feat: YWH in Programs+pipeline, findings-count fix, Scans-page triggers, pipeline httpx

- programs: native YesWeHack fetch (fetchYWHPrograms via bbscope) wired into the
  Programs warmer + serveProgramsPayload 'ywh' filter + has_ywh_token. YWH now
  shows on the Programs page and feeds the root pipeline (which uses the same
  aggregation). H1/BC/YWH 'has token' now derive from accounts.Count.
- findings tag: the standalone global-nuclei scan and the root pipeline never
  called db.UpdateScanStats, so files_uploaded stayed 0 and the 'N findings' tag
  never showed. Both now record their match count; 'pipeline' added to
  indexScanArtifacts (results become viewable) and to the Scans-page finding-type
  lists (label reads 'findings').
- scans page: add Root Pipeline + Run Nuclei Template buttons to the Scans view
  header (reusing the existing global modals) so both are reachable there too.
- pipeline: add the httpx live-host step (livehosts.FilterLiveHosts) between
  enumeration and nuclei — scans only live hosts (falls back to all subs), matching
  the agreed workflow: roots(all platforms) → new-only → enum → httpx → nuclei → Discord.
- test: migration test made robust to the shared global db instance.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: h0tak88r

internal/accounts/accounts_test.go

@@ -21,31 +21,63 @@ func TestMigrateEnvAccounts(t *testing.T) {
 		t.Fatalf("db.EnsureSchema: %v", err)
 	}
 
-	t.Setenv("H1_USERNAME", "0x88")
-	t.Setenv("H1_TOKEN", "h1-secret")
-	t.Setenv("BUGCROWD_TOKEN", "bc-secret")
+	// Use a distinct platform (Intigriti) + unique token so the assertions are
+	// robust even though db.Init caches one global instance across tests.
+	t.Setenv("INTIGRITI_TOKEN", "it-secret-xyz")
 
 	MigrateEnvAccounts()
 
-	// h1 env creds imported as a "default" DB account.
-	rows, err := db.ListBBPAccounts("h1")
-	if err != nil {
-		t.Fatalf("ListBBPAccounts(h1): %v", err)
-	}
-	if len(rows) != 1 || rows[0].Label != "default" || rows[0].Username != "0x88" || rows[0].Token != "h1-secret" {
-		t.Fatalf("h1 not imported correctly: %+v", rows)
+	// The env Intigriti token is imported as a "default" DB account.
+	def := findAccount(t, "it", "default")
+	if def.Token != "it-secret-xyz" {
+		t.Fatalf("it/default not imported correctly: %+v", def)
 	}
 
-	// After migration, For(h1) serves exactly the DB account — the env account is
-	// no longer injected (would otherwise duplicate the same credential).
-	acc := For("h1")
-	if len(acc) != 1 || acc[0].Source != "db" || acc[0].Token != "h1-secret" {
-		t.Fatalf("For(h1) after migration = %+v, want one db account", acc)
+	// After migration, For(it) no longer injects an env-source account (DB is
+	// authoritative) and does include the migrated credential.
+	foundMigrated := false
+	for _, a := range For("it") {
+		if a.Source == "env" {
+			t.Fatalf("env account still injected after migration: %+v", a)
+		}
+		if a.Token == "it-secret-xyz" {
+			foundMigrated = true
+		}
+	}
+	if !foundMigrated {
+		t.Fatalf("migrated it account missing from For(it)")
 	}
 
-	// Idempotent: a second run must not create duplicates.
+	// Idempotent: a second run must not create a duplicate "default".
 	MigrateEnvAccounts()
-	if rows2, _ := db.ListBBPAccounts("h1"); len(rows2) != 1 {
-		t.Fatalf("migration not idempotent: %d h1 rows", len(rows2))
+	if n := countAccounts(t, "it", "default"); n != 1 {
+		t.Fatalf("migration not idempotent: %d it/default accounts", n)
+	}
+}
+
+func findAccount(t *testing.T, platform, label string) db.BBPAccount {
+	t.Helper()
+	rows, err := db.ListBBPAccounts(platform)
+	if err != nil {
+		t.Fatalf("ListBBPAccounts(%s): %v", platform, err)
+	}
+	for _, r := range rows {
+		if r.Label == label {
+			return r
+		}
+	}
+	t.Fatalf("no %s/%s account found in %+v", platform, label, rows)
+	return db.BBPAccount{}
+}
+
+func countAccounts(t *testing.T, platform, label string) int {
+	t.Helper()
+	rows, _ := db.ListBBPAccounts(platform)
+	n := 0
+	for _, r := range rows {
+		if r.Label == label {
+			n++
+		}
 	}
+	return n
 }

internal/api/api.go

@@ -1577,7 +1577,7 @@ func indexScanArtifacts(scanID, scanType, target string) {
 		"urls": true, "js": true, "jsscan": true, "reflection": true,
 		"nuclei": true, "tech": true, "ports": true, "gf": true,
 		"backup": true, "aem": true, "depconfusion": true, "wp_confusion": true,
-		"zerodays": true,
+		"zerodays": true, "pipeline": true,
 	}
 
 	if domainRootTypes[scanType] && target != "" {

internal/api/pipeline_api.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 	"github.com/h0tak88r/AutoAR/internal/db"
+	"github.com/h0tak88r/AutoAR/internal/scanner/livehosts"
 	"github.com/h0tak88r/AutoAR/internal/scanner/nuclei"
 	scopemod "github.com/h0tak88r/AutoAR/internal/scanner/scope"
 	"github.com/h0tak88r/AutoAR/internal/scanner/subdomains"
@@ -114,31 +115,45 @@ func runRootPipeline(scanID, template string, newOnly bool, threads, maxRoots in
 			defer wg.Done()
 			defer func() { <-sem }()
 			subs, err := subdomains.EnumerateSubdomains(root, threads)
-			mu.Lock()
-			defer mu.Unlock()
-			done++
 			if err != nil {
+				mu.Lock()
+				done++
 				stdLog(scanID, "[WARN] enum %s failed: %v", root, err)
+				mu.Unlock()
 				return
 			}
 			if len(subs) > 0 {
 				if ierr := db.BatchInsertSubdomains(root, subs, false); ierr != nil {
 					stdLog(scanID, "[WARN] store %s subs failed: %v", root, ierr)
 				}
-				allSubs = append(allSubs, subs...)
 			}
-			stdLog(scanID, "[OK] %s → %d subs (%d/%d roots)", root, len(subs), done, len(targetRoots))
+			// httpx: probe for live hosts (marks live in the DB) and scan only those.
+			// Falls back to the raw subdomains if the probe finds nothing (nuclei does
+			// its own probing anyway, so no host is lost).
+			targets := subs
+			liveN := 0
+			if res, herr := livehosts.FilterLiveHosts(root, threads, true); herr == nil && res != nil && res.LiveSubsFile != "" {
+				if live, rerr := utils.ReadLines(res.LiveSubsFile); rerr == nil && len(live) > 0 {
+					targets = live
+					liveN = len(live)
+				}
+			}
+			mu.Lock()
+			done++
+			allSubs = append(allSubs, targets...)
+			stdLog(scanID, "[OK] %s → %d subs, %d live (%d/%d roots)", root, len(subs), liveN, done, len(targetRoots))
+			mu.Unlock()
 		}(r)
 	}
 	wg.Wait()
 
 	allSubs = uniqueStrings(allSubs)
-	stdLog(scanID, "[INFO] enumeration complete: %d new subdomain(s)", len(allSubs))
+	stdLog(scanID, "[INFO] enumeration + httpx complete: %d live host(s) to scan", len(allSubs))
 	if len(allSubs) == 0 {
-		utils.SendMonitorWebhook(" Root Pipeline: enumeration found no subdomains for the new roots.")
+		utils.SendMonitorWebhook(" Root Pipeline: no live hosts found for the new roots.")
 		return nil
 	}
-	utils.SendMonitorWebhook(fmt.Sprintf(" Root Pipeline: enumerated **%d** subdomains — running nuclei…", len(allSubs)))
+	utils.SendMonitorWebhook(fmt.Sprintf(" Root Pipeline: %d live host(s) — running nuclei…", len(allSubs)))
 
 	// Write the discovered subs to a temp target file for nuclei.
 	tmpFile, err := os.CreateTemp("", "root-pipeline-targets-*.txt")
@@ -179,6 +194,9 @@ func runRootPipeline(scanID, template string, newOnly bool, threads, maxRoots in
 		return fmt.Errorf("nuclei scan failed: %w", err)
 	}
 
+	// Record the finding count so the Scans page shows the "N findings" tag.
+	_ = db.UpdateScanStats(scanID, matches, 0)
+
 	stdLog(scanID, "[OK] Root Pipeline complete — %d roots, %d subs, %d matches", len(targetRoots), len(allSubs), matches)
 	utils.SendMonitorWebhook(fmt.Sprintf(" **Root Pipeline complete**\nTemplate: `%s`\nNew roots: %d\nSubdomains: %d\nMatches: %d",
 		tplName, len(targetRoots), len(allSubs), matches))

internal/api/programs_api.go

@@ -243,6 +243,10 @@ func serveProgramsPayload(c *gin.Context, payload programsCachePayload, platform
 			if p.Platform == "it" {
 				programs = append(programs, p)
 			}
+		case "ywh", "yeswehack":
+			if p.Platform == "ywh" {
+				programs = append(programs, p)
+			}
 		case "ha", "hackadvisor", "external":
 			if p.Platform == "ha" {
 				programs = append(programs, p)
@@ -258,6 +262,7 @@ func serveProgramsPayload(c *gin.Context, payload programsCachePayload, platform
 		"has_h1_token":   payload.HasH1Token,
 		"has_bc_token":   payload.HasBCToken,
 		"has_it_token":   payload.HasITToken,
+		"has_ywh_token":  payload.HasYWHToken,
 		"has_ha_token":   payload.HasHAToken,
 		"scope_included": true,
 		"warm":           true,

internal/api/programs_cache.go

@@ -8,6 +8,7 @@ import (
 	"sync"
 	"time"
 
+	"github.com/h0tak88r/AutoAR/internal/accounts"
 	"github.com/h0tak88r/AutoAR/internal/db"
 )
 
@@ -42,6 +43,7 @@ type programsCachePayload struct {
 	HasH1Token  bool             `json:"has_h1_token"`
 	HasBCToken  bool             `json:"has_bc_token"`
 	HasITToken  bool             `json:"has_it_token"`
+	HasYWHToken bool             `json:"has_ywh_token"`
 	HasHAToken  bool             `json:"has_ha_token"`
 	GeneratedAt time.Time        `json:"generated_at"`
 }
@@ -133,6 +135,21 @@ func buildProgramsPayload() programsCachePayload {
 		mu.Unlock()
 	}()
 
+	// YesWeHack — native fetch across every configured YWH account (bbscope). No-op
+	// unless a YWH account/token is configured.
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		progs, err := fetchYWHPrograms(true, true)
+		if err != nil {
+			log.Printf("[PROGRAMS] YesWeHack fetch failed: %v", err)
+			return
+		}
+		mu.Lock()
+		all = append(all, progs...)
+		mu.Unlock()
+	}()
+
 	// HackAdvisor — external targets aggregator (Immunefi, Standoff365, BI.ZONE,
 	// YesWeHack, self-hosted, …). No-op unless HACKADVISOR_TOKEN is set. The list
 	// already carries scope_count + scope_updated_at, so no per-program enrichment.
@@ -160,9 +177,10 @@ func buildProgramsPayload() programsCachePayload {
 
 	return programsCachePayload{
 		Programs:    all,
-		HasH1Token:  os.Getenv("H1_USERNAME") != "" && os.Getenv("H1_TOKEN") != "",
-		HasBCToken:  os.Getenv("BUGCROWD_TOKEN") != "",
+		HasH1Token:  accounts.Count("h1") > 0,
+		HasBCToken:  accounts.Count("bc") > 0,
 		HasITToken:  hasIntigritiToken(),
+		HasYWHToken: accounts.Count("ywh") > 0,
 		HasHAToken:  hasHackAdvisorToken(),
 		GeneratedAt: time.Now().UTC(),
 	}

internal/api/programs_ywh.go

@@ -0,0 +1,90 @@
+package api
+
+import (
+	"strings"
+
+	"github.com/h0tak88r/AutoAR/internal/accounts"
+	scopemod "github.com/h0tak88r/AutoAR/internal/scanner/scope"
+	"github.com/sw33tLie/bbscope/pkg/scope"
+)
+
+// fetchYWHPrograms fetches YesWeHack programs (with in-scope assets) across every
+// configured YWH account and merges them, so YesWeHack shows up on the Programs
+// page and feeds the root pipeline just like HackerOne/Bugcrowd/Intigriti. Uses
+// bbscope's YesWeHack client via scopemod.FetchScope. includeScope is accepted for
+// signature parity with the other fetchers — bbscope always returns scope.
+func fetchYWHPrograms(bbpOnly, includeScope bool) ([]ProgramSummary, error) {
+	_ = includeScope
+	accts := accounts.For("ywh")
+	if len(accts) == 0 {
+		return nil, nil
+	}
+	var merged []ProgramSummary
+	idx := map[string]int{}
+	var firstErr error
+	for _, a := range accts {
+		if a.Token == "" && (a.Email == "" || a.Password == "") {
+			continue
+		}
+		programs, err := scopemod.FetchScope(scopemod.Options{
+			Platform:   scopemod.PlatformYesWeHack,
+			Token:      a.Token,
+			Email:      a.Email,
+			Password:   a.Password,
+			Categories: "all",
+			BBPOnly:    bbpOnly,
+			IncludeOOS: true,
+		})
+		if err != nil {
+			if firstErr == nil {
+				firstErr = err
+			}
+			continue
+		}
+		var summaries []ProgramSummary
+		for _, pd := range programs {
+			if s, ok := ywhProgramDataToSummary(pd); ok {
+				summaries = append(summaries, s)
+			}
+		}
+		merged = mergeProgramsByHandle(merged, idx, summaries, a.Label)
+	}
+	if len(merged) == 0 && firstErr != nil {
+		return nil, firstErr
+	}
+	return merged, nil
+}
+
+// ywhProgramDataToSummary converts a bbscope ProgramData (URL + scope) into a
+// ProgramSummary. bbscope carries no program name, so the URL slug is the handle.
+func ywhProgramDataToSummary(pd scope.ProgramData) (ProgramSummary, bool) {
+	handle := ywhHandleFromURL(pd.Url)
+	s := ProgramSummary{
+		Platform:       "ywh",
+		Handle:         handle,
+		Name:           handle,
+		URL:            pd.Url,
+		OffersBounties: true, // BBPOnly filter already applied upstream
+	}
+	for _, e := range pd.InScope {
+		t := strings.TrimSpace(e.Target)
+		if t == "" {
+			continue
+		}
+		s.ScopeTargets++
+		s.Assets = append(s.Assets, t)
+		if s.LatestTarget == "" {
+			s.LatestTarget = t
+			s.LatestTargetBrief = strings.TrimSpace(e.Description)
+		}
+	}
+	return s, pd.Url != "" || s.ScopeTargets > 0
+}
+
+func ywhHandleFromURL(u string) string {
+	u = strings.TrimRight(strings.TrimSpace(u), "/")
+	if i := strings.LastIndex(u, "/"); i >= 0 && i < len(u)-1 {
+		return u[i+1:]
+	}
+	return u
+}

internal/api/ui/index.html

@@ -243,9 +243,19 @@ <h1 class="view-title">Overview</h1>
       <!-- ══════════════════════════════════════════════════════════════════ -->
       <div class="view" id="view-scans">
 
-        <div class="view-header">
-          <h1 class="view-title">Scans</h1>
-          <div class="view-subtitle">Active and recent scan history</div>
+        <div class="view-header" style="display:flex;align-items:center;justify-content:space-between;flex-wrap:wrap;gap:12px">
+          <div>
+            <h1 class="view-title">Scans</h1>
+            <div class="view-subtitle">Active and recent scan history</div>
+          </div>
+          <div style="display:flex;gap:12px;align-items:center;flex-wrap:wrap">
+            <button id="scans-root-pipeline-btn" class="btn btn-primary" style="font-size:12px;padding:7px 16px;gap:6px;display:flex;align-items:center;background:var(--accent-emerald-dim);color:var(--accent-emerald);border-color:rgba(16,185,129,0.3)" onclick="promptRootPipeline()">
+               Root Pipeline
+            </button>
+            <button id="scans-run-nuclei-btn" class="btn btn-primary" style="font-size:12px;padding:7px 16px;gap:6px;display:flex;align-items:center;background:var(--accent-purple-dim);color:var(--accent-purple);border-color:rgba(168,85,247,0.3)" onclick="promptRunGlobalNuclei()">
+               Run Nuclei Template
+            </button>
+          </div>
         </div>
 
         <div id="scans-container">

internal/api/ui/pages/scans-page.js

@@ -149,7 +149,7 @@
           <span style="font-size:11px;color:var(--text-muted)">Phase ${currentPhase}${totalPhases > 0 ? '/' + totalPhases : ''} · ${pct}%</span>
           <div style="display:flex;gap:10px;align-items:center">
             ${(() => {
-    const isFindingType = ['reflection', 'dns_cf1016', 'dns-cf1016', 'dns', 'dns-takeover', 'dns-dangling-ip', 'nuclei', 'nuclei-full', 'nuclei-cves', 'nuclei-panels', 'nuclei-vulnerabilities', 'nuclei-default-logins', 'misconfig', 's3', 'github', 'github_org', 'github_scan', 'zerodays', 'gf', 'ffuf', 'sqlmap', 'backup', 'mcp-discovery'].includes(scanType);
+    const isFindingType = ['reflection', 'dns_cf1016', 'dns-cf1016', 'dns', 'dns-takeover', 'dns-dangling-ip', 'nuclei', 'nuclei-full', 'nuclei-cves', 'nuclei-panels', 'nuclei-vulnerabilities', 'nuclei-default-logins', 'misconfig', 's3', 'github', 'github_org', 'github_scan', 'zerodays', 'pipeline', 'gf', 'ffuf', 'sqlmap', 'backup', 'mcp-discovery'].includes(scanType);
     const label = isFindingType ? (filesUploaded === 1 ? 'finding' : 'findings') : (filesUploaded === 1 ? 'file' : 'files');
     const icon = isFindingType ? '' : '';
     return filesUploaded > 0 ? `<span style="font-size:10px;color:var(--text-muted)">${icon} ${filesUploaded} ${label}</span>` : '';
@@ -218,7 +218,7 @@
     const elapsed = completedAt ? elapsedBetween(startedAt, completedAt) : elapsedStr(startedAt);
     const scanID = s.scan_id || s.ScanID || '';
     const filesUploaded = s.files_uploaded || s.FilesUploaded || 0;
-    const isFindingType = ['reflection', 'dns_cf1016', 'dns-cf1016', 'dns', 'dns-takeover', 'dns-dangling-ip', 'nuclei', 'nuclei-full', 'nuclei-cves', 'nuclei-panels', 'nuclei-vulnerabilities', 'nuclei-default-logins', 'misconfig', 's3', 'github', 'github_org', 'github_scan', 'zerodays', 'jwt', 'gf', 'ffuf', 'sqlmap', 'backup', 'mcp-discovery'].includes(scanType);
+    const isFindingType = ['reflection', 'dns_cf1016', 'dns-cf1016', 'dns', 'dns-takeover', 'dns-dangling-ip', 'nuclei', 'nuclei-full', 'nuclei-cves', 'nuclei-panels', 'nuclei-vulnerabilities', 'nuclei-default-logins', 'misconfig', 's3', 'github', 'github_org', 'github_scan', 'zerodays', 'jwt', 'pipeline', 'gf', 'ffuf', 'sqlmap', 'backup', 'mcp-discovery'].includes(scanType);
     const label = isFindingType ? 'findings' : 'files';
     const icon = isFindingType ? '' : '';
     const badgeHtml = filesUploaded > 0 ? `<span class="badge badge-running" style="font-size:10px;padding:2px 6px;margin-bottom:4px;display:inline-block;background:rgba(6,182,212,0.15);border:1px solid rgba(6,182,212,0.3);color:var(--accent-cyan);cursor:help" title="${filesUploaded} ${label} identified">${icon} ${filesUploaded} ${label}</span><br/>` : '';

internal/api/ui_api.go

@@ -735,6 +735,9 @@ func apiRunGlobalNuclei(c *gin.Context) {
 			return fmt.Errorf("nuclei SDK scan failed: %w", err)
 		}
 
+		// Record the finding count so the Scans page shows the "N findings" tag.
+		_ = db.UpdateScanStats(scanID, matches, 0)
+
 		stdLog(scanID, "[OK] Global Nuclei scan completed. Matches: %d", matches)
 		utils.SendWebhookLogAsync(fmt.Sprintf(" **Global Nuclei Scan Completed**\nTemplate: `%s`\nTargets: %d\nMatches: %d", templateNameForLog, totalSubs, matches))