CyberSecurityUPandClaude Opus 4.8 07f97076de feat: multi-model preflight; deterministic subdomain fan-out for wildcard scope ...

(1) Preflight now checks EVERY configured model, not just the primary — a 3-model
jury that silently collapses to 1 (others not logged in / no key) is now shown:
each model prints usable/needs-login/needs-key, with a '→ N/M models usable'
summary. Fixes 'I set 3 models and only opus ran'. (qwen is API-only: use
nous:qwen3.8-max for Hermes, or export DASHSCOPE_API_KEY.)

(2) Wildcard engagement (*.domain in scope) now gets a deterministic subdomain
fan-out before recon: enumerate via crt.sh + subfinder/amass (in the Kali sandbox
when --sandbox, else host), keep only IN-SCOPE hosts, probe liveness, drop
soft-404/parked catch-alls, rank (401/403 auth hosts first — flagged for bypass —
then interesting names admin/api/dev/staging), and fold the live list into the
test surface so the run tests the WHOLE authorized domain end-to-end, not just the
seed host. Scope-respecting: one lightweight GET per host, no degradation.

(3) recon_tool() runs a recon tool in the Kali sandbox or on the host — the basis
for tool-powered recon.

423 tests passing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-10-04 07:54:15 -03:00

..

agents.rs

feat(container,coverage): Strix-1.6.2-inspired capabilities

2026-09-23 01:27:26 -03:00

assurance.rs

feat(report): SARIF 2.1.0 export + stronger cross-object reference mining (v4.2.1)

2026-09-24 12:14:49 -03:00

attack_graph.rs

feat(agents): deep Active Directory suite — 25 host/infra skills + 7 AD chains

2026-10-03 01:08:57 -03:00

audit.rs

feat(assurance): target gate (default-deny), evidence-graded CVSS, audit anchoring, P1–P5 bundle

2026-09-18 21:25:21 -03:00

belief.rs

v3.6.5: LLM red-teaming (jailbreaks & prompt injection) + Opus 5 / Sonnet 5 / Kimi K3

2026-07-28 13:38:15 -03:00

browser.rs

feat: browser validator for XSS, and replay that separates request from effect

2026-09-14 00:32:31 -03:00

budget.rs

feat(budget,provenance): reasoning budget modes and JOASNSCOPE provenance

2026-09-14 01:14:03 -03:00

capability.rs

feat(harness): risk model, engagement policies, capability tokens, audit trail

2026-09-13 17:56:31 -03:00

chain.rs

feat(chain,skills): close benchmark misses — CRLF-on-Location, second-order precondition; condense BENCHMARK

2026-09-20 12:42:36 -03:00

claims.rs

feat(claims): separate mechanic from impact so an overstatement stops deleting the observation

2026-09-14 00:27:29 -03:00

compliance.rs

feat: PoC validator, Kali sandbox, intercept proxy, compliance, +8 validators

2026-09-14 10:26:06 -03:00

creds.rs

identification/attribution + multi-role access-control auth (v3.5.5)

2026-07-01 23:59:02 -03:00

cvss.rs

feat(assurance): target gate (default-deny), evidence-graded CVSS, audit anchoring, P1–P5 bundle

2026-09-18 21:25:21 -03:00

grounding.rs

feat: human-in-loop validator (flag not delete), MD/JSON reports, SPA methodology, robust RL

2026-07-30 20:06:05 -03:00

hygiene.rs

feat(3.6.6): local/uncensored llama.cpp provider, clippy clean, CI (#40)

2026-08-03 23:48:08 -03:00

inbox.rs

feat(net): fail-closed egress, self-hosted OOB channel, inbound SMS

2026-09-14 01:35:36 -03:00

integrations.rs

feat: PR security gate, @neurosploit bot, richer NL REPL (#39)

2026-08-02 19:12:18 -03:00

integrity.rs

feat(hardening): scope-evasion resistance, evidence integrity, untrusted tool output

2026-09-18 21:52:14 -03:00

internal.rs

feat(internal): internal network / AD attack graph with choke-point analysis

2026-09-14 01:19:15 -03:00

json_extract.rs

fix: robust LLM response handling & JSON extraction (#46)

2026-10-02 18:48:50 -03:00

knowledge_graph.rs

feat: attack knowledge graph, layered memory, command rectification, FAIR dashboard

2026-09-07 15:35:36 -03:00

lib.rs

fix: robust LLM response handling & JSON extraction (#46)

2026-10-02 18:48:50 -03:00

memory.rs

feat: attack knowledge graph, layered memory, command rectification, FAIR dashboard

2026-09-07 15:35:36 -03:00

models.rs

fix: wildcard-target probe, per-run provenance, qwen via Hermes, broad default web objective

2026-10-04 01:06:28 -03:00

netguard.rs

feat(hardening): scope-evasion resistance, evidence integrity, untrusted tool output

2026-09-18 21:52:14 -03:00

oob.rs

feat(net): fail-closed egress, self-hosted OOB channel, inbound SMS

2026-09-14 01:35:36 -03:00

pipeline.rs

feat: multi-model preflight; deterministic subdomain fan-out for wildcard scope

2026-10-04 07:54:15 -03:00

poc.rs

feat(decision): wire 3 high-value System One decisions (backend = TypeSafe or Laya)

2026-09-23 01:18:14 -03:00

policy.rs

feat(harness): risk model, engagement policies, capability tokens, audit trail

2026-09-13 17:56:31 -03:00

pomdp.rs

v3.6.5: LLM red-teaming (jailbreaks & prompt injection) + Opus 5 / Sonnet 5 / Kimi K3

2026-07-28 13:38:15 -03:00

pool.rs

fix(pool): emit the quota/auth PAUSE notice once, not once per parallel agent

2026-10-02 19:01:32 -03:00

probe.rs

feat(hardening): scope-evasion resistance, evidence integrity, untrusted tool output

2026-09-18 21:52:14 -03:00

prosecutor.rs

fix: robust LLM response handling & JSON extraction (#46)

2026-10-02 18:48:50 -03:00

provenance.rs

fix: wildcard-target probe, per-run provenance, qwen via Hermes, broad default web objective

2026-10-04 01:06:28 -03:00

proxy.rs

feat: PoC validator, Kali sandbox, intercept proxy, compliance, +8 validators

2026-09-14 10:26:06 -03:00

replay.rs

feat: PoC validator, Kali sandbox, intercept proxy, compliance, +8 validators

2026-09-14 10:26:06 -03:00

report.rs

fix: version strings showed 4.2.0; use CARGO_PKG_VERSION so they never go stale

2026-10-03 01:08:57 -03:00

rl.rs

v3.4.x: intelligent agent selection, whitebox, recon/code agents, Gemini, artifacts, RL, XBOW GUI

2026-06-23 11:39:56 -03:00

sandbox.rs

feat(mcp,tooling): NeuroSploit as an MCP server; tool-discovery + CVE-PoC + headless doctrine

2026-09-20 20:55:49 -03:00

sarif.rs

feat(report): SARIF 2.1.0 export + stronger cross-object reference mining (v4.2.1)

2026-09-24 12:14:49 -03:00

scope.rs

feat(hardening): scope-evasion resistance, evidence integrity, untrusted tool output

2026-09-18 21:52:14 -03:00

taint.rs

feat(hardening): scope-evasion resistance, evidence integrity, untrusted tool output

2026-09-18 21:52:14 -03:00

transport.rs

fix(transport): exempt loopback from the fail-closed gate (unambiguous host)

2026-09-19 18:24:34 -03:00

types.rs

feat(repl): /class focus by vuln type, /authorization program ref; detect model refusals

2026-10-03 07:24:48 -03:00

typesafe_agent.rs

feat(typesafe): confirmation-loop agent + --typesafe flag (on/off/auto) for A/B

2026-09-19 18:15:10 -03:00

typesafe.rs

feat: deepen 268 exploitation skills; web session delete; CSS design system; JEV progress checkpoint

2026-09-26 16:25:58 -03:00

uncertainty.rs

feat(budget,provenance): reasoning budget modes and JOASNSCOPE provenance

2026-09-14 01:14:03 -03:00

validation.rs

feat: PoC validator, Kali sandbox, intercept proxy, compliance, +8 validators

2026-09-14 10:26:06 -03:00

waf.rs

feat(waf): tell the edge apart from the application

2026-09-14 01:39:20 -03:00