pentesting 0.100.14 → 0.101.2

package/ARCHITECTURE.md

@@ -130,19 +130,35 @@ request hot path. Explicit event metadata is routed deterministically; absent
 metadata receives one general strategy. Named profiles may add context, but
 coarse labels do not authorize or reject tool calls.
 
-CTF engagement metadata may select `ctf-competition` prompt context, and
-`flag_check` remains a verification tool and evidence source rather than a
-default completion gate. `explore` is always available; `[exploration]` only
-sets node and fan-out caps. Installed users edit the relevant engagement, flag,
-and frontier fields through `/config`.
+CTF engagement metadata may select `ctf-competition` prompt context, and
+`flag_check` remains a verification tool and evidence source rather than a
+default completion gate. `explore` is always available; `[exploration]` only
+sets node and fan-out caps. Installed users edit the relevant engagement, flag,
+and frontier fields through `/config`.
 
 The shipped exploration tool does not replace the core execution strategy.
 It provides a bounded `EvidenceKind::Lead` ledger and explicit dispatch. Stable
 generated identity is separate from semantic deduplication. Dead probes suppress
 an execution branch without rejecting its knowledge hypothesis, and fresh
-evidence reopens scheduling. There is no passive `/frontier` command, detached
-task registry, or second scheduler. `orch_spec::exploration_e2e` pins the off
-path and the explicit breadth/depth/pivot/reseed/merge behavior.
+evidence reopens scheduling. An explicit `explore op=frontier` call reads one
+canonical snapshot and returns a bounded attention brief: one visible focus, at
+most two alternatives, at most two alerts, state counts, and an omitted count.
+Focus is visibility, not a recommendation, authorization, or execution lock;
+priority scores stay internal and the model must name leads in a separate
+`dispatch` call. The model-facing payload stays within 4 KiB after JSON and HTML
+escaping. On an explicit `/status`, the same pure projection is loaded once and
+rendered as Battlefield Lite: at most eight logical rows and 1.5 KiB, containing
+only typed counts/enums/numeric metadata and revalidated Lead IDs. It omits Lead
+title, detail, parent/sample IDs, evidence references, tool output, and score;
+that is a narrow Lead-prose disclosure boundary, not a general secret scanner
+for the rest of the diagnostic output. There is no passive mission-control
+injection, model-request hot-path repository read, `/frontier` command, detached
+task registry, advisor, or second scheduler.
+`orch_spec::exploration_e2e` pins the explicit frontier/pivot/dispatch/merge
+behavior. A deterministic 256-Lead Phase 4 fixture measured the legacy rendered
+frontier at 121,420 bytes and the bounded brief at 1,858 bytes (98.46% smaller),
+while the existing completion-provenance corpus remained 9/9. This supports the
+bounded visibility decision; it is not a claim of improved live-model solve rate.
 
 Reliability guards sit below the profile layer. Provider protocol capabilities
 default native tool support for OpenAI/Anthropic-compatible responses on
@@ -179,16 +195,16 @@ flowchart TD
 The core agent team is domain-neutral. Each agent ships as a markdown persona
 definition under `crates/builder_repo/src/agents/`.
 
-Subagents are explicit and bounded. A `task` call selects one agent; its tasks
-run concurrently up to four per call and delegation stops at depth two.
-Separate top-level tool calls are sequenced. Built-ins include `crypto`, `rev`,
-and `pwn`.
-
-`explore dispatch` is a separate path. It runs selected leads as `builder`
-clones with category overlays, defaults to breadth one, is hard-capped at four,
-and waits for the batch. It does not auto-route leads to specialist personas.
-Every child uses the same tool/policy gateway, budget, lineage, and evidence
-merge contracts.
+Subagents are explicit and bounded. A `task` call selects one agent; its tasks
+run concurrently up to four per call and delegation stops at depth two.
+Separate top-level tool calls are sequenced. Built-ins include `crypto`, `rev`,
+and `pwn`.
+
+`explore dispatch` is a separate path. It runs selected leads as `builder`
+clones with category overlays, defaults to breadth one, is hard-capped at four,
+and waits for the batch. It does not auto-route leads to specialist personas.
+Every child uses the same tool/policy gateway, budget, lineage, and evidence
+merge contracts.
 
 | Agent | Default role | Runtime profile |
 | --- | --- | --- |
@@ -367,13 +383,52 @@ trusted verifier with explicit provenance is the only mission-promotion path;
 
 ## Diagnostic UI boundary
 
-The default TUI renders the response stream and deterministic input queue. It
-does not maintain a second workflow engine. `/status` consumes one immutable
+The default TUI renders the response stream and deterministic input queue. It
+does not maintain a second workflow engine. `/status` consumes one immutable
 `RunStatusProjection`; `/workflow report` is the explicit offline export. The
-former bare `/workflow` alias has been removed. The live status row deliberately
-shows only actionable progress/wait state; frontier JSON is not parsed into
-hidden chrome state, and full run/tool detail remains in explicit output and
-`/status`.
+former bare `/workflow` alias has been removed. For an active run the projection
+adds exactly one optional canonical Lead-ledger read and immediately reduces it
+to `Option<AttentionBrief>`; raw nodes never cross the API boundary, an optional
+read failure only renders `BATTLEFIELD [UNAVAILABLE]`, and no Lead produces no
+battlefield rows. Core status read failures retain their existing error path.
+With no recorded run, `/status` still shows goal, manual/auto mode, queue, and
+usage without an evidence read. Recorded `TurnExit` and typed `MissionState` are
+shown separately so model Stop or run completion cannot appear as verified
+mission completion. The live status row deliberately remains limited to
+actionable progress/wait state: there is no frontier parsing, background refresh,
+write, dispatch shortcut, or hidden chrome state.
+
+Completed type-ahead inputs carry an explicit active-turn behavior. Safe
+inspection commands (`/info`, `/usage`, `/context`, `/memory`, `/status`,
+`/help`, `/skill`, and `/tools`) are atomically extracted and
+rendered without cancelling the response stream. State-changing and modal
+commands, including `/log` and `/model`, remain in FIFO order until the next safe turn
+boundary. `/new`, `/retry`, `/exit`, and explicit `/replace` retain interrupt
+semantics and take priority over active-turn query extraction. The input buffer
+rebuilds replay events after extraction so queued messages and the current draft
+preserve their original order and cursor. Esc cancellation preserves submitted
+queued input and starts its FIFO replay after stream cleanup; Ctrl+C remains the
+explicit clear-buffer interrupt. A conversation reset consumes `/new` but retains
+its FIFO tail for the new conversation. Modal prompts isolate that pre-existing
+tail from widget input and expose it again only after modal ownership ends.
+Commands that eventually open a modal keep the outer interrupt listener during
+their asynchronous prefetch and persistence phases. Before the widget starts,
+the terminal session requests a reader pause and waits for its acknowledgement;
+the reader resumes after modal ownership ends. Type-ahead is therefore buffered
+FIFO instead of racing or leaking into a later model, agent, or configuration
+field. Service-layer approval, secret, selection, and follow-up prompts acquire
+the same lifetime-bound modal handoff through the prompt-entry hook, and
+concurrent service prompts are serialized so two widgets never read stdin at
+once.
+
+Typing `/` opens the complete registered command catalog. Search includes
+canonical names and aliases; Up/Down changes the selection, and Enter inserts
+the selected template into the editor for partial matches and commands that
+require arguments. A later Enter submits that populated input; a fully typed
+exact command that needs no expansion submits normally. Palette descriptions
+expose `[now]`, `[queued]`, and `[interrupt]` so the queue behavior is visible
+before submission. The selected entry is rendered as the first hint row so it
+remains visible when the terminal can show only a constrained input viewport.
 
 ## Distribution — single source, two surfaces
 
@@ -422,14 +477,14 @@ Compilation is outside the application runtime boundary and is always executed
 through resource-capped Docker wrappers. Host Cargo is not an emergency
 fallback. `dbuild.sh` owns individual Cargo commands, `dverify.sh` owns
 sequential gate profiles, and `dbuild-image.sh` owns BuildKit. Each path shares
-storage admission, effective-limit inspection, a machine-wide lock, watchdogs,
-and structured failure reports. Automated CI/CD is disabled; maintainers invoke
-these wrappers explicitly. The
-normative contract is [Docker-only build safety](https://github.com/agnusdei1207/pentesting/blob/main/docs/BUILD_SAFETY.md).
-
-Patch publication performs one Cross build. The version-checked, checksummed
-AMD64 musl artifact is uploaded to GitHub and packaged into Docker from a
-minimal context; its dependency cache stays in a versioned Docker volume.
+storage admission, effective-limit inspection, a machine-wide lock, watchdogs,
+and structured failure reports. Automated CI/CD is disabled; maintainers invoke
+these wrappers explicitly. The
+normative contract is [Docker-only build safety](https://github.com/agnusdei1207/pentesting/blob/main/docs/BUILD_SAFETY.md).
+
+Patch publication performs one Cross build. The version-checked, checksummed
+AMD64 musl artifact is uploaded to GitHub and packaged into Docker from a
+minimal context; its dependency cache stays in a versioned Docker volume.
 
 The measured next-stage simplification and deletion plan is indexed at
 [Minimal Core plan](https://github.com/agnusdei1207/pentesting/blob/main/docs/plans/2026/07/10/minimal-core/README.md).
@@ -443,9 +498,9 @@ overridden by project-local `.pentesting.toml` files discovered by walking up
 from the working directory. Local storage is the default; normal setup only
 needs the public model endpoint environment.
 
-The full file shape is represented in `builder.schema.json`; common runtime and
-CTF fields are editable through `/config`. Set `PENTESTING_CONFIG` to override
-the global config directory.
+The full file shape is represented in `builder.schema.json`; common runtime and
+CTF fields are editable through `/config`. Set `PENTESTING_CONFIG` to override
+the global config directory.
 
 | Variable | Description |
 | --- | --- |
@@ -474,7 +529,7 @@ Inside an interactive session, these commands inspect and drive runtime state
 (`/help` lists the full set):
 
 ```text
-/status        Show the current run phase, active tasks, hooks, and budget signals
+/status        Show goal/mode/queue, turn vs mission, run gates, budgets, and a bounded read-only battlefield
 /workflow report
                Export the active run, engagement metadata, evidence, and large outputs to Markdown
 /context       Show recent context-budget snapshots for the current conversation
@@ -483,7 +538,7 @@ Inside an interactive session, these commands inspect and drive runtime state
 /agent         Switch the active agent
 /conversation  Browse conversations for the active workspace
 /goal <task>   Set the active goal without enabling autonomous mode
-/auto          Toggle autonomous mode for the current goal (default: off; Esc stops it)
+/auto          Toggle autonomous mode for the current goal (default: off; Esc stops it)
 /update        Download and apply the latest public release asset for supported native targets
 /help          Show all commands
 /exit          Quit

package/README.md

@@ -1,103 +1,126 @@
-# Pentesting 🔓
-
+# Pentesting 🔓
+
 <div align="center">
   <img src="https://api.iconify.design/hugeicons:bash.svg" alt="pentesting bash icon" width="120" />
-  <h1>pentesting</h1>
-  <p>Security-Focused Agent Runtime</p>
-
-[![MIT License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
-[![npm](https://img.shields.io/npm/v/pentesting.svg)](https://www.npmjs.com/package/pentesting)
-</div>
+  <h1>A High-Efficiency Penetration-Testing Agent</h1>
+  <p>Designed to achieve strong results with low-cost models. Powered by Rust.</p>
+
+[![MIT License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
+[![npm](https://img.shields.io/npm/v/pentesting.svg)](https://www.npmjs.com/package/pentesting)
+</div>
+
+---
+
+## 🚀 Quick Start
+
+Install globally, or run once with a Node package runner (Node.js 18.18+):
+
+```bash
+npm install -g pentesting && pentesting   # install
+npx pentesting                            # or run once, no install
+pnpm dlx pentesting
+yarn dlx pentesting
+```
+
+### 🐳 Run with Docker
+
+No local toolchain needed. Published images are `linux/amd64` only.
+
+```bash
+export OPENAI_API_KEY="sk-..."                 # provider API key or gateway token
+export OPENAI_BASE_URL="https://api.openai.com/v1"
+export OPENAI_MODEL="gpt-4o"
+export OPENAI_MAX_TOKENS="4096"
+
+docker run -it --rm \
+  -v "$(pwd):/workspace" \
+  -v pentesting-config:/root/.pentesting \
+  -w /workspace \
+  -e OPENAI_API_KEY \
+  -e OPENAI_BASE_URL \
+  -e OPENAI_MODEL \
+  -e OPENAI_MAX_TOKENS \
+  agnusdei1207/pentesting:latest
+```
+
+Provider variables are optional — the TUI launches without them and lets you log in inside the persistent `pentesting-config` volume. The TUI pre-fills output max tokens from the model; `OPENAI_MAX_TOKENS` overrides it.
+
+---
+
+## ✅ Capabilities
+
+| Area | What it does |
+| --- | --- |
+| Verified agent loop | Streams actions and observations; a model Stop ends only the turn, evidence-backed verification closes the mission, and the full trajectory is persisted |
+| Unified tool boundary | Built-in, delegated, and MCP calls share schema validation, provenance, permissions, policy, and resource limits |
+| Context economy | Automatic micro-pruning and model-triggered summaries preserve useful context for low-cost models |
+| Deterministic steering | Esc stops the current turn and auto loop, while submitted input resumes in FIFO order at safe turn boundaries |
+| Reverse-shell & PTY lifecycle | One control plane manages authorized callbacks and local PTY/pipe sessions, from tagging, probing, and verified upgrades to transcripts, evidence, FD accounting, and deterministic reclamation |
+| Bounded battlefield | A persistent Lead ledger produces a compact on-demand attention brief and read-only `/status` view; dispatch stays explicit and is capped at four branches |
+| Adversarial pathfinding | A localized AlphaGo-inspired minimax technique models an opponent's best defensive move and improves the ability to find viable bypass paths |
+| Dynamic fan-out / fan-in | The model sizes each specialist batch to the task, runs up to four delegated branches concurrently, then returns their results to the parent with bounded depth and recorded lineage |
+| Extensible skills & tools | Discovers MCP tools dynamically and layers Markdown skills onto the same guarded runtime surface |
+| Forgetting-aware memory | Ebbinghaus-style decaying notes combine with lexical, semantic, and graph retrieval |
 
 ---
 
-## 🚀 Quick Start
-
-Install globally, or run once with a Node package runner (Node.js 18.18+):
-
-```bash
-npm install -g pentesting && pentesting   # install
-npx pentesting                            # or run once, no install
-pnpm dlx pentesting
-yarn dlx pentesting
-```
+## 🧭 Philosophy
 
-### 🐳 Run with Docker
-
-No local toolchain needed. Published images are `linux/amd64` only.
-
-```bash
-export OPENAI_API_KEY="sk-..."                 # provider API key or gateway token
-export OPENAI_BASE_URL="https://api.openai.com/v1"
-export OPENAI_MODEL="gpt-4o"
-export OPENAI_MAX_TOKENS="4096"
-
-docker run -it --rm \
-  -v "$(pwd):/workspace" \
-  -v pentesting-config:/root/.pentesting \
-  -w /workspace \
-  -e OPENAI_API_KEY \
-  -e OPENAI_BASE_URL \
-  -e OPENAI_MODEL \
-  -e OPENAI_MAX_TOKENS \
-  agnusdei1207/pentesting:latest
-```
+| Principle | What it means here |
+| --- | --- |
+| Simplicity is best | Prefer the smallest design that preserves the capability, makes ownership clear, and remains easy to verify |
+| If it cannot be measured, it cannot be improved | Instrument outcomes, compare them under repeatable conditions, and let evidence drive the next change |
+| The best design blueprint is the human being | Better systems begin with better self-observation: understand how we perceive, decide, learn, and recover, then make those loops observable |
+| The agent is the bottleneck | As AI models advance, the agent framework and the surrounding system must evolve with them |
 
-Provider variables are optional — the TUI launches without them and lets you log in inside the persistent `pentesting-config` volume. The TUI pre-fills output max tokens from the model; `OPENAI_MAX_TOKENS` overrides it.
+### Capability record
 
----
+| Date | Record | Test conditions |
+| --- | --- | --- |
+| 2026-04 | Project work began | Initial implementation and baseline work |
+| 2026-07-15 | First project-reported result in which Pentesting exceeded Claude Code on the tested penetration-testing capability set; reported margin: approximately 40% | Pentesting with MiniMax M3 versus Claude Code with Sonnet 5; identical prompts; CTF tasks ranging from easy to hard; a 60-minute test window for each system |
 
-## ✅ Capabilities
+This is a project-maintained, task-specific record, not an independent or general-purpose benchmark. It does not claim broader general-purpose superiority.
 
-| Area | What it does |
-| --- | --- |
-| Model-driven loop | Streaming action/observation loop; a model Stop ends a turn, verified artifacts close a mission, and the full turn trajectory is persisted |
-| Tool guardrails | Read-before-edit enforcement, repeat-call guard, policy-gated file/shell/network |
-| Permissions | Allow / Deny / Confirm, with once/always decisions persisted |
-| Context compaction | Automatic micro-pruning + model-triggered summarization |
-| Interrupt & steering | Esc stops the current turn and auto loop; queued input uses revisioned FIFO amend/replace semantics |
-| Reverse-shell control plane | Accept and track authorized callbacks, tag/probe sessions, verify PTY upgrades, keep transcript/evidence records |
-| PTY session control | One actor owns each socket/PTY/pipe, command queue, transcript, and child lifecycle, with FD accounting and deterministic reclamation |
-| Frontier-guided exploration | Persistent lead ledger with explicit dispatch; breadth defaults to one and is hard-capped at four |
-| Subagents | Explicit delegation to built-in specialists (`crypto`, `rev`, `pwn`); one selected agent can run up to four tasks concurrently |
-| MCP & skills | Dynamic MCP tool discovery, layered markdown skills |
-| Memory | Ebbinghaus-style decaying notes + hybrid lexical/semantic/graph retrieval |
+> Claude Code's strength is generality, an area where Pentesting was weaker. Even so, it was strong enough to become a foundation that other products wrapped for penetration-testing workflows. To me, it felt like a formidable wall—and, at the same time, the goal I wanted to surpass.
 
 ---
 
-## ⌨️ Interactive commands
-
-Sessions start with auto mode off. Esc stops both the current turn and autonomous continuation. Queued input replays in FIFO order.
+## ⌨️ Slash commands
 
 | Command | Purpose |
 | --- | --- |
-| `/help` | List every command |
-| `/model [query]` | Choose a provider/model or custom endpoint |
-| `/goal <objective>` · `/auto` | Record a goal, then toggle autonomous continuation; Esc stops it |
-| `/status` · `/usage` | Inspect run state, gates, budgets, tokens, and requests |
-| `/context` · `/memory` | Inspect context-budget snapshots and stored memories |
-| `/agent` · `/builder` · `/planner` · `/researcher` | Select the active agent |
-| `/new` · `/retry` · `/compact` | Start fresh, retry the last turn, or compact context |
-| `/config` · `/tools` · `/skill` | Configure the runtime and inspect capabilities |
-| `/workflow report` | Export the active run as Markdown |
-| `/update` · `/exit` | Update the native release or quit |
-
-> The command you run is always **`pentesting`**. The internal engine is **`builder`** — `pentesting` runs it under the hood; the engine name never surfaces in normal use.
-
----
-
+| `/help` | Show commands |
+| `/model [query]` | Switch provider, model, or custom endpoint |
+| `/goal <objective>` | Set or clear the active goal |
+| `/auto` | Run the active goal automatically; Esc stops it |
+| `/status` | Show the current run and verified mission status |
+| `/new` · `/retry` | Start a new conversation or retry the last turn |
+| `/config` | Edit runtime configuration |
+| `/exit` | Quit |
+
+> The command you run is always **`pentesting`**. The internal engine is **`builder`** — `pentesting` runs it under the hood; the engine name never surfaces in normal use.
+
+---
+
 ## 🎹 From the Developer
 
 <div align="center">
   <img src="https://github.com/user-attachments/assets/abe73474-f27b-4536-b358-fedef1e461f0" alt="Chopin Ballade No.4" width="600" />
 </div>
-
-<br/>
-
-> "I believe playing the piano is also a form of orchestration."
->
-> The harmony of polyphony — multiple voices — and homophony — a single melodic line.
->
+
+<br/>
+
+> "I believe playing the piano is also a form of orchestration."
+>
+> The harmony of polyphony — multiple voices — and homophony — a single melodic line.
+>
 > Each voice sings its most beautiful song from its own place, yet when combined, they create one grand, beautiful melody. I believe this structure is no different from AI agents.
 >
 > — *agnusdei1207*
+
+### First principles
+
+> Since the AI era began, I have studied many highly starred agent systems, but their machinery often obscured a clear philosophy. The ideas that actually improved performance came from observing myself and returning to computer science fundamentals—Kruskal and Prim, divide and conquer, backtracking, Monte Carlo methods, and time/space complexity. My conclusion is simple: observe yourself, master the fundamentals, and build from there.
+
+> I use Pentesting to study CTFs and penetration testing.

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "pentesting",
-  "version": "0.100.14",
-  "builderReleaseTag": "v0.100.14",
-  "description": "pentesting — coding agent runtime with audited reverse-shell capture, verified PTY session upgrades, pivot control, evidence transcripts, and safe session reclamation.",
+  "version": "0.101.2",
+  "builderReleaseTag": "v0.101.2",
+  "description": "Penetration testing AI agent powered by Rust, with audited reverse-shell capture, verified PTY upgrades, and evidence-first orchestration.",
   "license": "MIT",
   "author": "agnusdei1207",
   "type": "module",
@@ -36,8 +36,7 @@
     "hacker",
     "ai",
     "autonomous",
-    "claude",
-    "anthropic",
+    "rust",
     "tui",
     "cli",
     "nmap",