updating main

Author: grisuno

.gitignore

@@ -51,3 +51,5 @@ lazysentinel.db
 parquets/session_knowledge.parquet
 prompt.md
 knowledge_base_vuln.json
+graphify-out/cache/
+graphify-out/.graphify_*

CLAUDE.md

@@ -60,7 +60,7 @@ bash skills/mcp_restart.sh                                   # after editing MCP
 | `cli/commands/` | cmd2 `CommandSet` subpkg, auto-discovered by `cli/registry.py`. |
 | `core/` | Canonical `Config`, crypto, validators, `typing.Protocol` interfaces. No framework imports. |
 | `scripts/` | Build/maintenance: `build_command_index.py`, `patch_playbook_atomic_ids.py`. |
-| `tests/` | 61 files, ~1810 tests. No mocking of C2 or daemon. |
+| `tests/` | 62 files, ~1860 tests. No mocking of C2 or daemon. |
 | `lazyown-docker/` `lazygui/` | Docker + desktop GUI. |
 | `docs/` | GH Pages site — auto-generated by `DEPLOY.sh`, don't edit HTML. |
 | `lazyc2/` | Security validators (`validate_route_path`, `validate_template_name`, `is_safe_template_path`). |
@@ -216,6 +216,8 @@ Only module both CLI and C2 import. Use existing helpers:
 | Exploit search | `find_ss`/`find_ea`/`find_ps`/`nvddb`/`exploitalert`/`packetstormsecurity` |
 | HTTP req | `generate_http_req(host, port, uri, ...)` |
 | Input validation | `check_rhost`/`check_lhost`/`check_lport` |
+| Binary present? | `is_binary_present(name)` — `shutil.which` based, no shell |
+| Optional heavy dep | `from core.dependencies import optional_import, optional_attr` — bind lazily so a missing package degrades one feature, not the whole framework |
 | Tmux bootstrap | `ensure_tmux_session(name)` |
 | Emails/users/creds | `generate_emails`/`get_users_dic`/`crack_password` |
 | Vulnerability scan + persist | `VulnerabilityScanner().search_cves(service)` → `.persist(service, target, cves)` writes `sessions/vulns_<target>.json` |

QUICKSTART.md

@@ -183,3 +183,14 @@ bash gen_cert.sh
 ```
 (LazyOwn) > assign dirwordlist /path/to/wordlist.txt
 ```
+
+**A command fails with `MissingDependencyError`** — a heavy optional package (for
+example `pycryptodome`, `python-libnmap`, `impacket`) is not installed. The shell
+itself keeps running; only the dependent feature is affected. The error names the
+exact `pip install` command. To list every optional dependency and its status
+without launching the shell (useful when the install is so broken that `rich` or
+`cmd2` will not import):
+```bash
+python3 -m core.dependencies
+```
+Then reinstall everything with `pip install -r requirements.txt`.

README.md

@@ -99,6 +99,12 @@ git clone https://github.com/grisuno/LazyOwn.git && cd LazyOwn && bash install.s
 (LazyOwn) > doctor   # preflight: Python, venv, packages, certs, SecLists, tools
 (LazyOwn) > wizard   # auto-detects lhost, walks 7 config steps
 
+# Heavy optional dependencies (pycryptodome, python-libnmap, impacket, ...) are
+# imported lazily: a missing package degrades only its feature instead of
+# crashing the shell, and the dependent command raises a clear "pip install ..."
+# error when used. To audit them without launching the shell (works even if rich
+# or cmd2 are broken):  python3 -m core.dependencies
+
 # 3. Define your authorized scope, then recon
 (LazyOwn) > scope add 10.10.11.0/24 && scope mode enforce
 (LazyOwn) > ping && lazynmap && auto_populate && facts_show

UTILS.md

@@ -75,6 +75,11 @@ This function checks if a specified binary is available in the system's PATH
 by using the `which` command. It returns True if the binary is found and False
 otherwise.
 
+The lookup is performed with :func:`shutil.which`, which resolves the name
+against ``PATH`` without spawning a shell. This avoids the command-injection
+surface of interpolating ``binary_name`` into a shell string and works on
+platforms that do not ship the ``which`` utility.
+
 :param binary_name: The name of the binary to be checked.
 :type binary_name: str
 :return: True if the binary is present, False otherwise.

cli/command_index.json

@@ -14,7 +14,7 @@
     "cli/commands/scan.py"
   ],
   "source_sha256": {
-    "lazyown.py": "d397fbe579e6a613002b44776b2e11003ee488d2c69cfdfde8816c37cdf9a0fa",
+    "lazyown.py": "dcd2fd4b9d584aae9637a81dec3c2eb16a51534efd478789886a2d987a25ffa9",
     "cli/commands/ai.py": "f21c625015834ceff49ebc5bde7a1c56f05217556513868350d477f290da3c00",
     "cli/commands/audit.py": "f374f86060903ce1ca64333f191ee9a68f05588aa064e8fe02c18e2e5240d47b",
     "cli/commands/command_and_control.py": "35fdf900504dbedbec9c514249693d9d5122cd7cbba8cfc5ed18ed6404ac12f2",

core/README.md

@@ -14,7 +14,8 @@ low-level protocol constants. Nothing in `core/` imports from `lazyown.py`,
 | `validators.py` | Input validation functions: IP address format check, port range check, safe path validation. Used by CLI commands before they touch `payload.json` or the filesystem. |
 | `protocols.py` | `typing.Protocol` definitions shared across `cli/`, `modules/`, and `skills/`: `PayloadProvider`, `CommandLister`, `TerminalIO`, `LLMBackend`, `MemoryStore`, `Selector`. Enables Dependency Inversion without circular imports. |
 | `console.py` | Rich console singleton and ANSI colour helpers used by `print_msg`, `print_warn`, `print_error`. |
-| `__init__.py` | Re-exports `Config`, `load_payload`, and the validators so callers can do `from core import Config`. |
+| `dependencies.py` | Graceful optional-import handling. `optional_import` / `optional_attr` bind heavy third-party packages lazily so a missing dependency (for example `pycryptodome`) degrades a single feature instead of crashing the framework at import time. `OPTIONAL_PYTHON_DEPENDENCIES` is the single source of truth for each lazily-imported package's install hint. Standard-library only, so `python3 -m core.dependencies` works even when `rich` or `cmd2` are broken. |
+| `__init__.py` | Re-exports `Config`, `load_payload`, the validators, and `optional_import` / `optional_attr` / `MissingDependencyError` so callers can do `from core import Config`. |
 
 ## Usage
 
@@ -39,3 +40,25 @@ if not check_rhost(cfg.rhost):
   but adds no new logic.
 - All validators return `bool` — they never raise, never print, never log.
   Callers decide what to do on failure.
+- Heavy third-party packages must be bound through `optional_import` /
+  `optional_attr`, never imported directly at module top level in
+  `utils.py`. This keeps a single missing package from crashing the whole
+  framework at import time. The dependent feature raises
+  `MissingDependencyError` (with a `pip install` hint) only when actually
+  used. The operator-facing preflight report — Python version, virtual
+  environment, external binaries, certificates, SecLists — lives in
+  `cli/doctor.py` (the `doctor` shell command); `core/dependencies.py` owns
+  runtime resilience for lazily-imported Python packages only.
+
+## Optional dependencies
+
+```python
+from core.dependencies import optional_attr, optional_import
+
+AES = optional_attr("Crypto.Cipher", "AES")   # real class when installed
+pandas = optional_import("pandas")             # deferred proxy when missing
+
+if pandas:                                     # proxy is falsy
+    frame = pandas.DataFrame(rows)
+```
+

core/__init__.py

@@ -57,6 +57,11 @@
     print_warn,
 )
 from core.crypto import xor_encrypt_decrypt
+from core.dependencies import (
+    MissingDependencyError,
+    optional_attr,
+    optional_import,
+)
 from core.payload_schema import (
     SCHEMA,
     FieldKind,
@@ -131,6 +136,9 @@
     "check_lhost",
     "check_lport",
     "check_port",
+    "MissingDependencyError",
+    "optional_import",
+    "optional_attr",
     "SCHEMA",
     "FieldKind",
     "FieldSpec",