lfx-darkmoon 0.1.0__tar.gz

lfx_darkmoon-0.1.0/.gitignore

@@ -0,0 +1,12 @@
+__pycache__/
+*.pyc
+.pytest_cache/
+.ruff_cache/
+.venv/
+venv/
+.env
+.env.*
+*.egg-info/
+dist/
+build/
+.DS_Store

lfx_darkmoon-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ASC-IT (Darkmoon)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

lfx_darkmoon-0.1.0/PKG-INFO

@@ -0,0 +1,111 @@
+Metadata-Version: 2.5
+Name: lfx-darkmoon
+Version: 0.1.0
+Summary: Darkmoon components as a standalone Langflow Extension Bundle: run an authorised AI pentest, pull findings, and review the fix pull requests Darkmoon prepares.
+Project-URL: Homepage, https://github.com/ASCIT31/Dark-Moon
+Project-URL: Documentation, https://docs.langflow.org/extensions
+Project-URL: Source, https://github.com/ASCIT31/langflow-darkmoon
+Project-URL: Issues, https://github.com/ASCIT31/langflow-darkmoon/issues
+Author: ASC-IT (Darkmoon)
+License: MIT
+License-File: LICENSE
+Keywords: ai-security,appsec,bundle,darkmoon,dast,extension,langflow,lfx,pentest,security
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Requires-Python: <3.15,>=3.10
+Requires-Dist: lfx<2.0.0,>=1.12.0
+Requires-Dist: requests>=2.28
+Provides-Extra: test
+Requires-Dist: pytest>=8; extra == 'test'
+Description-Content-Type: text/markdown
+
+# langflow-darkmoon
+
+[![Darkmoon](https://img.shields.io/badge/Darkmoon-autonomous%20pentest-4f46e5)](https://github.com/ASCIT31/Dark-Moon)
+[![Star Dark-Moon on GitHub](https://img.shields.io/github/stars/ASCIT31/Dark-Moon?style=social)](https://github.com/ASCIT31/Dark-Moon)
+
+A [Langflow](https://github.com/langflow-ai/langflow) **Extension Bundle** (distribution `lfx-darkmoon`) for **[Darkmoon](https://github.com/ASCIT31/Dark-Moon)**, the local, privacy first autonomous AI penetration testing engine (GPLv3). Drop these components into a Langflow flow to **trigger a Darkmoon pentest against a target you are authorised to assess, pull back the findings, and review the fix pull requests Darkmoon prepares**, over your own self-hosted Darkmoon Dashboard API.
+
+> Darkmoon runs and validates security tests. It does not, and these components do not, guarantee that a system is secure. Findings can include false positives and must be reviewed by a qualified human. Only run assessments against systems you own or have explicit written authorisation to test. These components never merge a pull request; every fix is left for a person to review and merge.
+
+## Components
+
+| Component | Purpose |
+| --- | --- |
+| **Darkmoon Run Pentest** | Start a campaign against an authorised target; optionally wait and return findings and severity stats. |
+| **Darkmoon Get Findings** | Return the vulnerabilities and aggregated stats for a campaign id. |
+| **Darkmoon List Campaigns** | List the campaigns visible to the authenticated dashboard user. |
+| **Darkmoon List Pull Requests** | List the fix pull requests Darkmoon prepared (read only), optionally scoped and filtered by state. |
+
+The bundle registers under the `darkmoon` group. Each component is addressable by the canonical namespaced id `ext:darkmoon:<Class>@official`, for example `ext:darkmoon:DarkmoonRunPentest@official`.
+
+## Install
+
+Darkmoon is self hosted, so you point the components at your own **Darkmoon Dashboard API** (the FastAPI service shipped with Darkmoon, typically port `8000`). There is no public endpoint. Each component logs in with `POST /api/v1/auth/login` to obtain a short lived JWT.
+
+This is a standalone [Langflow Extension Bundle](https://docs.langflow.org/extensions): install it alongside Langflow and it is discovered automatically through the `langflow.extensions` entry point. No fork of Langflow and no `LANGFLOW_COMPONENTS_PATH` are required.
+
+```bash
+pip install langflow lfx-darkmoon
+langflow run
+```
+
+Restart the Langflow server; the four Darkmoon components appear in the visual editor under the **Darkmoon** bundle group. Set the base URL, username and password on a component, and a target on **Darkmoon Run Pentest**.
+
+## Remediation and secrets (Pro)
+
+The Darkmoon dashboard and the remediation feature that prepares fix pull requests are paid **Pro** capabilities. The open source Darkmoon (the CLI engine) focuses on finding, proving and reporting findings locally. When remediation is enabled it needs a **credential reference**, an opaque id of a credential stored in Darkmoon's encrypted vault (created in the dashboard), not a raw token. Raw source control secrets never travel through these components, and the remediation agent only ever prepares a pull request for human review; it never merges. **Darkmoon List Pull Requests** can read those pull requests through the API.
+
+## Privacy
+
+Darkmoon keeps assessment work on your own infrastructure and applies a privacy gateway so the language model works over placeholders in place of your real hosts, IPs and credentials. These components send data only to the base URL you configure.
+
+## Darkmoon at a glance
+
+Darkmoon is a GPLv3, self hosted autonomous AI pentester: an LLM orchestrates specialist agents and offensive tools over MCP, runs on a local model, and proves each finding with a real exploit. See [ASCIT31/Dark-Moon](https://github.com/ASCIT31/Dark-Moon).
+
+## Layout
+
+```
+langflow-darkmoon/
+├── pyproject.toml                 # distribution: lfx-darkmoon
+├── src/
+│   └── lfx_darkmoon/
+│       ├── __init__.py            # re-exports the four components
+│       ├── extension.json         # Extension Bundle manifest (v1)
+│       └── components/
+│           └── darkmoon/          # the bundle (path in extension.json)
+│               ├── run_pentest.py
+│               ├── get_findings.py
+│               ├── list_campaigns.py
+│               ├── list_pull_requests.py
+│               ├── _base.py          # shared inputs + client mixin (not a Component)
+│               ├── darkmoon_client.py# dependency free, transport injected API client
+│               └── transport.py      # requests transport + client factory
+└── tests/
+```
+
+## Development
+
+```bash
+pip install langflow          # brings lfx (the Bundle API surface)
+pip install -e ".[test]"      # install this bundle editable
+lfx extension validate src/lfx_darkmoon   # static manifest + bundle check
+lfx extension list            # confirm it is discovered at @official
+pytest -q
+```
+
+The API client (`darkmoon_client.py`) is dependency free and transport injected, so its logic is unit tested without a network (mock transport). The component tests instantiate the real Langflow (`lfx`) components, inject a mock transport, run each output, and assert each builds a valid Langflow frontend node. A full end to end run additionally requires a running Darkmoon instance pointed at an authorised target.
+
+Intra bundle imports are absolute (`from lfx_darkmoon.components.darkmoon...`), as required by the Langflow bundle loader, which does not support relative imports between bundle modules.
+
+## Related integrations
+
+Darkmoon also ships integrations for [n8n](https://github.com/ASCIT31/n8n-nodes-darkmoon), [Activepieces](https://github.com/ASCIT31/activepieces-piece-darkmoon), [Dify](https://github.com/ASCIT31/dify-plugin-darkmoon), [LangChain](https://github.com/ASCIT31/langchain-darkmoon) and [GitHub Actions](https://github.com/ASCIT31/darkmoon-scan-action).
+
+## License
+
+MIT, see [LICENSE](./LICENSE). Not affiliated with Langflow; "Langflow" is a trademark of its respective owner.

lfx_darkmoon-0.1.0/README.md

@@ -0,0 +1,87 @@
+# langflow-darkmoon
+
+[![Darkmoon](https://img.shields.io/badge/Darkmoon-autonomous%20pentest-4f46e5)](https://github.com/ASCIT31/Dark-Moon)
+[![Star Dark-Moon on GitHub](https://img.shields.io/github/stars/ASCIT31/Dark-Moon?style=social)](https://github.com/ASCIT31/Dark-Moon)
+
+A [Langflow](https://github.com/langflow-ai/langflow) **Extension Bundle** (distribution `lfx-darkmoon`) for **[Darkmoon](https://github.com/ASCIT31/Dark-Moon)**, the local, privacy first autonomous AI penetration testing engine (GPLv3). Drop these components into a Langflow flow to **trigger a Darkmoon pentest against a target you are authorised to assess, pull back the findings, and review the fix pull requests Darkmoon prepares**, over your own self-hosted Darkmoon Dashboard API.
+
+> Darkmoon runs and validates security tests. It does not, and these components do not, guarantee that a system is secure. Findings can include false positives and must be reviewed by a qualified human. Only run assessments against systems you own or have explicit written authorisation to test. These components never merge a pull request; every fix is left for a person to review and merge.
+
+## Components
+
+| Component | Purpose |
+| --- | --- |
+| **Darkmoon Run Pentest** | Start a campaign against an authorised target; optionally wait and return findings and severity stats. |
+| **Darkmoon Get Findings** | Return the vulnerabilities and aggregated stats for a campaign id. |
+| **Darkmoon List Campaigns** | List the campaigns visible to the authenticated dashboard user. |
+| **Darkmoon List Pull Requests** | List the fix pull requests Darkmoon prepared (read only), optionally scoped and filtered by state. |
+
+The bundle registers under the `darkmoon` group. Each component is addressable by the canonical namespaced id `ext:darkmoon:<Class>@official`, for example `ext:darkmoon:DarkmoonRunPentest@official`.
+
+## Install
+
+Darkmoon is self hosted, so you point the components at your own **Darkmoon Dashboard API** (the FastAPI service shipped with Darkmoon, typically port `8000`). There is no public endpoint. Each component logs in with `POST /api/v1/auth/login` to obtain a short lived JWT.
+
+This is a standalone [Langflow Extension Bundle](https://docs.langflow.org/extensions): install it alongside Langflow and it is discovered automatically through the `langflow.extensions` entry point. No fork of Langflow and no `LANGFLOW_COMPONENTS_PATH` are required.
+
+```bash
+pip install langflow lfx-darkmoon
+langflow run
+```
+
+Restart the Langflow server; the four Darkmoon components appear in the visual editor under the **Darkmoon** bundle group. Set the base URL, username and password on a component, and a target on **Darkmoon Run Pentest**.
+
+## Remediation and secrets (Pro)
+
+The Darkmoon dashboard and the remediation feature that prepares fix pull requests are paid **Pro** capabilities. The open source Darkmoon (the CLI engine) focuses on finding, proving and reporting findings locally. When remediation is enabled it needs a **credential reference**, an opaque id of a credential stored in Darkmoon's encrypted vault (created in the dashboard), not a raw token. Raw source control secrets never travel through these components, and the remediation agent only ever prepares a pull request for human review; it never merges. **Darkmoon List Pull Requests** can read those pull requests through the API.
+
+## Privacy
+
+Darkmoon keeps assessment work on your own infrastructure and applies a privacy gateway so the language model works over placeholders in place of your real hosts, IPs and credentials. These components send data only to the base URL you configure.
+
+## Darkmoon at a glance
+
+Darkmoon is a GPLv3, self hosted autonomous AI pentester: an LLM orchestrates specialist agents and offensive tools over MCP, runs on a local model, and proves each finding with a real exploit. See [ASCIT31/Dark-Moon](https://github.com/ASCIT31/Dark-Moon).
+
+## Layout
+
+```
+langflow-darkmoon/
+├── pyproject.toml                 # distribution: lfx-darkmoon
+├── src/
+│   └── lfx_darkmoon/
+│       ├── __init__.py            # re-exports the four components
+│       ├── extension.json         # Extension Bundle manifest (v1)
+│       └── components/
+│           └── darkmoon/          # the bundle (path in extension.json)
+│               ├── run_pentest.py
+│               ├── get_findings.py
+│               ├── list_campaigns.py
+│               ├── list_pull_requests.py
+│               ├── _base.py          # shared inputs + client mixin (not a Component)
+│               ├── darkmoon_client.py# dependency free, transport injected API client
+│               └── transport.py      # requests transport + client factory
+└── tests/
+```
+
+## Development
+
+```bash
+pip install langflow          # brings lfx (the Bundle API surface)
+pip install -e ".[test]"      # install this bundle editable
+lfx extension validate src/lfx_darkmoon   # static manifest + bundle check
+lfx extension list            # confirm it is discovered at @official
+pytest -q
+```
+
+The API client (`darkmoon_client.py`) is dependency free and transport injected, so its logic is unit tested without a network (mock transport). The component tests instantiate the real Langflow (`lfx`) components, inject a mock transport, run each output, and assert each builds a valid Langflow frontend node. A full end to end run additionally requires a running Darkmoon instance pointed at an authorised target.
+
+Intra bundle imports are absolute (`from lfx_darkmoon.components.darkmoon...`), as required by the Langflow bundle loader, which does not support relative imports between bundle modules.
+
+## Related integrations
+
+Darkmoon also ships integrations for [n8n](https://github.com/ASCIT31/n8n-nodes-darkmoon), [Activepieces](https://github.com/ASCIT31/activepieces-piece-darkmoon), [Dify](https://github.com/ASCIT31/dify-plugin-darkmoon), [LangChain](https://github.com/ASCIT31/langchain-darkmoon) and [GitHub Actions](https://github.com/ASCIT31/darkmoon-scan-action).
+
+## License
+
+MIT, see [LICENSE](./LICENSE). Not affiliated with Langflow; "Langflow" is a trademark of its respective owner.

lfx_darkmoon-0.1.0/pyproject.toml

@@ -0,0 +1,65 @@
+[project]
+name = "lfx-darkmoon"
+version = "0.1.0"
+description = "Darkmoon components as a standalone Langflow Extension Bundle: run an authorised AI pentest, pull findings, and review the fix pull requests Darkmoon prepares."
+readme = "README.md"
+requires-python = ">=3.10,<3.15"
+license = { text = "MIT" }
+authors = [{ name = "ASC-IT (Darkmoon)" }]
+keywords = ["langflow", "lfx", "extension", "bundle", "darkmoon", "pentest", "security", "dast", "appsec", "ai-security"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3",
+    "Topic :: Security",
+]
+
+# Runtime deps: lfx (the public BUNDLE_API surface these components are built
+# against) and requests (the HTTP transport). lfx is floored at the current
+# major.minor line and capped below the next lfx major; fine-grained BUNDLE_API
+# compatibility is enforced separately via extension.json's
+# "lfx": {"compat": ["1"]} contract against the running lfx's BUNDLE_API_VERSION.
+dependencies = [
+    "lfx>=1.12.0,<2.0.0",
+    "requests>=2.28",
+]
+
+[project.optional-dependencies]
+test = ["pytest>=8"]
+
+[project.urls]
+Homepage = "https://github.com/ASCIT31/Dark-Moon"
+Documentation = "https://docs.langflow.org/extensions"
+Source = "https://github.com/ASCIT31/langflow-darkmoon"
+Issues = "https://github.com/ASCIT31/langflow-darkmoon/issues"
+
+[build-system]
+requires = ["hatchling>=1.31.0"]
+build-backend = "hatchling.build"
+
+# Manifest-shipping distributions are discovered via the ``langflow.extensions``
+# entry-point. The value is the dotted path to the package containing
+# ``extension.json``; the loader walks ``importlib.metadata.files()`` from
+# there to find the manifest, and falls back to this entry-point for editable
+# installs whose dist.files only surfaces dist-info entries.
+[project.entry-points."langflow.extensions"]
+lfx-darkmoon = "lfx_darkmoon"
+
+[tool.hatch.build.targets.wheel]
+# extension.json + components live inside the lfx_darkmoon package so
+# ``importlib.metadata.files(dist)`` finds them and the loader resolves
+# bundles[].path relative to the manifest's directory.
+packages = ["src/lfx_darkmoon"]
+include = [
+    "src/lfx_darkmoon/extension.json",
+    "src/lfx_darkmoon/components/**/*.py",
+    "src/lfx_darkmoon/components/**/*.svg",
+]
+
+[tool.hatch.build.targets.sdist]
+include = [
+    "src/lfx_darkmoon",
+    "README.md",
+    "pyproject.toml",
+]

lfx_darkmoon-0.1.0/src/lfx_darkmoon/__init__.py

@@ -0,0 +1,25 @@
+"""lfx-darkmoon: Darkmoon components as a standalone Langflow Extension Bundle.
+
+This package is the distribution unit ``lfx-darkmoon``. At runtime Langflow's
+loader discovers the ``extension.json`` shipped alongside this ``__init__.py``
+and registers the four Darkmoon components under namespaced IDs such as
+``ext:darkmoon:DarkmoonRunPentest@official``.
+
+Darkmoon is the local, privacy-first autonomous AI penetration testing engine
+(GPLv3): https://github.com/ASCIT31/Dark-Moon. These components talk to a
+self-hosted Darkmoon Dashboard API; there is no public hosted endpoint.
+"""
+
+from lfx_darkmoon.components.darkmoon import (
+    DarkmoonGetFindingsComponent,
+    DarkmoonListCampaignsComponent,
+    DarkmoonListPullRequestsComponent,
+    DarkmoonRunPentestComponent,
+)
+
+__all__ = [
+    "DarkmoonRunPentestComponent",
+    "DarkmoonGetFindingsComponent",
+    "DarkmoonListCampaignsComponent",
+    "DarkmoonListPullRequestsComponent",
+]

lfx_darkmoon-0.1.0/src/lfx_darkmoon/components/darkmoon/__init__.py

@@ -0,0 +1,23 @@
+"""Darkmoon bundle for Langflow.
+
+The ``darkmoon`` bundle of the ``lfx-darkmoon`` Extension Bundle. It ships four
+components: Run Pentest, Get Findings, List Campaigns and List Pull Requests,
+over a self-hosted Darkmoon Dashboard API. Langflow discovers them via the
+manifest at ``lfx_darkmoon/extension.json``; each registers under the namespaced
+id ``ext:darkmoon:<Class>@official``. See https://github.com/ASCIT31/Dark-Moon.
+"""
+from lfx_darkmoon.components.darkmoon.darkmoon_client import DarkmoonClient, DarkmoonError, PR_STATES
+from lfx_darkmoon.components.darkmoon.get_findings import DarkmoonGetFindingsComponent
+from lfx_darkmoon.components.darkmoon.list_campaigns import DarkmoonListCampaignsComponent
+from lfx_darkmoon.components.darkmoon.list_pull_requests import DarkmoonListPullRequestsComponent
+from lfx_darkmoon.components.darkmoon.run_pentest import DarkmoonRunPentestComponent
+
+__all__ = [
+    "DarkmoonClient",
+    "DarkmoonError",
+    "PR_STATES",
+    "DarkmoonRunPentestComponent",
+    "DarkmoonGetFindingsComponent",
+    "DarkmoonListCampaignsComponent",
+    "DarkmoonListPullRequestsComponent",
+]

lfx_darkmoon-0.1.0/src/lfx_darkmoon/components/darkmoon/_base.py

@@ -0,0 +1,52 @@
+"""Shared connection inputs and client helper for the Darkmoon Langflow components."""
+from __future__ import annotations
+
+from lfx.io import SecretStrInput, StrInput
+
+from lfx_darkmoon.components.darkmoon.darkmoon_client import DarkmoonClient
+from lfx_darkmoon.components.darkmoon.transport import logged_in_client
+
+
+def connection_inputs():
+    """Fresh connection input instances (base URL / username / password).
+
+    Darkmoon is self-hosted, so the base URL is always supplied by the operator;
+    there is no public hosted endpoint.
+    """
+    return [
+        StrInput(
+            name="base_url",
+            display_name="Darkmoon base URL",
+            info="Base URL of your self-hosted Darkmoon Dashboard API (FastAPI, typically port 8000).",
+            required=True,
+        ),
+        StrInput(
+            name="username",
+            display_name="Dashboard username",
+            info="A Darkmoon dashboard user.",
+            required=True,
+        ),
+        SecretStrInput(
+            name="password",
+            display_name="Dashboard password",
+            info="The dashboard user's password. Used only to obtain a short-lived JWT.",
+            required=True,
+        ),
+    ]
+
+
+class DarkmoonClientMixin:
+    """Mixin that builds an authenticated Darkmoon client per run.
+
+    This is deliberately NOT a ``Component`` subclass: each concrete component
+    inherits ``(DarkmoonClientMixin, Component)`` so the extension validator
+    sees exactly the four real palette components and no abstract base without a
+    ``build()``/output method.
+
+    Tests monkeypatch :func:`logged_in_client` (a module global in this file) to
+    inject a mock-transport client, so component logic is exercised without a
+    network.
+    """
+
+    def _client(self) -> DarkmoonClient:
+        return logged_in_client(self.base_url, self.username, self.password)

lfx_darkmoon-0.1.0/src/lfx_darkmoon/components/darkmoon/darkmoon.svg

@@ -0,0 +1,21 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64" role="img" aria-label="Darkmoon">
+  <defs>
+    <linearGradient id="dm" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0" stop-color="#312e81"/>
+      <stop offset="0.55" stop-color="#4f46e5"/>
+      <stop offset="1" stop-color="#eff6ff"/>
+    </linearGradient>
+  </defs>
+  <rect width="64" height="64" rx="12" fill="#0b1020"/>
+  <g fill="url(#dm)">
+    <rect x="12" y="12" width="10" height="10" rx="2"/>
+    <rect x="26" y="12" width="10" height="10" rx="2"/>
+    <rect x="12" y="26" width="10" height="10" rx="2"/>
+    <rect x="40" y="26" width="10" height="10" rx="2"/>
+    <rect x="26" y="40" width="10" height="10" rx="2"/>
+    <rect x="40" y="40" width="10" height="10" rx="2"/>
+    <rect x="12" y="40" width="10" height="10" rx="2"/>
+  </g>
+  <circle cx="45" cy="19" r="7" fill="#eff6ff"/>
+  <circle cx="48.5" cy="17" r="6" fill="#0b1020"/>
+</svg>

lfx_darkmoon-0.1.0/src/lfx_darkmoon/components/darkmoon/darkmoon_client.py

@@ -0,0 +1,348 @@
+"""
+DarkmoonClient - dependency-free client for the Darkmoon Dashboard API.
+
+This module deliberately has NO Dify or third-party imports. It receives an
+injected HTTP function so it can run both inside a Dify tool (wrapping
+``requests``) and in a plain test harness (wrapping a mock). This keeps the
+component logic free of heavy runtime dependencies and lets the integration be
+unit-tested end to end without a live Darkmoon instance.
+
+The Darkmoon Dashboard API is a versioned FastAPI service (self-hosted). The
+endpoints used here mirror the ones the maintained n8n and Activepieces
+Darkmoon integrations use, read from Dark-Moon-Front-API (branch dev):
+
+    POST   /api/v1/auth/login                  -> { token, ... }
+    POST   /api/v1/run/campaign                -> { run_id, pid, command }
+    GET    /api/v1/run/logs/{run_id}           -> { data: events[], total }
+    DELETE /api/v1/run/{run_id}/stop           -> { message, run_id }
+    GET    /api/v1/campaigns                   -> { data: campaigns[], total }
+    GET    /api/v1/vulnerabilities?campaign_id -> { data, total, stats }
+    GET    /api/v1/campaigns/{id}/report       -> { content, format }
+    GET    /api/v1/pull-requests?campaign_id   -> { data: PullRequest[], total }
+
+There is no public hosted endpoint; every deployment is self-hosted, so the
+base URL is always supplied by the operator.
+"""
+from __future__ import annotations
+
+import time
+from dataclasses import dataclass
+from typing import Any, Callable, Dict, List, Optional
+from urllib.parse import quote
+
+# The exact PR states the store recognises (pr_store.PR_STATES).
+PR_STATES = ("proposed", "draft", "open", "merged", "closed", "error")
+
+# Run-log event types that mark a run as finished.
+_TERMINAL_TYPES = frozenset({"run_completed", "run_error"})
+
+
+@dataclass
+class HttpResponse:
+    """Raw HTTP result the injected transport must return."""
+
+    status_code: int
+    body: Any
+
+
+# Injected transport. Must return the raw status and parsed JSON body, and must
+# NEVER raise on a non-2xx status - the client inspects status_code itself so
+# error messages carry the API's own ``detail`` (and never a local secret).
+HttpFn = Callable[[Dict[str, Any]], HttpResponse]
+
+
+class DarkmoonError(Exception):
+    """Error carrying the API's own detail plus the HTTP status code."""
+
+    def __init__(self, message: str, status_code: Optional[int] = None) -> None:
+        super().__init__(message)
+        self.status_code = status_code
+
+
+def _detail(res: HttpResponse, fallback: str) -> str:
+    body = res.body if res else None
+    if isinstance(body, dict):
+        d = body.get("detail", body.get("message"))
+        if isinstance(d, str) and d:
+            return d
+    return fallback
+
+
+def _data_list(res: HttpResponse) -> List[Any]:
+    body = res.body
+    if isinstance(body, dict) and isinstance(body.get("data"), list):
+        return body["data"]
+    return []
+
+
+class DarkmoonClient:
+    """A thin, transport-injected client over the Darkmoon Dashboard API."""
+
+    def __init__(self, base_url: str, http: HttpFn) -> None:
+        # Strip trailing slashes so path joins stay clean.
+        self.base_url = base_url.rstrip("/")
+        self._http = http
+        self._token: Optional[str] = None
+
+    def _url(self, path: str) -> str:
+        return f"{self.base_url}{path}"
+
+    def _auth_headers(self) -> Dict[str, str]:
+        h: Dict[str, str] = {"Content-Type": "application/json"}
+        if self._token:
+            h["Authorization"] = f"Bearer {self._token}"
+        return h
+
+    # -- auth ---------------------------------------------------------------
+    def login(self, username: str, password: str) -> str:
+        """Authenticate and cache the JWT for subsequent calls."""
+        res = self._http(
+            {
+                "method": "POST",
+                "url": self._url("/api/v1/auth/login"),
+                "headers": {"Content-Type": "application/json"},
+                "body": {"username": username, "password": password},
+            }
+        )
+        token = res.body.get("token") if isinstance(res.body, dict) else None
+        if res.status_code != 200 or not token:
+            raise DarkmoonError(_detail(res, "Darkmoon login failed"), res.status_code)
+        self._token = token
+        return token
+
+    # -- campaigns ----------------------------------------------------------
+    def list_campaigns(self) -> List[Dict[str, Any]]:
+        res = self._http(
+            {"method": "GET", "url": self._url("/api/v1/campaigns"), "headers": self._auth_headers()}
+        )
+        if res.status_code != 200:
+            raise DarkmoonError(_detail(res, "Failed to list campaigns"), res.status_code)
+        return _data_list(res)
+
+    # -- run ----------------------------------------------------------------
+    def run_campaign(self, params: Dict[str, Any]) -> Dict[str, Any]:
+        """Start a pentest in the background. Returns the run handle."""
+        res = self._http(
+            {
+                "method": "POST",
+                "url": self._url("/api/v1/run/campaign"),
+                "headers": self._auth_headers(),
+                "body": params,
+            }
+        )
+        run_id = res.body.get("run_id") if isinstance(res.body, dict) else None
+        if res.status_code >= 400 or not run_id:
+            raise DarkmoonError(_detail(res, "Failed to start pentest run"), res.status_code)
+        return res.body
+
+    def get_run_log(self, run_id: str) -> List[Dict[str, Any]]:
+        res = self._http(
+            {
+                "method": "GET",
+                "url": self._url(f"/api/v1/run/logs/{quote(run_id, safe='')}"),
+                "headers": self._auth_headers(),
+            }
+        )
+        if res.status_code == 404:
+            return []
+        if res.status_code != 200:
+            raise DarkmoonError(_detail(res, "Failed to read run log"), res.status_code)
+        return _data_list(res)
+
+    def stop_run(self, run_id: str) -> None:
+        self._http(
+            {
+                "method": "DELETE",
+                "url": self._url(f"/api/v1/run/{quote(run_id, safe='')}/stop"),
+                "headers": self._auth_headers(),
+            }
+        )
+
+    def wait_for_run(
+        self,
+        run_id: str,
+        poll_s: float = 3.0,
+        timeout_s: float = 30 * 60,
+        on_event: Optional[Callable[[Dict[str, Any]], None]] = None,
+        sleep: Optional[Callable[[float], None]] = None,
+    ) -> Dict[str, Any]:
+        """Poll the run's JSONL log until a terminal event or the timeout.
+
+        The log is the API's single source of truth for run state: no terminal
+        event means the run is still going. Never loops forever.
+        """
+        _sleep = sleep or time.sleep
+        start = time.monotonic()
+        seen = 0
+        while time.monotonic() - start < timeout_s:
+            events = self.get_run_log(run_id)
+            if on_event:
+                for e in events[seen:]:
+                    on_event(e)
+            seen = len(events)
+            terminal = next((e for e in events if e.get("type") in _TERMINAL_TYPES), None)
+            if terminal is not None:
+                return {"events": events, "terminal": terminal, "timed_out": False}
+            _sleep(poll_s)
+        events = self.get_run_log(run_id)
+        return {"events": events, "terminal": None, "timed_out": True}
+
+    def resolve_run_campaign(
+        self, before_ids: "set[str]", target_host: str
+    ) -> Optional[Dict[str, Any]]:
+        """Resolve the campaign produced by a run.
+
+        The trigger returns a run_id, not a campaign_id - the agent mints the
+        campaign inside the run. We diff the campaign set captured before the
+        run against the set after it, preferring a new campaign whose id matches
+        the target host, and fall back to the newest campaign otherwise.
+        """
+        campaigns = self.list_campaigns()
+        host = (target_host or "").strip().lower()
+
+        def by_date(c: Dict[str, Any]) -> str:
+            return str(c.get("date") or "")
+
+        fresh = [c for c in campaigns if c.get("id") not in before_ids]
+        if len(fresh) == 1:
+            return fresh[0]
+        if len(fresh) > 1:
+            fresh.sort(key=by_date, reverse=True)
+            if host:
+                for c in fresh:
+                    if host in str(c.get("id", "")).lower():
+                        return c
+            return fresh[0]
+        if not campaigns:
+            return None
+        return sorted(campaigns, key=by_date, reverse=True)[0]
+
+    # -- findings / report --------------------------------------------------
+    def get_findings(self, campaign_id: str) -> Dict[str, Any]:
+        res = self._http(
+            {
+                "method": "GET",
+                "url": self._url(
+                    f"/api/v1/vulnerabilities?campaign_id={quote(campaign_id, safe='')}"
+                ),
+                "headers": self._auth_headers(),
+            }
+        )
+        if res.status_code != 200:
+            raise DarkmoonError(_detail(res, "Failed to fetch findings"), res.status_code)
+        body = res.body if isinstance(res.body, dict) else {}
+        return {
+            "data": body.get("data") or [],
+            "total": body.get("total") or 0,
+            "stats": body.get("stats") or {},
+        }
+
+    def get_report(self, campaign_id: str) -> Dict[str, Any]:
+        res = self._http(
+            {
+                "method": "GET",
+                "url": self._url(f"/api/v1/campaigns/{quote(campaign_id, safe='')}/report"),
+                "headers": self._auth_headers(),
+            }
+        )
+        if res.status_code != 200:
+            raise DarkmoonError(_detail(res, "Failed to fetch report"), res.status_code)
+        body = res.body if isinstance(res.body, dict) else {}
+        return {"content": body.get("content") or "", "format": body.get("format") or "markdown"}
+
+    # -- pull requests (read-only) -----------------------------------------
+    def list_pull_requests(self, campaign_id: Optional[str] = None) -> List[Dict[str, Any]]:
+        """List fix pull requests. campaign_id is the ONLY server-side filter."""
+        q = f"?campaign_id={quote(campaign_id, safe='')}" if campaign_id else ""
+        res = self._http(
+            {
+                "method": "GET",
+                "url": self._url(f"/api/v1/pull-requests{q}"),
+                "headers": self._auth_headers(),
+            }
+        )
+        if res.status_code != 200:
+            raise DarkmoonError(_detail(res, "Failed to list pull requests"), res.status_code)
+        return _data_list(res)
+
+    def get_pull_request(self, pr_id: str) -> Dict[str, Any]:
+        res = self._http(
+            {
+                "method": "GET",
+                "url": self._url(f"/api/v1/pull-requests/{quote(pr_id, safe='')}"),
+                "headers": self._auth_headers(),
+            }
+        )
+        if res.status_code != 200:
+            raise DarkmoonError(_detail(res, f"Pull request {pr_id} not found"), res.status_code)
+        body = res.body if isinstance(res.body, dict) else {}
+        return body.get("data") or {}
+
+    def get_pull_requests_for_finding(self, vuln_id: str) -> List[Dict[str, Any]]:
+        res = self._http(
+            {
+                "method": "GET",
+                "url": self._url(f"/api/v1/pull-requests/finding/{quote(vuln_id, safe='')}"),
+                "headers": self._auth_headers(),
+            }
+        )
+        if res.status_code != 200:
+            raise DarkmoonError(
+                _detail(res, f"Failed to fetch pull requests for finding {vuln_id}"),
+                res.status_code,
+            )
+        return _data_list(res)
+
+    @staticmethod
+    def filter_pull_requests(
+        prs: List[Dict[str, Any]],
+        state: Optional[List[str]] = None,
+        provider: Optional[str] = None,
+        repository: Optional[str] = None,
+    ) -> List[Dict[str, Any]]:
+        """Client-side narrowing. The API does not filter by these fields."""
+        out = prs
+        if state:
+            want = {s.lower() for s in state}
+            out = [p for p in out if str(p.get("state", "")).lower() in want]
+        if provider:
+            p = provider.lower()
+            out = [x for x in out if str(x.get("provider", "")).lower() == p]
+        if repository:
+            r = repository.lower()
+            out = [x for x in out if r in str(x.get("repo", "")).lower()]
+        return out
+
+    def wait_for_pull_requests(
+        self,
+        campaign_id: str,
+        min_count: int = 1,
+        poll_s: float = 5.0,
+        timeout_s: float = 5 * 60,
+        sleep: Optional[Callable[[float], None]] = None,
+    ) -> Dict[str, Any]:
+        _sleep = sleep or time.sleep
+        start = time.monotonic()
+        prs: List[Dict[str, Any]] = []
+        while time.monotonic() - start < timeout_s:
+            prs = self.list_pull_requests(campaign_id)
+            if len(prs) >= min_count:
+                return {"pull_requests": prs, "timed_out": False}
+            _sleep(poll_s)
+        prs = self.list_pull_requests(campaign_id)
+        return {"pull_requests": prs, "timed_out": len(prs) < min_count}
+
+    @staticmethod
+    def validate_remediation(remediate: bool, credential_id: Optional[str]) -> None:
+        """Guard for remediation (Pro) parameters.
+
+        When remediation is enabled a credential reference (an opaque vault id,
+        NOT a token) is required, validated before any request so a run is never
+        started half-configured.
+        """
+        if remediate and not str(credential_id or "").strip():
+            raise DarkmoonError(
+                "Remediation is enabled but no credential reference was provided. "
+                "Set the opaque Darkmoon credential reference (a vault id, not a token) "
+                "so the remediation agent can prepare a fix pull request for review."
+            )

lfx_darkmoon-0.1.0/src/lfx_darkmoon/components/darkmoon/get_findings.py

@@ -0,0 +1,45 @@
+from __future__ import annotations
+
+from lfx.io import MessageTextInput, Output
+from lfx.schema.data import Data
+
+from lfx.custom.custom_component.component import Component
+
+from lfx_darkmoon.components.darkmoon._base import DarkmoonClientMixin, connection_inputs
+
+
+class DarkmoonGetFindingsComponent(DarkmoonClientMixin, Component):
+    """Return the vulnerabilities and aggregated stats for a Darkmoon campaign."""
+
+    display_name = "Darkmoon Get Findings"
+    description = "Return the vulnerabilities and aggregated stats for a Darkmoon campaign id."
+    icon = "Shield"
+    name = "DarkmoonGetFindings"
+
+    inputs = [
+        *connection_inputs(),
+        MessageTextInput(
+            name="campaign_id",
+            display_name="Campaign id",
+            info="The Darkmoon campaign id, e.g. camp_20260922_abc123.",
+            required=True,
+        ),
+    ]
+
+    outputs = [Output(display_name="Findings", name="findings", method="get_findings_action")]
+
+    def get_findings_action(self) -> Data:
+        campaign_id = str(self.campaign_id or "").strip()
+        if not campaign_id:
+            raise ValueError("A campaign id is required.")
+        findings = self._client().get_findings(campaign_id)
+        data = Data(
+            data={
+                "campaign_id": campaign_id,
+                "total": findings["total"],
+                "stats": findings["stats"],
+                "findings": findings["data"],
+            }
+        )
+        self.status = data
+        return data

lfx_darkmoon-0.1.0/src/lfx_darkmoon/components/darkmoon/list_campaigns.py

@@ -0,0 +1,27 @@
+from __future__ import annotations
+
+from lfx.io import Output
+from lfx.schema.data import Data
+
+from lfx.custom.custom_component.component import Component
+
+from lfx_darkmoon.components.darkmoon._base import DarkmoonClientMixin, connection_inputs
+
+
+class DarkmoonListCampaignsComponent(DarkmoonClientMixin, Component):
+    """Return the campaigns visible to the authenticated dashboard user."""
+
+    display_name = "Darkmoon List Campaigns"
+    description = "List the Darkmoon campaigns visible to the authenticated dashboard user."
+    icon = "Shield"
+    name = "DarkmoonListCampaigns"
+
+    inputs = [*connection_inputs()]
+
+    outputs = [Output(display_name="Campaigns", name="campaigns", method="list_campaigns_action")]
+
+    def list_campaigns_action(self) -> Data:
+        campaigns = self._client().list_campaigns()
+        data = Data(data={"total": len(campaigns), "campaigns": campaigns})
+        self.status = data
+        return data

lfx_darkmoon-0.1.0/src/lfx_darkmoon/components/darkmoon/list_pull_requests.py

@@ -0,0 +1,52 @@
+from __future__ import annotations
+
+from lfx.io import DropdownInput, MessageTextInput, Output
+from lfx.schema.data import Data
+
+from lfx.custom.custom_component.component import Component
+
+from lfx_darkmoon.components.darkmoon._base import DarkmoonClientMixin, connection_inputs
+from lfx_darkmoon.components.darkmoon.darkmoon_client import DarkmoonClient, PR_STATES
+
+
+class DarkmoonListPullRequestsComponent(DarkmoonClientMixin, Component):
+    """Return the fix pull requests Darkmoon prepared (read-only).
+
+    Pull requests are prepared by the paid Pro remediation feature and left for a
+    human to review and merge. This component only reads them; it never merges.
+    """
+
+    display_name = "Darkmoon List Pull Requests"
+    description = "List the fix pull requests Darkmoon prepared (read-only)."
+    icon = "Shield"
+    name = "DarkmoonListPullRequests"
+
+    inputs = [
+        *connection_inputs(),
+        MessageTextInput(
+            name="campaign_id",
+            display_name="Campaign id",
+            info="Optional campaign id to scope the pull requests to (the only server-side filter).",
+            advanced=True,
+        ),
+        DropdownInput(
+            name="state",
+            display_name="State",
+            options=["", *PR_STATES],
+            value="",
+            advanced=True,
+        ),
+    ]
+
+    outputs = [Output(display_name="Pull Requests", name="pull_requests", method="list_pull_requests_action")]
+
+    def list_pull_requests_action(self) -> Data:
+        campaign_id = str(self.campaign_id or "").strip() or None
+        client = self._client()
+        prs = client.list_pull_requests(campaign_id)
+        state = str(self.state or "").strip()
+        if state:
+            prs = DarkmoonClient.filter_pull_requests(prs, state=[state])
+        data = Data(data={"total": len(prs), "pull_requests": prs})
+        self.status = data
+        return data

lfx_darkmoon-0.1.0/src/lfx_darkmoon/components/darkmoon/run_pentest.py

@@ -0,0 +1,127 @@
+from __future__ import annotations
+
+from lfx.io import BoolInput, DropdownInput, MessageTextInput, Output, SecretStrInput, StrInput
+from lfx.schema.data import Data
+
+from lfx.custom.custom_component.component import Component
+
+from lfx_darkmoon.components.darkmoon._base import DarkmoonClientMixin, connection_inputs
+from lfx_darkmoon.components.darkmoon.darkmoon_client import DarkmoonClient
+
+
+def _split_csv(value: str) -> list[str]:
+    return [p.strip() for p in str(value or "").split(",") if p.strip()]
+
+
+class DarkmoonRunPentestComponent(DarkmoonClientMixin, Component):
+    """Trigger a Darkmoon pentest against an authorised target and return findings.
+
+    Only run assessments against systems you own or have explicit written
+    authorisation to test. Findings can include false positives and must be
+    reviewed by a qualified human. This component never merges a pull request;
+    optional, credential-gated remediation is a paid Pro feature that only
+    prepares fixes for review.
+    """
+
+    display_name = "Darkmoon Run Pentest"
+    description = "Start a Darkmoon AI pentest against an authorised target and return the findings."
+    icon = "Shield"
+    name = "DarkmoonRunPentest"
+
+    inputs = [
+        *connection_inputs(),
+        MessageTextInput(
+            name="target",
+            display_name="Target",
+            info="The host, URL or scope to assess. Only targets you are authorised to test.",
+            required=True,
+        ),
+        BoolInput(
+            name="wait_for_completion",
+            display_name="Wait for completion",
+            info="Wait for the run to finish and return findings; if off, return the run id.",
+            value=True,
+        ),
+        MessageTextInput(name="program", display_name="Program / rules of engagement", advanced=True),
+        MessageTextInput(
+            name="focus",
+            display_name="Focus areas",
+            info='Optional comma-separated focus areas, e.g. "authentication, injection".',
+            advanced=True,
+        ),
+        DropdownInput(
+            name="severity",
+            display_name="Minimum severity",
+            options=["", "info", "low", "medium", "high", "critical"],
+            value="",
+            advanced=True,
+        ),
+        BoolInput(
+            name="remediate",
+            display_name="Prepare fix pull requests (Pro)",
+            info="Paid Pro feature. Prepares fix pull requests for human review during the run; never merges. Requires a credential reference.",
+            value=False,
+            advanced=True,
+        ),
+        SecretStrInput(
+            name="credential_id",
+            display_name="Credential reference (Pro remediation)",
+            info="Opaque Darkmoon vault credential reference (not a token). Required only when remediation is on.",
+            advanced=True,
+        ),
+        StrInput(name="git_repo", display_name="Git repository (Pro remediation)", advanced=True),
+    ]
+
+    outputs = [Output(display_name="Result", name="result", method="run_pentest_action")]
+
+    def run_pentest_action(self) -> Data:
+        target = str(self.target or "").strip()
+        if not target:
+            raise ValueError("A target is required (a host, URL or scope you are authorised to test).")
+        remediate = bool(self.remediate)
+        credential_id = str(self.credential_id or "").strip() or None
+        DarkmoonClient.validate_remediation(remediate, credential_id)
+
+        params: dict = {"target": target}
+        if str(self.program or "").strip():
+            params["program"] = str(self.program).strip()
+        areas = _split_csv(self.focus)
+        if areas:
+            params["focus"] = areas
+        if str(self.severity or "").strip():
+            params["severity"] = str(self.severity).strip()
+        if remediate:
+            params["remediate"] = True
+            params["credential_id"] = credential_id
+            if str(self.git_repo or "").strip():
+                params["git_repo"] = str(self.git_repo).strip()
+
+        client = self._client()
+        before = {c.get("id") for c in client.list_campaigns()}
+        handle = client.run_campaign(params)
+        run_id = handle.get("run_id")
+
+        if not bool(self.wait_for_completion):
+            data = Data(data={"status": "started", "run_id": run_id, "target": target})
+            self.status = data
+            return data
+
+        result = client.wait_for_run(run_id)
+        campaign = client.resolve_run_campaign(before, target)
+        campaign_id = campaign.get("id") if campaign else None
+        out = {
+            "run_id": run_id,
+            "campaign_id": campaign_id,
+            "timed_out": result["timed_out"],
+            "findings": [],
+            "stats": {},
+            "total": 0,
+        }
+        if campaign_id:
+            findings = client.get_findings(campaign_id)
+            out["findings"] = findings["data"]
+            out["stats"] = findings["stats"]
+            out["total"] = findings["total"]
+        data = Data(data=out)
+        self.status = data
+        return data

lfx_darkmoon-0.1.0/src/lfx_darkmoon/components/darkmoon/transport.py

@@ -0,0 +1,46 @@
+"""
+requests-based transport + client factory for the Langflow Darkmoon components.
+
+Kept out of ``darkmoon_client`` so the client stays dependency free and
+unit-testable without ``requests``. The transport never raises on a non-2xx
+status: it returns the real status and parsed body so the client surfaces the
+API's own ``detail`` rather than a local secret.
+"""
+from __future__ import annotations
+
+from typing import Any, Dict
+
+from lfx_darkmoon.components.darkmoon.darkmoon_client import DarkmoonClient, HttpResponse
+
+DEFAULT_TIMEOUT = 60
+
+
+def requests_transport(opts: Dict[str, Any]) -> HttpResponse:
+    import requests  # imported lazily so tests need no network stack
+
+    method = str(opts.get("method", "GET")).upper()
+    url = opts["url"]
+    headers = opts.get("headers") or {}
+    body = opts.get("body")
+    try:
+        resp = requests.request(
+            method,
+            url,
+            headers=headers,
+            json=body if body is not None else None,
+            timeout=DEFAULT_TIMEOUT,
+        )
+    except requests.exceptions.RequestException as exc:
+        return HttpResponse(status_code=0, body={"detail": f"Request to Darkmoon failed: {exc}"})
+    try:
+        parsed: Any = resp.json()
+    except ValueError:
+        parsed = resp.text
+    return HttpResponse(status_code=resp.status_code, body=parsed)
+
+
+def logged_in_client(base_url: str, username: str, password: str) -> DarkmoonClient:
+    """Build a DarkmoonClient over the requests transport and authenticate it."""
+    client = DarkmoonClient(base_url, requests_transport)
+    client.login(username, password)
+    return client

lfx_darkmoon-0.1.0/src/lfx_darkmoon/extension.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://schemas.langflow.org/extension/v1.json",
+  "id": "lfx-darkmoon",
+  "version": "0.1.0",
+  "name": "Darkmoon",
+  "description": "Trigger a Darkmoon autonomous AI penetration test against an authorised target, pull findings, and review the fix pull requests Darkmoon prepares, over a self-hosted Darkmoon Dashboard API. Only assess systems you own or have explicit written authorisation to test; findings can include false positives and must be reviewed by a qualified human.",
+  "lfx": {
+    "compat": ["1"]
+  },
+  "capabilities": {
+    "requiresCredentials": true
+  },
+  "bundles": [
+    {
+      "name": "darkmoon",
+      "path": "components/darkmoon",
+      "display_name": "Darkmoon",
+      "icon": "Shield"
+    }
+  ]
+}