wormclaude 1.0.158 → 1.0.160

package/dist/cli.js

@@ -948,9 +948,13 @@ function App() {
             // başarısızlıklar birikir) toplam eşiği aşınca dur+özetle.
             const _failed = results.filter((r) => !r.ok).length;
             totalFails += _failed;
+            // Kurulum turu: model eksik aracı kuruyor (winget/choco/pip/apt/brew/npm -g…). Bu normal
+            // KURTARMA, "başarısızlık döngüsü" değil → ardışık-fail sayacını SIFIRLA ki uzun install
+            // (ya da install öncesi 'komut yok' hatası) devre-kesiciyi erken tetikleyip taramayı kesmesin.
+            const _installTurn = results.some((r) => /\b(?:winget|choco|scoop|apt(?:-get)?|dnf|yum|zypper|pacman|brew|pip3?|pipx|gem|cargo|go)\b[^|&;]*\b(?:install|-S|in)\b/i.test(String(r?.args?.command || '')));
             const _allFailed = results.length > 0 && _failed === results.length;
-            consecFailTurns = _allFailed ? consecFailTurns + 1 : 0;
-            if (consecFailTurns >= 2 || totalFails >= 4) {
+            consecFailTurns = (_allFailed && !_installTurn) ? consecFailTurns + 1 : 0;
+            if (consecFailTurns >= 2 || totalFails >= 5) {
                 historyRef.current = [...historyRef.current, {
                         role: 'user',
                         content: getLang() === 'en'

package/dist/theme.js

@@ -16,4 +16,4 @@ export const theme = {
     synType: '#a78bfa', // tip/sınıf adları, sabitler
     synProp: '#e0e0e0', // özellik/anahtar adları
 };
-export const VERSION = '1.0.158';
+export const VERSION = '1.0.160';

package/dist/tools.js

@@ -32,6 +32,16 @@ const DEFAULT_BASH_TIMEOUT_MS = 120000;
 // Bunları run_in_background istenmese bile OTOMATİK arka plana alıyoruz → CLI asla donmaz.
 const _DEV_SERVER_RE = /\b(?:npm|pnpm|yarn)\s+(?:run\s+)?(?:dev|start|serve|preview)\b|\b(?:next|nuxt|vite|gatsby)\s+(?:dev|develop|start)\b|\bng\s+serve\b|\breact-scripts\s+start\b|\bnodemon\b|\bhttp-server\b|(?:^|\s)serve(?:\s|$)|\bpython3?\s+-m\s+http\.server\b|\bflask\s+run\b|\buvicorn\b|\bgunicorn\b|\bphp\s+-S\b|\brails\s+s(?:erver)?\b|\bwebpack(?:-dev-server)?\s+serve\b/i;
 const MAX_BASH_TIMEOUT_MS = 600000;
+// Paket KURULUM komutları (winget/choco/pip/apt/brew/npm -g …) yavaştır (indirme+derleme):
+// 2 dk default timeout'u aşıp ÖLDÜRÜLÜYORLARDI → "install yarım kaldı" + devre-kesici tetikleniyordu.
+// Bunlara otomatik MAX timeout (10 dk) verilir; model ayrıca süre belirtirse o kullanılır.
+const _LONG_INSTALL_RE = /\b(?:winget\s+install|choco\s+install|scoop\s+install|apt(?:-get)?\s+install|dnf\s+install|yum\s+install|zypper\s+(?:in|install)|pacman\s+-S|brew\s+install|pip3?\s+install|pipx\s+install|gem\s+install|cargo\s+install|go\s+install|npm\s+(?:i|install)\b[^|&;]*-g)\b/i;
+function _cmdTimeout(cmd, explicit) {
+    let t = Number(explicit) || (_LONG_INSTALL_RE.test(cmd) ? MAX_BASH_TIMEOUT_MS : DEFAULT_BASH_TIMEOUT_MS);
+    if (t > MAX_BASH_TIMEOUT_MS)
+        t = MAX_BASH_TIMEOUT_MS;
+    return t;
+}
 // Bash çalışma dizini — oturum boyunca kalıcı. execSync her çağrıda taze shell açtığı için
 // `cd` normalde kaybolur; burada cwd'yi takip edip her komuta geçiriyoruz.
 let bashCwd;
@@ -740,8 +750,10 @@ async function execOne(call, hooks) {
             // HYBRID: bu gömülü ilk-geçiştir. Modele, kullanıcıya derin taramayı TEKLİF ettir.
             txt += '\n\n[hybrid-note] This was WormClaude\'s fast embedded first-pass scan. After reporting these'
                 + ' findings, OFFER the user (in their language) a deeper full scan with real tools'
-                + ' (nmap, nuclei, sqlmap, dalfox, ffuf). Run that deeper pass ONLY if the user accepts AND the'
-                + ' target is in authorized scope.';
+                + ' (nmap, nuclei, sqlmap, dalfox, ffuf), paired with the authorization reminder: for'
+                + ' educational/authorized use only — run it only if the user owns the target or holds a written'
+                + ' authorization document. Escalate ONLY if the user accepts AND has confirmed ownership/written'
+                + ' authorization (ask once if unstated).';
             return { ok: true, output: txt, args };
         }
         catch (e) {
@@ -1031,9 +1043,7 @@ export async function executeTool(name, args) {
                     : '';
                 return { ok: true, output: `Background task started: ${task.id}.${_note} Read output later with TaskOutput("${task.id}").` };
             }
-            let timeout = Number(args.timeout) || DEFAULT_BASH_TIMEOUT_MS;
-            if (timeout > MAX_BASH_TIMEOUT_MS)
-                timeout = MAX_BASH_TIMEOUT_MS;
+            const timeout = _cmdTimeout(_cmd, args.timeout);
             const out = await runBashCapturingCwd(String(args.command), timeout);
             return { ok: true, output: (out || '(no output)').slice(0, 20000) };
         }
@@ -1387,9 +1397,7 @@ export async function executeTool(name, args) {
             return { ok: true, output: txt || '(boş)' };
         }
         if (name === 'PowerShell') {
-            let timeout = Number(args.timeout) || DEFAULT_BASH_TIMEOUT_MS;
-            if (timeout > MAX_BASH_TIMEOUT_MS)
-                timeout = MAX_BASH_TIMEOUT_MS;
+            const timeout = _cmdTimeout(String(args.command), args.timeout);
             const cmd = String(args.command).replace(/"/g, '\\"');
             // ASYNC — event-loop'u bloklamaz (eski execSync donmaya sebep oluyordu).
             const { out, code, killed } = await _spawnAsync(`powershell -NoProfile -NonInteractive -Command "${cmd}"`, timeout, { shell: true, windowsHide: true, cwd: getBashCwd() });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wormclaude",
-  "version": "1.0.158",
+  "version": "1.0.160",
   "description": "WormClaude CLI - uncensored security+code assistant (ink TUI, Claude-style)",
   "type": "module",
   "bin": {