pentesting 0.100.13 → 0.101.2

package/ARCHITECTURE.md

@@ -130,19 +130,35 @@ request hot path. Explicit event metadata is routed deterministically; absent
 metadata receives one general strategy. Named profiles may add context, but
 coarse labels do not authorize or reject tool calls.
 
-CTF engagement metadata may select `ctf-competition` prompt context, and
-`flag_check` remains a verification tool and evidence source rather than a
-default completion gate. `explore` is always available; `[exploration]` only
-sets node and fan-out caps. Installed users edit the relevant engagement, flag,
-and frontier fields through `/config`.
+CTF engagement metadata may select `ctf-competition` prompt context, and
+`flag_check` remains a verification tool and evidence source rather than a
+default completion gate. `explore` is always available; `[exploration]` only
+sets node and fan-out caps. Installed users edit the relevant engagement, flag,
+and frontier fields through `/config`.
 
 The shipped exploration tool does not replace the core execution strategy.
 It provides a bounded `EvidenceKind::Lead` ledger and explicit dispatch. Stable
 generated identity is separate from semantic deduplication. Dead probes suppress
 an execution branch without rejecting its knowledge hypothesis, and fresh
-evidence reopens scheduling. There is no passive `/frontier` command, detached
-task registry, or second scheduler. `orch_spec::exploration_e2e` pins the off
-path and the explicit breadth/depth/pivot/reseed/merge behavior.
+evidence reopens scheduling. An explicit `explore op=frontier` call reads one
+canonical snapshot and returns a bounded attention brief: one visible focus, at
+most two alternatives, at most two alerts, state counts, and an omitted count.
+Focus is visibility, not a recommendation, authorization, or execution lock;
+priority scores stay internal and the model must name leads in a separate
+`dispatch` call. The model-facing payload stays within 4 KiB after JSON and HTML
+escaping. On an explicit `/status`, the same pure projection is loaded once and
+rendered as Battlefield Lite: at most eight logical rows and 1.5 KiB, containing
+only typed counts/enums/numeric metadata and revalidated Lead IDs. It omits Lead
+title, detail, parent/sample IDs, evidence references, tool output, and score;
+that is a narrow Lead-prose disclosure boundary, not a general secret scanner
+for the rest of the diagnostic output. There is no passive mission-control
+injection, model-request hot-path repository read, `/frontier` command, detached
+task registry, advisor, or second scheduler.
+`orch_spec::exploration_e2e` pins the explicit frontier/pivot/dispatch/merge
+behavior. A deterministic 256-Lead Phase 4 fixture measured the legacy rendered
+frontier at 121,420 bytes and the bounded brief at 1,858 bytes (98.46% smaller),
+while the existing completion-provenance corpus remained 9/9. This supports the
+bounded visibility decision; it is not a claim of improved live-model solve rate.
 
 Reliability guards sit below the profile layer. Provider protocol capabilities
 default native tool support for OpenAI/Anthropic-compatible responses on
@@ -179,16 +195,16 @@ flowchart TD
 The core agent team is domain-neutral. Each agent ships as a markdown persona
 definition under `crates/builder_repo/src/agents/`.
 
-Subagents are explicit and bounded. A `task` call selects one agent; its tasks
-run concurrently up to four per call and delegation stops at depth two.
-Separate top-level tool calls are sequenced. Built-ins include `crypto`, `rev`,
-and `pwn`.
-
-`explore dispatch` is a separate path. It runs selected leads as `builder`
-clones with category overlays, defaults to breadth one, is hard-capped at four,
-and waits for the batch. It does not auto-route leads to specialist personas.
-Every child uses the same tool/policy gateway, budget, lineage, and evidence
-merge contracts.
+Subagents are explicit and bounded. A `task` call selects one agent; its tasks
+run concurrently up to four per call and delegation stops at depth two.
+Separate top-level tool calls are sequenced. Built-ins include `crypto`, `rev`,
+and `pwn`.
+
+`explore dispatch` is a separate path. It runs selected leads as `builder`
+clones with category overlays, defaults to breadth one, is hard-capped at four,
+and waits for the batch. It does not auto-route leads to specialist personas.
+Every child uses the same tool/policy gateway, budget, lineage, and evidence
+merge contracts.
 
 | Agent | Default role | Runtime profile |
 | --- | --- | --- |
@@ -367,13 +383,52 @@ trusted verifier with explicit provenance is the only mission-promotion path;
 
 ## Diagnostic UI boundary
 
-The default TUI renders the response stream and deterministic input queue. It
-does not maintain a second workflow engine. `/status` consumes one immutable
+The default TUI renders the response stream and deterministic input queue. It
+does not maintain a second workflow engine. `/status` consumes one immutable
 `RunStatusProjection`; `/workflow report` is the explicit offline export. The
-former bare `/workflow` alias has been removed. The live status row deliberately
-shows only actionable progress/wait state; frontier JSON is not parsed into
-hidden chrome state, and full run/tool detail remains in explicit output and
-`/status`.
+former bare `/workflow` alias has been removed. For an active run the projection
+adds exactly one optional canonical Lead-ledger read and immediately reduces it
+to `Option<AttentionBrief>`; raw nodes never cross the API boundary, an optional
+read failure only renders `BATTLEFIELD [UNAVAILABLE]`, and no Lead produces no
+battlefield rows. Core status read failures retain their existing error path.
+With no recorded run, `/status` still shows goal, manual/auto mode, queue, and
+usage without an evidence read. Recorded `TurnExit` and typed `MissionState` are
+shown separately so model Stop or run completion cannot appear as verified
+mission completion. The live status row deliberately remains limited to
+actionable progress/wait state: there is no frontier parsing, background refresh,
+write, dispatch shortcut, or hidden chrome state.
+
+Completed type-ahead inputs carry an explicit active-turn behavior. Safe
+inspection commands (`/info`, `/usage`, `/context`, `/memory`, `/status`,
+`/help`, `/skill`, and `/tools`) are atomically extracted and
+rendered without cancelling the response stream. State-changing and modal
+commands, including `/log` and `/model`, remain in FIFO order until the next safe turn
+boundary. `/new`, `/retry`, `/exit`, and explicit `/replace` retain interrupt
+semantics and take priority over active-turn query extraction. The input buffer
+rebuilds replay events after extraction so queued messages and the current draft
+preserve their original order and cursor. Esc cancellation preserves submitted
+queued input and starts its FIFO replay after stream cleanup; Ctrl+C remains the
+explicit clear-buffer interrupt. A conversation reset consumes `/new` but retains
+its FIFO tail for the new conversation. Modal prompts isolate that pre-existing
+tail from widget input and expose it again only after modal ownership ends.
+Commands that eventually open a modal keep the outer interrupt listener during
+their asynchronous prefetch and persistence phases. Before the widget starts,
+the terminal session requests a reader pause and waits for its acknowledgement;
+the reader resumes after modal ownership ends. Type-ahead is therefore buffered
+FIFO instead of racing or leaking into a later model, agent, or configuration
+field. Service-layer approval, secret, selection, and follow-up prompts acquire
+the same lifetime-bound modal handoff through the prompt-entry hook, and
+concurrent service prompts are serialized so two widgets never read stdin at
+once.
+
+Typing `/` opens the complete registered command catalog. Search includes
+canonical names and aliases; Up/Down changes the selection, and Enter inserts
+the selected template into the editor for partial matches and commands that
+require arguments. A later Enter submits that populated input; a fully typed
+exact command that needs no expansion submits normally. Palette descriptions
+expose `[now]`, `[queued]`, and `[interrupt]` so the queue behavior is visible
+before submission. The selected entry is rendered as the first hint row so it
+remains visible when the terminal can show only a constrained input viewport.
 
 ## Distribution — single source, two surfaces
 
@@ -422,14 +477,14 @@ Compilation is outside the application runtime boundary and is always executed
 through resource-capped Docker wrappers. Host Cargo is not an emergency
 fallback. `dbuild.sh` owns individual Cargo commands, `dverify.sh` owns
 sequential gate profiles, and `dbuild-image.sh` owns BuildKit. Each path shares
-storage admission, effective-limit inspection, a machine-wide lock, watchdogs,
-and structured failure reports. Automated CI/CD is disabled; maintainers invoke
-these wrappers explicitly. The
-normative contract is [Docker-only build safety](https://github.com/agnusdei1207/pentesting/blob/main/docs/BUILD_SAFETY.md).
-
-Patch publication performs one Cross build. The version-checked, checksummed
-AMD64 musl artifact is uploaded to GitHub and packaged into Docker from a
-minimal context; its dependency cache stays in a versioned Docker volume.
+storage admission, effective-limit inspection, a machine-wide lock, watchdogs,
+and structured failure reports. Automated CI/CD is disabled; maintainers invoke
+these wrappers explicitly. The
+normative contract is [Docker-only build safety](https://github.com/agnusdei1207/pentesting/blob/main/docs/BUILD_SAFETY.md).
+
+Patch publication performs one Cross build. The version-checked, checksummed
+AMD64 musl artifact is uploaded to GitHub and packaged into Docker from a
+minimal context; its dependency cache stays in a versioned Docker volume.
 
 The measured next-stage simplification and deletion plan is indexed at
 [Minimal Core plan](https://github.com/agnusdei1207/pentesting/blob/main/docs/plans/2026/07/10/minimal-core/README.md).
@@ -443,9 +498,9 @@ overridden by project-local `.pentesting.toml` files discovered by walking up
 from the working directory. Local storage is the default; normal setup only
 needs the public model endpoint environment.
 
-The full file shape is represented in `builder.schema.json`; common runtime and
-CTF fields are editable through `/config`. Set `PENTESTING_CONFIG` to override
-the global config directory.
+The full file shape is represented in `builder.schema.json`; common runtime and
+CTF fields are editable through `/config`. Set `PENTESTING_CONFIG` to override
+the global config directory.
 
 | Variable | Description |
 | --- | --- |
@@ -474,7 +529,7 @@ Inside an interactive session, these commands inspect and drive runtime state
 (`/help` lists the full set):
 
 ```text
-/status        Show the current run phase, active tasks, hooks, and budget signals
+/status        Show goal/mode/queue, turn vs mission, run gates, budgets, and a bounded read-only battlefield
 /workflow report
                Export the active run, engagement metadata, evidence, and large outputs to Markdown
 /context       Show recent context-budget snapshots for the current conversation
@@ -483,7 +538,7 @@ Inside an interactive session, these commands inspect and drive runtime state
 /agent         Switch the active agent
 /conversation  Browse conversations for the active workspace
 /goal <task>   Set the active goal without enabling autonomous mode
-/auto          Toggle autonomous mode for the current goal (default: off; Esc stops it)
+/auto          Toggle autonomous mode for the current goal (default: off; Esc stops it)
 /update        Download and apply the latest public release asset for supported native targets
 /help          Show all commands
 /exit          Quit

package/README.md

@@ -1,9 +1,9 @@
 # Pentesting 🔓
 
-<div align="center">
-  <img src="https://api.iconify.design/hugeicons:bash.svg" alt="pentesting bash icon" width="120" />
-  <h1>pentesting</h1>
-  <p>Security-Focused Agent Runtime</p>
+<div align="center">
+  <img src="https://api.iconify.design/hugeicons:bash.svg" alt="pentesting bash icon" width="120" />
+  <h1>A High-Efficiency Penetration-Testing Agent</h1>
+  <p>Designed to achieve strong results with low-cost models. Powered by Rust.</p>
 
 [![MIT License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
 [![npm](https://img.shields.io/npm/v/pentesting.svg)](https://www.npmjs.com/package/pentesting)
@@ -11,49 +11,9 @@
 
 ---
 
-## ✅ Capabilities
-
-Agent-loop essentials plus a security-focused runtime layer.
-
-| Area                        | What it does                                                                                                                                                          |
-| --- | --- |
-| Model-driven loop           | Streaming action/observation loop; model Stop ends a turn, while verified artifacts close a mission and the full turn trajectory is persisted with the outcome        |
-| Tool guardrails             | Read-before-edit enforcement, repeat-call guard, policy-gated file/shell/network                                                                                      |
-| Permissions                 | Allow / Deny / Confirm, with once/always decisions persisted                                                                                                          |
-| Context compaction          | Automatic micro-pruning + model-triggered summarization, pre/post hooks                                                                                               |
-| Interrupt & steering        | ESC stops the current turn and auto loop; queued input uses revisioned FIFO amend/replace semantics and deterministic PTY Enter ownership                              |
-| Reverse-shell control plane | Accept and track multiple authorized callbacks, tag/probe sessions, send/observe/run commands, verify PTY upgrades, and keep transcript/ledger/evidence records       |
-| PTY session control         | One actor owns each socket/PTY/pipe, command queue, transcript, and child lifecycle, with resize gating, FD accounting, and deterministic close/revoke/gc reclamation |
-| Frontier-guided exploration | Persistent lead ledger with explicit dispatch; breadth defaults to one and is hard-capped at four                                                                   |
-| Subagents                   | Explicit delegation to built-in specialists, including `crypto`, `rev`, and `pwn`; one selected agent can run up to four tasks concurrently                           |
-| MCP & skills                | Dynamic MCP tool discovery, layered markdown skills                                                                                                                   |
-| Memory                      | Ebbinghaus-style decaying notes + hybrid lexical/semantic/graph retrieval                                                                                             |
-
----
-
-Delegation is explicit. One `task` call selects one agent and may run its tasks
-concurrently; separate top-level calls are sequenced. `explore dispatch` instead
-uses `builder` clones with category overlays and waits for the batch. Both paths
-share permissions, budgets, lineage, and evidence checks.
-
-### Core algorithms
-
-| Area | Implementation | Time / space |
-| --- | --- | --- |
-| Exploration | Score-ranked BFS/DFS guidance, parent backtracking, global reseeding; append-only leads folded into a `HashMap` | Snapshot/advice `O(R + L log L)` time, `O(L)` working and `O(R)` stored space |
-| Knowledge | BM25 + 768-D cosine search + BFS over adjacency maps/visited sets, fused by RRF; fixed 20-round PageRank at index build | Query `O(M + N(Q + D + log N) + V log V + E)` time and `O(N + V + D)` working space; index storage `O(M + ND + V + E)` |
-| Runtime control | FIFO queues plus semaphore-bounded `join_all` fan-out | `O(T)` scheduling/result state, at most four active children per batch |
-
-`R` is lead records, `L` live leads, `M` searchable text, `N` notes, `Q` query
-terms, `D = 768`, and `V/E` graph nodes/links. Memory decay is constant-time per
-note. Kruskal, Prim, and a generic divide-and-conquer engine are not runtime
-components; agents may apply them to a target when useful.
-
----
-
 ## 🚀 Quick Start
 
-Install globally, or run once with a Node package runner:
+Install globally, or run once with a Node package runner (Node.js 18.18+):
 
 ```bash
 npm install -g pentesting && pentesting   # install
@@ -62,38 +22,9 @@ pnpm dlx pentesting
 yarn dlx pentesting
 ```
 
-Requires Node.js 18.18+. Use npm/npx/pnpm/yarn; Bun and Deno runners are not supported.
-
-### Docker-only development builds
-
-Repository builds and Rust tests must always use the resource-capped Docker
-wrappers. Host Cargo compilation is fail-closed; free disk or RAM does not make
-it an approved path.
-
-```bash
-scripts/dbuild.sh check --workspace --all-targets
-scripts/dbuild.sh test -p builder_domain
-scripts/dverify.sh focused
-scripts/dverify.sh full
-scripts/dbuild-image.sh validation                                                # once per fresh Docker cache
-powershell -NoProfile -ExecutionPolicy Bypass -File scripts/dbuild.ps1 test -p builder_domain  # Windows
-powershell -NoProfile -ExecutionPolicy Bypass -File scripts/nverify.ps1                  # Windows npm verify
-```
-
-The wrappers cap memory, CPU, PIDs, jobs, test threads, and time; verify storage
-before launch; serialize resource-intensive work; and leave a redacted resource
-report. Automated CI/CD is disabled. Full policy: [Docker-only build safety](https://github.com/agnusdei1207/pentesting/blob/main/docs/BUILD_SAFETY.md).
-
-Patch releases compile once, verify the binary version and SHA-256, and reuse
-that same AMD64 artifact for GitHub and Docker publication.
-
 ### 🐳 Run with Docker
 
-No local Rust toolchain needed:
-
-Published images support `linux/amd64` only. Docker is the recommended runtime
-on Windows and macOS; Apple Silicon Macs run the amd64 image through Docker
-Desktop emulation. Native ARM64 images and binaries are not supported.
+No local toolchain needed. Published images are `linux/amd64` only.
 
 ```bash
 export OPENAI_API_KEY="sk-..."                 # provider API key or gateway token
@@ -112,146 +43,71 @@ docker run -it --rm \
   agnusdei1207/pentesting:latest
 ```
 
-Provider environment variables are optional for startup. If they are omitted,
-the interactive TUI still launches and lets you configure/login inside the
-persistent `pentesting-config` volume.
-
-Or via Docker Compose:
-
-```bash
-PENTESTING_PROJECT_DIR=/path/to/project \
-OPENAI_API_KEY=sk-... \
-OPENAI_BASE_URL=https://api.openai.com/v1 \
-OPENAI_MODEL=gpt-4o \
-OPENAI_MAX_TOKENS=4096 \
-docker compose run --rm pentesting
-```
-
-### Common commands
-
-```bash
-pentesting                                                # Interactive TUI
-pentesting --prompt "Enumerate the target and summarize next actions."
-pentesting shell-listener --bind 127.0.0.1 --port 4444   # Authorized reverse-shell listener
-pentesting --version
-```
+Provider variables are optional — the TUI launches without them and lets you log in inside the persistent `pentesting-config` volume. The TUI pre-fills output max tokens from the model; `OPENAI_MAX_TOKENS` overrides it.
 
-Use `shell-listener` in authorized CTF/lab work to accept callbacks, tag sessions, run sentinel-tracked commands, verify PTY upgrades, and retain transcripts/evidence.
+---
 
-Short version: the agent can catch a dumb reverse shell, upgrade it to a verified PTY, pivot to a second callback, and reclaim both sessions cleanly with `close` / `revoke` / `gc`.
+## ✅ Capabilities
 
-### Interactive commands
+| Area | What it does |
+| --- | --- |
+| Verified agent loop | Streams actions and observations; a model Stop ends only the turn, evidence-backed verification closes the mission, and the full trajectory is persisted |
+| Unified tool boundary | Built-in, delegated, and MCP calls share schema validation, provenance, permissions, policy, and resource limits |
+| Context economy | Automatic micro-pruning and model-triggered summaries preserve useful context for low-cost models |
+| Deterministic steering | Esc stops the current turn and auto loop, while submitted input resumes in FIFO order at safe turn boundaries |
+| Reverse-shell & PTY lifecycle | One control plane manages authorized callbacks and local PTY/pipe sessions, from tagging, probing, and verified upgrades to transcripts, evidence, FD accounting, and deterministic reclamation |
+| Bounded battlefield | A persistent Lead ledger produces a compact on-demand attention brief and read-only `/status` view; dispatch stays explicit and is capped at four branches |
+| Adversarial pathfinding | A localized AlphaGo-inspired minimax technique models an opponent's best defensive move and improves the ability to find viable bypass paths |
+| Dynamic fan-out / fan-in | The model sizes each specialist batch to the task, runs up to four delegated branches concurrently, then returns their results to the parent with bounded depth and recorded lineage |
+| Extensible skills & tools | Discovers MCP tools dynamically and layers Markdown skills onto the same guarded runtime surface |
+| Forgetting-aware memory | Ebbinghaus-style decaying notes combine with lexical, semantic, and graph retrieval |
+
+---
 
-Sessions start with auto mode off. Esc stops both the current turn and autonomous continuation. Queued input is replayed in FIFO order.
+## 🧭 Philosophy
+
+| Principle | What it means here |
+| --- | --- |
+| Simplicity is best | Prefer the smallest design that preserves the capability, makes ownership clear, and remains easy to verify |
+| If it cannot be measured, it cannot be improved | Instrument outcomes, compare them under repeatable conditions, and let evidence drive the next change |
+| The best design blueprint is the human being | Better systems begin with better self-observation: understand how we perceive, decide, learn, and recover, then make those loops observable |
+| The agent is the bottleneck | As AI models advance, the agent framework and the surrounding system must evolve with them |
+
+### Capability record
+
+| Date | Record | Test conditions |
+| --- | --- | --- |
+| 2026-04 | Project work began | Initial implementation and baseline work |
+| 2026-07-15 | First project-reported result in which Pentesting exceeded Claude Code on the tested penetration-testing capability set; reported margin: approximately 40% | Pentesting with MiniMax M3 versus Claude Code with Sonnet 5; identical prompts; CTF tasks ranging from easy to hard; a 60-minute test window for each system |
+
+This is a project-maintained, task-specific record, not an independent or general-purpose benchmark. It does not claim broader general-purpose superiority.
+
+> Claude Code's strength is generality, an area where Pentesting was weaker. Even so, it was strong enough to become a foundation that other products wrapped for penetration-testing workflows. To me, it felt like a formidable wall—and, at the same time, the goal I wanted to surpass.
+
+---
+
+## ⌨️ Slash commands
 
 | Command | Purpose |
 | --- | --- |
-| `/help` | List every command |
-| `/model [query]` | Choose a provider/model or custom endpoint |
-| `/goal <objective>` · `/auto` | Record a goal, then toggle autonomous continuation; Esc stops it |
-| `/status` · `/usage` | Inspect run state, gates, budgets, tokens, and requests |
-| `/context` · `/memory` | Inspect context-budget snapshots and stored memories |
-| `/agent` · `/builder` · `/planner` · `/researcher` | Select the active agent |
-| `/new` · `/retry` · `/compact` | Start fresh, retry the last turn, or compact context |
-| `/config` · `/tools` · `/skill` | Configure the runtime and inspect capabilities |
-| `/workflow report` | Export the active run as Markdown |
-| `/update` · `/exit` | Update the native release or quit |
-
-On native Windows Git Bash, the repository smoke path builds the capped Docker
-image and then opens this interactive TUI without WSL:
+| `/help` | Show commands |
+| `/model [query]` | Switch provider, model, or custom endpoint |
+| `/goal <objective>` | Set or clear the active goal |
+| `/auto` | Run the active goal automatically; Esc stops it |
+| `/status` | Show the current run and verified mission status |
+| `/new` · `/retry` | Start a new conversation or retry the last turn |
+| `/config` | Edit runtime configuration |
+| `/exit` | Quit |
 
-```bash
-npm run check
-```
-
-### 🔌 Reverse-shell & PTY sessions
-
-Catch and manage authorized shell callbacks: one listener, many targets, audited cleanup.
-
-```bash
-pentesting shell-listener --port 4444             # 1. Catch callbacks (tracks many at once)
-pentesting shell-session list                     # 2. See every live session + FD ownership
-pentesting shell-session run -- id                # 3. Run sentinel-bounded commands, capture output
-pentesting shell-session upgrade --technique auto # 4. Recon, select, retry, and verify a real PTY
-pentesting shell-session revoke --session 1       # 5. Hard-close: reclaim FDs + archive evidence
-```
-
-- **Track** — each callback is accepted, numbered, and tagged; one session actor exclusively owns its live descriptors, transcript, and child lifecycle. `list` / `info` / `fdstat` / `lifecycle` show state and byte counts without cloned reader/writer descriptors.
-- **Drive** — `run` wraps commands in a sentinel to capture exactly their output; `send` / `raw` / `signal` / `resize` give interactive control.
-- **Upgrade** — `upgrade --technique auto` explicitly runs a bounded `recon → select → helper → probe` controller, choosing an allowlisted shell and retrying only evidence-backed failures across `python3`, `python`, `python2`, `script`, and `expect`. Omission is still rejected: use a concrete technique for one exact CLI attempt; unusual custom `text` commands are available through the `session_control`/JSONL API. CLI `pty-upgrade` sends one concrete catalog helper and never starts adaptive fallback.
-- **Record** — per-session raw log, full-duplex transcript, command ledger, replay, and evidence manifest — with secret redaction for registered values.
-- **Reclaim** — `close` (graceful) and `revoke` (hard) release file descriptors immediately and archive the session; `gc` prunes closed sessions. Reclamation is tracked end-to-end, so FDs never leak.
-- **Guard** — the JSONL control plane is a workspace-internal Unix socket only (absolute paths, symlink escapes, and non-socket files are rejected). Every request carries a protocol version and a correlating `request_id`, is bounded to 1 MiB in / 4 MiB out, and `timeout_ms` is capped at 5 minutes and rejected before any bytes reach the session. A small fixed worker pool multiplexes the socket so a long adaptive `upgrade` never blocks `health` / `observe` / `close`, and injected secrets are redacted from responses and sensitive audit records. `probe` / recon fields are the target's own self-report, not a security attestation.
+> The command you run is always **`pentesting`**. The internal engine is **`builder`** — `pentesting` runs it under the hood; the engine name never surfaces in normal use.
 
 ---
 
-## ⚙️ Configuration
-
-Pentesting uses local storage by default. For normal use, configure only the model endpoint:
-
-### Example `.env` / shell setup
-
-```bash
-# OpenAI-compatible provider or gateway
-export OPENAI_API_KEY="sk-..."
-export OPENAI_BASE_URL="https://api.openai.com/v1"
-export OPENAI_MODEL="gpt-4o"
-export OPENAI_MAX_TOKENS="4096"
-
-# Runtime overrides (optional)
-export PENTESTING_CONFIG="$HOME/.config/pentesting"      # move the global config dir
-export PENTESTING_SKIP_DOWNLOAD=1                        # skip postinstall binary download (CI)
-```
-
-The TUI pre-fills output max tokens from known model names/provider metadata. `OPENAI_MAX_TOKENS` and the TUI field are explicit overrides for custom/self-hosted models.
-
-### Frontier-guided CTF exploration
+## 🎹 From the Developer
 
-`explore` is always available. Use `/config` to set the engagement kind, flag
-verification, and frontier limits; settings persist in the installed runtime's
-user config. Breadth defaults to one and is capped at four. Leads are persistent,
-deduplicated, and dispatched explicitly.
-
-With Docker, mount both your project and the persistent runtime config volume, then pass the same variables through with `-e`:
-
-```bash
-docker run -it --rm \
-  -v "$(pwd):/workspace" \
-  -v pentesting-config:/root/.pentesting \
-  -w /workspace \
-  -e OPENAI_API_KEY \
-  -e OPENAI_BASE_URL \
-  -e OPENAI_MODEL \
-  -e OPENAI_MAX_TOKENS \
-  agnusdei1207/pentesting:latest
-```
-
-Those variables only pre-fill provider settings. Leaving them unset must not
-block the container from launching the TUI; configure the provider interactively
-inside the container instead.
-
-> **Note:** The command you run is always **`pentesting`**. The internal engine is **`builder`** — `pentesting` downloads and runs it under the hood; the engine name never surfaces in normal use.
-
----
-
-## 📖 Documentation
-
-- [`ARCHITECTURE.md`](ARCHITECTURE.md) — Runtime flow, agent team, memory model, crate map, tool surface, and supported targets.
-- [Documentation map](https://github.com/agnusdei1207/pentesting/blob/main/docs/README.md) — Current authoritative documents versus historical plans and research notes.
-- [Integrated runtime design](https://github.com/agnusdei1207/pentesting/blob/main/docs/BUILDER-CONSOLIDATED-DEEP-DIVE.md) — Top-down explanation from the one-loop model to prompt, subagents, persistence, and PTY ownership.
-- [Minimal Core implementation](https://github.com/agnusdei1207/pentesting/blob/main/docs/plans/2026/07/10/minimal-core/README.md) — Implemented simplification record for the single turn/tool/security surface.
-- [Next-generation clean-break convergence](https://github.com/agnusdei1207/pentesting/blob/main/docs/plans/2026/07/10/next-generation-convergence/README.md) — Canonical contracts, deleted compatibility paths, and the phase-by-phase migration boundary.
-- Internal layout: service traits are split under `builder_app/src/services/*`; OpenAI request conversion is isolated under `dto/openai/request/*`.
-- [Public site](https://agnusdei1207.github.io/pentesting-public/) — Landing page and public runtime entry surface.
-- [`compose.yaml`](https://github.com/agnusdei1207/pentesting-public) — Docker Compose facade for pentesting sessions.
-
----
-
-## 🎹 From the Developer
-
-<div align="center">
-  <img src="https://github.com/user-attachments/assets/abe73474-f27b-4536-b358-fedef1e461f0" alt="Chopin Ballade No.4" width="600" />
-</div>
+<div align="center">
+  <img src="https://github.com/user-attachments/assets/abe73474-f27b-4536-b358-fedef1e461f0" alt="Chopin Ballade No.4" width="600" />
+</div>
 
 <br/>
 
@@ -259,6 +115,12 @@ inside the container instead.
 >
 > The harmony of polyphony — multiple voices — and homophony — a single melodic line.
 >
-> Each voice sings its most beautiful song from its own place, yet when combined, they create one grand, beautiful melody. I believe this structure is no different from AI agents.
->
-> — *agnusdei1207*
+> Each voice sings its most beautiful song from its own place, yet when combined, they create one grand, beautiful melody. I believe this structure is no different from AI agents.
+>
+> — *agnusdei1207*
+
+### First principles
+
+> Since the AI era began, I have studied many highly starred agent systems, but their machinery often obscured a clear philosophy. The ideas that actually improved performance came from observing myself and returning to computer science fundamentals—Kruskal and Prim, divide and conquer, backtracking, Monte Carlo methods, and time/space complexity. My conclusion is simple: observe yourself, master the fundamentals, and build from there.
+
+> I use Pentesting to study CTFs and penetration testing.

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "pentesting",
-  "version": "0.100.13",
-  "builderReleaseTag": "v0.100.13",
-  "description": "pentesting — coding agent runtime with audited reverse-shell capture, verified PTY session upgrades, pivot control, evidence transcripts, and safe session reclamation.",
+  "version": "0.101.2",
+  "builderReleaseTag": "v0.101.2",
+  "description": "Penetration testing AI agent powered by Rust, with audited reverse-shell capture, verified PTY upgrades, and evidence-first orchestration.",
   "license": "MIT",
   "author": "agnusdei1207",
   "type": "module",
@@ -36,8 +36,7 @@
     "hacker",
     "ai",
     "autonomous",
-    "claude",
-    "anthropic",
+    "rust",
     "tui",
     "cli",
     "nmap",