wormclaude 1.0.194 → 1.0.196

package/dist/commands.js

@@ -60,6 +60,7 @@ export const COMMANDS = [
     { name: '/dirscan', desc: '[seviye 3+] dizin/içerik keşfi (yönetim/api/yedek/sızıntı yolları): /dirscan <alan>' },
     { name: '/report', desc: 'son taramadan profesyonel pentest raporu üret (CVSS/etki/çözüm, dosyaya yazar)' },
     { name: '/fullscan', desc: '[seviye 3+] tam kapsamlı DETERMİNİSTİK tarama: recon+XSS+SQLi tek komutta: /fullscan <hedef>' },
+    { name: '/pentest', desc: 'OTONOM çoklu-yüzey pentest (web+network+OSINT+cloud → tek rapor): /pentest <domain>' },
     { name: '/audit', desc: 'kaynak kod güvenlik denetimi (SAST — sır/açık/CVE, yerel): /audit [klasör]' },
     { name: '/jwt', desc: 'JWT token güvenlik analizi (alg=none/zayıf-secret/expiry/claim, yerel): /jwt <token>' },
     { name: '/spray', desc: 'login formuna parola-spray (yetkili test, trust 3+): /spray <login-url> [kullanıcı]' },

package/dist/theme.js

@@ -16,4 +16,4 @@ export const theme = {
     synType: '#a78bfa', // tip/sınıf adları, sabitler
     synProp: '#e0e0e0', // özellik/anahtar adları
 };
-export const VERSION = '1.0.194';
+export const VERSION = '1.0.196';

package/dist/tools.js

@@ -230,7 +230,7 @@ export const toolSchemas = [
             parameters: {
                 type: 'object',
                 properties: {
-                    tool: { type: 'string', enum: ['full', 'recon', 'scan', 'xss', 'sqli', 'dirscan', 'idor', 'portscan', 'osint', 'cloudscan', 'spray', 'defaultcreds'], description: 'full → tam kapsamlı web taraması; recon/scan/dirscan/portscan/osint/cloudscan → domain/host/şirket; xss/sqli/idor → parameterized URL. portscan = TCP port/servis. osint = DNS + e-posta güvenliği (SPF/DMARC). cloudscan = açık bulut bucket keşfi (S3/GCP/Azure). spray = login formuna parola-spray (target = login URL, username param ile; "parola dene"/"spray"/"brute" denince, trust 3+). defaultcreds = login\'e varsayılan kimlikler (admin/admin vb.) dene (target = login URL, trust 3+)' },
+                    tool: { type: 'string', enum: ['auto', 'full', 'recon', 'scan', 'xss', 'sqli', 'dirscan', 'idor', 'portscan', 'osint', 'cloudscan', 'spray', 'defaultcreds'], description: 'auto → OTONOM çoklu-yüzey pentest (web full + network portscan + OSINT + cloud bucket, hepsi tek raporda; "pentest yap"/"tam denetle"/"her şeyi tara"/"otonom" denince — domain/host); full → tam kapsamlı web taraması; recon/scan/dirscan/portscan/osint/cloudscan → domain/host/şirket; xss/sqli/idor → parameterized URL. portscan = TCP port/servis. osint = DNS + e-posta güvenliği (SPF/DMARC). cloudscan = açık bulut bucket keşfi (S3/GCP/Azure). spray = login formuna parola-spray (target = login URL, username param ile; "parola dene"/"spray"/"brute" denince, trust 3+). defaultcreds = login\'e varsayılan kimlikler (admin/admin vb.) dene (target = login URL, trust 3+)' },
                     target: { type: 'string', description: 'Domain for recon/scan/dirscan (example.com) OR parameterized URL for xss/sqli (https://example.com/p?id=1)' },
                     cookie: { type: 'string', description: 'Optional. Session cookie for AUTHENTICATED / behind-login scanning, e.g. "sessionid=abc123; csrftoken=xyz". The user copies it from their logged-in browser (DevTools → Application → Cookies, or the Cookie request header). Sent only to the target from the user IP — never stored on the server. Provide it whenever the user wants to scan pages behind a login.' },
                     auth_header: { type: 'string', description: 'Optional. Authorization header value for token-based authenticated scanning, e.g. "Bearer eyJhbGci..." or "Basic dXNlcjpwYXNz". Use instead of / together with cookie when the site authenticates via a token header.' },
@@ -767,7 +767,7 @@ async function execOne(call, hooks) {
     if (call.name === 'SecurityScan') {
         let tool = String(args?.tool || '').toLowerCase().trim();
         const target = String(args?.target || '').trim();
-        if (!['recon', 'scan', 'xss', 'sqli', 'dirscan', 'idor', 'portscan', 'osint', 'cloud', 'cloudscan', 'spray', 'credspray', 'defaultcreds', 'full', 'fullscan'].includes(tool) || !target) {
+        if (!['recon', 'scan', 'xss', 'sqli', 'dirscan', 'idor', 'portscan', 'osint', 'cloud', 'cloudscan', 'spray', 'credspray', 'defaultcreds', 'full', 'fullscan', 'auto', 'pentest'].includes(tool) || !target) {
             return { ok: false, output: 'SecurityScan: tool (recon|scan|xss|sqli|dirscan|full) ve target gerekli.', args };
         }
         if (tool === 'scan')
@@ -799,11 +799,14 @@ async function execOne(call, hooks) {
         const _authTag = _auth ? '|auth' : '';
         // FULL: tam kapsamlı tarama TEK ÇAĞRIDA — model orkestrasyona girmesin (döngü olur). Kod
         // deterministik olarak recon → xss → sqli koşar, TEK konsolide rapor döner.
-        if (tool === 'full' || tool === 'fullscan') {
-            const _fk = 'full|' + target.toLowerCase() + _authTag;
+        if (tool === 'full' || tool === 'fullscan' || tool === 'auto' || tool === 'pentest') {
+            // AUTO/PENTEST = otonom çoklu-yüzey: web (full) + network (portscan) + OSINT + cloud, TEK rapor.
+            // full = sadece web. İkisi de deterministik koşar (model orkestrasyona girip döngü yapmasın).
+            const _isAuto = tool === 'auto' || tool === 'pentest';
+            const _fk = (_isAuto ? 'auto|' : 'full|') + target.toLowerCase() + _authTag;
             const _fc = _scanCache.get(_fk);
             if (_fc && Date.now() - _fc.t < 120000) {
-                return { ok: false, args, output: `[ALREADY-SCANNED] full scan "${target}" already ran — findings are above. Do NOT call SecurityScan again; summarize the results in text.` };
+                return { ok: false, args, output: `[ALREADY-SCANNED] ${_isAuto ? 'autonomous pentest' : 'full scan'} "${target}" already ran — findings are above. Do NOT call SecurityScan again; summarize the results in text.` };
             }
             try {
                 const { runPentest, fetchPtTools } = await import('./pentest.js');
@@ -819,7 +822,12 @@ async function execOne(call, hooks) {
                     }
                 }
                 catch { }
-                let rpt = `Tam kapsamlı tarama — ${target}${_auth ? ' (authenticated / login-arkası — oturum enjekte edildi)' : ''}${_loginNote}\n${_steps.length} tarayıcı koşuluyor (recon+dirscan+xss+sqli + şablonlar).\n`;
+                // AUTO: web'in üstüne bağımsız yüzeyleri ekle (network + e-posta/DNS + bulut bucket).
+                const _extraSurfaces = _isAuto ? ['portscan', 'osint', 'cloudscan'] : [];
+                for (const s of _extraSurfaces)
+                    if (!_steps.includes(s))
+                        _steps.push(s);
+                let rpt = `${_isAuto ? 'Otonom pentest (web+network+OSINT+cloud)' : 'Tam kapsamlı tarama'} — ${target}${_auth ? ' (authenticated / login-arkası — oturum enjekte edildi)' : ''}${_loginNote}\n${_steps.length} tarayıcı koşuluyor${_isAuto ? ' (web full + portscan + osint + cloudscan)' : ' (recon+dirscan+xss+sqli + şablonlar)'}.\n`;
                 let _wafSeen = false;
                 for (const _t of _steps) {
                     if (hooks?.signal?.aborted) {
@@ -901,7 +909,9 @@ async function execOne(call, hooks) {
                 rpt += `\n\nToplam ${all.length} bulgu (${_steps.length} tarayıcı${_subs && _subs.length ? ' + ' + _subs.length + ' alt-alan' : ''}).`;
                 if (all.length)
                     rpt += '\n' + all.slice(0, 80).map((x) => '  ' + JSON.stringify(x)).join('\n');
-                rpt += `\n[full-done] comprehensive scan (${_steps.length} scanners${_subs && _subs.length ? ' + ' + _subs.length + ' subdomains' : ''}) ran. Each finding has a "cvss" base score. Do NOT call SecurityScan again — report to the user in text: severity-ordered summary, include the CVSS score per finding, note subdomain findings, prioritized fixes, in their language.`;
+                rpt += _isAuto
+                    ? `\n[auto-done] AUTONOMOUS multi-surface pentest ran (web full + network portscan + OSINT dns/email + cloud buckets, ${_steps.length} scanners${_subs && _subs.length ? ' + ' + _subs.length + ' subdomains' : ''}). Each finding has a "cvss" base score. Do NOT call SecurityScan again — write a PENTEST REPORT in the user's language: (1) executive summary (overall risk posture, count by severity), (2) findings grouped by SURFACE (web / network / email-DNS / cloud), severity-ordered, with CVSS, (3) prioritized remediation roadmap. Be concrete.`
+                    : `\n[full-done] comprehensive scan (${_steps.length} scanners${_subs && _subs.length ? ' + ' + _subs.length + ' subdomains' : ''}) ran. Each finding has a "cvss" base score. Do NOT call SecurityScan again — report to the user in text: severity-ordered summary, include the CVSS score per finding, note subdomain findings, prioritized fixes, in their language.`;
                 const _now = Date.now();
                 _scanCache.set(_fk, { out: rpt, t: _now });
                 for (const _t of ['recon', 'xss', 'sqli', 'dirscan'])

package/dist/tui.js

@@ -522,14 +522,24 @@ export async function runTui() {
                         printItem({ kind: 'tool', label: toolLabel(c.name, res.args), result, ok: res.ok });
                     },
                 });
-                for (let i = 0; i < toolCalls.length; i++)
-                    history.push({ role: 'tool', tool_call_id: toolCalls[i].id, content: capToolOut(toolCalls[i].name, results[i].output || '') });
                 // Devre-kesici: olmayan araç/Unix sözdizimini (grep/openssl/hydra) tekrar deneyip
                 // döngüye girmesin. Üst üste hepsi fail (2 tur) VEYA toplam 4 başarısız → dur+özetle.
                 const _failed = results.filter((r) => !r.ok).length;
                 totalFails += _failed;
                 consecFail = (results.length > 0 && _failed === results.length) ? consecFail + 1 : 0;
-                if (consecFail >= 2 || totalFails >= 4) {
+                const _willStop = consecFail >= 2 || totalFails >= 4;
+                // REFLECT-AFTER: bir araç başarısızsa (ve henüz sert-dur eşiğine gelmediysek) modele
+                // teşhis+adapte dayat — körlemesine tekrar/pes etmesin, benim gibi "neden + başka yol" düşünsün.
+                for (let i = 0; i < toolCalls.length; i++) {
+                    let _content = capToolOut(toolCalls[i].name, results[i].output || '');
+                    if (!results[i].ok && !_willStop) {
+                        _content += getLang() === 'en'
+                            ? '\n\n[REFLECT] This call failed. Before continuing, think briefly: (1) WHY did it fail? (2) Do NOT repeat the same call verbatim — fix the arguments or try a DIFFERENT approach/tool. (3) If it cannot be solved, tell the user plainly. Never give up silently or loop.'
+                            : '\n\n[DÜŞÜN] Bu çağrı başarısız oldu. Devam etmeden kısaca düşün: (1) NEDEN başarısız oldu? (2) Aynı çağrıyı AYNEN tekrarlama — parametreyi düzelt ya da BAŞKA bir yol/araç dene. (3) Çözülemiyorsa kullanıcıya açıkça söyle. Asla sessizce pes etme, döngüye girme.';
+                    }
+                    history.push({ role: 'tool', tool_call_id: toolCalls[i].id, content: _content });
+                }
+                if (_willStop) {
                     history.push({ role: 'user', content: getLang() === 'en'
                             ? 'Several commands failed — required tools/syntax are not available here (e.g. grep/openssl/hydra on Windows). STOP running commands now and give a SHORT summary of what you found so far. Do NOT call more tools, do NOT use grep/sed/awk.'
                             : 'Komutlar başarısız oldu — bu ortamda gerekli araç/sözdizim yok (Windows\'ta grep/openssl/hydra gibi). Komut çalıştırmayı ŞİMDİ BIRAK, şu ana kadarki bulguları KISA özetle. Başka araç çağırma, grep/sed/awk kullanma.' });
@@ -836,6 +846,16 @@ export async function runTui() {
                     quit();
                     return;
                 }
+                // /pentest — OTONOM çoklu-yüzey pentest (web+network+OSINT+cloud); SecurityScan tool=auto
+                if (tok === '/pentest') {
+                    const a = v.slice(tok.length).trim();
+                    if (!a) {
+                        printItem({ kind: 'note', text: 'Kullanım: /pentest <domain>' });
+                        return;
+                    }
+                    runTurn(`SecurityScan aracıyla tool=auto, target=${a} çalıştır (otonom çoklu-yüzey pentest: web+network+OSINT+cloud). Sonra yüzey-bazlı yönetici pentest raporu yaz.`, v);
+                    return;
+                }
                 // /audit — kaynak kod güvenlik denetimi (SAST, yerel); modele CodeAudit çağırt
                 if (tok === '/audit') {
                     const a = v.slice(tok.length).trim() || '.';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wormclaude",
-  "version": "1.0.194",
+  "version": "1.0.196",
   "description": "WormClaude CLI - uncensored security+code assistant (ink TUI, Claude-style)",
   "type": "module",
   "bin": {