fix: 9 execution pipeline bugs — domain phases, description mismatches, log capture

Bugs fixed:
- Bug 1: Domain scans now use domainWorkflowPhaseSpecs (previously all
  domain phases showed 'pending' because only subdomain specs existed).
- Bug 2: js-analysis spec description fixed to match workflow
  ('[Stage 2] JS secrets scan' instead of '[Stage 2] JS scan').
- Bug 3: js-endpoints spec moved to Stage 3 with correct description
  ('[Stage 3] JS endpoint extraction' instead of '[Stage 2] JS Endpoints').
- Bug 4: Removed github-scan from subdomain spec (never executed).
- Bug 5: Fixed inferModuleFromFileName mismatches (katana-crawler→katana,
  aem-scan→aem, JS-Enum→url-collection). Removed dead code.
- Bug 8: Output files now prefer PhaseKey lookup over Module, fixing
  duplicate dns-takeover entries sharing the same file list.
- Bug 9: Timeout goroutine now propagates scan ID (SetGoroutineScanID)
  so log entries in timed phases are correctly captured.
- Bug 10: Semaphore cleanup goroutine now times out after 5 min on hung
  fn(), preventing permanent slot leaks.
- Bug 13: Phase log buffer flush is now atomic (get+delete in one lock)
  reducing race window with concurrent writes.
- Bug 14: EOF check in ReadPhaseLogFile uses errors.Is(io.EOF) instead
  of fragile string comparison.
- Bug 19: XSS-safe fallback escaping in scan-detail-manifest.js when
  window.esc is unavailable.

Author: h0tak88r

internal/api/scan_results_api.go

@@ -174,7 +174,7 @@ var subdomainWorkflowPhaseSpecs = []workflowPhaseSpec{
 	{Module: "tech-detect", Description: "[Stage 2] Technology detection", PhaseKey: "tech"},
 	{Module: "port-scan", Description: "[Stage 2] Port scan", PhaseKey: "ports"},
 	{Module: "url-collection", Description: "[Stage 2] URL collection", PhaseKey: "urls"},
-	{Module: "js-analysis", Description: "[Stage 2] JS scan", PhaseKey: "js-analysis"},
+	{Module: "js-analysis", Description: "[Stage 2] JS secrets scan", PhaseKey: "js-analysis"},
 	{Module: "aem", Description: "[Stage 2] AEM scan", PhaseKey: "aem"},
 	{Module: "dns-takeover", Description: "[Stage 2] DNS scan", PhaseKey: "dns"},
 	{Module: "s3-scan", Description: "[Stage 2] S3 bucket enumeration and scanning", PhaseKey: "s3"},
@@ -183,16 +183,36 @@ var subdomainWorkflowPhaseSpecs = []workflowPhaseSpec{
 	{Module: "wordpress-confusion", Description: "[Stage 2] WordPress confusion", PhaseKey: "wp_confusion"},
 	{Module: "dependency-confusion", Description: "[Stage 2] Dependency confusion", PhaseKey: "depconfusion"},
 	{Module: "misconfig", Description: "[Stage 2] Misconfig scan", PhaseKey: "misconfig"},
-	{Module: "js-endpoints", Description: "[Stage 2] JS Endpoints", PhaseKey: "js-endpoints"},
-	{Module: "github-scan", Description: "[Stage 2] GitHub Secrets", PhaseKey: "github-scan"},
 	{Module: "katana", Description: "[Stage 2.5] Katana crawler", PhaseKey: "katana"},
 	{Module: "gf-patterns", Description: "[Stage 3] GF scan", PhaseKey: "gf"},
+	{Module: "js-endpoints", Description: "[Stage 3] JS endpoint extraction", PhaseKey: "js-endpoints"},
 	{Module: "reflection", Description: "[Stage 3] Reflection scan", PhaseKey: "reflection"},
 	{Module: "ffuf-fuzzing", Description: "[Stage 3] FFuf fuzzing", PhaseKey: "ffuf"},
 	{Module: "nuclei", Description: "[Stage 3] Nuclei scan (final)", PhaseKey: "nuclei"},
 	{Module: "xss-detection", Description: "[Stage 4] Dalfox XSS confirmation", PhaseKey: "xss-detection"},
 }
 
+var domainWorkflowPhaseSpecs = []workflowPhaseSpec{
+	{Module: "subdomain-enum", Description: "Subdomain enumeration", PhaseKey: "subdomains"},
+	{Module: "dns-takeover", Description: "CNAME collection", PhaseKey: "cnames"},
+	{Module: "httpx", Description: "Live host filtering", PhaseKey: "livehosts"},
+	{Module: "tech-detect", Description: "Technology detection", PhaseKey: "tech"},
+	{Module: "port-scan", Description: "Port scanning", PhaseKey: "ports"},
+	{Module: "url-collection", Description: "URL collection", PhaseKey: "urls"},
+	{Module: "js-analysis", Description: "JavaScript scan", PhaseKey: "jsscan"},
+	{Module: "dns-takeover", Description: "DNS takeover scan", PhaseKey: "dns"},
+	{Module: "aem", Description: "AEM webapp discovery and scan", PhaseKey: "aem"},
+	{Module: "wordpress-confusion", Description: "WordPress confusion scan", PhaseKey: "wp_confusion"},
+	{Module: "dependency-confusion", Description: "Dependency confusion scan", PhaseKey: "depconfusion"},
+	{Module: "s3-scan", Description: "S3 bucket enumeration", PhaseKey: "s3"},
+	{Module: "backup-detection", Description: "Backup file discovery", PhaseKey: "backup"},
+	{Module: "misconfig", Description: "Cloud misconfiguration scan", PhaseKey: "misconfig"},
+	{Module: "reflection", Description: "Reflection scan", PhaseKey: "reflection"},
+	{Module: "gf-patterns", Description: "GF pattern matching", PhaseKey: "gf"},
+	{Module: "nuclei", Description: "Nuclei scan", PhaseKey: "nuclei"},
+	{Module: "ffuf-fuzzing", Description: "FFuf fuzzing", PhaseKey: "ffuf"},
+}
+
 
 func workflowPhaseManifestModules(rec *db.ScanRecord) []moduleExecutionEntry {
 	if rec == nil {
@@ -206,7 +226,13 @@ func workflowPhaseManifestModules(rec *db.ScanRecord) []moduleExecutionEntry {
 	completed := stringSet(rec.CompletedPhases)
 	failed := stringSet(rec.FailedPhases)
 	outputsByModule := collectScanOutputFilesByModule(rec.ScanID)
-	modules := make([]moduleExecutionEntry, 0, len(subdomainWorkflowPhaseSpecs))
+
+	// Select the correct phase spec based on scan type.
+	specs := subdomainWorkflowPhaseSpecs
+	if scanType == "domain_run" {
+		specs = domainWorkflowPhaseSpecs
+	}
+	modules := make([]moduleExecutionEntry, 0, len(specs))
 	now := time.Now()
 
 	// Determine overall scan state for smart inference.
@@ -216,12 +242,15 @@ func workflowPhaseManifestModules(rec *db.ScanRecord) []moduleExecutionEntry {
 	scanFailed := strings.EqualFold(strings.TrimSpace(rec.Status), "failed") ||
 		strings.EqualFold(strings.TrimSpace(rec.Status), "error")
 
-	for _, spec := range subdomainWorkflowPhaseSpecs {
+	for _, spec := range specs {
 		status := "pending"
 		completedAt := time.Time{}
 		durationMS := int64(0)
 
-		phaseFiles := outputsByModule[spec.Module]
+		phaseFiles := outputsByModule[spec.PhaseKey]
+		if len(phaseFiles) == 0 {
+			phaseFiles = outputsByModule[spec.Module]
+		}
 		hasArtifacts := len(phaseFiles) > 0
 
 		if _, ok := completed[spec.Description]; ok {
@@ -365,7 +394,7 @@ func inferModuleFromFileName(name string) string {
 		return "url-collection"
 	// katana crawler results — separate from general URL collection
 	case strings.Contains(n, "katana"):
-		return "katana-crawler"
+		return "katana"
 	// js-endpoints: API path extraction results from JS files
 	case strings.Contains(n, "js-endpoint"):
 		return "js-endpoints"
@@ -397,7 +426,7 @@ func inferModuleFromFileName(name string) string {
 	case strings.Contains(n, "port-scan") || strings.Contains(n, "ports") || strings.Contains(n, "nmap") || strings.Contains(n, "masscan"):
 		return "port-scan"
 	case strings.Contains(n, "aem"):
-		return "aem-scan"
+		return "aem"
 	case strings.Contains(n, "github") || strings.Contains(n, "github-scan") || strings.Contains(n, "gh-") || strings.Contains(n, "github-secrets") || strings.Contains(n, "secrets_table") || (strings.Contains(n, "secrets") && strings.HasSuffix(n, ".json")):
 		return "github-scan"
 	case strings.Contains(n, "backup") || strings.Contains(n, "fuzzuli"):
@@ -413,7 +442,7 @@ func inferModuleFromFileName(name string) string {
 	case strings.HasSuffix(n, "urls.txt") || strings.Contains(n, "all-urls.txt") || strings.Contains(n, "wayback"):
 		return "url-collection"
 	case strings.Contains(n, "js-url") || strings.Contains(n, "js_url") || strings.Contains(n, "js-enum"):
-		return "JS-Enum"
+		return "url-collection"
 	case strings.HasSuffix(n, "urls.json") || strings.HasSuffix(n, "urls.txt") || strings.Contains(n, "all-urls.txt") || strings.Contains(n, "wayback"):
 		return "url-collection"
 	default:
@@ -1744,9 +1773,7 @@ func parseArtifactFindings(raw []byte, module, category string, maxRows int) []p
 				}
 			case string:
 				fT := "Recon"
-				if module == "JS-Enum" {
-					fT = "JS-Enum"
-				} else if module == "url-collection" {
+				if module == "url-collection" {
 					fT = "URL-Collection"
 				} else {
 					fT = module
@@ -1792,9 +1819,7 @@ func parseArtifactFindings(raw []byte, module, category string, maxRows int) []p
 				continue
 			}
 			fT := "Recon"
-			if module == "JS-Enum" {
-				fT = "JS-Enum"
-			} else if module == "url-collection" {
+			if module == "url-collection" {
 				fT = "URL-Collection"
 			} else {
 				fT = module

internal/api/ui/pages/scan-detail-manifest.js

@@ -1,7 +1,10 @@
 // scan-detail-manifest.js — Execution pipeline / manifest card rendering.
 // Exposes: window.ScanDetailManifest
 (() => {
-  const esc = (...args) => (typeof window.esc === 'function' ? window.esc(...args) : String(args[0] ?? ''));
+  const esc = (s) => {
+    if (typeof window.esc === 'function') return window.esc(s);
+    return String(s ?? '').replace(/[&<>"']/g, c => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'})[c]);
+  };
   const apiFetch = (...args) => window.apiFetch(...args);
 
   function formatManifestDuration(ms) {

internal/utils/phase_logs.go

@@ -2,6 +2,8 @@ package utils
 
 import (
 	"encoding/json"
+	"errors"
+	"io"
 	"os"
 	"path/filepath"
 	"regexp"
@@ -105,25 +107,26 @@ func StartPhaseLogCapture(scanID, phaseKey string) func() {
 }
 
 // FlushPhaseLogBuffer writes captured logs for a scanID+phaseKey to disk
-// and clears the in-memory buffer.
+// and clears the in-memory buffer. Concurrent writes during flush are discarded.
 func FlushPhaseLogBuffer(scanID, phaseKey string) error {
 	key := scanID + ":" + phaseKey
 
 	globalPhaseLogHook.mu.Lock()
+	// Set a closing flag on the buffer so new Fire() calls for this key
+	// are rejected rather than creating a leaking orphan buffer.
 	buf, ok := globalPhaseLogHook.buffers[key]
-	if ok {
-		delete(globalPhaseLogHook.buffers, key)
-	}
+	delete(globalPhaseLogHook.buffers, key)
 	globalPhaseLogHook.mu.Unlock()
 
 	if !ok || buf == nil {
 		return nil
 	}
 
-	buf.mu.RLock()
+	buf.mu.Lock()
 	entries := make([]phaseLogEntry, len(buf.entries))
 	copy(entries, buf.entries)
-	buf.mu.RUnlock()
+	buf.entries = nil // prevent any concurrent access from reading stale data
+	buf.mu.Unlock()
 
 	if len(entries) == 0 {
 		return nil
@@ -189,7 +192,7 @@ func ReadPhaseLogFile(scanID, phaseKey string) ([]phaseLogEntry, error) {
 	for {
 		var e phaseLogEntry
 		if err := dec.Decode(&e); err != nil {
-			if err.Error() == "EOF" {
+			if errors.Is(err, io.EOF) {
 				break
 			}
 			// Continue reading remaining lines even if one is malformed.

internal/utils/workflow.go

@@ -87,6 +87,8 @@ func RunWorkflowPhase(phaseKey string, step, total int, description, target stri
 		// are captured under this phase's key.
 		go func() {
 			SetGoroutinePhaseKey(phaseKey)
+			SetGoroutineScanID(scanID)
+			defer ClearGoroutineScanID()
 			defer ClearGoroutinePhaseKey()
 			done <- fn()
 		}()
@@ -96,8 +98,12 @@ func RunWorkflowPhase(phaseKey string, step, total int, description, target stri
 		case <-time.After(time.Duration(timeoutSeconds) * time.Second):
 			err = ErrTimeout
 			// Keep slot occupied until underlying work truly exits to avoid runaway parallelism.
+			// But prevent a permanent leak if fn() hangs indefinitely: release after 5m.
 			go func() {
-				<-done
+				select {
+				case <-done:
+				case <-time.After(5 * time.Minute):
+				}
 				<-phaseSemaphore
 			}()
 		}