sicario-red-team 0.1.0 → 0.1.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sicario-red-team",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Autonomous Agentic Red-Teaming Swarm Protocol",
   "type": "module",
   "files": [

package/src-cli/commands/hit.js

@@ -82,23 +82,47 @@ export async function hitCommand(target, options) {
             if (client && missionId) await client.mutation('handler:logMessage', { missionId, type: 'Breacher', message: 'Analysis complete.' });
 
             if (breachReport.vulnerabilityFound) {
-                console.log('\n' + theme.exploit(`${breachReport.title} locked on ${breachReport.targetElement}`));
-                console.log(pc.red(`Vector: ${breachReport.vector}`));
-                console.log(pc.red(`Severity: ${breachReport.severity}\n`));
+                // 6. Sanitization Layer (The Anti-Crash Upgrade)
+                const sanitize = (raw) => ({
+                    title: raw.title || "Unknown Logic Flaw",
+                    vector: raw.vector || "Vector analysis inconclusive.",
+                    severity: raw.severity || "MEDIUM",
+                    targetElement: raw.targetElement || "General DOM Context",
+                    mitigation: raw.mitigation || "Implement standard server-side validation guards.",
+                    thoughtProcess: raw.thoughtProcess || "Reasoning engine offline."
+                });
+
+                const clean = sanitize(breachReport);
+
+                console.log('\n' + theme.exploit(`${clean.title} locked on ${clean.targetElement}`));
+                console.log(pc.red(`Vector: ${clean.vector}`));
+                console.log(pc.red(`Severity: ${clean.severity}\n`));
 
                 if (client && missionId) {
                     await client.mutation('handler:logExploit', {
                         missionId,
-                        title: breachReport.title,
-                        vector: breachReport.vector,
-                        severity: breachReport.severity,
-                        target: breachReport.targetElement,
-                        mitigation: breachReport.mitigation // Ensure backend supports this
+                        ...clean
                     });
                 }
 
-                if (breachReport.mitigation) {
-                    note(pc.cyan(breachReport.mitigation), 'FIX RECOMMENDATION');
+                const mitigation = clean.mitigation;
+                const thoughtProcess = clean.thoughtProcess;
+
+                if (clean.mitigation) {
+                    const boxWidth = 60;
+                    const wrap = (str, width) => str.match(new RegExp(`.{1,${width}}(\\s|$)`, 'g')) || [str];
+                    
+                    const drawBoxRow = (content, width) => `│ ${content.trim().padEnd(width - 4)} │`;
+
+                    const thoughtLines = wrap(thoughtProcess, boxWidth - 4);
+                    const mitLines = wrap(mitigation, boxWidth - 4);
+                    
+                    console.log('\n' + pc.cyan(`◇  SICARIO REASONING ${'─'.repeat(boxWidth - 21)}╮`));
+                    thoughtLines.forEach(line => console.log(pc.cyan(drawBoxRow(line, boxWidth))));
+                    console.log(pc.cyan(`├${'─'.repeat(boxWidth - 2)}┤`));
+                    console.log(pc.cyan(`│ ${pc.bold('FIX RECOMMENDATION').padEnd(boxWidth - 4)} │`));
+                    mitLines.forEach(line => console.log(pc.cyan(drawBoxRow(line, boxWidth))));
+                    console.log(pc.cyan(`├${'─'.repeat(boxWidth - 2)}╯`) + '\n');
                 }
             } else {
                 log.info(theme.dim('No high-value business logic targets identified.'));

package/src-cli/nodes/breacher.js

@@ -13,25 +13,22 @@ export async function runBreacher(domElements) {
     });
 
     const systemPrompt = `
-You are 'The Breacher', an elite, autonomous SecOps AI. Your sole objective is to analyze a JSON array of web elements (DOM) and identify critical OWASP Business Logic vulnerabilities.
+You are the "Breacher" node of the Sicario Autonomous Swarm. 
+Your goal is to identify Business Logic Flaws that automated scanners miss.
 
-### YOUR RULES OF ENGAGEMENT:
-1. FOCUS ONLY ON BUSINESS LOGIC: Look for vectors allowing Action Limit Overruns (using coupons multiple times), Concurrent Workflow Bypassing (skipping checkout steps), or Price/State Manipulation.
-2. NO BASIC FLAWS: DO NOT report standard XSS, SQLi, or CSRF vulnerabilities. 
-3. GROUNDED REALITY: You may only formulate an attack if the specific elements required (e.g., a checkout button, a promo code input) exist in the provided JSON array.
-4. ZERO HALLUCINATIONS: If the DOM array does not contain high-value business logic targets (e.g., it is just a simple blog or static page), you MUST report no vulnerabilities.
+### PHASE 1: REASONING (THINK OUT LOUD)
+Before providing JSON, analyze the DOM elements for state-changing flows, manipulation vectors, and missing validation guards.
 
-### MANDATORY OUTPUT FORMAT:
-You must respond ONLY with a valid, raw JSON object. Do not include markdown formatting, conversational text, or explanations outside the JSON structure.
-
-Use this exact schema:
+### PHASE 2: DATA STRUCTURE
+Return a VALID JSON object. DO NOT use "null".
 {
   "vulnerabilityFound": boolean,
-  "title": string | null,
-  "targetElement": string | null, // The ID or Name of the exploited element
-  "vector": string | null, // A strict, 1-sentence technical explanation of the logic flaw
-  "severity": "LOW" | "MEDIUM" | "HIGH" | "CRITICAL" | null,
-  "mitigation": string | null // A brief, 2-sentence technical recommendation for fixing the logic flaw
+  "thoughtProcess": "Step-by-step logic on how you'd exploit this...",
+  "title": "Clear name of flaw",
+  "vector": "Technical exploit path",
+  "severity": "LOW|MEDIUM|HIGH|CRITICAL",
+  "targetElement": "The CSS selector or element name",
+  "mitigation": "Detailed code fix recommendation"
 }
 `;