Tags: samugit83/redamon

v6.14.1 - update no longer refuses to pull after a scan

v6.2.5 - LAN WebSocket + Neo4j Auth Fixes

docs: update readme

fix: orchestrator freeze, scan-start crash, and over-strict memory ca…

…ps (v6.0.2)

- Move blocking docker-py calls (status polls, spawns, per-line
  container.reload()) off the single event loop onto dedicated thread
  pools and throttle the liveness check, so the orchestrator stays
  responsive during parallel/long scans (recon, partial, gvm, github,
  trufflehog).
- Normalize the memory-governor rejection payload to a string across all
  scan start routes and add a root global-error boundary, fixing the
  "Objects are not valid as a React child" client-side crash after a
  rejected scan start.
- Right-size scan envelopes (partial 512MB, full 1.5GB) so parallel
  partials no longer trigger false "not enough RAM" rejections with plenty
  free.
- Add a default timeout to orchestratorFetch (SSE streams exempt) so a
  stalled backend fails fast instead of hanging.
- Raise default concurrent-scan ceilings to 30 (per-user and global).

Adds regression + integration coverage for the freeze and crash paths.

docs: wiki update

feat(ai-gauntlet): per-run Timeout bound + fix duplicate findings rows

Run timeout is now configurable per run instead of a hardcoded 1 hour, and
the findings tables no longer duplicate a finding that has multiple parents.

Timeout (min) run-bound:
- New "Timeout (min)" field in Run bounds (default 600 = 10h, clamped 1-1440),
  sent as seconds and threaded through Bounds.timeout into every tool, replacing
  each adapter's hardcoded DEFAULT_TIMEOUT: garak (run_garak_scan), giskard/pyrit
  (_invoke -> run_streamed), promptfoo (generate + eval steps).
- Env fallbacks AI_ATTACK_{GARAK,GISKARD,PYRIT,PROMPTFOO}_TIMEOUT bumped
  3600 -> 36000 so API-only runs also default to 10h.
- Fixes large multi-family garak sweeps getting killed at the 1h wall clock
  after only a few families (a slow probe like atkgen would starve the rest).

Duplicate findings-row fix:
- A Vulnerability with several HAS_VULNERABILITY parents (Endpoint + IP, from the
  synthetic off-graph-target anchor) was returned once per parent, duplicating
  the row and triggering a React duplicate-key error.
- Both the AI Gauntlet findings query and the Red Zone "AI Attack
  Vulnerabilities" query now collapse to one row per finding, preferring the
  most specific parent (Endpoint > BaseURL > IP/Subdomain/Domain).

RedAmon 4.0.0: Fireteam + SG-ReAct

docs: update README

feat: fix uncover integration, add IP filtering, engine-aware parsing…

…, and docs for v3.2.0

feat: Custom Nuclei templates, ParamSpider, Arjun, FFuf, RedAmon Term…

…inal, Tool Confirmation Gate

- Custom Nuclei template management: upload/view/delete .yaml templates from UI, per-project checkbox selection, dynamic agent discovery at startup, integrated into recon pipeline
- Spring Boot Actuator detection templates (community PR #69): 7 templates with WAF bypass techniques
- ParamSpider passive parameter discovery via Wayback Machine CDX API
- Arjun active parameter discovery with parallel multi-method scanning (GET/POST/JSON)
- FFuf directory fuzzer with custom wordlist upload
- RedAmon Terminal: interactive Kali sandbox shell via xterm.js
- Tool Confirmation Gate: per-tool human-in-the-loop approval for dangerous operations
- SSL verify toggle for OpenAI-compatible LLM providers (community PR #70)
- Graph fixes: orphaned BaseURL linking via Subdomain, Technology-CVE version-less matching fallback
- API key rotation: multi-key round-robin for all tool API keys
- Dockerfile DEBIAN_FRONTEND=noninteractive (community PR #63)