pentesting 0.101.7 → 0.101.8

package/ARCHITECTURE.md

@@ -2,7 +2,9 @@
 
 This document reflects the current `main` branch architecture. It is the single,
 detailed reference for how the runtime is structured; the [README](README.md)
-stays intentionally short and usage-focused.
+stays intentionally short and usage-focused. For a diagram-level tour of the
+main runtime flows, see [Main Flows](docs/architecture/MAIN_FLOWS.md). Both are
+internal-only and are never mirrored to the public repo.
 
 > **Engine vs product.** The orchestration engine is **`builder`** — a
 > general-purpose, local-first Rust agent runtime. **`pentesting`** is the
@@ -394,11 +396,33 @@ battlefield rows. Core status read failures retain their existing error path.
 With no recorded run, `/status` still shows goal, manual/auto mode, queue, and
 usage without an evidence read. Recorded `TurnExit` and typed `MissionState` are
 shown separately so model Stop or run completion cannot appear as verified
-mission completion. The live status row deliberately remains limited to
-actionable progress/wait state: there is no frontier parsing, background refresh,
-write, dispatch shortcut, or hidden chrome state.
-
-Completed type-ahead inputs carry an explicit active-turn behavior. Safe
+mission completion. The live status row deliberately remains limited to
+actionable progress/wait state: there is no frontier parsing, background refresh,
+write, dispatch shortcut, or hidden chrome state.
+
+Interactive `/auto` progress is producer-owned rather than inferred from the
+latest conversation after the fact. Dispatch marks a self-prompt turn in flight;
+successful cleanup captures that turn's final assistant markdown in memory,
+records a deterministic completed-turn line in the transcript, and synchronizes
+optional `current/target` progress to the footer before queued user input is
+replayed. A regular `AUTO_GOAL_PROGRESS` line is observability-only.
+`AUTO_GOAL_COMPLETE` retains completion authority and
+`AUTO_GOAL_BLOCKED` remains non-terminal. Cancellation, goal/auto reset, and a
+manual user turn invalidate pending completion provenance so a later reply
+cannot be misattributed to the autonomous turn. Unexpected stream termination
+also revokes ownership before queue replay, and explicit stop interrupts disable
+auto mode before preserved input is replayed. Interrupt-listener shutdown
+linearizes the terminal boundary as stop, reader join, then pending-source
+recovery, so an Esc accepted concurrently with `TurnCompleted` wins before
+progress or completion can be committed. Tool/delegated-agent markdown and
+terminal events have no root completion authority while a nested producer owns
+the stream. The auto footer is process-level chrome: turn-local backend resets
+preserve it until an explicit UI state transition clears it. The footer receives
+a bounded single-line goal projection, while the deterministic progress title
+does not repeat the goal every turn, so multiline/control-bearing goals cannot
+corrupt fixed chrome or inflate transcript history.
+
+Completed type-ahead inputs carry an explicit active-turn behavior. Safe
 inspection commands (`/info`, `/usage`, `/context`, `/memory`, `/status`,
 `/help`, `/skill`, and `/tools`) are atomically extracted and
 rendered without cancelling the response stream. State-changing and modal

package/README.md

@@ -115,3 +115,9 @@ Provider variables are optional — the TUI launches without them and lets you l
 > Each voice sings its most beautiful song from its own place, yet when combined, they create one grand, beautiful melody. I believe this structure is no different from AI agents.
 >
 > — *agnusdei1207*
+
+---
+
+## 💡 Insight
+
+> Analyzing countless starred agent repos and papers gave me insights, but adopting them didn't actually solve the core problem. What did, I think: primitive CS theory — backtracking, Monte Carlo, Prim, Kruskal — and ideas from observing myself, the best design blueprint and best practice there is. The AI era keeps pushing sensational marketing, and I've lost trust in analyzing it. I think refining the fundamentals, internalizing them, and finding my own way matters more, especially now.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pentesting",
-  "version": "0.101.7",
-  "builderReleaseTag": "v0.101.7",
+  "version": "0.101.8",
+  "builderReleaseTag": "v0.101.8",
   "description": "Penetration testing AI agent powered by Rust, with audited reverse-shell capture, verified PTY upgrades, and evidence-first orchestration.",
   "license": "MIT",
   "author": "agnusdei1207",