pentesting 0.90.10 → 0.92.3

package/README.md

@@ -13,50 +13,44 @@
 
 ---
 
-> **Role:** The published npm package and the command you run are both **`pentesting`**. The internal orchestration engine is **`builder`** — `pentesting` downloads and runs it under the hood. `npm i -g pentesting` installs the **`pentesting`** command (never a `builder` command); the engine name does not surface in normal use.
+## 🎹 From the Developer
 
----
+<div align="center">
+  <img src="public/image.png" alt="Chopin Ballade No.4" width="600" />
+</div>
 
-## 🎯 Key Design Pillars
+<br/>
 
-* **Runtime-Owned Adjudication** — Model output is a *candidate* until a 5-gate completion lattice verifies and closes the task.
-* **Local-First State** — Runtime state and a markdown knowledge graph live on disk. No external storage service.
-* **Weak-Model Hardening** — Rust-enforced classifiers, validators, and self-reviews guard against hallucination.
-* **Lineage & Horizons** — Run lineage, objective IDs, and horizon-aware memory reuse, all in local state.
-* **Policy-Gated Tools** — `Allow/Deny/Confirm` gates shell, file, and network access (policy-based today; OS sandboxing is roadmap).
-* **Intelligent Queuing** — Queued inputs are deduplicated and prioritized live; obsolete tasks are preempted, not FIFO-replayed.
-* **Lab Session Multiplexing** — `shell-listener` runs multiple authorized TCP sessions with per-session routing and PTY upgrades.
-* **Dynamic Agent Profiles** — No fixed persona: the classifier *generates* a profile per request, *recalls* reusable templates, *reuses* them to drive tool scope, phase, and memory weighting.
-* **Ebbinghaus-Inspired Memory** — Memories carry a *strength* that fades like human memory and reinforces on recall. Faded notes are de-referenced, never destroyed.
-* **Git-Backed Rewind** — Working-tree checkpoint/restore keeps autonomous edits reversible.
+> "I believe playing the piano is also a form of orchestration."
+>
+> The harmony of polyphony — multiple voices — and homophony — a single melodic line.
+>
+> Each voice sings its most beautiful song from its own place, yet when combined, they create one grand, beautiful melody. I believe this structure is no different from AI agents.
+>
+> — *agnusdei1207*
 
 ---
 
 ## 🚀 Quick Start
 
-### Install via npm
-
 ```bash
 npm install -g pentesting
 pentesting
 ```
 
-### Run with Docker
+Or run it with Docker:
 
 ```bash
-docker run -it --rm \
-  -v "$(pwd):/workspace" \
-  -w /workspace \
-  agnusdei1207/pentesting:latest
+docker run -it --rm -v "$(pwd):/workspace" -w /workspace agnusdei1207/pentesting:latest
 ```
 
-### Docker Compose
+Or via Docker Compose:
 
 ```bash
 PENTESTING_PROJECT_DIR=/path/to/project docker compose run pentesting
 ```
 
-### Quick commands
+### Common commands
 
 ```bash
 pentesting                                                # Interactive TUI
@@ -65,271 +59,27 @@ pentesting shell-listener --bind 127.0.0.1 --port 4444   # Authorized lab listen
 pentesting --version
 ```
 
----
-
-## 🧩 Orchestration Map
-
-Pentesting is a **domain-neutral** runtime with a security focus. Development, pentesting, CTF, audit, and release work layer in via skills — never baked into the core.
-
-**Profile flow** — generate → recall → reuse:
-
-```mermaid
-flowchart LR
-    R[Request] --> GEN["Generate<br/>dynamic profile"]
-    GEN --> REC["Recall<br/>named template + overlay"]
-    REC --> USE["Reuse<br/>tool scope · phase · memory weight"]
-```
-
-**Agent flow** — request to closure:
-
-```mermaid
-flowchart TD
-    U[User request] --> C[Intent classifier]
-    C --> P[Dynamic profile<br/>task shape + tool scope + rigor]
-    P --> R[Runtime router]
-    R --> A[Active agent]
-    A --> T{Need delegation?}
-    T -- no --> O[Tool execution]
-    T -- yes --> D[Agent tool]
-    D --> CO[coordinator]
-    D --> I[investigator]
-    D --> OP[operator]
-    D --> RV[reviewer]
-    D --> V[verifier]
-    D --> W[report-writer]
-    CO --> O
-    I --> O
-    OP --> O
-    RV --> O
-    V --> O
-    W --> O
-    O --> G[Completion gates]
-    G --> M[Memory + artifacts]
-    M --> U
-```
-
-### Built-in agent team
-
-| Agent | Default role | Runtime profile |
-| --- | --- | --- |
-| `builder` | Hands-on implementation, refactoring, local file changes, tests | Implement + broad local write |
-| `planner` | Implementation plans and risk breakdowns | Plan + read-only |
-| `researcher` | Read-only codebase and reference research | Investigate + read-only |
-| `coordinator` | Splits broad work into owned packets and consolidates results | Coordinate + broad local write |
-| `investigator` | Evidence gathering across code, logs, commands, APIs, and behavior | Investigate + shell diagnostics |
-| `operator` | Builds, tests, packaging, service startup, and runtime workflows | Implement + broad local write |
-| `reviewer` | Findings-first technical review | Review + strict read-only |
-| `verifier` | Reproduction, build/test proof, and completion claim checks | Verify + strict read-only |
-| `report-writer` | Reports, handoffs, release notes, and reproducibility records | Implement + bounded write |
-
-### Named autonomy profiles
-
-Optionally pin the top-level profile (`autonomy_profile = "ctf-competition"`); leave unset for classifier-driven defaults. Delegated subagent contracts stay intact.
-
-| Profile | Purpose |
-| --- | --- |
-| `general-agent` | Broad autonomous local orchestration for mixed tasks |
-| `local-builder` | Hands-on implementation with fresh evidence retrieval |
-| `ctf-competition` | Competition/lab workflow backed by `ctf-competition` and `pentesting-methodology` skills |
-| `enterprise-review` | Strict, review-heavy profile with read-only dynamic scope |
-
-### Engagement metadata
-
-Runs can attach typed engagement context — scope, phase, tags, and standard refs (PTES, MITRE ATT&CK, OWASP, CWE/CAPEC, NIST CSF, CIS Controls) — to workflow metadata. `/workflow report` exports it as a Markdown handoff.
-
-### Storage and graph strategy
-
-- **Local-first** — runtime state, notes, scratchpad, and graph inputs live on disk.
-- **Derived graph** — built from markdown notes, wiki-links/backlinks, skills, and memory; a view, not a second source of truth.
-- **Separate skills** — domain skills (`ctf-competition`, audit, release, dev) teach method without changing runtime identity.
-
----
-
-## 🧠 Memory & Knowledge
-
-One local-first store — plain markdown notes on disk, no vector DB, no cloud. Memories carry a *strength* that fades like human memory, so the store stays sharp instead of rotting.
-
-**Storage** — Ebbinghaus lifecycle (decay · reinforce · floor, never deleted):
-
-```mermaid
-flowchart TD
-    N[New memory] --> S["strength = quality × recall × e^-λ·age"]
-    S --> U{recalled?}
-    U -- yes --> RE[reinforce ↑ · reset age]
-    U -- no --> D[decay over time]
-    RE --> S
-    D --> F{below floor?}
-    F -- no --> S
-    F -- yes --> AR[de-reference: archive / tombstone]
-    AR -. recoverable on disk .-> N
-```
-
-Kinds fade at different speeds (procedural outlives episodic); bi-temporal `event_time` vs `ingestion_time` lets newer facts supersede stale ones.
-
-**Retrieval** — hybrid fuse, strength-weighted, read-only:
-
-```mermaid
-flowchart LR
-    Q[Query] --> L[Lexical]
-    Q --> SE[Semantic]
-    Q --> G[Graph]
-    L --> RRF[RRF fuse]
-    SE --> RRF
-    G --> RRF
-    RRF --> RR[rerank: phase · recency · task]
-    RR --> W[weight by strength]
-    W --> P[Prompt context]
-```
-
-Faded, private, or unsafe memories are held back from the prompt. Lookups never write — reinforce/archive/supersede are explicit, never search side effects.
-
----
-
-## 🧭 Interactive Essentials
-
-Inside an interactive pentesting session, these commands are the fastest way to inspect state:
-
-```text
-/status        Show the current run phase, active tasks, gates, hooks, and budget signals
-/workflow      Show the current focus and recent workflow steps for the active conversation
-/workflow report
-               Export the active run, engagement metadata, evidence, and large outputs to Markdown
-/context       Show recent context-budget snapshots for the current conversation
-/memory        Show stored conversation memories for the current conversation
-/tools         List the currently available tools and schemas
-/agent         Switch the active agent
-/conversation  Browse conversations for the active workspace
-/goal <task>   Set the active goal
-/auto          Toggle autonomous mode for the current goal
-/help          Show all commands
-/exit          Quit
-```
-
-`/update` downloads and applies the latest public release asset for the current OS/CPU target.
+Inside a session, `/help` lists every command and `/update` pulls the latest release for your OS/CPU.
 
 ---
 
-## ⚙️ Configuration (`.pentesting.toml`)
+## ⚙️ Configuration
 
-Pentesting reads a user-global config from `~/.pentesting/.pentesting.toml`, overridden by project-local `.pentesting.toml` files discovered by walking up from the working directory.
+Pentesting reads `~/.pentesting/.pentesting.toml`, overridden by a project-local `.pentesting.toml`:
 
 ```toml
 [storage]
-backend = "local"                            # Local md/fs runtime state
+backend = "local"   # Local md/fs runtime state
 ```
 
-Environment variables use the `PENTESTING_` prefix, with `__` for nested keys — e.g. `PENTESTING_SESSION__MODEL_ID=...`. Set `PENTESTING_CONFIG` to override the global config directory.
+Environment variables use the `PENTESTING_` prefix (`__` for nested keys, e.g. `PENTESTING_SESSION__MODEL_ID=...`). Full variable list and the legacy `BUILDER_*` aliases are documented in [`ARCHITECTURE.md`](ARCHITECTURE.md#configuration).
 
-### Backward compatibility — `builder` ↔ `pentesting`
-
-The runtime engine is still `builder` under the hood, so legacy names keep working. Use whichever you like; the `PENTESTING_*` form wins when both are set.
-
-| Surface | Canonical | Legacy (still accepted) |
-| :--- | :--- | :--- |
-| Env vars | `PENTESTING_*` | `BUILDER_*` |
-| Config-dir override | `PENTESTING_CONFIG` | `BUILDER_CONFIG` |
-| Global config file | `~/.pentesting/.pentesting.toml` | `~/.builder/.builder.toml`, `~/builder/.builder.toml` |
-| Project config file | `.pentesting.toml` | `.builder.toml` |
+> **Note:** The command you run is always **`pentesting`**. The internal engine is **`builder`** — `pentesting` downloads and runs it under the hood; the engine name never surfaces in normal use.
 
 ---
 
-## 🔐 Pentesting-Specific Notes
-
-### Architecture — single source, two surfaces
-
-Pentesting and Builder share the **same Rust runtime binary**. The `pentesting` npm package is a thin distribution facade:
-
-```text
-npm install -g pentesting
-         │
-         ▼
-  pentesting CLI (Node.js shim)
-         │  resolves or downloads the matching Builder release asset
-         ▼
-  Builder binary (Rust)  ← single runtime engine
-         │  PENTESTING_PRODUCT_NAME=pentesting
-         ▼
-  Interactive TUI with "pentesting" banner
-```
-
-- The npm package installs a launcher, **not** a second agent runtime.
-- It resolves or downloads the correct release asset from `agnusdei1207/pentesting-public`.
-- It forwards arguments directly into the Rust binary — no command translation or compatibility shims.
-- If a change would add orchestration, memory, or prompt logic into the npm layer, that change belongs upstream in the Rust runtime.
-
-### Security domain skills
-
-The `ctf-competition` and `pentesting-methodology` skills map authorized assessments to standard frameworks:
-
-- **PTES** (Penetration Testing Execution Standard)
-- **MITRE ATT&CK** tactics and techniques
-- **OWASP** Top 10 and Testing Guide
-- **CWE/CAPEC** weakness and attack pattern catalogs
-- **NIST CSF** and **CIS Controls**
+## 📖 Documentation
 
-### Shell listener for authorized labs
-
-```bash
-pentesting shell-listener --bind 127.0.0.1 --port 4444
-```
-
-Manages multiple accepted TCP sessions with per-session routing, buffered output, raw byte logging, and PTY-upgrade helpers. Bound to loopback by default; `--allow-remote` is an explicit opt-in gate.
-
----
-
-## 📦 Supported Runtime Targets
-
-| OS | CPU | Release asset |
-| --- | --- | --- |
-| Linux | x64 | `pentesting-x86_64-unknown-linux-musl` |
-| Linux | arm64 | `pentesting-aarch64-unknown-linux-musl` |
-| macOS | x64 | `pentesting-x86_64-apple-darwin` |
-| macOS | arm64 | `pentesting-aarch64-apple-darwin` |
-| Windows | x64 | `pentesting-x86_64-pc-windows-msvc.exe` |
-| Windows | arm64 | `pentesting-aarch64-pc-windows-msvc.exe` |
-| Android | arm64 | `pentesting-aarch64-linux-android` |
-
----
-
-## 🌍 Environment Variables
-
-| Variable | Description |
-| --- | --- |
-| `PENTESTING_BIN` | Use an already-installed Builder binary instead of the managed download. |
-| `PENTESTING_PRODUCT_NAME` | Runtime banner label. The `pentesting` launcher sets this to `pentesting` automatically. |
-| `PENTESTING_REPO` | Override the public release repo used for binary downloads. Defaults to `agnusdei1207/pentesting-public`. |
-| `PENTESTING_SKIP_DOWNLOAD` | Skip the postinstall binary download. Useful in CI or when `PENTESTING_BIN` will be provided later. |
-
----
-
-## 📖 Key Documentation
-
-* [`Public site`](https://agnusdei1207.github.io/pentesting-public/) — Landing page and public runtime entry surface.
+* [`ARCHITECTURE.md`](ARCHITECTURE.md) — Runtime flow, agent team, memory model, crate map, tool surface, and supported targets.
+* [Public site](https://agnusdei1207.github.io/pentesting-public/) — Landing page and public runtime entry surface.
 * [`compose.yaml`](https://github.com/agnusdei1207/pentesting-public) — Docker Compose facade for pentesting sessions.
-
----
-
-<div align="center">
-
-<br/>
-
-<img src="https://api.iconify.design/twemoji:flag-ireland.svg" width="36" height="36" alt="Ireland" />
-<img src="https://api.iconify.design/twemoji:flag-south-korea.svg" width="36" height="36" alt="South Korea" />
-<img src="https://api.iconify.design/twemoji:flag-germany.svg" width="36" height="36" alt="Germany" />
-<img src="https://api.iconify.design/twemoji:flag-italy.svg" width="36" height="36" alt="Italy" />
-<img src="https://api.iconify.design/twemoji:flag-netherlands.svg" width="36" height="36" alt="Netherlands" />
-<img src="https://api.iconify.design/twemoji:flag-japan.svg" width="36" height="36" alt="Japan" />
-<img src="https://api.iconify.design/twemoji:flag-belgium.svg" width="36" height="36" alt="Belgium" />
-<img src="https://api.iconify.design/twemoji:flag-spain.svg" width="36" height="36" alt="Spain" />
-<img src="https://api.iconify.design/twemoji:flag-portugal.svg" width="36" height="36" alt="Portugal" />
-<img src="https://api.iconify.design/twemoji:flag-austria.svg" width="36" height="36" alt="Austria" />
-
-**Quietly built across Ireland, Korea, Germany, Italy, the Netherlands, Japan, Belgium, Spain, Portugal, and Austria.**
-
-from recon to flag capture, the work speaks for itself.
-
-[![distributed-build](https://img.shields.io/badge/Built%20across-10%20countries-334155?style=flat-square&labelColor=0F172A)](#)
-
-<br/>
-
-</div>

package/lib/runtime.mjs

@@ -119,11 +119,7 @@ export async function installManagedBuilder(options = {}) {
 
   await mkdir(MANAGED_BINARY_DIR, { recursive: true });
   const downloadUrl = releaseAssetUrl(target.assetName, { repo, releaseTag });
-  const response = await fetch(downloadUrl, {
-    headers: {
-      "user-agent": `pentesting-npm/${packageVersion()}`,
-    },
-  });
+  const response = await fetch(downloadUrl);
 
   if (!response.ok || !response.body) {
     throw new Error(

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pentesting",
-  "version": "0.90.10",
-  "builderReleaseTag": "v0.1.8",
+  "version": "0.92.3",
+  "builderReleaseTag": "v0.92.3",
   "description": "pentesting — security-focused agent runtime (internal engine: builder). Thin npm facade that downloads the managed Builder binary and forwards arguments.",
   "license": "MIT",
   "author": "agnusdei1207",
@@ -49,42 +49,12 @@
     "test": "node --test tests/*.test.mjs",
     "preflight:local": "bash scripts/preflight-local.sh",
     "verify": "npm run preflight:local && npm run test",
-    "build": "CARGO_TARGET_DIR=${CARGO_TARGET_DIR:-$HOME/.cache/builder-target} $HOME/.cargo/bin/cargo build --bin pentesting",
-    "check": "sh -c 'npm run docker:builder:build && docker run -it --rm -v builder-workspace:/workspace -e ANTHROPIC_BASE_URL -e ANTHROPIC_AUTH_TOKEN -e ANTHROPIC_MODEL -e ANTHROPIC_API_KEY -e MINIMAX_API_KEY -e OPENAI_API_KEY -e OPENAI_BASE_URL -e GEMINI_API_KEY -e DEEPSEEK_API_KEY agnusdei1207/pentesting:latest'",
-    "check:smoke": "sh -c 'npm run docker:builder:build && docker run --rm -v builder-workspace:/workspace agnusdei1207/pentesting:latest --version'",
-    "eval": "tsx benchmarks/cli.ts",
-    "eval:all": "npm run build && find benchmarks/evals -name task.yml -exec dirname {} \\; | sort | while read -r d; do echo \"\\n=== Running $(basename $d) ===\"; tsx benchmarks/cli.ts \"$d\" || true; done",
-    "pentesting:help": "./scripts/pentesting-release-help.sh",
-    "pentesting:status": "./scripts/pentesting-release-status.sh",
-    "pentesting:test": "npm run test",
-    "pentesting:verify": "npm run verify",
-    "pentesting:pack:dry-run": "npm pack --dry-run",
-    "pentesting:check": "./scripts/check-pentesting-package.sh",
-    "pentesting:publish": "./scripts/publish-pentesting-package.sh",
-    "pentesting:publish:dry-run": "DRY_RUN=true ./scripts/publish-pentesting-package.sh",
-    "pentesting:release:patch": "npm run pentesting:check && AUTO_PUSH=true ./scripts/publish-pentesting-package.sh patch",
-    "pentesting:release:patch:dry-run": "npm run pentesting:check && DRY_RUN=true ./scripts/publish-pentesting-package.sh patch",
-    "pentesting:release:minor": "npm run pentesting:check && AUTO_PUSH=true ./scripts/publish-pentesting-package.sh minor",
-    "pentesting:release:minor:dry-run": "npm run pentesting:check && DRY_RUN=true ./scripts/publish-pentesting-package.sh minor",
-    "pentesting:release:major": "npm run pentesting:check && AUTO_PUSH=true ./scripts/publish-pentesting-package.sh major",
-    "pentesting:release:major:dry-run": "npm run pentesting:check && DRY_RUN=true ./scripts/publish-pentesting-package.sh major",
-    "public:sync": "./scripts/sync-public-repo.sh",
-    "public:sync:push": "AUTO_PUSH=true ./scripts/sync-public-repo.sh",
-    "public:pull": "git submodule update --remote --merge public",
-    "public:publish": "AUTO_PUSH=true ./scripts/sync-public-repo.sh && git add public && git commit -m 'chore: bump public facade pointer' && git push origin main",
-    "public:mirror-release": "./scripts/mirror-public-release.sh",
-    "docker:builder:build": "(docker image inspect agnusdei1207/pentesting-build-base:1.95 >/dev/null 2>&1 && docker image inspect agnusdei1207/pentesting-runtime-base:26.04 >/dev/null 2>&1 || npm run docker:base:build) && docker build --build-arg APP_VERSION=$(git describe --tags --abbrev=0 2>/dev/null || echo dev) -t agnusdei1207/pentesting:latest .",
-    "docker:builder:push": "if [ -n \"$DOCKER_PASSWORD\" ]; then echo \"$DOCKER_PASSWORD\" | docker login -u \"${DOCKER_USERNAME:-agnusdei1207}\" --password-stdin; fi && npm run docker:builder:build && docker push agnusdei1207/pentesting:latest",
-    "docker:builder:tag": "docker tag agnusdei1207/pentesting:latest agnusdei1207/pentesting:$(git describe --tags --abbrev=0) && docker push agnusdei1207/pentesting:$(git describe --tags --abbrev=0)",
-    "docker:base:build": "docker build -t agnusdei1207/pentesting-build-base:1.95 -f docker/build-base.Dockerfile . && docker build -t agnusdei1207/pentesting-runtime-base:26.04 -f docker/runtime-base.Dockerfile .",
-    "docker:base:push": "if [ -n \"$DOCKER_PASSWORD\" ]; then echo \"$DOCKER_PASSWORD\" | docker login -u \"${DOCKER_USERNAME:-agnusdei1207}\" --password-stdin; fi && npm run docker:base:build && docker push agnusdei1207/pentesting-build-base:1.95 && docker push agnusdei1207/pentesting-runtime-base:26.04",
-    "docker:clean": "docker stop $(docker ps -q) 2>/dev/null || true && docker system prune -af",
-    "release": "./scripts/release-all.sh patch",
-    "release:dry": "DRY_RUN=true ./scripts/release-all.sh patch",
-    "release:local": "./scripts/run-release-in-docker.sh ./scripts/build-release-local.sh",
-    "release:local:dry": "DRY_RUN=true ./scripts/run-release-in-docker.sh ./scripts/build-release-local.sh",
-    "release:backfill": "./scripts/run-release-in-docker.sh ./scripts/backfill-release-local.sh",
-    "release:backfill:dry": "DRY_RUN=true ./scripts/run-release-in-docker.sh ./scripts/backfill-release-local.sh"
+    "check": "sh -c 'npm run docker:build && docker run -it --rm -v builder-workspace:/workspace -e ANTHROPIC_BASE_URL -e ANTHROPIC_AUTH_TOKEN -e ANTHROPIC_MODEL -e ANTHROPIC_API_KEY -e MINIMAX_API_KEY -e OPENAI_API_KEY -e OPENAI_BASE_URL -e GEMINI_API_KEY -e DEEPSEEK_API_KEY agnusdei1207/pentesting:latest'",
+    "docker:build": "(docker image inspect agnusdei1207/pentesting-build-base:1.96 >/dev/null 2>&1 && docker image inspect agnusdei1207/pentesting-runtime-base:26.04 >/dev/null 2>&1 || npm run docker:base:build) && docker build --build-arg APP_VERSION=$(git describe --tags --abbrev=0 2>/dev/null || echo dev) -t agnusdei1207/pentesting:latest .",
+    "docker:base:build": "docker build -t agnusdei1207/pentesting-build-base:1.96 -f docker/build-base.Dockerfile . && docker build -t agnusdei1207/pentesting-runtime-base:26.04 -f docker/runtime-base.Dockerfile .",
+    "release:patch": "./scripts/release-all.sh patch",
+    "release:minor": "./scripts/release-all.sh minor",
+    "release:major": "./scripts/release-all.sh major"
   },
   "devDependencies": {
     "@ai-sdk/google-vertex": "^4.0.47",