Merge PR #25 and PR #27 into fix-conflicts-and-merge, resolving all conflicts by Copilot · Pull Request #28 · root-Manas/macaron

Copilot · 2026-04-12T15:58:03Z

Two open PRs with overlapping file changes and incompatible architectural directions needed to be merged into the working branch with conflicts resolved.

Conflict resolution strategy

PR #27 (cleanup-repo-configuration) — the authoritative redesign, merged first:

Conflicts in README.md, cmd/macaron/main.go, internal/app/app.go, internal/cliui/banner.go → took PR feat: major cleanup — remove dashboard, semantic CLI, banner, API management, uninstall, more tools #27's version

PR #25 (build-e2e-flow-research-tool) — incremental analytics/UX additions, merged second:

internal/ui/assets/index.html, internal/ui/server.go — modify/delete conflicts; kept the deletion since PR feat: major cleanup — remove dashboard, semantic CLI, banner, API management, uninstall, more tools #27 intentionally removed the dashboard
README.md, cmd/macaron/main.go, internal/app/app.go — took HEAD (PR feat: major cleanup — remove dashboard, semantic CLI, banner, API management, uninstall, more tools #27) as it supersedes PR End-to-end research workflow: analytics, graceful shutdown, CLI fixes, UX improvements, README #25's incremental changes

…l.sh Agent-Logs-Url: https://github.com/root-Manas/macaron/sessions/00996222-29d9-4f07-861f-153472cf533b Co-authored-by: root-Manas <97402139+root-Manas@users.noreply.github.com>

…trings Agent-Logs-Url: https://github.com/root-Manas/macaron/sessions/d6bb3d0b-c7d5-40b3-b491-e195b8b62ce5 Co-authored-by: root-Manas <97402139+root-Manas@users.noreply.github.com>

…t, uninstall, more tools, new README Agent-Logs-Url: https://github.com/root-Manas/macaron/sessions/bd43ae69-d546-45ff-aed6-3450bdddd865 Co-authored-by: root-Manas <97402139+root-Manas@users.noreply.github.com>

…n validation, append bug, comments Agent-Logs-Url: https://github.com/root-Manas/macaron/sessions/bd43ae69-d546-45ff-aed6-3450bdddd865 Co-authored-by: root-Manas <97402139+root-Manas@users.noreply.github.com>

… buffer constant, recursive flattenAPIKeys comment, uppercase TLD support Agent-Logs-Url: https://github.com/root-Manas/macaron/sessions/bd43ae69-d546-45ff-aed6-3450bdddd865 Co-authored-by: root-Manas <97402139+root-Manas@users.noreply.github.com>

…on' into copilot/fix-conflicts-and-merge # Conflicts: # README.md # cmd/macaron/main.go # internal/app/app.go # internal/cliui/banner.go Co-authored-by: root-Manas <97402139+root-Manas@users.noreply.github.com>

…tool' into copilot/fix-conflicts-and-merge # Conflicts: # README.md # cmd/macaron/main.go # internal/app/app.go # internal/ui/assets/index.html # internal/ui/server.go Co-authored-by: root-Manas <97402139+root-Manas@users.noreply.github.com>

Copilot

Pull request overview

This PR merges two previously open PRs with overlapping changes, resolving conflicts by keeping the post-cleanup architecture (semantic CLI + dashboard removal) while carrying over select pipeline/key-management additions.

Changes:

Replaces legacy flag-driven CLI with semantic subcommands (scan|status|results|setup|export|config|api|uninstall|guide|version) and updates docs accordingly.
Removes the dashboard/UI (internal/ui/...) and related documentation.
Expands the recon pipeline/tooling (amass, naabu fallback, gau/katana URL discovery) and adds/extends API key import/bulk loading support.

Reviewed changes

Copilot reviewed 12 out of 14 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
README.md	Rewritten usage/docs to match the semantic CLI and dashboard removal; adds API management and pipeline/tool tables.
internal/ui/server.go	Deletes the dashboard HTTP server implementation.
internal/ui/assets/index.html	Deletes dashboard frontend assets.
internal/store/store.go	Adds cross-scan analytics aggregation (currently appears dashboard-oriented).
internal/model/model.go	Adds analytics-related model types.
internal/engine/engine.go	Adds amass, subfinder provider-config injection, naabu-backed port scanning, gau+katana URL discovery; renames temp file prefix.
internal/cliui/banner.go	Refactors banner/log helpers (PrintBanner takes an `io.Writer`; new prefixed logging helpers).
internal/cfg/config.go	Adds bulk key loading and import-from-tool-config helpers; adds subfinder provider-config writer.
internal/app/app.go	Expands tool catalog/roles, adjusts status/setup rendering.
install.sh	Updates install messaging and expands PATH setup to zsh/profile.
cmd/macaron/main.go	Implements the semantic subcommand CLI, API key subcommands, uninstall flow, and updates version to 3.1.0.
cmd/macaron/main_test.go	Removes legacy arg-normalization tests; adds tests for profiles, domain heuristic, and storage override.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-12T16:03:40Z

+	fs.StringVar(&stages, "stages", "all", "Comma-separated stages: subdomains,http,ports,urls,vulns")
+	fs.StringVarP(&profile, "profile", "p", "balanced", "Workflow profile: passive|balanced|aggressive")
+	fs.BoolVarP(&quiet, "quiet", "q", false, "Suppress progress output")
+	fs.StringVar(&storage, "storage", "", "Storage root (default: ./storage)")
+	_ = fs.Parse(args)
+
+	// Positional args are also targets.
+	for _, a := range fs.Args() {
+		targets = append(targets, a)


All subcommands ignore the return value of fs.Parse (using _ = fs.Parse(args)). With pflag.ContinueOnError, parse errors (unknown flags, missing values, etc.) will be silently ignored and can cause the remaining tokens to be treated as positional targets/args (e.g., scanning --threads as a target). Please handle the error from Parse (and consider setting fs.SetOutput(io.Discard) if you want to fully control messaging).

Copilot · 2026-04-12T16:03:40Z

+func apiUnset(args []string) int {
+	// Reuse set with empty value to delete.
+	if len(args) == 0 {
+		cliui.Err("usage: macaron api unset key [key ...]")
+		return 1
+	}
+	// Append "=" to each key so ApplySetAPI treats it as a deletion.
+	kvs := make([]string, len(args))
+	for i, k := range args {
+		kvs[i] = strings.TrimSuffix(k, "=") + "="
+	}
+	return apiSet(kvs)
+}


apiUnset doesn’t parse flags (e.g. --storage) and blindly treats every token as a key name. This breaks calls like macaron api unset --storage /tmp shodan (it will attempt to delete keys named --storage and /tmp). Consider giving unset its own FlagSet like set/list, or refactor to a shared helper that parses flags and then applies deletions.

Copilot · 2026-04-12T16:03:40Z

 	}
 	if len(summaries) == 0 {
-		return "No scans found. Run: macaron scan example.com\n", nil
+		return "no scans on record. run: macaron scan <target>", nil


The empty-state message returned here lacks a trailing newline. Since callers print it with fmt.Print(out), the next shell prompt/output will appear on the same line.

Suggested change

return "no scans on record. run: macaron scan <target>", nil

return "no scans on record. run: macaron scan <target>\n", nil

Copilot · 2026-04-12T16:03:41Z

+// Analytics returns aggregated statistics across all scans for display in the
+// dashboard analytics tab.
+func (s *Store) Analytics() (model.AnalyticsReport, error) {
+	report := model.AnalyticsReport{}
+
+	// Per-day scan counts and cumulative findings.
+	rows, err := s.db.Query(`
+		SELECT id, target, finished_at, duration_ms, stats_json


This adds dashboard-oriented analytics aggregation (Store.Analytics) even though the dashboard/UI is deleted in this branch. As-is, this method (and the added analytics model types) appear to be unused, and the comment references a dashboard analytics tab that no longer exists. Either wire this into an actual consumer (CLI/API) or remove it to avoid dead code and confusing docs.

Copilot · 2026-04-12T16:03:41Z

+// AnalyticsReport is the response returned by /api/analytics.
+type AnalyticsReport struct {
+	ScanCount     int             `json:"scan_count"`
+	AvgDurationMS int64           `json:"avg_duration_ms"`
+	Totals        ScanStats       `json:"totals"`
+	Days          []DayStat       `json:"days"`
+	TopTargets    []TargetRank    `json:"top_targets"`
+	SeverityDist  []SeverityCount `json:"severity_dist"`
+}


The comment says this struct is returned by /api/analytics, but the UI/server (and any API endpoints) were removed in this merge. Since there’s no /api/analytics handler in the repo, this docstring is currently incorrect/misleading (and the type appears unused).

Copilot · 2026-04-12T16:03:41Z

+		if err != nil {
+			// naabu is installed but failed (e.g. permissions); warn and fall through.
+			emit(progress, model.StageEvent{Type: model.EventWarn, Stage: "ports", Message: "naabu failed (" + err.Error() + ") — falling back to native port scan"})
+		} else if len(hits) > 0 {


If naabu is installed and runs successfully but returns zero hits, this code falls back to the native scanner anyway. That means paying for two scans in the common ‘no open ports’ case. Consider falling back only when naabu errors (or when it’s known to be unusable), and treat a successful empty result as authoritative.

Suggested change

} else if len(hits) > 0 {

} else {

// A successful naabu run is authoritative, even when it finds no open ports.

Copilot · 2026-04-12T16:03:41Z

+	lines, _ := runLines(ctx, fmt.Sprintf("katana -u https://%s -silent -jc -d 3", shellEscape(host)), 5*time.Minute)
+	return lines


runKatana forces an https:// URL for every host. This will miss URL discovery on HTTP-only services (and can bias coverage depending on target). Consider trying both schemes, using http:// first (matching the prober’s scheme results), or letting katana handle scheme selection via its flags.

Suggested change

lines, _ := runLines(ctx, fmt.Sprintf("katana -u https://%s -silent -jc -d 3", shellEscape(host)), 5*time.Minute)

return lines

targets := []string{

fmt.Sprintf("https://%s", host),

fmt.Sprintf("http://%s", host),

}

all := make([]string, 0, 128)

for _, target := range targets {

lines, _ := runLines(ctx, fmt.Sprintf("katana -u %s -silent -jc -d 3", shellEscape(target)), 5*time.Minute)

all = append(all, lines...)

}

return dedupe(all)

Copilot · 2026-04-12T16:03:42Z

+// writeSubfinderProviderConfig creates a temporary provider-config.yaml with
+// macaron's API keys so subfinder uses them without changing the user's own
+// subfinder config. Returns the temp file path, or "" if nothing to write.
+// The caller is responsible for removing the returned file when done.
+func writeSubfinderProviderConfig(apiKeys map[string]string) string {
+	if len(apiKeys) == 0 {
+		return ""
+	}
+	// macaron key name → subfinder provider name
+	mapping := map[string]string{
+		"securitytrails": "securitytrails",
+		"virustotal":     "virustotal",
+		"shodan":         "shodan",
+		"binaryedge":     "binaryedge",
+		"c99":            "c99",
+		"chaos":          "chaos",
+		"hunter":         "hunter",
+		"intelx":         "intelx",
+		"urlscan":        "urlscan",
+		"zoomeye":        "zoomeye",
+		"fullhunt":       "fullhunt",
+		"github":         "github",
+		"leakix":         "leakix",
+		"netlas":         "netlas",
+		"quake":          "quake",
+	}


There are now two separate implementations for generating a subfinder provider config: this local writeSubfinderProviderConfig (with a limited mapping) and cfg.WriteSubfinderProviderConfig (with a much broader mapping). This duplication risks config drift and means keys like censys_id/censys_secret, fofa_*, etc. won’t be injected when running subfinder from the engine. Consider consolidating into a single shared implementation/mapping (e.g., reuse cfg’s writer with a temp file).

Copilot · 2026-04-12T16:03:42Z

+	if !noColor {
+		label = "\033[" + code + "m[" + tag + "]\033[0m"
+	}
+	fmt.Printf(label+" "+format+"\n", a...)


Info/OK/Warn currently write to stdout via fmt.Printf, while Err writes to stderr. This makes it hard to pipe command output cleanly (stdout gets mixed with informational logs) and is inconsistent with the previous behavior in this same file (all logs to stderr). Consider sending all log-prefixed lines to stderr, reserving stdout for command output.

Suggested change

fmt.Printf(label+" "+format+"\n", a...)

fmt.Fprintf(os.Stderr, label+" "+format+"\n", a...)

Copilot · 2026-04-12T16:03:42Z

+    latest.txt
+```
+
+Override with `--storage /path/to/dir` or `MACARON_HOME` (env not yet supported — use the flag).


This sentence is internally inconsistent: it suggests overriding with MACARON_HOME, but also says the env var is not yet supported. The current macaronHome() implementation only supports --storage (and otherwise defaults to ./storage). Please either remove the MACARON_HOME mention or implement env var support to match the docs.

Suggested change

Override with `--storage /path/to/dir` or `MACARON_HOME` (env not yet supported — use the flag).

Override with `--storage /path/to/dir`.

Copilot AI and others added 8 commits April 8, 2026 07:54

Initial plan

9481c8f

Fix e2e flow: analytics, graceful shutdown, bug fixes, README, instal…

15c6cff

…l.sh Agent-Logs-Url: https://github.com/root-Manas/macaron/sessions/00996222-29d9-4f07-861f-153472cf533b Co-authored-by: root-Manas <97402139+root-Manas@users.noreply.github.com>

UX improvements: better CLI output, tables, next-steps hints, clean s…

7111afb

…trings Agent-Logs-Url: https://github.com/root-Manas/macaron/sessions/d6bb3d0b-c7d5-40b3-b491-e195b8b62ce5 Co-authored-by: root-Manas <97402139+root-Manas@users.noreply.github.com>

fix: address code review issues — file close ordering, looksLikeDomai…

006d279

…n validation, append bug, comments Agent-Logs-Url: https://github.com/root-Manas/macaron/sessions/bd43ae69-d546-45ff-aed6-3450bdddd865 Co-authored-by: root-Manas <97402139+root-Manas@users.noreply.github.com>

Merge remote-tracking branch 'origin/copilot/cleanup-repo-configurati…

94ec21f

…on' into copilot/fix-conflicts-and-merge # Conflicts: # README.md # cmd/macaron/main.go # internal/app/app.go # internal/cliui/banner.go Co-authored-by: root-Manas <97402139+root-Manas@users.noreply.github.com>

Copilot AI assigned Copilot and root-Manas Apr 12, 2026

Copilot created this pull request from a session on behalf of root-Manas April 12, 2026 15:58 View session

root-Manas marked this pull request as ready for review April 12, 2026 15:59

Copilot AI review requested due to automatic review settings April 12, 2026 15:59

root-Manas merged commit e395add into main Apr 12, 2026
3 checks passed

Copilot started reviewing on behalf of root-Manas April 12, 2026 15:59 View session

Copilot AI reviewed Apr 12, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Merge PR #25 and PR #27 into fix-conflicts-and-merge, resolving all conflicts#28

Merge PR #25 and PR #27 into fix-conflicts-and-merge, resolving all conflicts#28
root-Manas merged 8 commits intomainfrom
copilot/fix-conflicts-and-merge

Copilot AI commented Apr 12, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 12, 2026

Uh oh!

Copilot AI Apr 12, 2026

Uh oh!

Copilot AI Apr 12, 2026

Uh oh!

Copilot AI Apr 12, 2026

Uh oh!

Copilot AI Apr 12, 2026

Uh oh!

Copilot AI Apr 12, 2026

Uh oh!

Copilot AI Apr 12, 2026

Uh oh!

Copilot AI Apr 12, 2026

Uh oh!

Copilot AI Apr 12, 2026

Uh oh!

Copilot AI Apr 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	return "no scans on record. run: macaron scan <target>", nil
	return "no scans on record. run: macaron scan <target>\n", nil

	} else if len(hits) > 0 {
	} else {
	// A successful naabu run is authoritative, even when it finds no open ports.

		lines, _ := runLines(ctx, fmt.Sprintf("katana -u https://%s -silent -jc -d 3", shellEscape(host)), 5*time.Minute)
		return lines

-	lines, _ := runLines(ctx, fmt.Sprintf("katana -u https://%s -silent -jc -d 3", shellEscape(host)), 5*time.Minute)
-	return lines
+	targets := []string{
+		fmt.Sprintf("https://%s", host),
+		fmt.Sprintf("http://%s", host),
+	}
+	all := make([]string, 0, 128)
+	for _, target := range targets {
+		lines, _ := runLines(ctx, fmt.Sprintf("katana -u %s -silent -jc -d 3", shellEscape(target)), 5*time.Minute)
+		all = append(all, lines...)
+	}
+	return dedupe(all)

	fmt.Printf(label+" "+format+"\n", a...)
	fmt.Fprintf(os.Stderr, label+" "+format+"\n", a...)

	Override with `--storage /path/to/dir` or `MACARON_HOME` (env not yet supported — use the flag).
	Override with `--storage /path/to/dir`.

Conversation

Copilot AI commented Apr 12, 2026

Conflict resolution strategy

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants