v0.2.0

## Pentest Swarm AI v0.2.0

Install via Homebrew:
```
brew install Armur-Ai/tap/pentestswarm
```

Install via AUR (once submitted):
```
yay -S pentestswarm-bin
```

Run via Docker (16 security tools pre-installed):
```
docker run --rm ghcr.io/armur-ai/pentestswarm:v0.2.0 scan example.com
```

## Changelog
### Features
* 5396e0481c80af6511f7aa6bed12d62cd2ab52e3: feat(api): opt-in X-API-Key auth + CORS origins knob (#44.5) (@AkhilSharma90)
* 3d4471e3a19d0d2e5f0253208b06f3739cd0eb6a: feat(bench): concrete swarm-vs-sequential speed runner + D.10 standardization plan (@AkhilSharma90)
* 3e1eb80c9b0fa7da7c37c333a84f597e0cd23fcc: feat(bench): scaffold swarm-vs-sequential speed benchmark (D.9.4) (@AkhilSharma90)
* e7b852ff6e60df6e728211f5ad00cf468dc156d9: feat(cli): --tui live terminal dashboard (real events, wires the TUI) (@AkhilSharma90)
* d2cf904a4a7132a6c014dffa37c3408f1c6146d5: feat(cli): add --nuclei-severity and --active-scan; list openai/gemini providers (@AkhilSharma90)
* 0600b158df776696fd5f2f0d63ada6cb786ad15d: feat(cli): add Page() helper for pipe-through-pager output (@AkhilSharma90)
* 762c4281a2ca58c4d973a843926194a57fae582b: feat(cli): add `pentestswarm man` command (@AkhilSharma90)
* 141071acaf087d0e5bb9668bac6db7d711e9de6e: feat(cli): add `pentestswarm upgrade` command (@AkhilSharma90)
* 9bc5aeaf907c01ec26951b0394c27d9ed471269e: feat(cli): add `pentestswarm version` command (@AkhilSharma90)
* 2cebd3d3f1203d49c8e4fa3e162e370075b6cc2a: feat(cli): add global --yes/-y flag and Confirm() gate (@AkhilSharma90)
* b75410d17a543ec984b01c3982f60ab50102e556: feat(cli): add install-tools command for the Go recon tool chain (@AkhilSharma90)
* c676e00c4501eaf3e9a1720a66f55f9b1ee41c0c: feat(cli): add workspace command — named config profiles (@AkhilSharma90)
* 3cad832170f9dc85ef5fb9bc4bb369349d37010e: feat(cli): config path/get/set + effective config show (@AkhilSharma90)
* 5cf885fc26dee9a15d66df52bea8dd7c4b9ca98c: feat(cli): doctor --fix installs into the managed tool dir, adds Docker guidance (@AkhilSharma90)
* 8616a289ede0aa7d383a2e3ab8ab1606e45805b8: feat(cli): interactive TUI launcher — `pentestswarm run` (@AkhilSharma90)
* 0bd0efdb6febe59aceab7129515d329713d5b50e: feat(cli): preflight checklist + inline fixes in the run launcher (@AkhilSharma90)
* 34de6818d426bcacf1196635d64df6f7e2eed344: feat(cli): scriptability — completions, --output/--json, exit codes (@AkhilSharma90)
* da4d01d5211f4259dd964758923664b21f3ac7bd: feat(compliance): add GRC control-mapping engine (D.11.4) (@AkhilSharma90)
* fdd605caab7f55015dc34bcd47785d45d9a0c936: feat(dashboard): live Attack Chains panel with MITRE ATT&CK (@AkhilSharma90)
* 95746a429390cbee2028f29bbef74cbcbe509790: feat(dashboard): live localhost mission-control web view (@AkhilSharma90)
* 7e7742bd28e143d3a9859a56f9fbb98fe52f7e28: feat(dashboard): rename to Operations Deck + click-to-read findings (@AkhilSharma90)
* 9bd3eea7c4770739c3f461ff71fb819c11568f0e: feat(dashboard): stream attack-chain execution to the live view (@AkhilSharma90)
* b9c64797f2495ca965b551a979dbde4f76f99a27: feat(dashboard): stream discovered API endpoints to the live view (@AkhilSharma90)
* a49fd2d69f8a72f90a905720d160b923e8aecae6: feat(dashboard): stream finding detail for the click-to-read panel (@AkhilSharma90)
* 37d3dfde44c8e9231099d1a49d49da1fa26e6a83: feat(dist): one-command install — curl|sh installer + npm package (@AkhilSharma90)
* cf4b1f9deef72ff255784c9082f7d8aad9f38868: feat(engine): warn on missing tools; wire nuclei-severity + active-scan (@AkhilSharma90)
* 3eeb25a2c84ff9bf10525184e9507b6a1ac7d4f4: feat(exploit): add httpreq built-in for authenticated API attacks (@AkhilSharma90)
* 1b5e9fda27545d03e7a66556d370c9af2ba82318: feat(exploit): add jwt builtin verb (forge/none/decode) (@AkhilSharma90)
* ea1dfebcf3e2786f4c05be2ad6db188805937ccf: feat(exploit): add planner usage hint for jwt verb (@AkhilSharma90)
* d760474a236e8be94811d13f37c611c7d1a9b605: feat(exploit): object-ref harvesting + generalized BOLA/IDOR engine (@AkhilSharma90)
* 2c3a581eb2271def1e95c82ef3d38a789f17de58: feat(exploit): teach the planner to build httpreq API attack chains (@AkhilSharma90)
* 3269ea3dc16bc18d014fb273e4ce2e8d3344c8f9: feat(exploit): thread state across steps for stateful API attack chains (@AkhilSharma90)
* 6cad7f0abfe97c464c0e4721e0ae46892dbb3f54: feat(lab): add VAmPI and DVGA bundled --lab targets (@AkhilSharma90)
* 8246557622b19959be429d6766f7d693ff62bd10: feat(lab): add crAPI multi-container target to --lab (@AkhilSharma90)
* 7be9fac2b317b753172430202339c18b8c4c167e: feat(llm): Gemini provider (#15) (@AkhilSharma90)
* 2d17a849d40cd59089b795a7fc0d03de3f49b618: feat(llm): add OpenAI-compatible provider (Together AI, DeepSeek, Groq, OpenAI) (@AkhilSharma90)
* 681956a810c7d289c7bed0c2fbf281871a3e0d0f: feat(llm): add OrcaRouter as a named provider (@XiaoHuo888-hue)
* adf0ef69ccb5ba41d0ea95a19157fe0dfc64038f: feat(osint): Shodan + Censys + GitHub code search clients (2.4.6–2.4.8) (@AkhilSharma90)
* 35709a9365a4c314deb00a7113347908488824ff: feat(packaging): AUR PKGBUILD for pentestswarm-bin (D.2.1) (@AkhilSharma90)
* e0023160afba7e21e095f075408b7c75d511619e: feat(packaging): install shell completions in AUR PKGBUILD (@AkhilSharma90)
* 2ef540c9d2c632bf9c13db3bc8f81ab75a6de22c: feat(pipeline): add VulnerabilityRecord to the attack surface (@AkhilSharma90)
* 8d3bd303de64441887a863f5b65c32ae1cfbc63b: feat(prompts): offensive-security prompt scaffolding infrastructure (1.4.7) (@AkhilSharma90)
* 6513905d959ed23e934cce09cddfa32b742a1b5b: feat(prompts): wire RetryProvider into factory + 6 call sites (@AkhilSharma90)
* c36102e6f953178af9fc0abf6c6670a3b348c063: feat(recon): add DVGA GraphQL fingerprint/attack profile (@AkhilSharma90)
* 8da876e07b4696493f8aeb206b0b5ec6243ead33: feat(recon): add OpenAPI/Swagger spec ingestion for generic API discovery (@AkhilSharma90)
* 747d52d950ddaa971ca84bcaf545ad7af02bcd57: feat(recon): add VAmPI API fingerprint/attack profile (@AkhilSharma90)
* 0da404a3b3531a7c770feffa8cba0706240bce8b: feat(recon): bound LLM context, add nuclei-severity + active-scan, surface vulns (@AkhilSharma90)
* 365f2640f5b0ddebf195944b5647fd817ef1d773: feat(recon): discover API surface by fingerprinting known apps (@AkhilSharma90)
* 9b2c175d6faf119739c38a2211422a14a22ad2b7: feat(recon): expand the crAPI playbook library (@AkhilSharma90)
* ad9e0454dffd7b78521ec28a486a73441da492d9: feat(recon): extract tool vulnerabilities from nuclei/dalfox/sqlmap/nikto (@AkhilSharma90)
* 2c1d29e88be8df4453b031b731a24fae24a93448: feat(recon): proven crAPI JWT-forgery playbook → account takeover (@AkhilSharma90)
* e9c3bbde934794c72c10058c3f1094709f153de5: feat(recon): wire OpenAPI spec discovery into DiscoverAPISurface (@AkhilSharma90)
* 848ea472cb8b1e41506d28506a04b8281f8bf50c: feat(recon): wire crlfuzz + gxss end-to-end into active scan (@AkhilSharma90)
* c47e831c81c56c5a38dc8c484f5571d4b962e75e: feat(release): GoReleaser pipeline replaces hand-rolled build matrix (D.6.3) (@AkhilSharma90)
* e57c300addf7b8d9d33386268cae3b27705af9c8: feat(report): MITRE ATT&CK technique mapping on findings (D.11.1) (@AkhilSharma90)
* 8d2e2f15c1f12833f4dd3626f69cbc640dbdda39: feat(report): OWASP Top 10 + CWE tagging on findings (D.10.1) (@AkhilSharma90)
* ca13d3412d4d77eeb1c7a22201bba32c689f3375: feat(scan): --lab bundled practice target — "watch it find" in 2 minutes (D.9.1) (@AkhilSharma90)
* 1a111771e287c8d32471a8c30928deeeb52ce8c6: feat(security): coordinator-sourced exec allowlist for exploit executor (#43) (@AkhilSharma90)
* 7250a596aebd5edd0f1dfcae24063ed046cb6269: feat(swarm): adaptive BOLA sweep — runtime reaction to discoveries (pillar ①) (@AkhilSharma90)
* 7cbb2baa8e10aa20b81db389d0bbd4e032721a71: feat(swarm): bounded LLM-feedback retry for improvised chains (@AkhilSharma90)
* e14a9643e5eb8a1caf8c0e2349bbfabdde62480e: feat(swarm): run verified attack playbooks deterministically (@AkhilSharma90)
* f1e450ffbe523e94cf1fa00172ef34f62764b523: feat(swarm): trigger exploit agent on API endpoints + misconfigs (@AkhilSharma90)
* 51b5b063b060de44f278d3008357f7d642613b95: feat(swarm): write tool vulnerabilities as report-ready findings (@AkhilSharma90)
* f9a40553376ab3722e04d6b503a7f022885a195c: feat(toolpath): add tool-path discovery for self-sufficient CLI (@AkhilSharma90)
* 200ca01c14480ac01b181474719a6bf10433627c: feat(tools): AWS cloud cluster — prowler + pacu + scoutsuite + cloudsplaining (@AkhilSharma90)
* 802b97c3d154eb4f1145ce7822ca58e8bcb238e7: feat(tools): dalfox adapter (2.1.9) (@AkhilSharma90)
* 5e3845d25abae5c7ee3d6ab15eeec269078b955a: feat(tools): dotdotpwn + crackmapexec + bloodhound adapters (2.1.28, 2.1.18, 2.1.19) (@AkhilSharma90)
* 42ab242e7ab234dad1349894dc44b8a4567f2d91: feat(tools): interactsh-client adapter (2.1.26, P0) (@AkhilSharma90)
* 73e8f35a936f377383a6bbf104ef53c3ac05be94: feat(tools): jwt_tool + arjun + ysoserial adapters (2.1.11, 2.1.13, 2.1.20) (@AkhilSharma90)
* ca19c93fbc2c5821394670a556538b58f6b9af03: feat(tools): kube_hunter + droopescan adapters (2.1.12, 2.1.17) (@AkhilSharma90)
* e71da87508a2c089cb197bc91e17cc16091c4854: feat(tools): nikto adapter (2.1.15) (@KhaiTrang1995)
* 080484feeaf12e5dce6002d4c4b24a6ec6ac9c4f: feat(tools): per-tool lifecycle hooks in coordinator (@siwacarn)
* fe249f0ea533607544815966071762fa2d0514cd: feat(tools): self-discover binaries via toolpath (kill the export-PATH step) (@AkhilSharma90)
* 6ca0566d9bf90d1f0887e03f51908ab485192b37: feat(tools): wpscan + checkov + gxss adapters (2.1.16, 2.1.25, 2.1.27) (@AkhilSharma90)
* 838457e1a8162f0bdc1530b79b13cd2ba5cf692d: feat(tools+osint): testssl + crlfuzz + gitlab_search adapters (@AkhilSharma90)
### Fixes
* 5292a2dd579b1409ad989d1e90ef5a1359d8aa5a: fix(classifier): extract JSON from prose, harden prompt, raise token budget (@AkhilSharma90)
* bed3324579fe94de0f868190b9a92df98c9a9366: fix(exploit): add CLI syntax hints for gau/dnsx to stop planner misuse (@oolejniczak)
* 83778e71b5950bd8941feaf41b7c697a3638286a: fix(exploit): make httpreq fit for authenticated API attacks (@AkhilSharma90)
* 8a2258c58f9123b62748f12faf278290957cd4a4: fix(exploit): restore corrupted exploit.go and enforce tool allowlist in plans (@oolejniczak)
* 78a2f5fc814f3c2e527559af7e7c7b2e16b18c17: fix(lab): drop hardcoded container_name from crAPI compose (@AkhilSharma90)
* 13bd01e396505cbfa0a8ddae23f3741a2a47bf80: fix(llm): tolerate Ollama shape drift in recon + classifier parsers (#45) (@AkhilSharma90)
* bd8d1f6b288710c2bcb8aeeacd208db23d0e438a: fix(report): collapse duplicate findings and drop ROI-footer hype (@AkhilSharma90)
* 93ec203b0fc88273d338e727607bb4fef5d1db18: fix(report): reasoning-model token headroom for report sections (@AkhilSharma90)
* f6b3435c636985d776c07d310a0d23b88e9cd139: fix(report): render "Steps to Reproduce" in the default report (D.10.3) (@AkhilSharma90)
* b7146f864701747719eefe52d93e8796703b690b: fix(report): sanitize filename, surface write errors, detach report ctx (@AkhilSharma90)
* b98abb784586080fe2fd4f7355a82c7169ab0aa8: fix(report): sanitize target in report path to prevent silent write failure in path (@str1ng0)
* ba09661505152387b14f59510f1f5c9b983b4162: fix(scope): ignore email-address domains in ValidateCommand (@AkhilSharma90)
* d34f5284e5152e48d8fd13a5cfb675f0ec6ff4ea: fix(security): wire --safe-mode, harden cleanup exec, extract shellsafe (#44) (@AkhilSharma90)
* 77470712420fd4a196123a29d1a7c8b4b3e76104: fix(swarm): stop classifying endpoints/tech as noise findings (@AkhilSharma90)
* a62c27762a1a4a6123e3e9b66b61eb554413b0c0: fix(swarm): terminate on quiescence so --swarm can't hang forever (#65) (@AkhilSharma90)
* 1651fc91ede70de847532f4c2551a7d1acf1a9e5: fix(tools):  add test case for tool katana (@siwacarn)
* d1c66e9ccc7e868a23858c93762a9dbde1fdf700: fix(tools): add test case for tool dnsx (@siwacarn)
* 29c9c35c6d072b8e14d633bc47d3375524c1a495: fix(tools): add test case for tool naabu (@siwacarn)
* 2e290ecf710c5a0ab9e661675f8934226b2d9b61: fix(tools): add test case for tool nuclei (@siwacarn)
* 329500f82ca3dd842fec47a0892b50af7368ebd1: fix(tools): correct naabu top-ports syntax (@siwacarn)
* 03a875afee6e041df6fd4fb616bc3976c979599f: fix(tools): json.Unmarshal lines in parseJSONLines (@siwacarn)
* 7eb00b7dd6c4088eefa8385954516dd55e3cd9b2: fix(tools): pipe targets via stdin in dnsx (@siwacarn)
* 504c6b9eefb143f1646f19b76d76fb37fc011129: fix(tools): use -jsonl in katana wrapper (@siwacarn)
* 6f9e88964fea33a8b83ceee57c3ddc885f3b82e2: fix(tools): use -jsonl in nuclei wrapper (@siwacarn)
* 6b0a3bd5295fccd0b68c0dc883b846b3c3075be3: fix: Dockerfile httpx conflict (#13) + playbook target_domain (#17) (@AkhilSharma90)
* ec393bbd48a2286ca5d2e150df05737bae8fda0d: fix: bare-IP targets scan nothing + Ollama silently truncates to 4096 tokens (@UniMtx85)
* c0e2e54fe058fc4a85884b9759bda548bae30792: fix: preserve discovered recon endpoints when LLM output drifts (@mvanhorn)
### Docs
* 20fc8b49e83034f23aca3b65df6701fff8bbcbb3: docs(contributing): add "Add a tool adapter (~30 lines)" on-ramp (D.9.6) (@AkhilSharma90)
* 37fe764912c668ddf25a61dad8e0177030cc3ea8: docs(demo): larger type + purple framed border on the demo GIF (@AkhilSharma90)
* b3769c3456ccc054d052694b5bb4f3e1a167a7ee: docs(demo): rebrand the product GIF — amber-gradient banner + wider frame (@AkhilSharma90)
* 546f1efa1ec1152a84fef52873ea71cd52719b90: docs(demo): rebuild the demo as a futuristic HUD with live graphs (@AkhilSharma90)
* 058efdfbe82446a7ba5c393148a1dac9f8e9b733: docs(plan): D.11 enterprise-adoption tier (standards / workflow / governance / reporting) (@AkhilSharma90)
* 49b5385d01669d264259155fe9f590705c68a41c: docs(plan): add 1.4.6 OpenAI-compatible provider + multi-backend Cybench plan (@AkhilSharma90)
* 127123f8a4094b5eeace8d37eb4eff2e34b34dd1: docs(plan): add 1.4.7 offensive-security prompt scaffolding (Flavor C) (@AkhilSharma90)
* b8d564fc4bc856b886d696d79f9524f678e7ce53: docs(plan): add 3.3.7 XBOW validation-benchmarks runner (future, P2) (@AkhilSharma90)
* 2825aa755d265e3bd1ec890018a341243621d295: docs(plan): add Wave 5 + Wave 6 + tool adapters + onboarding/submission ext. (@AkhilSharma90)
* 6b37d7fd4cc7f6782db46dba5b84f486ed430858: docs(plan): check off D.1.2 brew audit/test CI + caveats hygiene (@AkhilSharma90)
* 5f6f7d5c3d26a4217249628114e36697a8316f27: docs(plan): mark 2.1.9 dalfox adapter done (@AkhilSharma90)
* 9b3bee0128268bc5c213b41e1497c6eb37abe8e5: docs(plan): restructure distribution roadmap, refine Kali/BlackArch timing (@AkhilSharma90)
* 702b72bd7d1bb732b81ea62394e2714448982190: docs(readme): add the Adaptive Swarm roadmap (@AkhilSharma90)
* 1112472a6781613fc1e60a83617e3a16b89ba949: docs(readme): commercial contact → akhil@armur.ai (@AkhilSharma90)
* a25b43344a993af0629aaeeb9ed2599d3dfc8886: docs(readme): new SVG hero banner + architecture diagram, brand the demo tape (@AkhilSharma90)
* 5cbffcd91c3278c4e0e83fd8c707bed16bbefb95: docs(readme): replace Mythos hero with an enterprise problem→fix lead (@AkhilSharma90)
* e01930f0aab55bca6e9dd16c3fa7746ebcd0d1af: docs(readme): sharper hero + drop Pentest Copilot from credits (@AkhilSharma90)
* aeb996c68b2d27960c3109abc0c3c76b21d7a119: docs(recon): note crAPI's weak JWT_SECRET as an unverified forge lead (@AkhilSharma90)
* 41543f0d3bc51f5cb5768d9ffcd92b7ebeb61881: docs(roadmap): note the growing set of bundled practice targets (@AkhilSharma90)
* 8f25450f0a144e8e770a2b58601501ac542b17db: docs: add Together AI orchestrator config example (@AkhilSharma90)
* be784a07cd56e4bcd4816a2270993ce2170ddc2d: docs: add public ROADMAP and repoint README links (@AkhilSharma90)
* 9e7f3be0211bf6c21d1a5ed5182a650e1e3c7da0: docs: add three architecture diagrams (pheromone, providers, defense) (@AkhilSharma90)
* 5781aff960bfa397fd5224c731ec4853ad795848: docs: adopters list + enterprise/commercial support sections (@AkhilSharma90)
* 3ede459f5502e3c414d18f802f6b750d1d0d3f7d: docs: adoption push — local-first, harness positioning, Discord, star, plan (@AkhilSharma90)
* 6fe54a23ef4cbd91bba32ab4035d30875a9ee0af: docs: document Together AI + GLM/Qwen providers; delink internal plan (@AkhilSharma90)
### Other
* 6dd90b8c5122d3ba887f89fe0754e4d21438b403: Merge branch 'Armur-Ai:main' into security_updates (@bloodgroup-cplusplus)
* 8f1742ed40b8ac23e1fe7d7bc51f8231eecefe69: Merge pull request #46 from UniMtx85/fix/bare-ip-scope-and-ollama-numctx (@AkhilSharma90)
* 73d6e0918eb555fa331fc0b1f93225a102a70256: Merge pull request #52 from KhaiTrang1995/feat/nikto-adapter (@AkhilSharma90)
* 8f05b70acd3505981cefcaf40f5ebe0dd2a52985: Merge pull request #56 from str1ng0/fix/report-path-sanitization (@AkhilSharma90)
* 4efd827098f1dab850d124896f8a2b9b9f1c6cb3: Merge pull request #59 from XiaoHuo888-hue/add-orcarouter-provider (@AkhilSharma90)
* 9e43571c94a966b2c38b54fc2431d8e6a7c52ba2: Merge pull request #64 from mvanhorn/fix/54-preserve-recon-tool-findings (@AkhilSharma90)
* b85a738a6ca2c533ec36ec63612d207af52f5f31: Merge pull request #69 from bloodgroup-cplusplus/security_updates (@AkhilSharma90)
* 6f3135e1af7caf05697fc6c0a15ce45438d72acc: Merge pull request #70 from olivierolejniczak/main (@AkhilSharma90)
* e65f667e668c2cdf7e0e3f8536b9b6abb289a1de: adding turbopack={} for next js 16.1 (@bloodgroup-cplusplus)
* e2ce9c22b1249bac041685792b25092ca894cc95: build(docker): ship gobuster, gitleaks, ffuf alongside existing recon tools (@oolejniczak)
* 54d34d34db00c8cac44c209b058ee8e1f03503fb: build: add 'make tools' to install the security toolchain (@AkhilSharma90)
* 4c13c5d14f83bf494e3c5f749461b8d7e7342e56: build: install the security toolchain during setup (@AkhilSharma90)
* e0d4e1893a399f0fa3732b46609d13805a607dab: chore(github): SECURITY policy + Contributor Covenant CoC (@AkhilSharma90)
* 6d1f834513a9c910141167cc950070543112f400: chore(github): issue templates + PR template + CODEOWNERS + CONTRIBUTING (@AkhilSharma90)
* 658add20c7b354d617d1d09d3cba1437da586541: chore(lint): gofmt + spelling normalization (#11) (@bloodgroup-cplusplus)
* a7fb3486de89101e8996b97f94b0f256c3060f89: chore(lint): gofmt trailing whitespace in report-path sanitizer (#56) (@AkhilSharma90)
* 5c73f4bf1a47ade8a7055cfd6da6d6a5b19b38dc: chore(release): npm package version 0.2.0 (@AkhilSharma90)
* aba250bcfd54c18ce9fec0a726440c1546fb1252: chore(web): gitignore node_modules (@ThembinkosiThemba)
* 8da7ed94fb30e82c0568e9428ab28460fe774bb2: chore: gitignore private plan dir and IMPLEMENTATION_PLAN.md (@AkhilSharma90)
* e1827d0f41fbf1818dbf524cf2b477cede2a39aa: chore: move detailed implementation plan out of the public repo (@AkhilSharma90)
* 1a0a42a6f6088e0ff9007a25d93db8f8a396cbd4: ci: shellcheck guard on dev scripts; finishes D.9.6 (@AkhilSharma90)
* 063a7e837fff9fca49a0e05f429f5521874b2f2d: fixing sec vulnerabilites (@bloodgroup-cplusplus)
* 1693402393bb78cc031522375aad472838f83df2: license: switch from Apache 2.0 to AGPL 3.0 (@AkhilSharma90)
* 290fd5054c6c2e3b3b4feec3f7cf4db4c618f991: merge: --yes flag, Confirm() gate, pager (U1) (@AkhilSharma90)
* 95f67dfc32662dba0ce4b2799a19e47932efc41d: merge: CLI scriptability (U1-A) (@AkhilSharma90)
* 75f73127d2ba7c65c9e9900541f629b1b0d6d658: merge: OpenAPI/Swagger spec ingestion (U3 generalization) (@AkhilSharma90)
* f11de6ddd1b900935e2e8da14e0f6da76f37b139: merge: VAmPI + DVGA lab targets (U2) (@AkhilSharma90)
* 0439cfd2a0f83984e05a5b197b2e01c8b44deee3: merge: VAmPI + DVGA recon profiles (U2) (@AkhilSharma90)
* 03967311712773349565d7bc4e04569dd9fd8b0e: merge: config path/get/set + workspaces (U1) (@AkhilSharma90)
* 86c678b3ccb519e9aee2f200ab5925e883b08435: merge: jwt forge/none/decode attack primitive (U5) (@AkhilSharma90)
* 8b7bfadef628a2afcda2a07353c2c11e6356489f: merge: self-sufficient CLI UX — install-tools, doctor --fix, preflight (U0) (@AkhilSharma90)
* dac768404b42be4f5d4621f0e56ae2d1f6c5b811: merge: tool self-discovery via toolpath (U0 core) (@AkhilSharma90)
* 03f79b1abe8f9f2ad322c91d456474820d5954e6: merge: version / upgrade / man commands (U1) (@AkhilSharma90)
* 894334464a88669e9730f74f0d74a2576f4f33a7: refactor(config): extract newViper + add LoadSettings for effective-config views (@AkhilSharma90)
* d603fe62dd1eaf5ddb76856b0b6a9b31c78cb7a5: security(deps): bump Next.js floor to ^15.5.16 (#12) (@bloodgroup-cplusplus)
* 87016e20f4e08995366fa4a8c8392edb50b0563b: style(dashboard): 10X — living attack graph, phases, mission summary (@AkhilSharma90)
* a819c1606e62a89bb04c79a5ddaf0f4bc88d3cb9: style(dashboard): collapse attack chains, click to expand (@AkhilSharma90)
* 71f324dc6e789d2c6b8f9b9819bd087836ebb16a: style(dashboard): futuristic HUD — constellation, gauges, live charts (@AkhilSharma90)
* a03fc5aebfc100f11c6ce5a623c6338f86a0930a: style(dashboard): match the Armur brand — absolute black + green (@AkhilSharma90)
* f1ac48e29fb8128c895d95ce66b3d31d23383876: test(exploit): cover jwt forge/none/decode and capture chaining (@AkhilSharma90)
* 5c5589b5cac37d4349825231e4779ca0b6f9a8b3: test(tools): cover lifecycle hooks and stdin helper (@siwacarn)
* 84ec6bf598841a41d578cec693a1bed2f416739b: test(tools): update availability tests for PATH-independent discovery (@AkhilSharma90)

---
Full source: github.com/Armur-Ai/Pentest-Swarm-AI