@kinosec/cli 0.10.3 → 0.11.1

package/dist/cli.js

@@ -6732,10 +6732,11 @@ function parseApiError(body, status) {
     });
   }
   const b = body;
+  const detail = typeof b.detail === "string" ? b.detail : typeof b.error === "string" ? b.error : "An unexpected error occurred";
   return new ApiError({
     status: typeof b.status === "number" ? b.status : status,
     code: typeof b.code === "string" ? b.code : "unknown_error",
-    detail: typeof b.detail === "string" ? b.detail : "An unexpected error occurred",
+    detail,
     requestId: typeof b.request_id === "string" ? b.request_id : "unknown"
   });
 }
@@ -8435,7 +8436,7 @@ ${import_picocolors3.default.dim("use of its services.")}
 var import_picocolors4 = __toESM(require_picocolors(), 1);
 
 // src/lib/validate-mode.ts
-var VALID_SCAN_MODES = ["full", "quick", "htb", "defcon"];
+var VALID_SCAN_MODES = ["full", "quick", "htb", "defcon", "exploit-only"];
 function validateScanMode(mode) {
   if (!VALID_SCAN_MODES.includes(mode)) {
     console.error(`Invalid mode "${mode}". Must be one of: ${VALID_SCAN_MODES.join(", ")}.`);
@@ -12561,16 +12562,228 @@ function parseTarget(input) {
   };
 }
 
+// src/lib/graybox.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync3, mkdtempSync, readFileSync as readFileSync3, rmSync, statSync } from "fs";
+import { tmpdir } from "os";
+import { dirname as dirname3, join as join3 } from "path";
+import { fileURLToPath } from "url";
+var SOURCE_BYTES_WARN = 2e5;
+function findPython() {
+  const candidates = [
+    { cmd: "python3", args: [] },
+    { cmd: "py", args: ["-3"] },
+    { cmd: "python", args: [] }
+  ];
+  for (const interp of candidates) {
+    try {
+      const result = spawnSync(interp.cmd, [...interp.args, "--version"], { stdio: "ignore" });
+      if (!result.error && result.status === 0) return interp;
+    } catch {
+    }
+  }
+  return null;
+}
+function resolveCtxpackScript() {
+  const here = dirname3(fileURLToPath(import.meta.url));
+  const candidates = [
+    join3(here, "vendor", "ctxpack.py"),
+    // bundled: dist/cli.js -> dist/vendor/
+    join3(here, "..", "vendor", "ctxpack.py"),
+    // published package root -> vendor/
+    join3(here, "..", "..", "vendor", "ctxpack.py")
+    // dev: src/lib -> packages/cli/vendor/
+  ];
+  for (const candidate of candidates) {
+    if (existsSync3(candidate)) return candidate;
+  }
+  throw new Error(
+    `Could not locate the vendored ctxpack packer (looked in: ${candidates.join(", ")}). This is a packaging bug \u2014 reinstall @kinosec/cli.`
+  );
+}
+var PYTHON_MISSING_MESSAGE = 'Packing --source requires Python 3, but none of "python3", "py -3", or "python" was found on PATH.\nInstall Python 3 (https://www.python.org/downloads/) and re-run, or pass an already-packed bundle: --source <bundle.txt>.';
+async function packSource(source, options) {
+  if (!existsSync3(source)) {
+    throw new Error(`--source path not found: ${source}`);
+  }
+  const stats = statSync(source);
+  if (stats.isFile() && source.toLowerCase().endsWith(".txt")) {
+    const bundleText = readFileSync3(source, "utf8");
+    return {
+      bundleText,
+      bytes: Buffer.byteLength(bundleText, "utf8"),
+      mode: null,
+      stack: sniffBundleStack(bundleText),
+      manifest: null,
+      stderr: "",
+      premade: true
+    };
+  }
+  const python = findPython();
+  if (!python) {
+    throw new Error(PYTHON_MISSING_MESSAGE);
+  }
+  const script = resolveCtxpackScript();
+  const outDir = mkdtempSync(join3(tmpdir(), "kinosec-ctxpack-"));
+  try {
+    const args = [...python.args, script, source, "--budget", String(options.budget), "-o", outDir];
+    if (options.zipPassword) {
+      args.push("--zip-password", options.zipPassword);
+    }
+    const proc = spawnSync(python.cmd, args, { encoding: "utf8" });
+    if (proc.error) {
+      throw new Error(`Failed to run ctxpack via ${python.cmd}: ${proc.error.message}`);
+    }
+    if (proc.status !== 0) {
+      const detail = (proc.stderr || "").trim();
+      throw new Error(
+        `ctxpack failed to pack --source (exit ${proc.status ?? "unknown"}).` + (detail ? `
+${detail}` : "") + (looksLikeAesZip(detail) ? '\nHint: only classic ZipCrypto zips are supported (HTB handouts use "hackthebox"), not WinZip/AES-256. Re-create the archive with classic encryption, or extract it and pass the directory.' : "")
+      );
+    }
+    const bundlePath = join3(outDir, "bundle.txt");
+    if (!existsSync3(bundlePath)) {
+      throw new Error(`ctxpack produced no bundle (${bundlePath} missing).`);
+    }
+    const bundleText = readFileSync3(bundlePath, "utf8");
+    let manifest = null;
+    try {
+      manifest = JSON.parse(readFileSync3(join3(outDir, "manifest.json"), "utf8"));
+    } catch {
+      manifest = null;
+    }
+    const stack = manifest?.signals?.stack ? String(manifest.signals.stack) : null;
+    const mode = manifest?.mode ? String(manifest.mode) : null;
+    return {
+      bundleText,
+      bytes: Buffer.byteLength(bundleText, "utf8"),
+      mode,
+      stack,
+      manifest,
+      stderr: proc.stderr || "",
+      premade: false
+    };
+  } finally {
+    try {
+      rmSync(outDir, { recursive: true, force: true });
+    } catch {
+    }
+  }
+}
+function looksLikeAesZip(stderr) {
+  const lc = stderr.toLowerCase();
+  return lc.includes("compression type 99") || lc.includes("aes") || lc.includes("winzip");
+}
+function sniffBundleStack(text) {
+  const lc = text.toLowerCase();
+  if (/"next"|next\.config|\/_next\//.test(lc)) return "nextjs";
+  if (/"express"/.test(lc)) return "express";
+  if (/from flask|import flask/.test(lc)) return "flask";
+  if (/<\?php/.test(lc)) return "php";
+  return null;
+}
+function matchLiveStack(lowercased) {
+  if (lowercased.includes("x-powered-by: next.js") || lowercased.includes("/_next/") || lowercased.includes("__next_data__")) {
+    return "nextjs";
+  }
+  if (lowercased.includes("x-powered-by: express")) return "express";
+  if (lowercased.includes("x-powered-by: php") || lowercased.includes("phpsessid")) return "php";
+  if (lowercased.includes("server: werkzeug")) return "flask";
+  if (lowercased.includes("csrftoken")) return "django";
+  return null;
+}
+var COMPATIBLE_STACKS = /* @__PURE__ */ new Set([
+  "nextjs/react",
+  "react/nextjs",
+  "nextjs/node",
+  "node/nextjs",
+  "express/node",
+  "node/express"
+]);
+function stacksConflict(bundleStack, liveStack) {
+  if (!bundleStack || !liveStack) return false;
+  if (bundleStack === liveStack) return false;
+  if (COMPATIBLE_STACKS.has(`${bundleStack}/${liveStack}`)) return false;
+  return true;
+}
+async function probeLiveStack(host, timeoutMs = 8e3) {
+  for (const scheme of ["https", "http"]) {
+    let res;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      res = await fetch(`${scheme}://${host}/`, { signal: controller.signal, redirect: "follow" });
+    } catch {
+      continue;
+    } finally {
+      clearTimeout(timer);
+    }
+    const headerBlob = [...res.headers].map(([key, value]) => `${key}: ${value}`).join("\n");
+    let body = "";
+    try {
+      body = (await res.text()).slice(0, 4096);
+    } catch {
+    }
+    return matchLiveStack(`${headerBlob}
+${body}`.toLowerCase());
+  }
+  return null;
+}
+
 // src/commands/pentest.ts
+var DEFAULT_SOURCE_BUDGET = 4e4;
+function reportPackResult(result, budget) {
+  const size = `${result.bytes.toLocaleString()} bytes`;
+  if (result.premade) {
+    console.error(`Graybox: using pre-made source bundle (${size}).`);
+  } else {
+    for (const line of result.stderr.split("\n")) {
+      const trimmed = line.trim();
+      if (trimmed.startsWith("ctxpack: mode=")) {
+        console.error(`Graybox: ${trimmed.slice("ctxpack: ".length)} [${size}]`);
+      }
+    }
+  }
+  if (result.bytes > SOURCE_BYTES_WARN) {
+    printWarning(
+      `Source bundle is ${size} \u2014 that's a lot of prompt context. It will still be delivered (the server ships oversize source out-of-band), but large bundles raise per-scan cost and can dilute the agent's focus. Lower --budget (currently ${budget}) or trim --source to tighten it.`
+    );
+  }
+}
+function ensurePasteBundle(result) {
+  if (result.premade || result.mode === "paste") return;
+  if (result.mode === "retrieve") {
+    printWarning(
+      "ctxpack fell back to retrieve mode: the source is too large to paste within --budget, so the bundle is a path outline with no code \u2014 useless as graybox context."
+    );
+    console.error(
+      "Not sending it. Raise --budget to re-pack the source as a full paste bundle, or trim --source to the exploit-relevant files (or run a normal black-box scan without --source)."
+    );
+    process.exit(1);
+  }
+}
+function isUserDataTooLarge(err) {
+  return err.status === 413 || /user-?data too large/i.test(err.detail);
+}
 function registerPentestCommand(program3) {
-  const pentest = program3.command("pentest").description("Run and manage pentests").option("-t, --target <domain>", "Target domain to pentest").option("--profile <id>", "Pentest profile ID (alternative to --target)").option("--mode <mode>", "Pentest mode: full, quick, htb, or defcon", "full").option("--flag <prefix>", "CTF flag prefix (defcon mode only, default HTB)").option("--context <text>", "CTF focus hint (defcon mode only)").option("-y, --yes", "Accept authorization terms without prompting").option("--no-watch", "Skip auto-watch after starting the pentest").option("--deployment <type>", "Deployment type: cloud or on-prem", "cloud").option("--include <hosts>", "Include only these subdomains (comma-separated)").option("--exclude <hosts>", "Exclude these subdomains (comma-separated)").option("--scope <action>", "Scope action: clear").addHelpText("after", `
+  const pentest = program3.command("pentest").description("Run and manage pentests").option("-t, --target <domain>", "Target domain to pentest").option("--profile <id>", "Pentest profile ID (alternative to --target)").option("--mode <mode>", "Pentest mode: full, quick, htb, defcon, or exploit-only", "full").option("--flag <prefix>", "CTF flag prefix (defcon mode only, default HTB)").option("--context <text>", "CTF focus hint (defcon mode only)").option("-y, --yes", "Accept authorization terms without prompting").option("--no-watch", "Skip auto-watch after starting the pentest").option("--deployment <type>", "Deployment type: cloud or on-prem", "cloud").option("--include <hosts>", "Include only these subdomains (comma-separated)").option("--exclude <hosts>", "Exclude these subdomains (comma-separated)").option("--scope <action>", "Scope action: clear").option("--source <path>", "Graybox source handout: a directory, an archive (.zip/.tar/.tgz), or a pre-made bundle .txt. Its presence enables graybox").option("--budget <tokens>", "Token budget for packing --source (how much source to pack; larger = more context and cost)", String(DEFAULT_SOURCE_BUDGET)).option("--zip-password <pw>", "Password for an encrypted --source .zip (classic ZipCrypto only; HTB handouts use: hackthebox)").option("--force", "Proceed even when the --source stack looks unlike the live target").addHelpText("after", `
 Examples:
   $ kinosec pentest -t delikado.org
   $ kinosec pentest --profile abc123
   $ kinosec pentest -t internal.corp --deployment on-prem
   $ kinosec pentest -t example.com --include api.example.com,app.example.com
   $ kinosec pentest -t example.com --exclude staging.example.com
-  $ kinosec pentest -t example.com --scope clear`).action(async (options) => {
+  $ kinosec pentest -t example.com --scope clear
+  $ kinosec pentest -t juice.example.com --mode exploit-only
+  $ kinosec pentest -t target.htb --mode htb --source ./challenge.zip --zip-password hackthebox
+
+Graybox (--source):
+  Packs the target's source (paste-mode only) and folds it into the agent as authoritative
+  context. Works with --mode full and quick for any user's own asset; htb/defcon additionally
+  require admin access. Large source is delivered out-of-band, so there's no size ceiling to
+  fight \u2014 --budget just controls how much source is packed (bigger bundles add context and cost).
+  The source is sent over HTTPS, used only on the ephemeral scan droplet, and is NOT stored
+  server-side (the training log records just a "[GRAYBOX] N bytes injected" marker, never the source).`).action(async (options) => {
     if (!options.target && !options.profile) {
       console.error("Provide --target <domain> or --profile <id>.");
       process.exit(2);
@@ -12583,6 +12796,16 @@ Examples:
       process.exit(2);
     }
     validateScanMode(options.mode);
+    let sourceBudget = DEFAULT_SOURCE_BUDGET;
+    if (options.source) {
+      sourceBudget = parseInt(options.budget, 10);
+      if (!Number.isInteger(sourceBudget) || sourceBudget <= 0) {
+        console.error("Invalid --budget. Must be a positive integer (tokens).");
+        process.exit(2);
+      }
+    } else if (options.zipPassword || options.force) {
+      console.error("Warning: --zip-password/--force apply only with --source; ignoring.");
+    }
     const scopeClear = options.scope === "clear";
     if (options.scope && options.scope !== "clear") {
       console.error("Invalid --scope value. Must be: clear");
@@ -12601,6 +12824,15 @@ Examples:
       const opts = program3.opts();
       const { token, apiUrl } = resolveToken(opts);
       const client = new KinoSecClient({ apiUrl, token });
+      let packResult = null;
+      if (options.source) {
+        packResult = await packSource(options.source, {
+          budget: sourceBudget,
+          zipPassword: options.zipPassword
+        });
+        reportPackResult(packResult, sourceBudget);
+        ensurePasteBundle(packResult);
+      }
       let targetDisplay;
       let params;
       if (options.profile) {
@@ -12684,8 +12916,47 @@ Examples:
         }
         displayScope(asset);
       }
+      if (packResult?.stack && !options.force) {
+        const liveStack = await probeLiveStack(targetDisplay);
+        if (liveStack && stacksConflict(packResult.stack, liveStack)) {
+          printWarning(
+            `Source handout looks like "${packResult.stack}", but ${targetDisplay} responds like "${liveStack}".`
+          );
+          printWarning("The source may belong to a different app; graybox context could mislead the pentest.");
+          if (options.yes) {
+            console.error("Proceeding anyway (--yes).");
+          } else {
+            console.error("Aborting. Re-run with --force to override, or fix --source.");
+            process.exit(2);
+          }
+        }
+      }
       await confirmAuthorization(targetDisplay, Boolean(options.yes));
-      const result = await client.scans.create(params);
+      if (packResult) {
+        params.source_context = packResult.bundleText;
+      }
+      let result;
+      try {
+        result = await client.scans.create(params);
+      } catch (err) {
+        if (err instanceof ApiError) {
+          if (packResult && isUserDataTooLarge(err)) {
+            printWarning(`Server rejected the scan: ${err.detail}`);
+            console.error(
+              `The graybox source made the provisioning payload too large. Re-pack with a smaller --budget (currently ${sourceBudget}) or trim --source, then retry.`
+            );
+            process.exit(1);
+          }
+          if (err.status === 403 && (options.mode === "htb" || options.mode === "defcon")) {
+            printWarning(`The "${options.mode}" scan mode requires admin access (server returned 403).`);
+            console.error(
+              "Run with --mode full or --mode quick (which support --source for your own assets), or ask your KinoSec admin to enable CTF modes for your account."
+            );
+            process.exit(77);
+          }
+        }
+        throw err;
+      }
       const isOnPrem = result.deployment_type === "on_prem";
       if (opts.json || opts.output === "json") {
         printJson(result);
@@ -13793,7 +14064,7 @@ Examples:
 
 // src/cli.ts
 var program2 = new Command();
-program2.name("kinosec").description("KinoSec CLI \u2014 run pentests from your terminal").version("0.10.3", "-v, --version").option("--token <pat>", "API token (overrides KINOSEC_TOKEN)").option("--output <format>", "Output format: text or json", "text").option("--json", "Shorthand for --output json").option("--no-color", "Disable colors");
+program2.name("kinosec").description("KinoSec CLI \u2014 run pentests from your terminal").version("0.11.1", "-v, --version").option("--token <pat>", "API token (overrides KINOSEC_TOKEN)").option("--output <format>", "Output format: text or json", "text").option("--json", "Shorthand for --output json").option("--no-color", "Disable colors");
 registerAuthCommand(program2);
 registerMeCommand(program2);
 registerCreditsCommand(program2);
@@ -13802,7 +14073,7 @@ registerAssetCommand(program2);
 registerFindingCommand(program2);
 registerReportCommand(program2);
 registerTokenCommand(program2);
-program2.parseAsync(process.argv).then(() => checkForUpdate("0.10.3")).catch(handleError);
+program2.parseAsync(process.argv).then(() => checkForUpdate("0.11.1")).catch(handleError);
 /*! Bundled license information:
 
 ky/distribution/index.js: