anti ee9ade4cd5 feat(enroll): strip master API and frontend from agent tarball ...

Agents never run the FastAPI master app (decnet/web/) or serve the React
frontend (decnet_web/) — they run decnet.agent, decnet.updater, and
decnet.forwarder, none of which import decnet.web. Shipping the master
tree bloats every enrollment payload and needlessly widens the worker's
attack surface.

Excluded paths are unreachable on the worker (all cli.py imports of
decnet.web are inside master-only command bodies that the agent-mode
gate strips). Tests assert neither tree leaks into the tarball.

2026-04-19 18:47:03 -04:00

..

api

feat(enroll): strip master API and frontend from agent tarball

2026-04-19 18:47:03 -04:00

docker

feat(ssh-stealth): hide capture artifacts via XOR+gzip entrypoint blob

2026-04-18 05:34:50 -04:00

live

feat(swarm-mgmt): agent_host + updater opt-in; prevent duplicate forwarder spawn

2026-04-19 05:12:55 -04:00

perf

added: scripts/profile/view.sh — auto-pick newest artifact and open viewer

2026-04-17 13:20:05 -04:00

service_testing

refactor: strip DECNET tokens from container-visible surface

2026-04-17 22:57:53 -04:00

stress

perf(locust): skip change-password in on_start when not required

2026-04-17 15:15:59 -04:00

swarm

feat(updater): remote self-update daemon with auto-rollback

2026-04-18 21:40:21 -04:00

updater

fix(updater): restart agent+forwarder+self via systemd on push

2026-04-19 18:23:10 -04:00

__init__.py

Add 20 honeypot services: email, DB, ICS, cloud, IoT, network protocols

2026-04-03 23:07:44 -03:00

conftest.py

fix: dynamic TracedRepository proxy + disable tracing in test suite

2026-04-15 23:46:46 -04:00

mysql_spinup.sh

feat(swarm-mgmt): agent_host + updater opt-in; prevent duplicate forwarder spawn

2026-04-19 05:12:55 -04:00

test_admin_seed.py

fix: re-seed admin password when still unfinalized (must_change_password=True)

2026-04-17 14:49:13 -04:00

test_api_attackers.py

feat(web): attacker artifacts endpoint + UI drawer

2026-04-18 05:36:48 -04:00

test_archetypes.py

refactor: separate engine, collector, mutator, and fleet into independent subpackages

2026-04-12 00:26:22 -04:00

test_attacker_worker.py

fix: persist ingester position and profiler cursor across restarts

2026-04-15 13:58:12 -04:00

test_auth_async.py

perf: run bcrypt on a thread so it doesn't block the event loop

2026-04-17 14:52:22 -04:00

test_auto_spawn.py

feat(cli): auto-spawn listener as detached sibling from decnet swarmctl

2026-04-19 03:25:40 -04:00

test_base_repo.py

feat(swarm): worker agent + fix pre-existing base_repo coverage test

2026-04-18 07:15:53 -04:00

test_bounty_dedup.py

feat: deduplicate bounties on (bounty_type, attacker_ip, payload)

2026-04-15 18:02:52 -04:00

test_build.py

refactor: separate engine, collector, mutator, and fleet into independent subpackages

2026-04-12 00:26:22 -04:00

test_cli_db_reset.py

test: add repository factory and CLI db-reset tests

2026-04-15 12:51:29 -04:00

test_cli_service_pool.py

feat: fleet-wide MACVLAN sniffer microservice

2026-04-14 15:02:34 -04:00

test_cli.py

feat(cli): allow decnet status in agent mode

2026-04-19 18:29:41 -04:00

test_collector_thread_pool.py

fix: use dedicated thread pools for collector and sniffer workers

2026-04-15 22:57:03 -04:00

test_collector.py

feat(collector): parse real PROCID and extract IPs from logger kv pairs

2026-04-18 05:37:08 -04:00

test_composer.py

fix(telnet): replace Cowrie with real busybox telnetd + rsyslog logging

2026-04-12 00:34:45 -04:00

test_config_ini.py

feat(enroll): systemd units for agent/forwarder/engine + log-directory INI key

2026-04-19 05:46:08 -04:00

test_config.py

fix: align tests with model validation and API error reporting

2026-04-13 01:43:52 -04:00

test_correlation.py

revert: undo service badge filter, parser normalization, and SSH relay

2026-04-14 02:14:46 -04:00

test_custom_service.py

Implement ICS/SCADA and IMAP Bait features

2026-04-10 01:50:08 -04:00

test_decnet.db-shm

fix: stabilize test suite by ensuring proper test DB isolation and initialization

2026-04-09 02:31:14 -04:00

test_decnet.db-wal

fix: stabilize test suite by ensuring proper test DB isolation and initialization

2026-04-09 02:31:14 -04:00

test_deployer.py

fix(engine): pin docker compose project name to avoid empty-basename failure

2026-04-19 06:17:30 -04:00

test_embedded_workers.py

fix: gate embedded sniffer behind DECNET_EMBED_SNIFFER (default off)

2026-04-17 13:35:43 -04:00

test_env_lazy_jwt.py

fix(env): resolve DECNET_JWT_SECRET lazily so agent/updater subcommands don't need it

2026-04-19 02:43:25 -04:00

test_factory.py

fix(tests): clean up two pre-existing failures before config work

2026-04-19 03:17:17 -04:00

test_file_handler.py

Add RFC 5424 syslog logging to all service templates

2026-04-04 04:31:00 -03:00

test_fingerprinting.py

feat: JA4/JA4S/JA4L fingerprints, TLS session resumption, certificate extraction

2026-04-13 23:20:37 -04:00

test_fleet_singleton.py

feat: fleet-wide MACVLAN sniffer microservice

2026-04-14 15:02:34 -04:00

test_fleet.py

fix: align tests with model validation and API error reporting

2026-04-13 01:43:52 -04:00

test_health_config_cache.py

perf: 1s TTL cache for /health DB probe and /config state reads

2026-04-17 15:05:18 -04:00

test_ingester.py

perf(ingester): batch log writes into bulk commits

2026-04-17 16:37:34 -04:00

test_ini_loader.py

Fix all ruff lint errors across decnet/, templates/, and tests/

2026-04-04 17:36:16 -03:00

test_ini_spaces.py

fix: stabilize test suite by ensuring proper test DB isolation and initialization

2026-04-09 02:31:14 -04:00

test_ini_validation.py

feat: add server-side validation for web-based INI deployments

2026-04-08 01:04:59 -04:00

test_inode_aware_handler.py

fix: logging handler must not crash its caller on reopen failure

2026-04-17 14:01:36 -04:00

test_log_file_mount.py

feat: replace bind-mount log pipeline with Docker log streaming

2026-04-10 00:14:14 -04:00

test_logging_forwarder.py

Implement ICS/SCADA and IMAP Bait features

2026-04-10 01:50:08 -04:00

test_logging.py

feat: add component-aware RFC 5424 application logging system

2026-04-13 07:39:01 -04:00

test_mode_gating.py

feat(cli): gate master-only commands when DECNET_MODE=agent

2026-04-19 03:20:48 -04:00

test_mutator.py

Refactor: implemented Repository Factory and Async Mutator Engine. Decoupled storage logic and enforced Dependency Injection across CLI and Web API. Updated documentation.

2026-04-12 07:48:17 -04:00

test_mysql_histogram_sql.py

test: add MySQL backend integration tests

2026-04-15 12:51:33 -04:00

test_mysql_migration.py

fix: migrate TEXT→MEDIUMTEXT for attacker/state columns on MySQL

2026-04-15 12:59:54 -04:00

test_mysql_url_builder.py

fix: mysql url builder tests expect asyncmy, not aiomysql

2026-04-17 13:13:36 -04:00

test_network.py

fix(network): replace decnet_lan when driver differs (macvlan<->ipvlan)

2026-04-19 18:12:28 -04:00

test_os_fingerprint.py

refactor: separate engine, collector, mutator, and fleet into independent subpackages

2026-04-12 00:26:22 -04:00

test_privdrop.py

fix: chown log files to sudo-invoking user so non-root API can append

2026-04-17 13:39:09 -04:00

test_prober_bounty.py

feat: add HASSHServer and TCP/IP stack fingerprinting to DECNET-PROBER

2026-04-14 12:53:55 -04:00

test_prober_hassh.py

feat: add HASSHServer and TCP/IP stack fingerprinting to DECNET-PROBER

2026-04-14 12:53:55 -04:00

test_prober_jarm.py

refactor: prober auto-discovers attackers from log stream

2026-04-14 12:22:20 -04:00

test_prober_tcpfp.py

feat: add HASSHServer and TCP/IP stack fingerprinting to DECNET-PROBER

2026-04-14 12:53:55 -04:00

test_prober_worker.py

refactor: strip DECNET tokens from container-visible surface

2026-04-17 22:57:53 -04:00

test_profiler_behavioral.py

fix: wire prober tcpfp_fingerprint events into sniffer_rollup for OS/hop detection

2026-04-15 17:36:40 -04:00

test_router_cache.py

perf(api): TTL-cache /stats + unfiltered pagination counts

2026-04-17 19:09:15 -04:00

test_service_isolation.py

perf(ingester): batch log writes into bulk commits

2026-04-17 16:37:34 -04:00

test_services.py

feat(web): attacker artifacts endpoint + UI drawer

2026-04-18 05:36:48 -04:00

test_smtp_relay.py

Refactor: implemented Repository Factory and Async Mutator Engine. Decoupled storage logic and enforced Dependency Injection across CLI and Web API. Updated documentation.

2026-04-12 07:48:17 -04:00

test_sniffer_ja3.py

refactor: strip DECNET tokens from container-visible surface

2026-04-17 22:57:53 -04:00

test_sniffer_p0f.py

test: add fingerprinting and TCP analysis tests

2026-04-15 12:51:35 -04:00

test_sniffer_retransmit.py

test: add fingerprinting and TCP analysis tests

2026-04-15 12:51:35 -04:00

test_sniffer_tcp_fingerprint.py

refactor: strip DECNET tokens from container-visible surface

2026-04-17 22:57:53 -04:00

test_sniffer_worker.py

feat: fleet-wide MACVLAN sniffer microservice

2026-04-14 15:02:34 -04:00

test_ssh_capture_emit.py

test(ssh): add unit coverage for emit_capture RFC 5424 output

2026-04-18 05:37:42 -04:00

test_ssh_stealth.py

feat(ssh-stealth): hide capture artifacts via XOR+gzip entrypoint blob

2026-04-18 05:34:50 -04:00

test_ssh.py

feat(ssh-stealth): hide capture artifacts via XOR+gzip entrypoint blob

2026-04-18 05:34:50 -04:00

test_syslog_formatter.py

refactor: strip DECNET tokens from container-visible surface

2026-04-17 22:57:53 -04:00

test_telemetry.py

feat: add OpenTelemetry distributed tracing across all DECNET services

2026-04-15 23:23:13 -04:00

test_web_api.py

feat: Phase 1 — JA3/JA3S sniffer, Attacker model, profile worker

2026-04-13 20:22:08 -04:00