wormclaude 1.0.175 → 1.0.177

package/dist/theme.js

@@ -16,4 +16,4 @@ export const theme = {
     synType: '#a78bfa', // tip/sınıf adları, sabitler
     synProp: '#e0e0e0', // özellik/anahtar adları
 };
-export const VERSION = '1.0.175';
+export const VERSION = '1.0.177';

package/dist/tools.js

@@ -226,11 +226,11 @@ export const toolSchemas = [
         type: 'function',
         function: {
             name: 'SecurityScan',
-            description: "Run an AUTHORIZED security scan with WormClaude's own server-side engine (no external tools, no manual payloads). Use THIS — never shell/curl/Invoke-WebRequest — whenever the user asks to scan/test a target for vulnerabilities (\"tara\", \"scan\", \"xss tara\", \"sqli\", \"recon\", \"açık bul\", \"zafiyet tara\"). The engine runs payloads + detection server-side and returns findings. For xss/sqli give a PARAMETERIZED url (e.g. https://site/page?id=1); for recon/scan give a domain. Requires authorized-researcher level (3+); traffic exits the user's IP — only authorized targets.",
+            description: "Run an AUTHORIZED security scan with WormClaude's own server-side engine (no external tools, no manual payloads). Use THIS — never shell/curl/Invoke-WebRequest — whenever the user asks to scan/test a target (\"tara\", \"scan\", \"xss tara\", \"sqli\", \"recon\", \"açık bul\", \"zafiyet tara\", \"tam kapsamlı tara\"). For a FULL/comprehensive scan use tool='full' ONCE — it deterministically runs recon+XSS+SQLi in code and returns ONE consolidated report (do NOT chain recon/xss/sqli yourself, that loops). For a single check use recon/xss/sqli. For xss/sqli give a PARAMETERIZED url; for recon/full give a domain. Requires authorized-researcher level (3+); traffic exits the user's IP — only authorized targets.",
             parameters: {
                 type: 'object',
                 properties: {
-                    tool: { type: 'string', enum: ['recon', 'scan', 'xss', 'sqli', 'dirscan'], description: 'recon/scan/dirscan → domain; xss/sqli → parameterized URL' },
+                    tool: { type: 'string', enum: ['full', 'recon', 'scan', 'xss', 'sqli', 'dirscan'], description: 'full → tam kapsamlı (recon+xss+sqli tek seferde, kapsamlı tarama için BUNU kullan); recon/scan/dirscan → domain; xss/sqli → parameterized URL' },
                     target: { type: 'string', description: 'Domain for recon/scan/dirscan (example.com) OR parameterized URL for xss/sqli (https://example.com/p?id=1)' },
                 },
                 required: ['tool', 'target'],
@@ -732,11 +732,59 @@ async function execOne(call, hooks) {
     if (call.name === 'SecurityScan') {
         let tool = String(args?.tool || '').toLowerCase().trim();
         const target = String(args?.target || '').trim();
-        if (!['recon', 'scan', 'xss', 'sqli', 'dirscan'].includes(tool) || !target) {
-            return { ok: false, output: 'SecurityScan: tool (recon|scan|xss|sqli|dirscan) ve target gerekli.', args };
+        if (!['recon', 'scan', 'xss', 'sqli', 'dirscan', 'full', 'fullscan'].includes(tool) || !target) {
+            return { ok: false, output: 'SecurityScan: tool (recon|scan|xss|sqli|dirscan|full) ve target gerekli.', args };
         }
         if (tool === 'scan')
             tool = 'recon'; // "scan" genel tarama → motorun bildiği "recon" (slash ile aynı)
+        // FULL: tam kapsamlı tarama TEK ÇAĞRIDA — model orkestrasyona girmesin (döngü olur). Kod
+        // deterministik olarak recon → xss → sqli koşar, TEK konsolide rapor döner.
+        if (tool === 'full' || tool === 'fullscan') {
+            const _fk = 'full|' + target.toLowerCase();
+            const _fc = _scanCache.get(_fk);
+            if (_fc && Date.now() - _fc.t < 120000) {
+                return { ok: false, args, output: `[ALREADY-SCANNED] tam tarama "${target}" zaten koşuldu — bulgular yukarıda. TEKRAR SecurityScan çağırma; sonuçları METİN olarak özetle.` };
+            }
+            try {
+                const { runPentest } = await import('./pentest.js');
+                const all = [];
+                let rpt = `Tam kapsamlı tarama — ${target}\n`;
+                for (const _t of ['recon', 'xss', 'sqli']) {
+                    try {
+                        const o = await runPentest(cfg(), _t, target, true, () => { });
+                        if (o?.ok) {
+                            const ff = o.report?.findings || [];
+                            all.push(...ff.map((x) => ({ ...x, scan: _t })));
+                            rpt += `\n[${_t}] ${ff.length ? ff.length + ' bulgu' : 'temiz'}` + (o.report?.target ? ` (${o.report.target})` : '');
+                        }
+                        else {
+                            const rsn = o?.reason || o?.plan?.reason || 'error';
+                            rpt += `\n[${_t}] çalışmadı: ${rsn}`;
+                            if (rsn === 'trust_required') {
+                                rpt += ' — Doğrulanmış Araştırmacı (seviye 3+) gerekir.';
+                                break;
+                            }
+                        }
+                    }
+                    catch (e) {
+                        rpt += `\n[${_t}] hata: ${e?.message || e}`;
+                    }
+                }
+                rpt += `\n\nToplam ${all.length} bulgu.`;
+                if (all.length)
+                    rpt += '\n' + all.slice(0, 60).map((x) => '  ' + JSON.stringify(x)).join('\n');
+                rpt += `\n[full-done] recon+xss+sqli koşuldu. SecurityScan'i TEKRAR çağırma — bulguları kullanıcıya METİN olarak raporla (özet + öncelikli düzeltmeler).`;
+                const _now = Date.now();
+                _scanCache.set(_fk, { out: rpt, t: _now });
+                // Alt tarama tiplerini de cache'le → full sonrası model tek tek recon/xss/sqli çağıramaz (gereksiz tekrar).
+                for (const _t of ['recon', 'xss', 'sqli'])
+                    _scanCache.set(_t + '|' + target.toLowerCase(), { out: rpt, t: _now });
+                return { ok: true, output: rpt, args };
+            }
+            catch (e) {
+                return { ok: false, output: 'Tam tarama hatası: ' + (e?.message || e), args };
+            }
+        }
         // DÖNGÜ-KIRICI: aynı tarama 2 dk içinde tekrar → yeniden koşma, önceki sonuç + "yeniden tarama" notu.
         const _ck = tool + '|' + target.toLowerCase();
         const _cached = _scanCache.get(_ck);
@@ -760,11 +808,9 @@ async function execOne(call, hooks) {
                 txt += 'Zafiyet bulunamadı (hedef temiz ya da yanıt vermedi).';
             else
                 txt += `${rep.found_count} bulgu:\n` + f.slice(0, 50).map((x) => '  ' + JSON.stringify(x)).join('\n');
-            // HYBRID: bu gömülü ilk-geçiştir. Derin tarama = DETERMİNİSTİK /fullscan (model doğaçlamasın).
-            txt += `\n\n[hybrid-note] This was WormClaude's fast first-pass scan. For a COMPREHENSIVE scan, tell`
-                + ` the user to run the deterministic command "/fullscan ${target}" — it chains recon + XSS + SQLi`
-                + ` in one reliable, repeatable pass. Do NOT hand-orchestrate nmap/sqlmap yourself; recommend`
-                + ` /fullscan. Pair it with the authorization reminder (only on owned / written-authorized targets).`;
+            // Tek-tip tarama bitti. Kapsamlı isteniyorsa model TEK çağrıyla SecurityScan(tool:"full") koşmalı
+            // (kod deterministik recon+xss+sqli yapar) — kendi recon/xss/sqli zincirlemesin (döngüye girer).
+            txt += `\n\n[done] Bu tek tarama (${tool}) bitti — sonucu kullanıcıya METİN olarak özetle. SecurityScan'i bu hedefte TEKRAR çağırma.`;
             _scanCache.set(_ck, { out: txt, t: Date.now() }); // döngü-kırıcı için sakla
             return { ok: true, output: txt, args };
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wormclaude",
-  "version": "1.0.175",
+  "version": "1.0.177",
   "description": "WormClaude CLI - uncensored security+code assistant (ink TUI, Claude-style)",
   "type": "module",
   "bin": {