fix: Ensure .env file always overrides environment variables

- Fixed envloader to always override existing env vars from .env file
- Updated all entry points (StartBot, StartAPI, StartBoth, Main) to load .env dynamically
- Fixed InteractionCreate to read guild restrictions from .env dynamically
- Updated env.example to clarify .env file behavior
- Bumped version to 3.3.1

This ensures that DISCORD_ALLOWED_GUILD and other .env values are properly
loaded for all commands (js scan, subdomains, etc.) instead of using
package-level initialization values.

Author: h0tak88r

README.md

@@ -393,8 +393,8 @@ Once the bot is running, use these slash commands in Discord:
 - `/github-wordlist org:microsoft` - Generate wordlists from organization files
 
 #### Workflows
-- `/lite_scan domain:example.com [skip_js:false] [verbose:false] [phase_timeout:3600]` - Comprehensive automated scan workflow with real-time progress and file sending
-- `/fastlook domain:example.com` - Quick scan
+- `/lite_scan domain:example.com [skip_js:false] [verbose:false] [phase_timeout:3600]` - Comprehensive automated scan: livehosts → reflection → JS → CNAME → backup → DNS → misconfig → nuclei (with real-time progress and file sending)
+- `/fast_look domain:example.com` - Quick reconnaissance: subdomain enumeration → live host filtering → URL/JS collection
 - `/domain domain:example.com` - Full domain analysis
 
 #### Monitoring Commands
@@ -450,8 +450,8 @@ autoar gf scan -d example.com
 autoar wpDepConf scan -d example.com
 
 # Workflows
-autoar fastlook run -d example.com
-autoar lite run -d example.com --skip-js
+autoar fastlook run -d example.com  # Quick reconnaissance: subdomains → live hosts → URLs/JS
+autoar lite run -d example.com --skip-js  # Comprehensive scan: livehosts → reflection → JS → CNAME → backup → DNS → misconfig → nuclei
 autoar domain run -d example.com
 
 # Database operations
@@ -931,7 +931,7 @@ curl -X POST "http://localhost:8000/scan/github_org" \
   -H "Content-Type: application/json" \
   -d '{"org": "organization", "max_repos": 50}'
 
-# Lite Scan Workflow (comprehensive automated scan)
+# Lite Scan Workflow (comprehensive automated scan: livehosts → reflection → JS → CNAME → backup → DNS → misconfig → nuclei)
 curl -X POST "http://localhost:8000/scan/lite" \
   -H "Content-Type: application/json" \
   -d '{"domain": "example.com", "skip_js": false, "phase_timeout": 3600}'

bughunt.db-shm

@@ -29,8 +29,9 @@ DISCORD_WEBHOOK=your_discord_webhook_url_here
 DISCORD_ALLOWED_GUILD_ID=
 
 # Option 2: Use Guild Name (legacy, deprecated - use GUID instead)
-# Leave empty to allow bot in all servers, or set to server name (e.g., "Zhunterz")
+# Leave empty to allow bot in all servers, or set to your server name
 # The bot will reject commands from other servers
+# Note: .env file values always override system environment variables
 DISCORD_ALLOWED_GUILD=
 
 # ============================================================================

bughunt.db-wal

@@ -53,10 +53,9 @@ func LoadEnv() error {
 			}
 		}
 
-		// Only set if not already set in environment
-		if os.Getenv(key) == "" {
-			os.Setenv(key, value)
-		}
+		// Always set from .env file (override any existing environment variables)
+		// This ensures .env file is the source of truth
+		os.Setenv(key, value)
 	}
 
 	if err := scanner.Err(); err != nil {

env.example

@@ -218,7 +218,7 @@ func corsMiddleware() gin.HandlerFunc {
 func rootHandler(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{
 		"message": "AutoAR API Server",
-		"version": "3.3.0",
+		"version": "3.3.1",
 		"docs":    "/docs",
 		"status":  "operational",
 	})
@@ -327,7 +327,7 @@ func docsHandler(c *gin.Context) {
     <div class="container">
         <header>
             <h1>AutoAR API Documentation</h1>
-            <div class="version">Version 3.3.0</div>
+            <div class="version">Version 3.3.1</div>
         </header>
 
         <div class="section">
@@ -432,7 +432,7 @@ func docsHandler(c *gin.Context) {
 
             <div class="endpoint">
                 <div class="endpoint-path"><span class="method post">POST</span> /scan/lite</div>
-                <div class="description">Lite scan (comprehensive automated scan)</div>
+                <div class="description">Lite scan: Comprehensive automated scan workflow. Runs livehosts → reflection → JS → CNAME → backup → DNS → misconfig → nuclei phases sequentially with real-time progress updates.</div>
             </div>
 
             <div class="endpoint">

internal/modules/envloader/envloader.go

@@ -186,6 +186,19 @@ func StartBot() error {
 
 // StartAPI starts the REST API server
 func StartAPI() error {
+	fmt.Println("🚀 Starting AutoAR API Server...")
+	
+	// Load .env file if it exists
+	if err := envloader.LoadEnv(); err != nil {
+		log.Printf("[WARN] Failed to load .env file: %v", err)
+	} else {
+		fmt.Println("✅ Loaded environment variables from .env file")
+	}
+
+	// Re-read API host and port after loading .env
+	apiHostEnv := getEnv("API_HOST", "0.0.0.0")
+	apiPortEnv := getEnv("API_PORT", "8000")
+	
 	// Initialize database if configured
 	if os.Getenv("DB_HOST") != "" {
 		if err := db.Init(); err != nil {
@@ -205,7 +218,7 @@ func StartAPI() error {
 	}()
 
 	router := setupAPI()
-	addr := fmt.Sprintf("%s:%s", apiHost, apiPort)
+	addr := fmt.Sprintf("%s:%s", apiHostEnv, apiPortEnv)
 	fmt.Printf("AutoAR API Server starting on %s\n", addr)
 
 	sc := make(chan os.Signal, 1)
@@ -224,6 +237,19 @@ func StartAPI() error {
 
 // StartBoth starts both Discord bot and API server
 func StartBoth() error {
+	fmt.Println("🚀 Starting AutoAR (Discord Bot + API Server)...")
+	
+	// Load .env file if it exists
+	if err := envloader.LoadEnv(); err != nil {
+		log.Printf("[WARN] Failed to load .env file: %v", err)
+	} else {
+		fmt.Println("✅ Loaded environment variables from .env file")
+	}
+
+	// Re-read configuration after loading .env
+	botTokenEnv := os.Getenv("DISCORD_BOT_TOKEN")
+	autoarModeEnv := getEnv("AUTOAR_MODE", "both")
+	
 	// Initialize database if configured (only once for both services)
 	if os.Getenv("DB_HOST") != "" {
 		if err := db.Init(); err != nil {
@@ -244,27 +270,31 @@ func StartBoth() error {
 
 	var wg sync.WaitGroup
 
-	if botToken == "" {
+	if botTokenEnv == "" {
 		return fmt.Errorf("DISCORD_BOT_TOKEN environment variable is required")
 	}
 
-	// Start Discord bot
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		if err := StartBot(); err != nil {
-			log.Printf("Discord bot error: %v", err)
-		}
-	}()
+	// Start Discord bot if mode allows
+	if autoarModeEnv == "discord" || autoarModeEnv == "both" {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			if err := StartBot(); err != nil {
+				log.Printf("Discord bot error: %v", err)
+			}
+		}()
+	}
 
-	// Start API server
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		if err := StartAPI(); err != nil {
-			log.Printf("API server error: %v", err)
-		}
-	}()
+	// Start API server if mode allows
+	if autoarModeEnv == "api" || autoarModeEnv == "both" {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			if err := StartAPI(); err != nil {
+				log.Printf("API server error: %v", err)
+			}
+		}()
+	}
 
 	// Wait for interrupt signal
 	sc := make(chan os.Signal, 1)
@@ -282,26 +312,31 @@ func Ready(s *discordgo.Session, event *discordgo.Ready) {
 
 // InteractionCreate handles Discord slash command interactions
 func InteractionCreate(s *discordgo.Session, i *discordgo.InteractionCreate) {
+	// Read guild restriction from environment variables dynamically (supports .env file)
+	// This ensures values are read after .env is loaded, not from package-level initialization
+	allowedGuildIDEnv := getEnv("DISCORD_ALLOWED_GUILD_ID", "")
+	allowedGuildNameEnv := getEnv("DISCORD_ALLOWED_GUILD", "")
+	
 	// Check guild restriction by ID (GUID) - preferred method
-	if allowedGuildID != "" {
+	if allowedGuildIDEnv != "" {
 		// Reject DMs (commands must be in a server)
 		if i.GuildID == "" {
 			log.Printf("[INFO] Rejected command from DM (not in a server)")
-			respond(s, i, fmt.Sprintf("❌ This bot is restricted to a specific server (Guild ID: %s). Please use commands in that server.", allowedGuildID), true)
+			respond(s, i, fmt.Sprintf("❌ This bot is restricted to a specific server (Guild ID: %s). Please use commands in that server.", allowedGuildIDEnv), true)
 			return
 		}
-		if i.GuildID != allowedGuildID {
-			log.Printf("[INFO] Rejected command from unauthorized guild ID: %s (expected: %s)", i.GuildID, allowedGuildID)
-			respond(s, i, fmt.Sprintf("❌ This bot is restricted to a specific server (Guild ID: %s). Your server ID: %s", allowedGuildID, i.GuildID), true)
+		if i.GuildID != allowedGuildIDEnv {
+			log.Printf("[INFO] Rejected command from unauthorized guild ID: %s (expected: %s)", i.GuildID, allowedGuildIDEnv)
+			respond(s, i, fmt.Sprintf("❌ This bot is restricted to a specific server (Guild ID: %s). Your server ID: %s", allowedGuildIDEnv, i.GuildID), true)
 			return
 		}
 		log.Printf("[DEBUG] Command allowed from guild ID: %s", i.GuildID)
-	} else if allowedGuildName != "" {
+	} else if allowedGuildNameEnv != "" {
 		// Legacy: Check by guild name (deprecated, but kept for backward compatibility)
 		// Reject DMs (commands must be in a server)
 		if i.GuildID == "" {
 			log.Printf("[INFO] Rejected command from DM (not in a server)")
-			respond(s, i, fmt.Sprintf("❌ This bot only works in the **%s** server. Please use commands in that server.", allowedGuildName), true)
+			respond(s, i, fmt.Sprintf("❌ This bot only works in the **%s** server. Please use commands in that server.", allowedGuildNameEnv), true)
 			return
 		}
 
@@ -314,9 +349,9 @@ func InteractionCreate(s *discordgo.Session, i *discordgo.InteractionCreate) {
 		}
 
 		// Check if guild name matches allowed guild
-		if guild.Name != allowedGuildName {
-			log.Printf("[INFO] Rejected command from unauthorized guild: %s (expected: %s)", guild.Name, allowedGuildName)
-			respond(s, i, fmt.Sprintf("❌ This bot is restricted to the **%s** server only. Your server: **%s**", allowedGuildName, guild.Name), true)
+		if guild.Name != allowedGuildNameEnv {
+			log.Printf("[INFO] Rejected command from unauthorized guild: %s (expected: %s)", guild.Name, allowedGuildNameEnv)
+			respond(s, i, fmt.Sprintf("❌ This bot is restricted to the **%s** server only. Your server: **%s**", allowedGuildNameEnv, guild.Name), true)
 			return
 		}
 

internal/modules/gobot/api.go

@@ -805,7 +805,7 @@ func handleHelp(s *discordgo.Session, i *discordgo.InteractionCreate) {
 		embed.Fields = []*discordgo.MessageEmbedField{
 			{
 				Name:   "Core Workflows",
-				Value:  "• `/scan_domain` - Full domain workflow\n• `/lite_scan` - Lite scan (livehosts → reflection → JS → nuclei)\n• `/fast_look` - Fast recon (subs + livehosts + URLs)\n• `/react2shell_scan` - React2Shell smart scan",
+				Value:  "• `/scan_domain` - Full domain workflow\n• `/lite_scan` - Comprehensive automated scan: livehosts → reflection → JS → CNAME → backup → DNS → misconfig → nuclei\n• `/fast_look` - Quick reconnaissance: subdomain enumeration → live host filtering → URL/JS collection\n• `/react2shell_scan` - React2Shell smart scan",
 				Inline: false,
 			},
 			{

internal/modules/gobot/bot.go

@@ -43,7 +43,7 @@ func registerAllCommands(s *discordgo.Session) {
 		},
 		{
 			Name:        "lite_scan",
-			Description: "Perform a lite domain scan",
+			Description: "Comprehensive automated scan: livehosts → reflection → JS → CNAME → backup → DNS → misconfig → nuclei",
 			Options: []*discordgo.ApplicationCommandOption{
 				{Type: discordgo.ApplicationCommandOptionString, Name: "domain", Description: "The domain to scan", Required: true},
 				{Type: discordgo.ApplicationCommandOptionBoolean, Name: "verbose", Description: "Enable verbose output", Required: false},
@@ -57,7 +57,7 @@ func registerAllCommands(s *discordgo.Session) {
 		},
 		{
 			Name:        "fast_look",
-			Description: "Perform a fast domain lookup",
+			Description: "Quick reconnaissance: subdomain enumeration → live host filtering → URL/JS collection",
 			Options: []*discordgo.ApplicationCommandOption{
 				{Type: discordgo.ApplicationCommandOptionString, Name: "domain", Description: "The domain to scan", Required: true},
 				{Type: discordgo.ApplicationCommandOptionBoolean, Name: "verbose", Description: "Enable verbose output", Required: false},

internal/modules/gobot/commands3.go

@@ -7,16 +7,29 @@ import (
 	"os/signal"
 	"sync"
 	"syscall"
+
+	"github.com/h0tak88r/AutoAR/v3/internal/modules/envloader"
 )
 
 // Main function for standalone bot execution (backward compatibility)
 // This can be used if someone wants to run the bot standalone
 func Main() {
+	// Load .env file if it exists
+	if err := envloader.LoadEnv(); err != nil {
+		log.Printf("[WARN] Failed to load .env file: %v", err)
+	} else {
+		fmt.Println("✅ Loaded environment variables from .env file")
+	}
+
+	// Read configuration from environment (after .env is loaded)
+	autoarModeEnv := getEnv("AUTOAR_MODE", "discord")
+	botTokenEnv := os.Getenv("DISCORD_BOT_TOKEN")
+	
 	var wg sync.WaitGroup
 
 	// Start Discord bot if needed
-	if autoarMode == "discord" || autoarMode == "both" {
-		if botToken == "" {
+	if autoarModeEnv == "discord" || autoarModeEnv == "both" {
+		if botTokenEnv == "" {
 			log.Fatal("DISCORD_BOT_TOKEN environment variable is required")
 		}
 
@@ -30,7 +43,7 @@ func Main() {
 	}
 
 	// Start API server if needed
-	if autoarMode == "api" || autoarMode == "both" {
+	if autoarModeEnv == "api" || autoarModeEnv == "both" {
 		wg.Add(1)
 		go func() {
 			defer wg.Done()