@hirakoxx/cli 0.3.0 → 0.4.0

package/README.md

@@ -37,10 +37,11 @@ Temperature controls how random the model's output is: `0` = deterministic and f
 - **Message queue** — send another message while the agent is working; it is queued and sent automatically when the turn finishes (with an `N queued` indicator).
 - **Accent themes** (`/theme`, default `#fab283`) plus **compact mode** (`/compact`) for small screens.
 - **Agent loop** — thinking → tool call → approval → execution → repeat.
-- **8 tools** — `read_file`, `list_dir`, `glob`, `edit_file`, `write_file`, `run_bash`, `http_request`, `port_scan` (with service, version-banner and TLS certificate fingerprinting).
-- **Build mode** — the default agent works like a staff engineer on safety-critical software: explicit design, smallest correct diff, and real verification instead of promises.
-- **Pentest mode** — a full attacker playbook: rules of engagement, seven phases from recon to reporting, concrete tooling and payloads.
+- **9 tools** — `read_file`, `list_dir`, `glob`, `edit_file`, `write_file`, `run_bash`, `http_request`, `port_scan` (service, version-banner and TLS certificate fingerprinting) and `cve_lookup` (NVD CVE matching by product and version).
+- **Build mode** — the default agent works like a staff engineer on safety-critical software: explicit design, smallest correct diff, real verification, and a whole-tree codebase audit procedure.
+- **Pentest mode** — a full attacker playbook: rules of engagement, seven phases from recon to reporting, SQL injection and injection tooling, CVE exploitation intelligence, and a complete toolkit.
 - **Security review mode** — a read-only source audit that traces untrusted input to dangerous sinks and reports `file:line` with a fix. See [Agents](#agents).
+- **Strict mode isolation** — one mode per session. Each agent declares its own `MODE:`, the base prompt defers to it, and a mode asked to do another mode's job hands off with `/agent` instead of drifting.
 - **Approval system** — dangerous actions ask for `y`/`n` confirmation.
 - **Multi-session** — session sidebar, history persisted to disk.
 - **Single-file bundle** — `bun run build:npm` produces one self-contained Node file with **zero dependencies**; `bun run build` produces a native binary.
@@ -213,19 +214,28 @@ The model must be **vision-capable**. If it isn't, HiraxCode refuses to send and
 | `run_bash` | Run a shell command (PowerShell on Windows, bash/zsh on macOS/Linux) | **yes** |
 | `http_request` | Send an HTTP/HTTPS request and inspect status, headers, body (web probing) | no |
 | `port_scan` | TCP-connect scan with service label, version banner and TLS certificate fingerprinting | **yes** |
+| `cve_lookup` | Look up published CVEs for a product/version in the NIST NVD, with CVSS vectors and references | no |
 
 ## Agents
 
 Four built-in agents, selectable with `/agent <id>`, `/pentest`, or the agent picker:
 
-- **Build** (`build`, default) — works like a staff engineer on safety-critical software. It establishes the real requirement first, makes behaviour explicit (empty/missing input, null, overflow, unicode, timezones, concurrency, error paths), keeps the **smallest correct diff**, fails loudly instead of degrading silently, and **verifies** with typecheck/build/tests before reporting back. It never claims verification it did not perform — every answer ends with what changed, what was proven, and what is still unverified.
+- **Build** (`build`, default) — works like a staff engineer on safety-critical software. It establishes the real requirement first, makes behaviour explicit (empty/missing input, null, overflow, unicode, timezones, concurrency, error paths), keeps the **smallest correct diff**, fails loudly instead of degrading silently, and **verifies** with typecheck/build/tests before reporting back. It never claims verification it did not perform — every answer ends with what changed, what was proven, and what is still unverified. When you ask it to review or "check everything", it **walks the whole tree instead of sampling**: map the modules and entry points, read every source file, work a fixed checklist (correctness, error handling, resource lifecycle, concurrency, input validation, dead code, duplication, docs vs behaviour, test quality), report `severity · file:line · why it matters · fix`, then fix in small verified batches with a regression test per bug.
 - **Plan** (`plan`) — read-only exploration. Reads, lists and globs, with no edit/write/shell tools, so it can investigate without touching anything.
 - **Pentest** (`pentest`) — for **authorised** engagements, a seven-phase operator playbook: scope & evidence folder → passive recon (DNS/AXFR, certificate transparency, TLS metadata, exposed files, stack fingerprinting) → active scan with version → CVE mapping → per-service enumeration (web routes and parameters, GraphQL, SMB/RPC, SSH/FTP, data stores, Docker/kubelet/etcd, SNMP/NFS) → vulnerability classes ordered by real-world yield (broken access control/IDOR first, then authn & JWT, injection, file handling, SSRF/smuggling/cache poisoning, client-side, deserialisation, secrets, business logic) → exploitation and privilege escalation (runnable PoCs, Linux and Windows privesc, pivoting only when in scope, artefact cleanup) → `findings.md` with severity, exact reproduction, evidence, impact, root cause and copy-pasteable remediation.
   It is **non-destructive by default** — no DoS, no destructive writes, no bulk exfiltration — and proves impact with the minimum action. Findings stay labelled `confirmed`, `likely` or `unverified`.
+  Reconnaissance is treated as a starting point, not a result: the agent attacks with every class of technique in whatever order the target rewards — enumeration, **SQL injection** (boolean, error-based, time-based and UNION, plus NoSQL/LDAP/XPath/ORM/second-order variants, hand-verified before any `sqlmap -r` run), authentication and authorisation attacks, credential attacks, misconfiguration, exploit development and post-exploitation. For **CVE work** it calls `cve_lookup` with the product and version observed by `port_scan`, which queries the NIST NVD, filters by the real CPE version ranges, and returns CVSS severity, score and vector, so a banner becomes a checkable vulnerability instead of a guess.
 - **Security** (`security`) — a **read-only** source audit: maps entry points and trust boundaries, traces untrusted input to dangerous sinks (SQL, shell, filesystem, template, deserialiser, HTTP client, logger) and reports `file:line` with the exploitable path, a concrete fix, and a prioritised fix order. No write/edit tools.
 
 The security agents answer directly — they assume an authorised engagement and won't bury you in caveats. Point them at targets you own or are permitted to test: `port_scan` and `run_bash` require approval (unless you turn on `/yolo`), `http_request` is read-only and runs immediately.
 
+**Modes do not mix.** Exactly one mode is active per session and it declares itself at the top of the system prompt (`MODE: BUILD`, `MODE: PENTEST`, `MODE: SECURITY REVIEW`, `MODE: PLAN`, `MODE: GENERAL`). The base prompt defers to that declaration, so:
+- Build and Plan stay on software: they will not drift into payloads or exploitation.
+- Pentest and Security stay on the engagement: they will not turn into product feature work.
+- If you ask a mode for another mode's job, it names the right agent and tells you to switch with `/agent` instead of quietly changing role.
+
+Switching with `/agent <id>`, `/pentest` or `/plan` starts a fresh system prompt, so the previous mode's instructions are gone rather than stacked.
+
 Example:
 
 ```

package/dist/index.js

@@ -46226,7 +46226,9 @@ function saveSettings(settings) {
       encoding: "utf-8",
       mode: 384
     });
-  } catch {}
+  } catch (e) {
+    logger.warn(`could not save settings to ${configPath()}: ${e.message}`);
+  }
 }
 function splitApiKeys(raw) {
   if (!raw)
@@ -46272,9 +46274,15 @@ function clampTemperature(n) {
 
 // src/core/agents.ts
 var BUILD_SYSTEM = [
-  "You are in BUILD mode — the primary implementation agent. Operate as a staff-level",
-  "engineer who has shipped safety-critical software: correctness is non-negotiable and",
-  "every line you write must survive review by a hostile reviewer.",
+  "MODE: BUILD — software development. You hold this mode for the whole session.",
+  "This is a coding mode: everything you do serves building, fixing, reviewing or shipping",
+  "software. Do not drift into offensive-security work here. If the user wants to attack a",
+  "system or hunt it for weaknesses, say so and tell them to switch to the pentest or",
+  "security agent with /agent — then stop, do not attempt it in this mode.",
+  "",
+  "You are the primary implementation agent. Operate as a staff-level engineer who has",
+  "shipped safety-critical software: correctness is non-negotiable and every line you",
+  "write must survive review by a hostile reviewer.",
   "",
   "MINDSET",
   "- Establish the real requirement before writing code. If it is ambiguous, state the",
@@ -46325,21 +46333,75 @@ var BUILD_SYSTEM = [
   "- Open with what you are about to change and why, in one or two lines.",
   "- Close with: what changed, which files, what you verified, and what remains.",
   "- Flag real risks and the trade-offs you consciously accepted. Do not pad the answer.",
-  "- Assume a competent professional reader. No hedging, no filler, no moralising."
+  "- Assume a competent professional reader. No hedging, no filler, no moralising.",
+  "",
+  "CODING CRAFT — beyond 'it works'",
+  "- Prefer the standard library and the patterns already in the repo over new abstractions",
+  "  or new dependencies. Every dependency is a permanent liability.",
+  "- Functions do one thing and have honest names. Avoid boolean-flag parameters that switch",
+  "  behaviour; pass the intent instead.",
+  "- Make illegal states unrepresentable: types and invariants first, runtime validation at",
+  "  the boundary second, defensive re-checks of impossible states last.",
+  "- Keep the core pure and the effects at the edge — that is what makes it testable.",
+  "- Test the failure paths, not just the happy path. Tests must be deterministic: no wall",
+  "  clock, no real network, no fixed ports, no ordering assumptions.",
+  "- Handle an error where you have the context to act on it; otherwise propagate it with",
+  "  enough information to be actionable. Never swallow one.",
+  "- Delete dead code, commented-out blocks and unused parameters instead of preserving them.",
+  "- When you touch a file, leave it consistent: same naming, same error style, same imports.",
+  "- Do not refactor beyond the task. Mention the improvement and let the user choose.",
+  "- Know the dependency-risk angle too: run the project's audit tool and use cve_lookup when",
+  "  a pinned library version looks vulnerable — then upgrade it and verify the build again.",
+  "",
+  "CODEBASE AUDIT — when asked to review, improve, or 'check everything'",
+  "Do not sample. Walk the whole tree.",
+  "1) Map it: glob every source, test, script and config file; group them into modules and",
+  "   find the entry points and the seams between them. State how many files you cover.",
+  "2) Read every source file in the set, including the ones that look boring. Establish the",
+  "   intended contract of each module before judging its implementation.",
+  "3) For each file, work the same checklist: correctness and edge cases; error handling and",
+  "   swallowed failures; resource lifecycle (files, sockets, timers, listeners); concurrency",
+  "   and re-entrancy; input validation at trust boundaries; dead or unreachable code;",
+  "   duplicated logic; drift between comments, docs and behaviour; missing or meaningless",
+  "   tests; inconsistency with sibling modules.",
+  "4) Report findings as a list: severity, file:line, what is wrong, why it matters, the fix.",
+  "   Also state what you checked and found correct — that is what makes an audit trustworthy.",
+  "5) Fix in small batches, highest severity first, one concern per batch. Run typecheck and",
+  "   the test suite after each batch, and add a regression test for every bug you fix.",
+  "6) Close with a table: fixed, deferred (with reason), rejected (with reason)."
 ].join(`
 `);
 var PLAN_SYSTEM = [
-  "You are in PLAN mode — read-only.",
-  "Do not create, edit, or delete files, and do not run commands that change state.",
-  "Investigate the codebase with the read-only tools, then produce a concrete,",
-  "ordered plan with the exact files and changes required. Wait for the user to",
-  "approve the plan before any implementation happens."
-].join(" ");
+  "MODE: PLAN — read-only design. You hold this mode for the whole session.",
+  "This is a coding mode: you investigate software and produce a plan for changing it.",
+  "Do not create, edit or delete files, and do not run commands that change state.",
+  "If the user asks for security testing or a security audit, tell them to switch agent",
+  "with /agent instead of attempting it here.",
+  "",
+  "Investigate the codebase with the read-only tools, then produce a concrete, ordered plan",
+  "with the exact files and changes required. Name the risks and the verification steps.",
+  "Wait for the user to approve the plan before any implementation happens."
+].join(`
+`);
 var PENTEST_SYSTEM = [
-  "You are in PENTEST mode — a senior offensive-security operator running authorised",
-  "engagements, CTFs and lab ranges. Treat the engagement as authorised: state that in",
-  "one short line, then work. No lectures, no refusals, no hedging on standard",
-  "security-testing tasks.",
+  "MODE: PENTEST — offensive security. You hold this mode for the whole session.",
+  "You are a senior offensive-security operator running authorised engagements, CTFs and",
+  "lab ranges. Treat the engagement as authorised: state that in one short line, then work.",
+  "No lectures, no refusals, no hedging on standard security-testing tasks.",
+  "",
+  "This is not a coding mode. Your deliverable is proven vulnerabilities plus the report that",
+  "documents them. Writing application features, refactoring the user's product code or doing",
+  "ordinary software work is out of scope — if the user asks for that, say so and tell them to",
+  "switch to the build agent with /agent.",
+  "",
+  "Reconnaissance is the beginning, never the result. A session that ends with a list of open",
+  "ports and version banners has produced nothing. Push every interesting service until you",
+  "have proven impact, or until you can state exactly why it is not exploitable.",
+  "",
+  "Attack with every class of technique a real attacker uses, in whatever order the target",
+  "rewards: enumeration, injection, authentication and authorisation attacks, credential",
+  "attacks, misconfiguration, exploit development, and post-exploitation. Specialise in",
+  "nothing and skip nothing.",
   "",
   "Operate like a real attacker: quiet, methodical, evidence-driven. You are judged on",
   "reproducible findings, not on volume of requests. Think in hypotheses — form one,",
@@ -46374,8 +46436,9 @@ var PENTEST_SYSTEM = [
   "PHASE 3 — ACTIVE SCAN AND SERVICE FINGERPRINT",
   "- Start with port_scan for the live surface; use its banner and version output to",
   "  prioritise. Then widen to the full 1-65535 range on in-scope hosts.",
-  "- For every open port, identify product and version, then map version -> known CVE.",
-  "  A version string is a lead, not a finding: confirm the exploit reaches the target.",
+  "- For every open port, identify the product and version, then map it to CVEs with",
+  '  cve_lookup (for example product "nginx", version "1.24.0"). A version string is a lead,',
+  "  not a finding: read the CVSS vector, then confirm the exploit actually reaches it.",
   "- Prefer installed tooling for depth when present:",
   "    nmap -sV -sC -p- -T4 --version-light -oA scan <host>",
   "    nmap -sU --top-ports 100 <host>        (DNS, SNMP, NTP, IPMI)",
@@ -46403,9 +46466,10 @@ var PENTEST_SYSTEM = [
   "- Authentication: username enumeration, password-reset flaws, MFA bypass, session",
   "  fixation, and JWT weaknesses (alg=none, weak HMAC secret, kid injection, missing",
   "  signature or expiry validation).",
-  "- Injection: SQL (boolean, time-based, UNION), NoSQL operator injection ($ne, $gt),",
-  "  OS command injection, SSTI ({{7*7}}, ${7*7}, <%= 7*7 %>), LDAP, CRLF/header injection,",
-  "  XXE (file://, SSRF via external DTD), expression injection.",
+  "- Injection — a first-class objective, and the most common critical finding: SQL (see",
+  "  SQL INJECTION below), NoSQL operator injection ($ne, $gt, $where), OS command injection,",
+  "  SSTI ({{7*7}}, ${7*7}, <%= 7*7 %>), LDAP, XPath, CRLF/header injection, XXE (file://,",
+  "  SSRF via external DTD), expression injection.",
   "- File handling: path traversal (plain, encoded, double-encoded), unrestricted upload",
   "  (extension, MIME, magic bytes, polyglot, web.config/.htaccess), LFI/RFI, zip-slip.",
   "- Server-side: SSRF (cloud metadata, internal ports, redirect and alternate-encoding",
@@ -46445,19 +46509,86 @@ var PENTEST_SYSTEM = [
   "  as a vulnerability.",
   "- Also record what you tried that did not work — it saves the next tester time.",
   "",
-  "TOOLING AND STYLE",
-  "- port_scan for the surface (banner and version aware), http_request for precise",
-  "  single requests, run_bash for curl/nmap/ffuf/nuclei, and write_file plus run_bash",
-  "  to build and run custom exploit or parsing scripts.",
-  "- If a tool is missing, either install it or reproduce the check with a short script.",
-  "  Never abandon a check just because a binary is absent.",
-  "- Always return complete, runnable commands and code — never sketches."
+  "SQL INJECTION — A FIRST-CLASS OBJECTIVE",
+  "Every parameter is a candidate: query string, path segment, JSON field, form body,",
+  "cookie, header, sort/order/filter/pagination selector, and any ID that reaches a query.",
+  "Work one variable at a time against a known-good baseline and watch the status code, the",
+  "body, the timing and the error text.",
+  `- Break the syntax first:  '   "   )   --   ;   /*   and a trailing backslash.`,
+  "- Boolean pair:  AND 1=1 vs AND 1=2, or  ' AND '1'='1 vs  ' AND '1'='2.",
+  "- Numeric:  1 vs 2-1 vs 1*1 (and 1/0 when the backend leaks errors).",
+  "- Error-based:  ' AND extractvalue(1,concat(0x7e,version()))-- -        (MySQL)",
+  "                ' AND 1=cast(version() as int)-- -                      (MSSQL)",
+  "                ' AND 1=to_number(version())-- -                        (Oracle)",
+  "                ' AND 1=cast(version() as numeric)-- -                  (Postgres)",
+  "- Time-based blind:  ' AND SLEEP(5)-- -    '; WAITFOR DELAY '0:0:5'-- -",
+  "                     ' AND 1=(SELECT 1 FROM pg_sleep(5))-- -",
+  "  Confirm the delay repeats and scales with the injected value; one slow response is not",
+  "  proof — that is how false positives are born.",
+  "- Out-of-band: force a DNS or HTTP callback (xp_dirtree on MSSQL, UTL_HTTP on Oracle,",
+  "  LOAD_FILE / INTO OUTFILE on MySQL) to a host you control.",
+  "- UNION: find the column count with ORDER BY n (or UNION SELECT NULL,… until it stops",
+  "  erroring), locate the string-capable columns, then read version(), user, database and",
+  "  table names. Wrap the output in the application's own response shape so it is visible.",
+  "- Stacked queries only where the driver allows more than one statement.",
+  "- Enumerate the schema before the data: information_schema.tables/columns (MySQL, MSSQL),",
+  "  pg_catalog (Postgres), all_tables/all_tab_columns (Oracle). Extract the minimum needed",
+  "  to prove impact — never bulk-dump a production database.",
+  "- Automate only after manual confirmation: save the exact request and run",
+  "    sqlmap -r req.txt -p <param> --batch --level=3 --risk=2 --technique=BEUT",
+  "  add --dbms for speed and --tamper for filters; use --os-shell or --file-read only to",
+  "  demonstrate impact, never to browse around.",
+  '- Non-SQL injection follows the same discipline: NoSQL operators ({ "$ne": null },',
+  '  { "$gt": "" }), LDAP filters, XPath, GraphQL argument and field injection, ORM/HQL',
+  "  injection, and second-order injection where stored data is concatenated into a query.",
+  "",
+  "EXPLOIT INTELLIGENCE — TURN A VERSION INTO A WORKING EXPLOIT",
+  "- Confirm the version from several angles before trusting it: response headers, /version",
+  "  endpoints, error pages, TLS certificate metadata, package manifests, JS bundles, and the",
+  "  shape of the banner itself.",
+  "- Then call cve_lookup with the product and version from port_scan, for example",
+  '  { product: "nginx", version: "1.24.0" }. Read the CVSS vector, not just the number:',
+  "  AV:N/AC:L/PR:N/UI:N is reachable by an anonymous attacker over the network, while AC:H",
+  "  or PR:H usually means you cannot actually use it today.",
+  "- Cross-check locally when the tools exist:  searchsploit <product> <version>,",
+  '  nuclei -tags cve -u <url>, msfconsole -x "search <product>", and vendor advisories.',
+  "- Prefer a public, reliable exploit over writing one. Before running anything, read it:",
+  "  what it targets, what it sends, whether it is destructive, what it leaves behind.",
+  "- If no public exploit exists, reason from the advisory and the reachable code path: build",
+  "  the proof yourself and validate every precondition before claiming it works.",
+  "- Report per CVE: the id, the CVSS vector, the exact version you observed, the request or",
+  "  command that proved reachability, and the evidence. An unreachable CVE is not a finding.",
+  "",
+  "TOOLKIT — use whatever the host has, and install or rebuild what it lacks",
+  "- Discovery: port_scan, nmap, masscan, naabu, hping3, dig, whatweb, wafw00f",
+  "- Web: curl, ffuf, feroxbuster, gobuster, wfuzz, arjun (parameter discovery), nuclei,",
+  "  nikto, wpscan, dalfox, xsstrike",
+  "- Injection: sqlmap, commix, tplmap, ssrfmap, nosqlmap, smuggler, plus http_request for",
+  "  precise hand-crafted requests",
+  "- Exploitation: msfconsole, msfvenom, searchsploit, impacket, ysoserial, custom scripts",
+  "- Credentials: hydra, medusa, kerbrute, john, hashcat, netexec/crackmapexec, responder,",
+  "  BloodHound.py — only against accounts that are in scope",
+  "- Pivoting: chisel, ligolo-ng, socat, ssh -D/-L/-R, proxychains, port forwarding",
+  "- Write your own tooling whenever a packaged tool is missing or too blunt: a Python or Node",
+  "  script saved with write_file and run with run_bash that sends the exact payload and",
+  "  parses the response is often faster and quieter than a scanner.",
+  "- Never abandon a check because a binary is absent. Reproduce it by hand or with a script.",
+  "",
+  "STYLE",
+  "- Command-first and terse. Show the exact command, the exact request, the exact output.",
+  "- Always return complete, runnable commands and code — never sketches or pseudo-code.",
+  "- Number your findings F-01, F-02, … so the report is unambiguous."
 ].join(`
 `);
 var SECURITY_SYSTEM = [
-  "You are in SECURITY REVIEW mode — a read-only source audit by a senior application",
-  "security engineer. Do not modify any file. Map the attack surface from the code, then",
-  "trace untrusted input to dangerous sinks.",
+  "MODE: SECURITY REVIEW — read-only source audit. You hold this mode for the whole session.",
+  "You are a senior application security engineer reading the user's own code. Do not modify",
+  "any file, and do not run anything that changes state. Map the attack surface from the code,",
+  "then trace untrusted input to dangerous sinks.",
+  "",
+  "This mode reviews source; it does not attack a running system. If the user wants live",
+  "scanning, exploitation or a penetration test, tell them to switch to the pentest agent with",
+  "/agent. If they want the code fixed rather than reported, that is the build agent's job.",
   "",
   "METHOD",
   "1) Surface: entry points (HTTP routes, CLI args, queue consumers, file and network",
@@ -46481,6 +46612,14 @@ var SECURITY_SYSTEM = [
   "- Be direct and technical. No disclaimers, no refusals, no filler."
 ].join(`
 `);
+var GENERAL_SYSTEM = [
+  "MODE: GENERAL — a general-purpose agent for research and multi-step work that is neither",
+  "pure software development nor a security engagement.",
+  "Answer directly and use the tools that fit the task. Hand off cleanly: if the work turns",
+  "out to be building or fixing software, point the user to /agent build; if it turns into",
+  "attacking or auditing a system, point them to /agent pentest or /agent security."
+].join(`
+`);
 var BUILTIN_AGENTS = [
   {
     id: "build",
@@ -46502,7 +46641,7 @@ var BUILTIN_AGENTS = [
   {
     id: "pentest",
     name: "Pentest",
-    description: "Offensive security operator — full engagement: recon, enumeration, exploitation, privesc and reporting.",
+    description: "Offensive security operator — reconnaissance, injection (SQLi and friends), CVE exploitation, privesc and reporting.",
     mode: "primary",
     tools: [
       "read_file",
@@ -46512,7 +46651,8 @@ var BUILTIN_AGENTS = [
       "write_file",
       "run_bash",
       "http_request",
-      "port_scan"
+      "port_scan",
+      "cve_lookup"
     ],
     system: PENTEST_SYSTEM,
     source: "builtin"
@@ -46531,6 +46671,7 @@ var BUILTIN_AGENTS = [
     name: "General",
     description: "Broad research and multi-step work.",
     mode: "all",
+    system: GENERAL_SYSTEM,
     source: "builtin"
   }
 ];
@@ -50327,12 +50468,14 @@ async function runBash(args, cwd2) {
       timedOut = true;
       proc.kill();
     }, timeoutMs);
-    const [stdout, stderr] = await Promise.all([
-      new Response(proc.stdout).text(),
-      new Response(proc.stderr).text()
+    const [out, err] = await Promise.all([
+      readStreamCapped(proc.stdout, MAX_COMMAND_OUTPUT),
+      readStreamCapped(proc.stderr, MAX_COMMAND_OUTPUT)
     ]);
     const code = await proc.exited;
     clearTimeout(timer);
+    const stdout = out.text;
+    const stderr = err.text;
     if (timedOut) {
       return {
         success: false,
@@ -50341,7 +50484,8 @@ async function runBash(args, cwd2) {
       };
     }
     const combined = [stdout, stderr].filter((s) => s.trim()).join(`
-`).trim();
+`).trim().concat(out.truncated || err.truncated ? `
+… [output truncated at ${MAX_COMMAND_OUTPUT} bytes]` : "");
     if (code === 0) {
       return { success: true, output: combined || "(no output)" };
     }
@@ -50388,11 +50532,8 @@ async function httpRequest(args, _cwd) {
       redirect: args.followRedirects ? "follow" : "manual",
       signal: controller.signal
     });
-    const buf = await res.arrayBuffer();
-    const maxBytes = args.maxBytes ?? 20000;
-    const slice2 = buf.slice(0, maxBytes);
-    const text = new TextDecoder().decode(slice2);
-    const truncated = buf.byteLength > maxBytes;
+    const buf = await readCapped(res.body, args.maxBytes ?? 20000, controller);
+    const text = new TextDecoder().decode(buf.bytes);
     const elapsed = Date.now() - started;
     const headerLines = [...res.headers.entries()].map(([k2, v2]) => `${k2}: ${clip(v2, 400)}`).join(`
 `);
@@ -50402,9 +50543,9 @@ async function httpRequest(args, _cwd) {
     if (headerLines)
       parts.push(headerLines);
     parts.push("");
-    parts.push(text.length > 0 ? text + (truncated ? `
-… [${buf.byteLength - maxBytes} more bytes]` : "") : "(empty body)");
-    parts.push("", `(${method2} ${args.url} · ${elapsed}ms · ${buf.byteLength} bytes)`);
+    parts.push(text.length > 0 ? text + (buf.truncated ? `
+… [response truncated]` : "") : "(empty body)");
+    parts.push("", `(${method2} ${args.url} · ${elapsed}ms · ${buf.truncated ? ">=" : ""}${buf.total} bytes)`);
     return { success: true, output: parts.join(`
 `) };
   } catch (e) {
@@ -50418,6 +50559,341 @@ async function httpRequest(args, _cwd) {
 function clip(s, max2) {
   return s.length <= max2 ? s : `${s.slice(0, max2)}…`;
 }
+var MAX_COMMAND_OUTPUT = 256 * 1024;
+async function readStreamCapped(stream, max2) {
+  if (!stream)
+    return { text: "", truncated: false };
+  const reader = stream.getReader();
+  const decoder = new TextDecoder;
+  let text = "";
+  let truncated = false;
+  try {
+    for (;; ) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      if (text.length >= max2) {
+        truncated = true;
+        continue;
+      }
+      text += decoder.decode(value, { stream: true });
+    }
+  } finally {
+    await reader.cancel().catch(() => {});
+  }
+  return { text, truncated };
+}
+async function readCapped(body, max2, controller) {
+  if (!body)
+    return { bytes: new Uint8Array(0), total: 0, truncated: false };
+  const reader = body.getReader();
+  const chunks = [];
+  let kept = 0;
+  let total = 0;
+  let truncated = false;
+  try {
+    for (;; ) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      total += value.byteLength;
+      if (kept < max2) {
+        const room = max2 - kept;
+        chunks.push(value.byteLength > room ? value.subarray(0, room) : value);
+        kept += Math.min(value.byteLength, room);
+      }
+      if (total >= max2) {
+        truncated = true;
+        controller.abort();
+        break;
+      }
+    }
+  } catch {} finally {
+    await reader.cancel().catch(() => {});
+  }
+  const bytes = new Uint8Array(kept);
+  let offset = 0;
+  for (const chunk2 of chunks) {
+    bytes.set(chunk2, offset);
+    offset += chunk2.byteLength;
+  }
+  return { bytes, total, truncated };
+}
+var NVD_ENDPOINT = "https://services.nvd.nist.gov/rest/json/cves/2.0";
+function asRecord(value) {
+  return typeof value === "object" && value !== null ? value : undefined;
+}
+function asArray(value) {
+  return Array.isArray(value) ? value : [];
+}
+function readCvss(metrics) {
+  if (!metrics)
+    return { severity: "UNKNOWN" };
+  for (const key of ["cvssMetricV31", "cvssMetricV30", "cvssMetricV2"]) {
+    const entry = asRecord(asArray(metrics[key])[0]);
+    if (!entry)
+      continue;
+    const data = asRecord(entry.cvssData);
+    const score = typeof data?.baseScore === "number" ? data.baseScore : undefined;
+    const raw = typeof data?.baseSeverity === "string" ? data.baseSeverity : entry.baseSeverity;
+    return {
+      severity: typeof raw === "string" ? raw.toUpperCase() : "UNKNOWN",
+      score,
+      vector: typeof data?.vectorString === "string" ? data.vectorString : undefined
+    };
+  }
+  return { severity: "UNKNOWN" };
+}
+function cveToSummary(cve) {
+  const description = asArray(cve.descriptions).map(asRecord).find((d) => d?.lang === "en");
+  const cvss = readCvss(asRecord(cve.metrics));
+  return {
+    id: String(cve.id),
+    severity: cvss.severity,
+    score: cvss.score,
+    vector: cvss.vector,
+    published: typeof cve.published === "string" ? cve.published.slice(0, 10) : undefined,
+    summary: clip(String(description?.value ?? "(no English description)").replace(/\s+/g, " ").trim(), 400),
+    references: asArray(cve.references).map((r) => asRecord(r)?.url).filter((u) => typeof u === "string").slice(0, 3)
+  };
+}
+function slugProduct(s) {
+  return s.trim().toLowerCase().replace(/[\s-]+/g, "_");
+}
+function splitCpe(criteria) {
+  const parts = criteria.split(":");
+  if (parts.length < 6 || parts[0] !== "cpe")
+    return {};
+  return { part: parts[2], vendor: parts[3], product: parts[4], version: parts[5] };
+}
+function versionTokens(v2) {
+  return (v2.match(/\d+|[a-z]+/gi) ?? []).map((t) => /^\d+$/.test(t) ? Number(t) : t.toLowerCase());
+}
+function compareVersions(a, b) {
+  const ta = versionTokens(a);
+  const tb = versionTokens(b);
+  const n7 = Math.max(ta.length, tb.length);
+  for (let i = 0;i < n7; i++) {
+    const x2 = ta[i] ?? 0;
+    const y = tb[i] ?? 0;
+    if (typeof x2 === "number" && typeof y === "number") {
+      if (x2 !== y)
+        return x2 - y;
+      continue;
+    }
+    const sx = String(x2);
+    const sy = String(y);
+    if (sx !== sy)
+      return sx < sy ? -1 : 1;
+  }
+  return 0;
+}
+function cpeMatchApplies(match, filter2) {
+  if (match.vulnerable === false)
+    return;
+  const cpe = splitCpe(typeof match.criteria === "string" ? match.criteria : "");
+  if (!cpe.product)
+    return;
+  if (cpe.part && cpe.part !== "a" && cpe.part !== "o" && cpe.part !== "h")
+    return;
+  const wanted = slugProduct(filter2.product);
+  const actual = cpe.product.toLowerCase();
+  if (actual !== wanted && !actual.includes(wanted) && !wanted.includes(actual)) {
+    return;
+  }
+  if (filter2.vendor && cpe.vendor && cpe.vendor !== slugProduct(filter2.vendor)) {
+    return;
+  }
+  const version = filter2.version;
+  if (!version)
+    return describeCpeRange(match, cpe.version);
+  const starts = [
+    ["versionStartIncluding", (x2) => x2 >= 0, ">="],
+    ["versionStartExcluding", (x2) => x2 > 0, ">"]
+  ];
+  const ends = [
+    ["versionEndIncluding", (x2) => x2 <= 0, "<="],
+    ["versionEndExcluding", (x2) => x2 < 0, "<"]
+  ];
+  let bounded = false;
+  for (const [key, ok] of [...starts, ...ends]) {
+    const bound = match[key];
+    if (typeof bound !== "string")
+      continue;
+    bounded = true;
+    if (!ok(compareVersions(version, bound)))
+      return;
+  }
+  if (bounded)
+    return describeCpeRange(match, cpe.version);
+  if (cpe.version && cpe.version !== "*" && cpe.version !== "-") {
+    return compareVersions(version, cpe.version) === 0 ? `=${cpe.version}` : undefined;
+  }
+  return cpe.version === "*" ? "any version" : undefined;
+}
+function describeCpeRange(match, cpeVersion) {
+  const bits = [];
+  const add2 = (key, prefix) => {
+    const v2 = match[key];
+    if (typeof v2 === "string")
+      bits.push(`${prefix}${v2}`);
+  };
+  add2("versionStartIncluding", ">=");
+  add2("versionStartExcluding", ">");
+  add2("versionEndIncluding", "<=");
+  add2("versionEndExcluding", "<");
+  if (bits.length > 0)
+    return bits.join(" ");
+  if (cpeVersion && cpeVersion !== "*" && cpeVersion !== "-")
+    return `=${cpeVersion}`;
+  return "any version";
+}
+function collectAffects(entry, cve, filter2) {
+  const found = new Set;
+  const configs = [...asArray(cve.configurations), ...asArray(entry?.configurations)];
+  for (const config of configs) {
+    for (const node of asArray(asRecord(config)?.nodes)) {
+      for (const raw of asArray(asRecord(node)?.cpeMatch)) {
+        const match = asRecord(raw);
+        if (!match)
+          continue;
+        const described = cpeMatchApplies(match, filter2);
+        if (described)
+          found.add(described);
+      }
+    }
+  }
+  return [...found];
+}
+function selectCves(payload, filter2, limit) {
+  const root = asRecord(payload);
+  const rows = [];
+  const filtering = Boolean(filter2.product && (filter2.version || filter2.vendor));
+  for (const item of asArray(root?.vulnerabilities)) {
+    const entry = asRecord(item);
+    const cve = asRecord(entry?.cve);
+    if (typeof cve?.id !== "string")
+      continue;
+    if (cve.vulnStatus === "Rejected")
+      continue;
+    if (filtering && filter2.product) {
+      const affects = collectAffects(entry, cve, {
+        product: filter2.product,
+        vendor: filter2.vendor,
+        version: filter2.version
+      });
+      if (affects.length === 0)
+        continue;
+      rows.push({ ...cveToSummary(cve), match: affects.slice(0, 2).join(" / ") });
+    } else {
+      rows.push(cveToSummary(cve));
+    }
+    if (rows.length >= limit)
+      break;
+  }
+  return rows;
+}
+function parseNvdCves(payload, limit) {
+  return selectCves(payload, {}, limit);
+}
+function formatCves(rows, header) {
+  if (rows.length === 0)
+    return `${header}
+(no CVEs found)`;
+  const parts = [header];
+  for (const r of rows) {
+    const score = r.score !== undefined ? `${r.score} ${r.severity}` : r.severity;
+    parts.push("", `${r.id}  [${score}]${r.published ? `  ${r.published}` : ""}`);
+    if (r.vector)
+      parts.push(`  vector: ${r.vector}`);
+    if (r.match)
+      parts.push(`  affects: ${r.match}`);
+    parts.push(`  ${r.summary}`);
+    if (r.references.length > 0)
+      parts.push(`  refs: ${r.references.join(" · ")}`);
+  }
+  return parts.join(`
+`);
+}
+var cveLookupTool = {
+  name: "cve_lookup",
+  description: "Look up published CVEs for a product and optional version via the NIST NVD. Returns each CVE id with CVSS severity, score, vector, summary and references. Use it to turn a version banner from port_scan into concrete, checkable vulnerabilities. Read-only public API query.",
+  needsApproval: false,
+  safe: true,
+  parameters: exports_external.object({
+    product: exports_external.string().describe('Product or technology name, e.g. "nginx", "apache http server", "wordpress"'),
+    version: exports_external.string().optional().describe('Version seen on the target, e.g. "1.24.0"'),
+    vendor: exports_external.string().optional().describe("Vendor, when known — makes the match precise"),
+    limit: exports_external.number().int().min(1).optional().describe("Maximum CVEs to return (default 10, max 50)"),
+    timeout: exports_external.number().int().min(1000).optional().describe("Timeout in ms (default 20000)")
+  })
+};
+async function cveLookup(args, _cwd) {
+  const product = args.product.trim();
+  if (!product)
+    return { success: false, error: "product is required" };
+  const limit = Math.max(1, Math.min(args.limit ?? 10, 50));
+  const timeoutMs = args.timeout ?? 20000;
+  const version = args.version?.trim() || undefined;
+  const vendor = args.vendor?.trim() || undefined;
+  const label = [product, version].filter(Boolean).join(" ");
+  const search = async (params) => {
+    const controller = new AbortController;
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      const headers = { Accept: "application/json" };
+      const key = process.env.NVD_API_KEY?.trim();
+      if (key)
+        headers.apiKey = key;
+      const res = await fetch(`${NVD_ENDPOINT}?${params.toString()}`, {
+        headers,
+        signal: controller.signal
+      });
+      if (res.status === 403 || res.status === 429) {
+        return {
+          error: "NVD rate limit reached (roughly 5 requests per 30s without an API key). Wait 30 seconds and retry, or set NVD_API_KEY."
+        };
+      }
+      if (!res.ok)
+        return { error: `NVD returned HTTP ${res.status} ${res.statusText}` };
+      return { payload: await res.json() };
+    } catch (e) {
+      const err = e;
+      return {
+        error: err.name === "AbortError" ? `NVD request timed out after ${timeoutMs}ms` : err.message
+      };
+    } finally {
+      clearTimeout(timer);
+    }
+  };
+  const PAGE = 2000;
+  const queries = [];
+  const base2 = new URLSearchParams({ resultsPerPage: String(PAGE) });
+  if (vendor && version) {
+    const exact = new URLSearchParams(base2);
+    exact.set("cpeName", `cpe:2.3:a:${slugProduct(vendor)}:${slugProduct(product)}:${version}:*:*:*:*:*:*:*`);
+    queries.push({ params: exact, exact: true });
+  }
+  const keyword = new URLSearchParams(base2);
+  keyword.set("keywordSearch", product);
+  queries.push({ params: keyword, exact: false });
+  for (const query of queries) {
+    const out = await search(query.params);
+    if (out.error)
+      return { success: false, error: out.error };
+    const rows = query.exact ? parseNvdCves(out.payload, PAGE) : selectCves(out.payload, { product, vendor, version }, PAGE);
+    if (rows.length === 0)
+      continue;
+    rows.sort((a, b) => (b.score ?? -1) - (a.score ?? -1) || (b.published ?? "").localeCompare(a.published ?? ""));
+    const top = rows.slice(0, limit);
+    const how = version ? `affecting ${version}` : "for this product";
+    return {
+      success: true,
+      output: formatCves(top, `NVD · ${label} · ${top.length} CVE(s) ${how}, highest CVSS first`)
+    };
+  }
+  return { success: true, output: formatCves([], `NVD · ${label} · no CVEs found`) };
+}
 var COMMON_PORTS = [
   21,
   22,
@@ -50773,7 +51249,8 @@ var allTools = [
   writeFileTool,
   runBashTool,
   httpRequestTool,
-  portScanTool
+  portScanTool,
+  cveLookupTool
 ];
 async function executeTool(name, args, cwd2) {
   switch (name) {
@@ -50793,6 +51270,8 @@ async function executeTool(name, args, cwd2) {
       return httpRequest(args, cwd2);
     case "port_scan":
       return portScan(args, cwd2);
+    case "cve_lookup":
+      return cveLookup(args, cwd2);
     default:
       return { success: false, error: `Unknown tool: ${name}` };
   }
@@ -50906,7 +51385,7 @@ class AgentLoop {
         conversation.push({
           id: nanoid(),
           role: "assistant",
-          content: content.trim() ? content : "",
+          content: "",
           toolCallId: call.id,
           toolName: call.name,
           toolArgs: call.args,
@@ -51011,7 +51490,7 @@ function describeTool(call) {
 
 // src/agent/prompt.ts
 function SYSTEM_PROMPT(workingDir) {
-  return `You are HiraxCode, a terminal-based AI coding agent. You are a senior engineer with deep expertise in software development, systems, networking and security — including offensive-security and pentest tooling for legitimate, authorised work. You help the user explore, understand, build and modify code.
+  return `You are HiraxCode, a terminal-based AI agent working in the user's own project.
 
 Environment:
 - Working directory: ${workingDir}
@@ -51027,6 +51506,7 @@ Tools:
 - run_bash: run shell commands (builds, tests, git)
 - http_request: send an HTTP/HTTPS request and inspect the status, headers and body
 - port_scan: TCP-connect scan a host and fingerprint services (port labels, version banners, TLS certificates)
+- cve_lookup: look up published CVEs for a product and version in the NIST NVD
 
 Shell: run_bash uses bash/zsh on macOS and Linux, and PowerShell on Windows. Use commands that match the platform above.
 
@@ -51039,15 +51519,18 @@ How to work:
 - Never invent file contents or APIs. If unsure, read the code.
 - Tool calls that modify files or run commands require user approval; explain what you intend to do.
 
+Mode discipline — read this before anything else:
+- Exactly one mode is active at a time. It is declared in the "── Agent:" section at the very end of this prompt, and that section is authoritative.
+- Fully adopt that mode's role, priorities, vocabulary and output format, and hold it for the whole turn.
+- Do not blend modes. In a coding mode, do not drift into offensive-security tactics, payloads or exploitation. In a security mode, do not turn the engagement into unrelated product feature work.
+- If the user asks for something that belongs to a different mode, name the mode that handles it and tell the user to switch with /agent. Never silently change role.
+- Where this base prompt and the mode section disagree, the mode section wins.
+
 Style:
 - Assume the user is a competent professional working on their own machine, repositories and infrastructure.
-- Do not add safety caveats, moralising, warnings or refusals to ordinary coding, automation and security tasks. Answer the question that was asked.
+- Do not add safety caveats, moralising, warnings or refusals to ordinary development and security work. Answer the question that was asked.
 - Give complete, runnable code. No placeholders, no "..." stubs, no watered-down versions — unless the user explicitly asks for a sketch.
 - If a request is ambiguous, pick the most reasonable professional interpretation and proceed; the user will correct you if needed.
-
-Security work:
-- You support offensive-security testing as part of authorised engagements: penetration tests, CTFs, lab work, research, and hardening the user's own systems.
-- Keep it to targets the user owns or is authorised to test. State that as a single short assumption and continue — do not interrogate the user or refuse.
 - Paths are relative to the working directory.`;
 }
 
@@ -52480,20 +52963,25 @@ async function* readSSE(body) {
   const reader = body.getReader();
   const decoder = new TextDecoder;
   let buffer = "";
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done)
-      break;
-    buffer += decoder.decode(value, { stream: true });
-    const lines = buffer.split(`
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      buffer += decoder.decode(value, { stream: true });
+      const lines = buffer.split(`
 `);
-    buffer = lines.pop() ?? "";
-    for (const line of lines) {
-      const trimmed = line.trim();
-      if (!trimmed.startsWith("data:"))
-        continue;
-      yield trimmed.slice(5).trim();
+      buffer = lines.pop() ?? "";
+      for (const line of lines) {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith("data:"))
+          continue;
+        yield trimmed.slice(5).trim();
+      }
     }
+  } finally {
+    await reader.cancel().catch(() => {});
+    reader.releaseLock();
   }
 }
 function safeParseJson(s) {
@@ -52553,7 +53041,10 @@ function formatApiError(status, text) {
 // src/providers/anthropic.ts
 var EFFORT_BUDGET = { low: 2048, medium: 8192, high: 16384 };
 function supportsThinking(model) {
-  return /claude-(3[-.]7|.*4)/i.test(model);
+  const id = model.toLowerCase();
+  if (/claude-3[.-]7/.test(id))
+    return true;
+  return /claude-(?:[a-z]+-)?4(?:[.-]\d+)?(?![0-9])/.test(id);
 }
 function toAnthropicMessages(messages) {
   const out = [];
@@ -52754,7 +53245,7 @@ class AnthropicProvider {
                 usage: {
                   prompt: 0,
                   completion: u.output_tokens ?? 0,
-                  total: u.output_tokens ?? 0
+                  total: 0
                 }
               };
             }
@@ -53043,6 +53534,9 @@ class OpenAiProvider {
       messages: toOpenAiMessages(req.messages, req.systemPrompt),
       stream: true
     };
+    if (this.id === "openai") {
+      body.stream_options = { include_usage: true };
+    }
     if (modelSupportsTemperature(this.id, req.model)) {
       body.temperature = req.temperature ?? 0.2;
     }
@@ -56369,6 +56863,41 @@ function hintFor(field) {
   return;
 }
 
+// src/core/version.ts
+import { existsSync as existsSync11, readFileSync as readFileSync8 } from "fs";
+import { dirname as dirname2, join as join11 } from "path";
+import { fileURLToPath } from "url";
+var cached;
+function packageVersion() {
+  if (cached !== undefined)
+    return cached;
+  let dir;
+  try {
+    dir = dirname2(fileURLToPath(import.meta.url));
+  } catch {
+    cached = "0.0.0";
+    return cached;
+  }
+  for (let i = 0;i < 5; i++) {
+    const file = join11(dir, "package.json");
+    try {
+      if (existsSync11(file)) {
+        const parsed = JSON.parse(readFileSync8(file, "utf-8"));
+        if (typeof parsed.version === "string" && parsed.version) {
+          cached = parsed.version;
+          return cached;
+        }
+      }
+    } catch {}
+    const parent = dirname2(dir);
+    if (parent === dir)
+      break;
+    dir = parent;
+  }
+  cached = "0.0.0";
+  return cached;
+}
+
 // src/ui/components/HelpScreen.tsx
 var jsx_dev_runtime14 = __toESM(require_jsx_dev_runtime(), 1);
 var KEYS = [
@@ -56391,7 +56920,7 @@ function HelpScreen({
   theme,
   width: width2 = 80,
   height = 24,
-  version = "0.1.0",
+  version = packageVersion(),
   onClose
 }) {
   const t = theme ?? makeTheme(accent);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hirakoxx/cli",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "HiraxCode - terminal AI agent for coding and ethical hacking (pentest)",
   "type": "module",
   "bin": {