pentesting 0.100.4 → 0.100.7

package/lib/runtime.mjs

@@ -1,189 +1,182 @@
-import { createWriteStream, readFileSync } from "node:fs";
-import { chmod, mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
-import path from "node:path";
-import { Readable } from "node:stream";
-import { pipeline } from "node:stream/promises";
-import process from "node:process";
-import { fileURLToPath } from "node:url";
-
-const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const PACKAGE_JSON = JSON.parse(
-  readFileSync(new URL("../package.json", import.meta.url), "utf8"),
-);
-const MANAGED_BINARY_DIR = path.join(PACKAGE_ROOT, "vendor");
-const MANAGED_BINARY_MANIFEST = path.join(MANAGED_BINARY_DIR, "pentesting-manifest.json");
-
-const RELEASE_TARGETS = {
-  // Native binaries published as release assets. Linux uses musl (static, covers
-  // x64/arm64); android is the cross-built target. macOS/Windows are not
-  // cross-buildable from the Linux release host, so they are served by the
-  // Docker image (see the Unsupported-platform error below).
-  "android:arm64": {
-    assetName: "pentesting-aarch64-linux-android",
-    binaryFileName: "builder",
-    label: "android-arm64",
-  },
-  "linux:x64": {
-    assetName: "pentesting-x86_64-unknown-linux-musl",
-    binaryFileName: "builder",
-    label: "linux-x64",
-  },
-};
-
-export function packageVersion() {
-  return PACKAGE_JSON.version;
-}
-
-export function configuredBuilderReleaseTag() {
-  const releaseTag = PACKAGE_JSON.builderReleaseTag;
-  return typeof releaseTag === "string" && releaseTag.trim() ? releaseTag.trim() : undefined;
-}
-
-export function releaseRepository() {
-  return process.env.PENTESTING_REPO || "agnusdei1207/pentesting-public";
-}
-
-export function defaultReleaseTag(version = undefined) {
-  const resolvedVersion = version ?? configuredBuilderReleaseTag() ?? packageVersion();
-  if (resolvedVersion.startsWith("v")) {
-    return resolvedVersion;
-  }
-  return /^\d+\.\d+\.\d+(?:[-+].+)?$/.test(resolvedVersion)
-    ? `v${resolvedVersion}`
-    : "latest";
-}
-
-export function resolveReleaseAsset(platform = process.platform, arch = process.arch) {
-  const target = RELEASE_TARGETS[`${platform}:${arch}`];
-  if (!target) {
-    const supported = Object.keys(RELEASE_TARGETS).join(", ");
-    throw new Error(
-        `No native pentesting binary for '${platform}/${arch}'. ` +
-        `Native targets: ${supported}. ` +
-        `On macOS/Windows run it via Docker instead: ` +
-        `docker run -it --rm -v "$(pwd):/workspace" -v pentesting-config:/root/.pentesting -w /workspace -e OPENAI_API_KEY -e OPENAI_BASE_URL -e OPENAI_MODEL -e OPENAI_MAX_TOKENS agnusdei1207/pentesting`,
-    );
-  }
-  return target;
-}
-
-export function releaseAssetUrl(assetName, options = {}) {
-  const repo = options.repo || releaseRepository();
-  const releaseTag = options.releaseTag || defaultReleaseTag();
-  if (releaseTag === "latest") {
-    return `https://github.com/${repo}/releases/latest/download/${assetName}`;
-  }
-  return `https://github.com/${repo}/releases/download/${releaseTag}/${assetName}`;
-}
-
-async function pathExists(filePath) {
-  try {
-    await stat(filePath);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-async function manifestMatches(expected) {
-  try {
-    const raw = JSON.parse(await readFile(MANAGED_BINARY_MANIFEST, "utf8"));
-    return (
-      raw.assetName === expected.assetName &&
-      raw.releaseTag === expected.releaseTag &&
-      raw.repo === expected.repo
-    );
-  } catch {
-    return false;
-  }
-}
-
-export async function installManagedBuilder(options = {}) {
-  if (process.env.PENTESTING_BIN) {
-    return { binaryPath: process.env.PENTESTING_BIN, source: "external" };
-  }
-
-  const target = resolveReleaseAsset();
-  const repo = options.repo || releaseRepository();
-  const releaseTag = options.releaseTag || defaultReleaseTag();
-  const binaryPath = path.join(MANAGED_BINARY_DIR, target.binaryFileName);
-  const manifest = { assetName: target.assetName, releaseTag, repo };
-
-  if (!options.force && (await pathExists(binaryPath)) && (await manifestMatches(manifest))) {
-    return { binaryPath, source: "cached", ...manifest };
-  }
-
-  if (process.env.PENTESTING_SKIP_DOWNLOAD === "true") {
-    return { binaryPath, source: "skipped", ...manifest };
-  }
-
-  await mkdir(MANAGED_BINARY_DIR, { recursive: true });
-  const downloadUrl = releaseAssetUrl(target.assetName, { repo, releaseTag });
-  const response = await fetch(downloadUrl);
-
-  if (!response.ok || !response.body) {
-    throw new Error(
-      `Failed to download ${target.assetName} from ${downloadUrl} (${response.status} ${response.statusText}).`,
-    );
-  }
-
-  const tempPath = path.join(MANAGED_BINARY_DIR, `${target.binaryFileName}.download`);
-  await rm(tempPath, { force: true });
-  await pipeline(Readable.fromWeb(response.body), createWriteStream(tempPath));
-  if (process.platform !== "win32") {
-    await chmod(tempPath, 0o755);
-  }
-  await rm(binaryPath, { force: true });
-  await rename(tempPath, binaryPath);
-  await writeFile(
-    MANAGED_BINARY_MANIFEST,
-    JSON.stringify(
-      {
-        ...manifest,
-        downloadedAt: new Date().toISOString(),
-      },
-      null,
-      2,
-    ),
-    "utf8",
-  );
-
-  return { binaryPath, source: "downloaded", ...manifest };
-}
-
-export async function resolveBuilderBinary(options = {}) {
-  if (process.env.PENTESTING_BIN) {
-    return process.env.PENTESTING_BIN;
-  }
-
-  const target = resolveReleaseAsset();
-  const binaryPath = path.join(MANAGED_BINARY_DIR, target.binaryFileName);
-  if (await pathExists(binaryPath)) {
-    return binaryPath;
-  }
-
-  if (options.downloadIfMissing) {
-    const install = await installManagedBuilder();
-    if (install.source === "skipped") {
-      throw new Error(
-        "Managed Builder download was skipped and no PENTESTING_BIN override was provided.",
-      );
-    }
-    return install.binaryPath;
-  }
-
-  throw new Error(
-    "No managed Builder binary is available. Reinstall the pentesting package or set PENTESTING_BIN.",
-  );
-}
-
-export function translateBuilderInvocation(argv) {
-  return { builderArgs: argv, warnings: [] };
-}
-
-export function pentestingEnvironment(baseEnv = process.env) {
-  return {
-    ...baseEnv,
-    PENTESTING_PRODUCT_NAME: "pentesting",
-  };
-}
+import { createWriteStream, readFileSync } from "node:fs";
+import { chmod, mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const PACKAGE_JSON = JSON.parse(
+  readFileSync(new URL("../package.json", import.meta.url), "utf8"),
+);
+const MANAGED_BINARY_DIR = path.join(PACKAGE_ROOT, "vendor");
+const MANAGED_BINARY_MANIFEST = path.join(MANAGED_BINARY_DIR, "pentesting-manifest.json");
+
+const RELEASE_TARGETS = {
+  // Native binaries published as release assets. Linux x64 uses musl (static).
+  // Other platforms use the published linux/amd64 image through Docker.
+  "linux:x64": {
+    assetName: "pentesting-x86_64-unknown-linux-musl",
+    binaryFileName: "builder",
+    label: "linux-x64",
+  },
+};
+
+export function packageVersion() {
+  return PACKAGE_JSON.version;
+}
+
+export function configuredBuilderReleaseTag() {
+  const releaseTag = PACKAGE_JSON.builderReleaseTag;
+  return typeof releaseTag === "string" && releaseTag.trim() ? releaseTag.trim() : undefined;
+}
+
+export function releaseRepository() {
+  return process.env.PENTESTING_REPO || "agnusdei1207/pentesting-public";
+}
+
+export function defaultReleaseTag(version = undefined) {
+  const resolvedVersion = version ?? configuredBuilderReleaseTag() ?? packageVersion();
+  if (resolvedVersion.startsWith("v")) {
+    return resolvedVersion;
+  }
+  return /^\d+\.\d+\.\d+(?:[-+].+)?$/.test(resolvedVersion)
+    ? `v${resolvedVersion}`
+    : "latest";
+}
+
+export function resolveReleaseAsset(platform = process.platform, arch = process.arch) {
+  const target = RELEASE_TARGETS[`${platform}:${arch}`];
+  if (!target) {
+    const supported = Object.keys(RELEASE_TARGETS).join(", ");
+    throw new Error(
+        `No native pentesting binary for '${platform}/${arch}'. ` +
+        `Native targets: ${supported}. ` +
+        `On macOS or Windows, or on a non-amd64 host, use the linux/amd64 Docker image instead: ` +
+        `docker run -it --rm -v "$(pwd):/workspace" -v pentesting-config:/root/.pentesting -w /workspace -e OPENAI_API_KEY -e OPENAI_BASE_URL -e OPENAI_MODEL -e OPENAI_MAX_TOKENS agnusdei1207/pentesting`,
+    );
+  }
+  return target;
+}
+
+export function releaseAssetUrl(assetName, options = {}) {
+  const repo = options.repo || releaseRepository();
+  const releaseTag = options.releaseTag || defaultReleaseTag();
+  if (releaseTag === "latest") {
+    return `https://github.com/${repo}/releases/latest/download/${assetName}`;
+  }
+  return `https://github.com/${repo}/releases/download/${releaseTag}/${assetName}`;
+}
+
+async function pathExists(filePath) {
+  try {
+    await stat(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function manifestMatches(expected) {
+  try {
+    const raw = JSON.parse(await readFile(MANAGED_BINARY_MANIFEST, "utf8"));
+    return (
+      raw.assetName === expected.assetName &&
+      raw.releaseTag === expected.releaseTag &&
+      raw.repo === expected.repo
+    );
+  } catch {
+    return false;
+  }
+}
+
+export async function installManagedBuilder(options = {}) {
+  if (process.env.PENTESTING_BIN) {
+    return { binaryPath: process.env.PENTESTING_BIN, source: "external" };
+  }
+
+  const target = resolveReleaseAsset();
+  const repo = options.repo || releaseRepository();
+  const releaseTag = options.releaseTag || defaultReleaseTag();
+  const binaryPath = path.join(MANAGED_BINARY_DIR, target.binaryFileName);
+  const manifest = { assetName: target.assetName, releaseTag, repo };
+
+  if (!options.force && (await pathExists(binaryPath)) && (await manifestMatches(manifest))) {
+    return { binaryPath, source: "cached", ...manifest };
+  }
+
+  if (process.env.PENTESTING_SKIP_DOWNLOAD === "true") {
+    return { binaryPath, source: "skipped", ...manifest };
+  }
+
+  await mkdir(MANAGED_BINARY_DIR, { recursive: true });
+  const downloadUrl = releaseAssetUrl(target.assetName, { repo, releaseTag });
+  const response = await fetch(downloadUrl);
+
+  if (!response.ok || !response.body) {
+    throw new Error(
+      `Failed to download ${target.assetName} from ${downloadUrl} (${response.status} ${response.statusText}).`,
+    );
+  }
+
+  const tempPath = path.join(MANAGED_BINARY_DIR, `${target.binaryFileName}.download`);
+  await rm(tempPath, { force: true });
+  await pipeline(Readable.fromWeb(response.body), createWriteStream(tempPath));
+  if (process.platform !== "win32") {
+    await chmod(tempPath, 0o755);
+  }
+  await rm(binaryPath, { force: true });
+  await rename(tempPath, binaryPath);
+  await writeFile(
+    MANAGED_BINARY_MANIFEST,
+    JSON.stringify(
+      {
+        ...manifest,
+        downloadedAt: new Date().toISOString(),
+      },
+      null,
+      2,
+    ),
+    "utf8",
+  );
+
+  return { binaryPath, source: "downloaded", ...manifest };
+}
+
+export async function resolveBuilderBinary(options = {}) {
+  if (process.env.PENTESTING_BIN) {
+    return process.env.PENTESTING_BIN;
+  }
+
+  const target = resolveReleaseAsset();
+  const binaryPath = path.join(MANAGED_BINARY_DIR, target.binaryFileName);
+  if (await pathExists(binaryPath)) {
+    return binaryPath;
+  }
+
+  if (options.downloadIfMissing) {
+    const install = await installManagedBuilder();
+    if (install.source === "skipped") {
+      throw new Error(
+        "Managed Builder download was skipped and no PENTESTING_BIN override was provided.",
+      );
+    }
+    return install.binaryPath;
+  }
+
+  throw new Error(
+    "No managed Builder binary is available. Reinstall the pentesting package or set PENTESTING_BIN.",
+  );
+}
+
+export function translateBuilderInvocation(argv) {
+  return { builderArgs: argv, warnings: [] };
+}
+
+export function pentestingEnvironment(baseEnv = process.env) {
+  return {
+    ...baseEnv,
+    PENTESTING_PRODUCT_NAME: "pentesting",
+  };
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pentesting",
-  "version": "0.100.4",
-  "builderReleaseTag": "v0.100.1",
+  "version": "0.100.7",
+  "builderReleaseTag": "v0.100.7",
   "description": "pentesting — coding agent runtime with audited reverse-shell capture, verified PTY session upgrades, pivot control, evidence transcripts, and safe session reclamation.",
   "license": "MIT",
   "author": "agnusdei1207",
@@ -72,9 +72,9 @@
     "public:sync": "bash scripts/sync-public-repo.sh",
     "public:mirror-release": "bash scripts/mirror-public-release.sh",
     "release:backfill": "bash scripts/backfill-release-local.sh",
-    "check:docker": "sh -c ': \"${OPENAI_API_KEY:?Set OPENAI_API_KEY}\"; : \"${OPENAI_BASE_URL:?Set OPENAI_BASE_URL}\"; : \"${OPENAI_MODEL:?Set OPENAI_MODEL}\"; : \"${OPENAI_MAX_TOKENS:?Set OPENAI_MAX_TOKENS}\"; npm run docker:build && docker run -it --rm -v builder-workspace:/workspace -v pentesting-config:/root/.pentesting -e OPENAI_API_KEY -e OPENAI_BASE_URL -e OPENAI_MODEL -e OPENAI_MAX_TOKENS agnusdei1207/pentesting:latest'",
-    "docker:build": "(docker image inspect agnusdei1207/pentesting-build-base:1.96 >/dev/null 2>&1 && docker image inspect agnusdei1207/pentesting-runtime-base:26.04 >/dev/null 2>&1 || npm run docker:base:build) && docker build --build-arg APP_VERSION=$(git describe --tags --abbrev=0 2>/dev/null || echo dev) -t agnusdei1207/pentesting:latest .",
-    "docker:base:build": "docker build -t agnusdei1207/pentesting-build-base:1.96 -f docker/build-base.Dockerfile . && docker build -t agnusdei1207/pentesting-runtime-base:26.04 -f docker/runtime-base.Dockerfile .",
+    "check:docker": "npm run docker:build && docker run -it --rm --memory 2g --memory-swap 2g --cpus 2 --pids-limit 512 -v builder-workspace:/workspace -v pentesting-config:/root/.pentesting -e OPENAI_API_KEY -e OPENAI_BASE_URL -e OPENAI_MODEL -e OPENAI_MAX_TOKENS agnusdei1207/pentesting:latest",
+    "docker:build": "bash scripts/dbuild-image.sh app",
+    "docker:base:build": "bash scripts/dbuild-image.sh bases",
     "release:patch": "./scripts/release-all.sh patch",
     "release:minor": "./scripts/release-all.sh minor",
     "release:major": "./scripts/release-all.sh major"

package/pentesting-logo.svg

@@ -1,13 +1,13 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" aria-hidden="true">
-  <g
-    fill="none"
-    stroke="#00d4aa"
-    stroke-linecap="round"
-    stroke-linejoin="round"
-    stroke-width="1.5"
-  >
-    <path d="m7 7l1.227 1.057C8.742 8.502 9 8.724 9 9s-.258.498-.773.943L7 11" />
-    <path d="M11 11h3" />
-    <path d="M12 21c3.75 0 5.625 0 6.939-.955a5 5 0 0 0 1.106-1.106C21 17.625 21 15.749 21 12s0-5.625-.955-6.939a5 5 0 0 0-1.106-1.106C17.625 3 15.749 3 12 3s-5.625 0-6.939.955A5 5 0 0 0 3.955 5.06C3 6.375 3 8.251 3 12s0 5.625.955 6.939a5 5 0 0 0 1.106 1.106C6.375 21 8.251 21 12 21" />
-  </g>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" aria-hidden="true">
+  <g
+    fill="none"
+    stroke="#00d4aa"
+    stroke-linecap="round"
+    stroke-linejoin="round"
+    stroke-width="1.5"
+  >
+    <path d="m7 7l1.227 1.057C8.742 8.502 9 8.724 9 9s-.258.498-.773.943L7 11" />
+    <path d="M11 11h3" />
+    <path d="M12 21c3.75 0 5.625 0 6.939-.955a5 5 0 0 0 1.106-1.106C21 17.625 21 15.749 21 12s0-5.625-.955-6.939a5 5 0 0 0-1.106-1.106C17.625 3 15.749 3 12 3s-5.625 0-6.939.955A5 5 0 0 0 3.955 5.06C3 6.375 3 8.251 3 12s0 5.625.955 6.939a5 5 0 0 0 1.106 1.106C6.375 21 8.251 21 12 21" />
+  </g>
+</svg>

package/scripts/postinstall.mjs

@@ -1,33 +1,33 @@
-import { installManagedBuilder } from "../lib/runtime.mjs";
-
-if (process.env.PENTESTING_BIN) {
-  console.log("[pentesting] PENTESTING_BIN is set; skipping managed Builder download.");
-  process.exit(0);
-}
-
-if (process.env.PENTESTING_SKIP_DOWNLOAD === "true") {
-  console.log("[pentesting] Skipping managed Builder download.");
-  process.exit(0);
-}
-
-try {
-  const result = await installManagedBuilder({
-    force: process.env.PENTESTING_FORCE_DOWNLOAD === "true",
-  });
-
-  if (result.source === "cached") {
-    console.log("[pentesting] Runtime already installed.");
-  } else if (result.source === "downloaded") {
-    console.log("[pentesting] Runtime downloaded successfully.");
-  }
-} catch (error) {
-  // Non-fatal: never break `npm i pentesting`. The runtime is fetched on first
-  // run (resolveBuilderBinary downloads if missing), so a failed/offline
-  // postinstall just defers the download instead of failing the install.
-  console.warn(
-    `[pentesting] Runtime not pre-downloaded (${
-      error instanceof Error ? error.message : String(error)
-    }). It will be fetched automatically on first run.`,
-  );
-  process.exit(0);
-}
+import { installManagedBuilder } from "../lib/runtime.mjs";
+
+if (process.env.PENTESTING_BIN) {
+  console.log("[pentesting] PENTESTING_BIN is set; skipping managed Builder download.");
+  process.exit(0);
+}
+
+if (process.env.PENTESTING_SKIP_DOWNLOAD === "true") {
+  console.log("[pentesting] Skipping managed Builder download.");
+  process.exit(0);
+}
+
+try {
+  const result = await installManagedBuilder({
+    force: process.env.PENTESTING_FORCE_DOWNLOAD === "true",
+  });
+
+  if (result.source === "cached") {
+    console.log("[pentesting] Runtime already installed.");
+  } else if (result.source === "downloaded") {
+    console.log("[pentesting] Runtime downloaded successfully.");
+  }
+} catch (error) {
+  // Non-fatal: never break `npm i pentesting`. The runtime is fetched on first
+  // run (resolveBuilderBinary downloads if missing), so a failed/offline
+  // postinstall just defers the download instead of failing the install.
+  console.warn(
+    `[pentesting] Runtime not pre-downloaded (${
+      error instanceof Error ? error.message : String(error)
+    }). It will be fetched automatically on first run.`,
+  );
+  process.exit(0);
+}