@memrov2/pentcloud-recon 0.1.0 → 0.1.1-dev.0

package/README.md

@@ -1,5 +1,10 @@
 # PentCloud tools
 
+[![Quality](https://github.com/Memrov/PentCloud-tools/actions/workflows/quality.yml/badge.svg)](https://github.com/Memrov/PentCloud-tools/actions/workflows/quality.yml)
+[![codecov](https://codecov.io/gh/Memrov/PentCloud-tools/branch/main/graph/badge.svg)](https://app.codecov.io/gh/Memrov/PentCloud-tools)
+[![npm](https://badgen.net/npm/v/@memrov2/pentcloud-recon)](https://www.npmjs.com/package/@memrov2/pentcloud-recon)
+[![Adapter license: MIT](https://badgen.net/static/adapter%20license/MIT/blue)](LICENSE)
+
 Small, versioned tool runtimes for Cloudflare. The first package, **`@memrov2/pentcloud-recon`**, runs the original httpx, dnsx, Katana and Subfinder binaries together in one lightweight Linux container.
 
 Each tool is callable separately. Cloudflare Workflows can orchestrate the calls, or an agent harness can call the same Durable Object binding. This repository does not deploy or modify the PentCloud application.
@@ -73,7 +78,7 @@ Version `0.1.0` identifies the recon pack and its SDK contract. `tools.lock.json
 
 Pin the npm package and container image digest together. The runner checks the image's release manifest before executing commands and rejects a mismatched running image. Finish active runs before upgrading their SDK/image pair; retain prior images and matching adapters for retries and rollback. Publishing a package does not deploy it to customer accounts or replace a running container.
 
-To prepare a release: update the package/lock versions together, run the tests and Cloudflare smoke check, build the image, inspect `npm pack --dry-run`, and attach the verified npm tarball, image archive and SHA-256 checksums to the release. Authentication belongs in native CLI login or a secret store, never source files. No GitHub Actions are configured.
+To prepare a release: update the package/lock versions together, run the tests and Cloudflare smoke check, build the image, inspect `npm pack --dry-run`, and attach the verified npm tarball, image archive and SHA-256 checksums to the release. Authentication belongs in native CLI login or a secret store, never source files. GitHub Actions runs synthetic quality checks only; publishing uses the maintainer’s local npm authentication. No scanners or assessments run in Actions.
 
 ## Limits and safety
 
@@ -94,3 +99,15 @@ The runtime supports Linux/amd64 on Cloudflare Containers. It does not make thes
 - [Third-party notices](THIRD_PARTY_NOTICES.md)
 
 MIT license for the PentCloud adapter. Included executables and base-image packages retain their upstream licenses.
+
+## Tool-pack inventory and quality
+
+See [tool packs and agent capabilities](docs/tool-packs.md) for the current Kali interface inventory, the needs of each agent, and the proposed next bundles. Candidate tools are clearly separated from released support.
+
+Run `npm run coverage` after the development setup in [testing and coverage](docs/testing.md). Reports use standard Node LCOV, Go coverprofile and Python Cobertura formats. The public Quality workflow runs these synthetic tests and uploads explicit coverage reports to Codecov. Cloud account, npm publishing and target credentials are not available to the workflow.
+
+The [release table](docs/releases.md) lists the npm SDKs and their image-distribution requirements. [HTTP, Nuclei and SQLmap](docs/bundles.md) and [the other tool families](docs/remaining-bundles.md) each have their own pinned image and bounded interface. Browser automation stays with managed Browser Run. These profiles do not replace every Kali operation.
+
+## Named instance presets (development)
+
+The next SDK version uses Cloudflare's named Container presets. Most bounded packs start on `lite`; recon, password and Metasploit use `standard-1`. `ready()` verifies and prepares a runtime without executing a scanner. Actual tool execution still waits for readiness and verifies the image manifest. SDK-only lifecycle/sizing updates can retain the same tool lock and image when their executable payload and image manifest are unchanged. Released SDK versions remain immutable.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@memrov2/pentcloud-recon",
-  "version": "0.1.0",
+  "version": "0.1.1-dev.0",
   "description": "A small Cloudflare-native runtime for httpx, dnsx, Katana and Subfinder",
   "type": "module",
   "license": "MIT",
@@ -31,7 +31,11 @@
     "image:build": "node scripts/build-image.mjs",
     "prepublishOnly": "npm test && npm run test:runner && npm run test:image && npm run typecheck",
     "typecheck": "wrangler types --config examples/cloudflare/wrangler.jsonc .cache/worker-types.d.ts && tsc --noEmit --strict --skipLibCheck --module nodenext --moduleResolution nodenext --target es2022 .cache/worker-types.d.ts test/types.ts",
-    "test:image": "python3 -m unittest discover -s test -p \"*_test.py\""
+    "test:image": "python3 -m unittest discover -s test -p \"*_test.py\"",
+    "coverage": "node scripts/coverage.mjs",
+    "test:bundles": "node --test test/packs.test.mjs test/pack-runtime.test.mjs",
+    "image:pack": "python3 scripts/prepare-pack.py",
+    "image:pack:build": "node scripts/build-pack.mjs"
   },
   "engines": {
     "node": ">=22"
@@ -42,5 +46,8 @@
   "devDependencies": {
     "typescript": "5.9.3",
     "wrangler": "4.157.0"
-  }
+  },
+  "workspaces": [
+    "packages/*"
+  ]
 }

package/src/worker.d.mts

@@ -1,6 +1,8 @@
 import { DurableObject } from "cloudflare:workers";
 import type { ReconRequest, ReconResult } from "./index.mjs";
 export declare class ReconRunner extends DurableObject {
+  ready(): Promise<{ image: string; instance: "standard-1"; readyMs: number }>;
   run(request: ReconRequest): Promise<ReconResult & { readyMs: number }>;
+  retire(): Promise<{ stopped: boolean; retired: true }>;
   stop(): Promise<{ stopped: boolean }>;
 }

package/src/worker.mjs

@@ -28,6 +28,7 @@ export class ReconRunner extends DurableObject {
     return result;
   }
   async #ready() {
+      if (await this.ctx.storage.get("retired")) throw new Error("Owned tool runtime is retired");
     const container = this.ctx.container,
       image = container.images.recon,
       start = Date.now();
@@ -41,7 +42,7 @@ export class ReconRunner extends DurableObject {
     } else
       container.start({
         image,
-        instance: { vcpu: 1, memoryMib: 512, diskMb: 2000 },
+        instance: "standard-1",
         enableInternet: true,
         labels: { pack: "recon", version: packVersion },
       });
@@ -90,7 +91,10 @@ export class ReconRunner extends DurableObject {
     const info = await container.inspect();
     if (info?.image !== image)
       throw new Error("Unable to verify recon image identity");
-    return { image, readyMs: Date.now() - start };
+    return { image, instance: "standard-1", readyMs: Date.now() - start };
+  }
+  ready() {
+    return this.#serialize(() => this.#ready());
   }
   run(input) {
     const command = buildCommand(input);
@@ -129,6 +133,13 @@ export class ReconRunner extends DurableObject {
       };
     });
   }
+  retire() {
+    return this.#serialize(async () => {
+      await this.ctx.storage.put("retired", true);
+      if (this.ctx.container.running) await this.ctx.container.destroy();
+      return { stopped: !this.ctx.container.running, retired: true };
+    });
+  }
   stop() {
     return this.#serialize(async () => {
       if (this.ctx.container.running) await this.ctx.container.destroy();