pentesting 0.1.9 → 0.1.11

package/dist/index.js

@@ -200,10 +200,139 @@ Analyze your situation honestly:
 
 Based on this reflection, propose 3 completely different approaches to try next.`;
 
+// src/config/agent-constants.ts
+var AGENT_STATUS = {
+  IDLE: "idle",
+  RUNNING: "running",
+  PAUSED: "paused",
+  STUCK: "stuck",
+  WAITING_INPUT: "waiting_input",
+  COMPLETED: "completed"
+};
+var PHASE_ID = {
+  RECON: "recon",
+  SCAN: "scan",
+  ENUM: "enum",
+  VULN: "vuln",
+  EXPLOIT: "exploit",
+  PRIVESC: "privesc",
+  PIVOT: "pivot",
+  PERSIST: "persist",
+  EXFIL: "exfil",
+  REPORT: "report"
+};
+var PHASE_STATUS = {
+  PENDING: "pending",
+  IN_PROGRESS: "in_progress",
+  COMPLETED: "completed",
+  FAILED: "failed",
+  SKIPPED: "skipped"
+};
+var THOUGHT_TYPE = {
+  OBSERVATION: "observation",
+  HYPOTHESIS: "hypothesis",
+  PLAN: "plan",
+  ACTION: "action",
+  RESULT: "result",
+  REFLECTION: "reflection",
+  STUCK: "stuck",
+  BREAKTHROUGH: "breakthrough"
+};
+var AGENT_EVENT = {
+  // Lifecycle
+  PLUGINS_LOADED: "plugins_loaded",
+  HOOKS_LOADED: "hooks_loaded",
+  COMMANDS_LOADED: "commands_loaded",
+  MCP_SERVER_ADDED: "mcp_server_added",
+  // Execution
+  ITERATION: "iteration",
+  THOUGHT: "thought",
+  RESPONSE: "response",
+  TOOL_CALL: "tool_call",
+  TOOL_RESULT: "tool_result",
+  COMMAND_EXECUTE: "command_execute",
+  // State changes
+  TARGET_SET: "target_set",
+  PHASE_CHANGE: "phase_change",
+  AGENT_SWITCH: "agent_switch",
+  PAUSED: "paused",
+  RESUMED: "resumed",
+  RESET: "reset",
+  // Discoveries
+  FINDING: "finding",
+  CREDENTIAL: "credential",
+  COMPROMISED: "compromised",
+  // Completion
+  COMPLETE: "complete",
+  REPORT: "report",
+  ERROR: "error",
+  HINT_RECEIVED: "hint_received"
+};
+var CLI_COMMAND = {
+  HELP: "help",
+  TARGET: "target",
+  START: "start",
+  STOP: "stop",
+  FINDINGS: "findings",
+  CLEAR: "clear",
+  EXIT: "exit"
+};
+var MESSAGE_TYPE = {
+  USER: "user",
+  ASSISTANT: "assistant",
+  TOOL: "tool",
+  THINKING: "thinking",
+  ERROR: "error",
+  SYSTEM: "system",
+  RESULT: "result"
+};
+var TOOL_NAME = {
+  // System
+  BASH: "bash",
+  READ_FILE: "read_file",
+  WRITE_FILE: "write_file",
+  LIST_DIRECTORY: "list_directory",
+  // Network
+  NMAP_SCAN: "nmap_scan",
+  TCPDUMP_CAPTURE: "tcpdump_capture",
+  // Web
+  WEB_REQUEST: "web_request",
+  DIRECTORY_BRUTEFORCE: "directory_bruteforce",
+  SQL_INJECTION: "sql_injection",
+  BROWSER_AUTOMATION: "browser_automation",
+  // Exploit
+  SEARCHSPLOIT: "searchsploit",
+  METASPLOIT: "metasploit",
+  GENERATE_PAYLOAD: "generate_payload",
+  // Credential
+  BRUTEFORCE_LOGIN: "bruteforce_login",
+  CRACK_HASH: "crack_hash",
+  DUMP_CREDENTIALS: "dump_credentials",
+  // Privilege Escalation
+  CHECK_SUDO: "check_sudo",
+  FIND_SUID: "find_suid",
+  RUN_PRIVESC_ENUM: "run_privesc_enum",
+  // Post-Exploitation
+  SETUP_TUNNEL: "setup_tunnel",
+  LATERAL_MOVEMENT: "lateral_movement",
+  // Reporting
+  REPORT_FINDING: "report_finding",
+  TAKE_SCREENSHOT: "take_screenshot"
+};
+var SENSITIVE_TOOLS = [
+  TOOL_NAME.WRITE_FILE,
+  TOOL_NAME.BRUTEFORCE_LOGIN,
+  TOOL_NAME.METASPLOIT,
+  TOOL_NAME.SQL_INJECTION,
+  TOOL_NAME.DUMP_CREDENTIALS,
+  TOOL_NAME.GENERATE_PAYLOAD,
+  TOOL_NAME.LATERAL_MOVEMENT
+];
+
 // src/core/tools/tool-definitions.ts
 var SYSTEM_TOOLS = [
   {
-    name: "bash",
+    name: TOOL_NAME.BASH,
     description: `Execute any bash command. This is your primary tool for interacting with the system.
     
 IMPORTANT:
@@ -224,7 +353,7 @@ IMPORTANT:
     }
   },
   {
-    name: "read_file",
+    name: TOOL_NAME.READ_FILE,
     description: "Read file contents. Use for configs, source code, logs, data files.",
     input_schema: {
       type: "object",
@@ -237,7 +366,7 @@ IMPORTANT:
     }
   },
   {
-    name: "write_file",
+    name: TOOL_NAME.WRITE_FILE,
     description: "Write content to file. Use for scripts, payloads, configs, reports.",
     input_schema: {
       type: "object",
@@ -250,7 +379,7 @@ IMPORTANT:
     }
   },
   {
-    name: "list_directory",
+    name: TOOL_NAME.LIST_DIRECTORY,
     description: "List directory contents with file details.",
     input_schema: {
       type: "object",
@@ -265,7 +394,7 @@ IMPORTANT:
 ];
 var NETWORK_TOOLS = [
   {
-    name: "nmap_scan",
+    name: TOOL_NAME.NMAP_SCAN,
     description: `Network scanning with nmap.
     
 SCAN TYPES:
@@ -294,7 +423,7 @@ SCAN TYPES:
     }
   },
   {
-    name: "tcpdump_capture",
+    name: TOOL_NAME.TCPDUMP_CAPTURE,
     description: `Capture network traffic with tcpdump.
     
 Use for:
@@ -317,7 +446,7 @@ Use for:
 ];
 var WEB_TOOLS = [
   {
-    name: "web_request",
+    name: TOOL_NAME.WEB_REQUEST,
     description: `Make HTTP requests with full control. Use curl under the hood.
     
 Use for:
@@ -340,7 +469,7 @@ Use for:
     }
   },
   {
-    name: "directory_bruteforce",
+    name: TOOL_NAME.DIRECTORY_BRUTEFORCE,
     description: `Directory/file bruteforcing with gobuster or ffuf.
     
 MODES:
@@ -361,7 +490,7 @@ MODES:
     }
   },
   {
-    name: "sql_injection",
+    name: TOOL_NAME.SQL_INJECTION,
     description: `SQL injection testing with sqlmap.
     
 Automatically:
@@ -384,7 +513,7 @@ Automatically:
     }
   },
   {
-    name: "browser_automation",
+    name: TOOL_NAME.BROWSER_AUTOMATION,
     description: `Headless browser automation with Playwright.
     
 Use for:
@@ -413,7 +542,7 @@ Use for:
 ];
 var EXPLOIT_TOOLS = [
   {
-    name: "searchsploit",
+    name: TOOL_NAME.SEARCHSPLOIT,
     description: "Search Exploit-DB for exploits matching service/version.",
     input_schema: {
       type: "object",
@@ -427,7 +556,7 @@ var EXPLOIT_TOOLS = [
     }
   },
   {
-    name: "metasploit",
+    name: TOOL_NAME.METASPLOIT,
     description: `Execute Metasploit commands.
     
 Use for:
@@ -444,7 +573,7 @@ Use for:
     }
   },
   {
-    name: "generate_payload",
+    name: TOOL_NAME.GENERATE_PAYLOAD,
     description: `Generate custom payloads with msfvenom.
     
 PAYLOAD TYPES:
@@ -469,7 +598,7 @@ PAYLOAD TYPES:
 ];
 var CREDENTIAL_TOOLS = [
   {
-    name: "bruteforce_login",
+    name: TOOL_NAME.BRUTEFORCE_LOGIN,
     description: `Password bruteforce attack with hydra.
     
 SERVICES: ssh, ftp, telnet, http-get, http-post-form, smb, rdp, mysql, mssql, vnc`,
@@ -488,7 +617,7 @@ SERVICES: ssh, ftp, telnet, http-get, http-post-form, smb, rdp, mysql, mssql, vn
     }
   },
   {
-    name: "crack_hash",
+    name: TOOL_NAME.CRACK_HASH,
     description: `Crack password hashes with john or hashcat.
     
 HASH MODES (hashcat):
@@ -513,7 +642,7 @@ HASH MODES (hashcat):
 ];
 var PRIVESC_TOOLS = [
   {
-    name: "run_privesc_enum",
+    name: TOOL_NAME.RUN_PRIVESC_ENUM,
     description: `Run privilege escalation enumeration scripts.
     
 SCRIPTS:
@@ -532,7 +661,7 @@ SCRIPTS:
     }
   },
   {
-    name: "check_sudo",
+    name: TOOL_NAME.CHECK_SUDO,
     description: "Check sudo permissions and potential escalation paths.",
     input_schema: {
       type: "object",
@@ -542,7 +671,7 @@ SCRIPTS:
     }
   },
   {
-    name: "find_suid",
+    name: TOOL_NAME.FIND_SUID,
     description: "Find SUID/SGID binaries and check for escalation.",
     input_schema: {
       type: "object",
@@ -554,7 +683,7 @@ SCRIPTS:
 ];
 var POST_EXPLOIT_TOOLS = [
   {
-    name: "setup_tunnel",
+    name: TOOL_NAME.SETUP_TUNNEL,
     description: `Set up network tunneling for pivoting.
     
 TOOLS:
@@ -574,7 +703,7 @@ TOOLS:
     }
   },
   {
-    name: "dump_credentials",
+    name: TOOL_NAME.DUMP_CREDENTIALS,
     description: `Extract credentials from compromised system.
     
 METHODS:
@@ -593,7 +722,7 @@ METHODS:
     }
   },
   {
-    name: "lateral_movement",
+    name: TOOL_NAME.LATERAL_MOVEMENT,
     description: `Move laterally to other systems.
     
 METHODS:
@@ -617,7 +746,7 @@ METHODS:
 ];
 var REPORT_TOOLS = [
   {
-    name: "report_finding",
+    name: TOOL_NAME.REPORT_FINDING,
     description: "Document a security finding with proper categorization.",
     input_schema: {
       type: "object",
@@ -635,7 +764,7 @@ var REPORT_TOOLS = [
     }
   },
   {
-    name: "take_screenshot",
+    name: TOOL_NAME.TAKE_SCREENSHOT,
     description: "Capture evidence screenshot of terminal or browser.",
     input_schema: {
       type: "object",
@@ -1252,13 +1381,25 @@ var AGENT_CONFIG = {
   maxIterations: 200,
   maxToolCallsPerIteration: 10,
   autoApprove: false,
-  sensitiveTools: ["credential_attack", "write_file", "metasploit", "generate_payload"],
+  sensitiveTools: SENSITIVE_TOOLS,
   defaultTimeout: 6e4,
   longRunningTimeout: 6e5,
   stuckThreshold: 5,
   stuckTimeThreshold: 3e5,
   maxPhaseAttempts: 20
 };
+var PENTEST_PHASES = [
+  { id: PHASE_ID.RECON, name: "Reconnaissance", description: "Information gathering" },
+  { id: PHASE_ID.SCAN, name: "Scanning", description: "Port and service scanning" },
+  { id: PHASE_ID.ENUM, name: "Enumeration", description: "Deep service enumeration" },
+  { id: PHASE_ID.VULN, name: "Vulnerability Analysis", description: "Vulnerability identification" },
+  { id: PHASE_ID.EXPLOIT, name: "Exploitation", description: "Gaining access" },
+  { id: PHASE_ID.PRIVESC, name: "Privilege Escalation", description: "Elevating privileges" },
+  { id: PHASE_ID.PIVOT, name: "Pivoting", description: "Lateral movement" },
+  { id: PHASE_ID.PERSIST, name: "Persistence", description: "Maintaining access" },
+  { id: PHASE_ID.EXFIL, name: "Data Exfiltration", description: "Data extraction" },
+  { id: PHASE_ID.REPORT, name: "Reporting", description: "Documentation" }
+];
 
 // src/core/agent/agent-loader.ts
 import * as fs2 from "fs/promises";
@@ -1923,36 +2064,36 @@ var AutonomousHackingAgent = class extends EventEmitter3 {
     try {
       const agentsDir = new URL("../../../../plugins/pentesting-core/agents", import.meta.url).pathname;
       this.pluginAgents = await loadAllAgents(agentsDir);
-      this.emit("plugins_loaded", { agents: this.pluginAgents.length });
+      this.emit(AGENT_EVENT.PLUGINS_LOADED, { agents: this.pluginAgents.length });
       await this.hookExecutor.initialize();
-      this.emit("hooks_loaded");
+      this.emit(AGENT_EVENT.HOOKS_LOADED);
       await this.commandRegistry.initialize();
-      this.emit("commands_loaded");
+      this.emit(AGENT_EVENT.COMMANDS_LOADED);
     } catch {
     }
   }
   // Add MCP server at runtime
   async addMCPServer(name, command, args) {
     await this.mcpManager.addServer(name, { command, args });
-    this.emit("mcp_server_added", { name });
+    this.emit(AGENT_EVENT.MCP_SERVER_ADDED, { name });
   }
   // Web search capabilities
   async webSearch(query) {
-    this.think("observation", `Web search: ${query}`);
+    this.think(THOUGHT_TYPE.OBSERVATION, `Web search: ${query}`);
     const results = await searchDuckDuckGo(query);
-    this.think("result", `Found ${results.length} results`);
+    this.think(THOUGHT_TYPE.RESULT, `Found ${results.length} results`);
     return results;
   }
   async searchForCVE(query) {
-    this.think("observation", `CVE search: ${query}`);
+    this.think(THOUGHT_TYPE.OBSERVATION, `CVE search: ${query}`);
     const results = await searchCVE(query);
-    this.think("result", `Found ${results.length} CVE results`);
+    this.think(THOUGHT_TYPE.RESULT, `Found ${results.length} CVE results`);
     return results;
   }
   async searchForExploits(query) {
-    this.think("observation", `Exploit search: ${query}`);
+    this.think(THOUGHT_TYPE.OBSERVATION, `Exploit search: ${query}`);
     const results = await searchExploits(query);
-    this.think("result", `Found ${results.length} exploit results`);
+    this.think(THOUGHT_TYPE.RESULT, `Found ${results.length} exploit results`);
     return results;
   }
   // Process slash command
@@ -1964,8 +2105,8 @@ var AutonomousHackingAgent = class extends EventEmitter3 {
       return `Unknown command: /${parsed.command}
 ${await this.commandRegistry.getHelp()}`;
     }
-    this.think("plan", `Executing command: /${cmd.name}`);
-    this.emit("command_execute", { command: cmd.name, args: parsed.rawArgs });
+    this.think(THOUGHT_TYPE.PLAN, `Executing command: /${cmd.name}`);
+    this.emit(AGENT_EVENT.COMMAND_EXECUTE, { command: cmd.name, args: parsed.rawArgs });
     return cmd.content;
   }
   // Switch to specialized agent
@@ -1975,8 +2116,8 @@ ${await this.commandRegistry.getHelp()}`;
     );
     if (agent) {
       this.currentAgent = agent;
-      this.think("plan", `Switching to specialized agent: ${agent.name}`);
-      this.emit("agent_switch", agent);
+      this.think(THOUGHT_TYPE.PLAN, `Switching to specialized agent: ${agent.name}`);
+      this.emit(AGENT_EVENT.AGENT_SWITCH, agent);
       return true;
     }
     return false;
@@ -1988,7 +2129,7 @@ ${await this.commandRegistry.getHelp()}`;
   // ===== State Management =====
   createInitialState() {
     return {
-      status: "idle",
+      status: AGENT_STATUS.IDLE,
       target: {
         primary: "",
         discovered: [],
@@ -2015,7 +2156,7 @@ ${await this.commandRegistry.getHelp()}`;
     return { ...this.state };
   }
   getPhaseProgress() {
-    const completed = this.state.phases.filter((p) => p.status === "completed").length;
+    const completed = this.state.phases.filter((p) => p.status === PHASE_STATUS.COMPLETED).length;
     return {
       completed,
       full: this.state.phases.length,
@@ -2032,13 +2173,13 @@ ${await this.commandRegistry.getHelp()}`;
       phase: this.state.currentPhase
     };
     this.state.thoughts.push(thought);
-    this.emit("thought", thought);
+    this.emit(AGENT_EVENT.THOUGHT, thought);
   }
   // ===== Target Setting =====
   setTarget(target) {
     this.state.target.primary = target;
-    this.think("observation", `Target Setting: ${target}`);
-    this.emit("target_set", target);
+    this.think(THOUGHT_TYPE.OBSERVATION, `Target Setting: ${target}`);
+    this.emit(AGENT_EVENT.TARGET_SET, target);
   }
   // ===== Phase Management =====
   getCurrentPhase() {
@@ -2051,21 +2192,21 @@ ${await this.commandRegistry.getHelp()}`;
       phase.status = status;
       if (status === "in_progress" && !phase.startTime) {
         phase.startTime = /* @__PURE__ */ new Date();
-      } else if ((status === "completed" || status === "failed") && !phase.endTime) {
+      } else if ((status === PHASE_STATUS.COMPLETED || status === PHASE_STATUS.FAILED) && !phase.endTime) {
         phase.endTime = /* @__PURE__ */ new Date();
       }
-      this.emit("phase_change", { phaseId, oldStatus, newStatus: status });
-      this.think("observation", `Phase status changed: ${phase.shortName} (${oldStatus} \u2192 ${status})`);
+      this.emit(AGENT_EVENT.PHASE_CHANGE, { phaseId, oldStatus, newStatus: status });
+      this.think(THOUGHT_TYPE.OBSERVATION, `Phase status changed: ${phase.shortName} (${oldStatus} \u2192 ${status})`);
     }
   }
   advanceToNextPhase() {
     const currentIndex = this.state.phases.findIndex((p) => p.id === this.state.currentPhase);
     if (currentIndex < this.state.phases.length - 1) {
       const nextPhase = this.state.phases[currentIndex + 1];
-      this.setPhaseStatus(this.state.currentPhase, "completed");
+      this.setPhaseStatus(this.state.currentPhase, PHASE_STATUS.COMPLETED);
       this.state.currentPhase = nextPhase.id;
       this.setPhaseStatus(nextPhase.id, "in_progress");
-      this.think("plan", `Advancing to next phase: ${nextPhase.shortName}`);
+      this.think(THOUGHT_TYPE.PLAN, `Advancing to next phase: ${nextPhase.shortName}`);
       this.resetStuckCounter();
       return true;
     }
@@ -2075,16 +2216,16 @@ ${await this.commandRegistry.getHelp()}`;
   checkIfStuck() {
     const currentPhase = this.getCurrentPhase();
     if (currentPhase.attempts > this.MAX_PHASE_ATTEMPTS) {
-      this.think("stuck", `[!] Rabbit hole detected: ${currentPhase.attempts} attempts in ${currentPhase.shortName} phase`);
+      this.think(THOUGHT_TYPE.STUCK, `[!] Rabbit hole detected: ${currentPhase.attempts} attempts in ${currentPhase.shortName} phase`);
       return true;
     }
     const timeSinceProgress = Date.now() - this.state.lastProgressTime.getTime();
     if (timeSinceProgress > this.STUCK_TIME_THRESHOLD) {
-      this.think("stuck", `[!] Rabbit hole detected: No progress for ${Math.round(timeSinceProgress / 6e4)} minutes`);
+      this.think(THOUGHT_TYPE.STUCK, `[!] Rabbit hole detected: No progress for ${Math.round(timeSinceProgress / 6e4)} minutes`);
       return true;
     }
     if (this.state.stuckCounter > this.STUCK_THRESHOLD) {
-      this.think("stuck", `[!] Rabbit hole detected: Same pattern ${this.state.stuckCounter} times repeated`);
+      this.think(THOUGHT_TYPE.STUCK, `[!] Rabbit hole detected: Same pattern ${this.state.stuckCounter} times repeated`);
       return true;
     }
     return false;
@@ -2103,7 +2244,7 @@ ${await this.commandRegistry.getHelp()}`;
   }
   // ===== Self Reflection =====
   async performSelfReflection() {
-    this.think("reflection", "[reflect] Starting self-reflection...");
+    this.think(THOUGHT_TYPE.REFLECTION, "[reflect] Starting self-reflection...");
     const reflectionPrompt = `
 ${SELF_REFLECTION_PROMPT}
 
@@ -2124,7 +2265,7 @@ What went wrong and what different approach should be tried?
       messages: [{ role: "user", content: reflectionPrompt }]
     });
     const reflection = response.content.filter((b) => b.type === "text").map((b) => b.text).join("\n");
-    this.think("reflection", reflection);
+    this.think(THOUGHT_TYPE.REFLECTION, reflection);
     return reflection;
   }
   // ===== Progress Detection =====
@@ -2133,16 +2274,16 @@ What went wrong and what different approach should be tried?
     this.state.lastProgressTime = /* @__PURE__ */ new Date();
     switch (type) {
       case "discovery":
-        this.think("breakthrough", "[target] New target discovered!");
+        this.think(THOUGHT_TYPE.BREAKTHROUGH, "[target] New target discovered!");
         break;
       case "credential":
-        this.think("breakthrough", "[cred] Credential obtained!");
+        this.think(THOUGHT_TYPE.BREAKTHROUGH, "[cred] Credential obtained!");
         break;
       case "access":
-        this.think("breakthrough", "[access] Access obtained!");
+        this.think(THOUGHT_TYPE.BREAKTHROUGH, "[access] Access obtained!");
         break;
       case "exploit":
-        this.think("breakthrough", "[exploit] Exploit successful!");
+        this.think(THOUGHT_TYPE.BREAKTHROUGH, "[exploit] Exploit successful!");
         this.state.successfulExploits++;
         break;
     }
@@ -2156,7 +2297,7 @@ What went wrong and what different approach should be tried?
     };
     this.state.findings.push(newFinding);
     this.getCurrentPhase().findings.push(newFinding);
-    this.emit("finding", newFinding);
+    this.emit(AGENT_EVENT.FINDING, newFinding);
     if (finding.severity === "critical" || finding.severity === "high") {
       this.recordProgress("discovery");
     }
@@ -2164,55 +2305,55 @@ What went wrong and what different approach should be tried?
   addCredential(cred) {
     this.state.target.credentials.push(cred);
     this.recordProgress("credential");
-    this.emit("credential", cred);
-    this.think("observation", `Credential obtained: ${cred.type} - ${cred.username || "unknown"}@${cred.source}`);
+    this.emit(AGENT_EVENT.CREDENTIAL, cred);
+    this.think(THOUGHT_TYPE.OBSERVATION, `Credential obtained: ${cred.type} - ${cred.username || "unknown"}@${cred.source}`);
   }
   addCompromisedHost(host) {
     if (!this.state.target.compromised.includes(host)) {
       this.state.target.compromised.push(host);
       this.recordProgress("access");
-      this.emit("compromised", host);
-      this.think("breakthrough", `Host compromised: ${host}`);
+      this.emit(AGENT_EVENT.COMPROMISED, host);
+      this.think(THOUGHT_TYPE.BREAKTHROUGH, `Host compromised: ${host}`);
     }
   }
   // ===== Main Autonomous Execution Loop =====
   async runAutonomous(objective) {
     if (!this.state.target.primary) {
-      this.emit("error", new Error("Target not set"));
+      this.emit(AGENT_EVENT.ERROR, new Error("Target not set"));
       return;
     }
-    this.state.status = "running";
+    this.state.status = AGENT_STATUS.RUNNING;
     this.setPhaseStatus("recon", "in_progress");
     const mainObjective = objective || `
 Target ${this.state.target.primary} - performing full penetration test.
 Goal: Deep penetration to obtain root/system privileges, extract internal data, map entire network.
 `;
-    this.think("plan", `Autonomous hacking started: ${mainObjective}`);
+    this.think(THOUGHT_TYPE.PLAN, `Autonomous hacking started: ${mainObjective}`);
     this.state.history.push({
       role: "user",
       content: mainObjective
     });
     let iteration = 0;
     const maxIterations = this.config.maxIterations;
-    while (iteration < maxIterations && this.state.status === "running") {
+    while (iteration < maxIterations && this.state.status === AGENT_STATUS.RUNNING) {
       iteration++;
       this.state.iteration = iteration;
       this.getCurrentPhase().attempts++;
       this.state.fullAttempts++;
-      this.emit("iteration", { current: iteration, max: maxIterations, phase: this.state.currentPhase });
+      this.emit(AGENT_EVENT.ITERATION, { current: iteration, max: maxIterations, phase: this.state.currentPhase });
       try {
         if (this.checkIfStuck()) {
-          this.state.status = "stuck";
+          this.state.status = AGENT_STATUS.STUCK;
           const reflection = await this.performSelfReflection();
           const shouldSkip = await this.decideNextAction(reflection);
           if (shouldSkip) {
             this.setPhaseStatus(this.state.currentPhase, "skipped");
             if (!this.advanceToNextPhase()) {
-              this.think("observation", "All phases completed or skipped");
+              this.think(THOUGHT_TYPE.OBSERVATION, "All phases completed or skipped");
               break;
             }
           }
-          this.state.status = "running";
+          this.state.status = AGENT_STATUS.RUNNING;
           this.resetStuckCounter();
           continue;
         }
@@ -2220,25 +2361,25 @@ Goal: Deep penetration to obtain root/system privileges, extract internal data,
         await this.analyzeResponse(response);
         if (this.shouldAdvancePhase()) {
           if (!this.advanceToNextPhase()) {
-            this.think("observation", "[done] All phases completed!");
+            this.think(THOUGHT_TYPE.OBSERVATION, "[done] All phases completed!");
             break;
           }
         }
       } catch (error) {
         this.state.failedAttempts++;
-        this.think("result", `[-] Error: ${error.message}`);
-        this.emit("error", error);
+        this.think(THOUGHT_TYPE.RESULT, `[-] Error: ${error.message}`);
+        this.emit(AGENT_EVENT.ERROR, error);
         await this.attemptRecovery(error);
       }
     }
-    this.state.status = "completed";
+    this.state.status = AGENT_STATUS.COMPLETED;
     await this.generateFinalReport();
-    this.emit("complete", this.getSummary());
+    this.emit(AGENT_EVENT.COMPLETE, this.getSummary());
   }
   // ===== Step Execution =====
   async executeStep() {
     const contextPrompt = this.buildContextPrompt();
-    this.think("plan", "Deciding next action...");
+    this.think(THOUGHT_TYPE.PLAN, "Deciding next action...");
     const historyMessages = this.state.history.map(toMessageParam);
     const messages = [
       ...historyMessages,
@@ -2266,7 +2407,7 @@ Goal: Deep penetration to obtain root/system privileges, extract internal data,
 === Current Status ===
 Target: ${this.state.target.primary}
 Current phase: ${phase.shortName} (${phase.name})
-Phase progress: ${this.state.phases.filter((p) => p.status === "completed").length}/${this.state.phases.length}
+Phase progress: ${this.state.phases.filter((p) => p.status === PHASE_STATUS.COMPLETED).length}/${this.state.phases.length}
 Compromised hosts: ${this.state.target.compromised.join(", ") || "none"}
 
 === Discovered Services ===
@@ -2293,8 +2434,8 @@ Use report_finding tool for important discoveries.
       if (block.type === "text") {
         textResponse += block.text;
         contentBlocks.push({ type: "text", text: block.text });
-        this.think("observation", block.text.slice(0, 500));
-        this.emit("response", block.text);
+        this.think(THOUGHT_TYPE.OBSERVATION, block.text.slice(0, 500));
+        this.emit(AGENT_EVENT.RESPONSE, block.text);
       } else if (block.type === "tool_use") {
         const toolName = block.name;
         const toolInput = block.input;
@@ -2306,15 +2447,15 @@ Use report_finding tool for important discoveries.
         });
         const actionKey = `${toolName}:${JSON.stringify(toolInput).slice(0, 100)}`;
         this.trackAction(actionKey);
-        this.think("action", `[tool] Tool execution: ${toolName}`);
-        this.emit("tool_call", { id: block.id, name: toolName, input: toolInput });
+        this.think(THOUGHT_TYPE.ACTION, `[tool] Tool execution: ${toolName}`);
+        this.emit(AGENT_EVENT.TOOL_CALL, { id: block.id, name: toolName, input: toolInput });
         const result = await executeToolCall(toolName, toolInput);
         const resultType = result.success ? "result" : "result";
         this.think(
           resultType,
           result.success ? `[+] ${toolName} Success: ${result.output.slice(0, 200)}...` : `[-] ${toolName} Failed: ${result.error}`
         );
-        this.emit("tool_result", { id: block.id, name: toolName, result });
+        this.emit(AGENT_EVENT.TOOL_RESULT, { id: block.id, name: toolName, result });
         this.extractIntelligence(toolName, result);
         this.state.history.push({
           role: "assistant",
@@ -2378,14 +2519,14 @@ Use report_finding tool for important discoveries.
       passwordPatterns.forEach((pattern) => {
         const matches = result.output.match(pattern);
         if (matches) {
-          this.think("observation", `Potential credentials found: ${matches.slice(0, 3).join(", ")}`);
+          this.think(THOUGHT_TYPE.OBSERVATION, `Potential credentials found: ${matches.slice(0, 3).join(", ")}`);
         }
       });
     }
     const cveMatches = result.output.match(/CVE-\d{4}-\d+/gi);
     if (cveMatches) {
       cveMatches.forEach((cve) => {
-        this.think("observation", `CVE found: ${cve}`);
+        this.think(THOUGHT_TYPE.OBSERVATION, `CVE found: ${cve}`);
       });
     }
     if (output.includes("meterpreter") || output.includes("shell session") || output.includes("www-data") || output.includes("uid=")) {
@@ -2431,11 +2572,11 @@ Use report_finding tool for important discoveries.
   }
   // ===== Recovery Attempt =====
   async attemptRecovery(error) {
-    this.think("reflection", `Attempting recovery: ${error.message}`);
+    this.think(THOUGHT_TYPE.REFLECTION, `Attempting recovery: ${error.message}`);
     if (error.message.includes("timeout")) {
-      this.think("plan", "Timeout - retrying with shorter command");
+      this.think(THOUGHT_TYPE.PLAN, "Timeout - retrying with shorter command");
     } else if (error.message.includes("permission")) {
-      this.think("plan", "Permission error - trying different approach");
+      this.think(THOUGHT_TYPE.PLAN, "Permission error - trying different approach");
     }
   }
   // ===== Final Report Generation =====
@@ -2480,8 +2621,8 @@ ${this.state.phases.map((p) => `- **${p.shortName}**: ${p.status} (${p.attempts}
 Based on the findings, the following remediation steps are recommended:
 ${this.state.findings.filter((f) => f.severity !== "info").map((f) => `- Address: ${f.title}`).join("\n")}
 `;
-    this.setPhaseStatus("report", "completed");
-    this.emit("report", report);
+    this.setPhaseStatus(PHASE_ID.REPORT, PHASE_STATUS.COMPLETED);
+    this.emit(AGENT_EVENT.REPORT, report);
     return report;
   }
   // ===== Summary =====
@@ -2499,29 +2640,29 @@ ${this.state.findings.filter((f) => f.severity !== "info").map((f) => `- Address
   }
   // ===== User Hint Processing =====
   async processUserHint(hint) {
-    this.think("observation", `User hint: ${hint}`);
+    this.think(THOUGHT_TYPE.OBSERVATION, `User hint: ${hint}`);
     this.state.history.push({
       role: "user",
       content: `[User hint] ${hint}`
     });
     this.resetStuckCounter();
-    this.emit("hint_received", hint);
+    this.emit(AGENT_EVENT.HINT_RECEIVED, hint);
   }
   // ===== Pause/Resume =====
   pause() {
-    this.state.status = "paused";
-    this.emit("paused");
+    this.state.status = AGENT_STATUS.PAUSED;
+    this.emit(AGENT_EVENT.PAUSED);
   }
   resume() {
-    if (this.state.status === "paused") {
-      this.state.status = "running";
-      this.emit("resumed");
+    if (this.state.status === AGENT_STATUS.PAUSED) {
+      this.state.status = AGENT_STATUS.RUNNING;
+      this.emit(AGENT_EVENT.RESUMED);
     }
   }
   // ===== Reset =====
   reset() {
     this.state = this.createInitialState();
-    this.emit("reset");
+    this.emit(AGENT_EVENT.RESET);
   }
 };
 
@@ -2610,52 +2751,6 @@ var ASCII_BANNER = `
  \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D
 `;
 
-// src/config/agent-constants.ts
-var AGENT_EVENT = {
-  // Lifecycle
-  PLUGINS_LOADED: "plugins_loaded",
-  HOOKS_LOADED: "hooks_loaded",
-  COMMANDS_LOADED: "commands_loaded",
-  MCP_SERVER_ADDED: "mcp_server_added",
-  // Execution
-  ITERATION: "iteration",
-  THOUGHT: "thought",
-  RESPONSE: "response",
-  TOOL_CALL: "tool_call",
-  TOOL_RESULT: "tool_result",
-  COMMAND_EXECUTE: "command_execute",
-  // State changes
-  TARGET_SET: "target_set",
-  PHASE_CHANGE: "phase_change",
-  AGENT_SWITCH: "agent_switch",
-  // Discoveries
-  FINDING: "finding",
-  CREDENTIAL: "credential",
-  COMPROMISED: "compromised",
-  // Completion
-  COMPLETE: "complete",
-  REPORT: "report",
-  ERROR: "error"
-};
-var CLI_COMMAND = {
-  HELP: "help",
-  TARGET: "target",
-  START: "start",
-  STOP: "stop",
-  FINDINGS: "findings",
-  CLEAR: "clear",
-  EXIT: "exit"
-};
-var MESSAGE_TYPE = {
-  USER: "user",
-  ASSISTANT: "assistant",
-  TOOL: "tool",
-  THINKING: "thinking",
-  ERROR: "error",
-  SYSTEM: "system",
-  RESULT: "result"
-};
-
 // src/cli/app.tsx
 import { jsx, jsxs } from "react/jsx-runtime";
 var App = ({ autoApprove = false, target }) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pentesting",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "description": "Autonomous Penetration Testing AI Agent",
   "type": "module",
   "main": "dist/index.js",