External/violin
1
0
Fork 0
mirror of https://github.com/Strategic-Automation/violin.git synced 2026-08-14 12:33:37 +02:00
Code Issues Packages Projects Releases Wiki Activity
112 Commits 2 Branches 8 Tags
1e04f565b00a6bbc8521bc4ecd7e75b20310ba45
Commit Graph
112 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
DanandGitHub e23933099a Merge pull request #23 from Strategic-Automation/codex/v2.0.6-code-quality 
Resolve CodeQL standard quality findings (v2.0.6)
 2026-07-18 19:07:24 -04:00
Violin 5873cf9ddd fix CodeQL quality findings (v2.0.6) 2026-07-19 00:03:08 +01:00
DanandGitHub 6b555a945b Merge pull request #22 from Strategic-Automation/codex/issue-3-history-exact-repeat 
Fix exact-repeat history parsing (v2.0.5)
 2026-07-18 18:35:54 -04:00
Violin 6e8ba6e77c fix exact repeat history parsing (#3) 2026-07-18 23:31:16 +01:00
DanandGitHub a0eb44f7b3 Merge pull request #21 from Strategic-Automation/codex/issue-2-secondary-host-primary-block 
Block secondary-only primary targets (v2.0.4)
 2026-07-18 18:22:06 -04:00
Violin 22560d57b4 block secondary-only primary targets (#2) 2026-07-18 23:19:50 +01:00
DanandGitHub 9b1092bc8c Merge pull request #18 from Strategic-Automation/codex/issue-1-terminal-compound-policy 
Fix compound terminal command policy (v2.0.3)
 2026-07-18 18:12:33 -04:00
Violin a7dffbd191 fix compound terminal command policy (#1) 2026-07-18 23:01:48 +01:00
DanandGitHub 37105bd1a7 Merge pull request #20 from Strategic-Automation/codex/workflow-least-privilege-v2-0-2 
Restrict GitHub Actions token permissions (v2.0.2)
 2026-07-18 17:58:19 -04:00
Violin e2be6759a5 restrict workflow token permissions 2026-07-18 22:54:16 +01:00
DanandGitHub 9857463812 Merge pull request #19 from Strategic-Automation/codex/security-pytest-9-0-3 
Upgrade pytest for CVE-2025-71176 (v2.0.1)
 2026-07-18 17:49:23 -04:00
Violin 28c72446fa upgrade pytest for CVE-2025-71176 2026-07-18 22:42:57 +01:00
DanandGitHub 4c44d47f6b Merge pull request #4 from Strategic-Automation/dev 
release: Violin v2.0.0

Promote the Hermes-native Violin Guard execution boundary, phase-aware
batch review, engagement-state diagnostics, receipt-backed findings,
safer scope and target parsing, and routed pentest skills.

Synchronize the distribution metadata, documentation, tests, and
cross-platform release checks with the v2.0.0 runtime surface.
v2.0.0 		2026-07-18 11:00:40 -04:00
Violin dc53bbb08a consolidate guard batch collaboration 2026-07-18 08:02:50 +01:00
Violin 4fa3a4452c Fix distribution manifest trailing whitespace 2026-07-17 21:40:39 +01:00
Violin f461945394 Remove iteration cap and extend heartbeat cadence 2026-07-17 21:36:20 +01:00
Violin 2926beb3a7 Fix heartbeat command threshold 2026-07-17 21:06:51 +01:00
Violin 323a28bb9d Fix cross-platform CI workflow checks 2026-07-17 20:50:34 +01:00
Violin 1a86fc7916 Fix release check in clean CI checkout 2026-07-17 20:44:06 +01:00
Violin 909b66cd52 feat: implement violin_guard plugin registration and command execution hooks 2026-07-17 20:35:43 +01:00
Violin f65b70871d feat: add violin_guard plugin with tool registration and execution hooks 2026-07-17 20:34:06 +01:00
Violin e988b0600e Document generic Kali execution in agent identity 2026-07-17 20:33:20 +01:00
Violin dc6d9a41a8 Allow arbitrary Kali CLI tools through guarded execution 2026-07-17 20:31:28 +01:00
Violin 698edc0a45 chore: bump version to v2.0.0 and update docs 2026-07-17 20:26:47 +01:00
Violin 5870509fdb feat: implement violin_guard plugin for centralized command execution auditing, terminal policy enforcement, and history tracking. 2026-07-17 20:14:20 +01:00
Violin 1c5bfb9ba2 fix: increase file lock acquisition timeout to prevent flaky concurrent lock test timeouts on Windows 2026-07-16 18:24:57 +01:00
Violin b02d8eb68f refactor: reorganize violin guard core, unify locking and json storage, optimize facades 2026-07-16 18:23:46 +01:00
Violin 56387e2577 perf: optimize PTT lookup in handle_exec_burst 2026-07-16 18:17:54 +01:00
Violin c816bcd6a9 feat: implement target resolution for handle_target in violin_guard 2026-07-16 18:12:44 +01:00
Violin 681450278d feat: implement engagement directory bootstrap and auto-repair functionality for violin_guard 2026-07-16 18:09:06 +01:00
Violin b739e0ff9e Refactor target extraction logic to simplify candidate identification and enhance test for explicit targets handling 2026-07-16 17:34:39 +01:00
Violin 0075850b61 Add playbooks for SQL Injection, SSRF, and XSS vulnerabilities; enhance testing suite 
- Created a comprehensive playbook for SQL Injection (SQLi) detailing types, detection methods, tools, and remediation strategies.
- Added a playbook for Server-Side Request Forgery (SSRF) covering classification, detection payloads, and remediation guidance.
- Introduced a playbook for Cross-Site Scripting (XSS) including types, detection techniques, and safe proof of concept examples.
- Expanded the test suite with new tests for command history deduplication, scope authorization, and structured argument handling.
- Improved existing tests for engagement and execution tracking, ensuring robust coverage of functionality.
 2026-07-16 17:20:00 +01:00
Violin 072d5c7160 Update playbook count command to use find for improved accuracy 2026-07-14 18:18:00 +01:00
Violin 4e92047fc6 Merge branch 'codex/fix-guard-target-hypothesis-friction' into dev 2026-07-13 21:11:59 +01:00
Violin a51aa00d06 Refactor playbooks and templates for improved evidence handling and research documentation 
- Updated various playbooks to use `$ENG_DIR` for storing evidence files instead of hardcoded paths.
- Enhanced documentation in playbooks to include mandatory CVE and exploit research fields in hypotheses.
- Introduced a new `pty-safe-delivery.md` reference for safe file delivery practices over PTY.
- Added a `shell_ctrl.py` template for PTY shell control with safeguards against long commands and file transfers.
- Improved tests to validate new hypothesis fields and ensure compliance with updated playbook requirements.
- General cleanup and consistency improvements across playbooks and templates.
 2026-07-13 21:10:43 +01:00
Violin 4c40ebb260 Merge P0 release and CI hardening 2026-07-13 08:53:57 +01:00
Violin a9130fe02c Harden plugin release checks and CI 2026-07-13 08:53:57 +01:00
Violin e7d76785dd Merge P0 concurrent state safety 2026-07-13 08:49:36 +01:00
Violin e84de38943 Serialise concurrent guard state transitions 2026-07-13 08:49:36 +01:00
Violin 16f04068f6 Merge P0 batch integrity 2026-07-13 08:45:45 +01:00
Violin 98b4d8ed7d Bind sync batches to captured PTT tasks 2026-07-13 08:45:44 +01:00
Violin 683f393ac7 Merge P0 PTT hypothesis phase enforcement 2026-07-13 08:41:03 +01:00
Violin ac5848a85a Enforce PTT phase and hypothesis relevance 2026-07-13 08:41:03 +01:00
Violin bcc57fe534 Merge P0 scope authorization 2026-07-13 08:36:02 +01:00
Violin cdae366bdc Enforce scope authorization and exclusions 2026-07-13 08:36:02 +01:00
Violin f5c6015c83 Merge P0 sync credit enforcement 2026-07-13 08:30:17 +01:00
Violin a2c551ef59 Fix bounded sync credit enforcement 2026-07-13 08:30:07 +01:00
Violin f29b79ac20 Merge violin guard release into dev 2026-07-13 08:28:06 +01:00
Violin 8884e6956f P1-hyp: enforce out-of-scope target rejection on hypothesis write 
update_hypothesis silently skipped the scope check because it called
validate_hypothesis_record without forwarding in_scope_hosts, so an
out-of-scope target was written to the board. Thread in_scope_hosts
through so both the direct API and handle_record_hypothesis reject
out-of-scope targets fail-closed (verified ad-hoc, 7/7).
 2026-07-12 21:05:53 +01:00
Violin ea7e094528 Remediate audit P0/P1 findings; migrate tests to green 
- state.py: fcntl/msvcrt file locking, reservation+finalization, history
  verification, remove dead subprocess bridges (p1-lock)
- hypotheses.py: enforce canonical status, phase/host/service/port match,
  reject unrelated hypotheses (p1-hyp)
- tools.py/__init__.py: retain kwargs (task_id), lifecycle hooks wired
  (REGISTERED_TOOLS + no-op-then-active hooks) (p1-life)
- Migrate tests from tests/*.py to tests/guard + tests/pentest_docs; align
  to actual API (handle_target returns ips[0], handle_exec_burst fail-closed,
  PTT self-certify uses real batch_id, post-exploitation requires hypothesis)
- scoping.md: add checkpoint.json continuity-artifact drift note
- pyproject.toml: v1.2.0, per-file-ignores for tests/scripts (E402/S101)
- Add .pytest-tmp-plugin/ to .gitignore

64 passed; ruff clean.
 2026-07-12 20:57:55 +01:00