cfg.models = models;
            }
            apply_creds(&mut cfg, creds.as_deref()).await;
            let mode = if repo.is_some() { Mode::Grey } else { Mode::Black };
            tui::run(&base, cfg, mcp, mode).await?;
        }
        Cmd::Host { target, models, creds, focus, max_agents, vote_n, offline, subscription, verbose } => {
            let mut cfg = RunConfig::new(&target);
            cfg.max_agents = max_agents;
            cfg.vote_n = vote_n;
            cfg.offline = offline;
            cfg.subscription = subscription;
            cfg.verbose = verbose;
            cfg.instructions = focus;
            if !models.is_empty() {
                cfg.models = models;
            }
            apply_creds(&mut cfg, creds.as_deref()).await;
            let out = run_mode(&base, cfg, false, Mode::Host).await?;
            print_findings(&out);
        }
    }
    Ok(())
 }
-/// Shared engagement runner for `run` / `whitebox`.
+// Helpers the TUI module reuses.
-async fn run_engagement(base: &Path, mut cfg: RunConfig, mcp: bool, whitebox: bool) -> anyhow::Result<RunOutput> {
+pub(crate) fn now_ts_pub() -> u64 { now_ts() }
-    let lib = agents::load(base);
+pub(crate) fn sanitize_pub(s: &str) -> String { sanitize(s) }
 pub(crate) fn write_status_pub(workdir: &Path, state: &str, extra: &str) { write_status(workdir, state, extra); }
-    // Unique, sortable run id → runs/<id>/
+/// Load a creds.yaml into the run config. Direct material (jwt/header/cookie) is
 /// used as-is; a `login:` flow is EXECUTED now (real HTTP) to capture a live
 /// session cookie/token. If the auto-login fails, fall back to instructing the
 /// agents to authenticate themselves.
 pub(crate) async fn apply_creds(cfg: &mut RunConfig, path: Option<&str>) {
    let Some(p) = path else { return };
    let Some(c) = harness::creds::Creds::load(Path::new(p)) else {
        eprintln!("  [!] no usable credentials in {p}");
        return;
    };
    println!("  [*] loaded credentials from {p}");
    if cfg.auth.is_none() {
        cfg.auth = c.auth_header();
    }
    // Host credentials (SSH / Windows-AD) → tell the agents how to authenticate
    // to the host so they can run on-host enumeration / privesc / AD checks.
    if let Some(hi) = c.host_instruction() {
        let base = cfg.instructions.clone().unwrap_or_default();
        cfg.instructions = Some(format!("{hi}\n{base}"));
        println!("  [*] host credentials loaded (SSH/Windows-AD)");
    }
    // No direct material but a login flow → perform it now.
    if cfg.auth.is_none() {
        if let Some(login) = &c.login {
            println!("  [*] auto-login: {} {} ...", login.method, login.url);
            match harness::creds::login(login).await {
                Ok((auth, note)) => {
                    println!("  [*] authenticated — {note}");
                    cfg.auth = Some(auth);
                }
                Err(e) => {
                    eprintln!("  [!] auto-login failed ({e}); agents will attempt to log in themselves");
                    if let Some(instr) = c.login_instruction() {
                        let base = cfg.instructions.clone().unwrap_or_default();
                        cfg.instructions = Some(format!("{instr}\n{base}"));
                    }
                }
            }
        }
    }
 }
 #[derive(Clone, Copy, PartialEq)]
 pub(crate) enum Mode { Black, White, Grey, Host }
 pub(crate) async fn run_greybox_engagement(base: &Path, cfg: RunConfig, mcp: bool) -> anyhow::Result<RunOutput> {
    run_mode(base, cfg, mcp, Mode::Grey).await
 }
 /// Shared engagement runner for `run` / `whitebox` / the interactive session.
 pub(crate) async fn run_engagement(base: &Path, cfg: RunConfig, mcp: bool, whitebox: bool) -> anyhow::Result<RunOutput> {
    run_mode(base, cfg, mcp, if whitebox { Mode::White } else { Mode::Black }).await
 }
 /// A spawned engagement: the running task, its live event stream, a cancel
 /// handle, and the run's output dir. Lets callers drive it blocking (run_mode)
 /// or in the background (the REPL), and finalize with `finalize_run`.
 pub(crate) struct Spawned {
    pub task: tokio::task::JoinHandle<RunOutput>,
    pub rx: tokio::sync::mpsc::Receiver<String>,
    pub cancel: std::sync::Arc<std::sync::atomic::AtomicBool>,
    pub soft: std::sync::Arc<std::sync::atomic::AtomicBool>,
    /// Set when the run is parked on token/quota exhaustion (awaiting /continue).
    pub paused: std::sync::Arc<std::sync::atomic::AtomicBool>,
    /// Wakes a parked run when the user runs /continue.
    pub resume: std::sync::Arc<tokio::sync::Notify>,
    /// Fallback models pushed by /continue <provider:model> before resuming.
    pub fallback: std::sync::Arc<std::sync::Mutex<Vec<ModelRef>>>,
    pub workdir: PathBuf,
 }
 /// Set up + start an engagement (synchronous setup; the work runs in the task).
 pub(crate) fn spawn_engagement(base: &Path, mut cfg: RunConfig, mcp: bool, mode: Mode) -> Spawned {
    let lib = agents::load(base);
    let run_id = format!("ns-{}-{}", now_ts(), sanitize(&cfg.target));
    let workdir = base.join("runs").join(&run_id);
    std::fs::create_dir_all(&workdir).ok();
@@ -171,31 +379,28 @@ async fn run_engagement(base: &Path, mut cfg: RunConfig, mcp: bool, whitebox: bo
    cfg.rl_path = Some(base.join("data").join("rl_state_rs.json").display().to_string());
    write_status(&workdir, "running", &format!("\"target\":{:?}", cfg.target));
-    println!("  ┌─ NeuroSploit v3.4.1  ·  by Joas A Santos & Red Team Leaders");
+    println!("  ┌─ NeuroSploit v3.5.1  ·  by Joas A Santos & Red Team Leaders");
    println!("  │  run id : {run_id}");
    println!("  │  target : {}", cfg.target);
    println!("  │  models : {}", cfg.models.join(", "));
    println!("  │  output : {}", workdir.display());
    if let Mode::Grey = mode {
        println!("  │  repo   : {}", cfg.repo.clone().unwrap_or_default());
    }
    println!("  └─ mode   : {}{}{}",
-        if whitebox { "white-box" } else { "black-box" },
+        match mode { Mode::White => "white-box", Mode::Grey => "greybox", Mode::Host => "host/infra", Mode::Black => "black-box" },
        if cfg.subscription { " · subscription" } else { " · api" },
        if mcp { " · mcp" } else { "" });
    // Playwright MCP: only for backends that support it; auto-provision if asked.
    let mcp_config = if mcp && cfg.subscription {
        let providers: Vec<String> = cfg.models.iter().map(|m| ModelRef::parse(m).provider).collect();
        if providers.iter().any(|p| harness::mcp_supported(p)) {
            match harness::ensure_playwright_mcp() {
                Ok(()) => {
                    // Optional user-supplied extra MCP servers merged into the pipeline.
                    let extra = base.join("mcp.servers.json");
                    let extra_ref = if extra.is_file() { Some(extra.as_path()) } else { None };
                    match harness::write_mcp_config(&workdir, extra_ref) {
-                    Ok(p) => {
+                        Ok(p) => { println!("  [*] Playwright MCP ready → {}", p.display()); Some(p.display().to_string()) }
                        if extra_ref.is_some() { println!("  [*] merged extra MCP servers from mcp.servers.json"); }
                        println!("  [*] Playwright MCP ready → {}", p.display());
                        Some(p.display().to_string())
                    }
                        Err(e) => { eprintln!("  [!] MCP config failed: {e}"); None }
                    }
                }
@@ -205,41 +410,112 @@ async fn run_engagement(base: &Path, mut cfg: RunConfig, mcp: bool, whitebox: bo
            eprintln!("  [!] selected backend(s) don't support MCP; using built-in tools");
            None
        }
-    } else {
+    } else { None };
        None
    };
    let refs: Vec<ModelRef> = cfg.models.iter().map(|s| ModelRef::parse(s)).collect();
    let pool = ModelPool::with_auth(refs, cfg.concurrency, cfg.subscription, mcp_config);
-
+    let cancel = pool.cancel_handle();
-    let (tx, mut rx) = tokio::sync::mpsc::channel::<String>(256);
+    let soft = pool.soft_handle();
-    let printer = tokio::spawn(async move {
+    let paused = pool.pause_handle();
-        while let Some(line) = rx.recv().await {
+    let resume = pool.resume_handle();
-            println!("  [*] {line}");
+    let fallback = pool.fallback_handle();
    let (tx, rx) = tokio::sync::mpsc::channel::<String>(256);
    let task = tokio::spawn(async move {
        match mode {
            Mode::White => harness::run_whitebox(cfg, &lib, &pool, tx).await,
            Mode::Grey => harness::run_greybox(cfg, &lib, &pool, tx).await,
            Mode::Host => harness::run_host(cfg, &lib, &pool, tx).await,
            Mode::Black => harness::run(cfg, &lib, &pool, tx).await,
        }
    });
-    let out = if whitebox {
+    Spawned { task, rx, cancel, soft, paused, resume, fallback, workdir }
-        harness::run_whitebox(cfg, &lib, &pool, tx).await
+}
-    } else {
+
-        harness::run(cfg, &lib, &pool, tx).await
+/// Absolute file:// URL of a run's report (PDF if present, else HTML).
 pub(crate) fn report_url(workdir: &Path) -> String {
    let pdf = workdir.join("report.pdf");
    let f = if pdf.is_file() { pdf } else { workdir.join("report.html") };
    let abs = f.canonicalize().unwrap_or(f);
    format!("file://{}", abs.display())
 }
 /// Generate a report directly from raw (unvalidated) findings — used by the REPL
 /// when the user chooses "report without validating" on /stop.
 pub(crate) fn report_raw(target: &str, findings: &[harness::types::Finding], workdir: &Path) {
    let mut fs = findings.to_vec();
    harness::attack_graph::enrich(&mut fs);
    std::fs::write(workdir.join("findings.json"), serde_json::to_string_pretty(&fs).unwrap_or_default()).ok();
    let _ = harness::report::typst_report(target, &fs, workdir);
    write_status(workdir, "stopped-raw", &format!("\"findings\":{}", fs.len()));
 }
 /// Generate the report + final status for a finished run, ensuring the workdir
 /// is always recorded (even on an aborted/partial run).
 pub(crate) fn finalize_run(mut out: RunOutput, workdir: &Path) -> RunOutput {
    if out.workdir.is_empty() { out.workdir = workdir.display().to_string(); }
    if out.target.is_empty() {
        out.target = workdir.file_name().and_then(|s| s.to_str()).unwrap_or("").to_string();
    }
    let _ = harness::report::typst_report(&out.target, &out.findings, workdir);
    write_status(workdir, "complete", &format!("\"findings\":{},\"agents_ran\":{}", out.findings.len(), out.agents_ran.len()));
    out
 }
 async fn run_mode(base: &Path, cfg: RunConfig, mcp: bool, mode: Mode) -> anyhow::Result<RunOutput> {
    let Spawned { mut task, mut rx, cancel, workdir, .. } = spawn_engagement(base, cfg, mcp, mode);
    let printer = tokio::spawn(async move {
        while let Some(line) = rx.recv().await { render_line(&line); }
    });
    let mut cancelled = false;
    let out: RunOutput = tokio::select! {
        r = &mut task => r.unwrap_or_default(),
        _ = tokio::signal::ctrl_c() => {
            cancelled = true;
            cancel.store(true, std::sync::atomic::Ordering::Relaxed);
            println!("\n  \x1b[33m⏸  stopping — finishing in-flight work… (Ctrl-C again to abort now)\x1b[0m");
            tokio::select! {
                r = &mut task => r.unwrap_or_default(),
                _ = tokio::signal::ctrl_c() => { task.abort(); println!("  \x1b[31m✗ aborted.\x1b[0m"); RunOutput::default() }
            }
        }
    };
    let _ = printer.await;
-    // Final report via Typst (PDF if the `typst` binary is present) + HTML/MD already written.
+    // On a graceful stop, ask whether to keep (generate report) or discard.
-    match harness::report::typst_report(&out.target, &out.findings, &workdir) {
+    if cancelled {
-        Ok(p) => println!("  [*] report → {}", p.display()),
+        let keep = ask_yes_no("Generate a report from partial results? [Y/n]");
-        Err(e) => eprintln!("  [!] typst report skipped: {e}"),
+        if !keep {
            std::fs::remove_dir_all(&workdir).ok();
            write_status(&workdir, "discarded", "");
            println!("  🗑  discarded run {}", workdir.display());
            return Ok(out);
        }
-    write_status(&workdir, "complete", &format!("\"findings\":{},\"agents_ran\":{}", out.findings.len(), out.agents_ran.len()));
+    }
-    println!("  ✓ COMPLETE — {} validated finding(s) · status: {}/status.json", out.findings.len(), workdir.display());
+
    let out = finalize_run(out, &workdir);
    println!("  ✓ COMPLETE — {} validated finding(s)", out.findings.len());
    println!("  \x1b[36mreport: {}\x1b[0m", report_url(&workdir));
    Ok(out)
 }
-fn print_findings(out: &RunOutput) {
+pub(crate) fn print_findings(out: &RunOutput) {
    println!("\n=== {} validated finding(s) ===", out.findings.len());
-    println!("{}", serde_json::to_string_pretty(&out.findings).unwrap_or_default());
+    if !out.findings.is_empty() {
        let mut by = std::collections::BTreeMap::new();
        for f in &out.findings { *by.entry(f.severity.as_str()).or_insert(0) += 1; }
        let chips: Vec<String> = by.iter().map(|(k, v)| format!("{k}:{v}")).collect();
        println!("  severity: {}", chips.join("  "));
        println!("\n  \x1b[1mAttack path / kill chain\x1b[0m");
        print!("{}", harness::attack_graph::ascii_killchain(&out.findings));
    }
    let toks = token_summary();
    if !toks.is_empty() {
        println!("\n  {toks}");
    }
    if !out.artifacts.is_empty() {
        println!("  artifacts: {}", out.artifacts.join(", "));
        println!("  (full attack graph rendered in report.html)");
    }
 }
@@ -256,52 +532,196 @@ fn now_ts() -> u64 {
    SystemTime::now().duration_since(UNIX_EPOCH).map(|d| d.as_secs()).unwrap_or(0)
 }
 /// Blocking yes/no prompt (default yes). Used after a graceful Ctrl-C.
 fn ask_yes_no(q: &str) -> bool {
    use std::io::Write;
    print!("  {q} ");
    std::io::stdout().flush().ok();
    let mut s = String::new();
    if std::io::stdin().read_line(&mut s).is_err() {
        return true;
    }
    !matches!(s.trim().to_lowercase().as_str(), "n" | "no")
 }
 // ── Activity-feed renderer ─────────────────────────────────────────────────
 // Turns the harness's tagged progress stream into a categorized feed: tool/
 // command/file events render as compact cards; everything else as a state line
 // with an icon, so it's clear what the AI is doing (no "black box").
 const RST: &str = "\x1b[0m";
 fn render_line(raw: &str) {
    let mut line = raw.trim_end();
    // Optional "@agent " prefix tags which agent produced the event.
    let mut who = String::new();
    if let Some(stripped) = line.strip_prefix('@') {
        if let Some((label, rest)) = stripped.split_once(' ') {
            who = format!("\x1b[2m[{label}]\x1b[0m ");
            line = rest;
        }
    }
    let (tag, rest) = match line.split_once(": ") {
        Some((t, r)) if matches!(t, "exec" | "danger" | "read" | "edit" | "tool" | "net" | "ai" | "plan" | "tokens" | "notify" | "finding") => (t, r),
        _ => ("", line),
    };
    match tag {
        "notify" => println!("  \x1b[1;36m🔔 {}\x1b[0m", rest.trim()),
        "finding" => println!("  \x1b[1;33m✦ possible finding\x1b[0m {who}{}", rest.trim()),
        "exec" => card(&format!("{who}⌘ command"), rest, "\x1b[33m"),
        "danger" => card(&format!("{who}⚠ DANGEROUS command"), rest, "\x1b[1;31m"),
        "read" => state("📄", "reading", &format!("{who}{rest}"), "\x1b[34m"),
        "edit" => state("✏️", "editing", &format!("{who}{rest}"), "\x1b[35m"),
        "net" => card(&format!("{who}🌐 request"), rest, "\x1b[36m"),
        "tool" => state("🔧", "tool", &format!("{who}{rest}"), "\x1b[35m"),
        "tokens" => { track_tokens(rest); state("🪙", "tokens", &format!("{who}{rest}"), "\x1b[2;33m"); }
        "ai" => state("💬", "", &format!("{who}{rest}"), "\x1b[2m"),
        "plan" => state("🧭", "plan", &format!("{who}{rest}"), "\x1b[36m"),
        _ => render_untagged(line),
    }
 }
 /// One-line styled rendering of a stream event — used by the background REPL run
 /// (via rustyline's external printer) where multi-line cards would fight the
 /// prompt. Returns None for events that shouldn't clutter the background feed.
 pub(crate) fn render_compact(raw: &str) -> Option<String> {
    let mut line = raw.trim_end();
    let mut who = String::new();
    if let Some(stripped) = line.strip_prefix('@') {
        if let Some((label, rest)) = stripped.split_once(' ') { who = format!("[{label}] "); line = rest; }
    }
    let (tag, rest) = line.split_once(": ").unwrap_or(("", line));
    if tag == "finding_json" { return None; } // captured for /results & /finding, not shown
    let s = match tag {
        "exec" | "danger" => format!("\x1b[33m  ⌘ {who}{}\x1b[0m", trunc1(rest, 110)),
        "net" => format!("\x1b[36m  🌐 {who}{}\x1b[0m", trunc1(rest, 110)),
        "read" => format!("\x1b[34m  📄 {who}{}\x1b[0m", rest),
        "tokens" => { track_tokens(rest); return None; } // counted, shown in /status
        // Candidate finding — color by severity (not all-yellow).
        "finding" => {
            let sev = rest.strip_prefix('[').and_then(|b| b.split_once(']')).map(|(s, _)| s).unwrap_or("");
            format!("  {}✦ {who}{}\x1b[0m", sev_color(sev), rest)
        }
        "notify" => format!("\x1b[1;36m  🔔 {}\x1b[0m", rest),
        "ai" => return None, // skip verbose model chatter in background feed
        _ => {
            let low = line.to_lowercase();
            if low.contains("recon complete") { "\x1b[36m  🔍 recon complete\x1b[0m".into() }
            else if low.contains("selected") && low.contains("agent") { format!("\x1b[36m  🧭 {}\x1b[0m", trunc1(line, 110)) }
            else if low.starts_with("vote") && low.contains("confirmed") { format!("\x1b[1;32m  ✓ {}\x1b[0m", trunc1(line, 110)) }
            else if low.starts_with("exploit") || low.starts_with("test ") || low.contains("launching agent") { format!("\x1b[35m  🧪 {}\x1b[0m", trunc1(line, 110)) }
            else if low.starts_with("vote") { format!("\x1b[2m  · {}\x1b[0m", trunc1(line, 110)) }
            else if low.contains("fail") || low.contains("error") { format!("\x1b[31m  ✗ {}\x1b[0m", trunc1(line, 110)) }
            else { return None; }
        }
    };
    Some(s)
 }
 /// ANSI color per severity — so confirmed/critical findings stand out instead of
 /// everything being yellow.
 fn sev_color(sev: &str) -> &'static str {
    match sev.trim() {
        "Critical" => "\x1b[1;31m",  // bold red
        "High"     => "\x1b[38;5;208m", // orange
        "Medium"   => "\x1b[33m",     // yellow
        "Low"      => "\x1b[36m",     // cyan
        _          => "\x1b[37m",     // info/grey
    }
 }
 fn trunc1(s: &str, n: usize) -> String {
    let one = s.replace('\n', " ");
    if one.chars().count() <= n { one } else { format!("{}…", one.chars().take(n).collect::<String>()) }
 }
 // Running token/cost total across the engagement (shown in the summary).
 static TOK_IN: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
 static TOK_OUT: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
 static COST_MILLI: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
 fn track_tokens(rest: &str) {
    use std::sync::atomic::Ordering::Relaxed;
    // parse "in=N out=M cost=$X.XXXX"
    for part in rest.split_whitespace() {
        if let Some(v) = part.strip_prefix("in=") { TOK_IN.fetch_add(v.parse().unwrap_or(0), Relaxed); }
        else if let Some(v) = part.strip_prefix("out=") { TOK_OUT.fetch_add(v.parse().unwrap_or(0), Relaxed); }
        else if let Some(v) = part.strip_prefix("cost=$") {
            COST_MILLI.fetch_add((v.parse::<f64>().unwrap_or(0.0) * 1000.0) as u64, Relaxed);
        }
    }
 }
 /// Render and reset the running token/cost total (called at end of a run).
 pub(crate) fn token_summary() -> String {
    use std::sync::atomic::Ordering::Relaxed;
    let i = TOK_IN.swap(0, Relaxed);
    let o = TOK_OUT.swap(0, Relaxed);
    let c = COST_MILLI.swap(0, Relaxed) as f64 / 1000.0;
    if i == 0 && o == 0 && c == 0.0 { return String::new(); }
    format!("🪙 tokens: in={i} out={o} · est. cost ${c:.4}")
 }
 fn render_untagged(l: &str) {
    let low = l.to_lowercase();
    if l.starts_with("===") {
        println!("\n\x1b[1;35m▌ {}\x1b[0m", l.trim_matches('=').trim());
    } else if low.contains("✓ complete") || low.contains("validated finding(s)") {
        println!("  \x1b[1;32m✓\x1b[0m {l}");
    } else if low.starts_with("recon") {
        state("🔍", "reconning", l.trim_start_matches("recon").trim_start_matches(' '), "\x1b[36m");
    } else if low.contains("selected") || low.contains("agent selection") || low.contains("heuristic") {
        state("🧭", "planning", l, "\x1b[36m");
    } else if low.starts_with("exploit") || low.starts_with("analyze") || low.contains("launching agent") || low.starts_with("review ") {
        state("🧪", "testing", l, "\x1b[35m");
    } else if low.starts_with("vote") {
        if low.contains("confirmed") { state("✓", "validated", l, "\x1b[32m"); }
        else { state("·", "rejected", l, "\x1b[2m"); }
    } else if low.starts_with("chain") {
        state("🔗", "chaining", l, "\x1b[36m");
    } else if low.contains("report") {
        state("📄", "report", l, "\x1b[34m");
    } else if low.contains("fail") || low.contains("error") || low.starts_with('✗') {
        println!("  \x1b[31m✗\x1b[0m {l}");
    } else {
        println!("  \x1b[2m·\x1b[0m {l}");
    }
 }
 fn state(icon: &str, kind: &str, msg: &str, color: &str) {
    let k = if kind.is_empty() { String::new() } else { format!("{color}{kind}{RST} ") };
    println!("  {icon} {k}{}", msg.trim());
 }
 /// Compact card for a tool the AI ran (the "tool runner visual").
 fn card(title: &str, body: &str, color: &str) {
    let body = body.trim();
    let width = body.chars().count().min(72);
    let bar = "─".repeat(width.max(title.chars().count()) + 2);
    println!("  {color}╭─ {title} {}{RST}", "─".repeat(bar.len().saturating_sub(title.chars().count() + 3)));
    for chunk in wrap(body, 72) {
        println!("  {color}│{RST} {chunk}");
    }
    println!("  {color}╰{}{RST}", bar);
 }
 fn wrap(s: &str, w: usize) -> Vec<String> {
    let mut out = Vec::new();
    let mut cur = String::new();
    for word in s.split_whitespace() {
        if cur.chars().count() + word.chars().count() + 1 > w && !cur.is_empty() {
            out.push(std::mem::take(&mut cur));
        }
        if !cur.is_empty() { cur.push(' '); }
        cur.push_str(word);
    }
    if !cur.is_empty() { out.push(cur); }
    if out.is_empty() { out.push(String::new()); }
    out
 }
 fn write_status(workdir: &Path, state: &str, extra: &str) {
    let p = workdir.join("status.json");
    let _ = std::fs::write(&p, format!("{{\"state\":\"{state}\",\"ts\":{}{}}}", now_ts(),
        if extra.is_empty() { String::new() } else { format!(",{extra}") }));
 }
 fn prompt(q: &str, default: &str) -> String {
    use std::io::Write;
    print!("  {q}{}: ", if default.is_empty() { String::new() } else { format!(" [{default}]") });
    std::io::stdout().flush().ok();
    let mut s = String::new();
    std::io::stdin().read_line(&mut s).ok();
    let s = s.trim().to_string();
    if s.is_empty() { default.to_string() } else { s }
 }
 /// Interactive wizard launched when `neurosploit` is run with no subcommand.
 async fn interactive(base: &Path) -> anyhow::Result<Cmd> {
    let lib = agents::load(base);
    let backends = harness::installed_cli_backends();
    println!("\n  ┌────────────────────────────────────────────┐");
    println!("  │  NeuroSploit v3.4.1 — interactive            │");
    println!("  │  by Joas A Santos & Red Team Leaders         │");
    println!("  └────────────────────────────────────────────┘");
    println!("  agents: {} · detected CLI logins: {}\n",
        lib.total(), if backends.is_empty() { "none".into() } else { backends.join(", ") });
    let mode = prompt("Mode — (b)lack-box URL or (w)hite-box repo?", "b").to_lowercase();
    let whitebox = mode.starts_with('w');
    let target = if whitebox {
        prompt("Repository path", "/tmp/DVWA")
    } else {
        prompt("Target URL", "http://testphp.vulnweb.com/")
    };
    let model = prompt("Model (provider:model)", "anthropic:claude-opus-4-8");
    let sub = prompt("Use subscription login (no API key)? (y/n)", "y").to_lowercase().starts_with('y');
    let mcp = if whitebox { false } else {
        prompt("Use Playwright MCP browser if available? (y/n)", "y").to_lowercase().starts_with('y')
    };
    let max_agents: usize = prompt("Max agents (0 = all matching)", "5").parse().unwrap_or(5);
    let vote_n: usize = prompt("Validator votes (N)", "3").parse().unwrap_or(3);
    let models = vec![model];
    Ok(if whitebox {
        Cmd::Whitebox { path: target, models, max_agents, vote_n, offline: false, subscription: sub, verbose: true }
    } else {
        Cmd::Run { url: target, models, max_agents, vote_n, offline: false, subscription: sub, mcp, verbose: true }
    })
 }
@@ -0,0 +1,304 @@
 //! NeuroSploit v3.5.1 — TUI "Mission Control" mode.
 //!
 //! Concurrent panels that update live while the engagement runs in the
 //! background, with a composer input that stays active during execution:
 //!
 //!   ┌ status header (target · mode · phase · elapsed · tokens · findings) ┐
 //!   │ live activity feed              │ findings (live)                   │
 //!   │  (recon/exploit/tool/command)   ├───────────────────────────────────┤
 //!   │                                 │ targets / queue                   │
 //!   └ composer: ask 'summary', 'pause', 'errors', or notes … ────────────┘
 //!
 //! The engagement runs as a tokio task streaming tagged events over an mpsc
 //! channel; the UI drains them each tick. The composer answers locally
 //! (summary / what-found / errors / pause) WITHOUT stopping the runner.
 use crate::Mode;
 use crossterm::event::{self, Event, KeyCode, KeyModifiers};
 use crossterm::{execute, terminal};
 use harness::{agents, models::ModelRef, pool::ModelPool, types::RunConfig};
 use ratatui::prelude::*;
 use ratatui::widgets::{Block, Borders, List, ListItem, Paragraph, Wrap};
 use std::collections::VecDeque;
 use std::io::stdout;
 use std::path::Path;
 use std::sync::atomic::Ordering;
 use std::time::{Duration, Instant};
 struct Ui {
    target: String,
    models: String,
    mode: &'static str,
    phase: String,
    started: Instant,
    feed: VecDeque<String>,
    findings: Vec<(String, String, String)>, // sev, title, endpoint
    targets: Vec<(String, String)>,          // host, state
    tin: u64,
    tout: u64,
    cost: f64,
    input: String,
    filter_errors: bool,
    done: bool,
    paused: bool,
 }
 impl Ui {
    fn new(target: &str, models: &str, mode: &'static str) -> Self {
        let host = target.replace("https://", "").replace("http://", "");
        let host = host.split('/').next().unwrap_or(&host).to_string();
        Ui {
            target: target.into(), models: models.into(), mode,
            phase: "starting".into(), started: Instant::now(),
            feed: VecDeque::new(), findings: vec![],
            targets: vec![(host, "🔄 running".into())],
            tin: 0, tout: 0, cost: 0.0, input: String::new(),
            filter_errors: false, done: false, paused: false,
        }
    }
    fn ingest(&mut self, raw: String) {
        let line = raw.trim_end().to_string();
        let low = line.to_lowercase();
        // phase tracking
        if low.contains("recon") { self.phase = "🔍 recon".into(); }
        else if low.contains("planning") || low.contains("selected") || low.contains("selection") { self.phase = "🧭 planning".into(); }
        else if low.starts_with("exploit") || low.contains("launching agent") || low.starts_with("analyze") { self.phase = "🧪 exploiting".into(); }
        else if low.starts_with("vote") || low.contains("validating") { self.phase = "✓ validating".into(); }
        else if low.starts_with("chain") { self.phase = "🔗 chaining".into(); }
        else if low.contains("phase complete") || low.contains("validated finding(s)") { self.phase = "✓ complete".into(); }
        // live findings
        if let Some(rest) = line.strip_prefix("finding: ") {
            // "[sev] title @ endpoint"
            if let Some(b) = rest.strip_prefix('[') {
                if let Some((sev, tail)) = b.split_once(']') {
                    let (title, ep) = tail.trim().split_once(" @ ").unwrap_or((tail.trim(), ""));
                    self.findings.push((sev.to_string(), title.to_string(), ep.to_string()));
                    self.note_target_from(ep);
                }
            }
            return;
        }
        // token telemetry
        if let Some(rest) = line.strip_prefix("@").and_then(|s| s.split_once(' ')).map(|(_, r)| r).filter(|r| r.starts_with("tokens:")).or_else(|| line.strip_prefix("tokens: ").map(|_| line.as_str())) {
            for part in rest.split_whitespace() {
                if let Some(v) = part.strip_prefix("in=") { self.tin += v.parse().unwrap_or(0); }
                else if let Some(v) = part.strip_prefix("out=") { self.tout += v.parse().unwrap_or(0); }
                else if let Some(v) = part.strip_prefix("cost=$") { self.cost += v.parse().unwrap_or(0.0); }
            }
        }
        let is_err = low.contains("fail") || low.contains("error") || low.starts_with('✗');
        if self.filter_errors && !is_err { return; }
        self.feed.push_back(line);
        while self.feed.len() > 500 { self.feed.pop_front(); }
    }
    fn note_target_from(&mut self, endpoint: &str) {
        let host = endpoint.replace("https://", "").replace("http://", "");
        let host = host.split('/').next().unwrap_or("").to_string();
        if !host.is_empty() && !self.targets.iter().any(|(h, _)| h == &host) {
            self.targets.push((host, "🔄 testing".into()));
        }
    }
    /// Composer command (local, non-blocking). Returns feed lines to show.
    fn composer(&mut self, cmd: &str) -> Vec<String> {
        let c = cmd.trim().to_lowercase();
        match c.as_str() {
            "" => vec![],
            "pause" | "/pause" | "stop" | "/stop" => { self.paused = true; vec!["⏸ pausing — finishing in-flight work, no new agents".into()] }
            "errors" | "/errors" => { self.filter_errors = !self.filter_errors; vec![format!("filter errors: {}", self.filter_errors)] }
            "clear" | "/clear" => { self.feed.clear(); vec![] }
            "summary" | "/summary" | "what" | "o que" | "resumo" => self.summary(),
            "findings" | "/findings" => self.summary(),
            "quit" | "/quit" | "exit" => { self.done = true; vec![] }
            other => vec![format!("noted: {other}")],
        }
    }
    fn summary(&self) -> Vec<String> {
        let mut by: std::collections::BTreeMap<&str, usize> = Default::default();
        for (s, _, _) in &self.findings { *by.entry(s.as_str()).or_insert(0) += 1; }
        let sev = if by.is_empty() { "0".into() } else { by.iter().map(|(k, v)| format!("{k}:{v}")).collect::<Vec<_>>().join(" ") };
        let mut out = vec![format!("── partial summary: {} finding(s) [{}] · phase {} ──", self.findings.len(), sev, self.phase)];
        for (s, t, _) in self.findings.iter().rev().take(5) { out.push(format!("  • [{s}] {t}")); }
        out
    }
 }
 /// Run the Mission-Control TUI for an engagement.
 pub async fn run(base: &Path, mut cfg: RunConfig, mcp: bool, mode: Mode) -> anyhow::Result<()> {
    let lib = agents::load(base);
    let run_id = format!("ns-{}-{}", crate::now_ts_pub(), crate::sanitize_pub(&cfg.target));
    let workdir = base.join("runs").join(&run_id);
    std::fs::create_dir_all(&workdir).ok();
    cfg.workdir = Some(workdir.display().to_string());
    cfg.rl_path = Some(base.join("data").join("rl_state_rs.json").display().to_string());
    cfg.verbose = true;
    let mcp_config = if mcp && cfg.subscription {
        harness::ensure_playwright_mcp().ok().and_then(|_| harness::write_mcp_config(&workdir, None).ok())
            .map(|p| p.display().to_string())
    } else { None };
    let refs: Vec<ModelRef> = cfg.models.iter().map(|s| ModelRef::parse(s)).collect();
    let pool = ModelPool::with_auth(refs, cfg.concurrency, cfg.subscription, mcp_config);
    let cancel = pool.cancel_handle();
    let (tx, mut rx) = tokio::sync::mpsc::channel::<String>(512);
    let models = cfg.models.join(", ");
    let mode_s = match mode { Mode::White => "white-box", Mode::Grey => "greybox", Mode::Host => "host/infra", Mode::Black => "black-box" };
    let target_s = cfg.target.clone();
    // ---- terminal setup FIRST: on a non-TTY this errors before we spawn any
    // live engagement, so we never detach a running task. ----
    terminal::enable_raw_mode()?;
    execute!(stdout(), terminal::EnterAlternateScreen)?;
    let mut term = Terminal::new(CrosstermBackend::new(stdout()))?;
    let mut ui = Ui::new(&target_s, &models, mode_s);
    let mut task = tokio::spawn(async move {
        match mode {
            Mode::White => harness::run_whitebox(cfg, &lib, &pool, tx).await,
            Mode::Grey => harness::run_greybox(cfg, &lib, &pool, tx).await,
            Mode::Host => harness::run_host(cfg, &lib, &pool, tx).await,
            Mode::Black => harness::run(cfg, &lib, &pool, tx).await,
        }
    });
    let out;
    loop {
        // drain engagement events
        while let Ok(line) = rx.try_recv() { ui.ingest(line); }
        // engagement finished?
        if task.is_finished() {
            ui.done = true;
            ui.phase = "✓ complete".into();
            if let Some((_, st)) = ui.targets.get_mut(0) { *st = "✅ done".into(); }
        }
        draw(&mut term, &ui)?;
        // input (100ms tick keeps the UI live while the runner works)
        if event::poll(Duration::from_millis(120))? {
            if let Event::Key(k) = event::read()? {
                let ctrl_c = k.modifiers.contains(KeyModifiers::CONTROL) && k.code == KeyCode::Char('c');
                match k.code {
                    KeyCode::Esc => { cancel.store(true, Ordering::Relaxed); if ui.done { break; } ui.paused = true; }
                    KeyCode::Char('c') if ctrl_c => { cancel.store(true, Ordering::Relaxed); if ui.done { break; } ui.paused = true; }
                    KeyCode::Enter => {
                        let line = std::mem::take(&mut ui.input);
                        if matches!(line.trim(), "quit" | "/quit" | "exit") && ui.done { break; }
                        let lines = ui.composer(&line);
                        if ui.paused { cancel.store(true, Ordering::Relaxed); }
                        for l in lines { ui.feed.push_back(l); }
                    }
                    KeyCode::Backspace => { ui.input.pop(); }
                    KeyCode::Char(c) => { ui.input.push(c); }
                    _ => {}
                }
            }
        }
        if ui.done && task.is_finished() && ui.input.is_empty() {
            // brief grace so the final frame is visible; exit on next Esc/Enter handled above
        }
    }
    out = (&mut task).await.unwrap_or_default();
    // ---- restore terminal ----
    execute!(stdout(), terminal::LeaveAlternateScreen)?;
    terminal::disable_raw_mode()?;
    // generate report unless discarded; print a plain summary after leaving the TUI
    match harness::report::typst_report(&out.target, &out.findings, &workdir) {
        Ok(p) => println!("  report → {}", p.display()),
        Err(_) => {}
    }
    crate::write_status_pub(&workdir, if cancel.load(Ordering::Relaxed) { "stopped" } else { "complete" }, "");
    println!("  ✓ {} validated finding(s) · {}", out.findings.len(), workdir.display());
    Ok(())
 }
 fn sevstyle(s: &str) -> Style {
    match s {
        "Critical" => Style::new().fg(Color::Red).bold(),
        "High" => Style::new().fg(Color::Rgb(251, 146, 60)),
        "Medium" => Style::new().fg(Color::Yellow),
        "Low" => Style::new().fg(Color::Cyan),
        _ => Style::new().fg(Color::Gray),
    }
 }
 fn draw(term: &mut Terminal<CrosstermBackend<std::io::Stdout>>, ui: &Ui) -> anyhow::Result<()> {
    term.draw(|f| {
        let root = Layout::vertical([
            Constraint::Length(3), // header
            Constraint::Min(5),    // body
            Constraint::Length(3), // composer
        ]).split(f.area());
        // ── header ──
        let el = ui.started.elapsed().as_secs();
        let accent = Style::new().fg(Color::Rgb(139, 92, 246)).bold();
        let header = Line::from(vec![
            Span::styled(" 🧠 NeuroSploit ", accent),
            Span::raw(format!("│ {} ", ui.target)),
            Span::styled(format!("│ {} ", ui.mode), Style::new().fg(Color::Magenta)),
            Span::styled(format!("│ {} ", short_models(&ui.models)), Style::new().fg(Color::DarkGray)),
            Span::styled(format!("│ {} ", ui.phase), Style::new().fg(Color::Cyan)),
            Span::raw(format!("│ {:02}:{:02} ", el / 60, el % 60)),
            Span::styled(format!("│ {} findings ", ui.findings.len()), Style::new().fg(Color::Yellow)),
            Span::raw(format!("│ 🪙 {}/{} ${:.3} ", ui.tin, ui.tout, ui.cost)),
            if ui.paused { Span::styled("│ ⏸ stopping ", Style::new().fg(Color::Red)) } else { Span::raw("") },
        ]);
        f.render_widget(Paragraph::new(header).block(Block::default().borders(Borders::ALL)
            .title(" Mission Control ").border_style(accent)), root[0]);
        // ── body: feed | (findings / targets) ──
        let body = Layout::horizontal([Constraint::Percentage(60), Constraint::Percentage(40)]).split(root[1]);
        let feed_h = body[0].height.saturating_sub(2) as usize;
        let feed: Vec<ListItem> = ui.feed.iter().rev().take(feed_h).rev()
            .map(|l| ListItem::new(feed_span(l))).collect();
        f.render_widget(List::new(feed).block(Block::default().borders(Borders::ALL)
            .title(format!(" Activity{} ", if ui.filter_errors { " [errors]" } else { "" }))), body[0]);
        let right = Layout::vertical([Constraint::Percentage(60), Constraint::Percentage(40)]).split(body[1]);
        let finds: Vec<ListItem> = ui.findings.iter().rev().take(right[0].height.saturating_sub(2) as usize)
            .map(|(s, t, _)| ListItem::new(Line::from(vec![
                Span::styled(format!("[{s}] "), sevstyle(s)), Span::raw(t.clone())]))).collect();
        f.render_widget(List::new(finds).block(Block::default().borders(Borders::ALL)
            .title(format!(" Findings ({}) ", ui.findings.len()))), right[0]);
        let tg: Vec<ListItem> = ui.targets.iter()
            .map(|(h, st)| ListItem::new(format!("{st}  {h}"))).collect();
        f.render_widget(List::new(tg).block(Block::default().borders(Borders::ALL).title(" Targets ")), right[1]);
        // ── composer ──
        let hint = if ui.done { "engagement done — type quit/Esc to exit · summary" }
                   else { "composer (runner active): summary · pause · errors · clear · or a note" };
        let comp = Paragraph::new(Line::from(vec![
            Span::styled("› ", accent), Span::raw(&ui.input),
            Span::styled("▏", Style::new().fg(Color::Rgb(139, 92, 246))),
        ])).block(Block::default().borders(Borders::ALL).title(format!(" {hint} "))).wrap(Wrap { trim: false });
        f.render_widget(comp, root[2]);
    })?;
    Ok(())
 }
 fn short_models(m: &str) -> String {
    // show just the first model's name, compactly
    m.split(',').next().unwrap_or(m).split(':').next_back().unwrap_or(m).trim().to_string()
 }
 fn feed_span(l: &str) -> Line<'static> {
    let low = l.to_lowercase();
    let (color, s) = if l.starts_with("finding:") || l.contains("possible finding") { (Color::Yellow, l) }
        else if l.starts_with("notify:") || l.contains('🔔') { (Color::Cyan, l) }
        else if low.contains("fail") || low.contains("error") || l.starts_with('✗') { (Color::Red, l) }
        else if low.contains("exec:") || low.contains("command") || low.contains("curl") { (Color::Rgb(230, 180, 100), l) }
        else if low.contains("recon") || low.contains("vote") || low.contains("chain") { (Color::Cyan, l) }
        else { (Color::Gray, l) };
    Line::from(Span::styled(s.to_string(), Style::new().fg(color)))
 }
@@ -23,11 +23,14 @@ pub struct Library {
    pub meta: Vec<Agent>,
    pub recon: Vec<Agent>,
    pub code: Vec<Agent>,
    pub infra: Vec<Agent>,
    pub chains: Vec<Agent>,
 }
 impl Library {
    pub fn total(&self) -> usize {
        self.vulns.len() + self.meta.len() + self.recon.len() + self.code.len()
            + self.infra.len() + self.chains.len()
    }
 }
@@ -39,6 +42,8 @@ pub fn load(base: &Path) -> Library {
        meta: load_dir(&root.join("meta"), "meta"),
        recon: load_dir(&root.join("recon"), "recon"),
        code: load_dir(&root.join("code"), "code"),
        infra: load_dir(&root.join("infra"), "infra"),
        chains: load_dir(&root.join("chains"), "chain"),
    }
 }
@@ -0,0 +1,138 @@
 //! Attack graph & kill-chain mapping.
 //!
 //! Enriches findings with OWASP Top 10 / MITRE ATT&CK / kill-chain stage /
 //! exploitability (derived from CWE + severity when the model didn't supply
 //! them), then renders an attack-path graph (Mermaid) and a kill-chain table for
 //! the report, plus a compact ASCII summary for the REPL.
 use crate::types::Finding;
 /// CWE → (OWASP Top 10 2021, MITRE ATT&CK technique, kill-chain stage).
 fn map_cwe(cwe: &str) -> (&'static str, &'static str, &'static str) {
    let n: u32 = cwe.trim_start_matches("CWE-").parse().unwrap_or(0);
    match n {
        89 | 943 => ("A03:2021-Injection", "T1190", "initial-access"),
        77 | 78 | 94 | 95 | 917 | 1336 => ("A03:2021-Injection", "T1059", "execution"),
        79 | 80 => ("A03:2021-Injection", "T1059.007", "execution"),
        90 => ("A03:2021-Injection", "T1190", "initial-access"),
        611 | 776 => ("A05:2021-Security-Misconfiguration", "T1190", "initial-access"),
        918 => ("A10:2021-SSRF", "T1090", "lateral"),
        22 | 23 | 98 | 73 => ("A01:2021-Broken-Access-Control", "T1083", "execution"),
        639 | 862 | 863 | 284 | 285 => ("A01:2021-Broken-Access-Control", "T1078", "privesc"),
        287 | 384 | 613 | 620 => ("A07:2021-Auth-Failures", "T1078", "initial-access"),
        798 | 522 | 321 | 256 | 257 | 312 | 319 => ("A07:2021-Auth-Failures", "T1552", "credential-access"),
        502 => ("A08:2021-Software-Data-Integrity", "T1059", "execution"),
        327 | 328 | 916 | 326 | 330 => ("A02:2021-Cryptographic-Failures", "T1600", "credential-access"),
        200 | 209 | 538 | 540 | 532 => ("A05:2021-Security-Misconfiguration", "T1592", "recon"),
        601 => ("A01:2021-Broken-Access-Control", "T1566", "initial-access"),
        352 => ("A01:2021-Broken-Access-Control", "T1189", "execution"),
        434 => ("A04:2021-Insecure-Design", "T1505.003", "execution"),
        1321 | 915 => ("A08:2021-Software-Data-Integrity", "T1059", "execution"),
        400 | 770 | 1333 | 799 => ("A04:2021-Insecure-Design", "T1499", "impact"),
        _ => ("A04:2021-Insecure-Design", "T1190", "initial-access"),
    }
 }
 fn exploitability(sev: &str, conf: f64) -> &'static str {
    match (sev, conf) {
        (_, c) if c >= 0.85 => "trivial",
        ("Critical" | "High", _) => "moderate",
        _ => "hard",
    }
 }
 /// Fill in any empty mapping fields on each finding (does not overwrite model-set values).
 pub fn enrich(findings: &mut [Finding]) {
    for f in findings.iter_mut() {
        let (owasp, mitre, stage) = map_cwe(&f.cwe);
        if f.owasp.is_empty() { f.owasp = owasp.into(); }
        if f.mitre.is_empty() { f.mitre = mitre.into(); }
        if f.stage.is_empty() { f.stage = stage.into(); }
        if f.exploitability.is_empty() { f.exploitability = exploitability(&f.severity, f.confidence).into(); }
        if f.business_impact.is_empty() { f.business_impact = f.impact.clone(); }
    }
 }
 const STAGE_ORDER: &[&str] = &[
    "recon", "initial-access", "execution", "credential-access", "privesc", "lateral", "exfil", "impact",
 ];
 fn stage_rank(s: &str) -> usize {
    STAGE_ORDER.iter().position(|x| *x == s).unwrap_or(STAGE_ORDER.len())
 }
 /// Mermaid flowchart of the attack path: findings grouped by kill-chain stage,
 /// with explicit chains_from edges plus implicit stage→stage progression.
 pub fn mermaid(findings: &[Finding]) -> String {
    if findings.is_empty() {
        return String::new();
    }
    let mut out = String::from("flowchart LR\n");
    // stage subgraphs
    let mut by_stage: std::collections::BTreeMap<usize, Vec<&Finding>> = Default::default();
    for f in findings {
        by_stage.entry(stage_rank(&f.stage)).or_default().push(f);
    }
    let node_id = |f: &Finding| -> String {
        format!("n{}", sanitize_id(&f.id))
    };
    for (rank, group) in &by_stage {
        let stage = STAGE_ORDER.get(*rank).copied().unwrap_or("other");
        out.push_str(&format!("  subgraph S{rank}[\"{}\"]\n", stage));
        for f in group {
            out.push_str(&format!("    {}[\"{}<br/>{} · {}\"]\n",
                node_id(f), esc(&f.title), esc(&f.severity), esc(&f.owasp)));
        }
        out.push_str("  end\n");
    }
    // explicit chain edges
    let ids: std::collections::HashMap<&str, &Finding> = findings.iter().map(|f| (f.id.as_str(), f)).collect();
    let mut had_edge = false;
    for f in findings {
        for src in &f.chains_from {
            if let Some(sf) = ids.get(src.as_str()) {
                out.push_str(&format!("  {} --> {}\n", node_id(sf), node_id(f)));
                had_edge = true;
            }
        }
    }
    // implicit progression between consecutive populated stages if no explicit edges
    if !had_edge && by_stage.len() > 1 {
        let ranks: Vec<usize> = by_stage.keys().copied().collect();
        for w in ranks.windows(2) {
            if let (Some(a), Some(b)) = (by_stage[&w[0]].first(), by_stage[&w[1]].first()) {
                out.push_str(&format!("  {} -.-> {}\n", node_id(a), node_id(b)));
            }
        }
    }
    out
 }
 /// Compact ASCII kill-chain for the REPL: one line per stage with its findings.
 pub fn ascii_killchain(findings: &[Finding]) -> String {
    if findings.is_empty() {
        return "  (no findings to map)".into();
    }
    let mut by_stage: std::collections::BTreeMap<usize, Vec<&Finding>> = Default::default();
    for f in findings {
        by_stage.entry(stage_rank(&f.stage)).or_default().push(f);
    }
    let mut out = String::new();
    for (rank, group) in &by_stage {
        let stage = STAGE_ORDER.get(*rank).copied().unwrap_or("other");
        out.push_str(&format!("  ▸ {:<16} ", stage));
        let items: Vec<String> = group.iter()
            .map(|f| format!("[{}] {} ({})", f.severity, f.title, f.mitre))
            .collect();
        out.push_str(&items.join("\n                     "));
        out.push('\n');
    }
    out
 }
 fn sanitize_id(s: &str) -> String {
    s.chars().map(|c| if c.is_alphanumeric() { c } else { '_' }).take(24).collect()
 }
 fn esc(s: &str) -> String {
    s.replace('"', "'").replace('\n', " ").chars().take(60).collect()
 }
@@ -0,0 +1,146 @@
 //! POMDP belief-state world model (v3.5.1).
 //!
 //! The target is only partially observable, so we don't track booleans — we
 //! track a **belief**: a property graph whose nodes (host / service / vuln /
 //! credential) each carry a probability that the proposition is true. Recon
 //! produces *observations* that update those beliefs via a Bayesian step; the
 //! per-node Shannon entropy measures how diffuse the belief still is.
 //!
 //! - **Black-box**: beliefs start uncertain (~0.5) and sharpen with observation.
 //! - **White-box**: the world model is built (near-)deterministically from
 //!   source/SAST, so beliefs collapse toward 0/1 — the POMDP degenerates into an
 //!   MDP and uncertainty migrates to *path reachability*, not state.
 //!
 //! This is the substrate for value-of-information planning (see `pomdp.rs`): when
 //! a node's belief is diffuse, gathering an observation about it is worth more
 //! than acting on it — which is also the anti-hallucination criterion.
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 /// What a belief node is about.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub enum Kind {
    Host,       // a host exists / is reachable
    Service,    // a service/endpoint is present
    Vuln,       // a specific weakness is present
    Exploit,    // the weakness is actually exploitable
    Credential, // a credential is valid
 }
 /// A single proposition with a probability of being true and the evidence count
 /// behind it (used for confidence/entropy).
 #[derive(Clone, Debug, Serialize, Deserialize)]
 pub struct Node {
    pub id: String,
    pub kind: Kind,
    pub label: String,
    /// P(proposition is true) ∈ [0,1].
    pub p: f64,
    /// number of independent observations folded in.
    pub obs: u32,
 }
 impl Node {
    /// Shannon entropy in bits of the Bernoulli(p) belief — 1.0 = maximally
    /// uncertain (p=0.5), 0.0 = certain.
    pub fn entropy(&self) -> f64 {
        let p = self.p.clamp(1e-6, 1.0 - 1e-6);
        -(p * p.log2() + (1.0 - p) * (1.0 - p).log2())
    }
 }
 /// A directed edge: "from enables/leads-to to" with a transition probability.
 #[derive(Clone, Debug, Serialize, Deserialize)]
 pub struct Edge {
    pub from: String,
    pub to: String,
    pub p: f64,
 }
 /// The belief: a property graph over the partially-observed target.
 #[derive(Default, Clone, Serialize, Deserialize)]
 pub struct WorldModel {
    pub nodes: HashMap<String, Node>,
    pub edges: Vec<Edge>,
    /// true once beliefs were built deterministically (white-box → MDP regime).
    pub deterministic: bool,
 }
 /// A sensed observation about a node: P(observation | true) vs P(observation | false).
 /// `positive` true means the observation supports the proposition.
 pub struct Observation<'a> {
    pub node: &'a str,
    pub positive: bool,
    /// sensor reliability ∈ (0.5, 1.0]; how much one observation moves the belief.
    pub reliability: f64,
 }
 impl WorldModel {
    pub fn new() -> Self {
        WorldModel::default()
    }
    /// Seed a node with a prior. Black-box priors are ~0.5 (unknown); white-box
    /// callers pass priors near 0/1.
    pub fn add(&mut self, id: &str, kind: Kind, label: &str, prior: f64) {
        self.nodes.entry(id.to_string()).or_insert_with(|| Node {
            id: id.to_string(),
            kind,
            label: label.to_string(),
            p: prior.clamp(0.0, 1.0),
            obs: 0,
        });
    }
    pub fn link(&mut self, from: &str, to: &str, p: f64) {
        self.edges.push(Edge { from: from.into(), to: to.into(), p: p.clamp(0.0, 1.0) });
    }
    /// Bayesian update of a node's belief from one observation. With sensor
    /// reliability r: a positive obs multiplies the odds by r/(1-r), a negative
    /// one by (1-r)/r.
    pub fn observe(&mut self, o: Observation) {
        let r = o.reliability.clamp(0.5 + 1e-6, 1.0 - 1e-6);
        if let Some(n) = self.nodes.get_mut(o.node) {
            let p = n.p.clamp(1e-6, 1.0 - 1e-6);
            let prior_odds = p / (1.0 - p);
            let lr = if o.positive { r / (1.0 - r) } else { (1.0 - r) / r };
            let post_odds = prior_odds * lr;
            n.p = post_odds / (1.0 + post_odds);
            n.obs += 1;
        }
    }
    /// Collapse a node to (near-)certainty — used by white-box when SAST/dataflow
    /// determines the proposition deterministically.
    pub fn set_known(&mut self, id: &str, truth: bool) {
        if let Some(n) = self.nodes.get_mut(id) {
            n.p = if truth { 0.98 } else { 0.02 };
            n.obs += 3;
        }
    }
    /// Mean entropy across nodes of a kind (or all). 1.0 = totally diffuse.
    pub fn uncertainty(&self, kind: Option<Kind>) -> f64 {
        let rel: Vec<&Node> = self.nodes.values()
            .filter(|n| kind.map(|k| n.kind == k).unwrap_or(true)).collect();
        if rel.is_empty() {
            return 1.0;
        }
        rel.iter().map(|n| n.entropy()).sum::<f64>() / rel.len() as f64
    }
    /// Nodes whose belief is still diffuse (entropy above `thresh`) — the recon
    /// frontier: where collecting an observation has the highest value.
    pub fn frontier(&self, thresh: f64) -> Vec<&Node> {
        let mut v: Vec<&Node> = self.nodes.values().filter(|n| n.entropy() > thresh).collect();
        v.sort_by(|a, b| b.entropy().partial_cmp(&a.entropy()).unwrap_or(std::cmp::Ordering::Equal));
        v
    }
    /// Is a proposition confident enough to *act/assert* on? (low entropy + high p)
    pub fn is_confident(&self, id: &str, min_p: f64, max_entropy: f64) -> bool {
        self.nodes.get(id).map(|n| n.p >= min_p && n.entropy() <= max_entropy).unwrap_or(false)
    }
 }
@@ -0,0 +1,253 @@
 //! Credential loading for authenticated testing (`creds.yaml`).
 //!
 //! Dependency-free parser for a small YAML subset: flat `key: value` pairs plus
 //! one nested `login:` block (2-space indent). Lets the operator hand the
 //! harness a JWT / header / cookie, or a login flow the agents should perform so
 //! they test the target as an authenticated user.
 //!
 //! Example `creds.yaml`:
 //! ```yaml
 //! jwt: eyJhbGciOi...                 # → Authorization: Bearer <jwt>
 //! # header: "X-Api-Key: abc123"      # raw header (alternative)
 //! # cookie: "session=deadbeef"       # → Cookie: session=deadbeef
 //! login:
 //!   url: http://app/login
 //!   method: POST
 //!   username_field: uid
 //!   password_field: passw
 //!   username: admin
 //!   password: admin
 //!   success: Logout
 //! ```
 #[derive(Default, Debug, Clone)]
 pub struct Login {
    pub url: String,
    pub method: String,
    pub username_field: String,
    pub password_field: String,
    pub username: String,
    pub password: String,
    pub success: String,
 }
 /// SSH credentials for Linux host testing.
 #[derive(Default, Debug, Clone)]
 pub struct Ssh {
    pub host: String,
    pub port: String,   // default 22
    pub user: String,
    pub password: String,
    pub key: String,    // path to a private key
 }
 /// Windows / Active Directory credentials.
 #[derive(Default, Debug, Clone)]
 pub struct Win {
    pub host: String,
    pub user: String,
    pub password: String,
    pub domain: String,
    pub hash: String,   // NTLM hash for pass-the-hash (LM:NT or NT)
 }
 #[derive(Default, Debug, Clone)]
 pub struct Creds {
    pub jwt: Option<String>,
    pub header: Option<String>,
    pub cookie: Option<String>,
    pub login: Option<Login>,
    pub ssh: Option<Ssh>,
    pub win: Option<Win>,
 }
 impl Creds {
    pub fn load(path: &std::path::Path) -> Option<Creds> {
        let text = std::fs::read_to_string(path).ok()?;
        let mut c = Creds::default();
        let mut login = Login { method: "POST".into(), ..Default::default() };
        let mut ssh = Ssh { port: "22".into(), ..Default::default() };
        let mut win = Win::default();
        let (mut have_login, mut have_ssh, mut have_win) = (false, false, false);
        let mut block = ""; // "", "login", "ssh", "windows"
        for raw in text.lines() {
            let line = raw.split('#').next().unwrap_or("");
            if line.trim().is_empty() {
                continue;
            }
            let indented = line.starts_with(' ') || line.starts_with('\t');
            let (k, v) = match line.split_once(':') {
                Some((k, v)) => (k.trim().to_string(), unquote(v.trim())),
                None => continue,
            };
            // Enter a nested block (header line with empty value).
            if v.is_empty() && !indented {
                block = match k.as_str() {
                    "login" => { have_login = true; "login" }
                    "ssh" => { have_ssh = true; "ssh" }
                    "windows" | "win" | "ad" => { have_win = true; "windows" }
                    _ => "",
                };
                continue;
            }
            if indented {
                match block {
                    "login" => match k.as_str() {
                        "url" => login.url = v,
                        "method" => login.method = v.to_uppercase(),
                        "username_field" => login.username_field = v,
                        "password_field" => login.password_field = v,
                        "username" | "user" => login.username = v,
                        "password" | "pass" => login.password = v,
                        "success" => login.success = v,
                        _ => {}
                    },
                    "ssh" => match k.as_str() {
                        "host" | "ip" => ssh.host = v,
                        "port" => ssh.port = v,
                        "user" | "username" => ssh.user = v,
                        "password" | "pass" => ssh.password = v,
                        "key" | "keyfile" | "identity" => ssh.key = v,
                        _ => {}
                    },
                    "windows" => match k.as_str() {
                        "host" | "ip" => win.host = v,
                        "user" | "username" => win.user = v,
                        "password" | "pass" => win.password = v,
                        "domain" => win.domain = v,
                        "hash" | "ntlm" => win.hash = v,
                        _ => {}
                    },
                    _ => {}
                }
                continue;
            }
            block = "";
            match k.as_str() {
                "jwt" | "token" => c.jwt = Some(v),
                "header" => c.header = Some(v),
                "cookie" => c.cookie = Some(v),
                _ => {}
            }
        }
        if have_login && !login.url.is_empty() { c.login = Some(login); }
        if have_ssh && !ssh.host.is_empty() { c.ssh = Some(ssh); }
        if have_win && !win.host.is_empty() { c.win = Some(win); }
        if c.jwt.is_none() && c.header.is_none() && c.cookie.is_none()
            && c.login.is_none() && c.ssh.is_none() && c.win.is_none() {
            return None;
        }
        Some(c)
    }
    /// A directive describing the host credentials available to the agents, so
    /// they can authenticate to Linux (SSH) / Windows (AD) hosts.
    pub fn host_instruction(&self) -> Option<String> {
        let mut s = String::new();
        if let Some(h) = &self.ssh {
            let auth = if !h.key.is_empty() { format!("private key {}", h.key) } else { "password (provided)".into() };
            s.push_str(&format!(
                "SSH ACCESS (Linux): host {}:{} as user '{}' via {}. Use `ssh`/`sshpass` to run \
                 enumeration and privilege-escalation checks on the host.\n",
                h.host, h.port, h.user, auth));
        }
        if let Some(w) = &self.win {
            let auth = if !w.hash.is_empty() { "NTLM hash (pass-the-hash)".to_string() } else { "password".into() };
            s.push_str(&format!(
                "WINDOWS/AD ACCESS: host {} domain '{}' as user '{}' via {}. Use tools like \
                 crackmapexec/netexec, impacket, evil-winrm, bloodhound-python for host and AD checks.\n",
                w.host, if w.domain.is_empty() { "(workgroup)" } else { &w.domain }, w.user, auth));
        }
        if s.is_empty() { None } else { Some(s) }
    }
    /// The auth material to send with each request, as a header line.
    pub fn auth_header(&self) -> Option<String> {
        if let Some(h) = &self.header {
            return Some(h.clone());
        }
        if let Some(j) = &self.jwt {
            return Some(format!("Authorization: Bearer {j}"));
        }
        if let Some(ck) = &self.cookie {
            return Some(format!("Cookie: {ck}"));
        }
        None
    }
    /// A directive instructing the agent to authenticate first via curl.
    pub fn login_instruction(&self) -> Option<String> {
        let l = self.login.as_ref()?;
        Some(format!(
            "AUTHENTICATE FIRST: {} {} with {}={} and {}={}; capture the session cookie/token \
             from the response (success indicator: \"{}\") and reuse it on every subsequent request.",
            l.method, l.url, l.username_field, l.username, l.password_field, l.password, l.success
        ))
    }
 }
 /// Perform the login flow now (real HTTP POST) and return an auth header to
 /// reuse on every subsequent request: a `Cookie:` from Set-Cookie, or an
 /// `Authorization: Bearer` from a token in the JSON response. Returns
 /// (auth_header, note). Redirects are not followed so the login response's
 /// Set-Cookie is visible.
 pub async fn login(l: &Login) -> anyhow::Result<(String, String)> {
    use reqwest::header::SET_COOKIE;
    let client = reqwest::Client::builder()
        .redirect(reqwest::redirect::Policy::none())
        .timeout(std::time::Duration::from_secs(30))
        .build()?;
    let form: Vec<(String, String)> = vec![
        (l.username_field.clone(), l.username.clone()),
        (l.password_field.clone(), l.password.clone()),
    ];
    let req = if l.method == "GET" {
        client.get(&l.url).query(&form)
    } else {
        client.post(&l.url).form(&form)
    };
    let resp = req.send().await?;
    let status = resp.status();
    // 1) session cookies from Set-Cookie on the login response
    let mut cookie_pairs = Vec::new();
    for hv in resp.headers().get_all(SET_COOKIE) {
        if let Ok(s) = hv.to_str() {
            if let Some(pair) = s.split(';').next() {
                let p = pair.trim();
                if !p.is_empty() {
                    cookie_pairs.push(p.to_string());
                }
            }
        }
    }
    let body = resp.text().await.unwrap_or_default();
    // 2) bearer token from a JSON response body
    if let Ok(v) = serde_json::from_str::<serde_json::Value>(&body) {
        for k in ["access_token", "token", "jwt", "id_token", "accessToken"] {
            if let Some(t) = v.get(k).and_then(|x| x.as_str()).filter(|t| !t.is_empty()) {
                return Ok((format!("Authorization: Bearer {t}"), format!("bearer token from JSON `{k}` (HTTP {status})")));
            }
        }
    }
    if !cookie_pairs.is_empty() {
        let cookie = cookie_pairs.join("; ");
        // Soft success check (don't fail hard — many apps 302 on success).
        let ok = l.success.is_empty() || body.contains(&l.success) || status.is_redirection() || status.is_success();
        let note = format!("session cookie captured (HTTP {status}{})", if ok { "" } else { ", success marker not seen" });
        return Ok((format!("Cookie: {cookie}"), note));
    }
    anyhow::bail!("login returned no Set-Cookie or token (HTTP {status})")
 }
 fn unquote(s: &str) -> String {
    let s = s.trim();
    if (s.starts_with('"') && s.ends_with('"') && s.len() >= 2)
        || (s.starts_with('\'') && s.ends_with('\'') && s.len() >= 2)
    {
        s[1..s.len() - 1].to_string()
    } else {
        s.to_string()
    }
 }
@@ -0,0 +1,87 @@
 //! Verification / grounding engine (v3.5.1).
 //!
 //! Hard rule: **no claim enters the world model without a tool receipt** — raw
 //! tool output, not the LLM's paraphrase. This is the empirical anti-hallucination
 //! anchor that complements the POMDP belief gate:
 //!
 //! - **Black-box**: grounding is empirical — the finding's evidence must look
 //!   like raw tool output (an HTTP response, an OOB callback, an error oracle),
 //!   not prose.
 //! - **White-box**: grounding is symbolic — a file:line reference into the
 //!   reviewed source (reachability/taint), checked against the collected context.
 //!
 //! Ungrounded claims are flagged (`receipt_missing`) so the reward layer can
 //! penalize them (the "claim without receipt" term).
 use crate::types::Finding;
 /// Verdict of grounding a single finding.
 pub struct Grounded {
    pub ok: bool,
    pub kind: &'static str, // "empirical" | "symbolic" | "missing"
    pub reason: String,
 }
 /// Markers that suggest the evidence is a real tool receipt rather than prose.
 fn looks_empirical(evidence: &str) -> bool {
    let e = evidence.to_lowercase();
    let markers = [
        "http/", "status", "200", "301", "302", "401", "403", "500",
        "set-cookie", "location:", "content-type", "<html", "<script",
        "server:", "x-", "alert(", "uid=", "root:", "sql", "error", "stack",
        "callback", "oob", "collaborator", "$ ", "# ", "curl", "nmap",
    ];
    evidence.len() >= 24 && markers.iter().filter(|m| e.contains(*m)).count() >= 2
 }
 /// White-box: evidence should reference a source location present in `context`.
 fn looks_symbolic(f: &Finding, context: &str) -> bool {
    // endpoint like file.ext:line, and the file appears in the reviewed source.
    let loc = &f.endpoint;
    if let Some((file, _)) = loc.rsplit_once(':') {
        let base = file.rsplit('/').next().unwrap_or(file);
        if !base.is_empty() && context.contains(base) {
            return true;
        }
    }
    // or the evidence quotes code that is actually in the context
    !f.evidence.trim().is_empty()
        && f.evidence.split_whitespace().take(6).collect::<Vec<_>>().join(" ")
            .split_whitespace()
            .filter(|t| t.len() > 4 && context.contains(*t))
            .count()
            >= 2
 }
 /// Ground a finding. `context` is the reviewed source for white-box (empty for
 /// black-box). Returns whether it has a valid receipt and of what kind.
 pub fn ground(f: &Finding, context: &str, whitebox: bool) -> Grounded {
    if whitebox && !context.is_empty() {
        if looks_symbolic(f, context) {
            return Grounded { ok: true, kind: "symbolic", reason: "source location/quote matches reviewed code".into() };
        }
        return Grounded { ok: false, kind: "missing", reason: "no source reference into reviewed code".into() };
    }
    if looks_empirical(&f.evidence) {
        Grounded { ok: true, kind: "empirical", reason: "evidence resembles raw tool output".into() }
    } else {
        Grounded { ok: false, kind: "missing", reason: "evidence is paraphrase, not a tool receipt".into() }
    }
 }
 /// Apply the grounding gate to a finding set. Ungrounded findings are flagged
 /// (receipt recorded in `votes`) and demoted to unvalidated so they never get
 /// reported as confirmed. Returns (kept, demoted_count).
 pub fn gate(mut findings: Vec<Finding>, context: &str, whitebox: bool) -> (Vec<Finding>, usize) {
    let mut demoted = 0;
    for f in findings.iter_mut() {
        let g = ground(f, context, whitebox);
        if !g.ok {
            f.validated = false;
            f.votes = format!("{} · receipt_missing", f.votes);
            demoted += 1;
        }
    }
    findings.retain(|f| f.validated);
    (findings, demoted)
 }
@@ -1,4 +1,4 @@
-//! NeuroSploit v3.4.1 harness — a robust multi-model runtime for the
+//! NeuroSploit v3.5.1 harness — a robust multi-model runtime for the
 //! markdown-driven autonomous pentest engine.
 //!
 //! The harness loads the `agents_md/` library, drives a *pool* of LLM models
@@ -7,6 +7,11 @@
 //! **N-model voting** before scoring and reporting.
 pub mod agents;
 pub mod attack_graph;
 pub mod belief;
 pub mod creds;
 pub mod grounding;
 pub mod pomdp;
 pub mod models;
 pub mod pipeline;
 pub mod pool;
@@ -19,7 +24,7 @@ pub use models::{
    cli_binary_for, ensure_playwright_mcp, installed_cli_backends, mcp_supported, provider_for,
    providers, write_mcp_config, ChatClient, ModelRef, Provider,
 };
-pub use pipeline::{run_whitebox, RunOutput};
+pub use pipeline::{run_greybox, run_host, run_whitebox, RunOutput};
 pub use pipeline::run;
 pub use pool::{ModelPool, Task};
 pub use types::{Finding, RunConfig};
@@ -2,7 +2,7 @@ use anyhow::{anyhow, Result};
 use serde::Serialize;
 use std::process::Stdio;
 use std::time::Duration;
-use tokio::io::AsyncWriteExt;
+use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
 use tokio::process::Command;
 /// A model provider exposing an OpenAI-compatible `/chat/completions` endpoint.
@@ -24,12 +24,12 @@ pub fn providers() -> Vec<Provider> {
    vec![
        Provider { key: "anthropic", label: "Anthropic Claude", base_url: "https://api.anthropic.com/v1", env_key: "ANTHROPIC_API_KEY", kind: "cli",
            models: vec!["claude-opus-4-8", "claude-sonnet-4-6", "claude-haiku-4-5"] },
-        Provider { key: "openai", label: "OpenAI", base_url: "https://api.openai.com/v1", env_key: "OPENAI_API_KEY", kind: "cli",
+        Provider { key: "openai", label: "OpenAI (ChatGPT)", base_url: "https://api.openai.com/v1", env_key: "OPENAI_API_KEY", kind: "cli",
-            models: vec!["gpt-5.1", "o4"] },
+            models: vec!["gpt-5.5", "gpt-5.4", "gpt-5.4-mini", "gpt-5.3-codex", "gpt-5.2", "gpt-5.1", "gpt-5.1-codex", "o4"] },
        Provider { key: "xai", label: "xAI Grok", base_url: "https://api.x.ai/v1", env_key: "XAI_API_KEY", kind: "cli",
            models: vec!["grok-4", "grok-4-fast"] },
        Provider { key: "gemini", label: "Google Gemini", base_url: "https://generativelanguage.googleapis.com/v1beta/openai", env_key: "GEMINI_API_KEY", kind: "cli",
-            models: vec!["gemini-2.5-pro", "gemini-2.5-flash", "gemini-2.0-flash"] },
+            models: vec!["gemini-3-pro", "gemini-2.5-pro", "gemini-2.5-flash"] },
        Provider { key: "nvidia_nim", label: "NVIDIA NIM", base_url: "https://integrate.api.nvidia.com/v1", env_key: "NVIDIA_NIM_API_KEY", kind: "api",
            models: vec!["nvidia/llama-3.3-nemotron-super-49b-v1", "deepseek-ai/deepseek-r1", "qwen/qwen2.5-coder-32b-instruct"] },
        Provider { key: "deepseek", label: "DeepSeek", base_url: "https://api.deepseek.com/v1", env_key: "DEEPSEEK_API_KEY", kind: "api",
@@ -42,6 +42,11 @@ pub fn providers() -> Vec<Provider> {
            models: vec!["llama-3.3-70b-versatile", "qwen-2.5-coder-32b"] },
        Provider { key: "together", label: "Together AI", base_url: "https://api.together.xyz/v1", env_key: "TOGETHER_API_KEY", kind: "api",
            models: vec!["Qwen/Qwen2.5-Coder-32B-Instruct", "deepseek-ai/DeepSeek-R1", "meta-llama/Llama-3.3-70B-Instruct-Turbo"] },
        // LiteLLM proxy (OpenAI-compatible). Point at your gateway with
        // LITELLM_BASE_URL (default http://localhost:4000/v1); key = LITELLM_API_KEY.
        // Use `litellm:<any-model-the-proxy-routes>` — model names pass through.
        Provider { key: "litellm", label: "LiteLLM (proxy)", base_url: "http://localhost:4000/v1", env_key: "LITELLM_API_KEY", kind: "api",
            models: vec!["gpt-4o", "claude-3-7-sonnet", "gemini/gemini-2.5-pro"] },
        Provider { key: "openrouter", label: "OpenRouter", base_url: "https://openrouter.ai/api/v1", env_key: "OPENROUTER_API_KEY", kind: "api",
            models: vec!["anthropic/claude-opus-4-8", "qwen/qwen-2.5-coder-32b-instruct", "deepseek/deepseek-r1", "meta-llama/llama-3.3-70b-instruct"] },
        Provider { key: "ollama", label: "Ollama (local)", base_url: "http://localhost:11434/v1", env_key: "OLLAMA_API_KEY", kind: "api",
@@ -93,10 +98,16 @@ impl ChatClient {
        let p = provider_for(&m.provider)
            .ok_or_else(|| anyhow!("unknown provider '{}'", m.provider))?;
        let key = std::env::var(p.env_key).unwrap_or_default();
-        if key.is_empty() && p.key != "ollama" {
+        if key.is_empty() && p.key != "ollama" && p.key != "litellm" {
            return Err(anyhow!("no API key ({}) for provider '{}'", p.env_key, p.key));
        }
-        let url = format!("{}/chat/completions", p.base_url.trim_end_matches('/'));
+        // Allow an env base-URL override (LiteLLM gateway, self-hosted proxies, …).
        let base = match p.key {
            "litellm" => std::env::var("LITELLM_BASE_URL").unwrap_or_else(|_| p.base_url.to_string()),
            "ollama" => std::env::var("OLLAMA_BASE_URL").unwrap_or_else(|_| p.base_url.to_string()),
            _ => p.base_url.to_string(),
        };
        let url = format!("{}/chat/completions", base.trim_end_matches('/'));
        let body = serde_json::json!({
            "model": m.model,
            "max_tokens": 4096,
@@ -134,29 +145,26 @@ impl ChatClient {
    /// **Playwright** (browse, execute JS, screenshot) during execution.
    pub async fn chat_cli(
        &self,
        label: &str,
        provider: &str,
        model: &str,
        system: &str,
        user: &str,
        mcp_config: Option<&str>,
        progress: Option<tokio::sync::mpsc::Sender<String>>,
    ) -> Result<String> {
        let bin = cli_binary_for(provider)
            .ok_or_else(|| anyhow!("no CLI/subscription backend for provider '{}'", provider))?;
        let prompt = format!("{system}\n\n{user}");
        // Claude Code can stream structured events (tools, commands, files) which
        // we surface live as a categorized activity feed, attributed to `label`.
        if bin == "claude" {
            return self.chat_claude_stream(label, model, &prompt, mcp_config, progress).await;
        }
        let mut cmd = Command::new(bin);
        match bin {
            // Claude Code headless print mode (uses the Claude subscription login).
            // Tool autonomy is always enabled so the agent can use its built-in
            // tools (Bash/curl/etc.) to actually probe the target — Playwright MCP
            // is an *optional* add-on, not a requirement.
            "claude" => {
                cmd.arg("-p").arg("--model").arg(model).arg("--dangerously-skip-permissions");
                // Required to allow tool autonomy when running as root.
                cmd.env("IS_SANDBOX", "1");
                if let Some(mcp) = mcp_config {
                    cmd.arg("--mcp-config").arg(mcp);
                }
            }
            // Codex non-interactive exec (uses the ChatGPT/Codex login), prompt on stdin.
            "codex" => {
                cmd.arg("exec").arg("--model").arg(model)
@@ -211,6 +219,125 @@ impl ChatClient {
        }
        Ok(stdout)
    }
    /// Drive Claude Code with `--output-format stream-json` and surface its
    /// activity as a live, categorized feed (states, tools, commands, files).
    /// Tagged events are sent to `progress`; the final assistant text is returned.
    async fn chat_claude_stream(
        &self,
        label: &str,
        model: &str,
        prompt: &str,
        mcp_config: Option<&str>,
        progress: Option<tokio::sync::mpsc::Sender<String>>,
    ) -> Result<String> {
        let mut cmd = Command::new("claude");
        cmd.arg("-p").arg("--model").arg(model)
            .arg("--output-format").arg("stream-json").arg("--verbose")
            .arg("--dangerously-skip-permissions")
            .env("IS_SANDBOX", "1");
        if let Some(mcp) = mcp_config {
            cmd.arg("--mcp-config").arg(mcp);
        }
        cmd.stdin(Stdio::piped()).stdout(Stdio::piped()).stderr(Stdio::piped()).kill_on_drop(true);
        let mut child = cmd.spawn().map_err(|e| anyhow!("spawn claude failed: {e}"))?;
        if let Some(mut stdin) = child.stdin.take() {
            stdin.write_all(prompt.as_bytes()).await?;
        }
        let stdout = child.stdout.take().ok_or_else(|| anyhow!("no stdout"))?;
        let mut lines = BufReader::new(stdout).lines();
        // Tag every streamed event with the agent label so the feed is attributable.
        let lbl = if label.is_empty() { String::new() } else { format!("@{label} ") };
        let emit = |s: String| {
            if let Some(tx) = &progress {
                let _ = tx.try_send(format!("{lbl}{s}"));
            }
        };
        let mut result = String::new();
        let mut had_err = String::new();
        let read = async {
            while let Ok(Some(line)) = lines.next_line().await {
                let Ok(v) = serde_json::from_str::<serde_json::Value>(&line) else { continue };
                match v.get("type").and_then(|t| t.as_str()) {
                    Some("assistant") => {
                        if let Some(content) = v.pointer("/message/content").and_then(|c| c.as_array()) {
                            for blk in content {
                                match blk.get("type").and_then(|t| t.as_str()) {
                                    Some("text") => {
                                        if let Some(t) = blk.get("text").and_then(|x| x.as_str()) {
                                            let t = t.trim();
                                            if !t.is_empty() {
                                                emit(format!("ai: {}", truncate(t, 240)));
                                            }
                                        }
                                    }
                                    Some("tool_use") => {
                                        let name = blk.get("name").and_then(|x| x.as_str()).unwrap_or("tool");
                                        let input = blk.get("input");
                                        emit(tool_event(name, input));
                                    }
                                    _ => {}
                                }
                            }
                        }
                    }
                    Some("result") => {
                        if let Some(r) = v.get("result").and_then(|x| x.as_str()) {
                            result = r.to_string();
                        }
                        // Token/cost telemetry from the final result event.
                        let ti = v.pointer("/usage/input_tokens").and_then(|x| x.as_u64());
                        let to = v.pointer("/usage/output_tokens").and_then(|x| x.as_u64());
                        let cost = v.get("total_cost_usd").and_then(|x| x.as_f64());
                        if ti.is_some() || to.is_some() || cost.is_some() {
                            emit(format!("tokens: in={} out={} cost=${:.4}",
                                ti.unwrap_or(0), to.unwrap_or(0), cost.unwrap_or(0.0)));
                        }
                        if v.get("is_error").and_then(|x| x.as_bool()).unwrap_or(false) {
                            had_err = v.get("result").and_then(|x| x.as_str()).unwrap_or("error").to_string();
                        }
                    }
                    _ => {}
                }
            }
        };
        // Bound the whole streamed turn.
        if tokio::time::timeout(Duration::from_secs(900), read).await.is_err() {
            return Err(anyhow!("claude stream timed out after 900s"));
        }
        let _ = child.wait().await;
        if !had_err.is_empty() && result.is_empty() {
            return Err(anyhow!("claude: {}", truncate(&had_err, 240)));
        }
        if result.is_empty() {
            return Err(anyhow!("claude stream produced no result"));
        }
        Ok(result)
    }
 }
 /// Categorise a Claude tool_use block into a tagged activity-feed event.
 fn tool_event(name: &str, input: Option<&serde_json::Value>) -> String {
    let s = |k: &str| input.and_then(|i| i.get(k)).and_then(|x| x.as_str()).unwrap_or("");
    match name {
        "Bash" => {
            let c = s("command");
            let danger = c.contains("rm -rf") || c.contains("mkfs") || c.contains(":(){")
                || c.contains("dd if=") || c.contains("> /dev/");
            format!("{}: {}", if danger { "danger" } else { "exec" }, truncate(c, 200))
        }
        "Read" => format!("read: {}", s("file_path")),
        "Write" | "Edit" => format!("edit: {}", s("file_path")),
        "Grep" => format!("tool: grep {}", truncate(s("pattern"), 80)),
        "Glob" => format!("tool: glob {}", truncate(s("pattern"), 80)),
        "WebFetch" => format!("net: fetch {}", s("url")),
        n if n.contains("playwright") || n.contains("browser") => {
            let url = s("url");
            format!("net: browser {}{}", n.rsplit('_').next().unwrap_or(n), if url.is_empty() { String::new() } else { format!(" {url}") })
        }
        other => format!("tool: {other}"),
    }
 }
 /// Map a provider to its local agentic CLI binary (subscription backend).
@@ -300,9 +427,12 @@ impl Default for ChatClient {
 }
 fn truncate(s: &str, n: usize) -> String {
-    if s.len() <= n {
+    // Truncate by CHARACTERS, never bytes — slicing `&s[..n]` panics when `n`
    // lands inside a multi-byte char (e.g. '—'). That panic was crashing agent
    // tasks and silently dropping their findings.
    if s.chars().count() <= n {
        s.to_string()
    } else {
-        format!("{}…", &s[..n])
+        format!("{}…", s.chars().take(n).collect::<String>())
    }
 }
@@ -16,12 +16,30 @@ pub struct RunOutput {
    pub agents_ran: Vec<String>,
    pub candidates: usize,
    pub recon: String,
    /// The run's output directory (runs/ns-<ts>-<target>/).
    pub workdir: String,
    /// Paths to persisted artifacts (recon/exploit/findings/report), if any.
    pub artifacts: Vec<String>,
 }
 const RECON_SYS: &str = "You are a web recon specialist on an AUTHORIZED engagement. You have shell tools (curl etc.) — actively fetch the target, enumerate pages/params, and map the real attack surface. Do not ask for permission; proceed. Reply with a compact JSON object (tech, endpoints, params, auth, apis). No prose.";
 /// Operator directives (focus instructions + auth material) prepended to
 /// recon/exploit prompts so the engagement is steered as the user asked.
 fn operator_directives(cfg: &RunConfig) -> String {
    let mut s = String::new();
    if let Some(focus) = cfg.instructions.as_deref().filter(|x| !x.trim().is_empty()) {
        s.push_str(&format!("OPERATOR FOCUS — prioritise this: {focus}\n"));
    }
    if let Some(auth) = cfg.auth.as_deref().filter(|x| !x.trim().is_empty()) {
        s.push_str(&format!("AUTHENTICATION — test as an authenticated user; send this with each request: {auth}\n"));
    }
    if !s.is_empty() {
        s.push('\n');
    }
    s
 }
 /// Tool-usage doctrine prepended to recon/exploit prompts so the agent knows
 /// exactly what it may use. Best run on Kali Linux (or the Kali Docker image),
 /// where these tools are preinstalled.
@@ -53,6 +71,7 @@ Base every claim on an actual observed response — never assume. Stop when you'
 /// Black-box web engagement: recon → parallel exploit → N-model vote → report.
 pub async fn run(cfg: RunConfig, lib: &Library, pool: &ModelPool, tx: Sender<String>) -> RunOutput {
    pool.set_progress(tx.clone());
    let _ = tx
        .send(format!(
            "Loaded {} agents ({} vuln / {} recon / {} code / {} meta) · models: {} · vote_n={} · concurrency={}{}",
@@ -68,8 +87,8 @@ pub async fn run(cfg: RunConfig, lib: &Library, pool: &ModelPool, tx: Sender<Str
        let _ = tx.send("recon: offline mode — skipping model calls".into()).await;
        "{}".to_string()
    } else {
-        let recon_user = format!("{}Target: {}", tool_doctrine(pool.mcp_config.is_some()), cfg.target);
+        let recon_user = format!("{}{}Target: {}", operator_directives(&cfg), tool_doctrine(pool.mcp_config.is_some()), cfg.target);
-        match pool.complete_routed(Task::Recon, RECON_SYS, &recon_user).await {
+        match pool.complete_routed(Task::Recon, "recon", RECON_SYS, &recon_user).await {
            Ok((m, t)) => {
                let _ = tx.send(format!("recon complete via {}", m.label())).await;
                if cfg.verbose {
@@ -96,24 +115,25 @@ pub async fn run(cfg: RunConfig, lib: &Library, pool: &ModelPool, tx: Sender<Str
        let _ = tx.send(format!("selected {} specialist agents (RL-ranked)", selected.len())).await;
        let _ = tx.send("offline: no exploitation performed (provide API keys or --subscription to run live)".into()).await;
        let artifacts = persist(&cfg, &recon, "", &[]);
-        return RunOutput { target: cfg.target.clone(), findings: vec![], agents_ran: selected.iter().map(|a| a.name.clone()).collect(), candidates: 0, recon, artifacts };
+        return RunOutput { target: cfg.target.clone(), workdir: cfg.workdir.clone().unwrap_or_default(), findings: vec![], agents_ran: selected.iter().map(|a| a.name.clone()).collect(), candidates: 0, recon, artifacts };
    }
    // Use the model to pick the agents whose preconditions match the recon —
    // the harness reasons about *which* specialists to run, not all of them.
-    let chosen = select_agents(pool, &recon, &ranked, &tx).await;
+    let focus = cfg.instructions.clone().unwrap_or_default();
    let chosen = select_agents(pool, &recon, &focus, &ranked, &tx).await;
    let selected: Vec<Agent> = if !chosen.is_empty() {
        let sel: Vec<Agent> =
            ranked.iter().filter(|a| chosen.iter().any(|c| c == &a.name)).cloned().collect();
        if sel.is_empty() {
-            heuristic_select(&ranked, &recon, cap)
+            heuristic_select(&ranked, &recon, &focus, cap)
        } else {
            sel.into_iter().take(cap).collect()
        }
    } else {
-        // LLM selection failed/empty → recon-keyword heuristic, not a blind flat list.
+        // LLM selection failed/empty → recon+focus keyword heuristic, not a blind flat list.
        let _ = tx.send("selection empty — using recon-keyword heuristic".into()).await;
-        heuristic_select(&ranked, &recon, cap)
+        heuristic_select(&ranked, &recon, &focus, cap)
    };
    // Dedup: never run the same agent twice in one engagement.
    let selected: Vec<Agent> = {
@@ -129,32 +149,43 @@ pub async fn run(cfg: RunConfig, lib: &Library, pool: &ModelPool, tx: Sender<Str
    let target = cfg.target.clone();
    let verbose = cfg.verbose;
    let mcp_on = pool.mcp_config.is_some();
    let directives = operator_directives(&cfg);
    // Token economy: each agent gets a capped recon context, not the full blob.
    let recon_ctx: String = recon.chars().take(3500).collect();
    let raw: Vec<(String, String, Vec<Finding>)> = stream::iter(selected.iter().cloned())
        .map(|ag| {
            let target = target.clone();
            let recon = recon_ctx.clone();
            let directives = directives.clone();
            let txc = tx.clone();
            async move {
                if pool.stop_exploiting() {
                    return (ag.name.clone(), String::new(), vec![]);
                }
                if verbose {
                    let _ = txc.send(format!("  ▶ launching agent: {} ({})", ag.name, ag.title.replace(" Agent", ""))).await;
                }
                let user = format!(
                    "AUTHORIZED engagement — you have explicit permission to test {target}. \
                     Do not ask for confirmation — proceed and PROVE each issue.\n\n\
-                     {react}{doctrine}{body}\n\nWhen done, reply with ONLY a JSON array of confirmed findings (may be empty []). \
+                     {directives}{react}{doctrine}{body}\n\nWhen done, reply with ONLY a JSON array of confirmed findings (may be empty []). \
                     Each item: {{id,title,severity,cwe,endpoint,payload,evidence,impact,remediation,confidence}}. \
                     `evidence` must contain the concrete proof (request/response excerpt).",
                    target = target,
                    directives = directives,
                    react = REACT_DOCTRINE,
                    doctrine = tool_doctrine(mcp_on),
                    body = ag.user.replace("{target}", &target).replace("{recon_json}", &recon),
                );
-                match pool.complete_routed(Task::Exploit, &ag.system, &user).await {
+                match pool.complete_routed(Task::Exploit, &ag.name, &ag.system, &user).await {
                    Ok((m, text)) => {
                        let f = extract_findings(&text, &ag.name);
                        let _ = txc.send(format!("exploit {} via {} → {} candidate(s)", ag.name, m.label(), f.len())).await;
                        // Live findings feed: surface each candidate the moment it appears.
                        for c in &f {
                            let _ = txc.send(format!("finding: [{}] {} @ {}", c.severity, c.title, c.endpoint)).await;
                            if let Ok(j) = serde_json::to_string(c) { let _ = txc.send(format!("finding_json: {j}")).await; }
                        }
                        (ag.name.clone(), text, f)
                    }
                    Err(e) => {
@@ -173,12 +204,22 @@ pub async fn run(cfg: RunConfig, lib: &Library, pool: &ModelPool, tx: Sender<Str
    let _ = tx.send(format!("{} candidate finding(s) (deduped) — validating by {}-model vote", candidates.len(), cfg.vote_n)).await;
    // ---- 4. Validate by N-model voting ---------------------------------
-    let findings = validate(candidates, pool, VOTE_SYS, cfg.vote_n, &tx).await;
+    let mut findings = validate(candidates, pool, VOTE_SYS, cfg.vote_n, &tx).await;
    // ---- 5. Chain confirmed findings into deeper impact ----------------
    let chained = chain_round(pool, &cfg.target, &recon, &operator_directives(&cfg), &findings, &lib.chains, &tx).await;
    if !chained.is_empty() {
        let extra = validate(dedup_findings(chained), pool, VOTE_SYS, cfg.vote_n, &tx).await;
        let _ = tx.send(format!("chaining added {} validated finding(s)", extra.len())).await;
        findings.extend(extra);
        findings = dedup_findings(findings);
    }
    finish(cfg, lib, recon, transcript, findings, selected, &mut rl, tx).await
 }
 /// White-box engagement: analyse a repository's source for vulnerabilities.
 pub async fn run_whitebox(cfg: RunConfig, lib: &Library, pool: &ModelPool, tx: Sender<String>) -> RunOutput {
    pool.set_progress(tx.clone());
    let _ = tx.send(format!("WHITEBOX · repo: {} · {} code agents · models: {}", cfg.target, lib.code.len(),
        pool.candidates.iter().map(|m| m.label()).collect::<Vec<_>>().join(", "))).await;
@@ -198,7 +239,7 @@ pub async fn run_whitebox(cfg: RunConfig, lib: &Library, pool: &ModelPool, tx: S
    if cfg.offline || bytes == 0 {
        let artifacts = persist(&cfg, "{}", &context, &[]);
-        return RunOutput { target: cfg.target.clone(), findings: vec![], agents_ran: selected.iter().map(|a| a.name.clone()).collect(), candidates: 0, recon: String::new(), artifacts };
+        return RunOutput { target: cfg.target.clone(), workdir: cfg.workdir.clone().unwrap_or_default(), findings: vec![], agents_ran: selected.iter().map(|a| a.name.clone()).collect(), candidates: 0, recon: String::new(), artifacts };
    }
    let raw: Vec<(String, String, Vec<Finding>)> = stream::iter(selected.iter().cloned())
@@ -213,7 +254,7 @@ pub async fn run_whitebox(cfg: RunConfig, lib: &Library, pool: &ModelPool, tx: S
                    ag.user.replace("{target}", "the provided repository").replace("{recon_json}", "{}"),
                    ctx
                );
-                match pool.complete(&ag.system, &user).await {
+                match pool.complete_routed(Task::Exploit, &ag.name, &ag.system, &user).await {
                    Ok((m, text)) => {
                        let f = extract_findings(&text, &ag.name);
                        let _ = txc.send(format!("analyze {} via {} → {} candidate(s)", ag.name, m.label(), f.len())).await;
@@ -237,13 +278,191 @@ pub async fn run_whitebox(cfg: RunConfig, lib: &Library, pool: &ModelPool, tx: S
    finish(cfg, lib, "{}".into(), transcript, findings, selected, &mut rl, tx).await
 }
 /// Greybox engagement: review the source code AND exploit the running app in one
 /// pipeline — code-review findings become *leads* that guide live exploitation
 /// (with credentials/auth so testing is authenticated).
 pub async fn run_greybox(cfg: RunConfig, lib: &Library, pool: &ModelPool, tx: Sender<String>) -> RunOutput {
    pool.set_progress(tx.clone());
    let repo = cfg.repo.clone().unwrap_or_default();
    let _ = tx.send(format!("GREYBOX · live: {} · repo: {} · {} code agents",
        cfg.target, repo, lib.code.len())).await;
    // ---- 1. Recon the live target -------------------------------------
    let recon = if cfg.offline {
        "{}".to_string()
    } else {
        match pool.complete_routed(Task::Recon, "recon", RECON_SYS,
            &format!("{}{}Target: {}", operator_directives(&cfg), tool_doctrine(pool.mcp_config.is_some()), cfg.target)).await {
            Ok((m, t)) => { let _ = tx.send(format!("recon complete via {}", m.label())).await; t }
            Err(e) => { let _ = tx.send(format!("recon failed ({e})")).await; "{}".to_string() }
        }
    };
    // ---- 2. Review the source for leads -------------------------------
    let context = collect_repo_context(Path::new(&repo), 200, 90_000);
    let _ = tx.send(format!("collected {} bytes of source for code review", context.len())).await;
    let mut rl = cfg.rl_path.as_ref().map(|p| RlState::load(Path::new(p))).unwrap_or_default();
    let mut code_leads = String::new();
    if !cfg.offline && !context.is_empty() {
        let code_cap = if cfg.max_agents > 0 { cfg.max_agents.min(lib.code.len()) } else { lib.code.len().min(12) };
        let code_agents: Vec<Agent> = lib.code.iter().take(code_cap).cloned().collect();
        let leads: Vec<Finding> = stream::iter(code_agents.into_iter())
            .map(|ag| {
                let ctx = context.clone();
                let txc = tx.clone();
                async move {
                    let user = format!(
                        "{}\n\nSOURCE:\n```\n{}\n```\nReply ONLY a JSON array of issues (may be []): \
                         {{id,title,severity,cwe,endpoint,payload,evidence,impact,remediation,confidence}} \
                         where endpoint is file:line.",
                        ag.user.replace("{target}", "the repository").replace("{recon_json}", "{}"), ctx
                    );
                    match pool.complete_routed(Task::Select, &ag.name, &ag.system, &user).await {
                        Ok((_, text)) => { let f = extract_findings(&text, &ag.name);
                            let _ = txc.send(format!("review {} → {} lead(s)", ag.name, f.len())).await; f }
                        Err(_) => vec![],
                    }
                }
            })
            .buffer_unordered(cfg.concurrency)
            .collect::<Vec<Vec<Finding>>>().await.into_iter().flatten().collect();
        let leads = dedup_findings(leads);
        if !leads.is_empty() {
            code_leads.push_str("CODE-REVIEW LEADS (confirm these against the LIVE app):\n");
            for l in leads.iter().take(25) {
                code_leads.push_str(&format!("- [{}] {} @ {} ({})\n", l.severity, l.title, l.endpoint, l.cwe));
            }
            code_leads.push('\n');
        }
        let _ = tx.send(format!("{} code lead(s) → guiding live exploitation", leads.len())).await;
    }
    // ---- 3. Select live agents (recon + focus + code leads) -----------
    let mut ranked: Vec<Agent> = lib.vulns.clone();
    ranked.sort_by(|a, b| rl.weight(&b.name).partial_cmp(&rl.weight(&a.name)).unwrap_or(std::cmp::Ordering::Equal));
    let cap = if cfg.max_agents > 0 { cfg.max_agents.min(ranked.len()) } else { ranked.len() };
    let focus = format!("{} {}", cfg.instructions.clone().unwrap_or_default(), code_leads);
    if cfg.offline {
        let selected: Vec<Agent> = ranked.into_iter().take(cap).collect();
        let _ = tx.send(format!("offline: selected {} agent(s); no live exploitation", selected.len())).await;
        let artifacts = persist(&cfg, &recon, &code_leads, &[]);
        return RunOutput { target: cfg.target.clone(), workdir: cfg.workdir.clone().unwrap_or_default(), findings: vec![],
            agents_ran: selected.iter().map(|a| a.name.clone()).collect(), candidates: 0, recon, artifacts };
    }
    let chosen = select_agents(pool, &recon, &focus, &ranked, &tx).await;
    let selected: Vec<Agent> = if !chosen.is_empty() {
        let sel: Vec<Agent> = ranked.iter().filter(|a| chosen.iter().any(|c| c == &a.name)).cloned().collect();
        if sel.is_empty() { heuristic_select(&ranked, &recon, &focus, cap) } else { sel.into_iter().take(cap).collect() }
    } else {
        heuristic_select(&ranked, &recon, &focus, cap)
    };
    let selected: Vec<Agent> = { let mut seen = std::collections::HashSet::new();
        selected.into_iter().filter(|a| seen.insert(a.name.clone())).collect() };
    let _ = tx.send(format!("selected {} live agent(s): {}", selected.len(),
        selected.iter().map(|a| a.name.clone()).collect::<Vec<_>>().join(", "))).await;
    // ---- 4. Exploit live, guided by code leads ------------------------
    let target = cfg.target.clone();
    let verbose = cfg.verbose;
    let mcp_on = pool.mcp_config.is_some();
    let directives = operator_directives(&cfg);
    let recon_ctx: String = recon.chars().take(3000).collect();
    let leads_ctx = code_leads.clone();
    let raw: Vec<(String, String, Vec<Finding>)> = stream::iter(selected.iter().cloned())
        .map(|ag| {
            let target = target.clone();
            let recon = recon_ctx.clone();
            let directives = directives.clone();
            let leads = leads_ctx.clone();
            let txc = tx.clone();
            async move {
                if pool.stop_exploiting() {
                    return (ag.name.clone(), String::new(), vec![]);
                }
                if verbose {
                    let _ = txc.send(format!("  ▶ launching agent: {} ({})", ag.name, ag.title.replace(" Agent", ""))).await;
                }
                let user = format!(
                    "AUTHORIZED greybox engagement on {target} — you also have the source review below. \
                     Proceed and PROVE each issue against the LIVE app.\n\n{directives}{leads}{react}{doctrine}{body}\n\n\
                     Reply ONLY a JSON array of confirmed findings (may be []): \
                     {{id,title,severity,cwe,endpoint,payload,evidence,impact,remediation,confidence}}.",
                    target = target, directives = directives, leads = leads,
                    react = REACT_DOCTRINE, doctrine = tool_doctrine(mcp_on),
                    body = ag.user.replace("{target}", &target).replace("{recon_json}", &recon),
                );
                match pool.complete_routed(Task::Exploit, &ag.name, &ag.system, &user).await {
                    Ok((m, text)) => { let f = extract_findings(&text, &ag.name);
                        let _ = txc.send(format!("exploit {} via {} → {} candidate(s)", ag.name, m.label(), f.len())).await;
                        (ag.name.clone(), text, f) }
                    Err(e) => { let _ = txc.send(format!("exploit {} failed: {e}", ag.name)).await;
                        (ag.name.clone(), format!("ERROR: {e}"), vec![]) }
                }
            }
        })
        .buffer_unordered(cfg.concurrency)
        .collect::<Vec<_>>().await;
    let transcript = format!("{}\n{}", code_leads, transcript_of(&raw));
    let candidates = dedup_findings(raw.iter().flat_map(|(_, _, f)| f.clone()).collect());
    let _ = tx.send(format!("{} candidate finding(s) (deduped) — validating", candidates.len())).await;
    let mut findings = validate(candidates, pool, VOTE_SYS, cfg.vote_n, &tx).await;
    let chained = chain_round(pool, &cfg.target, &recon, &operator_directives(&cfg), &findings, &lib.chains, &tx).await;
    if !chained.is_empty() {
        let extra = validate(dedup_findings(chained), pool, VOTE_SYS, cfg.vote_n, &tx).await;
        let _ = tx.send(format!("chaining added {} validated finding(s)", extra.len())).await;
        findings.extend(extra);
        findings = dedup_findings(findings);
    }
    finish(cfg, lib, recon, transcript, findings, selected, &mut rl, tx).await
 }
 const CHAIN_SYS: &str = "You are an exploit-chaining specialist. Given already-CONFIRMED findings, chain them into deeper impact — e.g. SSRF→cloud metadata creds, SQLi→DB dump→credential reuse, IDOR→account takeover, arbitrary file read→secrets→RCE, auth bypass→admin. Use your tools to actually carry the chain forward and PROVE the escalated impact. Report ONLY NEW findings beyond the inputs.";
 /// One orchestration round: take the confirmed findings and try to chain them
 /// into higher-impact follow-ups, reusing the recon/auth context. Returns the
 /// (unvalidated) new candidate findings produced by chaining.
 async fn chain_round(pool: &ModelPool, target: &str, recon: &str, directives: &str,
                     confirmed: &[Finding], chains: &[Agent], tx: &Sender<String>) -> Vec<Finding> {
    if confirmed.is_empty() {
        return vec![];
    }
    let summary: String = confirmed.iter().take(20)
        .map(|f| format!("- [{}] {} @ {} ({})", f.severity, f.title, f.endpoint, f.cwe))
        .collect::<Vec<_>>().join("\n");
    // Offer the known chain recipes as a menu so the LLM applies proven multi-stage paths.
    let recipes: String = chains.iter().map(|a| format!("- {}", a.title.replace(" Agent", ""))).collect::<Vec<_>>().join("\n");
    let recipe_block = if recipes.is_empty() { String::new() } else { format!("KNOWN CHAIN RECIPES (apply any that fit):\n{recipes}\n\n") };
    let _ = tx.send(format!("chaining {} confirmed finding(s) for deeper impact…", confirmed.len())).await;
    let recon_ctx: String = recon.chars().take(2500).collect();
    let user = format!(
        "AUTHORIZED engagement on {target}.\n\n{directives}{react}{doctrine}{recipe_block}\
         CONFIRMED FINDINGS TO CHAIN:\n{summary}\n\nRecon:\n{recon_ctx}\n\n\
         Chain these into deeper impact (e.g. SQLi→RCE→LPE, SSRF→cloud creds, upload→LFI→RCE) and PROVE each stage. \
         Reply ONLY a JSON array of NEW findings \
         (may be []): {{id,title,severity,cwe,endpoint,payload,evidence,impact,remediation,confidence}}.",
        react = REACT_DOCTRINE, doctrine = tool_doctrine(pool.mcp_config.is_some()),
    );
    match pool.complete_routed(Task::Exploit, "chain", CHAIN_SYS, &user).await {
        Ok((m, text)) => {
            let f = extract_findings(&text, "chain");
            let _ = tx.send(format!("chain via {} → {} new candidate(s)", m.label(), f.len())).await;
            f
        }
        Err(e) => { let _ = tx.send(format!("chaining failed: {e}")).await; vec![] }
    }
 }
 // --------------------------------------------------------------------------- shared
 const SELECT_SYS: &str = "You are a penetration-test orchestrator. Given recon of a target and a catalog of specialist agents, choose ONLY the agents whose preconditions clearly match the target's attack surface. Be selective. Reply with a JSON array of agent names (strings) drawn exactly from the catalog. No prose.";
 /// Ask the model which agents to run for this recon. Returns chosen agent names
 /// (empty on failure → caller falls back to RL-ranked agents).
-async fn select_agents(pool: &ModelPool, recon: &str, catalog: &[Agent], tx: &Sender<String>) -> Vec<String> {
+async fn select_agents(pool: &ModelPool, recon: &str, focus: &str, catalog: &[Agent], tx: &Sender<String>) -> Vec<String> {
    let list = catalog
        .iter()
        .map(|a| format!("{} — {} [{}]", a.name, a.title.replace(" Agent", ""), a.cwe))
@@ -251,8 +470,13 @@ async fn select_agents(pool: &ModelPool, recon: &str, catalog: &[Agent], tx: &Se
        .join("\n");
    // Token economy: cap the recon blob fed to the selector.
    let recon_trim: String = recon.chars().take(3000).collect();
-    let user = format!("RECON:\n{recon_trim}\n\nAGENT CATALOG (name — title [cwe]):\n{list}\n\nReturn a JSON array of agent names to run.");
+    let focus_line = if focus.trim().is_empty() {
-    match pool.complete_routed(Task::Select, SELECT_SYS, &user).await {
+        String::new()
    } else {
        format!("OPERATOR FOCUS (strongly prioritise agents for this): {focus}\n\n")
    };
    let user = format!("{focus_line}RECON:\n{recon_trim}\n\nAGENT CATALOG (name — title [cwe]):\n{list}\n\nReturn a JSON array of agent names to run.");
    match pool.complete_routed(Task::Select, "select", SELECT_SYS, &user).await {
        Ok((m, text)) => {
            let names = parse_string_array(&text);
            if names.is_empty() {
@@ -280,7 +504,7 @@ fn parse_string_array(text: &str) -> Vec<String> {
 /// Fallback agent selection when the LLM selector fails: score each agent by
 /// keyword overlap between its name/title and the recon text, always seed a
 /// black-box baseline of high-yield web classes, and take the top `cap`.
-fn heuristic_select(ranked: &[Agent], recon: &str, cap: usize) -> Vec<Agent> {
+fn heuristic_select(ranked: &[Agent], recon: &str, focus: &str, cap: usize) -> Vec<Agent> {
    const BASELINE: &[&str] = &[
        "sqli_error", "sqli_blind", "sqli_union", "xss_reflected", "xss_stored", "xss_dom",
        "command_injection", "lfi", "path_traversal", "ssrf", "idor", "open_redirect",
@@ -288,6 +512,7 @@ fn heuristic_select(ranked: &[Agent], recon: &str, cap: usize) -> Vec<Agent> {
        "security_headers", "cors_misconfig",
    ];
    let r = recon.to_lowercase();
    let f = focus.to_lowercase();
    // Recon signal → agent-name substrings. Only agents whose surface the recon
    // actually identified get the signal boost; the rest rely on the baseline.
    let signals: &[(&str, &[&str])] = &[
@@ -335,6 +560,18 @@ fn heuristic_select(ranked: &[Agent], recon: &str, cap: usize) -> Vec<Agent> {
                    score += 2;
                }
            }
            // operator focus: strongly boost agents matching the requested classes
            if !f.is_empty() {
                let blob = format!("{} {}", a.name, a.title).to_lowercase();
                let hit = ["inject", "sqli", "xss", "ssrf", "ssti", "rce", "command", "lfi", "rfi",
                           "idor", "bola", "bfla", "access", "auth", "privilege", "csrf", "redirect",
                           "deserial", "xxe", "traversal", "upload", "jwt", "secret", "crypto"]
                    .iter()
                    .any(|kw| f.contains(kw) && blob.contains(kw));
                if hit {
                    score += 10;
                }
            }
            (score, a)
        })
        .collect();
@@ -374,9 +611,32 @@ async fn validate(candidates: Vec<Finding>, pool: &ModelPool, sys: &str, vote_n:
    validated.into_iter().filter(|f| f.validated).collect()
 }
-async fn finish(cfg: RunConfig, _lib: &Library, recon: String, transcript: String, findings: Vec<Finding>,
+async fn finish(cfg: RunConfig, _lib: &Library, recon: String, transcript: String, mut findings: Vec<Finding>,
                selected: Vec<Agent>, rl: &mut RlState, tx: Sender<String>) -> RunOutput {
    // --- Grounding gate: no claim without a tool receipt (anti-hallucination) ---
    // White/grey carry source context; black-box is verified empirically.
    let whitebox = cfg.repo.is_some() && cfg.target.starts_with('/');
    let before = findings.len();
    let (kept, demoted) = crate::grounding::gate(findings, &transcript, whitebox);
    findings = kept;
    if demoted > 0 {
        let _ = tx.send(format!("grounding gate: demoted {demoted}/{before} ungrounded claim(s) (no tool receipt)")).await;
    }
    // --- POMDP belief: build from grounded findings, report residual uncertainty ---
    let mut wm = crate::belief::WorldModel::new();
    wm.deterministic = whitebox;
    for f in &findings {
        wm.add(&f.id, crate::belief::Kind::Exploit, &f.title, f.confidence.max(0.05).min(0.99));
    }
    let unc = wm.uncertainty(None);
    if !findings.is_empty() {
        let _ = tx.send(format!("belief uncertainty over confirmed findings: {:.2} (0=sharp,1=diffuse)", unc)).await;
    }
    let _ = tx.send(format!("{} validated finding(s)", findings.len())).await;
    // Map findings to OWASP / MITRE / kill-chain stage for the attack graph.
    crate::attack_graph::enrich(&mut findings);
    // RL update: reward agents that produced validated findings; gently decay idle.
    let hit: std::collections::HashMap<&str, f64> = findings.iter().fold(Default::default(), |mut m, f| {
@@ -396,11 +656,21 @@ async fn finish(cfg: RunConfig, _lib: &Library, recon: String, transcript: Strin
    let artifacts = persist(&cfg, &recon, &transcript, &findings);
    if !artifacts.is_empty() {
        let _ = tx.send(format!("notify: evidence saved → {}", cfg.workdir.clone().unwrap_or_default())).await;
        let _ = tx.send(format!("artifacts saved: {}", artifacts.join(", "))).await;
    }
    // Automatic partial summary (phase complete).
    {
        let mut by: std::collections::BTreeMap<&str, usize> = Default::default();
        for f in &findings { *by.entry(f.severity.as_str()).or_insert(0) += 1; }
        let sev = if by.is_empty() { "none".to_string() }
                  else { by.iter().map(|(k, v)| format!("{k}:{v}")).collect::<Vec<_>>().join(" ") };
        let _ = tx.send(format!("notify: phase complete — {} validated finding(s) [{}]", findings.len(), sev)).await;
    }
    RunOutput {
        target: cfg.target.clone(),
        workdir: cfg.workdir.clone().unwrap_or_default(),
        candidates: findings.len(),
        findings,
        agents_ran: selected.iter().map(|a| a.name.clone()).collect(),
@@ -502,6 +772,7 @@ fn extract_findings(text: &str, agent: &str) -> Vec<Finding> {
                confidence: conf(o.get("confidence")),
                validated: false,
                votes: String::new(),
                ..Default::default()
            })
        })
        .collect()
@@ -592,9 +863,111 @@ fn collect_repo_context(root: &Path, max_files: usize, max_bytes: usize) -> Stri
            let rel = path.strip_prefix(root).unwrap_or(path).to_string_lossy();
            let budget = max_bytes.saturating_sub(out.len());
            let take = content.len().min(budget).min(8_000);
-            out.push_str(&format!("\n// ===== file: {} =====\n{}\n", rel, &content[..take]));
+            // Char-safe slice: back off to the nearest char boundary so multibyte
            // source files (UTF-8) never panic.
            let mut end = take.min(content.len());
            while end > 0 && !content.is_char_boundary(end) { end -= 1; }
            out.push_str(&format!("\n// ===== file: {} =====\n{}\n", rel, &content[..end]));
            files += 1;
        }
    }
    out
 }
 const HOST_RECON_SYS: &str = "You are an infrastructure recon specialist on an AUTHORIZED engagement against a HOST/IP. Actively scan with rustscan/nmap (and netexec/smbclient where relevant) to map open ports, services, versions and auth surfaces. Use any provided SSH/Windows credentials to enumerate from inside. Do not ask permission; proceed. Reply with a compact JSON object (host, os, ports, services, auth, ad). No prose.";
 const HOST_TOOLING: &str = "TOOLING (best on Kali): nmap/rustscan (ports), netexec/crackmapexec + smbclient (SMB/AD), ssh/sshpass + linpeas (Linux), evil-winrm + winPEAS + impacket (Windows), bloodhound-python/SharpHound (AD), hashcat (offline cracking). Use only supplied credentials; never brute force or run destructive/DoS actions.\n\n";
 /// Infrastructure engagement: scan/enumerate an IP/host and run Linux/Windows/AD
 /// agents. Mirrors the web pipeline but selects from the `infra` agent set.
 pub async fn run_host(cfg: RunConfig, lib: &Library, pool: &ModelPool, tx: Sender<String>) -> RunOutput {
    pool.set_progress(tx.clone());
    let _ = tx.send(format!("HOST · target: {} · {} infra agents · models: {}", cfg.target, lib.infra.len(),
        pool.candidates.iter().map(|m| m.label()).collect::<Vec<_>>().join(", "))).await;
    let recon = if cfg.offline {
        "{}".to_string()
    } else {
        let user = format!("{}{}Target host: {}", operator_directives(&cfg), HOST_TOOLING, cfg.target);
        match pool.complete_routed(Task::Recon, "recon", HOST_RECON_SYS, &user).await {
            Ok((m, t)) => { let _ = tx.send(format!("recon complete via {}", m.label())).await; t }
            Err(e) => { let _ = tx.send(format!("recon failed ({e})")).await; "{}".to_string() }
        }
    };
    let mut rl = cfg.rl_path.as_ref().map(|p| RlState::load(Path::new(p))).unwrap_or_default();
    let mut ranked: Vec<Agent> = lib.infra.clone();
    ranked.sort_by(|a, b| rl.weight(&b.name).partial_cmp(&rl.weight(&a.name)).unwrap_or(std::cmp::Ordering::Equal));
    let cap = if cfg.max_agents > 0 { cfg.max_agents.min(ranked.len()) } else { ranked.len() };
    let focus = cfg.instructions.clone().unwrap_or_default();
    if cfg.offline {
        let selected: Vec<Agent> = ranked.into_iter().take(cap).collect();
        let _ = tx.send(format!("offline: selected {} infra agent(s); no live testing", selected.len())).await;
        let artifacts = persist(&cfg, &recon, "", &[]);
        return RunOutput { target: cfg.target.clone(), workdir: cfg.workdir.clone().unwrap_or_default(), findings: vec![],
            agents_ran: selected.iter().map(|a| a.name.clone()).collect(), candidates: 0, recon, artifacts };
    }
    let chosen = select_agents(pool, &recon, &focus, &ranked, &tx).await;
    let selected: Vec<Agent> = if !chosen.is_empty() {
        let sel: Vec<Agent> = ranked.iter().filter(|a| chosen.iter().any(|c| c == &a.name)).cloned().collect();
        if sel.is_empty() { ranked.iter().take(cap).cloned().collect() } else { sel.into_iter().take(cap).collect() }
    } else {
        ranked.iter().take(cap).cloned().collect()
    };
    let selected: Vec<Agent> = { let mut seen = std::collections::HashSet::new();
        selected.into_iter().filter(|a| seen.insert(a.name.clone())).collect() };
    let _ = tx.send(format!("selected {} infra agent(s): {}", selected.len(),
        selected.iter().map(|a| a.name.clone()).collect::<Vec<_>>().join(", "))).await;
    let target = cfg.target.clone();
    let verbose = cfg.verbose;
    let directives = operator_directives(&cfg);
    let recon_ctx: String = recon.chars().take(3000).collect();
    let raw: Vec<(String, String, Vec<Finding>)> = stream::iter(selected.iter().cloned())
        .map(|ag| {
            let target = target.clone();
            let recon = recon_ctx.clone();
            let directives = directives.clone();
            let txc = tx.clone();
            async move {
                if pool.stop_exploiting() { return (ag.name.clone(), String::new(), vec![]); }
                if verbose {
                    let _ = txc.send(format!("  ▶ launching agent: {} ({})", ag.name, ag.title.replace(" Agent", ""))).await;
                }
                let user = format!(
                    "AUTHORIZED host engagement on {target}. Proceed and PROVE each issue with raw tool output.\n\n{directives}{tooling}{react}{body}\n\nReply ONLY a JSON array of confirmed findings (may be []): {{id,title,severity,cwe,endpoint,payload,evidence,impact,remediation,confidence}}.",
                    target = target, directives = directives, tooling = HOST_TOOLING, react = REACT_DOCTRINE,
                    body = ag.user.replace("{target}", &target).replace("{recon_json}", &recon),
                );
                match pool.complete_routed(Task::Exploit, &ag.name, &ag.system, &user).await {
                    Ok((m, text)) => {
                        let f = extract_findings(&text, &ag.name);
                        let _ = txc.send(format!("test {} via {} → {} candidate(s)", ag.name, m.label(), f.len())).await;
                        for c in &f {
                            let _ = txc.send(format!("finding: [{}] {} @ {}", c.severity, c.title, c.endpoint)).await;
                            if let Ok(j) = serde_json::to_string(c) { let _ = txc.send(format!("finding_json: {j}")).await; }
                        }
                        (ag.name.clone(), text, f)
                    }
                    Err(e) => { let _ = txc.send(format!("test {} failed: {e}", ag.name)).await;
                        (ag.name.clone(), format!("ERROR: {e}"), vec![]) }
                }
            }
        })
        .buffer_unordered(cfg.concurrency)
        .collect::<Vec<_>>().await;
    let transcript = transcript_of(&raw);
    let candidates = dedup_findings(raw.iter().flat_map(|(_, _, f)| f.clone()).collect());
    let _ = tx.send(format!("{} candidate finding(s) (deduped) — validating", candidates.len())).await;
    let mut findings = validate(candidates, pool, VOTE_SYS, cfg.vote_n, &tx).await;
    let chained = chain_round(pool, &cfg.target, &recon, &operator_directives(&cfg), &findings, &lib.chains, &tx).await;
    if !chained.is_empty() {
        let extra = validate(dedup_findings(chained), pool, VOTE_SYS, cfg.vote_n, &tx).await;
        findings.extend(extra);
        findings = dedup_findings(findings);
    }
    finish(cfg, lib, recon, transcript, findings, selected, &mut rl, tx).await
 }
@@ -0,0 +1,109 @@
 //! POMDP decision layer (v3.5.1): value-of-information planning + the
 //! anti-hallucination gate.
 //!
 //! The choice "scan more vs exploit now" is **not** a heuristic here — it falls
 //! out of the belief. When a target node's belief is diffuse (high entropy), the
 //! expected value of an observation (recon) exceeds that of an exploit, because
 //! the observation is expected to sharpen the belief by more than the exploit's
 //! risk-adjusted payoff. That same criterion is the anti-hallucination rule: the
 //! agent must not assert exploitability while the belief about the target state
 //! is diffuse — it must collect more observation first.
 use crate::belief::{Kind, WorldModel};
 /// What the planner recommends doing next.
 #[derive(Debug, Clone, PartialEq)]
 pub enum Action {
    /// Gather an observation about a still-diffuse node (recon).
    Recon { node: String, voi: f64 },
    /// Act on a node the belief is confident about (exploit/report).
    Exploit { node: String, ev: f64 },
    /// Belief is sharp and nothing actionable remains.
    Stop,
 }
 /// Decision thresholds (tunable; could be learned later).
 pub struct Policy {
    /// Above this belief entropy, recon dominates exploit (value-of-information).
    pub explore_entropy: f64,
    /// Minimum P(true) to allow asserting/acting.
    pub assert_min_p: f64,
    /// Maximum entropy to allow asserting/acting (the anti-hallucination ceiling).
    pub assert_max_entropy: f64,
 }
 impl Default for Policy {
    fn default() -> Self {
        Policy { explore_entropy: 0.6, assert_min_p: 0.7, assert_max_entropy: 0.4 }
    }
 }
 /// Expected value of an observation about a node ≈ how much entropy it can
 /// remove, weighted by the node's relevance (Exploit/Credential nodes matter
 /// most). A sharp belief has ~0 VoI; a diffuse one has VoI≈1×weight.
 pub fn value_of_information(wm: &WorldModel, node_id: &str) -> f64 {
    let Some(n) = wm.nodes.get(node_id) else { return 0.0 };
    let weight = match n.kind {
        Kind::Exploit | Kind::Credential => 1.0,
        Kind::Vuln => 0.8,
        Kind::Service => 0.5,
        Kind::Host => 0.4,
    };
    n.entropy() * weight
 }
 /// Risk-adjusted expected value of exploiting a node now: only worthwhile when
 /// the belief is both high and sharp.
 fn exploit_ev(wm: &WorldModel, node_id: &str, pol: &Policy) -> f64 {
    let Some(n) = wm.nodes.get(node_id) else { return 0.0 };
    if n.entropy() > pol.assert_max_entropy {
        return 0.0; // too uncertain — exploiting now is gambling
    }
    n.p
 }
 /// Decide the next macro-action from the current belief: recon the highest-VoI
 /// diffuse node, or exploit the most-confident node, whichever wins.
 pub fn decide(wm: &WorldModel, pol: &Policy) -> Action {
    // Best recon candidate by value-of-information.
    let best_recon = wm.nodes.keys()
        .map(|id| (id.clone(), value_of_information(wm, id)))
        .max_by(|a, b| a.1.partial_cmp(&b.1).unwrap_or(std::cmp::Ordering::Equal));
    // Best exploit candidate by risk-adjusted EV.
    let best_exploit = wm.nodes.values()
        .filter(|n| matches!(n.kind, Kind::Exploit | Kind::Vuln | Kind::Credential))
        .map(|n| (n.id.clone(), exploit_ev(wm, &n.id, pol)))
        .max_by(|a, b| a.1.partial_cmp(&b.1).unwrap_or(std::cmp::Ordering::Equal));
    match (best_recon, best_exploit) {
        (Some((rid, voi)), exp) => {
            let ev = exp.as_ref().map(|(_, e)| *e).unwrap_or(0.0);
            // Value-of-information dominates while the belief is diffuse.
            if voi >= ev && voi > (1.0 - pol.explore_entropy) {
                Action::Recon { node: rid, voi }
            } else if let Some((eid, e)) = exp.filter(|(_, e)| *e > 0.0) {
                Action::Exploit { node: eid, ev: e }
            } else {
                Action::Recon { node: rid, voi }
            }
        }
        (None, Some((eid, e))) if e > 0.0 => Action::Exploit { node: eid, ev: e },
        _ => Action::Stop,
    }
 }
 /// Anti-hallucination gate. A claim of exploitability about `node` may only be
 /// asserted when the belief is confident AND sharp. Returns Ok(()) to allow the
 /// claim, or Err(reason) to force "collect more observation first".
 pub fn may_assert(wm: &WorldModel, node_id: &str, pol: &Policy) -> Result<(), String> {
    match wm.nodes.get(node_id) {
        None => Err("no belief about this target — observe first".into()),
        Some(n) if n.entropy() > pol.assert_max_entropy =>
            Err(format!("belief diffuse (entropy {:.2} > {:.2}) — recon before asserting exploitability",
                n.entropy(), pol.assert_max_entropy)),
        Some(n) if n.p < pol.assert_min_p =>
            Err(format!("belief too low (p {:.2} < {:.2}) — not exploitable on current evidence",
                n.p, pol.assert_min_p)),
        Some(_) => Ok(()),
    }
 }
@@ -1,7 +1,24 @@
 use crate::models::{cli_binary_for, ChatClient, ModelRef};
 use anyhow::{anyhow, Result};
-use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
-use tokio::sync::Semaphore;
+use std::sync::{Arc, Mutex};
 use std::time::Duration;
 use tokio::sync::{Notify, Semaphore};
 /// Does this error look like token/quota/rate-limit exhaustion (as opposed to a
 /// transient network blip)? Used to PAUSE the run instead of silently dropping
 /// the agent, so the user can /continue (wait for renewal) or switch model.
 pub fn is_exhaustion(e: &anyhow::Error) -> bool {
    let s = format!("{e:#}").to_lowercase();
    [
        "rate limit", "rate_limit", "ratelimit", "429", "too many requests",
        "quota", "insufficient_quota", "insufficient quota", "out of credit",
        "credit balance", "billing", "exhausted", "overloaded", "capacity",
        "usage limit", "resource_exhausted", "resource exhausted",
    ]
    .iter()
    .any(|k| s.contains(k))
 }
 /// Task type used by the model router to pick the best model for the step.
 #[derive(Clone, Copy, Debug)]
@@ -31,6 +48,22 @@ pub struct ModelPool {
    pub subscription: bool,
    /// Path to an `.mcp.json` (Playwright) used on the subscription/CLI path.
    pub mcp_config: Option<String>,
    /// Progress channel: when set, the subscription CLI streams structured
    /// activity (tools called, commands run, files read) here live.
    progress: std::sync::Mutex<Option<tokio::sync::mpsc::Sender<String>>>,
    /// HARD cancellation: when set, in-flight model calls short-circuit (abort).
    cancel: std::sync::Arc<std::sync::atomic::AtomicBool>,
    /// SOFT stop: stop launching new EXPLOIT agents, but let in-flight finish and
    /// VALIDATION still run — so "stop and validate what was found" works.
    soft: std::sync::Arc<std::sync::atomic::AtomicBool>,
    /// PAUSE: set when every candidate model is token/quota-exhausted. The run
    /// parks (keeping all state) until the user runs /continue.
    paused: Arc<AtomicBool>,
    /// Wakes the parked task when the user runs /continue.
    resume: Arc<Notify>,
    /// Fallback models the user added via `/continue <provider:model>` while
    /// paused — tried first on the next attempt.
    fallback: Arc<Mutex<Vec<ModelRef>>>,
 }
 impl ModelPool {
@@ -57,29 +90,131 @@ impl ModelPool {
            },
            subscription,
            mcp_config,
            progress: std::sync::Mutex::new(None),
            cancel: Arc::new(std::sync::atomic::AtomicBool::new(false)),
            soft: Arc::new(std::sync::atomic::AtomicBool::new(false)),
            paused: Arc::new(AtomicBool::new(false)),
            resume: Arc::new(Notify::new()),
            fallback: Arc::new(Mutex::new(Vec::new())),
        }
    }
    /// Attach a progress channel so the subscription CLI streams structured
    /// activity (commands run, files read, tools called) live.
    pub fn set_progress(&self, tx: tokio::sync::mpsc::Sender<String>) {
        if let Ok(mut g) = self.progress.lock() {
            *g = Some(tx);
        }
    }
    fn progress(&self) -> Option<tokio::sync::mpsc::Sender<String>> {
        self.progress.lock().ok().and_then(|g| g.clone())
    }
    /// Handle to request HARD cancellation (abort all model calls).
    pub fn cancel_handle(&self) -> Arc<std::sync::atomic::AtomicBool> {
        self.cancel.clone()
    }
    /// Handle to request a SOFT stop (stop launching new exploit agents; keep
    /// validation running).
    pub fn soft_handle(&self) -> Arc<std::sync::atomic::AtomicBool> {
        self.soft.clone()
    }
    pub fn is_cancelled(&self) -> bool {
        self.cancel.load(std::sync::atomic::Ordering::Relaxed)
    }
    /// Should the exploit phase stop launching new agents? (hard OR soft stop)
    pub fn stop_exploiting(&self) -> bool {
        self.cancel.load(std::sync::atomic::Ordering::Relaxed)
            || self.soft.load(std::sync::atomic::Ordering::Relaxed)
    }
    /// Handle to the PAUSE flag (observe whether the run is parked on exhaustion).
    pub fn pause_handle(&self) -> Arc<AtomicBool> {
        self.paused.clone()
    }
    /// Handle used by the REPL to wake a parked run (`/continue`).
    pub fn resume_handle(&self) -> Arc<Notify> {
        self.resume.clone()
    }
    /// Slot the REPL pushes a fallback model into before resuming
    /// (`/continue <provider:model>`).
    pub fn fallback_handle(&self) -> Arc<Mutex<Vec<ModelRef>>> {
        self.fallback.clone()
    }
    pub fn is_paused(&self) -> bool {
        self.paused.load(Ordering::Relaxed)
    }
    /// Park the run on token/quota exhaustion: keep ALL state, emit a notice,
    /// and wait until the user runs `/continue` (or cancels). Returns when the
    /// run should retry (pause cleared) or give up (cancelled).
    async fn park_exhausted(&self, err: &anyhow::Error) {
        self.paused.store(true, Ordering::Relaxed);
        if let Some(tx) = self.progress() {
            let msg = format!("{err:#}");
            let short = msg.lines().next().unwrap_or(&msg);
            let _ = tx
                .send(format!(
                    "notify: ⏸ token/quota exhausted ({}). Run is PAUSED — type /continue when your quota renews, or switch with /model <provider:model> then /continue.",
                    short.chars().take(120).collect::<String>()
                ))
                .await;
        }
        while self.paused.load(Ordering::Relaxed) && !self.is_cancelled() {
            let notified = self.resume.notified();
            tokio::select! {
                _ = notified => {}
                _ = tokio::time::sleep(Duration::from_millis(500)) => {}
            }
        }
        if !self.is_cancelled() {
            if let Some(tx) = self.progress() {
                let _ = tx.send("notify: ▶ resumed — retrying exhausted step.".to_string()).await;
            }
        }
    }
    /// One completion for a model, via subscription CLI (optionally with MCP) or
-    /// HTTP API, with a short retry/backoff to ride out transient failures
+    /// HTTP API, with a short retry/backoff. `label` (e.g. the agent name) tags
-    /// (rate limits, MCP cold-starts, network blips).
+    /// the streamed activity so each command/tool is attributable.
-    async fn one(&self, m: &ModelRef, system: &str, user: &str) -> Result<String> {
+    async fn one(&self, label: &str, m: &ModelRef, system: &str, user: &str) -> Result<String> {
        if self.is_cancelled() {
            return Err(anyhow!("cancelled"));
        }
        let use_cli = self.subscription && cli_binary_for(&m.provider).is_some();
        let progress = self.progress();
        let mut last = anyhow::anyhow!("no attempt");
        for attempt in 0..3u64 {
            if self.is_cancelled() {
                return Err(anyhow!("cancelled"));
            }
            if attempt > 0 {
                // 1.5s, 4.5s backoff.
                tokio::time::sleep(std::time::Duration::from_millis(1500 * attempt * attempt.max(1))).await;
            }
-            let r = if use_cli {
+            let call = async {
                if use_cli {
                    self.client
-                    .chat_cli(&m.provider, &m.model, system, user, self.mcp_config.as_deref())
+                        .chat_cli(label, &m.provider, &m.model, system, user, self.mcp_config.as_deref(), progress.clone())
                        .await
                } else {
                    self.client.chat(m, system, user).await
                }
            };
            // Race the in-flight call against a HARD cancel: when the user picks
            // "report raw" / "discard" on /stop, drop the call future so the
            // CLI child (spawned with kill_on_drop) is terminated immediately
            // instead of finishing its whole command sequence.
            let r = tokio::select! {
                biased;
                _ = wait_cancelled(&self.cancel) => return Err(anyhow!("cancelled")),
                r = call => r,
            };
            match r {
                Ok(t) => return Ok(t),
                // Don't burn retries on exhaustion — surface it so the caller
                // can park and let the user /continue.
                Err(e) if is_exhaustion(&e) => return Err(e),
                Err(e) => last = e,
            }
        }
@@ -87,25 +222,51 @@ impl ModelPool {
    }
    /// Complete a prompt, trying each candidate model until one succeeds.
    /// Returns the model that answered and its text.
    pub async fn complete(&self, system: &str, user: &str) -> Result<(ModelRef, String)> {
-        self.complete_routed(Task::Default, system, user).await
+        self.complete_routed(Task::Default, "", system, user).await
    }
-    /// Router-aware completion: reorder the candidate panel by task before the
+    /// Router-aware completion. `label` tags streamed activity (agent name).
-    /// failover loop. Recon/triage prefer a fast/cheap model to save tokens and
+    pub async fn complete_routed(&self, task: Task, label: &str, system: &str, user: &str) -> Result<(ModelRef, String)> {
    /// latency; exploitation prefers the strongest (primary) model.
    pub async fn complete_routed(&self, task: Task, system: &str, user: &str) -> Result<(ModelRef, String)> {
        let _permit = self.sem.acquire().await.expect("semaphore closed");
-        let order = self.route(task);
+        loop {
            if self.is_cancelled() {
                return Err(anyhow!("cancelled"));
            }
            // User-supplied fallback models (via /continue) are tried first.
            let mut order = self.route(task);
            if let Ok(fb) = self.fallback.lock() {
                for m in fb.iter().rev() {
                    if !order.iter().any(|o| o.provider == m.provider && o.model == m.model) {
                        order.insert(0, m.clone());
                    }
                }
            }
            let mut last = anyhow!("no candidate models");
            let mut exhausted = false;
            for m in &order {
-            match self.one(m, system, user).await {
+                if self.is_cancelled() {
                    return Err(anyhow!("cancelled"));
                }
                match self.one(label, m, system, user).await {
                    Ok(text) => return Ok((m.clone(), text)),
-                Err(e) => last = e,
+                    Err(e) => {
                        if is_exhaustion(&e) {
                            exhausted = true;
                        }
                        last = e;
                    }
                }
-        Err(last)
+            }
            // Every candidate failed. If it was token/quota exhaustion, park the
            // run until the user runs /continue, then retry the whole order (now
            // including any fallback model they added). Otherwise, give up.
            if exhausted && !self.is_cancelled() {
                self.park_exhausted(&last).await;
                continue;
            }
            return Err(last);
        }
    }
    /// Reorder candidates for a task. With a single-model panel this is a no-op.
@@ -149,7 +310,7 @@ impl ModelPool {
                Ok(p) => p,
                Err(_) => break,
            };
-            if let Ok(text) = self.one(m, system, user).await {
+            if let Ok(text) = self.one("validate", m, system, user).await {
                total += 1;
                let t = text.to_lowercase();
                if t.contains("\"verdict\": \"confirmed\"")
@@ -164,3 +325,11 @@ impl ModelPool {
        (confirmed, total)
    }
 }
 /// Resolve once the HARD-cancel flag flips. Lets `tokio::select!` race an
 /// in-flight model call against cancellation and drop it on the spot.
 async fn wait_cancelled(flag: &Arc<AtomicBool>) {
    while !flag.load(Ordering::Relaxed) {
        tokio::time::sleep(Duration::from_millis(120)).await;
    }
 }
@@ -69,8 +69,26 @@ pub fn html(target: &str, findings: &[Finding]) -> String {
        rows
    };
    // Attack graph (Mermaid) + kill-chain table.
    let graph = crate::attack_graph::mermaid(&sorted);
    let graph_block = if graph.is_empty() {
        String::new()
    } else {
        let rows: String = sorted.iter().map(|f| format!(
            "<tr><td>{}</td><td><span class=sev style=background:{}>{}</span></td><td>{}</td><td>{}</td><td>{}</td><td>{}</td></tr>",
            esc(&f.stage), sev_color(&f.severity), esc(&f.severity), esc(&f.title),
            esc(&f.owasp), esc(&f.mitre), esc(&f.exploitability))).collect();
        format!(
            "<h2>Attack Path &amp; Kill Chain</h2>\
             <div class=mermaid>{graph}</div>\
             <table class=kc><tr><th>Stage</th><th>Sev</th><th>Finding</th><th>OWASP</th><th>MITRE</th><th>Exploitability</th></tr>{rows}</table>\
             <script type=module>import mermaid from 'https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs';mermaid.initialize({{startOnLoad:true,theme:'dark'}});</script>"
        )
    };
    format!(
        "<!DOCTYPE html><html><head><meta charset=utf-8><title>NeuroSploit Report — {t}</title><style>\
         table.kc{{border-collapse:collapse;width:100%;margin:14px 0;font-size:13px}}table.kc th,table.kc td{{border:1px solid #e3e3e3;padding:6px 9px;text-align:left}}\
         .mermaid{{background:#0f1117;border-radius:10px;padding:16px;margin:14px 0;overflow:auto}}\
         body{{font:14px/1.6 -apple-system,Segoe UI,Roboto,sans-serif;color:#1a1a1a;max-width:860px;margin:40px auto;padding:0 24px}}\
         h1{{margin:0}}.meta{{color:#666;margin:4px 0 18px}}.chip{{color:#fff;border-radius:999px;padding:4px 12px;margin-right:8px;font-size:13px;font-weight:600}}\
         .finding{{border:1px solid #e3e3e3;border-radius:12px;padding:16px 20px;margin:16px 0}}.finding h3{{margin:0 0 8px;font-size:16px}}\
@@ -79,10 +97,10 @@ pub fn html(target: &str, findings: &[Finding]) -> String {
         h4{{margin:12px 0 3px;font-size:12px;text-transform:uppercase;letter-spacing:.5px;color:#8b5cf6}}\
         .b{{color:#8b5cf6;font-weight:800}}</style></head><body>\
         <h1><span class=b>NeuroSploit</span> Penetration Test Report</h1>\
-         <div class=meta>Target: <b>{t}</b> · v3.4.1 Rust harness · multi-model validated</div>\
+         <div class=meta>Target: <b>{t}</b> · v3.5.1 Rust harness · multi-model validated</div>\
-         <div>{chips}</div><h2>Findings ({n})</h2>{body}\
+         <div>{chips}</div>{graph_block}<h2>Findings ({n})</h2>{body}\
-         <p class=meta>Authorized testing only. Findings confirmed by multi-model adversarial voting.<br>NeuroSploit v3.4.1 · by <b>Joas A Santos</b> &amp; <b>Red Team Leaders</b></p></body></html>",
+         <p class=meta>Authorized testing only. Findings confirmed by multi-model adversarial voting.<br>NeuroSploit v3.5.1 · by <b>Joas A Santos</b> &amp; <b>Red Team Leaders</b></p></body></html>",
-        t = esc(target), chips = chips, n = sorted.len(), body = body,
+        t = esc(target), chips = chips, n = sorted.len(), body = body, graph_block = graph_block,
    )
 }
@@ -117,13 +135,14 @@ pub fn typst_report(target: &str, findings: &[Finding], dir: &Path) -> std::io::
    let mut data = String::new();
    data.push_str(&format!(
        "#let meta = (target: {}, run_id: {}, generated: {}, model: {})\n",
-        tq(target), tq(&run_id), tq("NeuroSploit v3.4.1"), tq("multi-model")
+        tq(target), tq(&run_id), tq("NeuroSploit v3.5.1"), tq("multi-model")
    ));
    data.push_str("#let findings = (\n");
    for f in sorted_findings(findings) {
        let owasp = if f.owasp.is_empty() { f.cwe.clone() } else { f.owasp.clone() };
        data.push_str(&format!(
-            "  (severity: {}, title: {}, agent: {}, cwe: {}, cvss: {}, endpoint: {}, payload: {}, evidence: {}, impact: {}, remediation: {}, votes: {}, confidence: {}),\n",
+            "  (severity: {}, title: {}, agent: {}, cwe: {}, owasp: {}, cvss: {}, endpoint: {}, payload: {}, evidence: {}, impact: {}, remediation: {}, votes: {}, confidence: {}),\n",
-            tq(&f.severity), tq(&f.title), tq(&f.agent), tq(&f.cwe), tq(&f.cvss),
+            tq(&f.severity), tq(&f.title), tq(&f.agent), tq(&f.cwe), tq(&owasp), tq(&f.cvss),
            tq(&f.endpoint), tq(&f.payload), tq(&f.evidence), tq(&f.impact),
            tq(&f.remediation), tq(&f.votes), f.confidence,
        ));
@@ -28,6 +28,25 @@ pub struct Finding {
    /// Per-model vote summary, e.g. "3/4 confirmed".
    #[serde(default)]
    pub votes: String,
    // --- attack-graph / kill-chain mapping (best-effort, optional) ---
    /// OWASP Top 10 category, e.g. "A03:2021-Injection".
    #[serde(default)]
    pub owasp: String,
    /// MITRE ATT&CK technique id, e.g. "T1190".
    #[serde(default)]
    pub mitre: String,
    /// Kill-chain stage: recon|initial-access|execution|privesc|lateral|exfil|impact.
    #[serde(default)]
    pub stage: String,
    /// Exploitability: trivial|moderate|hard.
    #[serde(default)]
    pub exploitability: String,
    /// Business impact, one line.
    #[serde(default)]
    pub business_impact: String,
    /// IDs of findings this one chains from (attack-path edges).
    #[serde(default)]
    pub chains_from: Vec<String>,
 }
 impl Default for Finding {
@@ -47,6 +66,12 @@ impl Default for Finding {
            confidence: 0.0,
            validated: false,
            votes: String::new(),
            owasp: String::new(),
            mitre: String::new(),
            stage: String::new(),
            exploitability: String::new(),
            business_impact: String::new(),
            chains_from: Vec::new(),
        }
    }
 }
@@ -83,6 +108,21 @@ pub struct RunConfig {
    /// Verbose: log each agent as it launches, recon snippet, and votes.
    #[serde(default)]
    pub verbose: bool,
    /// Free-text instructions from the operator that steer agent selection and
    /// execution (e.g. "focus on injection and broken access control").
    #[serde(default)]
    pub instructions: Option<String>,
    /// Authentication material to use against the target so agents test as an
    /// authenticated user (e.g. "Authorization: Bearer <jwt>" or "Cookie: session=...").
    #[serde(default)]
    pub auth: Option<String>,
    /// Greybox: a source repository to review alongside the live `target` URL.
    #[serde(default)]
    pub repo: Option<String>,
    /// Explicit agent allowlist. When non-empty, the pipeline runs exactly these
    /// agents (skipping recon-based selection) — used by the category picker.
    #[serde(default)]
    pub pinned: Vec<String>,
 }
 fn default_vote() -> usize {
@@ -105,6 +145,10 @@ impl RunConfig {
            workdir: None,
            rl_path: None,
            verbose: false,
            instructions: None,
            auth: None,
            repo: None,
            pinned: Vec::new(),
        }
    }
 }
@@ -0,0 +1,37 @@
 # NeuroSploit — example credentials file for authenticated testing.
 # Pass with:  neurosploit greybox <repo> --url <app> --creds creds.yaml
 #        or:  neurosploit run <url> --creds creds.yaml   (after adding --creds support)
 #        or in the interactive session:  /creds creds.yaml
 #
 # Provide ANY of the auth materials below (first match wins), and/or a `login`
 # flow the agents will perform with curl before testing.
 # --- direct auth material (pick one) ---
 jwt: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWRtaW4ifQ.signature
 # header: "X-Api-Key: 0123456789abcdef"
 # cookie: "session=deadbeef; role=admin"
 # --- OR an automated login flow ---
 login:
  url: http://localhost:8080/login
  method: POST
  username_field: username
  password_field: password
  username: admin
  password: password
  success: Logout        # text that appears on a successful login
 # --- infra/host credentials (used by `neurosploit host <ip> --creds creds.yaml`) ---
 ssh:
  host: 10.0.0.5
  port: 22
  user: ubuntu
  password: s3cret        # or:
  key: /home/op/id_ed25519
 windows:                  # also used for Active Directory
  host: 10.0.0.10
  domain: CORP
  user: jdoe
  password: Winter2026!   # or pass-the-hash:
  hash: aad3b435b51404eeaad3b435b51404ee:NThashhere
@@ -1,4 +1,4 @@
-// NeuroSploit v3.4.1 — Typst report template (blank, structured).
+// NeuroSploit v3.5.1 — Typst report template (blank, structured).
 //
 // The harness generates `report.typ` per run by prepending a `findings` array
 // and a `meta` dict, then including this template's rendering logic. This file
@@ -24,7 +24,7 @@
 #set page(margin: 2cm, numbering: "1", footer: context [
  #set text(size: 8pt, fill: gray)
-  NeuroSploit v3.4.1 · #meta.target · confidential
+  NeuroSploit v3.5.1 · #meta.target · confidential
  #h(1fr) #counter(page).display()
 ])
 #set text(font: ("Helvetica Neue", "Helvetica", "Arial"), size: 10pt)
@@ -71,13 +71,32 @@
  )
 ]
 #let sorted = findings.sorted(key: f => sevrank(f.severity))
 // ---- Vulnerability summary table ----
 #if sorted.len() > 0 [
  #v(8pt)
  == Vulnerability Summary
  #v(4pt)
  #table(
    columns: (auto, 1fr, auto, auto, auto),
    inset: 6pt, align: (left + horizon, left + horizon, center + horizon, center + horizon, center + horizon),
    stroke: 0.5pt + rgb("#dddddd"),
    table.header(
      text(weight: "bold")[\#], text(weight: "bold")[Vulnerability],
      text(weight: "bold")[Severity], text(weight: "bold")[CVSS], text(weight: "bold")[OWASP / CWE],
    ),
    ..sorted.enumerate().map(((i, f)) => (
      str(i + 1), f.title, sevbadge(f.severity), f.cvss, f.owasp,
    )).flatten()
  )
 ]
 #v(10pt)
 #line(length: 100%, stroke: 0.5pt + gray)
-// ---- Findings ----
+// ---- Detailed findings ----
 = Findings
 #let sorted = findings.sorted(key: f => sevrank(f.severity))
 #if sorted.len() == 0 [
  #text(fill: gray)[_Nothing to report._]
 ]
@@ -86,14 +105,20 @@
    stroke: (left: 3pt + sevcolor.at(f.severity, default: gray), rest: 0.5pt + rgb("#dddddd")))[
    #sevbadge(f.severity) #h(6pt) #text(12pt, weight: "bold")[#str(i + 1). #f.title]
    #v(4pt)
-    #text(9pt, fill: gray)[
+    #table(
-      agent: #raw(f.agent) · CWE: #f.cwe · CVSS: #f.cvss · votes: #f.votes · confidence: #str(f.confidence)
+      columns: (auto, 1fr, auto, 1fr),
-    ]
+      inset: 4pt, stroke: none, align: left + horizon,
-    #v(2pt) #text(9pt)[Endpoint: #raw(f.endpoint)]
+      text(8pt, fill: gray)[Criticality], text(8pt)[#f.severity],
-    #v(5pt) #strong[Payload] #linebreak() #raw(f.payload)
+      text(8pt, fill: gray)[CVSS], text(8pt)[#f.cvss],
      text(8pt, fill: gray)[OWASP/CWE], text(8pt)[#f.owasp · #f.cwe],
      text(8pt, fill: gray)[Confidence], text(8pt)[#f.votes votes · #str(f.confidence)],
      text(8pt, fill: gray)[Location], text(8pt)[#raw(f.endpoint)],
      text(8pt, fill: gray)[Agent], text(8pt)[#raw(f.agent)],
    )
    #v(4pt) #strong[Description / Impact] #linebreak() #text(9pt)[#f.impact]
    #v(4pt) #strong[Proof of Concept] #linebreak() #raw(f.payload)
    #v(3pt) #strong[Evidence] #linebreak() #raw(f.evidence)
-    #v(3pt) #strong[Impact:] #f.impact
+    #v(3pt) #strong[Remediation] #linebreak() #text(9pt)[#f.remediation]
    #v(2pt) #strong[Remediation:] #f.remediation
  ]
  #v(8pt)
 ]
@@ -0,0 +1,143 @@
 #!/usr/bin/env python3
 """
 NeuroSploit v3.5.1 — application-stack & CVE-hunting agents.
 Adds IIS/.NET, CMS (WordPress/Drupal/Joomla/etc.), app-server and known-CVE
 exploitation agents to agents_md/vulns/. Credits: Joas A Santos & Red Team Leaders.
 """
 import os
 ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 OUT = os.path.join(ROOT, "agents_md", "vulns")
 def render(a):
    L = [f"# {a['title']} Agent\n", "## User Prompt",
         f"You are testing **{{target}}** for {a['for']}.\n",
         "**Recon Context:**\n{recon_json}\n", "**METHODOLOGY:**\n"]
    for i, (s, bs) in enumerate(a["steps"], 1):
        L.append(f"### {i}. {s}")
        L += [f"- {b}" for b in bs]
        L.append("")
    n = len(a["steps"]) + 1
    L += [f"### {n}. Report Format", "For each CONFIRMED finding:", "```", "FINDING:",
          f"- Title: {a['title']} at [endpoint]", f"- Severity: {a['sev']}", f"- CWE: {a['cwe']}",
          "- Endpoint: [full URL]", "- Vector: [what/where]", "- Payload: [exact payload/command]",
          "- Evidence: [raw tool output proving it]", f"- Impact: {a['impact']}",
          f"- Remediation: {a['fix']}", "```\n", "## System Prompt", a["system"]]
    return "\n".join(L) + "\n"
 def A(name, title, vc, cwe, sev, steps, fix, impact):
    return {"name": name, "title": title, "for": vc, "sev": sev, "cwe": cwe, "impact": impact,
            "fix": fix, "steps": steps,
            "system": (f"You are a specialist in {vc}. AUTHORIZED engagement. Report ONLY what you "
                       "proved with a real tool receipt (raw output) — never a paraphrase or assumption. "
                       "Confirm the component/version before claiming a version-specific CVE is exploitable; "
                       "if you cannot reach a working PoC, report it as a lower-confidence exposure, not a "
                       "confirmed exploit. No destructive/DoS actions. Credits: Joas A Santos and Red Team Leaders.")}
 AGENTS = [
 # ---- IIS / ASP.NET ----
 A("iis_tilde_shortname", "IIS Tilde (~) Short-Name Enumeration", "IIS 8.3 short-name disclosure",
   "CWE-200", "Medium",
   [("Detect", ["Probe `GET /*~1*/.aspx` style requests; a 404-vs-error differential reveals 8.3 short names",
                "Confirm IIS version from Server header"]),
    ("Enumerate", ["Brute the short names char by char to reveal hidden files/dirs"]),
    ("Confirm", ["Show recovered short names mapping to real sensitive files"])],
   "Disable 8.3 name creation; patch IIS", "Discovery of hidden files/backups/configs"),
 A("iis_webdav", "IIS WebDAV Misconfiguration", "exposed/unsafe WebDAV on IIS",
   "CWE-650", "High",
   [("Detect", ["`OPTIONS /` — look for DAV header / PUT/MOVE/COPY allowed"]),
    ("Test write", ["Attempt PUT of a benign file; if blocked, try `.txt`→MOVE→`.asp` trick"]),
    ("Confirm", ["Show an uploaded file is served (and if executable → RCE)"])],
   "Disable WebDAV or restrict methods/authn", "Arbitrary upload, potential RCE"),
 A("aspnet_viewstate", "ASP.NET ViewState Deserialization", "unprotected/known-key __VIEWSTATE deserialization",
   "CWE-502", "Critical",
   [("Inspect", ["Capture __VIEWSTATE; check if MAC is disabled (enableViewStateMac=false) or a known/leaked machineKey is in play"]),
    ("Weaponize", ["With a known/guessed machineKey, craft a ysoserial.net ViewState gadget"]),
    ("Confirm", ["Prove code execution via OOB callback or command output tied to a unique marker"])],
   "Enable ViewState MAC; rotate machineKey; patch", "Remote code execution"),
 A("aspnet_debug_trace", "ASP.NET Debug/Trace Exposure", "debug/trace enabled in production ASP.NET",
   "CWE-489", "Medium",
   [("Probe", ["Request `trace.axd`; send `DEBUG` verb; check `<compilation debug=...>` leakage via errors"]),
    ("Assess", ["Harvest request/session data, stack traces, app internals from trace output"]),
    ("Confirm", ["Show sensitive runtime data exposed"])],
   "Disable debug/trace; custom errors", "Information disclosure"),
 A("iis_handler_bypass", "IIS Handler/Extension Bypass", "auth or filter bypass via IIS handler quirks",
   "CWE-288", "High",
   [("Probe", ["Test path/extension tricks: `;.asp`, `::$DATA`, trailing dot, `%20`, case, `/admin/.`/`..%2f`"]),
    ("Bypass", ["Reach a protected handler/endpoint via a normalization or handler-mapping quirk"]),
    ("Confirm", ["Show access to a resource that should be blocked"])],
   "Consistent normalization; patch; tighten ACLs", "Auth/control bypass"),
 # ---- CMS general & specific ----
 A("cms_fingerprint", "CMS Fingerprint & Version", "CMS identification and version disclosure",
   "CWE-200", "Info",
   [("Identify", ["Detect CMS via meta generator, paths (`/wp-`, `/sites/`, `/administrator/`), headers, favicon hash",
                  "Run whatweb/wpscan-style detection without auth"]),
    ("Version", ["Pin exact version from readme/changelog/asset hashes"]),
    ("Map", ["List plugins/themes/modules and their versions for CVE correlation"])],
   "Hide version/generator; keep components updated", "Targeted exploitation surface"),
 A("wordpress_audit", "WordPress Security Audit", "WordPress core/plugin/theme weaknesses",
   "CWE-1395", "High",
   [("Enumerate", ["Users (`/?author=`, REST `/wp-json/wp/v2/users`), plugins/themes + versions, `xmlrpc.php`"]),
    ("Correlate CVEs", ["Map plugin/theme versions to known vulns (arbitrary upload, SQLi, auth bypass, LFI)"]),
    ("Confirm", ["Reproduce one concrete issue (e.g. unauth arbitrary file upload) with proof"])],
   "Update core/plugins/themes; harden; disable xmlrpc", "Site takeover / RCE"),
 A("joomla_audit", "Joomla Security Audit", "Joomla core/extension weaknesses",
   "CWE-1395", "High",
   [("Enumerate", ["Version (`administrator/manifests/files/joomla.xml`), components/extensions + versions"]),
    ("Correlate CVEs", ["Map to known Joomla/extension CVEs (SQLi, LFI, object injection)"]),
    ("Confirm", ["Reproduce one with proof"])],
   "Update core/extensions; harden admin", "Site takeover / data breach"),
 A("drupal_audit", "Drupal Security Audit", "Drupal core/module weaknesses (e.g. Drupalgeddon class)",
   "CWE-1395", "Critical",
   [("Enumerate", ["Version (CHANGELOG, headers), enabled modules"]),
    ("Correlate CVEs", ["Map to known Drupal RCE/SQLi (e.g. SA-CORE highly-critical classes)"]),
    ("Confirm", ["Reproduce with an OOB/output proof where applicable"])],
   "Patch core/modules promptly", "Remote code execution"),
 A("cms_default_admin", "CMS Admin Panel & Default Creds", "exposed CMS admin with weak/default credentials",
   "CWE-1392", "High",
   [("Locate", ["Find admin (`/wp-admin`, `/administrator`, `/user/login`, `/admin`)"]),
    ("Test (in scope)", ["Try supplied/default credentials; respect lockout/ROE — no out-of-scope brute force"]),
    ("Confirm", ["Show authenticated admin access"])],
   "Remove defaults; strong creds + MFA; restrict admin", "Full CMS compromise"),
 # ---- app servers / panels ----
 A("appserver_exposure", "App-Server Console Exposure", "exposed Tomcat/JBoss/Jenkins/Actuator consoles",
   "CWE-1188", "High",
   [("Discover", ["Probe `/manager/html`, `/jmx-console`, `/jenkins`, `/actuator`, `/console`, `/admin`"]),
    ("Assess", ["Test default/weak creds (in scope); check unauth-exposed management endpoints"]),
    ("Confirm", ["Demonstrate a management action / deploy / info-leak proving exposure (→ often RCE)"])],
   "Authenticate & network-restrict consoles; remove defaults", "Remote code execution / takeover"),
 A("git_svn_exposure_app", "Exposed VCS / Build Artifacts", "exposed .git/.svn/CI artifacts on the app host",
   "CWE-527", "High",
   [("Probe", ["Request `/.git/HEAD`, `/.svn/entries`, `/.env`, build/CI artifact paths"]),
    ("Recover", ["Dump source (git-dumper) / read secrets"]),
    ("Confirm", ["Show recovered source or live secret"])],
   "Block VCS/dotfiles from web; rotate secrets", "Source/secret disclosure → RCE"),
 # ---- CVE hunting ----
 A("cve_known_exploitation", "Known-CVE Exploitation Specialist", "exploiting known CVEs for the detected stack",
   "CWE-1395", "Critical",
   [("Identify versions", ["From recon, list each component + exact version (server, framework, CMS, plugins, libs)"]),
    ("Map to CVEs", ["Match versions to known CVEs; prioritise unauth RCE/SQLi/auth-bypass; note CVE id + CVSS",
                     "Prefer issues with a reliable, non-destructive PoC"]),
    ("Reproduce safely", ["Run a benign PoC (e.g. a version/echo check or OOB callback) to confirm the CVE is actually present and exploitable — never a destructive payload"]),
    ("Confirm", ["Report the CVE only when the PoC produced concrete proof (output/OOB); otherwise report it as 'potentially vulnerable (version match, unconfirmed)'"])],
   "Patch/upgrade the affected components; apply vendor advisories", "Depends on CVE — up to full compromise"),
 A("outdated_dependency_cve", "Outdated Component CVE Specialist", "outdated front-end/back-end components with known CVEs",
   "CWE-1104", "High",
   [("Inventory", ["Extract JS libs (jQuery, Angular, etc.), server modules, framework versions from responses/JS/headers"]),
    ("Correlate", ["Map each to known CVEs; flag the exploitable, reachable ones"]),
    ("Confirm", ["Prove exploitability where a safe PoC exists; else report as version-based exposure"])],
   "Upgrade components; dependency scanning in CI", "Varies — XSS/RCE/info-leak"),
 ]
 def main():
    os.makedirs(OUT, exist_ok=True)
    for a in AGENTS:
        open(os.path.join(OUT, a["name"] + ".md"), "w").write(render(a))
    print(f"wrote {len(AGENTS)} app-stack/CVE agents to {OUT}")
 if __name__ == "__main__":
    main()
@@ -0,0 +1,201 @@
 #!/usr/bin/env python3
 """
 NeuroSploit v3.5.1 — attack-chain agents.
 Each agent is a multi-stage exploitation-chaining playbook: take a confirmed
 entry-point weakness and escalate it through concrete stages to deeper impact
 (e.g. SQLi → RCE → local privilege escalation). Writes agents_md/chains/*.md.
 Credits: Joas A Santos & Red Team Leaders.
 """
 import os
 ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 OUT = os.path.join(ROOT, "agents_md", "chains")
 def render(a):
    L = [f"# {a['title']} Agent\n", "## User Prompt",
         f"You are executing a multi-stage ATTACK CHAIN against **{{target}}**: {a['chain']}.\n",
         "**Recon Context / prior findings:**\n{recon_json}\n",
         f"**GOAL:** {a['goal']}\n",
         "**CHAIN — advance stage by stage; each stage's output is the next stage's input. "
         "Use the ReAct loop and PROVE every stage with raw tool output before advancing:**\n"]
    for i, (stage, bs) in enumerate(a["stages"], 1):
        L.append(f"### Stage {i}. {stage}")
        L += [f"- {b}" for b in bs]
        L.append("")
    n = len(a["stages"]) + 1
    L += [f"### {n}. Report Format",
          "Report the chain as ONE finding (plus per-stage evidence):", "```", "FINDING:",
          f"- Title: {a['title']}", f"- Severity: {a['sev']}", f"- CWE: {a['cwe']}",
          "- Endpoint: [entry point]", "- Vector: [the full chain, stage by stage]",
          "- Payload: [the key payloads/commands per stage]",
          "- Evidence: [raw output proving EACH stage actually executed]",
          f"- Impact: {a['impact']}", f"- Remediation: {a['fix']}",
          "- chains_from: [ids of the prerequisite findings this builds on]", "```\n",
          "## System Prompt", a["system"]]
    return "\n".join(L) + "\n"
 def A(name, title, chain, goal, cwe, sev, impact, fix, stages):
    return {"name": name, "title": title, "chain": chain, "goal": goal, "cwe": cwe,
            "sev": sev, "impact": impact, "fix": fix, "stages": stages,
            "system": ("You are an exploit-chaining specialist. Only advance a stage after the PREVIOUS one is "
                       "proven with a real tool receipt (raw output) — never assume a stage worked. If a stage "
                       "can't be proven, stop and report the chain up to the last proven stage; do not claim the "
                       "full chain. AUTHORIZED engagement; no destructive/DoS actions. Each reported stage must "
                       "carry its own evidence. Credits: Joas A Santos & Red Team Leaders.")}
 CHAINS = [
 A("chain_sqli_to_rce_to_lpe",
   "SQLi → RCE → Local PrivEsc Chain",
   "SQL injection → command execution → local privilege escalation",
   "Turn a database-layer injection into root/SYSTEM on the host.",
   "CWE-89", "Critical",
   "Full host compromise originating from a web injection",
   "Parameterize queries; least-privilege DB account; harden host; patch local vectors",
   [("Exploit the SQL injection", ["Confirm injection (error/boolean/time); identify DBMS and privileges",
                                    "Enumerate whether stacked queries / FILE / xp_cmdshell / INTO OUTFILE are available"]),
    ("Pivot SQLi → RCE", ["MSSQL: enable & use `xp_cmdshell`; MySQL: `INTO OUTFILE` a webshell to a known web path; PostgreSQL: `COPY ... PROGRAM`",
                          "Confirm OS command execution with `id`/`whoami` output"]),
    ("Establish a foothold", ["Drop/upgrade to a stable shell as the web/db service user"]),
    ("Local privilege escalation", ["Enumerate SUID/sudo/cron/kernel (Linux) or token/service/unquoted-path (Windows)",
                                     "Escalate to root/SYSTEM and prove with a privileged command output"])]),
 A("chain_ssrf_to_aws_compromise",
   "SSRF → AWS Credential Compromise Chain",
   "SSRF → cloud metadata → IAM credentials → cloud account access",
   "Convert a server-side request forgery into valid AWS credentials and account access.",
   "CWE-918", "Critical",
   "Cloud account compromise via stolen IAM role credentials",
   "Enforce IMDSv2 hop-limit=1; egress allowlists; SSRF input validation; scoped IAM roles",
   [("Confirm the SSRF primitive", ["Find a server-side fetch you control (url/webhook/import/pdf/image param)",
                                     "Prove it reaches an attacker-controlled / internal host"]),
    ("Reach the metadata service", ["IMDSv2: PUT `/latest/api/token` then GET with the token header; else IMDSv1 GET",
                                     "Retrieve `/latest/meta-data/iam/security-credentials/<role>`"]),
    ("Harvest IAM credentials", ["Capture AccessKeyId/SecretAccessKey/Token from the metadata response"]),
    ("Use the credentials (in scope)", ["`aws sts get-caller-identity` to confirm; enumerate permitted actions read-only",
                                        "Prove access to at least one resource the role can reach"])]),
 A("chain_ssrf_to_rce",
   "SSRF → RCE Chain",
   "SSRF → internal service abuse → remote code execution",
   "Escalate an SSRF into code execution via a reachable internal service.",
   "CWE-918", "Critical",
   "Remote code execution pivoted through an internal service",
   "Egress controls; authenticate internal services; SSRF allowlists",
   [("Confirm SSRF + map internals", ["Prove the SSRF; port-scan internal hosts through it (gopher/http)",
                                       "Identify exploitable internal services (Redis, unauth admin, CI, internal API)"]),
    ("Weaponize the internal service", ["e.g. Redis → write SSH key/cron/module; internal Jenkins/Actuator → job/exec; gopher:// to craft raw protocol payloads"]),
    ("Achieve RCE", ["Trigger command execution on the internal/back-end host"]),
    ("Confirm", ["Prove execution with an OOB callback or command output tied to a unique marker"])]),
 A("chain_upload_to_rce",
   "File Upload → RCE Chain",
   "insecure file upload → webshell → remote code execution",
   "Turn an unrestricted/insecure upload into code execution.",
   "CWE-434", "Critical",
   "Remote code execution via uploaded executable content",
   "Validate type by content; randomize names; store outside webroot; non-exec storage",
   [("Probe the upload", ["Map accepted types/extensions, storage path, and how files are served",
                          "Test bypasses: double extension, content-type spoof, magic-byte prefix, null byte, .htaccess/.phar"]),
    ("Upload a payload", ["Place a minimal webshell/handler in a web-served, executable location"]),
    ("Locate & trigger", ["Find the served URL of the upload; request it to execute"]),
    ("Confirm RCE", ["Run `id`/`whoami`; capture output proving execution"])]),
 A("chain_upload_lfi_rce_lpe",
   "Upload → LFI → RCE → LPE Chain",
   "file upload + local file inclusion → log/session poisoning → RCE → privilege escalation",
   "Chain a benign upload and an LFI into code execution and then root.",
   "CWE-98", "Critical",
   "Host compromise from a non-executable upload chained through LFI",
   "Fix LFI (allowlist includes); validate uploads; harden host",
   [("Confirm the LFI", ["Prove local file inclusion (read /etc/passwd or app config); identify wrappers (php://, data://, zip://)"]),
    ("Plant controllable content via upload", ["Upload a file whose path/content you can later include (image with PHP, zip for zip:// , or use the LFI to read your uploaded file)"]),
    ("LFI → RCE", ["Include the planted file, or poison logs/session/`/proc/self/environ` then include it to execute code"]),
    ("Confirm RCE then escalate", ["Prove command execution; then enumerate and perform local privilege escalation to root/SYSTEM"])]),
 A("chain_xss_to_account_takeover",
   "XSS → Session/Account Takeover Chain",
   "stored/reflected XSS → session or token theft → account takeover",
   "Escalate XSS into full takeover of a victim (incl. admin) account.",
   "CWE-79", "High",
   "Account takeover (incl. privileged) via client-side execution",
   "Output encoding + CSP; HttpOnly/SameSite cookies; rotate tokens",
   [("Prove execution", ["Confirm the payload executes in the victim's browser context (Playwright: alert/DOM), not just reflects"]),
    ("Steal the session", ["Exfiltrate the session cookie/JWT/CSRF token to a collaborator, or perform actions in-context if HttpOnly"]),
    ("Take over the account", ["Replay the stolen session, or change email/password/MFA via in-context requests"]),
    ("Confirm + escalate", ["Prove control of the victim account; target an admin for privilege escalation"])]),
 A("chain_idor_to_takeover",
   "IDOR → Mass Account Takeover Chain",
   "IDOR → cross-account data → credential/role manipulation → takeover",
   "Chain object-level authz failure into taking over arbitrary accounts.",
   "CWE-639", "High",
   "Mass account takeover via broken object-level authorization",
   "Enforce per-object ownership on every endpoint; indirect references",
   [("Confirm the IDOR", ["Access another user's object with your session, proven by their data"]),
    ("Find a state-changing IDOR", ["Locate IDOR on email/password/role/API-key endpoints"]),
    ("Manipulate the victim account", ["Change a victim's email or reset token / elevate role via the IDOR"]),
    ("Confirm takeover", ["Log in as / act as the victim; demonstrate control"])]),
 A("chain_ssti_to_rce_to_cloud",
   "SSTI → RCE → Cloud Pivot Chain",
   "template injection → RCE → host creds → cloud/lateral movement",
   "Go from template injection to code execution to cloud or lateral access.",
   "CWE-1336", "Critical",
   "Cloud/lateral compromise originating from template injection",
   "Never render user input as templates; sandbox; scope host IAM/creds",
   [("Confirm SSTI → RCE", ["Fingerprint the engine (`{{7*7}}` etc.); use the gadget to execute a command; prove with output"]),
    ("Loot the host", ["Read env/config/instance metadata for cloud creds, DB creds, tokens"]),
    ("Pivot", ["Use recovered creds against cloud APIs or adjacent internal hosts"]),
    ("Confirm impact", ["Prove access to a cloud resource or a second host with evidence"])]),
 A("chain_default_creds_to_domain",
   "Default Creds → Foothold → Domain Compromise Chain",
   "default/weak creds → host foothold → AD escalation → domain dominance",
   "Chain an exposed credential into Active Directory domain compromise.",
   "CWE-798", "Critical",
   "Domain compromise from a single weak/default credential",
   "Rotate defaults; unique strong passwords; tiered admin; monitor",
   [("Get the foothold", ["Authenticate with the default/weak/reused credential (SSH/WinRM/SMB/web)"]),
    ("Enumerate AD", ["From the foothold, run BloodHound/netexec; map attack paths, roastable accounts, ACLs"]),
    ("Escalate in AD", ["Kerberoast/AS-REP-roast, abuse an ACL edge, or relay — recover higher-priv creds"]),
    ("Reach domain dominance", ["Demonstrate DCSync or DA-equivalent access (single test account) proving the path"])]),
 A("chain_deserialization_to_rce",
   "Insecure Deserialization → RCE Chain",
   "untrusted deserialization → gadget chain → remote code execution",
   "Turn a deserialization sink into reliable code execution.",
   "CWE-502", "Critical",
   "Remote code execution via unsafe object deserialization",
   "Never deserialize untrusted data; allowlist types; safe formats",
   [("Locate the sink", ["Identify where attacker data is deserialized (cookie/param/file/RPC); fingerprint the format/library"]),
    ("Build the gadget", ["Select a working gadget chain (ysoserial/ysoserial.net/PyYAML/pickle) for the target stack"]),
    ("Execute", ["Deliver the payload to the sink"]),
    ("Confirm", ["Prove execution via OOB callback or command output with a unique marker"])]),
 A("chain_exposed_git_to_rce",
   "Exposed .git/.env → Secret → RCE Chain",
   "exposed source/secrets → recovered credentials → authenticated RCE",
   "Chain leaked source/secrets into authenticated code execution.",
   "CWE-527", "High",
   "Code execution using credentials recovered from exposed source/secrets",
   "Block dotfiles from web; rotate leaked secrets; vault storage",
   [("Recover the source/secrets", ["Dump exposed `.git` (git-dumper) or read `.env`/config; extract keys/creds/tokens"]),
    ("Validate the secrets", ["Confirm a recovered credential/key is live (admin panel, cloud, DB, CI)"]),
    ("Gain execution", ["Use the access to deploy code / run a CI job / write a webshell / exec via admin feature"]),
    ("Confirm RCE", ["Prove command execution with output"])]),
 A("chain_subdomain_takeover_to_phishing",
   "Subdomain Takeover → Trusted Phishing/Cookie Chain",
   "dangling DNS → subdomain takeover → trusted-origin abuse",
   "Chain a dangling record into hosting attacker content on a trusted subdomain.",
   "CWE-350", "High",
   "Trusted-origin abuse (cookie theft / phishing / OAuth) via a taken-over subdomain",
   "Remove dangling DNS; monitor; scope cookies/CSP per-host",
   [("Find the dangling record", ["Identify a CNAME/A pointing to an unclaimed provider resource"]),
    ("Claim it", ["Register the resource so the subdomain serves your content (benign PoC)"]),
    ("Abuse the trust", ["Show impact: wildcard-cookie capture, OAuth redirect trust, or CSP allowlist bypass"]),
    ("Confirm", ["Demonstrate the concrete trusted-origin abuse with evidence"])]),
 ]
 def main():
    os.makedirs(OUT, exist_ok=True)
    for a in CHAINS:
        open(os.path.join(OUT, a["name"] + ".md"), "w").write(render(a))
    print(f"wrote {len(CHAINS)} chain agents to {OUT}")
 if __name__ == "__main__":
    main()
@@ -0,0 +1,117 @@
 #!/usr/bin/env python3
 """
 NeuroSploit v3.5.1 — infrastructure host agents (Linux / Windows / Active Directory).
 Writes agents_md/infra/*.md. Credits: Joas A Santos & Red Team Leaders.
 """
 import os
 ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 OUT = os.path.join(ROOT, "agents_md", "infra")
 def render(a):
    L = [f"# {a['title']} Agent\n", "## User Prompt",
         f"You are testing **{{target}}** (a host/infrastructure target) for {a['for']}.\n",
         "**Recon Context:**\n{recon_json}\n",
         "Authentication/credentials, if provided, are described in the operator directives above.\n",
         "**METHODOLOGY:**\n"]
    for i, (s, bs) in enumerate(a["steps"], 1):
        L.append(f"### {i}. {s}")
        L += [f"- {b}" for b in bs]
        L.append("")
    n = len(a["steps"]) + 1
    L += [f"### {n}. Report Format", "For each CONFIRMED finding:", "```", "FINDING:",
          f"- Title: {a['title']} on [host]", f"- Severity: {a['sev']}", f"- CWE: {a['cwe']}",
          "- Endpoint: [host/service]", "- Vector: [how]", "- Payload: [command/PoC]",
          "- Evidence: [raw tool output proving it]", f"- Impact: {a['impact']}",
          f"- Remediation: {a['fix']}", "```\n",
          "## System Prompt", a["system"]]
    return "\n".join(L) + "\n"
 def A(name, title, vc, cwe, sev, steps, fix, impact):
    return {"name": name, "title": title, "for": vc, "sev": sev, "cwe": cwe, "impact": impact,
            "fix": fix, "steps": steps,
            "system": f"You are an infrastructure pentest specialist for {vc}. AUTHORIZED engagement. "
                      "Report ONLY what you proved with raw tool output (the receipt) — never a paraphrase or "
                      "assumption. If you lack access/observation to confirm, say so and gather more first. "
                      "Stay in scope; never run destructive or DoS actions. Credits: Joas A Santos & Red Team Leaders."}
 INFRA = [
 # ---- recon / network ----
 A("infra_port_service_scan", "Host Port & Service Scan", "open ports and service/version discovery", "CWE-200", "Info",
   [("Scan", ["`rustscan -a {target} -- -sV` if present, else `nmap -sV -sC -Pn {target}`",
              "Identify open TCP/UDP ports, service banners and versions"]),
    ("Triage", ["Flag risky services (SMB, RDP, SSH, WinRM, LDAP, databases) and outdated versions",
                "Correlate versions to known CVEs for downstream agents"])],
   "Close/patch exposed services; restrict by firewall", "Attack-surface mapping"),
 A("infra_smb_enum", "SMB/NetBIOS Enumeration", "SMB shares, sessions and misconfigurations", "CWE-200", "Medium",
   [("Enumerate", ["`netexec smb {target}` / `crackmapexec smb {target}` for hosts, signing, null sessions",
                   "`smbclient -L //{target}/ -N` to list shares; check anonymous read/write"]),
    ("Assess", ["Flag SMB signing disabled (relay risk), guest/anonymous access, writable shares"])],
   "Require SMB signing; disable guest; restrict shares", "Lateral movement, credential relay"),
 # ---- linux ----
 A("linux_priv_esc", "Linux Privilege Escalation", "local privilege-escalation paths on a Linux host", "CWE-269", "High",
   [("Enumerate (authenticated via SSH)", ["Run linpeas/`sudo -l`, SUID/SGID (`find / -perm -4000`), cron, capabilities, writable PATH",
                                            "Check kernel version for known local exploits"]),
    ("Confirm", ["Demonstrate an actual escalation to root (or a clear, reachable path) with command output"])],
   "Patch kernel; fix sudo/SUID/cron/permission issues", "Full host compromise"),
 A("linux_ssh_weak_auth", "SSH Weak Authentication", "weak/guessable SSH credentials or misconfig", "CWE-1391", "High",
   [("Assess", ["Check allowed auth methods; test provided creds with `ssh`/`sshpass`",
                "Only test supplied credentials — never brute force out of scope"]),
    ("Confirm", ["Show authenticated shell access with the credentials, capturing the session banner"])],
   "Key-only auth; strong passwords; fail2ban", "Unauthorized host access"),
 A("linux_sudo_misconfig", "Linux Sudo Misconfiguration", "exploitable sudo rules", "CWE-250", "High",
   [("Enumerate", ["`sudo -l`; look for NOPASSWD binaries and GTFObins-exploitable entries"]),
    ("Confirm", ["Escalate via a permitted binary and show `id`=root output"])],
   "Restrict sudo to least privilege; avoid shell-capable binaries", "Privilege escalation to root"),
 A("linux_cron_writable", "Writable Cron / Service Abuse", "world-writable cron jobs or unit files", "CWE-732", "High",
   [("Find", ["Inspect /etc/cron*, systemd units, and scripts they call for writable paths"]),
    ("Confirm", ["Plant a benign marker that the privileged job executes, proving control"])],
   "Fix permissions on jobs and their targets", "Privilege escalation"),
 # ---- windows ----
 A("windows_priv_esc", "Windows Privilege Escalation", "local privilege escalation on a Windows host", "CWE-269", "High",
   [("Enumerate (authenticated)", ["Run winPEAS/`whoami /priv`; check unquoted service paths, weak service perms, AlwaysInstallElevated, token privileges (SeImpersonate)"]),
    ("Confirm", ["Demonstrate escalation to SYSTEM/admin with command output (e.g. via a Potato technique where applicable)"])],
   "Patch; fix service perms; remove dangerous privileges", "Full host compromise"),
 A("windows_smb_signing", "SMB Signing & Relay Exposure", "SMB signing not required (NTLM relay risk)", "CWE-294", "Medium",
   [("Detect", ["`netexec smb {target}` — note `signing:False`"]),
    ("Assess", ["Explain the NTLM-relay exposure; confirm a coercible auth path only if in scope"])],
   "Enforce SMB signing; disable NTLM where possible", "Credential relay, lateral movement"),
 A("windows_winrm_access", "WinRM Authenticated Access", "remote management access via WinRM", "CWE-287", "Medium",
   [("Connect", ["`evil-winrm -i {target} -u <user> -p <pass>` (or -H <hash>) with supplied creds/hash"]),
    ("Confirm", ["Show an authenticated remote shell and the host context (`whoami`, hostname)"])],
   "Restrict WinRM; strong creds; network segmentation", "Remote host control"),
 # ---- active directory ----
 A("ad_kerberoasting", "AD Kerberoasting", "service accounts with crackable SPNs", "CWE-522", "High",
   [("Request", ["`netexec ldap {target} -u <user> -p <pass> --kerberoasting out.txt` or impacket GetUserSPNs"]),
    ("Crack & confirm", ["Crack the TGS hash offline (hashcat -m 13100); confirm a recovered service-account password"])],
   "Strong/long service-account passwords; gMSA", "Service-account compromise, lateral movement"),
 A("ad_asreproasting", "AD AS-REP Roasting", "accounts with Kerberos pre-auth disabled", "CWE-522", "High",
   [("Enumerate", ["impacket GetNPUsers / `netexec ldap {target} --asreproast out.txt` for DONT_REQ_PREAUTH accounts"]),
    ("Crack & confirm", ["Crack the AS-REP (hashcat -m 18200); confirm a recovered password"])],
   "Require Kerberos pre-auth; strong passwords", "Account compromise"),
 A("ad_acl_privesc", "AD ACL / DACL Abuse", "dangerous Active Directory ACLs", "CWE-269", "High",
   [("Map", ["Collect with bloodhound-python/SharpHound; find GenericAll/WriteDACL/ForceChangePassword edges"]),
    ("Confirm", ["Demonstrate one safe, reversible control step (e.g. shadow-cred / targeted password reset in a lab) proving the path"])],
   "Tighten ACLs; tiered admin model", "Domain privilege escalation"),
 A("ad_dcsync", "AD DCSync Exposure", "replication rights enabling DCSync", "CWE-269", "Critical",
   [("Check rights", ["Identify principals with DS-Replication-Get-Changes(-All) via BloodHound/ACL review"]),
    ("Confirm", ["With authorized creds, prove replication right (e.g. impacket secretsdump -just-dc-user for a single test account)"])],
   "Remove replication rights from non-DC principals", "Full domain credential compromise"),
 A("ad_default_creds", "AD/Host Default & Reused Credentials", "default or reused credentials across the domain", "CWE-798", "High",
   [("Spray (authorized, throttled)", ["With supplied account list, `netexec smb {target} -u users -p pass --continue-on-success` within ROE"]),
    ("Confirm", ["Show a successful authentication that should not have worked (reused/default cred)"])],
   "Rotate defaults; enforce unique strong passwords; lockout", "Lateral movement, domain access"),
 ]
 def main():
    os.makedirs(OUT, exist_ok=True)
    for a in INFRA:
        open(os.path.join(OUT, a["name"] + ".md"), "w").write(render(a))
    print(f"wrote {len(INFRA)} infra agents to {OUT}")
 if __name__ == "__main__":
    main()
@@ -0,0 +1,109 @@
 #!/usr/bin/env bash
 # NeuroSploit installer — by Joas A Santos & Red Team Leaders
 #
 #   curl -fsSL https://raw.githubusercontent.com/JoasASantos/NeuroSploit/main/setup.sh | bash
 #
 # Builds the v3.5.0 Rust harness and installs the `neurosploit` binary.
 # Safe to re-run (idempotent). Honors:
 #   NEUROSPLOIT_DIR   install/clone dir   (default: ~/.neurosploit)
 #   NEUROSPLOIT_REF   git branch/tag      (default: main)
 #   PREFIX            bin install prefix  (default: ~/.local/bin)
 set -euo pipefail
 REPO="https://github.com/JoasASantos/NeuroSploit.git"
 DIR="${NEUROSPLOIT_DIR:-$HOME/.neurosploit}"
 REF="${NEUROSPLOIT_REF:-main}"
 PREFIX="${PREFIX:-$HOME/.local/bin}"
 c()  { printf '\033[%sm%s\033[0m\n' "$1" "$2"; }
 say() { c '1;35' "  ▌ $*"; }
 ok()  { c '1;32' "  ✓ $*"; }
 warn(){ c '1;33' "  ! $*"; }
 die() { c '1;31' "  ✗ $*"; exit 1; }
 cat <<'BANNER'
   ███╗   ██╗███████╗██╗   ██╗██████╗  ██████╗
   ████╗  ██║██╔════╝██║   ██║██╔══██╗██╔═══██╗   NeuroSploit installer
   ██╔██╗ ██║█████╗  ██║   ██║██████╔╝██║   ██║   v3.5.1 — Rust harness
   ██║╚██╗██║██╔══╝  ██║   ██║██╔══██╗██║   ██║   by Joas A Santos
   ██║ ╚████║███████╗╚██████╔╝██║  ██║╚██████╔╝   & Red Team Leaders
   ╚═╝  ╚═══╝╚══════╝ ╚═════╝ ╚═╝  ╚═╝ ╚═════╝
 BANNER
 # ---- platform detection (Linux / macOS / Windows-via-WSL/MSYS · x64 / arm64) ----
 OS_RAW="$(uname -s)"
 ARCH_RAW="$(uname -m)"
 case "$OS_RAW" in
  Linux*)             OS="Linux" ;;
  Darwin*)            OS="macOS" ;;
  MINGW*|MSYS*|CYGWIN*) OS="Windows" ;;
  *)                  OS="$OS_RAW" ;;
 esac
 case "$ARCH_RAW" in
  x86_64|amd64)   ARCH="x64" ;;
  arm64|aarch64)  ARCH="arm64" ;;
  *)              ARCH="$ARCH_RAW" ;;
 esac
 say "Platform: $OS / $ARCH"
 if [ "$OS" = "Windows" ]; then
  warn "On native Windows, run this in WSL2, Git Bash or MSYS2. (Or build with: cargo build --release)"
 fi
 if [ "$OS" != "Linux" ] && [ "$OS" != "macOS" ] && [ "$OS" != "Windows" ]; then
  warn "Unrecognized OS '$OS_RAW' — attempting a generic Rust build anyway."
 fi
 # 1) git
 command -v git >/dev/null 2>&1 || die "git is required. Install git and re-run."
 # 2) Rust toolchain (rustup)
 if ! command -v cargo >/dev/null 2>&1; then
  [ -f "$HOME/.cargo/env" ] && . "$HOME/.cargo/env" || true
 fi
 if ! command -v cargo >/dev/null 2>&1; then
  say "Rust not found — installing rustup (stable, minimal)…"
  curl --proto '=https' --tlsv1.2 -fsSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
  . "$HOME/.cargo/env"
 fi
 ok "Rust: $(cargo --version)"
 # 3) clone or update
 if [ -d "$DIR/.git" ]; then
  say "Updating existing checkout at $DIR…"
  git -C "$DIR" fetch --depth 1 origin "$REF" && git -C "$DIR" checkout -q "$REF" && git -C "$DIR" reset -q --hard "origin/$REF" 2>/dev/null || git -C "$DIR" pull -q
 else
  say "Cloning $REPO ($REF) → $DIR…"
  git clone --depth 1 --branch "$REF" "$REPO" "$DIR" 2>/dev/null || git clone --depth 1 "$REPO" "$DIR"
 fi
 # 4) build
 say "Building release binary (first build downloads crates; grab a coffee)…"
 ( cd "$DIR/neurosploit-rs" && cargo build --release )
 BIN="$DIR/neurosploit-rs/target/release/neurosploit"
 [ -x "$BIN" ] || die "build did not produce $BIN"
 ok "Built: $("$BIN" --version 2>/dev/null || echo neurosploit)"
 # 5) install on PATH
 mkdir -p "$PREFIX"
 ln -sf "$BIN" "$PREFIX/neurosploit"
 ok "Installed → $PREFIX/neurosploit"
 # 6) optional tooling hints (don't fail if absent)
 say "Recommended tools for richer testing (optional):"
 for t in curl nmap rustscan ffuf node npx typst; do
  if command -v "$t" >/dev/null 2>&1; then ok "$t present"; else warn "$t missing"; fi
 done
 echo
 warn "Best run on Kali Linux  →  docker run -it --rm kalilinux/kali-rolling"
 warn "typst (PDF reports):  cargo install typst-cli   ·   rustscan:  cargo install rustscan"
 case ":$PATH:" in
  *":$PREFIX:"*) ;;
  *) warn "Add to PATH:  echo 'export PATH=\"$PREFIX:\$PATH\"' >> ~/.bashrc && source ~/.bashrc" ;;
 esac
 echo
 ok "Done. Authenticate a model, then launch:"
 echo "      neurosploit                 # interactive session"
 echo "      neurosploit run http://testphp.vulnweb.com/ --subscription --model anthropic:claude-opus-4-8 -v"
 echo "      neurosploit --help"