wormclaude 1.0.168 → 1.0.169
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/theme.js +1 -1
- package/dist/tools.js +12 -0
- package/package.json +1 -1
package/dist/theme.js
CHANGED
package/dist/tools.js
CHANGED
|
@@ -47,6 +47,10 @@ function _cmdTimeout(cmd, explicit) {
|
|
|
47
47
|
let bashCwd;
|
|
48
48
|
export function getBashCwd() { return bashCwd || process.cwd(); }
|
|
49
49
|
export function setBashCwd(dir) { bashCwd = dir; }
|
|
50
|
+
// SecurityScan döngü-kırıcı: model mevcut bulguları "açıklarken" aynı taramayı tekrar tekrar
|
|
51
|
+
// çağırıp döngüye giriyordu. Aynı (tool,target) 2 dk içinde tekrar gelirse YENİDEN tarama yok —
|
|
52
|
+
// önceki sonucu + "yeniden tarama, bulgularla yanıtla" notunu dön.
|
|
53
|
+
const _scanCache = new Map();
|
|
50
54
|
// Göreli dosya yollarını AKTİF workspace'e (bashCwd) çözer; mutlak yol aynen kalır.
|
|
51
55
|
// Böylece model "index.html" gibi göreli yol verse bile dosya bilinen klasöre yazılır.
|
|
52
56
|
export function resolveWs(fp) {
|
|
@@ -733,6 +737,13 @@ async function execOne(call, hooks) {
|
|
|
733
737
|
}
|
|
734
738
|
if (tool === 'scan')
|
|
735
739
|
tool = 'recon'; // "scan" genel tarama → motorun bildiği "recon" (slash ile aynı)
|
|
740
|
+
// DÖNGÜ-KIRICI: aynı tarama 2 dk içinde tekrar → yeniden koşma, önceki sonuç + "yeniden tarama" notu.
|
|
741
|
+
const _ck = tool + '|' + target.toLowerCase();
|
|
742
|
+
const _cached = _scanCache.get(_ck);
|
|
743
|
+
if (_cached && Date.now() - _cached.t < 120000) {
|
|
744
|
+
return { ok: true, args, output: _cached.out
|
|
745
|
+
+ '\n\n[ALREADY-SCANNED] This exact scan just ran — results above. Do NOT scan again. Answer the user from these findings (explain / prioritize / translate / show fixes). Re-scanning is a loop.' };
|
|
746
|
+
}
|
|
736
747
|
try {
|
|
737
748
|
const { runPentest } = await import('./pentest.js');
|
|
738
749
|
const out = await runPentest(cfg(), tool, target, true, () => { });
|
|
@@ -754,6 +765,7 @@ async function execOne(call, hooks) {
|
|
|
754
765
|
+ ` the user to run the deterministic command "/fullscan ${target}" — it chains recon + XSS + SQLi`
|
|
755
766
|
+ ` in one reliable, repeatable pass. Do NOT hand-orchestrate nmap/sqlmap yourself; recommend`
|
|
756
767
|
+ ` /fullscan. Pair it with the authorization reminder (only on owned / written-authorized targets).`;
|
|
768
|
+
_scanCache.set(_ck, { out: txt, t: Date.now() }); // döngü-kırıcı için sakla
|
|
757
769
|
return { ok: true, output: txt, args };
|
|
758
770
|
}
|
|
759
771
|
catch (e) {
|