pentesting 0.100.3 → 0.100.4

package/ARCHITECTURE.md

@@ -332,22 +332,19 @@ supported OS/CPU target from `agnusdei1207/pentesting-public`.
 
 Pentesting reads a user-global config from `~/.pentesting/.pentesting.toml`,
 overridden by project-local `.pentesting.toml` files discovered by walking up
-from the working directory. The storage config is intentionally small:
-
-```toml
-[storage]
-backend = "local"                            # Local md/fs runtime state
-```
+from the working directory. Local storage is the default; normal setup only
+needs the public model endpoint environment.
 
 The same shape is represented in `builder.schema.json`, `.pentesting.toml`, and
-the interactive `/config` UI.
-
-Environment variables use the `PENTESTING_` prefix, with `__` for nested keys —
-e.g. `PENTESTING_SESSION__MODEL_ID=...`. Set `PENTESTING_CONFIG` to override the
-global config directory.
+the interactive `/config` UI. Set `PENTESTING_CONFIG` to override the global
+config directory.
 
 | Variable | Description |
 | --- | --- |
+| `OPENAI_API_KEY` | API key or gateway token for OpenAI-compatible providers. |
+| `OPENAI_BASE_URL` | OpenAI-compatible base URL, for example `https://api.openai.com/v1` or a self-hosted gateway. |
+| `OPENAI_MODEL` | Default model id. |
+| `OPENAI_MAX_TOKENS` | Optional output-token override; accepts values like `4096`, `32k`, or `1M`. |
 | `PENTESTING_BIN` | Use an already-installed Builder binary instead of the managed download. |
 | `PENTESTING_PRODUCT_NAME` | Runtime banner label. The `pentesting` launcher sets this to `pentesting` automatically. |
 | `PENTESTING_REPO` | Override the public release repo used for binary downloads. Defaults to `agnusdei1207/pentesting-public`. |

package/README.md

@@ -17,7 +17,7 @@ The runtime—not the model—owns routing, tool sandboxing, verification, compl
 
 ## ✅ Capabilities
 
-Agent-loop essentials at parity with leading coding agents, plus a security-focused layer on top.
+Agent-loop essentials plus a security-focused runtime layer.
 
 | Area | What it does |
 | --- | --- |
@@ -32,42 +32,39 @@ Agent-loop essentials at parity with leading coding agents, plus a security-focu
 | MCP & skills | Dynamic MCP tool discovery, layered markdown skills |
 | Memory | Ebbinghaus-style decaying notes + hybrid lexical/semantic/graph retrieval |
 
-**Beyond the baseline:** evidence-gated completion adjudication (Complete / Replan / Blocked), a CTF-oriented reverse-shell/PTY control plane (multi-session tracking, helper-only `pty_upgrade` plus verified `upgrade`, transcript/history/replay, lifecycle/FD management), and CTF-grade verification tools (flag check, best-of-N verify, findings ledger).
-
 ---
 
 ## 🚀 Quick Start
 
-Install globally, or run without installing via your package manager of choice:
+Install globally, or run once with a Node package runner:
 
 ```bash
 npm install -g pentesting && pentesting   # install
 npx pentesting                            # or run once, no install
 pnpm dlx pentesting
 yarn dlx pentesting
-bunx pentesting
-deno run npm:pentesting
 ```
 
+Requires Node.js 18.18+. Use npm/npx/pnpm/yarn; Bun and Deno runners are not supported.
+
 ### 🐳 Run with Docker
 
-No local Rust toolchain or native binary needed — the image ships the full
-runtime plus the offensive testing toolchain:
+No local Rust toolchain needed:
 
 ```bash
-export ANTHROPIC_AUTH_TOKEN="sk-..."                    # provider token
-export ANTHROPIC_API_KEY="$ANTHROPIC_AUTH_TOKEN"        # keep both for Anthropic-compatible gateways
-export ANTHROPIC_BASE_URL="https://api.minimax.io/anthropic"
-export ANTHROPIC_MODEL="MiniMax-M2.7"
-export PENTESTING_SESSION__MODEL_ID="$ANTHROPIC_MODEL"
+export OPENAI_API_KEY="sk-..."                 # provider API key or gateway token
+export OPENAI_BASE_URL="https://api.openai.com/v1"
+export OPENAI_MODEL="gpt-4o"
+export OPENAI_MAX_TOKENS="4096"
 
 docker run -it --rm \
-  -v "$(pwd):/workspace" -w /workspace \
-  -e ANTHROPIC_AUTH_TOKEN \
-  -e ANTHROPIC_API_KEY \
-  -e ANTHROPIC_BASE_URL \
-  -e ANTHROPIC_MODEL \
-  -e PENTESTING_SESSION__MODEL_ID \
+  -v "$(pwd):/workspace" \
+  -v pentesting-config:/root/.pentesting \
+  -w /workspace \
+  -e OPENAI_API_KEY \
+  -e OPENAI_BASE_URL \
+  -e OPENAI_MODEL \
+  -e OPENAI_MAX_TOKENS \
   agnusdei1207/pentesting:latest
 ```
 
@@ -75,12 +72,11 @@ Or via Docker Compose:
 
 ```bash
 PENTESTING_PROJECT_DIR=/path/to/project \
-ANTHROPIC_AUTH_TOKEN=sk-... \
-ANTHROPIC_API_KEY=sk-... \
-ANTHROPIC_BASE_URL=https://api.minimax.io/anthropic \
-ANTHROPIC_MODEL=MiniMax-M2.7 \
-PENTESTING_SESSION__MODEL_ID=MiniMax-M2.7 \
-docker compose run pentesting
+OPENAI_API_KEY=sk-... \
+OPENAI_BASE_URL=https://api.openai.com/v1 \
+OPENAI_MODEL=gpt-4o \
+OPENAI_MAX_TOKENS=4096 \
+docker compose run --rm pentesting
 ```
 
 ### Common commands
@@ -92,7 +88,7 @@ pentesting shell-listener --bind 127.0.0.1 --port 4444   # Authorized reverse-sh
 pentesting --version
 ```
 
-Use `shell-listener` in authorized CTF/lab work to accept multiple callbacks, label/tag sessions, probe remote identity, run sentinel-tracked commands, verify dumb-shell PTY upgrades, attach/detach without closing, and retain raw logs, transcripts, command history, replay data, and evidence manifests.
+Use `shell-listener` in authorized CTF/lab work to accept callbacks, tag sessions, run sentinel-tracked commands, verify PTY upgrades, and retain transcripts/evidence.
 
 Short version: the agent can catch a dumb reverse shell, upgrade it to a verified PTY, pivot to a second callback, and reclaim both sessions cleanly with `close` / `revoke` / `gc`.
 
@@ -100,7 +96,7 @@ Inside a session, `/help` lists every command and `/update` pulls the latest rel
 
 ### 🔌 Reverse-shell & PTY sessions
 
-Catch and manage authorized shell callbacks like a session manager — **one listener, many targets, full audit trail, no leaked file descriptors.**
+Catch and manage authorized shell callbacks: one listener, many targets, audited cleanup.
 
 ```bash
 pentesting shell-listener --port 4444             # 1. Catch callbacks (tracks many at once)
@@ -120,42 +116,35 @@ pentesting shell-session revoke --session 1       # 5. Hard-close: reclaim FDs +
 
 ## ⚙️ Configuration
 
-Pentesting reads `~/.pentesting/.pentesting.toml`, overridden by a project-local `.pentesting.toml`:
-
-```toml
-[storage]
-backend = "local"   # Local md/fs runtime state
-```
-
-Environment variables use the `PENTESTING_` prefix (`__` for nested keys, e.g. `PENTESTING_SESSION__MODEL_ID=...`). Full variable list and the legacy `BUILDER_*` aliases are documented in [`ARCHITECTURE.md`](ARCHITECTURE.md#configuration).
+Pentesting uses local storage by default. For normal use, configure only the model endpoint:
 
 ### Example `.env` / shell setup
 
 ```bash
-# Model provider credentials — set whichever provider(s) you use
-export ANTHROPIC_API_KEY="sk-ant-..."
-export ANTHROPIC_AUTH_TOKEN="$ANTHROPIC_API_KEY"         # token used by Anthropic-compatible providers
-export ANTHROPIC_BASE_URL="https://api.minimax.io/anthropic"
-export ANTHROPIC_MODEL="MiniMax-M2.7"
+# OpenAI-compatible provider or gateway
 export OPENAI_API_KEY="sk-..."
-export OPENROUTER_API_KEY="sk-or-..."
+export OPENAI_BASE_URL="https://api.openai.com/v1"
+export OPENAI_MODEL="gpt-4o"
+export OPENAI_MAX_TOKENS="4096"
 
 # Runtime overrides (optional)
-export PENTESTING_SESSION__MODEL_ID="$ANTHROPIC_MODEL"  # default model for new sessions
 export PENTESTING_CONFIG="$HOME/.config/pentesting"      # move the global config dir
 export PENTESTING_SKIP_DOWNLOAD=1                        # skip postinstall binary download (CI)
 ```
 
-With Docker, pass the same variables through with `-e`:
+The TUI pre-fills output max tokens from known model names/provider metadata. `OPENAI_MAX_TOKENS` and the TUI field are explicit overrides for custom/self-hosted models.
+
+With Docker, mount both your project and the persistent runtime config volume, then pass the same variables through with `-e`:
 
 ```bash
 docker run -it --rm \
-  -v "$(pwd):/workspace" -w /workspace \
-  -e ANTHROPIC_AUTH_TOKEN \
-  -e ANTHROPIC_API_KEY \
-  -e ANTHROPIC_BASE_URL \
-  -e ANTHROPIC_MODEL \
-  -e PENTESTING_SESSION__MODEL_ID \
+  -v "$(pwd):/workspace" \
+  -v pentesting-config:/root/.pentesting \
+  -w /workspace \
+  -e OPENAI_API_KEY \
+  -e OPENAI_BASE_URL \
+  -e OPENAI_MODEL \
+  -e OPENAI_MAX_TOKENS \
   agnusdei1207/pentesting:latest
 ```
 
@@ -166,6 +155,7 @@ docker run -it --rm \
 ## 📖 Documentation
 
 * [`ARCHITECTURE.md`](ARCHITECTURE.md) — Runtime flow, agent team, memory model, crate map, tool surface, and supported targets.
+* Internal layout: service traits are split under `builder_app/src/services/*`; OpenAI request conversion is isolated under `dto/openai/request/*`.
 * [Public site](https://agnusdei1207.github.io/pentesting-public/) — Landing page and public runtime entry surface.
 * [`compose.yaml`](https://github.com/agnusdei1207/pentesting-public) — Docker Compose facade for pentesting sessions.
 

package/lib/runtime.mjs

@@ -58,10 +58,10 @@ export function resolveReleaseAsset(platform = process.platform, arch = process.
   if (!target) {
     const supported = Object.keys(RELEASE_TARGETS).join(", ");
     throw new Error(
-      `No native pentesting binary for '${platform}/${arch}'. ` +
+        `No native pentesting binary for '${platform}/${arch}'. ` +
         `Native targets: ${supported}. ` +
         `On macOS/Windows run it via Docker instead: ` +
-        `docker run -it --rm -v "$(pwd):/workspace" agnusdei1207/pentesting`,
+        `docker run -it --rm -v "$(pwd):/workspace" -v pentesting-config:/root/.pentesting -w /workspace -e OPENAI_API_KEY -e OPENAI_BASE_URL -e OPENAI_MODEL -e OPENAI_MAX_TOKENS agnusdei1207/pentesting`,
     );
   }
   return target;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pentesting",
-  "version": "0.100.3",
-  "builderReleaseTag": "v0.100.0",
+  "version": "0.100.4",
+  "builderReleaseTag": "v0.100.1",
   "description": "pentesting — coding agent runtime with audited reverse-shell capture, verified PTY session upgrades, pivot control, evidence transcripts, and safe session reclamation.",
   "license": "MIT",
   "author": "agnusdei1207",
@@ -52,8 +52,9 @@
     "audit": "bash scripts/audit-project.sh",
     "test": "node --test tests/*.test.mjs",
     "preflight:local": "bash scripts/preflight-local.sh",
+    "refactor:stability": "bash scripts/refactor-stability.sh",
     "verify": "npm run consistency && npm run test",
-    "check": "npm run verify",
+    "check": "npm run check:docker",
     "pentesting:help": "bash scripts/pentesting-release-help.sh",
     "pentesting:status": "bash scripts/pentesting-release-status.sh",
     "pentesting:test": "npm run test",
@@ -71,7 +72,7 @@
     "public:sync": "bash scripts/sync-public-repo.sh",
     "public:mirror-release": "bash scripts/mirror-public-release.sh",
     "release:backfill": "bash scripts/backfill-release-local.sh",
-    "check:docker": "sh -c 'npm run docker:build && docker run -it --rm -v builder-workspace:/workspace -e ANTHROPIC_BASE_URL -e ANTHROPIC_AUTH_TOKEN -e ANTHROPIC_MODEL -e ANTHROPIC_API_KEY -e MINIMAX_API_KEY -e OPENAI_API_KEY -e OPENAI_BASE_URL -e GEMINI_API_KEY -e DEEPSEEK_API_KEY agnusdei1207/pentesting:latest'",
+    "check:docker": "sh -c ': \"${OPENAI_API_KEY:?Set OPENAI_API_KEY}\"; : \"${OPENAI_BASE_URL:?Set OPENAI_BASE_URL}\"; : \"${OPENAI_MODEL:?Set OPENAI_MODEL}\"; : \"${OPENAI_MAX_TOKENS:?Set OPENAI_MAX_TOKENS}\"; npm run docker:build && docker run -it --rm -v builder-workspace:/workspace -v pentesting-config:/root/.pentesting -e OPENAI_API_KEY -e OPENAI_BASE_URL -e OPENAI_MODEL -e OPENAI_MAX_TOKENS agnusdei1207/pentesting:latest'",
     "docker:build": "(docker image inspect agnusdei1207/pentesting-build-base:1.96 >/dev/null 2>&1 && docker image inspect agnusdei1207/pentesting-runtime-base:26.04 >/dev/null 2>&1 || npm run docker:base:build) && docker build --build-arg APP_VERSION=$(git describe --tags --abbrev=0 2>/dev/null || echo dev) -t agnusdei1207/pentesting:latest .",
     "docker:base:build": "docker build -t agnusdei1207/pentesting-build-base:1.96 -f docker/build-base.Dockerfile . && docker build -t agnusdei1207/pentesting-runtime-base:26.04 -f docker/runtime-base.Dockerfile .",
     "release:patch": "./scripts/release-all.sh patch",