Conversation
…remove saved filters - Added detail() functions to ffuf, misconfig, github, and default modules so every module now has inline expandable finding detail panels - Removed TARGET column from all module tables (moved into detail panels) - Removed saved filters UI (dropdown, name input, save/delete buttons) - Updated colgroup and raw mode header widths - Updated README with findings UX description Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…onents, Secrets, Only JS) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
… auditors Rewrite APK Auditor styling to permanent dark theme with purple/indigo accent palette, removing the old green accent scheme and light mode. Adds Inter + JetBrains Mono fonts, ambient glow effects, glass-morphism header, animated gradient dropzone border, noise overlay, and hero grid/glow effects. Also fixes comp.authorities.split bug when the decompiler returns an array instead of a semicolon-delimited string. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Use String() coercion before .split(';') to handle cases where the
decompiler returns a non-string, non-array value for authorities.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
HackerOne programs load via public GraphQL API when no tokens are set, or via REST API with richer user stats when H1_USERNAME/H1_TOKEN are configured. Bugcrowd programs load when BUGCROWD_TOKEN is set. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The Discord bot was removed in dd65f43 but stale references remained throughout the README, env config, code comments, and a few dead helpers. README: - Drop the Discord badge, `autoar bot`/`autoar both` commands, the /ai and /brain slash-command table, and the Discord Bot config section. - Fix the non-existent `--profile full` / `autoar-discord` docker references; document the real `--profile localdb` + `autoar-api` setup. - Replace the bot config with MONITOR_WEBHOOK_URL docs, set AUTOAR_MODE=api, drop `internal/bot/` from the architecture section, and correct the log filename from autoar-bot.log to api.log. Code/config: - env.example: document MONITOR_WEBHOOK_URL, fix Docker profile commands, remove Discord size-limit wording from the R2 section. - docker-compose.yml: drop "same as discord" comment. - Rename the bot-era default log autoar-bot.log -> autoar.log (root.go, logger.go, subdomain.go). - Remove dead code: sendToDiscord() stub in wp-confusion and the unused DiscordWebhook field on next88.ScanOptions. - Reword stale "Discord alert" / "posted to Discord" / "under bot" comments to "webhook" across brain, monitor daemons, db types, errors, cnames, ports, jsscan, misconfig, githubscan, r2storage, ui_api, app.js, settings.js, and setup.go (which printed `./autoar bot` instructions -> `./autoar api`). Kept the Discord-compatible MONITOR_WEBHOOK_URL feature, the accurate "Discord bot has been removed" note in phase_files.go, and all secret-scanning regexes (Discord token detectors, webhook-URL patterns, CNAME takeover signatures). Build: go build ./... clean. Tests: ./internal/logger and ./internal/utils pass. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…ides
The previously-default `stepfun/step-3.5-flash:free` (and the README-claimed
`z-ai/glm-4.5-air:free`) is no longer free on OpenRouter. AutoAR now defaults
to OpenCode Zen's free tier; users can still bring their own OpenRouter or
Gemini key, and both endpoints' models are now overridable from env or UI.
brain.go:
- New constants OpenCodeEndpoint + DefaultOpenCodeModel ("deepseek-v4-flash-free").
- Renamed DefaultModel -> DefaultOpenRouterModel for clarity.
- openRouterModel() / openCodeModel() helpers read OPENROUTER_MODEL /
OPENCODE_MODEL env vars with fallback to the constants.
- New callOpenCode + callOpenCodeMulti — OpenAI-compatible POSTs reusing the
existing OpenRouterRequest/Response shapes (no Referer/X-Title headers).
- Provider chain: OpenRouter -> OpenCode -> Z.ai -> Gemini. Each tries on
its own key; failures fall through to the next configured provider.
- hasAnyAIKey() + errNoAIKey consolidate 4 precondition checks.
ui_api.go:
- GET /api/config now returns opencode_key_set / openrouter_key_set /
gemini_key_set (booleans only — keys never leak) and the effective
opencode_model / openrouter_model values.
- monitor_ai_available + the internal `ai` health flag count OpenCode.
- POST /api/settings accepts opencode_key, opencode_model, openrouter_model.
Model fields use pointer-string so `""` or `"default"` clears the override
while omitting keeps the current value.
settings.js:
- New inputs in the AI Intelligence section: OpenCode API Key, OpenCode
Model, OpenRouter Model. Each provider row shows a configured/not-set
badge driven by the new *_key_set flags.
- Saved keys are masked with `••••••• (saved)` placeholders rather than
echoed into the DOM. After save, /api/config is re-fetched and the page
re-renders.
- New handlers saveOpenCodeKey, saveOpenCodeModel, saveOpenRouterModel.
docker-compose.yml: pass through OPENCODE_API_KEY, OPENCODE_MODEL,
OPENROUTER_API_KEY, OPENROUTER_MODEL, ZHIPU_API_KEY (previously only
GEMINI_API_KEY was explicit; the rest worked via env_file but emitted
"variable not set" warnings).
env.example: new AI/LLM PROVIDERS section documenting all four keys, both
model overrides, and the provider priority order.
config.go: env allowlist now includes OPENCODE_API_KEY, OPENCODE_MODEL,
OPENROUTER_MODEL.
monitorsuggest/suggest.go: AI-rank gate also accepts OPENCODE_API_KEY.
README.md: rewrote the AI section around OpenCode Zen as the default free
path, documented the new env vars, added a "Configuring from the dashboard"
note, and updated the Docker env snippet.
Build: go build ./... clean. Tests: brain, logger, utils, monitorsuggest,
and config packages all pass.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…counts - New POST /api/scope/program-summaries endpoint fetches scope details on demand for a list of (platform, handle) pairs. Results are cached so repeat lookups are cheap. - fetchH1Programs / fetchH1WithREST / fetchBCPrograms grow an includeScope flag; when true they call fetchH1ScopeSummary / fetchBCScopeSummary per program to populate in-scope and out-of-scope target counts. - programScopeCacheKey + cache plumbing keys results by (platform, handle). - programs.js renders scope counts inline in the monitoring table and triggers the summary endpoint as rows become visible. - .gitignore: exclude local .cache/ directory used by the new cache layer. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…page The Programs page fetched the full H1 + Bugcrowd catalogue and one scope call per program (~1000 upstream requests) on every visit, so it took ~a minute to fully populate. Now the whole assembled payload (programs + scope) is cached and refreshed in the background, so loads are sub-second. - programs_cache.go (new): persist the assembled payload as one JSON blob in the settings KV table (TEXT — works on both Postgres and SQLite, no schema changes). StartProgramsWarmer pre-warms on boot and rebuilds every 10 min. refreshProgramsCache is single-flight guarded and never clobbers a good cache with an empty/failed fetch. - apiListPrograms: cache-first with stale-while-revalidate. Warm hits serve instantly with scope baked in; ?refresh=true kicks a background rebuild and serves the current cache (a rebuild takes ~a minute — too long to block on); a cold miss falls back to the previous live fetch and kicks a build for next time. Extracted sortPrograms + serveProgramsPayload helpers. - app.go: start the warmer from StartAPI when DB_HOST is set. - programs.js: when the response is warm (scope_included), skip the per-program hydration loop and render the fully populated table in one shot. Added an "Updated Xm ago / Refresh now" indicator; Refresh now forces a background rebuild and reloads shortly after. Build: go build ./... clean. Tests: api + db packages pass. go vet clean. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates