pentesting 0.4.0 → 0.4.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/README.md +113 -54
  2. package/dist/{auto-update-H72IBVEQ.js → auto-update-B2Z37JG3.js} +2 -2
  3. package/dist/{chunk-LZGHM27D.js → chunk-5RFHBFIH.js} +1 -1
  4. package/dist/{chunk-IU6YJKJT.js → chunk-JOYCWIE7.js} +1 -1
  5. package/dist/index.js +86 -9
  6. package/dist/{update-DNXSBIOM.js → update-NZKK32L2.js} +2 -2
  7. package/package.json +1 -1
package/README.md CHANGED
@@ -1,3 +1,5 @@
1
+ # PENTEST
2
+
1
3
  ```
2
4
  ╔═══════════════════════════════════════════════════════════════╗
3
5
  ║ ║
@@ -9,6 +11,7 @@
9
11
  ║ ╚═╝ ╚══════╝╚═╝ ╚═══╝ ╚═╝ ╚══════╝╚══════╝ ╚═╝ ║
10
12
  ║ ║
11
13
  ║ 🎯 DEF CON-level Autonomous Pentesting Agent ║
14
+ ║ ⚡ Powered by Claude + MCP + Ralph Loop ║
12
15
  ║ ║
13
16
  ╚═══════════════════════════════════════════════════════════════╝
14
17
  ```
@@ -29,11 +32,6 @@ export PENTEST_API_KEY=your_api_key
29
32
  export PENTEST_BASE_URL=https://your-api-endpoint.com/v1
30
33
  export PENTEST_MODEL=your-model-name
31
34
 
32
- export PENTEST_API_KEY="key"
33
- export PENTEST_BASE_URL="https://api.z.ai/api/anthropic"
34
- export PENTEST_MODEL="glm-4.7"
35
-
36
-
37
35
  # Run
38
36
  pentesting
39
37
  ```
@@ -42,46 +40,70 @@ pentesting
42
40
 
43
41
  ## ✨ Features
44
42
 
43
+ ### Core Capabilities
45
44
  - **10-Phase Attack Workflow**: Recon → Scan → Enum → Vuln Analysis → Exploitation → PrivEsc → Pivot → Persist → Exfil → Report
46
- - **9 Specialized Agents**: Built-in experts for each security domain
45
+ - **9 Specialized Agents**: Built-in domain experts for security testing
47
46
  - **Ralph Loop**: Autonomous iteration until objective is achieved
48
- - **Streaming Responses**: Real-time LLM output
47
+ - **Streaming Responses**: Real-time LLM output display
49
48
  - **Session Persistence**: Save/resume pentesting sessions
50
49
  - **Tool Approval**: Manual confirmation for dangerous commands
51
50
  - **MCP Integration**: Extend with Model Context Protocol tools
52
51
  - **Docker Toolkit**: 50+ pre-installed pentesting tools
53
52
  - **Provider Agnostic**: Works with any OpenAI-compatible API
54
53
 
54
+ ### v0.4+ New Features (kimi-cli inspired)
55
+ - **Context Checkpoints**: Save/restore conversation states with `/checkpoint`, `/undo`, `/revert`
56
+ - **Flow Skills**: Mermaid/D2 diagram-based workflow automation
57
+ - **Session Replay**: Review past sessions from wire recordings
58
+ - **Auto-Update**: Background version checking with update notifications
59
+ - **Vision Analysis**: Analyze images from clipboard with `/paste`
60
+ - **Wire Logging**: Detailed session recording in JSONL format
61
+ - **Rich TUI**: Premium ASCII banner, organized help, status reports
62
+
55
63
  ---
56
64
 
57
65
  ## 📖 CLI Commands
58
66
 
67
+ ### Core
59
68
  ```bash
60
- # Target & Session
61
- /target <ip> Set target
69
+ /target <ip> Set target IP/hostname
62
70
  /start [objective] Start autonomous pentest
71
+ /stop Stop current operation
72
+ /status Show status report
73
+ ```
74
+
75
+ ### Session Management
76
+ ```bash
77
+ /checkpoint [desc] Create checkpoint with optional description
78
+ /checkpoints List all checkpoints
79
+ /undo Undo to last checkpoint
80
+ /revert <id> Revert to specific checkpoint
81
+ /compact Compact context (keep last 3 messages)
63
82
  /sessions List saved sessions
64
83
  /resume [id] Resume a session
84
+ /replay Show session recordings
85
+ ```
65
86
 
66
- # Scanning & Enumeration
67
- /scan <target> Quick enumeration
68
- /web <url> Web application testing
69
-
70
- # Exploitation
71
- /exploit <service> Search for exploits
72
- /privesc [os] Check privilege escalation vectors
73
- /attack <objective> Execute attack chain
74
- /hash <hash> Identify and crack hashes
87
+ ### Skills & Extras
88
+ ```bash
89
+ /skills List available skills
90
+ /update Check for updates
91
+ /update now Install update
92
+ ```
75
93
 
76
- # Reporting
94
+ ### Findings & Reports
95
+ ```bash
96
+ /findings Show discovered findings
77
97
  /report Generate pentest report
78
- /findings Show findings
98
+ ```
79
99
 
80
- # Control
100
+ ### Utility
101
+ ```bash
102
+ /paste Paste from clipboard (text or image)
81
103
  /yolo Toggle auto-approve mode
82
- /approve /deny Approve/deny tool execution
83
104
  /clear Clear screen
84
105
  /exit Exit
106
+ /y /n /ya Approve/Deny/Always approve (for pending tools)
85
107
  ```
86
108
 
87
109
  ---
@@ -195,33 +217,62 @@ await agent.addMCPServer('security-tools', 'docker', [
195
217
  ## 🏗️ Architecture
196
218
 
197
219
  ```
198
- ┌─────────────────────────────────────────────────────────────┐
199
- │ TUI (app.tsx) │
200
- │ - Streaming text display │
201
- │ - Tool approval prompts │
202
- │ - Session management │
203
- └──────────────────────────┬──────────────────────────────────┘
204
- │ Wire Protocol
205
- ┌──────────────────────────▼──────────────────────────────────┐
206
- │ PentestingAgent (Unified) │
207
- │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │
208
- │ │ RalphLoop │ │ Streaming │ │ Session │ │
209
- │ │ (Auto-iter) │ │ Handler │ │ Manager │ │
210
- │ └──────────────┘ └──────────────┘ └──────────────┘ │
211
- │ │
212
- │ ┌──────────────────────────────────────────────────┐ │
213
- │ │ AutonomousHackingAgent (Core) │ │
214
- │ │ ┌──────────────────────────────────────────┐ │ │
215
- │ │ │ 9 Built-in Specialized Agents │ │ │
216
- │ │ └──────────────────────────────────────────┘ │ │
217
- │ └──────────────────────────────────────────────────┘ │
218
- └──────────────────────────┬──────────────────────────────────┘
219
- │
220
- ┌────────────────┼────────────────┐
221
- ┌────▼────┐ ┌────▼────┐ ┌────▼────┐
222
- │ Tool │ │ Bash │ │ MCP │
223
- │Executor │ │ Commands│ │ Servers │
224
- └─────────┘ └─────────┘ └─────────┘
220
+ ┌─────────────────────────────────────────────────────────────────┐
221
+ │ TUI (app.tsx) │
222
+ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────────────────┐ │
223
+ │ │ WireLogger │ │ContextMgr │ │ SlashCommandRegistry │ │
224
+ │ │ (Recording) │ │(Checkpoints)│ │ (Command Handling) │ │
225
+ │ └──────────────┘ └──────────────┘ └──────────────────────────┘ │
226
+ └────────────────────────────┬────────────────────────────────────┘
227
+ │ Events
228
+ ┌────────────────────────────▼────────────────────────────────────┐
229
+ │ AutonomousHackingAgent (Core Engine) │
230
+ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │
231
+ │ │ HookExecutor │ │ MCPManager │ │ApprovalMgr │ │
232
+ │ │ (Lifecycle) │ │ (Extensions) │ │(Tool Safety) │ │
233
+ │ └──────────────┘ └──────────────┘ └──────────────┘ │
234
+ │ │
235
+ │ ┌────────────────────────────────────────────────────────────┐ │
236
+ │ │ 9 Built-in Specialized Agents │ │
237
+ │ │ target-explorer • exploit-researcher • privesc-master │ │
238
+ │ │ web-hacker • crypto-solver • forensics-analyst │ │
239
+ │ │ reverse-engineer • attack-architect • finding-reviewer │ │
240
+ │ └────────────────────────────────────────────────────────────┘ │
241
+ └────────────────────────────┬────────────────────────────────────┘
242
+ │
243
+ ┌──────────────────┼──────────────────┐
244
+ ┌────▼────┐ ┌────▼────┐ ┌────▼────┐
245
+ │ Tool │ │ Bash │ │ MCP │
246
+ │Executor │ │Commands │ │ Servers │
247
+ └─────────┘ └─────────┘ └─────────┘
248
+ ```
249
+
250
+ ### Module Connectivity
251
+
252
+ ```
253
+ Core Modules (src/core/):
254
+ ├── agent/ AutonomousHackingAgent, PentestingAgent, AgentOrchestrator
255
+ ├── approval/ ApprovalManager - tool execution safety
256
+ ├── commands/ SlashCommandRegistry - command handling
257
+ ├── context/ ContextManager (checkpoints) + Compaction (tokens)
258
+ ├── display/ DisplayBlocks - rich output formatting
259
+ ├── hooks/ HookExecutor - lifecycle events
260
+ ├── loop/ RalphLoop - autonomous iteration
261
+ ├── prompts/ System prompts for agents
262
+ ├── replay/ SessionReplay - wire file parsing
263
+ ├── session/ SessionManager - persistence
264
+ ├── skill/ SkillManager + FlowExecutor - workflow automation
265
+ ├── streaming/ StreamingAgent - real-time output
266
+ ├── tools/ Tool definitions, executor, registry
267
+ └── update/ AutoUpdate - version management
268
+
269
+ Support Modules:
270
+ ├── wire/ WireLogger (JSONL recording) + Wire Protocol
271
+ ├── mcp/ MCPManager, MCPClient - extensions
272
+ ├── utils/ Clipboard, Retry utilities
273
+ ├── agents/ 9 built-in specialized agents
274
+ ├── commands/ Built-in slash commands
275
+ └── config/ Constants, Theme, Agent configuration
225
276
  ```
226
277
 
227
278
  ---
@@ -231,21 +282,29 @@ await agent.addMCPServer('security-tools', 'docker', [
231
282
  ```
232
283
  src/
233
284
  ├── index.tsx # CLI entry point
234
- ├── cli/app.tsx # TUI with streaming, approval, sessions
285
+ ├── cli/
286
+ │ ├── app.tsx # TUI with streaming, approval, sessions
287
+ │ └── components/ # Rich display components
235
288
  ├── core/
236
289
  │ ├── agent/ # Agent implementations
237
290
  │ ├── approval/ # Tool approval system
238
- │ ├── context/ # Conversation compaction
291
+ │ ├── commands/ # Slash command registry
292
+ │ ├── context/ # Checkpoint + compaction
293
+ │ ├── display/ # Rich output blocks
239
294
  │ ├── hooks/ # Event hooks
240
295
  │ ├── loop/ # Ralph autonomous loop
296
+ │ ├── replay/ # Session replay
241
297
  │ ├── session/ # Session persistence
298
+ │ ├── skill/ # Flow skills (Mermaid/D2)
242
299
  │ ├── streaming/ # Real-time streaming
300
+ │ ├── update/ # Auto-update system
243
301
  │ ├── prompts/ # System prompts
244
302
  │ └── tools/ # Tool definitions & executor
245
- ├── agents/index.ts # 9 built-in specialized agents
246
- ├── commands/index.ts # Built-in slash commands
247
- ├── wire/ # Agent-UI communication
303
+ ├── agents/ # 9 built-in specialized agents
304
+ ├── commands/ # Built-in slash commands
305
+ ├── wire/ # JSONL logging + Wire protocol
248
306
  ├── mcp/ # MCP client integration
307
+ ├── utils/ # Clipboard, retry utilities
249
308
  └── config/ # Constants, theme
250
309
  ```
251
310
 
package/dist/{auto-update-H72IBVEQ.js → auto-update-B2Z37JG3.js} RENAMED
@@ -8,8 +8,8 @@ import {
8
8
  readVersionCache,
9
9
  semverTuple,
10
10
  writeVersionCache
11
- } from "./chunk-LZGHM27D.js";
12
- import "./chunk-IU6YJKJT.js";
11
+ } from "./chunk-5RFHBFIH.js";
12
+ import "./chunk-JOYCWIE7.js";
13
13
  import "./chunk-3RG5ZIWI.js";
14
14
  export {
15
15
  checkForUpdate,
package/dist/{chunk-LZGHM27D.js → chunk-5RFHBFIH.js} RENAMED
@@ -1,7 +1,7 @@
1
1
  import {
2
2
  APP_NAME,
3
3
  APP_VERSION
4
- } from "./chunk-IU6YJKJT.js";
4
+ } from "./chunk-JOYCWIE7.js";
5
5
 
6
6
  // src/core/update/auto-update.ts
7
7
  import { execSync } from "child_process";
package/dist/{chunk-IU6YJKJT.js → chunk-JOYCWIE7.js} RENAMED
@@ -132,7 +132,7 @@ var SENSITIVE_TOOLS = [
132
132
 
133
133
  // src/config/constants.ts
134
134
  var APP_NAME = "pentesting";
135
- var APP_VERSION = "0.4.0";
135
+ var APP_VERSION = "0.4.2";
136
136
  var APP_DESCRIPTION = "Autonomous Penetration Testing AI Agent";
137
137
  var LLM_API_KEY = process.env.PENTEST_API_KEY || process.env.ANTHROPIC_API_KEY || "";
138
138
  var LLM_BASE_URL = process.env.PENTEST_BASE_URL || void 0;
package/dist/index.js CHANGED
@@ -15,7 +15,7 @@ import {
15
15
  PHASE_STATUS,
16
16
  THOUGHT_TYPE,
17
17
  TOOL_NAME
18
- } from "./chunk-IU6YJKJT.js";
18
+ } from "./chunk-JOYCWIE7.js";
19
19
  import {
20
20
  __require
21
21
  } from "./chunk-3RG5ZIWI.js";
@@ -3155,6 +3155,44 @@ var AutonomousHackingAgent = class extends EventEmitter4 {
3155
3155
  current: this.state.currentPhase
3156
3156
  };
3157
3157
  }
3158
+ // ===== Image Analysis with Vision =====
3159
+ async analyzeImage(base64, mimeType, prompt) {
3160
+ this.think(THOUGHT_TYPE.OBSERVATION, `Analyzing image: ${prompt}`);
3161
+ try {
3162
+ const response = await this.client.messages.create({
3163
+ model: LLM_MODEL,
3164
+ max_tokens: 4096,
3165
+ messages: [{
3166
+ role: "user",
3167
+ content: [
3168
+ {
3169
+ type: "image",
3170
+ source: {
3171
+ type: "base64",
3172
+ media_type: mimeType,
3173
+ data: base64
3174
+ }
3175
+ },
3176
+ {
3177
+ type: "text",
3178
+ text: `${AUTONOMOUS_HACKING_PROMPT}
3179
+
3180
+ Analyze this image from a security perspective:
3181
+ ${prompt}`
3182
+ }
3183
+ ]
3184
+ }]
3185
+ });
3186
+ const textContent = response.content.find((c) => c.type === "text");
3187
+ const result = textContent && "text" in textContent ? textContent.text : "No analysis available";
3188
+ this.think(THOUGHT_TYPE.REFLECTION, `Image analysis complete`);
3189
+ return result;
3190
+ } catch (error) {
3191
+ const errorMsg = error instanceof Error ? error.message : String(error);
3192
+ this.think(THOUGHT_TYPE.STUCK, `Image analysis failed: ${errorMsg}`);
3193
+ throw error;
3194
+ }
3195
+ }
3158
3196
  // ===== Thought Process Recording =====
3159
3197
  think(type, content) {
3160
3198
  const thought = {
@@ -4609,7 +4647,7 @@ function readClipboardImage() {
4609
4647
  if (result === "success" && existsSync3(tmpPath)) {
4610
4648
  const imageBuffer = readFileSync3(tmpPath);
4611
4649
  const base64 = imageBuffer.toString("base64");
4612
- return { path: tmpPath, base64 };
4650
+ return { path: tmpPath, base64, mimeType: "image/png" };
4613
4651
  }
4614
4652
  } else if (os === "linux") {
4615
4653
  try {
@@ -4622,7 +4660,7 @@ function readClipboardImage() {
4622
4660
  if (stats.size > 0) {
4623
4661
  const imageBuffer = readFileSync3(tmpPath);
4624
4662
  const base64 = imageBuffer.toString("base64");
4625
- return { path: tmpPath, base64 };
4663
+ return { path: tmpPath, base64, mimeType: "image/png" };
4626
4664
  }
4627
4665
  }
4628
4666
  } catch {
@@ -4642,7 +4680,7 @@ function readClipboardImage() {
4642
4680
  if (result === "success" && existsSync3(tmpPath)) {
4643
4681
  const imageBuffer = readFileSync3(tmpPath);
4644
4682
  const base64 = imageBuffer.toString("base64");
4645
- return { path: tmpPath, base64 };
4683
+ return { path: tmpPath, base64, mimeType: "image/png" };
4646
4684
  }
4647
4685
  }
4648
4686
  } catch (error) {
@@ -4884,7 +4922,7 @@ var App = ({ autoApprove = false, target }) => {
4884
4922
  setCheckpointCount(contextManagerRef.current?.getCheckpoints().length || 0);
4885
4923
  }
4886
4924
  });
4887
- import("./auto-update-H72IBVEQ.js").then(({ checkForUpdateAsync, formatUpdateNotification }) => {
4925
+ import("./auto-update-B2Z37JG3.js").then(({ checkForUpdateAsync, formatUpdateNotification }) => {
4888
4926
  checkForUpdateAsync().then((result) => {
4889
4927
  if (result.hasUpdate) {
4890
4928
  const notification = formatUpdateNotification(result);
@@ -4927,13 +4965,39 @@ var App = ({ autoApprove = false, target }) => {
4927
4965
  return duration;
4928
4966
  }, []);
4929
4967
  useEffect(() => {
4930
- addMessage(MESSAGE_TYPE.SYSTEM, "Pentesting Agent initialized. Type /help for commands.");
4968
+ const versionPadded = `v${APP_VERSION}`.padEnd(8);
4969
+ const banner = `
4970
+ \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557
4971
+ \u2551 \u2551
4972
+ \u2551 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2557 \u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2551
4973
+ \u2551 \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2551\u255A\u2550\u2550\u2588\u2588\u2554\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u255A\u2550\u2550\u2588\u2588\u2554\u2550\u2550\u255D\u2551
4974
+ \u2551 \u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2551 \u2588\u2588\u2551 \u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2551 \u2551
4975
+ \u2551 \u2588\u2588\u2554\u2550\u2550\u2550\u255D \u2588\u2588\u2554\u2550\u2550\u255D \u2588\u2588\u2551\u255A\u2588\u2588\u2557\u2588\u2588\u2551 \u2588\u2588\u2551 \u2588\u2588\u2554\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2588\u2588\u2551 \u2588\u2588\u2551 \u2551
4976
+ \u2551 \u2588\u2588\u2551 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2551 \u255A\u2588\u2588\u2588\u2588\u2551 \u2588\u2588\u2551 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2551 \u2588\u2588\u2551 \u2551
4977
+ \u2551 \u255A\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D\u255A\u2550\u255D \u255A\u2550\u2550\u2550\u255D \u255A\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u255D \u2551
4978
+ \u2551 \u2551
4979
+ \u2551 \u{1F3AF} DEF CON-level Autonomous Pentesting Agent ${versionPadded}\u2551
4980
+ \u2551 \u26A1 Powered by Claude + MCP + Ralph Loop \u2551
4981
+ \u2551 \u2551
4982
+ \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D`;
4983
+ addMessage(MESSAGE_TYPE.SYSTEM, banner);
4984
+ addMessage(MESSAGE_TYPE.SYSTEM, `
4985
+ \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
4986
+ \u2502 \u{1F680} Quick Start \u2502
4987
+ \u2502 \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 \u2502
4988
+ \u2502 /target <ip> Set target IP/hostname \u2502
4989
+ \u2502 /start [goal] Start autonomous pentesting \u2502
4990
+ \u2502 /help Show all commands \u2502
4991
+ \u2502 \u2502
4992
+ \u2502 \u{1F527} Features: 10 Attack Phases \u2022 9 Specialized Agents \u2502
4993
+ \u2502 \u{1F4E1} Session Recording \u2022 Checkpoints \u2022 Auto-Update \u2502
4994
+ \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518`);
4931
4995
  if (autoApprove) {
4932
- addMessage(MESSAGE_TYPE.SYSTEM, "\u26A0\uFE0F YOLO mode: Auto-approving all tools");
4996
+ addMessage(MESSAGE_TYPE.SYSTEM, "\u26A0\uFE0F YOLO Mode: Auto-approving all tool executions");
4933
4997
  }
4934
4998
  if (target) {
4935
4999
  agent.setTarget(target);
4936
- addMessage(MESSAGE_TYPE.SYSTEM, `Target: ${target}`);
5000
+ addMessage(MESSAGE_TYPE.SYSTEM, `\u{1F3AF} Target: ${target}`);
4937
5001
  }
4938
5002
  agent.on(AGENT_EVENT.THOUGHT, (thought) => {
4939
5003
  setCurrentStatus(thought.content.slice(0, 60));
@@ -5237,6 +5301,19 @@ var App = ({ autoApprove = false, target }) => {
5237
5301
  if (img) {
5238
5302
  addMessage(MESSAGE_TYPE.SYSTEM, `\u{1F4F7} Image from clipboard: ${img.path}`);
5239
5303
  addMessage(MESSAGE_TYPE.SYSTEM, ` Size: ${Math.round(img.base64.length / 1024)}KB base64`);
5304
+ const prompt = args.join(" ") || "Analyze this image for security-relevant information";
5305
+ addMessage(MESSAGE_TYPE.SYSTEM, ` Sending to agent: "${prompt}"`);
5306
+ setIsProcessing(true);
5307
+ startTimer();
5308
+ try {
5309
+ const response = await agent.analyzeImage(img.base64, img.mimeType, prompt);
5310
+ const duration = stopTimer();
5311
+ addMessage(MESSAGE_TYPE.ASSISTANT, response, duration);
5312
+ } catch (e) {
5313
+ stopTimer();
5314
+ addMessage(MESSAGE_TYPE.ERROR, `Image analysis failed: ${e instanceof Error ? e.message : String(e)}`);
5315
+ }
5316
+ setIsProcessing(false);
5240
5317
  }
5241
5318
  } else {
5242
5319
  const text = readClipboardText();
@@ -5333,7 +5410,7 @@ var App = ({ autoApprove = false, target }) => {
5333
5410
  return;
5334
5411
  case "update":
5335
5412
  try {
5336
- const { checkForUpdate, formatUpdateNotification, doUpdate } = await import("./update-DNXSBIOM.js");
5413
+ const { checkForUpdate, formatUpdateNotification, doUpdate } = await import("./update-NZKK32L2.js");
5337
5414
  const result = checkForUpdate(true);
5338
5415
  if (result.hasUpdate) {
5339
5416
  const notification = formatUpdateNotification(result);
package/dist/{update-DNXSBIOM.js → update-NZKK32L2.js} RENAMED
@@ -8,8 +8,8 @@ import {
8
8
  readVersionCache,
9
9
  semverTuple,
10
10
  writeVersionCache
11
- } from "./chunk-LZGHM27D.js";
12
- import "./chunk-IU6YJKJT.js";
11
+ } from "./chunk-5RFHBFIH.js";
12
+ import "./chunk-JOYCWIE7.js";
13
13
  import "./chunk-3RG5ZIWI.js";
14
14
  export {
15
15
  checkForUpdate,
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "pentesting",
3
- "version": "0.4.0",
3
+ "version": "0.4.2",
4
4
  "description": "Autonomous Penetration Testing AI Agent",
5
5
  "type": "module",
6
6
  "main": "dist/index.js",