Darkmoon v1.4.0 — LLM/AI endpoint pentest agent, privacy gateway hardening & garak toolbox

This release adds a dedicated LLM / AI inference-endpoint pentest agent, closes several privacy-gateway leaks found during live engagements, and extends the toolbox with NVIDIA's garak LLM vulnerability scanner. Everything below was validated end to end — detection → dispatch → exploitation → report — with no regression to the existing agent roster.

---

🔒 Privacy gateway hardening

The privacy gateway tokenizes sensitive values (IPs, hosts, URLs, paths, credentials) into reversible placeholders so the model never sees your real infrastructure, and rehydrates them only when the final report is written. This release closes gaps found while running real assessments:

• Pre-model prompt tokenization (issue #40). Your prompt is now anonymized before it reaches the model — from both the terminal and the UI — through an opencode plugin that routes it to the persistent MCP privacy vault over a local socket. The same session ID means the report still rehydrates the real values. Previously only tool inputs and outputs were tokenized, so the very first prompt could carry raw values straight to the model.
• Output / restitution leak closure. Fixed leaks discovered during a live Active Directory engagement where real values could resurface in tool output and in the finalized report.
• A command substitution could carry a value to a third party. Closed: exfiltration checks are now decoupled from structural safety checks in the command gateway.
• Slug-safe report filename. finalize_campaign rehydrated the target host into the report filename; a URL target such as http://host:port injected / and : and broke the write path. The host is now slugified — the report content still carries the real, rehydrated values.
• Per-session privacy override (PR #42). The gateway now supports a per-session override and degrades gracefully (tokenize-and-continue) instead of refusing a command when a value cannot be classified.

🤖 LLM / AI endpoint pentest agent (new specialist)

A new llm specialist brings the same methodology discipline as the rest of the roster to LLM/AI inference endpoints, aligned with the OWASP LLM Top 10.

• Automatic detection & dispatch. pentest.md now probes for LLM/AI inference endpoints during discovery — OpenAI-compatible /v1/models, Ollama /api/tags, vLLM / TGI / llama.cpp banners, openai-* and x-ratelimit-* headers — and dispatches the llm agent on a positive artifact, exactly like the GraphQL, Active Directory and Kubernetes agents.
• Methodology. Fingerprint → capability profiling → optional systematic garak pass → adaptive manual OWASP-LLM attacks with explicit detectors and a per-run canary token → manual confirmation of every hit before it is reported. Bounded throughout to avoid uncontrolled denial of service.
• Coverage (validated against a deliberately-vulnerable OpenAI-compatible target). System-prompt leakage and hard-coded credential disclosure (LLM07 / LLM06), prompt injection, jailbreak and guardrail bypass (LLM01 / LLM09), insecure output handling / XSS (LLM02), unbounded consumption and missing rate limiting (LLM04 / LLM10), SSRF via the model (LLM05), plus unauthenticated access and input-validation gaps — eight findings, each with the exact request, the raw response and the proof behind it.
• The agent is both the attacker and the judge (curl / python3 / jq), so it degrades cleanly to its manual methodology when garak is unavailable.

🧰 Toolbox

• garak — NVIDIA's LLM vulnerability scanner (Apache-2.0) — is added to the toolbox and the tool allow-list, pinned to 0.16.0 for reproducible builds. It is installed CPU-only (it scans a remote endpoint, so no GPU is needed) and the install is non-blocking: if it fails, the image still builds and the llm agent falls back to its manual methodology.
• Resilient firmwalker fetch. The upstream craigz28/firmwalker repository was deleted (404), which broke every toolbox rebuild. The Dockerfile now falls back to a mirror and continues best-effort if neither source is reachable.

✅ Validation

• End to end on the built image: detection → dispatch → exploitation → auto-finalized report with rehydrated real values, zero residual placeholders, and zero loopback leakage to the model (verified across the full model-facing traffic).
• Toolbox non-regression: every existing tool is still advertised and functional after the rebuild; garak verified functional against an OpenAI-compatible endpoint.
• No change to the behavior of the existing agent roster.