v0.3.5

OpenMOSS/MOSS-Transcribe-Diarizev0.3.5Jul 19, 2026by Attack-Phantom

AI Summary

This release introduces a major refactor of the VulnClaw penetration agent engine, shifting from a stage-driven approach to a model-led autonomous solving mode. It enhances evidence management with raw storage and search capabilities while upgrading HTTP probing and introducing new local command execution tools.

Key Highlights

Shifted from stage-driven to model-led autonomous solving engine
Introduced `AgentState` for unified evidence memory and search capabilities
Enhanced `http_probe_batch` to support HTTPS and raw evidence
Added `shell_command` for local verification and `runtime_diff_probe` for parsing verification
Disabled context compression by default to preserve full information

Breaking Changes

Removed the old blackboard and fixed research direction planning system
Changed Skill injection from forced scripts to optional reference indices
Disabled context compression by default

New Features

Model-led autonomous solving loop
Evidence search and view tools for historical evidence
Shell command execution for local verification
Runtime diff probe for parser/filter boundary validation
HTTPS support for HTTP probing
Automatic post-solve report generation

Full Release Notes

  ## What's Changed

  ### 渗透 Agent 引擎重构

  本版本重点重构了 VulnClaw 默认渗透引擎，将旧的“方向规划 / 黑板 / 阶段驱动”体系替换为更接近 Claude Code / Codex 的“模型主导”自主求解模式。

  - 默认 solve 引擎改为模型主导循环，由模型自行决定下一步行动、工具调用、继续探索、询问用户或结束任务。
  - 移除旧黑板和固定研究方向规划体系，避免框架强行限制模型思路。
  - Skill 不再作为强制剧本注入上下文，而是作为可选参考资料索引，模型可按需调用 `load_skill_reference` 阅读。
  - 引入 `AgentState` 证据记忆，统一保存工具调用、原始输出、关键发现和完成证据。
  - 大型 HTML / body / stdout / stderr 默认完整保存为 raw evidence，active context 只注入高信号预览，减少上下文污染。
  - 新增 `evidence_search` / `evidence_view`，模型可按需回查完整历史证据，避免信息丢失。
  - 引入轻量纠偏层，记录工具失败、重复试错、same-body、parser/filter 边界等信号，但不替模型规划下一步。
  - 保留证据闸门，模型声明 flag、漏洞结论或目标达成时必须有真实工具输出支撑。
  - 工具调用改为更接近原生 tool transcript 的模式，减少额外总结步骤对模型上下文的污染。
  - 增强 `fetch` / `http_probe_batch`，支持 HTTPS、完整请求面、响应头、body、raw evidence 和批量差分探测。
  - 新增源码自动还原能力，针对 `highlight_file`、HTML 高亮源码、混杂 HTML/JS body 自动提取 clean source。
  - 新增 `shell_command`，支持模型调用本地命令做验证，例如 `php -r`、`curl`、`rg` 等。
  - 新增 `runtime_diff_probe`，用于正则过滤器与运行时解析器差异验证，例如 PHP serialize/unserialize 边界。
  - solve 达成目标后自动生成复盘报告，包含解题思路、关键证据、复现请求包和证据索引。
  - 上下文压缩默认关闭，仅在接近上下文上限或用户显式 `/compact` 时触发。