pentool 0.2.3__tar.gz → 0.2.4__tar.gz

{pentool-0.2.3 → pentool-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pentool
-Version: 0.2.3
+Version: 0.2.4
 Summary: Modern Web Pentesting TUI - Professional security testing tool
 Author-email: Pentool Team <dev@pentool.pro>
 License: AGPL-3.0
@@ -130,6 +130,11 @@ Fast, transparent, and built for real-world testing.
 # Install
 pip install pentool
 
+# Start a 14-day PRO trial (unlocks Scanner + other PRO features)
+# Run this BEFORE first launching the TUI — if the TUI is already open,
+# restart it afterwards so it picks up the new license.
+pentool license trial
+
 # Launch TUI
 pentool
 

{pentool-0.2.3 → pentool-0.2.4}/README.md

@@ -84,6 +84,11 @@ Fast, transparent, and built for real-world testing.
 # Install
 pip install pentool
 
+# Start a 14-day PRO trial (unlocks Scanner + other PRO features)
+# Run this BEFORE first launching the TUI — if the TUI is already open,
+# restart it afterwards so it picks up the new license.
+pentool license trial
+
 # Launch TUI
 pentool
 

{pentool-0.2.3 → pentool-0.2.4}/pentool/__init__.py

@@ -1,6 +1,6 @@
 """Pentool — professional web security testing toolkit with Textual TUI."""
 
-__version__ = "0.2.3"
+__version__ = "0.2.4"
 __author__ = "pentool"
 
 

{pentool-0.2.3 → pentool-0.2.4}/pentool/api/target_api.py

@@ -83,6 +83,8 @@ class TargetAPI(ExportableAPI):
                 try:
                     node = SiteNode.from_dict(node_dict)
                     self._sitemap._nodes.setdefault(host, {})[node.path] = node
+                    if node.in_scope:
+                        self._sitemap._scope_hosts.add(self._sitemap._norm_host(host))
                     loaded += 1
                 except Exception as exc:
                     logger.warning("TargetAPI.import_project_data: skip node: %s", exc)

{pentool-0.2.3 → pentool-0.2.4}/pentool/modules/target.py

@@ -66,6 +66,20 @@ class SiteMap:
         self._db_path = db_path
     # host -> path -> SiteNode
         self._nodes: dict[str, dict[str, SiteNode]] = {}
+        # Scope is tracked independently of _nodes (normalized, port-stripped
+        # host names) so that adding a host to scope from Proxy works even
+        # if Target hasn't seen any traffic for it yet (or saw it under a
+        # host:port key that doesn't match the port-less host the user/Proxy
+        # refers to). Previously set_in_scope() was a no-op unless the exact
+        # host string already existed as a node — a host added to scope
+        # before any matching traffic arrived (or under a different
+        # host:port key) silently never got flagged, with no error raised.
+        self._scope_hosts: set[str] = set()
+
+    @staticmethod
+    def _norm_host(host: str) -> str:
+        """Normalize a host for scope comparisons: lowercase, no port."""
+        return host.split(":")[0].strip().lower()
 
     def add_request(self, req: "ParsedRequest") -> None:
         try:
@@ -79,6 +93,7 @@ class SiteMap:
 
         now = datetime.now(timezone.utc)
         host_map = self._nodes.setdefault(host, {})
+        in_scope = self._norm_host(host) in self._scope_hosts
 
         if path in host_map:
             node = host_map[path]
@@ -92,6 +107,7 @@ class SiteMap:
                 methods={req.method},
                 request_count=1,
                 last_seen=now,
+                in_scope=in_scope,
             )
 
     def get_tree(self) -> dict[str, list[SiteNode]]:
@@ -107,18 +123,38 @@ class SiteMap:
         return sorted(self._nodes.get(host, {}).values(), key=lambda n: n.path)
 
     def get_scope(self) -> list[str]:
-        return [h for h, paths in self._nodes.items() if any(n.in_scope for n in paths.values())]
+        # Union of hosts flagged via nodes (legacy/DB-loaded state) and hosts
+        # registered in _scope_hosts before any matching node existed.
+        node_hosts = {h for h, paths in self._nodes.items() if any(n.in_scope for n in paths.values())}
+        explicit_hosts = {h for h in self._nodes if self._norm_host(h) in self._scope_hosts}
+        return sorted(node_hosts | explicit_hosts)
 
     def get_request_count(self, host: str) -> int:
         return sum(n.request_count for n in self._nodes.get(host, {}).values())
 
     def set_in_scope(self, host: str, in_scope: bool) -> None:
-        """Include/exclude a host from Scope."""
-        if host in self._nodes:
-            for node in self._nodes[host].values():
-                node.in_scope = in_scope
+        """Include/exclude a host from Scope.
+
+        Tracks the (normalized, port-stripped) host in `_scope_hosts`
+        independently of whether a matching node already exists in
+        `_nodes` — a host added to scope before any traffic for it has
+        been seen (or seen under a different host:port key) is still
+        remembered and will be applied to any node for that host,
+        present now or added later via add_request().
+        """
+        norm = self._norm_host(host)
+        if in_scope:
+            self._scope_hosts.add(norm)
+        else:
+            self._scope_hosts.discard(norm)
+        for h, paths in self._nodes.items():
+            if self._norm_host(h) == norm:
+                for node in paths.values():
+                    node.in_scope = in_scope
 
     def is_in_scope(self, host: str) -> bool:
+        if self._norm_host(host) in self._scope_hosts:
+            return True
         paths = self._nodes.get(host, {})
         return any(n.in_scope for n in paths.values())
 
@@ -172,11 +208,14 @@ class SiteMap:
                     in_scope=bool(row["in_scope"]),
                 )
                 self._nodes.setdefault(node.host, {})[node.path] = node
+                if node.in_scope:
+                    self._scope_hosts.add(self._norm_host(node.host))
         except Exception as exc:
             logger.error("SiteMap.load error: %s", exc)
 
     def clear(self) -> None:
         self._nodes.clear()
+        self._scope_hosts.clear()
 
     def export_json(self) -> dict:
         return {

{pentool-0.2.3 → pentool-0.2.4}/pentool/tui/app.py

@@ -1017,6 +1017,12 @@ class PentoolApp(App):
             # out by that reload, making a simple "Add to Scope" click
             # from Proxy appear to clear the whole Target tree.
             target._refresh_tree()
+            # Persist the scope change right away — without this, the
+            # in-memory-only mutation above can be silently discarded by a
+            # later full api.load() from the DB (e.g. on project import),
+            # making the scope change from Proxy appear to have never
+            # happened once the project is reloaded.
+            self.run_worker(api.save(), exclusive=False)
         except Exception as e:
             logger.debug("on_sync_scope_to_target: %s", e)
 

pentool-0.2.4/pentool/tui/dialogs/comment_dialog.py

@@ -0,0 +1,61 @@
+"""CommentDialog — view/edit the comment for a proxy history request.
+
+Standardized on the same compact layout as the other dialogs (ToolbarButton
+flat buttons, compact Input, CSS in a sibling .tcss file) instead of the
+default textual.widgets.Button/Input, which render with full-size borders
+and looked oversized compared to the rest of the app.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from textual import on
+from textual.app import ComposeResult
+from textual.binding import Binding
+from textual.containers import Horizontal, Vertical
+from textual.screen import ModalScreen
+from textual.widgets import Input, Label
+
+from pentool.tui.widgets.toolbar_button import ToolbarButton
+
+_CSS = (Path(__file__).parent / "comment_dialog.tcss").read_text(encoding="utf-8")
+
+
+class CommentDialog(ModalScreen[str | None]):
+    """Dialog: view/edit the comment for the currently-selected request."""
+
+    DEFAULT_CSS = _CSS
+
+    BINDINGS = [Binding("escape", "dismiss(None)", "Cancel")]
+
+    def __init__(self, initial_comment: str = "") -> None:
+        super().__init__()
+        self._initial_comment = initial_comment
+
+    def compose(self) -> ComposeResult:
+        with Vertical(id="dialog"):
+            yield Label("Comment:", id="comment-label")
+            yield Input(
+                value=self._initial_comment,
+                placeholder="Add comment...",
+                id="comment-dialog-input",
+                compact=True,
+            )
+            with Horizontal(id="buttons"):
+                yield ToolbarButton("Save", "btn-save")
+                yield ToolbarButton("Cancel", "btn-cancel")
+
+    def on_mount(self) -> None:
+        self.query_one("#comment-dialog-input", Input).focus()
+
+    @on(ToolbarButton.Pressed, "#btn-save")
+    def on_btn_save(self, _: ToolbarButton.Pressed) -> None:
+        self.dismiss(self.query_one("#comment-dialog-input", Input).value)
+
+    @on(ToolbarButton.Pressed, "#btn-cancel")
+    def on_btn_cancel(self, _: ToolbarButton.Pressed) -> None:
+        self.dismiss(None)
+
+    def on_input_submitted(self, event: Input.Submitted) -> None:
+        self.dismiss(event.value)

pentool-0.2.4/pentool/tui/dialogs/comment_dialog.tcss

@@ -0,0 +1,25 @@
+CommentDialog {
+    align: center middle;
+}
+CommentDialog #dialog {
+    width: 60;
+    height: auto;
+    border: round $primary;
+    background: $surface;
+    padding: 1 2;
+}
+CommentDialog #comment-label {
+    margin-bottom: 1;
+}
+CommentDialog #comment-dialog-input {
+    margin-bottom: 1;
+}
+CommentDialog #buttons {
+    layout: horizontal;
+    height: 1;
+    align: right middle;
+    margin-top: 1;
+}
+CommentDialog #buttons ToolbarButton {
+    margin-left: 1;
+}

{pentool-0.2.3 → pentool-0.2.4}/pentool/tui/screens/dashboard/live_dashboard.py

@@ -277,8 +277,17 @@ class HeatmapWidget(Widget):
         yield Static("[bold]┌─ HOST HEATMAP ─[/bold]")
         yield Static("", id="heatmap-body")
 
+    _MAX_HOSTS = 500
+
     def increment_host(self, host: str) -> None:
         self._host_counts[host] = self._host_counts.get(host, 0) + 1
+        if len(self._host_counts) > self._MAX_HOSTS:
+            # Only the top 6 are ever displayed — keep a generous top slice
+            # and drop the long tail of one-off hosts.
+            keep = dict(
+                sorted(self._host_counts.items(), key=lambda x: -x[1])[: self._MAX_HOSTS // 2]
+            )
+            self._host_counts = keep
         self._update_display()
 
     def _update_display(self) -> None:
@@ -541,6 +550,8 @@ class MiniSiteMap(Widget):
         yield Static("[bold]┌─ SITE MAP ─[/bold]")
         yield Static("", id="sitemap-body")
 
+    _MAX_PATHS = 500
+
     def add_url(self, url: str) -> None:
         """Add a URL to the mini-map."""
         try:
@@ -550,6 +561,13 @@ class MiniSiteMap(Widget):
             parts = [p for p in parsed.path.split("/") if p]
             key = "/" + "/".join(parts[:2]) if parts else "/"
             self._paths[key] = self._paths.get(key, 0) + 1
+            if len(self._paths) > self._MAX_PATHS:
+                # Only the top 8 are ever displayed — keep a generous top
+                # slice and drop the long tail of one-off paths.
+                keep = dict(
+                    sorted(self._paths.items(), key=lambda x: -x[1])[: self._MAX_PATHS // 2]
+                )
+                self._paths = keep
             self._update_display()
         except Exception:
             pass

{pentool-0.2.3 → pentool-0.2.4}/pentool/tui/screens/proxy/screen.py

@@ -95,16 +95,16 @@ def _row_to_record(r: dict) -> tuple:
     else:
         time_str = "-"
 
-    # Prepend color dot to Host column if the request has a color mark
-    # (color IS the tag — variant A — so one dot covers both concepts).
-    # Also append a 💬 marker if the request has a non-empty comment, so
-    # marked/commented requests are visible in the list without opening them.
+    # Prepend color dot and/or 💬 comment marker to Host column — both are
+    # left-aligned prefixes so marked/commented requests are visible in the
+    # list without opening them.
     host = str(r.get("host", "") or "")
     color = str(r.get("color", "") or "")
     dot = _COLOR_DOTS.get(color, "")
     comment = str(r.get("comment", "") or "")
-    comment_marker = " 💬" if comment.strip() else ""
-    host_display = f"{dot} {host}{comment_marker}" if dot else f"{host}{comment_marker}"
+    comment_marker = "💬 " if comment.strip() else ""
+    prefix = f"{dot} " if dot else ""
+    host_display = f"{prefix}{comment_marker}{host}"
 
     return (
         r.get("id", 0),
@@ -257,6 +257,11 @@ class ProxyScreen(RequestContextMenuMixin, AppMixin, Widget):
         # Debounce: batch rapid row appends into one incremental add_rows() call
         self._pending_append_rows: list[tuple] = []  # (req, row_id) pairs
         self._debounce_timer = None
+        # Cap on in-memory _rows_cache size — beyond this, oldest loaded rows
+        # are dropped and _history_oldest_offset is bumped so "scroll up to
+        # load more" can re-fetch them from storage on demand instead of
+        # keeping the whole session's history resident in memory forever.
+        self._ROWS_CACHE_MAX = 5000
         # "Showing N of M" + scroll-up-to-load-more state (HTTP History only)
         self._history_total: int = 0       # total rows matching current filters (from COUNT(*))
         self._history_oldest_offset: int = 0  # how many older rows are NOT yet loaded (above what's in _rows_cache)
@@ -837,6 +842,24 @@ class ProxyScreen(RequestContextMenuMixin, AppMixin, Widget):
             table.scroll_end(animate=False)
         except Exception as exc:
             logger.debug("PROXY SCREEN: _flush_pending_rows: %s", exc)
+        # Cap unbounded growth of the in-memory cache during very long
+        # sessions: drop the oldest rows once we exceed the cap and mark
+        # them as available again via _history_oldest_offset so scrolling
+        # up re-fetches them from storage instead of leaking memory.
+        if len(self._rows_cache) > self._ROWS_CACHE_MAX:
+            overflow = len(self._rows_cache) - self._ROWS_CACHE_MAX
+            self._rows_cache = self._rows_cache[overflow:]
+            self._history_oldest_offset += overflow
+            try:
+                table = self.query_one("#request-list", DataTable)
+                arrow = _rows_to_arrow(self._rows_cache)
+                table.backend = ArrowBackend(arrow)
+                table._ordered_columns = None
+                table._clear_caches()
+                table._require_update_dimensions = True
+                table.scroll_end(animate=False)
+            except Exception as exc:
+                logger.debug("PROXY SCREEN: _rows_cache trim rebuild failed: %s", exc)
         self._update_history_count_label()
 
     def _select_row(self, row_idx: int) -> None:
@@ -2087,53 +2110,15 @@ class ProxyScreen(RequestContextMenuMixin, AppMixin, Widget):
         req_id = self._selected_req_id
         if not req_id:
             return
-        from textual.screen import ModalScreen
+        from pentool.tui.dialogs.comment_dialog import CommentDialog
 
         initial_comment = initial_comment if initial_comment is not None else self._current_comment
 
-        class CommentDialog(ModalScreen):
-            DEFAULT_CSS = """
-            CommentDialog > Vertical {
-                width: 60;
-                height: auto;
-                border: round $primary;
-                padding: 1 2;
-                background: $panel;
-            }
-            CommentDialog Input { margin: 1 0; }
-            CommentDialog Horizontal { align: center middle; height: auto; }
-            CommentDialog Button { margin: 0 1; }
-            """
-
-            def compose(self) -> ComposeResult:
-                with Vertical():
-                    yield Label("Comment:")
-                    yield Input(
-                        value=initial_comment,
-                        placeholder="Add comment...",
-                        id="comment-dialog-input",
-                    )
-                    with Horizontal():
-                        yield Button("Save", id="save", variant="primary")
-                        yield Button("Cancel", id="cancel")
-
-            def on_mount(self) -> None:
-                self.query_one("#comment-dialog-input", Input).focus()
-
-            def on_button_pressed(self, event: Button.Pressed) -> None:
-                if event.button.id == "save":
-                    self.dismiss(self.query_one("#comment-dialog-input", Input).value)
-                else:
-                    self.dismiss(None)
-
-            def on_input_submitted(self, event: Input.Submitted) -> None:
-                self.dismiss(event.value)
-
         def _on_comment(comment: str | None) -> None:
             if comment is not None:
                 self.run_worker(self._save_comment(req_id, comment))
 
-        self.app.push_screen(CommentDialog(), _on_comment)
+        self.app.push_screen(CommentDialog(initial_comment), _on_comment)
 
     async def _save_comment(self, request_id: int, comment: str) -> None:
         """Save comment to database."""

{pentool-0.2.3 → pentool-0.2.4}/pentool/tui/screens/target/screen.py

@@ -93,14 +93,14 @@ class TargetScreen(Widget):
         try:
             api = self._target_api
             if api is not None:
-                # Was api.sitemap.hosts() — no such method (only get_hosts()
-                # exists). The AttributeError was swallowed by the bare
-                # except below, so scope_hosts silently stayed empty and
-                # the in-memory scope set by SyncScopeToTarget (Proxy →
-                # Target sync) was wiped by the api.load() reload in
-                # _load_worker() with nothing to restore it — this was the
-                # actual cause of "scope star missing after switching to
-                # Target following an Add to Scope from Proxy".
+                # Defense in depth: SiteMap now tracks scope in its own
+                # _scope_hosts set (independent of whether a node exists
+                # yet) and load() re-seeds it from the DB's in_scope
+                # column — so this manual save/restore is no longer the
+                # only thing keeping scope alive across a reload. Kept
+                # anyway in case _target_api is swapped for a fresh
+                # instance (whose _scope_hosts would start empty) between
+                # scope changes and the reload.
                 for host in api.sitemap.get_hosts():
                     if api.sitemap.is_in_scope(host):
                         scope_hosts.add(host)

{pentool-0.2.3 → pentool-0.2.4}/pentool.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pentool
-Version: 0.2.3
+Version: 0.2.4
 Summary: Modern Web Pentesting TUI - Professional security testing tool
 Author-email: Pentool Team <dev@pentool.pro>
 License: AGPL-3.0
@@ -130,6 +130,11 @@ Fast, transparent, and built for real-world testing.
 # Install
 pip install pentool
 
+# Start a 14-day PRO trial (unlocks Scanner + other PRO features)
+# Run this BEFORE first launching the TUI — if the TUI is already open,
+# restart it afterwards so it picks up the new license.
+pentool license trial
+
 # Launch TUI
 pentool
 

{pentool-0.2.3 → pentool-0.2.4}/pentool.egg-info/SOURCES.txt

@@ -72,6 +72,8 @@ pentool/tui/project_manager.py
 pentool/tui/dialogs/__init__.py
 pentool/tui/dialogs/cert_dialog.py
 pentool/tui/dialogs/cert_dialog.tcss
+pentool/tui/dialogs/comment_dialog.py
+pentool/tui/dialogs/comment_dialog.tcss
 pentool/tui/dialogs/file_selector.py
 pentool/tui/dialogs/file_selector.tcss
 pentool/tui/dialogs/load_from_proxy.py

{pentool-0.2.3 → pentool-0.2.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pentool"
-version = "0.2.3"
+version = "0.2.4"
 description = "Modern Web Pentesting TUI - Professional security testing tool"
 authors = [
     {name = "Pentool Team", email = "dev@pentool.pro"}