cxg changelog

Version 1.2.0

AI-driven whitebox pentest pipeline (cxg pentest)

New subsystem that reads guardlink’s whitebox/findings.sarif, LLM-ranks threats against an operator goal, and has a local AI CLI (claude / codex / gemini, or the Anthropic / OpenAI HTTP APIs) write JavaScript probe templates that read the target’s source to craft code-aware payloads. Those templates run in N parallel authenticated Chromium contexts, emitting confirmed / refuted / ambiguous findings to report.json plus a JSONL audit log of every HTTP request.
Interactive auth capture for SSO/MFA flows (cxg pentest auth), chained-auth probes for cross-user IDOR (--auth-numbers 2+), scope enforcement (URL/method allowlist, per-endpoint budget, 5xx hard-kill), validator-guarded code generation, and retry-with-mutation on ambiguous triage.
Operator-supplied identity metadata — --tier, --persona, --cohort, and free-form --tag — fed to the AI ranker so it selects the right identity per probe.
The Python orchestrator is embedded in the binary (via include_dir!) and installed on demand, for a self-contained distribution.
cxg update — self-update the cxg binary to the latest released build.

SPA dashboards are no longer false-flagged as dead sessions during pentest pre-flight and session-health checks.
Template config-directory resolution is now cross-platform (fixes Windows).
AIManager provider tests are isolated from any on-disk AI config.

Cleared dependency advisories: openssl 0.10.73 → 0.10.81 (8 advisories), bytes 1.10.1 → 1.12.1 (integer overflow), git2 0.18 → 0.20.4 (GHSA-j39j-6gw9-jw6h), prometheus 0.13 → 0.14 (protobuf advisory). TLS/HTTP stacks were consolidated onto reqwest.