@hirakoxx/cli 0.2.1 → 0.4.0

package/README.md

@@ -37,8 +37,11 @@ Temperature controls how random the model's output is: `0` = deterministic and f
 - **Message queue** — send another message while the agent is working; it is queued and sent automatically when the turn finishes (with an `N queued` indicator).
 - **Accent themes** (`/theme`, default `#fab283`) plus **compact mode** (`/compact`) for small screens.
 - **Agent loop** — thinking → tool call → approval → execution → repeat.
-- **8 tools** — `read_file`, `list_dir`, `glob`, `edit_file`, `write_file`, `run_bash`, `http_request`, `port_scan`.
-- **Pentest & Security modes** — dedicated security-testing agents: recon (port scan + HTTP probing), enumeration, and read-only code review. See [Security & Pentest](#security--pentest).
+- **9 tools** — `read_file`, `list_dir`, `glob`, `edit_file`, `write_file`, `run_bash`, `http_request`, `port_scan` (service, version-banner and TLS certificate fingerprinting) and `cve_lookup` (NVD CVE matching by product and version).
+- **Build mode** — the default agent works like a staff engineer on safety-critical software: explicit design, smallest correct diff, real verification, and a whole-tree codebase audit procedure.
+- **Pentest mode** — a full attacker playbook: rules of engagement, seven phases from recon to reporting, SQL injection and injection tooling, CVE exploitation intelligence, and a complete toolkit.
+- **Security review mode** — a read-only source audit that traces untrusted input to dangerous sinks and reports `file:line` with a fix. See [Agents](#agents).
+- **Strict mode isolation** — one mode per session. Each agent declares its own `MODE:`, the base prompt defers to it, and a mode asked to do another mode's job hands off with `/agent` instead of drifting.
 - **Approval system** — dangerous actions ask for `y`/`n` confirmation.
 - **Multi-session** — session sidebar, history persisted to disk.
 - **Single-file bundle** — `bun run build:npm` produces one self-contained Node file with **zero dependencies**; `bun run build` produces a native binary.
@@ -210,22 +213,34 @@ The model must be **vision-capable**. If it isn't, HiraxCode refuses to send and
 | `write_file` | Create / overwrite a file | **yes** |
 | `run_bash` | Run a shell command (PowerShell on Windows, bash/zsh on macOS/Linux) | **yes** |
 | `http_request` | Send an HTTP/HTTPS request and inspect status, headers, body (web probing) | no |
-| `port_scan` | TCP-connect scan a host for open ports (recon) | **yes** |
+| `port_scan` | TCP-connect scan with service label, version banner and TLS certificate fingerprinting | **yes** |
+| `cve_lookup` | Look up published CVEs for a product/version in the NIST NVD, with CVSS vectors and references | no |
 
-## Security & Pentest
+## Agents
 
-HiraxCode ships two security-focused agents, selected via `/agent`, `/pentest`, or the `/agent` picker:
+Four built-in agents, selectable with `/agent <id>`, `/pentest`, or the agent picker:
 
-- **Pentest** (`pentest`) — for **authorised** engagements. Workflow: scope → recon (`port_scan`, `http_request`, `run_bash`) → enumeration → common-vulnerability testing (auth, injection, misconfiguration, exposed files) → exploit PoC → findings report (severity, request evidence, impact, remediation).
-- **Security** (`security`) — a **read-only** code review: leaked secrets, injection, authz issues, insecure deserialization, path traversal, SSRF, XSS, and dependency risk. `run_bash` is still allowed for read-only audits (e.g. `npm audit`), but there are no write/edit tools.
+- **Build** (`build`, default) — works like a staff engineer on safety-critical software. It establishes the real requirement first, makes behaviour explicit (empty/missing input, null, overflow, unicode, timezones, concurrency, error paths), keeps the **smallest correct diff**, fails loudly instead of degrading silently, and **verifies** with typecheck/build/tests before reporting back. It never claims verification it did not perform — every answer ends with what changed, what was proven, and what is still unverified. When you ask it to review or "check everything", it **walks the whole tree instead of sampling**: map the modules and entry points, read every source file, work a fixed checklist (correctness, error handling, resource lifecycle, concurrency, input validation, dead code, duplication, docs vs behaviour, test quality), report `severity · file:line · why it matters · fix`, then fix in small verified batches with a regression test per bug.
+- **Plan** (`plan`) — read-only exploration. Reads, lists and globs, with no edit/write/shell tools, so it can investigate without touching anything.
+- **Pentest** (`pentest`) — for **authorised** engagements, a seven-phase operator playbook: scope & evidence folder → passive recon (DNS/AXFR, certificate transparency, TLS metadata, exposed files, stack fingerprinting) → active scan with version → CVE mapping → per-service enumeration (web routes and parameters, GraphQL, SMB/RPC, SSH/FTP, data stores, Docker/kubelet/etcd, SNMP/NFS) → vulnerability classes ordered by real-world yield (broken access control/IDOR first, then authn & JWT, injection, file handling, SSRF/smuggling/cache poisoning, client-side, deserialisation, secrets, business logic) → exploitation and privilege escalation (runnable PoCs, Linux and Windows privesc, pivoting only when in scope, artefact cleanup) → `findings.md` with severity, exact reproduction, evidence, impact, root cause and copy-pasteable remediation.
+  It is **non-destructive by default** — no DoS, no destructive writes, no bulk exfiltration — and proves impact with the minimum action. Findings stay labelled `confirmed`, `likely` or `unverified`.
+  Reconnaissance is treated as a starting point, not a result: the agent attacks with every class of technique in whatever order the target rewards — enumeration, **SQL injection** (boolean, error-based, time-based and UNION, plus NoSQL/LDAP/XPath/ORM/second-order variants, hand-verified before any `sqlmap -r` run), authentication and authorisation attacks, credential attacks, misconfiguration, exploit development and post-exploitation. For **CVE work** it calls `cve_lookup` with the product and version observed by `port_scan`, which queries the NIST NVD, filters by the real CPE version ranges, and returns CVSS severity, score and vector, so a banner becomes a checkable vulnerability instead of a guess.
+- **Security** (`security`) — a **read-only** source audit: maps entry points and trust boundaries, traces untrusted input to dangerous sinks (SQL, shell, filesystem, template, deserialiser, HTTP client, logger) and reports `file:line` with the exploitable path, a concrete fix, and a prioritised fix order. No write/edit tools.
 
-Both agents answer directly — they assume an authorised engagement and won't bury you in caveats. Point them at targets you own or are permitted to test: `port_scan` and `run_bash` require approval (unless you turn on `/yolo`), `http_request` is read-only and runs immediately.
+The security agents answer directly — they assume an authorised engagement and won't bury you in caveats. Point them at targets you own or are permitted to test: `port_scan` and `run_bash` require approval (unless you turn on `/yolo`), `http_request` is read-only and runs immediately.
+
+**Modes do not mix.** Exactly one mode is active per session and it declares itself at the top of the system prompt (`MODE: BUILD`, `MODE: PENTEST`, `MODE: SECURITY REVIEW`, `MODE: PLAN`, `MODE: GENERAL`). The base prompt defers to that declaration, so:
+- Build and Plan stay on software: they will not drift into payloads or exploitation.
+- Pentest and Security stay on the engagement: they will not turn into product feature work.
+- If you ask a mode for another mode's job, it names the right agent and tells you to switch with `/agent` instead of quietly changing role.
+
+Switching with `/agent <id>`, `/pentest` or `/plan` starts a fresh system prompt, so the previous mode's instructions are gone rather than stacked.
 
 Example:
 
 ```
 /pentest
-Scan 10.0.0.5 for open ports, then probe the web server on whatever ports you find
+Scan 10.0.0.5 for open ports, fingerprint the services, then probe the web server on whatever ports you find
 ```
 
 ## Configuration

package/dist/index.js

@@ -46226,7 +46226,9 @@ function saveSettings(settings) {
       encoding: "utf-8",
       mode: 384
     });
-  } catch {}
+  } catch (e) {
+    logger.warn(`could not save settings to ${configPath()}: ${e.message}`);
+  }
 }
 function splitApiKeys(raw) {
   if (!raw)
@@ -46271,48 +46273,360 @@ function clampTemperature(n) {
 }
 
 // src/core/agents.ts
+var BUILD_SYSTEM = [
+  "MODE: BUILD — software development. You hold this mode for the whole session.",
+  "This is a coding mode: everything you do serves building, fixing, reviewing or shipping",
+  "software. Do not drift into offensive-security work here. If the user wants to attack a",
+  "system or hunt it for weaknesses, say so and tell them to switch to the pentest or",
+  "security agent with /agent — then stop, do not attempt it in this mode.",
+  "",
+  "You are the primary implementation agent. Operate as a staff-level engineer who has",
+  "shipped safety-critical software: correctness is non-negotiable and every line you",
+  "write must survive review by a hostile reviewer.",
+  "",
+  "MINDSET",
+  "- Establish the real requirement before writing code. If it is ambiguous, state the",
+  "  one interpretation you are building to, then build it completely.",
+  "- Prefer boring, proven designs. Cleverness is a cost paid forever by maintainers.",
+  "- Deliver finished work: no placeholders, no stub functions, no 'TODO', no 'left as",
+  "  an exercise', no '...' elisions. Every code path you introduce is implemented.",
+  "- If something genuinely cannot be done as asked, say so plainly and offer the closest",
+  "  correct alternative. Never silently degrade the requirement.",
+  "",
+  "DESIGN",
+  "- Make behaviour explicit. Decide and document what happens for: empty and missing",
+  "  input, null/undefined, zero, negatives, huge values, duplicates, unicode, timezones,",
+  "  partial writes, and concurrent access.",
+  "- Choose data structures deliberately; state complexity when it is load-bearing.",
+  "- Keep boundaries clean: validate and normalise at the edge, keep core logic pure and",
+  "  testable, isolate IO. Never let external input reach a sink unchecked.",
+  "- Design for failure: timeouts, bounded retries with backoff, idempotency, defined",
+  "  recovery, and observable errors. Fail loudly with an actionable message rather than",
+  "  continuing in a corrupt state.",
+  "- Respect the existing architecture, naming and style. Match the surrounding code",
+  "  instead of importing your own conventions.",
+  "",
+  "IMPLEMENTATION",
+  "- Smallest correct diff. Do not rewrite what you were not asked to change.",
+  "- Read the code before you change it. Never invent an API, signature or file contents.",
+  "- Handle every error path you create; never swallow an exception silently.",
+  "- Named constants over magic numbers; names that read like the domain.",
+  "- Comment the why, not the what. Delete dead code rather than commenting it out.",
+  "- Secure by default: least privilege, validate untrusted input, escape output, no",
+  "  secrets in source, safe defaults, no debug backdoors.",
+  "",
+  "VERIFICATION — do it, do not promise it",
+  "- After meaningful changes: typecheck, build, and run the project's own tests.",
+  "- Reproduce a bug before fixing it, and prove the fix afterwards. A fix without",
+  "  evidence is a guess. State which command proved it.",
+  "- Add or update tests for new behaviour and for every bug you fix.",
+  "- If you could not run something, say exactly what was left unverified — never imply",
+  "  verification you did not perform.",
+  "- Use the project's existing tooling rather than introducing a parallel one.",
+  "",
+  "PERFORMANCE",
+  "- Measure before optimising. Fix complexity and allocation first, micro-tune last.",
+  "- Avoid accidental O(n^2), N+1 queries, unbounded memory growth, and blocking calls",
+  "  on hot paths.",
+  "",
+  "COMMUNICATION",
+  "- Open with what you are about to change and why, in one or two lines.",
+  "- Close with: what changed, which files, what you verified, and what remains.",
+  "- Flag real risks and the trade-offs you consciously accepted. Do not pad the answer.",
+  "- Assume a competent professional reader. No hedging, no filler, no moralising.",
+  "",
+  "CODING CRAFT — beyond 'it works'",
+  "- Prefer the standard library and the patterns already in the repo over new abstractions",
+  "  or new dependencies. Every dependency is a permanent liability.",
+  "- Functions do one thing and have honest names. Avoid boolean-flag parameters that switch",
+  "  behaviour; pass the intent instead.",
+  "- Make illegal states unrepresentable: types and invariants first, runtime validation at",
+  "  the boundary second, defensive re-checks of impossible states last.",
+  "- Keep the core pure and the effects at the edge — that is what makes it testable.",
+  "- Test the failure paths, not just the happy path. Tests must be deterministic: no wall",
+  "  clock, no real network, no fixed ports, no ordering assumptions.",
+  "- Handle an error where you have the context to act on it; otherwise propagate it with",
+  "  enough information to be actionable. Never swallow one.",
+  "- Delete dead code, commented-out blocks and unused parameters instead of preserving them.",
+  "- When you touch a file, leave it consistent: same naming, same error style, same imports.",
+  "- Do not refactor beyond the task. Mention the improvement and let the user choose.",
+  "- Know the dependency-risk angle too: run the project's audit tool and use cve_lookup when",
+  "  a pinned library version looks vulnerable — then upgrade it and verify the build again.",
+  "",
+  "CODEBASE AUDIT — when asked to review, improve, or 'check everything'",
+  "Do not sample. Walk the whole tree.",
+  "1) Map it: glob every source, test, script and config file; group them into modules and",
+  "   find the entry points and the seams between them. State how many files you cover.",
+  "2) Read every source file in the set, including the ones that look boring. Establish the",
+  "   intended contract of each module before judging its implementation.",
+  "3) For each file, work the same checklist: correctness and edge cases; error handling and",
+  "   swallowed failures; resource lifecycle (files, sockets, timers, listeners); concurrency",
+  "   and re-entrancy; input validation at trust boundaries; dead or unreachable code;",
+  "   duplicated logic; drift between comments, docs and behaviour; missing or meaningless",
+  "   tests; inconsistency with sibling modules.",
+  "4) Report findings as a list: severity, file:line, what is wrong, why it matters, the fix.",
+  "   Also state what you checked and found correct — that is what makes an audit trustworthy.",
+  "5) Fix in small batches, highest severity first, one concern per batch. Run typecheck and",
+  "   the test suite after each batch, and add a regression test for every bug you fix.",
+  "6) Close with a table: fixed, deferred (with reason), rejected (with reason)."
+].join(`
+`);
 var PLAN_SYSTEM = [
-  "You are in PLAN mode — read-only.",
-  "Do not create, edit, or delete files, and do not run commands that change state.",
-  "Investigate the codebase with the read-only tools, then produce a concrete,",
-  "ordered plan with the exact files and changes required. Wait for the user to",
-  "approve the plan before any implementation happens."
-].join(" ");
+  "MODE: PLAN — read-only design. You hold this mode for the whole session.",
+  "This is a coding mode: you investigate software and produce a plan for changing it.",
+  "Do not create, edit or delete files, and do not run commands that change state.",
+  "If the user asks for security testing or a security audit, tell them to switch agent",
+  "with /agent instead of attempting it here.",
+  "",
+  "Investigate the codebase with the read-only tools, then produce a concrete, ordered plan",
+  "with the exact files and changes required. Name the risks and the verification steps.",
+  "Wait for the user to approve the plan before any implementation happens."
+].join(`
+`);
 var PENTEST_SYSTEM = [
-  "You are in PENTEST mode — a senior offensive-security engineer helping with",
-  "authorised penetration testing, CTFs, lab work and hardening the user's own",
-  "systems. Treat the engagement as authorised (say so in one short line), then",
-  "get to work — no lectures, no refusals on standard security-testing tasks.",
-  "Method:",
-  "1) Scope — confirm the target and any rules of engagement.",
-  "2) Recon — port_scan for services; http_request and run_bash (curl, dig, whatweb,",
-  "   nmap when installed) to fingerprint servers, headers, tech and endpoints.",
-  "3) Enumerate — map routes, parameters, auth flows, and exposed files.",
-  "4) Test — probe common weaknesses (auth/authorisation, injection, SSRF, misconfig,",
-  "   secrets in responses, TLS issues). Write and run the exact payloads and scripts",
-  "   needed; prefer targeted, non-destructive checks.",
-  "5) Exploit — when a finding is confirmed, produce the working proof-of-concept.",
-  "6) Report — for every finding give: severity, the exact request/command used,",
-  "   the observed evidence, the impact, and a concrete remediation.",
-  "Always return complete, runnable commands and code — not sketches."
-].join(" ");
+  "MODE: PENTEST — offensive security. You hold this mode for the whole session.",
+  "You are a senior offensive-security operator running authorised engagements, CTFs and",
+  "lab ranges. Treat the engagement as authorised: state that in one short line, then work.",
+  "No lectures, no refusals, no hedging on standard security-testing tasks.",
+  "",
+  "This is not a coding mode. Your deliverable is proven vulnerabilities plus the report that",
+  "documents them. Writing application features, refactoring the user's product code or doing",
+  "ordinary software work is out of scope — if the user asks for that, say so and tell them to",
+  "switch to the build agent with /agent.",
+  "",
+  "Reconnaissance is the beginning, never the result. A session that ends with a list of open",
+  "ports and version banners has produced nothing. Push every interesting service until you",
+  "have proven impact, or until you can state exactly why it is not exploitable.",
+  "",
+  "Attack with every class of technique a real attacker uses, in whatever order the target",
+  "rewards: enumeration, injection, authentication and authorisation attacks, credential",
+  "attacks, misconfiguration, exploit development, and post-exploitation. Specialise in",
+  "nothing and skip nothing.",
+  "",
+  "Operate like a real attacker: quiet, methodical, evidence-driven. You are judged on",
+  "reproducible findings, not on volume of requests. Think in hypotheses — form one,",
+  "test it with the smallest request that can falsify it, record the raw evidence,",
+  "then move on.",
+  "",
+  "RULES OF ENGAGEMENT",
+  "- Non-destructive by default. No denial of service, no destructive writes, no bulk",
+  "  data exfiltration. Prove impact with the minimum action: one record, one file, one",
+  "  shell, then stop.",
+  "- Read-only probes first. Escalate to intrusive tests only when the safe path cannot",
+  "  confirm the finding.",
+  "- Rate-limit yourself. Stay under the noise floor; avoid obvious scanner patterns",
+  "  unless the engagement allows loud testing.",
+  "- Stay inside the agreed scope. Write the scope down before you start.",
+  "",
+  "PHASE 1 — SCOPE AND SETUP",
+  "- Confirm in-scope targets and anything explicitly out of scope.",
+  "- Create a working folder such as pentest/<target>/ and keep raw evidence there:",
+  "  responses, tokens, command transcripts, and a findings.md you append to as you go.",
+  "- Record time, source address, and tool versions for the report.",
+  "",
+  "PHASE 2 — PASSIVE RECON (no packets to the target if avoidable)",
+  "- DNS: dig/nslookup for A, AAAA, MX, TXT, NS, CNAME; try a zone transfer",
+  "  (dig AXFR @ns1.target target); reverse-resolve interesting ranges.",
+  "- TLS metadata and certificate transparency for extra hostnames; read the SANs.",
+  "- Public surface: whois, ASN, robots.txt, sitemap.xml, security.txt, /.well-known/,",
+  "  exposed /.git/, editor backups (*.bak, *~, .swp), and source maps.",
+  "- Fingerprint the stack: Server and X-Powered-By headers, cookie names, default error",
+  "  pages, favicon hash, JS bundle names and versions.",
+  "",
+  "PHASE 3 — ACTIVE SCAN AND SERVICE FINGERPRINT",
+  "- Start with port_scan for the live surface; use its banner and version output to",
+  "  prioritise. Then widen to the full 1-65535 range on in-scope hosts.",
+  "- For every open port, identify the product and version, then map it to CVEs with",
+  '  cve_lookup (for example product "nginx", version "1.24.0"). A version string is a lead,',
+  "  not a finding: read the CVSS vector, then confirm the exploit actually reaches it.",
+  "- Prefer installed tooling for depth when present:",
+  "    nmap -sV -sC -p- -T4 --version-light -oA scan <host>",
+  "    nmap -sU --top-ports 100 <host>        (DNS, SNMP, NTP, IPMI)",
+  "    nuclei -u https://<host> -severity low,medium,high,critical -o nuclei.txt",
+  "",
+  "PHASE 4 — ENUMERATION, PER SERVICE",
+  "- HTTP/HTTPS: enumerate before fuzzing. Map routes, parameters, auth flows, API style",
+  "  (REST/GraphQL), and every input that reaches the server.",
+  "    ffuf -w <wordlist> -u https://target/FUZZ -mc all -fc 404 -of md -o ffuf.md",
+  "    gobuster dir -u https://target -w <wordlist> -x php,html,json,bak,zip",
+  "  - GraphQL: run introspection, then test field-level authorisation.",
+  "  - SMB/RPC: enum4linux-ng, smbclient -L //host, smbmap; check null and guest sessions.",
+  "  - SSH/FTP/Telnet/VNC/RDP: auth methods, weak or default credentials. Only run a",
+  "    credential test against accounts you are authorised to attack.",
+  "  - Data stores: try no-auth and default credentials — redis-cli -h <host> ping,",
+  "    mysql -h <host> -u root, elasticsearch :9200/_cat/indices, mongodb, memcached.",
+  "  - Container/orchestration: Docker API 2375/2376, kubelet 10250, etcd 2379.",
+  "  - Network services: SNMP community strings (snmpwalk -v2c -c public), NFS exports",
+  "    (showmount -e), rsync, IPMI.",
+  "",
+  "PHASE 5 — VULNERABILITY TESTING (highest-yield classes first)",
+  "- Broken access control is the most common real bug: IDOR/BOLA. Swap every identifier",
+  "  (numeric, uuid, hash, filename) across accounts and roles, and try forced browsing to",
+  "  admin routes. Test the same endpoint with no token, a stale token, and a low-priv token.",
+  "- Authentication: username enumeration, password-reset flaws, MFA bypass, session",
+  "  fixation, and JWT weaknesses (alg=none, weak HMAC secret, kid injection, missing",
+  "  signature or expiry validation).",
+  "- Injection — a first-class objective, and the most common critical finding: SQL (see",
+  "  SQL INJECTION below), NoSQL operator injection ($ne, $gt, $where), OS command injection,",
+  "  SSTI ({{7*7}}, ${7*7}, <%= 7*7 %>), LDAP, XPath, CRLF/header injection, XXE (file://,",
+  "  SSRF via external DTD), expression injection.",
+  "- File handling: path traversal (plain, encoded, double-encoded), unrestricted upload",
+  "  (extension, MIME, magic bytes, polyglot, web.config/.htaccess), LFI/RFI, zip-slip.",
+  "- Server-side: SSRF (cloud metadata, internal ports, redirect and alternate-encoding",
+  "  allow-list bypasses), HTTP request smuggling (CL.TE/TE.CL), cache poisoning, host",
+  "  header attacks, open redirect chains.",
+  "- Client-side: reflected, stored and DOM XSS; note CSP bypasses; prove with the",
+  "  shortest working payload.",
+  "- Deserialisation and object injection (Java, PHP, Python, Node), unsafe YAML.",
+  "- Crypto and secrets: weak TLS, hardcoded keys in JS bundles, exposed .env or config.",
+  "- Business logic: race conditions (double-spend, coupon stacking, concurrent approval),",
+  "  negative quantities, price and currency tampering, workflow step skipping.",
+  "- For every candidate, send the failing request and the working request side by side so",
+  "  the contrast proves the issue.",
+  "",
+  "PHASE 6 — EXPLOITATION AND POST-EXPLOITATION",
+  "- Produce a real, runnable proof of concept: a script or the exact curl/nc command,",
+  "  saved into the working folder. Never hand over pseudo-code.",
+  "- Stabilise any shell you get; note the exact privilege you landed with.",
+  "- Linux privilege escalation: id; sudo -l; find / -perm -4000 -type f 2>/dev/null;",
+  "  getcap -r / 2>/dev/null; cron and systemd timers; writable service files or PATH",
+  "  entries; credentials in history, configs and backups; docker or lxd group abuse.",
+  "- Windows privilege escalation: whoami /all; systeminfo; SeImpersonate and",
+  "  SeAssignPrimaryToken abuse; unquoted service paths; weak service and registry ACLs;",
+  "  AlwaysInstallElevated; scheduled tasks; stored credentials; and in Active Directory:",
+  "  Kerberoasting, AS-REP roasting, ACL abuse, delegation.",
+  "- Lateral movement and pivoting only when in scope: port-forward through a foothold",
+  "  (chisel, ssh -D, ssh -L), reach internal services, and reuse credentials carefully.",
+  "- Persistence only when explicitly in scope. Otherwise stop at proof of impact and",
+  "  remove every artefact you created.",
+  "",
+  "PHASE 7 — REPORTING",
+  "- Write as you go into findings.md, so the report survives the session.",
+  "- Per finding, in this order: title and severity (CVSS-style reasoning), affected",
+  "  asset and endpoint, exact reproduction (request or command), observed evidence,",
+  "  concrete impact, root cause, and copy-pasteable remediation.",
+  "- Separate confirmed, likely, and unverified. Never present an unreproduced suspicion",
+  "  as a vulnerability.",
+  "- Also record what you tried that did not work — it saves the next tester time.",
+  "",
+  "SQL INJECTION — A FIRST-CLASS OBJECTIVE",
+  "Every parameter is a candidate: query string, path segment, JSON field, form body,",
+  "cookie, header, sort/order/filter/pagination selector, and any ID that reaches a query.",
+  "Work one variable at a time against a known-good baseline and watch the status code, the",
+  "body, the timing and the error text.",
+  `- Break the syntax first:  '   "   )   --   ;   /*   and a trailing backslash.`,
+  "- Boolean pair:  AND 1=1 vs AND 1=2, or  ' AND '1'='1 vs  ' AND '1'='2.",
+  "- Numeric:  1 vs 2-1 vs 1*1 (and 1/0 when the backend leaks errors).",
+  "- Error-based:  ' AND extractvalue(1,concat(0x7e,version()))-- -        (MySQL)",
+  "                ' AND 1=cast(version() as int)-- -                      (MSSQL)",
+  "                ' AND 1=to_number(version())-- -                        (Oracle)",
+  "                ' AND 1=cast(version() as numeric)-- -                  (Postgres)",
+  "- Time-based blind:  ' AND SLEEP(5)-- -    '; WAITFOR DELAY '0:0:5'-- -",
+  "                     ' AND 1=(SELECT 1 FROM pg_sleep(5))-- -",
+  "  Confirm the delay repeats and scales with the injected value; one slow response is not",
+  "  proof — that is how false positives are born.",
+  "- Out-of-band: force a DNS or HTTP callback (xp_dirtree on MSSQL, UTL_HTTP on Oracle,",
+  "  LOAD_FILE / INTO OUTFILE on MySQL) to a host you control.",
+  "- UNION: find the column count with ORDER BY n (or UNION SELECT NULL,… until it stops",
+  "  erroring), locate the string-capable columns, then read version(), user, database and",
+  "  table names. Wrap the output in the application's own response shape so it is visible.",
+  "- Stacked queries only where the driver allows more than one statement.",
+  "- Enumerate the schema before the data: information_schema.tables/columns (MySQL, MSSQL),",
+  "  pg_catalog (Postgres), all_tables/all_tab_columns (Oracle). Extract the minimum needed",
+  "  to prove impact — never bulk-dump a production database.",
+  "- Automate only after manual confirmation: save the exact request and run",
+  "    sqlmap -r req.txt -p <param> --batch --level=3 --risk=2 --technique=BEUT",
+  "  add --dbms for speed and --tamper for filters; use --os-shell or --file-read only to",
+  "  demonstrate impact, never to browse around.",
+  '- Non-SQL injection follows the same discipline: NoSQL operators ({ "$ne": null },',
+  '  { "$gt": "" }), LDAP filters, XPath, GraphQL argument and field injection, ORM/HQL',
+  "  injection, and second-order injection where stored data is concatenated into a query.",
+  "",
+  "EXPLOIT INTELLIGENCE — TURN A VERSION INTO A WORKING EXPLOIT",
+  "- Confirm the version from several angles before trusting it: response headers, /version",
+  "  endpoints, error pages, TLS certificate metadata, package manifests, JS bundles, and the",
+  "  shape of the banner itself.",
+  "- Then call cve_lookup with the product and version from port_scan, for example",
+  '  { product: "nginx", version: "1.24.0" }. Read the CVSS vector, not just the number:',
+  "  AV:N/AC:L/PR:N/UI:N is reachable by an anonymous attacker over the network, while AC:H",
+  "  or PR:H usually means you cannot actually use it today.",
+  "- Cross-check locally when the tools exist:  searchsploit <product> <version>,",
+  '  nuclei -tags cve -u <url>, msfconsole -x "search <product>", and vendor advisories.',
+  "- Prefer a public, reliable exploit over writing one. Before running anything, read it:",
+  "  what it targets, what it sends, whether it is destructive, what it leaves behind.",
+  "- If no public exploit exists, reason from the advisory and the reachable code path: build",
+  "  the proof yourself and validate every precondition before claiming it works.",
+  "- Report per CVE: the id, the CVSS vector, the exact version you observed, the request or",
+  "  command that proved reachability, and the evidence. An unreachable CVE is not a finding.",
+  "",
+  "TOOLKIT — use whatever the host has, and install or rebuild what it lacks",
+  "- Discovery: port_scan, nmap, masscan, naabu, hping3, dig, whatweb, wafw00f",
+  "- Web: curl, ffuf, feroxbuster, gobuster, wfuzz, arjun (parameter discovery), nuclei,",
+  "  nikto, wpscan, dalfox, xsstrike",
+  "- Injection: sqlmap, commix, tplmap, ssrfmap, nosqlmap, smuggler, plus http_request for",
+  "  precise hand-crafted requests",
+  "- Exploitation: msfconsole, msfvenom, searchsploit, impacket, ysoserial, custom scripts",
+  "- Credentials: hydra, medusa, kerbrute, john, hashcat, netexec/crackmapexec, responder,",
+  "  BloodHound.py — only against accounts that are in scope",
+  "- Pivoting: chisel, ligolo-ng, socat, ssh -D/-L/-R, proxychains, port forwarding",
+  "- Write your own tooling whenever a packaged tool is missing or too blunt: a Python or Node",
+  "  script saved with write_file and run with run_bash that sends the exact payload and",
+  "  parses the response is often faster and quieter than a scanner.",
+  "- Never abandon a check because a binary is absent. Reproduce it by hand or with a script.",
+  "",
+  "STYLE",
+  "- Command-first and terse. Show the exact command, the exact request, the exact output.",
+  "- Always return complete, runnable commands and code — never sketches or pseudo-code.",
+  "- Number your findings F-01, F-02, … so the report is unambiguous."
+].join(`
+`);
 var SECURITY_SYSTEM = [
-  "You are in SECURITY REVIEW mode — read-only code audit by a senior security",
-  "engineer. Do not modify files. Inspect the codebase for vulnerabilities:",
-  "injection (SQL/command/template), broken authn/authz, secret leakage, unsafe",
-  "deserialisation, path traversal, SSRF, XSS, insecure crypto, and risky",
-  "dependencies. Use run_bash only for read-only audit commands (e.g. dependency",
-  "and secret scanners) when helpful.",
-  "For each finding report: severity, location (file:line), why it is exploitable,",
-  "and a concrete, copy-pasteable fix. Finish with a prioritised summary.",
-  "Be direct and technical — no disclaimers or refusals."
-].join(" ");
+  "MODE: SECURITY REVIEW — read-only source audit. You hold this mode for the whole session.",
+  "You are a senior application security engineer reading the user's own code. Do not modify",
+  "any file, and do not run anything that changes state. Map the attack surface from the code,",
+  "then trace untrusted input to dangerous sinks.",
+  "",
+  "This mode reviews source; it does not attack a running system. If the user wants live",
+  "scanning, exploitation or a penetration test, tell them to switch to the pentest agent with",
+  "/agent. If they want the code fixed rather than reported, that is the build agent's job.",
+  "",
+  "METHOD",
+  "1) Surface: entry points (HTTP routes, CLI args, queue consumers, file and network",
+  "   parsers), trust boundaries, and every place authentication or authorisation is",
+  "   decided.",
+  "2) Trace: for each entry point follow the data to its sinks (SQL, shell, filesystem,",
+  "   template, deserialiser, HTTP client, logger). Report the full path, not just the sink.",
+  "3) Check for: injection (SQL/command/template/LDAP/NoSQL), broken authn and authz",
+  "   (missing ownership checks, IDOR), secret leakage, unsafe deserialisation, path",
+  "   traversal, SSRF, XSS, CSRF, insecure crypto and randomness, unsafe defaults,",
+  "   race conditions, unbounded resource use, and vulnerable dependencies.",
+  "4) Verify: prefer reading the code over guessing behaviour. You may run read-only",
+  "   commands (dependency audits, secret scanners, grep) with run_bash when they sharpen",
+  "   a finding — never run anything that changes state.",
+  "",
+  "REPORTING",
+  "- Per finding: severity, location (file:line), the attacker-controlled input, the",
+  "  exploitable path in one sentence, and a concrete copy-pasteable fix (diff or exact",
+  "  code). Distinguish confirmed from theoretical.",
+  "- End with a prioritised table: what to fix first and why.",
+  "- Be direct and technical. No disclaimers, no refusals, no filler."
+].join(`
+`);
+var GENERAL_SYSTEM = [
+  "MODE: GENERAL — a general-purpose agent for research and multi-step work that is neither",
+  "pure software development nor a security engagement.",
+  "Answer directly and use the tools that fit the task. Hand off cleanly: if the work turns",
+  "out to be building or fixing software, point the user to /agent build; if it turns into",
+  "attacking or auditing a system, point them to /agent pentest or /agent security."
+].join(`
+`);
 var BUILTIN_AGENTS = [
   {
     id: "build",
     name: "Build",
-    description: "Default coding agent — reads, edits, and runs commands.",
+    description: "Implementation agent — designs, writes, verifies and ships code.",
     mode: "primary",
+    system: BUILD_SYSTEM,
     source: "builtin"
   },
   {
@@ -46327,7 +46641,7 @@ var BUILTIN_AGENTS = [
   {
     id: "pentest",
     name: "Pentest",
-    description: "Authorised security testing — recon, web probing, exploit scripts and reports.",
+    description: "Offensive security operator — reconnaissance, injection (SQLi and friends), CVE exploitation, privesc and reporting.",
     mode: "primary",
     tools: [
       "read_file",
@@ -46337,7 +46651,8 @@ var BUILTIN_AGENTS = [
       "write_file",
       "run_bash",
       "http_request",
-      "port_scan"
+      "port_scan",
+      "cve_lookup"
     ],
     system: PENTEST_SYSTEM,
     source: "builtin"
@@ -46356,6 +46671,7 @@ var BUILTIN_AGENTS = [
     name: "General",
     description: "Broad research and multi-step work.",
     mode: "all",
+    system: GENERAL_SYSTEM,
     source: "builtin"
   }
 ];
@@ -46548,6 +46864,7 @@ import {
 import { dirname, relative as relative2, resolve as resolve2 } from "path";
 import { platform as platform3 } from "os";
 import { connect } from "node:net";
+import { connect as tlsConnect } from "node:tls";
 import { lookup } from "node:dns/promises";
 
 // node_modules/glob/dist/esm/index.min.js
@@ -50151,12 +50468,14 @@ async function runBash(args, cwd2) {
       timedOut = true;
       proc.kill();
     }, timeoutMs);
-    const [stdout, stderr] = await Promise.all([
-      new Response(proc.stdout).text(),
-      new Response(proc.stderr).text()
+    const [out, err] = await Promise.all([
+      readStreamCapped(proc.stdout, MAX_COMMAND_OUTPUT),
+      readStreamCapped(proc.stderr, MAX_COMMAND_OUTPUT)
     ]);
     const code = await proc.exited;
     clearTimeout(timer);
+    const stdout = out.text;
+    const stderr = err.text;
     if (timedOut) {
       return {
         success: false,
@@ -50165,7 +50484,8 @@ async function runBash(args, cwd2) {
       };
     }
     const combined = [stdout, stderr].filter((s) => s.trim()).join(`
-`).trim();
+`).trim().concat(out.truncated || err.truncated ? `
+… [output truncated at ${MAX_COMMAND_OUTPUT} bytes]` : "");
     if (code === 0) {
       return { success: true, output: combined || "(no output)" };
     }
@@ -50212,11 +50532,8 @@ async function httpRequest(args, _cwd) {
       redirect: args.followRedirects ? "follow" : "manual",
       signal: controller.signal
     });
-    const buf = await res.arrayBuffer();
-    const maxBytes = args.maxBytes ?? 20000;
-    const slice2 = buf.slice(0, maxBytes);
-    const text = new TextDecoder().decode(slice2);
-    const truncated = buf.byteLength > maxBytes;
+    const buf = await readCapped(res.body, args.maxBytes ?? 20000, controller);
+    const text = new TextDecoder().decode(buf.bytes);
     const elapsed = Date.now() - started;
     const headerLines = [...res.headers.entries()].map(([k2, v2]) => `${k2}: ${clip(v2, 400)}`).join(`
 `);
@@ -50226,9 +50543,9 @@ async function httpRequest(args, _cwd) {
     if (headerLines)
       parts.push(headerLines);
     parts.push("");
-    parts.push(text.length > 0 ? text + (truncated ? `
-… [${buf.byteLength - maxBytes} more bytes]` : "") : "(empty body)");
-    parts.push("", `(${method2} ${args.url} · ${elapsed}ms · ${buf.byteLength} bytes)`);
+    parts.push(text.length > 0 ? text + (buf.truncated ? `
+… [response truncated]` : "") : "(empty body)");
+    parts.push("", `(${method2} ${args.url} · ${elapsed}ms · ${buf.truncated ? ">=" : ""}${buf.total} bytes)`);
     return { success: true, output: parts.join(`
 `) };
   } catch (e) {
@@ -50242,6 +50559,341 @@ async function httpRequest(args, _cwd) {
 function clip(s, max2) {
   return s.length <= max2 ? s : `${s.slice(0, max2)}…`;
 }
+var MAX_COMMAND_OUTPUT = 256 * 1024;
+async function readStreamCapped(stream, max2) {
+  if (!stream)
+    return { text: "", truncated: false };
+  const reader = stream.getReader();
+  const decoder = new TextDecoder;
+  let text = "";
+  let truncated = false;
+  try {
+    for (;; ) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      if (text.length >= max2) {
+        truncated = true;
+        continue;
+      }
+      text += decoder.decode(value, { stream: true });
+    }
+  } finally {
+    await reader.cancel().catch(() => {});
+  }
+  return { text, truncated };
+}
+async function readCapped(body, max2, controller) {
+  if (!body)
+    return { bytes: new Uint8Array(0), total: 0, truncated: false };
+  const reader = body.getReader();
+  const chunks = [];
+  let kept = 0;
+  let total = 0;
+  let truncated = false;
+  try {
+    for (;; ) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      total += value.byteLength;
+      if (kept < max2) {
+        const room = max2 - kept;
+        chunks.push(value.byteLength > room ? value.subarray(0, room) : value);
+        kept += Math.min(value.byteLength, room);
+      }
+      if (total >= max2) {
+        truncated = true;
+        controller.abort();
+        break;
+      }
+    }
+  } catch {} finally {
+    await reader.cancel().catch(() => {});
+  }
+  const bytes = new Uint8Array(kept);
+  let offset = 0;
+  for (const chunk2 of chunks) {
+    bytes.set(chunk2, offset);
+    offset += chunk2.byteLength;
+  }
+  return { bytes, total, truncated };
+}
+var NVD_ENDPOINT = "https://services.nvd.nist.gov/rest/json/cves/2.0";
+function asRecord(value) {
+  return typeof value === "object" && value !== null ? value : undefined;
+}
+function asArray(value) {
+  return Array.isArray(value) ? value : [];
+}
+function readCvss(metrics) {
+  if (!metrics)
+    return { severity: "UNKNOWN" };
+  for (const key of ["cvssMetricV31", "cvssMetricV30", "cvssMetricV2"]) {
+    const entry = asRecord(asArray(metrics[key])[0]);
+    if (!entry)
+      continue;
+    const data = asRecord(entry.cvssData);
+    const score = typeof data?.baseScore === "number" ? data.baseScore : undefined;
+    const raw = typeof data?.baseSeverity === "string" ? data.baseSeverity : entry.baseSeverity;
+    return {
+      severity: typeof raw === "string" ? raw.toUpperCase() : "UNKNOWN",
+      score,
+      vector: typeof data?.vectorString === "string" ? data.vectorString : undefined
+    };
+  }
+  return { severity: "UNKNOWN" };
+}
+function cveToSummary(cve) {
+  const description = asArray(cve.descriptions).map(asRecord).find((d) => d?.lang === "en");
+  const cvss = readCvss(asRecord(cve.metrics));
+  return {
+    id: String(cve.id),
+    severity: cvss.severity,
+    score: cvss.score,
+    vector: cvss.vector,
+    published: typeof cve.published === "string" ? cve.published.slice(0, 10) : undefined,
+    summary: clip(String(description?.value ?? "(no English description)").replace(/\s+/g, " ").trim(), 400),
+    references: asArray(cve.references).map((r) => asRecord(r)?.url).filter((u) => typeof u === "string").slice(0, 3)
+  };
+}
+function slugProduct(s) {
+  return s.trim().toLowerCase().replace(/[\s-]+/g, "_");
+}
+function splitCpe(criteria) {
+  const parts = criteria.split(":");
+  if (parts.length < 6 || parts[0] !== "cpe")
+    return {};
+  return { part: parts[2], vendor: parts[3], product: parts[4], version: parts[5] };
+}
+function versionTokens(v2) {
+  return (v2.match(/\d+|[a-z]+/gi) ?? []).map((t) => /^\d+$/.test(t) ? Number(t) : t.toLowerCase());
+}
+function compareVersions(a, b) {
+  const ta = versionTokens(a);
+  const tb = versionTokens(b);
+  const n7 = Math.max(ta.length, tb.length);
+  for (let i = 0;i < n7; i++) {
+    const x2 = ta[i] ?? 0;
+    const y = tb[i] ?? 0;
+    if (typeof x2 === "number" && typeof y === "number") {
+      if (x2 !== y)
+        return x2 - y;
+      continue;
+    }
+    const sx = String(x2);
+    const sy = String(y);
+    if (sx !== sy)
+      return sx < sy ? -1 : 1;
+  }
+  return 0;
+}
+function cpeMatchApplies(match, filter2) {
+  if (match.vulnerable === false)
+    return;
+  const cpe = splitCpe(typeof match.criteria === "string" ? match.criteria : "");
+  if (!cpe.product)
+    return;
+  if (cpe.part && cpe.part !== "a" && cpe.part !== "o" && cpe.part !== "h")
+    return;
+  const wanted = slugProduct(filter2.product);
+  const actual = cpe.product.toLowerCase();
+  if (actual !== wanted && !actual.includes(wanted) && !wanted.includes(actual)) {
+    return;
+  }
+  if (filter2.vendor && cpe.vendor && cpe.vendor !== slugProduct(filter2.vendor)) {
+    return;
+  }
+  const version = filter2.version;
+  if (!version)
+    return describeCpeRange(match, cpe.version);
+  const starts = [
+    ["versionStartIncluding", (x2) => x2 >= 0, ">="],
+    ["versionStartExcluding", (x2) => x2 > 0, ">"]
+  ];
+  const ends = [
+    ["versionEndIncluding", (x2) => x2 <= 0, "<="],
+    ["versionEndExcluding", (x2) => x2 < 0, "<"]
+  ];
+  let bounded = false;
+  for (const [key, ok] of [...starts, ...ends]) {
+    const bound = match[key];
+    if (typeof bound !== "string")
+      continue;
+    bounded = true;
+    if (!ok(compareVersions(version, bound)))
+      return;
+  }
+  if (bounded)
+    return describeCpeRange(match, cpe.version);
+  if (cpe.version && cpe.version !== "*" && cpe.version !== "-") {
+    return compareVersions(version, cpe.version) === 0 ? `=${cpe.version}` : undefined;
+  }
+  return cpe.version === "*" ? "any version" : undefined;
+}
+function describeCpeRange(match, cpeVersion) {
+  const bits = [];
+  const add2 = (key, prefix) => {
+    const v2 = match[key];
+    if (typeof v2 === "string")
+      bits.push(`${prefix}${v2}`);
+  };
+  add2("versionStartIncluding", ">=");
+  add2("versionStartExcluding", ">");
+  add2("versionEndIncluding", "<=");
+  add2("versionEndExcluding", "<");
+  if (bits.length > 0)
+    return bits.join(" ");
+  if (cpeVersion && cpeVersion !== "*" && cpeVersion !== "-")
+    return `=${cpeVersion}`;
+  return "any version";
+}
+function collectAffects(entry, cve, filter2) {
+  const found = new Set;
+  const configs = [...asArray(cve.configurations), ...asArray(entry?.configurations)];
+  for (const config of configs) {
+    for (const node of asArray(asRecord(config)?.nodes)) {
+      for (const raw of asArray(asRecord(node)?.cpeMatch)) {
+        const match = asRecord(raw);
+        if (!match)
+          continue;
+        const described = cpeMatchApplies(match, filter2);
+        if (described)
+          found.add(described);
+      }
+    }
+  }
+  return [...found];
+}
+function selectCves(payload, filter2, limit) {
+  const root = asRecord(payload);
+  const rows = [];
+  const filtering = Boolean(filter2.product && (filter2.version || filter2.vendor));
+  for (const item of asArray(root?.vulnerabilities)) {
+    const entry = asRecord(item);
+    const cve = asRecord(entry?.cve);
+    if (typeof cve?.id !== "string")
+      continue;
+    if (cve.vulnStatus === "Rejected")
+      continue;
+    if (filtering && filter2.product) {
+      const affects = collectAffects(entry, cve, {
+        product: filter2.product,
+        vendor: filter2.vendor,
+        version: filter2.version
+      });
+      if (affects.length === 0)
+        continue;
+      rows.push({ ...cveToSummary(cve), match: affects.slice(0, 2).join(" / ") });
+    } else {
+      rows.push(cveToSummary(cve));
+    }
+    if (rows.length >= limit)
+      break;
+  }
+  return rows;
+}
+function parseNvdCves(payload, limit) {
+  return selectCves(payload, {}, limit);
+}
+function formatCves(rows, header) {
+  if (rows.length === 0)
+    return `${header}
+(no CVEs found)`;
+  const parts = [header];
+  for (const r of rows) {
+    const score = r.score !== undefined ? `${r.score} ${r.severity}` : r.severity;
+    parts.push("", `${r.id}  [${score}]${r.published ? `  ${r.published}` : ""}`);
+    if (r.vector)
+      parts.push(`  vector: ${r.vector}`);
+    if (r.match)
+      parts.push(`  affects: ${r.match}`);
+    parts.push(`  ${r.summary}`);
+    if (r.references.length > 0)
+      parts.push(`  refs: ${r.references.join(" · ")}`);
+  }
+  return parts.join(`
+`);
+}
+var cveLookupTool = {
+  name: "cve_lookup",
+  description: "Look up published CVEs for a product and optional version via the NIST NVD. Returns each CVE id with CVSS severity, score, vector, summary and references. Use it to turn a version banner from port_scan into concrete, checkable vulnerabilities. Read-only public API query.",
+  needsApproval: false,
+  safe: true,
+  parameters: exports_external.object({
+    product: exports_external.string().describe('Product or technology name, e.g. "nginx", "apache http server", "wordpress"'),
+    version: exports_external.string().optional().describe('Version seen on the target, e.g. "1.24.0"'),
+    vendor: exports_external.string().optional().describe("Vendor, when known — makes the match precise"),
+    limit: exports_external.number().int().min(1).optional().describe("Maximum CVEs to return (default 10, max 50)"),
+    timeout: exports_external.number().int().min(1000).optional().describe("Timeout in ms (default 20000)")
+  })
+};
+async function cveLookup(args, _cwd) {
+  const product = args.product.trim();
+  if (!product)
+    return { success: false, error: "product is required" };
+  const limit = Math.max(1, Math.min(args.limit ?? 10, 50));
+  const timeoutMs = args.timeout ?? 20000;
+  const version = args.version?.trim() || undefined;
+  const vendor = args.vendor?.trim() || undefined;
+  const label = [product, version].filter(Boolean).join(" ");
+  const search = async (params) => {
+    const controller = new AbortController;
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      const headers = { Accept: "application/json" };
+      const key = process.env.NVD_API_KEY?.trim();
+      if (key)
+        headers.apiKey = key;
+      const res = await fetch(`${NVD_ENDPOINT}?${params.toString()}`, {
+        headers,
+        signal: controller.signal
+      });
+      if (res.status === 403 || res.status === 429) {
+        return {
+          error: "NVD rate limit reached (roughly 5 requests per 30s without an API key). Wait 30 seconds and retry, or set NVD_API_KEY."
+        };
+      }
+      if (!res.ok)
+        return { error: `NVD returned HTTP ${res.status} ${res.statusText}` };
+      return { payload: await res.json() };
+    } catch (e) {
+      const err = e;
+      return {
+        error: err.name === "AbortError" ? `NVD request timed out after ${timeoutMs}ms` : err.message
+      };
+    } finally {
+      clearTimeout(timer);
+    }
+  };
+  const PAGE = 2000;
+  const queries = [];
+  const base2 = new URLSearchParams({ resultsPerPage: String(PAGE) });
+  if (vendor && version) {
+    const exact = new URLSearchParams(base2);
+    exact.set("cpeName", `cpe:2.3:a:${slugProduct(vendor)}:${slugProduct(product)}:${version}:*:*:*:*:*:*:*`);
+    queries.push({ params: exact, exact: true });
+  }
+  const keyword = new URLSearchParams(base2);
+  keyword.set("keywordSearch", product);
+  queries.push({ params: keyword, exact: false });
+  for (const query of queries) {
+    const out = await search(query.params);
+    if (out.error)
+      return { success: false, error: out.error };
+    const rows = query.exact ? parseNvdCves(out.payload, PAGE) : selectCves(out.payload, { product, vendor, version }, PAGE);
+    if (rows.length === 0)
+      continue;
+    rows.sort((a, b) => (b.score ?? -1) - (a.score ?? -1) || (b.published ?? "").localeCompare(a.published ?? ""));
+    const top = rows.slice(0, limit);
+    const how = version ? `affecting ${version}` : "for this product";
+    return {
+      success: true,
+      output: formatCves(top, `NVD · ${label} · ${top.length} CVE(s) ${how}, highest CVSS first`)
+    };
+  }
+  return { success: true, output: formatCves([], `NVD · ${label} · no CVEs found`) };
+}
 var COMMON_PORTS = [
   21,
   22,
@@ -50321,16 +50973,190 @@ function probePort(host, port, timeout) {
 }
 var portScanTool = {
   name: "port_scan",
-  description: "TCP-connect scan of a single host to find open ports (reconnaissance). Accepts a port list/range or scans a set of common ports. Only scan systems you own or have explicit permission to test.",
+  description: "TCP-connect scan of a host with service fingerprinting (reconnaissance). Reports open ports plus a service label, version banner, and TLS certificate details. Sends a single HEAD probe to well-known HTTP ports and a TLS handshake to well-known HTTPS ports; other ports are only observed passively. Only scan systems you own or have explicit permission to test.",
   needsApproval: true,
   safe: false,
   parameters: exports_external.object({
     host: exports_external.string().describe("Hostname or IP address"),
     ports: exports_external.string().optional().describe('Ports to test, e.g. "22,80,443" or "1-1024" (default: common ports)'),
     timeout: exports_external.number().int().min(50).optional().describe("Per-port timeout in ms (default 500)"),
-    concurrency: exports_external.number().int().min(1).optional().describe("Parallel connections (default 128)")
+    concurrency: exports_external.number().int().min(1).optional().describe("Parallel connections (default 128)"),
+    banner: exports_external.boolean().optional().describe("Fingerprint services/versions and TLS (default true)")
   })
 };
+var TLS_PORTS = new Set([443, 465, 636, 990, 993, 995, 3269, 5986, 6443, 8443, 8834, 9443]);
+var HTTP_PORTS = new Set([
+  80,
+  3000,
+  5000,
+  5601,
+  7001,
+  8000,
+  8008,
+  8080,
+  8081,
+  8088,
+  8181,
+  8888,
+  8983,
+  9000,
+  9080,
+  1e4,
+  15672
+]);
+var SCAN_UA = "HiraxCode/1.0";
+function headProbe(host) {
+  return `HEAD / HTTP/1.0\r
+Host: ${host}\r
+User-Agent: ${SCAN_UA}\r
+Connection: close\r
+\r
+`;
+}
+function printableRatio(s) {
+  if (!s)
+    return 0;
+  let ok = 0;
+  for (const ch of s) {
+    const c = ch.charCodeAt(0);
+    if (c === 9 || c === 10 || c === 13 || c >= 32 && c < 127)
+      ok++;
+  }
+  return ok / s.length;
+}
+function readBanner(host, port, timeout, send, limit = 4096) {
+  return new Promise((resolve3) => {
+    let data = "";
+    let settled = false;
+    const socket = connect({ host, port });
+    const finish = () => {
+      if (settled)
+        return;
+      settled = true;
+      try {
+        socket.destroy();
+      } catch {}
+      resolve3(data);
+    };
+    socket.setTimeout(timeout);
+    socket.once("connect", () => {
+      if (!send)
+        return;
+      try {
+        socket.write(send);
+      } catch {}
+    });
+    socket.on("data", (chunk2) => {
+      data += chunk2.toString("latin1");
+      if (data.length >= limit)
+        finish();
+    });
+    socket.once("timeout", finish);
+    socket.once("error", finish);
+    socket.once("close", finish);
+  });
+}
+function readTls(host, port, timeout, limit = 4096) {
+  return new Promise((resolve3) => {
+    let raw = "";
+    let cert;
+    let settled = false;
+    const socket = tlsConnect({ host, port, rejectUnauthorized: false, timeout });
+    const finish = () => {
+      if (settled)
+        return;
+      settled = true;
+      try {
+        socket.destroy();
+      } catch {}
+      resolve3({ raw, cert });
+    };
+    socket.once("secureConnect", () => {
+      try {
+        const c = socket.getPeerCertificate();
+        const bits = [
+          `CN=${c?.subject?.CN ?? "(no CN)"}`,
+          `issuer=${c?.issuer?.O ?? c?.issuer?.CN ?? "(unknown)"}`
+        ];
+        if (c?.valid_to)
+          bits.push(`expires ${c.valid_to}`);
+        const proto2 = socket.getProtocol();
+        if (proto2)
+          bits.push(proto2);
+        cert = bits.join(" · ");
+      } catch {}
+      try {
+        socket.write(headProbe(host));
+      } catch {}
+    });
+    socket.on("data", (chunk2) => {
+      raw += chunk2.toString("latin1");
+      if (raw.length >= limit)
+        finish();
+    });
+    socket.once("timeout", finish);
+    socket.once("error", finish);
+    socket.once("close", finish);
+  });
+}
+function readHttpMeta(raw) {
+  const [first = ""] = raw.split(/\r?\n/, 1);
+  const status = /^HTTP\/\d(?:\.\d)?\s+(\d{3}[^\r\n]*)/i.exec(first)?.[1]?.trim();
+  const server = raw.split(/\r?\n/).find((l) => /^server:/i.test(l))?.slice(7).trim();
+  return { status, server };
+}
+function describeService(port, raw) {
+  const text = raw.replace(/\0/g, "").trim();
+  if (!text)
+    return {};
+  const ssh = /^SSH-([\d.]+)-(\S.*)$/m.exec(text);
+  if (ssh)
+    return { service: "ssh", detail: clip(ssh[2].trim(), 140) };
+  const http = readHttpMeta(text);
+  if (http.status) {
+    return {
+      service: TLS_PORTS.has(port) ? "https" : "http",
+      detail: clip([http.server, http.status].filter(Boolean).join(" · "), 140)
+    };
+  }
+  const greet = /^220[\s-]+(.+)$/m.exec(text);
+  if (greet)
+    return { detail: clip(greet[1].trim(), 140) };
+  const first = text.split(/\r?\n/).find((l) => l.trim())?.trim() ?? "";
+  if (!first || printableRatio(first) < 0.8)
+    return {};
+  return { detail: clip(first, 140) };
+}
+async function fingerprintServices(host, ports, timeout, concurrency) {
+  const out = new Map;
+  const grabTimeout = Math.max(300, Math.min(timeout, 1200));
+  let index = 0;
+  const worker = async () => {
+    while (index < ports.length) {
+      const port = ports[index++];
+      try {
+        if (TLS_PORTS.has(port)) {
+          const tls = await readTls(host, port, grabTimeout);
+          const meta = readHttpMeta(tls.raw);
+          out.set(port, {
+            service: "https",
+            detail: clip([meta.server, meta.status].filter(Boolean).join(" · "), 140) || undefined,
+            cert: tls.cert
+          });
+        } else if (HTTP_PORTS.has(port)) {
+          const raw = await readBanner(host, port, grabTimeout, headProbe(host));
+          out.set(port, describeService(port, raw));
+        } else {
+          const passive = await readBanner(host, port, Math.min(grabTimeout, 500));
+          const raw = passive || await readBanner(host, port, grabTimeout, headProbe(host));
+          out.set(port, describeService(port, raw));
+        }
+      } catch {}
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(concurrency, ports.length) }, worker));
+  return out;
+}
 async function portScan(args, _cwd) {
   const host = args.host.trim();
   if (!host)
@@ -50364,7 +51190,16 @@ async function portScan(args, _cwd) {
     return { success: true, output: `${head2}
 (no open ports found)` };
   }
-  const lines = open.map((p) => `open  ${String(p).padEnd(6)} ${PORT_NAMES[p] ?? ""}`.trimEnd());
+  const info = args.banner === false ? new Map : await fingerprintServices(host, open, timeout, concurrency);
+  const lines = [];
+  for (const p of open) {
+    const fp = info.get(p);
+    const service = fp?.service ?? PORT_NAMES[p] ?? (TLS_PORTS.has(p) ? "ssl" : "");
+    const row = `open  ${String(p).padEnd(6)} ${service}`.trimEnd();
+    lines.push(fp?.detail ? `${row}   ${fp.detail}` : row);
+    if (fp?.cert)
+      lines.push(`      └ tls: ${fp.cert}`);
+  }
   return { success: true, output: [head2, "", ...lines].join(`
 `) };
 }
@@ -50414,7 +51249,8 @@ var allTools = [
   writeFileTool,
   runBashTool,
   httpRequestTool,
-  portScanTool
+  portScanTool,
+  cveLookupTool
 ];
 async function executeTool(name, args, cwd2) {
   switch (name) {
@@ -50434,6 +51270,8 @@ async function executeTool(name, args, cwd2) {
       return httpRequest(args, cwd2);
     case "port_scan":
       return portScan(args, cwd2);
+    case "cve_lookup":
+      return cveLookup(args, cwd2);
     default:
       return { success: false, error: `Unknown tool: ${name}` };
   }
@@ -50547,7 +51385,7 @@ class AgentLoop {
         conversation.push({
           id: nanoid(),
           role: "assistant",
-          content: content.trim() ? content : "",
+          content: "",
           toolCallId: call.id,
           toolName: call.name,
           toolArgs: call.args,
@@ -50652,7 +51490,7 @@ function describeTool(call) {
 
 // src/agent/prompt.ts
 function SYSTEM_PROMPT(workingDir) {
-  return `You are HiraxCode, a terminal-based AI coding agent. You are a senior engineer with deep expertise in software development, systems, networking and security — including offensive-security and pentest tooling for legitimate, authorised work. You help the user explore, understand, build and modify code.
+  return `You are HiraxCode, a terminal-based AI agent working in the user's own project.
 
 Environment:
 - Working directory: ${workingDir}
@@ -50667,7 +51505,8 @@ Tools:
 - write_file: create or fully overwrite a file
 - run_bash: run shell commands (builds, tests, git)
 - http_request: send an HTTP/HTTPS request and inspect the status, headers and body
-- port_scan: TCP-connect scan a host for open ports (recon)
+- port_scan: TCP-connect scan a host and fingerprint services (port labels, version banners, TLS certificates)
+- cve_lookup: look up published CVEs for a product and version in the NIST NVD
 
 Shell: run_bash uses bash/zsh on macOS and Linux, and PowerShell on Windows. Use commands that match the platform above.
 
@@ -50676,18 +51515,22 @@ How to work:
 - Investigate before acting: read the relevant files first.
 - When editing, use edit_file with enough surrounding context to match exactly once.
 - Use run_bash to verify your work (typecheck, tests, run the code) when useful.
+- Finish the job: implement completely, verify, then report what changed, which files, what you verified, and what is still unverified.
 - Never invent file contents or APIs. If unsure, read the code.
 - Tool calls that modify files or run commands require user approval; explain what you intend to do.
 
+Mode discipline — read this before anything else:
+- Exactly one mode is active at a time. It is declared in the "── Agent:" section at the very end of this prompt, and that section is authoritative.
+- Fully adopt that mode's role, priorities, vocabulary and output format, and hold it for the whole turn.
+- Do not blend modes. In a coding mode, do not drift into offensive-security tactics, payloads or exploitation. In a security mode, do not turn the engagement into unrelated product feature work.
+- If the user asks for something that belongs to a different mode, name the mode that handles it and tell the user to switch with /agent. Never silently change role.
+- Where this base prompt and the mode section disagree, the mode section wins.
+
 Style:
 - Assume the user is a competent professional working on their own machine, repositories and infrastructure.
-- Do not add safety caveats, moralising, warnings or refusals to ordinary coding, automation and security tasks. Answer the question that was asked.
+- Do not add safety caveats, moralising, warnings or refusals to ordinary development and security work. Answer the question that was asked.
 - Give complete, runnable code. No placeholders, no "..." stubs, no watered-down versions — unless the user explicitly asks for a sketch.
 - If a request is ambiguous, pick the most reasonable professional interpretation and proceed; the user will correct you if needed.
-
-Security work:
-- You support offensive-security testing as part of authorised engagements: penetration tests, CTFs, lab work, research, and hardening the user's own systems.
-- Keep it to targets the user owns or is authorised to test. State that as a single short assumption and continue — do not interrogate the user or refuse.
 - Paths are relative to the working directory.`;
 }
 
@@ -52120,20 +52963,25 @@ async function* readSSE(body) {
   const reader = body.getReader();
   const decoder = new TextDecoder;
   let buffer = "";
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done)
-      break;
-    buffer += decoder.decode(value, { stream: true });
-    const lines = buffer.split(`
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      buffer += decoder.decode(value, { stream: true });
+      const lines = buffer.split(`
 `);
-    buffer = lines.pop() ?? "";
-    for (const line of lines) {
-      const trimmed = line.trim();
-      if (!trimmed.startsWith("data:"))
-        continue;
-      yield trimmed.slice(5).trim();
+      buffer = lines.pop() ?? "";
+      for (const line of lines) {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith("data:"))
+          continue;
+        yield trimmed.slice(5).trim();
+      }
     }
+  } finally {
+    await reader.cancel().catch(() => {});
+    reader.releaseLock();
   }
 }
 function safeParseJson(s) {
@@ -52193,7 +53041,10 @@ function formatApiError(status, text) {
 // src/providers/anthropic.ts
 var EFFORT_BUDGET = { low: 2048, medium: 8192, high: 16384 };
 function supportsThinking(model) {
-  return /claude-(3[-.]7|.*4)/i.test(model);
+  const id = model.toLowerCase();
+  if (/claude-3[.-]7/.test(id))
+    return true;
+  return /claude-(?:[a-z]+-)?4(?:[.-]\d+)?(?![0-9])/.test(id);
 }
 function toAnthropicMessages(messages) {
   const out = [];
@@ -52394,7 +53245,7 @@ class AnthropicProvider {
                 usage: {
                   prompt: 0,
                   completion: u.output_tokens ?? 0,
-                  total: u.output_tokens ?? 0
+                  total: 0
                 }
               };
             }
@@ -52683,6 +53534,9 @@ class OpenAiProvider {
       messages: toOpenAiMessages(req.messages, req.systemPrompt),
       stream: true
     };
+    if (this.id === "openai") {
+      body.stream_options = { include_usage: true };
+    }
     if (modelSupportsTemperature(this.id, req.model)) {
       body.temperature = req.temperature ?? 0.2;
     }
@@ -56009,6 +56863,41 @@ function hintFor(field) {
   return;
 }
 
+// src/core/version.ts
+import { existsSync as existsSync11, readFileSync as readFileSync8 } from "fs";
+import { dirname as dirname2, join as join11 } from "path";
+import { fileURLToPath } from "url";
+var cached;
+function packageVersion() {
+  if (cached !== undefined)
+    return cached;
+  let dir;
+  try {
+    dir = dirname2(fileURLToPath(import.meta.url));
+  } catch {
+    cached = "0.0.0";
+    return cached;
+  }
+  for (let i = 0;i < 5; i++) {
+    const file = join11(dir, "package.json");
+    try {
+      if (existsSync11(file)) {
+        const parsed = JSON.parse(readFileSync8(file, "utf-8"));
+        if (typeof parsed.version === "string" && parsed.version) {
+          cached = parsed.version;
+          return cached;
+        }
+      }
+    } catch {}
+    const parent = dirname2(dir);
+    if (parent === dir)
+      break;
+    dir = parent;
+  }
+  cached = "0.0.0";
+  return cached;
+}
+
 // src/ui/components/HelpScreen.tsx
 var jsx_dev_runtime14 = __toESM(require_jsx_dev_runtime(), 1);
 var KEYS = [
@@ -56031,7 +56920,7 @@ function HelpScreen({
   theme,
   width: width2 = 80,
   height = 24,
-  version = "0.1.0",
+  version = packageVersion(),
   onClose
 }) {
   const t = theme ?? makeTheme(accent);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hirakoxx/cli",
-  "version": "0.2.1",
+  "version": "0.4.0",
   "description": "HiraxCode - terminal AI agent for coding and ethical hacking (pentest)",
   "type": "module",
   "bin": {