feat: add support for js-endpoints and katana-crawler modules, cleanup font loading, and update scan analysis logic

Author: h0tak88r

internal/api/ui/index.html

@@ -5,8 +5,7 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
   <title>AutoAR Dashboard</title>
   <meta name="description" content="AutoAR — Automated Attack Surface Recon dashboard. Monitor domains, scans, R2 files and change events in real time." />
-  <link rel="preconnect" href="https://fonts.googleapis.com" />
-  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+
   <link rel="stylesheet" href="/ui/styles.css" />
   <link rel="icon" type="image/png" href="/ui/logo.png" />
 </head>

internal/api/ui/pages/scan-common.js

@@ -91,6 +91,8 @@
     const n = String(fileName || '').toLowerCase();
     if (!n) return 'unknown';
     // JS secret artifacts (check this before generic github/secret checks)
+    if (n.includes('js-endpoint')) return 'js-endpoints';
+    if (n.includes('katana')) return 'katana-crawler';
     if (n.includes('js-secret') || n.includes('js-exposure') || n.includes('js-analysis') || n.startsWith('js-sec')) return 'js-analysis';
     if (n.includes('/apkx/') || n.includes('\\apkx\\')) return 'apkx';
     // GitHub must be BEFORE generic "secret" match
@@ -151,7 +153,9 @@
       'subdomain-enum': { icon: '🔗', name: 'Subdomains', color: '#6366f1' },
       httpx: { icon: '🌐', name: 'Live Hosts', color: '#22c55e' },
       apkx: { icon: '📱', name: 'APK Analysis', color: '#22d3ee' },
-      'js-analysis': { icon: '📜', name: 'JS Analysis', color: '#eab308' },
+      'js-analysis': { icon: '📜', name: 'JS Secrets', color: '#eab308' },
+      'js-endpoints': { icon: '🛣️', name: 'JS Endpoints', color: '#10b981' },
+      'katana-crawler': { icon: '🕷️', name: 'Katana Crawler', color: '#8b5cf6' },
       'xss-detection': { icon: '💥', name: 'XSS Detection', color: '#f97316' },
       'sql-detection': { icon: '🗻', name: 'SQLi', color: '#dc2626' },
       'gf-patterns': { icon: '🎯', name: 'GF Patterns', color: '#8b5cf6' },

internal/api/ui/pages/scan-detail.js

@@ -395,21 +395,28 @@
 
         const looksLikeJSMatcher = (/^\s*\[[^\]]+\].*->/i.test(finding) || (file.includes('js-') && !file.includes('trufflehog') && !file.includes('github'))) && !file.includes('trufflehog') && !file.includes('github-secrets');
         const looksLikeJSURL = file.includes('js-url') || /\.m?jsx?(\?|$)/i.test(target);
-        // Exclude JS analysis files from GitHub bucket
+        const looksLikeJSEndpoints = file.includes('js-endpoint') || moduleNorm === 'js-endpoints';
+        const looksLikeKatana = file.includes('katana') || moduleNorm === 'katana-crawler' || moduleNorm === 'katana';
         const looksLikeGitHub = (file.includes('github') || file.includes('trufflehog') || file.includes('secrets_table') || file.includes('github-secrets') || (file.includes('secrets') && file.endsWith('.json'))) && !file.startsWith('js-');
 
         if (looksLikeGitHub) kind = 'github-scan';
+        else if (looksLikeJSEndpoints) kind = 'js-endpoints';
+        else if (looksLikeKatana) kind = 'katana-crawler';
         else if (looksLikeJSMatcher) kind = 'js-analysis';
         else if (looksLikeJSURL && kind === 'other') kind = 'js_urls';
         if (isAPKScan) kind = 'apkx';
 
         // Do not treat GitHub/TruffleHog rows as JS just because the blob URL ends in .js
-        const isJS = kind !== 'github-scan' && (kind === 'js_urls' || looksLikeJSURL);
+        const isJS = kind !== 'github-scan' && kind !== 'js-endpoints' && kind !== 'katana-crawler' && (kind === 'js_urls' || looksLikeJSURL);
         if (kind === 'js_urls') kind = 'urls';
 
         let normalizedModule = isAPKScan ? 'apkx' : moduleNorm;
         if (kind === 'github-scan') {
           normalizedModule = 'github-scan';
+        } else if (kind === 'js-endpoints') {
+          normalizedModule = 'js-endpoints';
+        } else if (kind === 'katana-crawler') {
+          normalizedModule = 'katana-crawler';
         } else if (moduleNorm === 'unknown' && (kind === 'js-analysis' || isJS)) {
           normalizedModule = 'js-analysis';
         }
@@ -457,13 +464,16 @@
       assets: '🏠 Assets',
       urls: '🔗 Links',
       apkx: '📱 APK Analysis',
-      'js-analysis': '📜 JS Analysis',
+      'js-analysis': '📜 JS Secrets',
+      'js-endpoints': '🛣️ JS Endpoints',
+      'katana-crawler': '🕷️ Katana',
       'gf-patterns': '🎯 GF Patterns',
       nuclei: '☢️ Nuclei',
       ffuf: '🎲 FFUF',
       buckets: '🪣 S3 Buckets',
       ports: '📡 Ports',
       reflection: '🔎 Reflection',
+      'xss-detection': '🐛 XSS (Dalfox)',
       'github-scan': '🐦 GitHub Secrets',
       other: '📁 Other',
       github: '🐙 GitHub Secrets',
@@ -478,7 +488,7 @@
 
     dynamicKinds.forEach(k => {
       if (k === 'subdomains' || k === 'assets' || k === 'vuln' || VULN_KINDS.has(k) || k === 'github-scan') {
-        if (['js-analysis', 'gf-patterns', 'nuclei', 'ffuf', 'reflection', 'github-scan', 'github'].includes(k)) {
+        if (['js-analysis', 'js-endpoints', 'katana-crawler', 'gf-patterns', 'nuclei', 'ffuf', 'reflection', 'xss-detection', 'github-scan', 'github'].includes(k)) {
           DATASET_TABS.push([k, TAB_LABELS[k] || k]);
         }
         return;
@@ -501,7 +511,7 @@
 
     const preferredModuleOrder = [
       'nuclei', 'gf-patterns', 'misconfig', 'ffuf-fuzzing', 'dns-takeover',
-      'backup-detection', 'js-analysis', 'xss-detection', 'sql-detection',
+      'backup-detection', 'js-analysis', 'js-endpoints', 'katana-crawler', 'xss-detection', 'sql-detection',
       's3-scan', 'port-scan', 'zerodays', 'aem', 'github-scan'
     ];
     const usedModulesRaw = [...new Set(allRows.map(r => window.normalizeModuleKey(r.module)).filter(Boolean))];
@@ -513,7 +523,7 @@
       if (bi !== -1) return 1;
       return a.localeCompare(b);
     });
-    const excludedModuleTabs = new Set(['autoar', 'unknown', 'tech-detect', 'ffuf-fuzzing', 'js-analysis', 'github-scan', 'nuclei', 'ffuf', 'reflection', 'js-analysis']);
+    const excludedModuleTabs = new Set(['autoar', 'unknown', 'tech-detect', 'ffuf-fuzzing', 'js-analysis', 'js-endpoints', 'katana-crawler', 'xss-detection', 'github-scan', 'nuclei', 'ffuf', 'reflection']);
     const hasUrlsDatasetTab = UNIQUE_TABS.some((t) => t[0] === 'urls');
     if (hasUrlsDatasetTab) excludedModuleTabs.add('url-collection');
     const hasApkxDatasetTab = UNIQUE_TABS.some((t) => t[0] === 'apkx');

internal/api/ui/pages/scan-results-core.js

@@ -50,11 +50,17 @@
     if (module === 'zerodays' || fileName.includes('zeroday')) {
       if (first.cve || first.vulnerability || first.exploit) return 'zerodays-findings';
     }
-    if (module === 'js-analysis' || fileName.includes('js-')) {
+    if (module === 'js-endpoints' || fileName.includes('js-endpoint')) {
+      if (first.endpoint || first.url) return 'js-endpoints';
+    }
+    if (module === 'katana-crawler' || fileName.includes('katana')) {
+      if (first.url || first.domain) return 'katana-crawler';
+    }
+    if (module === 'js-analysis' || (fileName.includes('js-') && !fileName.includes('js-endpoint'))) {
       if (first.url || first.endpoint || first.secret || first.key) return 'js-findings';
     }
     if (module === 'xss-detection' || fileName.includes('dalfox') || fileName.includes('kxss')) {
-      if (first.url && (first.payload || first.parameter)) return 'xss-findings';
+      if (first.url && (first.payload || first.parameter || first.finding)) return 'xss-findings';
     }
     if (module === 'sql-detection' || fileName.includes('sqlmap')) {
       if (first.url && (first.parameter || first.type)) return 'sqli-findings';

internal/api/ui/styles.css

@@ -2,8 +2,7 @@
 /* AutoAR Dashboard — Premium Dark Theme                                        */
 /* ──────────────────────────────────────────────────────────────────────────── */
 
-@import url('https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700;800&family=JetBrains+Mono:wght@400;500&display=swap');
-
+/* Fonts are loaded locally or fallback to system-ui */
 :root {
   /* Backgrounds */
   --bg-base: #030712;