test: fix rebrand-lag test failures; drop Windows installer - #2
Merged
Conversation
The OpenCode→PentestCode rebrand updated product code but left test fixtures asserting the old branding, so `bun turbo test` and the HttpApi exerciser were red on main. Bring the fixtures in line with the rebranded behavior (no product-code changes): - provider plugins (vercel/openrouter/llmgateway/nvidia/kilo/zenmux/cerebras/ cloudflare-*): expect pentestcode referer/title/source/integration/user-agent values instead of opencode. - webfetch: user-agent "pentestcode". - observability: pentestcode.client / pentestcode.run resource attributes. - config: fixtures write pentestcode.json/.jsonc and .pentestcode dirs (the loader no longer reads opencode.*). - global/project: tmp dir "pentestcode", project-id file .git/pentestcode. - agent/session-runner(-recorded)/permission: default agent is "pentest" (renamed from "build"). - location-layer: pentestcode.json fixture; drop apply_patch/edit/todowrite from expected tools (removed from core builtins). - skill: built-in skill is customize-pentestcode. - httpapi exerciser: send Basic auth user "pentestcode" to match the server's rebranded OPENCODE_SERVER_USERNAME default. Windows installer removal: - delete install.ps1 (Windows curl-entrypoint) and script/sign-windows.ps1; no build/CI references remained. Update the CLAUDE.md release checklist. Verified: core 1075/0, full `bun turbo test` 8/8, check:generated clean, test:httpapi coverage+auth 208/208.
s0ld13rr
added a commit
that referenced
this pull request
Jul 27, 2026
…ore-claim read-back #2 (pentest.txt): judge a vector by SIGNAL, not the trophy. 'No root/marker yet after 25min' is NOT a kill reason — kill only on ZERO NEW SIGNAL across ~3 approaches (no auth, no confirmed vuln, no accepted payload, no partial exec, no new cred). A vector still producing signal is ALIVE — persist. A CONFIRMED-but-unfinished vuln → ESCALATE to exploit_dev with the exact partial state (session/tokens/stored ids/missing step), never kill. Fixes the cacti loss (real auth'd payload-accepted RCE killed at 27min 'because no marker'). Kill only for truly-dead; record via resolved_vectors. #4 (kernel-exploit.txt): prove-before-claim — READ BACK, don't fire-and-forget. Before recording access/root/marker as done, read it back through the same channel (ls/cat the marker; confirm id=uid=0, don't infer root from a CVE name). MANDATORY on blind/OOB/ stateless channels where a write error is invisible. Can't confirm -> status suspected, not achieved. Fixes the dubbo root miss (marker dropped blind, never read back, file absent -> 0 credit) and prevents fabricated 'I have root' findings in real reports.
KumaloWilson
pushed a commit
to KumaloWilson/pentestcode
that referenced
this pull request
Aug 2, 2026
When a versioned component has a public fixed release, diff patched vs target version to locate the vuln from the fix, then focus exploitation on the changed code. Target-agnostic (any versioned software) — no CVE/framework specifics, so zero_day measurement stays clean. Depth-committing: also counters breadth-first scatter. Complements read-the-handler (fix s0ld13rr#1).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The OpenCode→PentestCode rebrand updated product code but left test fixtures asserting the old branding, so
bun turbo testand the HttpApi exerciser were red onmain. This brings the fixtures in line with the rebranded behavior — no product-code changes, only test fixtures + Windows installer removal.Rebrand-lag test fixes (36 unit failures + HttpApi auth)
pentestcodereferer/title/source/integration/user-agent values instead ofopencode.pentestcode.pentestcode.client/pentestcode.runresource attributes.pentestcode.json/.jsoncand.pentestcodedirs (the loader no longer readsopencode.*).pentestcode, project-id file.git/pentestcode.pentest(renamed frombuild).pentestcode.jsonfixture; dropapply_patch/edit/todowritefrom expected tools (removed from core builtins in the fork).customize-pentestcode.pentestcodeto match the server's rebrandedOPENCODE_SERVER_USERNAMEdefault (was sendingopencode→ 401 on every protected route).Legitimate
opencodereferences were left intact: theopencodeprovider id, theopencode.ai/zenURL, app localStorage namespaces (opencode.global.dat) and DOM ids (#opencode-titlebar-right) — these are unchanged in product code, so e2e fixtures already match.Windows installer removal
install.ps1(the Windows curl entrypoint) andscript/sign-windows.ps1; no build/CI references remained.Verified locally
packages/coretests: 1075 pass, 0 fail.bun turbo test: 8/8 tasks pass.check:generated: clean.test:httpapicoverage + auth: 208/208 pass.