feat(feat): suggested commands \n\n Version: release/0.2.131 \n\n \n\n LazyOwn on HackTheBox: https://app.hackthebox.com/teams/overview/6429 \n\n LazyOwn/ https://grisuno.github.io/LazyOwn/ \n\n \n\n Fecha: mar 19 may 2026 23:05:50 -04 \n\n Hora: 1779246350

Author: grisuno

CHANGELOG.md

@@ -2,6 +2,13 @@
 # Changelog
 
 
+### Nuevas características
+
+### Otros
+
+  *   * feat(feat): suggested commands \n\n Version: release/0.2.131 \n\n  \n\n   LazyOwn on HackTheBox: https://app.hackthebox.com/teams/overview/6429 \n\n  LazyOwn/   https://grisuno.github.io/LazyOwn/ \n\n \n\n Fecha: mar 19 may 2026 23:05:50 -04 \n\n Hora: 1779246350
+
+
 ### Nuevas características
 
 ### Otros

CLAUDE.md

@@ -87,6 +87,10 @@ Critical keys:
 | `sleep`, `sleep_start` | Beacon jitter + auto-loop bootstrap delay |
 | `api_key` | Groq (used by `report.py`, AI agents) |
 | `enable_telegram_c2`/`discord_c2`/`ia`/`deepseek`/`cloudflare`/`run_in_memory`/`c2_implant_debug`/`c2_debug` | Feature flags |
+| `llm_backend` | LLM selection: `"auto"` (Groq when API key is set, else Ollama), `"groq"`, or `"ollama"` |
+| `llm_model_groq` | Model identifier passed to the Groq API (default `llama-3.3-70b-versatile`) |
+| `llm_model_ollama` | Model identifier passed to the Ollama API (default `deepseek-r1:1.5b`) |
+| `ollama_host` | Base URL of the Ollama daemon (default `http://localhost:11434`) |
 | `c2_daily_limit`, `c2_hour_limit`, `c2_login_limit` | flask-limiter strings |
 | `targets` | Multi-target list (status, ports, tags, notes) |
 | `rat_key` | XOR key for stub/beacon |
@@ -166,7 +170,7 @@ CLI and C2 both import `utils.py` + read `payload.json`. MCP reuses `LazyOwnShel
 ### Adding a route — happy path
 1. Decide operator-only (`@requires_auth`) vs beacon-facing (apply both canonical path AND `f'{route_maleable}<...>'` alias).
 2. `render_template('foo.html', ctx=...)` — typed context, not raw request data.
-3. Validate paths/templates with `validate_route_path` + `validate_template_name` + `is_safe_template_path`. Never bypass.
+3. Validate paths/templates with `validate_route_path` + `validate_template_name` + `is_safe_template_path`. Never bypass. The canonical implementations live in `lazyc2/security/validators.py` (return `(bool, str)` tuples). Module-level shims in `lazyc2.py` wrap them as booleans for legacy callers — new code must consume the tuple form so the error string can be surfaced to the operator.
 4. Persist via existing helpers:
    - JSON: `load_routes`/`save_routes`, `load_short_urls`, etc. — atomic (`*.tmp` → `os.rename`, chmod 600).
    - SQLite: `sqlite3.connect(DB_PATH)` inside `with` blocks.
@@ -205,11 +209,15 @@ Only module both CLI and C2 import. Use existing helpers:
 | Input validation | `check_rhost`/`check_lhost`/`check_lport` |
 | Tmux bootstrap | `ensure_tmux_session(name)` |
 | Emails/users/creds | `generate_emails`/`get_users_dic`/`crack_password` |
+| Vulnerability scan + persist | `VulnerabilityScanner().search_cves(service)` → `.persist(service, target, cves)` writes `sessions/vulns_<target>.json` |
+| LLM backend | `from modules.llm_factory import get_llm_backend, try_get_llm_backend` — reads `llm_backend`/`llm_model_*`/`ollama_host` from `payload.json` and returns an `AIModel` that also structurally satisfies `core.protocols.LLMBackend` |
 
 New helpers go here only if shared CLI↔C2. Feature-local helpers → `modules/<feature>.py`.
 
 **Known issue**: two `class Config` defs in `utils.py` (3229, 3328). Second is duplicate — don't add a third; deduplicate first in a separate change before editing.
 
+**LLM backends**: do **not** instantiate `GroqModel`/`OllamaModel` directly. Use `from modules.llm_factory import get_llm_backend` (raises) or `try_get_llm_backend` (returns `None` on failure). The factory reads `llm_backend`, `llm_model_groq`, `llm_model_ollama`, and `ollama_host` from `payload.json`, so swapping providers never requires a code change. Callers that pass an explicit `provider` argument should translate the legacy `groq`/`deepseek` identifiers via the `_PROVIDER_ALIAS` mapping declared next to each call site.
+
 ---
 
 ## 8. MCP — `skills/lazyown_mcp.py`
@@ -242,6 +250,7 @@ New helpers go here only if shared CLI↔C2. Feature-local helpers → `modules/
 | `logs/command_<tool>output<domain>.txt` | run_command CSV logger | facts_show |
 | `LazyOwn_session_report.csv` | every command | timeline_narrator, threat_model |
 | `credentials*.txt`, `hash*.txt` | reactive_engine, do_responder | later phases |
+| `vulns_<rhost>.json` | `do_vulns` via `utils.VulnerabilityScanner.persist` | `get_target_context`, reactive_engine, report generator |
 | `world_model.json` | autonomous_daemon | session_state, recommend_next |
 | `tasks.json` | campaign_tasks | sitrep, dashboard |
 | `objectives.jsonl` | inject_objective | autonomous_daemon |
@@ -343,6 +352,7 @@ When invoking Claude/Groq/Ollama (`lazyown_llm_ask`, `swan_run`, `hive_spawn`, `
 | New MCP tool | `skills/lazyown_mcp.py` |
 | New autonomous selector | subclass `BaseSelector` in `skills/autonomous_daemon.py` |
 | New AI agent persona | `skills/lazyown_groq_agents.py` registry |
+| New LLM backend | implement `AIModel` in `modules/ai_model.py`, register identifier in `modules/llm_factory.SUPPORTED_BACKENDS`, expose via the `_PROVIDER_ALIAS` mapping when callers need the legacy `groq`/`deepseek` identifiers |
 | New knowledge base | new parquet + `lazyown_parquet_query` mode |
 | New directory | create + `README.md` immediately |
 

COMMANDS.md

@@ -46,6 +46,49 @@ Args:
 Returns:
     data unchanged — the hook must return PostcommandData.
 
+## _read_recent_commands_for_autosuggest
+Return the last ``limit`` first-tokens from the session transcript.
+
+The transcript lives at ``sessions/LazyOwn_session_report.csv``.
+Newest entries appear last in the returned list.
+
+Args:
+    limit: Maximum number of distinct command names to return.
+
+Returns:
+    A list of command first-tokens. Empty when the file is
+    absent or unreadable.
+
+## _refresh_autosuggest
+Recompute the active suggestion from the engine's provider chain.
+
+Reads ``enable_autosuggest`` from ``self.params`` so the
+operator can toggle the feature with ``set enable_autosuggest
+false`` without restarting the shell. Commands listed in the
+engine's skip set are passed through unchanged so help/exit
+do not poison the context.
+
+Args:
+    executed_command: First-line of the command that just
+        executed. The engine drops it into
+        :class:`cli.autosuggest.SuggestionContext.last_command`.
+
+## _autosuggest_hook
+Refresh the next-command suggestion and print one dim hint line.
+
+The hint is printed below the command output, never injected
+into ``self.prompt``, so readline column accounting stays
+intact and the prompt itself remains clean. Failure inside the
+hook is swallowed — at worst the operator sees no hint.
+
+Args:
+    data: cmd2 PostcommandData containing the executed
+        statement.
+
+Returns:
+    ``data`` unchanged. cmd2 expects the hook to return the
+    same PostcommandData reference.
+
 ## _engagement_hook
 Post-command hook: biological curiosity reveal + VRI reward.
 
@@ -3114,6 +3157,96 @@ Example:
 Note:
     Ensure that the `rhost` is valid by checking it with the `check_rhost` function before updating the prompt.
 
+## next
+Execute the active next-command suggestion (alias ``.``).
+
+The autosuggest engine prints a dim ``press '.' to run: <cmd>``
+line after every command. ``next`` (or ``.``) pops that
+suggestion, runs it via ``onecmd_plus_hooks`` so every regular
+pre/post hook fires, and then forces the engine to recompute
+using the executed command as ``last_command`` — guaranteeing
+the next suggestion advances even if cmd2 does not re-fire its
+postcmd hook for the nested call.
+
+Args:
+    line: Ignored. Present to satisfy the cmd2 ``do_*``
+        contract.
+
+Returns:
+    None.
+
+## daemon_mode
+Switch the autonomous daemon between auto, approval and paused modes.
+
+Usage:
+    daemon_mode auto       Run without operator gating (default).
+    daemon_mode approval   Require operator approval per command.
+    daemon_mode paused     Block the loop before the next step.
+
+The selected mode is persisted to
+``sessions/daemon_control.json`` and read by the daemon before
+every step. No daemon restart is required.
+
+Args:
+    line: Whitespace-stripped mode name.
+
+Returns:
+    None.
+
+## daemon_pause
+Pause the autonomous daemon before its next step.
+
+Equivalent to ``daemon_mode paused``. The daemon polls the
+control file between steps and resumes once the mode flips back
+to auto or approval.
+
+Args:
+    line: Ignored.
+
+## daemon_resume
+Resume the autonomous daemon (switch mode to auto).
+
+Args:
+    line: Ignored.
+
+## daemon_veto
+Add or clear vetoed command first-tokens for the autonomous daemon.
+
+Usage:
+    daemon_veto add <command>       Block <command> on future steps.
+    daemon_veto remove <command>    Remove a previously-blocked command.
+    daemon_veto clear               Drop every veto entry.
+    daemon_veto                     List the current vetoes.
+
+Args:
+    line: Sub-command plus optional command token.
+
+## daemon_focus
+Restrict the autonomous daemon to a set of focus targets.
+
+Usage:
+    daemon_focus <ip_or_host> [<ip_or_host> ...]
+    daemon_focus clear         Drop the focus list (run anywhere).
+    daemon_focus               Print the current focus targets.
+
+Args:
+    line: Whitespace-separated list of targets or sub-command.
+
+## daemon_approve
+Approve or veto the daemon's currently-pending action.
+
+Usage:
+    daemon_approve                   Approve the active pending action.
+    daemon_approve veto              Veto the active pending action.
+    daemon_approve show              Print the pending action (no decision).
+
+The active action lives in ``sessions/daemon_control.json``
+under ``pending`` and is created by the daemon when running in
+approval mode.
+
+Args:
+    line: Optional sub-command.
+
 ## banner
 Show the banner
 
@@ -8955,16 +9088,23 @@ Parameters:
 Return None
 
 ## vulns
-Scan for vulnerabilities based on a provided service banner.
+Search the NVD for CVEs matching a service banner and persist findings.
 
-This function initializes a vulnerability scanner and searches for CVEs (Common Vulnerabilities and Exposures)
-related to the specified service banner. If no service banner is provided, it prompts the user to enter one.
+The configured ``rhost`` value from ``payload.json`` is used as
+the target identifier for the persisted JSON report. The scanner
+respects the operator's ``user_agent_lin`` setting when present
+so reconnaissance traffic shares the same fingerprint across the
+framework.
 
 Args:
-    line (str): The service banner to search for vulnerabilities. If not provided, the user will be prompted to enter one.
+    line: Optional service banner. When empty the operator is
+        prompted interactively; the input is stripped of
+        surrounding whitespace before being sent to the NVD.
 
 Returns:
-    None
+    None. Results are printed to the shell and persisted to
+    ``sessions/vulns_<rhost>.json`` so the reactive engine and
+    report generator can consume them without re-scanning.
 
 Example:
     do_vulns "ProFTPD 1.3.5"