test: reduce extension callback test complexity

fix(mcp): make `mcp start` usable without the interactive confirmation

.github/workflows/autorelease.yml

@@ -52,10 +52,10 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Go 1.25.8
+      - name: Go 1.26.6
         uses: actions/setup-go@v6
         with:
-          go-version: "1.25.8"
+          go-version: "1.26.6"
 
       - name: Install Minisign
         run: sudo apt-get update --fix-missing && sudo apt-get -y install minisign

.github/workflows/codeql-scanning.yml

@@ -16,10 +16,10 @@ jobs:
 
     steps:
       # Setup go environment
-      - name: Go 1.25.8
+      - name: Go 1.26.6
         uses: actions/setup-go@v6
         with:
-          go-version: "1.25.8"
+          go-version: "1.26.6"
 
       - name: Checkout repository
         uses: actions/checkout@v6

.github/workflows/comprehensive-e2e.yml

@@ -0,0 +1,449 @@
+name: Comprehensive e2e Tests
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: comprehensive-e2e-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  authorize:
+    name: Require repository administrator
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Check actor repository permission
+        uses: actions/github-script@v9
+        env:
+          REQUESTING_ACTOR: ${{ github.triggering_actor }}
+        with:
+          script: |
+            const actor = process.env.REQUESTING_ACTOR || context.actor;
+            const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              username: actor,
+            });
+            core.info(`${actor} has repository permission ${data.permission} (${data.role_name})`);
+            if (data.permission !== "admin") {
+              core.setFailed("Comprehensive e2e Tests may only be run by repository administrators");
+            }
+
+  darwin:
+    name: comprehensive-e2e-darwin-${{ matrix.goarch }}
+    needs: authorize
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 360
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: macos-15-intel
+            goarch: amd64
+            server_arch: amd64
+          - runner: macos-15
+            goarch: arm64
+            server_arch: arm64
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Prepare coverage artifact
+        run: |
+          mkdir -p e2e-results
+          printf 'darwin/%s\n' '${{ matrix.goarch }}' > e2e-results/target-darwin-${{ matrix.goarch }}.txt
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Download Sliver build assets
+        run: go run -buildvcs=false -mod=vendor ./util/cmd/assets
+
+      - name: Build unmodified Sliver server
+        env:
+          CGO_ENABLED: "0"
+          GOARCH: ${{ matrix.server_arch }}
+          GOOS: darwin
+        run: >-
+          go build -buildvcs=false -mod=vendor -trimpath -tags go_sqlite,server
+          -o sliver-server ./server
+
+      - name: Compile comprehensive E2E driver
+        env:
+          CGO_ENABLED: "0"
+          GOARCH: ${{ matrix.goarch }}
+          GOOS: darwin
+        run: >-
+          go test -c -buildvcs=false -mod=vendor -trimpath -tags client,go_sqlite
+          -o sliver-comprehensive-e2e ./test/e2e
+
+      - name: Run comprehensive E2E suite
+        run: >-
+          ./sliver-comprehensive-e2e
+          -test.v
+          -test.run=^TestComprehensiveE2E$
+          -test.timeout=0
+          -repo .
+          -server ./sliver-server
+          -server-arch ${{ matrix.server_arch }}
+          -target-os darwin
+          -target-arch ${{ matrix.goarch }}
+          -results ./e2e-results
+          -transports mtls,wg,http
+          -implant-modes session,beacon
+          -beacon-interval 10s
+
+      - name: Upload target coverage
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: comprehensive-e2e-target-darwin-${{ matrix.goarch }}
+          path: e2e-results
+          if-no-files-found: error
+          overwrite: true
+          retention-days: 14
+
+  linux-native:
+    name: comprehensive-e2e-linux-${{ matrix.goarch }}
+    needs: authorize
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 360
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-24.04
+            goarch: amd64
+            server_arch: amd64
+          - runner: ubuntu-24.04-arm
+            goarch: arm64
+            server_arch: arm64
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Prepare coverage artifact
+        run: |
+          mkdir -p e2e-results
+          printf 'linux/%s\n' '${{ matrix.goarch }}' > e2e-results/target-linux-${{ matrix.goarch }}.txt
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Download Sliver build assets
+        run: go run -buildvcs=false -mod=vendor ./util/cmd/assets
+
+      - name: Build unmodified Sliver server
+        env:
+          CGO_ENABLED: "0"
+          GOARCH: ${{ matrix.server_arch }}
+          GOOS: linux
+        run: >-
+          go build -buildvcs=false -mod=vendor -trimpath -tags go_sqlite,server
+          -o sliver-server ./server
+
+      - name: Compile comprehensive E2E driver
+        env:
+          CGO_ENABLED: "0"
+          GOARCH: ${{ matrix.goarch }}
+          GOOS: linux
+        run: >-
+          go test -c -buildvcs=false -mod=vendor -trimpath -tags client,go_sqlite
+          -o sliver-comprehensive-e2e ./test/e2e
+
+      - name: Run comprehensive E2E suite
+        run: >-
+          ./sliver-comprehensive-e2e
+          -test.v
+          -test.run=^TestComprehensiveE2E$
+          -test.timeout=0
+          -repo .
+          -server ./sliver-server
+          -server-arch ${{ matrix.server_arch }}
+          -target-os linux
+          -target-arch ${{ matrix.goarch }}
+          -results ./e2e-results
+          -transports mtls,wg,http
+          -implant-modes session,beacon
+          -beacon-interval 10s
+
+      - name: Upload target coverage
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: comprehensive-e2e-target-linux-${{ matrix.goarch }}
+          path: e2e-results
+          if-no-files-found: error
+          overwrite: true
+          retention-days: 14
+
+  linux-386:
+    name: comprehensive-e2e-linux-386
+    needs: authorize
+    runs-on: ubuntu-24.04
+    timeout-minutes: 360
+    env:
+      CONTAINER_NAME: sliver-comprehensive-e2e-linux-386-${{ github.run_id }}-${{ github.run_attempt }}
+      IMAGE_NAME: sliver-comprehensive-e2e-linux-386:${{ github.run_id }}-${{ github.run_attempt }}
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Prepare coverage artifact
+        run: |
+          mkdir -p e2e-results
+          printf 'linux/386\n' > e2e-results/target-linux-386.txt
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build linux/386 E2E image
+        run: |
+          set -euo pipefail
+          go_version="$(awk '$1 == "go" { print $2; exit }' go.mod)"
+          docker buildx build \
+            --load \
+            --platform linux/386 \
+            --build-arg "GO_VERSION=${go_version}" \
+            --file test/e2e/Dockerfile.linux-386 \
+            --tag "${IMAGE_NAME}" \
+            .
+
+      - name: Run comprehensive E2E suite
+        run: >-
+          docker run
+          --name "${CONTAINER_NAME}"
+          --platform linux/386
+          --volume "${PWD}/e2e-results:/results"
+          "${IMAGE_NAME}"
+
+      - name: Clean up linux/386 Docker resources
+        if: ${{ always() }}
+        run: |
+          docker rm --force "${CONTAINER_NAME}" 2>/dev/null || true
+          docker image rm --force "${IMAGE_NAME}" 2>/dev/null || true
+          docker buildx prune --all --force >/dev/null 2>&1 || true
+
+      - name: Upload target coverage
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: comprehensive-e2e-target-linux-386
+          path: e2e-results
+          if-no-files-found: error
+          overwrite: true
+          retention-days: 14
+
+  windows:
+    name: comprehensive-e2e-windows-${{ matrix.goarch }}
+    needs: authorize
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 360
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: windows-2022
+            goarch: 386
+            server_arch: amd64
+          - runner: windows-2022
+            goarch: amd64
+            server_arch: amd64
+          - runner: windows-11-arm
+            goarch: arm64
+            server_arch: arm64
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Prepare coverage artifact
+        run: |
+          mkdir -p e2e-results
+          printf 'windows/%s\n' '${{ matrix.goarch }}' > e2e-results/target-windows-${{ matrix.goarch }}.txt
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Download Sliver build assets
+        run: go run -buildvcs=false -mod=vendor ./util/cmd/assets
+
+      - name: Build unmodified Sliver server
+        env:
+          CGO_ENABLED: "0"
+          GOARCH: ${{ matrix.server_arch }}
+          GOOS: windows
+        run: >-
+          go build -buildvcs=false -mod=vendor -trimpath -tags go_sqlite,server
+          -o sliver-server.exe ./server
+
+      - name: Compile comprehensive E2E driver
+        env:
+          CGO_ENABLED: "0"
+          GOARCH: ${{ matrix.goarch }}
+          GOOS: windows
+        run: >-
+          go test -c -buildvcs=false -mod=vendor -trimpath -tags client,go_sqlite
+          -o sliver-comprehensive-e2e.exe ./test/e2e
+
+      - name: Run comprehensive E2E suite
+        run: >-
+          ./sliver-comprehensive-e2e.exe
+          -test.v
+          -test.run=^TestComprehensiveE2E$
+          -test.timeout=0
+          -repo .
+          -server ./sliver-server.exe
+          -server-arch ${{ matrix.server_arch }}
+          -target-os windows
+          -target-arch ${{ matrix.goarch }}
+          -results ./e2e-results
+          -transports mtls,wg,http
+          -implant-modes session,beacon
+          -beacon-interval 10s
+
+      - name: Upload target coverage
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: comprehensive-e2e-target-windows-${{ matrix.goarch }}
+          path: e2e-results
+          if-no-files-found: error
+          overwrite: true
+          retention-days: 14
+
+  aggregate-coverage:
+    name: Aggregate comprehensive E2E coverage
+    needs:
+      - authorize
+      - darwin
+      - linux-native
+      - linux-386
+      - windows
+    if: ${{ always() && needs.authorize.result == 'success' }}
+    outputs:
+      command_coverage_markdown: ${{ steps.publish_command_coverage.outputs.command_coverage_markdown }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Download target coverage
+        uses: actions/download-artifact@v8
+        with:
+          pattern: comprehensive-e2e-target-*
+          path: coverage-input
+          merge-multiple: true
+
+      - name: Prepare aggregate artifact
+        run: |
+          mkdir -p coverage-input coverage-summary
+          printf 'Comprehensive E2E coverage aggregate\n' > coverage-summary/README.txt
+
+      - name: Aggregate coverage and enforce required cells
+        id: aggregate
+        continue-on-error: true
+        run: >-
+          go run -buildvcs=false -mod=vendor ./test/e2e/report
+          -input coverage-input
+          -output coverage-summary
+
+      - name: Publish command coverage table
+        id: publish_command_coverage
+        if: ${{ always() }}
+        run: |
+          detailed_report="coverage-summary/coverage-summary.md"
+          report="coverage-summary/command-coverage.md"
+          if [[ ! -s "${report}" ]]; then
+            printf 'Command coverage report is missing or empty: %s\n' "${report}" >&2
+            exit 1
+          fi
+
+          delimiter="COMPREHENSIVE_E2E_COMMAND_COVERAGE_EOF"
+          if grep -Fxq "${delimiter}" "${report}"; then
+            printf 'Command coverage report contains the reserved output delimiter: %s\n' "${delimiter}" >&2
+            exit 1
+          fi
+
+          {
+            printf 'command_coverage_markdown<<%s\n' "${delimiter}"
+            cat "${report}"
+            printf '%s\n' "${delimiter}"
+          } >> "${GITHUB_OUTPUT}"
+
+          if [[ -f "${detailed_report}" ]]; then
+            cat "${detailed_report}" >> "${GITHUB_STEP_SUMMARY}"
+          fi
+          printf '\n## Command coverage by OS/architecture/transport\n\n' >> "${GITHUB_STEP_SUMMARY}"
+          cat "${report}" >> "${GITHUB_STEP_SUMMARY}"
+
+      - name: Upload aggregate coverage
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: comprehensive-e2e-coverage-summary
+          path: coverage-summary
+          if-no-files-found: error
+          overwrite: true
+          retention-days: 30
+
+      - name: Fail on failed or not-run coverage
+        if: ${{ steps.aggregate.outcome != 'success' }}
+        run: exit 1
+
+  reflektor:
+    name: Existing Reflektor test matrix
+    needs: authorize
+    uses: ./.github/workflows/reflektor-tests.yml
+
+  shellcode:
+    name: Shellcode E2E test matrix
+    needs: authorize
+    uses: ./.github/workflows/shellcode-tests.yml

.github/workflows/golangci-lint.yml

@@ -0,0 +1,56 @@
+name: golangci-lint
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
+    paths:
+      - ".golangci.yml"
+      - ".github/workflows/golangci-lint.yml"
+      - "go.mod"
+      - "go.sum"
+      - "go.work"
+      - "go.work.sum"
+      - "Makefile"
+      - "vendor/**"
+      - "**/*.go"
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: golangci-lint (${{ matrix.goos }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        goos:
+          - linux
+          - darwin
+          - windows
+    env:
+      GOOS: ${{ matrix.goos }}
+      GOARCH: amd64
+      CGO_ENABLED: "0"
+    steps:
+      - name: Check Out Code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Go 1.26.6
+        uses: actions/setup-go@v6
+        with:
+          go-version: "1.26.6"
+
+      - name: Run golangci-lint
+        uses: golangci/golangci-lint-action@v9
+        with:
+          version: v2.12.2
+          # Gate only findings introduced since the event base revision.
+          args: --new-from-rev=${{ github.event.pull_request.base.sha || github.event.before }} ./client/... ./server/... ./util/... ./protobuf/... ./docs ./implant/...

.github/workflows/reflektor-tests.yml

@@ -0,0 +1,232 @@
+name: Reflektor Integration Test Matrix
+
+on:
+  workflow_call:
+  push:
+    branches:
+      - master
+    paths:
+      - "implant/**"
+      - "test/reflektor/**"
+      - ".github/workflows/reflektor-tests.yml"
+  pull_request:
+    paths:
+      - "implant/**"
+      - "test/reflektor/**"
+      - ".github/workflows/reflektor-tests.yml"
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  darwin:
+    name: reflektor-darwin-${{ matrix.goarch }}
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 180
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: macos-15-intel
+            goarch: amd64
+            server_arch: amd64
+          - runner: macos-15
+            goarch: arm64
+            server_arch: arm64
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Download Sliver build assets
+        run: go run -mod=vendor ./util/cmd/assets
+
+      - name: Build Sliver server
+        env:
+          CGO_ENABLED: "0"
+          GOARCH: ${{ matrix.server_arch }}
+          GOOS: darwin
+        run: go build -mod=vendor -trimpath -tags go_sqlite,server -o sliver-server ./server
+
+      - name: Build Reflektor integration driver
+        env:
+          CGO_ENABLED: "0"
+          GOARCH: ${{ matrix.goarch }}
+          GOOS: darwin
+        run: go build -mod=vendor -trimpath -tags client,go_sqlite -o sliver-reflektor-e2e ./test/reflektor
+
+      - name: Load Sliver with Reflektor
+        run: >-
+          ./sliver-reflektor-e2e
+          -repo .
+          -server ./sliver-server
+          -target-os darwin
+          -target-arch ${{ matrix.goarch }}
+
+  linux-native:
+    name: reflektor-linux-${{ matrix.goarch }}-native
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 180
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-24.04
+            goarch: amd64
+            server_arch: amd64
+          - runner: ubuntu-24.04-arm
+            goarch: arm64
+            server_arch: arm64
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Download Sliver build assets
+        run: go run -mod=vendor ./util/cmd/assets
+
+      - name: Build Sliver server
+        env:
+          CGO_ENABLED: "0"
+          GOARCH: ${{ matrix.server_arch }}
+          GOOS: linux
+        run: go build -mod=vendor -trimpath -tags go_sqlite,server -o sliver-server ./server
+
+      - name: Build Reflektor integration driver
+        env:
+          CGO_ENABLED: "0"
+          GOARCH: ${{ matrix.goarch }}
+          GOOS: linux
+        run: go build -mod=vendor -trimpath -tags client,go_sqlite -o sliver-reflektor-e2e ./test/reflektor
+
+      - name: Load Sliver with Reflektor
+        run: >-
+          ./sliver-reflektor-e2e
+          -repo .
+          -server ./sliver-server
+          -target-os linux
+          -target-arch ${{ matrix.goarch }}
+
+  linux-386:
+    name: reflektor-linux-386-docker
+    runs-on: ubuntu-24.04
+    timeout-minutes: 180
+    env:
+      CONTAINER_NAME: sliver-reflektor-linux-386-${{ github.run_id }}-${{ github.run_attempt }}
+      IMAGE_NAME: sliver-reflektor-linux-386:${{ github.run_id }}-${{ github.run_attempt }}
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build linux/386 test image
+        run: |
+          set -euo pipefail
+          go_version="$(awk '$1 == "go" { print $2; exit }' go.mod)"
+          docker buildx build \
+            --load \
+            --platform linux/386 \
+            --build-arg "GO_VERSION=${go_version}" \
+            --file test/reflektor/Dockerfile.linux-386 \
+            --tag "${IMAGE_NAME}" \
+            .
+          docker buildx prune --all --force
+
+      - name: Load Sliver with Reflektor
+        run: >-
+          docker run
+          --name "${CONTAINER_NAME}"
+          --platform linux/386
+          "${IMAGE_NAME}"
+
+      - name: Clean up linux/386 Docker resources
+        if: ${{ always() }}
+        run: |
+          docker rm --force "${CONTAINER_NAME}" 2>/dev/null || true
+          docker image rm --force "${IMAGE_NAME}" 2>/dev/null || true
+          docker buildx prune --all --force >/dev/null 2>&1 || true
+
+  windows:
+    name: reflektor-windows-${{ matrix.goarch }}
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 180
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: windows-2022
+            goarch: amd64
+            server_arch: amd64
+          - runner: windows-2022
+            goarch: 386
+            server_arch: amd64
+          - runner: windows-11-arm
+            goarch: arm64
+            server_arch: amd64
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Download Sliver build assets
+        run: go run -mod=vendor ./util/cmd/assets
+
+      - name: Build Sliver server
+        env:
+          CGO_ENABLED: "0"
+          GOARCH: ${{ matrix.server_arch }}
+          GOOS: windows
+        run: go build -mod=vendor -trimpath -tags go_sqlite,server -o sliver-server.exe ./server
+
+      - name: Build Reflektor integration driver
+        env:
+          CGO_ENABLED: "0"
+          GOARCH: ${{ matrix.goarch }}
+          GOOS: windows
+        run: go build -mod=vendor -trimpath -tags client,go_sqlite -o sliver-reflektor-e2e.exe ./test/reflektor
+
+      - name: Load Sliver with Reflektor
+        run: >-
+          ./sliver-reflektor-e2e.exe
+          -repo .
+          -server ./sliver-server.exe
+          -target-os windows
+          -target-arch ${{ matrix.goarch }}

.github/workflows/shellcode-tests.yml

@@ -0,0 +1,207 @@
+name: Shellcode E2E Test Matrix
+
+on:
+  workflow_call:
+    outputs:
+      shellcode_coverage_markdown:
+        description: Shellcode E2E coverage table in Markdown
+        value: ${{ jobs.aggregate.outputs.shellcode_coverage_markdown }}
+
+permissions:
+  contents: read
+
+jobs:
+  target:
+    name: shellcode-e2e-${{ matrix.target_os }}-${{ matrix.target_arch }}
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 360
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: macos-26
+            target_os: darwin
+            target_arch: arm64
+            server_os: darwin
+            server_arch: arm64
+            server_executable: ./sliver-server
+            test_executable: ./sliver-shellcode-e2e
+          - runner: ubuntu-24.04
+            target_os: linux
+            target_arch: amd64
+            server_os: linux
+            server_arch: amd64
+            server_executable: ./sliver-server
+            test_executable: ./sliver-shellcode-e2e
+          - runner: ubuntu-24.04-arm
+            target_os: linux
+            target_arch: arm64
+            server_os: linux
+            server_arch: arm64
+            server_executable: ./sliver-server
+            test_executable: ./sliver-shellcode-e2e
+          - runner: windows-2022
+            target_os: windows
+            target_arch: "386"
+            server_os: windows
+            server_arch: amd64
+            server_executable: ./sliver-server.exe
+            test_executable: ./sliver-shellcode-e2e.exe
+          - runner: windows-2022
+            target_os: windows
+            target_arch: amd64
+            server_os: windows
+            server_arch: amd64
+            server_executable: ./sliver-server.exe
+            test_executable: ./sliver-shellcode-e2e.exe
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Prepare target artifact
+        run: |
+          mkdir -p shellcode-results
+          printf '%s/%s\n' \
+            '${{ matrix.target_os }}' \
+            '${{ matrix.target_arch }}' \
+            > 'shellcode-results/target-${{ matrix.target_os }}-${{ matrix.target_arch }}.txt'
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Download Sliver build assets
+        run: go run -buildvcs=false -mod=vendor -trimpath ./util/cmd/assets
+
+      - name: Build unmodified Sliver server
+        env:
+          CGO_ENABLED: "0"
+          GOARCH: ${{ matrix.server_arch }}
+          GOOS: ${{ matrix.server_os }}
+        run: >-
+          go build -buildvcs=false -mod=vendor -trimpath -tags go_sqlite,server
+          -o ${{ matrix.server_executable }} ./server
+
+      - name: Compile shellcode E2E client
+        env:
+          CGO_ENABLED: "0"
+          GOARCH: ${{ matrix.target_arch }}
+          GOOS: ${{ matrix.target_os }}
+        run: >-
+          go test -c -buildvcs=false -mod=vendor -trimpath -tags client,go_sqlite
+          -o ${{ matrix.test_executable }} ./test/e2e
+
+      - name: Run shellcode generation and execution tests
+        run: >-
+          ${{ matrix.test_executable }}
+          -test.v
+          -test.run=^TestShellcodeE2E$
+          -test.timeout=0
+          -repo .
+          -server ${{ matrix.server_executable }}
+          -server-arch ${{ matrix.server_arch }}
+          -target-os ${{ matrix.target_os }}
+          -target-arch ${{ matrix.target_arch }}
+          -results ./shellcode-results
+          -transports mtls,wg,http
+          -implant-modes session,beacon
+          -beacon-interval 10s
+
+      - name: Upload target shellcode results
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: shellcode-e2e-target-${{ matrix.target_os }}-${{ matrix.target_arch }}
+          path: shellcode-results
+          if-no-files-found: error
+          overwrite: true
+          retention-days: 14
+
+  aggregate:
+    name: Aggregate shellcode E2E coverage
+    needs: target
+    if: ${{ always() }}
+    outputs:
+      shellcode_coverage_markdown: ${{ steps.publish_shellcode_coverage.outputs.shellcode_coverage_markdown }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Prepare aggregate artifact
+        run: |
+          mkdir -p shellcode-input shellcode-summary
+          printf 'Shellcode E2E coverage aggregate\n' > shellcode-summary/README.txt
+
+      - name: Download target shellcode results
+        continue-on-error: true
+        uses: actions/download-artifact@v8
+        with:
+          pattern: shellcode-e2e-target-*
+          path: shellcode-input
+          merge-multiple: true
+
+      - name: Aggregate shellcode coverage
+        id: aggregate
+        continue-on-error: true
+        run: >-
+          go run -buildvcs=false -mod=vendor -trimpath ./test/e2e/shellcode-report
+          -input ./shellcode-input
+          -output ./shellcode-summary
+
+      - name: Publish shellcode coverage table
+        id: publish_shellcode_coverage
+        if: ${{ always() }}
+        run: |
+          report="shellcode-summary/shellcode-coverage.md"
+          if [[ ! -s "${report}" ]]; then
+            printf 'Shellcode coverage report is missing or empty: %s\n' "${report}" >&2
+            exit 1
+          fi
+
+          delimiter="SHELLCODE_E2E_COVERAGE_EOF"
+          if grep -Fxq "${delimiter}" "${report}"; then
+            printf 'Shellcode coverage report contains the reserved output delimiter: %s\n' "${delimiter}" >&2
+            exit 1
+          fi
+
+          {
+            printf 'shellcode_coverage_markdown<<%s\n' "${delimiter}"
+            cat "${report}"
+            printf '%s\n' "${delimiter}"
+          } >> "${GITHUB_OUTPUT}"
+
+          cat "${report}" >> "${GITHUB_STEP_SUMMARY}"
+
+      - name: Upload aggregate shellcode coverage
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: shellcode-e2e-coverage-summary
+          path: shellcode-summary
+          if-no-files-found: error
+          overwrite: true
+          retention-days: 30
+
+      - name: Fail on failed or not-run shellcode coverage
+        if: ${{ always() && steps.aggregate.outcome != 'success' }}
+        run: exit 1

.github/workflows/unit-tests.yml

@@ -25,10 +25,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 180
     steps:
-      - name: Go 1.25.8
+      - name: Go 1.26.6
         uses: actions/setup-go@v6
         with:
-          go-version: "1.25.8"
+          go-version: "1.26.6"
 
       - name: OS Packages
         run: |
@@ -71,10 +71,10 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 180
     steps:
-      - name: Go 1.25.8
+      - name: Go 1.26.6
         uses: actions/setup-go@v6
         with:
-          go-version: "1.25.8"
+          go-version: "1.26.6"
 
       - name: Install make
         run: choco install make -y --no-progress
@@ -115,10 +115,10 @@ jobs:
     runs-on: macos-latest
     timeout-minutes: 180
     steps:
-      - name: Go 1.25.8
+      - name: Go 1.26.6
         uses: actions/setup-go@v6
         with:
-          go-version: "1.25.8"
+          go-version: "1.26.6"
 
       - name: Check Out Code
         uses: actions/checkout@v6
@@ -153,10 +153,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 90
     steps:
-      - name: Go 1.25.8
+      - name: Go 1.26.6
         uses: actions/setup-go@v6
         with:
-          go-version: "1.25.8"
+          go-version: "1.26.6"
 
       - name: Check Out Code
         uses: actions/checkout@v6

.golangci.yml

@@ -0,0 +1,27 @@
+version: "2"
+
+run:
+  timeout: 10m
+  modules-download-mode: vendor
+  build-tags:
+    - client
+    - server
+    - osusergo
+    - netgo
+    - go_sqlite
+    # Raw implant entry points are Go templates; lint their supporting packages.
+    - sliver_lint
+
+linters:
+  default: standard
+  enable:
+    - gocyclo
+    - misspell
+    - revive
+  settings:
+    gocyclo:
+      min-complexity: 15
+
+formatters:
+  enable:
+    - gofmt

Makefile

@@ -2,18 +2,31 @@
 # Makefile for Sliver
 #
 
+.DEFAULT_GOAL := default
+
 GO ?= go
 ARTIFACT_SUFFIX ?=
 ENV =
 TAGS ?= -tags go_sqlite
 CGO_ENABLED = 0
+GOLANGCI_LINT ?= golangci-lint
+# The tree has legacy lint findings, so gate issues introduced by this change.
+GOLANGCI_LINT_BASE ?= master
+GOLANGCI_LINT_ARGS ?= --new-from-merge-base=$(GOLANGCI_LINT_BASE)
+GOLANGCI_LINT_PACKAGES = \
+	./client/... \
+	./server/... \
+	./util/... \
+	./protobuf/... \
+	./docs \
+	./implant/...
 
 ifneq (,$(findstring cgo_sqlite,$(TAGS)))
 	CGO_ENABLED = 1
 endif
 
 MIN_SUPPORTED_GO_MAJOR_VERSION = 1
-MIN_SUPPORTED_GO_MINOR_VERSION = 25
+MIN_SUPPORTED_GO_MINOR_VERSION = 26
 GO_VERSION_VALIDATION_ERR_MSG = Golang version is not supported, please update to at least $(MIN_SUPPORTED_GO_MAJOR_VERSION).$(MIN_SUPPORTED_GO_MINOR_VERSION)
 
 SLIVER_PUBLIC_KEY ?= RWTZPg959v3b7tLG7VzKHRB1/QT+d3c71Uzetfa44qAoX5rH7mGoQTTR
@@ -23,6 +36,10 @@ CLIENT_ASSETS_PKG = github.com/bishopfox/sliver/client/assets
 SLIVER_UPDATE_PKG = github.com/bishopfox/sliver/client/command/update
 PB_COMPILERS = protoc protoc-gen-go protoc-gen-go-grpc
 
+.PHONY: lint
+lint:
+	$(GOLANGCI_LINT) run $(GOLANGCI_LINT_ARGS) $(GOLANGCI_LINT_PACKAGES)
+
 ifneq ($(OS),Windows_NT)
 
 #

README.md

@@ -4,7 +4,7 @@ Sliver is an open source cross-platform adversary emulation/red team framework,
 
 The server and client support MacOS, Windows, and Linux. Implants are supported on MacOS, Windows, and Linux (and possibly every Golang compiler target but we've not tested them all).
 
-[![Release](https://github.com/BishopFox/sliver/actions/workflows/autorelease.yml/badge.svg)](https://github.com/BishopFox/sliver/actions/workflows/autorelease.yml) [![Go Report Card](https://goreportcard.com/badge/github.com/BishopFox/sliver)](https://goreportcard.com/report/github.com/BishopFox/sliver) [![License: GPL v3](https://img.shields.io/badge/License-GPLv3-blue.svg)](https://www.gnu.org/licenses/gpl-3.0)
+[![Release](https://github.com/BishopFox/sliver/actions/workflows/autorelease.yml/badge.svg)](https://github.com/BishopFox/sliver/actions/workflows/autorelease.yml) [![golangci-lint](https://github.com/BishopFox/sliver/actions/workflows/golangci-lint.yml/badge.svg)](https://github.com/BishopFox/sliver/actions/workflows/golangci-lint.yml) [![License: GPL v3](https://img.shields.io/badge/License-GPLv3-blue.svg)](https://www.gnu.org/licenses/gpl-3.0)
 
 Visit [https://sliver.sh/](https://sliver.sh/) for tutorials and documentation.
 

client/command/alias/args.go

@@ -0,0 +1,251 @@
+package alias
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/spf13/cobra"
+)
+
+// Alias commands run with cobra's DisableFlagParsing enabled (see LoadAlias),
+// the same treatment extension commands received for their arguments. Before
+// that, an unknown flag such as the payload's own `-pid` was rejected outright
+// by pflag ("unknown flag"), and operators had to inject cobra's "--"
+// separator (documented on the wiki) to pass arguments through at all (#2264).
+//
+// With flag parsing disabled cobra hands Run the raw, unstripped slice, and we
+// extract the Sliver-owned flags ourselves here. Everything we do not own is
+// passed to the payload untouched, so all of these now work:
+//
+//	amsi-bypass -pid 6969
+//	fakealias --process notepad.exe arg1 arg2
+//	fakealias -- --anything still-here     (existing workaround, unchanged)
+type ownedFlagKind int
+
+const (
+	ownedBool ownedFlagKind = iota
+	ownedString
+	ownedUint32
+	ownedInt64
+)
+
+// ownedFlagSpec describes one Sliver-owned flag that splitAliasArgs extracts
+// from the raw argument slice before the rest is handed to the alias payload.
+type ownedFlagSpec struct {
+	long  string        // canonical pflag name, e.g. "process-arguments"
+	short string        // shorthand letter, e.g. "A" ("" if the flag has none)
+	kind  ownedFlagKind // how the value is consumed and validated
+}
+
+// baseAliasOwnedFlags are registered for every alias command.
+var baseAliasOwnedFlags = []ownedFlagSpec{
+	{long: "process", short: "p", kind: ownedString},
+	{long: "process-arguments", short: "A", kind: ownedString},
+	{long: "ppid", short: "P", kind: ownedUint32},
+	{long: "save", short: "s", kind: ownedBool},
+	{long: "timeout", short: "t", kind: ownedInt64},
+}
+
+// assemblyAliasOwnedFlags are only owned when the alias wraps a .NET assembly;
+// for every other alias they are unknown tokens and pass through to the payload.
+var assemblyAliasOwnedFlags = []ownedFlagSpec{
+	{long: "method", short: "m", kind: ownedString},
+	{long: "class", short: "c", kind: ownedString},
+	{long: "app-domain", short: "d", kind: ownedString},
+	{long: "arch", short: "a", kind: ownedString},
+	{long: "in-process", short: "i", kind: ownedBool},
+	{long: "runtime", short: "r", kind: ownedString},
+	{long: "amsi-bypass", short: "M", kind: ownedBool},
+	{long: "etw-bypass", short: "E", kind: ownedBool},
+}
+
+// aliasOwnedFlagSpecs returns the flag set owned by a particular alias.
+func aliasOwnedFlagSpecs(isAssembly bool) []ownedFlagSpec {
+	if !isAssembly {
+		return baseAliasOwnedFlags
+	}
+	specs := make([]ownedFlagSpec, 0, len(baseAliasOwnedFlags)+len(assemblyAliasOwnedFlags))
+	specs = append(specs, baseAliasOwnedFlags...)
+	return append(specs, assemblyAliasOwnedFlags...)
+}
+
+// ownedFlagMatch is a raw token that spelled one of the Sliver-owned flags.
+type ownedFlagMatch struct {
+	spec   ownedFlagSpec
+	value  string // value from a "--flag=value" / "-f=value" spelling
+	inline bool   // whether the token carried its value inline
+}
+
+// splitAliasArgs separates the Sliver-owned flags from the alias payload's own
+// arguments in a raw (DisableFlagParsing) argument slice. It accepts the long
+// forms --flag, --flag=value, --flag value and the shorthand forms -f, -f=value,
+// -f value, mirroring pflag. Two deliberate differences from pflag:
+//
+//   - a glued shorthand value (-pnotepad) does NOT match --process: tokens
+//     like the payload's own "-pid" must survive intact (#2264);
+//   - after a literal "--" every token is copied through verbatim, preserving
+//     the long-standing separator workaround.
+//
+// The returned map holds the raw string value of each flag that was provided;
+// callers re-publish the values with applyOwnedAliasFlags.
+func splitAliasArgs(raw []string, specs []ownedFlagSpec) (map[string]string, bool, []string, error) {
+	values := make(map[string]string)
+	extArgs := make([]string, 0, len(raw))
+	byLong, byShort := ownedFlagTables(specs)
+
+	passthrough := false
+	for i := 0; i < len(raw); i++ {
+		tok := raw[i]
+
+		// Once we have seen "--", copy everything through untouched.
+		if passthrough {
+			extArgs = append(extArgs, tok)
+			continue
+		}
+		if tok == "--" {
+			passthrough = true
+			continue
+		}
+		if tok == "--help" || tok == "-h" {
+			return values, true, extArgs, nil
+		}
+
+		match, ok := matchOwnedFlag(tok, byLong, byShort)
+		if !ok {
+			// Not one of ours (including glued shorthands and the payload's
+			// own flags): the alias owns the token, pass it through untouched.
+			extArgs = append(extArgs, tok)
+			continue
+		}
+		i = takeOwnedValue(match, raw, i, values)
+	}
+
+	if err := validateOwnedValues(specs, values); err != nil {
+		return nil, false, nil, err
+	}
+	return values, false, extArgs, nil
+}
+
+// ownedFlagTables indexes the specs by long name and shorthand.
+func ownedFlagTables(specs []ownedFlagSpec) (byLong, byShort map[string]ownedFlagSpec) {
+	byLong = make(map[string]ownedFlagSpec, len(specs))
+	byShort = make(map[string]ownedFlagSpec, len(specs))
+	for _, spec := range specs {
+		byLong[spec.long] = spec
+		if spec.short != "" {
+			byShort[spec.short] = spec
+		}
+	}
+	return byLong, byShort
+}
+
+// matchOwnedFlag checks whether tok spells one of the Sliver-owned flags, in
+// the long form (--name, --name=value) or shorthand form (-f, -f=value). A
+// glued shorthand value (-pnotepad) deliberately does not match: pflag would
+// read "-pid" as -p with value "id", which is exactly the mangling that broke
+// #2264, so such tokens must fall through to the payload.
+func matchOwnedFlag(tok string, byLong, byShort map[string]ownedFlagSpec) (ownedFlagMatch, bool) {
+	var match ownedFlagMatch
+	var name, value string
+	var hasValue, isShort bool
+
+	switch {
+	case strings.HasPrefix(tok, "--"):
+		name, value, hasValue = strings.Cut(tok[2:], "=")
+	case strings.HasPrefix(tok, "-") && len(tok) > 1:
+		name, value, hasValue = strings.Cut(tok[1:], "=")
+		isShort = len(name) == 1
+	default:
+		return match, false
+	}
+
+	spec, ok := byLong[name]
+	if isShort {
+		spec, ok = byShort[name]
+	}
+	if !ok {
+		return match, false
+	}
+	match.spec, match.value, match.inline = spec, value, hasValue
+	return match, true
+}
+
+// takeOwnedValue records the flag's value in values and returns the index of
+// the last raw token it consumed. The "--flag value" / "-f value" spellings
+// consume the following token; a bool without an inline value defaults to
+// true; a value flag as the very last token is dropped and keeps its default,
+// mirroring the extension behaviour.
+func takeOwnedValue(match ownedFlagMatch, raw []string, i int, values map[string]string) int {
+	switch {
+	case match.spec.kind == ownedBool:
+		if !match.inline {
+			match.value = "true"
+		}
+		values[match.spec.long] = match.value
+	case match.inline:
+		values[match.spec.long] = match.value
+	case i+1 < len(raw):
+		values[match.spec.long] = raw[i+1]
+		return i + 1
+	}
+	return i
+}
+
+// validateOwnedValues rejects non-numeric values for the numeric flag kinds,
+// the way pflag's typed values would have.
+func validateOwnedValues(specs []ownedFlagSpec, values map[string]string) error {
+	for _, spec := range specs {
+		value, provided := values[spec.long]
+		if !provided {
+			continue
+		}
+		var err error
+		switch spec.kind {
+		case ownedUint32:
+			_, err = strconv.ParseUint(value, 10, 32)
+		case ownedInt64:
+			_, err = strconv.ParseInt(value, 10, 64)
+		}
+		if err != nil {
+			return fmt.Errorf("invalid value %q for --%s", value, spec.long)
+		}
+	}
+	return nil
+}
+
+// applyOwnedAliasFlags republishes the manually parsed Sliver-owned flag values
+// onto the command's flag set. DisableFlagParsing prevents pflag from
+// populating them, so readers such as runAliasCommand's Get* calls and
+// ActiveTarget.Request (which derives the gRPC timeout from --timeout) would
+// otherwise observe only the defaults.
+func applyOwnedAliasFlags(cmd *cobra.Command, values map[string]string) error {
+	for name, value := range values {
+		flag := cmd.Flags().Lookup(name)
+		if flag == nil {
+			continue // e.g. an assembly flag on a non-assembly alias
+		}
+		if err := flag.Value.Set(value); err != nil {
+			return fmt.Errorf("invalid value %q for --%s: %w", value, name, err)
+		}
+	}
+	return nil
+}

client/command/alias/args_test.go

@@ -0,0 +1,259 @@
+package alias
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+)
+
+// TestSplitAliasArgs covers the argument passthrough regression from #2264:
+// the alias payload's own flags must reach the payload intact, while the
+// Sliver-owned flags are extracted and validated.
+func TestSplitAliasArgs(t *testing.T) {
+	base := aliasOwnedFlagSpecs(false)
+	assembly := aliasOwnedFlagSpecs(true)
+
+	cases := []struct {
+		name    string
+		specs   []ownedFlagSpec
+		in      []string
+		values  map[string]string
+		help    bool
+		extArgs []string
+		wantErr bool
+	}{
+		{
+			name:    "payload flag without -- separator (#2264 regression)",
+			specs:   base,
+			in:      []string{"-pid", "6969"},
+			values:  map[string]string{},
+			extArgs: []string{"-pid", "6969"},
+		},
+		{
+			name:    "glued shorthand is not ours and passes through",
+			specs:   base,
+			in:      []string{"-pid"},
+			values:  map[string]string{},
+			extArgs: []string{"-pid"},
+		},
+		{
+			name:    "payload flag with -- separator (existing workaround)",
+			specs:   base,
+			in:      []string{"--", "--pid", "6969"},
+			values:  map[string]string{},
+			extArgs: []string{"--pid", "6969"},
+		},
+		{
+			name:    "owned flag after -- belongs to the payload",
+			specs:   base,
+			in:      []string{"--", "--save"},
+			values:  map[string]string{},
+			extArgs: []string{"--save"},
+		},
+		{
+			name:    "long flag with separate value, then payload args",
+			specs:   base,
+			in:      []string{"--process", "notepad.exe", "arg1", "arg2"},
+			values:  map[string]string{"process": "notepad.exe"},
+			extArgs: []string{"arg1", "arg2"},
+		},
+		{
+			name:    "long flag with equals value",
+			specs:   base,
+			in:      []string{"--process=notepad.exe", "arg1"},
+			values:  map[string]string{"process": "notepad.exe"},
+			extArgs: []string{"arg1"},
+		},
+		{
+			name:    "shorthand with separate value",
+			specs:   base,
+			in:      []string{"-p", "notepad.exe", "arg1"},
+			values:  map[string]string{"process": "notepad.exe"},
+			extArgs: []string{"arg1"},
+		},
+		{
+			name:    "shorthand with equals value",
+			specs:   base,
+			in:      []string{"-p=notepad.exe"},
+			values:  map[string]string{"process": "notepad.exe"},
+			extArgs: []string{},
+		},
+		{
+			name:    "bool shorthand and long false form",
+			specs:   base,
+			in:      []string{"-s", "--save=false", "arg1"},
+			values:  map[string]string{"save": "false"},
+			extArgs: []string{"arg1"},
+		},
+		{
+			name:    "quoted value containing spaces stays a single argument",
+			specs:   base,
+			in:      []string{"-A", "-kalc -kdisable", "arg1"},
+			values:  map[string]string{"process-arguments": "-kalc -kdisable"},
+			extArgs: []string{"arg1"},
+		},
+		{
+			name:    "valid uint32 and int64 values",
+			specs:   base,
+			in:      []string{"-P", "1234", "--timeout=90"},
+			values:  map[string]string{"ppid": "1234", "timeout": "90"},
+			extArgs: []string{},
+		},
+		{
+			name:    "invalid uint32 value errors",
+			specs:   base,
+			in:      []string{"--ppid", "notanumber"},
+			wantErr: true,
+		},
+		{
+			name:    "invalid int64 value errors",
+			specs:   base,
+			in:      []string{"--timeout=x"},
+			wantErr: true,
+		},
+		{
+			name:  "assembly flags are owned for assembly aliases",
+			specs: assembly,
+			in:    []string{"--method", "Run", "--class", "Prog", "-i", "-M", "--arch", "x64", "payloadArg"},
+			values: map[string]string{
+				"method": "Run", "class": "Prog", "in-process": "true",
+				"amsi-bypass": "true", "arch": "x64",
+			},
+			extArgs: []string{"payloadArg"},
+		},
+		{
+			name:    "assembly flags pass through for non-assembly aliases",
+			specs:   base,
+			in:      []string{"--method", "Run"},
+			values:  map[string]string{},
+			extArgs: []string{"--method", "Run"},
+		},
+		{
+			name:    "help flags are detected",
+			specs:   base,
+			in:      []string{"--help"},
+			help:    true,
+			values:  map[string]string{},
+			extArgs: []string{},
+		},
+		{
+			name:    "short help is detected",
+			specs:   base,
+			in:      []string{"-h"},
+			help:    true,
+			values:  map[string]string{},
+			extArgs: []string{},
+		},
+		{
+			name:    "value flag as last token keeps its default",
+			specs:   base,
+			in:      []string{"arg1", "--process"},
+			values:  map[string]string{},
+			extArgs: []string{"arg1"},
+		},
+		{
+			name:    "empty input",
+			specs:   base,
+			in:      nil,
+			values:  map[string]string{},
+			extArgs: []string{},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			values, help, extArgs, err := splitAliasArgs(tc.in, tc.specs)
+
+			if tc.wantErr {
+				if err == nil {
+					t.Fatalf("expected error, got values=%#v help=%v extArgs=%#v", values, help, extArgs)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %s", err)
+			}
+			if help != tc.help {
+				t.Errorf("help: got %v, want %v", help, tc.help)
+			}
+			if !reflect.DeepEqual(values, tc.values) {
+				t.Errorf("values: got %#v, want %#v", values, tc.values)
+			}
+			if !reflect.DeepEqual(extArgs, tc.extArgs) {
+				t.Errorf("extArgs: got %#v, want %#v", extArgs, tc.extArgs)
+			}
+		})
+	}
+}
+
+// TestApplyOwnedAliasFlags checks that manually parsed values are re-published
+// on the command's flag set for every value type an alias can own.
+func TestApplyOwnedAliasFlags(t *testing.T) {
+	cmd := &cobra.Command{}
+	f := pflag.NewFlagSet("alias-test", pflag.ContinueOnError)
+	f.StringP("process", "p", "", "host process")
+	f.StringP("process-arguments", "A", "", "host process arguments")
+	f.Uint32P("ppid", "P", 0, "parent pid")
+	f.BoolP("save", "s", false, "save output")
+	f.Int64P("timeout", "t", 60, "timeout")
+	f.BoolP("amsi-bypass", "M", false, "amsi bypass")
+	cmd.Flags().AddFlagSet(f)
+
+	err := applyOwnedAliasFlags(cmd, map[string]string{
+		"process":           "notepad.exe",
+		"process-arguments": "-k foo",
+		"ppid":              "1234",
+		"save":              "true",
+		"timeout":           "90",
+		"amsi-bypass":       "true",
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %s", err)
+	}
+
+	for name, want := range map[string]interface{}{
+		"process": "notepad.exe", "process-arguments": "-k foo",
+	} {
+		got, _ := cmd.Flags().GetString(name)
+		if got != want.(string) {
+			t.Errorf("%s: got %q, want %q", name, got, want)
+		}
+	}
+	if ppid, _ := cmd.Flags().GetUint32("ppid"); ppid != 1234 {
+		t.Errorf("ppid: got %d, want 1234", ppid)
+	}
+	if save, _ := cmd.Flags().GetBool("save"); !save {
+		t.Error("save: got false, want true")
+	}
+	if timeout, _ := cmd.Flags().GetInt64("timeout"); timeout != 90 {
+		t.Errorf("timeout: got %d, want 90", timeout)
+	}
+	if amsi, _ := cmd.Flags().GetBool("amsi-bypass"); !amsi {
+		t.Error("amsi-bypass: got false, want true")
+	}
+
+	// Unset flags keep their defaults.
+	if inProc := cmd.Flags().Lookup("in-process"); inProc != nil {
+		t.Error("in-process should not be registered on this command")
+	}
+}

client/command/alias/load.go

@@ -215,8 +215,6 @@ func LoadAlias(manifestPath string, cmd *cobra.Command, con *console.SliverClien
 			longHelp.WriteString(fmt.Sprintf("%s (%s):\t%s%s", strings.ToUpper(arg.Name), aType, optStr, arg.Desc))
 		}
 	}
-	longHelp.WriteString("\n\n⚠️  If you're having issues passing arguments to the alias please read:\n")
-	longHelp.WriteString("https://github.com/BishopFox/sliver/wiki/Aliases-&-Extensions#aliases-command-parsing")
 
 	// for each alias command, add a new app command
 	helpMsg := fmt.Sprintf("[%s] %s", aliasManifest.Name, aliasManifest.Help)
@@ -227,9 +225,14 @@ func LoadAlias(manifestPath string, cmd *cobra.Command, con *console.SliverClien
 		Run: func(cmd *cobra.Command, args []string) {
 			runAliasCommand(cmd, con, args)
 		},
-		Args:        cobra.ArbitraryArgs, // 	a.StringList("arguments", "arguments", grumble.Default([]string{}))
-		GroupID:     consts.AliasHelpGroup,
-		Annotations: makeAliasPlatformFilters(aliasManifest),
+		Args: cobra.ArbitraryArgs, // 	a.StringList("arguments", "arguments", grumble.Default([]string{}))
+		// DisableFlagParsing keeps the alias payload's own flags (which are
+		// unknown to pflag) from being rejected or swallowed; we split the
+		// Sliver-owned flags out of the raw slice ourselves in
+		// runAliasCommand (#2264, same treatment as extensions).
+		DisableFlagParsing: true,
+		GroupID:            consts.AliasHelpGroup,
+		Annotations:        makeAliasPlatformFilters(aliasManifest),
 	}
 
 	if aliasManifest.IsAssembly {
@@ -333,6 +336,27 @@ func runAliasCommand(cmd *cobra.Command, con *console.SliverClient, args []strin
 		return
 	}
 	aliasManifest := loadedAlias.Manifest
+
+	// The command runs with DisableFlagParsing, so args is the raw, unstripped
+	// slice. Separate the Sliver-owned flags from the payload's own arguments
+	// and re-publish them on the flag set (so the Get* readers below and
+	// Request()'s --timeout still work), then hand only the payload arguments
+	// to the execution paths (#2264, same treatment as extensions in #2323).
+	ownedValues, helpRequested, payloadArgs, err := splitAliasArgs(args, aliasOwnedFlagSpecs(aliasManifest.IsAssembly))
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	if helpRequested {
+		_ = cmd.Help()
+		return
+	}
+	if err := applyOwnedAliasFlags(cmd, ownedValues); err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	args = payloadArgs
+
 	binPath, err := aliasManifest.getFileForTarget(cmd.Name(), goos, goarch)
 	if err != nil {
 		con.PrintErrorf("Fail to find alias file: %s\n", err)

client/command/extensions/args.go

@@ -0,0 +1,123 @@
+package extensions
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"strconv"
+	"strings"
+
+	"github.com/spf13/cobra"
+)
+
+// splitExtensionArgs separates Sliver-owned flags (--save, --timeout, --help)
+// from the extension's own arguments in a raw argument slice.
+//
+// Extension commands run with cobra's DisableFlagParsing enabled (see
+// ExtensionRegisterCommand). Without it, pflag parses the command line first
+// and, because the extension's own flags (e.g. --type, --fqdn) are unknown to
+// pflag, ParseErrorsWhitelist.UnknownFlags causes pflag to silently drop each
+// unknown flag together with its value; the BOF argument parser never saw them
+// unless the operator injected cobra's "--" separator (#2309). Running with
+// flag parsing disabled hands us the raw, unstripped slice, so we separate the
+// Sliver-owned flags ourselves here.
+//
+// A literal "--" stops Sliver-flag scanning; every token after it is passed
+// through verbatim, preserving the long-standing workaround syntax. Unknown
+// tokens (the extension's named flags, their values and positional arguments)
+// are never consumed or reordered, so both forms work:
+//
+//	delegationbof --timeout 30 --type 6 --fqdn child.htb.local
+//	delegationbof -- --type 6 --fqdn child.htb.local
+func splitExtensionArgs(raw []string) (save bool, timeout int64, help bool, extArgs []string) {
+	timeout = defaultTimeout
+	extArgs = make([]string, 0, len(raw))
+
+	passthrough := false
+	for i := 0; i < len(raw); i++ {
+		tok := raw[i]
+
+		// Once we have seen "--", copy everything through untouched so the
+		// existing `ext -- --foo bar` syntax keeps working identically.
+		if passthrough {
+			extArgs = append(extArgs, tok)
+			continue
+		}
+
+		switch {
+		case tok == "--":
+			passthrough = true
+
+		case tok == "--help" || tok == "-h":
+			help = true
+
+		case tok == "--save" || tok == "-s":
+			save = true
+
+		case strings.HasPrefix(tok, "--save="):
+			save = parseBoolValue(tok[len("--save="):], true)
+
+		case tok == "--timeout" || tok == "-t":
+			// Consume the following token as the value, mirroring pflag. If no
+			// token follows, leave the default in place rather than erroring.
+			if i+1 < len(raw) {
+				if n, err := strconv.ParseInt(raw[i+1], 10, 64); err == nil {
+					timeout = n
+				}
+				i++
+			}
+
+		case strings.HasPrefix(tok, "--timeout="):
+			if n, err := strconv.ParseInt(tok[len("--timeout="):], 10, 64); err == nil {
+				timeout = n
+			}
+
+		default:
+			// Not a Sliver-owned flag: hand it to the extension parser untouched.
+			extArgs = append(extArgs, tok)
+		}
+	}
+
+	return save, timeout, help, extArgs
+}
+
+// applyOwnedFlags republishes the manually parsed Sliver-owned flag values back
+// onto the command's flag set. DisableFlagParsing prevents pflag from populating
+// them, so helpers that read them via cmd.Flags() (notably ActiveTarget.Request,
+// which derives the gRPC timeout from --timeout) would otherwise observe only the
+// defaults.
+func applyOwnedFlags(cmd *cobra.Command, save bool, timeout int64) {
+	if flag := cmd.Flags().Lookup("timeout"); flag != nil {
+		_ = flag.Value.Set(strconv.FormatInt(timeout, 10))
+	}
+	if flag := cmd.Flags().Lookup("save"); flag != nil {
+		_ = flag.Value.Set(strconv.FormatBool(save))
+	}
+}
+
+// parseBoolValue parses a --flag=value bool, defaulting to defVal when the value
+// is empty (the bare-flag form). It accepts the same spellings pflag does.
+func parseBoolValue(v string, defVal bool) bool {
+	switch strings.ToLower(v) {
+	case "", "true", "t", "1":
+		return true
+	case "false", "f", "0":
+		return false
+	}
+	return defVal
+}

client/command/extensions/args_test.go

@@ -0,0 +1,149 @@
+package extensions
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"reflect"
+	"testing"
+)
+
+// TestSplitExtensionArgs covers the argument-passthrough regression from #2309:
+// the extension's own named flags must reach the BOF parser intact regardless of
+// the cobra "--" separator, while Sliver-owned flags are still honoured.
+func TestSplitExtensionArgs(t *testing.T) {
+	cases := []struct {
+		name    string
+		in      []string
+		save    bool
+		timeout int64
+		help    bool
+		extArgs []string
+	}{
+		{
+			name:    "named extension flags without -- separator (#2309 regression)",
+			in:      []string{"--type", "6", "--fqdn", "child.htb.local"},
+			timeout: defaultTimeout,
+			extArgs: []string{"--type", "6", "--fqdn", "child.htb.local"},
+		},
+		{
+			name:    "named extension flags with -- separator (existing workaround)",
+			in:      []string{"--", "--type", "6", "--fqdn", "child.htb.local"},
+			timeout: defaultTimeout,
+			extArgs: []string{"--type", "6", "--fqdn", "child.htb.local"},
+		},
+		{
+			name:    "sliver-owned flags precede extension arguments",
+			in:      []string{"--timeout", "30", "--save", "--type", "6"},
+			save:    true,
+			timeout: 30,
+			extArgs: []string{"--type", "6"},
+		},
+		{
+			name:    "quoted value containing spaces stays a single argument",
+			in:      []string{"--name", "hello world", "--type", "6"},
+			timeout: defaultTimeout,
+			extArgs: []string{"--name", "hello world", "--type", "6"},
+		},
+		{
+			name:    "positional extension arguments are preserved",
+			in:      []string{"foo", "bar", "baz"},
+			timeout: defaultTimeout,
+			extArgs: []string{"foo", "bar", "baz"},
+		},
+		{
+			name:    "single-dash and double-dash forms are preserved",
+			in:      []string{"-type", "6", "--fqdn", "child.htb.local"},
+			timeout: defaultTimeout,
+			extArgs: []string{"-type", "6", "--fqdn", "child.htb.local"},
+		},
+		{
+			name:    "equals form for timeout",
+			in:      []string{"--timeout=120", "--type", "6"},
+			timeout: 120,
+			extArgs: []string{"--type", "6"},
+		},
+		{
+			name:    "short -s save flag",
+			in:      []string{"-s", "--type", "6"},
+			save:    true,
+			timeout: defaultTimeout,
+			extArgs: []string{"--type", "6"},
+		},
+		{
+			name:    "help flag is detected",
+			in:      []string{"--help"},
+			help:    true,
+			timeout: defaultTimeout,
+			extArgs: []string{},
+		},
+		{
+			name:    "empty input",
+			in:      nil,
+			timeout: defaultTimeout,
+			extArgs: []string{},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			save, timeout, help, extArgs := splitExtensionArgs(tc.in)
+
+			if save != tc.save {
+				t.Errorf("save: got %v, want %v", save, tc.save)
+			}
+			if timeout != tc.timeout {
+				t.Errorf("timeout: got %d, want %d", timeout, tc.timeout)
+			}
+			if help != tc.help {
+				t.Errorf("help: got %v, want %v", help, tc.help)
+			}
+			if !reflect.DeepEqual(extArgs, tc.extArgs) {
+				t.Errorf("extArgs: got %#v, want %#v", extArgs, tc.extArgs)
+			}
+		})
+	}
+}
+
+// TestParseBoolValue checks the --flag=value helper used for --save=value.
+func TestParseBoolValue(t *testing.T) {
+	cases := []struct {
+		in   string
+		want bool
+	}{
+		{"", true},
+		{"true", true},
+		{"TRUE", true},
+		{"1", true},
+		{"t", true},
+		{"false", false},
+		{"0", false},
+		{"no", false}, // unsupported spellings keep the default
+	}
+	for _, tc := range cases {
+		got := parseBoolValue(tc.in, true)
+		// "no" is not a pflag spelling, so it falls through to the default (true).
+		want := tc.want
+		if tc.in == "no" {
+			want = true
+		}
+		if got != want {
+			t.Errorf("parseBoolValue(%q): got %v, want %v", tc.in, got, want)
+		}
+	}
+}

client/command/extensions/extensions_test.go

@@ -1,10 +1,21 @@
 package extensions
 
 import (
+	"context"
 	"encoding/json"
+	"errors"
 	"testing"
+	"time"
 
+	"github.com/bishopfox/sliver/client/console"
+	consts "github.com/bishopfox/sliver/client/constants"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/bishopfox/sliver/protobuf/rpcpb"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/bishopfox/sliver/util"
+	"github.com/spf13/cobra"
+	"google.golang.org/grpc"
 )
 
 /*
@@ -115,6 +126,25 @@ const (
 	}`
 )
 
+type registerExtensionTestRPC struct {
+	rpcpb.SliverRPCClient
+	register func(context.Context, *sliverpb.RegisterExtensionReq, ...grpc.CallOption) (*sliverpb.RegisterExtension, error)
+}
+
+func (f *registerExtensionTestRPC) RegisterExtension(ctx context.Context, req *sliverpb.RegisterExtensionReq, opts ...grpc.CallOption) (*sliverpb.RegisterExtension, error) {
+	return f.register(ctx, req, opts...)
+}
+
+func newExtensionTestConsole(t *testing.T, rpc rpcpb.SliverRPCClient, session *clientpb.Session, beacon *clientpb.Beacon) *console.SliverClient {
+	t.Helper()
+
+	con := console.NewConsole(false)
+	con.IsCLI = true
+	con.Rpc = rpc
+	con.ActiveTarget.Set(session, beacon)
+	return con
+}
+
 func TestParseExtensionManifest(t *testing.T) {
 	expectedPath := util.ResolvePath("foo/test1.dll")
 
@@ -189,6 +219,218 @@ func TestParseExtensionManifest(t *testing.T) {
 
 }
 
+func TestConvertOldManifestPreservesInit(t *testing.T) {
+	const initExport = "InitializeExtension"
+
+	manifest, err := ParseExtensionManifest([]byte(`{
+		"name": "legacy-test",
+		"command_name": "legacy-test",
+		"help": "some help",
+		"init": "InitializeExtension",
+		"files": [
+			{
+				"os": "windows",
+				"arch": "amd64",
+				"path": "foo/test.dll"
+			}
+		]
+	}`))
+	if err != nil {
+		t.Fatalf("Error parsing legacy extension manifest: %s", err)
+	}
+	if len(manifest.ExtCommand) != 1 {
+		t.Fatalf("Expected 1 extension command, got %d", len(manifest.ExtCommand))
+	}
+	if manifest.ExtCommand[0].Init != initExport {
+		t.Errorf("Expected init export %q, got %q", initExport, manifest.ExtCommand[0].Init)
+	}
+}
+
+func TestRegisterExtensionPropagatesInit(t *testing.T) {
+	const initExport = "InitializeExtension"
+
+	tests := []struct {
+		name      string
+		session   *clientpb.Session
+		beacon    *clientpb.Beacon
+		wantAsync bool
+		wantID    string
+	}{
+		{
+			name:    "session",
+			session: &clientpb.Session{ID: "session-id"},
+			wantID:  "session-id",
+		},
+		{
+			name:      "beacon",
+			beacon:    &clientpb.Beacon{ID: "beacon-id"},
+			wantAsync: true,
+			wantID:    "beacon-id",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			var gotReq *sliverpb.RegisterExtensionReq
+			rpc := &registerExtensionTestRPC{
+				register: func(_ context.Context, req *sliverpb.RegisterExtensionReq, _ ...grpc.CallOption) (*sliverpb.RegisterExtension, error) {
+					gotReq = req
+					return &sliverpb.RegisterExtension{Response: &commonpb.Response{}}, nil
+				},
+			}
+			con := newExtensionTestConsole(t, rpc, test.session, test.beacon)
+
+			err := registerExtension("linux", &ExtCommand{CommandName: "test", Init: initExport}, []byte("extension"), nil, con)
+			if err != nil {
+				t.Fatalf("RegisterExtension returned an error: %s", err)
+			}
+			if gotReq == nil {
+				t.Fatal("RegisterExtension RPC was not called")
+			}
+			if gotReq.Init != initExport {
+				t.Errorf("Expected init export %q, got %q", initExport, gotReq.Init)
+			}
+			if gotReq.Request.GetAsync() != test.wantAsync {
+				t.Errorf("Expected async=%t, got %t", test.wantAsync, gotReq.Request.GetAsync())
+			}
+			if test.wantAsync && gotReq.Request.GetBeaconID() != test.wantID {
+				t.Errorf("Expected beacon ID %q, got %q", test.wantID, gotReq.Request.GetBeaconID())
+			}
+			if !test.wantAsync && gotReq.Request.GetSessionID() != test.wantID {
+				t.Errorf("Expected session ID %q, got %q", test.wantID, gotReq.Request.GetSessionID())
+			}
+		})
+	}
+}
+
+func TestRegisterExtensionWaitsForBeaconRegistration(t *testing.T) {
+	started := make(chan struct{})
+	release := make(chan struct{})
+	rpc := &registerExtensionTestRPC{
+		register: func(_ context.Context, _ *sliverpb.RegisterExtensionReq, _ ...grpc.CallOption) (*sliverpb.RegisterExtension, error) {
+			close(started)
+			<-release
+			return &sliverpb.RegisterExtension{Response: &commonpb.Response{Async: true}}, nil
+		},
+	}
+	con := newExtensionTestConsole(t, rpc, nil, &clientpb.Beacon{ID: "beacon-id"})
+	done := make(chan error, 1)
+	go func() {
+		done <- registerExtension("linux", &ExtCommand{CommandName: "test"}, []byte("extension"), nil, con)
+	}()
+
+	select {
+	case <-started:
+	case <-time.After(time.Second):
+		t.Fatal("Timed out waiting for RegisterExtension RPC")
+	}
+	select {
+	case err := <-done:
+		t.Fatalf("RegisterExtension returned before the beacon registration was enqueued: %v", err)
+	case <-time.After(100 * time.Millisecond):
+	}
+	close(release)
+	select {
+	case err := <-done:
+		if err != nil {
+			t.Fatalf("RegisterExtension returned an error: %s", err)
+		}
+	case <-time.After(time.Second):
+		t.Fatal("Timed out waiting for RegisterExtension to return")
+	}
+}
+
+func TestRegisterExtensionReturnsBeaconRPCError(t *testing.T) {
+	wantErr := errors.New("register failed")
+	rpc := &registerExtensionTestRPC{
+		register: func(_ context.Context, _ *sliverpb.RegisterExtensionReq, _ ...grpc.CallOption) (*sliverpb.RegisterExtension, error) {
+			return nil, wantErr
+		},
+	}
+	con := newExtensionTestConsole(t, rpc, nil, &clientpb.Beacon{ID: "beacon-id"})
+
+	err := registerExtension("linux", &ExtCommand{CommandName: "test"}, []byte("extension"), nil, con)
+	if !errors.Is(err, wantErr) {
+		t.Fatalf("Expected error %q, got %v", wantErr, err)
+	}
+}
+
+func TestRegisterExtensionRejectsNilResponse(t *testing.T) {
+	rpc := &registerExtensionTestRPC{
+		register: func(_ context.Context, _ *sliverpb.RegisterExtensionReq, _ ...grpc.CallOption) (*sliverpb.RegisterExtension, error) {
+			return nil, nil
+		},
+	}
+	con := newExtensionTestConsole(t, rpc, &clientpb.Session{ID: "session-id"}, nil)
+
+	if err := registerExtension("linux", &ExtCommand{CommandName: "test"}, []byte("extension"), nil, con); err == nil {
+		t.Fatal("RegisterExtension accepted a nil response")
+	}
+}
+
+func TestExtensionCommandVisibilityUsesExactTargetPairs(t *testing.T) {
+	extension := &ExtCommand{Files: []*extensionFile{
+		{OS: "windows", Arch: "amd64"},
+		{OS: "linux", Arch: "amd64"},
+		{OS: "darwin", Arch: "arm64"},
+	}}
+
+	tests := []struct {
+		name        string
+		session     *clientpb.Session
+		beacon      *clientpb.Beacon
+		wantVisible bool
+	}{
+		{
+			name:        "cross-platform Linux session",
+			session:     &clientpb.Session{OS: "linux", Arch: "amd64"},
+			wantVisible: true,
+		},
+		{
+			name:        "cross-platform macOS beacon",
+			beacon:      &clientpb.Beacon{OS: "darwin", Arch: "arm64"},
+			wantVisible: true,
+		},
+		{
+			name:        "cross-platform Windows session",
+			session:     &clientpb.Session{OS: "windows", Arch: "amd64"},
+			wantVisible: true,
+		},
+		{
+			name:        "Linux architecture mismatch",
+			session:     &clientpb.Session{OS: "linux", Arch: "arm64"},
+			wantVisible: false,
+		},
+		{
+			name:        "macOS architecture mismatch",
+			beacon:      &clientpb.Beacon{OS: "darwin", Arch: "amd64"},
+			wantVisible: false,
+		},
+		{
+			name:        "Windows architecture mismatch",
+			session:     &clientpb.Session{OS: "windows", Arch: "386"},
+			wantVisible: false,
+		},
+		{
+			name:        "unsupported native extension target",
+			beacon:      &clientpb.Beacon{OS: "linux", Arch: "riscv64"},
+			wantVisible: false,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			con := newExtensionTestConsole(t, nil, test.session, test.beacon)
+			command := &cobra.Command{Annotations: makeCommandPlatformFilters(extension)}
+			activeFilters := con.App.Menu(consts.ImplantMenu).ActiveFiltersFor(command)
+			visible := len(activeFilters) == 0
+			if visible != test.wantVisible {
+				t.Fatalf("command visibility = %t, want %t (active filters: %v)", visible, test.wantVisible, activeFilters)
+			}
+		})
+	}
+}
+
 func TestParseMultipleCmdManifest(t *testing.T) {
 	expectedPath := util.ResolvePath("ex.dll")
 

client/command/extensions/load.go

@@ -221,6 +221,7 @@ func convertOldManifest(old *ExtensionManifest_) *ExtensionManifest {
 				Help:        old.Help,
 				LongHelp:    old.LongHelp,
 				Entrypoint:  old.Entrypoint,
+				Init:        old.Init,
 				Files:       old.Files,
 				Arguments:   old.Arguments,
 				Schema:      nil,
@@ -370,8 +371,12 @@ func ExtensionRegisterCommand(extCmd *ExtCommand, cmd *cobra.Command, con *conso
 		Run: func(cmd *cobra.Command, args []string) {
 			runExtensionCmd(cmd, con, args)
 		},
-		GroupID:     consts.ExtensionHelpGroup,
-		Annotations: makeCommandPlatformFilters(extCmd),
+		GroupID: consts.ExtensionHelpGroup,
+		// DisableFlagParsing keeps the extension's own flags (which are unknown to
+		// pflag) from being silently stripped together with their values. We split
+		// Sliver-owned flags out of the raw slice ourselves in runExtensionCmd (#2309).
+		DisableFlagParsing: true,
+		Annotations:        makeCommandPlatformFilters(extCmd),
 	}
 
 	// Flags
@@ -379,7 +384,6 @@ func ExtensionRegisterCommand(extCmd *ExtCommand, cmd *cobra.Command, con *conso
 	f.BoolP("save", "s", false, "Save output to disk")
 	f.Int64P("timeout", "t", defaultTimeout, "command timeout in seconds")
 	extensionCmd.Flags().AddFlagSet(f)
-	extensionCmd.Flags().ParseErrorsWhitelist.UnknownFlags = true
 
 	// Completions
 	comps := carapace.Gen(extensionCmd)
@@ -468,44 +472,30 @@ func registerExtension(goos string, ext *ExtCommand, binData []byte, cmd *cobra.
 	//set extension name to a hash of the data to avoid loading more than one instance
 	bd := sha256.Sum256(binData)
 	name := hex.EncodeToString(bd[:])
-	sess, beac := con.ActiveTarget.GetInteractive()
+	sess, _ := con.ActiveTarget.GetInteractive()
 	ctrl := make(chan bool)
 	//first time run of an extension will require some waiting depending on the size
 	if sess != nil {
 		msg := fmt.Sprintf("Sending %s to implant ...", ext.CommandName)
 		con.SpinUntil(msg, ctrl)
 	}
-	//don't block if we are in beacon mode
-	if beac != nil && sess == nil {
-		go func() {
-			registerResp, err := con.Rpc.RegisterExtension(context.Background(), &sliverpb.RegisterExtensionReq{
-				Name:    name,
-				Data:    binData,
-				OS:      goos,
-				Init:    ext.Init,
-				Request: con.ActiveTarget.Request(cmd),
-			})
-			if err != nil {
-				con.PrintErrorf("Error registering extension: %s\n", err)
-			}
-			if registerResp.Response != nil && registerResp.Response.Err != "" {
-				con.PrintErrorf("Error registering extension: %s\n", errors.New(registerResp.Response.Err))
-			}
-		}()
-		return nil
-	}
-	//session mode (hopefully)
 	registerResp, err := con.Rpc.RegisterExtension(context.Background(), &sliverpb.RegisterExtensionReq{
 		Name:    name,
 		Data:    binData,
 		OS:      goos,
+		Init:    ext.Init,
 		Request: con.ActiveTarget.Request(cmd),
 	})
-	ctrl <- true
-	<-ctrl
+	if sess != nil {
+		ctrl <- true
+		<-ctrl
+	}
 	if err != nil {
 		return err
 	}
+	if registerResp == nil {
+		return errors.New("received empty register extension response")
+	}
 	if registerResp.Response != nil && registerResp.Response.Err != "" {
 		return errors.New(registerResp.Response.Err)
 	}
@@ -529,6 +519,18 @@ func loadDep(goos string, goarch string, depName string, cmd *cobra.Command, con
 }
 
 func runExtensionCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
+	// The command runs with DisableFlagParsing, so args is the raw, unstripped
+	// slice. Separate Sliver-owned flags from the extension's own arguments and
+	// re-publish them on the flag set (so Request()'s --timeout still works),
+	// then feed only the extension arguments to the BOF/DLL parsers (#2309).
+	save, timeout, helpRequested, extArgs := splitExtensionArgs(args)
+	if helpRequested {
+		_ = cmd.Help()
+		return
+	}
+	applyOwnedFlags(cmd, save, timeout)
+	args = extArgs
+
 	var (
 		err           error
 		extensionArgs []byte
@@ -850,37 +852,22 @@ func makeExtensionFlagNameCompletion(extCmd *ExtCommand) carapace.Action {
 }
 
 func makeCommandPlatformFilters(extCmd *ExtCommand) map[string]string {
-	filtersOS := make(map[string]bool)
-	filtersArch := make(map[string]bool)
-
-	var all []string
-
-	// Only add filters for architectures when there OS matters.
+	supportedTargets := make(map[string]struct{}, len(extCmd.Files))
 	for _, file := range extCmd.Files {
-		filtersOS[file.OS] = true
-
-		if filtersOS[file.OS] {
-			filtersArch[file.Arch] = true
-		}
+		supportedTargets[file.OS+"/"+file.Arch] = struct{}{}
 	}
 
-	for os, enabled := range filtersOS {
-		if enabled {
-			all = append(all, os)
+	// Console command filters are hide-on-match, so annotate the command with
+	// every exact target pair it does not support. A separate fallback hides all
+	// native extensions on target pairs outside the supported loader matrix.
+	filters := []string{consts.NativeExtensionUnsupportedTargetFilter}
+	for _, target := range consts.NativeExtensionTargets() {
+		if _, supported := supportedTargets[target.GOOS+"/"+target.GOARCH]; !supported {
+			filters = append(filters, target.Filter)
 		}
 	}
 
-	for arch, enabled := range filtersArch {
-		if enabled {
-			all = append(all, arch)
-		}
-	}
-
-	if len(all) == 0 {
-		return map[string]string{}
-	}
-
 	return map[string]string{
-		appConsole.CommandFilterKey: strings.Join(all, ","),
+		appConsole.CommandFilterKey: strings.Join(filters, ","),
 	}
 }

client/command/generate/commands.go

@@ -159,7 +159,7 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 		f.StringP("save", "s", "", "directory/file to the binary to")
 		f.String("shellcode-encoder", "", "shellcode encoder to apply (optional; see `shellcode-encoders`)")
 		f.StringP("name", "n", "", "Implant name")
-
+		f.BoolP("external-builder", "E", false, "use an external builder")
 	})
 	flags.BindFlagCompletions(profilesGenerateCmd, func(comp *carapace.ActionMap) {
 		(*comp)["save"] = carapace.ActionFiles().Tag("directory/file to save implant")
@@ -367,7 +367,7 @@ func coreImplantFlags(name string, cmd *cobra.Command) {
 		f.StringP("limit-locale", "L", "", "limit execution to hosts that match this locale")
 		bindSpoofMetadataFlag(f)
 
-		f.StringP("format", "f", "exe", "Specifies the output formats, valid values are: 'exe', 'shared' (for dynamic libraries), 'service' (see: `psexec` for more info) and 'shellcode' (windows, darwin/arm64, linux/amd64, linux/arm64)")
+		f.StringP("format", "f", "exe", "Specifies the output formats, valid values are: 'exe', 'shared' (for dynamic libraries), 'archive' (for Go c-archives), 'service' (see: `psexec` for more info) and 'shellcode' (windows, darwin/arm64, linux/amd64, linux/arm64)")
 
 		// Shellcode generation options:
 		// - Windows: Donut

client/command/generate/commands_test.go

@@ -24,6 +24,30 @@ func TestGenerateSaveFlagCompletionRegistered(t *testing.T) {
 	assertFlagHasDefaultFileCompletion(t, beaconCmd, "save")
 }
 
+func TestProfilesGenerateExternalBuilderFlagRegistered(t *testing.T) {
+	cmds := Commands(&console.SliverClient{})
+
+	profilesCmd := commandByUse(cmds, consts.ProfilesStr)
+	if profilesCmd == nil {
+		t.Fatalf("missing %q command", consts.ProfilesStr)
+	}
+	profilesGenerateCmd := commandByUse(profilesCmd.Commands(), consts.GenerateStr)
+	if profilesGenerateCmd == nil {
+		t.Fatalf("missing %q subcommand under %q", consts.GenerateStr, consts.ProfilesStr)
+	}
+
+	flag := profilesGenerateCmd.Flags().Lookup("external-builder")
+	if flag == nil {
+		t.Fatalf("%q missing %q flag", profilesGenerateCmd.Use, "external-builder")
+	}
+	if flag.Shorthand != "E" {
+		t.Fatalf("%q %q flag shorthand mismatch: got=%q want=%q", profilesGenerateCmd.Use, "external-builder", flag.Shorthand, "E")
+	}
+	if flag.DefValue != "false" {
+		t.Fatalf("%q %q flag default mismatch: got=%q want=%q", profilesGenerateCmd.Use, "external-builder", flag.DefValue, "false")
+	}
+}
+
 func assertFlagHasDefaultFileCompletion(t *testing.T, cmd *cobra.Command, flag string) {
 	t.Helper()
 

client/command/generate/generate.go

@@ -87,6 +87,7 @@ var (
 		"linux/arm64":   true,
 		"windows/386":   true,
 		"windows/amd64": true,
+		"windows/arm64": true,
 	}
 
 	ErrNoExternalBuilder = errors.New("no external builders are available")
@@ -254,6 +255,8 @@ func nameOfOutputFormat(value clientpb.OutputFormat) string {
 		return "Service"
 	case clientpb.OutputFormat_SHARED_LIB:
 		return "Shared Library"
+	case clientpb.OutputFormat_GO_ARCHIVE:
+		return "Go Archive"
 	case clientpb.OutputFormat_SHELLCODE:
 		return "Shellcode"
 	default:
@@ -389,6 +392,9 @@ func parseCompileFlags(cmd *cobra.Command, con *console.SliverClient) (string, *
 		configFormat = clientpb.OutputFormat_SHARED_LIB
 		isSharedLib = true
 		runAtLoad, _ = cmd.Flags().GetBool("run-at-load")
+	case "archive":
+		configFormat = clientpb.OutputFormat_GO_ARCHIVE
+		isSharedLib = true
 	case "shellcode":
 		configFormat = clientpb.OutputFormat_SHELLCODE
 		isShellcode = true

client/command/generate/helpers.go

@@ -197,7 +197,7 @@ func OSCompleter(con *console.SliverClient) carapace.Action {
 func FormatCompleter() carapace.Action {
 	return carapace.ActionCallback(func(_ carapace.Context) carapace.Action {
 		return carapace.ActionValues([]string{
-			"exe", "shared", "service", "shellcode",
+			"exe", "shared", "archive", "service", "shellcode",
 		}...).Tag("implant format")
 	})
 }

client/command/generate/output_format_test.go

@@ -0,0 +1,13 @@
+package generate
+
+import (
+	"testing"
+
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+)
+
+func TestNameOfOutputFormatGoArchive(t *testing.T) {
+	if got := nameOfOutputFormat(clientpb.OutputFormat_GO_ARCHIVE); got != "Go Archive" {
+		t.Fatalf("nameOfOutputFormat(GO_ARCHIVE) = %q, want %q", got, "Go Archive")
+	}
+}

client/command/generate/profiles-generate.go

@@ -19,6 +19,7 @@ package generate
 */
 
 import (
+	"fmt"
 	"os"
 	"strings"
 
@@ -81,9 +82,27 @@ func ProfilesGenerateCmd(cmd *cobra.Command, con *console.SliverClient, args []s
 				profile.Config.SGNEnabled = encoder == clientpb.ShellcodeEncoder_SHIKATA_GA_NAI
 			}
 		}
-		_, err := compile(implantName, profile.Config, nil, save, con)
-		if err != nil {
-			return
+		if external, _ := cmd.Flags().GetBool("external-builder"); !external {
+			_, err := compile(implantName, profile.Config, nil, save, con)
+			if err != nil {
+				return
+			}
+		} else {
+			_, err := externalBuild(implantName, profile.Config, nil, save, con)
+			if err != nil {
+				switch err {
+				case ErrNoExternalBuilder:
+					con.PrintErrorf("There are no external builders currently connected to the server\n")
+					con.PrintErrorf("See 'builders' command for more information\n")
+				case ErrNoValidBuilders:
+					con.PrintErrorf("There are external builders connected to the server, but none can build the target you specified\n")
+					con.PrintErrorf("Invalid target %s\n", fmt.Sprintf("%s:%s/%s", profile.Config.Format, profile.Config.GOOS, profile.Config.GOARCH))
+					con.PrintErrorf("See 'builders' command for more information\n")
+				default:
+					con.PrintErrorf("%s\n", err)
+				}
+				return
+			}
 		}
 	} else {
 		con.PrintErrorf("No profile with name '%s'", name)

client/command/generate/profiles.go

@@ -263,6 +263,8 @@ func populateProfileProperties(config *clientpb.ImplantConfig) map[string]string
 		properties["format"] = "Executable"
 	case clientpb.OutputFormat_SHARED_LIB:
 		properties["format"] = "Shared Library"
+	case clientpb.OutputFormat_GO_ARCHIVE:
+		properties["format"] = "Go Archive"
 	case clientpb.OutputFormat_SERVICE:
 		properties["format"] = "Service"
 	case clientpb.OutputFormat_SHELLCODE:

client/command/mcp/commands.go

@@ -38,6 +38,7 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 		f.String("listen", defaultConfig.ListenAddress, "listen address for the MCP server")
 		f.String("name", defaultConfig.ServerName, "server name for MCP initialize")
 		f.String("version", defaultConfig.ServerVersion, "server version for MCP initialize")
+		f.BoolP("yes", "y", false, "skip the prompt-injection confirmation (broken or non-interactive terminals)")
 	})
 	flags.BindFlagCompletions(startCmd, func(comp *carapace.ActionMap) {
 		(*comp)["transport"] = carapace.ActionValues("http", "sse")

client/command/mcp/mcp.go

@@ -32,6 +32,9 @@ func McpCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
 	if status.AuthToken != "" {
 		con.Printf("Auth Token: %s\n", status.AuthToken)
 	}
+	if status.AuthConfigPath != "" {
+		con.Printf("Auth Config: %s\n", status.AuthConfigPath)
+	}
 
 	if status.Running && !status.StartedAt.IsZero() {
 		uptime := time.Since(status.StartedAt).Truncate(time.Second)

client/command/mcp/start.go

@@ -28,8 +28,10 @@ func McpStartCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
 	}.WithDefaults()
 
 	msg := `Do you know what prompt injection is and are you an adult?`
-	if !settings.IsUserAnAdultWithPrompt(con, msg) {
+	skipConfirm, _ := cmd.Flags().GetBool("yes")
+	if !skipConfirm && !settings.IsUserAnAdultWithPrompt(con, msg) {
 		con.PrintErrorf("Failed to start MCP server, the user is not qualified to use feature\n")
+		con.PrintInfof("Use --yes to skip the confirmation prompt, or toggle it with 'settings autoadult'\n")
 		return
 	}
 
@@ -50,4 +52,7 @@ func McpStartCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
 	if status.AuthToken != "" {
 		con.PrintInfof("Auth Token: %s\n", status.AuthToken)
 	}
+	if status.AuthConfigPath != "" {
+		con.PrintInfof("Auth Config: %s\n", status.AuthConfigPath)
+	}
 }

client/command/settings/opsec.go

@@ -50,7 +50,12 @@ func IsUserAnAdultWithPrompt(con *console.SliverClient, prompt string) bool {
 		return true
 	}
 	confirm := false
-	_ = forms.Confirm(prompt, &confirm)
+	if err := forms.Confirm(prompt, &confirm); err != nil {
+		// The interactive form is known to fail on some terminals (#2133);
+		// surface the error instead of silently treating it as a rejection.
+		con.PrintErrorf("Confirmation prompt failed: %s\n", err)
+		return false
+	}
 	return confirm
 }
 

client/console/console.go

@@ -1147,6 +1147,7 @@ func (con *SliverClient) ExposeCommands() {
 	case con.ActiveTarget.session != nil:
 		session := con.ActiveTarget.session
 		filters = append(filters, consts.BeaconCmdsFilter)
+		filters = append(filters, consts.NativeExtensionTargetFilter(session.OS, session.Arch))
 
 		// Operating system
 		if session.OS != "windows" {
@@ -1161,6 +1162,7 @@ func (con *SliverClient) ExposeCommands() {
 	case con.ActiveTarget.beacon != nil:
 		beacon := con.ActiveTarget.beacon
 		filters = append(filters, consts.SessionCmdsFilter)
+		filters = append(filters, consts.NativeExtensionTargetFilter(beacon.OS, beacon.Arch))
 
 		// Operating system
 		if beacon.OS != "windows" {

client/constants/constants.go

@@ -363,8 +363,53 @@ const (
 	BeaconCmdsFilter    = "beacon"
 	WindowsCmdsFilter   = "windows"
 	WireguardCmdsFilter = "wireguard"
+
+	NativeExtensionUnsupportedTargetFilter = "native-extension:unsupported"
+	NativeExtensionDarwinAMD64Filter       = "native-extension:darwin/amd64"
+	NativeExtensionDarwinARM64Filter       = "native-extension:darwin/arm64"
+	NativeExtensionLinux386Filter          = "native-extension:linux/386"
+	NativeExtensionLinuxAMD64Filter        = "native-extension:linux/amd64"
+	NativeExtensionLinuxARM64Filter        = "native-extension:linux/arm64"
+	NativeExtensionWindows386Filter        = "native-extension:windows/386"
+	NativeExtensionWindowsAMD64Filter      = "native-extension:windows/amd64"
+	NativeExtensionWindowsARM64Filter      = "native-extension:windows/arm64"
 )
 
+// NativeExtensionTarget identifies a GOOS/GOARCH pair supported by native
+// implant extensions and the command filter associated with that exact pair.
+type NativeExtensionTarget struct {
+	GOOS   string
+	GOARCH string
+	Filter string
+}
+
+var nativeExtensionTargets = [8]NativeExtensionTarget{
+	{GOOS: "darwin", GOARCH: "amd64", Filter: NativeExtensionDarwinAMD64Filter},
+	{GOOS: "darwin", GOARCH: "arm64", Filter: NativeExtensionDarwinARM64Filter},
+	{GOOS: "linux", GOARCH: "386", Filter: NativeExtensionLinux386Filter},
+	{GOOS: "linux", GOARCH: "amd64", Filter: NativeExtensionLinuxAMD64Filter},
+	{GOOS: "linux", GOARCH: "arm64", Filter: NativeExtensionLinuxARM64Filter},
+	{GOOS: "windows", GOARCH: "386", Filter: NativeExtensionWindows386Filter},
+	{GOOS: "windows", GOARCH: "amd64", Filter: NativeExtensionWindowsAMD64Filter},
+	{GOOS: "windows", GOARCH: "arm64", Filter: NativeExtensionWindowsARM64Filter},
+}
+
+// NativeExtensionTargets returns the supported native extension target matrix.
+func NativeExtensionTargets() [8]NativeExtensionTarget {
+	return nativeExtensionTargets
+}
+
+// NativeExtensionTargetFilter returns the filter for an exact supported target.
+// Unsupported pairs share a filter that hides all native extension commands.
+func NativeExtensionTargetFilter(goos string, goarch string) string {
+	for _, target := range nativeExtensionTargets {
+		if target.GOOS == goos && target.GOARCH == goarch {
+			return target.Filter
+		}
+	}
+	return NativeExtensionUnsupportedTargetFilter
+}
+
 // Creds (needed here to avoid recursive imports).
 const (
 	UserColonHashNewlineFormat = "user:hash" // username:hash\n

client/forms/generate_profiles_new.go

@@ -79,6 +79,7 @@ func GenerateProfilesNewForm() (*GenerateProfilesNewFormResult, error) {
 					options := []huh.Option[string]{
 						huh.NewOption("Executable", "exe"),
 						huh.NewOption("Shared library", "shared"),
+						huh.NewOption("Go archive", "archive"),
 					}
 					if result.OS == "windows" {
 						options = append(options,

client/forms/generate_profiles_new_beacon.go

@@ -84,6 +84,7 @@ func GenerateProfilesNewBeaconForm() (*GenerateProfilesNewBeaconFormResult, erro
 					options := []huh.Option[string]{
 						huh.NewOption("Executable", "exe"),
 						huh.NewOption("Shared library", "shared"),
+						huh.NewOption("Go archive", "archive"),
 					}
 					if result.OS == "windows" {
 						options = append(options,

client/forms/generate_targets.go

@@ -22,6 +22,7 @@ type targetOptionBindings struct {
 var formatOptionOrder = []formatOption{
 	{format: clientpb.OutputFormat_EXECUTABLE, label: "Executable", value: "exe"},
 	{format: clientpb.OutputFormat_SHARED_LIB, label: "Shared library", value: "shared"},
+	{format: clientpb.OutputFormat_GO_ARCHIVE, label: "Go archive", value: "archive"},
 	{format: clientpb.OutputFormat_SERVICE, label: "Service", value: "service"},
 	{format: clientpb.OutputFormat_SHELLCODE, label: "Shellcode", value: "shellcode"},
 }
@@ -59,6 +60,7 @@ func commonFormatOptions(goos string) []huh.Option[string] {
 	options := []huh.Option[string]{
 		huh.NewOption("Executable", "exe"),
 		huh.NewOption("Shared library", "shared"),
+		huh.NewOption("Go archive", "archive"),
 	}
 	if goos == "windows" {
 		options = append(options,

docs/sliver-docs/components/asciinema.tsx

@@ -3,6 +3,8 @@ import React from "react";
 
 type AsciinemaPlayerProps = {
   src: string;
+  className?: string;
+  hideControls?: boolean;
 
   cols?: string;
   rows?: string;
@@ -18,10 +20,67 @@ type AsciinemaPlayerProps = {
   fontSize?: string;
 };
 
-function AsciinemaPlayer({ src, ...asciinemaOptions }: AsciinemaPlayerProps) {
+function AsciinemaPlayer({
+  src,
+  className,
+  hideControls,
+  cols,
+  rows,
+  autoPlay,
+  preload,
+  loop,
+  startAt,
+  speed,
+  idleTimeLimit,
+  theme,
+  poster,
+  fit,
+  fontSize,
+}: AsciinemaPlayerProps) {
   const ref = React.useRef<HTMLDivElement>(null);
+  const [prefersReducedMotion, setPrefersReducedMotion] = React.useState(false);
   const [player, setPlayer] =
     React.useState<typeof import("asciinema-player")>();
+  const asciinemaOptions = React.useMemo(
+    () => ({
+      autoPlay: prefersReducedMotion ? false : autoPlay,
+      cols,
+      controls: hideControls ? false : undefined,
+      fit,
+      fontSize,
+      idleTimeLimit,
+      loop: prefersReducedMotion ? false : loop,
+      poster,
+      preload,
+      rows,
+      speed,
+      startAt,
+      theme,
+    }),
+    [
+      autoPlay,
+      cols,
+      fit,
+      fontSize,
+      hideControls,
+      idleTimeLimit,
+      loop,
+      poster,
+      preload,
+      prefersReducedMotion,
+      rows,
+      speed,
+      startAt,
+      theme,
+    ],
+  );
+  React.useEffect(() => {
+    const mediaQuery = window.matchMedia("(prefers-reduced-motion: reduce)");
+    const syncPreference = () => setPrefersReducedMotion(mediaQuery.matches);
+    syncPreference();
+    mediaQuery.addEventListener("change", syncPreference);
+    return () => mediaQuery.removeEventListener("change", syncPreference);
+  }, []);
   React.useEffect(() => {
     import("asciinema-player").then((p) => {
       setPlayer(p);
@@ -35,7 +94,17 @@ function AsciinemaPlayer({ src, ...asciinemaOptions }: AsciinemaPlayerProps) {
     };
   }, [src, player, asciinemaOptions]);
 
-  return <div ref={ref} />;
+  return (
+    <div
+      ref={ref}
+      className={[
+        className,
+        hideControls ? "sliver-asciinema-controls-hidden" : undefined,
+      ]
+        .filter(Boolean)
+        .join(" ")}
+    />
+  );
 }
 
 export default AsciinemaPlayer;

docs/sliver-docs/components/code.tsx

@@ -60,11 +60,8 @@ const CodeViewer = (props: CodeViewerProps) => {
     props.script.source_code
   );
   const [fontSize, setFontSize] = React.useState(props.fontSize || 13);
-  const editorContainerClassName = React.useMemo(() => {
-    return theme === Themes.DARK
-      ? "col-span-12 mt-4 rounded-2xl overflow-hidden"
-      : "col-span-12 mt-4 rounded-2xl overflow-hidden border border-gray-300";
-  }, [theme]);
+  const editorContainerClassName =
+    "col-span-12 mt-4 overflow-hidden rounded-2xl border border-separator bg-surface-secondary";
 
   return (
     <div className={editorContainerClassName}>

docs/sliver-docs/components/loading-state.tsx

@@ -3,9 +3,9 @@ import React from "react";
 
 const LoadingState: React.FC = () => {
   return (
-    <div className="flex min-h-screen w-full items-center justify-center gap-3 text-foreground">
+    <div className="flex min-h-[55vh] w-full items-center justify-center gap-3 text-muted">
       <Spinner aria-label="Loading" />
-      <span>Loading...</span>
+      <span className="text-sm">Loading documentation…</span>
     </div>
   );
 };

docs/sliver-docs/components/markdown.tsx

@@ -27,6 +27,7 @@ import Youtube from "./youtube";
 
 export type MarkdownProps = {
   markdown: string;
+  demoteTopLevelHeading?: boolean;
 };
 
 type MarkdownAsciiCast = {
@@ -121,12 +122,12 @@ const slugify = (value: string) => {
 };
 
 const headingClassNames: Record<HeadingLevel, string> = {
-  1: "mt-12 text-3xl font-semibold tracking-tight text-slate-900 first:mt-0 dark:text-slate-100",
-  2: "mt-10 text-2xl font-semibold tracking-tight text-slate-900 dark:text-slate-100",
-  3: "mt-8 text-xl font-semibold tracking-tight text-slate-900 dark:text-slate-100",
-  4: "mt-6 text-lg font-semibold tracking-tight text-slate-900 dark:text-slate-100",
-  5: "mt-6 text-base font-semibold tracking-tight text-slate-900 dark:text-slate-100",
-  6: "mt-6 text-base font-semibold uppercase tracking-wide text-slate-700 dark:text-slate-300",
+  1: "mt-12 text-3xl font-semibold tracking-tight text-foreground first:mt-0",
+  2: "mt-12 text-2xl font-semibold tracking-tight text-foreground",
+  3: "mt-9 text-xl font-semibold tracking-tight text-foreground",
+  4: "mt-8 text-lg font-semibold tracking-tight text-foreground",
+  5: "mt-7 text-base font-semibold tracking-tight text-foreground",
+  6: "mt-7 text-base font-semibold tracking-tight text-foreground",
 };
 
 const MarkdownViewer = (props: MarkdownProps) => {
@@ -218,7 +219,9 @@ const MarkdownViewer = (props: MarkdownProps) => {
         }
 
         const anchor = anchorRef.current;
-        const HeadingTag = `h${level}`;
+        const renderedLevel =
+          level === 1 && props.demoteTopLevelHeading ? 2 : level;
+        const HeadingTag = `h${renderedLevel}`;
 
         return createElement(
           HeadingTag,
@@ -226,7 +229,7 @@ const MarkdownViewer = (props: MarkdownProps) => {
             ...rest,
             id: anchor || undefined,
             className: mergeClassNames(
-              headingClassNames[level],
+              headingClassNames[renderedLevel],
               "scroll-mt-[70px]",
               className
             ),
@@ -236,8 +239,8 @@ const MarkdownViewer = (props: MarkdownProps) => {
             {anchor && (
               <a
                 href={`#${anchor}`}
-                aria-label="Copy link to section"
-                className="inline-flex h-6 w-6 items-center justify-center rounded-md text-slate-400 transition focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-primary/40 focus-visible:ring-offset-2 hover:text-primary dark:text-slate-500"
+                aria-label={`Link to ${textContent}`}
+                className="-my-2 inline-flex size-10 items-center justify-center rounded-xl text-muted focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent/40 hover:bg-surface-secondary hover:text-accent"
               >
                 <svg
                   aria-hidden="true"
@@ -283,12 +286,12 @@ const MarkdownViewer = (props: MarkdownProps) => {
       h5: createHeadingComponent(5),
       h6: createHeadingComponent(6),
     };
-  }, [getAnchor]);
+  }, [getAnchor, props.demoteTopLevelHeading]);
 
   const proseClassName = mergeClassNames(
     "markdown-body prose max-w-none leading-7",
     theme === Themes.DARK ? "dark:prose-invert prose-slate" : "prose-slate",
-    "prose-pre:bg-slate-950/90 prose-pre:text-slate-100 prose-code:font-mono prose-img:rounded-xl"
+    "prose-code:font-mono prose-img:rounded-2xl"
   );
 
   return (
@@ -307,7 +310,7 @@ const MarkdownViewer = (props: MarkdownProps) => {
                   {...rest}
                   href={href}
                   className={mergeClassNames(
-                    "font-medium text-primary transition-colors duration-150 hover:text-primary-dark",
+                    "font-medium text-accent underline-offset-4 hover:underline",
                     className
                   )}
                   onClick={(e) => {
@@ -342,7 +345,7 @@ const MarkdownViewer = (props: MarkdownProps) => {
             }
 
             const anchorClassName = mergeClassNames(
-              "font-medium text-primary transition-colors duration-150 underline-offset-4 hover:text-primary-dark",
+              "font-medium text-accent underline-offset-4 hover:underline",
               className
             );
 
@@ -376,7 +379,7 @@ const MarkdownViewer = (props: MarkdownProps) => {
               <p
                 {...rest}
                 className={mergeClassNames(
-                  "my-6 text-base leading-7 text-slate-700 dark:text-slate-300",
+                  "my-6 text-base leading-7 text-foreground/80",
                   className
                 )}
               >
@@ -391,7 +394,7 @@ const MarkdownViewer = (props: MarkdownProps) => {
               <ul
                 {...rest}
                 className={mergeClassNames(
-                  "my-6 list-disc space-y-2 pl-6 text-slate-700 marker:text-primary dark:text-slate-300",
+                  "my-6 list-disc space-y-2 pl-6 text-foreground/80 marker:text-accent",
                   className
                 )}
               >
@@ -406,7 +409,7 @@ const MarkdownViewer = (props: MarkdownProps) => {
               <ol
                 {...rest}
                 className={mergeClassNames(
-                  "my-6 list-decimal space-y-2 pl-6 text-slate-700 marker:text-primary dark:text-slate-300",
+                  "my-6 list-decimal space-y-2 pl-6 text-foreground/80 marker:text-accent",
                   className
                 )}
               >
@@ -421,7 +424,7 @@ const MarkdownViewer = (props: MarkdownProps) => {
               <li
                 {...rest}
                 className={mergeClassNames(
-                  "leading-6 text-slate-700 dark:text-slate-300",
+                  "leading-6 text-foreground/80",
                   className
                 )}
               >
@@ -436,7 +439,7 @@ const MarkdownViewer = (props: MarkdownProps) => {
               <blockquote
                 {...rest}
                 className={mergeClassNames(
-                  "my-8 border-l-4 border-slate-200 bg-slate-50 px-6 py-4 text-base italic text-slate-700 shadow-sm dark:border-slate-700 dark:bg-slate-900/50 dark:text-slate-300",
+                  "my-8 rounded-r-2xl border-l-4 border-accent/40 bg-surface-secondary px-6 py-4 text-base italic text-foreground/80",
                   className
                 )}
               >
@@ -451,7 +454,7 @@ const MarkdownViewer = (props: MarkdownProps) => {
               <hr
                 {...rest}
                 className={mergeClassNames(
-                  "my-12 border-t border-slate-200 dark:border-slate-800",
+                  "my-12 border-t border-separator",
                   className
                 )}
               />
@@ -461,11 +464,11 @@ const MarkdownViewer = (props: MarkdownProps) => {
           table(tableProps) {
             const { className, children, ...rest } = tableProps;
             return (
-              <div className="my-8 overflow-hidden rounded-xl border border-slate-200 bg-white shadow-sm dark:border-slate-800 dark:bg-slate-950/40">
+              <div className="sliver-scrollbar my-8 overflow-x-auto rounded-2xl border border-separator bg-surface">
                 <table
                   {...rest}
                   className={mergeClassNames(
-                    "w-full min-w-max divide-y divide-slate-200 text-left text-sm dark:divide-slate-800",
+                    "w-full min-w-max divide-y divide-separator text-left text-sm",
                     className
                   )}
                 >
@@ -481,7 +484,7 @@ const MarkdownViewer = (props: MarkdownProps) => {
               <thead
                 {...rest}
                 className={mergeClassNames(
-                  "bg-slate-50 text-sm font-semibold uppercase tracking-wide text-slate-600 dark:bg-slate-900/60 dark:text-slate-300",
+                  "bg-surface-secondary text-sm font-semibold text-muted",
                   className
                 )}
               >
@@ -496,7 +499,7 @@ const MarkdownViewer = (props: MarkdownProps) => {
               <tbody
                 {...rest}
                 className={mergeClassNames(
-                  "divide-y divide-slate-200 dark:divide-slate-800",
+                  "divide-y divide-separator",
                   className
                 )}
               >
@@ -511,7 +514,7 @@ const MarkdownViewer = (props: MarkdownProps) => {
               <tr
                 {...rest}
                 className={mergeClassNames(
-                  "transition-colors hover:bg-slate-50 dark:hover:bg-slate-900/60",
+                  "bg-transparent",
                   className
                 )}
               >
@@ -526,7 +529,7 @@ const MarkdownViewer = (props: MarkdownProps) => {
               <th
                 {...rest}
                 className={mergeClassNames(
-                  "px-4 py-3 text-left text-sm font-semibold text-slate-600 dark:text-slate-200",
+                  "px-4 py-3 text-left text-sm font-semibold text-foreground",
                   className
                 )}
               >
@@ -541,7 +544,7 @@ const MarkdownViewer = (props: MarkdownProps) => {
               <td
                 {...rest}
                 className={mergeClassNames(
-                  "px-4 py-3 align-top text-sm text-slate-700 dark:text-slate-300",
+                  "px-4 py-3 align-top text-sm text-foreground/80",
                   className
                 )}
               >
@@ -556,7 +559,7 @@ const MarkdownViewer = (props: MarkdownProps) => {
               <strong
                 {...rest}
                 className={mergeClassNames(
-                  "font-semibold text-slate-900 dark:text-slate-100",
+                  "font-semibold text-foreground",
                   className
                 )}
               >
@@ -571,7 +574,7 @@ const MarkdownViewer = (props: MarkdownProps) => {
               <em
                 {...rest}
                 className={mergeClassNames(
-                  "text-slate-700 dark:text-slate-300",
+                  "text-foreground/80",
                   className
                 )}
               >
@@ -605,7 +608,7 @@ const MarkdownViewer = (props: MarkdownProps) => {
               <pre
                 {...rest}
                 className={mergeClassNames(
-                  "my-6 overflow-x-auto rounded-xl border border-slate-200 bg-slate-50 p-4 text-[13px] leading-6 text-slate-900 shadow-inner dark:border-slate-800 dark:bg-slate-950/90 dark:text-slate-100",
+                  "sliver-scrollbar my-6 overflow-x-auto rounded-2xl border border-separator bg-surface-secondary p-4 text-[13px] leading-6 text-foreground",
                   className
                 )}
               >
@@ -625,7 +628,7 @@ const MarkdownViewer = (props: MarkdownProps) => {
                 width={1200}
                 height={720}
                 className={mergeClassNames(
-                  "my-8 w-full rounded-xl border border-slate-200 object-contain shadow-sm dark:border-slate-800",
+                  "my-8 w-full rounded-2xl border border-separator/70 object-contain",
                   className
                 )}
               />
@@ -655,7 +658,11 @@ const MarkdownViewer = (props: MarkdownProps) => {
 
             if (normalizedLang === "youtube") {
               const embedId = sourceCode || "";
-              return <Youtube embedId={embedId.trim()} />;
+              return (
+                <div className="not-prose my-8 overflow-hidden rounded-2xl">
+                  <Youtube embedId={embedId.trim()} />
+                </div>
+              );
             }
 
             if (normalizedLang === "asciinema") {
@@ -668,15 +675,18 @@ const MarkdownViewer = (props: MarkdownProps) => {
                 return <></>;
               }
               return (
-                <AsciinemaPlayer
-                  src={srcUrl.toString()}
-                  rows={asciiCast.rows || "18"}
-                  cols={asciiCast.cols || "75"}
-                  idleTimeLimit={asciiCast.idleTimeLimit || 2}
-                  preload={true}
-                  autoPlay={true}
-                  loop={true}
-                />
+                <div className="sliver-terminal-frame not-prose my-8 w-full max-w-full overflow-x-auto rounded-2xl bg-[#111315]">
+                  <AsciinemaPlayer
+                    className="min-w-[42rem]"
+                    src={srcUrl.toString()}
+                    rows={asciiCast.rows || "18"}
+                    cols={asciiCast.cols || "75"}
+                    idleTimeLimit={asciiCast.idleTimeLimit || 2}
+                    preload={true}
+                    autoPlay={true}
+                    loop={true}
+                  />
+                </div>
               );
             }
 
@@ -694,7 +704,7 @@ const MarkdownViewer = (props: MarkdownProps) => {
                 <code
                   {...rest}
                   className={mergeClassNames(
-                    "rounded-md bg-slate-100 px-1.5 py-0.5 font-mono text-[13px] text-slate-700 dark:bg-slate-800/80 dark:text-slate-200",
+                    "rounded-md bg-surface-secondary px-1.5 py-0.5 font-mono text-[13px] text-foreground",
                     className
                   )}
                 >
@@ -752,7 +762,7 @@ const MarkdownViewer = (props: MarkdownProps) => {
             const formattedSourceCode = sourceCode.replace(/\n$/, "");
 
             const preWrapperClassName = mergeClassNames(
-              "not-prose mt-4 overflow-x-auto rounded-2xl border border-slate-200 bg-slate-50 px-4 py-4 text-[13px] leading-6 text-slate-900 shadow-sm dark:border-slate-800 dark:bg-slate-950/90 dark:text-slate-100",
+              "sliver-scrollbar not-prose mt-4 overflow-x-auto rounded-2xl border border-separator bg-surface-secondary px-4 py-4 text-[13px] leading-6 text-foreground",
               className
             );
 

docs/sliver-docs/components/mermaid.tsx

@@ -115,7 +115,7 @@ const Mermaid = ({ diagram, minHeight }: MermaidProps) => {
 
   if (error) {
     return (
-      <div className="not-prose my-6 text-sm text-rose-700 dark:text-rose-300">
+      <div className="not-prose my-6 rounded-2xl bg-danger-soft p-4 text-sm text-danger-soft-foreground">
         Failed to render Mermaid diagram: {error}
       </div>
     );

docs/sliver-docs/components/navbar.tsx

@@ -5,24 +5,28 @@ import { Themes } from "@/util/themes";
 import { faDiscord, faGithub } from "@fortawesome/free-brands-svg-icons";
 import {
   faBars,
-  faHome,
   faMoon,
   faSearch,
   faSun,
   faXmark,
 } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-import { Button, SearchField, Tooltip } from "@heroui/react";
+import { Button, Drawer, SearchField, Tooltip } from "@heroui/react";
 import { useTheme } from "next-themes";
+import NextLink from "next/link";
 import { useRouter } from "next/router";
 import React from "react";
 
 const routes = [
+  { href: "/docs", label: "Docs" },
   { href: "/tutorials", label: "Tutorials" },
   { href: "/talks", label: "Talks" },
-  { href: "/docs", label: "Docs" },
 ];
 
+const discordUrl =
+  "https://discord.com/channels/791066041198968873/1339996286514106409";
+const githubUrl = "https://github.com/BishopFox/sliver";
+
 export default function TopNavbar() {
   const router = useRouter();
   const { theme, setTheme } = useTheme();
@@ -30,9 +34,28 @@ export default function TopNavbar() {
   const [isMobileMenuOpen, setIsMobileMenuOpen] = React.useState(false);
 
   const activeTheme = theme || Themes.DARK;
-  const lightDarkModeIcon = React.useMemo(() => {
-    return activeTheme === Themes.DARK ? faSun : faMoon;
-  }, [activeTheme]);
+  const isDarkTheme = activeTheme === Themes.DARK;
+  const lightDarkModeIcon = isDarkTheme ? faSun : faMoon;
+  const themeToggleLabel = isDarkTheme
+    ? "Switch to light mode"
+    : "Switch to dark mode";
+
+  const toggleTheme = React.useCallback(() => {
+    setTheme(isDarkTheme ? Themes.LIGHT : Themes.DARK);
+  }, [isDarkTheme, setTheme]);
+
+  React.useEffect(() => {
+    const desktopBreakpoint = window.matchMedia("(min-width: 768px)");
+    const closeMobileMenu = (event: MediaQueryListEvent) => {
+      if (event.matches) {
+        setIsMobileMenuOpen(false);
+      }
+    };
+
+    desktopBreakpoint.addEventListener("change", closeMobileMenu);
+    return () =>
+      desktopBreakpoint.removeEventListener("change", closeMobileMenu);
+  }, []);
 
   const handleSearchSubmit = React.useCallback(
     (value = query) => {
@@ -41,7 +64,11 @@ export default function TopNavbar() {
       if (searchQuery.length === 0) {
         return;
       }
-      router.push({ pathname: "/search/", query: { search: searchQuery } });
+
+      void router.push({
+        pathname: "/search/",
+        query: { search: searchQuery },
+      });
       setQuery("");
       setIsMobileMenuOpen(false);
     },
@@ -58,12 +85,13 @@ export default function TopNavbar() {
     [],
   );
 
-  const renderSearchInput = (wrapperClassName?: string) => (
+  const renderSearchInput = (className?: string) => (
     <SearchField
       aria-label="Search documentation"
-      className={wrapperClassName}
+      className={className}
       fullWidth
       value={query}
+      variant="secondary"
       onChange={setQuery}
       onSubmit={handleSearchSubmit}
     >
@@ -71,8 +99,10 @@ export default function TopNavbar() {
         <SearchField.SearchIcon>
           <FontAwesomeIcon icon={faSearch} />
         </SearchField.SearchIcon>
-        <SearchField.Input placeholder="Search..." />
-        {query.length > 0 ? <SearchField.ClearButton aria-label="Clear search" /> : null}
+        <SearchField.Input placeholder="Search documentation…" />
+        {query.length > 0 ? (
+          <SearchField.ClearButton aria-label="Clear search" />
+        ) : null}
       </SearchField.Group>
     </SearchField>
   );
@@ -82,82 +112,80 @@ export default function TopNavbar() {
 
     return (
       <li key={href}>
-        <Button
-          variant={isActive ? "secondary" : "ghost"}
-          onPress={() => router.push(href)}
+        <NextLink
+          href={href}
+          aria-current={isActive ? "page" : undefined}
+          className={`inline-flex h-10 items-center justify-center rounded-xl px-4 text-sm font-medium no-underline outline-none focus-visible:ring-2 focus-visible:ring-accent/40 ${
+            isActive
+              ? "bg-surface-secondary text-foreground shadow-surface"
+              : "text-muted hover:bg-surface-secondary hover:text-foreground"
+          }`}
         >
           {label}
-        </Button>
+        </NextLink>
       </li>
     );
   };
 
   const renderMobileRoute = (href: string, label: string) => {
-    const isActive = href === "/" ? router.pathname === "/" : router.pathname.startsWith(href);
+    const isActive =
+      href === "/"
+        ? router.pathname === "/"
+        : router.pathname.startsWith(href);
 
     return (
-      <Button
+      <NextLink
         key={href}
-        fullWidth
-        variant={isActive ? "primary" : "ghost"}
-        onPress={() => {
-          router.push(href);
-          setIsMobileMenuOpen(false);
-        }}
+        href={href}
+        aria-current={isActive ? "page" : undefined}
+        className={`inline-flex min-h-10 w-full items-center rounded-xl px-3 py-2 text-sm font-medium no-underline outline-none focus-visible:ring-2 focus-visible:ring-accent/40 ${
+          isActive
+            ? "bg-surface-secondary text-foreground shadow-surface"
+            : "text-muted hover:bg-surface-secondary hover:text-foreground"
+        }`}
+        onClick={() => setIsMobileMenuOpen(false)}
       >
-        {href === "/" ? <FontAwesomeIcon fixedWidth icon={faHome} /> : null}
         {label}
-      </Button>
+      </NextLink>
     );
   };
 
   return (
     <>
-      <nav className="sliver-navbar-glass sticky top-0 z-40 px-4 shadow-sm md:px-6">
-        <div className="flex h-16 items-center gap-4">
-          <button
-            type="button"
-            className="flex items-center gap-2 text-foreground"
-            onClick={() => {
-              router.push("/");
-              setIsMobileMenuOpen(false);
-            }}
-            aria-label="Sliver C2 home"
+      <nav
+        aria-label="Primary navigation"
+        className="sticky top-0 z-40 h-16 border-b border-separator bg-background/85 backdrop-blur-xl"
+      >
+        <div className="mx-auto flex h-16 w-full max-w-[1440px] items-center gap-3 px-4 sm:px-6 lg:px-8">
+          <NextLink
+            href="/"
+            aria-label="Sliver documentation home"
+            className="-ml-2 inline-flex h-10 shrink-0 items-center gap-2 rounded-xl px-2 text-sm font-semibold text-foreground no-underline outline-none hover:bg-surface-secondary focus-visible:ring-2 focus-visible:ring-accent/40"
           >
-            <SliversIcon />
-            <span className="hidden font-bold text-inherit sm:block">
-              Sliver C2
+            <span className="flex size-8 items-center justify-center rounded-xl bg-accent text-accent-foreground">
+              <SliversIcon height={18} />
             </span>
-          </button>
+            <span className="hidden items-baseline gap-1.5 sm:flex">
+              <span>Sliver C2</span>
+            </span>
+          </NextLink>
 
-          <ul className="hidden items-center gap-2 md:flex">
-            <li>
-              {renderTooltip(
-                "Home",
-                <Button
-                  isIconOnly
-                  aria-label="Home"
-                  variant={router.pathname === "/" ? "secondary" : "ghost"}
-                  onPress={() => router.push("/")}
-                >
-                  <FontAwesomeIcon fixedWidth icon={faHome} />
-                </Button>,
-              )}
-            </li>
-            {routes.map((route) => renderDesktopRoute(route.href, route.label))}
+          <ul className="hidden items-center gap-1 md:flex">
+            {routes.map((route) =>
+              renderDesktopRoute(route.href, route.label),
+            )}
           </ul>
 
-          <div className="ml-auto hidden items-center gap-2 md:flex">
-            {renderSearchInput("w-64")}
+          <div className="ml-auto hidden items-center gap-1 md:flex">
+            {renderSearchInput("mr-2 w-56 xl:w-72")}
+
             {renderTooltip(
-              activeTheme === Themes.DARK ? "Switch to light mode" : "Switch to dark mode",
+              themeToggleLabel,
               <Button
                 isIconOnly
-                aria-label={activeTheme === Themes.DARK ? "Switch to light mode" : "Switch to dark mode"}
+                aria-label={themeToggleLabel}
                 variant="ghost"
-                onPress={() => {
-                  setTheme(activeTheme === Themes.DARK ? Themes.LIGHT : Themes.DARK);
-                }}
+                onPress={toggleTheme}
               >
                 <FontAwesomeIcon icon={lightDarkModeIcon} />
               </Button>,
@@ -165,62 +193,55 @@ export default function TopNavbar() {
 
             {renderTooltip(
               "Join Discord",
-              <Button
-                isIconOnly
+              <a
+                href={discordUrl}
+                target="_blank"
+                rel="noreferrer"
                 aria-label="Join Discord"
-                variant="ghost"
-                onPress={() => {
-                  window.open(
-                    "https://discord.com/channels/791066041198968873/1339996286514106409",
-                    "_blank",
-                    "noopener,noreferrer",
-                  );
-                }}
+                className="inline-flex size-10 items-center justify-center rounded-xl text-muted no-underline outline-none hover:bg-surface-secondary hover:text-foreground focus-visible:ring-2 focus-visible:ring-accent/40"
               >
                 <FontAwesomeIcon icon={faDiscord} />
-              </Button>,
+              </a>,
             )}
 
             {renderTooltip(
               "View on GitHub",
-              <Button
-                isIconOnly
+              <a
+                href={githubUrl}
+                target="_blank"
+                rel="noreferrer"
                 aria-label="View on GitHub"
-                variant="ghost"
-                onPress={() => {
-                  window.open(
-                    "https://github.com/BishopFox/sliver",
-                    "_blank",
-                    "noopener,noreferrer",
-                  );
-                }}
+                className="inline-flex size-10 items-center justify-center rounded-xl text-muted no-underline outline-none hover:bg-surface-secondary hover:text-foreground focus-visible:ring-2 focus-visible:ring-accent/40"
               >
                 <FontAwesomeIcon icon={faGithub} />
-              </Button>,
+              </a>,
             )}
           </div>
 
-          <div className="ml-auto flex items-center gap-2 md:hidden">
+          <div className="ml-auto flex items-center gap-1 md:hidden">
             {renderTooltip(
-              activeTheme === Themes.DARK ? "Switch to light mode" : "Switch to dark mode",
+              themeToggleLabel,
               <Button
                 isIconOnly
-                aria-label={activeTheme === Themes.DARK ? "Switch to light mode" : "Switch to dark mode"}
+                aria-label={themeToggleLabel}
                 variant="ghost"
-                onPress={() => {
-                  setTheme(activeTheme === Themes.DARK ? Themes.LIGHT : Themes.DARK);
-                }}
+                onPress={toggleTheme}
               >
                 <FontAwesomeIcon icon={lightDarkModeIcon} />
               </Button>,
             )}
+
             {renderTooltip(
               isMobileMenuOpen ? "Close menu" : "Open menu",
               <Button
                 isIconOnly
-                variant="ghost"
+                aria-controls="mobile-navigation"
+                aria-expanded={isMobileMenuOpen}
                 aria-label={isMobileMenuOpen ? "Close menu" : "Open menu"}
-                onPress={() => setIsMobileMenuOpen((current) => !current)}
+                variant="ghost"
+                onPress={() =>
+                  setIsMobileMenuOpen((current) => !current)
+                }
               >
                 <FontAwesomeIcon icon={isMobileMenuOpen ? faXmark : faBars} />
               </Button>,
@@ -229,43 +250,56 @@ export default function TopNavbar() {
         </div>
       </nav>
 
-      {isMobileMenuOpen ? (
-        <div className="sliver-navbar-glass px-4 pb-4 shadow-sm md:hidden">
-          <div className="mt-3">{renderSearchInput("w-full")}</div>
-          <div className="mt-4 flex flex-col gap-2">
-            {renderMobileRoute("/", "Home")}
-            {routes.map((route) => renderMobileRoute(route.href, route.label))}
-            <Button
-              fullWidth
-              variant="ghost"
-              onPress={() => {
-                window.open(
-                  "https://discord.com/channels/791066041198968873/1339996286514106409",
-                  "_blank",
-                  "noopener,noreferrer",
-                );
-              }}
-            >
-              <FontAwesomeIcon icon={faDiscord} />
-              Discord
-            </Button>
-            <Button
-              fullWidth
-              variant="ghost"
-              onPress={() => {
-                window.open(
-                  "https://github.com/BishopFox/sliver",
-                  "_blank",
-                  "noopener,noreferrer",
-                );
-              }}
-            >
-              <FontAwesomeIcon icon={faGithub} />
-              GitHub
-            </Button>
-          </div>
-        </div>
-      ) : null}
+      <Drawer.Backdrop
+        isOpen={isMobileMenuOpen}
+        variant="blur"
+        onOpenChange={setIsMobileMenuOpen}
+      >
+        <Drawer.Content placement="right">
+          <Drawer.Dialog
+            id="mobile-navigation"
+            className="w-[min(24rem,calc(100vw-1.5rem))]"
+          >
+            <Drawer.CloseTrigger />
+            <Drawer.Header>
+              <Drawer.Heading>Navigate Sliver Docs</Drawer.Heading>
+            </Drawer.Header>
+            <Drawer.Body className="flex flex-col gap-5 pt-2">
+              {renderSearchInput("w-full")}
+
+              <nav
+                aria-label="Mobile navigation"
+                className="flex flex-col gap-1"
+              >
+                {renderMobileRoute("/", "Home")}
+                {routes.map((route) =>
+                  renderMobileRoute(route.href, route.label),
+                )}
+              </nav>
+            </Drawer.Body>
+            <Drawer.Footer className="grid grid-cols-2 gap-2">
+              <a
+                href={discordUrl}
+                target="_blank"
+                rel="noreferrer"
+                className="inline-flex h-10 w-full items-center justify-center gap-2 rounded-xl border border-separator px-4 text-sm font-medium text-foreground no-underline outline-none hover:bg-surface-secondary focus-visible:ring-2 focus-visible:ring-accent/40"
+              >
+                <FontAwesomeIcon icon={faDiscord} />
+                Discord
+              </a>
+              <a
+                href={githubUrl}
+                target="_blank"
+                rel="noreferrer"
+                className="inline-flex h-10 w-full items-center justify-center gap-2 rounded-xl border border-separator px-4 text-sm font-medium text-foreground no-underline outline-none hover:bg-surface-secondary focus-visible:ring-2 focus-visible:ring-accent/40"
+              >
+                <FontAwesomeIcon icon={faGithub} />
+                GitHub
+              </a>
+            </Drawer.Footer>
+          </Drawer.Dialog>
+        </Drawer.Content>
+      </Drawer.Backdrop>
     </>
   );
 }

docs/sliver-docs/components/tutorial-card.tsx

@@ -3,7 +3,6 @@ import AsciinemaPlayer from "./asciinema";
 
 import { faChevronRight } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-import styles from "./TutorialCard.module.css";
 
 export type TutorialCardCardProps = {
   name: string;
@@ -13,6 +12,7 @@ export type TutorialCardCardProps = {
   rows?: string;
   cols?: string;
   idleTimeLimit?: number;
+  hideControls?: boolean;
 
   italicDescription?: boolean;
   onPress?: () => void;
@@ -21,55 +21,48 @@ export type TutorialCardCardProps = {
 };
 
 export default function TutorialCard(props: TutorialCardCardProps) {
-  const actionButtonClassName =
-    "ml-auto h-auto min-h-0 shrink-0 px-0 py-0 text-sm font-semibold [--button-bg-hover:transparent] [--button-bg-pressed:transparent] [--button-bg:transparent] [--button-fg:var(--warning)]";
-
   return (
-    <Card className="relative z-0 gap-0 overflow-hidden p-0">
-      <Card.Header className="absolute left-3 right-3 top-3 z-10 flex-col items-end p-0 text-right">
-        <p className="text-sm font-bold uppercase leading-none text-white/70">
-          {props.name}
-        </p>
-      </Card.Header>
-
-      <div className={`${styles["hide-control-bar"]} overflow-hidden`}>
+    <Card className="relative h-full min-w-0 gap-0 overflow-hidden bg-black p-0 shadow-surface">
+      <div className="sliver-terminal-frame relative w-full max-w-full overflow-x-auto bg-[#111315]">
         <AsciinemaPlayer
+          className="min-w-[36rem]"
           src={props.asciiCast}
-          rows={props.rows ? props.rows : "18"}
-          cols={props.cols ? props.cols : "75"}
-          idleTimeLimit={props.idleTimeLimit ? props.idleTimeLimit : 2}
+          hideControls={props.hideControls}
+          rows={props.rows || "18"}
+          cols={props.cols || "75"}
+          idleTimeLimit={props.idleTimeLimit || 2}
           preload={true}
           autoPlay={true}
           loop={true}
         />
+
+        <div className="pointer-events-none absolute inset-x-3 top-3 z-10 flex justify-end">
+          <h3 className="max-w-[80%] rounded-xl border border-white/15 bg-black/55 px-3 py-2 text-right text-sm font-semibold text-white/85 shadow-lg backdrop-blur-xl">
+            {props.name}
+          </h3>
+        </div>
       </div>
 
-      <Card.Footer className="absolute bottom-0 left-0 right-0 z-10 border-t border-white/20 bg-black/40 p-3 backdrop-blur-md">
-        <div className="flex min-h-10 w-full flex-row items-center gap-4">
-          <p
-            className={
-              props.italicDescription
-                ? "min-w-0 flex-1 text-sm leading-snug text-white/80 italic"
-                : "min-w-0 flex-1 text-sm leading-snug text-white/80"
-            }
-          >
-            {props.description}
-          </p>
+      <Card.Footer className="absolute inset-x-3 bottom-10 z-10 flex-row items-center gap-3 rounded-2xl border border-white/15 bg-black/55 px-3 py-2.5 text-white shadow-xl backdrop-blur-xl">
+        <p
+          className={`min-w-0 flex-1 text-sm leading-5 text-white/70 ${
+            props.italicDescription ? "italic" : ""
+          }`}
+        >
+          {props.description}
+        </p>
 
-          {props.showButton ? (
-            <Button
-              variant="ghost"
-              size="sm"
-              onPress={props.onPress}
-              className={actionButtonClassName}
-            >
-              {props.buttonText ? props.buttonText : "Read Tutorial"}
-              <FontAwesomeIcon icon={faChevronRight} />
-            </Button>
-          ) : (
-            <></>
-          )}
-        </div>
+        {props.showButton ? (
+          <Button
+            className="shrink-0 text-white hover:bg-white/10"
+            size="sm"
+            variant="ghost"
+            onPress={props.onPress}
+          >
+            {props.buttonText || "Read tutorial"}
+            <FontAwesomeIcon icon={faChevronRight} />
+          </Button>
+        ) : null}
       </Card.Footer>
     </Card>
   );

docs/sliver-docs/package.json

@@ -26,8 +26,8 @@
     "asciinema-player": "^3.15.1",
     "fuse.js": "^7.3.0",
     "lunr": "^2.3.9",
-    "mermaid": "^11.14.0",
-    "next": "^16.2.4",
+    "mermaid": "^11.16.1",
+    "next": "^16.2.6",
     "next-themes": "^0.4.6",
     "react": "^19.2.5",
     "react-dom": "^19.2.5",
@@ -51,8 +51,10 @@
     "typescript": "^6.0.3"
   },
   "overrides": {
-    "dompurify": "^3.4.2",
+    "dompurify": "^3.4.13",
     "postcss": "^8.5.13",
+    "sharp": "^0.35.3",
+    "shell-quote": "^1.8.4",
     "uuid": "^14.0.0"
   }
 }

docs/sliver-docs/pages/_app.tsx

@@ -8,6 +8,7 @@ import { fetchDocs as fetchDocsContent, fetchTutorials as fetchTutorialsContent
 import { Themes } from "@/util/themes";
 import { faExternalLink } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { RouterProvider } from "@heroui/react";
 import {
   HydrationBoundary,
   QueryClient,
@@ -15,9 +16,19 @@ import {
 } from "@tanstack/react-query";
 import { ThemeProvider as NextThemesProvider } from "next-themes";
 import type { AppProps } from "next/app";
+import { useRouter } from "next/router";
 import React from "react";
 
 export default function App({ Component, pageProps }: AppProps) {
+  const router = useRouter();
+
+  const navigate = React.useCallback(
+    (path: string) => {
+      void router.push(path);
+    },
+    [router],
+  );
+
   // Initialize search
   const [search] = React.useState(() => new SearchCtx());
 
@@ -101,54 +112,50 @@ export default function App({ Component, pageProps }: AppProps) {
     >
       <QueryClientProvider client={queryClient}>
         <HydrationBoundary state={pageProps.dehydratedState}>
-          <SearchContext.Provider value={search}>
-            <Navbar />
-            <Component {...pageProps} />
-            <div className="mb-16 md:mb-20"></div>
-            <footer className="z-20 w-full border-t border-separator bg-surface/80 px-3 py-4 text-center shadow backdrop-blur-md dark:bg-black/75 md:fixed md:bottom-0 md:left-0 md:right-0 md:flex md:items-center md:justify-between md:px-6 md:py-4">
-              <div className="flex flex-col items-center gap-2 text-xs leading-snug text-muted sm:text-sm md:flex-row md:items-center md:gap-3 md:text-left">
-                <span>
-                  © {new Date().getFullYear()}&nbsp;
-                  <a
-                    href="https://bishopfox.com/"
-                    className="hover:underline"
-                    rel="noreferrer"
-                    target="_blank"
-                  >
-                    Bishop Fox
-                  </a>
-                </span>
-                <span className="hidden md:inline" aria-hidden="true">
-                  ·
-                </span>
-                <span className="max-w-xs md:max-w-none">
-                  <a
-                    href="https://github.com/BishopFox/sliver/pulls"
-                    rel="noreferrer"
-                    className="hover:underline"
-                    target="_blank"
-                  >
-                    Help improve this documentation
-                    <span className="ml-1 inline-block">
-                      <FontAwesomeIcon icon={faExternalLink} />
+          <RouterProvider navigate={navigate}>
+            <SearchContext.Provider value={search}>
+              <div className="flex min-h-dvh flex-col">
+                <Navbar />
+                <main className="sliver-page-content flex-1">
+                  <Component {...pageProps} />
+                </main>
+                <footer className="sliver-fixed-footer fixed inset-x-0 bottom-0 z-30 border-t border-separator/70 bg-background/70 backdrop-blur-xl">
+                  <div className="mx-auto flex min-h-[var(--sliver-footer-height)] w-full max-w-7xl flex-col items-center justify-center gap-1.5 px-4 py-3 text-center text-sm text-muted sm:px-6 md:flex-row md:justify-between md:text-left lg:px-8">
+                    <span>
+                      © {new Date().getFullYear()} {" "}
+                      <a
+                        href="https://bishopfox.com/"
+                        className="font-medium text-foreground no-underline hover:text-accent"
+                        rel="noreferrer"
+                        target="_blank"
+                      >
+                        Bishop Fox
+                      </a>
                     </span>
-                  </a>
-                </span>
+                    <div className="flex flex-wrap items-center justify-center gap-x-5 gap-y-2">
+                      <a
+                        href="https://github.com/BishopFox/sliver/pulls"
+                        rel="noreferrer"
+                        className="inline-flex items-center gap-1.5 no-underline hover:text-foreground"
+                        target="_blank"
+                      >
+                        Improve these docs
+                        <FontAwesomeIcon className="text-xs" icon={faExternalLink} />
+                      </a>
+                      <a
+                        href="https://github.com/BishopFox/sliver/blob/master/LICENSE"
+                        target="_blank"
+                        rel="noreferrer"
+                        className="no-underline hover:text-foreground"
+                      >
+                        GPLv3
+                      </a>
+                    </div>
+                  </div>
+                </footer>
               </div>
-              <ul className="mt-3 flex flex-wrap items-center justify-center gap-3 text-xs font-medium text-muted md:mt-0 md:gap-6 md:text-sm">
-                <li>
-                  <a
-                    href="https://github.com/BishopFox/sliver/blob/master/LICENSE"
-                    target="_blank"
-                    rel="noreferrer"
-                    className="hover:underline"
-                  >
-                    GPLv3 License
-                  </a>
-                </li>
-              </ul>
-            </footer>
-          </SearchContext.Provider>
+            </SearchContext.Provider>
+          </RouterProvider>
         </HydrationBoundary>
       </QueryClientProvider>
     </NextThemesProvider>

docs/sliver-docs/pages/docs/index.tsx

@@ -3,14 +3,18 @@ import LoadingState from "@/components/loading-state";
 import { Docs } from "@/util/docs";
 import { PREBUILD_VERSION } from "@/util/__generated__/prebuild-version";
 import { fetchDocs as fetchDocsContent } from "@/util/content-fetchers";
-import { faSearch } from "@fortawesome/free-solid-svg-icons";
+import {
+  faBookOpen,
+  faChevronRight,
+  faSearch,
+} from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import {
+  Button,
   Card,
   ListBox,
   ScrollShadow,
   SearchField,
-  Separator,
 } from "@heroui/react";
 import { useQuery } from "@tanstack/react-query";
 import Fuse from "fuse.js";
@@ -20,6 +24,15 @@ import { useSearchParams } from "next/navigation";
 import { useRouter } from "next/router";
 import React from "react";
 
+const featuredDocNames = [
+  "Getting Started",
+  "Compile from Source",
+  "Architecture",
+  "Armory",
+  "Stagers",
+  "Troubleshooting",
+];
+
 const DocsIndexPage: NextPage = () => {
   const router = useRouter();
 
@@ -70,13 +83,20 @@ const DocsIndexPage: NextPage = () => {
   }, [docs, name, visibleDocs]);
 
   const listboxClasses =
-    "p-0 gap-0 divide-y divide-separator bg-surface overflow-visible rounded-lg shadow-sm";
+    "flex flex-col gap-1 overflow-visible bg-transparent p-0";
+
+  const featuredDocs = React.useMemo(() => {
+    return featuredDocNames
+      .map((featuredName) => docs?.docs.find((doc) => doc.name === featuredName))
+      .filter((doc) => doc !== undefined);
+  }, [docs]);
 
   const renderFilterInput = (className?: string) => (
     <SearchField
       aria-label="Filter documents"
       className={className}
       fullWidth
+      variant="secondary"
       value={filterValue}
       onChange={setFilterValue}
     >
@@ -99,87 +119,144 @@ const DocsIndexPage: NextPage = () => {
   return (
     <>
       <Head>
-        <title>Sliver Docs: {name}</title>
+        <title>{name ? `${name} · Sliver Docs` : "Sliver Documentation"}</title>
       </Head>
-      <div className="px-4 pt-4 lg:hidden">
-        <label
-          htmlFor="docs-mobile-selector"
-          className="block text-sm font-medium text-foreground"
-        >
-          Select a document
-        </label>
-        <div className="mt-2">{renderFilterInput()}</div>
-        <select
-          id="docs-mobile-selector"
-          className="mt-3 w-full rounded-lg border border-separator bg-surface p-2 text-sm"
-          value={name}
-          onChange={(event) => {
-            const selectedName = event.target.value;
-            router.push({
-              pathname: "/docs",
-              query: selectedName ? { name: selectedName } : undefined,
-            });
-          }}
-        >
-          <option value="">Browse documents…</option>
-          {mobileDocs.map((doc) => (
-            <option key={doc.name} value={doc.name}>
-              {doc.name}
-            </option>
-          ))}
-        </select>
-      </div>
-      <div className="grid grid-cols-1 gap-6 lg:grid-cols-12 lg:gap-8">
-        <aside className="hidden lg:block lg:col-span-3">
-          <div className="sticky top-16 ml-4 flex flex-col gap-3">
-            {renderFilterInput("mt-2")}
-            <ScrollShadow className="max-h-[calc(100vh-15rem)] sliver-scrollbar overflow-y-auto pr-1 rounded-lg">
-              <ListBox
-                aria-label="Toolbox Menu"
-                className={listboxClasses}
-                onAction={(key) => {
-                  router.push({
-                    pathname: "/docs",
-                    query: { name: String(key) },
-                  });
-                }}
-              >
-                {visibleDocs.map((doc) => (
-                  <ListBox.Item
-                    key={doc.name}
-                    id={doc.name}
-                    textValue={doc.name}
-                    className="h-12 rounded-none px-3 first:rounded-t-lg last:rounded-b-lg"
-                  >
-                    {doc.name}
-                  </ListBox.Item>
-                ))}
-              </ListBox>
-            </ScrollShadow>
+      <div className="mx-auto w-full max-w-[90rem] px-4 pt-8 sm:px-6 lg:px-8 lg:pt-10">
+        <div className="mb-8 lg:hidden">
+          <div className="flex items-center gap-3">
+            <span className="flex size-9 items-center justify-center rounded-2xl bg-surface-secondary text-accent">
+              <FontAwesomeIcon icon={faBookOpen} />
+            </span>
+            <div>
+              <p className="text-sm font-medium text-foreground">Documentation</p>
+              <p className="text-xs text-muted">Browse the reference library</p>
+            </div>
           </div>
-        </aside>
-        <div className="px-4 pb-8 lg:col-span-9 lg:px-8">
-          {name !== "" ? (
-            <Card className="mt-2">
-              <Card.Header>
-                <span className="text-3xl">{name}</span>
-              </Card.Header>
-              <Separator />
-              <Card.Content>
+          <div className="mt-5">{renderFilterInput()}</div>
+          <label
+            htmlFor="docs-mobile-selector"
+            className="mt-4 block text-sm font-medium text-foreground"
+          >
+            Document
+          </label>
+          <select
+            id="docs-mobile-selector"
+            className="mt-2 w-full rounded-2xl border border-transparent bg-surface-secondary px-3 py-2.5 text-sm text-foreground outline-none focus:border-accent"
+            value={name}
+            onChange={(event) => {
+              const selectedName = event.target.value;
+              router.push({
+                pathname: "/docs",
+                query: selectedName ? { name: selectedName } : undefined,
+              });
+            }}
+          >
+            <option value="">Browse documents…</option>
+            {mobileDocs.map((doc) => (
+              <option key={doc.name} value={doc.name}>
+                {doc.name}
+              </option>
+            ))}
+          </select>
+        </div>
+
+        <div className="grid min-w-0 grid-cols-1 gap-8 lg:grid-cols-[17rem_minmax(0,1fr)] lg:gap-10">
+          <aside className="sliver-sticky-sidebar hidden border-r border-separator/70 pr-6 lg:block">
+            <div className="flex h-full min-h-0 flex-col gap-5">
+              <div className="flex items-center gap-3 px-1">
+                <span className="flex size-9 items-center justify-center rounded-2xl bg-surface-secondary text-accent">
+                  <FontAwesomeIcon icon={faBookOpen} />
+                </span>
+                <div>
+                  <p className="text-sm font-medium text-foreground">Documentation</p>
+                  <p className="text-xs text-muted">{docs.docs.length} articles</p>
+                </div>
+              </div>
+              {renderFilterInput()}
+              <ScrollShadow className="sliver-scrollbar min-h-0 flex-1 overscroll-contain overflow-y-auto pr-2">
+                <ListBox
+                  aria-label="Documentation"
+                  className={listboxClasses}
+                  selectedKeys={name ? [name] : []}
+                  selectionMode="single"
+                >
+                  {visibleDocs.map((doc) => (
+                    <ListBox.Item
+                      key={doc.name}
+                      id={doc.name}
+                      href={`/docs/?name=${encodeURIComponent(doc.name)}`}
+                      textValue={doc.name}
+                      className={`min-h-10 rounded-xl px-3 py-2 text-sm ${
+                        doc.name === name
+                          ? "bg-surface font-medium text-foreground shadow-surface"
+                          : "text-muted"
+                      }`}
+                    >
+                      {doc.name}
+                    </ListBox.Item>
+                  ))}
+                </ListBox>
+              </ScrollShadow>
+            </div>
+          </aside>
+
+          <div
+            key={name || "documentation-overview"}
+            className="min-w-0 pb-16 lg:pr-4"
+          >
+            {name !== "" ? (
+              <article className="mx-auto w-full max-w-4xl">
+                <header className="mb-8 border-b border-separator/70 pb-8">
+                  <p className="text-sm font-medium text-accent">Reference</p>
+                  <h1 className="mt-2 text-balance text-4xl font-semibold tracking-tight text-foreground sm:text-5xl">
+                    {name}
+                  </h1>
+                </header>
                 <MarkdownViewer
                   key={name}
                   markdown={markdown || ""}
+                  demoteTopLevelHeading
                 />
-              </Card.Content>
-            </Card>
-          ) : (
-            <div className="mt-8 text-center text-2xl text-foreground/90">
-              Welcome to the Sliver Wiki!
-              <div className="mt-2 text-xl text-muted">
-                Please select a document
+              </article>
+            ) : (
+              <div className="mx-auto w-full max-w-5xl pt-4 lg:pt-8">
+                <h1 className="text-sm font-medium text-accent">
+                  Sliver reference
+                </h1>
+                <p className="mt-4 max-w-2xl text-lg leading-8 text-muted">
+                  Browse configuration, transports, extensions, payloads, and
+                  troubleshooting guidance for the Sliver framework.
+                </p>
+
+                <div className="mt-10 grid gap-4 sm:grid-cols-2">
+                  {featuredDocs.map((doc) => (
+                    <Card key={doc.name} className="h-full">
+                      <Card.Header>
+                        <Card.Title>{doc.name}</Card.Title>
+                        <Card.Description>
+                          Open this topic in the Sliver reference.
+                        </Card.Description>
+                      </Card.Header>
+                      <Card.Footer className="mt-auto">
+                        <Button
+                          variant="ghost"
+                          onPress={() => {
+                            router.push({
+                              pathname: "/docs",
+                              query: { name: doc.name },
+                            });
+                          }}
+                        >
+                          Open article
+                          <FontAwesomeIcon icon={faChevronRight} />
+                        </Button>
+                      </Card.Footer>
+                    </Card>
+                  ))}
+                </div>
               </div>
-            </div>
-          )}
+            )}
+          </div>
         </div>
       </div>
     </>

docs/sliver-docs/pages/docs/md/Aliases and Extensions.md

@@ -168,6 +168,8 @@ As the alias support relies on Sliver side loading capabilities, please make sur
 
 ## Extensions
 
-⚠️ Extensions are currently only supported when using Windows implants, though we're actively working on MacOS/Linux support.
+Native extensions are supported by Windows implants (`386`, `amd64`, and `arm64`), Linux implants (`386`, `amd64`, and `arm64`), and macOS implants (`amd64` and `arm64`). Each manifest must include a platform-native shared library for every target it supports: `.dll` on Windows, `.so` on Linux, and `.dylib` on macOS.
 
 Extensions are similar in structure to an alias, but internally work differently. An extension is an artifact of native code that is reflectively loaded by the implant and passed certain callbacks. These callbacks allow the extension to return data to the C2 server. Extensions may also have dependencies (other extensions), which Sliver will load prior to the extension; circular dependencies are not allowed. For example, all BOF extensions (`.o` files) rely on the COFF Loader extension (a `.dll`).
+
+Native exports use the same Sliver extension ABI on every supported operating system. The export receives the argument buffer, its size, and a callback used to return output. The optional `init` export in the extension manifest is called once after the library is loaded and before any command export is invoked.

docs/sliver-docs/pages/docs/md/Community Guides.md

@@ -20,7 +20,7 @@
 - https://dominicbreuker.com/post/learning_sliver_c2_01_installation/
 - https://vk9-sec.com/how-to-set-up-use-c2-sliver/
 - https://0x90-1.gitbook.io/sliver/
-- https://blog.ecapuano.com/p/so-you-want-to-be-a-soc-analyst-part-ea2
+- https://blog.ecapuano.com/p/so-you-want-to-be-a-soc-analyst-20
 - https://wsummerhill.github.io/redteam/2023/07/25/Sliver-C2-Usage-for-Red-Teams.html
 - https://rootsecdev.medium.com/hacking-active-directory-with-sliver-c2-19d7ceabbf13
 - https://dev.to/living_syn/sliver-and-cursed-chrome-for-post-exploitation-4gnk

docs/sliver-docs/pages/docs/md/Compile from Source.md

@@ -2,7 +2,7 @@ You'll want to compile Sliver from a MacOS or Linux machine. Compiling from nati
 
 To compile from source you'll need:
 
-- Go v1.25 or later
+- Go v1.26.6 or later
 - `make` (on MacOS you may need to install XCode and accompanying cli tools)
 
 ```asciinema

docs/sliver-docs/pages/docs/md/Go Archive Output.md

@@ -0,0 +1,127 @@
+Sliver can generate Go c-archive output for use in native link workflows. The archive format returns a ZIP bundle containing the generated static archive (`.a`) and C headers (`.h`) produced by Go's `c-archive` build mode.
+
+Use this format when you want to link the generated implant entrypoint into another native artifact, such as a DLL or application, and validate that the exported symbol resolves correctly in your own loader or harness.
+
+## Generate an Archive
+
+For the example, a Windows archive was generated via the Sliver console:
+
+```shell
+sliver > generate --format archive --os windows --arch amd64 --mtls 127.0.0.1
+```
+
+The output ZIP contains an archive (`.a`) file and the headers (`.h`).
+
+```text
+ARCHITECTURAL_YOKE.a
+ARCHITECTURAL_YOKE.h
+main.h
+```
+
+If no export symbols are configured, Sliver exports `StartW` by default. The examples below assume the generated implant name is `ARCHITECTURAL_YOKE`; replace that name with the files generated in your environment.
+
+## Link the Archive into a DLL
+
+Create a wrapper that calls `StartW` from a worker thread when the DLL loads, which keeps `DllMain` lightweight and avoids doing long-running initialization work while the Windows loader lock is held.
+
+```cpp
+#include "ARCHITECTURAL_YOKE.h"
+#include <windows.h>
+
+DWORD WINAPI WorkerThread(LPVOID lpParam)
+{
+    StartW();
+    return 0;
+}
+
+BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved)
+{
+    if (fdwReason == DLL_PROCESS_ATTACH) {
+        DisableThreadLibraryCalls(hinstDLL);
+
+        HANDLE hThread = CreateThread(NULL, 0, WorkerThread, NULL, 0, NULL);
+        if (hThread != NULL) {
+            CloseHandle(hThread);
+        }
+    }
+    return TRUE;
+}
+```
+
+Compile the wrapper and link it with the generated archive:
+
+```shell
+x86_64-w64-mingw32-g++ -std=c++11 -Wall -I. -shared -o beacon.dll wrapper.cpp ARCHITECTURAL_YOKE.a
+```
+
+## Validate Symbol Resolution
+
+Sample minimal loader to confirm the DLL loads and the `StartW` export resolves:
+
+```c
+#include <windows.h>
+#include <stdio.h>
+
+int main() {
+    HMODULE h = LoadLibraryA("beacon.dll");
+    if (!h) {
+        printf("LoadLibrary failed: %lu\n", GetLastError());
+        return 1;
+    }
+
+    FARPROC p = GetProcAddress(h, "StartW");
+    printf("LoadLibrary OK, StartW=%p\n", p);
+
+    FreeLibrary(h);
+    return 0;
+}
+```
+
+Build the loader:
+
+```shell
+x86_64-w64-mingw32-gcc -Wall -o loader.exe loader.c
+```
+
+Run the loader in an authorized local test environment with `beacon.dll` in the same directory.
+
+## Validate Invocation
+
+To validate that the resolved entrypoint can be invoked, use a small test application:
+
+```c
+#include <windows.h>
+#include <stdio.h>
+
+typedef void (*StartWFn)(void);
+
+int main() {
+    HMODULE h = LoadLibraryA("beacon.dll");
+    if (!h) {
+        printf("LoadLibrary failed: %lu\n", GetLastError());
+        return 1;
+    }
+
+    StartWFn StartW = (StartWFn)GetProcAddress(h, "StartW");
+    if (!StartW) {
+        printf("GetProcAddress failed: %lu\n", GetLastError());
+        return 1;
+    }
+
+    printf("Calling StartW...\n");
+    StartW();
+
+    printf("StartW returned\n");
+    FreeLibrary(h);
+    return 0;
+}
+```
+
+Build the invocation test:
+
+```shell
+x86_64-w64-mingw32-gcc -Wall -o call_startw.exe call_startw.c
+```
+
+This validates the archive-to-DLL link path, DLL loading, export lookup, and `StartW` invocation all work as expected.
+

docs/sliver-docs/pages/docs/md/Stagers.md

@@ -14,7 +14,7 @@ For this to work, we need the following pieces:
 
 - a staging server (the Sliver server)
 - a stage 2 payload (usually a Sliver shellcode, but can be in other formats)
-- stagers (generated by `msfvenom`, the Sliver `generate stager` command, or a custom one)
+- stagers (generated by `msfvenom` or built by hand, see [Custom Stagers](#custom-stagers) below)
 
 ## Example
 
@@ -81,7 +81,11 @@ ID  Name  Protocol  Port
 
 **Using Metasploit stagers is only supported on Windows.**
 
-#### Generating an HTTP stager
+> **Note:** The Sliver `generate stager` command has been removed and will no longer
+> work. Generate stagers using Metasploit's `msfvenom` (or write your own custom
+> stager, see [Custom Stagers](#custom-stagers) below).
+
+#### Generating an HTTP(S) stager
 If you want to use [stagers generated by the Metasploit Framework with Sliver](https://www.rapid7.com/blog/post/2022/09/16/metasploit-weekly-wrap-up-176/) (using `msfconsole` or `msfvenom`), you will need to pass the additional `--prepend-size` flag to `stage-listener`, like this:
 
 ```

docs/sliver-docs/pages/index.tsx

@@ -1,144 +1,212 @@
 import AsciinemaPlayer from "@/components/asciinema";
 import { SliversIcon } from "@/components/icons/slivers";
 import TutorialCard from "@/components/tutorial-card";
-import { Themes } from "@/util/themes";
-import { faDownload, faExternalLink } from "@fortawesome/free-solid-svg-icons";
+import {
+  faArrowUpRightFromSquare,
+  faDownload,
+} from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-import { Button, Card, Separator } from "@heroui/react";
-import { useTheme } from "next-themes";
+import { Button, Card, buttonVariants } from "@heroui/react";
+import Head from "next/head";
+import Link from "next/link";
 import { useRouter } from "next/router";
-import React from "react";
 
 export default function Home() {
   const router = useRouter();
-  const { resolvedTheme } = useTheme();
-
-  const isDarkTheme = React.useMemo(() => {
-    return (resolvedTheme || Themes.DARK) !== Themes.LIGHT;
-  }, [resolvedTheme]);
 
   return (
-    <div className="mt-6 flex flex-col gap-6 px-4 sm:px-6 lg:grid lg:grid-cols-12 lg:px-12">
-      <div className="lg:col-span-6">
-        <div className="w-full overflow-hidden rounded-xl border border-separator bg-surface shadow-sm">
-          <div className="w-full overflow-x-auto lg:overflow-visible">
-            <AsciinemaPlayer
-              src="/asciinema/intro.cast"
-              rows="18"
-              cols="75"
-              idleTimeLimit={60}
-              preload={true}
-              autoPlay={true}
-              loop={true}
-            />
-          </div>
-        </div>
-      </div>
-      <div className="lg:col-span-6 lg:ml-2">
-        <Card className="mx-auto max-w-3xl lg:mx-0">
-          <Card.Header>
-            <div className="flex items-center">
-              <SliversIcon className="mr-2" height={28} />
-              <span className="text-2xl">Sliver Command &amp; Control</span>
+    <>
+      <Head>
+        <title>Sliver C2 Documentation</title>
+        <meta
+          name="description"
+          content="Documentation, tutorials, and community resources for the Sliver command and control framework."
+        />
+      </Head>
+
+      <div className="relative overflow-hidden">
+        <div className="sliver-grid-surface pointer-events-none absolute inset-x-0 top-0 h-[34rem] opacity-55" />
+
+        <div className="relative mx-auto w-full max-w-7xl px-4 pb-20 pt-8 sm:px-6 sm:pt-12 lg:px-8 lg:pt-16">
+          <section className="grid min-w-0 grid-cols-1 items-stretch gap-6 lg:grid-cols-12">
+            <div className="min-w-0 lg:col-span-7">
+              <Card className="relative h-full min-w-0 gap-0 overflow-hidden rounded-3xl bg-black p-0 shadow-surface">
+                <div className="absolute right-3 top-3 z-10 max-w-[calc(100%_-_1.5rem)]">
+                  <Link
+                    href="/tutorials"
+                    aria-label="Browse Sliver tutorials"
+                    className="inline-flex min-w-0 cursor-pointer items-center gap-2.5 rounded-xl border border-white/15 bg-black/55 px-3 py-2 text-white no-underline shadow-lg outline-none backdrop-blur-xl hover:bg-black/70 focus-visible:ring-2 focus-visible:ring-white/70"
+                  >
+                    <span className="flex size-7 shrink-0 items-center justify-center rounded-lg bg-white/10 text-white/90">
+                      <SliversIcon height={16} />
+                    </span>
+                    <div className="min-w-0">
+                      <p className="truncate text-xs font-semibold">
+                        Sliver operator console
+                      </p>
+                      <p className="truncate text-[11px] text-white/60">
+                        Interactive command tour
+                      </p>
+                    </div>
+                  </Link>
+                </div>
+
+                <div className="sliver-terminal-frame min-h-[20rem] flex-1 overflow-x-auto bg-[#111315] sm:min-h-[24rem]">
+                  <AsciinemaPlayer
+                    className="sliver-asciinema-bottom-aligned h-full w-full sm:min-w-[35rem]"
+                    src="/asciinema/intro.cast"
+                    fit="width"
+                    hideControls
+                    rows="18"
+                    cols="75"
+                    idleTimeLimit={60}
+                    preload={true}
+                    autoPlay={true}
+                    loop={true}
+                  />
+                </div>
+              </Card>
             </div>
-          </Card.Header>
-          <Separator />
-          <Card.Content>
-            <p className={isDarkTheme ? "prose dark:prose-invert" : "prose prose-slate"}>
-              Sliver is a powerful command and control (C2) framework designed
-              to provide advanced capabilities for covertly managing and
-              controlling remote systems. With Sliver, security professionals,
-              red teams, and penetration testers can easily establish a secure
-              and reliable communication channel over Mutual TLS, HTTP(S), DNS,
-              or Wireguard with target machines. Enabling them to execute
-              commands, gather information, and perform various
-              post-exploitation activities. The framework offers a user-friendly
-              console interface, extensive functionality, and support for
-              multiple operating systems as well as multiple CPU architectures,
-              making it an indispensable tool for conducting comprehensive
-              offensive security operations.
-            </p>
-            <div className="mt-4 flex w-full gap-3">
+
+            <Card className="h-full bg-surface/80 shadow-surface backdrop-blur-2xl lg:col-span-5">
+              <Card.Header className="pb-3">
+                <div className="min-w-0">
+                  <p className="text-sm font-medium text-accent">
+                    Operator documentation
+                  </p>
+                  <h1 className="mt-1 text-balance text-3xl font-semibold tracking-tight text-foreground sm:text-4xl">
+                    Sliver Command &amp; Control
+                  </h1>
+                </div>
+              </Card.Header>
+
+              <Card.Content className="pt-2">
+                <p className="text-pretty text-base leading-7 text-muted">
+                  Sliver is a cross-platform command and control framework for
+                  professional red teams. Operate over mTLS, WireGuard, HTTP(S),
+                  and DNS from one console, with broad operating-system and CPU
+                  architecture support.
+                </p>
+                <p className="mt-4 text-sm leading-6 text-muted">
+                  Start with the operator guide, download the latest release, or
+                  extend your workflow with community packages from the Armory.
+                </p>
+              </Card.Content>
+
+              <Card.Footer className="mt-auto flex-col items-stretch gap-3 pt-5">
+                <div className="grid grid-cols-1 gap-3 sm:grid-cols-2">
+                  <Button
+                    fullWidth
+                    variant="primary"
+                    onPress={() =>
+                      router.push({
+                        pathname: "/docs",
+                        query: { name: "Getting Started" },
+                      })
+                    }
+                  >
+                    Get started
+                  </Button>
+                  <Button
+                    className="[--button-bg-hover:var(--color-purple-700)] [--button-bg-pressed:var(--color-purple-700)] [--button-bg:var(--color-purple-600)] [--button-fg:var(--color-white)]"
+                    fullWidth
+                    variant="tertiary"
+                    onPress={() => {
+                      window.open(
+                        "https://github.com/BishopFox/sliver/releases/latest",
+                        "_blank",
+                        "noopener,noreferrer",
+                      );
+                    }}
+                  >
+                    <FontAwesomeIcon icon={faDownload} />
+                    Latest release
+                  </Button>
+                </div>
+                <a
+                  className={buttonVariants({
+                    fullWidth: true,
+                    variant: "secondary",
+                  })}
+                  href="https://github.com/sliverarmory"
+                  target="_blank"
+                  rel="noreferrer"
+                >
+                  Browse the Armory
+                  <FontAwesomeIcon
+                    className="text-xs"
+                    icon={faArrowUpRightFromSquare}
+                  />
+                </a>
+              </Card.Footer>
+            </Card>
+          </section>
+
+          <section
+            aria-labelledby="quick-guides-heading"
+            className="mt-12 border-t border-separator/70 pt-10"
+          >
+            <div className="flex flex-col gap-3 sm:flex-row sm:items-end sm:justify-between">
+              <div>
+                <h2
+                  id="quick-guides-heading"
+                  className="text-sm font-medium text-accent"
+                >
+                  Quick guides
+                </h2>
+                <blockquote className="mt-1 max-w-3xl text-xl font-medium italic leading-snug tracking-tight text-foreground sm:text-2xl">
+                  Bred as living shields, these slivers have proven unruly—they
+                  know they cannot be caught.
+                </blockquote>
+              </div>
               <Button
-                className="flex-1"
-                variant="primary"
-                onPress={() => {
-                  window.open(
-                    "https://github.com/BishopFox/sliver/releases/latest",
-                    "_blank",
-                    "noopener,noreferrer",
-                  );
-                }}
-              >
-                <FontAwesomeIcon icon={faDownload} />
-                Download Latest Release
-              </Button>
-              <Button
-                className="sliver-armory-ghost flex-1"
                 variant="ghost"
-                onPress={() => {
-                  window.open(
-                    "https://github.com/sliverarmory",
-                    "_blank",
-                    "noopener,noreferrer",
-                  );
-                }}
+                onPress={() => router.push("/tutorials")}
               >
-                Visit the Armory
-                <FontAwesomeIcon icon={faExternalLink} />
+                Browse all tutorials
               </Button>
             </div>
-          </Card.Content>
-        </Card>
-      </div>
 
-      <div className="col-span-12 mt-8">
-        <Separator />
-      </div>
+            <div className="mt-6 grid min-w-0 grid-cols-1 gap-5 xl:grid-cols-2">
+              <TutorialCard
+                name="Getting Started"
+                description="Install Sliver and open your first operator workflow."
+                asciiCast="/asciinema/install-1.cast"
+                cols="133"
+                rows="32"
+                idleTimeLimit={1}
+                hideControls
+                showButton={true}
+                buttonText="Read guide"
+                onPress={() => {
+                  router.push({
+                    pathname: "/docs",
+                    query: { name: "Getting Started" },
+                  });
+                }}
+              />
 
-      <div className="col-span-12 mt-8">
-        <div className="grid gap-4 sm:grid-cols-2 lg:grid-cols-9">
-          <div className="sm:col-span-1 lg:col-span-3">
-            <TutorialCard
-              name="Getting Started"
-              description="A quick start guide to get you up and running"
-              asciiCast="/asciinema/install-1.cast"
-              cols="133"
-              rows="32"
-              idleTimeLimit={1}
-              showButton={true}
-              buttonText="Read Docs"
-              onPress={() => {
-                router.push({
-                  pathname: "/docs",
-                  query: { name: "Getting Started" },
-                });
-              }}
-            />
-          </div>
-
-          <div className="sm:col-span-1 lg:col-span-3">
-            <TutorialCard
-              name="Compile From Source"
-              description="How to compile Sliver from source"
-              asciiCast="/asciinema/compile-from-source.cast"
-              cols="133"
-              rows="32"
-              idleTimeLimit={1}
-              showButton={true}
-              buttonText="Read Docs"
-              onPress={() => {
-                router.push({
-                  pathname: "/docs",
-                  query: { name: "Compile from Source" },
-                });
-              }}
-            />
-          </div>
+              <TutorialCard
+                name="Compile from Source"
+                description="Build a development copy and understand the toolchain."
+                asciiCast="/asciinema/compile-from-source.cast"
+                cols="133"
+                rows="32"
+                idleTimeLimit={1}
+                hideControls
+                showButton={true}
+                buttonText="Read guide"
+                onPress={() => {
+                  router.push({
+                    pathname: "/docs",
+                    query: { name: "Compile from Source" },
+                  });
+                }}
+              />
+            </div>
+          </section>
         </div>
       </div>
-
-      <div className="col-span-12 mb-8"></div>
-    </div>
+    </>
   );
 }

docs/sliver-docs/pages/search/index.tsx

@@ -1,66 +1,165 @@
-import MarkdownViewer from "@/components/markdown";
-import { useSearchContext } from "@/util/search-context";
-import { faChevronCircleRight } from "@fortawesome/free-solid-svg-icons";
+import LoadingState from "@/components/loading-state";
+import { PREBUILD_VERSION } from "@/util/__generated__/prebuild-version";
+import { fetchDocs as fetchDocsContent } from "@/util/content-fetchers";
+import { SearchCtx } from "@/util/search-context";
+import {
+  faChevronRight,
+  faMagnifyingGlass,
+} from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-import { Button, Card, Separator } from "@heroui/react";
+import { Button, Card, SearchField } from "@heroui/react";
+import { useQuery } from "@tanstack/react-query";
 import { NextPage } from "next";
+import Head from "next/head";
 import { useSearchParams } from "next/navigation";
 import { useRouter } from "next/router";
 import React from "react";
 
 export type SearchPageProps = {};
 
+const createExcerpt = (markdown: string) => {
+  return markdown
+    .replace(/```[\s\S]*?```/g, " ")
+    .replace(/!\[[^\]]*\]\([^)]*\)/g, " ")
+    .replace(/\[([^\]]+)\]\([^)]*\)/g, "$1")
+    .replace(/[#>*_`~|-]/g, " ")
+    .replace(/\s+/g, " ")
+    .trim()
+    .slice(0, 240);
+};
+
 const SearchPage: NextPage = (props: SearchPageProps) => {
   const router = useRouter();
-  const search = useSearchContext();
-  const query = useSearchParams().get("search");
+  const query = useSearchParams().get("search")?.trim() || "";
+  const { data: docs, isLoading } = useQuery({
+    queryKey: ["docs", PREBUILD_VERSION],
+    queryFn: () => fetchDocsContent(PREBUILD_VERSION),
+  });
+
+  const docsSearch = React.useMemo(() => {
+    const search = new SearchCtx();
+    if (docs) {
+      search.addDocs(docs);
+    }
+    return search;
+  }, [docs]);
 
   const searchResults = React.useMemo(() => {
     if (query) {
-      return search.searchDocs(query);
+      return docsSearch.searchDocs(query);
     }
     return [];
-  }, [query, search]);
+  }, [docsSearch, query]);
+
+  if (isLoading || !docs) {
+    return <LoadingState />;
+  }
 
   return (
-    <div className="px-4 pb-8 pt-4">
-      <div className="mx-auto flex w-full max-w-5xl flex-col gap-4">
-        <div className="text-3xl">
-          Search: &quot;{query?.slice(0, 50)}&quot;
-          <div className="text-sm text-gray-500">
-            {searchResults.length} Results
+    <>
+      <Head>
+        <title>{query ? `Search: ${query} · Sliver Docs` : "Search · Sliver Docs"}</title>
+      </Head>
+      <div className="mx-auto w-full max-w-5xl px-4 pb-20 pt-12 sm:px-6 lg:px-8 lg:pt-16">
+        <header className="max-w-3xl">
+          <p className="text-sm font-medium text-accent">Search the reference</p>
+          <h1 className="mt-2 text-balance text-4xl font-semibold tracking-tight text-foreground sm:text-5xl">
+            Find exactly what you need.
+          </h1>
+          <p className="mt-4 text-lg leading-8 text-muted">
+            Search configuration, workflows, transports, extensions, and
+            troubleshooting notes across the Sliver documentation.
+          </p>
+        </header>
+
+        <SearchField
+          key={query}
+          aria-label="Search documentation"
+          className="mt-8 max-w-2xl"
+          defaultValue={query}
+          fullWidth
+          onClear={() => router.push("/search")}
+          onSubmit={(value) => {
+            const nextQuery = value.trim();
+            if (nextQuery) {
+              router.push({ pathname: "/search", query: { search: nextQuery } });
+            }
+          }}
+        >
+          <SearchField.Group>
+            <SearchField.SearchIcon>
+              <FontAwesomeIcon icon={faMagnifyingGlass} />
+            </SearchField.SearchIcon>
+            <SearchField.Input placeholder="Search documentation…" />
+            <SearchField.ClearButton aria-label="Clear search" />
+          </SearchField.Group>
+        </SearchField>
+
+        <div className="mt-10 flex items-end justify-between gap-4">
+          <div>
+            <h2 className="text-2xl font-semibold text-foreground">
+              {query ? `Results for “${query.slice(0, 50)}”` : "Search results"}
+            </h2>
+            <p className="mt-1 text-sm tabular-nums text-muted">
+              {searchResults.length} {searchResults.length === 1 ? "result" : "results"}
+            </p>
           </div>
         </div>
 
-        {searchResults.map((doc) => (
-          <Card key={doc.name}>
-            <Card.Content className="flex flex-col gap-3">
-              <div className="flex flex-col gap-3 sm:flex-row sm:items-center">
-                <span className="text-xl">{doc.name}</span>
-                <div className="flex-1"></div>
+        {searchResults.length > 0 ? (
+          <div className="mt-5 grid gap-4">
+            {searchResults.map((doc) => (
+              <Card key={doc.name}>
+                <Card.Header>
+                  <Card.Title>{doc.name}</Card.Title>
+                  <Card.Description className="mt-1 max-w-3xl leading-6">
+                    {createExcerpt(doc.content) || "Open this article in the Sliver reference."}
+                    {doc.content.length > 240 ? "…" : ""}
+                  </Card.Description>
+                </Card.Header>
+                <Card.Footer>
+                  <Button
+                    variant="ghost"
+                    onPress={() => {
+                      router.push({ pathname: "/docs", query: { name: doc.name } });
+                    }}
+                  >
+                    Open article
+                    <FontAwesomeIcon icon={faChevronRight} />
+                  </Button>
+                </Card.Footer>
+              </Card>
+            ))}
+          </div>
+        ) : (
+          <Card className="mt-5">
+            <Card.Content className="flex flex-col items-start gap-3 p-8">
+              <span className="flex size-10 items-center justify-center rounded-2xl bg-surface-secondary text-accent">
+                <FontAwesomeIcon icon={faMagnifyingGlass} />
+              </span>
+              <div>
+                <h2 className="text-lg font-semibold text-foreground">
+                  {query ? "No matching documentation" : "Start with a keyword"}
+                </h2>
+                <p className="mt-1 max-w-xl text-sm leading-6 text-muted">
+                  {query
+                    ? "Try a command name, transport, feature, or a shorter phrase."
+                    : "Search for topics like staging, WireGuard, profiles, or extensions."}
+                </p>
+              </div>
+              {query ? (
                 <Button
-                  size="sm"
-                  variant="secondary"
-                  className="w-full sm:w-[150px]"
-                  onPress={() => {
-                    router.push(`/docs?name=${doc.name}`);
-                  }}
+                  variant="outline"
+                  onPress={() => router.push("/docs")}
                 >
-                  Full Doc
-                  <FontAwesomeIcon icon={faChevronCircleRight} />
+                  Browse all documentation
                 </Button>
-              </div>
-
-              <Separator />
-
-              <div className="max-h-[200px] overflow-hidden">
-                <MarkdownViewer markdown={doc.content} />
-              </div>
+              ) : null}
             </Card.Content>
           </Card>
-        ))}
+        )}
       </div>
-    </div>
+    </>
   );
 };
 

docs/sliver-docs/pages/talks/index.tsx

@@ -1,7 +1,7 @@
 import Youtube from "@/components/youtube";
-import { faChevronRight } from "@fortawesome/free-solid-svg-icons";
+import { faArrowUpRightFromSquare } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-import { Accordion, Button, Card } from "@heroui/react";
+import { Accordion, Card } from "@heroui/react";
 import { NextPage } from "next";
 import Head from "next/head";
 import React from "react";
@@ -21,7 +21,7 @@ type TalkSection = {
 
 const workshopTalks: Talk[] = [
   {
-    title:"Getting Started with Sliver v1.6",
+    title: "Getting Started with Sliver v1.6",
     description: "Introductory workshop covering basics and new features.",
     url: "https://www.youtube.com/watch?v=IOiyXYp1lDc",
   },
@@ -47,7 +47,7 @@ const generalTradecraftTalks: Talk[] = [
     title: "The Sliver C2 Framework",
     description: "General discussion of C2 design.",
     url: "https://www.youtube.com/watch?v=tkjMZuZ_8nw",
-  }
+  },
 ];
 
 const communityTalks: Talk[] = [
@@ -100,81 +100,124 @@ const talkSections: TalkSection[] = [
 ];
 
 const TalksIndexPage: NextPage = () => {
-  const [footerHidden, setFooterHidden] = React.useState<Record<string, boolean>>(
-    {}
-  );
-  const actionButtonClassName =
-    "ml-auto h-auto min-h-0 shrink-0 px-0 py-0 text-sm font-semibold [--button-bg-hover:transparent] [--button-bg-pressed:transparent] [--button-bg:transparent] [--button-fg:var(--warning)]";
+  const [overlayHidden, setOverlayHidden] = React.useState<
+    Record<string, boolean>
+  >({});
 
-  const hideFooterFor = React.useCallback((url: string) => {
-    setFooterHidden((prev) => (prev[url] ? prev : { ...prev, [url]: true }));
+  const hideOverlayFor = React.useCallback((url: string) => {
+    setOverlayHidden((current) =>
+      current[url] ? current : { ...current, [url]: true },
+    );
   }, []);
 
   return (
     <>
       <Head>
         <title>Sliver Talks</title>
+        <meta
+          name="description"
+          content="Sliver workshops, technical talks, and community videos."
+        />
       </Head>
-      <div className="mt-6 px-4 pb-8 sm:px-6 lg:px-12">
-        <Accordion
-          allowsMultipleExpanded
-          defaultExpandedKeys={["workshops", "general-tradecraft"]}
-          hideSeparator
-          className="px-0"
-        >
-          {talkSections.map((section) => (
-            <Accordion.Item
-              key={section.key}
-              id={section.key}
-            >
-              <Accordion.Heading>
-                <Accordion.Trigger>
-                  <span className="flex flex-col items-start text-left">
-                    <span className="text-lg font-semibold">{section.title}</span>
-                    <span className="text-sm text-muted">{section.description}</span>
-                  </span>
-                  <Accordion.Indicator className="ml-auto" />
-                </Accordion.Trigger>
-              </Accordion.Heading>
-              <Accordion.Panel>
-                <Accordion.Body>
-              <div className="grid grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-9">
-                {section.talks.map((talk) => (
-                  <div key={talk.url} className="sm:col-span-1 lg:col-span-3">
-                    <Card className="relative z-0 gap-0 overflow-hidden p-0">
-                      <Youtube
-                        className="w-full"
-                        url={talk.url}
-                        title={talk.title}
-                        onPlay={() => hideFooterFor(talk.url)}
-                      />
 
-                      {footerHidden[talk.url] ? null : (
-                        <Card.Footer className="absolute bottom-0 left-0 right-0 z-10 border-t border-white/20 bg-black/40 p-3 backdrop-blur-md">
-                          <div className="flex min-h-10 w-full items-center gap-4">
-                            <p className="min-w-0 flex-1 text-sm leading-snug text-white/80">{talk.description}</p>
-                            <Button
-                              variant="ghost"
-                              size="sm"
-                              className={actionButtonClassName}
-                              onPress={() => {
-                                window.open(talk.url, "_blank", "noopener,noreferrer");
-                              }}
-                            >
-                              Watch <FontAwesomeIcon icon={faChevronRight} />
-                            </Button>
-                          </div>
-                        </Card.Footer>
-                      )}
-                    </Card>
-                  </div>
-                ))}
-              </div>
-                </Accordion.Body>
-              </Accordion.Panel>
-            </Accordion.Item>
-          ))}
-        </Accordion>
+      <div className="relative overflow-hidden">
+        <div className="sliver-grid-surface pointer-events-none absolute inset-x-0 top-0 h-72 opacity-35" />
+
+        <div className="relative mx-auto w-full max-w-7xl px-4 pb-20 pt-8 sm:px-6 sm:pt-10 lg:px-8 lg:pt-12">
+          <header className="mb-6 max-w-3xl">
+            <p className="text-sm font-medium text-accent">Talks &amp; workshops</p>
+            <h1 className="mt-1 text-balance text-3xl font-semibold tracking-tight text-foreground sm:text-4xl">
+              Watch Sliver in the field.
+            </h1>
+            <p className="mt-3 max-w-2xl text-base leading-7 text-muted">
+              Practical workshops, technical deep dives, and community sessions
+              collected in one compact library.
+            </p>
+          </header>
+
+          <Accordion
+            allowsMultipleExpanded
+            defaultExpandedKeys={["workshops", "general-tradecraft"]}
+            hideSeparator
+            className="w-full px-0"
+          >
+            {talkSections.map((section) => (
+              <Accordion.Item key={section.key} id={section.key}>
+                <Accordion.Heading>
+                  <Accordion.Trigger>
+                    <span className="flex flex-col items-start text-left">
+                      <span className="flex items-center gap-2 text-lg font-semibold text-foreground">
+                        {section.title}
+                        <span className="text-xs font-normal tabular-nums text-muted">
+                          {section.talks.length}
+                        </span>
+                      </span>
+                      <span className="mt-1 text-sm text-muted">
+                        {section.description}
+                      </span>
+                    </span>
+                    <Accordion.Indicator className="ml-auto" />
+                  </Accordion.Trigger>
+                </Accordion.Heading>
+
+                <Accordion.Panel>
+                  <Accordion.Body>
+                    <div className="grid grid-cols-1 gap-4 md:grid-cols-2 xl:grid-cols-3">
+                      {section.talks.map((talk) => (
+                        <Card
+                          key={talk.url}
+                          className="relative z-0 gap-0 overflow-hidden bg-black p-0 shadow-surface"
+                        >
+                          <Youtube
+                            className="w-full"
+                            url={talk.url}
+                            title={talk.title}
+                            onInteract={() => hideOverlayFor(talk.url)}
+                            onPlay={() => hideOverlayFor(talk.url)}
+                          />
+
+                          {overlayHidden[talk.url] ? null : (
+                            <>
+                              <div
+                                aria-hidden="true"
+                                className="pointer-events-none absolute inset-x-0 bottom-0 h-32 bg-gradient-to-t from-black/85 via-black/35 to-transparent"
+                              />
+                              <div className="pointer-events-none absolute inset-x-3 bottom-3 z-10">
+                                <div className="flex items-end gap-3 rounded-2xl border border-white/15 bg-black/55 p-3 text-white shadow-xl backdrop-blur-xl">
+                                  <div className="min-w-0 flex-1">
+                                    <h3 className="text-sm font-semibold leading-snug text-white">
+                                      {talk.title}
+                                    </h3>
+                                    <p className="mt-0.5 truncate text-xs text-white/65">
+                                      {talk.description}
+                                    </p>
+                                  </div>
+                                  <a
+                                    href={talk.url}
+                                    target="_blank"
+                                    rel="noreferrer"
+                                    aria-label={`Watch ${talk.title} on YouTube`}
+                                    className="pointer-events-auto inline-flex min-h-9 shrink-0 items-center gap-1.5 rounded-xl px-2.5 text-xs font-semibold text-white no-underline outline-none transition-colors hover:bg-white/10 focus-visible:ring-2 focus-visible:ring-white/70"
+                                  >
+                                    Watch
+                                    <FontAwesomeIcon
+                                      className="text-[10px]"
+                                      icon={faArrowUpRightFromSquare}
+                                    />
+                                  </a>
+                                </div>
+                              </div>
+                            </>
+                          )}
+                        </Card>
+                      ))}
+                    </div>
+                  </Accordion.Body>
+                </Accordion.Panel>
+              </Accordion.Item>
+            ))}
+          </Accordion>
+        </div>
       </div>
     </>
   );

docs/sliver-docs/pages/tutorials/index.tsx

@@ -3,14 +3,18 @@ import LoadingState from "@/components/loading-state";
 import { Tutorials } from "@/util/tutorials";
 import { PREBUILD_VERSION } from "@/util/__generated__/prebuild-version";
 import { fetchTutorials as fetchTutorialsContent } from "@/util/content-fetchers";
-import { faSearch } from "@fortawesome/free-solid-svg-icons";
+import {
+  faChevronRight,
+  faGraduationCap,
+  faSearch,
+} from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import {
+  Button,
   Card,
   ListBox,
   ScrollShadow,
   SearchField,
-  Separator,
 } from "@heroui/react";
 import { useQuery } from "@tanstack/react-query";
 import Fuse from "fuse.js";
@@ -70,13 +74,14 @@ const TutorialsIndexPage: NextPage = () => {
   }, [name, tutorials, visibleTutorials]);
 
   const listboxClasses =
-    "p-0 gap-0 divide-y divide-separator bg-surface overflow-visible rounded-lg shadow-sm";
+    "flex flex-col gap-1 overflow-visible bg-transparent p-0";
 
   const renderFilterInput = (className?: string) => (
     <SearchField
       aria-label="Filter tutorials"
       className={className}
       fullWidth
+      variant="secondary"
       value={filterValue}
       onChange={setFilterValue}
     >
@@ -99,87 +104,146 @@ const TutorialsIndexPage: NextPage = () => {
   return (
     <>
       <Head>
-        <title>Sliver Tutorial: {name}</title>
+        <title>{name ? `${name} · Sliver Tutorials` : "Sliver Tutorials"}</title>
       </Head>
-      <div className="px-4 pt-4 lg:hidden">
-        <label
-          htmlFor="tutorials-mobile-selector"
-          className="block text-sm font-medium text-foreground"
-        >
-          Select a tutorial
-        </label>
-        <div className="mt-2">{renderFilterInput()}</div>
-        <select
-          id="tutorials-mobile-selector"
-          className="mt-3 w-full rounded-lg border border-separator bg-surface p-2 text-sm"
-          value={name}
-          onChange={(event) => {
-            const selectedName = event.target.value;
-            router.push({
-              pathname: "/tutorials",
-              query: selectedName ? { name: selectedName } : undefined,
-            });
-          }}
-        >
-          <option value="">Browse tutorials…</option>
-          {mobileTutorials.map((tutorial) => (
-            <option key={tutorial.name} value={tutorial.name}>
-              {tutorial.name}
-            </option>
-          ))}
-        </select>
-      </div>
-      <div className="grid grid-cols-1 gap-6 lg:grid-cols-12 lg:gap-8">
-        <aside className="hidden lg:block lg:col-span-3">
-          <div className="sticky top-16 ml-4 flex flex-col gap-3">
-            {renderFilterInput("mt-2")}
-            <ScrollShadow className="max-h-[calc(100vh-6rem)] sliver-scrollbar overflow-y-auto pr-1 rounded-lg">
-              <ListBox
-                aria-label="Toolbox Menu"
-                className={listboxClasses}
-                onAction={(key) => {
-                  router.push({
-                    pathname: "/tutorials",
-                    query: { name: String(key) },
-                  });
-                }}
-              >
-                {visibleTutorials.map((tutorial) => (
-                  <ListBox.Item
-                    key={tutorial.name}
-                    id={tutorial.name}
-                    textValue={tutorial.name}
-                    className="h-12 rounded-none px-3 first:rounded-t-lg last:rounded-b-lg"
-                  >
-                    {tutorial.name}
-                  </ListBox.Item>
-                ))}
-              </ListBox>
-            </ScrollShadow>
+      <div className="mx-auto w-full max-w-[90rem] px-4 pt-8 sm:px-6 lg:px-8 lg:pt-10">
+        <div className="mb-8 lg:hidden">
+          <div className="flex items-center gap-3">
+            <span className="flex size-9 items-center justify-center rounded-2xl bg-surface-secondary text-accent">
+              <FontAwesomeIcon icon={faGraduationCap} />
+            </span>
+            <div>
+              <p className="text-sm font-medium text-foreground">Tutorials</p>
+              <p className="text-xs text-muted">Follow a guided workflow</p>
+            </div>
           </div>
-        </aside>
-        <div className="px-4 pb-8 lg:col-span-9 lg:px-8">
-          {name !== "" ? (
-            <Card className="mt-2">
-              <Card.Header>
-                <span className="text-3xl">{name}</span>
-              </Card.Header>
-              <Separator />
-              <Card.Content>
+          <div className="mt-5">{renderFilterInput()}</div>
+          <label
+            htmlFor="tutorials-mobile-selector"
+            className="mt-4 block text-sm font-medium text-foreground"
+          >
+            Tutorial
+          </label>
+          <select
+            id="tutorials-mobile-selector"
+            className="mt-2 w-full rounded-2xl border border-transparent bg-surface-secondary px-3 py-2.5 text-sm text-foreground outline-none focus:border-accent"
+            value={name}
+            onChange={(event) => {
+              const selectedName = event.target.value;
+              router.push({
+                pathname: "/tutorials",
+                query: selectedName ? { name: selectedName } : undefined,
+              });
+            }}
+          >
+            <option value="">Browse tutorials…</option>
+            {mobileTutorials.map((tutorial) => (
+              <option key={tutorial.name} value={tutorial.name}>
+                {tutorial.name}
+              </option>
+            ))}
+          </select>
+        </div>
+
+        <div className="grid min-w-0 grid-cols-1 gap-8 lg:grid-cols-[17rem_minmax(0,1fr)] lg:gap-10">
+          <aside className="sliver-sticky-sidebar hidden border-r border-separator/70 pr-6 lg:block">
+            <div className="flex h-full min-h-0 flex-col gap-5">
+              <div className="flex items-center gap-3 px-1">
+                <span className="flex size-9 items-center justify-center rounded-2xl bg-surface-secondary text-accent">
+                  <FontAwesomeIcon icon={faGraduationCap} />
+                </span>
+                <div>
+                  <p className="text-sm font-medium text-foreground">Tutorials</p>
+                  <p className="text-xs text-muted">
+                    {tutorials.tutorials.length} chapters
+                  </p>
+                </div>
+              </div>
+              {renderFilterInput()}
+              <ScrollShadow className="sliver-scrollbar min-h-0 flex-1 overscroll-contain overflow-y-auto pr-2">
+                <ListBox
+                  aria-label="Tutorials"
+                  className={listboxClasses}
+                  selectedKeys={name ? [name] : []}
+                  selectionMode="single"
+                >
+                  {visibleTutorials.map((tutorial) => (
+                    <ListBox.Item
+                      key={tutorial.name}
+                      id={tutorial.name}
+                      href={`/tutorials/?name=${encodeURIComponent(tutorial.name)}`}
+                      textValue={tutorial.name}
+                      className={`min-h-10 rounded-xl px-3 py-2 text-sm ${
+                        tutorial.name === name
+                          ? "bg-surface font-medium text-foreground shadow-surface"
+                          : "text-muted"
+                      }`}
+                    >
+                      {tutorial.name}
+                    </ListBox.Item>
+                  ))}
+                </ListBox>
+              </ScrollShadow>
+            </div>
+          </aside>
+
+          <div
+            key={name || "tutorials-overview"}
+            className="min-w-0 pb-16 lg:pr-4"
+          >
+            {name !== "" ? (
+              <article className="mx-auto w-full max-w-4xl">
+                <header className="mb-8 border-b border-separator/70 pb-8">
+                  <p className="text-sm font-medium text-accent">Tutorial</p>
+                  <h1 className="mt-2 text-balance text-4xl font-semibold tracking-tight text-foreground sm:text-5xl">
+                    {name}
+                  </h1>
+                </header>
                 <MarkdownViewer
                   key={name}
                   markdown={markdown || ""}
+                  demoteTopLevelHeading
                 />
-              </Card.Content>
-            </Card>
-          ) : (
-            <div className="mt-8 text-center text-2xl text-foreground/90">
-              Welcome to the Sliver Tutorials!
-              <div className="mt-2 text-xl text-muted">
-                Please select a chapter
+              </article>
+            ) : (
+              <div className="mx-auto w-full max-w-5xl pt-4 lg:pt-8">
+                <h1 className="text-sm font-medium text-accent">
+                  Guided learning
+                </h1>
+                <p className="mt-4 max-w-2xl text-lg leading-8 text-muted">
+                  Follow practical walkthroughs covering setup, sessions,
+                  staging, pivots, scripting, and post-exploitation workflows.
+                </p>
+
+                <div className="mt-10 grid gap-4 sm:grid-cols-2">
+                  {tutorials.tutorials.slice(0, 6).map((tutorial) => (
+                    <Card key={tutorial.name} className="h-full">
+                      <Card.Header>
+                        <Card.Title>{tutorial.name}</Card.Title>
+                        <Card.Description>
+                          Continue through this guided Sliver workflow.
+                        </Card.Description>
+                      </Card.Header>
+                      <Card.Footer className="mt-auto">
+                        <Button
+                          variant="ghost"
+                          onPress={() => {
+                            router.push({
+                              pathname: "/tutorials",
+                              query: { name: tutorial.name },
+                            });
+                          }}
+                        >
+                          Start tutorial
+                          <FontAwesomeIcon icon={faChevronRight} />
+                        </Button>
+                      </Card.Footer>
+                    </Card>
+                  ))}
+                </div>
               </div>
-            </div>
-          )}
+            )}
+          </div>
         </div>
       </div>
     </>

docs/sliver-docs/public/install

@@ -9,20 +9,31 @@ if [[ "$EUID" -ne 0 ]];then
     exit
 fi
 
+# Only include minisign in the package list when it isn't already on PATH.
+# The minisign apt package isn't in the default Ubuntu 22.04 repos, but
+# users often install it manually to /usr/local/bin first; without this
+# guard the apt-get call below fails the whole script (issue #2239).
+MINISIGN_PKG=(minisign)
+if command -v minisign &> /dev/null; then
+    MINISIGN_PKG=()
+fi
+
 # Determine OS type
 # Debian-based OS (Debian, Ubuntu, etc)
 if command -v apt-get &> /dev/null; then
     echo "Installing dependencies using apt..."
     DEBIAN_FRONTEND=noninteractive apt-get install -yqq \
-        minisign curl build-essential git
-    	INSTALLER=(apt-get install -yqq)
+        "${MINISIGN_PKG[@]}" curl build-essential git
+    INSTALLER=(apt-get install -yqq)
 elif command -v yum &> /dev/null; then # Redhat-based OS (Fedora, CentOS, RHEL)
     echo "Installing dependencies using yum..."
-    yum -y install minisign curl make git
-	INSTALLER=(yum -y)
+    yum -y install "${MINISIGN_PKG[@]}" curl make git
+    INSTALLER=(yum -y)
 elif command -v pacman &>/dev/null; then # Arch-based (Manjaro, Garuda, Blackarch)
-	echo "Installing dependencies using pacman..."
-	pacman --noconfirm -S minisign
+    echo "Installing dependencies using pacman..."
+    if [[ ${#MINISIGN_PKG[@]} -gt 0 ]]; then
+        pacman --noconfirm -S "${MINISIGN_PKG[@]}"
+    fi
     INSTALLER=(pacman --noconfirm -S)
 else
     echo "Unsupported OS, exiting"
@@ -31,9 +42,9 @@ fi
 
 # Verify if necessary tools are installed
 for cmd in curl awk minisign; do
-    if ! command -v "$cmd" &> /dev/null; then		
+    if ! command -v "$cmd" &> /dev/null; then
         echo "$cmd could not be found, installing..."
-		${INSTALLER[@]} "$cmd"
+        ${INSTALLER[@]} "$cmd"
     fi
 done
 

docs/sliver-docs/styles/globals.css

@@ -6,14 +6,39 @@
 :root {
   --font-mono: "Fira Code", ui-monospace, SFMono-Regular, Menlo, Monaco,
     Consolas, "Liberation Mono", "Courier New", monospace;
+  --sliver-navbar-height: 4rem;
+  --sliver-footer-height: 4.75rem;
 }
 
-/*
-  Keep html as the single scrolling element. Setting overflow on both html
-  and body breaks sticky sidebar behavior on docs/tutorial pages.
-*/
+/* Keep html as the single page scroller so content can pass beneath the shell. */
 html {
   overflow-y: scroll;
+  scroll-padding-top: calc(var(--sliver-navbar-height) + 1.5rem);
+  scroll-padding-bottom: calc(
+    var(--sliver-footer-height) + env(safe-area-inset-bottom)
+  );
+}
+
+body {
+  min-height: 100dvh;
+  background:
+    radial-gradient(circle at 12% -10%, color-mix(in oklab, var(--accent) 12%, transparent), transparent 28rem),
+    radial-gradient(circle at 88% 4%, color-mix(in oklab, var(--surface-tertiary) 55%, transparent), transparent 26rem),
+    var(--background);
+}
+
+.sliver-page-content {
+  padding-bottom: calc(
+    var(--sliver-footer-height) + env(safe-area-inset-bottom)
+  );
+}
+
+.sliver-fixed-footer {
+  padding-bottom: env(safe-area-inset-bottom);
+}
+
+::selection {
+  background: color-mix(in oklab, var(--accent) 32%, transparent);
 }
 
 /* Fallback for engines that do not support scrollbar-gutter. */
@@ -31,6 +56,22 @@ html {
   html {
     overflow-y: scroll;
   }
+
+  .sliver-sticky-sidebar {
+    position: sticky;
+    top: calc(var(--sliver-navbar-height) + 2.5rem);
+    align-self: start;
+    height: calc(
+      100dvh - var(--sliver-navbar-height) - var(--sliver-footer-height) -
+        env(safe-area-inset-bottom) - 3.5rem
+    );
+  }
+}
+
+@media (min-width: 768px) {
+  :root {
+    --sliver-footer-height: 3.5rem;
+  }
 }
 
 code,
@@ -44,7 +85,7 @@ pre {
 
 .sliver-scrollbar {
   scrollbar-width: thin;
-  scrollbar-color: rgba(148, 163, 184, 0.7) transparent;
+  scrollbar-color: color-mix(in oklab, var(--muted) 58%, transparent) transparent;
   scrollbar-gutter: stable;
 }
 
@@ -57,33 +98,35 @@ pre {
 }
 
 .sliver-scrollbar::-webkit-scrollbar-thumb {
-  background-color: rgba(148, 163, 184, 0.7);
+  background-color: color-mix(in oklab, var(--muted) 58%, transparent);
   border-radius: 9999px;
   border: 2px solid transparent;
   background-clip: content-box;
 }
 
-.sliver-navbar-glass {
-  width: 100%;
-  border-bottom: 1px solid var(--separator);
-  background-color: color-mix(in oklab, var(--surface) 72%, transparent);
-  -webkit-backdrop-filter: blur(18px) saturate(1.18);
-  backdrop-filter: blur(18px) saturate(1.18);
+.sliver-grid-surface {
+  background-image:
+    linear-gradient(color-mix(in oklab, var(--separator) 35%, transparent) 1px, transparent 1px),
+    linear-gradient(90deg, color-mix(in oklab, var(--separator) 35%, transparent) 1px, transparent 1px);
+  background-size: 32px 32px;
+  mask-image: linear-gradient(to bottom, black, transparent 92%);
 }
 
-.sliver-armory-ghost {
-  --button-bg: transparent;
-  --button-bg-hover: rgb(109 40 217 / 0.16);
-  --button-bg-pressed: rgb(109 40 217 / 0.24);
-  --button-fg: #a78bfa;
+.sliver-terminal-frame .ap-wrapper {
+  border-radius: 0 !important;
 }
 
-.dark .sliver-scrollbar {
-  scrollbar-color: rgba(79, 97, 125, 0.8) transparent;
+.sliver-asciinema-bottom-aligned .ap-wrapper {
+  align-items: flex-end;
+  justify-content: flex-start;
 }
 
-.dark .sliver-scrollbar::-webkit-scrollbar-thumb {
-  background-color: rgba(79, 97, 125, 0.8);
+.sliver-terminal-frame .asciinema-player {
+  background: #111315;
+}
+
+.sliver-asciinema-controls-hidden .ap-control-bar {
+  display: none !important;
 }
 
 .asciinema-player {
@@ -94,3 +137,19 @@ pre {
 .asciinema-player .asciinema-terminal {
   max-width: 100% !important;
 }
+
+.markdown-body {
+  color: var(--foreground);
+}
+
+.markdown-body :where(h2, h3, h4) {
+  scroll-margin-top: calc(var(--sliver-navbar-height) + 1.5rem);
+}
+
+@media (prefers-reduced-motion: reduce) {
+  *,
+  *::before,
+  *::after {
+    scroll-behavior: auto !important;
+  }
+}

go-tests.ps1

@@ -367,6 +367,13 @@ try {
     }
 
     if (-not $SkipGenerate) {
+        # The package tests above no longer need their Go build cache. Reclaim it
+        # before the cross-platform generation matrix starts so long CI runs do
+        # not exhaust the runner's disk while retaining the implant compiler cache.
+        Invoke-TestStep -Name "clean Go build cache" -Action {
+            Invoke-ExternalCommand -FilePath "go" -Arguments @("clean", "-cache")
+        }
+
         $generateGoMaxProcs = if ($env:SLIVER_GENERATE_GOMAXPROCS) { $env:SLIVER_GENERATE_GOMAXPROCS } else { "2" }
         $generateGoP = if ($env:SLIVER_GENERATE_GO_P) { $env:SLIVER_GENERATE_GO_P } else { "1" }
         $generateTestParallel = if ($env:SLIVER_GENERATE_TEST_PARALLEL) { $env:SLIVER_GENERATE_TEST_PARALLEL } else { "1" }

go-tests.sh

@@ -125,19 +125,29 @@ run_test_cmd() {
 should_skip_package() {
 	local pkg="$1"
 	local tags="${2:-}"
-	local go_list_cmd=(go list -e -f '{{if .Error}}{{.Error}}{{end}}')
-	if [ -n "$tags" ]; then
-		go_list_cmd+=("-tags=$tags")
-	fi
-	go_list_cmd+=("$pkg")
-
 	local go_list_error
-	go_list_error="$("${go_list_cmd[@]}" 2>/dev/null || true)"
+	local test_file_counts
+	if [ -n "$tags" ]; then
+		go_list_error="$(go list -e -f '{{if .Error}}{{.Error}}{{end}}' "-tags=$tags" "$pkg" 2>/dev/null || true)"
+		test_file_counts="$(go list -e -f '{{len .TestGoFiles}} {{len .XTestGoFiles}}' "-tags=$tags" "$pkg" 2>/dev/null || true)"
+	else
+		go_list_error="$(go list -e -f '{{if .Error}}{{.Error}}{{end}}' "$pkg" 2>/dev/null || true)"
+		test_file_counts="$(go list -e -f '{{len .TestGoFiles}} {{len .XTestGoFiles}}' "$pkg" 2>/dev/null || true)"
+	fi
 	if [[ "$go_list_error" == *"build constraints exclude all Go files"* ]]; then
 		echo
 		echo "==> Skipping $pkg (unsupported on current platform)"
 		return 0
 	fi
+
+	# File discovery intentionally sees tests for every OS. Avoid forcing a
+	# package build when all of its tests are excluded by the current target's
+	# build constraints; those tests remain discoverable on their target OS.
+	if [ "$test_file_counts" = "0 0" ]; then
+		echo
+		echo "==> Skipping $pkg (no tests for current platform)"
+		return 0
+	fi
 	return 1
 }
 
@@ -145,7 +155,7 @@ collect_test_dirs() {
 	if command -v rg >/dev/null 2>&1; then
 		rg --files -g '*_test.go'
 	else
-		find client implant server util -type f -name '*_test.go' -print
+		find client implant server test util -type f -name '*_test.go' -print
 	fi
 }
 
@@ -169,6 +179,7 @@ done < <(collect_test_dirs | xargs -n1 dirname | sort -u)
 CLIENT_TEST_PKGS=()
 IMPLANT_TEST_PKGS=()
 SERVER_UTIL_TEST_PKGS=()
+E2E_SUPPORT_TEST_PKGS=()
 
 for test_dir in "${TEST_DIRS[@]}"; do
 	pkg="./$test_dir"
@@ -185,6 +196,9 @@ for test_dir in "${TEST_DIRS[@]}"; do
 	./server/* | ./util*)
 		SERVER_UTIL_TEST_PKGS+=("$pkg")
 		;;
+	./test/e2e | ./test/e2e/*)
+		E2E_SUPPORT_TEST_PKGS+=("$pkg")
+		;;
 	esac
 done
 
@@ -196,6 +210,15 @@ for pkg in "${CLIENT_TEST_PKGS[@]}"; do
 	run_test_cmd "$pkg" go test -tags="client,$TAGS" "$pkg" || exit 1
 done
 
+## Comprehensive E2E support packages. The top-level lifecycle test skips
+## unless a server binary is supplied; coverage/report unit tests run here.
+for pkg in "${E2E_SUPPORT_TEST_PKGS[@]}"; do
+	if should_skip_package "$pkg" "client,$TAGS"; then
+		continue
+	fi
+	run_test_cmd "$pkg" go test -tags="client,$TAGS" "$pkg" || exit 1
+done
+
 ## Implant
 for pkg in "${IMPLANT_TEST_PKGS[@]}"; do
 	if should_skip_package "$pkg"; then
@@ -234,6 +257,10 @@ fi
 
 ## Server generate
 if [ "$SKIP_GENERATE" -eq 0 ]; then
+	# The package tests above no longer need their Go build cache. Reclaim it
+	# before the cross-platform generation matrix starts so long CI runs do not
+	# exhaust the runner's disk while retaining the implant compiler cache.
+	run_test_cmd "clean Go build cache" go clean -cache || exit 1
 	export GOPROXY=off
 	# Generate tests are memory intensive (garble/c-shared cross-builds). Keep
 	# parallelism conservative by default to avoid OOM kills on smaller systems.

go.mod

@@ -1,6 +1,6 @@
 module github.com/bishopfox/sliver
 
-go 1.25.8
+go 1.26.6
 
 replace github.com/rsteube/carapace v0.36.3 => github.com/reeflective/carapace v0.46.3-0.20231214181515-27e49f3c3b69
 
@@ -10,14 +10,12 @@ replace github.com/reeflective/console => github.com/moloch--/console v0.0.0-202
 
 require (
 	charm.land/bubbles/v2 v2.0.0
-	charm.land/fantasy v0.8.1
-	charm.land/glamour/v2 v2.0.0
+	charm.land/glamour/v2 v2.0.1
 	charm.land/huh/v2 v2.0.3
-	charm.land/lipgloss/v2 v2.0.2
+	charm.land/lipgloss/v2 v2.0.6
 	filippo.io/age v1.3.1
 	github.com/Binject/binjection v0.0.0-20210701074423-605d46e35deb
 	github.com/Binject/debug v0.0.0-20230508195519-26db73212a7a
-	github.com/Binject/universal v0.0.0-20220519011857-bea739e758c0
 	github.com/Ne0nd0g/go-clr v1.0.3
 	github.com/SherClockHolmes/webpush-go v1.4.0
 	github.com/alecthomas/chroma v0.10.0
@@ -25,6 +23,7 @@ require (
 	github.com/cheggaaa/pb/v3 v3.1.7
 	github.com/chromedp/cdproto v0.0.0-20250803210736-d308e07a266d
 	github.com/chromedp/chromedp v0.14.1
+	github.com/ebitengine/purego v0.10.1
 	github.com/glebarez/sqlite v1.11.0
 	github.com/gofrs/uuid v4.4.0+incompatible
 	github.com/golang/protobuf v1.5.4
@@ -32,7 +31,7 @@ require (
 	github.com/gorilla/mux v1.8.1
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0
 	github.com/hashicorp/yamux v0.1.2
-	github.com/jedib0t/go-pretty/v6 v6.7.8
+	github.com/jedib0t/go-pretty/v6 v6.8.3
 	github.com/kbinani/screenshot v0.0.0-20250624051815-089614a94018
 	github.com/klauspost/compress v1.18.4
 	github.com/lesnuages/go-winio v0.4.19
@@ -40,16 +39,17 @@ require (
 	github.com/mattn/go-sqlite3 v1.14.32
 	github.com/miekg/dns v1.1.70
 	github.com/moloch--/asciicast v0.1.1
-	github.com/moloch--/memmod v0.0.0-20230225130813-fd77d905589e
 	github.com/moloch--/sgn v0.0.5
 	github.com/ncruces/go-sqlite3 v0.30.4
 	github.com/nikoksr/notify v1.5.0
+	github.com/openai/openai-go/v2 v2.7.1
 	github.com/reeflective/console v0.1.25
 	github.com/reeflective/readline v1.1.4
 	github.com/rsteube/carapace v0.50.2
 	github.com/sirupsen/logrus v1.9.4
 	github.com/sliverarmory/beignet v0.0.3
 	github.com/sliverarmory/malasada v0.0.3
+	github.com/sliverarmory/reflektor v0.0.6
 	github.com/sliverarmory/wasm-donut v0.0.3
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
@@ -59,22 +59,23 @@ require (
 	github.com/ulikunitz/xz v0.5.15
 	github.com/xlab/treeprint v1.2.0
 	github.com/yiya1989/sshkrb5 v0.0.1
-	golang.org/x/crypto v0.49.0
+	golang.org/x/crypto v0.53.0
 	golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa
-	golang.org/x/mod v0.33.0
-	golang.org/x/net v0.52.0
-	golang.org/x/sys v0.42.0
-	golang.org/x/term v0.41.0
-	golang.org/x/text v0.35.0
+	golang.org/x/mod v0.37.0
+	golang.org/x/net v0.56.0
+	golang.org/x/sys v0.47.0
+	golang.org/x/term v0.44.0
+	golang.org/x/text v0.40.0
 	golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10
 	google.golang.org/api v0.269.0
-	google.golang.org/grpc v1.79.3
+	google.golang.org/grpc v1.82.1
 	google.golang.org/protobuf v1.36.11
+	gopkg.in/natefinch/lumberjack.v2 v2.2.1
 	gorm.io/driver/mysql v1.6.0
-	gorm.io/driver/postgres v1.6.0
+	gorm.io/driver/postgres v1.6.2
 	gorm.io/driver/sqlite v1.6.0
-	gorm.io/gorm v1.31.0
+	gorm.io/gorm v1.31.2
 	gvisor.dev/gvisor v0.0.0-20250503011706-39ed1f5ac29c
 	maunium.net/go/mautrix v0.26.0
 	modernc.org/sqlite v1.39.0
@@ -93,7 +94,7 @@ require (
 	cloud.google.com/go/storage v1.60.0 // indirect
 	filippo.io/hpke v0.4.0 // indirect
 	firebase.google.com/go/v4 v4.18.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 // indirect
 	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 // indirect
 	github.com/MicahParks/keyfunc v1.9.0 // indirect
@@ -101,7 +102,6 @@ require (
 	github.com/RocketChat/Rocket.Chat.Go.SDK v0.0.0-20250718055228-285ecf400b48 // indirect
 	github.com/appleboy/go-fcm v1.2.6 // indirect
 	github.com/atc0005/go-teams-notify/v2 v2.14.0 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.5 // indirect
 	github.com/aws/aws-sdk-go-v2/credentials v1.19.11 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.19 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.19 // indirect
@@ -125,11 +125,10 @@ require (
 	github.com/caarlos0/go-reddit/v3 v3.0.1 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/charmbracelet/anthropic-sdk-go v0.0.0-20260223140439-63879b0b8dab // indirect
-	github.com/charmbracelet/ultraviolet v0.0.0-20260205113103-524a6607adb8 // indirect
+	github.com/charmbracelet/harmonica v0.2.0 // indirect
+	github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886 // indirect
 	github.com/charmbracelet/x/exp/ordered v0.1.0 // indirect
 	github.com/charmbracelet/x/exp/slice v0.0.0-20250904123553-b4e2667e5ad5 // indirect
-	github.com/charmbracelet/x/json v0.2.0 // indirect
 	github.com/charmbracelet/x/termios v0.1.1 // indirect
 	github.com/charmbracelet/x/windows v0.2.2 // indirect
 	github.com/clipperhouse/displaywidth v0.11.0 // indirect
@@ -146,7 +145,7 @@ require (
 	github.com/fatih/structs v1.1.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.3 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
 	github.com/go-lark/lark v1.16.0 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
@@ -154,8 +153,6 @@ require (
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-redis/redis/v8 v8.11.6-0.20220405070650-99c79f7041fc // indirect
 	github.com/go-telegram-bot-api/telegram-bot-api v4.6.4+incompatible // indirect
-	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
-	github.com/goccy/go-yaml v1.19.2 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
 	github.com/golang-jwt/jwt/v5 v5.3.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
@@ -166,12 +163,9 @@ require (
 	github.com/gorilla/websocket v1.5.3 // indirect
 	github.com/gregdel/pushover v1.4.0 // indirect
 	github.com/invopop/jsonschema v0.13.0 // indirect
+	github.com/joho/godotenv v1.5.1 // indirect
 	github.com/jordan-wright/email v4.0.1-0.20210109023952-943e75fe5223+incompatible // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/kaptinlin/go-i18n v0.2.3 // indirect
-	github.com/kaptinlin/jsonpointer v0.4.9 // indirect
-	github.com/kaptinlin/jsonschema v0.6.10 // indirect
-	github.com/kaptinlin/messageformat-go v0.4.9 // indirect
 	github.com/kevinburke/go-types v0.0.0-20240719050749-165e75e768f7 // indirect
 	github.com/kevinburke/rest v0.0.0-20250718180114-1a15e4f2364f // indirect
 	github.com/kevinburke/twilio-go v0.0.0-20250718182727-5fe7adc01f29 // indirect
@@ -186,7 +180,6 @@ require (
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/oapi-codegen/runtime v1.1.2 // indirect
-	github.com/openai/openai-go/v2 v2.7.1 // indirect
 	github.com/pires/go-proxyproto v0.8.1 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
@@ -195,7 +188,7 @@ require (
 	github.com/sendgrid/rest v2.6.9+incompatible // indirect
 	github.com/sendgrid/sendgrid-go v3.16.1+incompatible // indirect
 	github.com/silenceper/wechat/v2 v2.1.11 // indirect
-	github.com/slack-go/slack v0.17.3 // indirect
+	github.com/slack-go/slack v0.24.0 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
 	github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
 	github.com/stretchr/objx v0.5.3 // indirect
@@ -214,18 +207,17 @@ require (
 	github.com/yuin/goldmark-emoji v1.0.5 // indirect
 	go.mau.fi/util v0.9.3 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/detectors/gcp v1.40.0 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.43.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.65.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 // indirect
-	go.opentelemetry.io/otel v1.40.0 // indirect
-	go.opentelemetry.io/otel/metric v1.40.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.40.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.40.0 // indirect
-	go.opentelemetry.io/otel/trace v1.40.0 // indirect
+	go.opentelemetry.io/otel v1.43.0 // indirect
+	go.opentelemetry.io/otel/metric v1.43.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
+	go.opentelemetry.io/otel/trace v1.43.0 // indirect
 	google.golang.org/appengine/v2 v2.0.6 // indirect
-	google.golang.org/genai v1.49.0 // indirect
 	google.golang.org/genproto v0.0.0-20260226221140-a57be14db171 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect
 	gopkg.in/go-playground/validator.v9 v9.31.0 // indirect
 )
 
@@ -239,17 +231,15 @@ require (
 	github.com/VividCortex/ewma v1.2.0 // indirect
 	github.com/akutz/memconn v0.1.0 // indirect
 	github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e // indirect
-	github.com/atotto/clipboard v0.1.4 // indirect
-	github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0 // indirect
-	github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4 // indirect
+	github.com/atotto/clipboard v0.1.4
 	github.com/aws/aws-sdk-go-v2 v1.41.3 // indirect
 	github.com/aws/aws-sdk-go-v2/config v1.32.11 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssm v1.65.1 // indirect
 	github.com/carapace-sh/carapace v1.11.0
 	github.com/carapace-sh/carapace-shlex v1.1.1 // indirect
 	github.com/catppuccin/go v0.3.0 // indirect
-	github.com/charmbracelet/colorprofile v0.4.2
-	github.com/charmbracelet/x/ansi v0.11.6
+	github.com/charmbracelet/colorprofile v0.4.3
+	github.com/charmbracelet/x/ansi v0.11.8
 	github.com/charmbracelet/x/exp/charmtone v0.0.0-20260109001716-2fbdffcb221f
 	github.com/charmbracelet/x/exp/strings v0.0.0-20240722160745-212f7b056ed0 // indirect
 	github.com/charmbracelet/x/term v0.2.2 // indirect
@@ -281,7 +271,7 @@ require (
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
-	github.com/jackc/pgx/v5 v5.7.6 // indirect
+	github.com/jackc/pgx/v5 v5.10.0 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/jcmturner/gofork v1.7.6 // indirect
 	github.com/jezek/xgb v1.1.1 // indirect
@@ -289,12 +279,12 @@ require (
 	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/jsimonetti/rtnetlink v1.4.2 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
-	github.com/lucasb-eyer/go-colorful v1.3.0
+	github.com/lucasb-eyer/go-colorful v1.4.1
 	github.com/lxn/win v0.0.0-20210218163916-a377121e959e // indirect
 	github.com/mark3labs/mcp-go v0.45.0
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/mattn/go-runewidth v0.0.20 // indirect
+	github.com/mattn/go-runewidth v0.0.24 // indirect
 	github.com/mdlayher/netlink v1.8.0 // indirect
 	github.com/mdlayher/socket v0.5.1 // indirect
 	github.com/mitchellh/go-ps v1.0.0 // indirect
@@ -324,12 +314,12 @@ require (
 	go4.org/mem v0.0.0-20240501181205-ae6ca9944745 // indirect
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
 	golang.org/x/time v0.14.0
-	golang.org/x/tools v0.42.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	golang.zx2c4.com/wireguard/windows v0.5.3 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260316180232-0b37fe3546d5 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
 	gopkg.in/jcmturner/aescts.v1 v1.0.1 // indirect
 	gopkg.in/jcmturner/dnsutils.v1 v1.0.1 // indirect
 	gopkg.in/jcmturner/goidentity.v3 v3.0.0 // indirect

go.sum

@@ -8,14 +8,12 @@ charm.land/bubbles/v2 v2.0.0 h1:tE3eK/pHjmtrDiRdoC9uGNLgpopOd8fjhEe31B/ai5s=
 charm.land/bubbles/v2 v2.0.0/go.mod h1:rCHoleP2XhU8um45NTuOWBPNVHxnkXKTiZqcclL/qOI=
 charm.land/bubbletea/v2 v2.0.2 h1:4CRtRnuZOdFDTWSff9r8QFt/9+z6Emubz3aDMnf/dx0=
 charm.land/bubbletea/v2 v2.0.2/go.mod h1:3LRff2U4WIYXy7MTxfbAQ+AdfM3D8Xuvz2wbsOD9OHQ=
-charm.land/fantasy v0.8.1 h1:2zQovDrd26g+/X2+/6bMomTX54HmZWNNHWeorDO0WRo=
-charm.land/fantasy v0.8.1/go.mod h1:KJ8vjy9FH7G2aeR/fL+os2uFHkQ4js2+UJVbsUKCXYM=
-charm.land/glamour/v2 v2.0.0 h1:IDBoqLEy7Hdpb9VOXN+khLP/XSxtJy1VsHuW/yF87+U=
-charm.land/glamour/v2 v2.0.0/go.mod h1:kjq9WB0s8vuUYZNYey2jp4Lgd9f4cKdzAw88FZtpj/w=
+charm.land/glamour/v2 v2.0.1 h1:xl+r00A4aJWU0z8fgwKd9fQQ4rsphqGUzuEiXZP5n+c=
+charm.land/glamour/v2 v2.0.1/go.mod h1:jo9z8XqVKPeEFMVdvCRLGk++RyJ3CdUwgNr7EvXLw3k=
 charm.land/huh/v2 v2.0.3 h1:2cJsMqEPwSywGHvdlKsJyQKPtSJLVnFKyFbsYZTlLkU=
 charm.land/huh/v2 v2.0.3/go.mod h1:93eEveeeqn47MwiC3tf+2atZ2l7Is88rAtmZNZ8x9Wc=
-charm.land/lipgloss/v2 v2.0.2 h1:xFolbF8JdpNkM2cEPTfXEcW1p6NRzOWTSamRfYEw8cs=
-charm.land/lipgloss/v2 v2.0.2/go.mod h1:KjPle2Qd3YmvP1KL5OMHiHysGcNwq6u83MUjYkFvEkM=
+charm.land/lipgloss/v2 v2.0.6 h1:EaGKeuA8FvF+v2BT5VmZd2LoYLaMZJXA5n34th8nCIQ=
+charm.land/lipgloss/v2 v2.0.6/go.mod h1:ipDDJNSGa1hlwDtSfW1s2/xR8Vdhbut4PXh2zEKZd0Q=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=
 cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU=
@@ -51,19 +49,16 @@ firebase.google.com/go/v4 v4.18.0 h1:S+g0P72oDGqOaG4wlLErX3zQmU9plVdu7j+Bc3R1qFw
 firebase.google.com/go/v4 v4.18.0/go.mod h1:P7UfBpzc8+Z3MckX79+zsWzKVfpGryr6HLbAe7gCWfs=
 github.com/Binject/binjection v0.0.0-20210701074423-605d46e35deb h1:c1Bb1n1wr2xgTHkNVxkUHBshff33m+IXgY6lE6oYttg=
 github.com/Binject/binjection v0.0.0-20210701074423-605d46e35deb/go.mod h1:fSQ9asCJK/lIGXUnoRwJNMXcnzel53AsZMCtlVBIn3k=
-github.com/Binject/debug v0.0.0-20210225042342-c9b8b45728d2/go.mod h1:QzgxDLY/qdKlvnbnb65eqTedhvQPbaSP2NqIbcuKvsQ=
 github.com/Binject/debug v0.0.0-20210312092933-6277045c2fdf/go.mod h1:QzgxDLY/qdKlvnbnb65eqTedhvQPbaSP2NqIbcuKvsQ=
 github.com/Binject/debug v0.0.0-20230508195519-26db73212a7a h1:4c0nc0krv8eh7gD809n+swLaCuFyHpxdrxwx0ZmHvBw=
 github.com/Binject/debug v0.0.0-20230508195519-26db73212a7a/go.mod h1:QzgxDLY/qdKlvnbnb65eqTedhvQPbaSP2NqIbcuKvsQ=
 github.com/Binject/shellcode v0.0.0-20191101084904-a8a90e7d4563 h1:T8z8Wz/fqaPPANF8Unv4LjWLoa0TAvsjYAsRpvSkOqs=
 github.com/Binject/shellcode v0.0.0-20191101084904-a8a90e7d4563/go.mod h1:HMbzsKPz1sF7H4Hmeovh+d2PH2iKPYpAB4XMOVz8wmM=
-github.com/Binject/universal v0.0.0-20220519011857-bea739e758c0 h1:1sdnMvqxxlMXsu8ku/Xrh6gi3V40ykksst5fd0lfWnc=
-github.com/Binject/universal v0.0.0-20220519011857-bea739e758c0/go.mod h1:J3XDRlam5pPYca3i6EqgQ35GCCEoyxafpCbLkta0ozc=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c h1:pxW6RcqyfI9/kWtOwnv/G+AzdKuy2ZrqINhenH4HyNs=
 github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 h1:DHa2U07rk8syqvCge0QIGMCE1WxGj9njT44GH7zNJLQ=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0/go.mod h1:P4WPRUkOhJC13W//jWpyfJNDAIpvRbAUIYLX/4jtlE0=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 h1:rIkQfkCOVKc1OiRCNcSDD8ml5RJlZbH/Xsq7lbpynwc=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0/go.mod h1:RD2SsorTmYhF6HkTmDw7KmPYQk8OBYwTkuasChwv7R4=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 h1:UnDZ/zFfG1JhH/DqxIZYU/1CUAlTUScoXD/LcM2Ykk8=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0/go.mod h1:IA1C1U7jO/ENqm/vhi7V9YYpBsp+IMyqNrEN94N7tVc=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0 h1:7t/qx5Ost0s0wbA/VDrByOooURhp+ikYwv20i9Y07TQ=
@@ -116,14 +111,8 @@ github.com/atc0005/go-teams-notify/v2 v2.14.0 h1:7N+xw+COnYANLREaAveQ65rsNQ12nIZ
 github.com/atc0005/go-teams-notify/v2 v2.14.0/go.mod h1:EECsWM2b0Hvoz7O+QdlsvyN2KCUOFQCGj8bUBXv3A3Q=
 github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4=
 github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI=
-github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0 h1:JjwxKkxzcBk4k8147g0eBQRCIy0UN1Be8AAv6RaIj4Q=
-github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0/go.mod h1:IbERvuyb387Hppp8hX0SQTFt/mkej8+OhuS8L0nC2CI=
-github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4 h1:cIAK2NNf2yafdgpFRNJrgZMwvy61BEVpGoHc2n4/yWs=
-github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4/go.mod h1:SalMPBCab3yuID8nIhLfzwoBV+lBRyaC7NhuN8qL8xE=
 github.com/aws/aws-sdk-go-v2 v1.41.3 h1:4kQ/fa22KjDt13QCy1+bYADvdgcxpfH18f0zP542kZA=
 github.com/aws/aws-sdk-go-v2 v1.41.3/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.5 h1:zWFmPmgw4sveAYi1mRqG+E/g0461cJ5M4bJ8/nc6d3Q=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.5/go.mod h1:nVUlMLVV8ycXSb7mSkcNu9e3v/1TJq2RTlrPwhYWr5c=
 github.com/aws/aws-sdk-go-v2/config v1.32.11 h1:ftxI5sgz8jZkckuUHXfC/wMUc8u3fG1vQS0plr2F2Zs=
 github.com/aws/aws-sdk-go-v2/config v1.32.11/go.mod h1:twF11+6ps9aNRKEDimksp923o44w/Thk9+8YIlzWMmo=
 github.com/aws/aws-sdk-go-v2/credentials v1.19.11 h1:NdV8cwCcAXrCWyxArt58BrvZJ9pZ9Fhf9w6Uh5W3Uyc=
@@ -186,14 +175,14 @@ github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA
 github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/charmbracelet/anthropic-sdk-go v0.0.0-20260223140439-63879b0b8dab h1:J7XQLgl9sefgTnTGrmX3xqvp5o6MCiBzEjGv5igAlc4=
-github.com/charmbracelet/anthropic-sdk-go v0.0.0-20260223140439-63879b0b8dab/go.mod h1:hqlYqR7uPKOKfnNeicUbZp0Ps0GeYFlKYtwh5HGDCx8=
-github.com/charmbracelet/colorprofile v0.4.2 h1:BdSNuMjRbotnxHSfxy+PCSa4xAmz7szw70ktAtWRYrY=
-github.com/charmbracelet/colorprofile v0.4.2/go.mod h1:0rTi81QpwDElInthtrQ6Ni7cG0sDtwAd4C4le060fT8=
-github.com/charmbracelet/ultraviolet v0.0.0-20260205113103-524a6607adb8 h1:eyFRbAmexyt43hVfeyBofiGSEmJ7krjLOYt/9CF5NKA=
-github.com/charmbracelet/ultraviolet v0.0.0-20260205113103-524a6607adb8/go.mod h1:SQpCTRNBtzJkwku5ye4S3HEuthAlGy2n9VXZnWkEW98=
-github.com/charmbracelet/x/ansi v0.11.6 h1:GhV21SiDz/45W9AnV2R61xZMRri5NlLnl6CVF7ihZW8=
-github.com/charmbracelet/x/ansi v0.11.6/go.mod h1:2JNYLgQUsyqaiLovhU2Rv/pb8r6ydXKS3NIttu3VGZQ=
+github.com/charmbracelet/colorprofile v0.4.3 h1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex9t5KX76i20Q=
+github.com/charmbracelet/colorprofile v0.4.3/go.mod h1:/zT4BhpD5aGFpqQQqw7a+VtHCzu+zrQtt1zhMt9mR4Q=
+github.com/charmbracelet/harmonica v0.2.0 h1:8NxJWRWg/bzKqqEaaeFNipOu77YR5t8aSwG4pgaUBiQ=
+github.com/charmbracelet/harmonica v0.2.0/go.mod h1:KSri/1RMQOZLbw7AHqgcBycp8pgJnQMYYT8QZRqZ1Ao=
+github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886 h1:rdnVWKgJpTVXKuKuJyxDJ+NFJdUaUqGvyGy61OcvlbA=
+github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886/go.mod h1:nAw0d9PhFp1qdzi2xhQU5YOu5sVpDIHWlaW2Uz/bCro=
+github.com/charmbracelet/x/ansi v0.11.8 h1:JMFwp0CgDC2+jcOB162HH5k7I3FVbgFSMMYg7dSPBQQ=
+github.com/charmbracelet/x/ansi v0.11.8/go.mod h1:ZNN+3mXny/516oTQPLMPIBeSINvNJJQ8uQXDgbeJxY0=
 github.com/charmbracelet/x/conpty v0.1.1 h1:s1bUxjoi7EpqiXysVtC+a8RrvPPNcNvAjfi4jxsAuEs=
 github.com/charmbracelet/x/conpty v0.1.1/go.mod h1:OmtR77VODEFbiTzGE9G1XiRJAga6011PIm4u5fTNZpk=
 github.com/charmbracelet/x/errors v0.0.0-20240508181413-e8d8b6e2de86 h1:JSt3B+U9iqk37QUU2Rvb6DSBYRLtWqFqfxf8l5hOZUA=
@@ -208,8 +197,6 @@ github.com/charmbracelet/x/exp/slice v0.0.0-20250904123553-b4e2667e5ad5 h1:DTSZx
 github.com/charmbracelet/x/exp/slice v0.0.0-20250904123553-b4e2667e5ad5/go.mod h1:vI5nDVMWi6veaYH+0Fmvpbe/+cv/iJfMntdh+N0+Tms=
 github.com/charmbracelet/x/exp/strings v0.0.0-20240722160745-212f7b056ed0 h1:qko3AQ4gK1MTS/de7F5hPGx6/k1u0w4TeYmBFwzYVP4=
 github.com/charmbracelet/x/exp/strings v0.0.0-20240722160745-212f7b056ed0/go.mod h1:pBhA0ybfXv6hDjQUZ7hk1lVxBiUbupdw5R31yPUViVQ=
-github.com/charmbracelet/x/json v0.2.0 h1:DqB+ZGx2h+Z+1s98HOuOyli+i97wsFQIxP2ZQANTPrQ=
-github.com/charmbracelet/x/json v0.2.0/go.mod h1:opFIflx2YgXgi49xVUu8gEQ21teFAxyMwvOiZhIvWNM=
 github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=
 github.com/charmbracelet/x/term v0.2.2/go.mod h1:kF8CY5RddLWrsgVwpw4kAa6TESp6EB5y3uxGLeCqzAI=
 github.com/charmbracelet/x/termios v0.1.1 h1:o3Q2bT8eqzGnGPOYheoYS8eEleT5ZVNYNy8JawjaNZY=
@@ -276,12 +263,12 @@ github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYC
 github.com/dlclark/regexp2 v1.4.0/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55kozfMjCc=
 github.com/dlclark/regexp2 v1.11.5 h1:Q/sSnsKerHeCkc/jSTNq1oCm7KiVgUMZRDUoRu0JQZQ=
 github.com/dlclark/regexp2 v1.11.5/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/dnaeon/go-vcr v1.2.0 h1:zHCHvJYTMh1N7xnV7zf1m1GPBF9Ad0Jk/whtQ1663qI=
-github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ=
 github.com/drswork/go-twitter v0.0.0-20221107160839-dea1b6ed53d7 h1:uh1GSejOhVPRQmoXZxY82TiewZB8QXiaP1skL7Nun3Y=
 github.com/drswork/go-twitter v0.0.0-20221107160839-dea1b6ed53d7/go.mod h1:ncTaGuXc5v7AuiVekeJ0Nwh8Bf4cudukoj0qM/15UZE=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/ebitengine/purego v0.10.1 h1:dewVBCBT2GaMu1SrNTYxQhgQBethzfhiwvZiLGP/qyY=
+github.com/ebitengine/purego v0.10.1/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
@@ -321,8 +308,8 @@ github.com/glebarez/sqlite v1.11.0 h1:wSG0irqzP6VurnMEpFGer5Li19RpIRi2qvQz++w0GM
 github.com/glebarez/sqlite v1.11.0/go.mod h1:h8/o8j5wiAsqSPoWELDUdJXhjAhsVliSn7bWZjOhrgQ=
 github.com/go-chi/chi/v5 v5.2.3 h1:WQIt9uxdsAbgIYgid+BpYc+liqQZGMHRaUwp0JUcvdE=
 github.com/go-chi/chi/v5 v5.2.3/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
-github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs=
-github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
+github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-json-experiment/json v0.0.0-20251027170946-4849db3c2f7e h1:Lf/gRkoycfOBPa42vU2bbgPurFong6zXeFtPoxholzU=
 github.com/go-json-experiment/json v0.0.0-20251027170946-4849db3c2f7e/go.mod h1:uNVvRXArCGbZ508SxYYTC5v1JWoz2voff5pm25jU1Ok=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
@@ -354,8 +341,6 @@ github.com/go-telegram-bot-api/telegram-bot-api v4.6.4+incompatible h1:2cauKuaEL
 github.com/go-telegram-bot-api/telegram-bot-api v4.6.4+incompatible/go.mod h1:qf9acutJ8cwBUhm1bqgz6Bei9/C/c93FPDljKWwsOgM=
 github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
 github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
-github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
-github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/go4org/plan9netshell v0.0.0-20250324183649-788daa080737 h1:cf60tHxREO3g1nroKr2osU3JWZsJzkfi7rEg+oAB0Lo=
 github.com/go4org/plan9netshell v0.0.0-20250324183649-788daa080737/go.mod h1:MIS0jDzbU/vuM9MC4YnBITCv+RYuTRq8dJzmCrFsK9g=
 github.com/gobwas/httphead v0.1.0 h1:exrUm0f4YX0L7EBwZHuCF4GDp8aJfVeBrlLQrs6NqWU=
@@ -364,8 +349,6 @@ github.com/gobwas/pool v0.2.1 h1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=
 github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
 github.com/gobwas/ws v1.4.0 h1:CTaoG1tojrh4ucGPcoJFiAQUAsEWekEWvLy7GsVNqGs=
 github.com/gobwas/ws v1.4.0/go.mod h1:G3gNqMNtPppf5XUz7O4shetPpcZ1VJ7zt18dlUeakrc=
-github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
-github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/godbus/dbus/v5 v5.1.1-0.20230522191255-76236955d466 h1:sQspH8M4niEijh3PFscJRLDnkL547IeP7kpPe3uUhEg=
 github.com/godbus/dbus/v5 v5.1.1-0.20230522191255-76236955d466/go.mod h1:ZiQxhyQ+bbbfxUKVvjfO498oPYvtYhZzycal3G/NHmU=
@@ -467,15 +450,15 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.7.6 h1:rWQc5FwZSPX58r1OQmkuaNicxdmExaEz5A2DO2hUuTk=
-github.com/jackc/pgx/v5 v5.7.6/go.mod h1:aruU7o91Tc2q2cFp5h4uP3f6ztExVpyVv88Xl/8Vl8M=
+github.com/jackc/pgx/v5 v5.10.0 h1:VhSvgU2jSli8o3AqIEOTJr7rZwAEUVo4E4XhR94Zfr0=
+github.com/jackc/pgx/v5 v5.10.0/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jcmturner/gofork v1.0.0/go.mod h1:MK8+TM0La+2rjBD4jE12Kj1pCCxK7d2LK/UM3ncEo0o=
 github.com/jcmturner/gofork v1.7.6 h1:QH0l3hzAU1tfT3rZCnW5zXl+orbkNMMRGJfdJjHVETg=
 github.com/jcmturner/gofork v1.7.6/go.mod h1:1622LH6i/EZqLloHfE7IeZ0uEJwMSUyQ/nDd82IeqRo=
-github.com/jedib0t/go-pretty/v6 v6.7.8 h1:BVYrDy5DPBA3Qn9ICT+PokP9cvCv1KaHv2i+Hc8sr5o=
-github.com/jedib0t/go-pretty/v6 v6.7.8/go.mod h1:YwC5CE4fJ1HFUDeivSV1r//AmANFHyqczZk+U6BDALU=
+github.com/jedib0t/go-pretty/v6 v6.8.3 h1:yVSk5aemoYHCvcrtqyXklwqcgHQIQzmy/oUzFlmffSQ=
+github.com/jedib0t/go-pretty/v6 v6.8.3/go.mod h1:YwC5CE4fJ1HFUDeivSV1r//AmANFHyqczZk+U6BDALU=
 github.com/jellydator/ttlcache/v3 v3.1.0 h1:0gPFG0IHHP6xyUyXq+JaD8fwkDCqgqwohXNJBcYE71g=
 github.com/jellydator/ttlcache/v3 v3.1.0/go.mod h1:hi7MGFdMAwZna5n2tuvh63DvFLzVKySzCVW6+0gA2n4=
 github.com/jezek/xgb v1.1.1 h1:bE/r8ZZtSv7l9gk6nU0mYx51aXrvnyb44892TwSaqS4=
@@ -494,14 +477,6 @@ github.com/jsimonetti/rtnetlink v1.4.2 h1:Df9w9TZ3npHTyDn0Ev9e1uzmN2odmXd0QX+J5G
 github.com/jsimonetti/rtnetlink v1.4.2/go.mod h1:92s6LJdE+1iOrw+F2/RO7LYI2Qd8pPpFNNUYW06gcoM=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/kaptinlin/go-i18n v0.2.3 h1:jyN/YOXXLcnGRBLdU+a8+6782B97fWE5aQqAHtvvk8Q=
-github.com/kaptinlin/go-i18n v0.2.3/go.mod h1:O+Ax4HkMO0Jt4OaP4E4WCx0PAADeWkwk8Jgt9bjAU1w=
-github.com/kaptinlin/jsonpointer v0.4.9 h1:o//bYf4PCvnMJIIX8bIg77KB6DO3wBPAabRyPRKh680=
-github.com/kaptinlin/jsonpointer v0.4.9/go.mod h1:9y0LgXavlmVE5FSHShY5LRlURJJVhbyVJSRWkilrTqA=
-github.com/kaptinlin/jsonschema v0.6.10 h1:CYded7nrwVu7pU1GaIjtd9dSzgqZjh7+LTKFaWqS08I=
-github.com/kaptinlin/jsonschema v0.6.10/go.mod h1:ZXZ4K5KrRmCCF1i6dgvBsQifl+WTb8XShKj0NpQNrz8=
-github.com/kaptinlin/messageformat-go v0.4.9 h1:FR5j5n4aL4nG0afKn9vvANrKxLu7HjmbhJnw5ogIwAQ=
-github.com/kaptinlin/messageformat-go v0.4.9/go.mod h1:qZzrGrlvWDz2KyyvN3dOWcK9PVSRV1BnfnNU+zB/RWc=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
 github.com/kbinani/screenshot v0.0.0-20250624051815-089614a94018 h1:NQYgMY188uWrS+E/7xMVpydsI48PMHcc7SfR4OxkDF4=
@@ -541,8 +516,8 @@ github.com/lesnuages/snitch v0.6.0 h1:vOao32MdYDHYDcTAq2CKszDh6Dn8Bv1Gmgc8uVh193
 github.com/lesnuages/snitch v0.6.0/go.mod h1:RfXlAVJYL7gUoZ9VMMon4LqrPiAjC8x62Ntbse4a4s0=
 github.com/line/line-bot-sdk-go v7.8.0+incompatible h1:Uf9/OxV0zCVfqyvwZPH8CrdiHXXmMRa/L91G3btQblQ=
 github.com/line/line-bot-sdk-go v7.8.0+incompatible/go.mod h1:0RjLjJEAU/3GIcHkC3av6O4jInAbt25nnZVmOFUgDBg=
-github.com/lucasb-eyer/go-colorful v1.3.0 h1:2/yBRLdWBZKrf7gB40FoiKfAWYQ0lqNcbuQwVHXptag=
-github.com/lucasb-eyer/go-colorful v1.3.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/lucasb-eyer/go-colorful v1.4.1 h1:1EO+WB73+EH8EVbzlrG3KLAfEypQWVHIBqlTf+2hNss=
+github.com/lucasb-eyer/go-colorful v1.4.1/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/lxn/win v0.0.0-20210218163916-a377121e959e h1:H+t6A/QJMbhCSEH5rAuRxh+CtW96g0Or0Fxa9IKr4uc=
 github.com/lxn/win v0.0.0-20210218163916-a377121e959e/go.mod h1:KxxjdtRkfNoYDCUP5ryK7XJJNTnpC8atvtmTheChOtk=
 github.com/mailgun/errors v0.4.0 h1:6LFBvod6VIW83CMIOT9sYNp28TCX0NejFPP4dSX++i8=
@@ -551,8 +526,6 @@ github.com/mailgun/mailgun-go/v5 v5.8.1 h1:QoRa2oBqLq+8GTYgM4id/cKW/WySQRka3PtnW
 github.com/mailgun/mailgun-go/v5 v5.8.1/go.mod h1:qNTXXuJi9/myqpDLI8Mbn54WCXdto1kEHm6I2/WWYQQ=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
-github.com/mark3labs/mcp-go v0.43.2 h1:21PUSlWWiSbUPQwXIJ5WKlETixpFpq+WBpbMGDSVy/I=
-github.com/mark3labs/mcp-go v0.43.2/go.mod h1:YnJfOL382MIWDx1kMY+2zsRHU/q78dBg9aFb8W6Thdw=
 github.com/mark3labs/mcp-go v0.45.0 h1:s0S8qR/9fWaQ3pHxz7pm1uQ0DrswoSnRIxKIjbiQtkc=
 github.com/mark3labs/mcp-go v0.45.0/go.mod h1:YnJfOL382MIWDx1kMY+2zsRHU/q78dBg9aFb8W6Thdw=
 github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
@@ -565,8 +538,8 @@ github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
-github.com/mattn/go-runewidth v0.0.20 h1:WcT52H91ZUAwy8+HUkdM3THM6gXqXuLJi9O3rjcQQaQ=
-github.com/mattn/go-runewidth v0.0.20/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
+github.com/mattn/go-runewidth v0.0.24 h1:cpokDiIn0MGnhdHwuWnJBITySJ20QyNGnY2kR/ay2DU=
+github.com/mattn/go-runewidth v0.0.24/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
 github.com/mattn/go-sqlite3 v1.14.32 h1:JD12Ag3oLy1zQA+BNn74xRgaBbdhbNIDYvQUEuuErjs=
 github.com/mattn/go-sqlite3 v1.14.32/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/mdlayher/genetlink v1.3.2 h1:KdrNKe+CTu+IbZnm/GVUMXSqBBLqcGpRDa0xkQy56gw=
@@ -598,8 +571,6 @@ github.com/moloch--/console v0.0.0-20260129035459-883dcb25c701 h1:6caCgDZpovjvv+
 github.com/moloch--/console v0.0.0-20260129035459-883dcb25c701/go.mod h1:UdqyqqCSnPu3Zc8Q3kpDszrq1hcyBHsG17hlWlRJmWI=
 github.com/moloch--/go-keystone v0.0.2 h1:xThbYs45CSzoDUz5kBZxAyTPIpK3t5M7NB1x+NTTRL8=
 github.com/moloch--/go-keystone v0.0.2/go.mod h1:kpGRJpw9b7Eq3MluHrba+GPKZhSyDrvhLULSwH5nGGM=
-github.com/moloch--/memmod v0.0.0-20230225130813-fd77d905589e h1:IkFCPlAa0iTiLxck+NqAwBx8JDlnHYm4orOQBbs4BDQ=
-github.com/moloch--/memmod v0.0.0-20230225130813-fd77d905589e/go.mod h1:eYeI6cQ5YHhHt9i0BBW0zc1DaQnb4ZMXsSPuEV/V5Og=
 github.com/moloch--/readline v0.0.0-20260129035512-cb5b3e87d51a h1:Q69DxLWF+Z8oIjuNbeKC6Xygk8Z4heWzzO79Io1cEYA=
 github.com/moloch--/readline v0.0.0-20260129035512-cb5b3e87d51a/go.mod h1:CwNkh9BmFBBCSO6mdDaNWb34rOqQsI9eYbxyqvOEazY=
 github.com/moloch--/sgn v0.0.5 h1:92GFaRpe+353uhqzFiNKXKgmTiD4dBxnvb8gd4MaV/g=
@@ -645,8 +616,6 @@ github.com/openai/openai-go/v2 v2.7.1/go.mod h1:jrJs23apqJKKbT+pqtFgNKpRju/KP9zp
 github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
 github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde h1:x0TT0RDC7UhAVbbWWBzr41ElhJx5tXPWkIHA2HWPRuw=
 github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde/go.mod h1:nZgzbfBr3hhjoZnS66nKrHmduYNpc34ny7RK4z5/HM0=
-github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
-github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pierrec/lz4/v4 v4.1.21 h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ=
 github.com/pierrec/lz4/v4 v4.1.21/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pires/go-proxyproto v0.8.1 h1:9KEixbdJfhrbtjpz/ZwCdWDD2Xem0NZ38qMYaASJgp0=
@@ -698,12 +667,14 @@ github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic
 github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
 github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
-github.com/slack-go/slack v0.17.3 h1:zV5qO3Q+WJAQ/XwbGfNFrRMaJ5T/naqaonyPV/1TP4g=
-github.com/slack-go/slack v0.17.3/go.mod h1:X+UqOufi3LYQHDnMG1vxf0J8asC6+WllXrVrhl8/Prk=
+github.com/slack-go/slack v0.24.0 h1:oMz5WcCBVTkxpBxeA8QVxxK70R+XV/a0qNka6TRNGHQ=
+github.com/slack-go/slack v0.24.0/go.mod h1:H0yR/YBuRJ39RkE+JpV/d/oEsbanzTRowR82bCN0cEs=
 github.com/sliverarmory/beignet v0.0.3 h1:ssR6AK9lirVulHZhQMyMmVAi0FcFwWxlh9LwKCJQ4X0=
 github.com/sliverarmory/beignet v0.0.3/go.mod h1:xXfTKBJqFBY/pakRFwJ+5+oGiSlg2CiCVUg/76kW1H4=
 github.com/sliverarmory/malasada v0.0.3 h1:b2KG2NhQVfBIIrbP8rGJwmdh7o8LH6NKYKH1DF4No1U=
 github.com/sliverarmory/malasada v0.0.3/go.mod h1:F96IgTOoX72FU995F+Jip0ni8Z5sXiYOwfmlRGobJkQ=
+github.com/sliverarmory/reflektor v0.0.6 h1:iW492LhJ6yeG3u647mJgyhdTbjrZZNnw8bks4UxIL1s=
+github.com/sliverarmory/reflektor v0.0.6/go.mod h1:+lCyQy0xHVqx6D5nYbcz5XIDVtAGbDMIMU0Yc6Brb1s=
 github.com/sliverarmory/wasm-donut v0.0.3 h1:sldbfAsz1YziULlhDKpU3DY/+/dAfv5gl26qSqHIpzE=
 github.com/sliverarmory/wasm-donut v0.0.3/go.mod h1:D6OLBZBfFm2Tk857vqGqFS9uUi4CXqnqHxKqtONllVk=
 github.com/sony/sonyflake v1.0.0 h1:MpU6Ro7tfXwgn2l5eluf9xQvQJDROTBImNCfRXn/YeM=
@@ -830,24 +801,24 @@ go.mau.fi/util v0.9.3 h1:aqNF8KDIN8bFpFbybSk+mEBil7IHeBwlujfyTnvP0uU=
 go.mau.fi/util v0.9.3/go.mod h1:krWWfBM1jWTb5f8NCa2TLqWMQuM81X7TGQjhMjBeXmQ=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/detectors/gcp v1.40.0 h1:Awaf8gmW99tZTOWqkLCOl6aw1/rxAWVlHsHIZ3fT2sA=
-go.opentelemetry.io/contrib/detectors/gcp v1.40.0/go.mod h1:99OY9ZCqyLkzJLTh5XhECpLRSxcZl+ZDKBEO+jMBFR4=
+go.opentelemetry.io/contrib/detectors/gcp v1.43.0 h1:62yY3dT7/ShwOxzA0RsKRgshBmfElKI4d/Myu2OxDFU=
+go.opentelemetry.io/contrib/detectors/gcp v1.43.0/go.mod h1:RyaZMFY7yi1kAs45S6mbFGz8O8rqB0dTY14uzvG4LCs=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.65.0 h1:XmiuHzgJt067+a6kwyAzkhXooYVv3/TOw9cM2VfJgUM=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.65.0/go.mod h1:KDgtbWKTQs4bM+VPUr6WlL9m/WXcmkCcBlIzqxPGzmI=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 h1:7iP2uCb7sGddAr30RRS6xjKy7AZ2JtTOPA3oolgVSw8=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0/go.mod h1:c7hN3ddxs/z6q9xwvfLPk+UHlWRQyaeR1LdgfL/66l0=
-go.opentelemetry.io/otel v1.40.0 h1:oA5YeOcpRTXq6NN7frwmwFR0Cn3RhTVZvXsP4duvCms=
-go.opentelemetry.io/otel v1.40.0/go.mod h1:IMb+uXZUKkMXdPddhwAHm6UfOwJyh4ct1ybIlV14J0g=
+go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
+go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
 go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.39.0 h1:5gn2urDL/FBnK8OkCfD1j3/ER79rUuTYmCvlXBKeYL8=
 go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.39.0/go.mod h1:0fBG6ZJxhqByfFZDwSwpZGzJU671HkwpWaNe2t4VUPI=
-go.opentelemetry.io/otel/metric v1.40.0 h1:rcZe317KPftE2rstWIBitCdVp89A2HqjkxR3c11+p9g=
-go.opentelemetry.io/otel/metric v1.40.0/go.mod h1:ib/crwQH7N3r5kfiBZQbwrTge743UDc7DTFVZrrXnqc=
-go.opentelemetry.io/otel/sdk v1.40.0 h1:KHW/jUzgo6wsPh9At46+h4upjtccTmuZCFAc9OJ71f8=
-go.opentelemetry.io/otel/sdk v1.40.0/go.mod h1:Ph7EFdYvxq72Y8Li9q8KebuYUr2KoeyHx0DRMKrYBUE=
-go.opentelemetry.io/otel/sdk/metric v1.40.0 h1:mtmdVqgQkeRxHgRv4qhyJduP3fYJRMX4AtAlbuWdCYw=
-go.opentelemetry.io/otel/sdk/metric v1.40.0/go.mod h1:4Z2bGMf0KSK3uRjlczMOeMhKU2rhUqdWNoKcYrtcBPg=
-go.opentelemetry.io/otel/trace v1.40.0 h1:WA4etStDttCSYuhwvEa8OP8I5EWu24lkOzp+ZYblVjw=
-go.opentelemetry.io/otel/trace v1.40.0/go.mod h1:zeAhriXecNGP/s2SEG3+Y8X9ujcJOTqQ5RgdEJcawiA=
+go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
+go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
+go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
+go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
+go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
+go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
+go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
+go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
 go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
@@ -868,10 +839,8 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
-golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
-golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
-golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
+golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
+golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa h1:Zt3DZoOFFYkKhDT3v7Lm9FDMEV06GpzjG2jrqW+QTE0=
 golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa/go.mod h1:K79w1Vqn7PoiZn+TkNpx3BUWUQksGO3JcVX6qIjytmA=
@@ -890,8 +859,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
-golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
 golang.org/x/net v0.0.0-20171115151908-9dfe39835686/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -913,10 +882,8 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
-golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
@@ -933,10 +900,8 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190204203706-41f3e6584952/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -957,7 +922,6 @@ golang.org/x/sys v0.0.0-20201018230417-eeed37f84f13/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210217105451-b926d437f341/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -975,8 +939,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -986,10 +950,8 @@ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
-golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
-golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
-golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
+golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
+golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -1003,10 +965,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
-golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
-golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
-golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -1023,8 +983,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
-golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1037,36 +997,30 @@ golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10 h1:3GDAcqdI
 golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10/go.mod h1:T97yPqesLiNrOYxkwmhMI0ZIlJDm+p0PMR8eRVeR5tQ=
 golang.zx2c4.com/wireguard/windows v0.5.3 h1:On6j2Rpn3OEMXqBq00QEDC7bWSZrPIHKIus8eIuExIE=
 golang.zx2c4.com/wireguard/windows v0.5.3/go.mod h1:9TEe8TJmtwyQebdFwAkEWOPr3prrtqm+REGFifP60hI=
-gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
-gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
 google.golang.org/api v0.269.0 h1:qDrTOxKUQ/P0MveH6a7vZ+DNHxJQjtGm/uvdbdGXCQg=
 google.golang.org/api v0.269.0/go.mod h1:N8Wpcu23Tlccl0zSHEkcAZQKDLdquxK+l9r2LkwAauE=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine/v2 v2.0.6 h1:LvPZLGuchSBslPBp+LAhihBeGSiRh1myRoYK4NtuBIw=
 google.golang.org/appengine/v2 v2.0.6/go.mod h1:WoEXGoXNfa0mLvaH5sV3ZSGXwVmy8yf7Z1JKf3J3wLI=
-google.golang.org/genai v1.49.0 h1:Se+QJaH2GYK1aaR1o5S38mlU2GD5FnVvP76nfkV7LH0=
-google.golang.org/genai v1.49.0/go.mod h1:A3kkl0nyBjyFlNjgxIwKq70julKbIxpSxqKO5gw/gmk=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20200423170343-7949de9c1215/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20260226221140-a57be14db171 h1:RxhCsti413yL0IjU9dVvuTbCISo8gs3RW1jPMStck+4=
 google.golang.org/genproto v0.0.0-20260226221140-a57be14db171/go.mod h1:uhvzakVEqAuXU3TC2JCsxIRe5f77l+JySE3EqPoMyqM=
-google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 h1:tu/dtnW1o3wfaxCOjSLn5IRX4YDcJrtlpzYkhHhGaC4=
-google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171/go.mod h1:M5krXqk4GhBKvB596udGL3UyjL4I1+cTbK0orROM9ng=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260316180232-0b37fe3546d5 h1:aJmi6DVGGIStN9Mobk/tZOOQUBbj0BPjZjjnOdoZKts=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260316180232-0b37fe3546d5/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 h1:yQugLulqltosq0B/f8l4w9VryjV+N/5gcW0jQ3N8Qec=
+google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478/go.mod h1:C6ADNqOxbgdUUeRTU+LCHDPB9ttAMCTff6auwCVa4uc=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
-google.golang.org/grpc v1.79.1 h1:zGhSi45ODB9/p3VAawt9a+O/MULLl9dpizzNNpq7flY=
-google.golang.org/grpc v1.79.1/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
-google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=
-google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
+google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
+google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -1099,6 +1053,8 @@ gopkg.in/jcmturner/gokrb5.v7 v7.5.0 h1:a9tsXlIDD9SKxotJMK3niV7rPZAJeX2aD/0yg3qlI
 gopkg.in/jcmturner/gokrb5.v7 v7.5.0/go.mod h1:l8VISx+WGYp+Fp7KRbsiUuXTTOnxIc3Tuvyavf11/WM=
 gopkg.in/jcmturner/rpc.v1 v1.1.0 h1:QHIUxTX1ISuAv9dD2wJ9HWQVuWDX/Zc0PfeC2tjc4rU=
 gopkg.in/jcmturner/rpc.v1 v1.1.0/go.mod h1:YIdkC4XfD6GXbzje11McwsDuOlZQSb9W4vfLvuNnlv8=
+gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc=
+gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYskCTPBJVb9jqSc=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
@@ -1113,12 +1069,12 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gorm.io/driver/mysql v1.6.0 h1:eNbLmNTpPpTOVZi8MMxCi2aaIm0ZpInbORNXDwyLGvg=
 gorm.io/driver/mysql v1.6.0/go.mod h1:D/oCC2GWK3M/dqoLxnOlaNKmXz8WNTfcS9y5ovaSqKo=
-gorm.io/driver/postgres v1.6.0 h1:2dxzU8xJ+ivvqTRph34QX+WrRaJlmfyPqXmoGVjMBa4=
-gorm.io/driver/postgres v1.6.0/go.mod h1:vUw0mrGgrTK+uPHEhAdV4sfFELrByKVGnaVRkXDhtWo=
+gorm.io/driver/postgres v1.6.2 h1:BvXQ/cNUg63q5TFNg672DmDcowZSFrNLkkA3Xe6GXq4=
+gorm.io/driver/postgres v1.6.2/go.mod h1:0c4fQA44XhOklXDkgtuKqysHCycTa5i9e3EIpDGCwXk=
 gorm.io/driver/sqlite v1.6.0 h1:WHRRrIiulaPiPFmDcod6prc4l2VGVWHz80KspNsxSfQ=
 gorm.io/driver/sqlite v1.6.0/go.mod h1:AO9V1qIQddBESngQUKWL9yoH93HIeA1X6V633rBwyT8=
-gorm.io/gorm v1.31.0 h1:0VlycGreVhK7RF/Bwt51Fk8v0xLiiiFdbGDPIZQ7mJY=
-gorm.io/gorm v1.31.0/go.mod h1:XyQVbO2k6YkOis7C2437jSit3SsDK72s7n7rsSHd+Gs=
+gorm.io/gorm v1.31.2 h1:3o8FXNo9v9S858gil+3LlZA1LkCOzgb4g5BL64FgaCo=
+gorm.io/gorm v1.31.2/go.mod h1:XyQVbO2k6YkOis7C2437jSit3SsDK72s7n7rsSHd+Gs=
 gvisor.dev/gvisor v0.0.0-20250503011706-39ed1f5ac29c h1:m/r7OM+Y2Ty1sgBQ7Qb27VgIMBW8ZZhT4gLnUyDIhzI=
 gvisor.dev/gvisor v0.0.0-20250503011706-39ed1f5ac29c/go.mod h1:3r5CMtNQMKIvBlrmM9xWUNamjKBYPOWyXOjmg5Kts3g=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=

implant/go-mod

@@ -1,35 +1,32 @@
 module github.com/bishopfox/sliver
 
-go 1.24.0
+go 1.26.6
 
 require (
 	filippo.io/age v1.1.1
-	github.com/Binject/universal v0.0.0-20220519011857-bea739e758c0
 	github.com/Ne0nd0g/go-clr v1.0.3
+	github.com/ebitengine/purego v0.10.1
 	github.com/gofrs/uuid v4.0.0+incompatible
 	github.com/hashicorp/yamux v0.1.2
 	github.com/kbinani/screenshot v0.0.0-20191211154542-3a185f1ce18f
 	github.com/lesnuages/go-winio v0.4.19
 	github.com/miekg/dns v1.1.50
-	github.com/moloch--/memmod v0.0.0-20230225130813-fd77d905589e
+	github.com/sliverarmory/reflektor v0.0.6
 	github.com/stretchr/testify v1.8.4
 	github.com/tetratelabs/wazero v1.7.1
 	github.com/things-go/go-socks5 v0.0.4
 	github.com/yiya1989/sshkrb5 v0.0.0-20201110125252-a1455b75a35e
-	golang.org/x/crypto v0.42.0
-	golang.org/x/net v0.43.0
-	golang.org/x/sys v0.36.0
+	golang.org/x/crypto v0.52.0
+	golang.org/x/net v0.55.0
+	golang.org/x/sys v0.45.0
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
 	google.golang.org/protobuf v1.32.0
 	gvisor.dev/gvisor v0.0.0-20230927004350-cbd86285d259
 )
 
 require (
-	github.com/Binject/debug v0.0.0-20210225042342-c9b8b45728d2 // indirect
 	github.com/BurntSushi/xgb v0.0.0-20210121224620-deaf085860bc // indirect
 	github.com/Microsoft/go-winio v0.6.0 // indirect
-	github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0 // indirect
-	github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/gen2brain/shm v0.0.0-20200228170931-49f9650110c5 // indirect
 	github.com/google/btree v1.1.2 // indirect
@@ -37,11 +34,11 @@ require (
 	github.com/jcmturner/gofork v1.0.0 // indirect
 	github.com/lxn/win v0.0.0-20210218163916-a377121e959e // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	golang.org/x/mod v0.27.0 // indirect
-	golang.org/x/sync v0.17.0 // indirect
-	golang.org/x/text v0.29.0 // indirect
+	golang.org/x/mod v0.35.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/text v0.37.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
-	golang.org/x/tools v0.36.0 // indirect
+	golang.org/x/tools v0.44.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	gopkg.in/jcmturner/aescts.v1 v1.0.1 // indirect
 	gopkg.in/jcmturner/dnsutils.v1 v1.0.1 // indirect

implant/go-sum

@@ -1,22 +1,16 @@
 filippo.io/age v1.1.1 h1:pIpO7l151hCnQ4BdyBujnGP2YlUo0uj6sAVNHGBvXHg=
 filippo.io/age v1.1.1/go.mod h1:l03SrzDUrBkdBx8+IILdnn2KZysqQdbEBUQ4p3sqEQE=
-github.com/Binject/debug v0.0.0-20210225042342-c9b8b45728d2 h1:8kQNJC9AxAaNs0JkXnWUfbNeDnIO1QLYYWjYqC6JEE4=
-github.com/Binject/debug v0.0.0-20210225042342-c9b8b45728d2/go.mod h1:QzgxDLY/qdKlvnbnb65eqTedhvQPbaSP2NqIbcuKvsQ=
-github.com/Binject/universal v0.0.0-20220519011857-bea739e758c0 h1:1sdnMvqxxlMXsu8ku/Xrh6gi3V40ykksst5fd0lfWnc=
-github.com/Binject/universal v0.0.0-20220519011857-bea739e758c0/go.mod h1:J3XDRlam5pPYca3i6EqgQ35GCCEoyxafpCbLkta0ozc=
 github.com/BurntSushi/xgb v0.0.0-20210121224620-deaf085860bc h1:7D+Bh06CRPCJO3gr2F7h1sriovOZ8BMhca2Rg85c2nk=
 github.com/BurntSushi/xgb v0.0.0-20210121224620-deaf085860bc/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/Microsoft/go-winio v0.6.0 h1:slsWYD/zyx7lCXoZVlvQrj0hPTM1HI4+v1sIda2yDvg=
 github.com/Microsoft/go-winio v0.6.0/go.mod h1:cTAf44im0RAYeL23bpB+fzCyDH2MJiz2BO69KH/soAE=
 github.com/Ne0nd0g/go-clr v1.0.3 h1:xt92wwuqY23ZSC7RuHD3mKu3K22Bk5NNbxI803vojK4=
 github.com/Ne0nd0g/go-clr v1.0.3/go.mod h1:TKYSQ/5xT25EvBUttAlUrzpR8yHuI0qTRK495I5xG/I=
-github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0 h1:JjwxKkxzcBk4k8147g0eBQRCIy0UN1Be8AAv6RaIj4Q=
-github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0/go.mod h1:IbERvuyb387Hppp8hX0SQTFt/mkej8+OhuS8L0nC2CI=
-github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4 h1:cIAK2NNf2yafdgpFRNJrgZMwvy61BEVpGoHc2n4/yWs=
-github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4/go.mod h1:SalMPBCab3yuID8nIhLfzwoBV+lBRyaC7NhuN8qL8xE=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/ebitengine/purego v0.10.1 h1:dewVBCBT2GaMu1SrNTYxQhgQBethzfhiwvZiLGP/qyY=
+github.com/ebitengine/purego v0.10.1/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/gen2brain/shm v0.0.0-20200228170931-49f9650110c5 h1:Y5Q2mEwfzjMt5+3u70Gtw93ZOu2UuPeeeTBDntF7FoY=
 github.com/gen2brain/shm v0.0.0-20200228170931-49f9650110c5/go.mod h1:uF6rMu/1nvu+5DpiRLwusA6xB8zlkNoGzKn8lmYONUo=
 github.com/gofrs/uuid v4.0.0+incompatible h1:1SD/1F5pU8p29ybwgQSwpQk+mwdRrXCYuPhW6m+TnJw=
@@ -39,16 +33,15 @@ github.com/lxn/win v0.0.0-20210218163916-a377121e959e h1:H+t6A/QJMbhCSEH5rAuRxh+
 github.com/lxn/win v0.0.0-20210218163916-a377121e959e/go.mod h1:KxxjdtRkfNoYDCUP5ryK7XJJNTnpC8atvtmTheChOtk=
 github.com/miekg/dns v1.1.50 h1:DQUfb9uc6smULcREF09Uc+/Gd46YWqJd5DbpPE9xkcA=
 github.com/miekg/dns v1.1.50/go.mod h1:e3IlAVfNqAllflbibAZEWOXOQ+Ynzk/dDozDxY7XnME=
-github.com/moloch--/memmod v0.0.0-20230225130813-fd77d905589e h1:IkFCPlAa0iTiLxck+NqAwBx8JDlnHYm4orOQBbs4BDQ=
-github.com/moloch--/memmod v0.0.0-20230225130813-fd77d905589e/go.mod h1:eYeI6cQ5YHhHt9i0BBW0zc1DaQnb4ZMXsSPuEV/V5Og=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
+github.com/sliverarmory/reflektor v0.0.6 h1:iW492LhJ6yeG3u647mJgyhdTbjrZZNnw8bks4UxIL1s=
+github.com/sliverarmory/reflektor v0.0.6/go.mod h1:+lCyQy0xHVqx6D5nYbcz5XIDVtAGbDMIMU0Yc6Brb1s=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/tetratelabs/wazero v1.7.1 h1:QtSfd6KLc41DIMpDYlJdoMc6k7QTN246DM2+n2Y/Dx8=
@@ -61,51 +54,50 @@ github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.42.0 h1:chiH31gIWm57EkTXpwnqf8qeuMUi0yekh6mT2AvFlqI=
-golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8=
+golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
+golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
-golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
+golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
+golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20210726213435-c6fcb2dbf985/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
-golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
+golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
+golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
-golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201018230417-eeed37f84f13/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210217105451-b926d437f341/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220330033206-e17cdc41300f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
-golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.35.0 h1:bZBVKBudEyhRcajGcNc3jIfWPqV4y/Kt2XcoigOWtDQ=
-golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA=
+golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
+golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
-golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
 golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.6-0.20210726203631-07bc1bf47fb2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
-golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
+golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
+golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

implant/scripts/update-vendor.sh

@@ -34,5 +34,16 @@ cd "$tempDir"
 go mod tidy -compat=1.25
 go mod vendor
 
+# The lesnuages/go-winio fork provides RemoteClientMode, which Sliver needs,
+# but its checked-in syscall wrappers predate syscall.SyscallN. Regenerate the
+# wrappers with the pinned x/sys generator so Go 1.26 Windows/ARM64 debug builds
+# do not link the oversized syscall.Syscall15 wrapper.
+(
+  cd vendor/github.com/lesnuages/go-winio
+  go run -mod=mod golang.org/x/sys/windows/mkwinsyscall \
+    -output zsyscall_windows.go \
+    file.go pipe.go sd.go fileinfo.go privilege.go backup.go hvsock.go
+)
+
 # move updated files back
 cleanup

implant/sliver/extension/README.md

@@ -2,13 +2,15 @@
 
 ## Overview
 
-Extension host runtime allowing implants to load optional capabilities. Manages sandboxing, lifecycle, and communication with extension modules. Runtime components handle extension darwin, extension windows, memfs, and WASM for implant-side extension features.
+Extension host runtime allowing implants to load optional capabilities. Manages native shared-library and WASM extension lifecycle, registration, and communication across supported implant platforms.
 
 ## Go Files
 
-- `extension.go` – Core extension host that loads modules and brokers RPC communication.
-- `extension_darwin.go` – macOS-specific stubs and build tags for extension support.
-- `extension_windows.go` – Windows-specific integration for loading and managing extensions.
+- `extension.go` – Thread-safe native extension registry and single-flight loading lifecycle.
+- `extension_darwin.go` – macOS constructor for the shared Reflektor-backed Unix loader.
+- `extension_linux.go` – Linux constructor for the shared Reflektor-backed Unix loader.
+- `extension_unix.go` – CGO-free macOS/Linux loading, export invocation, and callback bridge.
+- `extension_windows.go` – Windows-specific Reflektor integration for loading and invoking extensions.
 - `memfs.go` – Implements the in-memory filesystem backing extension assets.
 - `memfs_test.go` *(tests)* – Tests the in-memory filesystem behavior for extensions.
 - `wasm.go` – Sets up the WASM runtime for implant extensions and handles module lifecycle.

implant/sliver/extension/extension.go

@@ -20,13 +20,31 @@ package extension
 
 import (
 	"errors"
+	"sync"
 
 	// {{if .Config.Debug}}
 	"log"
 	// {{end}}
 )
 
-var extensions map[string]Extension
+const (
+	// Success indicates that a native extension callback completed successfully.
+	Success = 0
+	// Failure indicates that a native extension callback failed.
+	Failure = 1
+)
+
+var (
+	extensions     map[string]Extension
+	extensionLoads map[string]*extensionLoad
+	extensionsMu   sync.RWMutex
+)
+
+type extensionLoad struct {
+	done    chan struct{}
+	err     error
+	waiters int
+}
 
 type Extension interface {
 	Load() error
@@ -36,10 +54,47 @@ type Extension interface {
 }
 
 func Add(e Extension) {
+	extensionsMu.Lock()
+	defer extensionsMu.Unlock()
 	extensions[e.GetID()] = e
 }
 
+// Register loads an extension once per ID and publishes it only after loading
+// succeeds. Concurrent registrations for the same ID wait for the in-flight
+// load instead of mapping duplicate libraries and allocating duplicate callback
+// trampolines.
+func Register(e Extension) error {
+	id := e.GetID()
+	extensionsMu.Lock()
+	if _, found := extensions[id]; found {
+		extensionsMu.Unlock()
+		return nil
+	}
+	if loading, found := extensionLoads[id]; found {
+		loading.waiters++
+		extensionsMu.Unlock()
+		<-loading.done
+		return loading.err
+	}
+	loading := &extensionLoad{done: make(chan struct{})}
+	extensionLoads[id] = loading
+	extensionsMu.Unlock()
+
+	err := e.Load()
+	extensionsMu.Lock()
+	if err == nil {
+		extensions[id] = e
+	}
+	loading.err = err
+	close(loading.done)
+	delete(extensionLoads, id)
+	extensionsMu.Unlock()
+	return err
+}
+
 func List() []string {
+	extensionsMu.RLock()
+	defer extensionsMu.RUnlock()
 	var extList []string
 	for id := range extensions {
 		extList = append(extList, id)
@@ -48,10 +103,15 @@ func List() []string {
 }
 
 func Run(extID string, funcName string, arguments []byte, callback func([]byte)) error {
-	if ext, found := extensions[extID]; found {
+	extensionsMu.RLock()
+	ext, found := extensions[extID]
+	extensionsMu.RUnlock()
+	if found {
 		return ext.Call(funcName, arguments, callback)
 	}
 	// {{if .Config.Debug}}
+	extensionsMu.RLock()
+	defer extensionsMu.RUnlock()
 	for id, ext := range extensions {
 		log.Printf("Extension '%s' (%s)", id, ext.GetArch())
 	}
@@ -61,4 +121,5 @@ func Run(extID string, funcName string, arguments []byte, callback func([]byte))
 
 func init() {
 	extensions = make(map[string]Extension)
+	extensionLoads = make(map[string]*extensionLoad)
 }

implant/sliver/extension/extension_darwin.go

@@ -18,113 +18,10 @@ package extension
 	along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */
 
-import (
-	"bytes"
-	"runtime"
-	"sync"
-	"unsafe"
-
-	// {{if .Config.Debug}}
-	"log"
-	// {{end}}
-
-	"github.com/Binject/universal"
-)
-
-type DarwinExtension struct {
-	id          string
-	data        []byte
-	module      *universal.Library
-	arch        string
-	serverStore bool
-	init        string
-	sync.Mutex
-}
-
-type extensionArguments struct {
-	inDataSize  uintptr
-	inDataBuff  uintptr
-	outDataSize uintptr
-	outDataBuff uintptr
-}
+// DarwinExtension is a Reflektor-backed native macOS extension.
+type DarwinExtension = UnixExtension
 
+// NewDarwinExtension creates a native macOS extension backed by Reflektor.
 func NewDarwinExtension(data []byte, id string, arch string, init string) *DarwinExtension {
-	return &DarwinExtension{
-		id:   id,
-		data: data,
-		arch: arch,
-		init: init,
-	}
-}
-
-func (d *DarwinExtension) GetID() string {
-	return d.id
-}
-
-func (d *DarwinExtension) GetArch() string {
-	return d.arch
-}
-
-func (d *DarwinExtension) Load() error {
-	var err error
-	d.Lock()
-	defer d.Unlock()
-	loader, err := universal.NewLoader()
-	if err != nil {
-		return err
-	}
-	d.module, err = loader.LoadLibrary(d.id, &d.data)
-	if err != nil {
-		return err
-	}
-	if d.init != "" {
-		if _, errInit := d.module.Call(d.init); errInit != nil {
-			return errInit
-		}
-	}
-	return nil
-}
-
-func (d *DarwinExtension) Call(export string, arguments []byte, onFinish func([]byte)) error {
-	// We currently have 2 issues with Darwin extensions:
-	// - cppgo (used by universal) fucks up when calling a function with more than 1 argument
-	// - we don't have Go callback support for the loaded extension,
-	// so we have to wait for the call to finish to get the results
-	// To circumvent these issues, we pass the extensionArguments structure
-	// as the only argument to the call, so we can pass args in and extract
-	// the result at the same time.
-	runtime.LockOSThread()
-	defer runtime.UnlockOSThread()
-	extArgs := extensionArguments{}
-	if len(arguments) > 0 {
-		extArgs.inDataBuff = uintptr(unsafe.Pointer(&arguments[0]))
-		extArgs.inDataSize = uintptr(uint64(len(arguments)))
-	}
-	// {{if .Config.Debug}}
-	log.Printf("Calling %s, arg size: %d\n", export, extArgs.inDataSize)
-	// {{end}}
-	d.Lock()
-	defer d.Unlock()
-	_, err := d.module.Call(export, uintptr(unsafe.Pointer(&extArgs)))
-	if err != nil {
-		return err
-	}
-	// {{if .Config.Debug}}
-	log.Printf("%s done!\n", export)
-	// {{end}}
-	outData := new(bytes.Buffer)
-	outDataSize := int(extArgs.outDataSize)
-	// {{if .Config.Debug}}
-	log.Printf("Out data size: %d\n", outDataSize)
-	// {{end}}
-	for i := 0; i < outDataSize; i++ {
-		b := (*byte)(unsafe.Pointer(uintptr(i) + extArgs.outDataBuff))
-		outData.WriteByte(*b)
-	}
-	// We currently don't have a way to trigger a callback
-	// in the loaded code for Darwin.
-	if outData.Len() > 0 {
-		onFinish(outData.Bytes())
-	}
-	return nil
+	return newUnixExtension(data, id, arch, init)
 }

implant/sliver/extension/extension_linux.go

@@ -0,0 +1,29 @@
+//go:build 386 || amd64 || arm64
+
+package extension
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+// LinuxExtension is a Reflektor-backed native Linux extension.
+type LinuxExtension = UnixExtension
+
+// NewLinuxExtension creates a native Linux extension backed by Reflektor.
+func NewLinuxExtension(data []byte, id string, arch string, init string) *LinuxExtension {
+	return newUnixExtension(data, id, arch, init)
+}

implant/sliver/extension/extension_linux_unsupported.go

@@ -0,0 +1,55 @@
+//go:build !(386 || amd64 || arm64)
+
+package extension
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import "errors"
+
+// LinuxExtension reports unsupported native-extension operations on Linux
+// architectures without a Reflektor backend.
+type LinuxExtension struct {
+	id   string
+	arch string
+}
+
+// NewLinuxExtension creates an unsupported-architecture extension placeholder.
+func NewLinuxExtension(_ []byte, id string, arch string, _ string) *LinuxExtension {
+	return &LinuxExtension{id: id, arch: arch}
+}
+
+// GetID returns the extension identifier.
+func (l *LinuxExtension) GetID() string {
+	return l.id
+}
+
+// GetArch returns the extension architecture.
+func (l *LinuxExtension) GetArch() string {
+	return l.arch
+}
+
+// Load reports that native extensions are unsupported on this architecture.
+func (l *LinuxExtension) Load() error {
+	return errors.New("{{if .Config.Debug}} native extensions are not supported on this Linux architecture {{end}}")
+}
+
+// Call reports that native extensions are unsupported on this architecture.
+func (l *LinuxExtension) Call(_ string, _ []byte, _ func([]byte)) error {
+	return errors.New("{{if .Config.Debug}} native extensions are not supported on this Linux architecture {{end}}")
+}

implant/sliver/extension/extension_test.go

@@ -0,0 +1,236 @@
+package extension
+
+import (
+	"errors"
+	"fmt"
+	"runtime"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+type testExtension struct {
+	id string
+}
+
+func (e *testExtension) Load() error {
+	return nil
+}
+
+func (e *testExtension) Call(_ string, arguments []byte, callback func([]byte)) error {
+	callback(arguments)
+	return nil
+}
+
+func (e *testExtension) GetID() string {
+	return e.id
+}
+
+func (e *testExtension) GetArch() string {
+	return "test"
+}
+
+type registeringTestExtension struct {
+	testExtension
+	loadCalls *atomic.Int32
+	loadErr   error
+	started   chan struct{}
+	release   chan struct{}
+}
+
+func (e *registeringTestExtension) Load() error {
+	e.loadCalls.Add(1)
+	if e.started != nil {
+		close(e.started)
+	}
+	if e.release != nil {
+		<-e.release
+	}
+	return e.loadErr
+}
+
+func resetExtensionRegistry(t *testing.T) {
+	t.Helper()
+	extensionsMu.Lock()
+	previousExtensions := extensions
+	previousLoads := extensionLoads
+	extensions = make(map[string]Extension)
+	extensionLoads = make(map[string]*extensionLoad)
+	extensionsMu.Unlock()
+	t.Cleanup(func() {
+		extensionsMu.Lock()
+		extensions = previousExtensions
+		extensionLoads = previousLoads
+		extensionsMu.Unlock()
+	})
+}
+
+func waitForExtensionWaiters(t *testing.T, extensionID string, want int) {
+	t.Helper()
+	deadline := time.Now().Add(time.Second)
+	for {
+		extensionsMu.RLock()
+		loading := extensionLoads[extensionID]
+		got := 0
+		if loading != nil {
+			got = loading.waiters
+		}
+		extensionsMu.RUnlock()
+		if got == want {
+			return
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("registration waiters = %d, want %d", got, want)
+		}
+		runtime.Gosched()
+	}
+}
+
+func TestExtensionRegistryConcurrentAccess(t *testing.T) {
+	resetExtensionRegistry(t)
+
+	const count = 64
+	errCh := make(chan error, count)
+	var waitGroup sync.WaitGroup
+	for index := 0; index < count; index++ {
+		index := index
+		waitGroup.Add(1)
+		go func() {
+			defer waitGroup.Done()
+			id := fmt.Sprintf("extension-%d", index)
+			Add(&testExtension{id: id})
+			argument := []byte(id)
+			if err := Run(id, "run", argument, func(output []byte) {
+				if string(output) != id {
+					errCh <- fmt.Errorf("callback output = %q, want %q", output, id)
+				}
+			}); err != nil {
+				errCh <- err
+			}
+			_ = List()
+		}()
+	}
+	waitGroup.Wait()
+	close(errCh)
+	for err := range errCh {
+		t.Error(err)
+	}
+
+	if got := len(List()); got != count {
+		t.Fatalf("List returned %d extensions, want %d", got, count)
+	}
+}
+
+func TestRegisterLoadsExtensionOnlyOnce(t *testing.T) {
+	resetExtensionRegistry(t)
+
+	const extensionID = "duplicate-extension"
+	var loadCalls atomic.Int32
+	started := make(chan struct{})
+	release := make(chan struct{})
+	first := &registeringTestExtension{
+		testExtension: testExtension{id: extensionID},
+		loadCalls:     &loadCalls,
+		started:       started,
+		release:       release,
+	}
+
+	const registrations = 16
+	errorsCh := make(chan error, registrations)
+	go func() {
+		errorsCh <- Register(first)
+	}()
+	<-started
+	for index := 1; index < registrations; index++ {
+		go func() {
+			errorsCh <- Register(&registeringTestExtension{
+				testExtension: testExtension{id: extensionID},
+				loadCalls:     &loadCalls,
+			})
+		}()
+	}
+	waitForExtensionWaiters(t, extensionID, registrations-1)
+	select {
+	case err := <-errorsCh:
+		t.Fatalf("Register returned before the in-flight load completed: %v", err)
+	default:
+	}
+	close(release)
+	for index := 0; index < registrations; index++ {
+		if err := <-errorsCh; err != nil {
+			t.Fatalf("Register returned an error: %v", err)
+		}
+	}
+
+	if got := loadCalls.Load(); got != 1 {
+		t.Fatalf("Load called %d times, want 1", got)
+	}
+	if got := List(); len(got) != 1 || got[0] != extensionID {
+		t.Fatalf("List returned %q, want [%q]", got, extensionID)
+	}
+
+	if err := Register(&registeringTestExtension{
+		testExtension: testExtension{id: extensionID},
+		loadCalls:     &loadCalls,
+	}); err != nil {
+		t.Fatalf("repeat Register returned an error: %v", err)
+	}
+	if got := loadCalls.Load(); got != 1 {
+		t.Fatalf("repeat Register called Load; total calls = %d, want 1", got)
+	}
+}
+
+func TestRegisterRetriesAfterFailedLoad(t *testing.T) {
+	resetExtensionRegistry(t)
+
+	const extensionID = "retry-extension"
+	var loadCalls atomic.Int32
+	wantErr := errors.New("load failed")
+	started := make(chan struct{})
+	release := make(chan struct{})
+	const registrations = 8
+	errorsCh := make(chan error, registrations)
+	go func() {
+		errorsCh <- Register(&registeringTestExtension{
+			testExtension: testExtension{id: extensionID},
+			loadCalls:     &loadCalls,
+			loadErr:       wantErr,
+			started:       started,
+			release:       release,
+		})
+	}()
+	<-started
+	for index := 1; index < registrations; index++ {
+		go func() {
+			errorsCh <- Register(&registeringTestExtension{
+				testExtension: testExtension{id: extensionID},
+				loadCalls:     &loadCalls,
+				loadErr:       errors.New("unexpected follower load"),
+			})
+		}()
+	}
+	waitForExtensionWaiters(t, extensionID, registrations-1)
+	close(release)
+	for index := 0; index < registrations; index++ {
+		if err := <-errorsCh; !errors.Is(err, wantErr) {
+			t.Fatalf("Register error = %v, want shared error %v", err, wantErr)
+		}
+	}
+	if got := loadCalls.Load(); got != 1 {
+		t.Fatalf("failed Load called %d times, want 1", got)
+	}
+	if got := List(); len(got) != 0 {
+		t.Fatalf("failed extension was published: %q", got)
+	}
+
+	if err := Register(&registeringTestExtension{
+		testExtension: testExtension{id: extensionID},
+		loadCalls:     &loadCalls,
+	}); err != nil {
+		t.Fatalf("retry Register returned an error: %v", err)
+	}
+	if got := loadCalls.Load(); got != 2 {
+		t.Fatalf("Load called %d times, want 2", got)
+	}
+}

implant/sliver/extension/extension_unix.go

@@ -0,0 +1,174 @@
+//go:build (darwin && (amd64 || arm64)) || (linux && (386 || amd64 || arm64))
+
+package extension
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"errors"
+	"runtime"
+	"sync"
+	"sync/atomic"
+	"unsafe"
+
+	// {{if .Config.Debug}}
+	"log"
+	// {{end}}
+
+	"github.com/ebitengine/purego"
+	reflektor "github.com/sliverarmory/reflektor/native"
+)
+
+type extensionCall struct {
+	onFinish func([]byte)
+}
+
+// UnixExtension is a Reflektor-backed native extension for supported Unix
+// targets.
+type UnixExtension struct {
+	id       string
+	data     []byte
+	module   *reflektor.Library
+	arch     string
+	init     string
+	callback uintptr
+	active   atomic.Pointer[extensionCall]
+	sync.Mutex
+}
+
+func newUnixExtension(data []byte, id string, arch string, init string) *UnixExtension {
+	return &UnixExtension{
+		id:   id,
+		data: data,
+		arch: arch,
+		init: init,
+	}
+}
+
+// GetID returns the extension identifier.
+func (u *UnixExtension) GetID() string {
+	return u.id
+}
+
+// GetArch returns the extension architecture.
+func (u *UnixExtension) GetArch() string {
+	return u.arch
+}
+
+// Load maps the extension and invokes its optional initialization export.
+func (u *UnixExtension) Load() error {
+	if len(u.data) == 0 {
+		return errors.New("{{if .Config.Debug}} extension data is empty {{end}}")
+	}
+
+	u.Lock()
+	defer u.Unlock()
+	if u.module != nil {
+		return errors.New("{{if .Config.Debug}} module already loaded {{end}}")
+	}
+
+	module, err := reflektor.LoadLibrary(u.data)
+	if err != nil {
+		return err
+	}
+	if u.init != "" {
+		// {{if .Config.Debug}}
+		log.Printf("Calling %s\n", u.init)
+		// {{end}}
+		if err := module.CallExport(u.init); err != nil {
+			_ = module.Close()
+			return err
+		}
+	}
+
+	callback, err := newUnixExtensionCallback(u)
+	if err != nil {
+		_ = module.Close()
+		return err
+	}
+	u.callback = callback
+	u.module = module
+	return nil
+}
+
+// Call invokes an extension export with the native extension callback ABI.
+func (u *UnixExtension) Call(export string, arguments []byte, onFinish func([]byte)) error {
+	u.Lock()
+	defer u.Unlock()
+	if u.module == nil {
+		return errors.New("{{if .Config.Debug}} module not loaded {{end}}")
+	}
+	if uint64(len(arguments)) > uint64(^uint32(0)) {
+		return errors.New("{{if .Config.Debug}} extension arguments exceed uint32 size {{end}}")
+	}
+
+	var argumentsPtr uintptr
+	if len(arguments) > 0 {
+		argumentsPtr = uintptr(unsafe.Pointer(&arguments[0]))
+	}
+	argumentsSize := uintptr(uint32(len(arguments)))
+	call := &extensionCall{onFinish: onFinish}
+	u.active.Store(call)
+	defer u.active.Store(nil)
+
+	// {{if .Config.Debug}}
+	log.Printf("Calling %s, arguments addr: 0x%08x, args size: %08x\n", export, argumentsPtr, argumentsSize)
+	// {{end}}
+	_, err := u.module.CallExportWithArgs(export, argumentsPtr, argumentsSize, u.callback)
+	runtime.KeepAlive(arguments)
+	runtime.KeepAlive(call)
+	return err
+}
+
+func newUnixExtensionCallback(extension *UnixExtension) (callback uintptr, err error) {
+	defer func() {
+		if recovered := recover(); recovered != nil {
+			// {{if .Config.Debug}}
+			log.Printf("Failed to create extension callback: %v\n", recovered)
+			// {{end}}
+			callback = 0
+			err = errors.New("{{if .Config.Debug}} failed to create extension callback {{end}}")
+		}
+	}()
+	return purego.NewCallback(extension.extensionCallback), nil
+}
+
+func (u *UnixExtension) extensionCallback(data unsafe.Pointer, dataLen int32) (result int32) {
+	result = Failure
+	defer func() {
+		if recover() != nil {
+			result = Failure
+		}
+	}()
+
+	call := u.active.Load()
+	if call == nil || call.onFinish == nil {
+		return Failure
+	}
+	if dataLen == 0 {
+		return Success
+	}
+	if data == nil || dataLen < 0 {
+		return Failure
+	}
+
+	output := append([]byte(nil), unsafe.Slice((*byte)(data), int(dataLen))...)
+	call.onFinish(output)
+	return Success
+}

implant/sliver/extension/extension_unix_test.go

@@ -0,0 +1,59 @@
+//go:build (darwin && (amd64 || arm64)) || (linux && (386 || amd64 || arm64))
+
+package extension
+
+import (
+	"bytes"
+	"testing"
+	"unsafe"
+)
+
+func TestUnixExtensionCallbackCopiesOutput(t *testing.T) {
+	extension := &UnixExtension{}
+	var got []byte
+	call := &extensionCall{onFinish: func(output []byte) {
+		got = output
+	}}
+	extension.active.Store(call)
+	defer extension.active.Store(nil)
+
+	source := []byte("extension output")
+	result := extension.extensionCallback(unsafe.Pointer(&source[0]), int32(len(source)))
+	if result != Success {
+		t.Fatalf("extension callback returned %d, want %d", result, Success)
+	}
+	source[0] = 'X'
+	if !bytes.Equal(got, []byte("extension output")) {
+		t.Fatalf("extension callback output = %q, want an independent copy", got)
+	}
+}
+
+func TestUnixExtensionCallbackRejectsInvalidCalls(t *testing.T) {
+	extension := &UnixExtension{}
+	if result := extension.extensionCallback(nil, 1); result != Failure {
+		t.Fatalf("callback without an active call returned %d, want %d", result, Failure)
+	}
+
+	extension.active.Store(&extensionCall{onFinish: func([]byte) {}})
+	defer extension.active.Store(nil)
+	if result := extension.extensionCallback(nil, 1); result != Failure {
+		t.Fatalf("callback with a nil data pointer returned %d, want %d", result, Failure)
+	}
+	source := byte(0)
+	if result := extension.extensionCallback(unsafe.Pointer(&source), -1); result != Failure {
+		t.Fatalf("callback with a negative length returned %d, want %d", result, Failure)
+	}
+}
+
+func TestUnixExtensionCallbackContainsPanics(t *testing.T) {
+	extension := &UnixExtension{}
+	extension.active.Store(&extensionCall{onFinish: func([]byte) {
+		panic("callback failed")
+	}})
+	defer extension.active.Store(nil)
+
+	source := []byte("output")
+	if result := extension.extensionCallback(unsafe.Pointer(&source[0]), int32(len(source))); result != Failure {
+		t.Fatalf("panicking callback returned %d, want %d", result, Failure)
+	}
+}

implant/sliver/extension/extension_windows.go

@@ -28,18 +28,13 @@ import (
 	"log"
 	// {{end}}
 
-	"github.com/moloch--/memmod"
-)
-
-const (
-	Success = 0
-	Failure = 1
+	reflektor "github.com/sliverarmory/reflektor/memmod"
 )
 
 type WindowsExtension struct {
 	id     string
 	data   []byte
-	module *memmod.Module
+	module *reflektor.Module
 	arch   string
 	init   string
 	sync.Mutex
@@ -73,7 +68,7 @@ func (w *WindowsExtension) Load() error {
 	}
 	w.Lock()
 	defer w.Unlock()
-	w.module, err = memmod.LoadLibrary(w.data)
+	w.module, err = reflektor.LoadLibrary(w.data)
 	if err != nil {
 		return err
 	}

implant/sliver/handlers/README.md

@@ -2,16 +2,18 @@
 
 ## Overview
 
-Runtime message handlers that react to server instructions. Dispatches inbound RPC messages to feature-specific executors. Runtime components handle extensions WASM, handlers wireguard, handlers darwin, and handlers generic for implant-side handlers features.
+Runtime message handlers that react to server instructions. Dispatches inbound RPC messages to feature-specific executors, including native and WASM extension lifecycle requests.
 
 ## Go Files
 
 - `extensions-wasm.go` – Routes extension-related RPC messages to the WASM runtime.
+- `handlers_extensions.go` – Shared Windows, macOS, and Linux native extension registration, invocation, and listing handlers.
 - `handlers-wireguard.go` – Handles WireGuard control messages and state updates.
 - `handlers.go` – Registers core handler functions and shared dispatch utilities.
 - `handlers_darwin.go` – macOS-specific handler bindings and feature toggles.
 - `handlers_generic.go` – Generic handler implementations used when no platform specialization is required.
 - `handlers_linux.go` – Linux-focused handler logic and build tags.
+- `handlers_unix.go` – Shared macOS and Linux permission-change handlers.
 - `handlers_windows.go` – Windows-specific handler implementations.
 - `kill-handlers.go` – Processes kill commands for sessions and tasks in a platform-agnostic way.
 - `kill-handlers_windows.go` – Windows-specific kill command handling.

implant/sliver/handlers/handlers.go

@@ -444,12 +444,13 @@ func cdHandler(data []byte, resp RPCResponse) {
 		return
 	}
 
-	os.Chdir(cdReq.Path)
-	dir, err := os.Getwd()
-	pwd := &sliverpb.Pwd{Path: dir}
-	if err != nil {
-		resp([]byte{}, err)
-		return
+	chdirErr := os.Chdir(cdReq.Path)
+	dir, getwdErr := os.Getwd()
+	pwd := &sliverpb.Pwd{Path: dir, Response: &commonpb.Response{}}
+	if chdirErr != nil {
+		pwd.Response.Err = chdirErr.Error()
+	} else if getwdErr != nil {
+		pwd.Response.Err = getwdErr.Error()
 	}
 
 	// {{if .Config.Debug}}
@@ -984,7 +985,7 @@ func extractFiles(data []byte, path string, overwrite bool) (int, int, error) {
 					return filesWritten, filesSkipped, err
 				}
 			}
-			file, err := os.OpenFile(fileName, os.O_CREATE|os.O_RDWR, os.FileMode(header.Mode))
+			file, err := os.OpenFile(fileName, os.O_CREATE|os.O_RDWR|os.O_TRUNC, os.FileMode(header.Mode))
 			if err != nil {
 				file.Close()
 				return filesWritten, filesSkipped, err

implant/sliver/handlers/handlers_darwin.go

@@ -53,6 +53,8 @@ var (
 		pb.MsgUnsetEnvReq:        unsetEnvHandler,
 		pb.MsgChtimesReq:         chtimesHandler,
 		pb.MsgGrepReq:            grepHandler,
+		pb.MsgChmodReq:           chmodHandler,
+		pb.MsgChownReq:           chownHandler,
 
 		pb.MsgScreenshotReq: screenshotHandler,
 		pb.MsgNetstatReq:    netstatHandler,
@@ -92,69 +94,8 @@ func GetSystemHandlers() map[uint32]RPCHandler {
 
 // Extensions
 
-func registerExtensionHandler(data []byte, resp RPCResponse) {
-	registerReq := &pb.RegisterExtensionReq{}
-
-	err := proto.Unmarshal(data, registerReq)
-	if err != nil {
-		return
-	}
-
-	ext := extension.NewDarwinExtension(registerReq.Data, registerReq.Name, registerReq.OS, registerReq.Init)
-	extension.Add(ext)
-	err = ext.Load()
-	registerResp := &pb.RegisterExtension{
-		Response: &commonpb.Response{},
-	}
-	if err != nil {
-		registerResp.Response.Err = err.Error()
-	}
-	data, err = proto.Marshal(registerResp)
-	resp(data, err)
-}
-
-func callExtensionHandler(data []byte, resp RPCResponse) {
-	callReq := &pb.CallExtensionReq{}
-
-	err := proto.Unmarshal(data, callReq)
-	if err != nil {
-		return
-	}
-
-	callResp := &pb.CallExtension{
-		Response: &commonpb.Response{},
-	}
-	gotOutput := false
-	err = extension.Run(callReq.Name, callReq.Export, callReq.Args, func(out []byte) {
-		gotOutput = true
-		callResp.Output = out
-		data, err = proto.Marshal(callResp)
-		resp(data, err)
-	})
-	// Only send back synchronously if there was an error
-	if err != nil || !gotOutput {
-		if err != nil {
-			callResp.Response.Err = err.Error()
-		}
-		data, err = proto.Marshal(callResp)
-		resp(data, err)
-	}
-}
-
-func listExtensionsHandler(data []byte, resp RPCResponse) {
-	lstReq := &pb.ListExtensionsReq{}
-	err := proto.Unmarshal(data, lstReq)
-	if err != nil {
-		return
-	}
-
-	exts := extension.List()
-	lstResp := &pb.ListExtensions{
-		Response: &commonpb.Response{},
-		Names:    exts,
-	}
-	data, err = proto.Marshal(lstResp)
-	resp(data, err)
+func newExtension(data []byte, id string, arch string, init string) extension.Extension {
+	return extension.NewDarwinExtension(data, id, arch, init)
 }
 
 func mountHandler(data []byte, resp RPCResponse) {

implant/sliver/handlers/handlers_extensions.go

@@ -0,0 +1,92 @@
+//go:build linux || darwin || windows
+
+package handlers
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"github.com/bishopfox/sliver/implant/sliver/extension"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"google.golang.org/protobuf/proto"
+)
+
+type extensionFactory func(data []byte, id string, arch string, init string) extension.Extension
+
+func registerExtensionHandler(data []byte, resp RPCResponse) {
+	registerExtension(data, resp, newExtension)
+}
+
+func registerExtension(data []byte, resp RPCResponse, factory extensionFactory) {
+	registerReq := &sliverpb.RegisterExtensionReq{}
+	if err := proto.Unmarshal(data, registerReq); err != nil {
+		return
+	}
+
+	ext := factory(registerReq.Data, registerReq.Name, registerReq.OS, registerReq.Init)
+	err := extension.Register(ext)
+	registerResp := &sliverpb.RegisterExtension{Response: &commonpb.Response{}}
+	if err != nil {
+		registerResp.Response.Err = err.Error()
+	}
+	data, err = proto.Marshal(registerResp)
+	resp(data, err)
+}
+
+func callExtensionHandler(data []byte, resp RPCResponse) {
+	callReq := &sliverpb.CallExtensionReq{}
+	if err := proto.Unmarshal(data, callReq); err != nil {
+		return
+	}
+
+	callResp := &sliverpb.CallExtension{Response: &commonpb.Response{}}
+	gotOutput := false
+	var output []byte
+	err := extension.Run(callReq.Name, callReq.Export, callReq.Args, func(out []byte) {
+		// Native callbacks run on the extension's call stack. Keep the first
+		// result, copy it before the native buffer expires, and respond only
+		// after the extension call has returned.
+		if gotOutput {
+			return
+		}
+		gotOutput = true
+		output = append([]byte(nil), out...)
+	})
+	if gotOutput {
+		callResp.Output = output
+	} else if err != nil {
+		callResp.Response.Err = err.Error()
+	}
+	data, err = proto.Marshal(callResp)
+	resp(data, err)
+}
+
+func listExtensionsHandler(data []byte, resp RPCResponse) {
+	lstReq := &sliverpb.ListExtensionsReq{}
+	if err := proto.Unmarshal(data, lstReq); err != nil {
+		return
+	}
+
+	lstResp := &sliverpb.ListExtensions{
+		Response: &commonpb.Response{},
+		Names:    extension.List(),
+	}
+	data, err := proto.Marshal(lstResp)
+	resp(data, err)
+}

implant/sliver/handlers/handlers_extensions_test.go

@@ -0,0 +1,215 @@
+//go:build linux || darwin || windows
+
+package handlers
+
+import (
+	"bytes"
+	"errors"
+	"slices"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/bishopfox/sliver/implant/sliver/extension"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"google.golang.org/protobuf/proto"
+)
+
+type failingExtension struct {
+	id      string
+	loadErr error
+}
+
+type callbackLifetimeExtension struct {
+	id               string
+	output           []byte
+	nativeOutput     []byte
+	callActive       atomic.Bool
+	callbackReturned chan struct{}
+	allowCallReturn  chan struct{}
+	allowReturnOnce  sync.Once
+}
+
+func (f *failingExtension) Load() error {
+	return f.loadErr
+}
+
+func (f *failingExtension) Call(string, []byte, func([]byte)) error {
+	return nil
+}
+
+func (f *failingExtension) GetID() string {
+	return f.id
+}
+
+func (f *failingExtension) GetArch() string {
+	return "test"
+}
+
+func (e *callbackLifetimeExtension) Load() error {
+	return nil
+}
+
+func (e *callbackLifetimeExtension) Call(_ string, _ []byte, callback func([]byte)) error {
+	e.callActive.Store(true)
+	defer e.callActive.Store(false)
+
+	e.nativeOutput = append([]byte(nil), e.output...)
+	callback(e.nativeOutput)
+	for index := range e.nativeOutput {
+		e.nativeOutput[index] = 0xa5
+	}
+	close(e.callbackReturned)
+	<-e.allowCallReturn
+	return nil
+}
+
+func (e *callbackLifetimeExtension) GetID() string {
+	return e.id
+}
+
+func (e *callbackLifetimeExtension) GetArch() string {
+	return "test"
+}
+
+func (e *callbackLifetimeExtension) allowReturn() {
+	e.allowReturnOnce.Do(func() {
+		close(e.allowCallReturn)
+	})
+}
+
+func TestRegisterExtensionDoesNotAddFailedLoad(t *testing.T) {
+	const extensionID = "handler-test-failed-load"
+	wantErr := errors.New("load failed")
+	request, err := proto.Marshal(&sliverpb.RegisterExtensionReq{Name: extensionID})
+	if err != nil {
+		t.Fatalf("marshal request: %v", err)
+	}
+
+	var (
+		responseData []byte
+		responseErr  error
+		responses    int
+	)
+	registerExtension(request, func(data []byte, err error) {
+		responses++
+		responseData = data
+		responseErr = err
+	}, func(_ []byte, id string, _, _ string) extension.Extension {
+		return &failingExtension{id: id, loadErr: wantErr}
+	})
+
+	if responseErr != nil {
+		t.Fatalf("response callback returned error: %v", responseErr)
+	}
+	if responses != 1 {
+		t.Fatalf("got %d responses, want 1", responses)
+	}
+	response := &sliverpb.RegisterExtension{}
+	if err := proto.Unmarshal(responseData, response); err != nil {
+		t.Fatalf("unmarshal response: %v", err)
+	}
+	if response.GetResponse().GetErr() != wantErr.Error() {
+		t.Fatalf("got response error %q, want %q", response.GetResponse().GetErr(), wantErr)
+	}
+	if slices.Contains(extension.List(), extensionID) {
+		t.Fatalf("extension %q was registered after its load failed", extensionID)
+	}
+}
+
+func TestCallExtensionHandlerDefersResponseAndCopiesCallbackOutput(t *testing.T) {
+	const extensionID = "handler-test-callback-lifetime"
+	wantOutput := []byte("native extension output")
+	ext := &callbackLifetimeExtension{
+		id:               extensionID,
+		output:           wantOutput,
+		callbackReturned: make(chan struct{}),
+		allowCallReturn:  make(chan struct{}),
+	}
+	extension.Add(ext)
+	defer ext.allowReturn()
+
+	request, err := proto.Marshal(&sliverpb.CallExtensionReq{Name: extensionID, Export: "Run"})
+	if err != nil {
+		t.Fatalf("marshal request: %v", err)
+	}
+
+	type handlerResponse struct {
+		data       []byte
+		err        error
+		callActive bool
+	}
+	responses := make(chan handlerResponse, 2)
+	handlerDone := make(chan struct{})
+	go func() {
+		defer close(handlerDone)
+		callExtensionHandler(request, func(data []byte, err error) {
+			responses <- handlerResponse{
+				data:       append([]byte(nil), data...),
+				err:        err,
+				callActive: ext.callActive.Load(),
+			}
+		})
+	}()
+
+	select {
+	case <-ext.callbackReturned:
+	case <-time.After(5 * time.Second):
+		t.Fatal("extension callback did not return")
+	}
+	select {
+	case <-responses:
+		t.Fatal("RPC response was delivered before Extension.Call returned")
+	default:
+	}
+
+	ext.allowReturn()
+	var response handlerResponse
+	select {
+	case response = <-responses:
+	case <-time.After(5 * time.Second):
+		t.Fatal("callExtensionHandler did not deliver a response")
+	}
+	if response.callActive {
+		t.Fatal("RPC response was delivered while Extension.Call was active")
+	}
+	if response.err != nil {
+		t.Fatalf("response callback returned error: %v", response.err)
+	}
+
+	callResponse := &sliverpb.CallExtension{}
+	if err := proto.Unmarshal(response.data, callResponse); err != nil {
+		t.Fatalf("unmarshal response: %v", err)
+	}
+	if !bytes.Equal(callResponse.Output, wantOutput) {
+		t.Fatalf("response output = %q, want %q", callResponse.Output, wantOutput)
+	}
+	if bytes.Equal(ext.nativeOutput, wantOutput) {
+		t.Fatal("fake native output was not poisoned after the callback")
+	}
+
+	select {
+	case <-handlerDone:
+	case <-time.After(5 * time.Second):
+		t.Fatal("callExtensionHandler did not return")
+	}
+	select {
+	case <-responses:
+		t.Fatal("callExtensionHandler delivered more than one response")
+	default:
+	}
+}
+
+func TestSystemHandlersIncludeExtensions(t *testing.T) {
+	handlers := GetSystemHandlers()
+	for _, messageType := range []uint32{
+		sliverpb.MsgRegisterExtensionReq,
+		sliverpb.MsgCallExtensionReq,
+		sliverpb.MsgListExtensionsReq,
+	} {
+		if handlers[messageType] == nil {
+			t.Errorf("handler for message type %d is not registered", messageType)
+		}
+	}
+}

implant/sliver/handlers/handlers_filesystem_test.go

@@ -0,0 +1,77 @@
+package handlers
+
+import (
+	"archive/tar"
+	"bytes"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"google.golang.org/protobuf/proto"
+)
+
+func TestCdHandlerReportsChdirFailure(t *testing.T) {
+	workingDirectory := t.TempDir()
+	t.Chdir(workingDirectory)
+
+	request, err := proto.Marshal(&sliverpb.CdReq{Path: filepath.Join(workingDirectory, "missing")})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	called := false
+	cdHandler(request, func(data []byte, handlerErr error) {
+		called = true
+		if handlerErr != nil {
+			t.Fatalf("cdHandler callback error: %v", handlerErr)
+		}
+		response := &sliverpb.Pwd{}
+		if err := proto.Unmarshal(data, response); err != nil {
+			t.Fatalf("decode cd response: %v", err)
+		}
+		if response.GetResponse().GetErr() == "" {
+			t.Fatal("cdHandler returned success for a missing directory")
+		}
+		if response.Path != workingDirectory {
+			t.Fatalf("working directory changed: got %q, want %q", response.Path, workingDirectory)
+		}
+	})
+	if !called {
+		t.Fatal("cdHandler did not invoke its response callback")
+	}
+}
+
+func TestExtractFilesTruncatesOverwrittenFile(t *testing.T) {
+	destination := t.TempDir()
+	archive := func(content string) []byte {
+		t.Helper()
+		buffer := bytes.NewBuffer(nil)
+		writer := tar.NewWriter(buffer)
+		header := &tar.Header{Name: "bundle/item.txt", Mode: 0o600, Size: int64(len(content)), Typeflag: tar.TypeReg}
+		if err := writer.WriteHeader(header); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := writer.Write([]byte(content)); err != nil {
+			t.Fatal(err)
+		}
+		if err := writer.Close(); err != nil {
+			t.Fatal(err)
+		}
+		return buffer.Bytes()
+	}
+
+	if written, skipped, err := extractFiles(archive("a deliberately long first payload\n"), destination, false); err != nil || written != 1 || skipped != 0 {
+		t.Fatalf("initial extract: written=%d skipped=%d err=%v", written, skipped, err)
+	}
+	if written, skipped, err := extractFiles(archive("short\n"), destination, true); err != nil || written != 1 || skipped != 0 {
+		t.Fatalf("overwrite extract: written=%d skipped=%d err=%v", written, skipped, err)
+	}
+	content, err := os.ReadFile(filepath.Join(destination, "bundle", "item.txt"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(content) != "short\n" {
+		t.Fatalf("overwritten content = %q, want exact shorter payload", content)
+	}
+}

implant/sliver/handlers/handlers_linux.go

@@ -20,22 +20,20 @@ package handlers
 
 import (
 	"fmt"
-	"io/fs"
 	"os"
 	"os/user"
-	"path/filepath"
-	"runtime"
 	"strconv"
 	"strings"
 	"syscall"
 	"time"
-	"unsafe"
 
+	"github.com/bishopfox/sliver/implant/sliver/extension"
 	"github.com/bishopfox/sliver/implant/sliver/mount"
 	"github.com/bishopfox/sliver/implant/sliver/procdump"
 	"github.com/bishopfox/sliver/implant/sliver/taskrunner"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"golang.org/x/sys/unix"
 	"google.golang.org/protobuf/proto"
 
 	// {{if .Config.Debug}}
@@ -76,6 +74,11 @@ var (
 		sliverpb.MsgMountReq:       mountHandler,
 		sliverpb.MsgGrepReq:        grepHandler,
 
+		// Extensions
+		sliverpb.MsgRegisterExtensionReq: registerExtensionHandler,
+		sliverpb.MsgCallExtensionReq:     callExtensionHandler,
+		sliverpb.MsgListExtensionsReq:    listExtensionsHandler,
+
 		// Wasm Extensions - Note that execution can be done via a tunnel handler
 		sliverpb.MsgRegisterWasmExtensionReq:   registerWasmExtensionHandler,
 		sliverpb.MsgDeregisterWasmExtensionReq: deregisterWasmExtensionHandler,
@@ -91,11 +94,12 @@ var (
 		sliverpb.MsgWGListSocksReq:      wgListSocksServersHandler,
 		// {{end}}
 
-		// Linux Only
+		// Unix permissions
 		sliverpb.MsgChmodReq:   chmodHandler,
 		sliverpb.MsgChownReq:   chownHandler,
 		sliverpb.MsgChtimesReq: chtimesHandler,
 
+		// Linux Only
 		sliverpb.MsgMemfilesListReq: memfilesListHandler,
 		sliverpb.MsgMemfilesAddReq:  memfilesAddHandler,
 		sliverpb.MsgMemfilesRmReq:   memfilesRmHandler,
@@ -107,6 +111,10 @@ func GetSystemHandlers() map[uint32]RPCHandler {
 	return linuxHandlers
 }
 
+func newExtension(data []byte, id string, arch string, init string) extension.Extension {
+	return extension.NewLinuxExtension(data, id, arch, init)
+}
+
 func dumpHandler(data []byte, resp RPCResponse) {
 	procDumpReq := &sliverpb.ProcessDumpReq{}
 	err := proto.Unmarshal(data, procDumpReq)
@@ -251,34 +259,24 @@ func memfilesListHandler(_ []byte, resp RPCResponse) {
 }
 
 func memfilesAddHandler(_ []byte, resp RPCResponse) {
-
-	var nrMemfdCreate int
-	memfilesAdd := &sliverpb.MemfilesAdd{}
-	memfilesAdd.Response = &commonpb.Response{}
+	memfilesAdd := &sliverpb.MemfilesAdd{Response: &commonpb.Response{}}
 
 	memfdName := taskrunner.RandomString(8)
-	memfd, err := syscall.BytePtrFromString(memfdName)
+	fd, err := unix.MemfdCreate(memfdName, unix.MFD_CLOEXEC)
 	if err != nil {
 		//{{if .Config.Debug}}
-		log.Printf("Error during conversion: %s\n", err)
+		log.Printf("Error creating memfd: %s\n", err)
 		//{{end}}
-		return
-	}
-	if runtime.GOARCH == "386" {
-		nrMemfdCreate = 356
+		memfilesAdd.Response.Err = err.Error()
 	} else {
-		nrMemfdCreate =
-			319
+		memfilesAdd.Fd = int64(fd)
 	}
 
-	fd, _, _ := syscall.Syscall(uintptr(nrMemfdCreate), uintptr(unsafe.Pointer(memfd)), 1, 0)
-	fd_str := fmt.Sprintf("%d", fd)
-	fd_int, _ := strconv.ParseInt(fd_str, 0, 64)
-	memfilesAdd.Fd = fd_int
-
 	data, err := proto.Marshal(memfilesAdd)
+	if err != nil && fd >= 0 {
+		_ = unix.Close(fd)
+	}
 	resp(data, err)
-
 }
 
 func memfilesRmHandler(data []byte, resp RPCResponse) {
@@ -320,165 +318,3 @@ func memfilesRmHandler(data []byte, resp RPCResponse) {
 	resp(data, err)
 
 }
-
-func chmodHandler(data []byte, resp RPCResponse) {
-	chmodReq := &sliverpb.ChmodReq{}
-	err := proto.Unmarshal(data, chmodReq)
-	if err != nil {
-		// {{if .Config.Debug}}
-		log.Printf("error decoding message: %v", err)
-		// {{end}}
-		return
-	}
-
-	chmod := &sliverpb.Chmod{}
-	target, _ := filepath.Abs(chmodReq.Path)
-	chmod.Path = target
-	// Make sure file exists
-	_, err = os.Stat(target)
-
-	chmod.Response = &commonpb.Response{}
-	if err == nil {
-		// Convert string to octal number
-		octal, err := strconv.ParseInt(chmodReq.FileMode, 8, 32)
-		if err == nil {
-
-			setuid := octal & 04000
-			setgid := octal & 02000
-			setstcky := octal & 01000
-
-			// Cast the octal number to fs.FileMode
-			fileMode := os.FileMode(octal)
-
-			// Found this was necessary because the constructor above doesn't set special permissions
-			if setuid > 0 {
-				fileMode = fileMode | os.ModeSetuid
-			}
-			if setgid > 0 {
-				fileMode = fileMode | os.ModeSetgid
-			}
-			if setstcky > 0 {
-				fileMode = fileMode | os.ModeSticky
-			}
-
-			if chmodReq.Recursive {
-
-				err := filepath.WalkDir(target, func(file string, d fs.DirEntry, err error) error {
-					if err == nil {
-						err = os.Chmod(file, fileMode)
-						if err != nil {
-							return err
-						}
-					} else {
-						return err
-					}
-					return nil
-				})
-				if err != nil {
-					chmod.Response.Err = err.Error()
-				}
-
-			} else {
-				err = os.Chmod(target, fileMode)
-				if err != nil {
-					chmod.Response.Err = err.Error()
-				}
-			}
-		} else {
-			chmod.Response.Err = err.Error()
-		}
-	} else {
-		chmod.Response.Err = err.Error()
-	}
-
-	data, err = proto.Marshal(chmod)
-	resp(data, err)
-}
-
-func chownHandler(data []byte, resp RPCResponse) {
-
-	// variable definitions so goto won't break
-	var uid_str string
-	var gid_str string
-	var gid uint64
-	var uid uint64
-	var err error
-	var usr *user.User
-	var grp *user.Group
-
-	chownReq := &sliverpb.ChownReq{}
-	err = proto.Unmarshal(data, chownReq)
-	if err != nil {
-		// {{if .Config.Debug}}
-		log.Printf("error decoding message: %v", err)
-		// {{end}}
-		return
-	}
-
-	chown := &sliverpb.Chown{}
-	target, _ := filepath.Abs(chownReq.Path)
-	chown.Path = target
-	_, err = os.Stat(target)
-
-	chown.Response = &commonpb.Response{}
-	if err != nil {
-		chown.Response.Err = err.Error()
-		goto finished
-	}
-
-	uid_str = chownReq.Uid
-	usr, err = user.Lookup(uid_str)
-	if err != nil {
-		chown.Response.Err = err.Error()
-		goto finished
-	}
-
-	uid, err = strconv.ParseUint(usr.Uid, 10, 32)
-	if err != nil {
-		chown.Response.Err = err.Error()
-		goto finished
-	}
-
-	gid_str = chownReq.Gid
-	grp, err = user.LookupGroup(gid_str)
-	if err != nil {
-		chown.Response.Err = err.Error()
-		goto finished
-	}
-
-	gid, err = strconv.ParseUint(grp.Gid, 10, 32)
-	if err != nil {
-		chown.Response.Err = err.Error()
-		goto finished
-	}
-
-	// Check if the recursive flag is set and the path is a directory
-	if chownReq.Recursive {
-
-		err := filepath.WalkDir(target, func(file string, d fs.DirEntry, err error) error {
-			if err == nil {
-				err = os.Chown(file, int(uid), int(gid))
-				if err != nil {
-					return err
-				}
-			} else {
-				return err
-			}
-			return nil
-		})
-		if err != nil {
-			chown.Response.Err = err.Error()
-		}
-
-	} else {
-
-		err = os.Chown(target, int(uid), int(gid))
-		if err != nil {
-			chown.Response.Err = err.Error()
-		}
-	}
-
-finished:
-	data, err = proto.Marshal(chown)
-	resp(data, err)
-}

implant/sliver/handlers/handlers_memfiles_linux_test.go

@@ -0,0 +1,69 @@
+package handlers
+
+import (
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"golang.org/x/sys/unix"
+	"google.golang.org/protobuf/proto"
+)
+
+func TestMemfilesAddAndRemoveLifecycle(t *testing.T) {
+	var addResponse *sliverpb.MemfilesAdd
+	memfilesAddHandler(nil, func(data []byte, handlerErr error) {
+		if handlerErr != nil {
+			t.Fatalf("memfilesAddHandler callback error: %v", handlerErr)
+		}
+		addResponse = &sliverpb.MemfilesAdd{}
+		if err := proto.Unmarshal(data, addResponse); err != nil {
+			t.Fatalf("decode add response: %v", err)
+		}
+	})
+	if addResponse == nil {
+		t.Fatal("memfilesAddHandler did not invoke its response callback")
+	}
+	if errText := addResponse.GetResponse().GetErr(); errText != "" {
+		t.Fatalf("memfilesAddHandler returned error: %s", errText)
+	}
+	if addResponse.Fd < 3 {
+		t.Fatalf("memfilesAddHandler returned invalid fd %d", addResponse.Fd)
+	}
+	fd := int(addResponse.Fd)
+	defer func() { _ = unix.Close(fd) }()
+
+	fdPath := fmt.Sprintf("/proc/%d/fd/%d", os.Getpid(), fd)
+	link, err := os.Readlink(fdPath)
+	if err != nil {
+		t.Fatalf("read memfd link: %v", err)
+	}
+	if !strings.Contains(link, "/memfd:") {
+		t.Fatalf("fd link %q does not identify a memfd", link)
+	}
+
+	request, err := proto.Marshal(&sliverpb.MemfilesRmReq{Fd: addResponse.Fd})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var removeResponse *sliverpb.MemfilesRm
+	memfilesRmHandler(request, func(data []byte, handlerErr error) {
+		if handlerErr != nil {
+			t.Fatalf("memfilesRmHandler callback error: %v", handlerErr)
+		}
+		removeResponse = &sliverpb.MemfilesRm{}
+		if err := proto.Unmarshal(data, removeResponse); err != nil {
+			t.Fatalf("decode remove response: %v", err)
+		}
+	})
+	if removeResponse == nil {
+		t.Fatal("memfilesRmHandler did not invoke its response callback")
+	}
+	if errText := removeResponse.GetResponse().GetErr(); errText != "" {
+		t.Fatalf("memfilesRmHandler returned error: %s", errText)
+	}
+	if _, err := os.Readlink(fdPath); !os.IsNotExist(err) {
+		t.Fatalf("memfd still accessible after removal: %v", err)
+	}
+}

implant/sliver/handlers/handlers_network_test.go

@@ -0,0 +1,30 @@
+package handlers
+
+import (
+	"testing"
+
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"google.golang.org/protobuf/proto"
+)
+
+func TestNetstatHandlerRespondsWithoutTCP(t *testing.T) {
+	request, err := proto.Marshal(&sliverpb.NetstatReq{UDP: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	called := false
+	netstatHandler(request, func(data []byte, handlerErr error) {
+		called = true
+		if handlerErr != nil {
+			t.Fatalf("netstatHandler callback error: %v", handlerErr)
+		}
+		response := &sliverpb.Netstat{}
+		if err := proto.Unmarshal(data, response); err != nil {
+			t.Fatalf("decode netstat response: %v", err)
+		}
+	})
+	if !called {
+		t.Fatal("netstatHandler did not respond to a request without TCP")
+	}
+}

implant/sliver/handlers/handlers_unix.go

@@ -0,0 +1,199 @@
+//go:build darwin || linux
+
+package handlers
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2019  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"io/fs"
+	"os"
+	"os/user"
+	"path/filepath"
+	"strconv"
+
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"google.golang.org/protobuf/proto"
+
+	// {{if .Config.Debug}}
+	"log"
+	// {{end}}
+)
+
+func chmodHandler(data []byte, resp RPCResponse) {
+	chmodReq := &sliverpb.ChmodReq{}
+	err := proto.Unmarshal(data, chmodReq)
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Printf("error decoding message: %v", err)
+		// {{end}}
+		return
+	}
+
+	chmod := &sliverpb.Chmod{}
+	target, _ := filepath.Abs(chmodReq.Path)
+	chmod.Path = target
+	// Make sure file exists
+	_, err = os.Stat(target)
+
+	chmod.Response = &commonpb.Response{}
+	if err == nil {
+		// Convert string to octal number
+		octal, err := strconv.ParseInt(chmodReq.FileMode, 8, 32)
+		if err == nil {
+
+			setuid := octal & 04000
+			setgid := octal & 02000
+			setstcky := octal & 01000
+
+			// Cast the octal number to fs.FileMode
+			fileMode := os.FileMode(octal)
+
+			// Found this was necessary because the constructor above doesn't set special permissions
+			if setuid > 0 {
+				fileMode = fileMode | os.ModeSetuid
+			}
+			if setgid > 0 {
+				fileMode = fileMode | os.ModeSetgid
+			}
+			if setstcky > 0 {
+				fileMode = fileMode | os.ModeSticky
+			}
+
+			if chmodReq.Recursive {
+
+				err := filepath.WalkDir(target, func(file string, _ fs.DirEntry, err error) error {
+					if err == nil {
+						err = os.Chmod(file, fileMode)
+						if err != nil {
+							return err
+						}
+					} else {
+						return err
+					}
+					return nil
+				})
+				if err != nil {
+					chmod.Response.Err = err.Error()
+				}
+
+			} else {
+				err = os.Chmod(target, fileMode)
+				if err != nil {
+					chmod.Response.Err = err.Error()
+				}
+			}
+		} else {
+			chmod.Response.Err = err.Error()
+		}
+	} else {
+		chmod.Response.Err = err.Error()
+	}
+
+	data, err = proto.Marshal(chmod)
+	resp(data, err)
+}
+
+func chownHandler(data []byte, resp RPCResponse) {
+
+	// variable definitions so goto won't break
+	var uidStr string
+	var gidStr string
+	var gid uint64
+	var uid uint64
+	var err error
+	var usr *user.User
+	var grp *user.Group
+
+	chownReq := &sliverpb.ChownReq{}
+	err = proto.Unmarshal(data, chownReq)
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Printf("error decoding message: %v", err)
+		// {{end}}
+		return
+	}
+
+	chown := &sliverpb.Chown{}
+	target, _ := filepath.Abs(chownReq.Path)
+	chown.Path = target
+	_, err = os.Stat(target)
+
+	chown.Response = &commonpb.Response{}
+	if err != nil {
+		chown.Response.Err = err.Error()
+		goto finished
+	}
+
+	uidStr = chownReq.Uid
+	usr, err = user.Lookup(uidStr)
+	if err != nil {
+		chown.Response.Err = err.Error()
+		goto finished
+	}
+
+	uid, err = strconv.ParseUint(usr.Uid, 10, 32)
+	if err != nil {
+		chown.Response.Err = err.Error()
+		goto finished
+	}
+
+	gidStr = chownReq.Gid
+	grp, err = user.LookupGroup(gidStr)
+	if err != nil {
+		chown.Response.Err = err.Error()
+		goto finished
+	}
+
+	gid, err = strconv.ParseUint(grp.Gid, 10, 32)
+	if err != nil {
+		chown.Response.Err = err.Error()
+		goto finished
+	}
+
+	// Check if the recursive flag is set and the path is a directory
+	if chownReq.Recursive {
+
+		err := filepath.WalkDir(target, func(file string, _ fs.DirEntry, err error) error {
+			if err == nil {
+				err = os.Chown(file, int(uid), int(gid))
+				if err != nil {
+					return err
+				}
+			} else {
+				return err
+			}
+			return nil
+		})
+		if err != nil {
+			chown.Response.Err = err.Error()
+		}
+
+	} else {
+
+		err = os.Chown(target, int(uid), int(gid))
+		if err != nil {
+			chown.Response.Err = err.Error()
+		}
+	}
+
+finished:
+	data, err = proto.Marshal(chown)
+	resp(data, err)
+}

implant/sliver/handlers/handlers_unix_test.go

@@ -0,0 +1,153 @@
+//go:build darwin || linux
+
+package handlers
+
+import (
+	"os"
+	"os/user"
+	"path/filepath"
+	"strconv"
+	"syscall"
+	"testing"
+
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"google.golang.org/protobuf/proto"
+)
+
+func TestUnixPermissionHandlersRegistered(t *testing.T) {
+	handlers := GetSystemHandlers()
+	for _, messageType := range []uint32{sliverpb.MsgChmodReq, sliverpb.MsgChownReq} {
+		if _, ok := handlers[messageType]; !ok {
+			t.Fatalf("message type %d is not registered", messageType)
+		}
+	}
+}
+
+func TestChmodHandlerRecursive(t *testing.T) {
+	target := filepath.Join(t.TempDir(), "target")
+	nested := filepath.Join(target, "nested")
+	file := filepath.Join(nested, "fixture.txt")
+	if err := os.MkdirAll(nested, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(file, []byte("fixture"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	request, err := proto.Marshal(&sliverpb.ChmodReq{Path: target, FileMode: "0750", Recursive: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	called := false
+	chmodHandler(request, func(data []byte, handlerErr error) {
+		called = true
+		if handlerErr != nil {
+			t.Fatalf("chmodHandler callback error: %v", handlerErr)
+		}
+		response := &sliverpb.Chmod{}
+		if err := proto.Unmarshal(data, response); err != nil {
+			t.Fatalf("decode chmod response: %v", err)
+		}
+		if response.GetResponse().GetErr() != "" {
+			t.Fatalf("chmodHandler response error: %s", response.GetResponse().GetErr())
+		}
+		if response.Path != target {
+			t.Fatalf("chmodHandler path = %q, want %q", response.Path, target)
+		}
+	})
+	if !called {
+		t.Fatal("chmodHandler did not invoke its response callback")
+	}
+
+	for _, path := range []string{target, nested, file} {
+		info, err := os.Stat(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if got := info.Mode().Perm(); got != 0o750 {
+			t.Errorf("%s mode = %o, want 750", path, got)
+		}
+	}
+}
+
+func TestChownHandlerRecursiveCurrentOwner(t *testing.T) {
+	current, group, wantUID, wantGID := currentOwner(t)
+
+	target := filepath.Join(t.TempDir(), "target")
+	file := filepath.Join(target, "fixture.txt")
+	if err := os.MkdirAll(target, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(file, []byte("fixture"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	request, err := proto.Marshal(&sliverpb.ChownReq{
+		Path: target, Uid: current.Username, Gid: group.Name, Recursive: true,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	called := false
+	chownHandler(request, func(data []byte, handlerErr error) {
+		called = true
+		if handlerErr != nil {
+			t.Fatalf("chownHandler callback error: %v", handlerErr)
+		}
+		response := &sliverpb.Chown{}
+		if err := proto.Unmarshal(data, response); err != nil {
+			t.Fatalf("decode chown response: %v", err)
+		}
+		if response.GetResponse().GetErr() != "" {
+			t.Fatalf("chownHandler response error: %s", response.GetResponse().GetErr())
+		}
+		if response.Path != target {
+			t.Fatalf("chownHandler path = %q, want %q", response.Path, target)
+		}
+	})
+	if !called {
+		t.Fatal("chownHandler did not invoke its response callback")
+	}
+
+	assertOwner(t, []string{target, file}, wantUID, wantGID)
+}
+
+func currentOwner(t *testing.T) (*user.User, *user.Group, uint64, uint64) {
+	t.Helper()
+	current, err := user.Current()
+	if err != nil {
+		t.Fatal(err)
+	}
+	group, err := user.LookupGroupId(current.Gid)
+	if err != nil {
+		t.Fatal(err)
+	}
+	wantUID, err := strconv.ParseUint(current.Uid, 10, 32)
+	if err != nil {
+		t.Fatal(err)
+	}
+	wantGID, err := strconv.ParseUint(group.Gid, 10, 32)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return current, group, wantUID, wantGID
+}
+
+func assertOwner(t *testing.T, paths []string, wantUID uint64, wantGID uint64) {
+	t.Helper()
+	for _, path := range paths {
+		info, err := os.Stat(path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		stat, ok := info.Sys().(*syscall.Stat_t)
+		if !ok {
+			t.Fatalf("%s stat type = %T, want *syscall.Stat_t", path, info.Sys())
+		}
+		if uint64(stat.Uid) != wantUID || uint64(stat.Gid) != wantGID {
+			t.Errorf("%s owner = %d:%d, want %d:%d", path, stat.Uid, stat.Gid, wantUID, wantGID)
+		}
+	}
+}

implant/sliver/handlers/handlers_windows.go

@@ -912,63 +912,8 @@ func mountHandler(data []byte, resp RPCResponse) {
 
 // Extensions
 
-func registerExtensionHandler(data []byte, resp RPCResponse) {
-	registerReq := &sliverpb.RegisterExtensionReq{}
-	err := proto.Unmarshal(data, registerReq)
-	if err != nil {
-		return
-	}
-	ext := extension.NewWindowsExtension(registerReq.Data, registerReq.Name, registerReq.OS, registerReq.Init)
-	err = ext.Load()
-	registerResp := &sliverpb.RegisterExtension{Response: &commonpb.Response{}}
-	if err != nil {
-		registerResp.Response.Err = err.Error()
-	} else {
-		extension.Add(ext)
-	}
-	data, err = proto.Marshal(registerResp)
-	resp(data, err)
-}
-
-func callExtensionHandler(data []byte, resp RPCResponse) {
-	callReq := &sliverpb.CallExtensionReq{}
-	err := proto.Unmarshal(data, callReq)
-	if err != nil {
-		return
-	}
-
-	callResp := &sliverpb.CallExtension{Response: &commonpb.Response{}}
-	gotOutput := false
-	err = extension.Run(callReq.Name, callReq.Export, callReq.Args, func(out []byte) {
-		gotOutput = true
-		callResp.Output = out
-		data, err = proto.Marshal(callResp)
-		resp(data, err)
-	})
-	// Only send back synchronously if there was an error
-	if err != nil || !gotOutput {
-		if err != nil {
-			callResp.Response.Err = err.Error()
-		}
-		data, err = proto.Marshal(callResp)
-		resp(data, err)
-	}
-}
-
-func listExtensionsHandler(data []byte, resp RPCResponse) {
-	lstReq := &sliverpb.ListExtensionsReq{}
-	err := proto.Unmarshal(data, lstReq)
-	if err != nil {
-		return
-	}
-
-	exts := extension.List()
-	lstResp := &sliverpb.ListExtensions{
-		Response: &commonpb.Response{},
-		Names:    exts,
-	}
-	data, err = proto.Marshal(lstResp)
-	resp(data, err)
+func newExtension(data []byte, id string, arch string, init string) extension.Extension {
+	return extension.NewWindowsExtension(data, id, arch, init)
 }
 
 // Stub since Windows doesn't support UID

implant/sliver/handlers/rpc-handlers.go

@@ -201,10 +201,10 @@ func netstatHandler(data []byte, resp RPCResponse) {
 			}
 			entries = append(entries, buildEntries("tcp6", tabs)...)
 		}
-		result.Entries = entries
-		data, err := proto.Marshal(result)
-		resp(data, err)
 	}
+	result.Entries = entries
+	data, err = proto.Marshal(result)
+	resp(data, err)
 }
 
 func buildEntries(proto string, s []netstat.SockTabEntry) []*sliverpb.SockTabEntry {

implant/sliver/main.go

@@ -1,3 +1,5 @@
+//go:build !sliver_lint
+
 package main
 
 /*

implant/sliver/pivots/pivots.go

@@ -38,11 +38,20 @@ import (
 	"google.golang.org/protobuf/proto"
 )
 
+// MaxFrameLength bounds the payload size a pivot will allocate from a peer's
+// 4-byte length prefix. A corrupted or desynced prefix can otherwise be read as
+// a value up to ~4GiB and trigger an allocation large enough to crash the
+// implant (see BishopFox/sliver#1452). 512MiB is far above any realistic
+// relayed message but well below a fatal allocation.
+const MaxFrameLength = 512 * 1024 * 1024
+
 var (
 	// ErrFailedWrite - Failed to write to a connection
 	ErrFailedWrite = errors.New("failed to write")
 	// ErrFailedKeyExchange - Failed to exchange session and/or peer keys
 	ErrFailedKeyExchange = errors.New("failed key exchange")
+	// ErrFrameTooLarge - A peer's declared frame length exceeds MaxFrameLength
+	ErrFrameTooLarge = errors.New("pivot frame exceeds maximum length")
 
 	pivotListeners        = &sync.Map{}
 	stoppedPivotListeners = &sync.Map{}
@@ -496,6 +505,12 @@ func (p *NetConnPivot) read() ([]byte, error) {
 		// {{end}}
 		return nil, errors.New("[pivot] zero data length")
 	}
+	if dataLength > MaxFrameLength {
+		// {{if .Config.Debug}}
+		log.Printf("[pivot] read error: frame length %d exceeds max %d\n", dataLength, MaxFrameLength)
+		// {{end}}
+		return nil, ErrFrameTooLarge
+	}
 	dataBuf := make([]byte, dataLength)
 
 	n, err = io.ReadFull(p.conn, dataBuf)

implant/sliver/pivots/pivots_test.go

@@ -0,0 +1,100 @@
+package pivots
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2019  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"encoding/binary"
+	"errors"
+	"net"
+	"sync"
+	"testing"
+	"time"
+)
+
+func framePrefix(n uint32) []byte {
+	b := make([]byte, 4)
+	binary.LittleEndian.PutUint32(b, n)
+	return b
+}
+
+// readWithTimeout runs read() with a deadline so a regression (an unbounded
+// read that blocks waiting for a bogus multi-GB body) fails fast instead of
+// hanging the whole test binary.
+func readWithTimeout(t *testing.T, read func() ([]byte, error)) ([]byte, error) {
+	t.Helper()
+	type result struct {
+		data []byte
+		err  error
+	}
+	ch := make(chan result, 1)
+	go func() {
+		d, e := read()
+		ch <- result{d, e}
+	}()
+	select {
+	case r := <-ch:
+		return r.data, r.err
+	case <-time.After(3 * time.Second):
+		t.Fatal("read() did not return in time (possible unbounded read)")
+		return nil, nil
+	}
+}
+
+// A corrupted/desynced 4-byte length prefix that reads as a huge value must be
+// rejected before allocating, instead of triggering a multi-GB allocation that
+// crashes the implant (BishopFox/sliver#1452).
+func TestNetConnPivotReadRejectsOversizedFrame(t *testing.T) {
+	client, server := net.Pipe()
+	defer func() { _ = client.Close() }()
+	defer func() { _ = server.Close() }()
+
+	p := &NetConnPivot{conn: server, readMutex: &sync.Mutex{}}
+
+	go func() {
+		// Only the length prefix is ever sent; no body follows.
+		_, _ = client.Write(framePrefix(uint32(MaxFrameLength) + 1))
+	}()
+
+	if _, err := readWithTimeout(t, p.read); !errors.Is(err, ErrFrameTooLarge) {
+		t.Fatalf("expected ErrFrameTooLarge, got %v", err)
+	}
+}
+
+// A well-formed frame within the bound must still round-trip unchanged.
+func TestNetConnPivotReadAcceptsValidFrame(t *testing.T) {
+	client, server := net.Pipe()
+	defer func() { _ = client.Close() }()
+	defer func() { _ = server.Close() }()
+
+	p := &NetConnPivot{conn: server, readMutex: &sync.Mutex{}}
+
+	payload := []byte("hello pivot")
+	go func() {
+		_, _ = client.Write(framePrefix(uint32(len(payload))))
+		_, _ = client.Write(payload)
+	}()
+
+	data, err := readWithTimeout(t, p.read)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if string(data) != string(payload) {
+		t.Fatalf("got %q, want %q", data, payload)
+	}
+}

implant/sliver/ps/architecture_test.go

@@ -0,0 +1,42 @@
+// Package ps provides process enumeration and architecture detection.
+package ps
+
+import "testing"
+
+func TestArchitectureFromELFMachine(t *testing.T) {
+	tests := map[uint16]string{
+		3:   "x86",
+		62:  "x86_64",
+		183: "aarch64",
+		179: "",
+	}
+	for machine, expected := range tests {
+		if actual := architectureFromELFMachine(machine); actual != expected {
+			t.Errorf("machine %d: got %q, want %q", machine, actual, expected)
+		}
+	}
+}
+
+func TestArchitectureFromWindowsMachines(t *testing.T) {
+	tests := []struct {
+		name           string
+		processMachine uint16
+		nativeMachine  uint16
+		expected       string
+	}{
+		{name: "x86 on amd64", processMachine: 0x014c, nativeMachine: 0x8664, expected: "x86"},
+		{name: "x86 on arm64", processMachine: 0x014c, nativeMachine: 0xaa64, expected: "x86"},
+		{name: "native amd64", nativeMachine: 0x8664, expected: "x86_64"},
+		{name: "native arm64", nativeMachine: 0xaa64, expected: "arm64"},
+		{name: "exact amd64", processMachine: 0x8664, nativeMachine: 0xaa64, expected: "x86_64"},
+		{name: "unknown", processMachine: 0xffff, nativeMachine: 0xaa64, expected: ""},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			actual := architectureFromWindowsMachines(test.processMachine, test.nativeMachine)
+			if actual != test.expected {
+				t.Fatalf("got %q, want %q", actual, test.expected)
+			}
+		})
+	}
+}

implant/sliver/ps/ps.go

@@ -56,3 +56,36 @@ func Kill(pid int) error {
 	}
 	return p.Kill()
 }
+
+func architectureFromELFMachine(machine uint16) string {
+	switch machine {
+	case 3:
+		return "x86"
+	case 62:
+		return "x86_64"
+	case 183:
+		return "aarch64"
+	default:
+		return ""
+	}
+}
+
+func architectureFromWindowsMachine(machine uint16) string {
+	switch machine {
+	case 0x014c:
+		return "x86"
+	case 0x8664:
+		return "x86_64"
+	case 0xaa64:
+		return "arm64"
+	default:
+		return ""
+	}
+}
+
+func architectureFromWindowsMachines(processMachine, nativeMachine uint16) string {
+	if processMachine != 0 {
+		return architectureFromWindowsMachine(processMachine)
+	}
+	return architectureFromWindowsMachine(nativeMachine)
+}

implant/sliver/ps/ps_linux.go

@@ -4,6 +4,7 @@
 package ps
 
 import (
+	"encoding/binary"
 	"fmt"
 	"io"
 	"os"
@@ -114,16 +115,7 @@ func getProcessArchitecture(pid int) (string, error) {
 		return "", nil
 	}
 
-	if mach[0] == 0xb3 {
-		return "aarch64", nil
-	}
-	if mach[0] == 0x03 {
-		return "x86", nil
-	}
-	if mach[0] == 0x3e {
-		return "x86_64", nil
-	}
-	return "", err
+	return architectureFromELFMachine(binary.LittleEndian.Uint16(mach)), nil
 }
 
 // Refresh reloads all the data associated with this process.

implant/sliver/ps/ps_windows.go

@@ -4,6 +4,7 @@
 package ps
 
 import (
+	"errors"
 	"fmt"
 	"runtime"
 	"strings"
@@ -14,6 +15,16 @@ import (
 	"golang.org/x/sys/windows"
 )
 
+const processMachineTypeInfo = 9
+
+type processMachineInformation struct {
+	ProcessMachine    uint16
+	Reserved          uint16
+	MachineAttributes uint32
+}
+
+var getProcessInformation = windows.NewLazySystemDLL("kernel32.dll").NewProc("GetProcessInformation")
+
 // WindowsProcess is an implementation of Process for Windows.
 type WindowsProcess struct {
 	pid       int
@@ -267,32 +278,7 @@ func getCmdLine(pid uint32) ([]string, error) {
 	return strings.Fields(syscall.UTF16ToString(module.SzExePath[:]) + " : " + syscall.UTF16ToString(cmdLine[:])), nil
 }
 
-var nativeArch string = ""
-var nativeArchLookup bool = true
-
 func getProcessArchitecture(pid uint32) (string, error) {
-
-	if nativeArchLookup {
-		nativeArchLookup = false
-		if runtime.GOARCH == "amd64" {
-			nativeArch = "x86_64"
-		} else {
-			var is64Bit bool
-			pHandle := windows.CurrentProcess()
-			if uint(pHandle) == 0 {
-				nativeArch = ""
-			} else if err := windows.IsWow64Process(pHandle, &is64Bit); err != nil {
-				nativeArch = ""
-			} else {
-				if !is64Bit {
-					nativeArch = "x86"
-				} else {
-					nativeArch = "x86_64"
-				}
-			}
-		}
-	}
-
 	proc, err := syscall.OpenProcess(
 		windows.PROCESS_QUERY_INFORMATION,
 		false,
@@ -309,22 +295,74 @@ func getProcessArchitecture(pid uint32) (string, error) {
 		}
 	}
 
-	arch := ""
-	var isWow64 bool
-	if err := windows.IsWow64Process(windows.Handle(proc), &isWow64); err == nil {
-		if isWow64 {
-			arch = "x86"
-		} else {
-			arch = nativeArch
+	arch, queryErr := queryProcessArchitecture(windows.Handle(proc))
+	closeErr := syscall.CloseHandle(proc)
+	if queryErr != nil {
+		return "", queryErr
+	}
+	if closeErr != nil {
+		return "", closeErr
+	}
+	return arch, nil
+}
+
+func queryProcessArchitecture(handle windows.Handle) (string, error) {
+	if arch, err := processMachineArchitecture(handle); err == nil && arch != "" {
+		return arch, nil
+	}
+
+	var processMachine, nativeMachine uint16
+	if err := windows.IsWow64Process2(handle, &processMachine, &nativeMachine); err == nil {
+		if arch := architectureFromWindowsMachines(processMachine, nativeMachine); arch != "" {
+			return arch, nil
 		}
 	}
 
-	err = syscall.CloseHandle(proc)
-	if err != nil {
+	var isWow64 bool
+	if err := windows.IsWow64Process(handle, &isWow64); err != nil {
 		return "", err
 	}
+	if isWow64 {
+		return "x86", nil
+	}
 
-	return arch, err
+	switch runtime.GOARCH {
+	case "amd64":
+		return "x86_64", nil
+	case "arm64":
+		return "arm64", nil
+	case "386":
+		var currentIsWow64 bool
+		if err := windows.IsWow64Process(windows.CurrentProcess(), &currentIsWow64); err != nil {
+			return "", err
+		}
+		if currentIsWow64 {
+			return "x86_64", nil
+		}
+		return "x86", nil
+	default:
+		return "", nil
+	}
+}
+
+func processMachineArchitecture(handle windows.Handle) (string, error) {
+	if err := getProcessInformation.Find(); err != nil {
+		return "", err
+	}
+	info := processMachineInformation{}
+	result, _, callErr := getProcessInformation.Call(
+		uintptr(handle),
+		uintptr(processMachineTypeInfo),
+		uintptr(unsafe.Pointer(&info)),
+		unsafe.Sizeof(info),
+	)
+	if result == 0 {
+		if callErr != nil && !errors.Is(callErr, syscall.Errno(0)) {
+			return "", callErr
+		}
+		return "", syscall.EINVAL
+	}
+	return architectureFromWindowsMachine(info.ProcessMachine), nil
 }
 
 func getSessionID(pid uint32) (int, error) {

implant/sliver/ps/ps_windows_test.go

@@ -0,0 +1,26 @@
+package ps
+
+import (
+	"os"
+	"runtime"
+	"testing"
+)
+
+func TestGetProcessArchitectureCurrentProcess(t *testing.T) {
+	expected := map[string]string{
+		"386":   "x86",
+		"amd64": "x86_64",
+		"arm64": "arm64",
+	}[runtime.GOARCH]
+	if expected == "" {
+		t.Skipf("unsupported test architecture %s", runtime.GOARCH)
+	}
+
+	actual, err := getProcessArchitecture(uint32(os.Getpid()))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if actual != expected {
+		t.Fatalf("got %q, want %q", actual, expected)
+	}
+}

implant/sliver/runner/runner.go

@@ -1,3 +1,5 @@
+//go:build !sliver_lint
+
 package runner
 
 /*
@@ -147,6 +149,7 @@ func beaconStartup() {
 		abort <- struct{}{}
 	}()
 	beacons := transports.StartBeaconLoop(abort)
+	pendingResults := &beaconResultQueue{}
 	for beacon := range beacons {
 		// {{if .Config.Debug}}
 		log.Printf("Next beacon = %v", beacon)
@@ -159,7 +162,7 @@ func beaconStartup() {
 				// {{end}}
 				continue
 			}
-			err := beaconMainLoop(beacon)
+			err := beaconMainLoop(beacon, pendingResults)
 			if err != nil {
 				connectionErrors++
 				if transports.GetMaxConnectionErrors() < connectionErrors {
@@ -215,7 +218,38 @@ func sessionStartup() {
 // {{end}}
 
 // {{if .Config.IsBeacon}}
-func beaconMainLoop(beacon *transports.Beacon) error {
+type beaconResultQueue struct {
+	mu      sync.Mutex
+	results []*sliverpb.Envelope
+}
+
+func (q *beaconResultQueue) add(result *sliverpb.Envelope) {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+	q.results = append(q.results, result)
+}
+
+func (q *beaconResultQueue) drain() []*sliverpb.Envelope {
+	q.mu.Lock()
+	defer q.mu.Unlock()
+	results := q.results
+	q.results = nil
+	return results
+}
+
+func (q *beaconResultQueue) prepend(results []*sliverpb.Envelope) {
+	if len(results) == 0 {
+		return
+	}
+	q.mu.Lock()
+	defer q.mu.Unlock()
+	combined := make([]*sliverpb.Envelope, 0, len(results)+len(q.results))
+	combined = append(combined, results...)
+	combined = append(combined, q.results...)
+	q.results = combined
+}
+
+func beaconMainLoop(beacon *transports.Beacon, pendingResults *beaconResultQueue) error {
 	// Register beacon
 	err := beacon.Init()
 	if err != nil {
@@ -248,7 +282,6 @@ func beaconMainLoop(beacon *transports.Beacon) error {
 	// {{if .Config.Debug}}
 	log.Printf("Registering beacon with server")
 	// {{end}}
-	nextCheckin := time.Now().Add(beacon.Duration())
 	register := registerSliver()
 	register.ActiveC2 = beacon.ActiveC2
 	register.ProxyURL = beacon.ProxyURL
@@ -262,44 +295,40 @@ func beaconMainLoop(beacon *transports.Beacon) error {
 	time.Sleep(time.Second)
 	beacon.Close()
 
-	// BeaconMain - Tasks run in background goroutines, check-ins happen on schedule
-	// Results are collected and sent on subsequent check-ins
-	pendingResults := make(chan *sliverpb.Envelope, 100)
-	errors := make(chan error)
-	shortCircuit := make(chan struct{})
+	return beaconCheckinLoop(beacon, pendingResults, beaconMain)
+}
 
+type beaconCheckinFunc func(*transports.Beacon, time.Time, *beaconResultQueue) error
+
+// beaconCheckinLoop schedules check-ins without overlapping them. Beacon
+// transport callbacks share per-check-in connection state, so the previous
+// check-in must finish closing its resources before the next one can start.
+func beaconCheckinLoop(beacon *transports.Beacon, pendingResults *beaconResultQueue, checkin beaconCheckinFunc) error {
 	for {
 		duration := beacon.Duration()
-		nextCheckin = time.Now().Add(duration)
-
-		go func() {
-			oldInterval := beacon.Interval()
-			err := beaconMain(beacon, nextCheckin, pendingResults)
-			if err != nil {
-				// {{if .Config.Debug}}
-				log.Printf("[beacon] main error: %v", nextCheckin)
-				// {{end}}
-				errors <- err
-			} else if oldInterval != beacon.Interval() {
-				// The beacon's interval was modified so we need to short circuit
-				// the current sleep and tell the server when the next checkin will
-				// be based on the new interval.
-				shortCircuit <- struct{}{}
-			}
-		}()
+		nextCheckin := time.Now().Add(duration)
+		oldInterval := beacon.Interval()
+		err := checkin(beacon, nextCheckin, pendingResults)
+		if err != nil {
+			// {{if .Config.Debug}}
+			log.Printf("[beacon] main error: %v", nextCheckin)
+			// {{end}}
+			return err
+		}
 
 		// {{if .Config.Debug}}
 		log.Printf("[beacon] sleep until %v", nextCheckin)
 		// {{end}}
-		select {
-		case <-errors:
-			return err
-		case <-time.After(duration):
-		case <-shortCircuit:
-			// Short circuit current duration with no error
+		if oldInterval == beacon.Interval() {
+			// Keep the original start-to-start cadence when the check-in
+			// finishes before its deadline. If it overruns, begin the next
+			// check-in immediately without overlapping shared transport state.
+			if remaining := time.Until(nextCheckin); 0 < remaining {
+				time.Sleep(remaining)
+			}
 		}
 
-		// check if reconfig used to set a new C2-URI 
+		// check if reconfig used to set a new C2-URI
 		if c2 := transports.GetC2URI(); c2 != "" && c2 != beacon.ActiveC2 {
 			// {{if .Config.Debug}}
 			log.Printf("[beacon] C2 URI changed to %s, reconnecting...", c2)
@@ -307,10 +336,9 @@ func beaconMainLoop(beacon *transports.Beacon) error {
 			return nil
 		}
 	}
-	return nil
 }
 
-func beaconMain(beacon *transports.Beacon, nextCheckin time.Time, pendingResults chan *sliverpb.Envelope) error {
+func beaconMain(beacon *transports.Beacon, nextCheckin time.Time, pendingResults *beaconResultQueue) error {
 	err := beacon.Start()
 	if err != nil {
 		// {{if .Config.Debug}}
@@ -326,17 +354,8 @@ func beaconMain(beacon *transports.Beacon, nextCheckin time.Time, pendingResults
 		beacon.Close()
 	}()
 
-	// Collect any pending results from background tasks
-	var completedResults []*sliverpb.Envelope
-collecting:
-	for {
-		select {
-		case result := <-pendingResults:
-			completedResults = append(completedResults, result)
-		default:
-			break collecting
-		}
-	}
+	// Collect any pending results from background tasks.
+	completedResults := pendingResults.drain()
 
 	// {{if .Config.Debug}}
 	log.Printf("[beacon] sending check in with %d pending results...", len(completedResults))
@@ -347,11 +366,18 @@ collecting:
 		Tasks:       completedResults,
 	}))
 	if err != nil {
+		pendingResults.prepend(completedResults)
 		// {{if .Config.Debug}}
 		log.Printf("[beacon] send failure %s", err)
 		// {{end}}
 		return err
 	}
+	// The server deliberately does not return pending tasks on a result-only
+	// check-in. Waiting for a response here blocks this loop until another
+	// check-in replaces the transport connection.
+	if len(completedResults) > 0 {
+		return nil
+	}
 	// {{if .Config.Debug}}
 	log.Printf("[beacon] recv task(s) ...")
 	// {{end}}
@@ -399,7 +425,7 @@ collecting:
 	// Dispatch tasks to background - results sent to pendingResults as each completes
 	// Extensions must be registered synchronously before other tasks can use them
 	for _, r := range beaconHandleTasklist(tasksExtensionRegister) {
-		pendingResults <- r
+		pendingResults.add(r)
 	}
 
 	// Dispatch other tasks individually - each sends its result when done
@@ -412,7 +438,7 @@ collecting:
 }
 
 // beaconDispatchTasks dispatches tasks to run in background, sending results as each completes
-func beaconDispatchTasks(tasks []*sliverpb.Envelope, pendingResults chan *sliverpb.Envelope) {
+func beaconDispatchTasks(tasks []*sliverpb.Envelope, pendingResults *beaconResultQueue) {
 	sysHandlers := handlers.GetSystemHandlers()
 	specHandlers := handlers.GetKillHandlers()
 
@@ -432,10 +458,10 @@ func beaconDispatchTasks(tasks []*sliverpb.Envelope, pendingResults chan *sliver
 					}
 					log.Printf("[beacon] task completed (id: %d)", taskID)
 					// {{end}}
-					pendingResults <- &sliverpb.Envelope{
+					pendingResults.add(&sliverpb.Envelope{
 						ID:   taskID,
 						Data: data,
-					}
+					})
 				})
 			}()
 			//  {{else}}
@@ -447,26 +473,26 @@ func beaconDispatchTasks(tasks []*sliverpb.Envelope, pendingResults chan *sliver
 					}
 					log.Printf("[beacon] task completed (id: %d)", taskID)
 					// {{end}}
-					pendingResults <- &sliverpb.Envelope{
+					pendingResults.add(&sliverpb.Envelope{
 						ID:   taskID,
 						Data: data,
-					}
+					})
 				})
 			}()
 			// {{end}}
 		} else if task.Type == sliverpb.MsgOpenSession {
 			go openSessionHandler(task.Data)
-			pendingResults <- &sliverpb.Envelope{
+			pendingResults.add(&sliverpb.Envelope{
 				ID:   task.ID,
 				Data: []byte{},
-			}
+			})
 		} else if handler, ok := specHandlers[task.Type]; ok {
 			go handler(task.Data, nil)
 		} else {
-			pendingResults <- &sliverpb.Envelope{
+			pendingResults.add(&sliverpb.Envelope{
 				ID:                 task.ID,
 				UnknownMessageType: true,
-			}
+			})
 		}
 	}
 }

implant/sliver/runner/runner_beacon_test.go

@@ -0,0 +1,220 @@
+//go:build windows && !sliver_lint
+
+package runner
+
+import (
+	"errors"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/bishopfox/sliver/implant/sliver/transports"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+)
+
+func setBeaconTimingForTest(t *testing.T, interval time.Duration) {
+	t.Helper()
+	oldInterval := transports.GetInterval()
+	oldJitter := transports.GetJitter()
+	oldC2URI := transports.GetC2URI()
+	transports.SetInterval(int64(interval))
+	transports.SetJitter(1) // Int63n(1) always yields zero jitter.
+	transports.SetC2URI("")
+	t.Cleanup(func() {
+		transports.SetInterval(oldInterval)
+		transports.SetJitter(oldJitter)
+		transports.SetC2URI(oldC2URI)
+	})
+}
+
+func TestBeaconCheckinLoopSerializesSlowCheckins(t *testing.T) {
+	const interval = 10 * time.Millisecond
+	setBeaconTimingForTest(t, interval)
+
+	firstStarted := make(chan struct{})
+	secondStarted := make(chan struct{})
+	releaseFirst := make(chan struct{})
+	var releaseOnce sync.Once
+	release := func() { releaseOnce.Do(func() { close(releaseFirst) }) }
+	defer release()
+
+	stopErr := errors.New("stop check-in loop")
+	var stateMu sync.Mutex
+	active := 0
+	maxActive := 0
+	calls := 0
+	checkin := func(*transports.Beacon, time.Time, *beaconResultQueue) error {
+		stateMu.Lock()
+		active++
+		calls++
+		call := calls
+		if maxActive < active {
+			maxActive = active
+		}
+		stateMu.Unlock()
+		defer func() {
+			stateMu.Lock()
+			active--
+			stateMu.Unlock()
+		}()
+
+		switch call {
+		case 1:
+			close(firstStarted)
+			<-releaseFirst
+			return nil
+		case 2:
+			close(secondStarted)
+			return stopErr
+		default:
+			return errors.New("unexpected extra check-in")
+		}
+	}
+
+	done := make(chan error, 1)
+	go func() {
+		done <- beaconCheckinLoop(&transports.Beacon{}, &beaconResultQueue{}, checkin)
+	}()
+
+	select {
+	case <-firstStarted:
+	case <-time.After(time.Second):
+		t.Fatal("first check-in did not start")
+	}
+	overlapped := false
+	select {
+	case <-secondStarted:
+		overlapped = true
+	case <-time.After(5 * interval):
+	}
+
+	release()
+	select {
+	case err := <-done:
+		if !errors.Is(err, stopErr) {
+			t.Fatalf("got error %v, want %v", err, stopErr)
+		}
+	case <-time.After(time.Second):
+		t.Fatal("check-in loop did not stop")
+	}
+
+	stateMu.Lock()
+	defer stateMu.Unlock()
+	if overlapped {
+		t.Error("second check-in overlapped the first")
+	}
+	if calls != 2 {
+		t.Fatalf("check-in called %d times, want 2", calls)
+	}
+	if maxActive != 1 {
+		t.Fatalf("maximum concurrent check-ins = %d, want 1", maxActive)
+	}
+}
+
+func TestBeaconCheckinLoopShortCircuitsReconfiguredInterval(t *testing.T) {
+	const originalInterval = 500 * time.Millisecond
+	setBeaconTimingForTest(t, originalInterval)
+
+	stopErr := errors.New("stop check-in loop")
+	calls := 0
+	start := time.Now()
+	err := beaconCheckinLoop(&transports.Beacon{}, &beaconResultQueue{}, func(*transports.Beacon, time.Time, *beaconResultQueue) error {
+		calls++
+		if calls == 1 {
+			transports.SetInterval(int64(time.Millisecond))
+			return nil
+		}
+		return stopErr
+	})
+	if !errors.Is(err, stopErr) {
+		t.Fatalf("got error %v, want %v", err, stopErr)
+	}
+	if elapsed := time.Since(start); originalInterval/2 <= elapsed {
+		t.Fatalf("reconfigured interval did not short circuit sleep: %s", elapsed)
+	}
+}
+
+func TestBeaconResultQueuePrependPreservesOrder(t *testing.T) {
+	queue := &beaconResultQueue{}
+	first := &sliverpb.Envelope{ID: 1}
+	second := &sliverpb.Envelope{ID: 2}
+	third := &sliverpb.Envelope{ID: 3}
+	queue.add(third)
+	queue.prepend([]*sliverpb.Envelope{first, second})
+
+	actual := queue.drain()
+	if len(actual) != 3 || actual[0] != first || actual[1] != second || actual[2] != third {
+		t.Fatalf("unexpected result order: %+v", actual)
+	}
+	if remaining := queue.drain(); len(remaining) != 0 {
+		t.Fatalf("drain left %d result(s)", len(remaining))
+	}
+}
+
+func TestBeaconMainResultCheckinDoesNotWaitForTasks(t *testing.T) {
+	queue := &beaconResultQueue{}
+	queue.add(&sliverpb.Envelope{ID: 41, Data: []byte("result")})
+
+	var recvCalled bool
+	beacon := &transports.Beacon{
+		Start: func() error { return nil },
+		Send:  func(*sliverpb.Envelope) error { return nil },
+		Recv: func() (*sliverpb.Envelope, error) {
+			recvCalled = true
+			return nil, errors.New("unexpected receive")
+		},
+		Close: func() error { return nil },
+	}
+
+	if err := beaconMain(beacon, time.Now(), queue); err != nil {
+		t.Fatal(err)
+	}
+	if recvCalled {
+		t.Fatal("result-only check-in waited for a server task response")
+	}
+	if remaining := queue.drain(); len(remaining) != 0 {
+		t.Fatalf("successful check-in retained %d result(s)", len(remaining))
+	}
+}
+
+func TestBeaconMainEmptyCheckinWaitsForTasks(t *testing.T) {
+	queue := &beaconResultQueue{}
+	var recvCalled bool
+	beacon := &transports.Beacon{
+		Start: func() error { return nil },
+		Send:  func(*sliverpb.Envelope) error { return nil },
+		Recv: func() (*sliverpb.Envelope, error) {
+			recvCalled = true
+			return nil, nil
+		},
+		Close: func() error { return nil },
+	}
+
+	if err := beaconMain(beacon, time.Now(), queue); err != nil {
+		t.Fatal(err)
+	}
+	if !recvCalled {
+		t.Fatal("empty check-in did not wait for a server task response")
+	}
+}
+
+func TestBeaconMainRequeuesResultsAfterSendFailure(t *testing.T) {
+	wantErr := errors.New("send failed")
+	result := &sliverpb.Envelope{ID: 73, Data: []byte("result")}
+	queue := &beaconResultQueue{}
+	queue.add(result)
+	beacon := &transports.Beacon{
+		Start: func() error { return nil },
+		Send:  func(*sliverpb.Envelope) error { return wantErr },
+		Recv:  func() (*sliverpb.Envelope, error) { return nil, nil },
+		Close: func() error { return nil },
+	}
+
+	if err := beaconMain(beacon, time.Now(), queue); !errors.Is(err, wantErr) {
+		t.Fatalf("got error %v, want %v", err, wantErr)
+	}
+	actual := queue.drain()
+	if len(actual) != 1 || actual[0] != result {
+		t.Fatalf("send failure did not preserve exact result: %+v", actual)
+	}
+}

implant/sliver/taskrunner/task_linux.go

@@ -29,6 +29,8 @@ import (
 	"syscall"
 	"unsafe"
 
+	"golang.org/x/sys/unix"
+
 	//{{if .Config.Debug}}
 	"log"
 	//{{end}}
@@ -98,26 +100,21 @@ func RemoteTask(processID int, data []byte, rwxPages bool) error {
 // Sideload - Side load a library and return its output
 func Sideload(procName string, procArgs []string, _ uint32, data []byte, args []string, kill bool) (string, error) {
 	var (
-		nrMemfdCreate int
-		stdOut        bytes.Buffer
-		stdErr        bytes.Buffer
-		wg            sync.WaitGroup
-		cmd           *exec.Cmd
+		stdOut bytes.Buffer
+		stdErr bytes.Buffer
+		wg     sync.WaitGroup
+		cmd    *exec.Cmd
 	)
 	memfdName := RandomString(8)
-	memfd, err := syscall.BytePtrFromString(memfdName)
+	fd, err := unix.MemfdCreate(memfdName, unix.MFD_CLOEXEC)
 	if err != nil {
 		//{{if .Config.Debug}}
-		log.Printf("Error during conversion: %s\n", err)
+		log.Printf("Error creating memfd: %s\n", err)
 		//{{end}}
-		return "", err
+		return "", fmt.Errorf("create memfd: %w", err)
 	}
-	if runtime.GOARCH == "386" {
-		nrMemfdCreate = 356
-	} else {
-		nrMemfdCreate = 319
-	}
-	fd, _, _ := syscall.Syscall(uintptr(nrMemfdCreate), uintptr(unsafe.Pointer(memfd)), 1, 0)
+	defer func() { _ = unix.Close(fd) }()
+
 	pid := os.Getpid()
 	fdPath := fmt.Sprintf("/proc/%d/fd/%d", pid, fd)
 	err = os.WriteFile(fdPath, data, 0755)

implant/sliver/transports/beacon.go

@@ -325,8 +325,9 @@ func wgBeacon(uri *url.URL) *Beacon {
 				return err
 			}
 			if _, err := conn.Write([]byte(wireguard.YamuxPreface)); err != nil {
-				_ = conn.Close()
-				_ = dev.Down()
+				closeWGBeaconResources(nil, conn, dev)
+				conn = nil
+				dev = nil
 				return err
 			}
 			cfg := yamux.DefaultConfig()
@@ -339,8 +340,9 @@ func wgBeacon(uri *url.URL) *Beacon {
 			// {{end}}
 			muxSession, err = yamux.Client(conn, cfg)
 			if err != nil {
-				_ = conn.Close()
-				_ = dev.Down()
+				closeWGBeaconResources(nil, conn, dev)
+				conn = nil
+				dev = nil
 				return err
 			}
 			return nil
@@ -354,26 +356,13 @@ func wgBeacon(uri *url.URL) *Beacon {
 			return wireguard.ReadEnvelope(stream)
 		},
 		Send: func(envelope *pb.Envelope) error {
-			stream, err := muxSession.Open()
-			if err != nil {
-				return err
-			}
-			defer stream.Close()
-			return wireguard.WriteEnvelope(stream, envelope)
+			return sendWGBeaconEnvelope(muxSession, envelope)
 		},
 		Close: func() error {
-			if muxSession != nil {
-				_ = muxSession.Close()
-				muxSession = nil
-			}
-			if conn != nil {
-				_ = conn.Close()
-				conn = nil
-			}
-			if dev != nil {
-				_ = dev.Down()
-				dev = nil
-			}
+			closeWGBeaconResources(muxSession, conn, dev)
+			muxSession = nil
+			conn = nil
+			dev = nil
 			return nil
 		},
 		Cleanup: func() error {
@@ -383,6 +372,71 @@ func wgBeacon(uri *url.URL) *Beacon {
 	return beacon
 }
 
+// closeWGBeaconResources permanently closes each per-check-in resource. A
+// device.Down only stops the bind and peers; it leaves the netstack TUN and
+// WireGuard worker goroutines alive, so beacon reconnects must use Close.
+func closeWGBeaconResources(muxSession *yamux.Session, conn net.Conn, dev *device.Device) {
+	if muxSession != nil {
+		_ = muxSession.Close()
+	}
+	if conn != nil {
+		_ = conn.Close()
+	}
+	if dev != nil {
+		closeWGBeaconDevice(dev.Close)
+	}
+}
+
+func closeWGBeaconDevice(closeDevice func()) {
+	if closeDevice != nil {
+		closeDevice()
+	}
+}
+
+const wgBeaconStreamReceiptTimeout = 5 * time.Second
+
+func sendWGBeaconEnvelope(muxSession *yamux.Session, envelope *pb.Envelope) error {
+	if envelope == nil {
+		return errors.New("[wg] nil beacon envelope")
+	}
+	return sendWGBeaconStream(muxSession, wgBeaconStreamReceiptTimeout, func(stream net.Conn) error {
+		return wireguard.WriteEnvelope(stream, envelope)
+	})
+}
+
+// sendWGBeaconStream waits for the peer's FIN after writing the request. A
+// successful yamux write only means the frame reached the local transport; the
+// remote FIN proves the server read the complete request before the beacon
+// tears down the WireGuard session.
+func sendWGBeaconStream(muxSession *yamux.Session, receiptTimeout time.Duration, write func(net.Conn) error) error {
+	if muxSession == nil {
+		return errors.New("[wg] send called with nil yamux session")
+	}
+	if receiptTimeout <= 0 {
+		return errors.New("[wg] invalid beacon stream receipt timeout")
+	}
+	stream, err := muxSession.Open()
+	if err != nil {
+		return err
+	}
+	if isNilInterface(stream) {
+		return errors.New("[wg] open returned nil stream")
+	}
+	defer func() { _ = stream.Close() }()
+
+	if err := write(stream); err != nil {
+		return err
+	}
+	if err := stream.SetReadDeadline(time.Now().Add(receiptTimeout)); err != nil {
+		return err
+	}
+	if err := stream.Close(); err != nil {
+		return err
+	}
+	_, err = io.Copy(io.Discard, stream)
+	return err
+}
+
 // {{end}}
 
 // {{if .Config.IncludeHTTP}}

implant/sliver/transports/beacon_yamux_test.go

@@ -0,0 +1,159 @@
+//go:build windows || darwin || linux
+
+package transports
+
+import (
+	"errors"
+	"io"
+	"net"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/yamux"
+)
+
+type recordingWGBeaconDevice struct {
+	closeCalls int
+}
+
+func (d *recordingWGBeaconDevice) Close() {
+	d.closeCalls++
+}
+
+func TestCloseWGBeaconDeviceUsesPermanentClose(t *testing.T) {
+	dev := &recordingWGBeaconDevice{}
+	closeWGBeaconDevice(dev.Close)
+	if dev.closeCalls != 1 {
+		t.Fatalf("wireguard device Close called %d times, want 1", dev.closeCalls)
+	}
+}
+
+func TestSendWGBeaconStreamWaitsForRemoteClose(t *testing.T) {
+	client, server := newBeaconYamuxPair(t)
+	marker := []byte("beacon-result")
+	serverRead := make(chan struct{})
+	releaseServer := make(chan struct{})
+	var releaseOnce sync.Once
+	release := func() { releaseOnce.Do(func() { close(releaseServer) }) }
+	t.Cleanup(release)
+	serverErr := make(chan error, 1)
+
+	go func() {
+		stream, err := server.Accept()
+		if err != nil {
+			serverErr <- err
+			return
+		}
+		defer func() { _ = stream.Close() }()
+		got := make([]byte, len(marker))
+		if _, err := io.ReadFull(stream, got); err != nil {
+			serverErr <- err
+			return
+		}
+		if string(got) != string(marker) {
+			serverErr <- errors.New("server received an unexpected payload")
+			return
+		}
+		close(serverRead)
+		<-releaseServer
+		serverErr <- nil
+	}()
+
+	sendErr := make(chan error, 1)
+	go func() {
+		sendErr <- sendWGBeaconStream(client, time.Second, func(stream net.Conn) error {
+			_, err := stream.Write(marker)
+			return err
+		})
+	}()
+
+	select {
+	case err := <-serverErr:
+		t.Fatalf("server failed before reading the request: %v", err)
+	case err := <-sendErr:
+		t.Fatalf("send returned before the server read the request: %v", err)
+	case <-serverRead:
+	case <-time.After(time.Second):
+		t.Fatal("server did not receive the request")
+	}
+
+	select {
+	case err := <-sendErr:
+		t.Fatalf("send returned before the server closed its stream: %v", err)
+	case <-time.After(100 * time.Millisecond):
+	}
+
+	release()
+	select {
+	case err := <-sendErr:
+		if err != nil {
+			t.Fatalf("send failed after the server closed its stream: %v", err)
+		}
+	case <-time.After(time.Second):
+		t.Fatal("send did not observe the server stream close")
+	}
+	if err := <-serverErr; err != nil {
+		t.Fatalf("server failed: %v", err)
+	}
+}
+
+func TestSendWGBeaconStreamReceiptTimeout(t *testing.T) {
+	client, server := newBeaconYamuxPair(t)
+	marker := []byte("beacon-result")
+	releaseServer := make(chan struct{})
+	var releaseOnce sync.Once
+	release := func() { releaseOnce.Do(func() { close(releaseServer) }) }
+	t.Cleanup(release)
+	serverErr := make(chan error, 1)
+
+	go func() {
+		stream, err := server.Accept()
+		if err != nil {
+			serverErr <- err
+			return
+		}
+		defer func() { _ = stream.Close() }()
+		got := make([]byte, len(marker))
+		if _, err := io.ReadFull(stream, got); err != nil {
+			serverErr <- err
+			return
+		}
+		<-releaseServer
+		serverErr <- nil
+	}()
+
+	err := sendWGBeaconStream(client, 50*time.Millisecond, func(stream net.Conn) error {
+		_, err := stream.Write(marker)
+		return err
+	})
+	if !errors.Is(err, yamux.ErrTimeout) {
+		t.Fatalf("got receipt error %v, want %v", err, yamux.ErrTimeout)
+	}
+	release()
+	if err := <-serverErr; err != nil {
+		t.Fatalf("server failed: %v", err)
+	}
+}
+
+func newBeaconYamuxPair(t *testing.T) (*yamux.Session, *yamux.Session) {
+	t.Helper()
+	clientConn, serverConn := net.Pipe()
+	config := yamux.DefaultConfig()
+	config.EnableKeepAlive = false
+	config.LogOutput = io.Discard
+	server, err := yamux.Server(serverConn, config)
+	if err != nil {
+		t.Fatal(err)
+	}
+	client, err := yamux.Client(clientConn, config)
+	if err != nil {
+		_ = server.Close()
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_ = client.Close()
+		_ = server.Close()
+	})
+	return client, server
+}

implant/sliver/transports/dnsclient/dnsclient.go

@@ -709,6 +709,9 @@ func (s *SliverDNSClient) parallelRecv(manifest *dnspb.DNSMessage) ([]byte, erro
 // SplitBuffer - There's probably a fancy way to calculate this with math and shit but it's much easier to just encode bytes
 // and check the length until we hit the limit
 func (s *SliverDNSClient) SplitBuffer(msg *dnspb.DNSMessage, encoder encoders.Encoder, data []byte) ([]string, error) {
+	if msg == nil {
+		return nil, ErrInvalidMsg
+	}
 	subdata := []string{}
 	start := 0
 	stop := start
@@ -743,14 +746,34 @@ func (s *SliverDNSClient) SplitBuffer(msg *dnspb.DNSMessage, encoder encoders.En
 			// log.Printf("[dns] shave data [%d:%d] of %d", start, stop, len(data))
 			// {{end}}
 			msg.Data = data[start:stop]
-			pbMsg, _ := proto.Marshal(msg)
-			encodedValue, _ := encoder.Encode(pbMsg)
-			encoded = string(encodedValue)
+			var err error
+			encoded, err = encodeDNSMessage(msg, encoder)
+			if err != nil {
+				return nil, err
+			}
 			// {{if .Config.Debug}}
 			// log.Printf("[dns] encoded length is %d (max: %d)", len(encoded), s.subdataSpace)
 			// {{end}}
 		}
+
+		// Step back if a protobuf varint boundary caused encoded to overshoot.
+		// Adding 1 byte across a varint boundary (e.g. Data length 127 to 128) grows
+		// the proto by 2 bytes, which can jump base32 by +3 or +4, exceeding the
+		// subdataSpace-1 guard above.
+		for s.subdataSpace < len(encoded) && stop > start {
+			stop--
+			msg.Data = data[start:stop]
+			var err error
+			encoded, err = encodeDNSMessage(msg, encoder)
+			if err != nil {
+				return nil, err
+			}
+		}
+		if stop <= start {
+			return nil, errMsgTooLong
+		}
 		lastLen = len(msg.Data) // Save the amount of data that fit for the next loop
+
 		// {{if .Config.Debug}}
 		encodedSubdata = append(encodedSubdata, encoded)
 		// {{end}}
@@ -789,6 +812,18 @@ func (s *SliverDNSClient) SplitBuffer(msg *dnspb.DNSMessage, encoder encoders.En
 	return subdata, nil
 }
 
+func encodeDNSMessage(msg *dnspb.DNSMessage, encoder encoders.Encoder) (string, error) {
+	pbMsg, err := proto.Marshal(msg)
+	if err != nil {
+		return "", err
+	}
+	encoded, err := encoder.Encode(pbMsg)
+	if err != nil {
+		return "", err
+	}
+	return string(encoded), nil
+}
+
 func (s *SliverDNSClient) randomDNSSessionID() (uint32, error) {
 	// sessionID is 24-bit and must be non-zero.
 	randBuf := make([]byte, 4)

implant/sliver/transports/dnsclient/dnsclient_test.go

@@ -21,6 +21,7 @@ package dnsclient
 import (
 	"bytes"
 	"crypto/rand"
+	"errors"
 	"fmt"
 	"log"
 	insecureRand "math/rand"
@@ -34,6 +35,18 @@ import (
 	"google.golang.org/protobuf/proto"
 )
 
+type errorEncoder struct {
+	err error
+}
+
+func (e errorEncoder) Encode([]byte) ([]byte, error) {
+	return nil, e.err
+}
+
+func (e errorEncoder) Decode([]byte) ([]byte, error) {
+	return nil, e.err
+}
+
 const (
 	// Do not change these without updating the tests
 	parent1        = ".1.example.com."
@@ -137,6 +150,40 @@ func TestSplitBufferBase32(t *testing.T) {
 	}
 }
 
+func TestSplitBufferVarintBoundary(t *testing.T) {
+	// At this parent length, growing msg.Data from 127 to 128 bytes makes the
+	// encoded protobuf jump from 215 to 218 bytes while only 217 bytes fit.
+	// SplitBuffer must step back before joining the encoded data to the parent.
+	parent := fmt.Sprintf(".%s.example.com.", strings.Repeat("x", 19))
+	client := NewDNSClient(parent, opts)
+	if client.subdataSpace != 217 {
+		t.Fatalf("Unexpected subdata space for parent %s: %d", parent, client.subdataSpace)
+	}
+	clientSplitBuffer(t, client, encoders.Base32{}, randomData(256))
+}
+
+func TestSplitBufferErrors(t *testing.T) {
+	client := NewDNSClient(parent1, opts)
+	if _, err := client.SplitBuffer(nil, encoders.Base32{}, []byte{1}); !errors.Is(err, ErrInvalidMsg) {
+		t.Fatalf("Expected %s, got %v", ErrInvalidMsg, err)
+	}
+
+	encodeErr := errors.New("encode failed")
+	msg := &dnspb.DNSMessage{Type: dnspb.DNSMessageType_DATA_FROM_IMPLANT, Size: 1}
+	if _, err := client.SplitBuffer(msg, errorEncoder{err: encodeErr}, []byte{1}); !errors.Is(err, encodeErr) {
+		t.Fatalf("Expected %s, got %v", encodeErr, err)
+	}
+
+	// Leave one encoded byte of space so no non-empty protobuf can fit.
+	client = NewDNSClient("."+strings.Repeat("a", 250)+".", opts)
+	if client.subdataSpace != 1 {
+		t.Fatalf("Unexpected subdata space: %d", client.subdataSpace)
+	}
+	if _, err := client.SplitBuffer(msg, encoders.Base32{}, []byte{1}); !errors.Is(err, errMsgTooLong) {
+		t.Fatalf("Expected %s, got %v", errMsgTooLong, err)
+	}
+}
+
 func TestSplitBufferDomainConstraints(t *testing.T) {
 	client := NewDNSClient(parent1, opts)
 	testData := randomData(8192)

implant/sliver/transports/httpclient/drivers/win/wininet/client_generic.go

@@ -1,6 +1,7 @@
 //go:build !windows
 
-package http
+// Package wininet provides the Windows WinINet HTTP transport.
+package wininet
 
 import "errors"