patchi 0.7.5__py3-none-any.whl

patchi/core/security/orchestrator.py

@@ -0,0 +1,313 @@
+"""
+Security Orchestrator — deduplication, correlation, and composite risk scoring.
+
+Receives raw AgentResult objects from all security agents and produces
+a unified SecurityReport with deduplicated, correlated findings.
+
+Deterministic first, AI second.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+from dataclasses import dataclass, field
+from pathlib import Path
+
+from patchi.core.agents.base import AgentResult, Finding
+from patchi.core.security.chain_analyzer import Chain, ChainAnalyzer
+from patchi.core.security.intent_analyzer import IntentAnalyzer, IntentReport
+
+_log = logging.getLogger("patchi.core.security.orchestrator")
+
+
+# ── Security Report ───────────────────────────────────────────────────────────
+
+
+@dataclass
+class CorrelatedFinding:
+    """A deduplicated finding, possibly confirmed by multiple agents."""
+
+    finding: Finding
+    confirmed_by: list[str] = field(default_factory=list)
+    composite_score: float = 0.0
+    owasp_category: str = ""
+    cwe_ids: list[str] = field(default_factory=list)
+
+    def to_dict(self) -> dict:
+        d = self.finding.to_dict()
+        d["confirmed_by"] = self.confirmed_by
+        d["composite_score"] = self.composite_score
+        d["owasp_category"] = self.owasp_category
+        d["cwe_ids"] = self.cwe_ids
+        return d
+
+
+@dataclass
+class SecurityReport:
+    """Unified output from all security agents after orchestration."""
+
+    findings: list[CorrelatedFinding] = field(default_factory=list)
+    total_findings: int = 0
+    by_severity: dict[str, int] = field(default_factory=dict)
+    by_owasp: dict[str, int] = field(default_factory=dict)
+    agents_run: list[str] = field(default_factory=list)
+    correlation_count: int = 0
+    chains: list[Chain] = field(default_factory=list)
+    intent_report: IntentReport | None = None
+    charter_violations: list[dict] = field(default_factory=list)
+
+    def to_dict(self) -> dict:
+        d = {
+            "total_findings": self.total_findings,
+            "by_severity": self.by_severity,
+            "by_owasp": self.by_owasp,
+            "agents_run": self.agents_run,
+            "correlation_count": self.correlation_count,
+            "findings": [f.to_dict() for f in self.findings],
+            "chains": [
+                {
+                    "steps": [
+                        {
+                            "file": n.finding.file,
+                            "line": n.finding.line,
+                            "type": n.finding.type,
+                            "label": lbl,
+                        }
+                        for n, lbl in zip(c.nodes, c.labels, strict=False)
+                    ],
+                    "total_severity": c.total_severity,
+                }
+                for c in self.chains
+            ],
+        }
+        if self.intent_report:
+            d["intent_report"] = self.intent_report.to_dict()
+        if self.charter_violations:
+            d["charter_violations"] = self.charter_violations
+        return d
+
+
+# ── OWASP Top 10 2021 mapping (CWE ranges) ──────────────────────────────────
+
+_OWASP_MAPPING: dict | None = None
+_OWASP_BY_CWE: dict[int, str] | None = None
+_OWASP_KEYWORD_FALLBACK: dict[str, list[str]] | None = None
+
+_MAPPING_FILE = Path(__file__).parent / "owasp_mapping.json"
+
+
+def _load_owasp_mapping() -> dict:
+    """Load OWASP mapping from JSON file (cached)."""
+    global _OWASP_MAPPING, _OWASP_BY_CWE, _OWASP_KEYWORD_FALLBACK
+    if _OWASP_MAPPING is not None:
+        return _OWASP_MAPPING
+
+    with open(_MAPPING_FILE, encoding="utf-8") as f:
+        data = json.load(f)
+
+    # Build lookup: CWE number → full category name (e.g. "A01:2021 Broken Access Control")
+    by_cwe: dict[int, str] = {}
+    for cat in data["categories"]:
+        name = f"{cat['code']}:2021 {cat['name']}"
+        for cwe in cat["cwes"]:
+            by_cwe[cwe] = name
+
+    _OWASP_MAPPING = data
+    _OWASP_BY_CWE = by_cwe
+    _OWASP_KEYWORD_FALLBACK = data.get("keyword_fallback", {})
+    return data
+
+
+def _classify_owasp(finding: Finding) -> str:
+    """Map a finding to an OWASP Top 10 category via CWE ID or keyword fallback."""
+    _load_owasp_mapping()
+    cwe_str = finding.cwe.upper().replace("CWE-", "").strip()
+    if cwe_str.isdigit() and _OWASP_BY_CWE is not None:
+        cwe_num = int(cwe_str)
+        if cwe_num in _OWASP_BY_CWE:
+            return _OWASP_BY_CWE[cwe_num]
+    # Fallback by finding type keywords
+    ftype = finding.type.lower()
+    msg = finding.message.lower()
+    combined = ftype + msg
+    if _OWASP_KEYWORD_FALLBACK is not None:
+        for code, keywords in _OWASP_KEYWORD_FALLBACK.items():
+            if any(w in combined for w in keywords):
+                # Map code back to full name via the mapping data
+                for cat in _OWASP_MAPPING["categories"]:
+                    if cat["code"] == code:
+                        return f"{code}:2021 {cat['name']}"
+    return "A05:2021 Security Misconfiguration"
+
+
+# ── Composite risk score ─────────────────────────────────────────────────────
+
+_SEV_WEIGHTS = {"critical": 10.0, "high": 7.0, "medium": 4.0, "low": 1.5, "info": 0.0}
+
+
+def _composite_score(finding: Finding, confirm_count: int) -> float:
+    """0-100 score: severity + confirmation bonus + confidence."""
+    base = _SEV_WEIGHTS.get(finding.severity.value, 0.0)
+    confirm_bonus = min(confirm_count * 3.0, 15.0)  # up to +15 for multi-agent confirmation
+    return min(100.0, base * 10.0 + confirm_bonus)
+
+
+# ── Orchestrator ─────────────────────────────────────────────────────────────
+
+
+class SecurityOrchestrator:
+    """
+    Takes raw AgentResult list, deduplicates, correlates, scores.
+
+    Usage:
+        orch = SecurityOrchestrator()
+        report = orch.correlate(agent_results)
+    """
+
+    def correlate(self, results: list[AgentResult]) -> SecurityReport:
+        all_findings: list[Finding] = []
+        agents_run = []
+
+        for r in results:
+            agents_run.append(r.agent_name)
+            all_findings.extend(r.findings)
+
+        # Step 1: Group by (file, type, cwe) with line-tolerance window (LIMIT-08)
+        LINE_TOLERANCE = 5
+        groups: dict[tuple, list[Finding]] = {}
+        used: set[tuple] = set()
+        # CWE secondary index: different tools name the same weakness
+        # differently ("B608" vs "patchi-sql-injection-..."), but the CWE is
+        # the semantic join. Same file + same CWE within tolerance => merge.
+        cwe_index: dict[tuple[str, str], tuple] = {}
+        for f in sorted(all_findings, key=lambda x: (x.file, x.line)):
+            cwe_key = f.cwe.upper().replace("CWE-", "").strip() if f.cwe else ""
+            # Try exact match first
+            exact_key = (f.file, f.line, f.type, cwe_key)
+            if exact_key not in used:
+                # Try line-tolerance match within same file + type + cwe
+                matched = False
+                for tolerance_line in range(
+                    max(1, f.line - LINE_TOLERANCE), f.line + LINE_TOLERANCE + 1
+                ):
+                    tol_key = (f.file, tolerance_line, f.type, cwe_key)
+                    if tol_key in used:
+                        matched = True
+                        break
+                if not matched and cwe_key and f.line > 0:
+                    # Cross-tool join on (file, cwe) proximity
+                    gkey = cwe_index.get((f.file, cwe_key))
+                    if gkey is not None and abs(gkey[1] - f.line) <= LINE_TOLERANCE:
+                        groups[gkey].append(f)
+                        matched = True
+                if not matched:
+                    key = (f.file, f.line, f.type, cwe_key)
+                    used.add(key)
+                    groups[key] = [f]
+                    if cwe_key and f.line > 0:
+                        existing = cwe_index.get((f.file, cwe_key))
+                        if existing is None or abs(existing[1] - f.line) <= LINE_TOLERANCE:
+                            cwe_index[(f.file, cwe_key)] = key
+                else:
+                    # Add to existing tolerance group
+                    for gkey in groups:
+                        if (
+                            gkey[0] == f.file
+                            and gkey[2] == f.type
+                            and gkey[3] == cwe_key
+                            and abs(gkey[1] - f.line) <= LINE_TOLERANCE
+                        ):
+                            groups[gkey].append(f)
+                            break
+            else:
+                groups[exact_key].append(f)
+
+        correlated: list[CorrelatedFinding] = []
+
+        for _key, group in groups.items():
+            primary = group[0]
+            confirmed_by = list({f.agent for f in group})
+            owasp = _classify_owasp(primary)
+            cwe_ids = list({f.cwe for f in group if f.cwe})
+
+            score = _composite_score(primary, len(confirmed_by))
+
+            # Take highest severity from the group
+            best = max(group, key=lambda f: f.severity.sort_key())
+
+            correlated.append(
+                CorrelatedFinding(
+                    finding=best,
+                    confirmed_by=confirmed_by,
+                    composite_score=score,
+                    owasp_category=owasp,
+                    cwe_ids=cwe_ids,
+                )
+            )
+
+        # Sort by composite score descending (most dangerous first)
+        correlated.sort(key=lambda c: (-c.composite_score, c.finding.file, c.finding.line))
+
+        # Build summary
+        by_sev: dict[str, int] = {}
+        by_owasp: dict[str, int] = {}
+        for c in correlated:
+            sev = c.finding.severity.value
+            by_sev[sev] = by_sev.get(sev, 0) + 1
+            by_owasp[c.owasp_category] = by_owasp.get(c.owasp_category, 0) + 1
+
+        # ── Chain analysis (cross-file exploit chains) ──────────────────────
+        chains: list[Chain] = []
+        import_edges: dict[str, set[str]] = {}
+        try:
+            from patchi.core.brain.import_graph import build_import_graph
+
+            ig = build_import_graph(Path("."))
+            import_edges = dict(ig.edges)
+        except Exception as _exc:
+            _log.warning('correlate failed: %s', _exc)
+        try:
+            chain_analyzer = ChainAnalyzer(all_findings, import_edges=import_edges)
+            chains = chain_analyzer.find_chains(max_chains=20)
+        except Exception as _exc:
+            _log.warning('correlate failed: %s', _exc)
+
+        # ── Intent analysis (route ↔ code gap detection) ──────────────────────
+        intent_report: IntentReport | None = None
+        try:
+            intent_analyzer = IntentAnalyzer()
+            intent_report = intent_analyzer.analyze_root(Path("."))
+        except Exception as _exc:
+            _log.warning('correlate failed: %s', _exc)
+
+        # ── Charter drift detection ───────────────────────────────────────────
+        charter_violations: list[dict] = []
+        try:
+            from patchi.core.security.charter import (
+                check_all_violations,
+                load_charter,
+            )
+            charter = load_charter(Path("."))
+            if charter.rules:
+                flat_edges: list[tuple[str, str]] = []
+                for src, dsts in import_edges.items():
+                    for dst in dsts:
+                        flat_edges.append((src, dst))
+                charter_violations = [
+                    v.to_dict() for v in check_all_violations(charter, flat_edges)
+                ]
+        except Exception as _exc:
+            _log.warning('correlate failed: %s', _exc)
+
+        return SecurityReport(
+            findings=correlated,
+            total_findings=len(correlated),
+            by_severity=by_sev,
+            by_owasp=by_owasp,
+            agents_run=agents_run,
+            correlation_count=sum(1 for c in correlated if len(c.confirmed_by) > 1),
+            chains=chains,
+            intent_report=intent_report,
+            charter_violations=charter_violations,
+        )

patchi/core/security/pattern_context.py

@@ -0,0 +1,125 @@
+"""
+Pattern-context suppression for security agents.
+
+Detects when a flagged line lives inside:
+  - A regex definition (re.compile, _PATTERNS list)
+  - A docstring or multi-line comment block
+  - A string literal in a variable named *pattern*, *regex*, *payload*, etc.
+  - A test fixture file (tests/ or test_*.py)
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+
+def _try_read(file_path: str) -> str | None:
+    """Try reading a file, resolving relative paths against CWD."""
+    p = Path(file_path)
+    if not p.is_absolute():
+        p = Path.cwd() / file_path
+    if not p.is_file():
+        return None
+    try:
+        return p.read_text(encoding="utf-8", errors="ignore")
+    except OSError:
+        return None
+
+
+def is_pattern_context(file_path: str, line_num: int) -> bool:
+    """
+    Return True if line_num in file_path is inside a pattern definition,
+    docstring, or test fixture — meaning a security finding there is a
+    self-referential false positive.
+    """
+    if line_num < 1:
+        return False
+
+    content = _try_read(file_path)
+    if content is None:
+        return False
+
+    lines = content.splitlines()
+    if line_num > len(lines):
+        return False
+
+    target_line = lines[line_num - 1].strip()
+
+    # ── Test file check ───────────────────────────────────────────────────
+    fp = file_path.replace("\\", "/")
+    if "/tests/" in fp or fp.split("/")[-1].startswith("test_"):
+        return True
+
+    # ── Variable name check ───────────────────────────────────────────────
+    assign_match = re.match(r"(\w+)\s*[:=]", target_line)
+    if assign_match:
+        var_name = assign_match.group(1).lower()
+        if any(
+            kw in var_name
+            for kw in (
+                "pattern",
+                "regex",
+                "payload",
+                "explanation",
+                "template",
+                "descriptions",
+                "protocol",
+                "metadata",
+                "indicator",
+            )
+        ):
+            return True
+
+    # ── re.compile() check ────────────────────────────────────────────────
+    if "re.compile(" in target_line or "re.match(" in target_line:
+        return True
+
+    # ── Triple-quote / docstring check ────────────────────────────────────
+    in_triple = False
+    tq_char = None
+    bracket_depth = 0
+
+    for i in range(line_num - 1):
+        line = lines[i].strip()
+        for tq in ('"""', "'''"):
+            count = line.count(tq)
+            if count % 2 == 1:
+                if in_triple and tq_char == tq:
+                    in_triple = False
+                elif not in_triple:
+                    in_triple = True
+                    tq_char = tq
+        if in_triple:
+            return True
+        for ch in line:
+            if ch in "({[":
+                bracket_depth += 1
+            elif ch in ")}]":
+                bracket_depth -= 1
+
+    # ── Pattern block in list/dict literal ─────────────────────────────────
+    if bracket_depth > 0:
+        start = max(0, line_num - 8)
+        end = min(len(lines), line_num + 4)
+        block = "\n".join(lines[start:end])
+        if re.search(r're\.compile\(|r["\']|\\[dDwWsSbB]|\[\^', block):
+            return True
+
+    return False
+
+
+def suppress_findings(result) -> int:
+    """
+    Remove pattern-context false positives from an AgentResult in place.
+    Returns the count of findings removed.
+    """
+    from patchi.core.agents.base import AgentResult
+
+    if not isinstance(result, AgentResult):
+        return 0
+    original = len(result.findings)
+    result.findings = [
+        f for f in result.findings if not is_pattern_context(f.file, f.line if f.line else 0)
+    ]
+    return original - len(result.findings)

patchi/core/security/pattern_loader.py

@@ -0,0 +1,101 @@
+"""
+Pattern loader for security agents.
+
+Loads sink/source patterns from YAML config and merges them with
+agent-specific defaults. Agents call `load_patterns()` once at
+startup and use the returned dict.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+_PATTERNS_CACHE: dict[str, Any] | None = None
+_PATTERNS_PATH = Path(__file__).parent / "security_patterns.yaml"
+
+
+def load_patterns(path: Path | None = None) -> dict[str, Any]:
+    """Load and cache security patterns from YAML config."""
+    global _PATTERNS_CACHE
+    if _PATTERNS_CACHE is not None and path is None:
+        return _PATTERNS_CACHE
+
+    config_path = path or _PATTERNS_PATH
+    if not config_path.exists():
+        return {}
+
+    with open(config_path, encoding="utf-8") as f:
+        data = yaml.safe_load(f) or {}
+
+    _PATTERNS_CACHE = data
+    return data
+
+
+def get_injection_sinks(patterns: dict | None = None) -> dict[str, dict[str, list[str]]]:
+    """Get injection sinks grouped by type and language."""
+    p = patterns or load_patterns()
+    return p.get("injection", {})
+
+
+def get_ssrf_patterns(patterns: dict | None = None) -> dict[str, Any]:
+    """Get SSRF detection patterns."""
+    p = patterns or load_patterns()
+    return p.get("ssrf", {})
+
+
+def get_ssrf_protocol_patterns(patterns: dict | None = None) -> list[tuple[re.Pattern, str, str]]:
+    """Get compiled SSRF protocol regex patterns with severity and message."""
+    ssrf = get_ssrf_patterns(patterns)
+    result = []
+    for entry in ssrf.get("protocol_patterns", []):
+        try:
+            compiled = re.compile(entry["pattern"], re.IGNORECASE)
+            result.append((compiled, entry["severity"], entry["message"]))
+        except re.error:
+            continue
+    return result
+
+
+def get_ssrf_metadata_patterns(patterns: dict | None = None) -> list[tuple[re.Pattern, str, str]]:
+    """Get compiled SSRF metadata endpoint regex patterns."""
+    ssrf = get_ssrf_patterns(patterns)
+    result = []
+    for entry in ssrf.get("metadata_patterns", []):
+        try:
+            compiled = re.compile(entry["pattern"], re.IGNORECASE)
+            result.append((compiled, entry["severity"], entry["message"]))
+        except re.error:
+            continue
+    return result
+
+
+def get_ssrf_internal_network_patterns(
+    patterns: dict | None = None,
+) -> list[tuple[re.Pattern, str, str]]:
+    """Get compiled SSRF internal network regex patterns."""
+    ssrf = get_ssrf_patterns(patterns)
+    result = []
+    for entry in ssrf.get("internal_network", []):
+        try:
+            compiled = re.compile(entry["pattern"])
+            result.append((compiled, entry["severity"], entry["message"]))
+        except re.error:
+            continue
+    return result
+
+
+def get_catch_noop_patterns(patterns: dict | None = None) -> list[re.Pattern]:
+    """Get compiled catch block no-op regex patterns."""
+    p = patterns or load_patterns()
+    cb = p.get("catch_block", {})
+    result = []
+    for pat_str in cb.get("noop_patterns", []):
+        try:
+            result.append(re.compile(pat_str))
+        except re.error:
+            continue
+    return result

patchi/core/security/pentest/__init__.py

@@ -0,0 +1,4 @@
+"""Pentest tool adapters — real DAST engines for Patchi."""
+
+from patchi.core.security.pentest.base import PentestTool  # noqa: F401
+from patchi.core.security.pentest.registry import PentestRegistry  # noqa: F401

patchi/core/security/pentest/base.py

@@ -0,0 +1,58 @@
+"""PentestTool base — interface every real DAST adapter implements."""
+
+from __future__ import annotations
+
+import logging
+import shutil
+import subprocess
+from abc import ABC, abstractmethod
+from dataclasses import dataclass, field
+from pathlib import Path
+
+_log = logging.getLogger("patchi.pentest.base")
+
+
+@dataclass
+class PentestResult:
+    tool: str
+    success: bool
+    evidence: str = ""
+    findings: list[dict] = field(default_factory=list)
+    raw_output: str = ""
+    duration_ms: int = 0
+    error: str = ""
+
+
+class PentestTool(ABC):
+    """Abstract base for real exploit tools."""
+
+    name: str = "base"
+    binary: str = ""  # e.g. "nuclei" or "npx"
+    docker_image: str = ""  # fallback
+    requires_target: bool = True
+
+    def is_available(self) -> bool:
+        if self.binary and shutil.which(self.binary):
+            return True
+        if self.docker_image and shutil.which("docker"):
+            try:
+                out = subprocess.run(
+                    ["docker", "image", "inspect", self.docker_image],
+                    capture_output=True,
+                    timeout=5,
+                )
+                if out.returncode == 0:
+                    return True
+            except Exception as exc:  # noqa: BLE001
+                _log.debug("%s docker check failed: %s", self.name, exc)
+        return False
+
+    @abstractmethod
+    def run(
+        self,
+        target: str,
+        safe_mode: bool = True,
+        workspace: Path | None = None,
+        extra: dict | None = None,
+    ) -> PentestResult:
+        """Execute tool against target. Never raises — returns PentestResult."""

patchi/core/security/pentest/dalfox_adapter.py

@@ -0,0 +1,40 @@
+"""Dalfox adapter — XSS (reflected/stored)."""
+
+from __future__ import annotations
+
+import logging
+import shutil
+import subprocess
+import time
+from pathlib import Path
+
+from patchi.core.security.pentest.base import PentestResult, PentestTool
+
+_log = logging.getLogger("patchi.pentest.dalfox")
+
+
+class DalfoxTool(PentestTool):
+    name = "dalfox"
+    binary = "dalfox"
+    docker_image = "hahwul/dalfox:latest"
+
+    def run(self, target: str, safe_mode: bool = True, workspace: Path | None = None, extra: dict | None = None) -> PentestResult:
+        t0 = time.monotonic()
+        base = ["dalfox", "url", target, "--silence", "--format", "json"]
+        if safe_mode:
+            base += ["--skip-bav"]
+        cmd = base if shutil.which("dalfox") else (["docker","run","--rm","hahwul/dalfox:latest","url",target,"--silence","--format","json"] if shutil.which("docker") else None)
+        if not cmd:
+            return PentestResult(tool=self.name, success=False, error="dalfox not available")
+        try:
+            proc = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
+            out = proc.stdout + proc.stderr
+            findings=[]
+            for line in out.splitlines()[:100]:
+                if "poc" in line.lower() or "vuln" in line.lower():
+                    findings.append({"type":"xss","detail": line[:300]})
+            return PentestResult(tool=self.name, success=True, evidence=f"dalfox {len(findings)} poc", findings=findings, raw_output=out[:8000], duration_ms=int((time.monotonic()-t0)*1000))
+        except subprocess.TimeoutExpired:
+            return PentestResult(tool=self.name, success=False, error="dalfox timeout 5m", duration_ms=int((time.monotonic()-t0)*1000))
+        except Exception as exc:  # noqa: BLE001
+            return PentestResult(tool=self.name, success=False, error=str(exc), duration_ms=int((time.monotonic()-t0)*1000))

patchi/core/security/pentest/ffuf_adapter.py

@@ -0,0 +1,48 @@
+"""FFuF adapter — discovery/fuzz."""
+from __future__ import annotations
+
+import json
+import logging
+import shutil
+import subprocess
+import time
+from pathlib import Path
+
+from patchi.core.security.pentest.base import PentestResult, PentestTool
+
+_log = logging.getLogger("patchi.pentest.ffuf")
+
+
+class FfufTool(PentestTool):
+    name = "ffuf"
+    binary = "ffuf"
+    docker_image = "ffuf/ffuf:latest"
+
+    def run(self, target: str, safe_mode: bool = True, workspace: Path | None = None, extra: dict | None = None) -> PentestResult:
+        extra = extra or {}
+        wordlist = extra.get("wordlist", "/usr/share/wordlists/common.txt")
+        t0 = time.monotonic()
+        # ffuf target expected as https://host/FUZZ
+        if "FUZZ" not in target:
+            target = target.rstrip("/") + "/FUZZ"
+        base = ["ffuf", "-u", target, "-w", wordlist, "-json", "-s"]
+        if safe_mode:
+            base += ["-rate", "10"]
+        cmd = base if shutil.which("ffuf") else (["docker","run","--rm","ffuf/ffuf:latest","-u",target,"-w",wordlist,"-json","-s"] if shutil.which("docker") else None)
+        if not cmd:
+            return PentestResult(tool=self.name, success=False, error="ffuf not available")
+        try:
+            proc = subprocess.run(cmd, capture_output=True, text=True, timeout=180)
+            dur = int((time.monotonic()-t0)*1000)
+            findings=[]
+            try:
+                data = json.loads(proc.stdout)
+                for r in data.get("results", [])[:30]:
+                    findings.append({"url": r.get("url",""), "status": r.get("status"), "length": r.get("length")})
+            except Exception as _exc:
+                _log.debug("ffuf json parse skipped: %s", _exc)
+            return PentestResult(tool=self.name, success=True, evidence=f"ffuf {len(findings)} hits", findings=findings, raw_output=proc.stdout[:6000], duration_ms=dur)
+        except subprocess.TimeoutExpired:
+            return PentestResult(tool=self.name, success=False, error="ffuf timeout 3m", duration_ms=int((time.monotonic()-t0)*1000))
+        except Exception as exc:  # noqa: BLE001
+            return PentestResult(tool=self.name, success=False, error=str(exc), duration_ms=int((time.monotonic()-t0)*1000))