omen-sec-cli 1.0.12 → 1.0.14

package/core/diff-engine.js

@@ -0,0 +1,35 @@
+import fs from 'fs/promises';
+import path from 'path';
+
+export async function compareWithPreviousScan() {
+  const historyDir = path.join(process.cwd(), '.omen', 'history');
+  try {
+    const files = await fs.readdir(historyDir);
+    if (files.length < 2) return null;
+
+    // Sort files by modification time to get the last two
+    const sortedFiles = files.map(async file => {
+      const stats = await fs.stat(path.join(historyDir, file));
+      return { name: file, mtime: stats.mtime };
+    });
+    const promisedFiles = await Promise.all(sortedFiles);
+    promisedFiles.sort((a, b) => b.mtime - a.mtime);
+
+    const [currentFile, previousFile] = promisedFiles;
+
+    const currentData = JSON.parse(await fs.readFile(path.join(historyDir, currentFile.name), 'utf-8'));
+    const previousData = JSON.parse(await fs.readFile(path.join(historyDir, previousFile.name), 'utf-8'));
+
+    const currentVulnIds = new Set(currentData.vulnerabilities.map(v => v.description)); // Use description for simple diff
+    const previousVulnIds = new Set(previousData.vulnerabilities.map(v => v.description));
+
+    const newVulnerabilities = currentData.vulnerabilities.filter(v => !previousVulnIds.has(v.description));
+    const fixedVulnerabilities = previousData.vulnerabilities.filter(v => !currentVulnIds.has(v.description));
+    const scoreDiff = currentData.score - previousData.score;
+
+    return { newVulnerabilities, fixedVulnerabilities, scoreDiff };
+
+  } catch (err) {
+    return null;
+  }
+}

package/core/engine.js

@@ -3,6 +3,7 @@ import { runScannerSteps } from './scanner.js';
 import { generateOutputs } from './generator.js';
 import { showCommunitySection } from '../ui/banner.js';
 import { getMassiveAIProtocol } from './ai-protocol.js';
+import { compareWithPreviousScan } from './diff-engine.js';
 
 export async function runScan(args) {
   const target = args.flags.local ? 'Local Project' : args.target;
@@ -20,7 +21,23 @@ export async function runScan(args) {
   
   await generateOutputs(scanData);
 
-  console.log(chalk.green(`\n[✔] Scan completed successfully!`));
+  // Compare with previous scan
+  const diff = await compareWithPreviousScan();
+  if (diff) {
+    console.log(chalk.bold('\n--- Scan Comparison ---'));
+    if (diff.newVulnerabilities.length > 0) {
+      console.log(chalk.red(`[+] ${diff.newVulnerabilities.length} New Vulnerabilities Found:`));
+      diff.newVulnerabilities.forEach(v => console.log(`    - ${v.description}`));
+    }
+    if (diff.fixedVulnerabilities.length > 0) {
+      console.log(chalk.green(`[✔] ${diff.fixedVulnerabilities.length} Vulnerabilities Fixed:`));
+      diff.fixedVulnerabilities.forEach(v => console.log(`    - ${v.description}`));
+    }
+    console.log(chalk.yellow(`Score Change: ${diff.scoreDiff > 0 ? '+' : ''}${diff.scoreDiff} points`));
+    console.log(chalk.gray('-----------------------\n'));
+  }
+
+  console.log(chalk.green(`[✔] Scan completed successfully!`));
   console.log(chalk.white(`    Report JSON: ./omen-reports/omen-report.json`));
   console.log(chalk.white(`    AI Prompt: ./omen-reports/omen-ai.txt\n`));
 

package/core/generator.js

@@ -6,18 +6,22 @@ import { getMassiveAIProtocol } from './ai-protocol.js';
 export async function generateOutputs(scanData) {
   const cwd = process.cwd();
   const outputDir = path.join(cwd, 'omen-reports');
+  const historyDir = path.join(cwd, '.omen', 'history');
 
-  // Criar a pasta se não existir
+  // Criar as pastas se não existirem
   try {
     await fs.mkdir(outputDir, { recursive: true });
+    await fs.mkdir(historyDir, { recursive: true });
   } catch (err) {
-    console.error(chalk.red(`Failed to create output directory: ${err.message}`));
+    console.error(chalk.red(`Failed to create output directories: ${err.message}`));
     return;
   }
+
+  const jsonContent = JSON.stringify(scanData, null, 2);
   
   // JSON Report
   const jsonReportPath = path.join(outputDir, 'omen-report.json');
-  await fs.writeFile(jsonReportPath, JSON.stringify(scanData, null, 2));
+  await fs.writeFile(jsonReportPath, jsonContent);
   console.log(` /omen-reports/omen-report.json`);
   
   // TXT Report
@@ -30,4 +34,9 @@ export async function generateOutputs(scanData) {
   const aiReportPath = path.join(outputDir, 'omen-ai.txt');
   await fs.writeFile(aiReportPath, getMassiveAIProtocol(scanData));
   console.log(` /omen-reports/omen-ai.txt`);
+
+  // Save historical report
+  const timestamp = new Date().toISOString().replace(/:/g, '-');
+  const historyReportPath = path.join(historyDir, `omen-report-${timestamp}.json`);
+  await fs.writeFile(historyReportPath, jsonContent);
 }

package/core/local-scanner.js

@@ -61,19 +61,23 @@ export async function scanLocalProject() {
     if (deps['lodash'] && deps['lodash'].match(/[~^]?4\.17\.[0-20]/)) {
       vulnerabilities.push({
         id: `LOC-VULN-${Date.now()}-1`,
-        type: 'Vulnerable Components',
+        category: 'Confirmed',
+        confidence: 'High',
         severity: 'High',
-        description: `Outdated dependency detected in package.json: lodash (${deps['lodash']}). Prototype Pollution risk.`,
-        cwe: 'CWE-1321'
+        description: `Outdated dependency detected in package.json: lodash (${deps['lodash']}). Known Prototype Pollution risk.`,
+        cwe: 'CWE-1321',
+        evidence: { file: 'package.json', finding: `lodash: ${deps['lodash']}` }
       });
     }
     if (deps['express'] && deps['express'].match(/[~^]?3\./)) {
       vulnerabilities.push({
         id: `LOC-VULN-${Date.now()}-2`,
-        type: 'Vulnerable Components',
+        category: 'Confirmed',
+        confidence: 'High',
         severity: 'High',
         description: `Severely outdated Express.js version (${deps['express']}) detected. Multiple CVEs exist.`,
-        cwe: 'CWE-1104'
+        cwe: 'CWE-1104',
+        evidence: { file: 'package.json', finding: `express: ${deps['express']}` }
       });
     }
   } catch (err) {
@@ -98,10 +102,12 @@ export async function scanLocalProject() {
         if (/(api_key|apikey|secret|password|token)\s*=\s*['"][a-zA-Z0-9_-]{10,}['"]/i.test(line)) {
           vulnerabilities.push({
             id: `LOC-VULN-${Date.now()}-3`,
-            type: 'Sensitive Data Exposure',
+            category: 'Confirmed',
+            confidence: 'Medium', // Could be a test key
             severity: 'Critical',
             description: `Potential hardcoded secret found in ${path.basename(file)} at line ${index + 1}`,
-            cwe: 'CWE-798'
+            cwe: 'CWE-798',
+            evidence: { file: path.basename(file), line: index + 1, code: line.trim() }
           });
         }
 
@@ -109,10 +115,12 @@ export async function scanLocalProject() {
         if (/eval\s*\(/.test(line)) {
           vulnerabilities.push({
             id: `LOC-VULN-${Date.now()}-4`,
-            type: 'Code Injection',
+            category: 'Confirmed',
+            confidence: 'High',
             severity: 'Critical',
             description: `Dangerous use of eval() detected in ${path.basename(file)} at line ${index + 1}`,
-            cwe: 'CWE-94'
+            cwe: 'CWE-94',
+            evidence: { file: path.basename(file), line: index + 1, code: line.trim() }
           });
         }
 
@@ -120,10 +128,12 @@ export async function scanLocalProject() {
         if (/SELECT.*FROM.*WHERE.*(\+|`|\${)/i.test(line)) {
           vulnerabilities.push({
             id: `LOC-VULN-${Date.now()}-5`,
-            type: 'SQL Injection',
+            category: 'Probable',
+            confidence: 'Medium',
             severity: 'Critical',
-            description: `Critical SQL Injection vulnerability (raw string concatenation) in ${path.basename(file)} at line ${index + 1}. Attacker can bypass authentication or dump the entire database.`,
-            cwe: 'CWE-89'
+            description: `Potential SQL Injection (raw string concatenation) in ${path.basename(file)} at line ${index + 1}.`,
+            cwe: 'CWE-89',
+            evidence: { file: path.basename(file), line: index + 1, code: line.trim() }
           });
         }
 
@@ -131,10 +141,12 @@ export async function scanLocalProject() {
         if (/(require|import)\s*\(['"]?.*(\+|`|\${)/i.test(line)) {
           vulnerabilities.push({
             id: `LOC-VULN-${Date.now()}-6`,
-            type: 'Local File Inclusion',
+            category: 'Probable',
+            confidence: 'Medium',
             severity: 'High',
             description: `Potential LFI detected in ${path.basename(file)} at line ${index + 1}. Dynamic loading of files based on user input can lead to sensitive data exposure.`,
-            cwe: 'CWE-22'
+            cwe: 'CWE-22',
+            evidence: { file: path.basename(file), line: index + 1, code: line.trim() }
           });
         }
 
@@ -142,10 +154,12 @@ export async function scanLocalProject() {
         if (/\.prototype\.[a-zA-Z0-9_]+\s*=\s*/.test(line)) {
           vulnerabilities.push({
             id: `LOC-VULN-${Date.now()}-7`,
-            type: 'Prototype Pollution Risk',
+            category: 'Hardening',
+            confidence: 'Low',
             severity: 'Medium',
             description: `Direct prototype modification in ${path.basename(file)} at line ${index + 1}. This can lead to Prototype Pollution if user input reaches this assignment.`,
-            cwe: 'CWE-1321'
+            cwe: 'CWE-1321',
+            evidence: { file: path.basename(file), line: index + 1, code: line.trim() }
           });
         }
 

package/core/remote-scanner.js

@@ -36,10 +36,12 @@ export async function scanRemoteTarget(targetUrl) {
       headers_analysis["Strict-Transport-Security"] = "Missing";
       vulnerabilities.push({
         id: `REM-VULN-${Date.now()}-1`,
-        type: 'Security Misconfiguration',
+        category: 'Hardening',
+        confidence: 'High',
         severity: 'Medium',
         description: `HSTS Header is missing. This lacks forced HTTPS enforcement for browsers that have already visited the site.`,
-        cwe: 'CWE-319'
+        cwe: 'CWE-319',
+        evidence: { request: { headers: { ...response.request.headers } }, response: { headers: response.headers } }
       });
     } else {
       headers_analysis["Strict-Transport-Security"] = headers['strict-transport-security'];
@@ -49,20 +51,24 @@ export async function scanRemoteTarget(targetUrl) {
       headers_analysis["Content-Security-Policy"] = "Missing";
       vulnerabilities.push({
         id: `REM-VULN-${Date.now()}-2`,
-        type: 'Security Misconfiguration',
+        category: 'Confirmed',
+        confidence: 'High',
         severity: 'High',
         description: `CSP header is missing. Without a strict Content-Security-Policy, the application is highly vulnerable to Cross-Site Scripting (XSS) and data injection attacks.`,
-        cwe: 'CWE-1022'
+        cwe: 'CWE-1022',
+        evidence: { request: { headers: { ...response.request.headers } }, response: { headers: response.headers } }
       });
     } else {
       headers_analysis["Content-Security-Policy"] = headers['content-security-policy'];
       if (headers['content-security-policy'].includes("unsafe-inline")) {
         vulnerabilities.push({
           id: `REM-VULN-${Date.now()}-3`,
-          type: 'Security Misconfiguration',
+          category: 'Confirmed',
+          confidence: 'High',
           severity: 'High',
           description: `Weak CSP detected: 'unsafe-inline' is allowed.`,
-          cwe: 'CWE-16'
+          cwe: 'CWE-16',
+          evidence: { finding: `policy: ${headers['content-security-policy']}` }
         });
       }
     }
@@ -72,10 +78,12 @@ export async function scanRemoteTarget(targetUrl) {
       headers_analysis["X-Frame-Options"] = "Missing";
       vulnerabilities.push({
         id: `REM-VULN-${Date.now()}-4`,
-        type: 'Security Misconfiguration',
+        category: 'Hardening',
+        confidence: 'High',
         severity: 'Low',
-        description: `Missing X-Frame-Options. Vulnerable to Clickjacking.`,
-        cwe: 'CWE-1021'
+        description: `Missing X-Frame-Options. Increases risk of Clickjacking.`,
+        cwe: 'CWE-1021',
+        evidence: { request: { headers: { ...response.request.headers } }, response: { headers: response.headers } }
       });
     } else {
       headers_analysis["X-Frame-Options"] = headers['x-frame-options'];
@@ -86,10 +94,12 @@ export async function scanRemoteTarget(targetUrl) {
       headers_analysis["Server"] = headers['server'];
       vulnerabilities.push({
         id: `REM-VULN-${Date.now()}-5`,
-        type: 'Information Exposure',
+        category: 'Informational',
+        confidence: 'High',
         severity: 'Low',
         description: `Server header leaks technology stack: ${headers['server']}`,
-        cwe: 'CWE-200'
+        cwe: 'CWE-200',
+        evidence: { finding: `Server: ${headers['server']}` }
       });
     } else {
       headers_analysis["Server"] = "Hidden (Good)";
@@ -99,10 +109,12 @@ export async function scanRemoteTarget(targetUrl) {
     if (headers['x-powered-by']) {
       vulnerabilities.push({
         id: `REM-VULN-${Date.now()}-6`,
-        type: 'Information Exposure',
+        category: 'Informational',
+        confidence: 'High',
         severity: 'Low',
         description: `X-Powered-By header leaks framework: ${headers['x-powered-by']}`,
-        cwe: 'CWE-200'
+        cwe: 'CWE-200',
+        evidence: { finding: `X-Powered-By: ${headers['x-powered-by']}` }
       });
     }
 
@@ -110,7 +122,7 @@ export async function scanRemoteTarget(targetUrl) {
     if (typeof html === 'string') {
       const $ = cheerio.load(html);
       
-      // Discover Links & Params
+      // Discover Links, Params, and JS files
       $('a').each((i, link) => {
         const href = $(link).attr('href');
         if (href && !href.startsWith('#') && !href.startsWith('mailto:')) {
@@ -119,7 +131,6 @@ export async function scanRemoteTarget(targetUrl) {
             if (absoluteUrl.startsWith(targetUrl)) {
               discoveredLinks.add(absoluteUrl);
               
-              // Extract query parameters
               const urlObj = new URL(absoluteUrl);
               urlObj.searchParams.forEach((value, name) => discoveredParams.add(name));
             }
@@ -127,6 +138,18 @@ export async function scanRemoteTarget(targetUrl) {
         }
       });
 
+      $('script[src]').each((i, script) => {
+        const src = $(script).attr('src');
+        if (src) {
+          try {
+            const absoluteUrl = new URL(src, targetUrl).href;
+            if (absoluteUrl.startsWith(targetUrl)) {
+              discoveredLinks.add(absoluteUrl);
+            }
+          } catch (e) {}
+        }
+      });
+
       // Discover Forms
       $('form').each((i, form) => {
         const action = $(form).attr('action') || '';
@@ -140,6 +163,46 @@ export async function scanRemoteTarget(targetUrl) {
       });
     }
 
+    // --- DEEP CRAWL: robots.txt, sitemap.xml, and JS files ---
+    const robotsUrl = new URL('/robots.txt', targetUrl).href;
+    try {
+      const robotsRes = await axios.get(robotsUrl, { timeout: 5000 });
+      const robotsLines = robotsRes.data.split('\n');
+      robotsLines.forEach(line => {
+        if (line.toLowerCase().startsWith('allow:') || line.toLowerCase().startsWith('disallow:')) {
+          const path = line.split(':')[1].trim();
+          if (path !== '/') discoveredLinks.add(new URL(path, targetUrl).href);
+        }
+        if (line.toLowerCase().startsWith('sitemap:')) {
+          discoveredLinks.add(line.split(':')[1].trim());
+        }
+      });
+    } catch (e) {}
+
+    // Process sitemaps and JS files found
+    const extraLinks = new Set();
+    for (const link of discoveredLinks) {
+      if (link.endsWith('.xml')) {
+        try {
+          const sitemapRes = await axios.get(link, { timeout: 5000 });
+          const $sitemap = cheerio.load(sitemapRes.data, { xmlMode: true });
+          $sitemap('loc').each((i, loc) => extraLinks.add($sitemap(loc).text()));
+        } catch (e) {}
+      } else if (link.endsWith('.js')) {
+        try {
+          const jsRes = await axios.get(link, { timeout: 10000 });
+          const jsContent = jsRes.data;
+          const paths = jsContent.match(/(['"])\/[a-zA-Z0-9_\-\/]+(\?.*)?\1/g) || [];
+          paths.forEach(path => {
+            const cleanPath = path.replace(/['"]/g, '');
+            extraLinks.add(new URL(cleanPath, targetUrl).href);
+          });
+        } catch (e) {}
+      }
+    }
+    extraLinks.forEach(link => discoveredLinks.add(link));
+
+
     // --- FUZZER (Path Discovery - Aggressive) ---
     const aggressivePaths = [
       '/.env', '/.git/config', '/admin', '/wp-admin', '/config.php', '/.vscode/settings.json', 
@@ -239,4 +302,75 @@ export async function scanRemoteTarget(targetUrl) {
     discoveredParams: Array.from(discoveredParams),
     vulnerabilities
   };
+}
+
+async function validateFuzzerFinding(path, response, url) {
+  const { status, data } = response;
+  const evidence = {
+    request: { url, method: 'GET' },
+    response: { status, headers: response.headers, body_snippet: typeof data === 'string' ? data.substring(0, 250) : '' }
+  };
+
+  // Rule 1: Detect soft 404s on 200 OK responses
+  if (status === 200 && typeof data === 'string' && /(page not found|could not be found|404)/i.test(data)) {
+    return null; // Ignore soft 404s as they are not interesting paths
+  }
+
+  // Rule 2: Handle truly sensitive file exposures
+  const isSensitiveFile = /\.env|\.git|\.ssh|config|credentials|password/i.test(path);
+  if (isSensitiveFile && status === 200) {
+    // If content is not HTML, it's likely the raw file
+    if (typeof data === 'string' && !data.trim().startsWith('<html')) {
+      return {
+        id: `REM-CONFIRMED-FILE-${Date.now()}`,
+        category: 'Confirmed',
+        confidence: 'High',
+        severity: 'Critical',
+        description: `CRITICAL: Sensitive file exposed at ${url}. Contents may contain credentials, private keys, or configuration secrets.`,
+        cwe: 'CWE-538', // File and Directory Information Exposure
+        evidence
+      };
+    }
+  }
+
+  // Rule 3: Analyze admin panel paths
+  const isAdminPath = /admin|dashboard|login/i.test(path);
+  if (isAdminPath && status === 200) {
+    if (typeof data === 'string' && /password|login/i.test(data)) {
+      return {
+        id: `REM-INFO-LOGIN-${Date.now()}`,
+        category: 'Informational',
+        confidence: 'High',
+        severity: 'Info',
+        description: `Admin login page discovered at ${url}. This is part of the attack surface.`,
+        cwe: 'CWE-200',
+        evidence
+      };
+    }
+    // If it's a 200 but not a login page, it could be an exposed panel
+    return {
+      id: `REM-PROBABLE-PANEL-${Date.now()}`,
+      category: 'Probable',
+      confidence: 'Medium',
+      severity: 'High',
+      description: `Potential exposed admin panel at ${url}. Manual verification required.`,
+      cwe: 'CWE-284', // Improper Access Control
+      evidence
+    };
+  }
+
+  // Rule 4: Treat 403 Forbidden as low-confidence informational
+  if (status === 403) {
+    return {
+      id: `REM-INFO-FORBIDDEN-${Date.now()}`,
+      category: 'Informational',
+      confidence: 'Low',
+      severity: 'Info',
+      description: `Path exists but is protected (403 Forbidden): ${url}. This confirms the path's existence.`,
+      cwe: 'CWE-406', // Insufficient Guarantees of Data Integrity
+      evidence
+    };
+  }
+
+  return null; // By default, not a significant finding
 }

package/core/scanner.js

@@ -48,16 +48,26 @@ export async function runScannerSteps(target, flags) {
     spinner.succeed(`[${i + 1}/${steps.length}] ${step.text}`);
   }
 
-  // Calculate dynamic score
+  // Calculate dynamic score based on confidence and severity
   const baseScore = 100;
   const penalties = allVulnerabilities.reduce((acc, v) => {
-    if (v.severity === 'Critical') return acc + 25;
-    if (v.severity === 'High') return acc + 15;
-    if (v.severity === 'Medium') return acc + 10;
-    return acc + 5;
+    // Only penalize for Confirmed or Probable issues
+    if (v.category !== 'Confirmed' && v.category !== 'Probable') return acc;
+
+    let severityWeight = 0;
+    if (v.severity === 'Critical') severityWeight = 25;
+    else if (v.severity === 'High') severityWeight = 15;
+    else if (v.severity === 'Medium') severityWeight = 10;
+    else if (v.severity === 'Low') severityWeight = 5;
+
+    let confidenceMultiplier = 1;
+    if (v.confidence === 'Medium') confidenceMultiplier = 0.6;
+    if (v.confidence === 'Low') confidenceMultiplier = 0.3;
+
+    return acc + (severityWeight * confidenceMultiplier);
   }, 0);
   
-  const finalScore = Math.max(0, baseScore - penalties);
+  const finalScore = Math.max(0, Math.round(baseScore - penalties));
   let riskLevel = 'Low';
   if (finalScore < 50) riskLevel = 'Critical';
   else if (finalScore < 70) riskLevel = 'High';

package/core/ui-server.js

@@ -13,6 +13,19 @@ export async function startUIServer() {
       const data = await fs.readFile(reportPath, 'utf-8');
       const report = JSON.parse(data);
 
+      const getSeverityClass = (severity) => {
+        if (severity === 'Critical') return 'text-red-500';
+        if (severity === 'High') return 'text-orange-500';
+        if (severity === 'Medium') return 'text-yellow-500';
+        return 'text-green-500';
+      };
+
+      const getConfidenceClass = (confidence) => {
+        if (confidence === 'High') return 'text-green-400';
+        if (confidence === 'Medium') return 'text-yellow-400';
+        return 'text-red-400';
+      };
+
       const html = `
       <!DOCTYPE html>
       <html lang="en">
@@ -22,76 +35,106 @@ export async function startUIServer() {
           <title>OMEN SEC-CLI Dashboard</title>
           <script src="https://cdn.tailwindcss.com"></script>
           <style>
-              body { background-color: #0a0a0c; color: #e0e0e0; font-family: 'Courier New', Courier, monospace; }
-              .card { background-color: #16161a; border: 1px solid #333; }
-              .critical { color: #ff4d4d; }
-              .high { color: #ff944d; }
-              .medium { color: #ffd11a; }
-              .low { color: #4dff88; }
+              body { background-color: #0a0a0c; color: #e0e0e0; font-family: 'Inter', sans-serif; }
+              .card { background-color: #16161a; border: 1px solid #2d2d3a; }
+              .tab { cursor: pointer; padding: 10px 15px; border-bottom: 2px solid transparent; }
+              .tab.active { border-bottom: 2px solid #ef4444; color: #ef4444; }
+              .collapsible { cursor: pointer; }
+              .content { display: none; }
+              pre { background-color: #000; padding: 10px; border-radius: 5px; overflow-x: auto; }
           </style>
       </head>
-      <body class="p-8">
-          <div class="max-w-6xl mx-auto">
+      <body class="p-4 md:p-8">
+          <div class="max-w-7xl mx-auto">
               <header class="flex justify-between items-center mb-8 border-b border-gray-800 pb-4">
-                  <h1 class="text-3xl font-bold tracking-tighter text-red-500">OMEN <span class="text-white">SEC-CLI</span></h1>
-                  <div class="text-right">
-                      <p class="text-gray-500">Scan ID: ${report.scan_id}</p>
-                      <p class="text-gray-500">${new Date(report.timestamp).toLocaleString()}</p>
+                  <h1 class="text-3xl font-bold tracking-tighter text-red-500">OMEN <span class="text-white">EVIDENCE-CENTER</span></h1>
+                  <div class="text-right text-sm">
+                      <p class="text-gray-400">Scan ID: ${report.scan_id}</p>
+                      <p class="text-gray-400">${new Date(report.timestamp).toLocaleString()}</p>
                   </div>
               </header>
 
-              <div class="grid grid-cols-1 md:grid-cols-4 gap-6 mb-8">
-                  <div class="card p-6 rounded-lg shadow-xl">
-                      <h3 class="text-gray-400 mb-2">Security Score</h3>
-                      <p class="text-5xl font-bold ${report.score < 50 ? 'critical' : report.score < 75 ? 'high' : 'low'}">${report.score}/100</p>
-                  </div>
-                  <div class="card p-6 rounded-lg shadow-xl">
-                      <h3 class="text-gray-400 mb-2">Risk Level</h3>
-                      <p class="text-5xl font-bold ${report.riskLevel === 'Critical' ? 'critical' : report.riskLevel === 'High' ? 'high' : 'low'}">${report.riskLevel}</p>
+              <!-- Tabs -->
+              <div class="flex border-b border-gray-700 mb-6">
+                  <div class="tab active" onclick="showTab('dashboard')">Dashboard</div>
+                  <div class="tab" onclick="showTab('findings')">Findings</div>
+                  <div class="tab" onclick="showTab('surface')">Attack Surface</div>
+                  <div class="tab" onclick="showTab('history')">History</div>
+              </div>
+
+              <!-- Dashboard Tab -->
+              <div id="dashboard" class="tab-content block">
+                  <div class="grid grid-cols-2 md:grid-cols-4 gap-4 mb-8">
+                      <div class="card p-4 rounded-lg"><h3 class="text-gray-400">Security Score</h3><p class="text-4xl font-bold ${getSeverityClass(report.riskLevel)}">${report.score}/100</p></div>
+                      <div class="card p-4 rounded-lg"><h3 class="text-gray-400">Risk Level</h3><p class="text-4xl font-bold ${getSeverityClass(report.riskLevel)}">${report.riskLevel}</p></div>
+                      <div class="card p-4 rounded-lg"><h3 class="text-gray-400">Confirmed</h3><p class="text-4xl font-bold">${report.vulnerabilities.filter(v => v.category === 'Confirmed').length}</p></div>
+                      <div class="card p-4 rounded-lg"><h3 class="text-gray-400">Probable</h3><p class="text-4xl font-bold">${report.vulnerabilities.filter(v => v.category === 'Probable').length}</p></div>
                   </div>
-                  <div class="card p-6 rounded-lg shadow-xl">
-                      <h3 class="text-gray-400 mb-2">Vulnerabilities</h3>
-                      <p class="text-5xl font-bold text-white">${report.vulnerabilities.length}</p>
+              </div>
+
+              <!-- Findings Tab -->
+              <div id="findings" class="tab-content hidden">
+                  <div class="card p-4 rounded-lg">
+                      <h2 class="text-xl font-bold mb-4">Vulnerability Details</h2>
+                      <div class="space-y-3">
+                          ${report.vulnerabilities.map((v, i) => `
+                              <div>
+                                  <div class="collapsible flex justify-between items-center p-3 bg-gray-800 rounded-t-lg" onclick="toggleCollapse(${i})">
+                                      <span class="font-bold ${getSeverityClass(v.severity)}">${v.severity}</span>
+                                      <span class="flex-1 mx-4">${v.description}</span>
+                                      <span class="${getConfidenceClass(v.confidence)}">${v.confidence} Confidence</span>
+                                  </div>
+                                  <div id="content-${i}" class="content p-4 bg-gray-900 rounded-b-lg">
+                                      <h4 class="font-bold mb-2">Evidence</h4>
+                                      <pre>${JSON.stringify(v.evidence, null, 2)}</pre>
+                                  </div>
+                              </div>
+                          `).join('')}
+                      </div>
                   </div>
-                  <div class="card p-6 rounded-lg shadow-xl">
-                      <h3 class="text-gray-400 mb-2">Attack Surface</h3>
-                      <p class="text-sm text-gray-400">Endpoints: ${report.attack_surface.endpoints_discovered}</p>
-                      <p class="text-sm text-gray-400">Forms: ${report.attack_surface.forms_detected}</p>
-                      <p class="text-sm text-gray-400">Tech: ${(report.attack_surface.tech_stack || []).join(', ')}</p>
+              </div>
+
+              <!-- Attack Surface Tab -->
+              <div id="surface" class="tab-content hidden">
+                  <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+                      <div class="card p-4 rounded-lg"> <h3 class="font-bold mb-2">Tech Stack</h3> <pre>${(report.attack_surface.tech_stack || []).join('\n')}</pre> </div>
+                      <div class="card p-4 rounded-lg"> <h3 class="font-bold mb-2">Forms</h3> <pre>${JSON.stringify(report.attack_surface.forms_detected, null, 2)}</pre> </div>
+                      <div class="card p-4 rounded-lg col-span-1 md:col-span-2"> <h3 class="font-bold mb-2">Discovered Links</h3> <pre class="max-h-96">${(report.attack_surface.endpoints_discovered || []).join('\n')}</pre> </div>
                   </div>
               </div>
 
-              <div class="card p-6 rounded-lg shadow-xl mb-8">
-                  <h2 class="text-xl font-bold mb-4 border-b border-gray-800 pb-2">Detected Vulnerabilities</h2>
-                  <div class="space-y-4">
-                      ${report.vulnerabilities.map(v => `
-                          <div class="border-l-4 ${v.severity === 'Critical' ? 'border-red-600' : v.severity === 'High' ? 'border-orange-500' : 'border-yellow-400'} bg-black bg-opacity-30 p-4 rounded">
-                              <div class="flex justify-between">
-                                  <h4 class="font-bold text-lg">${v.type}</h4>
-                                  <span class="px-2 py-1 rounded text-xs font-bold ${v.severity === 'Critical' ? 'bg-red-900 text-red-100' : v.severity === 'High' ? 'bg-orange-900 text-orange-100' : 'bg-yellow-900 text-yellow-100'}">${v.severity}</span>
-                              </div>
-                              <p class="text-gray-300 mt-2">${v.description}</p>
-                              <p class="text-gray-500 text-sm mt-1">CWE: ${v.cwe} | ID: ${v.id}</p>
-                          </div>
-                      `).join('')}
+              <!-- History Tab -->
+              <div id="history" class="tab-content hidden">
+                  <div class="card p-4 rounded-lg">
+                      <h2 class="text-xl font-bold mb-4">Scan History</h2>
+                      <p class="text-gray-400">Feature coming soon. Historical data is being saved in the .omen/history/ directory.</p>
                   </div>
               </div>
 
-              <footer class="text-center text-gray-600 mt-12">
-                  <p>OMEN Security Framework - v1.0.6</p>
-              </footer>
           </div>
+          <script>
+              function showTab(tabName) {
+                  document.querySelectorAll('.tab-content').forEach(tab => tab.classList.add('hidden'));
+                  document.getElementById(tabName).classList.remove('hidden');
+                  document.querySelectorAll('.tab').forEach(tab => tab.classList.remove('active'));
+                  document.querySelector(`[onclick="showTab('${tabName}')"]`).classList.add('active');
+              }
+              function toggleCollapse(index) {
+                  const content = document.getElementById('content-' + index);
+                  content.style.display = content.style.display === 'block' ? 'none' : 'block';
+              }
+          </script>
       </body>
       </html>
       `;
       res.send(html);
     } catch (err) {
-      res.status(500).send(`<h1>Error loading report</h1><p>Please run a scan first to generate omen-report.json</p>`);
+      res.status(500).send(`<h1>Error loading report</h1><p>Please run a scan first to generate omen-report.json. Error: ${err.message}</p>`);
     }
   });
 
   app.listen(port, () => {
-    console.log(chalk.cyan(`\n[OMEN UI] Dashboard is running at:`));
+    console.log(chalk.cyan(`\n[OMEN UI] Evidence Center is running at:`));
     console.log(chalk.bold.green(`    http://localhost:${port}\n`));
     console.log(chalk.gray(`Press Ctrl+C to stop the server.`));
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omen-sec-cli",
-  "version": "1.0.12",
+  "version": "1.0.14",
   "description": "OMEN — AI Security Engine",
   "main": "bin/index.js",
   "type": "module",