v0.15.1 — UI polish

ReachScope Workbench 0.15.1

A UI polish release: clearer terminology, stronger keyboard and screen-reader
semantics, and honest empty states. There are no backend, API, schema or
dependency changes — the workspace schema stays 7 and no migration is needed.

Highlights

• Terminology — one action vocabulary across the app (新建检查 / 工作区 /
  添加资产), synced into the browser tests.
• Display labels — enum codes now show Chinese labels with the raw code as a
  footnote; export buttons, counts and status codes are localized; zero-count
  badges are hidden.
• Workspace form — required/optional markers, a reason line when the submit
  button is disabled (role="status" + aria-describedby), and the
  private-target disclaimer as a persistent hint instead of placeholder text.
• Accessibility — a shell-level live region for task completion and refresh
  announcements, visible-focus filtering in dialogs, aria-controls on job
  tabs, and a defined --line token (borders had been silently missing since
  0.14.1) with higher --muted contrast and restored focus rings.
• States — clickable stat cards that switch the inner Web panel before
  scrolling, a loopback guard in the wizard (private-target warnings, rejected
  addresses, OUT_OF_SCOPE banner), "采集失败 · 未取得数据" for zero-response
  jobs, retest no longer clears a half-filled form, and a two-step confirmation
  for "重新分析".
• Structure — App.tsx split from 1302 to 457 lines into Overview.tsx,
  JobDetail.tsx and focused lib/ modules; behavior preserved.
• Docs — real screenshots and a "try it in 60 seconds" hook on the project
  page, a new outbound-network inventory
  (docs/reference/network-behavior.md), and compressed publication disclosure
  in the English README.

Verification

• scripts/check_all.py — 2119 passed / 10 skipped, coverage 92.62%
  (ruff, mypy, tsc, Prettier and Vite all green).
• Browser release gate — 8/8 groups pass.
• scripts/quality/check_repository.py — 0 errors.

Upgrade

pip install --upgrade reachscope-workbench

Or install the attached wheel:

pip install reachscope_workbench-0.15.1-py3-none-any.whl

Existing workspaces open as-is; no migration step.

ReachScope Workbench v0.15.0

Scenario packs. The teaching lab is now data-driven: a lesson is a scenario.yaml
plus static pages, so a new scenario needs no Python change and no frontend rebuild.

What is new

• Scenario packs. Three built-in lessons ship in the wheel: missing security
  headers, cookie flags, and CSRF on a state-changing GET. User packs load from
  repeatable --scenarios-dir roots; a bad pack is surfaced as an issue without
  taking the service down.
• Lab API. GET /api/lab/scenarios lists loaded packs and load issues;
  POST /api/lab/start accepts an optional scenario_id (unknown id returns 404).
  Lab status metadata now describes the running scenario instead of a hardcoded site.
• Pack validation rejects path escapes, symlinks, oversize packs, case-duplicate
  and reserved headers, malformed cookies and unknown fields.

Reliability and boundaries

• Workers survive terminal persistence errors; schema 7 is rechecked after the
  workspace lease is acquired; a SQLite WAL fallback is reported instead of silent.
• Input bounds: invalid UTF-8 is an input error, malformed smali directives are
  counted as unknown syntax instead of aborting the decode, and register-range
  expansion and apkid scan time are capped.
• Decoder memory defaults are now platform-specific: 4 GiB committed memory on
  Windows, 8 GiB address space on POSIX so JVM reservations fit. Override with
  REACHSCOPE_WORKER_MEMORY_MB.
• An inferred android:exported="false" is reported as unknown/medium and can no
  longer refute a reachability claim; an explicit false keeps its existing result.
• Uploads are read from verified regular files; host-scope namespace changes are
  distinguished; Windows collector process trees are reaped; AI endpoints without
  a hostname are rejected.
• Frontend: a recoverable render fallback, tolerance for incomplete historical
  payloads, retest request errors preserved, and both AI provider wire spellings
  accepted.

No workspace schema change (still 7), no migration, no new runtime dependency.

Full changelog: CHANGELOG.md

ReachScope Workbench v0.14.2

Release hygiene. No functional change: the application behaves exactly as 0.14.1.

What changed

• Version declarations locked. A unit test now requires pyproject.toml, the
  package __version__, frontend/package.json and the OpenAPI contract to
  state the same version. Any drift fails the test suite instead of shipping.
• CI actions updated to their current majors (checkout, setup-python,
  setup-node, upload-artifact → v7), ahead of the Node 20 runner deprecation.
• Runner images pinned to ubuntu-24.04 and windows-2025 while
  ubuntu-latest migrates to Ubuntu 26, so the toolchain cannot change silently.
• Trigger narrowed. Tag pushes no longer re-run the full check set; branch
  pushes, pull requests and manual dispatch still do.
• README. The English README no longer opens with a list of negations; the
  same boundaries remain documented in SECURITY.md.
  Both READMEs now state that this repository is a one-time public export of a
  privately developed history.

Install

python -m venv .venv
# Activate .venv using your shell.
python -m pip install reachscope_workbench-0.14.2-py3-none-any.whl
reachscope-workbench serve --port 8765 --data .workbench

Python 3.11+. Prebuilt frontend included. Binds loopback only.

Artifacts

File	Size	SHA-256
reachscope_workbench-0.14.2-py3-none-any.whl	591,580 B	aeebc0f8a6b9e2b971a281abd3698ff89b034c379795dbfb69d479c3f676b168
reachscope_workbench-0.14.2.tar.gz	1,901,091 B	a2d32bd1dbc16ef8389c9b82c48b0ca24133c102331569bec33d42e3ce8eaa63

Both artifacts were rebuilt from the tagged tree and verified byte-for-byte
against it: every wheel runtime file and every sdist member matches the
repository content.

ReachScope Workbench v0.14.1

First public release.

ReachScope Workbench is a local, single-user workbench that carries a security
result one step past the finding: the same evidence enters a remediation
workspace, gets assigned, is re-tested against a comparable condition, and is
only then closed by a human.

What is in it

Module	Input	Output
Android client	APK upload or 5 source samples	Configuration review, components, permissions, deep links, candidate paths, source lookup, comparable re-test
Web	Up to 20 exact HTTP(S) URLs	Status, title, server, IP, TLS, redirects, headers, timing, body summary
Web review & history	Imported scan results, two completed probes	Fingerprint grouping, config checks, cookie / form profile, field-level change between runs
Cloud	AWS Terraform Plan / IAM / supported export JSON	Network, permission and storage rules with field-level evidence
Host	SSH / Nginx config JSON, Nginx access logs, SSH auth logs	7 baseline checks, 3 bounded log rules, redacted events, config re-test
Red / blue workspace	Completed checks inside a declared scope	Candidate leads with raw evidence, owner, remediation decision, comparable re-test, manual close

Try it without a target

Start the app and open http://127.0.0.1:8765/#/lab — a real site on
loopback. Collect a baseline, apply one explicit hardening change, re-test the
same URL, compare the two observations field by field, and close the item by
hand. Every number comes from an actual HTTP response and nothing leaves the
machine, so the same run gives the same result in front of a class.

Install

python -m venv .venv
# Activate .venv using your shell.
python -m pip install reachscope_workbench-0.14.1-py3-none-any.whl
reachscope-workbench doctor --data .workbench
reachscope-workbench serve --port 8765 --data .workbench

Or run from a source checkout with pip install .; on Windows the repository
also ships start-workbench.ps1.

Requires Python 3.11+. The frontend is prebuilt and included — no Node.js
needed. No account, no AI key, no scanning API key.

Artifacts

File	Size	SHA-256
reachscope_workbench-0.14.1-py3-none-any.whl	591,804 B	54c5871dc3732ed02983249ec5a7e6d7ff2006ac810b05c56b13e66f56519654
reachscope_workbench-0.14.1.tar.gz	1,865,761 B	4a29f5aabbcc2bca67c08bd544031c2ca563d2758ff29887bae72f8672aad10a

Source archives for the tag are generated by GitHub.

Boundaries

Local and single-user by design; it binds loopback only. Not a vulnerability
scanner and not an attack tool — no crawling, no brute forcing, no exploit or
APK execution. The bundled rule tables are a reading aid for a human, not steps
the application performs. A missing observation is never presented as evidence
that an asset is safe.

Documentation is written in Chinese and is authoritative; the English README is
a curated summary. See SECURITY.md
for the security model and THIRD_PARTY.md
for vendor sources.

MIT licensed.