@pentoshi/clai 3.5.1 → 3.7.2

package/dist/tools/nmap-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"nmap-runner.js","sourceRoot":"","sources":["../../src/tools/nmap-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAG1E;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe;IAG5B,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QAC7C,oCAAoC;QACpC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC3B,IAAI,MAAM,gBAAgB,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACzE,IAAI,MAAM,gBAAgB,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC3E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,0EAA0E;QAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,iCAAiC,CAAC,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,MAAM,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACzE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iFAAiF;AACjF,SAAS,uBAAuB,CAAC,MAAc;IAC7C,OAAO,8SAA8S,CAAC,IAAI,CACxT,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAc,EACd,OAAwB;IAExB,MAAM,cAAc,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,MAAM,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpE,MAAM,QAAQ,GAMT,EAAE,CAAC;IAER,IAAI,cAAc,IAAI,MAAM,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAC9B,wEAAwE;YACxE,qEAAqE;YACrE,mEAAmE;YACnE,OAAO,EAAE,QAAQ,EAAE,CACjB,OAAO,EAAE,aAAa;gBACpB,CAAC,CAAC,qGAAqG;gBACvG,CAAC,CAAC,0GAA0G,EAC9G,QAAQ,CACT,CAAC;YACF,IAAI,IAAgB,CAAC;YACrB,IAAI,YAAgC,CAAC;YACrC,IAAI,OAAO,EAAE,aAAa,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC;oBAC3C,KAAK,EAAE,sBAAsB;oBAC7B,MAAM,EAAE,kFAAkF;iBAC3F,CAAC,CAAC;gBACH,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;gBACzF,CAAC;gBACD,YAAY,GAAG,QAAQ,CAAC;gBACxB,IAAI,GAAG,MAAM,SAAS,CAAC;oBACrB,OAAO,EAAE,MAAM;oBACf,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC;oBAC5B,SAAS,EAAE,GAAG,QAAQ,IAAI;oBAC1B,SAAS,EAAE,MAAM;oBACjB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,UAAU,EAAE,IAAI;oBAChB,gBAAgB,EAAE,KAAK;iBACxB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,sEAAsE;gBACtE,IAAI,GAAG,MAAM,SAAS,CAAC;oBACrB,OAAO,EAAE,MAAM;oBACf,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;oBAC5B,SAAS,EAAE,OAAO;oBAClB,MAAM,EAAE,OAAO,EAAE,MAAM;oBACvB,QAAQ,EAAE,OAAO,EAAE,QAAQ;oBAC3B,gBAAgB,EAAE,IAAI;oBACtB,UAAU,EAAE,IAAI;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACnE,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;gBACZ,QAAQ,CAAC,IAAI,CAAC;oBACZ,OAAO,EAAE,MAAM;oBACf,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;oBAC1F,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,YAAY,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS;oBACzE,IAAI,EAAE,sEAAsE;iBAC7E,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,QAAQ,EAAE,CACjB,4FAA4F,EAC5F,QAAQ,CACT,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;gBACvC,gBAAgB,EAAE,IAAI;gBACtB,IAAI,EAAE,+BAA+B,MAAM,CAAC,OAAO,2CAA2C;aAC/F,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,gBAAgB;YAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,mEAAmE;QACnE,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC;YAC7B,IAAI,EAAE,uFAAuF;SAC9F,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,cAAc,IAAI,CAAC,MAAM,EAAE,CAAC;QACrC,yEAAyE;QACzE,yDAAyD;QACzD,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC;YAC7B,IAAI,EACF,QAAQ,EAAE,KAAK,OAAO;gBACpB,CAAC,CAAC,+IAA+I;gBACjJ,CAAC,CAAC,0GAA0G;SACjH,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,IAA4B,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QAC7B,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,OAAO,CAAC,IAAI;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;YAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO;YAClB,MAAM,EAAE,OAAO,EAAE,MAAM;YACvB,QAAQ,EAAE,OAAO,EAAE,QAAQ;YAC3B,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE;gBAChD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,IAAI,GAAG,MAAM,CAAC;QACd,wEAAwE;QACxE,MAAM,aAAa,GAAG,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,EAAE,IAAI,aAAa,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1E,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,iDAAiD;IACnD,CAAC;IACD,OAAO,IAAI,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAChF,CAAC"}
+{"version":3,"file":"nmap-runner.js","sourceRoot":"","sources":["../../src/tools/nmap-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EACL,+BAA+B,EAC/B,SAAS,GACV,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,aAAa,EACb,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AAGvB;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe;IAG5B,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QAC7C,oCAAoC;QACpC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC3B,IAAI,MAAM,gBAAgB,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACzE,IAAI,MAAM,gBAAgB,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC3E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,0EAA0E;QAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,iCAAiC,CAAC,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,MAAM,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACzE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iFAAiF;AACjF,SAAS,uBAAuB,CAAC,MAAc;IAC7C,OAAO,8SAA8S,CAAC,IAAI,CACxT,MAAM,CACP,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AA2BD,MAAM,gBAAgB,GAA4C;IAChE,QAAQ,EAAE,CAAC,GAAG,MAAM;IACpB,IAAI,EAAE,EAAE,GAAG,MAAM;IACjB,IAAI,EAAE,EAAE,GAAG,MAAM;CAClB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAuB,EACvB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC3F,CAAC;IAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAuB;IACjD,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,IAAI,+BAA+B,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC;IAClE,MAAM,aAAa,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhE,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAC3C,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAC7E,CAAC;IACF,IAAI,QAAQ,GAAG,KAAK,IAAI,aAAa,GAAG,KAAK,IAAI,kBAAkB;QAAE,OAAO,MAAM,CAAC;IACnF,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAc,EACd,OAAwB;IAExB,2EAA2E;IAC3E,kEAAkE;IAClE,IAAI,QAAQ,GACV,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAClD,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAC7B,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAEhB,MAAM,cAAc,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,MAAM,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpE,MAAM,QAAQ,GAMT,EAAE,CAAC;IAER,IAAI,cAAc,IAAI,MAAM,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAC9B,uEAAuE;YACvE,yEAAyE;YACzE,0EAA0E;YAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YAClD,MAAM,MAAM,GACV,CAAC,SAAS;gBACV,kBAAkB,EAAE;gBACpB,+BAA+B,EAAE,CAAC;YAEpC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC1B,OAAO,EAAE,QAAQ,EAAE,CACjB,uHAAuH,EACvH,QAAQ,CACT,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,QAAQ,EAAE,CACjB,SAAS;oBACP,CAAC,CAAC,qGAAqG;oBACvG,CAAC,CAAC,0GAA0G,EAC9G,QAAQ,CACT,CAAC;gBACF,IAAI,SAAS,IAAI,OAAO,EAAE,aAAa,EAAE,CAAC;oBACxC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC;wBAC3C,KAAK,EAAE,sBAAsB;wBAC7B,MAAM,EACJ,gHAAgH;qBACnH,CAAC,CAAC;oBACH,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;wBAC3B,OAAO,EAAE,QAAQ,EAAE,CACjB,+EAA+E,EAC/E,QAAQ,CACT,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACN,MAAM,aAAa,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;wBACxD,8DAA8D;wBAC9D,gDAAgD;wBAChD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC;4BAC3B,OAAO,EAAE,MAAM;4BACf,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC;4BAC5B,SAAS,EAAE,aAAa;4BACxB,SAAS,EAAE,MAAM;4BACjB,MAAM,EAAE,OAAO,CAAC,MAAM;4BACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;4BAC1B,UAAU,EAAE,IAAI;4BAChB,gBAAgB,EAAE,KAAK;yBACxB,CAAC,CAAC;wBACH,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;4BACtD,OAAO,EAAE,QAAQ,EAAE,CACjB,6EAA6E,EAC7E,QAAQ,CACT,CAAC;wBACJ,CAAC;6BAAM,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;4BACnB,6DAA6D;4BAC7D,6DAA6D;4BAC7D,yDAAyD;4BACzD,0DAA0D;4BAC1D,QAAQ,CAAC,IAAI,CAAC;gCACZ,OAAO,EAAE,MAAM;gCACf,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;gCAC3C,SAAS,EAAE,aAAa;gCACxB,gBAAgB,EAAE,KAAK;gCACvB,IAAI,EAAE,sEAAsE;6BAC7E,CAAC,CAAC;wBACL,CAAC;6BAAM,CAAC;4BACN,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE;gCAChC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;gCACzC,CAAC,CAAC,EAAE,CAAC;4BACP,OAAO,EAAE,QAAQ,EAAE,CACjB,gFAAgF,MAAM,IAAI,EAC1F,QAAQ,CACT,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,6DAA6D;oBAC7D,+DAA+D;oBAC/D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC;wBAC3B,OAAO,EAAE,MAAM;wBACf,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;wBAC5B,SAAS,EAAE,OAAO;wBAClB,MAAM,EAAE,OAAO,EAAE,MAAM;wBACvB,QAAQ,EAAE,OAAO,EAAE,QAAQ;wBAC3B,gBAAgB,EAAE,IAAI;wBACtB,UAAU,EAAE,IAAI;qBACjB,CAAC,CAAC;oBACH,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG;wBAAE,OAAO,IAAI,CAAC;oBACnE,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;wBACZ,QAAQ,CAAC,IAAI,CAAC;4BACZ,OAAO,EAAE,MAAM;4BACf,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;4BACjC,gBAAgB,EAAE,KAAK;4BACvB,IAAI,EAAE,sEAAsE;yBAC7E,CAAC,CAAC;oBACL,CAAC;yBAAM,CAAC;wBACN,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE;4BAChC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;4BACzC,CAAC,CAAC,EAAE,CAAC;wBACP,OAAO,EAAE,QAAQ,EAAE,CACjB,qGAAqG,MAAM,IAAI,EAC/G,QAAQ,CACT,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC1B,mEAAmE;YACnE,IAAI,+BAA+B,EAAE,EAAE,CAAC;gBACtC,QAAQ,CAAC,IAAI,CAAC;oBACZ,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;oBAC3C,gBAAgB,EAAE,IAAI;oBACtB,IAAI,EAAE,+BAA+B,MAAM,CAAC,OAAO,2CAA2C;iBAC/F,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,QAAQ,EAAE,CACjB,KAAK,MAAM,CAAC,OAAO,0GAA0G,EAC7H,QAAQ,CACT,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,gBAAgB;YAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,mEAAmE;QACnE,MAAM,WAAW,GAAG,qBAAqB,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,2FAA2F;SAClG,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,cAAc,IAAI,CAAC,MAAM,EAAE,CAAC;QACrC,yEAAyE;QACzE,yDAAyD;QACzD,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,qBAAqB,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACxD,IAAI,EACF,QAAQ,EAAE,KAAK,OAAO;gBACpB,CAAC,CAAC,mJAAmJ;gBACrJ,CAAC,CAAC,8GAA8G;SACrH,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,aAAa,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACzD,OAAO,EAAE,QAAQ,EAAE,CACjB,UAAU,aAAa,CAAC,KAAK,kBAAkB,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,GAAG,MAAM,CAAC,MAAM,aAAa,CAAC,MAAM,KAAK,EAC1H,QAAQ,CACT,CAAC;IAEF,IAAI,IAA4B,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QAC7B,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,OAAO,CAAC,IAAI;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvE,IAAI,MAAM,GAAG,MAAM,SAAS,CAAC;YAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,aAAa,CAAC,SAAS;YAClC,MAAM,EAAE,OAAO,EAAE,MAAM;YACvB,QAAQ,EAAE,OAAO,EAAE,QAAQ;YAC3B,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE;gBAChD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QAEH,4EAA4E;QAC5E,IACE,MAAM,CAAC,EAAE;YACT,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC;YACrC,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC;YAC5B,sBAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,EACpC,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,CACjB,0FAA0F,EAC1F,QAAQ,CACT,CAAC;YACF,MAAM,GAAG,MAAM,SAAS,CAAC;gBACvB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI,EAAE,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC;gBACzC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,aAAa,CAAC,SAAS;gBAClC,MAAM,EAAE,OAAO,EAAE,MAAM;gBACvB,QAAQ,EAAE,OAAO,EAAE,QAAQ;gBAC3B,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;oBACxC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE;oBAChD,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;QAED,IAAI,GAAG,MAAM,CAAC;QACd,wEAAwE;QACxE,MAAM,aAAa,GAAG,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,EAAE,IAAI,aAAa,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1E,yEAAyE;YACzE,IACE,MAAM,CAAC,EAAE;gBACT,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC;gBACrC,sBAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,EACpC,CAAC;gBACD,OAAO;oBACL,GAAG,MAAM;oBACT,MAAM,EACJ,MAAM,CAAC,MAAM;wBACb,mEAAmE;wBACnE,gEAAgE;wBAChE,uEAAuE;wBACvE,4FAA4F;iBAC/F,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,iDAAiD;IACnD,CAAC;IACD,OAAO,IAAI,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAChF,CAAC"}

package/dist/tools/pentest-workflows.d.ts

@@ -0,0 +1,8 @@
+import type { ToolResult } from "../types.js";
+import type { ToolRunOptions } from "./tool-types.js";
+export declare function discoverWebSurface(baseUrl: string, paths: readonly string[], options?: ToolRunOptions): Promise<ToolResult>;
+export declare function enumerateApi(specUrl: string, options?: ToolRunOptions): Promise<ToolResult>;
+export declare function compareAuthorizationContexts(url: string, contexts: readonly {
+    label: string;
+    headers: Record<string, string>;
+}[], options?: ToolRunOptions): Promise<ToolResult>;

package/dist/tools/pentest-workflows.js

@@ -0,0 +1,71 @@
+import { httpFetch } from "./http.js";
+async function runBoundedRequests(requests, options, concurrency = 4) {
+    const results = [];
+    let cursor = 0;
+    const workers = Array.from({ length: Math.min(concurrency, requests.length) }, async () => {
+        for (;;) {
+            const index = cursor++;
+            const request = requests[index];
+            if (!request)
+                return;
+            const result = await httpFetch(request.url, {
+                method: "GET",
+                headers: request.headers,
+                maxBytes: 128 * 1024,
+                signal: options?.signal,
+                authorizeHop: options?.authorizeNetworkHop,
+            });
+            results[index] = { request, result };
+        }
+    });
+    await Promise.all(workers);
+    return results;
+}
+export async function discoverWebSurface(baseUrl, paths, options) {
+    const base = new URL(baseUrl);
+    const unique = Array.from(new Set(["/", "/robots.txt", "/sitemap.xml", ...paths])).slice(0, 100);
+    const requests = unique.map((path) => ({
+        label: path,
+        url: new URL(path.startsWith("/") ? path : `/${path}`, base).toString(),
+    }));
+    const results = await runBoundedRequests(requests, options);
+    const observations = results.map(({ request, result }) => `${request.label}: ${result.ok ? "reachable" : "failed"}\n${result.output.slice(0, 2_000)}`);
+    return {
+        ok: results.some(({ result }) => result.ok),
+        output: `Web surface discovery (${results.length} bounded requests)\n\n${observations.join("\n\n")}`,
+        exitCode: results.some(({ result }) => result.ok) ? 0 : 1,
+    };
+}
+export async function enumerateApi(specUrl, options) {
+    const result = await httpFetch(specUrl, {
+        method: "GET",
+        maxBytes: 1024 * 1024,
+        signal: options?.signal,
+        authorizeHop: options?.authorizeNetworkHop,
+    });
+    if (!result.ok)
+        return result;
+    const pathMatches = Array.from(result.output.matchAll(/^\s{0,8}["']?(\/[^\s"']*)["']?\s*:/gm), (match) => match[1]);
+    const endpoints = Array.from(new Set(pathMatches.filter((value) => Boolean(value)))).slice(0, 500);
+    return {
+        ...result,
+        output: `${result.output}\n\nDiscovered API paths (${endpoints.length}):\n${endpoints.map((path) => `- ${path}`).join("\n") || "- None parsed; inspect the retained specification body."}`,
+    };
+}
+export async function compareAuthorizationContexts(url, contexts, options) {
+    if (contexts.length < 2)
+        return { ok: false, output: "auth.compare requires at least two authorization contexts", exitCode: 1 };
+    const results = await runBoundedRequests(contexts.slice(0, 10).map((context) => ({ url, label: context.label, headers: context.headers })), options, 2);
+    const fingerprints = results.map(({ request, result }) => ({
+        label: request.label,
+        ok: result.ok,
+        bytes: Buffer.byteLength(result.output),
+        preview: result.output.slice(0, 500),
+    }));
+    return {
+        ok: results.some(({ result }) => result.ok),
+        output: `Authorization-context comparison (credentials redacted; scanner lead only)\n${JSON.stringify(fingerprints, null, 2)}`,
+        exitCode: results.some(({ result }) => result.ok) ? 0 : 1,
+    };
+}
+//# sourceMappingURL=pentest-workflows.js.map

package/dist/tools/pentest-workflows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pentest-workflows.js","sourceRoot":"","sources":["../../src/tools/pentest-workflows.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAStC,KAAK,UAAU,kBAAkB,CAC/B,QAAkC,EAClC,OAAmC,EACnC,WAAW,GAAG,CAAC;IAEf,MAAM,OAAO,GAA0D,EAAE,CAAC;IAC1E,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;QACxF,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC1C,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,QAAQ,EAAE,GAAG,GAAG,IAAI;gBACpB,MAAM,EAAE,OAAO,EAAE,MAAM;gBACvB,YAAY,EAAE,OAAO,EAAE,mBAAmB;aAC3C,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,KAAwB,EACxB,OAAwB;IAExB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACrC,KAAK,EAAE,IAAI;QACX,GAAG,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE;KACxE,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACvJ,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,MAAM,EAAE,0BAA0B,OAAO,CAAC,MAAM,yBAAyB,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;QACpG,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAe,EACf,OAAwB;IAExB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE;QACtC,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,IAAI,GAAG,IAAI;QACrB,MAAM,EAAE,OAAO,EAAE,MAAM;QACvB,YAAY,EAAE,OAAO,EAAE,mBAAmB;KAC3C,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC9B,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,sCAAsC,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpH,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpH,OAAO;QACL,GAAG,MAAM;QACT,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,6BAA6B,SAAS,CAAC,MAAM,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,yDAAyD,EAAE;KAC3L,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAW,EACX,QAAuE,EACvE,OAAwB;IAExB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2DAA2D,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAChI,MAAM,OAAO,GAAG,MAAM,kBAAkB,CACtC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,EACjG,OAAO,EACP,CAAC,CACF,CAAC;IACF,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACzD,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;KACrC,CAAC,CAAC,CAAC;IACJ,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,MAAM,EAAE,+EAA+E,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QAC9H,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC1D,CAAC;AACJ,CAAC"}

package/dist/tools/registry.d.ts

@@ -1,6 +1,15 @@
 import type { ToolCall, ToolResult } from "../types.js";
 import { type ToolRunOptions, type ToolHandler } from "./tool-types.js";
 export type { ToolRunOptions, ToolHandler };
+export interface ScanResourceEstimate {
+    profile: "standard" | "deep" | "full";
+    estimatedSeconds: number;
+    timeoutMs: number;
+    durableRecommended: boolean;
+}
+export declare function estimateScanResources(argv: readonly string[]): ScanResourceEstimate;
+/** nmap argv for pentest.recon — ports configurable (default top-100). */
+export declare function buildPentestReconNmapArgv(args: Record<string, unknown>, host: string): string[];
 export declare const toolRegistry: Record<string, ToolHandler>;
 export declare function availableToolNames(): string[];
 /**

package/dist/tools/registry.js

@@ -4,6 +4,7 @@ import { safeCwd } from "../os/cwd.js";
 import { fsEdit, fsDelete, fsList, fsRead, fsSearch, fsWrite, fsWriteMany, fsReplaceLines, fsAppend, } from "./fs.js";
 import { httpFetch } from "./http.js";
 import { shellExec, spawnArgv } from "./shell.js";
+import { isLongQuietInstallOrScaffoldCommand, } from "../agent/task-evidence.js";
 import { imageOcr } from "./image.js";
 import { pdfRead } from "./pdf.js";
 import { webFetch } from "./web/fetch.js";
@@ -11,7 +12,7 @@ import { webSearch } from "./web/search.js";
 import { RESPONSE_MODES } from "./web/types.js";
 import { classifyToolCall } from "../safety/classifier.js";
 import { loadScope } from "../store/scope.js";
-import { parseHost, parsePortSpec, parseLegacyFlags, profileToNmapArgs, } from "./validate.js";
+import { parseHost, parsePortSpec, parseLegacyFlags, profileToNmapArgs, nmapScanNeedsPrivilege, } from "./validate.js";
 import { getNetworkContext } from "./network-context.js";
 import { pingSweep } from "./net-ping-sweep.js";
 import { toolCheckHandler } from "./capabilities.js";
@@ -19,7 +20,11 @@ import { wordlistFind } from "./wordlists.js";
 import { jobManager } from "./jobs.js";
 import { looksLongRunning } from "./command-intent.js";
 import { packageBinaryName } from "./package-binary.js";
-import { runNmapScan } from "./nmap-runner.js";
+import { resolveNmapTimeoutPolicy, runNmapScan } from "./nmap-runner.js";
+import { compareAuthorizationContexts, discoverWebSurface, enumerateApi } from "./pentest-workflows.js";
+import { fromWireName, sanitizeToolName } from "../llm/tool-protocol.js";
+import { prepareElevatedBackgroundCommand, preparePrivilegedBackgroundArgv, tryRunElevatedWithoutTty, } from "./elevated-shell.js";
+import { getAllowInteractiveStdinInherit, looksInteractiveStdin, } from "./shell.js";
 function requireString(args, key) {
     const value = args[key];
     if (typeof value !== "string" || value.length === 0) {
@@ -27,6 +32,14 @@ function requireString(args, key) {
     }
     return value;
 }
+/** Like requireString but allows empty string (e.g. replaceLines delete). */
+function requireStringAllowEmpty(args, key) {
+    const value = args[key];
+    if (typeof value !== "string") {
+        throw new Error(`Tool argument "${key}" must be a string`);
+    }
+    return value;
+}
 function optionalString(args, key) {
     const value = args[key];
     return typeof value === "string" && value.length > 0 ? value : undefined;
@@ -46,6 +59,43 @@ function optionalBoolean(args, key) {
     const value = args[key];
     return typeof value === "boolean" ? value : undefined;
 }
+export function estimateScanResources(argv) {
+    const policy = resolveNmapTimeoutPolicy(argv, {});
+    const estimatedSeconds = policy.depth === "full" ? 1_800 : policy.depth === "deep" ? 600 : 120;
+    return {
+        profile: policy.depth,
+        estimatedSeconds,
+        timeoutMs: policy.timeoutMs,
+        durableRecommended: policy.depth !== "standard",
+    };
+}
+/** nmap argv for pentest.recon — ports configurable (default top-100). */
+export function buildPentestReconNmapArgv(args, host) {
+    const argv = ["-sS", "-sV"];
+    const full = args.full === true || args.full === "true";
+    const ports = typeof args.ports === "string" && args.ports.trim()
+        ? args.ports.trim()
+        : undefined;
+    let topPorts;
+    if (typeof args.topPorts === "number" && Number.isFinite(args.topPorts)) {
+        topPorts = Math.max(1, Math.min(65535, Math.floor(args.topPorts)));
+    }
+    else if (typeof args.topPorts === "string" && /^\d+$/.test(args.topPorts)) {
+        topPorts = Math.max(1, Math.min(65535, Number(args.topPorts)));
+    }
+    if (full) {
+        argv.push("-p-");
+    }
+    else if (ports) {
+        const spec = parsePortSpec(ports);
+        argv.push("-p", spec);
+    }
+    else {
+        argv.push("--top-ports", String(topPorts ?? 100));
+    }
+    argv.push(host);
+    return argv;
+}
 function optionalResponseMode(args, key) {
     const value = args[key];
     if (typeof value === "string" &&
@@ -67,9 +117,14 @@ export const toolRegistry = {
         // The model is still encouraged to use shell.start directly; this just
         // catches the common mistake of using shell.exec for a server.
         if (looksLongRunning(command)) {
-            const job = await jobManager.startJob(command, {
-                cwd: optionalString(args, "cwd"),
+            const elevated = await prepareElevatedBackgroundCommand(command, {
+                signal: options?.signal,
+                onOutput: options?.onOutput,
+                requestSecret: options?.requestSecret,
             });
+            if (elevated && !elevated.prepared)
+                return elevated.result;
+            const job = await jobManager.startJob(elevated?.prepared ? elevated.spec : command, { cwd: optionalString(args, "cwd") });
             if (job.ok) {
                 return {
                     ...job,
@@ -82,12 +137,41 @@ export const toolRegistry = {
             }
             return job;
         }
+        // create-next-app / npm install often exceed the default 3 min shell timeout
+        // when the model omits timeoutMs — bump automatically for known long jobs.
+        const explicitTimeout = optionalNumber(args, "timeoutMs");
+        const timeoutMs = explicitTimeout ??
+            (isLongQuietInstallOrScaffoldCommand(command) ? 900_000 : undefined);
+        // Password tools must never steal the TTY in OpenTUI (freezes Esc/clicks).
+        // Prefer secure modal + sudo -S; otherwise refuse interactive elevation.
+        if (looksInteractiveStdin(command)) {
+            const elevated = await tryRunElevatedWithoutTty(command, {
+                cwd: optionalString(args, "cwd"),
+                timeoutMs,
+                signal: options?.signal,
+                onOutput: options?.onOutput,
+                requestSecret: options?.requestSecret,
+            });
+            if (elevated)
+                return elevated;
+            if (!getAllowInteractiveStdinInherit()) {
+                return {
+                    ok: false,
+                    exitCode: 1,
+                    output: "This command needs an interactive password prompt, which would freeze the TUI. " +
+                        "Use a simple `sudo <command>` so clai can open the secure password modal, " +
+                        "or run without elevation (e.g. nmap -sT).",
+                };
+            }
+        }
         return shellExec({
             command,
             cwd: optionalString(args, "cwd"),
-            timeoutMs: optionalNumber(args, "timeoutMs"),
+            timeoutMs,
             signal: options?.signal,
             onOutput: options?.onOutput,
+            // Explicit: never inherit unless classic REPL policy allows it.
+            interactiveStdin: getAllowInteractiveStdinInherit() ? "auto" : false,
         });
     },
     async "fs.read"(args, options) {
@@ -177,6 +261,27 @@ export const toolRegistry = {
         if (ports)
             argv.push("-p", ports);
         argv.push(...profileArgs, ...legacyArgs, host.value);
+        const estimate = estimateScanResources(argv);
+        const durable = args.background === true || estimate.durableRecommended;
+        if (durable) {
+            const prepared = nmapScanNeedsPrivilege(argv)
+                ? await preparePrivilegedBackgroundArgv("nmap", argv, {
+                    signal: options?.signal,
+                    onOutput: options?.onOutput,
+                    requestSecret: options?.requestSecret,
+                    title: "Administrator access for nmap",
+                    prompt: "Enter your password for the nmap raw-socket scan. It is sent only to sudo stdin and is never stored. Esc cancels.",
+                })
+                : { prepared: true, spec: { command: "nmap", argv: [...argv] } };
+            if (!prepared.prepared)
+                return prepared.result;
+            return jobManager.startJob(prepared.spec, {
+                name: `nmap-${estimate.profile}-${host.value}`,
+                profile: estimate.profile,
+                estimatedSeconds: estimate.estimatedSeconds,
+                ...(options?.engagementAuthorization ? { authorization: options.engagementAuthorization } : {}),
+            });
+        }
         return runNmapScan(argv, options);
     },
     async "http.fetch"(args, options) {
@@ -185,14 +290,43 @@ export const toolRegistry = {
             !Array.isArray(args.headers)
             ? args.headers
             : undefined;
-        return httpFetch(requireString(args, "url"), {
+        const url = requireString(args, "url");
+        const method = (optionalString(args, "method") ?? "GET").toUpperCase();
+        // Local app verify: loopback GET/HEAD is the owner's own process — auto-own
+        // so models are not stuck without iOwnThis. Mutating methods and non-loopback
+        // private/metadata addresses still require explicit ownership.
+        let iOwnThis = args.iOwnThis === true || args.own === true;
+        // Keep the caller's host (localhost). httpFetch dual-stacks 127.0.0.1/::1
+        // on connection failure — rewriting to 127.0.0.1 alone broke Vite on
+        // IPv6-only macOS binds while the browser still worked.
+        if (!iOwnThis && (method === "GET" || method === "HEAD")) {
+            try {
+                const parsed = new URL(url);
+                const host = parsed.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+                if (host === "localhost" ||
+                    host === "127.0.0.1" ||
+                    host === "::1" ||
+                    host === "localhost.localdomain" ||
+                    host === "ip6-localhost" ||
+                    /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host)) {
+                    iOwnThis = true;
+                }
+            }
+            catch {
+                /* invalid URL handled inside httpFetch */
+            }
+        }
+        return httpFetch(url, {
             method: optionalString(args, "method"),
             body: optionalString(args, "body"),
             headers,
             maxBytes: optionalNumber(args, "maxBytes"),
-            iOwnThis: args.iOwnThis === true || args.own === true,
+            iOwnThis,
             retries: optionalNumber(args, "retries"),
             signal: options?.signal,
+            // Never attach engagement hop checks for owned loopback — leftover
+            // pentest scope must not fail local app verify.
+            authorizeHop: iOwnThis ? undefined : options?.authorizeNetworkHop,
         });
     },
     async "web.search"(args, options) {
@@ -309,13 +443,10 @@ export const toolRegistry = {
     },
     async "pentest.recon"(args, options) {
         const host = parseHost(requireString(args, "target"));
-        // Per-step opt-in flags so callers can ask for ONLY the recon they
-        // need. When no flags are supplied the legacy behavior runs (all
-        // three steps), preserving backwards compatibility for prompts that
-        // expect a full sweep.
         const wantWhois = args.whois !== false;
         const wantDns = args.dns !== false;
         const wantNmap = args.nmap !== false;
+        const nmapArgv = buildPentestReconNmapArgv(args, host.value);
         const allSteps = [
             { key: "whois", command: "whois", argv: [host.value] },
             {
@@ -326,11 +457,7 @@ export const toolRegistry = {
             {
                 key: "nmap",
                 command: "nmap",
-                // -sS = stealth SYN scan (the professional default). It needs raw
-                // sockets, so runNmapScan wraps it in sudo / elevation and falls
-                // back to an unprivileged TCP connect scan (-sT) when privilege
-                // can't be obtained.
-                argv: ["-sS", "-sV", "--top-ports", "100", host.value],
+                argv: nmapArgv,
             },
         ];
         const steps = allSteps.filter((step) => {
@@ -372,55 +499,71 @@ export const toolRegistry = {
         const transcript = [];
         let anyOk = false;
         const userAborted = () => Boolean(options?.signal?.aborted);
-        for (const step of steps) {
-            if (userAborted())
-                break;
+        const runStep = async (step) => {
             const display = `${step.command} ${step.argv.join(" ")}`;
-            transcript.push(`$ ${display}`);
-            // Announce each sub-step so users see progress through long recons.
             options?.onOutput?.(`\n$ ${display}\n`, "stdout");
-            // Heartbeat so the outer 60s stall watchdog doesn't kill a quiet whois.
             const beat = setInterval(() => {
                 options?.onOutput?.(`[recon] ${step.key} still running…\n`, "stdout");
             }, 5_000);
             beat.unref?.();
-            // Per-step caps: whois often hangs; nmap needs longer; dns is quick.
-            const stepTimeoutMs = step.key === "whois" ? 20_000 : step.key === "dns" ? 30_000 : 180_000;
-            let result;
             try {
-                result =
-                    step.key === "nmap"
-                        ? await runNmapScan(step.argv, options)
-                        : await spawnArgv({
-                            command: step.command,
-                            argv: step.argv,
-                            timeoutMs: stepTimeoutMs,
-                            signal: options?.signal,
-                            onOutput: options?.onOutput,
-                        });
+                if (step.key === "nmap") {
+                    const estimate = estimateScanResources(step.argv);
+                    if (estimate.durableRecommended || args.background === true) {
+                        const prepared = nmapScanNeedsPrivilege(step.argv)
+                            ? await preparePrivilegedBackgroundArgv("nmap", step.argv, {
+                                signal: options?.signal,
+                                onOutput: options?.onOutput,
+                                requestSecret: options?.requestSecret,
+                                title: "Administrator access for nmap",
+                                prompt: "Enter your password for the durable nmap raw-socket scan. It is sent only to sudo stdin and is never stored. Esc cancels.",
+                            })
+                            : { prepared: true, spec: { command: "nmap", argv: [...step.argv] } };
+                        const result = prepared.prepared
+                            ? await jobManager.startJob(prepared.spec, {
+                                name: `recon-${estimate.profile}-${host.value}`,
+                                profile: estimate.profile,
+                                estimatedSeconds: estimate.estimatedSeconds,
+                                ...(options?.engagementAuthorization ? { authorization: options.engagementAuthorization } : {}),
+                            })
+                            : prepared.result;
+                        return { key: step.key, display, result };
+                    }
+                    return { key: step.key, display, result: await runNmapScan(step.argv, options) };
+                }
+                const timeoutMs = step.key === "whois" ? 20_000 : 30_000;
+                return {
+                    key: step.key,
+                    display,
+                    result: await spawnArgv({
+                        command: step.command,
+                        argv: step.argv,
+                        timeoutMs,
+                        signal: options?.signal,
+                        onOutput: options?.onOutput,
+                    }),
+                };
             }
             catch (error) {
-                const msg = error instanceof Error ? error.message : String(error);
-                result = {
-                    ok: false,
-                    output: `${step.key} error: ${msg}`,
-                    exitCode: 1,
+                return {
+                    key: step.key,
+                    display,
+                    result: { ok: false, output: `${step.key} error: ${error instanceof Error ? error.message : String(error)}`, exitCode: 1 },
                 };
             }
             finally {
                 clearInterval(beat);
             }
-            // Continue remaining steps even if whois/dns fails — never cancel
-            // sibling top-level tools just because whois hung.
+        };
+        // Passive WHOIS/DNS and the selected scan run independently. Deep/full
+        // scans return a durable job receipt immediately while passive results
+        // continue to completion in this foreground turn.
+        const completed = await Promise.all(steps.map(runStep));
+        for (const { display, result } of completed) {
+            transcript.push(`$ ${display}`, result.output);
+            outputs.push(result.output);
             if (result.ok)
                 anyOk = true;
-            const body = result.ok
-                ? result.output
-                : `${result.output || `${step.key} failed`}${result.exitCode !== undefined ? ` (exit ${result.exitCode})` : ""}`;
-            outputs.push(body);
-            transcript.push(body);
-            if (userAborted())
-                break;
         }
         if (artifactPath) {
             const body = transcript.join("\n\n");
@@ -431,18 +574,54 @@ export const toolRegistry = {
                 artifactPath = undefined;
             }
         }
-        // Soft-success when any step worked and the user didn't cancel. Partial
-        // whois failure still returns useful dns/nmap output to the model.
+        // Passive successes remain useful evidence, but a requested nmap step
+        // that failed authentication or never started must make the composite
+        // operation fail rather than disguising it as a successful recon.
         const aborted = userAborted();
+        const nmapResult = completed.find((entry) => entry.key === "nmap")?.result;
+        const requestedScanFailed = wantNmap && Boolean(nmapResult && !nmapResult.ok);
+        const backgroundJob = completed.find((entry) => entry.result.backgroundJob)?.result.backgroundJob;
+        const output = outputs.join("\n\n");
         return {
-            ok: aborted ? false : anyOk || outputs.length > 0,
+            ok: !aborted && anyOk && !requestedScanFailed,
             output: aborted
-                ? `${outputs.join("\n\n")}\n\nCommand aborted.`.trim()
-                : outputs.join("\n\n"),
-            exitCode: aborted ? 130 : anyOk ? 0 : 1,
+                ? `${output}\n\nCommand aborted.`.trim()
+                : requestedScanFailed
+                    ? `${output}\n\nThe requested nmap scan failed or was not started; passive recon results above are partial only.`.trim()
+                    : output,
+            exitCode: aborted ? 130 : anyOk && !requestedScanFailed ? 0 : 1,
             ...(artifactPath ? { outputPath: artifactPath } : {}),
+            ...(backgroundJob ? { backgroundJob } : {}),
         };
     },
+    async "pentest.webDiscover"(args, options) {
+        const paths = Array.isArray(args.paths) ? args.paths.filter((value) => typeof value === "string") : [];
+        return discoverWebSurface(requireString(args, "baseUrl"), paths, options);
+    },
+    async "pentest.apiEnumerate"(args, options) {
+        return enumerateApi(requireString(args, "specUrl"), options);
+    },
+    async "pentest.authCompare"(args, options) {
+        const contexts = Array.isArray(args.contexts)
+            ? args.contexts.filter((value) => {
+                if (!value || typeof value !== "object" || Array.isArray(value))
+                    return false;
+                const candidate = value;
+                return typeof candidate.label === "string" && Boolean(candidate.headers) && typeof candidate.headers === "object" && !Array.isArray(candidate.headers);
+            })
+            : [];
+        return compareAuthorizationContexts(requireString(args, "url"), contexts, options);
+    },
+    async "pentest.scanStatus"(args) {
+        const offset = optionalNumber(args, "offset");
+        const bytes = optionalNumber(args, "bytes");
+        const stream = optionalString(args, "stream");
+        return jobManager.tailJob(requireString(args, "id"), {
+            ...(offset !== undefined ? { offset } : {}),
+            ...(bytes !== undefined ? { bytes } : {}),
+            ...(stream !== undefined ? { stream } : {}),
+        });
+    },
     async "tool.batch"(args, options) {
         return runToolBatch(args, options);
     },
@@ -473,9 +652,16 @@ export const toolRegistry = {
     async "pdf.read"(args, options) {
         return pdfRead(args, options);
     },
-    async "shell.start"(args) {
+    async "shell.start"(args, options) {
         const command = requireString(args, "command");
-        return jobManager.startJob(command, {
+        const elevated = await prepareElevatedBackgroundCommand(command, {
+            signal: options?.signal,
+            onOutput: options?.onOutput,
+            requestSecret: options?.requestSecret,
+        });
+        if (elevated && !elevated.prepared)
+            return elevated.result;
+        return jobManager.startJob(elevated?.prepared ? elevated.spec : command, {
             cwd: optionalString(args, "cwd"),
             name: optionalString(args, "name"),
         });
@@ -493,7 +679,18 @@ export const toolRegistry = {
         return fsEdit(requireString(args, "path"), requireString(args, "oldText"), requireString(args, "newText"), optionalNumber(args, "expectedReplacements"), { confirmed: options?.confirmed });
     },
     async "fs.replaceLines"(args, options) {
-        return fsReplaceLines(requireString(args, "path"), requireNumber(args, "startLine"), requireNumber(args, "endLine"), requireString(args, "content"), { confirmed: options?.confirmed });
+        // Empty content / delete:true removes the line range (X6).
+        let content;
+        if (args.delete === true) {
+            content = "";
+        }
+        else if (typeof args.content === "string") {
+            content = requireStringAllowEmpty(args, "content");
+        }
+        else {
+            throw new Error('Tool argument "content" must be a string (use "" or delete:true to delete the line range)');
+        }
+        return fsReplaceLines(requireString(args, "path"), requireNumber(args, "startLine"), requireNumber(args, "endLine"), content, { confirmed: options?.confirmed });
     },
     async "fs.append"(args, options) {
         return fsAppend(requireString(args, "path"), requireString(args, "content"), {
@@ -569,13 +766,25 @@ function buildShellCommandFromCall(name, args) {
  * dangerous commands are gated exactly as a hand-written shell.exec would be.
  */
 export function normalizeToolCall(call) {
-    if (toolRegistry[call.name])
-        return call;
-    const name = typeof call.name === "string" ? call.name.trim() : "";
+    // X1: strip channel/commentary tokens before registry lookup.
+    let name = typeof call.name === "string" ? call.name.trim() : "";
+    if (name && !toolRegistry[name]) {
+        const cleaned = sanitizeToolName(name);
+        const mapped = fromWireName(cleaned) ?? fromWireName(name) ?? cleaned;
+        if (mapped && toolRegistry[mapped]) {
+            return { name: mapped, args: call.args ?? {} };
+        }
+        if (cleaned && cleaned !== name)
+            name = cleaned;
+    }
+    if (toolRegistry[name]) {
+        return name === call.name ? call : { name, args: call.args ?? {} };
+    }
     // Leave genuinely unknown namespaced tools (e.g. a typo'd "fs.reed") to
     // surface a clear error rather than guessing at a shell command.
-    if (!name || name.includes(".") || name.includes("/"))
-        return call;
+    if (!name || name.includes(".") || name.includes("/")) {
+        return name === call.name ? call : { name, args: call.args ?? {} };
+    }
     const args = call.args ?? {};
     const command = buildShellCommandFromCall(name, args);
     if (!command)