hotfix(hotfix): in recon command ss now work propertly \n\n Version: release/0.2.151 \n\n with lvoe \n\n LazyOwn on HackTheBox: https://app.hackthebox.com/teams/overview/6429 \n\n LazyOwn/ https://grisuno.github.io/LazyOwn/ \n\n \n\n Fecha: dom 07 jun 2026 23:12:51 -04 \n\n Hora: 1780888371

Author: grisuno

CHANGELOG.md

@@ -2,6 +2,13 @@
 # Changelog
 
 
+### Correcciones urgentes
+
+### Otros
+
+  *   * hotfix(hotfix): in recon command ss now work propertly \n\n Version: release/0.2.151 \n\n with lvoe \n\n   LazyOwn on HackTheBox: https://app.hackthebox.com/teams/overview/6429 \n\n  LazyOwn/   https://grisuno.github.io/LazyOwn/ \n\n \n\n Fecha: dom 07 jun 2026 23:12:51 -04 \n\n Hora: 1780888371
+
+
 ### Refactorización
 
 ### Otros

README.md

@@ -13021,6 +13021,20 @@ No description available.
 # Changelog
 
 
+### Refactorización
+
+### Otros
+
+  *   * refactor(refactor): some love to security issues \n\n Version: release/0.2.149 \n\n Versiones de corrección confirmadas contra la base OSV (vía pip-audit sobre el entorno real, no a ojo): \n\n Modified file(s):\n- core/payload_schema.py - lazyc2.py - lazyown.py - modules/lazyown_metaextract0r.py - pyproject.toml - requirements.txt - templates/surface_live.html - tests/test_improvements_spec.py\n  LazyOwn on HackTheBox: https://app.hackthebox.com/teams/overview/6429 \n\n  LazyOwn/   https://grisuno.github.io/LazyOwn/ \n\n \n\n Fecha: dom 07 jun 2026 13:50:59 -04 \n\n Hora: 1780854659
+
+
+### Otros
+
+### Otros
+
+  *   * update pp
+
+
 ### Refactorización
 
 ### Otros

cli/commands/_base.py

@@ -24,6 +24,7 @@
 from typing import Any
 
 from cmd2 import CommandSet
+from cmd2.exceptions import CommandSetRegistrationError
 
 SHELL_INJECTION_ATTRIBUTE = "_cmd"
 
@@ -42,6 +43,26 @@ class LazyOwnCommandSet(CommandSet):
     phase: str = ""
     category: str = ""
 
+    def _resolve_shell(self) -> Any:
+        """Return the bound parent shell, or ``None`` before registration.
+
+        ``cmd2`` stores the parent shell in a name-mangled private attribute
+        and exposes it through the :attr:`cmd2.CommandSet._cmd` property, which
+        raises :class:`CommandSetRegistrationError` until the set is
+        registered. This helper centralises that access so the migrated
+        ``do_*`` methods can forward attribute reads without leaking the cmd2
+        registration exception or depending on cmd2 internals.
+
+        Returns:
+            The parent ``LazyOwnShell`` instance once the set is registered,
+            otherwise ``None``.
+        """
+        try:
+            shell = self._cmd
+        except CommandSetRegistrationError:
+            return None
+        return shell if shell is not self else None
+
     @property
     def params(self) -> dict[str, Any]:
         """Return the live ``params`` dict owned by the parent shell.
@@ -50,7 +71,7 @@ def params(self) -> dict[str, Any]:
             The same dict object that ``LazyOwnShell.params`` exposes when
             the set is registered, or an empty dict when it is not.
         """
-        shell = self.__dict__.get(SHELL_INJECTION_ATTRIBUTE)
+        shell = self._resolve_shell()
         return getattr(shell, "params", {}) if shell is not None else {}
 
     @property
@@ -62,7 +83,7 @@ def payload(self) -> Any:
             ``LazyOwnShell.params`` so callers always receive a mapping-
             like object. Falls back to an empty dict before registration.
         """
-        shell = self.__dict__.get(SHELL_INJECTION_ATTRIBUTE)
+        shell = self._resolve_shell()
         if shell is None:
             return {}
         return getattr(shell, "config", None) or getattr(shell, "params", {})
@@ -88,8 +109,8 @@ def __getattr__(self, name: str) -> Any:
         """
         if name.startswith("_"):
             raise AttributeError(name)
-        shell = self.__dict__.get(SHELL_INJECTION_ATTRIBUTE)
-        if shell is None or shell is self:
+        shell = self._resolve_shell()
+        if shell is None:
             raise AttributeError(name)
         return getattr(shell, name)