Skip to content

v0.1.6-beta

Choose a tag to compare

View all tags
@pikpikcu pikpikcu released this 17 Mar 12:29
· 178 commits to main since this release
v0.1.6-beta
47dd19a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's New in v0.1.6-beta

Phase 1 — Autonomous Recovery & Exploration Engine

  • Watchdog forcing — LLM stuck in text-only loop → auto-force execute tool (max 2x before abort)
  • Anti-stagnation exploration — temperature boost when no new high-confidence evidence (threshold ≥0.65)
  • Tool diversity tracking — same-tool streak detection, configurable window and max streak
  • Per-phase exploration directives — phase-specific anti-loop tactics injected into system prompt
  • Quality scoreboard — evidence 40%, reproducibility 35%, impact 25% weights
  • Recovery state context — compact findings injected after every conversation truncation
  • Objective queue + evidence log — objective_queue (max 64), evidence_log (max 200, dedup)
  • 6 new exploration config keys — full control over exploration behavior in config.json

Phase 2 — Skill Orchestration & Tool Budget

  • Skill phase boost — skills in phase-preferred directories get +2 relevance score
  • Tool budget per phase — soft limits per tool per phase (e.g. no deep_fuzz in RECON)
  • Budget warnings — 75% (warning), 100% (exhausted), 0 (discouraged) prepended to tool results
  • Phase skill hints — active phase lists preferred skill directories in system prompt

Ollama Stability — Context & VRAM Recovery

  • Multi-level VRAM crash recovery — 4 escalation tiers via persistent _adaptive_num_ctx:
    • Tier 1: ollama_num_ctx_small, 80 messages, no wait
    • Tier 2: ÷2 context, 50 messages, 5s wait
    • Tier 3: ÷4 context, 30 messages, 10s wait
    • Tier 4: 4096 (minimum), 20 messages, 30s wait
  • Proactive context monitoring — trims conversation at ≥80% token usage (aggressive at ≥90%)
  • Dynamic compression interval — 5/10/15 iterations based on context fullness
  • OOM-safe compression — skips compress_with_llm when >65% context full
  • Dynamic tool result cap — scales down with _adaptive_num_ctx to prevent context overflow
  • Session auto-saved after each VRAM crash recovery
  • [CONTEXT MONITOR] hidden from TUI — logged to file only

Tested Endpoints Memory

  • SessionData.tested_endpoints — LRU list (max 500) tracking "METHOD url" strings
  • Auto-recorded from execute (curl + -X/-d detection), browser_action (goto/new_tab), fuzz tools
  • Shown after truncation — last 20 tested endpoints in critical findings context

@/file and @/folder References

  • @/path resolver — copies local files/dirs to Docker workspace/uploads/ automatically
  • Per-file error handling — single copy errors no longer abort the entire directory operation
  • Detailed skip reporting — separates binary, too-large, and OS-error skips in summary

TUI — Slash Command Autocomplete

  • / prefix triggers slash command autocomplete dropdown in chat input
  • PathCompleter widget with proper error logging (no bare except)

Agent Intelligence

  • Attack chain detection linking vuln evidence across phases
  • Semantic dedup for objectives (Jaccard 0.70 threshold)
  • Cross-session memory loading prior findings on start
  • Smart fuzzer routing + dynamic URL correlation + injection-chain detection
  • 22 new skills added (frameworks, protocols, technologies, LLM coverage)

Version Management

  • airecon/_version.py — single source of truth for version (all files import from here)
  • install.sh — auto-detects version from pyproject.toml, shows ASCII banner + upgrade diff

Bug Fixes

  • Block $() and backtick command substitution in watchdog (has_dangerous_patterns())
  • Auth browser actions: login_form, handle_totp, save_auth_state, inject_cookies, oauth_authorize
  • _executed_cmd_hashes pruned at >5000 entries (memory leak fix)
  • IDOR false positive reduction in correlation engine
  • Phase timeout now counts iterations, not wall-clock time
  • --ignore-certificate-errors for TLS cipher mismatch on pentest targets
  • 8+ Docker binary name mismatches fixed in tools_meta.json
  • All match-breaking issues fixed across pattern files

Tests

  • 448 → 879 tests (96% growth)
  • New: test_context_recovery.py, test_tested_endpoints.py, test_recon_dedup.py, test_path_completer.py, test_command_parse.py, test_reporting_helpers.py

Full Changelog: https://github.com/pikpikcu/airecon/blob/main/CHANGELOG.txt

Assets 3
Loading