Skip to content

v0.1.1 — 24 fixes since v0.1.0

Latest
Latest

Choose a tag to compare

View all tags
@NeoTheCapt NeoTheCapt released this 06 May 18:09
· 17 commits to master since this release
v0.1.1
8b317ce

RedTeam Agent v0.1.1

Maintenance release — 24 commits collected since v0.1.0 (4 days of autonomous auditor cycles + 2 deep meta-audits). Same install path, just bumped to the new tag.

bash <(curl -fsSL https://raw.githubusercontent.com/NeoTheCapt/RedteamAgent/v0.1.1/install.sh) docker
cd ~/redteam-docker && ./run.sh
# inside the TUI:
/autoengage http://your-target:8080

🛠 What's fixed

Backend reconcile (orchestrator/backend/app/services/runs.py + launcher.py)

  • Continuous-observation hold preservation correctly distinguishes genuinely-completed holds from detached holds with stale queue_incomplete / runtime_disappeared log entries — the latter now route to _maybe_auto_resume_run instead of being silently flipped to completed. reason_text="continuous observation hold detached" restored.
  • Bounded-blocker classification: completed runs whose stop_reason_text documents an exhaustive bounded queue closure are kept terminal as completed_with_blockers instead of being demoted to failed/incomplete_terminal_state by the reconciler.
  • Metasploit MCP env defaults: workspace/.env now ships with non-blank MSF_* defaults so the in-container helpers connect on first launch; explicit project overrides still win.
  • /engage --auto direct launch replaces the prior /autoengage indirection — fewer command layers, simpler runtime detection.

Agent operator-core (agent/operator-core.md + CLAUDE.md + AGENTS.md)

  • Auth-respawn dispatch now uses real task @recon-specialist / task @source-analyzer calls instead of bookkeeping-only text that could trigger permission prompts in autonomous mode.
  • CTF recall closure gate hardened: explicit named challenge lists for FTP / Web3 / NFT / Database Schema / Upload Type / Password Strength branches, and pre-report verification that all peak-solved challenges have current solved-state evidence.
  • New "incomplete recall blocker requeue" rule: if a closure batch proves the technical primitive but the named peak-solved challenge stays unsolved, the case must be requeued with the next concrete challenge-triggering action rather than retired clean.

New regression contracts

agent/scripts/check_operator_respawn_contract.py, check_operator_prompt_contract.py, check_sensitive_data_skill_contract.py, check_exploit_developer_prompt_contract.py — focused contract scripts that fail loudly if any of the above guarantees regress.

Plus a few audit-found stale-test catches: tests/agent/test_exploit_developer_prompt_guardrails.py, tests/orchestrator/backend/test_launcher.py (loopback rewriting + workspace-env baseline), tests/orchestrator/backend/test_runs.py (continuous-hold ignores stale stop reason) all updated to track post-rewording behavior.

Auth helper hardening (local-hermes-agent/scripts/lib/orchestrator_auth.sh)

  • _refresh_orchestrator_token cooldown now bypasses when current ORCH_TOKEN is empty. Previously the cooldown could trap the 401-retry path with an empty bearer header — would emit the same orch_api FND every cycle until the cooldown TTL expired.

📦 Compatibility

  • Same docker image (redteam-allinone:latest), no rebuild required if you've already pulled v0.1.0
  • Same install command structure — only the tag in the URL changed (v0.1.0 → v0.1.1)
  • Same per-project config — Auth / Env / Crawler / Parallel / Agents tabs unchanged
  • Same CLI commands — /engage, /autoengage, /resume, /status, /queue, /report, etc.

📥 Upgrade

If you installed v0.1.0:

# Force-reinstall from v0.1.1 tag
bash <(curl -fsSL https://raw.githubusercontent.com/NeoTheCapt/RedteamAgent/v0.1.1/install.sh) docker
# or, if you want to pin a different ref:
REDTEAM_REF=v0.1.1 bash <(curl -fsSL https://raw.githubusercontent.com/NeoTheCapt/RedteamAgent/v0.1.1/install.sh) docker

Engagement workspaces from v0.1.0 keep working — this release only changes orchestrator-side reconcile behavior and operator-prompt guardrails; nothing in the engagement file format changed.

🙏 Acknowledgements

Built on top of OpenCode, Claude Code, Codex, Katana, mitmproxy, Metasploit Framework, and the broader Kali Linux toolchain.

For authorized security testing only. All targets must be CTF / lab / explicitly-authorized environments.

Assets 2
Loading