fix: post-0.2.0 tester feedback — tool discipline, subagent UX, upgrade#1
Merged
Conversation
Prompts (tool discipline): - webapp: Authenticated Testing block (auth goes via ffuf/gobuster/nuclei/ sqlmap -H/-b/--cookie, not hand-run curl); Injection→sqlmap block with a single-recon-curl exception for Next.js RSC/Server Actions, then sqlmap -r + sqlmap_parse; Long-running Fuzz block (-maxtime, background, separate parse, drop -s, lower -t on throttle); narrow the line-118 loophole so "PoC bytes" can't justify manual payload sweeps. - pentest.txt: mirror the auth/injection/maxtime discipline next to NO CURL LOOPS. - Skills now MANDATORY just-in-time (one at a time) across webapp + scanner, enumerator, exploiter, infrastructure, identity, post-exploit; coordinator delegates skill-loading to subagents. - web-server skill: mirror auth/injection/maxtime; add -maxtime to ffuf example. Coordinator delegation (prompt-only): - pentest.txt + orchestrator-mode.txt: narrow the do-it-yourself whitelist to one command, add "dispatch then wait — don't grab the work back". Subagent management (TUI + registry): - subagent-bar: show only running subagents; finished drop out (reachable via session list). - session nav (←/→): cycle active subagents only (present session_status entry); makes overflow beyond the bar reachable too. - background-job: prune finished jobs to a 30-entry tail so <live-subagents> and state_query subagents stop growing unbounded; running never pruned. Upgrade: - upgradeCurl: fetch install.sh from raw main (release asset was dropped in eb77230) and pass PENTESTCODE_VERSION so `pentestcode upgrade` works again. - app.tsx: drop stray console.log in the update-available handler (garbled TUI). Branding: - sidebar footer plugin: "Open"→"Pentest" (it overrode the rebranded default).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Batch fix from live 0.2.0 tester feedback. Bumps version → 0.2.1.
Prompts — tool discipline
Authenticated Testingblock (auth is carried by ffuf/gobuster/nuclei/sqlmap via-H/-b/--cookie, not hand-run curl);Injection → sqlmapblock with a single recon-curl exception for Next.js RSC/Server Actions, thensqlmap -r+sqlmap_parse;Long-running Fuzzblock (-maxtime, background, separate parse, drop-s, lower-ton throttle); narrowed the line-118 loophole (single curl only to PoC a confirmed finding, not to detect).NO CURL LOOPS.-maxtimeto the ffuf example.Coordinator delegation — prompt only
pentest.txt+orchestrator-mode.txt: narrowed the do-it-yourself whitelist to one command; added "dispatch, then wait — don't grab the work back".Subagent management (TUI + registry)
session_statusentry); this also makes subagents beyondMAX_ROWSreachable.core/background-job.ts): prune finished jobs to a 30-entry tail so<live-subagents>andstate_query subagentsstop growing unbounded; running jobs are never pruned.Upgrade
upgradeCurl: fetchinstall.shfrom raw main (the release asset was dropped in eb77230) and passPENTESTCODE_VERSION→pentestcode upgradeworks again.app.tsx: drop a strayconsole.login the update-available handler (it garbled the TUI render).Branding
Open→Pentest(it overrode the already-rebranded default).Verified
bun turbo typecheck19/19.PENTESTCODE_VERSION.Rollout
curl … install.sh | bash), because 0.2.0'supgradeCurlis still broken; after thatpentestcode upgradeself-heals. Bundled skills re-seed automatically on the first launch of the new binary (embedded bundle version changes); prompts ship inside the binary.