@naraya/cli 0.1.0 → 0.4.0

package/dist/pentest/types.js

@@ -0,0 +1,90 @@
+/**
+ * Pentest Types - Full integration from pentest-core
+ */
+// ── Mode Presets ──
+export const MODE_PRESETS = {
+    "auto": {
+        mode: "auto",
+        description: "Auto-detect mode based on target type. Smart tool priority and adaptive strategy.",
+        scope_enforcement: "moderate",
+        tool_priority: ["recon", "enumeration", "exploitation", "reporting", "utility"],
+        skill_chain: ["pentest-recon", "pentest-enum", "pentest-exploit", "pentest-report"],
+        parallelism: 4,
+        stealth: false,
+        report_format: "standard",
+        loop_config: { max_iterations: 100, iteration_timeout_ms: 300000, strategy: "adaptive", auto_continue: true, speed: "moderate" },
+        safety_constraints: { scope_strict: true, no_dos: true, no_exfiltration: true, stealth_mode: false, auto_stop_on_scope_violation: true }
+    },
+    "ctf": {
+        mode: "ctf",
+        description: "CTF challenge mode. Speed-first, parallel everything, flag-focused reporting.",
+        scope_enforcement: "none",
+        tool_priority: ["exploitation", "enumeration", "recon", "utility"],
+        skill_chain: ["ctf-recon", "ctf-exploit", "ctf-crypto", "ctf-forensics"],
+        parallelism: 8,
+        stealth: false,
+        report_format: "flag",
+        loop_config: { max_iterations: 200, iteration_timeout_ms: 120000, strategy: "adaptive", auto_continue: true, speed: "fast" },
+        safety_constraints: { scope_strict: false, no_dos: false, no_exfiltration: false, stealth_mode: false, auto_stop_on_scope_violation: false }
+    },
+    "bug-bounty": {
+        mode: "bug-bounty",
+        description: "Bug bounty mode. Scope-strict, web-focused, HackerOne/Bugcrowd report format.",
+        scope_enforcement: "strict",
+        tool_priority: ["recon", "enumeration", "exploitation", "reporting"],
+        skill_chain: ["pentest-recon", "pentest-enum", "pentest-exploit", "pentest-report"],
+        parallelism: 6,
+        stealth: false,
+        report_format: "hackerone",
+        loop_config: { max_iterations: 150, iteration_timeout_ms: 300000, strategy: "continue", auto_continue: true, speed: "moderate" },
+        safety_constraints: { scope_strict: true, no_dos: true, no_exfiltration: true, stealth_mode: false, auto_stop_on_scope_violation: true }
+    },
+    "red-team": {
+        mode: "red-team",
+        description: "Red team mode. Stealth-first, persistence, lateral movement, executive reporting.",
+        scope_enforcement: "strict",
+        tool_priority: ["recon", "exploitation", "enumeration", "reporting"],
+        skill_chain: ["red-recon", "red-exploit", "red-lateral", "red-persistence"],
+        parallelism: 2,
+        stealth: true,
+        report_format: "executive",
+        loop_config: { max_iterations: 50, iteration_timeout_ms: 600000, strategy: "continue", auto_continue: true, speed: "slow" },
+        safety_constraints: { scope_strict: true, no_dos: true, no_exfiltration: true, stealth_mode: true, auto_stop_on_scope_violation: true }
+    },
+    "blue-team": {
+        mode: "blue-team",
+        description: "Blue team mode. Detection-first, log analysis, incident response, IR reporting.",
+        scope_enforcement: "strict",
+        tool_priority: ["enumeration", "recon", "reporting", "utility"],
+        skill_chain: ["blue-detect", "blue-ir", "blue-forensics", "blue-report"],
+        parallelism: 4,
+        stealth: false,
+        report_format: "ir",
+        loop_config: { max_iterations: 100, iteration_timeout_ms: 300000, strategy: "continue", auto_continue: true, speed: "moderate" },
+        safety_constraints: { scope_strict: true, no_dos: true, no_exfiltration: true, stealth_mode: false, auto_stop_on_scope_violation: true }
+    },
+    "offensive": {
+        mode: "offensive",
+        description: "Offensive mode. Aggressive exploitation, privilege escalation, technical reporting.",
+        scope_enforcement: "strict",
+        tool_priority: ["exploitation", "enumeration", "recon", "reporting"],
+        skill_chain: ["pentest-recon", "pentest-enum", "pentest-exploit", "pentest-privesc"],
+        parallelism: 6,
+        stealth: false,
+        report_format: "technical",
+        loop_config: { max_iterations: 100, iteration_timeout_ms: 300000, strategy: "continue", auto_continue: true, speed: "moderate" },
+        safety_constraints: { scope_strict: true, no_dos: true, no_exfiltration: true, stealth_mode: false, auto_stop_on_scope_violation: true }
+    },
+    "grey-hat": {
+        mode: "grey-hat",
+        description: "Grey hat mode. Balanced offensive/defensive, moderate stealth, hybrid reporting.",
+        scope_enforcement: "moderate",
+        tool_priority: ["recon", "enumeration", "exploitation", "reporting", "utility"],
+        skill_chain: ["pentest-recon", "pentest-enum", "pentest-exploit", "pentest-report"],
+        parallelism: 4,
+        stealth: true,
+        report_format: "technical",
+        loop_config: { max_iterations: 100, iteration_timeout_ms: 300000, strategy: "adaptive", auto_continue: true, speed: "moderate" },
+        safety_constraints: { scope_strict: true, no_dos: true, no_exfiltration: true, stealth_mode: true, auto_stop_on_scope_violation: true }
+    }
+};

package/package.json

@@ -1,14 +1,42 @@
-{
-  "name": "@naraya/cli",
-  "version": "0.1.0",
-  "description": "Naraya AI coding agent - one sign-in, all models via router.naraya.ai",
-  "type": "module",
-  "bin": { "naraya": "bin/naraya.mjs" },
-  "files": ["bin/", "src/", "assets/"],
-  "engines": { "node": ">=22.19.0" },
-  "scripts": { "test": "node --test" },
-  "dependencies": {
-    "@earendil-works/pi-coding-agent": "0.79.1"
-  },
-  "license": "MIT"
-}
+{
+  "name": "@naraya/cli",
+  "version": "0.4.0",
+  "description": "Naraya AI coding agent - one sign-in, all models via router.naraya.ai",
+  "type": "module",
+  "bin": {
+    "naraya": "bin/naraya.mjs"
+  },
+  "files": [
+    "bin/",
+    "src/",
+    "dist/"
+  ],
+  "engines": {
+    "node": ">=22.19.0"
+  },
+  "scripts": {
+    "test": "node --test",
+    "build:assets": "node scripts/build-assets.mjs",
+    "minify": "node scripts/minify.mjs",
+    "restore": "node scripts/restore-src.mjs",
+    "prepack": "node scripts/build-assets.mjs && node scripts/minify.mjs",
+    "postpack": "node scripts/restore-src.mjs"
+  },
+  "dependencies": {
+    "@ast-grep/napi": "^0.43.0",
+    "@earendil-works/pi-coding-agent": "0.79.1",
+    "@earendil-works/pi-tui": "0.79.1",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "commander": "^12.1.0",
+    "puppeteer-core": "^25.1.0",
+    "ssh2": "^1.17.0",
+    "typescript": "^6.0.3",
+    "typescript-language-server": "^5.3.0",
+    "undici": "^7.28.0"
+  },
+  "license": "UNLICENSED",
+  "devDependencies": {
+    "@types/node": "^26.0.0",
+    "esbuild": "^0.28.1"
+  }
+}

package/src/assets-pack.mjs

@@ -0,0 +1 @@
+import f from"node:fs";import i from"node:zlib";function m(r){const t=i.gunzipSync(f.readFileSync(r)),e=JSON.parse(t.toString("utf8"));return Object.entries(e).map(([o,n])=>({rel:o,buf:Buffer.from(n,"base64")}))}export{m as readPack};

package/src/banner.mjs

@@ -0,0 +1,5 @@
+import x from"node:fs";import I from"node:os";import l from"node:path";import{fileURLToPath as S}from"node:url";const c="\x1B[38;2;45;123;255m",R="\x1B[48;2;45;123;255m",L="\x1B[38;2;10;29;77m",E="\x1B[48;2;10;29;77m",w="\x1B[38;2;51;102;204m",u="\x1B[1m",h="\x1B[2m",r="\x1B[0m",v=40,O=48,k=/\x1b\[[0-9;]*m/g,D=t=>t.replace(k,""),i=t=>D(t).length,U=(t,o,n)=>Math.max(o,Math.min(n,t)),b=(()=>{try{const t=l.dirname(l.dirname(S(import.meta.url)));return JSON.parse(x.readFileSync(l.join(t,"package.json"),"utf8")).version??""}catch{return process.env.NARAYA_VERSION??""}})(),$=["_____________BB___","___BBB_______BBB__","_BBBBBB______BBBBB","_BBBBBBBB____BBBBB","B_BBBBBBBB___BBBBB","BB_BBBBBBBB__BBBNN","BBB_BBBBBBB__BBNNN","BBBB__BBB____BNNNN","BBBBBB_____BBBNNNN","BBBBBB___BBBBBNNNN","BBBBB___BBBBBBNNNN","BBBBB___BBBBBBNNNN","BBBBB____BBBBBNNNN","BBBBB______BBBNNN_","BBBBB_______BBNN__","_BBBB________B____","__BBB_____________","____B_____________"],m=t=>t==="B"?c:t==="N"?L:"",j=t=>t==="B"?R:t==="N"?E:"";function G(){const t=[];for(let o=0;o<$.length;o+=2){let n="";for(let B=0;B<$[o].length;B++){const _=$[o][B],e=$[o+1]?.[B]??"_";_==="_"&&e==="_"?n+=" ":_!=="_"&&e==="_"?n+=`${m(_)}\u2580${r}`:_==="_"&&e!=="_"?n+=`${m(e)}\u2584${r}`:_===e?n+=`${m(_)}\u2588${r}`:n+=`${m(_)}${j(e)}\u2580${r}`}t.push(n)}return t}const A={N:["\u2588\u2588\u2588\u2557   \u2588\u2588\u2557","\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551","\u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2551","\u2588\u2588\u2551\u255A\u2588\u2588\u2557\u2588\u2588\u2551","\u2588\u2588\u2551 \u255A\u2588\u2588\u2588\u2588\u2551","\u255A\u2550\u255D  \u255A\u2550\u2550\u2550\u255D"],A:[" \u2588\u2588\u2588\u2588\u2588\u2557 ","\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557","\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551","\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2551","\u2588\u2588\u2551  \u2588\u2588\u2551","\u255A\u2550\u255D  \u255A\u2550\u255D"],R:["\u2588\u2588\u2588\u2588\u2588\u2588\u2557 ","\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557","\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D","\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557","\u2588\u2588\u2551  \u2588\u2588\u2551","\u255A\u2550\u255D  \u255A\u2550\u255D"],C:[" \u2588\u2588\u2588\u2588\u2588\u2588\u2557","\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D","\u2588\u2588\u2551     ","\u2588\u2588\u2551     ","\u255A\u2588\u2588\u2588\u2588\u2588\u2588\u2557"," \u255A\u2550\u2550\u2550\u2550\u2550\u255D"],L:["\u2588\u2588\u2557     ","\u2588\u2588\u2551     ","\u2588\u2588\u2551     ","\u2588\u2588\u2551     ","\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557","\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D"],I:["\u2588\u2588\u2557","\u2588\u2588\u2551","\u2588\u2588\u2551","\u2588\u2588\u2551","\u2588\u2588\u2551","\u255A\u2550\u255D"]},P="NARA",T="CLI";function Y(){const t=[];for(let o=0;o<6;o++){let n=`${u}${c}`;for(const B of P)n+=A[B][o];n+=`${r}${u}${w}`;for(const B of T)n+=A[B][o];t.push(n+r)}return t}function q(t,o,n=3){const B=Math.max(...t.map(i),0),_=Math.max(t.length,o.length),e=Math.floor((_-t.length)/2),a=Math.floor((_-o.length)/2),s=" ".repeat(n);return Array.from({length:_},(f,g)=>`${N(t[g-e]??"",B)}${s}${o[g-a]??""}`)}function C(t,o){if(i(t)<=o)return t;const n=Math.max(0,o-1);let B="",_=0;for(let e=0;e<t.length&&_<n;){if(t[e]==="\x1B"){const a=t.slice(e).match(/^\x1b\[[0-9;]*m/);if(a){B+=a[0],e+=a[0].length;continue}}B+=t[e],e+=1,_+=1}return`${B}\u2026${r}`}const N=(t,o)=>{const n=C(t,o);return n+" ".repeat(Math.max(0,o-i(n)))};function d(t,o,n){const B=i(o),_=B>0?2:0;return`${N(t,Math.max(0,n-B-_))}${" ".repeat(_)}${o}`}function p(t,o,n,B){return d(`${c}${N(t,7)}${r}${o}`,n?`${h}${n}${r}`:"",B)}const y=t=>t>=1e6?`${(t/1e6).toFixed(1).replace(/\.0$/,"")}M`:Number(t).toLocaleString("id-ID");function F(t,o){const n=o-4,B=` ${u}NARAYA${r}${b?`${c} v${b}${r}${c}`:""}${c} `,_=`${c}\u256D\u2500${B}${"\u2500".repeat(Math.max(0,o-i(B)-3))}\u256E${r}`,e=`${c}\u2570${"\u2500".repeat(Math.max(0,o-2))}\u256F${r}`,a=f=>`${c}\u2502${r} ${N(f,n)} ${c}\u2502${r}`,s=[_];return t?(s.push(a(d(`${u}${t.email||"Naraya User"}${r}`,`${h}${t.plan||"Plan"}${r}`,n))),s.push(a(p("Saldo",t.saldoIdr,t.saldoUsd,n))),s.push(a(p("Kuota",t.kuotaMain,t.kuotaSide,n)))):(s.push(a(d(`${u}Not connected${r}`,`${h}Guest${r}`,n))),s.push(a(p("Login","naraya login","",n))),s.push(a(p("Router","router.naraya.ai","",n)))),s.push(e),s}function M(t,o){const n=Math.max(...t.map(i),0),B=" ".repeat(Math.max(0,Math.floor((o-n)/2)));return t.map(_=>B+_)}function J(){return process.env.PI_CODING_AGENT_DIR??l.join(I.homedir(),".naraya","agent")}async function V(){let t;try{if(t=JSON.parse(x.readFileSync(l.join(J(),"models.json"),"utf8")).providers?.naraya,!t?.baseUrl||!t?.apiKey)return null}catch{return null}try{const o=await fetch(`${t.baseUrl}/me`,{headers:{authorization:`Bearer ${t.apiKey}`},signal:AbortSignal.timeout(3e3)});if(!o.ok)return null;const n=await o.json(),B=Number(n.credit?.available??0),_=Number(n.quota?.limit??0),e=Number(n.quota?.remaining??0);return{email:n.account?.email??"",plan:n.account?.plan??"",saldoIdr:`Rp ${B.toLocaleString("id-ID",{maximumFractionDigits:0})}`,saldoUsd:n.credit?.usd_equivalent?`$${n.credit.usd_equivalent}`:"",kuotaMain:_>0?`${y(e)} / ${y(_)}`:"fair-use",kuotaSide:`${Array.isArray(n.models)?n.models.length:0} model`}}catch{return null}}async function H(){try{if(!process.stdout.isTTY)return;const t=Number(process.stdout.columns)>0?process.stdout.columns:90,o=await V(),n=q(G(),Y(),3),B=F(o,U(t-4,v,O)),_=[...M(n,t),"",...M(B,t)];process.stdout.write(`\x1B[2J\x1B[3J\x1B[H
+`+_.join(`
+`)+`
+
+`)}catch{}}export{H as printBanner};

package/src/clipboard.mjs

@@ -0,0 +1 @@
+import c from"node:os";import m from"node:path";import n from"node:fs";import p from"node:crypto";import{spawnSync as l}from"node:child_process";function i(t,o,e={}){try{const r=l(t,o,{timeout:5e3,maxBuffer:67108864,...e});return{ok:r.status===0&&!r.error,stdout:r.stdout??Buffer.alloc(0)}}catch{return{ok:!1,stdout:Buffer.alloc(0)}}}function a(){return m.join(c.tmpdir(),`naraya-clipboard-${p.randomUUID()}.png`)}function f(){const t=a(),e=["Add-Type -AssemblyName System.Windows.Forms","Add-Type -AssemblyName System.Drawing","$img = [System.Windows.Forms.Clipboard]::GetImage()",`if ($img) { $img.Save('${t.replace(/'/g,"''")}', [System.Drawing.Imaging.ImageFormat]::Png); Write-Output 'ok' } else { Write-Output 'empty' }`].join("; "),r=i("powershell.exe",["-NoProfile","-NonInteractive","-Command",e]);if(!r.ok||r.stdout.toString("utf8").trim()!=="ok"){try{n.rmSync(t,{force:!0})}catch{}return null}try{if(n.statSync(t).size===0)return n.rmSync(t,{force:!0}),null}catch{return null}return{path:t,mimeType:"image/png"}}function d(){const t=i("xclip",["-selection","clipboard","-t","TARGETS","-o"]),e=(t.ok?t.stdout.toString("utf8").split(/\r?\n/).map(s=>s.trim()):[]).find(s=>/^image\//.test(s))??"image/png",r=i("xclip",["-selection","clipboard","-t",e,"-o"]);if(!r.ok||r.stdout.length===0)return null;const u=a();try{n.writeFileSync(u,r.stdout)}catch{return null}return{path:u,mimeType:e.split(";")[0]}}function y(){const t=a(),o=i("pngpaste",[t]);try{if(!o.ok||n.statSync(t).size===0)return n.rmSync(t,{force:!0}),null}catch{return null}return{path:t,mimeType:"image/png"}}function b(){try{if(process.platform==="win32")return f();if(process.platform==="darwin")return y();if(process.platform==="linux")return d()}catch{}return null}export{b as readClipboardImage};

package/src/config.mjs

@@ -1,40 +1 @@
-import fs from "node:fs";
-import path from "node:path";
-
-const DEFAULT_BASE = "https://router.naraya.ai";
-
-// Known context-window overrides; default 128k/8k for everything else.
-const CTX = { "claude-sonnet-4.5": 200000, "claude-haiku-4.5": 200000, "qwen3.7-plus-1m": 1000000 };
-
-/**
- * Resolve the single gateway base from (in order): a `--base <url>` flag in
- * argv, the NARAYA_BASE env var, or the production default. Returns the derived
- * SITE (page + /api) and BASE_URL (/v1). The flag avoids cross-shell env-var
- * syntax pain (cmd.exe vs bash vs PowerShell).
- */
-export function resolveBase(argv = []) {
-  const i = argv.indexOf("--base");
-  const override = i >= 0 && argv[i + 1] ? argv[i + 1] : process.env.NARAYA_BASE;
-  const base = (override ?? DEFAULT_BASE).replace(/\/+$/, "");
-  return { SITE: base, BASE_URL: `${base}/v1` };
-}
-
-// Back-compat constants resolved from the default/env base (no flag).
-export const { SITE, BASE_URL } = resolveBase();
-
-/** Write models.json for the naraya provider. 0600 — contains the API key. */
-export function writeModelsConfig(agentDir, apiKey, modelIds, baseUrl = BASE_URL) {
-  fs.mkdirSync(agentDir, { recursive: true });
-  const config = {
-    providers: {
-      naraya: {
-        name: "Naraya",
-        baseUrl,
-        api: "openai-completions",
-        apiKey,
-        models: modelIds.map((id) => ({ id, name: id, contextWindow: CTX[id] ?? 128000, maxTokens: 8192, input: ["text"] })),
-      },
-    },
-  };
-  fs.writeFileSync(path.join(agentDir, "models.json"), JSON.stringify(config, null, 2), { mode: 0o600 });
-}
+import s from"node:fs";import c from"node:path";const y="https://router.naraya.ai",m=128e3,S=32e3;function A(t){try{const e=Number(JSON.parse(s.readFileSync(c.join(t,"max-output.json"),"utf8")));return Number.isFinite(e)&&e>0?Math.floor(e):null}catch{return null}}function f(t,e){if(e)return e;const o=Number(t.max_output_tokens??t.max_completion_tokens??t.maxOutputTokens);return Number.isFinite(o)&&o>0?o:S}function _(t=[]){const e=t.indexOf("--base"),r=((e>=0&&t[e+1]?t[e+1]:process.env.NARAYA_BASE)??y).replace(/\/+$/,"");return{SITE:r,BASE_URL:`${r}/v1`}}const{SITE:h,BASE_URL:w}=_();function T(t){try{const e=JSON.parse(s.readFileSync(c.join(t,"custom-models.json"),"utf8"));return Array.isArray(e)?e.map(o=>typeof o=="string"?{id:o}:o).filter(o=>o&&o.id):[]}catch{return[]}}function E(t,e,o,r=w){s.mkdirSync(t,{recursive:!0});const u=A(t),a=o.map(n=>{const i=typeof n=="string"?{id:n}:n,p=Number(i.weight),l=p>0?`${i.id} (${p}x)`:i.id;return{id:i.id,name:l,contextWindow:i.context_window??m,maxTokens:f(i,u),input:["text","image"]}}),d=new Set(a.map(n=>n.id));for(const n of T(t))d.has(n.id)||(d.add(n.id),a.push({id:n.id,name:n.name||`${n.id} (custom)`,contextWindow:n.context_window??m,maxTokens:f(n,u),input:n.vision===!1?["text"]:["text","image"]}));const x={providers:{naraya:{name:"Naraya",baseUrl:r,api:"openai-completions",apiKey:e,models:a}}};s.writeFileSync(c.join(t,"models.json"),JSON.stringify(x,null,2),{mode:384})}export{w as BASE_URL,h as SITE,T as readCustomModels,A as readMaxOutputOverride,_ as resolveBase,E as writeModelsConfig};

package/src/goodbye.mjs

@@ -0,0 +1,7 @@
+const c="\x1B[38;2;45;123;255m",m="\x1B[2m",s="\x1B[0m",$=/\x1b\[[0-9;?]*[a-zA-Z]/g,l=t=>t.replace($,"").length,e=["\u2588\u2588\u2588\u2557   \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2557   \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2557 ","\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u255A\u2588\u2588\u2557 \u2588\u2588\u2554\u255D\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557","\u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551 \u255A\u2588\u2588\u2588\u2588\u2554\u255D \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551","\u2588\u2588\u2551\u255A\u2588\u2588\u2557\u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2551  \u255A\u2588\u2588\u2554\u255D  \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2551","\u2588\u2588\u2551 \u255A\u2588\u2588\u2588\u2588\u2551\u2588\u2588\u2551  \u2588\u2588\u2551\u2588\u2588\u2551  \u2588\u2588\u2551\u2588\u2588\u2551  \u2588\u2588\u2551   \u2588\u2588\u2551   \u2588\u2588\u2551  \u2588\u2588\u2551","\u255A\u2550\u255D  \u255A\u2550\u2550\u2550\u255D\u255A\u2550\u255D  \u255A\u2550\u255D\u255A\u2550\u255D  \u255A\u2550\u255D\u255A\u2550\u255D  \u255A\u2550\u255D   \u255A\u2550\u255D   \u255A\u2550\u255D  \u255A\u2550\u255D"],i=Math.max(...e.map(t=>t.length));function u(){if(!process.stdout.isTTY)return;const t=process.stdout.columns||80,o=(n,r)=>" ".repeat(Math.max(0,Math.floor((t-r)/2)))+n,a=t<i+2?[o(`${c}NARAYA${s}`,6)]:e.map(n=>o(`${c}${n}${s}`,n.length)),p=o(`${m}Sampai jumpa \u{1F44B}${s}`,15);process.stdout.write(`
+${a.join(`
+`)}
+
+${p}
+
+`)}export{u as printBye};

package/src/login.mjs

@@ -1,49 +1,7 @@
-import http from "node:http";
-import crypto from "node:crypto";
-import { spawn } from "node:child_process";
-import { writeModelsConfig, BASE_URL as DEFAULT_BASE_URL, SITE as DEFAULT_SITE } from "./config.mjs";
-
-function openBrowser(url) {
-  const cmd = process.platform === "win32" ? ["cmd", ["/c", "start", "", url]]
-    : process.platform === "darwin" ? ["open", [url]] : ["xdg-open", [url]];
-  spawn(cmd[0], cmd[1], { stdio: "ignore", detached: true }).unref();
-}
-
-export async function login(agentDir, { SITE = DEFAULT_SITE, BASE_URL = DEFAULT_BASE_URL } = {}) {
-  const state = crypto.randomBytes(16).toString("hex");
-  const code = await new Promise((resolve, reject) => {
-    const server = http.createServer((req, res) => {
-      const u = new URL(req.url, "http://127.0.0.1");
-      if (u.pathname !== "/callback") { res.writeHead(404).end(); return; }
-      if (u.searchParams.get("state") !== state) {
-        res.writeHead(400).end("State mismatch. Close this tab and retry `naraya login`.");
-        server.close(); reject(new Error("state mismatch")); return;
-      }
-      res.writeHead(200, { "content-type": "text/html" }).end("<h3>Naraya CLI connected. You can close this tab.</h3>");
-      server.close(); resolve(u.searchParams.get("code"));
-    });
-    server.listen(0, "127.0.0.1", () => {
-      const { port } = server.address();
-      const url = `${SITE}/connect/cli?state=${state}&port=${port}`;
-      console.log(`Opening browser to sign in...\n  ${url}`);
-      openBrowser(url);
-    });
-    setTimeout(() => { server.close(); reject(new Error("login timed out (5m)")); }, 300_000).unref();
-  });
-
-  const ex = await fetch(`${SITE}/api/auth/exchange`, {
-    method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ code }),
-  });
-  if (!ex.ok) throw new Error(`exchange failed: HTTP ${ex.status}`);
-  const { api_key } = await ex.json();
-  if (!api_key) throw new Error("exchange response missing api_key");
-
-  const models = await fetch(`${BASE_URL}/models`, { headers: { authorization: `Bearer ${api_key}` } });
-  if (!models.ok) throw new Error(`model list failed: HTTP ${models.status}`);
-  const data = (await models.json()).data;
-  if (!Array.isArray(data)) throw new Error("model list response malformed (no data array)");
-  const ids = data.map((m) => m.id);
-
-  writeModelsConfig(agentDir, api_key, ids, BASE_URL);
-  console.log(`Signed in. ${ids.length} models configured. Run \`naraya\` to start.`);
-}
+import g from"node:http";import u from"node:crypto";import{spawn as p}from"node:child_process";import{writeModelsConfig as y,BASE_URL as $,SITE as E}from"./config.mjs";function S(t){if(process.platform==="win32"){p("powershell",["-NoProfile","-NonInteractive","-Command",`Start-Process '${t}'`],{stdio:"ignore",detached:!0}).unref();return}const o=process.platform==="darwin"?["open",[t]]:["xdg-open",[t]];p(o[0],o[1],{stdio:"ignore",detached:!0}).unref()}async function _(t,{SITE:o=E,BASE_URL:l=$}={}){const m=u.randomBytes(16).toString("hex"),f=await new Promise((w,h)=>{const r=g.createServer((c,e)=>{const d=new URL(c.url,"http://127.0.0.1");if(d.pathname!=="/callback"){e.writeHead(404).end();return}if(d.searchParams.get("state")!==m){e.writeHead(400).end("State mismatch. Close this tab and retry `naraya login`."),r.close(),h(new Error("state mismatch"));return}e.writeHead(200,{"content-type":"text/html"}).end("<h3>Naraya CLI connected. You can close this tab.</h3>"),r.close(),w(d.searchParams.get("code"))});r.listen(0,"127.0.0.1",()=>{const{port:c}=r.address(),e=`${o}/connect/cli?state=${m}&port=${c}`;console.log(`
+Sign in to Naraya.
+Trying to open your browser \u2014 if it doesn't open, copy this link in:
+
+  ${e}
+
+Waiting for you to authorize\u2026`),S(e)}),setTimeout(()=>{r.close(),h(new Error("login timed out (5m)"))},3e5).unref()}),n=await fetch(`${o}/api/auth/exchange`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({code:f})});if(!n.ok)throw new Error(`exchange failed: HTTP ${n.status}`);const{api_key:a}=await n.json();if(!a)throw new Error("exchange response missing api_key");const s=await fetch(`${l}/models`,{headers:{authorization:`Bearer ${a}`}});if(!s.ok)throw new Error(`model list failed: HTTP ${s.status}`);const i=(await s.json()).data;if(!Array.isArray(i))throw new Error("model list response malformed (no data array)");y(t,a,i,l),console.log(`Signed in. ${i.length} models configured. Run \`naraya\` to start.`)}export{_ as login};

package/src/mcp/config-loader.ts

@@ -0,0 +1,50 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+
+export interface McpServerConfig {
+  command?: string;
+  args?: string[];
+  type?: "http" | "streamable-http";
+  url?: string;
+  headers?: Record<string, string>;
+  env?: Record<string, string>;
+  timeout?: number;
+}
+
+export interface McpConfig {
+  mcpServers: Record<string, McpServerConfig>;
+}
+
+export function loadMcpConfig(projectDir: string, globalDir: string): McpConfig {
+  const globalPath = path.join(globalDir, "mcp.json");
+  const projectPath = path.join(projectDir, ".mcp.json");
+
+  let globalConfig: McpConfig = { mcpServers: {} };
+  let projectConfig: McpConfig = { mcpServers: {} };
+
+  try {
+    if (fs.existsSync(globalPath)) {
+      globalConfig = JSON.parse(fs.readFileSync(globalPath, "utf8"));
+    }
+  } catch {
+    // Ignore malformed global config
+  }
+
+  try {
+    if (fs.existsSync(projectPath)) {
+      projectConfig = JSON.parse(fs.readFileSync(projectPath, "utf8"));
+    }
+  } catch {
+    // Ignore malformed project config
+  }
+
+  // Merge: project wins on conflict
+  const merged: McpConfig = {
+    mcpServers: {
+      ...globalConfig.mcpServers,
+      ...projectConfig.mcpServers
+    }
+  };
+
+  return merged;
+}

package/src/mcp/lifecycle.ts

@@ -0,0 +1,113 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import type { McpConfig, McpServerConfig } from "./config-loader.js";
+import { createTransport } from "./transport.js";
+
+interface ServerConnection {
+  client: Client;
+  transport: any;
+  config: McpServerConfig;
+  tools: any[];
+  status: "connecting" | "connected" | "failed" | "disconnected";
+  error?: string;
+}
+
+export class McpManager {
+  private servers: Map<string, ServerConnection> = new Map();
+  private projectDir: string;
+
+  constructor(private config: McpConfig, projectDir: string) {
+    this.projectDir = projectDir;
+  }
+
+  async start(): Promise<void> {
+    const serverEntries = Object.entries(this.config.mcpServers ?? {});
+    
+    for (const [name, serverConfig] of serverEntries) {
+      await this.startServer(name, serverConfig);
+    }
+  }
+
+  private async startServer(name: string, config: McpServerConfig): Promise<void> {
+    try {
+      const transport = await createTransport(config, this.projectDir);
+      const client = new Client(
+        { name: "naraya-cli", version: "0.2.4" },
+        { capabilities: {} }
+      );
+
+      const connection: ServerConnection = {
+        client,
+        transport,
+        config,
+        tools: [],
+        status: "connecting"
+      };
+
+      this.servers.set(name, connection);
+
+      await client.connect(transport);
+      connection.status = "connected";
+
+      // Discover tools
+      const toolsResult = await client.listTools();
+      connection.tools = toolsResult.tools ?? [];
+    } catch (err: any) {
+      const connection = this.servers.get(name);
+      if (connection) {
+        connection.status = "failed";
+        connection.error = err.message;
+      }
+      console.error(`[MCP] Failed to start server '${name}': ${err.message}`);
+    }
+  }
+
+  async stop(): Promise<void> {
+    for (const [name, conn] of this.servers.entries()) {
+      try {
+        if (conn.status === "connected") {
+          await conn.client.close();
+        }
+        conn.status = "disconnected";
+      } catch (err: any) {
+        console.error(`[MCP] Error stopping server '${name}': ${err.message}`);
+      }
+    }
+    this.servers.clear();
+  }
+
+  getServerStatus(): Record<string, { status: string; toolCount: number; error?: string }> {
+    const result: Record<string, any> = {};
+    for (const [name, conn] of this.servers.entries()) {
+      result[name] = {
+        status: conn.status,
+        toolCount: conn.tools.length,
+        error: conn.error
+      };
+    }
+    return result;
+  }
+
+  async callTool(serverName: string, toolName: string, params: any): Promise<any> {
+    const conn = this.servers.get(serverName);
+    if (!conn) {
+      throw new Error(`MCP server '${serverName}' not found`);
+    }
+    if (conn.status !== "connected") {
+      throw new Error(`MCP server '${serverName}' is not connected (status: ${conn.status})`);
+    }
+
+    return await conn.client.callTool({ name: toolName, arguments: params });
+  }
+
+  getTools(): Array<{ serverName: string; tool: any }> {
+    const result: Array<{ serverName: string; tool: any }> = [];
+    for (const [serverName, conn] of this.servers.entries()) {
+      if (conn.status === "connected") {
+        for (const tool of conn.tools) {
+          result.push({ serverName, tool });
+        }
+      }
+    }
+    return result;
+  }
+}

package/src/mcp/tool-mapper.ts

@@ -0,0 +1,42 @@
+export interface PiToolConfig {
+  name: string;
+  label: string;
+  description: string;
+  parameters: any;
+}
+
+export function mapMcpToolToPi(
+  serverName: string,
+  mcpTool: any
+): PiToolConfig {
+  const toolName = `mcp__${serverName}__${mcpTool.name}`;
+  const label = `${serverName}: ${mcpTool.name}`;
+  const description = mcpTool.description ?? `MCP tool: ${mcpTool.name}`;
+
+  return {
+    name: toolName,
+    label,
+    description,
+    parameters: mcpTool.inputSchema ?? { type: "object", properties: {} }
+  };
+}
+
+export function mapMcpResultToPi(result: any): any {
+  const content = result.content ?? [];
+  return {
+    content: content.map((c: any) => {
+      if (c.type === "text") return { type: "text", text: c.text };
+      if (c.type === "image") return { type: "image", data: c.data, mimeType: c.mimeType };
+      return { type: "text", text: JSON.stringify(c) };
+    }),
+    details: {}
+  };
+}
+
+export function mapMcpErrorToPi(err: any): any {
+  return {
+    content: [{ type: "text", text: `MCP error: ${err.message}` }],
+    isError: true,
+    details: {}
+  };
+}

package/src/mcp/transport.ts

@@ -0,0 +1,38 @@
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import type { McpServerConfig } from "./config-loader.js";
+
+export async function createTransport(
+  config: McpServerConfig,
+  projectDir: string
+): Promise<any> {
+  if (config.type === "http" || config.type === "streamable-http") {
+    if (!config.url) {
+      throw new Error("url is required for HTTP transport");
+    }
+    return new StreamableHTTPClientTransport(new URL(config.url), {
+      requestInit: {
+        headers: config.headers
+      }
+    });
+  }
+
+  // Default: stdio
+  if (!config.command) {
+    throw new Error("command is required for stdio transport");
+  }
+
+  const env: Record<string, string> = {
+    ...process.env,
+    ...config.env,
+    NARAYA_PROJECT_DIR: projectDir
+  };
+
+  return new StdioClientTransport({
+    command: config.command,
+    args: config.args ?? [],
+    env,
+    // Suppress MCP server startup logs by discarding stderr
+    stderr: "ignore"
+  });
+}

package/src/mcp-cli.mjs

@@ -0,0 +1,5 @@
+import p from"node:fs";import l from"node:path";import g from"node:os";const f=l.join(g.homedir(),".naraya","agent"),d=l.join(f,"mcp.json");function a(){try{return JSON.parse(p.readFileSync(d,"utf8"))}catch{return{mcpServers:{}}}}function m(e){p.mkdirSync(f,{recursive:!0}),p.writeFileSync(d,JSON.stringify(e,null,2))}function y(){const e=a();e.mcpServers=e.mcpServers||{},e.mcpServers.context7||(e.mcpServers.context7={command:"npx",args:["-y","@upstash/context7-mcp@latest"]}),m(e)}async function x(e){const s=e[3];if(s==="list"||!s){const o=a(),r=Object.keys(o.mcpServers??{});if(r.length===0){console.log("No MCP servers configured.");return}console.log(`
+Configured MCP servers:
+`);for(const n of r){const t=o.mcpServers[n],c=t.type==="http"||t.type==="streamable-http"?"HTTP":"stdio";console.log(`  ${n} (${c})`)}console.log();return}if(s==="add"){const o=e[4];o||(console.error("Usage: naraya mcp add <name> [--transport http <url>] -- <command> [args...]"),process.exit(1));const r=a(),n=e.indexOf("--",5),t=e.indexOf("--transport",5);if(t!==-1&&n===-1){const c=e[t+1]==="http"?"http":"streamable-http",i=e[t+2];i||(console.error("Usage: naraya mcp add <name> --transport http <url>"),process.exit(1)),r.mcpServers[o]={type:c,url:i}}else if(n!==-1){const c=e[n+1],i=e.slice(n+2);c||(console.error("Usage: naraya mcp add <name> -- <command> [args...]"),process.exit(1)),r.mcpServers[o]={command:c,args:i}}else console.error("Usage: naraya mcp add <name> [--transport http <url>] -- <command> [args...]"),process.exit(1);m(r),console.log(`Added MCP server: ${o}`);return}if(s==="remove"){const o=e[4];o||(console.error("Usage: naraya mcp remove <name>"),process.exit(1));const r=a();r.mcpServers[o]||(console.error(`Server '${o}' not found.`),process.exit(1)),delete r.mcpServers[o],m(r),console.log(`Removed MCP server: ${o}`);return}if(s==="get"){const o=e[4];o||(console.error("Usage: naraya mcp get <name>"),process.exit(1));const n=a().mcpServers[o];n||(console.error(`Server '${o}' not found.`),process.exit(1)),console.log(`
+${o}:
+`),console.log(JSON.stringify(n,null,2)),console.log();return}console.error(`Unknown action: ${s}`),console.error("Available: list, add, remove, get"),process.exit(1)}export{y as ensureBundledMcpServers,x as mcpCLI};

package/src/pentest/catalog/catalog-loader.ts

@@ -0,0 +1,55 @@
+import type { ToolsCatalog, ToolEntry } from "../types.js"
+
+const DEFAULT_CATALOG_PATH = "tools-catalog.json"
+
+export interface CatalogLoaderOptions {
+  readonly catalogPath?: string
+}
+
+export async function loadToolsCatalog(options?: CatalogLoaderOptions): Promise<ToolsCatalog> {
+  const path = options?.catalogPath ?? DEFAULT_CATALOG_PATH
+  const response = await fetch(`file://${process.cwd()}/${path}`)
+  
+  if (!response.ok) {
+    throw new Error(`Failed to load tools catalog from ${path}: ${response.statusText}`)
+  }
+  
+  return response.json() as Promise<ToolsCatalog>
+}
+
+export async function loadToolsCatalogFromFs(fs: typeof import("fs/promises"), options?: CatalogLoaderOptions): Promise<ToolsCatalog> {
+  const path = options?.catalogPath ?? DEFAULT_CATALOG_PATH
+  const content = await fs.readFile(path, "utf-8")
+  return JSON.parse(content) as ToolsCatalog
+}
+
+export function getToolByName(catalog: ToolsCatalog, name: string): ToolEntry | undefined {
+  return catalog.tools.find((t: ToolEntry) => t.tools_name === name)
+}
+
+export function getToolNames(catalog: ToolsCatalog): string[] {
+  return catalog.tools.map((t: ToolEntry) => t.tools_name)
+}
+
+export function validateCatalog(catalog: unknown): catalog is ToolsCatalog {
+  if (typeof catalog !== "object" || catalog === null) return false
+  const c = catalog as Record<string, unknown>
+  if (typeof c.$schema !== "string") return false
+  if (typeof c.version !== "string") return false
+  if (!Array.isArray(c.categories)) return false
+  if (!Array.isArray(c.tools)) return false
+  return c.tools.every(validateToolEntry)
+}
+
+function validateToolEntry(tool: unknown): tool is ToolEntry {
+  if (typeof tool !== "object" || tool === null) return false
+  const t = tool as Record<string, unknown>
+  return (
+    typeof t.tools_name === "string" &&
+    typeof t.description === "string" &&
+    typeof t.category === "string" &&
+    typeof t.command === "object" &&
+    typeof t.skills_loader === "string" &&
+    Array.isArray(t.phase)
+  )
+}

package/src/pentest/catalog/index.ts

@@ -0,0 +1 @@
+export * from "./catalog-loader.js"