@kinosec/cli 0.10.3 → 0.11.2

package/dist/cli.js

@@ -6732,10 +6732,11 @@ function parseApiError(body, status) {
     });
   }
   const b = body;
+  const detail = typeof b.detail === "string" ? b.detail : typeof b.error === "string" ? b.error : "An unexpected error occurred";
   return new ApiError({
     status: typeof b.status === "number" ? b.status : status,
     code: typeof b.code === "string" ? b.code : "unknown_error",
-    detail: typeof b.detail === "string" ? b.detail : "An unexpected error occurred",
+    detail,
     requestId: typeof b.request_id === "string" ? b.request_id : "unknown"
   });
 }
@@ -8434,28 +8435,111 @@ ${import_picocolors3.default.dim("use of its services.")}
 // src/commands/schedule.ts
 var import_picocolors4 = __toESM(require_picocolors(), 1);
 
-// src/lib/validate-mode.ts
-var VALID_SCAN_MODES = ["full", "quick", "htb", "defcon"];
-function validateScanMode(mode) {
-  if (!VALID_SCAN_MODES.includes(mode)) {
-    console.error(`Invalid mode "${mode}". Must be one of: ${VALID_SCAN_MODES.join(", ")}.`);
-    process.exit(2);
+// src/lib/validate-schedule.ts
+var SCHEDULE_PATTERNS = ["once", "daily", "weekly", "biweekly", "monthly"];
+var SCHEDULE_MODES = ["quick", "full"];
+var TIME_OF_DAY = /^([01]?\d|2[0-3]):[0-5]\d$/;
+var DIGITS = /^\d+$/;
+var ONCE_AT = /^(\d{4})-(\d{2})-(\d{2})T([01]\d|2[0-3]):[0-5]\d(:[0-5]\d(\.\d{3})?)?(Z|[+-]([01]\d|2[0-3]):[0-5]\d)$/;
+function scheduleInputError(flags, now) {
+  const { pattern, mode, at, time, timezone, dayOfWeek, dayOfMonth } = flags;
+  if (pattern !== void 0 && !SCHEDULE_PATTERNS.includes(pattern)) {
+    return `Invalid --pattern "${pattern}". Must be one of: ${SCHEDULE_PATTERNS.join(", ")}.`;
+  }
+  if (mode !== void 0 && !SCHEDULE_MODES.includes(mode)) {
+    return `Invalid --mode "${mode}". Schedules support: ${SCHEDULE_MODES.join(", ")}.`;
+  }
+  if (at !== void 0) {
+    const atError = onceAtError(at, now);
+    if (atError) return atError;
+  }
+  if (time !== void 0 && !TIME_OF_DAY.test(time)) {
+    return `Invalid --time "${time}". Use 24-hour HH:MM, e.g. 09:00.`;
+  }
+  if (timezone !== void 0 && !isKnownTimezone(timezone)) {
+    return `Invalid --timezone "${timezone}". Use an IANA name, e.g. America/New_York.`;
+  }
+  if (dayOfWeek !== void 0 && !isWholeNumberIn(dayOfWeek, 0, 6)) {
+    return `Invalid --day-of-week "${dayOfWeek}". Use a whole number 0-6 (0=Sunday).`;
+  }
+  if (dayOfMonth !== void 0 && !isWholeNumberIn(dayOfMonth, 1, 31)) {
+    return `Invalid --day-of-month "${dayOfMonth}". Use a whole number 1-31.`;
+  }
+  if (pattern === void 0 && at !== void 0) return "--at requires --pattern once.";
+  if (pattern === void 0) return null;
+  return patternFitError(pattern, flags);
+}
+function patternFitError(pattern, flags) {
+  if (pattern === "once" && flags.at === void 0) {
+    return "--at is required for once schedules: YYYY-MM-DDTHH:MM followed by Z or \xB1HH:MM.";
+  }
+  if (pattern === "once" && flags.time !== void 0) {
+    return "--time does not apply to once schedules; put the time in --at.";
+  }
+  if (pattern !== "once" && flags.at !== void 0) {
+    return "--at only applies to once schedules.";
+  }
+  const isWeekly = pattern === "weekly" || pattern === "biweekly";
+  if (isWeekly && flags.dayOfWeek === void 0) {
+    return `--day-of-week is required for ${pattern} schedules.`;
+  }
+  if (!isWeekly && flags.dayOfWeek !== void 0) {
+    return "--day-of-week only applies to weekly and biweekly schedules.";
   }
+  if (pattern === "monthly" && flags.dayOfMonth === void 0) {
+    return "--day-of-month is required for monthly schedules.";
+  }
+  if (pattern !== "monthly" && flags.dayOfMonth !== void 0) {
+    return "--day-of-month only applies to monthly schedules.";
+  }
+  return null;
+}
+function onceAtError(at, now) {
+  const match = ONCE_AT.exec(at);
+  const ms = Date.parse(at);
+  if (!match || Number.isNaN(ms) || !isCalendarDate(Number(match[1]), Number(match[2]), Number(match[3]))) {
+    return `Invalid --at "${at}". Use YYYY-MM-DDTHH:MM followed by Z or \xB1HH:MM, on a real date.`;
+  }
+  if (ms <= now.getTime()) return `--at "${at}" is in the past. Pick a future time.`;
+  return null;
+}
+function isCalendarDate(year, month, day) {
+  const date = new Date(Date.UTC(year, month - 1, day));
+  return date.getUTCMonth() === month - 1 && date.getUTCDate() === day;
+}
+function isKnownTimezone(timezone) {
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: timezone });
+    return true;
+  } catch (error2) {
+    if (error2 instanceof RangeError) return false;
+    throw error2;
+  }
+}
+function isWholeNumberIn(value, min, max) {
+  if (!DIGITS.test(value)) return false;
+  const n = Number(value);
+  return n >= min && n <= max;
 }
 
 // src/commands/schedule.ts
-var VALID_PATTERNS = ["once", "daily", "weekly", "biweekly", "monthly"];
 var DAY_NAMES = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
 function extractTime(scheduledAt) {
   if (!scheduledAt) return "\u2014";
   const d = new Date(scheduledAt);
   return d.toLocaleTimeString([], { hour: "2-digit", minute: "2-digit", hour12: false });
 }
+function extractDate(scheduledAt) {
+  if (!scheduledAt) return "\u2014";
+  const d = new Date(scheduledAt);
+  const pad = (n) => String(n).padStart(2, "0");
+  return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}`;
+}
 function formatPattern(s) {
   const time = extractTime(s.scheduled_at);
   switch (s.recurrence_pattern) {
     case "once":
-      return `Once at ${time}`;
+      return `Once on ${extractDate(s.scheduled_at)} at ${time}`;
     case "daily":
       return `Daily at ${time}`;
     case "weekly":
@@ -8468,6 +8552,22 @@ function formatPattern(s) {
       return s.recurrence_pattern;
   }
 }
+function modeTypedOnPentest(pentestCmd) {
+  return pentestCmd.getOptionValueSource("mode") === "cli" ? String(pentestCmd.getOptionValue("mode")) : void 0;
+}
+function yesTypedOnPentest(pentestCmd) {
+  return pentestCmd.getOptionValueSource("yes") === "cli";
+}
+function exitOnInputError(flags) {
+  const error2 = scheduleInputError(flags, /* @__PURE__ */ new Date());
+  if (!error2) return;
+  console.error(error2);
+  process.exit(2);
+}
+function scheduleMode(mode) {
+  if (mode === "quick" || mode === "full") return mode;
+  throw new Error(`Unchecked schedule mode "${mode}".`);
+}
 function registerScheduleCommand(pentestCmd) {
   const schedule = pentestCmd.command("schedule").description("Manage scheduled pentests");
   schedule.command("list").description("List scheduled pentests").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").option("--status <status>", "Filter: active, paused, or all", "all").addHelpText("after", `
@@ -8542,36 +8642,35 @@ Examples:
       handleError(error2);
     }
   });
-  schedule.command("create").description("Create a scheduled pentest").requiredOption("--asset <id>", "Asset ID to scan").requiredOption("--pattern <pattern>", "Recurrence: once, daily, weekly, biweekly, monthly").option("--name <name>", "Schedule name").option("--mode <mode>", "Scan mode (default: full)", "full").option("--time <HH:MM>", "Time of day (24h format)", "09:00").option("--day-of-week <0-6>", "Day of week (0=Sun..6=Sat) for weekly/biweekly").option("--day-of-month <1-31>", "Day of month for monthly").option("--timezone <tz>", "Timezone (e.g. America/New_York)", Intl.DateTimeFormat().resolvedOptions().timeZone).addHelpText("after", `
+  schedule.command("create").description("Create a scheduled pentest").requiredOption("--asset <id>", "Asset ID to scan").requiredOption("--pattern <pattern>", "Recurrence: once, daily, weekly, biweekly, monthly").option("--name <name>", "Schedule name").option("--mode <mode>", "Scan mode: quick or full (default: full)", "full").option("--at <datetime>", "Run time for --pattern once: YYYY-MM-DDTHH:MM followed by Z or \xB1HH:MM").option("--time <HH:MM>", "Time of day, 24h, for recurring patterns (default: 09:00)").option("--day-of-week <0-6>", "Day of week (0=Sun..6=Sat) for weekly/biweekly").option("--day-of-month <1-31>", "Day of month for monthly").option("--timezone <tz>", "Timezone (e.g. America/New_York)", Intl.DateTimeFormat().resolvedOptions().timeZone).addHelpText("after", `
 Examples:
   $ kinosec pentest schedule create --asset abc123 --pattern weekly --day-of-week 1 --time 09:00
   $ kinosec pentest schedule create --asset abc123 --pattern daily --time 14:00
-  $ kinosec pentest schedule create --asset abc123 --pattern monthly --day-of-month 15 --time 03:00 --timezone UTC`).action(async (options) => {
-    if (!VALID_PATTERNS.includes(options.pattern)) {
-      console.error(`Invalid pattern "${options.pattern}". Must be: ${VALID_PATTERNS.join(", ")}`);
-      process.exit(2);
-    }
-    validateScanMode(options.mode);
-    if ((options.pattern === "weekly" || options.pattern === "biweekly") && options.dayOfWeek === void 0) {
-      console.error(`--day-of-week is required for ${options.pattern} schedules.`);
-      process.exit(2);
-    }
-    if (options.pattern === "monthly" && options.dayOfMonth === void 0) {
-      console.error("--day-of-month is required for monthly schedules.");
-      process.exit(2);
-    }
+  $ kinosec pentest schedule create --asset abc123 --pattern monthly --day-of-month 15 --time 03:00 --timezone UTC
+  $ kinosec pentest schedule create --asset abc123 --pattern once --at 2099-12-01T09:00+01:00`).action(async (options) => {
+    const mode = modeTypedOnPentest(pentestCmd) ?? options.mode;
+    exitOnInputError({
+      pattern: options.pattern,
+      mode,
+      at: options.at,
+      time: options.time,
+      timezone: options.timezone,
+      dayOfWeek: options.dayOfWeek,
+      dayOfMonth: options.dayOfMonth
+    });
     try {
       const opts = schedule.parent.parent.opts();
       const { token, apiUrl } = resolveToken(opts);
       const client = new KinoSecClient({ apiUrl, token });
       const params = {
-        asset_id: options.domain_or_ip,
-        name: options.name ?? `${options.pattern} ${options.mode} pentest`,
-        scan_mode: options.mode,
+        asset_id: options.asset,
+        name: options.name ?? `${options.pattern} ${mode} pentest`,
+        scan_mode: scheduleMode(mode),
         recurrence_pattern: options.pattern,
-        time_of_day: options.time,
         timezone: options.timezone
       };
+      if (options.pattern === "once") params.once_at = new Date(options.at).toISOString();
+      else params.time_of_day = options.time ?? "09:00";
       if (options.dayOfWeek !== void 0) params.day_of_week = parseInt(options.dayOfWeek, 10);
       if (options.dayOfMonth !== void 0) params.day_of_month = parseInt(options.dayOfMonth, 10);
       const s = await client.schedules.create(params);
@@ -8589,17 +8688,26 @@ Manage: kinosec pentest schedule get ${s.id}`);
       handleError(error2);
     }
   });
-  schedule.command("update").description("Update a schedule").argument("<id>", "Schedule ID").option("--pattern <pattern>", "Recurrence: once, daily, weekly, biweekly, monthly").option("--name <name>", "Schedule name").option("--mode <mode>", "Scan mode").option("--time <HH:MM>", "Time of day (24h format)").option("--day-of-week <0-6>", "Day of week (0=Sun..6=Sat)").option("--day-of-month <1-31>", "Day of month").option("--timezone <tz>", "Timezone").addHelpText("after", `
+  schedule.command("update").description("Update a schedule").argument("<id>", "Schedule ID").option("--pattern <pattern>", "Recurrence: once, daily, weekly, biweekly, monthly").option("--name <name>", "Schedule name").option("--mode <mode>", "Scan mode: quick or full").option("--at <datetime>", "Run time with --pattern once: ISO date and time with an offset").option("--time <HH:MM>", "Time of day (24h format)").option("--day-of-week <0-6>", "Day of week (0=Sun..6=Sat)").option("--day-of-month <1-31>", "Day of month").option("--timezone <tz>", "Timezone").addHelpText("after", `
 Examples:
   $ kinosec pentest schedule update abc123 --pattern daily --time 14:00
-  $ kinosec pentest schedule update abc123 --time 14:00`).action(async (id, options) => {
+  $ kinosec pentest schedule update abc123 --time 14:00
+  $ kinosec pentest schedule update abc123 --pattern once --at 2099-12-01T09:00Z`).action(async (id, options) => {
+    const mode = modeTypedOnPentest(pentestCmd) ?? options.mode;
+    exitOnInputError({
+      pattern: options.pattern,
+      mode,
+      at: options.at,
+      time: options.time,
+      timezone: options.timezone,
+      dayOfWeek: options.dayOfWeek,
+      dayOfMonth: options.dayOfMonth
+    });
     const params = {};
     if (options.pattern) params.recurrence_pattern = options.pattern;
     if (options.name) params.name = options.name;
-    if (options.mode) {
-      validateScanMode(options.mode);
-      params.scan_mode = options.mode;
-    }
+    if (mode) params.scan_mode = scheduleMode(mode);
+    if (options.at !== void 0) params.once_at = new Date(options.at).toISOString();
     if (options.time) params.time_of_day = options.time;
     if (options.dayOfWeek !== void 0) params.day_of_week = parseInt(options.dayOfWeek, 10);
     if (options.dayOfMonth !== void 0) params.day_of_month = parseInt(options.dayOfMonth, 10);
@@ -8629,7 +8737,7 @@ Examples:
   $ kinosec pentest schedule delete abc123
   $ kinosec pentest schedule delete abc123 --yes`).action(async (id, options) => {
     try {
-      await confirmDestructive(`Delete schedule ${id}?`, Boolean(options.yes));
+      await confirmDestructive(`Delete schedule ${id}?`, Boolean(options.yes) || yesTypedOnPentest(pentestCmd));
       const opts = schedule.parent.parent.opts();
       const { token, apiUrl } = resolveToken(opts);
       const client = new KinoSecClient({ apiUrl, token });
@@ -11903,18 +12011,6 @@ function normalizeActivityHistory(raw) {
     return JSON.stringify(entry);
   });
 }
-function filterActivityForTier(entries, showFullDetails) {
-  if (showFullDetails) return entries;
-  return entries.filter((line) => !/^\s{4,}/.test(line)).map((line) => {
-    if (/\] Running:/.test(line)) {
-      return line.replace(
-        /Running:.*/,
-        "Running: [upgrade to Security Pro for full details]"
-      );
-    }
-    return line;
-  });
-}
 
 // src/lib/buzzwords.ts
 var SCAN_EXECUTION_PHRASES = [
@@ -12018,15 +12114,6 @@ function printActivityLines(entries, tty3) {
     console.log(`${prompt} ${text}`);
   }
 }
-async function resolveShowFullDetails(client) {
-  try {
-    const me = await client.me.get();
-    const slug = me.plan.slug;
-    return slug === "security_pro" || slug === "enterprise";
-  } catch {
-    return false;
-  }
-}
 async function watchPentest(client, profileId, options) {
   const { timeoutMs, intervalMs, useJson, showFindingsSummary } = options;
   const tty3 = isTTY();
@@ -12055,7 +12142,6 @@ async function watchPentest(client, profileId, options) {
     console.log("\nWatch cancelled. Pentest is still running.");
     process.exit(0);
   });
-  const showFullDetails = await resolveShowFullDetails(client);
   let consecutiveErrors = 0;
   const MAX_CONSECUTIVE_ERRORS = 2;
   let deferredExitCode = null;
@@ -12103,17 +12189,16 @@ ${icon2} Lost connection to pentest.`);
           JSON.stringify({ ...scanDetail, elapsed_seconds: elapsed }) + "\n"
         );
       } else {
-        const normalized = normalizeActivityHistory(scanDetail.activity_history);
-        const filtered = filterActivityForTier(normalized, showFullDetails);
-        if (printedCount > filtered.length) printedCount = 0;
-        const newEntries = filtered.slice(printedCount);
+        const entries = normalizeActivityHistory(scanDetail.activity_history);
+        if (printedCount > entries.length) printedCount = 0;
+        const newEntries = entries.slice(printedCount);
         if (newEntries.length > 0) {
           if (spinner) spinner.stop();
           printActivityLines(newEntries, tty3);
           printedCount += newEntries.length;
           if (spinner) spinner = ora({ color: "green", isEnabled: true, discardStdin: false }).start();
         }
-        currentPhase = extractPhase(filtered);
+        currentPhase = extractPhase(entries);
         updateSpinnerText();
       }
       const status = scanDetail.scan_status;
@@ -12316,6 +12401,15 @@ Timeout: Scout did not connect within ${secs}s.`);
   }
 }
 
+// src/lib/validate-mode.ts
+var VALID_SCAN_MODES = ["full", "quick", "htb", "defcon", "exploit-only"];
+function validateScanMode(mode) {
+  if (!VALID_SCAN_MODES.includes(mode)) {
+    console.error(`Invalid mode "${mode}". Must be one of: ${VALID_SCAN_MODES.join(", ")}.`);
+    process.exit(2);
+  }
+}
+
 // src/lib/scope.ts
 var import_picocolors7 = __toESM(require_picocolors(), 1);
 
@@ -12561,16 +12655,226 @@ function parseTarget(input) {
   };
 }
 
+// src/lib/graybox.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync3, mkdtempSync, readFileSync as readFileSync3, rmSync, statSync } from "fs";
+import { tmpdir } from "os";
+import { dirname as dirname3, join as join3 } from "path";
+import { fileURLToPath } from "url";
+var SOURCE_BYTES_WARN = 2e5;
+function findPython() {
+  const candidates = [
+    { cmd: "python3", args: [] },
+    { cmd: "py", args: ["-3"] },
+    { cmd: "python", args: [] }
+  ];
+  for (const interp of candidates) {
+    try {
+      const result = spawnSync(interp.cmd, [...interp.args, "--version"], { stdio: "ignore" });
+      if (!result.error && result.status === 0) return interp;
+    } catch {
+    }
+  }
+  return null;
+}
+function resolveCtxpackScript() {
+  const here = dirname3(fileURLToPath(import.meta.url));
+  const candidates = [
+    join3(here, "vendor", "ctxpack.py"),
+    // bundled: dist/cli.js -> dist/vendor/
+    join3(here, "..", "vendor", "ctxpack.py"),
+    // published package root -> vendor/
+    join3(here, "..", "..", "vendor", "ctxpack.py")
+    // dev: src/lib -> packages/cli/vendor/
+  ];
+  for (const candidate of candidates) {
+    if (existsSync3(candidate)) return candidate;
+  }
+  throw new Error(
+    `Could not locate the vendored ctxpack packer (looked in: ${candidates.join(", ")}). This is a packaging bug \u2014 reinstall @kinosec/cli.`
+  );
+}
+var PYTHON_MISSING_MESSAGE = 'Packing --source requires Python 3, but none of "python3", "py -3", or "python" was found on PATH.\nInstall Python 3 (https://www.python.org/downloads/) and re-run, or pass an already-packed bundle: --source <bundle.txt>.';
+async function packSource(source, options) {
+  if (!existsSync3(source)) {
+    throw new Error(`--source path not found: ${source}`);
+  }
+  const stats = statSync(source);
+  if (stats.isFile() && source.toLowerCase().endsWith(".txt")) {
+    const bundleText = readFileSync3(source, "utf8");
+    return {
+      bundleText,
+      bytes: Buffer.byteLength(bundleText, "utf8"),
+      mode: null,
+      stack: sniffBundleStack(bundleText),
+      manifest: null,
+      stderr: "",
+      premade: true
+    };
+  }
+  const python = findPython();
+  if (!python) {
+    throw new Error(PYTHON_MISSING_MESSAGE);
+  }
+  const script = resolveCtxpackScript();
+  const outDir = mkdtempSync(join3(tmpdir(), "kinosec-ctxpack-"));
+  try {
+    const args = [...python.args, script, source, "--budget", String(options.budget), "-o", outDir];
+    if (options.zipPassword) {
+      args.push("--zip-password", options.zipPassword);
+    }
+    const proc = spawnSync(python.cmd, args, { encoding: "utf8" });
+    if (proc.error) {
+      throw new Error(`Failed to run ctxpack via ${python.cmd}: ${proc.error.message}`);
+    }
+    if (proc.status !== 0) {
+      const detail = (proc.stderr || "").trim();
+      throw new Error(
+        `ctxpack failed to pack --source (exit ${proc.status ?? "unknown"}).` + (detail ? `
+${detail}` : "") + (looksLikeAesZip(detail) ? '\nHint: only classic ZipCrypto zips are supported (HTB handouts use "hackthebox"), not WinZip/AES-256. Re-create the archive with classic encryption, or extract it and pass the directory.' : "")
+      );
+    }
+    const bundlePath = join3(outDir, "bundle.txt");
+    if (!existsSync3(bundlePath)) {
+      throw new Error(`ctxpack produced no bundle (${bundlePath} missing).`);
+    }
+    const bundleText = readFileSync3(bundlePath, "utf8");
+    let manifest = null;
+    try {
+      manifest = JSON.parse(readFileSync3(join3(outDir, "manifest.json"), "utf8"));
+    } catch {
+      manifest = null;
+    }
+    const stack = manifest?.signals?.stack ? String(manifest.signals.stack) : null;
+    const mode = manifest?.mode ? String(manifest.mode) : null;
+    return {
+      bundleText,
+      bytes: Buffer.byteLength(bundleText, "utf8"),
+      mode,
+      stack,
+      manifest,
+      stderr: proc.stderr || "",
+      premade: false
+    };
+  } finally {
+    try {
+      rmSync(outDir, { recursive: true, force: true });
+    } catch {
+    }
+  }
+}
+function looksLikeAesZip(stderr) {
+  const lc = stderr.toLowerCase();
+  return lc.includes("compression type 99") || lc.includes("aes") || lc.includes("winzip");
+}
+function sniffBundleStack(text) {
+  const lc = text.toLowerCase();
+  if (/"next"|next\.config|\/_next\//.test(lc)) return "nextjs";
+  if (/"express"/.test(lc)) return "express";
+  if (/from flask|import flask/.test(lc)) return "flask";
+  if (/<\?php/.test(lc)) return "php";
+  return null;
+}
+function matchLiveStack(lowercased) {
+  if (lowercased.includes("x-powered-by: next.js") || lowercased.includes("/_next/") || lowercased.includes("__next_data__")) {
+    return "nextjs";
+  }
+  if (lowercased.includes("x-powered-by: express")) return "express";
+  if (lowercased.includes("x-powered-by: php") || lowercased.includes("phpsessid")) return "php";
+  if (lowercased.includes("server: werkzeug")) return "flask";
+  if (lowercased.includes("csrftoken")) return "django";
+  return null;
+}
+var COMPATIBLE_STACKS = /* @__PURE__ */ new Set([
+  "nextjs/react",
+  "react/nextjs",
+  "nextjs/node",
+  "node/nextjs",
+  "express/node",
+  "node/express"
+]);
+function stacksConflict(bundleStack, liveStack) {
+  if (!bundleStack || !liveStack) return false;
+  if (bundleStack === liveStack) return false;
+  if (COMPATIBLE_STACKS.has(`${bundleStack}/${liveStack}`)) return false;
+  return true;
+}
+async function probeLiveStack(host, timeoutMs = 8e3) {
+  for (const scheme of ["https", "http"]) {
+    let res;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      res = await fetch(`${scheme}://${host}/`, { signal: controller.signal, redirect: "follow" });
+    } catch {
+      continue;
+    } finally {
+      clearTimeout(timer);
+    }
+    const headerBlob = [...res.headers].map(([key, value]) => `${key}: ${value}`).join("\n");
+    let body = "";
+    try {
+      body = (await res.text()).slice(0, 4096);
+    } catch {
+    }
+    return matchLiveStack(`${headerBlob}
+${body}`.toLowerCase());
+  }
+  return null;
+}
+
 // src/commands/pentest.ts
+var DEFAULT_SOURCE_BUDGET = 4e4;
+function reportPackResult(result, budget) {
+  const size = `${result.bytes.toLocaleString()} bytes`;
+  if (result.premade) {
+    console.error(`Graybox: using pre-made source bundle (${size}).`);
+  } else {
+    for (const line of result.stderr.split("\n")) {
+      const trimmed = line.trim();
+      if (trimmed.startsWith("ctxpack: mode=")) {
+        console.error(`Graybox: ${trimmed.slice("ctxpack: ".length)} [${size}]`);
+      }
+    }
+  }
+  if (result.bytes > SOURCE_BYTES_WARN) {
+    printWarning(
+      `Source bundle is ${size} \u2014 that's a lot of prompt context. It will still be delivered (the server ships oversize source out-of-band), but large bundles raise per-scan cost and can dilute the agent's focus. Lower --budget (currently ${budget}) or trim --source to tighten it.`
+    );
+  }
+}
+function ensurePasteBundle(result) {
+  if (result.premade || result.mode === "paste") return;
+  if (result.mode === "retrieve") {
+    printWarning(
+      "ctxpack fell back to retrieve mode: the source is too large to paste within --budget, so the bundle is a path outline with no code \u2014 useless as graybox context."
+    );
+    console.error(
+      "Not sending it. Raise --budget to re-pack the source as a full paste bundle, or trim --source to the exploit-relevant files (or run a normal black-box scan without --source)."
+    );
+    process.exit(1);
+  }
+}
+function isUserDataTooLarge(err) {
+  return err.status === 413 || /user-?data too large/i.test(err.detail);
+}
 function registerPentestCommand(program3) {
-  const pentest = program3.command("pentest").description("Run and manage pentests").option("-t, --target <domain>", "Target domain to pentest").option("--profile <id>", "Pentest profile ID (alternative to --target)").option("--mode <mode>", "Pentest mode: full, quick, htb, or defcon", "full").option("--flag <prefix>", "CTF flag prefix (defcon mode only, default HTB)").option("--context <text>", "CTF focus hint (defcon mode only)").option("-y, --yes", "Accept authorization terms without prompting").option("--no-watch", "Skip auto-watch after starting the pentest").option("--deployment <type>", "Deployment type: cloud or on-prem", "cloud").option("--include <hosts>", "Include only these subdomains (comma-separated)").option("--exclude <hosts>", "Exclude these subdomains (comma-separated)").option("--scope <action>", "Scope action: clear").addHelpText("after", `
+  const pentest = program3.command("pentest").description("Run and manage pentests").option("-t, --target <domain>", "Target domain to pentest").option("--profile <id>", "Pentest profile ID (alternative to --target)").option("--mode <mode>", "Pentest mode: full, quick, htb, defcon, or exploit-only", "full").option("--flag <prefix>", "CTF flag prefix (defcon mode only, default HTB)").option("--context <text>", "CTF focus hint (defcon mode only)").option("-y, --yes", "Accept authorization terms without prompting").option("--no-watch", "Skip auto-watch after starting the pentest").option("--deployment <type>", "Deployment type: cloud or on-prem", "cloud").option("--include <hosts>", "Include only these subdomains (comma-separated)").option("--exclude <hosts>", "Exclude these subdomains (comma-separated)").option("--scope <action>", "Scope action: clear").option("--source <path>", "Graybox source handout: a directory, an archive (.zip/.tar/.tgz), or a pre-made bundle .txt. Its presence enables graybox").option("--budget <tokens>", "Token budget for packing --source (how much source to pack; larger = more context and cost)", String(DEFAULT_SOURCE_BUDGET)).option("--zip-password <pw>", "Password for an encrypted --source .zip (classic ZipCrypto only; HTB handouts use: hackthebox)").option("--force", "Proceed even when the --source stack looks unlike the live target").addHelpText("after", `
 Examples:
   $ kinosec pentest -t delikado.org
   $ kinosec pentest --profile abc123
   $ kinosec pentest -t internal.corp --deployment on-prem
   $ kinosec pentest -t example.com --include api.example.com,app.example.com
   $ kinosec pentest -t example.com --exclude staging.example.com
-  $ kinosec pentest -t example.com --scope clear`).action(async (options) => {
+  $ kinosec pentest -t example.com --scope clear
+  $ kinosec pentest -t juice.example.com --mode exploit-only
+  $ kinosec pentest -t target.htb --mode htb --source ./challenge.zip --zip-password hackthebox
+
+Graybox (--source):
+  Packs the target's source and sends it with the pentest as extra context.
+  Works with --mode full and quick on your own assets. --budget controls how much
+  source is packed (bigger bundles add context and cost).
+  The source is sent over HTTPS, used only while the pentest runs, and is NOT stored.`).action(async (options) => {
     if (!options.target && !options.profile) {
       console.error("Provide --target <domain> or --profile <id>.");
       process.exit(2);
@@ -12583,6 +12887,16 @@ Examples:
       process.exit(2);
     }
     validateScanMode(options.mode);
+    let sourceBudget = DEFAULT_SOURCE_BUDGET;
+    if (options.source) {
+      sourceBudget = parseInt(options.budget, 10);
+      if (!Number.isInteger(sourceBudget) || sourceBudget <= 0) {
+        console.error("Invalid --budget. Must be a positive integer (tokens).");
+        process.exit(2);
+      }
+    } else if (options.zipPassword || options.force) {
+      console.error("Warning: --zip-password/--force apply only with --source; ignoring.");
+    }
     const scopeClear = options.scope === "clear";
     if (options.scope && options.scope !== "clear") {
       console.error("Invalid --scope value. Must be: clear");
@@ -12601,6 +12915,15 @@ Examples:
       const opts = program3.opts();
       const { token, apiUrl } = resolveToken(opts);
       const client = new KinoSecClient({ apiUrl, token });
+      let packResult = null;
+      if (options.source) {
+        packResult = await packSource(options.source, {
+          budget: sourceBudget,
+          zipPassword: options.zipPassword
+        });
+        reportPackResult(packResult, sourceBudget);
+        ensurePasteBundle(packResult);
+      }
       let targetDisplay;
       let params;
       if (options.profile) {
@@ -12684,8 +13007,47 @@ Examples:
         }
         displayScope(asset);
       }
+      if (packResult?.stack && !options.force) {
+        const liveStack = await probeLiveStack(targetDisplay);
+        if (liveStack && stacksConflict(packResult.stack, liveStack)) {
+          printWarning(
+            `Source handout looks like "${packResult.stack}", but ${targetDisplay} responds like "${liveStack}".`
+          );
+          printWarning("The source may belong to a different app; graybox context could mislead the pentest.");
+          if (options.yes) {
+            console.error("Proceeding anyway (--yes).");
+          } else {
+            console.error("Aborting. Re-run with --force to override, or fix --source.");
+            process.exit(2);
+          }
+        }
+      }
       await confirmAuthorization(targetDisplay, Boolean(options.yes));
-      const result = await client.scans.create(params);
+      if (packResult) {
+        params.source_context = packResult.bundleText;
+      }
+      let result;
+      try {
+        result = await client.scans.create(params);
+      } catch (err) {
+        if (err instanceof ApiError) {
+          if (packResult && isUserDataTooLarge(err)) {
+            printWarning(`Server rejected the scan: ${err.detail}`);
+            console.error(
+              `The graybox source made the provisioning payload too large. Re-pack with a smaller --budget (currently ${sourceBudget}) or trim --source, then retry.`
+            );
+            process.exit(1);
+          }
+          if (err.status === 403 && (options.mode === "htb" || options.mode === "defcon")) {
+            printWarning(`The "${options.mode}" scan mode requires admin access (server returned 403).`);
+            console.error(
+              "Run with --mode full or --mode quick (which support --source for your own assets), or ask your KinoSec admin to enable CTF modes for your account."
+            );
+            process.exit(77);
+          }
+        }
+        throw err;
+      }
       const isOnPrem = result.deployment_type === "on_prem";
       if (opts.json || opts.output === "json") {
         printJson(result);
@@ -13185,10 +13547,9 @@ Examples:
 // src/commands/asset.ts
 function registerAssetCommand(program3) {
   const asset = program3.command("asset").description("Manage assets");
-  asset.command("list").description("List assets").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").option("--search <term>", "Filter by asset value (substring match)").option("--status <status>", "Filter by status (verified, unverified)").option("--type <type>", "Filter by type (domain, subdomain, ip)").addHelpText("after", `
+  asset.command("list").description("List assets").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").option("--status <status>", "Filter by status (verified, unverified)").option("--type <type>", "Filter by type (domain, subdomain, ip)").addHelpText("after", `
 Examples:
   $ kinosec asset list
-  $ kinosec asset list --search example.com
   $ kinosec asset list --type subdomain --status verified
   $ kinosec asset list --limit 50 --json`).action(async (options) => {
     try {
@@ -13198,7 +13559,6 @@ Examples:
       const result = await client.assets.list({
         limit: parseInt(options.limit, 10),
         cursor: options.cursor,
-        search: options.search,
         status: options.status,
         type: options.type
       });
@@ -13433,7 +13793,7 @@ function registerFindingCommand(program3) {
   const finding = program3.command("finding").description("Manage findings");
   finding.command("list").description("List findings").argument("[profile-id]", "Pentest profile ID").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").addHelpText("after", `
 Examples:
-  $ kinosec finding list abc123
+  $ kinosec finding list a1b2c3d4-0000-0000-0000-000000000001
   $ kinosec finding list --limit 50 --json`).action(async (profileId, options) => {
     try {
       const opts = program3.opts();
@@ -13442,7 +13802,7 @@ Examples:
       const result = await client.findings.list({
         limit: parseInt(options.limit, 10),
         cursor: options.cursor,
-        scan: profileId
+        scan_profile_id: profileId
       });
       if (opts.json || opts.output === "json") {
         printJson(result);
@@ -13699,6 +14059,7 @@ Examples:
 
 // src/commands/token.ts
 var import_picocolors13 = __toESM(require_picocolors(), 1);
+var WEB_APP_TOKENS_URL = "https://kinosec.ai/settings?tab=api-tokens";
 function registerTokenCommand(program3) {
   const token = program3.command("token").description("Manage API tokens");
   token.command("list").description("List API tokens").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").addHelpText("after", `
@@ -13744,8 +14105,8 @@ More results available. Use --cursor ${result.next_cursor}`));
 Examples:
   $ kinosec token create --name "CI" --scopes assets:read,scans:create
   $ kinosec token create --name "Full" --scopes assets:read,scans:read --expires 30`).action(async (options) => {
+    const opts = program3.opts();
     try {
-      const opts = program3.opts();
       const { token: authToken, apiUrl } = resolveToken(opts);
       const client = new KinoSecClient({ apiUrl, token: authToken });
       const scopes = options.scopes.split(",").map((s) => s.trim());
@@ -13767,6 +14128,13 @@ Examples:
       console.log(`  Scopes: ${result.scopes.join(", ")}`);
       console.log(`  Expires: ${new Date(result.expires_at).toLocaleDateString()}`);
     } catch (error2) {
+      const isJson = opts.json || opts.output === "json";
+      if (error2 instanceof ApiError && error2.code === "pat_cannot_create_token" && !isJson) {
+        printWarning("API tokens can't create other API tokens.");
+        console.error("Create a new token in the KinoSec web app:");
+        console.error(`  ${WEB_APP_TOKENS_URL}`);
+        console.error("");
+      }
       handleError(error2);
     }
   });
@@ -13793,7 +14161,7 @@ Examples:
 
 // src/cli.ts
 var program2 = new Command();
-program2.name("kinosec").description("KinoSec CLI \u2014 run pentests from your terminal").version("0.10.3", "-v, --version").option("--token <pat>", "API token (overrides KINOSEC_TOKEN)").option("--output <format>", "Output format: text or json", "text").option("--json", "Shorthand for --output json").option("--no-color", "Disable colors");
+program2.name("kinosec").description("KinoSec CLI \u2014 run pentests from your terminal").version("0.11.2", "-v, --version").option("--token <pat>", "API token (overrides KINOSEC_TOKEN)").option("--output <format>", "Output format: text or json", "text").option("--json", "Shorthand for --output json").option("--no-color", "Disable colors");
 registerAuthCommand(program2);
 registerMeCommand(program2);
 registerCreditsCommand(program2);
@@ -13802,10 +14170,9 @@ registerAssetCommand(program2);
 registerFindingCommand(program2);
 registerReportCommand(program2);
 registerTokenCommand(program2);
-program2.parseAsync(process.argv).then(() => checkForUpdate("0.10.3")).catch(handleError);
+program2.parseAsync(process.argv).then(() => checkForUpdate("0.11.2")).catch(handleError);
 /*! Bundled license information:
 
 ky/distribution/index.js:
   (*! MIT License © Sindre Sorhus *)
 */
-//# sourceMappingURL=cli.js.map