v0.3.8

Highlights

• Rust ratatui TUI 全面移植 — 移植 DeepSec 的 Rust TUI，取代 Textual；thinking/content 流式输出按段落缓冲，不再逐词断行
• Context Vault 选择性归档 — ref 标签、分层蒸馏、保护区、restore/search、phantom guard；python -m vulnclaw 入口补齐
• i18n 双语 UI（默认英文 + agent 语言检测） — 41+ 新翻译键 en/zh 对称，英文关键词表纯追加不破坏中文匹配，/language 命令实时切换
• MCP 运行时修复 — read_timeout_seconds 改为纯浮点秒数，修复 chrome-devtools/burp/stdio/SSE/HTTP 工具首次调用即崩溃的问题
• Ollama 本地模型支持 — 接入本地 Ollama 推理
• Docker KB / Web 鉴权修复 — KB 面板本地化，loopback 客户端放行，鉴权豁免精确路径匹配
• 子 Agent 扇出 / 冷热记忆 / 上下文预算 — 延续 v0.3.7 架构能力（已在 v0.3.7 发布，此处为后续增量）

What's Changed

• feat(i18n): bilingual UI with English default + agent language detection by @reblox01 in #194
• fix(tui): buffer thinking/content tokens in JsonlStreamSink by @Unclecheng-li in #192
• fix: add vulnclaw/main.py so python -m vulnclaw works by @Unclecheng-li in #190
• fix(mcp): pass read_timeout_seconds as float, not timedelta (#171) by @NoiceHax in #188
• docs: list solve and plugins in the --help command snippet (#157) by @NoiceHax in #187
• Fix/report language by @mn-youssef in #183
• Fix/docker kb and web auth by @mn-youssef in #182
• Feat/ollama local models by @mn-youssef in #181
• fix(cli): 修复 REPL 持续模式提示词元组错误 #163 by @Eric-Terminal in #168

Full Changelog: v0.3.7...v0.3.8

What's Changed

• main文件463行以前的i18n by @zgyhim in #152
• fix: 修复上下文截断并实现冷热记忆分离 by @zhuge-Tom in #156
• 核心架构层修复 → TUI/Web 层修复 → 测试分层重组与覆盖加固 by @Nyaecho in #155
• feat(subagent): 引入sub-agents机制 by @FarStar-CN in #159
• fix: 限制工具循环局部上下文预算 by @zhuge-Tom in #162
• Feature/unclec by @Unclecheng-li in #164
• Dev by @Unclecheng-li in #165
• fix(cli): 修复 REPL 持续模式提示词元组错误 #163 by @Eric-Terminal in #168
• Feat/ollama local models by @mn-youssef in #181
• Fix/docker kb and web auth by @mn-youssef in #182
• Fix/report language by @mn-youssef in #183
• Feature/unclec by @Unclecheng-li in #186
• docs: list solve and plugins in the --help command snippet (#157) by @NoiceHax in #187
• fix(mcp): pass read_timeout_seconds as float, not timedelta (#171) by @NoiceHax in #188
• fix: add vulnclaw/main.py so python -m vulnclaw works by @Unclecheng-li in #191
• fix(tui): buffer thinking/content tokens in JsonlStreamSink by @Unclecheng-li in #192
• fix: add vulnclaw/main.py so python -m vulnclaw works by @Unclecheng-li in #190
• feat(i18n): bilingual UI with English default + agent language detection by @reblox01 in #194
• Feature/unclec by @Unclecheng-li in #196
• Dev by @Unclecheng-li in #197
• fix(ci): point release preflight at tests/meta/test_release.py by @Unclecheng-li in #198

New Contributors

• @zgyhim made their first contribution in #152
• @zhuge-Tom made their first contribution in #156
• @Eric-Terminal made their first contribution in #168
• @mn-youssef made their first contribution in #181
• @NoiceHax made their first contribution in #187
• @reblox01 made their first contribution in #194

Full Changelog: v0.3.7...v0.3.8

v0.3.7

Highlights

• 模型驱动并行子 Agent 扇出 — spawn_subagents 工具让主模型一轮内并发探索多个独立攻击方向；子证据合并回父状态统一重分配 eNNN，带完整生命周期预算与安全上限（max_depth 硬顶 2）
• TUI 子代理实时监控面板 — 私有 JSON 行协议实时展示每个子代理角色/状态/步数/进展，独立 run_id + 事件 token 防旧 worker 污染
• 冷热记忆分离 — 热上下文默认 48 条 / 32K token，超出自动归档到冷记忆 JSONL 分片，memory_search 按需检索；大工具输出自动归档为指针+预览
• 统一上下文预算与结构化压缩 — prepare_context() 唯一预算入口覆盖全部 LLM 路径；70% 触发、55% 目标的结构化压缩生成确定性 [context digest v1]，敏感字段脱敏，审计事件完整记录
• 工具循环上下文重构 — 稳定前缀 + 可变工具循环尾部，仅在超高水位时压缩；流式调用 asyncio.to_thread 避免阻塞兄弟 agent
• Web Settings 配置页 — 支持上下文压缩与记忆配置的 UI 管理
• 英文贡献指南 — 新增 CONTRIBUTING_EN.md（issue #157），服务国际贡献者

What's Changed

• feat(tui): /scope 动作约束改为表格弹窗 by @FarStar-CN in #138
• feat(tui): persist /scope state to config.yaml by @FarStar-CN in #142
• feat(i18n): render English-language runs fully in English by @JMAN730 in #136
• Add OSINT reconnaissance template and update Web module by @Unclecheng-li in #146
• Dev by @Unclecheng-li in #147
• Add image support for dark mode in README by @Unclecheng-li in #149
• Update README_EN.md by @Unclecheng-li in #150

Full Changelog: v0.3.5...v0.3.7

v0.3.6

What's Changed

• feat(tui): /scope 动作约束改为表格弹窗 by @FarStar-CN in #138
• feat(tui): persist /scope state to config.yaml by @FarStar-CN in #142
• feat(i18n): render English-language runs fully in English by @JMAN730 in #136
• Add OSINT reconnaissance template and update Web module by @Unclecheng-li in #146
• Dev by @Unclecheng-li in #147

Full Changelog: v0.3.5...v0.3.6

v0.3.5

What's Changed

渗透 Agent 引擎重构

本版本重点重构了 VulnClaw 默认渗透引擎，将旧的“方向规划 / 黑板 / 阶段驱动”体系替换为更接近 Claude Code / Codex 的“模型主导”自主求解模式。

• 默认 solve 引擎改为模型主导循环，由模型自行决定下一步行动、工具调用、继续探索、询问用户或结束任务。
• 移除旧黑板和固定研究方向规划体系，避免框架强行限制模型思路。
• Skill 不再作为强制剧本注入上下文，而是作为可选参考资料索引，模型可按需调用 load_skill_reference 阅读。
• 引入 AgentState 证据记忆，统一保存工具调用、原始输出、关键发现和完成证据。
• 大型 HTML / body / stdout / stderr 默认完整保存为 raw evidence，active context 只注入高信号预览，减少上下文污染。
• 新增 evidence_search / evidence_view，模型可按需回查完整历史证据，避免信息丢失。
• 引入轻量纠偏层，记录工具失败、重复试错、same-body、parser/filter 边界等信号，但不替模型规划下一步。
• 保留证据闸门，模型声明 flag、漏洞结论或目标达成时必须有真实工具输出支撑。
• 工具调用改为更接近原生 tool transcript 的模式，减少额外总结步骤对模型上下文的污染。
• 增强 fetch / http_probe_batch，支持 HTTPS、完整请求面、响应头、body、raw evidence 和批量差分探测。
• 新增源码自动还原能力，针对 highlight_file、HTML 高亮源码、混杂 HTML/JS body 自动提取 clean source。
• 新增 shell_command，支持模型调用本地命令做验证，例如 php -r、curl、rg 等。
• 新增 runtime_diff_probe，用于正则过滤器与运行时解析器差异验证，例如 PHP serialize/unserialize 边界。
• solve 达成目标后自动生成复盘报告，包含解题思路、关键证据、复现请求包和证据索引。
• 上下文压缩默认关闭，仅在接近上下文上限或用户显式 /compact 时触发。

v0.3.3

What's Changed

• fix: chrome-devtools MCP auto-discover real tool names on session init by @ww455 in #64
• fix(web): prevent path traversal in asset serving and report output_path by @pruefsumme in #63
• feat(auth): sign in with ChatGPT subscription + built-in OpenAI↔ChatGPT-backend proxy by @PseudoJoker-1 in #65
• feat: add Docker support by @pruefsumme in #66
• fix CI workflow by @Unclecheng-li in #67
• Update README with project website link by @Unclecheng-li in #70
• Update README with project details and website by @Unclecheng-li in #71
• Update README_EN.md by @Unclecheng-li in #72
• Update README.md by @Unclecheng-li in #73
• Update README_EN.md by @Unclecheng-li in #74
• Fix solve engine frontier recovery by @OracleNep in #75
• docs: quote pip extras install examples by @nyxst4ck in #76
• Add repository standards: CODE_OF_CONDUCT, SECURITY warning guide, and structured issues by @shiva24082 in #77
• fix: prevent AttributeError when setting MCP server config by @somyaknotfound in #78
• Fix five bugs across tool execution and reporting by @JMAN730 in #79
• Sync fork: config-tui, skills palette, VulnBot ports, security hardening by @JMAN730 in #80
• Fix three triaged bugs: scope-prompt drift, missing run report, dead fetch cookie jar by @JMAN730 in #82
• fix(mcp): suppress cross-task cancel-scope error on stdio/http session teardown by @JMAN730 in #83
• Add AtomGitStars badge to README by @Unclecheng-li in #86
• Update README_EN.md by @Unclecheng-li in #87
• fix(cli): fetch provider models in config TUI LLM editor by @JMAN730 in #84
• Remove NOTICE, add Anthropic provider, fix slash palette backgrounds by @JMAN730 in #85
• update version number by @Unclecheng-li in #88

New Contributors

• @pruefsumme made their first contribution in #63
• @PseudoJoker-1 made their first contribution in #65
• @OracleNep made their first contribution in #75
• @nyxst4ck made their first contribution in #76
• @shiva24082 made their first contribution in #77
• @somyaknotfound made their first contribution in #78
• @JMAN730 made their first contribution in #79

Full Changelog: v0.3.2...v0.3.3

What's Changed

• fix: chrome-devtools MCP auto-discover real tool names on session init by @ww455 in #64
• fix(web): prevent path traversal in asset serving and report output_path by @pruefsumme in #63
• feat(auth): sign in with ChatGPT subscription + built-in OpenAI↔ChatGPT-backend proxy by @PseudoJoker-1 in #65
• feat: add Docker support by @pruefsumme in #66
• fix CI workflow by @Unclecheng-li in #67
• Update README with project website link by @Unclecheng-li in #70
• Update README with project details and website by @Unclecheng-li in #71
• Update README_EN.md by @Unclecheng-li in #72
• Update README.md by @Unclecheng-li in #73
• Update README_EN.md by @Unclecheng-li in #74
• Fix solve engine frontier recovery by @OracleNep in #75
• docs: quote pip extras install examples by @nyxst4ck in #76
• Add repository standards: CODE_OF_CONDUCT, SECURITY warning guide, and structured issues by @shiva24082 in #77
• fix: prevent AttributeError when setting MCP server config by @somyaknotfound in #78
• Fix five bugs across tool execution and reporting by @JMAN730 in #79
• Sync fork: config-tui, skills palette, VulnBot ports, security hardening by @JMAN730 in #80
• Fix three triaged bugs: scope-prompt drift, missing run report, dead fetch cookie jar by @JMAN730 in #82
• fix(mcp): suppress cross-task cancel-scope error on stdio/http session teardown by @JMAN730 in #83
• Add AtomGitStars badge to README by @Unclecheng-li in #86
• Update README_EN.md by @Unclecheng-li in #87
• fix(cli): fetch provider models in config TUI LLM editor by @JMAN730 in #84
• Remove NOTICE, add Anthropic provider, fix slash palette backgrounds by @JMAN730 in #85
• update version number by @Unclecheng-li in #88

New Contributors

• @pruefsumme made their first contribution in #63
• @PseudoJoker-1 made their first contribution in #65
• @OracleNep made their first contribution in #75
• @nyxst4ck made their first contribution in #76
• @shiva24082 made their first contribution in #77
• @somyaknotfound made their first contribution in #78
• @JMAN730 made their first contribution in #79

Full Changelog: v0.3.2...v0.3.3

v0.3.2

v0.3.2

What's Changed

• feat: 新增 5 个国内模型 Provider + Bug 修复 by @chu0119 in #8
• Feature/i18n support中英文切换支持 ，与CLI 交互问题修复 by @ww455 in #15
• Fix/issue 10 trailing dot in allowed hosts by @sjkxq in #16
• Fix #2: 无法使用第三方 API by @nandanadileep in #20
• Fix/issue 9 streaming output by @sjkxq in #19
• fix: 优化 REPL 交互体验并修复约束系统问题 by @ww455 in #18
• 重构TUI by @Nyaecho in #23
• Feature/t UI by @Unclecheng-li in #24
• Feature/i18n web by @FarStar-CN in #26
• Feature/i18n web (#26) by @Unclecheng-li in #28
• 添加了新的skills by @Unclecheng-li in #29
• Feature/lcs ttf by @ww455 in #31
• Revert "Feature/lcs ttf" by @ww455 in #32
• feat: 新增 brute_force_login 内置工具 by @ww455 in #34
• fix(regression): 优化域名匹配正则以支持多级域名 by @ww455 in #36
• Feature/i18n tui by @FarStar-CN in #38
• fix: PR #19 流式输出重复打印回归修复 by @ww455 in #40
• fix(tui): 修复 /scope 链式输入无法正常完成的问题 by @FarStar-CN in #41
• fix(tui): 修复 /scope 链式输入无法正常完成的问题 by @FarStar-CN in #42
• Fix/流式链路健壮性修复 + tool_calls 补全 by @ww455 in #43
• 更新了版本号 by @Unclecheng-li in #44
• feat: 核心优化 — 上下文管理/工具并行/MCP健壮性/语义去重/KB降级/流式修复 by @Attack-Phantom in #47
• fix(tui): 修复了在tui下更改LLM提供商配置时出现的错误问题 by @FarStar-CN in #48
• fix(tui): 修复了在tui下更改LLM提供商配置时出现的错误问题 by @FarStar-CN in #49
• feat(tui): 支持从 LLM 提供商动态获取模型列表 by @FarStar-CN in #50
• feat: 重构渗透引擎 + 反幻觉 + 推理/反思/插件体系 (v0.4.0) by @Attack-Phantom in #52
• fix(web): 修复 py3.10 下任务流式循环超时未捕获导致中断 by @Attack-Phantom in #53
• feat: 并行探索 / 信息收集工具链 / MCP streamable-http by @Attack-Phantom in #55
• chore: bump version to v0.4.1 by @Attack-Phantom in #56
• fix: set default OpenAI client user agent by @Attack-Phantom in #58
• fix: improve mcp server configuration by @Attack-Phantom in #59
• version update by @Unclecheng-li in #60
• fix(agent): strip port before python_execute scope check by @ARMeeru in #61

New Contributors

• @chu0119 made their first contribution in #8
• @ww455 made their first contribution in #15
• @sjkxq made their first contribution in #16
• @nandanadileep made their first contribution in #20
• @Nyaecho made their first contribution in #23
• @Unclecheng-li made their first contribution in #24
• @Attack-Phantom made their first contribution in #47
• @ARMeeru made their first contribution in #61

Full Changelog: v0.2.5...v0.3.2

Finally, it's more usable now

Full Changelog: https://github.com/Unclecheng-li/VulnClaw/commits/v0.2.5