nova-arsenal 2.0.0__tar.gz

nova_arsenal-2.0.0/.devcontainer/devcontainer.json

@@ -0,0 +1,5 @@
+{
+  "name": "Ollama Dev",
+  "image": "mcr.microsoft.com/devcontainers/base:ubuntu-24.04",
+  "postCreateCommand": "curl -fsSL https://ollama.com/install.sh | sh"
+}

nova_arsenal-2.0.0/.github/CODEOWNERS

@@ -0,0 +1,21 @@
+# Nova-Arsenal Code Owners
+
+# Default owner for everything
+* @Informant254
+
+# Core agent system
+/nova_arsenal/ @Informant254
+
+# Web client
+/clients/web/ @Informant254
+
+# Infrastructure
+/containers/ @Informant254
+/k8s/ @Informant254
+/.github/ @Informant254
+
+# Configuration
+/config/ @Informant254
+
+# Documentation
+/docs/ @Informant254

nova_arsenal-2.0.0/.github/dependabot.yml

@@ -0,0 +1,45 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "python"
+    commit-message:
+      prefix: "deps"
+
+  - package-ecosystem: "npm"
+    directory: "/clients/web"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "javascript"
+    commit-message:
+      prefix: "deps"
+
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "docker"
+    commit-message:
+      prefix: "deps"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "ci"
+    commit-message:
+      prefix: "deps"

nova_arsenal-2.0.0/.github/workflows/ci.yml

@@ -0,0 +1,118 @@
+# Revival baseline: lint, formatting, typing, tests, client builds, and container builds are blocking gates.
+name: CI
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main, develop, "revive/**", "revival/**"]
+  pull_request:
+    branches: [main, "revival/**"]
+
+jobs:
+  lint:
+    name: Python Lint & Format
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.11"
+          cache: pip
+      - name: Install package and lint tools
+        run: pip install -e ".[dev]"
+      - name: Check Python linting
+        run: ruff check .
+      - name: Check Python formatting
+        run: ruff format --check .
+
+  typecheck:
+    name: Python Type Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.11"
+          cache: pip
+      - name: Install package and type checker
+        run: pip install -e ".[dev]"
+      - name: Run type checking
+        run: basedpyright nova_arsenal/
+
+  test:
+    name: Test (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
+      - name: Run tests
+        run: pytest tests/ -v --tb=short
+
+  web-build:
+    name: Web Client Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: "22"
+      - name: Install dependencies
+        working-directory: clients/web
+        run: npm install --no-audit --no-fund
+      - name: Build
+        working-directory: clients/web
+        run: npm run build
+
+  vscode-build:
+    name: VS Code Extension Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: clients/vscode/package-lock.json
+      - name: Install dependencies
+        working-directory: clients/vscode
+        run: npm ci
+      - name: Compile extension
+        working-directory: clients/vscode
+        run: npm run compile
+
+  docker-build:
+    name: Docker Build (${{ matrix.image }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        image: [agent, web, kali]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: docker/setup-buildx-action@v3
+      - name: Build ${{ matrix.image }} image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: containers/Dockerfile.${{ matrix.image }}
+          push: false
+          tags: nova-${{ matrix.image }}:test
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  ci-ok:
+    name: CI OK
+    runs-on: ubuntu-latest
+    needs: [lint, typecheck, test, web-build, vscode-build, docker-build]
+    steps:
+      - name: Required checks passed
+        run: echo "Required CI checks passed"

nova_arsenal-2.0.0/.github/workflows/release.yml

@@ -0,0 +1,180 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+env:
+  REGISTRY_GHCR: ghcr.io
+  REGISTRY_DOCKERHUB: docker.io
+
+jobs:
+  validate:
+    name: Validate release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.13"
+          cache: pip
+
+      - name: Verify tag matches package version
+        run: |
+          python - <<'PY'
+          import os
+          import tomllib
+          from pathlib import Path
+
+          version = tomllib.loads(Path("pyproject.toml").read_text())["project"]["version"]
+          tag = os.environ["GITHUB_REF_NAME"]
+          expected = f"v{version}"
+          if tag != expected:
+              raise SystemExit(f"Release tag {tag!r} does not match package version {version!r}; expected {expected!r}")
+          print(f"Release version validated: {tag}")
+          PY
+
+      - name: Install package and release tools
+        run: pip install -e ".[dev]" build twine
+
+      - name: Lint and format
+        run: |
+          ruff check .
+          ruff format --check .
+
+      - name: Type check
+        run: basedpyright nova_arsenal/
+
+      - name: Test
+        run: pytest tests/ -q
+
+      - name: Build package
+        run: python -m build
+
+      - name: Validate distributions
+        run: twine check dist/*
+
+  pypi:
+    name: Publish to PyPI
+    runs-on: ubuntu-latest
+    needs: validate
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.13"
+
+      - name: Install build tools
+        run: pip install build
+
+      - name: Build package
+        run: python -m build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          # Using Trusted Publishing (OIDC). Configure this on PyPI before tagging.
+          skip-existing: true
+
+  docker-ghcr:
+    name: Publish to GHCR (${{ matrix.image }})
+    runs-on: ubuntu-latest
+    needs: validate
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      matrix:
+        image: [agent, web, kali]
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Login to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY_GHCR }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY_GHCR }}/informant254/nova-${{ matrix.image }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: containers/Dockerfile.${{ matrix.image }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  docker-dockerhub:
+    name: Publish to Docker Hub (${{ matrix.image }})
+    runs-on: ubuntu-latest
+    needs: validate
+    strategy:
+      matrix:
+        image: [agent, web, kali]
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: informant254/nova-${{ matrix.image }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: containers/Dockerfile.${{ matrix.image }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  github-release:
+    name: Create GitHub Release
+    runs-on: ubuntu-latest
+    needs: [pypi, docker-ghcr, docker-dockerhub]
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Create release
+        uses: softprops/action-gh-release@v1
+        with:
+          generate_release_notes: true
+          draft: false
+          prerelease: ${{ contains(github.ref, '-') }}

nova_arsenal-2.0.0/.github/workflows/security.yml

@@ -0,0 +1,54 @@
+name: Security
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "0 0 * * 0"
+
+jobs:
+  codeql:
+    name: CodeQL Analysis
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@v7
+      - uses: github/codeql-action/init@v4
+        with:
+          languages: python
+      - uses: github/codeql-action/analyze@v4
+
+  trivy:
+    name: Trivy Secret Scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Scan repository for secrets
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          scanners: secret
+          exit-code: 1
+
+  pip-audit:
+    name: Python Dependency Audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.11"
+          cache: pip
+      - name: Install Nova-Arsenal runtime dependencies and audit tool
+        run: |
+          python -m pip install --upgrade pip "setuptools>=83" wheel
+          python -m pip install -e .
+          python -m pip install pip-audit
+      - name: Audit installed Python dependencies
+        run: pip-audit

nova_arsenal-2.0.0/.gitignore

@@ -0,0 +1,114 @@
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+
+# Virtual environments
+.venv/
+venv/
+ENV/
+env/
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+.project
+.settings/
+
+# Testing
+.pytest_cache/
+.coverage
+.coverage.*
+htmlcov/
+*.cover
+
+# Type checking
+.mypy_cache/
+.pytype/
+basedpyright/
+
+# Ruff
+.ruff_cache/
+
+# Environment variables
+.env
+.env.local
+.env.production
+
+# Database
+*.db
+*.sqlite
+*.sqlite3
+
+# Docker
+docker-compose.override.yml
+
+# Node.js (web client)
+clients/web/node_modules/
+clients/web/.next/
+clients/web/out/
+clients/web/.env.local
+
+# Nova workspace
+nova_workspace/
+nova_workspace/**
+
+# Logs
+*.log
+logs/
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# pyenv
+.python-version
+
+# pipenv
+Pipfile.lock
+
+# poetry
+poetry.lock
+
+# conda
+environment.yml
+
+# pre-commit
+.pre-commit-cache/
+
+# Kubernetes secrets (never commit)
+k8s/secrets.yaml
+node_modules/
+clients/vscode/node_modules/
+*.vsix
+.env
+config/.env
+__pycache__/
+*.pyc
+.pytest_cache/
+venv/
+.venv/
+fuzz_out/

nova_arsenal-2.0.0/.pre-commit-config.yaml

@@ -0,0 +1,28 @@
+repos:
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.4.4
+    hooks:
+      - id: ruff
+        args: [--fix]
+      - id: ruff-format
+
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.18.2
+    hooks:
+      - id: gitleaks
+
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.6.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-json
+      - id: check-added-large-files
+      - id: check-merge-conflict
+
+  - repo: https://github.com/koalaman/shellcheck-precommit
+    rev: v0.10.0
+    hooks:
+      - id: shellcheck
+        args: [-e, SC1091]

nova_arsenal-2.0.0/CHANGELOG.md

@@ -0,0 +1,110 @@
+# Changelog
+
+All notable changes to Nova-Arsenal will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+No unreleased changes yet.
+
+---
+
+## [2.0.0] - 2026-10-01
+
+### Added
+- **Concurrent work sessions + sub-agents** — `SessionManager` runs recon/web/osint/researcher/exploit/validator/reporter **in parallel** under one session; API `/api/work-sessions`, CLI `nova-agent session`, consensus aggregation, event stream, disk persistence
+- **Natural multi-turn chat** — conversation-first system prompts, full history, fixed SSE streaming via LLMRouter (not broken `active_providers`), offline fallback that still talks; web UI welcome copy for “chat like ChatGPT”
+- **ChatGPT / Codex subscription OAuth** — `nova-agent login --provider openai --oauth` (PKCE browser) and `--device-code` for headless; token refresh; preferred primary when signed in
+- **Local LLM first-class** — Ollama auto-discovery, `nova-agent login --provider ollama`, LM Studio/OpenAI-compatible local servers; `GET /api/llm/local`
+- **Account-style AI login (Codex / Claude Code)** — `nova-agent login`, import local Claude/Codex sessions, `CLAUDE_CODE_OAUTH_TOKEN`, Google OAuth for Gemini; tokens in `~/.nova/accounts.json`; API `/api/llm/accounts/*`
+- **VS Code extension fixed** — compiles to `out/`, correct chat endpoint, Sign In / Import sessions / Ollama commands, host-mediated API calls, Output channel
+- **BYOK (bring-your-own-key) LLM wiring** — auto-detect OpenAI/Anthropic/Gemini/OpenRouter/DeepSeek/Qwen/HF keys from `.env`; honor `LLM_PROVIDER` + `LLM_MODEL`; `GET /api/llm/status` + `POST /api/llm/reload`; Settings UI shows live key status (no secrets leaked)
+- **Zero-Day Candidate Pipeline (`nova_arsenal.zeroday`)** — high-speed research stack:
+  - Parallel attack-surface ranking (`AttackSurfaceMapper`)
+  - CVE variant / patch-gap analysis (`VariantAnalyzer`)
+  - Static bug-class heuristics (`StaticBugScanner`)
+  - Multi-engine fuzz campaign orchestration (`FuzzOrchestrator`)
+  - **Live fuzz worker** (`LiveFuzzWorker`) — detects/runs ffuf, AFL++, honggfuzz, radamsa, HTTP mutator
+  - Crash triage & dedup (`CrashTriageEngine`)
+  - Novelty scoring vs known CVE fingerprints (`NoveltyScorer`)
+  - Recon→services bridge (`findings_to_services`)
+  - Unified hunter (`ZeroDayHunter`) with authorization gate
+- **Swarm phase wiring:** recon → `researcher_zeroday` (auto ZeroDayHunter) → web/exploit/validator
+- CLI: `--zeroday`, `--swarm`, `--live-fuzz`, `--authorized`, `--auth-ref`
+- MCP: `zeroday_hunt`; `swarm_scan` returns phases + zeroday candidate count
+- Tool schema + tool-selector rules for zeroday research
+- Unit tests: `tests/unit/test_zeroday.py`, `tests/unit/test_swarm_zeroday.py`
+
+### Notes
+- Pipeline optimizes *seconds-scale prioritization and planning*. Live fuzz uses short
+  job timeouts by default. It does **not** guarantee confirmed zero-day discovery;
+  candidates require human validation and responsible disclosure. Authorized testing only.
+
+### Previous
+- Initial release of Nova-Arsenal platform
+- 70+ security modules (recon, attack, analysis, reporting)
+- Multi-LLM support (Ollama, OpenAI, Anthropic, Gemini)
+- Web dashboard with real-time monitoring
+- Docker-based deployment
+- Multi-user authentication with JWT
+- SQLite database for findings storage
+- Kubernetes deployment manifests
+- GitHub Actions CI/CD pipeline
+- Security scanning (CodeQL, Trivy, TruffleHog)
+
+### Changed
+- N/A (initial release)
+
+### Deprecated
+- N/A (initial release)
+
+### Removed
+- N/A (initial release)
+
+### Fixed
+- N/A (initial release)
+
+### Security
+- Privileged MCP and shared LLM-management APIs require analyst/admin authentication
+- Nmap MCP execution uses validated argument-vector subprocesses instead of shell interpolation
+- Credentialed CORS rejects wildcard origins and production Compose requires explicit secrets/origins
+- Authentication uses PyJWT + Argon2 with transparent legacy bcrypt migration
+- Internal provider/MCP exceptions are logged server-side and redacted from client responses
+- CI enforces Ruff formatting/linting, BasedPyright, Python 3.10–3.13 tests, web/VS Code builds, and Docker builds
+- Security CI runs dependency audit, Trivy secret scanning, and CodeQL
+- Capability dropping in all containers
+- Network isolation for sandbox
+- Secret redaction in logs
+- Tool governance and rate limiting
+
+---
+
+## Pre-2.0 development history
+
+### Added
+- Core agent system with autonomous reasoning
+- Skills library with prompt templates
+- Governed tool kit with scope enforcement
+- Multi-agent swarm architecture
+- Web UI dashboard
+- REST API with FastAPI
+- WebSocket real-time updates
+- Docker deployment
+- Kubernetes manifests
+- CI/CD pipeline
+- Comprehensive documentation
+
+---
+
+## Versioning
+
+We use [SemVer](https://semver.org/) for versioning. For the versions available, see the [tags on this repository](https://github.com/Informant254/Nova-arsenal/tags).
+
+## Release Process
+
+See [`docs/RELEASING.md`](docs/RELEASING.md). The tag must exactly match the package version
+(for example, package `2.0.0` requires tag `v2.0.0`). The release workflow validates the
+tag/version pair and full Python quality gate before publishing to PyPI, GHCR, Docker Hub,
+and GitHub Releases.