2 Commits

Include renames

Author	SHA1	Message	Date
Hardik Zinzu	4a9c3d0075	feat: interactive TUI, self-update & native settings; apply community bug fixes ... Interactive terminal UI (Textual, default on a TTY) - Category browser with live tool counts; type to search EVERY tool across all categories; up/down move, Enter open, left/Esc back; `/` opens a command palette. - Tool screen gates Run/Install/Uninstall behind a confirm, dropping to a real TTY so a tool can't crash the UI; Open-repo is http(s)-guarded. - The engine is unchanged; `--classic` keeps the full prompt_toolkit REPL and the headless `--engagement` orchestrator is untouched. Update awareness + self-update helper - Cached-daily GitHub Releases check (offline-safe, opt-out via HACKINGTOOL_NO_UPDATE_CHECK / update_check config); shows an "update available" line on the main screen via a background worker (never blocks first render). - `/update` detects the install method (pipx/pip/apt/docker/source) and shows the exact upgrade command to copy - it never runs it. Native settings + config hygiene - `/update`/`/config` run as in-TUI screens instead of suspending to prompt_toolkit (which raised "event loop already running" nested under Textual). - Sponsor feed URL moved from user config to a fixed code constant (SPONSORS_URL); update_check is now a proper bool toggle. Docker / README - Docker image references aligned to hardikzinzu/hackingtool. - README refreshed for the interactive UI; first screenshot replaced with the new UI. Community-reported bug fixes (verified still present in current code) - Data safety: atomic JSON/YAML writes (#773, #765); malformed config.json no longer crashes load/import (#775); UTF-8 for catalog/settings IO (#766); findings parsers skip non-object/typed records instead of aborting (#768); pipeline decodes invalid bytes and salvages timed-out evidence (#771, #770). - AI layer: reject null/non-text provider responses (#778); auto-mode connection test honors the Ollama fallback (#779); settings stay responsive during the AI probe (#780); one findings snapshot per AI report (#772). - CLI/REPL: `@nmap`/`@sqlmap` resolve canonically instead of fuzzy mis-hits (#767); bare `/` no longer crashes the REPL (#761); bad/incomplete args exit non-zero instead of opening the menu (#763); search/tag result #99 is reachable (#762); background pane creation failures are reported, not shown as "started" (#777); config/API-key save failures surface without closing settings (#776). - Misc: .dockerignore keeps README.md for the build (#781); PortScan prompt markup fixed (#698); uninstall command lines use [warning] not [error] (#666, #663); untrusted-output fence can't be broken out of + script import fix (#757).	2026-10-15 19:01:16 +05:30
Hardik Zinzuvadiya	2482cc9fd0	feat: AI operator console — 215 curated tools, AI layer, /find discovery (v2.0.0 rework) ... Squashed rework of hackingtool from a tool launcher into an AI-guided operator console for authorized security testing. 93 commits collapsed into this one; the pre-rework tree is tagged v2.0.0. CATALOG & ENGINE - Data-driven YAML catalog (21 categories, 215 live tools + 59 archived) with a registry/overlay loader and a fixed 66-tag taxonomy (63 in use). Adding a tool is one YAML entry, not edits across the codebase. - Engine honesty: real exit codes, truthful install success/failure, reuse-first skip, EOF-safe prompts, command audit logging. - Safe installs: sha256-required safe-fetch (killed `curl | bash` in feroxbuster, Caido and Sliver), list-form subprocess only, no forced sudo. AI LAYER (bring-your-own-key or local model; degrades offline, never fabricates) - AI1 intent -> tools; AI2 tool+goal -> command, curated-first with a grounded fallback; AI3 findings summary and engagement report; AI4 per-finding impact and remediation. Prompt-injection hardened per OWASP LLM01. - /goal plans an objective and runs it one step at a time, showing every command before it runs, with a plan.json + run.log audit trail. /find TOOL DISCOVERY (this branch's headline feature) - Suggests real GitHub projects when the catalog has no tool for a need. Deterministic: zero model calls, structured API fields only, suggest-only — it never clones, installs or runs anything. - A charter filter refuses destructive/DoS/jamming/mass-targeting/evasion asks before any network I/O, while a defensive-intent guard keeps blue-team and DFIR phrasing ("detect a SYN flood in a pcap") from being false-refused. - Query rewriting proved to be the dominant quality lever (the first design measured 29% precision with no results on 5 of 8 needs): a curated 41-row intent table maps plain English to canonical jargon plus a GitHub topic, and a two-arm search unions topic coverage with jargon precision. - Explainable additive ranking: log-flattened stars, license/age/language, trusted-author bonus derived from owners we already ship, docs-repo demotion by name, staleness as a soft demotion rather than a filter (a hard cutoff would delete THC-Hydan and John the Ripper), and a relevance term weighting curated topics above free-text description. - Optional no-scope GitHub token purely as a rate-limit lever (10 -> 30 req/min); it reaches only an Authorization header, never a cache key, log or output. - `[a]` saves a pick to ~/.hackingtool/found.yaml as a structurally inert entry, and the loader strips executable keys from user catalogs at read time so a hand-edited file cannot become a runnable command. CONSOLE & PACKAGING - REPL with a / command palette, @ tool mentions, tag filters, history and completion; background tmux panes; settings and first-run scaffolding. - src-layout package with catalog and pipelines as package data, console entry point, Docker image, signed releases with SBOM and build provenance. - Health docs (SECURITY, CONTRIBUTING, CHANGELOG, CODE_OF_CONDUCT), a CI gate (ruff + pytest + catalog/taxonomy conformance) and a pre-push hook. - README rewritten with a section index, the tool catalog split into docs/TOOLS.md and a step-by-step docs/HOW-TO-USE.md. 278 tests passing; scripts/check.sh green.	2026-07-27 00:18:34 +05:30