pentool 0.2.0__tar.gz → 0.2.2__tar.gz

{pentool-0.2.0 → pentool-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pentool
-Version: 0.2.0
+Version: 0.2.2
 Summary: Modern Web Pentesting TUI - Professional security testing tool
 Author-email: Pentool Team <dev@pentool.pro>
 License: AGPL-3.0
@@ -70,15 +70,15 @@ Fast, transparent, and built for real-world testing.
 
 | Dashboard | Scanner |
 |:---------:|:-------:|
-| ![Dashboard](screens/dashboard.png) | ![Scanner](screens/scaner.png) |
+| ![Dashboard](https://raw.githubusercontent.com/docxqwerty/pentool/main/screens/dashboard.png) | ![Scanner](https://raw.githubusercontent.com/docxqwerty/pentool/main/screens/scaner.png) |
 
 | Proxy | Repeater |
 |:-----:|:--------:|
-| ![Proxy](screens/proxy.png) | ![Repeater](screens/repeater.png) |
+| ![Proxy](https://raw.githubusercontent.com/docxqwerty/pentool/main/screens/proxy.png) | ![Repeater](https://raw.githubusercontent.com/docxqwerty/pentool/main/screens/repeater.png) |
 
 | Intruder | Settings |
 |:--------:|:--------:|
-| ![Intruder](screens/intruder.png) | ![Settings](screens/settings.png) |
+| ![Intruder](https://raw.githubusercontent.com/docxqwerty/pentool/main/screens/intruder.png) | ![Settings](https://raw.githubusercontent.com/docxqwerty/pentool/main/screens/settings.png) |
 
 ---
 
@@ -213,6 +213,7 @@ PRO extensions are available under a commercial license.
 ## 📬 Contact
 
 - **Website:** [pentool.pro](https://pentool.pro)
+- **Telegram channel:** [t.me/pentool_pro](https://t.me/pentool_pro)
 - **Telegram:** [@sudores](https://t.me/sudores)
 - **Email:** support@pentool.pro
 - **Author:** Anatoly Kashtanov (DoctorX)

{pentool-0.2.0 → pentool-0.2.2}/README.md

@@ -24,15 +24,15 @@ Fast, transparent, and built for real-world testing.
 
 | Dashboard | Scanner |
 |:---------:|:-------:|
-| ![Dashboard](screens/dashboard.png) | ![Scanner](screens/scaner.png) |
+| ![Dashboard](https://raw.githubusercontent.com/docxqwerty/pentool/main/screens/dashboard.png) | ![Scanner](https://raw.githubusercontent.com/docxqwerty/pentool/main/screens/scaner.png) |
 
 | Proxy | Repeater |
 |:-----:|:--------:|
-| ![Proxy](screens/proxy.png) | ![Repeater](screens/repeater.png) |
+| ![Proxy](https://raw.githubusercontent.com/docxqwerty/pentool/main/screens/proxy.png) | ![Repeater](https://raw.githubusercontent.com/docxqwerty/pentool/main/screens/repeater.png) |
 
 | Intruder | Settings |
 |:--------:|:--------:|
-| ![Intruder](screens/intruder.png) | ![Settings](screens/settings.png) |
+| ![Intruder](https://raw.githubusercontent.com/docxqwerty/pentool/main/screens/intruder.png) | ![Settings](https://raw.githubusercontent.com/docxqwerty/pentool/main/screens/settings.png) |
 
 ---
 
@@ -167,6 +167,7 @@ PRO extensions are available under a commercial license.
 ## 📬 Contact
 
 - **Website:** [pentool.pro](https://pentool.pro)
+- **Telegram channel:** [t.me/pentool_pro](https://t.me/pentool_pro)
 - **Telegram:** [@sudores](https://t.me/sudores)
 - **Email:** support@pentool.pro
 - **Author:** Anatoly Kashtanov (DoctorX)

{pentool-0.2.0 → pentool-0.2.2}/pentool/__init__.py

@@ -1,6 +1,6 @@
 """Pentool — professional web security testing toolkit with Textual TUI."""
 
-__version__ = "0.2.0"
+__version__ = "0.2.2"
 __author__ = "pentool"
 
 
@@ -34,8 +34,8 @@ def _bootstrap_pro() -> None:
     _repo_root = _pkg_dir.parent                 # .../pentool/
 
     candidates: list[Path] = [
-        Path.home() / ".pentool" / "pro" / "pentool",  # installed PRO package
         _repo_root / "pro" / "pentool",                 # dev submodule
+        Path.home() / ".pentool" / "pro" / "pentool",  # installed PRO package
     ]
 
     import pentool as _self

{pentool-0.2.0 → pentool-0.2.2}/pentool/__main__.py

@@ -1,6 +1,7 @@
 """Entry point: no arguments — TUI, with arguments — CLI."""
 
 import sys
+import threading
 
 
 def main() -> None:
@@ -8,6 +9,17 @@ def main() -> None:
         from pentool.cli.main import cli
         cli()
     else:
+        # Anonymous install-counter ping (fire-and-forget, one increment per
+        # machine — dedup happens server-side). Runs in a background thread —
+        # send_first_run_ping() opens a network connection with an 8s
+        # timeout, which must never delay the TUI actually starting when
+        # the network is slow/unreachable.
+        try:
+            from pentool.core.crash_reporter import send_first_run_ping
+            threading.Thread(target=send_first_run_ping, daemon=True).start()
+        except Exception:
+            pass
+
         try:
             from pentool.tui.app import PentoolApp
             PentoolApp().run()

{pentool-0.2.0 → pentool-0.2.2}/pentool/cli/main.py

@@ -126,6 +126,7 @@ def update_cmd(check_only: bool) -> None:
         click.echo("Upgrading via pip...")
         if do_pip_upgrade():
             click.echo("Upgrade successful. Restart Pentool to use the new version.")
+            _sync_pro_package_after_upgrade()
         else:
             click.echo(
                 "pip upgrade failed. You can update manually:\n"
@@ -135,6 +136,32 @@ def update_cmd(check_only: bool) -> None:
             raise SystemExit(1)
 
 
+def _sync_pro_package_after_upgrade() -> None:
+    """Re-download the PRO package too, if one is active on this machine.
+
+    `pip install --upgrade pentool` only touches the FREE package — the PRO
+    package lives separately in ~/.pentool/pro/ and is otherwise only ever
+    (re)downloaded by check_and_update_pro_package(), which normally runs in
+    the background on TUI startup. Doing it here too means a CLI-driven
+    upgrade doesn't leave a stale PRO build around until the next TUI launch.
+    Best-effort — never fails the overall upgrade if this part doesn't work.
+    """
+    import asyncio
+
+    from pentool.core.license import PRO_PACKAGE_DIR, check_and_update_pro_package
+
+    if not PRO_PACKAGE_DIR.exists():
+        return  # PRO was never activated on this machine — nothing to sync
+
+    try:
+        click.echo("Checking for a newer PRO build...")
+        updated = asyncio.run(check_and_update_pro_package())
+        if updated:
+            click.echo("PRO package updated to the latest build.")
+    except Exception as exc:
+        click.echo(f"Could not check for a PRO update: {exc}", err=True)
+
+
 @cli.group()
 def license() -> None:
     """License management: trial, activation, status."""

pentool-0.2.2/pentool/core/crash_reporter.py

@@ -0,0 +1,137 @@
+"""Crash reporter — collects and sends anonymous crash reports.
+
+Also sends a one-shot "first run" ping so the admin panel can show an
+install counter — see send_first_run_ping(). Both go to the same
+pentool-license Cloudflare Worker that already handles license
+validation (pentool.core.license._LICENSE_API_BASE) — /api/crash and
+/api/telemetry/first_run are public, unauthenticated ingestion
+endpoints there, mirrored in pentool-backend's admin.html dashboard.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import os
+import platform
+import sys
+import traceback
+from typing import Any
+
+# Same Worker as pentool.core.license — kept as a separate literal here
+# (rather than importing _LICENSE_API_BASE) so crash reporting has no
+# import-time dependency on the licensing module.
+_API_BASE = "https://pentool-license.akashtanov2020.workers.dev"
+
+
+def _get_metadata() -> dict[str, Any]:
+    """Collect anonymous metadata for crash report."""
+    try:
+        from pentool import __version__ as version
+    except Exception:
+        version = "unknown"
+    return {
+        "version": version,
+        "python": sys.version.split()[0],
+        "os": platform.system(),
+        "os_version": platform.release(),
+        "arch": platform.machine(),
+    }
+
+
+def _anonymize(text: str) -> str:
+    """Remove paths and potential tokens from traceback text."""
+    import re
+    # Remove absolute paths — keep only filename
+    text = re.sub(r'  File "([^"]+)"', lambda m: f'  File "{os.path.basename(m.group(1))}"', text)
+    # Remove anything that looks like a token/key (long hex strings)
+    text = re.sub(r'\b[A-Fa-f0-9]{32,}\b', '<TOKEN>', text)
+    return text
+
+
+async def send_crash_async(exc: BaseException, endpoint: str = f"{_API_BASE}/api/crash") -> None:
+    """Send crash report asynchronously. Silently ignores any errors."""
+    try:
+        import aiohttp  # type: ignore[import]
+    except ImportError:
+        return  # aiohttp not available — skip silently
+
+    try:
+        tb_lines = traceback.format_exception(type(exc), exc, exc.__traceback__)
+        tb_text = _anonymize("".join(tb_lines))
+        payload = {
+            "traceback": tb_text,
+            "exception": type(exc).__name__,
+            **_get_metadata(),
+        }
+        timeout = aiohttp.ClientTimeout(total=8)
+        async with aiohttp.ClientSession(timeout=timeout) as session:
+            await session.post(endpoint, json=payload, ssl=False)
+    except Exception:
+        pass  # never propagate errors from crash reporter
+
+
+def send_crash(exc: BaseException) -> None:
+    """Fire-and-forget crash report from sync context."""
+    try:
+        from pentool.core.config import get_config
+        cfg = get_config()
+        if not getattr(cfg, "send_crash_reports", True):
+            return
+    except Exception:
+        pass
+
+    try:
+        loop = asyncio.new_event_loop()
+        loop.run_until_complete(send_crash_async(exc))
+        loop.close()
+    except Exception:
+        pass
+
+
+async def send_first_run_ping_async(endpoint: str = f"{_API_BASE}/api/telemetry/first_run") -> None:
+    """Ping the install counter once per machine. Silently ignores errors.
+
+    Dedup happens server-side (keyed by machine_id) — safe to call on every
+    startup; only the very first call from a given machine increments the
+    counter, so no local "have I already sent this" state is needed here.
+    """
+    try:
+        import aiohttp  # type: ignore[import]
+    except ImportError:
+        return
+
+    try:
+        from pentool.core.license import get_machine_id
+        machine_id = get_machine_id()
+    except Exception:
+        return
+
+    try:
+        timeout = aiohttp.ClientTimeout(total=8)
+        async with aiohttp.ClientSession(timeout=timeout) as session:
+            await session.post(endpoint, json={"machine_id": machine_id}, ssl=False)
+    except Exception:
+        pass
+
+
+def send_first_run_ping() -> None:
+    """Fire-and-forget install-counter ping from sync context.
+
+    Respects the same send_crash_reports opt-out as send_crash() — both are
+    "anonymous telemetry to Anthropic-free, self-hosted infra" in spirit,
+    so one setting covers both rather than adding a second toggle.
+    """
+    try:
+        from pentool.core.config import get_config
+        cfg = get_config()
+        if not getattr(cfg, "send_crash_reports", True):
+            return
+    except Exception:
+        pass
+
+    try:
+        loop = asyncio.new_event_loop()
+        loop.run_until_complete(send_first_run_ping_async())
+        loop.close()
+    except Exception:
+        pass

{pentool-0.2.0 → pentool-0.2.2}/pentool/core/license.py

@@ -503,6 +503,13 @@ def _current_platform() -> str:
     return "linux"
 
 
+# File recording which PRO build is currently unpacked into PRO_PACKAGE_DIR —
+# lets check_and_update_pro_package() tell "same build as last time" apart
+# from "a new build was published" without re-downloading the archive to
+# compare it. See _fetch_pro_build_id() / /api/pro/version on the Worker.
+_PRO_BUILD_MARKER = PRO_PACKAGE_DIR / ".build_id"
+
+
 async def download_pro_package(key: str, machine_id: str) -> bool:
     """Download, verify, and install the obfuscated PRO package.
 
@@ -555,6 +562,85 @@ async def download_pro_package(key: str, machine_id: str) -> bool:
         finally:
             tmp_archive.unlink(missing_ok=True)
 
+        # Record which build this is, so a later check_and_update_pro_package()
+        # can tell "nothing changed" from "a new build was published" without
+        # re-downloading the archive just to compare it.
+        try:
+            build_id = await _fetch_pro_build_id(plat)
+            if build_id:
+                _PRO_BUILD_MARKER.write_text(build_id, encoding="utf-8")
+        except Exception:
+            pass  # non-fatal — worst case, next check just re-downloads once more
+
         return True
     except Exception:
         return False
+
+
+async def _fetch_pro_build_id(plat: str) -> str | None:
+    """Query /api/pro/version for the current PRO release's build_id.
+
+    No license key needed — this only identifies which build is published,
+    not whether the caller is entitled to it (that's still enforced by
+    /api/download re-validating the key server-side). Returns None on any
+    failure (network, missing asset, etc.) — callers should treat that as
+    "couldn't check, don't act on it" rather than "no update available".
+    """
+    try:
+        import aiohttp
+        async with aiohttp.ClientSession(
+            timeout=aiohttp.ClientTimeout(total=8)
+        ) as session:
+            async with session.get(
+                f"{_LICENSE_API_BASE}/api/pro/version",
+                params={"platform": plat},
+                ssl=False,
+            ) as resp:
+                if resp.status != 200:
+                    return None
+                data = await resp.json()
+                return data.get("build_id")
+    except Exception:
+        return None
+
+
+async def check_and_update_pro_package() -> bool:
+    """Re-download the PRO package if a newer build has been published.
+
+    Called on TUI startup (background worker, same pattern as
+    _check_for_updates for the pip package) and after `pentool update` — this
+    is what closes the gap where pentool-pro ships a fix but a machine that
+    already activated its license keeps running the stale code from
+    ~/.pentool/pro/ forever, because download_pro_package() otherwise only
+    ever runs once, at initial activation/trial-start.
+
+    Silently does nothing (returns False) if:
+      - there's no active PRO license (nothing to update)
+      - the PRO package was never downloaded in the first place (that's
+        activate_license's job, not this one)
+      - the version check or download fails for any reason
+
+    Returns True if a new build was found and successfully installed.
+    """
+    info = get_license()
+    if not info.valid or not info.features:
+        return False
+    if not PRO_PACKAGE_DIR.exists():
+        return False  # never activated on this machine — nothing to refresh
+
+    plat = _current_platform()
+    remote_build_id = await _fetch_pro_build_id(plat)
+    if not remote_build_id:
+        return False  # couldn't reach the server — don't touch anything
+
+    local_build_id = None
+    try:
+        if _PRO_BUILD_MARKER.exists():
+            local_build_id = _PRO_BUILD_MARKER.read_text(encoding="utf-8").strip()
+    except Exception:
+        pass
+
+    if local_build_id == remote_build_id:
+        return False  # already on the latest build
+
+    return await download_pro_package(info.license_key, info.machine_id)

{pentool-0.2.0 → pentool-0.2.2}/pentool/services/proxy_service.py

@@ -23,6 +23,7 @@ class ProxyService(BaseService):
         event_bus: EventBus | None = None,
         tui_loop: asyncio.AbstractEventLoop | None = None,
         on_log: Callable[[str], None] | None = None,
+        on_storage_error: Callable[[str], None] | None = None,
     ) -> None:
         super().__init__(event_bus=event_bus, tui_loop=tui_loop, on_log=on_log)
         self._proxy_api = proxy_api
@@ -31,6 +32,20 @@ class ProxyService(BaseService):
         self._storage_ready = False
         self._pre_storage_queue: list[InterceptedRequest] = []
         self._pre_storage_queue_max = 2000
+        # Optional callback(message: str) — fired when the DB file can't be
+        # opened (e.g. "database is locked" because another Pentool
+        # instance/process already has it open, or the path is unwritable).
+        # Without this, such failures were logged only — requests silently
+        # stopped being saved with zero indication in the UI of why.
+        self._on_storage_error = on_storage_error
+
+    def _report_storage_error(self, context: str, exc: Exception) -> None:
+        msg = str(exc) or type(exc).__name__
+        if self._on_storage_error:
+            try:
+                self._on_storage_error(f"{context}: {msg}")
+            except Exception:
+                pass
 
     async def init_storage(self) -> None:
         try:
@@ -49,6 +64,7 @@ class ProxyService(BaseService):
                 self._pre_storage_queue.clear()
         except Exception as exc:
             logger.error("ProxyService: storage init failed: %s", exc)
+            self._report_storage_error("Failed to open project database", exc)
 
     async def store_request(self, req: InterceptedRequest) -> int | None:
         if not self._storage_ready:
@@ -193,6 +209,9 @@ class ProxyService(BaseService):
         except Exception as exc:
             logger.error("ProxyService: switch_db failed: %s", exc)
             self._storage_ready = False
+            self._report_storage_error(
+                f"Failed to open project database ({new_db_path})", exc
+            )
 
     async def clear_history(self) -> None:
         if not self._storage_ready:

{pentool-0.2.0 → pentool-0.2.2}/pentool/tui/app.py

@@ -10,6 +10,7 @@ import threading
 from textual import on
 from textual.app import App, ComposeResult
 from textual.binding import Binding
+from textual.containers import Vertical
 from textual.widgets import Checkbox, ContentSwitcher, Footer
 
 # Nicer checkbox glyph applied project-wide — Checkbox is a subclass of
@@ -135,6 +136,31 @@ class PentoolApp(App):
         dock: bottom;
     }
 
+    /* Wrapper around Footer + StatusBar — see compose()'s comment for why
+       this exists: two independently-docked bottom widgets overlap rather
+       than stack, so both are laid out normally inside one docked container
+       instead. Height 2 = Footer's 1 + StatusBar's 1.
+
+       Both Footer (in its own DEFAULT_CSS) and StatusBar (in statusbar.tcss)
+       hard-code `dock: bottom` themselves — just nesting them inside this
+       wrapper is not enough, they'd still each dock to the bottom of the
+       wrapper and overlap each other exactly as before. Both docks must be
+       explicitly cancelled here so they lay out normally (stacked, one
+       above the other) inside #bottom-dock instead. */
+    #bottom-dock {
+        dock: bottom;
+        height: 2;
+        layout: vertical;
+    }
+    #bottom-dock Footer {
+        dock: none;
+        height: 1;
+    }
+    #bottom-dock StatusBar {
+        dock: none;
+        height: 1;
+    }
+
     /* Global checkbox style — compact, height 1, no border.
        Glyph itself ("[ ]" / "[✓]") is set once in Checkbox.BUTTON_LEFT/
        INNER/RIGHT above; this just controls color/spacing/hover so every
@@ -268,8 +294,17 @@ class PentoolApp(App):
             yield ExtensionsScreen(id="screen-extensions")
             yield TerminalScreen(id="screen-terminal")
             yield SettingsScreen(id="screen-settings")
-        yield StatusBar(id="statusbar")
-        yield Footer()
+        # Footer and StatusBar both used to `dock: bottom` independently —
+        # in Textual, multiple independently-docked widgets at the same
+        # edge don't stack, they all pin to the same row and overlap each
+        # other (whichever was composed last wins the pixels). That's why
+        # StatusBar (and, inside it, the new ActivityIndicator) never
+        # rendered — Footer, composed after it, was drawn on top and
+        # covered it completely. Wrapping both in one docked container
+        # lets them lay out normally (one above the other) inside it.
+        with Vertical(id="bottom-dock"):
+            yield Footer()
+            yield StatusBar(id="statusbar")
 
     async def on_mount(self) -> None:
         setup_logging(self._cfg.log_file, self._cfg.log_level)
@@ -298,6 +333,7 @@ class PentoolApp(App):
             proxy_api=self._proxy_api,
             db_path=self._cfg.db_path,
             event_bus=get_event_bus(),
+            on_storage_error=self._on_storage_error,
         )
         try:
             from pentool.tui.screens.proxy.screen import ProxyScreen
@@ -372,6 +408,12 @@ class PentoolApp(App):
         if getattr(self._cfg, "check_updates", True):
             self.run_worker(self._check_for_updates(), exclusive=False, thread=False)
 
+        # Check for a newer PRO build in background (if a PRO license is
+        # active) — closes the gap where pentool-pro ships a fix but an
+        # already-activated machine keeps running the stale code forever,
+        # since the PRO package otherwise only downloads once, at activation.
+        self.run_worker(self._check_for_pro_update(), exclusive=False, thread=False)
+
     async def _auto_open_last_project(self) -> None:
         """Open the last project from recent_projects at startup."""
         await asyncio.sleep(0.2)  # give Textual time to render the UI
@@ -403,6 +445,30 @@ class PentoolApp(App):
         except Exception as exc:
             logger.debug("APP: update check failed: %s", exc)
 
+    async def _check_for_pro_update(self) -> None:
+        """Re-download the PRO package in the background if a newer build
+        has been published, then notify so the user knows to restart.
+
+        No-op (silently) if there's no active PRO license or the package was
+        never downloaded in the first place — see
+        pentool.core.license.check_and_update_pro_package for the actual
+        build_id comparison logic.
+        """
+        import asyncio as _asyncio
+        await _asyncio.sleep(4.0)  # after the pip-update check, UI settled
+        try:
+            from pentool.core.license import check_and_update_pro_package
+            updated = await check_and_update_pro_package()
+            if updated:
+                self.notify(
+                    "PRO package updated to the latest build — restart Pentool to use it.",
+                    severity="information",
+                    timeout=10,
+                )
+                logger.info("APP: PRO package updated to a newer build")
+        except Exception as exc:
+            logger.debug("APP: PRO update check failed: %s", exc)
+
     def _setup_auto_save(self) -> None:
         """Configure / restart the auto-save timer from the current config.
 
@@ -649,6 +715,24 @@ class PentoolApp(App):
         except Exception:
             pass
 
+    def _on_storage_error(self, message: str) -> None:
+        """ProxyService.init_storage()/switch_db() failed to open the DB.
+
+        Most common cause: the project's .db file is locked by another
+        process (e.g. a second Pentool instance already has it open) or the
+        path is unwritable. Previously this was logged only — requests
+        silently stopped being saved to history with no visible indication
+        why. init_storage()/switch_db() both run on the app's own event
+        loop (awaited directly, never from a worker thread), so a plain
+        notify() here is safe without call_from_thread.
+        """
+        self.notify(
+            f"{message}\n\nRequests will not be saved until this is fixed — "
+            f"check that no other Pentool instance has this project open.",
+            severity="error",
+            timeout=8,
+        )
+
     def show_context_menu(
         self,
         items: list[tuple[str, str]],
@@ -769,11 +853,22 @@ class PentoolApp(App):
                 await self._proxy._server.serve_forever()
         except Exception as exc:
             logger.error("Proxy error: %s", exc)
+            # Surface this to the user — previously only logged, so a
+            # "port already in use" / "another process holds this file"
+            # failure looked like the proxy silently did nothing when the
+            # toolbar button was pressed, with no clue why.
+            msg = str(exc) or type(exc).__name__
+            self.call_from_thread(
+                self.notify,
+                f"Proxy failed to start: {msg}",
+                severity="error",
+                timeout=6,
+            )
         finally:
             self.call_from_thread(self._update_status)
             self.call_from_thread(self._update_proxy_screen_labels)
             self.call_from_thread(self._update_dashboard_proxy_status, False)
-            self.call_from_thread(self.flash, "○ Proxy остановлен", "warning")
+            self.call_from_thread(self.flash, "○ Proxy stopped", "warning")
 
     def _stop_proxy(self) -> None:
         logger.info("APP: _stop_proxy called")

pentool-0.2.2/pentool/tui/dialogs/__init__.py

@@ -0,0 +1,9 @@
+"""tui.dialogs package: modal dialogs shared across screens.
+
+extend_path lets the PRO package (pro/pentool/tui/dialogs/, e.g.
+checks_dialog.py) merge into this namespace the same way
+pentool.tui/pentool.tui.screens already do — see pentool/tui/__init__.py
+and pentool/tui/screens/__init__.py for the same pattern.
+"""
+import pkgutil
+__path__ = pkgutil.extend_path(__path__, __name__)

{pentool-0.2.0 → pentool-0.2.2}/pentool/tui/screens/target/screen.py

@@ -50,8 +50,6 @@ class TargetScreen(Widget):
                 tooltip="Crawl the selected host in the tree with the Spider"
             )
             yield Static(" │ ", classes="toolbar-sep")
-            yield ToolbarButton("↺ Reload from DB",     "btn-refresh")
-            yield Static(" │ ", classes="toolbar-sep")
             yield ToolbarButton("🗑 Clear",             "btn-clear")
             yield Static(" │ ", classes="toolbar-sep")
             yield ToolbarButton("📄 Export JSON",       "btn-export")
@@ -64,7 +62,7 @@ class TargetScreen(Widget):
                 yield RichLog(id="detail-log", markup=True, highlight=False)
 
         yield Static(
-            "Refresh: Reload site map  │  Scope: Add/Remove Scope  │  M: Context menu",
+            "Scope: Add/Remove Scope  │  M: Context menu",
             id="status-bar",
         )
 
@@ -79,6 +77,17 @@ class TargetScreen(Widget):
         return self._target_api
 
     def _load_sitemap(self) -> None:
+        # Reset selection/details BEFORE the async reload — otherwise a stale
+        # node from the previous project stays shown in the Details panel
+        # until the user clicks something in the new tree (looks like an
+        # artifact "leaking" between projects).
+        self._selected_host = None
+        self._selected_node_data = None
+        try:
+            self.query_one("#detail-log", RichLog).clear()
+        except Exception:
+            pass
+
         # Save current scope hosts before reload
         scope_hosts: set[str] = set()
         try:
@@ -243,10 +252,6 @@ class TargetScreen(Widget):
     def on_btn_crawl_host(self, _: ToolbarButton.Pressed) -> None:
         self.action_crawl_selected_host()
 
-    @on(ToolbarButton.Pressed, "#btn-refresh")
-    def on_btn_refresh(self, _: ToolbarButton.Pressed) -> None:
-        self._load_sitemap()
-
     @on(ToolbarButton.Pressed, "#btn-clear")
     def on_btn_clear(self, _: ToolbarButton.Pressed) -> None:
         self.action_clear()
@@ -314,6 +319,12 @@ class TargetScreen(Widget):
             api = self._get_api()
             api.clear()
             self._build_tree({})
+            self._selected_host = None
+            self._selected_node_data = None
+            try:
+                self.query_one("#detail-log", RichLog).clear()
+            except Exception:
+                pass
             self.app.notify("Site map cleared", severity="information")
         except Exception as exc:
             logger.warning("_clear_worker: %s", exc)