Implement linux detailed version info

Fix/pivots dos

.github/workflows/autorelease.yml

@@ -41,10 +41,10 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Go 1.25
+      - name: Go 1.25.8
         uses: actions/setup-go@v6
         with:
-          go-version: "1.25.6"
+          go-version: "1.25.8"
 
       - name: Install Minisign
         run: sudo apt-get update --fix-missing && sudo apt-get -y install minisign

.github/workflows/codeql-scanning.yml

@@ -16,10 +16,10 @@ jobs:
 
     steps:
       # Setup go environment
-      - name: Go 1.25
+      - name: Go 1.25.8
         uses: actions/setup-go@v6
         with:
-          go-version: "1.25.6"
+          go-version: "1.25.8"
 
       - name: Checkout repository
         uses: actions/checkout@v6

.github/workflows/unit-tests.yml

@@ -25,10 +25,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 180
     steps:
-      - name: Go 1.25
+      - name: Go 1.25.8
         uses: actions/setup-go@v6
         with:
-          go-version: "1.25.6"
+          go-version: "1.25.8"
 
       - name: OS Packages
         run: |
@@ -71,10 +71,10 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 180
     steps:
-      - name: Go 1.25
+      - name: Go 1.25.8
         uses: actions/setup-go@v6
         with:
-          go-version: "1.25.6"
+          go-version: "1.25.8"
 
       - name: Install make
         run: choco install make -y --no-progress
@@ -115,10 +115,10 @@ jobs:
     runs-on: macos-latest
     timeout-minutes: 180
     steps:
-      - name: Go 1.25
+      - name: Go 1.25.8
         uses: actions/setup-go@v6
         with:
-          go-version: "1.25.6"
+          go-version: "1.25.8"
 
       - name: Check Out Code
         uses: actions/checkout@v6
@@ -153,10 +153,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 90
     steps:
-      - name: Go 1.25
+      - name: Go 1.25.8
         uses: actions/setup-go@v6
         with:
-          go-version: "1.25.6"
+          go-version: "1.25.8"
 
       - name: Check Out Code
         uses: actions/checkout@v6

.gitignore

@@ -1,3 +1,7 @@
+/crush
+
+/examples
+
 /.vscode
 /.vscode/*
 /.devcontainer

Makefile

@@ -1,22 +1,33 @@
-#
-# Makefile for Sliver
-#
-
-ifneq ($(OS),Windows_NT)
-
-GO ?= go
-ARTIFACT_SUFFIX ?= 
-ENV =
-TAGS ?= -tags go_sqlite
-CGO_ENABLED = 0
-
-ifneq (,$(findstring cgo_sqlite,$(TAGS)))
-	CGO_ENABLED = 1
-endif
-
-#
-# Prerequisites 
-#
+#
+# Makefile for Sliver
+#
+
+GO ?= go
+ARTIFACT_SUFFIX ?=
+ENV =
+TAGS ?= -tags go_sqlite
+CGO_ENABLED = 0
+
+ifneq (,$(findstring cgo_sqlite,$(TAGS)))
+	CGO_ENABLED = 1
+endif
+
+MIN_SUPPORTED_GO_MAJOR_VERSION = 1
+MIN_SUPPORTED_GO_MINOR_VERSION = 25
+GO_VERSION_VALIDATION_ERR_MSG = Golang version is not supported, please update to at least $(MIN_SUPPORTED_GO_MAJOR_VERSION).$(MIN_SUPPORTED_GO_MINOR_VERSION)
+
+SLIVER_PUBLIC_KEY ?= RWTZPg959v3b7tLG7VzKHRB1/QT+d3c71Uzetfa44qAoX5rH7mGoQTTR
+ARMORY_PUBLIC_KEY ?= RWSBpxpRWDrD7Fe+VvRE3c2VEDC2NK80rlNCj+BX0gz44Xw07r6KQD9L
+ARMORY_REPO_URL ?= https://api.github.com/repos/sliverarmory/armory/releases
+CLIENT_ASSETS_PKG = github.com/bishopfox/sliver/client/assets
+SLIVER_UPDATE_PKG = github.com/bishopfox/sliver/client/command/update
+PB_COMPILERS = protoc protoc-gen-go protoc-gen-go-grpc
+
+ifneq ($(OS),Windows_NT)
+
+#
+# Prerequisites
+#
 # https://stackoverflow.com/questions/5618615/check-if-a-program-exists-from-a-makefile
 EXECUTABLES = uname sed git date cut $(GO)
 K := $(foreach exec,$(EXECUTABLES),\
@@ -25,21 +36,12 @@ K := $(foreach exec,$(EXECUTABLES),\
 #
 # Build Information
 #
-GO_MAJOR_VERSION = $(shell $(GO) version | cut -c 14- | cut -d' ' -f1 | cut -d'.' -f1)
-GO_MINOR_VERSION = $(shell $(GO) version | cut -c 14- | cut -d' ' -f1 | cut -d'.' -f2)
-MIN_SUPPORTED_GO_MAJOR_VERSION = 1
-MIN_SUPPORTED_GO_MINOR_VERSION = 25
-GO_VERSION_VALIDATION_ERR_MSG = Golang version is not supported, please update to at least $(MIN_SUPPORTED_GO_MAJOR_VERSION).$(MIN_SUPPORTED_GO_MINOR_VERSION)
-
-SLIVER_PUBLIC_KEY ?= RWTZPg959v3b7tLG7VzKHRB1/QT+d3c71Uzetfa44qAoX5rH7mGoQTTR
-ARMORY_PUBLIC_KEY ?= RWSBpxpRWDrD7Fe+VvRE3c2VEDC2NK80rlNCj+BX0gz44Xw07r6KQD9L
-ARMORY_REPO_URL ?= https://api.github.com/repos/sliverarmory/armory/releases
-CLIENT_ASSETS_PKG = github.com/bishopfox/sliver/client/assets
-SLIVER_UPDATE_PKG = github.com/bishopfox/sliver/client/command/update
-
-LDFLAGS = -ldflags "-s -w \
-	-X $(SLIVER_UPDATE_PKG).SliverPublicKey=$(SLIVER_PUBLIC_KEY) \
-	-X $(CLIENT_ASSETS_PKG).DefaultArmoryPublicKey=$(ARMORY_PUBLIC_KEY) \
+GO_MAJOR_VERSION = $(shell $(GO) version | cut -c 14- | cut -d' ' -f1 | cut -d'.' -f1)
+GO_MINOR_VERSION = $(shell $(GO) version | cut -c 14- | cut -d' ' -f1 | cut -d'.' -f2)
+
+LDFLAGS = -ldflags "-s -w \
+	-X $(SLIVER_UPDATE_PKG).SliverPublicKey=$(SLIVER_PUBLIC_KEY) \
+	-X $(CLIENT_ASSETS_PKG).DefaultArmoryPublicKey=$(ARMORY_PUBLIC_KEY) \
 	-X $(CLIENT_ASSETS_PKG).DefaultArmoryRepoURL=$(ARMORY_REPO_URL)"
 
 # Debug builds shouldn't be stripped (-s -w flags)
@@ -49,15 +51,14 @@ LDFLAGS_DEBUG = -ldflags "-X $(CLIENT_ASSETS_PKG).DefaultArmoryPublicKey=$(ARMOR
 SED_INPLACE := sed -i
 STATIC_TARGET := linux
 
-UNAME_S := $(shell uname -s)
-UNAME_P := $(shell uname -p)
-
-# Programs required for generating protobuf/grpc files
-PB_COMPILERS = protoc protoc-gen-go protoc-gen-go-grpc
-ifeq ($(MAKECMDGOALS), pb)
-	K := $(foreach exec,$(PB_COMPILERS),\
-			$(if $(shell which $(exec)),some string,$(error "Missing protobuf util $(exec) in PATH")))
-endif
+UNAME_S := $(shell uname -s)
+UNAME_P := $(shell uname -p)
+
+# Programs required for generating protobuf/grpc files
+ifeq ($(MAKECMDGOALS), pb)
+	K := $(foreach exec,$(PB_COMPILERS),\
+			$(if $(shell which $(exec)),some string,$(error "Missing protobuf util $(exec) in PATH")))
+endif
 
 # *** Darwin ***
 ifeq ($(UNAME_S),Darwin)
@@ -186,43 +187,23 @@ clean:
 	touch ./.downloaded_assets
 
 
-#
-# >>> WINDOWS <<<
-#
-else
-
-GO ?= go
-ARTIFACT_SUFFIX ?=
-ENV =
-TAGS ?= -tags go_sqlite
-CGO_ENABLED = 0
-
-ifneq (,$(findstring cgo_sqlite,$(TAGS)))
-	CGO_ENABLED = 1
-endif
-
-SHELL := cmd.exe
-.SHELLFLAGS := /C
-
-GO_VERSION := $(patsubst go%,%,$(strip $(shell $(GO) env GOVERSION)))
-GO_MAJOR_VERSION := $(word 1,$(subst ., ,$(GO_VERSION)))
-GO_MINOR_VERSION := $(word 2,$(subst ., ,$(GO_VERSION)))
-MIN_SUPPORTED_GO_MAJOR_VERSION = 1
-MIN_SUPPORTED_GO_MINOR_VERSION = 25
-GO_VERSION_VALIDATION_ERR_MSG = Golang version is not supported, please update to at least $(MIN_SUPPORTED_GO_MAJOR_VERSION).$(MIN_SUPPORTED_GO_MINOR_VERSION)
-
-SLIVER_PUBLIC_KEY ?= RWTZPg959v3b7tLG7VzKHRB1/QT+d3c71Uzetfa44qAoX5rH7mGoQTTR
-ARMORY_PUBLIC_KEY ?= RWSBpxpRWDrD7Fe+VvRE3c2VEDC2NK80rlNCj+BX0gz44Xw07r6KQD9L
-ARMORY_REPO_URL ?= https://api.github.com/repos/sliverarmory/armory/releases
-CLIENT_ASSETS_PKG = github.com/bishopfox/sliver/client/assets
-SLIVER_UPDATE_PKG = github.com/bishopfox/sliver/client/command/update
-
-LDFLAGS = -ldflags "-s -w -X $(SLIVER_UPDATE_PKG).SliverPublicKey=$(SLIVER_PUBLIC_KEY) -X $(CLIENT_ASSETS_PKG).DefaultArmoryPublicKey=$(ARMORY_PUBLIC_KEY) -X $(CLIENT_ASSETS_PKG).DefaultArmoryRepoURL=$(ARMORY_REPO_URL)"
-
-LDFLAGS_DEBUG = -ldflags "-X $(CLIENT_ASSETS_PKG).DefaultArmoryPublicKey=$(ARMORY_PUBLIC_KEY) -X $(CLIENT_ASSETS_PKG).DefaultArmoryRepoURL=$(ARMORY_REPO_URL)"
-
-PB_COMPILERS = protoc protoc-gen-go protoc-gen-go-grpc
-COMMA := ,
+#
+# >>> WINDOWS <<<
+#
+else
+
+SHELL := cmd.exe
+.SHELLFLAGS := /C
+
+GO_VERSION := $(patsubst go%,%,$(strip $(shell $(GO) env GOVERSION)))
+GO_MAJOR_VERSION := $(word 1,$(subst ., ,$(GO_VERSION)))
+GO_MINOR_VERSION := $(word 2,$(subst ., ,$(GO_VERSION)))
+
+LDFLAGS = -ldflags "-s -w -X $(SLIVER_UPDATE_PKG).SliverPublicKey=$(SLIVER_PUBLIC_KEY) -X $(CLIENT_ASSETS_PKG).DefaultArmoryPublicKey=$(ARMORY_PUBLIC_KEY) -X $(CLIENT_ASSETS_PKG).DefaultArmoryRepoURL=$(ARMORY_REPO_URL)"
+
+LDFLAGS_DEBUG = -ldflags "-X $(CLIENT_ASSETS_PKG).DefaultArmoryPublicKey=$(ARMORY_PUBLIC_KEY) -X $(CLIENT_ASSETS_PKG).DefaultArmoryRepoURL=$(ARMORY_REPO_URL)"
+
+COMMA := ,
 
 ifeq ($(MAKECMDGOALS), linux)
 	LDFLAGS = -ldflags "-s -w -extldflags '-static' -X $(CLIENT_ASSETS_PKG).DefaultArmoryPublicKey=$(ARMORY_PUBLIC_KEY) -X $(CLIENT_ASSETS_PKG).DefaultArmoryRepoURL=$(ARMORY_REPO_URL)"

client/assets/config.go

@@ -34,15 +34,25 @@ const (
 	ConfigDirName = "configs"
 )
 
+// ClientWGConfig - Optional WireGuard wrapper configuration for multiplayer.
+type ClientWGConfig struct {
+	ServerPubKey     string `json:"server_pub_key"`
+	ClientPrivateKey string `json:"client_private_key"`
+	ClientPubKey     string `json:"client_pub_key"`
+	ClientIP         string `json:"client_ip"`
+	ServerIP         string `json:"server_ip"`
+}
+
 // ClientConfig - Client JSON config
 type ClientConfig struct {
-	Operator      string `json:"operator"` // This value is actually ignored for the most part (cert CN is used instead)
-	LHost         string `json:"lhost"`
-	LPort         int    `json:"lport"`
-	Token         string `json:"token"`
-	CACertificate string `json:"ca_certificate"`
-	PrivateKey    string `json:"private_key"`
-	Certificate   string `json:"certificate"`
+	Operator      string          `json:"operator"` // This value is actually ignored for the most part (cert CN is used instead)
+	LHost         string          `json:"lhost"`
+	LPort         int             `json:"lport"`
+	Token         string          `json:"token"`
+	CACertificate string          `json:"ca_certificate"`
+	PrivateKey    string          `json:"private_key"`
+	Certificate   string          `json:"certificate"`
+	WG            *ClientWGConfig `json:"wg,omitempty"`
 }
 
 // GetConfigDir - Returns the path to the config dir

client/cli/cli.go

@@ -52,6 +52,8 @@ func init() {
 
 	rootCmd.TraverseChildren = true
 	rootCmd.Flags().String(RCFlagName, "", "path to rc script file")
+	rootCmd.PersistentFlags().Bool(disableWGFlag, false, "connect to multiplayer directly even if the operator config includes a WireGuard wrapper")
+	rootCmd.PersistentFlags().Bool(requireWGFlag, false, "require the operator config's WireGuard wrapper for multiplayer connections")
 
 	// Create the console client, without any RPC or commands bound to it yet.
 	// This created before anything so that multiple commands can make use of

client/cli/console.go

@@ -44,6 +44,9 @@ func consoleCmd(con *console.SliverClient) *cobra.Command {
 
 func consoleRunnerCmd(con *console.SliverClient, run bool) (pre, post func(cmd *cobra.Command, args []string) error) {
 	pre = func(cmd *cobra.Command, _ []string) error {
+		if err := applyMultiplayerConnectMode(cmd); err != nil {
+			return err
+		}
 
 		configs := assets.GetConfigs()
 		if len(configs) == 0 {

client/cli/mcp.go

@@ -43,6 +43,10 @@ func mcpCmd(con *console.SliverClient) *cobra.Command {
 }
 
 func runMCP(cmd *cobra.Command, con *console.SliverClient) error {
+	if err := applyMultiplayerConnectMode(cmd); err != nil {
+		return err
+	}
+
 	configPath, _ := cmd.Flags().GetString("config")
 	config, err := loadMCPClientConfig(configPath)
 	if err != nil {
@@ -55,7 +59,7 @@ func runMCP(cmd *cobra.Command, con *console.SliverClient) error {
 		fmt.Printf("Connection to server failed %s\n", err)
 		return nil
 	}
-	defer ln.Close()
+	defer transport.CloseGRPCConnection(ln)
 
 	con.Rpc = rpc
 	go handleConnectionLost(ln)

client/cli/transport_mode.go

@@ -0,0 +1,42 @@
+package cli
+
+import (
+	"fmt"
+
+	"github.com/bishopfox/sliver/client/transport"
+	"github.com/spf13/cobra"
+)
+
+const (
+	requireWGFlag = "require-wg"
+	disableWGFlag = "disable-wg"
+)
+
+func applyMultiplayerConnectMode(cmd *cobra.Command) error {
+	if cmd == nil {
+		transport.SetMultiplayerConnectMode(transport.MultiplayerConnectAuto)
+		return nil
+	}
+
+	requireWG, err := cmd.Flags().GetBool(requireWGFlag)
+	if err != nil {
+		return err
+	}
+	disableWG, err := cmd.Flags().GetBool(disableWGFlag)
+	if err != nil {
+		return err
+	}
+	if requireWG && disableWG {
+		return fmt.Errorf("--%s and --%s cannot be used together", requireWGFlag, disableWGFlag)
+	}
+
+	mode := transport.MultiplayerConnectAuto
+	switch {
+	case requireWG:
+		mode = transport.MultiplayerConnectRequireWG
+	case disableWG:
+		mode = transport.MultiplayerConnectDisableWG
+	}
+	transport.SetMultiplayerConnectMode(mode)
+	return nil
+}

client/command/README.md

@@ -12,6 +12,7 @@ Shared registration glue, scaffolding, and helpers for Sliver client console com
 
 ## Sub-packages
 
+- `ai/` – Implements the 'ai' Bubble Tea layout preview command for the Sliver client console.
 - `alias/` – Implements the 'alias' command group for the Sliver client console.
 - `armory/` – Implements the 'armory' command group for the Sliver client console.
 - `backdoor/` – Implements the 'backdoor' command group for the Sliver client console.

client/command/ai/README.md

@@ -0,0 +1,5 @@
+# client/command/ai
+
+Implements the `ai` command for the Sliver client console.
+
+The TUI loads server-backed AI conversation threads over gRPC, submits prompts to the server, and refreshes when `AIConversationEvent` updates arrive with assistant replies or failure messages.

client/command/ai/ai.go

@@ -0,0 +1,242 @@
+package ai
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2026  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"fmt"
+	"os"
+	"strings"
+	"time"
+
+	tea "charm.land/bubbletea/v2"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/termio"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/charmbracelet/colorprofile"
+	"github.com/spf13/cobra"
+	"golang.org/x/term"
+)
+
+var openAIProgramTTY = tea.OpenTTY
+
+// AICmd launches the AI conversation TUI.
+func AICmd(_ *cobra.Command, con *console.SliverClient, _ []string) {
+	if con == nil || con.Rpc == nil {
+		if con != nil {
+			con.PrintErrorf("Connect to a server before using `ai`.\n")
+		}
+		return
+	}
+
+	listenerID, listener := con.CreateEventListener()
+	defer con.RemoveEventListener(listenerID)
+	restoreEventNotifications := con.SuppressEventNotifications()
+	defer restoreEventNotifications()
+
+	model := newAIModel(con, buildAIContext(con), listener)
+	model.showExperimentalWarningModal()
+
+	width, height := 100, 30
+	if w, h, err := term.GetSize(0); err == nil && w > 0 && h > 0 {
+		width, height = w, h
+	}
+
+	opts := []tea.ProgramOption{
+		tea.WithWindowSize(width, height),
+		tea.WithColorProfile(colorprofile.TrueColor),
+	}
+	ttyOpts, cleanup := configureAIProgramTTY()
+	if cleanup != nil {
+		defer cleanup()
+	}
+	opts = append(opts, ttyOpts...)
+
+	program := tea.NewProgram(model, opts...)
+	if _, err := program.Run(); err != nil {
+		con.PrintErrorf("AI TUI error: %s\n", err)
+	}
+}
+
+// Console logging can swap stdout/stderr to pipes so session output can be tee'd
+// to disk. Bubble Tea needs a real TTY output to enable terminal features like
+// mouse reporting, so bind the AI TUI back to the interactive terminal when
+// stdout is no longer the controlling TTY.
+func configureAIProgramTTY() ([]tea.ProgramOption, func()) {
+	stdinTTY := isAITTY(os.Stdin)
+	stdoutTTY := isAITTY(os.Stdout)
+
+	switch {
+	case !stdinTTY || stdoutTTY:
+		return nil, nil
+
+	case isAITTY(termio.InteractiveInput()) && isAITTY(termio.InteractiveOutput()):
+		return []tea.ProgramOption{
+			tea.WithInput(termio.InteractiveInput()),
+			tea.WithOutput(termio.InteractiveOutput()),
+		}, nil
+
+	default:
+		inTTY, outTTY, err := openAIProgramTTY()
+		if err != nil {
+			return nil, nil
+		}
+		return []tea.ProgramOption{
+				tea.WithInput(inTTY),
+				tea.WithOutput(outTTY),
+			}, func() {
+				_ = inTTY.Close()
+				if outTTY != inTTY {
+					_ = outTTY.Close()
+				}
+			}
+	}
+}
+
+func isAITTY(file *os.File) bool {
+	return file != nil && term.IsTerminal(int(file.Fd()))
+}
+
+type aiContext struct {
+	target     aiTargetSummary
+	connection aiConnectionSummary
+	status     string
+}
+
+type aiTargetSummary struct {
+	SessionID string
+	BeaconID  string
+	Label     string
+	Host      string
+	OS        string
+	Arch      string
+	C2        string
+	Mode      string
+	Details   []string
+}
+
+type aiConnectionSummary struct {
+	Profile  string
+	Server   string
+	Operator string
+	State    string
+}
+
+func defaultAITargetSummary() aiTargetSummary {
+	return aiTargetSummary{
+		Label: "No active target",
+		Host:  "Select a session or beacon with `use` or ctrl+s",
+		Mode:  "offline preview",
+		C2:    "n/a",
+		OS:    "unknown",
+		Arch:  "unknown",
+	}
+}
+
+func aiSessionTargetSummary(session *clientpb.Session) aiTargetSummary {
+	if session == nil {
+		return defaultAITargetSummary()
+	}
+
+	return aiTargetSummary{
+		SessionID: session.ID,
+		Label:     fmt.Sprintf("Session %s", fallback(session.Name, session.ID)),
+		Host:      fallback(session.Hostname, "<unknown host>"),
+		OS:        fallback(session.OS, "unknown"),
+		Arch:      fallback(session.Arch, "unknown"),
+		C2:        fallback(session.ActiveC2, "unknown"),
+		Mode:      "interactive session",
+		Details: []string{
+			fmt.Sprintf("User: %s", fallback(session.Username, "<unknown>")),
+			fmt.Sprintf("PID: %d", session.PID),
+			fmt.Sprintf("Remote: %s", fallback(session.RemoteAddress, "<unknown>")),
+		},
+	}
+}
+
+func aiBeaconTargetSummary(beacon *clientpb.Beacon) aiTargetSummary {
+	if beacon == nil {
+		return defaultAITargetSummary()
+	}
+
+	return aiTargetSummary{
+		BeaconID: beacon.ID,
+		Label:    fmt.Sprintf("Beacon %s", fallback(beacon.Name, beacon.ID)),
+		Host:     fallback(beacon.Hostname, "<unknown host>"),
+		OS:       fallback(beacon.OS, "unknown"),
+		Arch:     fallback(beacon.Arch, "unknown"),
+		C2:       fallback(beacon.ActiveC2, "unknown"),
+		Mode:     "asynchronous beacon",
+		Details: []string{
+			fmt.Sprintf("User: %s", fallback(beacon.Username, "<unknown>")),
+			fmt.Sprintf("PID: %d", beacon.PID),
+			fmt.Sprintf("Remote: %s", fallback(beacon.RemoteAddress, "<unknown>")),
+			fmt.Sprintf("Interval: %s", time.Duration(beacon.Interval).String()),
+			fmt.Sprintf("Next checkin: %s", formatUnix(beacon.NextCheckin)),
+		},
+	}
+}
+
+func buildAIContext(con *console.SliverClient) aiContext {
+	ctx := aiContext{
+		target: defaultAITargetSummary(),
+		connection: aiConnectionSummary{
+			Profile:  "<disconnected>",
+			Server:   "<unknown>",
+			Operator: "<unknown>",
+			State:    "idle",
+		},
+		status: "Loading AI conversations from the server...",
+	}
+
+	if con != nil {
+		if details, state, ok := con.CurrentConnection(); ok {
+			ctx.connection.State = strings.ToLower(state.String())
+			if details != nil && details.Config != nil {
+				ctx.connection.Profile = fallback(details.ConfigKey, "<profile unavailable>")
+				ctx.connection.Server = fmt.Sprintf("%s:%d", details.Config.LHost, details.Config.LPort)
+				ctx.connection.Operator = fallback(details.Config.Operator, "<unknown>")
+			}
+		}
+
+		session, beacon := con.ActiveTarget.Get()
+		switch {
+		case session != nil:
+			ctx.target = aiSessionTargetSummary(session)
+		case beacon != nil:
+			ctx.target = aiBeaconTargetSummary(beacon)
+		}
+	}
+
+	return ctx
+}
+
+func fallback(value, def string) string {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return def
+	}
+	return value
+}
+
+func formatUnix(ts int64) string {
+	if ts <= 0 {
+		return "<unknown>"
+	}
+	return time.Unix(ts, 0).Local().Format("2006-01-02 15:04:05")
+}

client/command/ai/commands.go

@@ -0,0 +1,49 @@
+package ai
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2026  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"github.com/bishopfox/sliver/client/command/help"
+	"github.com/bishopfox/sliver/client/console"
+	consts "github.com/bishopfox/sliver/client/constants"
+	"github.com/spf13/cobra"
+)
+
+// Commands returns the ai command.
+func Commands(con *console.SliverClient) []*cobra.Command {
+	return []*cobra.Command{newAICommand(consts.SliverCoreHelpGroup, con)}
+}
+
+// ServerCommands returns the ai command for the top-level client REPL.
+func ServerCommands(con *console.SliverClient) []*cobra.Command {
+	return []*cobra.Command{newAICommand(consts.GenericHelpGroup, con)}
+}
+
+func newAICommand(groupID string, con *console.SliverClient) *cobra.Command {
+	return &cobra.Command{
+		Use:     consts.AIStr,
+		Short:   "Open the Sliver AI conversation TUI",
+		Long:    help.GetHelpFor([]string{consts.AIStr}),
+		Args:    cobra.NoArgs,
+		GroupID: groupID,
+		Run: func(cmd *cobra.Command, args []string) {
+			AICmd(cmd, con, args)
+		},
+	}
+}

client/command/ai/grpc_test.go

@@ -0,0 +1,591 @@
+package ai
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2026  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"context"
+	"net"
+	"sync"
+	"testing"
+
+	"github.com/bishopfox/sliver/client/console"
+	consts "github.com/bishopfox/sliver/client/constants"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/bishopfox/sliver/protobuf/rpcpb"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/test/bufconn"
+	"google.golang.org/protobuf/proto"
+)
+
+func TestLoadAIStateCmdLoadsConversationOverRPC(t *testing.T) {
+	server := &aiRPCServer{
+		providersResp: &clientpb.AIProviderConfigs{
+			Providers: []*clientpb.AIProviderConfig{{Name: "openai", Configured: true}},
+			Config: &clientpb.AIConfigSummary{
+				Provider: "openai",
+				Model:    "gpt-test",
+				Valid:    true,
+			},
+		},
+		conversationsResp: &clientpb.AIConversations{
+			Conversations: []*clientpb.AIConversation{
+				{ID: "conv-1", Provider: "openai", Model: "gpt-test", Title: "First"},
+				{ID: "conv-2", Provider: "openai", Model: "gpt-test", Title: "Second"},
+			},
+		},
+		conversationByID: map[string]*clientpb.AIConversation{
+			"conv-1": {
+				ID:       "conv-1",
+				Provider: "openai",
+				Model:    "gpt-test",
+				Title:    "First",
+				Messages: []*clientpb.AIConversationMessage{
+					{Role: "user", Content: "Hello"},
+				},
+			},
+		},
+	}
+
+	rpcClient, cleanup := newAITestRPCClient(t, server)
+	defer cleanup()
+
+	cmd := loadAIStateCmd(&console.SliverClient{Rpc: rpcClient}, aiTargetSummary{}, "")
+	msg := cmd()
+
+	loaded, ok := msg.(aiLoadedMsg)
+	if !ok {
+		t.Fatalf("expected aiLoadedMsg, got %T", msg)
+	}
+	if loaded.selectedID != "conv-1" {
+		t.Fatalf("unexpected selected conversation id: got=%q want=%q", loaded.selectedID, "conv-1")
+	}
+	if loaded.conversation == nil || loaded.conversation.GetID() != "conv-1" {
+		t.Fatalf("unexpected loaded conversation: %+v", loaded.conversation)
+	}
+	if len(loaded.conversations) != 2 {
+		t.Fatalf("unexpected conversation count: got=%d want=%d", len(loaded.conversations), 2)
+	}
+
+	server.mu.Lock()
+	defer server.mu.Unlock()
+	if server.getProvidersCalls != 1 {
+		t.Fatalf("expected GetAIProviders to be called once, got %d", server.getProvidersCalls)
+	}
+	if server.getConversationsCalls != 1 {
+		t.Fatalf("expected GetAIConversations to be called once, got %d", server.getConversationsCalls)
+	}
+	if len(server.getConversationReqs) != 1 {
+		t.Fatalf("expected GetAIConversation to be called once, got %d", len(server.getConversationReqs))
+	}
+	if server.getConversationReqs[0].GetID() != "conv-1" || !server.getConversationReqs[0].GetIncludeMessages() {
+		t.Fatalf("unexpected GetAIConversation request: %+v", server.getConversationReqs[0])
+	}
+}
+
+func TestLoadAIStateCmdCreatesConversationWhenNoneExist(t *testing.T) {
+	server := &aiRPCServer{
+		providersResp: &clientpb.AIProviderConfigs{
+			Providers: []*clientpb.AIProviderConfig{{Name: "openai", Configured: true}},
+			Config: &clientpb.AIConfigSummary{
+				Provider:     "openai",
+				Model:        "gpt-test",
+				SystemPrompt: "Stay concise.",
+				Valid:        true,
+			},
+		},
+		conversationsResp: &clientpb.AIConversations{},
+		saveConversationResp: &clientpb.AIConversation{
+			ID:           "conv-created",
+			Provider:     "openai",
+			Model:        "gpt-test",
+			Title:        "New conversation",
+			SystemPrompt: "Stay concise.",
+		},
+		conversationByID: map[string]*clientpb.AIConversation{
+			"conv-created": {
+				ID:           "conv-created",
+				Provider:     "openai",
+				Model:        "gpt-test",
+				Title:        "New conversation",
+				SystemPrompt: "Stay concise.",
+			},
+		},
+	}
+
+	rpcClient, cleanup := newAITestRPCClient(t, server)
+	defer cleanup()
+
+	msg := loadAIStateCmd(&console.SliverClient{Rpc: rpcClient}, aiTargetSummary{}, "")()
+
+	loaded, ok := msg.(aiLoadedMsg)
+	if !ok {
+		t.Fatalf("expected aiLoadedMsg, got %T", msg)
+	}
+	if loaded.status != "Created a new AI conversation." {
+		t.Fatalf("unexpected status: %q", loaded.status)
+	}
+	if loaded.selectedID != "conv-created" {
+		t.Fatalf("unexpected selected conversation id: %q", loaded.selectedID)
+	}
+
+	server.mu.Lock()
+	defer server.mu.Unlock()
+	if len(server.saveConversationReqs) != 1 {
+		t.Fatalf("expected SaveAIConversation to be called once, got %d", len(server.saveConversationReqs))
+	}
+	request := server.saveConversationReqs[0]
+	if request.GetProvider() != "openai" || request.GetModel() != "gpt-test" || request.GetTitle() != "New conversation" {
+		t.Fatalf("unexpected SaveAIConversation request: %+v", request)
+	}
+	if request.GetSystemPrompt() != "Stay concise." {
+		t.Fatalf("unexpected SaveAIConversation system prompt: %q", request.GetSystemPrompt())
+	}
+}
+
+func TestSubmitPromptCmdCreatesConversationAndSavesUserMessage(t *testing.T) {
+	server := &aiRPCServer{
+		saveConversationResp: &clientpb.AIConversation{
+			ID:       "conv-created",
+			Provider: "openai",
+			Model:    "gpt-test",
+			Title:    "Explain the workflow.",
+		},
+		saveMessageResp: &clientpb.AIConversationMessage{
+			ID:             "msg-1",
+			ConversationID: "conv-created",
+			Role:           "user",
+			Content:        "Explain the workflow.\n\nWith details.",
+		},
+	}
+
+	rpcClient, cleanup := newAITestRPCClient(t, server)
+	defer cleanup()
+
+	msg := submitPromptCmd(
+		&console.SliverClient{Rpc: rpcClient},
+		aiTargetSummary{SessionID: "session-1"},
+		nil,
+		"openai",
+		"gpt-test",
+		"Stay concise.",
+		"Explain the workflow.\n\nWith details.",
+	)()
+
+	submitted, ok := msg.(aiPromptSubmittedMsg)
+	if !ok {
+		t.Fatalf("expected aiPromptSubmittedMsg, got %T", msg)
+	}
+	if submitted.conversationID != "conv-created" {
+		t.Fatalf("unexpected conversation id: %q", submitted.conversationID)
+	}
+
+	server.mu.Lock()
+	defer server.mu.Unlock()
+	if len(server.saveConversationReqs) != 1 {
+		t.Fatalf("expected SaveAIConversation to be called once, got %d", len(server.saveConversationReqs))
+	}
+	if server.saveConversationReqs[0].GetTitle() != "Explain the workflow." {
+		t.Fatalf("unexpected conversation title: %q", server.saveConversationReqs[0].GetTitle())
+	}
+	if server.saveConversationReqs[0].GetTargetSessionID() != "session-1" {
+		t.Fatalf("expected target session to be forwarded, got %+v", server.saveConversationReqs[0])
+	}
+	if server.saveConversationReqs[0].GetSystemPrompt() != "Stay concise." {
+		t.Fatalf("unexpected conversation system prompt: %q", server.saveConversationReqs[0].GetSystemPrompt())
+	}
+	if len(server.saveMessageReqs) != 1 {
+		t.Fatalf("expected SaveAIConversationMessage to be called once, got %d", len(server.saveMessageReqs))
+	}
+	request := server.saveMessageReqs[0]
+	if request.GetConversationID() != "conv-created" || request.GetProvider() != "openai" || request.GetModel() != "gpt-test" || request.GetRole() != "user" {
+		t.Fatalf("unexpected SaveAIConversationMessage request: %+v", request)
+	}
+	if request.GetContent() != "Explain the workflow.\n\nWith details." {
+		t.Fatalf("unexpected prompt content: %q", request.GetContent())
+	}
+}
+
+func TestSubmitPromptCmdUsesExistingConversationSettings(t *testing.T) {
+	server := &aiRPCServer{
+		saveMessageResp: &clientpb.AIConversationMessage{
+			ID:             "msg-1",
+			ConversationID: "conv-1",
+			Role:           "user",
+			Content:        "hello",
+		},
+	}
+
+	rpcClient, cleanup := newAITestRPCClient(t, server)
+	defer cleanup()
+
+	msg := submitPromptCmd(
+		&console.SliverClient{Rpc: rpcClient},
+		aiTargetSummary{},
+		&clientpb.AIConversation{ID: "conv-1", Provider: "anthropic", Model: "claude-test", Title: "Thread"},
+		"openai",
+		"gpt-test",
+		"Stay concise.",
+		"hello",
+	)()
+
+	if _, ok := msg.(aiPromptSubmittedMsg); !ok {
+		t.Fatalf("expected aiPromptSubmittedMsg, got %T", msg)
+	}
+
+	server.mu.Lock()
+	defer server.mu.Unlock()
+	if len(server.saveConversationReqs) != 0 {
+		t.Fatalf("did not expect SaveAIConversation to be called, got %d calls", len(server.saveConversationReqs))
+	}
+	if len(server.saveMessageReqs) != 1 {
+		t.Fatalf("expected SaveAIConversationMessage to be called once, got %d", len(server.saveMessageReqs))
+	}
+	request := server.saveMessageReqs[0]
+	if request.GetProvider() != "anthropic" || request.GetModel() != "claude-test" {
+		t.Fatalf("unexpected conversation settings in message request: %+v", request)
+	}
+}
+
+func TestDeleteConversationCmdSendsDeleteRequest(t *testing.T) {
+	server := &aiRPCServer{}
+
+	rpcClient, cleanup := newAITestRPCClient(t, server)
+	defer cleanup()
+
+	msg := deleteConversationCmd(
+		&console.SliverClient{Rpc: rpcClient},
+		"conv-1",
+		"conv-2",
+		`Deleted "Thread".`,
+	)()
+
+	deleted, ok := msg.(aiConversationDeletedMsg)
+	if !ok {
+		t.Fatalf("expected aiConversationDeletedMsg, got %T", msg)
+	}
+	if deleted.conversationID != "conv-1" || deleted.selectedID != "conv-2" {
+		t.Fatalf("unexpected delete message: %+v", deleted)
+	}
+
+	server.mu.Lock()
+	defer server.mu.Unlock()
+	if len(server.deleteConversationReqs) != 1 {
+		t.Fatalf("expected DeleteAIConversation to be called once, got %d", len(server.deleteConversationReqs))
+	}
+	if server.deleteConversationReqs[0].GetID() != "conv-1" {
+		t.Fatalf("unexpected DeleteAIConversation request: %+v", server.deleteConversationReqs[0])
+	}
+}
+
+func TestWaitForAIConversationEventCmdFiltersForAIEvents(t *testing.T) {
+	eventPayload := &clientpb.AIConversationEvent{
+		EventType: clientpb.AIConversationEventType_AI_CONVERSATION_EVENT_TYPE_CONVERSATION_UPDATED,
+		Conversation: &clientpb.AIConversation{
+			ID:           "conv-1",
+			OperatorName: "alice",
+		},
+	}
+	data, err := proto.Marshal(eventPayload)
+	if err != nil {
+		t.Fatalf("marshal conversation event: %v", err)
+	}
+
+	listener := make(chan *clientpb.Event, 2)
+	listener <- &clientpb.Event{EventType: consts.WatchtowerEvent}
+	listener <- &clientpb.Event{EventType: consts.AIConversationEvent, Data: data}
+
+	msg := waitForAIConversationEventCmd(listener)()
+
+	aiEvent, ok := msg.(aiConversationEventMsg)
+	if !ok {
+		t.Fatalf("expected aiConversationEventMsg, got %T", msg)
+	}
+	if aiEvent.event == nil || aiEvent.event.GetConversation() == nil || aiEvent.event.GetConversation().GetID() != "conv-1" {
+		t.Fatalf("unexpected AI conversation event payload: %+v", aiEvent.event)
+	}
+}
+
+func TestWaitForAIConversationEventCmdReturnsToastMessages(t *testing.T) {
+	listener := make(chan *clientpb.Event, 1)
+	listener <- &clientpb.Event{
+		EventType: consts.ClientToastEvent,
+		Data:      []byte("Session alpha connected"),
+		Err:       "info",
+	}
+
+	msg := waitForAIConversationEventCmd(listener)()
+
+	toast, ok := msg.(aiToastMsg)
+	if !ok {
+		t.Fatalf("expected aiToastMsg, got %T", msg)
+	}
+	if toast.level != "info" || toast.message != "Session alpha connected" {
+		t.Fatalf("unexpected toast payload: %+v", toast)
+	}
+}
+
+func TestWaitForAIConversationEventCmdReturnsClosedMessage(t *testing.T) {
+	listener := make(chan *clientpb.Event)
+	close(listener)
+
+	msg := waitForAIConversationEventCmd(listener)()
+	if _, ok := msg.(aiListenerClosedMsg); !ok {
+		t.Fatalf("expected aiListenerClosedMsg, got %T", msg)
+	}
+}
+
+func TestAIModelAppliesSharedConversationEventsWithoutReload(t *testing.T) {
+	listener := make(chan *clientpb.Event)
+	close(listener)
+
+	model := newAIModel(nil, aiContext{
+		connection: aiConnectionSummary{Operator: "alice"},
+	}, listener)
+	model.loading = false
+	model.conversations = []*clientpb.AIConversation{{ID: "conv-1", Title: "First"}}
+
+	updated, cmd := model.Update(aiConversationEventMsg{event: &clientpb.AIConversationEvent{
+		EventType: clientpb.AIConversationEventType_AI_CONVERSATION_EVENT_TYPE_CONVERSATION_UPDATED,
+		Conversation: &clientpb.AIConversation{
+			ID:           "conv-2",
+			OperatorName: "bob",
+			Title:        "Shared thread",
+		},
+	}})
+
+	nextModel := updated.(*aiModel)
+	if nextModel.loading {
+		t.Fatal("did not expect shared conversation event to trigger a reload")
+	}
+	if conversationIndexByID(nextModel.conversations, "conv-2") < 0 {
+		t.Fatalf("expected shared conversation to be merged locally, got %+v", nextModel.conversations)
+	}
+	if cmd == nil {
+		t.Fatal("expected shared conversation event to continue listening for events")
+	}
+}
+
+func TestAIModelAppliesDeleteEventsWhileAwaitingResponse(t *testing.T) {
+	listener := make(chan *clientpb.Event)
+	close(listener)
+
+	model := newAIModel(nil, aiContext{
+		connection: aiConnectionSummary{Operator: "alice"},
+	}, listener)
+	model.loading = false
+	model.awaitingResponse = true
+	model.currentConversation = &clientpb.AIConversation{
+		ID:           "conv-2",
+		OperatorName: "alice",
+		UpdatedAt:    100,
+		TurnState:    clientpb.AIConversationTurnState_AI_TURN_STATE_IN_PROGRESS,
+		Messages: []*clientpb.AIConversationMessage{
+			{Role: "user", Content: "still waiting"},
+		},
+	}
+	model.conversations = []*clientpb.AIConversation{
+		{ID: "conv-2", Title: "Current"},
+		{ID: "conv-1", Title: "Fallback"},
+	}
+
+	updated, cmd := model.Update(aiConversationEventMsg{event: &clientpb.AIConversationEvent{
+		EventType:      clientpb.AIConversationEventType_AI_CONVERSATION_EVENT_TYPE_CONVERSATION_DELETED,
+		ConversationID: "conv-2",
+		Conversation: &clientpb.AIConversation{
+			ID: "conv-2",
+		},
+	}})
+
+	nextModel := updated.(*aiModel)
+	if nextModel.loading {
+		t.Fatal("did not expect delete tombstone to trigger a reload")
+	}
+	if nextModel.currentConversation != nil {
+		t.Fatalf("expected deleted conversation to be cleared, got %+v", nextModel.currentConversation)
+	}
+	if conversationIndexByID(nextModel.conversations, "conv-2") >= 0 {
+		t.Fatalf("expected deleted conversation to be removed, got %+v", nextModel.conversations)
+	}
+	if cmd == nil {
+		t.Fatal("expected delete tombstone to continue listening for events")
+	}
+}
+
+type aiRPCServer struct {
+	rpcpb.UnimplementedSliverRPCServer
+
+	mu sync.Mutex
+
+	providersResp        *clientpb.AIProviderConfigs
+	conversationsResp    *clientpb.AIConversations
+	conversationByID     map[string]*clientpb.AIConversation
+	saveConversationResp *clientpb.AIConversation
+	saveMessageResp      *clientpb.AIConversationMessage
+	sessionsResp         *clientpb.Sessions
+	beaconsResp          *clientpb.Beacons
+
+	getProvidersCalls      int
+	getConversationsCalls  int
+	getSessionsCalls       int
+	getBeaconsCalls        int
+	getConversationReqs    []*clientpb.AIConversationReq
+	deleteConversationReqs []*clientpb.AIConversationReq
+	saveConversationReqs   []*clientpb.AIConversation
+	saveMessageReqs        []*clientpb.AIConversationMessage
+	getConversationStart   chan struct{}
+	getConversationWait    <-chan struct{}
+	saveMessageStarted     chan struct{}
+	saveMessageRelease     <-chan struct{}
+}
+
+func (s *aiRPCServer) GetAIProviders(context.Context, *commonpb.Empty) (*clientpb.AIProviderConfigs, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.getProvidersCalls++
+	if s.providersResp == nil {
+		return &clientpb.AIProviderConfigs{}, nil
+	}
+	return proto.Clone(s.providersResp).(*clientpb.AIProviderConfigs), nil
+}
+
+func (s *aiRPCServer) GetAIConversations(context.Context, *commonpb.Empty) (*clientpb.AIConversations, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.getConversationsCalls++
+	if s.conversationsResp == nil {
+		return &clientpb.AIConversations{}, nil
+	}
+	return proto.Clone(s.conversationsResp).(*clientpb.AIConversations), nil
+}
+
+func (s *aiRPCServer) GetSessions(context.Context, *commonpb.Empty) (*clientpb.Sessions, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.getSessionsCalls++
+	if s.sessionsResp == nil {
+		return &clientpb.Sessions{}, nil
+	}
+	return proto.Clone(s.sessionsResp).(*clientpb.Sessions), nil
+}
+
+func (s *aiRPCServer) GetBeacons(context.Context, *commonpb.Empty) (*clientpb.Beacons, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.getBeaconsCalls++
+	if s.beaconsResp == nil {
+		return &clientpb.Beacons{}, nil
+	}
+	return proto.Clone(s.beaconsResp).(*clientpb.Beacons), nil
+}
+
+func (s *aiRPCServer) GetAIConversation(_ context.Context, req *clientpb.AIConversationReq) (*clientpb.AIConversation, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.getConversationReqs = append(s.getConversationReqs, proto.Clone(req).(*clientpb.AIConversationReq))
+	if s.getConversationStart != nil {
+		select {
+		case s.getConversationStart <- struct{}{}:
+		default:
+		}
+	}
+	if s.getConversationWait != nil {
+		s.mu.Unlock()
+		<-s.getConversationWait
+		s.mu.Lock()
+	}
+	if s.conversationByID == nil {
+		return &clientpb.AIConversation{}, nil
+	}
+	conversation := s.conversationByID[req.GetID()]
+	if conversation == nil {
+		return &clientpb.AIConversation{}, nil
+	}
+	return proto.Clone(conversation).(*clientpb.AIConversation), nil
+}
+
+func (s *aiRPCServer) SaveAIConversation(_ context.Context, req *clientpb.AIConversation) (*clientpb.AIConversation, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.saveConversationReqs = append(s.saveConversationReqs, proto.Clone(req).(*clientpb.AIConversation))
+	if s.saveConversationResp == nil {
+		return proto.Clone(req).(*clientpb.AIConversation), nil
+	}
+	return proto.Clone(s.saveConversationResp).(*clientpb.AIConversation), nil
+}
+
+func (s *aiRPCServer) DeleteAIConversation(_ context.Context, req *clientpb.AIConversationReq) (*commonpb.Empty, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.deleteConversationReqs = append(s.deleteConversationReqs, proto.Clone(req).(*clientpb.AIConversationReq))
+	return &commonpb.Empty{}, nil
+}
+
+func (s *aiRPCServer) SaveAIConversationMessage(_ context.Context, req *clientpb.AIConversationMessage) (*clientpb.AIConversationMessage, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.saveMessageReqs = append(s.saveMessageReqs, proto.Clone(req).(*clientpb.AIConversationMessage))
+	if s.saveMessageStarted != nil {
+		select {
+		case s.saveMessageStarted <- struct{}{}:
+		default:
+		}
+	}
+	if s.saveMessageRelease != nil {
+		s.mu.Unlock()
+		<-s.saveMessageRelease
+		s.mu.Lock()
+	}
+	if s.saveMessageResp == nil {
+		return proto.Clone(req).(*clientpb.AIConversationMessage), nil
+	}
+	return proto.Clone(s.saveMessageResp).(*clientpb.AIConversationMessage), nil
+}
+
+func newAITestRPCClient(t *testing.T, srv rpcpb.SliverRPCServer) (rpcpb.SliverRPCClient, func()) {
+	t.Helper()
+
+	listener := bufconn.Listen(1024 * 1024)
+	grpcServer := grpc.NewServer()
+	rpcpb.RegisterSliverRPCServer(grpcServer, srv)
+
+	go func() {
+		_ = grpcServer.Serve(listener)
+	}()
+
+	dialer := func(context.Context, string) (net.Conn, error) { return listener.Dial() }
+	conn, err := grpc.DialContext(context.Background(), "bufnet",
+		grpc.WithContextDialer(dialer),
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+	)
+	if err != nil {
+		grpcServer.Stop()
+		_ = listener.Close()
+		t.Fatalf("dial bufconn: %v", err)
+	}
+
+	cleanup := func() {
+		_ = conn.Close()
+		grpcServer.Stop()
+		_ = listener.Close()
+	}
+
+	return rpcpb.NewSliverRPCClient(conn), cleanup
+}

client/command/alias/load.go

@@ -400,7 +400,13 @@ func runAliasCommand(cmd *cobra.Command, con *console.SliverClient, args []strin
 
 	var outFilePath *os.File
 	if save, _ := cmd.Flags().GetBool("save"); save {
-		outFile := filepath.Base(fmt.Sprintf("%s_%s*.log", filepath.Base(cmd.Name()), filepath.Base(session.GetHostname())))
+		hostname := ""
+		if session != nil {
+			hostname = session.GetHostname()
+		} else if beacon != nil {
+			hostname = beacon.GetHostname()
+		}
+		outFile := filepath.Base(fmt.Sprintf("%s_%s*.log", filepath.Base(cmd.Name()), filepath.Base(hostname)))
 		outFilePath, err = os.CreateTemp("", outFile)
 		if err != nil {
 			con.PrintErrorf("%s\n", err)

client/command/armory/commands.go

@@ -1,5 +1,23 @@
 package armory
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2026  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 import (
 	"github.com/rsteube/carapace"
 	"github.com/spf13/cobra"

client/command/armory/manage.go

@@ -1,5 +1,23 @@
 package armory
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2026  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 import (
 	"fmt"
 	"os"

client/command/docs/commands.go

@@ -0,0 +1,31 @@
+package docs
+
+import (
+	"github.com/bishopfox/sliver/client/command/help"
+	"github.com/bishopfox/sliver/client/console"
+	consts "github.com/bishopfox/sliver/client/constants"
+	"github.com/spf13/cobra"
+)
+
+// Commands returns the docs command.
+func Commands(con *console.SliverClient) []*cobra.Command {
+	return []*cobra.Command{newDocsCommand(consts.SliverCoreHelpGroup, con)}
+}
+
+// ServerCommands returns the docs command for the top-level client REPL.
+func ServerCommands(con *console.SliverClient) []*cobra.Command {
+	return []*cobra.Command{newDocsCommand(consts.GenericHelpGroup, con)}
+}
+
+func newDocsCommand(groupID string, con *console.SliverClient) *cobra.Command {
+	return &cobra.Command{
+		Use:     consts.DocsStr,
+		Short:   "Browse the embedded Sliver docs in a TUI",
+		Long:    help.GetHelpFor([]string{consts.DocsStr}),
+		Args:    cobra.NoArgs,
+		GroupID: groupID,
+		Run: func(cmd *cobra.Command, args []string) {
+			DocsCmd(cmd, con, args)
+		},
+	}
+}

client/command/docs/docs.go

@@ -0,0 +1,36 @@
+package docs
+
+import (
+	tea "charm.land/bubbletea/v2"
+	"github.com/bishopfox/sliver/client/console"
+	"github.com/charmbracelet/colorprofile"
+	"github.com/spf13/cobra"
+	"golang.org/x/term"
+)
+
+// DocsCmd launches the embedded docs browser TUI.
+func DocsCmd(_ *cobra.Command, con *console.SliverClient, _ []string) {
+	entries, err := loadDocEntries()
+	if err != nil {
+		if con != nil {
+			con.PrintErrorf("Failed to load embedded docs: %s\n", err)
+		}
+		return
+	}
+
+	model := newDocsModel(entries)
+
+	width, height := 100, 32
+	if w, h, err := term.GetSize(0); err == nil && w > 0 && h > 0 {
+		width, height = w, h
+	}
+
+	program := tea.NewProgram(
+		model,
+		tea.WithWindowSize(width, height),
+		tea.WithColorProfile(colorprofile.TrueColor),
+	)
+	if _, err := program.Run(); err != nil && con != nil {
+		con.PrintErrorf("Docs TUI error: %s\n", err)
+	}
+}

client/command/docs/model_test.go

@@ -0,0 +1,199 @@
+package docs
+
+import (
+	"strings"
+	"testing"
+
+	tea "charm.land/bubbletea/v2"
+	"github.com/charmbracelet/x/ansi"
+)
+
+func sampleDocs() []docEntry {
+	return []docEntry{
+		{
+			Name:        "Getting Started",
+			Content:     "# Getting Started\n\n- first step\n- second step",
+			Description: "Getting Started",
+		},
+		{
+			Name:        "Operators",
+			Content:     "# Operators\n\nTeam workflows",
+			Description: "Team workflows",
+		},
+		{
+			Name:        "Networking",
+			Content:     "# Networking\n\nTransport details",
+			Description: "Transport details",
+		},
+	}
+}
+
+func TestRenderMarkdownWithGlowRendersBulletLists(t *testing.T) {
+	rendered, err := renderMarkdownWithGlow(48, "# Title\n\n- first item")
+	if err != nil {
+		t.Fatalf("renderMarkdownWithGlow(): %v", err)
+	}
+
+	plain := ansi.Strip(rendered)
+	if !strings.Contains(plain, "Title") {
+		t.Fatalf("expected heading text, got %q", plain)
+	}
+	if !strings.Contains(plain, "• first item") {
+		t.Fatalf("expected glow-style bullet rendering, got %q", plain)
+	}
+}
+
+func TestSummarizeMarkdownPrefersFirstMeaningfulLine(t *testing.T) {
+	summary := summarizeMarkdown("# Title\n\n- Bullet\n\nParagraph")
+	if summary != "Title" {
+		t.Fatalf("expected first heading summary, got %q", summary)
+	}
+}
+
+func TestSummarizeMarkdownStripsMarkdownAndUnicodeSymbols(t *testing.T) {
+	summary := summarizeMarkdown("⚠️ **IMPORTANT:** This content was NOT created by the Sliver authors.")
+	if summary != "IMPORTANT: This content was NOT created by the Sliver authors." {
+		t.Fatalf("expected sanitized browser summary, got %q", summary)
+	}
+}
+
+func TestDocsModelDefaultsToGettingStarted(t *testing.T) {
+	model := newDocsModel(sampleDocs())
+	model.applyWindowSize(120, 32)
+
+	if model.currentDocName != "Getting Started" {
+		t.Fatalf("expected Getting Started to be selected, got %q", model.currentDocName)
+	}
+	plain := ansi.Strip(model.viewer.View())
+	if !strings.Contains(plain, "first step") {
+		t.Fatalf("expected initial viewer content to render selected doc, got %q", plain)
+	}
+}
+
+func TestDocsModelSlashFocusesBrowserAndStartsFiltering(t *testing.T) {
+	model := newDocsModel(sampleDocs())
+	model.applyWindowSize(120, 32)
+	model.focus = docsFocusViewer
+
+	updated, cmd := model.Update(tea.KeyPressMsg{Text: "/", Code: '/'})
+	if cmd == nil {
+		t.Fatal("expected slash to focus the search input")
+	}
+
+	updatedModel := updated.(*docsModel)
+	if updatedModel.focus != docsFocusBrowser {
+		t.Fatalf("expected slash to move focus to browser, got %v", updatedModel.focus)
+	}
+	if updatedModel.filterState != docsFilterStateFiltering {
+		t.Fatalf("expected slash to enter filtering state, got %v", updatedModel.filterState)
+	}
+}
+
+func TestDocsModelFilteringUpdatesVisibleEntries(t *testing.T) {
+	model := newDocsModel(sampleDocs())
+	model.applyWindowSize(120, 32)
+
+	model.startFiltering()
+	model.browserFilter.SetValue("oper")
+	model.updateFilteredEntries(false)
+
+	visible := model.visibleEntries()
+	if len(visible) != 1 || visible[0].Name != "Operators" {
+		t.Fatalf("expected Operators to be the only filtered result, got %+v", visible)
+	}
+	if model.currentDocName != "Operators" {
+		t.Fatalf("expected filtering to sync selection to Operators, got %q", model.currentDocName)
+	}
+}
+
+func TestDocsModelEnterMovesFocusToViewer(t *testing.T) {
+	model := newDocsModel(sampleDocs())
+	model.applyWindowSize(120, 32)
+
+	updated, _ := model.Update(tea.KeyPressMsg{Code: tea.KeyEnter})
+	updatedModel := updated.(*docsModel)
+	if updatedModel.focus != docsFocusViewer {
+		t.Fatalf("expected enter to focus viewer, got %v", updatedModel.focus)
+	}
+}
+
+func TestDocsModelEscClearsAppliedFilter(t *testing.T) {
+	model := newDocsModel(sampleDocs())
+	model.applyWindowSize(120, 32)
+
+	model.startFiltering()
+	model.browserFilter.SetValue("net")
+	model.finishFiltering(false)
+
+	updated, _ := model.Update(tea.KeyPressMsg{Code: tea.KeyEsc})
+	updatedModel := updated.(*docsModel)
+	if updatedModel.filterState != docsFilterStateUnfiltered {
+		t.Fatalf("expected esc to clear the filter, got %v", updatedModel.filterState)
+	}
+	if len(updatedModel.visibleEntries()) != len(sampleDocs()) {
+		t.Fatalf("expected filter clear to restore all docs, got %d visible", len(updatedModel.visibleEntries()))
+	}
+}
+
+func TestDocsModelBrowserBodyPinsHelpToBottom(t *testing.T) {
+	model := newDocsModel(sampleDocs())
+	model.applyWindowSize(120, 28)
+
+	body := ansi.Strip(model.renderBrowserBody(model.browserWidth, model.browserHeight))
+	lines := strings.Split(body, "\n")
+	if len(lines) != model.browserHeight {
+		t.Fatalf("expected browser body height %d, got %d lines", model.browserHeight, len(lines))
+	}
+	if !strings.Contains(lines[len(lines)-1], "q quit") {
+		t.Fatalf("expected help controls on the last browser line, got %q", lines[len(lines)-1])
+	}
+}
+
+func TestDocsWindowPollSchedulesResizeAndKeepsPolling(t *testing.T) {
+	model := newDocsModel(sampleDocs())
+	model.applyWindowSize(100, 28)
+
+	updated, cmd := model.Update(docsWindowPollMsg{width: 120, height: 34})
+	if cmd == nil {
+		t.Fatal("expected window poll to schedule resize handling")
+	}
+
+	updatedModel := updated.(*docsModel)
+	if updatedModel.width != 100 || updatedModel.height != 28 {
+		t.Fatalf("expected poll tick to leave dimensions unchanged until WindowSizeMsg, got %dx%d", updatedModel.width, updatedModel.height)
+	}
+
+	msg := cmd()
+	batch, ok := msg.(tea.BatchMsg)
+	if !ok {
+		t.Fatalf("expected poll tick to return tea.BatchMsg, got %T", msg)
+	}
+	if len(batch) != 2 {
+		t.Fatalf("expected poll tick batch size 2, got %d", len(batch))
+	}
+
+	var sawWindowSize bool
+	var sawPollTick bool
+	for _, subcmd := range batch {
+		if subcmd == nil {
+			continue
+		}
+		submsg := subcmd()
+		switch msg := submsg.(type) {
+		case tea.WindowSizeMsg:
+			sawWindowSize = true
+			if msg.Width != 120 || msg.Height != 34 {
+				t.Fatalf("expected resize 120x34, got %dx%d", msg.Width, msg.Height)
+			}
+		case docsWindowPollMsg:
+			sawPollTick = true
+		}
+	}
+
+	if !sawWindowSize {
+		t.Fatal("expected poll tick to emit WindowSizeMsg")
+	}
+	if !sawPollTick {
+		t.Fatal("expected poll tick to schedule another poll")
+	}
+}

client/command/generate/commands.go

@@ -340,6 +340,13 @@ func coreImplantFlags(name string, cmd *cobra.Command) {
 
 		f.Uint32P("key-exchange", "X", DefaultWGKeyExPort, "wg key-exchange port")
 		f.Uint32P("tcp-comms", "T", DefaultWGNPort, "wg c2 comms port")
+		f.Bool("include-mtls", false, "force include mtls transport")
+		f.Bool("include-http", false, "force include http transport")
+		f.Bool("include-wg", false, "force include wireguard transport")
+		f.Bool("include-dns", false, "force include dns transport")
+		f.Bool("include-named-pipe", false, "force include named-pipe transport")
+		f.Bool("include-tcp-pivot", false, "force include tcp-pivot transport")
+		f.Bool("all-protocols", false, "force include all transport protocols")
 
 		f.BoolP("run-at-load", "R", false, "run the implant entrypoint from DllMain/Constructor (shared library only)")
 		f.BoolP("netgo", "q", false, "force the use of netgo")

client/command/generate/generate.go

@@ -483,6 +483,23 @@ func parseCompileFlags(cmd *cobra.Command, con *console.SliverClient) (string, *
 		c2Profile = consts.DefaultC2Profile
 	}
 
+	allProtocols, _ := cmd.Flags().GetBool("all-protocols")
+	includeMTLS, _ := cmd.Flags().GetBool("include-mtls")
+	includeHTTP, _ := cmd.Flags().GetBool("include-http")
+	includeWG, _ := cmd.Flags().GetBool("include-wg")
+	includeDNS, _ := cmd.Flags().GetBool("include-dns")
+	includeNamedPipe, _ := cmd.Flags().GetBool("include-named-pipe")
+	includeTCP, _ := cmd.Flags().GetBool("include-tcp-pivot")
+
+	if allProtocols {
+		includeMTLS = true
+		includeHTTP = true
+		includeWG = true
+		includeDNS = true
+		includeNamedPipe = true
+		includeTCP = true
+	}
+
 	// exports if its a shared library
 
 	config := &clientpb.ImplantConfig{
@@ -527,6 +544,13 @@ func parseCompileFlags(cmd *cobra.Command, con *console.SliverClient) (string, *
 		DebugFile:        debugFile,
 		HTTPC2ConfigName: c2Profile,
 		ShellcodeConfig:  shellcodeConfig,
+
+		IncludeMTLS:     includeMTLS,
+		IncludeHTTP:     includeHTTP,
+		IncludeWG:       includeWG,
+		IncludeDNS:      includeDNS,
+		IncludeNamePipe: includeNamedPipe,
+		IncludeTCP:      includeTCP,
 	}
 
 	return name, config

client/command/help/long-help.go

@@ -56,6 +56,9 @@ var (
 		consts.LsStr:          lsHelp,
 		consts.CdStr:          cdHelp,
 		consts.PwdStr:         pwdHelp,
+		consts.AIStr:          aiHelp,
+		consts.AIConfigStr:    aiConfigHelp,
+		consts.DocsStr:        docsHelp,
 		consts.CatStr:         catHelp,
 		consts.EditStr:        editHelp,
 		consts.HexEditStr:     hexEditHelp,
@@ -167,6 +170,29 @@ _=/usr/bin/env
 	infoHelp = `[[.Bold]]Command:[[.Normal]] info <sliver name/session>
 [[.Bold]]About:[[.Normal]] Get information about a Sliver by name, or for the active Sliver.`
 
+	aiHelp = `[[.Bold]]Command:[[.Normal]] ai
+[[.Bold]]About:[[.Normal]] Launch the Sliver AI Bubble Tea TUI. The AI workspace now loads server-side conversation threads over gRPC, keeps them synced through the shared event stream, and renders conversation transcripts as markdown in the main pane.
+
+[[.Bold]]Example:[[.Normal]]
+	use my-session
+	ai
+`
+
+	aiConfigHelp = `[[.Bold]]Command:[[.Normal]] ai-config
+[[.Bold]]About:[[.Normal]] Open a server-side form to update the AI block in server.yaml. The form stores the default provider, model, thinking level, and provider-specific credentials such as the API key and optional base URL.
+
+[[.Bold]]Example:[[.Normal]]
+	ai-config
+`
+
+	docsHelp = `[[.Bold]]Command:[[.Normal]] docs
+[[.Bold]]About:[[.Normal]] Browse the embedded Sliver documentation in a Bubble Tea TUI. The left pane is a searchable docs browser, and the right pane renders markdown with Glow styling.
+[[.Bold]]Keys:[[.Normal]] Use / to filter docs, enter to focus the selected document, tab to switch panes, and q to quit.
+
+[[.Bold]]Example:[[.Normal]]
+	docs
+`
+
 	useHelp = `[[.Bold]]Command:[[.Normal]] use [sliver name/session]
 [[.Bold]]About:[[.Normal]] Switch the active Sliver, a valid name must be provided (see sessions).`
 

client/command/mcp/commands.go

@@ -66,6 +66,7 @@ func Commands(con *console.SliverClient) []*cobra.Command {
 	flags.Bind("", false, consoleCmd, func(f *pflag.FlagSet) {
 		f.String("transport", string(defaultConfig.Transport), "mcp transport (http or sse)")
 		f.String("url", "", "mcp server URL (defaults to local server settings)")
+		f.String("auth-token", "", "MCP auth token (defaults to the local mcp.yaml token)")
 	})
 	flags.BindFlagCompletions(consoleCmd, func(comp *carapace.ActionMap) {
 		(*comp)["transport"] = carapace.ActionValues("http", "sse")

client/command/mcp/console.go

@@ -6,12 +6,14 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"os"
 	"strings"
 
 	"github.com/bishopfox/sliver/client/console"
 	clientmcp "github.com/bishopfox/sliver/client/mcp"
 	"github.com/bishopfox/sliver/client/version"
 	mcpclient "github.com/mark3labs/mcp-go/client"
+	mcptransport "github.com/mark3labs/mcp-go/client/transport"
 	mcpapi "github.com/mark3labs/mcp-go/mcp"
 	"github.com/spf13/cobra"
 )
@@ -36,7 +38,23 @@ func McpConsoleCmd(cmd *cobra.Command, con *console.SliverClient, args []string)
 		}
 	}
 
-	client, err := newConsoleClient(transport, targetURL)
+	authToken, _ := cmd.Flags().GetString("auth-token")
+	if authToken == "" {
+		status := clientmcp.GetStatus()
+		if status.AuthToken != "" {
+			authToken = status.AuthToken
+		} else {
+			authInfo, loadErr := clientmcp.LoadAuthInfo()
+			if loadErr == nil {
+				authToken = authInfo.Token
+			} else if !errors.Is(loadErr, os.ErrNotExist) {
+				con.PrintErrorf("%s\n", loadErr)
+				return
+			}
+		}
+	}
+
+	client, err := newConsoleClient(transport, targetURL, authToken)
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
 		return
@@ -68,12 +86,19 @@ func McpConsoleCmd(cmd *cobra.Command, con *console.SliverClient, args []string)
 	runConsoleREPL(ctx, client, cmd.InOrStdin(), cmd.OutOrStdout())
 }
 
-func newConsoleClient(transport clientmcp.Transport, targetURL string) (*mcpclient.Client, error) {
+func newConsoleClient(transport clientmcp.Transport, targetURL string, authToken string) (*mcpclient.Client, error) {
+	if strings.TrimSpace(authToken) == "" {
+		return nil, fmt.Errorf("mcp auth token is required (use --auth-token or start the local MCP server first)")
+	}
+	headers := map[string]string{
+		clientmcp.AuthHeaderName(): authToken,
+	}
+
 	switch transport {
 	case clientmcp.TransportHTTP:
-		return mcpclient.NewStreamableHttpClient(targetURL)
+		return mcpclient.NewStreamableHttpClient(targetURL, mcptransport.WithHTTPHeaders(headers))
 	case clientmcp.TransportSSE:
-		return mcpclient.NewSSEMCPClient(targetURL)
+		return mcpclient.NewSSEMCPClient(targetURL, mcpclient.WithHeaders(headers))
 	default:
 		return nil, fmt.Errorf("unsupported transport %q", transport)
 	}

client/command/mcp/mcp.go

@@ -26,6 +26,12 @@ func McpCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
 	} else {
 		con.PrintErrorf("Endpoint: %s\n", err)
 	}
+	if status.AuthHeader != "" {
+		con.Printf("Auth Header: %s\n", status.AuthHeader)
+	}
+	if status.AuthToken != "" {
+		con.Printf("Auth Token: %s\n", status.AuthToken)
+	}
 
 	if status.Running && !status.StartedAt.IsZero() {
 		uptime := time.Since(status.StartedAt).Truncate(time.Second)

client/command/mcp/start.go

@@ -43,4 +43,11 @@ func McpStartCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
 	if err == nil {
 		con.PrintInfof("Endpoint: %s\n", endpoint)
 	}
+	status := slivermcp.GetStatus()
+	if status.AuthHeader != "" {
+		con.PrintInfof("Auth Header: %s\n", status.AuthHeader)
+	}
+	if status.AuthToken != "" {
+		con.PrintInfof("Auth Token: %s\n", status.AuthToken)
+	}
 }

client/command/reconfig/reconfig.go

@@ -24,6 +24,7 @@ import (
 	"time"
 
 	"github.com/bishopfox/sliver/client/console"
+	"github.com/bishopfox/sliver/client/forms"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/spf13/cobra"
@@ -94,16 +95,24 @@ func ReconfigCmd(cmd *cobra.Command, con *console.SliverClient, args []string) {
 		if activeC2 != "" {
 			currentURI, err := url.Parse(activeC2)
 			if err == nil {
-				// must be the same protocol
 				if newURI.Scheme != currentURI.Scheme {
-					con.PrintErrorf("Cannot switch protocol from %s to %s (protocol must match compiled implant)\n",
+					confirm := false
+					con.PrintWarnf("Switching protocol from %s to %s. This will only work if the protocol was included in the compiled implant. If it was NOT included, YOU WILL LOSE THE BEACON CONNECTION PERMANENTLY.\n",
 						currentURI.Scheme, newURI.Scheme)
-					return
+					_ = forms.Confirm("Do you want to continue?", &confirm)
+					if !confirm {
+						return
+					}
 				}
-				// for now only support the same Host/C2 Server (becuase the implant crypto keys problem)
+				// Warning: Switching to a different host typically fails because the implant and server must share the same crypto keys.
 				if newURI.Hostname() != currentURI.Hostname() {
 					con.PrintWarnf("Switching to a different host (%s -> %s). This only works if both servers share the same crypto keys.\n",
 						currentURI.Hostname(), newURI.Hostname())
+					confirm := false
+					_ = forms.Confirm("Do you want to continue?", &confirm)
+					if !confirm {
+						return
+					}
 				}
 			}
 		}

client/command/server.go

@@ -22,6 +22,7 @@ import (
 	"fmt"
 	"os"
 
+	"github.com/bishopfox/sliver/client/command/ai"
 	"github.com/bishopfox/sliver/client/command/aka"
 	"github.com/bishopfox/sliver/client/command/alias"
 	"github.com/bishopfox/sliver/client/command/armory"
@@ -32,6 +33,7 @@ import (
 	"github.com/bishopfox/sliver/client/command/clean"
 	"github.com/bishopfox/sliver/client/command/crack"
 	"github.com/bishopfox/sliver/client/command/creds"
+	docscmd "github.com/bishopfox/sliver/client/command/docs"
 	"github.com/bishopfox/sliver/client/command/exit"
 	"github.com/bishopfox/sliver/client/command/extensions"
 	"github.com/bishopfox/sliver/client/command/generate"
@@ -98,6 +100,8 @@ func ServerCommands(con *client.SliverClient, serverCmds func() []*cobra.Command
 		// Core
 		bind(consts.GenericHelpGroup,
 			exit.Command,
+			ai.ServerCommands,
+			docscmd.ServerCommands,
 			serverctx.Commands,
 			licenses.Commands,
 			settings.Commands,

client/command/serverctx/commands_client.go

@@ -13,15 +13,15 @@ import (
 	"sync"
 	"time"
 
+	"charm.land/bubbles/v2/key"
+	tea "charm.land/bubbletea/v2"
+	"charm.land/huh/v2"
 	"charm.land/lipgloss/v2"
 	"github.com/bishopfox/sliver/client/assets"
 	"github.com/bishopfox/sliver/client/console"
 	clienttheme "github.com/bishopfox/sliver/client/theme"
 	"github.com/bishopfox/sliver/client/transport"
 	"github.com/bishopfox/sliver/protobuf/commonpb"
-	"github.com/charmbracelet/bubbles/key"
-	tea "github.com/charmbracelet/bubbletea"
-	"github.com/charmbracelet/huh"
 	"github.com/spf13/cobra"
 	"google.golang.org/grpc/connectivity"
 )
@@ -158,7 +158,7 @@ func serverSwitch(_ *cobra.Command, con *console.SliverClient) {
 		}
 
 		if err := con.SetConnection(rpc, conn, &console.ConnectionDetails{ConfigKey: inst.ConfigKey, Config: inst.Config}); err != nil {
-			_ = conn.Close()
+			_ = transport.CloseGRPCConnection(conn)
 			con.PrintErrorf("Switch failed: %s\n", err)
 			return
 		}
@@ -180,7 +180,7 @@ func serverSwitch(_ *cobra.Command, con *console.SliverClient) {
 		}
 
 		if err := con.SetConnection(rpc, conn, &console.ConnectionDetails{ConfigKey: result.ConfigKey, Config: cfg}); err != nil {
-			_ = conn.Close()
+			_ = transport.CloseGRPCConnection(conn)
 			con.PrintErrorf("Switch failed: %s\n", err)
 			return
 		}
@@ -347,7 +347,6 @@ type switchTUIModel struct {
 	result   switchResult
 	width    int
 	height   int
-	theme    *huh.Theme
 	styles   switchStyles
 	activeID string
 	counts   map[string]int
@@ -367,7 +366,7 @@ type switchStyles struct {
 
 func runSwitchTUI(instances []*consoleInstance, activeID string, configKeys []string, counts map[string]int) (switchResult, error) {
 	m := newSwitchTUIModel(instances, activeID, configKeys, counts)
-	prog := tea.NewProgram(m, tea.WithAltScreen())
+	prog := tea.NewProgram(m)
 	finalModel, err := prog.Run()
 	if err != nil {
 		return switchResult{}, err
@@ -465,7 +464,6 @@ func newSwitchTUIModel(instances []*consoleInstance, activeID string, configKeys
 		tab:      tabExisting,
 		existing: existingForm,
 		newConn:  newForm,
-		theme:    huhTheme,
 		styles:   styles,
 		activeID: activeID,
 		counts:   counts,
@@ -491,7 +489,7 @@ func (m switchTUIModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		m.newConn = modelB.(*huh.Form)
 		return m, tea.Batch(cmdA, cmdB)
 
-	case tea.KeyMsg:
+	case tea.KeyPressMsg:
 		switch msg.String() {
 		case "tab":
 			if m.tab == tabExisting {
@@ -548,7 +546,7 @@ func (m switchTUIModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	return m, nil
 }
 
-func (m switchTUIModel) View() string {
+func (m switchTUIModel) View() tea.View {
 	header := m.renderHeader()
 
 	body := ""
@@ -562,7 +560,9 @@ func (m switchTUIModel) View() string {
 	footer := m.renderFooter()
 
 	content := lipgloss.JoinVertical(lipgloss.Left, header, body, footer)
-	return m.styles.frame.Render(content)
+	view := tea.NewView(m.styles.frame.Render(content))
+	view.AltScreen = true
+	return view
 }
 
 func (m switchTUIModel) renderHeader() string {

client/command/sliver.go

@@ -22,16 +22,19 @@ import (
 	"fmt"
 
 	"github.com/bishopfox/sliver/client/assets"
+	"github.com/bishopfox/sliver/client/command/ai"
 	"github.com/bishopfox/sliver/client/command/aka"
 	"github.com/bishopfox/sliver/client/command/alias"
 	"github.com/bishopfox/sliver/client/command/backdoor"
 	"github.com/bishopfox/sliver/client/command/cursed"
 	"github.com/bishopfox/sliver/client/command/dllhijack"
+	docscmd "github.com/bishopfox/sliver/client/command/docs"
 	"github.com/bishopfox/sliver/client/command/edit"
 	"github.com/bishopfox/sliver/client/command/environment"
 	"github.com/bishopfox/sliver/client/command/exec"
 	"github.com/bishopfox/sliver/client/command/extensions"
 	"github.com/bishopfox/sliver/client/command/filesystem"
+	"github.com/bishopfox/sliver/client/command/hexedit"
 	"github.com/bishopfox/sliver/client/command/info"
 	"github.com/bishopfox/sliver/client/command/kill"
 	"github.com/bishopfox/sliver/client/command/network"
@@ -49,7 +52,6 @@ import (
 	"github.com/bishopfox/sliver/client/command/tasks"
 	"github.com/bishopfox/sliver/client/command/wasm"
 	"github.com/bishopfox/sliver/client/command/wireguard"
-	"github.com/bishopfox/sliver/client/command/hexedit"
 	client "github.com/bishopfox/sliver/client/console"
 	consts "github.com/bishopfox/sliver/client/constants"
 	"github.com/reeflective/console"
@@ -78,6 +80,8 @@ func SliverCommands(con *client.SliverClient) console.Commands {
 
 		// [ Core ]
 		bind(consts.SliverCoreHelpGroup,
+			ai.Commands,
+			docscmd.Commands,
 			reconfig.Commands,
 			// sessions.Commands,
 			sessions.SliverCommands,

client/console/connection.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/bishopfox/sliver/client/assets"
 	"github.com/bishopfox/sliver/client/core"
+	"github.com/bishopfox/sliver/client/transport"
 	"github.com/bishopfox/sliver/protobuf/rpcpb"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/connectivity"
@@ -123,7 +124,7 @@ func (con *SliverClient) detachConnectionLocked() {
 	}
 
 	if con.grpcConn != nil {
-		_ = con.grpcConn.Close()
+		_ = transport.CloseGRPCConnection(con.grpcConn)
 		con.grpcConn = nil
 	}
 	con.Rpc = nil

client/console/console.go

@@ -29,6 +29,7 @@ import (
 	"strconv"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/bishopfox/sliver/client/assets"
@@ -86,6 +87,11 @@ type SliverClient struct {
 	stdoutPipeWriter *os.File
 	stdoutPipeDone   chan struct{}
 	stdoutPipeOnce   sync.Once
+	stdoutSyncMu     sync.Mutex
+	stdoutSyncSeq    uint64
+	stdoutSyncMarker []byte
+	stdoutSyncAcks   map[uint64]chan struct{}
+	stdoutSyncAcksMu sync.Mutex
 
 	connMu                 sync.Mutex
 	grpcConn               *grpc.ClientConn
@@ -94,6 +100,7 @@ type SliverClient struct {
 	connWg                 *sync.WaitGroup
 	connectionHooksApplied bool
 	logCommandHookApplied  bool
+	suppressedEventNotifs  atomic.Int32
 
 	// These writers are always safe to use (never error); the underlying stream
 	// can be swapped on server switch to avoid breaking io.MultiWriter/io.Copy.
@@ -317,6 +324,8 @@ func (con *SliverClient) applyConnectionHooksOnce() {
 	}
 	con.connectionHooksApplied = true
 
+	con.App.PreReadlineHooks = append(con.App.PreReadlineHooks, con.syncOutputHook)
+	con.App.PostCmdRunHooks = append(con.App.PostCmdRunHooks, con.syncOutputHook)
 	con.App.PreCmdRunLineHooks = append(con.App.PreCmdRunLineHooks, con.allowServerRootCommands)
 	if shell := con.App.Shell(); shell != nil && shell.Completer != nil {
 		baseCompleter := shell.Completer
@@ -345,8 +354,20 @@ func (con *SliverClient) startEventLoop(ctx context.Context) {
 		switch event.EventType {
 
 		case consts.CanaryEvent:
-			con.PrintEventErrorf("%s %s has been burned (DNS Canary)", StyleBold.Render("WARNING:"), event.Session.Name)
 			sessions := con.GetSessionsByName(event.Session.Name)
+			if con.eventNotificationsSuppressed() {
+				affected := make([]string, 0, len(sessions))
+				for _, session := range sessions {
+					affected = append(affected, strings.Split(session.ID, "-")[0])
+				}
+				message := fmt.Sprintf("%s %s has been burned (DNS Canary)", StyleBold.Render("WARNING:"), event.Session.Name)
+				if len(affected) > 0 {
+					message += " Affected sessions: " + strings.Join(affected, ", ")
+				}
+				con.emitToastEvent("error", message)
+				break
+			}
+			con.PrintEventErrorf("%s %s has been burned (DNS Canary)", StyleBold.Render("WARNING:"), event.Session.Name)
 			for _, session := range sessions {
 				shortID := strings.Split(session.ID, "-")[0]
 				con.PrintErrorf("\t🔥 Session %s is affected", shortID)
@@ -354,8 +375,20 @@ func (con *SliverClient) startEventLoop(ctx context.Context) {
 
 		case consts.WatchtowerEvent:
 			msg := string(event.Data)
-			con.PrintEventErrorf("%s %s has been burned (seen on %s)", StyleBold.Render("WARNING:"), event.Session.Name, msg)
 			sessions := con.GetSessionsByName(event.Session.Name)
+			if con.eventNotificationsSuppressed() {
+				affected := make([]string, 0, len(sessions))
+				for _, session := range sessions {
+					affected = append(affected, strings.Split(session.ID, "-")[0])
+				}
+				message := fmt.Sprintf("%s %s has been burned (seen on %s)", StyleBold.Render("WARNING:"), event.Session.Name, msg)
+				if len(affected) > 0 {
+					message += " Affected sessions: " + strings.Join(affected, ", ")
+				}
+				con.emitToastEvent("error", message)
+				break
+			}
+			con.PrintEventErrorf("%s %s has been burned (seen on %s)", StyleBold.Render("WARNING:"), event.Session.Name, msg)
 			for _, session := range sessions {
 				shortID := strings.Split(session.ID, "-")[0]
 				con.PrintErrorf("\t🔥 Session %s is affected", shortID)
@@ -363,42 +396,42 @@ func (con *SliverClient) startEventLoop(ctx context.Context) {
 
 		case consts.JoinedEvent:
 			if con.Settings.UserConnect {
-				con.PrintInfof("%s has joined the game", event.Client.Operator.Name)
+				con.emitConsoleNotification("info", false, "%s has joined the game", event.Client.Operator.Name)
 			}
 		case consts.LeftEvent:
 			if con.Settings.UserConnect {
-				con.PrintInfof("%s left the game", event.Client.Operator.Name)
+				con.emitConsoleNotification("info", false, "%s left the game", event.Client.Operator.Name)
 			}
 
 		case consts.JobStoppedEvent:
 			job := event.Job
-			con.PrintErrorf("Job #%d stopped (%s/%s)", job.ID, job.Protocol, job.Name)
+			con.emitConsoleNotification("error", false, "Job #%d stopped (%s/%s)", job.ID, job.Protocol, job.Name)
 
 		case consts.SessionOpenedEvent:
 			session := event.Session
 			currentTime := time.Now().Format(time.RFC1123)
 			shortID := strings.Split(session.ID, "-")[0]
-			con.PrintEventInfof("Session %s %s - %s (%s) - %s/%s - %v",
+			con.emitConsoleNotification("info", true, "Session %s %s - %s (%s) - %s/%s - %v",
 				shortID, session.Name, session.RemoteAddress, session.Hostname, session.OS, session.Arch, currentTime)
 
 		case consts.SessionUpdateEvent:
 			session := event.Session
 			currentTime := time.Now().Format(time.RFC1123)
 			shortID := strings.Split(session.ID, "-")[0]
-			con.PrintInfof("Session %s has been updated - %v", shortID, currentTime)
+			con.emitConsoleNotification("info", false, "Session %s has been updated - %v", shortID, currentTime)
 
 		case consts.SessionClosedEvent:
 			session := event.Session
 			currentTime := time.Now().Format(time.RFC1123)
 			shortID := strings.Split(session.ID, "-")[0]
-			con.PrintEventErrorf("Lost session %s %s - %s (%s) - %s/%s - %v",
+			con.emitConsoleNotification("error", true, "Lost session %s %s - %s (%s) - %s/%s - %v",
 				shortID, session.Name, session.RemoteAddress, session.Hostname, session.OS, session.Arch, currentTime)
 			activeSession := con.ActiveTarget.GetSession()
 			core.GetTunnels().CloseForSession(session.ID)
 			core.CloseCursedProcesses(session.ID)
 			if activeSession != nil && activeSession.ID == session.ID {
 				con.ActiveTarget.Set(nil, nil)
-				con.PrintErrorf("Active session disconnected")
+				con.emitConsoleNotification("error", false, "Active session disconnected")
 			}
 
 		case consts.BeaconRegisteredEvent:
@@ -406,7 +439,7 @@ func (con *SliverClient) startEventLoop(ctx context.Context) {
 			proto.Unmarshal(event.Data, beacon)
 			currentTime := time.Now().Format(time.RFC1123)
 			shortID := strings.Split(beacon.ID, "-")[0]
-			con.PrintEventInfof("Beacon %s %s - %s (%s) - %s/%s - %v",
+			con.emitConsoleNotification("info", true, "Beacon %s %s - %s (%s) - %s/%s - %v",
 				shortID, beacon.Name, beacon.RemoteAddress, beacon.Hostname, beacon.OS, beacon.Arch, currentTime)
 
 		case consts.BeaconTaskResultEvent:
@@ -426,6 +459,66 @@ func (con *SliverClient) CreateEventListener() (string, <-chan *clientpb.Event)
 	return listenerID.String(), listener
 }
 
+// SuppressEventNotifications redirects console event messages to local listeners instead of stdout.
+func (con *SliverClient) SuppressEventNotifications() func() {
+	if con == nil {
+		return func() {}
+	}
+	con.suppressedEventNotifs.Add(1)
+	return func() {
+		if con == nil {
+			return
+		}
+		if con.suppressedEventNotifs.Add(-1) < 0 {
+			con.suppressedEventNotifs.Store(0)
+		}
+	}
+}
+
+func (con *SliverClient) eventNotificationsSuppressed() bool {
+	return con != nil && con.suppressedEventNotifs.Load() > 0
+}
+
+func (con *SliverClient) emitToastEvent(level string, message string) {
+	if con == nil || con.EventListeners == nil || strings.TrimSpace(message) == "" {
+		return
+	}
+	con.triggerEventListeners(&clientpb.Event{
+		EventType: consts.ClientToastEvent,
+		Data:      []byte(message),
+		Err:       strings.TrimSpace(level),
+	})
+}
+
+func (con *SliverClient) emitConsoleNotification(level string, emphasized bool, format string, args ...any) {
+	message := fmt.Sprintf(format, args...)
+	if con.eventNotificationsSuppressed() {
+		con.emitToastEvent(level, message)
+		return
+	}
+
+	switch strings.ToLower(strings.TrimSpace(level)) {
+	case "error", "warn", "warning":
+		if emphasized {
+			con.PrintEventErrorf("%s", message)
+		} else {
+			con.PrintErrorf("%s", message)
+		}
+	case "success":
+		if emphasized {
+			con.PrintEventSuccessf("%s", message)
+		} else {
+			con.PrintSuccessf("%s", message)
+		}
+	default:
+		if emphasized {
+			con.PrintEventInfof("%s", message)
+		} else {
+			con.PrintInfof("%s", message)
+		}
+	}
+}
+
 // RemoveEventListener - removes an event listener given its id.
 func (con *SliverClient) RemoveEventListener(listenerID string) {
 	value, ok := con.EventListeners.LoadAndDelete(listenerID)
@@ -470,10 +563,10 @@ func (con *SliverClient) triggerReactions(event *clientpb.Event) {
 
 	for _, reaction := range reactions {
 		for _, line := range reaction.Commands {
-			con.PrintInfof("%s '%s'", StyleBold.Render("Execute reaction:"), line)
+			con.emitConsoleNotification("info", false, "%s '%s'", StyleBold.Render("Execute reaction:"), line)
 			err := con.App.ActiveMenu().RunCommandLine(context.Background(), line)
 			if err != nil {
-				con.PrintErrorf("Reaction command error: %s\n", err)
+				con.emitConsoleNotification("error", false, "Reaction command error: %s", err)
 			}
 		}
 	}

client/console/log.go

@@ -19,7 +19,10 @@ package console
 */
 
 import (
+	"bytes"
 	"context"
+	"crypto/rand"
+	"encoding/binary"
 	"fmt"
 	"io"
 	"log"
@@ -38,6 +41,11 @@ import (
 	"golang.org/x/term"
 )
 
+const (
+	stdoutSyncMarkerSize = 16
+	stdoutSyncWait       = 2 * time.Second
+)
+
 // ConsoleClientLogger is an io.Writer that sends data to the server.
 type ConsoleClientLogger struct {
 	name   string
@@ -233,14 +241,158 @@ func (con *SliverClient) setupAsciicastRecord(logFile *os.File, server io.Writer
 	os.Stdout = w
 	os.Stderr = w
 
+	marker := make([]byte, stdoutSyncMarkerSize)
+	if _, err := rand.Read(marker); err != nil {
+		copy(marker, []byte(fmt.Sprintf("sliver-sync-%d", time.Now().UnixNano())))
+	}
+
 	done := make(chan struct{})
 	con.stdoutPipeWriter = w
 	con.stdoutPipeDone = done
+	con.stdoutSyncMarker = marker
+	con.stdoutSyncAcks = map[uint64]chan struct{}{}
 
-	go func() {
-		_, _ = io.Copy(mw, r)
-		close(done)
-	}()
+	go con.copyStdoutPipe(r, mw, done)
+}
+
+func buildStdoutSyncFrame(marker []byte, seq uint64) []byte {
+	frame := make([]byte, len(marker)*2+8)
+	copy(frame, marker)
+	binary.BigEndian.PutUint64(frame[len(marker):], seq)
+	copy(frame[len(marker)+8:], marker)
+	return frame
+}
+
+func pendingMarkerPrefixLen(pending []byte, marker []byte) int {
+	max := len(marker) - 1
+	if max > len(pending) {
+		max = len(pending)
+	}
+	for size := max; size > 0; size-- {
+		if bytes.Equal(pending[len(pending)-size:], marker[:size]) {
+			return size
+		}
+	}
+	return 0
+}
+
+func drainStdoutPipeBuffer(dst io.Writer, pending []byte, marker []byte, ack func(uint64)) []byte {
+	if len(pending) == 0 {
+		return pending
+	}
+	if len(marker) == 0 {
+		_, _ = dst.Write(pending)
+		return pending[:0]
+	}
+
+	frameLen := len(marker)*2 + 8
+	for {
+		idx := bytes.Index(pending, marker)
+		if idx == -1 {
+			keep := pendingMarkerPrefixLen(pending, marker)
+			flush := len(pending) - keep
+			if flush > 0 {
+				_, _ = dst.Write(pending[:flush])
+				pending = pending[flush:]
+			}
+			return pending
+		}
+
+		if idx > 0 {
+			_, _ = dst.Write(pending[:idx])
+			pending = pending[idx:]
+		}
+		if len(pending) < frameLen {
+			return pending
+		}
+		if bytes.Equal(pending[len(marker)+8:frameLen], marker) {
+			if ack != nil {
+				ack(binary.BigEndian.Uint64(pending[len(marker) : len(marker)+8]))
+			}
+			pending = pending[frameLen:]
+			continue
+		}
+
+		_, _ = dst.Write(pending[:1])
+		pending = pending[1:]
+	}
+}
+
+func (con *SliverClient) copyStdoutPipe(src *os.File, dst io.Writer, done chan struct{}) {
+	defer close(done)
+	defer src.Close()
+
+	readBuf := make([]byte, 4096)
+	pending := make([]byte, 0, 4096)
+	for {
+		n, err := src.Read(readBuf)
+		if n > 0 {
+			pending = append(pending, readBuf[:n]...)
+			pending = drainStdoutPipeBuffer(dst, pending, con.stdoutSyncMarker, con.ackStdoutSync)
+		}
+		if err != nil {
+			break
+		}
+	}
+	if len(pending) > 0 {
+		_, _ = dst.Write(pending)
+	}
+}
+
+func (con *SliverClient) ackStdoutSync(seq uint64) {
+	con.stdoutSyncAcksMu.Lock()
+	ack := con.stdoutSyncAcks[seq]
+	delete(con.stdoutSyncAcks, seq)
+	con.stdoutSyncAcksMu.Unlock()
+
+	if ack != nil {
+		close(ack)
+	}
+}
+
+func (con *SliverClient) clearStdoutSync(seq uint64) {
+	con.stdoutSyncAcksMu.Lock()
+	delete(con.stdoutSyncAcks, seq)
+	con.stdoutSyncAcksMu.Unlock()
+}
+
+func (con *SliverClient) syncOutputHook() error {
+	con.syncOutput()
+	return nil
+}
+
+func (con *SliverClient) syncOutput() {
+	if con.stdoutPipeWriter == nil {
+		_ = os.Stdout.Sync()
+		return
+	}
+	if len(con.stdoutSyncMarker) == 0 {
+		return
+	}
+
+	con.stdoutSyncMu.Lock()
+	con.stdoutSyncSeq++
+	seq := con.stdoutSyncSeq
+	ack := make(chan struct{})
+	con.stdoutSyncAcksMu.Lock()
+	if con.stdoutSyncAcks == nil {
+		con.stdoutSyncAcks = map[uint64]chan struct{}{}
+	}
+	con.stdoutSyncAcks[seq] = ack
+	con.stdoutSyncAcksMu.Unlock()
+	frame := buildStdoutSyncFrame(con.stdoutSyncMarker, seq)
+	_, err := con.stdoutPipeWriter.Write(frame)
+	con.stdoutSyncMu.Unlock()
+	if err != nil {
+		con.clearStdoutSync(seq)
+		return
+	}
+
+	select {
+	case <-ack:
+	case <-time.After(stdoutSyncWait):
+		con.clearStdoutSync(seq)
+	}
 }
 
 func getConsoleLogFile() *os.File {

client/console/log_test.go

@@ -0,0 +1,137 @@
+package console
+
+import (
+	"bytes"
+	"os"
+	"sync"
+	"testing"
+	"time"
+
+	consts "github.com/bishopfox/sliver/client/constants"
+)
+
+func TestDrainStdoutPipeBufferStripsSyncFrames(t *testing.T) {
+	marker := []byte{0x01, 0x02, 0x03, 0x04}
+	frame := buildStdoutSyncFrame(marker, 7)
+
+	var got bytes.Buffer
+	var acked []uint64
+	pending := drainStdoutPipeBuffer(&got, append(append([]byte("before"), frame...), []byte("after")...), marker, func(seq uint64) {
+		acked = append(acked, seq)
+	})
+	if len(pending) > 0 {
+		_, _ = got.Write(pending)
+	}
+
+	if got.String() != "beforeafter" {
+		t.Fatalf("unexpected output %q", got.String())
+	}
+	if len(acked) != 1 || acked[0] != 7 {
+		t.Fatalf("unexpected sync acknowledgements: %v", acked)
+	}
+}
+
+func TestDrainStdoutPipeBufferHandlesSplitFrame(t *testing.T) {
+	marker := []byte{0xaa, 0xbb, 0xcc, 0xdd}
+	frame := buildStdoutSyncFrame(marker, 11)
+
+	var got bytes.Buffer
+	var acked []uint64
+
+	chunk1 := append([]byte("left"), frame[:5]...)
+	pending := drainStdoutPipeBuffer(&got, chunk1, marker, func(seq uint64) {
+		acked = append(acked, seq)
+	})
+	if got.String() != "left" {
+		t.Fatalf("expected prefix output to flush, got %q", got.String())
+	}
+
+	chunk2 := append(append([]byte{}, pending...), frame[5:]...)
+	chunk2 = append(chunk2, []byte("right")...)
+	pending = drainStdoutPipeBuffer(&got, chunk2, marker, func(seq uint64) {
+		acked = append(acked, seq)
+	})
+	if len(pending) > 0 {
+		_, _ = got.Write(pending)
+	}
+
+	if got.String() != "leftright" {
+		t.Fatalf("unexpected split-frame output %q", got.String())
+	}
+	if len(acked) != 1 || acked[0] != 11 {
+		t.Fatalf("unexpected split-frame acknowledgements: %v", acked)
+	}
+}
+
+func TestSyncOutputWaitsForPipeDrain(t *testing.T) {
+	r, w, err := os.Pipe()
+	if err != nil {
+		t.Fatalf("pipe: %v", err)
+	}
+
+	done := make(chan struct{})
+	con := &SliverClient{
+		stdoutPipeWriter: w,
+		stdoutPipeDone:   done,
+		stdoutSyncMarker: []byte("0123456789abcdef"),
+		stdoutSyncAcks:   map[uint64]chan struct{}{},
+	}
+
+	var got bytes.Buffer
+	go con.copyStdoutPipe(r, &got, done)
+
+	if _, err := w.Write([]byte("hello")); err != nil {
+		t.Fatalf("write prefix: %v", err)
+	}
+	con.syncOutput()
+	if got.String() != "hello" {
+		t.Fatalf("syncOutput returned before draining stdout: %q", got.String())
+	}
+
+	if _, err := w.Write([]byte(" world")); err != nil {
+		t.Fatalf("write suffix: %v", err)
+	}
+	if err := w.Close(); err != nil {
+		t.Fatalf("close writer: %v", err)
+	}
+
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("timed out waiting for stdout copier to finish")
+	}
+
+	if got.String() != "hello world" {
+		t.Fatalf("unexpected final output %q", got.String())
+	}
+}
+
+func TestSuppressEventNotificationsRedirectsMessagesToListeners(t *testing.T) {
+	con := &SliverClient{
+		EventListeners: &sync.Map{},
+		printf:         func(string, ...any) (int, error) { return 0, nil },
+	}
+
+	listenerID, listener := con.CreateEventListener()
+	defer con.RemoveEventListener(listenerID)
+
+	restore := con.SuppressEventNotifications()
+	defer restore()
+
+	con.emitConsoleNotification("info", true, "Session %s connected", "alpha")
+
+	select {
+	case event := <-listener:
+		if event.GetEventType() != consts.ClientToastEvent {
+			t.Fatalf("expected toast event, got %q", event.GetEventType())
+		}
+		if got := string(event.GetData()); got != "Session alpha connected" {
+			t.Fatalf("unexpected toast payload %q", got)
+		}
+		if got := event.GetErr(); got != "info" {
+			t.Fatalf("unexpected toast level %q", got)
+		}
+	case <-time.After(time.Second):
+		t.Fatal("timed out waiting for redirected event notification")
+	}
+}

client/constants/constants.go

@@ -113,7 +113,15 @@ const (
 	CrackStatusEvent = "crack-status"
 
 	// WireGuardNewPeer - New Wireguard peer added.
-	WireGuardNewPeer = "wireguard-newpeer"
+	WireGuardNewPeer            = "wireguard-newpeer"
+	MultiplayerWireGuardNewPeer = "multiplayer-wireguard-newpeer"
+	MultiplayerWireGuardRemoved = "multiplayer-wireguard-removed"
+
+	// AIConversationEvent - Fires whenever an AI conversation or message changes.
+	AIConversationEvent = "ai-conversation"
+
+	// ClientToastEvent - Local-only event used to surface console notifications inside TUIs.
+	ClientToastEvent = "client-toast"
 )
 
 // Commands.
@@ -220,6 +228,9 @@ const (
 	MkdirStr    = "mkdir"
 	CdStr       = "cd"
 	PwdStr      = "pwd"
+	AIStr       = "ai"
+	AIConfigStr = "ai-config"
+	DocsStr     = "docs"
 	CatStr      = "cat"
 	EditStr     = "edit"
 	HexEditStr  = "hex-edit"

client/forms/armory_install.go

@@ -3,8 +3,8 @@ package forms
 import (
 	"errors"
 
+	"charm.land/huh/v2"
 	"github.com/bishopfox/sliver/client/theme"
-	"github.com/charmbracelet/huh"
 )
 
 // ArmoryInstallOption represents an armory install option.
@@ -46,7 +46,7 @@ func ArmoryInstallForm(options []ArmoryInstallOption) (*ArmoryInstallFormResult,
 		Value(&result.SelectedNames)
 
 	form := huh.NewForm(huh.NewGroup(field)).WithTheme(theme.HuhTheme())
-	if err := form.Run(); err != nil {
+	if err := runForm(form); err != nil {
 		return nil, err
 	}
 

client/forms/armory_updates.go

@@ -3,8 +3,8 @@ package forms
 import (
 	"errors"
 
+	"charm.land/huh/v2"
 	"github.com/bishopfox/sliver/client/theme"
-	"github.com/charmbracelet/huh"
 )
 
 // ArmoryUpdateOption represents an update option in the armory update form.
@@ -45,7 +45,7 @@ func ArmoryUpdateForm(options []ArmoryUpdateOption) (*ArmoryUpdateFormResult, er
 		Value(&result.SelectedIDs)
 
 	form := huh.NewForm(huh.NewGroup(field)).WithTheme(theme.HuhTheme())
-	if err := form.Run(); err != nil {
+	if err := runForm(form); err != nil {
 		return nil, err
 	}
 

client/forms/generate.go

@@ -4,10 +4,10 @@ import (
 	"errors"
 	"strings"
 
+	"charm.land/huh/v2"
 	"github.com/bishopfox/sliver/client/theme"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/util"
-	"github.com/charmbracelet/huh"
 )
 
 // ErrUserAborted exposes the huh user-abort sentinel for callers.
@@ -126,7 +126,7 @@ func GenerateForm(compiler *clientpb.Compiler) (*GenerateFormResult, error) {
 	)
 
 	form = form.WithTheme(theme.HuhTheme())
-	if err := form.Run(); err != nil {
+	if err := runForm(form); err != nil {
 		return nil, err
 	}
 

client/forms/generate_beacon.go

@@ -5,10 +5,10 @@ import (
 	"strconv"
 	"strings"
 
+	"charm.land/huh/v2"
 	"github.com/bishopfox/sliver/client/theme"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/util"
-	"github.com/charmbracelet/huh"
 )
 
 // GenerateBeaconFormResult captures the inputs needed to drive the generate beacon command.
@@ -156,7 +156,7 @@ func GenerateBeaconForm(compiler *clientpb.Compiler) (*GenerateBeaconFormResult,
 	)
 
 	form = form.WithTheme(theme.HuhTheme())
-	if err := form.Run(); err != nil {
+	if err := runForm(form); err != nil {
 		return nil, err
 	}
 

client/forms/generate_profiles_new.go

@@ -4,9 +4,9 @@ import (
 	"errors"
 	"strings"
 
+	"charm.land/huh/v2"
 	"github.com/bishopfox/sliver/client/theme"
 	"github.com/bishopfox/sliver/util"
-	"github.com/charmbracelet/huh"
 )
 
 // GenerateProfilesNewFormResult captures the inputs needed to drive the profiles new command.
@@ -136,7 +136,7 @@ func GenerateProfilesNewForm() (*GenerateProfilesNewFormResult, error) {
 	)
 
 	form = form.WithTheme(theme.HuhTheme())
-	if err := form.Run(); err != nil {
+	if err := runForm(form); err != nil {
 		return nil, err
 	}
 

client/forms/generate_profiles_new_beacon.go

@@ -4,9 +4,9 @@ import (
 	"errors"
 	"strings"
 
+	"charm.land/huh/v2"
 	"github.com/bishopfox/sliver/client/theme"
 	"github.com/bishopfox/sliver/util"
-	"github.com/charmbracelet/huh"
 )
 
 // GenerateProfilesNewBeaconFormResult captures the inputs needed to drive the profiles new beacon command.
@@ -168,7 +168,7 @@ func GenerateProfilesNewBeaconForm() (*GenerateProfilesNewBeaconFormResult, erro
 	)
 
 	form = form.WithTheme(theme.HuhTheme())
-	if err := form.Run(); err != nil {
+	if err := runForm(form); err != nil {
 		return nil, err
 	}
 

client/forms/generate_targets.go

@@ -3,8 +3,8 @@ package forms
 import (
 	"sort"
 
+	"charm.land/huh/v2"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
-	"github.com/charmbracelet/huh"
 )
 
 type formatOption struct {

client/forms/prompts.go

@@ -5,8 +5,8 @@ import (
 	"slices"
 	"strings"
 
+	"charm.land/huh/v2"
 	"github.com/bishopfox/sliver/client/theme"
-	"github.com/charmbracelet/huh"
 	"golang.org/x/term"
 )
 
@@ -35,7 +35,7 @@ func Confirm(title string, value *bool) error {
 		),
 	).WithTheme(theme.HuhTheme())
 
-	return form.Run()
+	return runForm(form)
 }
 
 // Input prompts for a single-line string.
@@ -52,7 +52,7 @@ func Input(title string, value *string) error {
 		),
 	).WithTheme(theme.HuhTheme())
 
-	return form.Run()
+	return runForm(form)
 }
 
 // Text prompts for multi-line input.
@@ -70,7 +70,7 @@ func Text(title string, value *string) error {
 		),
 	).WithTheme(theme.HuhTheme())
 
-	return form.Run()
+	return runForm(form)
 }
 
 // Select prompts for a single selection from options.
@@ -102,7 +102,7 @@ func MultiSelect(title string, options []string, value *[]string) error {
 	form := huh.NewForm(huh.NewGroup(field)).
 		WithTheme(theme.HuhTheme()).
 		WithWidth(getTerminalWidth())
-	return form.Run()
+	return runForm(form)
 }
 
 func selectPrompt(title string, options []string, value *string, required bool) error {
@@ -136,7 +136,7 @@ func selectPrompt(title string, options []string, value *string, required bool)
 	form := huh.NewForm(huh.NewGroup(field)).
 		WithTheme(theme.HuhTheme()).
 		WithWidth(getTerminalWidth())
-	err := form.Run()
+	err := runForm(form)
 
 	// On error restore the originalValue and return err
 	if err != nil {

client/forms/runtime.go

@@ -0,0 +1,76 @@
+package forms
+
+import (
+	"os"
+
+	tea "charm.land/bubbletea/v2"
+	"charm.land/huh/v2"
+	"github.com/bishopfox/sliver/client/termio"
+	"golang.org/x/term"
+)
+
+var openFormTTY = tea.OpenTTY
+
+func runForm(form *huh.Form) error {
+	cleanup := configureFormTTY(form)
+	if cleanup != nil {
+		defer cleanup()
+	}
+	return form.Run()
+}
+
+// Console logging swaps stdout/stderr to pipes so the session can be tee'd to
+// disk. Bubble Tea forms need a real TTY output, so temporarily bind them back
+// to the controlling terminal when the interactive console has piped stdio.
+func configureFormTTY(form *huh.Form) func() {
+	if form == nil {
+		return nil
+	}
+
+	stdinTTY := isTTY(os.Stdin)
+	stdoutTTY := isTTY(os.Stdout)
+	stderrTTY := isTTY(os.Stderr)
+
+	switch {
+	case shouldUseStdoutTTYForForm(stdinTTY, stdoutTTY, stderrTTY):
+		form.WithInput(os.Stdin)
+		form.WithOutput(os.Stdout)
+		return nil
+
+	case needsDedicatedTTYForForm(stdinTTY, stdoutTTY, stderrTTY):
+		if isTTY(termio.InteractiveInput()) && isTTY(termio.InteractiveOutput()) {
+			form.WithInput(termio.InteractiveInput())
+			form.WithOutput(termio.InteractiveOutput())
+			return nil
+		}
+
+		inTTY, outTTY, err := openFormTTY()
+		if err != nil {
+			return nil
+		}
+
+		form.WithInput(inTTY)
+		form.WithOutput(outTTY)
+		return func() {
+			_ = inTTY.Close()
+			if outTTY != inTTY {
+				_ = outTTY.Close()
+			}
+		}
+
+	default:
+		return nil
+	}
+}
+
+func isTTY(file *os.File) bool {
+	return file != nil && term.IsTerminal(int(file.Fd()))
+}
+
+func shouldUseStdoutTTYForForm(stdinTTY, stdoutTTY, stderrTTY bool) bool {
+	return stdinTTY && stdoutTTY && !stderrTTY
+}
+
+func needsDedicatedTTYForForm(stdinTTY, stdoutTTY, stderrTTY bool) bool {
+	return stdinTTY && !stdoutTTY && !stderrTTY
+}

client/forms/runtime_test.go

@@ -0,0 +1,49 @@
+package forms
+
+import "testing"
+
+func TestShouldUseStdoutTTYForForm(t *testing.T) {
+	tests := []struct {
+		name      string
+		stdinTTY  bool
+		stdoutTTY bool
+		stderrTTY bool
+		want      bool
+	}{
+		{name: "stderr redirected but stdout interactive", stdinTTY: true, stdoutTTY: true, stderrTTY: false, want: true},
+		{name: "default stderr already interactive", stdinTTY: true, stdoutTTY: true, stderrTTY: true, want: false},
+		{name: "non interactive stdin", stdinTTY: false, stdoutTTY: true, stderrTTY: false, want: false},
+		{name: "all stdio piped", stdinTTY: true, stdoutTTY: false, stderrTTY: false, want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := shouldUseStdoutTTYForForm(tt.stdinTTY, tt.stdoutTTY, tt.stderrTTY); got != tt.want {
+				t.Fatalf("shouldUseStdoutTTYForForm(%v, %v, %v) = %v, want %v", tt.stdinTTY, tt.stdoutTTY, tt.stderrTTY, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestNeedsDedicatedTTYForForm(t *testing.T) {
+	tests := []struct {
+		name      string
+		stdinTTY  bool
+		stdoutTTY bool
+		stderrTTY bool
+		want      bool
+	}{
+		{name: "interactive stdin with piped stdout and stderr", stdinTTY: true, stdoutTTY: false, stderrTTY: false, want: true},
+		{name: "stdout can be reused", stdinTTY: true, stdoutTTY: true, stderrTTY: false, want: false},
+		{name: "stderr already interactive", stdinTTY: true, stdoutTTY: false, stderrTTY: true, want: false},
+		{name: "non interactive stdin", stdinTTY: false, stdoutTTY: false, stderrTTY: false, want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := needsDedicatedTTYForForm(tt.stdinTTY, tt.stdoutTTY, tt.stderrTTY); got != tt.want {
+				t.Fatalf("needsDedicatedTTYForForm(%v, %v, %v) = %v, want %v", tt.stdinTTY, tt.stdoutTTY, tt.stderrTTY, got, tt.want)
+			}
+		})
+	}
+}

client/forms/settings.go

@@ -5,9 +5,9 @@ import (
 	"strconv"
 	"strings"
 
+	"charm.land/huh/v2"
 	"github.com/bishopfox/sliver/client/assets"
 	"github.com/bishopfox/sliver/client/theme"
-	"github.com/charmbracelet/huh"
 )
 
 // SettingsFormResult captures the inputs needed to update client settings.
@@ -108,7 +108,7 @@ func SettingsForm(settings *assets.ClientSettings, tableStyleOptions []string) (
 	)
 
 	form = form.WithTheme(theme.HuhTheme())
-	if err := form.Run(); err != nil {
+	if err := runForm(form); err != nil {
 		return nil, err
 	}
 

client/mcp/auth.go

@@ -0,0 +1,191 @@
+package mcp
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/subtle"
+	"encoding/hex"
+	"fmt"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/bishopfox/sliver/client/assets"
+	"gopkg.in/yaml.v3"
+)
+
+const (
+	authConfigFileName = "mcp.yaml"
+	authHeaderName     = "Authorization"
+	minAuthTokenLength = 8
+	authTokenBytes     = 16
+	sseMessagePath     = "/message"
+)
+
+// AuthInfo describes the persisted MCP HTTP/SSE authentication settings.
+type AuthInfo struct {
+	Header     string
+	Token      string
+	ConfigPath string
+}
+
+// AuthHeaderName returns the required header name for MCP HTTP/SSE requests.
+func AuthHeaderName() string {
+	return authHeaderName
+}
+
+// AuthConfigPath returns the MCP auth config path in the client app directory.
+func AuthConfigPath() string {
+	rootDir, _ := filepath.Abs(assets.GetRootAppDir())
+	return filepath.Join(rootDir, authConfigFileName)
+}
+
+type authConfig struct {
+	Token string `yaml:"token"`
+}
+
+// LoadAuthInfo loads the persisted MCP auth configuration without creating it.
+func LoadAuthInfo() (AuthInfo, error) {
+	cfg, exists, err := loadAuthConfig()
+	if err != nil {
+		return AuthInfo{}, err
+	}
+	if !exists {
+		return AuthInfo{}, os.ErrNotExist
+	}
+	cfg.Token = strings.TrimSpace(cfg.Token)
+	if err := validateAuthToken(cfg.Token); err != nil {
+		return AuthInfo{}, fmt.Errorf("invalid mcp token in %s: %w", AuthConfigPath(), err)
+	}
+	return AuthInfo{
+		Header:     authHeaderName,
+		Token:      cfg.Token,
+		ConfigPath: AuthConfigPath(),
+	}, nil
+}
+
+// ResolveAuthInfo loads the persisted auth token or creates and saves one on first use.
+func ResolveAuthInfo() (AuthInfo, bool, error) {
+	cfg, exists, err := loadAuthConfig()
+	if err != nil {
+		return AuthInfo{}, false, err
+	}
+	if exists {
+		cfg.Token = strings.TrimSpace(cfg.Token)
+		if err := validateAuthToken(cfg.Token); err != nil {
+			return AuthInfo{}, false, fmt.Errorf("invalid mcp token in %s: %w", AuthConfigPath(), err)
+		}
+		return AuthInfo{
+			Header:     authHeaderName,
+			Token:      cfg.Token,
+			ConfigPath: AuthConfigPath(),
+		}, false, nil
+	}
+
+	token, err := generateAuthToken()
+	if err != nil {
+		return AuthInfo{}, false, err
+	}
+	cfg = &authConfig{Token: token}
+	if err := saveAuthConfig(cfg); err != nil {
+		return AuthInfo{}, false, err
+	}
+	return AuthInfo{
+		Header:     authHeaderName,
+		Token:      token,
+		ConfigPath: AuthConfigPath(),
+	}, true, nil
+}
+
+func loadAuthConfig() (*authConfig, bool, error) {
+	data, err := os.ReadFile(AuthConfigPath())
+	if os.IsNotExist(err) {
+		return nil, false, nil
+	}
+	if err != nil {
+		return nil, false, err
+	}
+
+	cfg := &authConfig{}
+	if err := yaml.Unmarshal(data, cfg); err != nil {
+		return nil, true, err
+	}
+	return cfg, true, nil
+}
+
+func saveAuthConfig(cfg *authConfig) error {
+	data, err := yaml.Marshal(cfg)
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(AuthConfigPath(), data, 0o600)
+}
+
+func generateAuthToken() (string, error) {
+	tokenBytes := make([]byte, authTokenBytes)
+	if _, err := rand.Read(tokenBytes); err != nil {
+		return "", fmt.Errorf("generate mcp auth token: %w", err)
+	}
+	return hex.EncodeToString(tokenBytes), nil
+}
+
+func validateAuthToken(token string) error {
+	if len(strings.TrimSpace(token)) < minAuthTokenLength {
+		return fmt.Errorf("token must be at least %d characters", minAuthTokenLength)
+	}
+	return nil
+}
+
+func authMiddleware(token string, next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if !authTokenMatches(r.Header.Get(authHeaderName), token) {
+			http.Error(w, fmt.Sprintf("missing or invalid %s header", authHeaderName), http.StatusUnauthorized)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+func authTokenMatches(actual string, expected string) bool {
+	if len(expected) == 0 || len(actual) != len(expected) {
+		return false
+	}
+	return subtle.ConstantTimeCompare([]byte(actual), []byte(expected)) == 1
+}
+
+type authenticatedHTTPTransport struct {
+	server *http.Server
+}
+
+func newAuthenticatedTransport(cfg Config, handler http.Handler, token string) serverTransport {
+	mux := http.NewServeMux()
+	authenticatedHandler := authMiddleware(token, handler)
+
+	switch cfg.Transport {
+	case TransportHTTP:
+		mux.Handle("/mcp", authenticatedHandler)
+	case TransportSSE:
+		mux.Handle("/sse", authenticatedHandler)
+		mux.Handle(sseMessagePath, authenticatedHandler)
+	}
+
+	return &authenticatedHTTPTransport{
+		server: &http.Server{
+			Handler: mux,
+		},
+	}
+}
+
+func (t *authenticatedHTTPTransport) Start(addr string) error {
+	if t.server.Addr == "" {
+		t.server.Addr = addr
+	} else if t.server.Addr != addr {
+		return fmt.Errorf("conflicting listen address: %q vs %q", t.server.Addr, addr)
+	}
+	return t.server.ListenAndServe()
+}
+
+func (t *authenticatedHTTPTransport) Shutdown(ctx context.Context) error {
+	return t.server.Shutdown(ctx)
+}

client/mcp/auth_test.go

@@ -0,0 +1,97 @@
+package mcp
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strings"
+	"testing"
+)
+
+func TestResolveAuthInfoCreatesAndPersistsToken(t *testing.T) {
+	t.Setenv("SLIVER_CLIENT_ROOT_DIR", t.TempDir())
+
+	authInfo, created, err := ResolveAuthInfo()
+	if err != nil {
+		t.Fatalf("ResolveAuthInfo returned error: %v", err)
+	}
+	if !created {
+		t.Fatalf("expected first ResolveAuthInfo call to create a token")
+	}
+	if authInfo.Header != AuthHeaderName() {
+		t.Fatalf("expected header %q, got %q", AuthHeaderName(), authInfo.Header)
+	}
+	if len(authInfo.Token) != authTokenBytes*2 {
+		t.Fatalf("expected %d hex characters, got %d", authTokenBytes*2, len(authInfo.Token))
+	}
+
+	data, err := os.ReadFile(AuthConfigPath())
+	if err != nil {
+		t.Fatalf("failed to read persisted auth config: %v", err)
+	}
+	if !strings.Contains(string(data), "token: "+authInfo.Token) {
+		t.Fatalf("persisted config did not contain generated token: %s", string(data))
+	}
+
+	authInfoAgain, createdAgain, err := ResolveAuthInfo()
+	if err != nil {
+		t.Fatalf("second ResolveAuthInfo returned error: %v", err)
+	}
+	if createdAgain {
+		t.Fatalf("expected second ResolveAuthInfo call to reuse the existing token")
+	}
+	if authInfoAgain.Token != authInfo.Token {
+		t.Fatalf("expected persisted token %q, got %q", authInfo.Token, authInfoAgain.Token)
+	}
+}
+
+func TestResolveAuthInfoRejectsInvalidExistingToken(t *testing.T) {
+	t.Setenv("SLIVER_CLIENT_ROOT_DIR", t.TempDir())
+
+	if err := os.WriteFile(AuthConfigPath(), []byte("token: short\n"), 0o600); err != nil {
+		t.Fatalf("failed to seed auth config: %v", err)
+	}
+
+	_, _, err := ResolveAuthInfo()
+	if err == nil {
+		t.Fatal("expected invalid token error")
+	}
+	if !strings.Contains(err.Error(), "at least 8 characters") {
+		t.Fatalf("expected length validation error, got %v", err)
+	}
+}
+
+func TestAuthMiddlewareRequiresExactToken(t *testing.T) {
+	const token = "0123456789abcdef"
+
+	handler := authMiddleware(token, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))
+
+	testCases := []struct {
+		name       string
+		header     string
+		statusCode int
+	}{
+		{name: "missing", statusCode: http.StatusUnauthorized},
+		{name: "wrong", header: "wrong-token", statusCode: http.StatusUnauthorized},
+		{name: "prefixed", header: "Bearer " + token, statusCode: http.StatusUnauthorized},
+		{name: "exact", header: token, statusCode: http.StatusNoContent},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodGet, "/mcp", nil)
+			if testCase.header != "" {
+				req.Header.Set(AuthHeaderName(), testCase.header)
+			}
+
+			recorder := httptest.NewRecorder()
+			handler.ServeHTTP(recorder, req)
+
+			if recorder.Code != testCase.statusCode {
+				t.Fatalf("expected status %d, got %d", testCase.statusCode, recorder.Code)
+			}
+		})
+	}
+}

client/mcp/mcp.go

@@ -20,10 +20,13 @@ var (
 
 // Status describes the running state of the MCP server.
 type Status struct {
-	Running   bool
-	StartedAt time.Time
-	Config    Config
-	LastError string
+	Running        bool
+	StartedAt      time.Time
+	Config         Config
+	LastError      string
+	AuthHeader     string
+	AuthToken      string
+	AuthConfigPath string
 }
 
 type serverTransport interface {
@@ -42,6 +45,7 @@ type mcpManager struct {
 	done      chan struct{}
 	logger    *log.Logger
 	logFile   *os.File
+	authInfo  AuthInfo
 }
 
 func newManager() *mcpManager {
@@ -93,10 +97,13 @@ func (m *mcpManager) status() Status {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 	return Status{
-		Running:   m.running,
-		StartedAt: m.startedAt,
-		Config:    m.cfg,
-		LastError: m.lastErr,
+		Running:        m.running,
+		StartedAt:      m.startedAt,
+		Config:         m.cfg,
+		LastError:      m.lastErr,
+		AuthHeader:     m.authInfo.Header,
+		AuthToken:      m.authInfo.Token,
+		AuthConfigPath: m.authInfo.ConfigPath,
 	}
 }
 
@@ -105,6 +112,10 @@ func (m *mcpManager) start(cfg Config, rpc rpcpb.SliverRPCClient) error {
 	if err := cfg.Validate(); err != nil {
 		return err
 	}
+	authInfo, _, err := ResolveAuthInfo()
+	if err != nil {
+		return err
+	}
 
 	m.mu.Lock()
 	if m.running {
@@ -120,9 +131,9 @@ func (m *mcpManager) start(cfg Config, rpc rpcpb.SliverRPCClient) error {
 	var transport serverTransport
 	switch cfg.Transport {
 	case TransportHTTP:
-		transport = mcpserver.NewStreamableHTTPServer(mcpServer.server)
+		transport = newAuthenticatedTransport(cfg, mcpserver.NewStreamableHTTPServer(mcpServer.server), authInfo.Token)
 	case TransportSSE:
-		transport = mcpserver.NewSSEServer(mcpServer.server)
+		transport = newAuthenticatedTransport(cfg, mcpserver.NewSSEServer(mcpServer.server), authInfo.Token)
 	default:
 		m.mu.Unlock()
 		logFile.Close()
@@ -138,11 +149,12 @@ func (m *mcpManager) start(cfg Config, rpc rpcpb.SliverRPCClient) error {
 	m.done = make(chan struct{})
 	m.logger = logger
 	m.logFile = logFile
+	m.authInfo = authInfo
 	addr := cfg.ListenAddress
 	done := m.done
 	m.mu.Unlock()
 
-	logger.Printf("starting mcp server transport=%s listen=%s", cfg.Transport, cfg.ListenAddress)
+	logger.Printf("starting mcp server transport=%s listen=%s auth_header=%s auth_config=%s", cfg.Transport, cfg.ListenAddress, authInfo.Header, authInfo.ConfigPath)
 	go m.run(addr, transport, done)
 	return nil
 }
@@ -161,6 +173,7 @@ func (m *mcpManager) run(addr string, transport serverTransport, done chan struc
 	m.running = false
 	m.transport = nil
 	m.server = nil
+	m.authInfo = AuthInfo{}
 	logFile := m.logFile
 	m.logFile = nil
 	m.logger = nil

client/spin/thinking/thinking.go

@@ -0,0 +1,443 @@
+// Package thinking provides Crush's pending-request animation as a reusable
+// Bubble Tea component.
+package thinking
+
+import (
+	"fmt"
+	"image/color"
+	"math/rand/v2"
+	"slices"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	tea "charm.land/bubbletea/v2"
+	"charm.land/lipgloss/v2"
+	"github.com/charmbracelet/x/exp/charmtone"
+	"github.com/lucasb-eyer/go-colorful"
+	"github.com/zeebo/xxh3"
+)
+
+const (
+	fps           = 20
+	initialChar   = '.'
+	labelGap      = " "
+	labelGapWidth = 1
+
+	// If the FPS is 20 (50 milliseconds) this means that the ellipsis will
+	// change every 8 frames (400 milliseconds).
+	ellipsisAnimSpeed = 8
+
+	// The maximum amount of time that can pass before a character appears.
+	// This is used to create a staggered entrance effect.
+	maxBirthOffset = time.Second
+
+	// Number of frames to prerender for the animation. After this number of
+	// frames, the animation will loop. This only applies when color cycling is
+	// disabled.
+	prerenderedFrames = 10
+
+	// Default number of cycling chars.
+	defaultNumCyclingChars = 10
+)
+
+var (
+	availableRunes = []rune("0123456789abcdefABCDEF~!@#$£€%^&*()+=_")
+	ellipsisFrames = []string{".", "..", "...", ""}
+)
+
+// Internal ID management. Used during animating to ensure that frame messages
+// are received only by animation components that sent them.
+var lastID int64
+
+func nextID() int {
+	return int(atomic.AddInt64(&lastID, 1))
+}
+
+type animCache struct {
+	initialFrames  [][]string
+	cyclingFrames  [][]string
+	width          int
+	labelWidth     int
+	label          []string
+	ellipsisFrames []string
+}
+
+var animCacheMap sync.Map
+
+// Colors groups the animation's configurable colors.
+type Colors struct {
+	GradientA color.Color
+	GradientB color.Color
+	Label     color.Color
+}
+
+// DefaultColors returns the same color palette Crush uses today for pending
+// and thinking animations.
+func DefaultColors() Colors {
+	return Colors{
+		GradientA: charmtone.Charple,
+		GradientB: charmtone.Dolly,
+		Label:     charmtone.Ash,
+	}
+}
+
+func settingsHash(opts Settings) string {
+	h := xxh3.New()
+	fmt.Fprintf(h, "%d-%s-%v-%v-%v-%t",
+		opts.Size, opts.Label, opts.LabelColor, opts.GradColorA, opts.GradColorB, opts.CycleColors)
+	return fmt.Sprintf("%x", h.Sum(nil))
+}
+
+func withDefaultColors(opts Settings) Settings {
+	defaults := DefaultColors()
+	if colorIsUnset(opts.GradColorA) {
+		opts.GradColorA = defaults.GradientA
+	}
+	if colorIsUnset(opts.GradColorB) {
+		opts.GradColorB = defaults.GradientB
+	}
+	if colorIsUnset(opts.LabelColor) {
+		opts.LabelColor = defaults.Label
+	}
+	return opts
+}
+
+// StepMsg is a message type used to trigger the next step in the animation.
+type StepMsg struct{ ID string }
+
+// Settings defines animation settings.
+type Settings struct {
+	ID          string
+	Size        int
+	Label       string
+	LabelColor  color.Color
+	GradColorA  color.Color
+	GradColorB  color.Color
+	CycleColors bool
+	SkipIntro   bool
+}
+
+// Anim is a Bubble Tea component for Crush's pending/thinking animation.
+type Anim struct {
+	mu               sync.RWMutex
+	width            int
+	cyclingCharWidth int
+	label            []string
+	labelWidth       int
+	labelColor       color.Color
+	startTime        time.Time
+	birthOffsets     []time.Duration
+	initialFrames    [][]string
+	initialized      atomic.Bool
+	cyclingFrames    [][]string
+	step             atomic.Int64
+	ellipsisStep     atomic.Int64
+	ellipsisFrames   []string
+	id               string
+}
+
+// New creates a new animation instance with the specified settings.
+func New(opts Settings) *Anim {
+	a := &Anim{}
+
+	if opts.Size < 1 {
+		opts.Size = defaultNumCyclingChars
+	}
+	opts = withDefaultColors(opts)
+
+	if opts.ID != "" {
+		a.id = opts.ID
+	} else {
+		a.id = fmt.Sprintf("%d", nextID())
+	}
+	a.startTime = time.Now()
+	a.cyclingCharWidth = opts.Size
+	a.labelColor = opts.LabelColor
+
+	cacheKey := settingsHash(opts)
+	if cached, ok := loadAnimCache(cacheKey); ok {
+		a.width = cached.width
+		a.labelWidth = cached.labelWidth
+		a.label = slices.Clone(cached.label)
+		a.ellipsisFrames = slices.Clone(cached.ellipsisFrames)
+		a.initialFrames = cached.initialFrames
+		a.cyclingFrames = cached.cyclingFrames
+	} else {
+		a.labelWidth = lipgloss.Width(opts.Label)
+		a.width = opts.Size
+		if opts.Label != "" {
+			a.width += labelGapWidth + a.labelWidth
+		}
+
+		a.renderLabel(opts.Label)
+
+		var ramp []color.Color
+		numFrames := prerenderedFrames
+		if opts.CycleColors {
+			ramp = makeGradientRamp(a.width*3, opts.GradColorA, opts.GradColorB, opts.GradColorA, opts.GradColorB)
+			numFrames = a.width * 2
+		} else {
+			ramp = makeGradientRamp(a.width, opts.GradColorA, opts.GradColorB)
+		}
+
+		a.initialFrames = make([][]string, numFrames)
+		offset := 0
+		for i := range a.initialFrames {
+			a.initialFrames[i] = make([]string, a.width+labelGapWidth+a.labelWidth)
+			for j := range a.initialFrames[i] {
+				if j+offset >= len(ramp) {
+					continue
+				}
+
+				c := opts.LabelColor
+				if j <= a.cyclingCharWidth {
+					c = ramp[j+offset]
+				}
+
+				a.initialFrames[i][j] = lipgloss.NewStyle().
+					Foreground(c).
+					Render(string(initialChar))
+			}
+			if opts.CycleColors {
+				offset++
+			}
+		}
+
+		a.cyclingFrames = make([][]string, numFrames)
+		offset = 0
+		for i := range a.cyclingFrames {
+			a.cyclingFrames[i] = make([]string, a.width)
+			for j := range a.cyclingFrames[i] {
+				if j+offset >= len(ramp) {
+					continue
+				}
+
+				r := availableRunes[rand.IntN(len(availableRunes))]
+				a.cyclingFrames[i][j] = lipgloss.NewStyle().
+					Foreground(ramp[j+offset]).
+					Render(string(r))
+			}
+			if opts.CycleColors {
+				offset++
+			}
+		}
+
+		storeAnimCache(cacheKey, &animCache{
+			initialFrames:  a.initialFrames,
+			cyclingFrames:  a.cyclingFrames,
+			width:          a.width,
+			labelWidth:     a.labelWidth,
+			label:          slices.Clone(a.label),
+			ellipsisFrames: slices.Clone(a.ellipsisFrames),
+		})
+	}
+
+	a.birthOffsets = make([]time.Duration, a.width)
+	for i := range a.birthOffsets {
+		a.birthOffsets[i] = time.Duration(rand.N(int64(maxBirthOffset))) * time.Nanosecond
+	}
+	if opts.SkipIntro {
+		a.initialized.Store(true)
+	}
+
+	return a
+}
+
+func loadAnimCache(key string) (*animCache, bool) {
+	cached, ok := animCacheMap.Load(key)
+	if !ok {
+		return nil, false
+	}
+	animCache, ok := cached.(*animCache)
+	return animCache, ok
+}
+
+func storeAnimCache(key string, cached *animCache) {
+	animCacheMap.Store(key, cached)
+}
+
+// SetLabel updates the label text and re-renders it.
+func (a *Anim) SetLabel(newLabel string) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+
+	a.labelWidth = lipgloss.Width(newLabel)
+	a.width = a.cyclingCharWidth
+	if newLabel != "" {
+		a.width += labelGapWidth + a.labelWidth
+	}
+
+	a.renderLabel(newLabel)
+}
+
+func (a *Anim) renderLabel(label string) {
+	if a.labelWidth > 0 {
+		labelRunes := []rune(label)
+		a.label = make([]string, 0, len(labelRunes))
+		for i := range labelRunes {
+			rendered := lipgloss.NewStyle().
+				Foreground(a.labelColor).
+				Render(string(labelRunes[i]))
+			a.label = append(a.label, rendered)
+		}
+
+		a.ellipsisFrames = make([]string, 0, len(ellipsisFrames))
+		for _, frame := range ellipsisFrames {
+			rendered := lipgloss.NewStyle().
+				Foreground(a.labelColor).
+				Render(frame)
+			a.ellipsisFrames = append(a.ellipsisFrames, rendered)
+		}
+		return
+	}
+
+	a.label = nil
+	a.ellipsisFrames = nil
+}
+
+// Width returns the total width of the animation, including the animated
+// ellipsis when a label is present.
+func (a *Anim) Width() int {
+	a.mu.RLock()
+	defer a.mu.RUnlock()
+
+	w := a.cyclingCharWidth
+	if a.labelWidth > 0 {
+		w += labelGapWidth + a.labelWidth
+
+		var widestEllipsisFrame int
+		for _, frame := range ellipsisFrames {
+			widestEllipsisFrame = max(widestEllipsisFrame, lipgloss.Width(frame))
+		}
+		w += widestEllipsisFrame
+	}
+	return w
+}
+
+// Start starts the animation.
+func (a *Anim) Start() tea.Cmd {
+	return a.Step()
+}
+
+// Animate advances the animation to the next step.
+func (a *Anim) Animate(msg StepMsg) tea.Cmd {
+	if msg.ID != a.id {
+		return nil
+	}
+
+	step := a.step.Add(1)
+	if int(step) >= len(a.cyclingFrames) {
+		a.step.Store(0)
+	}
+
+	a.mu.RLock()
+	labelWidth := a.labelWidth
+	a.mu.RUnlock()
+
+	if a.initialized.Load() && labelWidth > 0 {
+		ellipsisStep := a.ellipsisStep.Add(1)
+		if int(ellipsisStep) >= ellipsisAnimSpeed*len(ellipsisFrames) {
+			a.ellipsisStep.Store(0)
+		}
+	} else if !a.initialized.Load() && time.Since(a.startTime) >= maxBirthOffset {
+		a.initialized.Store(true)
+	}
+	return a.Step()
+}
+
+// Render renders the current state of the animation.
+func (a *Anim) Render() string {
+	a.mu.RLock()
+	defer a.mu.RUnlock()
+
+	var b strings.Builder
+	step := int(a.step.Load())
+	for i := range a.width {
+		switch {
+		case !a.initialized.Load() && i < len(a.birthOffsets) && time.Since(a.startTime) < a.birthOffsets[i]:
+			b.WriteString(a.initialFrames[step][i])
+		case i < a.cyclingCharWidth:
+			b.WriteString(a.cyclingFrames[step][i])
+		case i == a.cyclingCharWidth:
+			b.WriteString(labelGap)
+		case i > a.cyclingCharWidth:
+			labelIdx := i - a.cyclingCharWidth - labelGapWidth
+			if labelIdx >= 0 && labelIdx < len(a.label) {
+				b.WriteString(a.label[labelIdx])
+			}
+		}
+	}
+
+	if a.initialized.Load() && a.labelWidth > 0 {
+		ellipsisStep := int(a.ellipsisStep.Load())
+		frameIdx := ellipsisStep / ellipsisAnimSpeed
+		if frameIdx >= 0 && frameIdx < len(a.ellipsisFrames) {
+			b.WriteString(a.ellipsisFrames[frameIdx])
+		}
+	}
+
+	return b.String()
+}
+
+// Step is a command that triggers the next step in the animation.
+func (a *Anim) Step() tea.Cmd {
+	return tea.Tick(time.Second/time.Duration(fps), func(t time.Time) tea.Msg {
+		return StepMsg{ID: a.id}
+	})
+}
+
+// makeGradientRamp returns a slice of colors blended between the given keys.
+// Blending is done as Hcl to stay in gamut.
+func makeGradientRamp(size int, stops ...color.Color) []color.Color {
+	if len(stops) < 2 {
+		return nil
+	}
+
+	points := make([]colorful.Color, len(stops))
+	for i, stop := range stops {
+		points[i], _ = colorful.MakeColor(stop)
+	}
+
+	numSegments := len(stops) - 1
+	if numSegments == 0 {
+		return nil
+	}
+	blended := make([]color.Color, 0, size)
+
+	segmentSizes := make([]int, numSegments)
+	baseSize := size / numSegments
+	remainder := size % numSegments
+	for i := range numSegments {
+		segmentSizes[i] = baseSize
+		if i < remainder {
+			segmentSizes[i]++
+		}
+	}
+
+	for i := range numSegments {
+		c1 := points[i]
+		c2 := points[i+1]
+		segmentSize := segmentSizes[i]
+
+		for j := range segmentSize {
+			if segmentSize == 0 {
+				continue
+			}
+			t := float64(j) / float64(segmentSize)
+			c := c1.BlendHcl(c2, t)
+			blended = append(blended, c)
+		}
+	}
+
+	return blended
+}
+
+func colorIsUnset(c color.Color) bool {
+	if c == nil {
+		return true
+	}
+	_, _, _, a := c.RGBA()
+	return a == 0
+}

client/termio/termio.go

@@ -0,0 +1,20 @@
+package termio
+
+import "os"
+
+var (
+	interactiveInput  = os.Stdin
+	interactiveOutput = os.Stdout
+)
+
+// InteractiveInput returns the process's original stdin handle before any
+// console logging hooks swapped stdio to pipes.
+func InteractiveInput() *os.File {
+	return interactiveInput
+}
+
+// InteractiveOutput returns the process's original stdout handle before any
+// console logging hooks swapped stdio to pipes.
+func InteractiveOutput() *os.File {
+	return interactiveOutput
+}

client/theme/huh.go

@@ -1,84 +1,88 @@
 package theme
 
 import (
-	"github.com/charmbracelet/huh"
-	"github.com/charmbracelet/lipgloss"
+	"image/color"
+
+	"charm.land/huh/v2"
+	"charm.land/lipgloss/v2"
 )
 
 // HuhTheme returns a huh Theme derived from the current Sliver client theme.
 //
 // This is used for all interactive TUI forms in the client so that colors are
 // consistent with the rest of the console styling (theme.yaml).
-func HuhTheme() *huh.Theme {
-	t := huh.ThemeBase()
+func HuhTheme() huh.Theme {
+	return huh.ThemeFunc(func(isDark bool) *huh.Styles {
+		t := huh.ThemeBase(isDark)
 
-	current := Current()
-	border := paletteModV1(current.Default, 300)
-	text := paletteModV1(current.Default, 900)
-	dim := paletteModV1(current.Default, 500)
-	faint := paletteModV1(current.Default, 400)
+		current := Current()
+		border := paletteMod(current.Default, 300)
+		text := paletteMod(current.Default, 900)
+		dim := paletteMod(current.Default, 500)
+		faint := paletteMod(current.Default, 400)
 
-	primary := paletteColorV1(current.Primary)
-	accent := paletteColorV1(current.Secondary)
+		primary := paletteColor(current.Primary)
+		accent := paletteColor(current.Secondary)
 
-	success := paletteColorV1(current.Success)
-	danger := paletteColorV1(current.Danger)
+		success := paletteColor(current.Success)
+		danger := paletteColor(current.Danger)
 
-	// Focused styles.
-	t.Focused.Base = t.Focused.Base.BorderForeground(border)
-	t.Focused.Card = t.Focused.Base
-	t.Focused.Title = t.Focused.Title.Foreground(primary).Bold(true)
-	t.Focused.NoteTitle = t.Focused.NoteTitle.Foreground(primary).Bold(true).MarginBottom(1)
-	t.Focused.Description = t.Focused.Description.Foreground(dim)
-	t.Focused.Directory = t.Focused.Directory.Foreground(primary)
-	t.Focused.File = t.Focused.File.Foreground(text)
-	t.Focused.ErrorIndicator = t.Focused.ErrorIndicator.Foreground(danger)
-	t.Focused.ErrorMessage = t.Focused.ErrorMessage.Foreground(danger)
-	t.Focused.SelectSelector = t.Focused.SelectSelector.Foreground(accent)
-	t.Focused.NextIndicator = t.Focused.NextIndicator.Foreground(accent)
-	t.Focused.PrevIndicator = t.Focused.PrevIndicator.Foreground(accent)
-	t.Focused.Option = t.Focused.Option.Foreground(text)
-	t.Focused.MultiSelectSelector = t.Focused.MultiSelectSelector.Foreground(accent)
-	t.Focused.SelectedOption = t.Focused.SelectedOption.Foreground(success)
-	t.Focused.SelectedPrefix = t.Focused.SelectedPrefix.Foreground(success)
-	t.Focused.UnselectedOption = t.Focused.UnselectedOption.Foreground(text)
-	t.Focused.UnselectedPrefix = t.Focused.UnselectedPrefix.Foreground(faint)
+		// Focused styles.
+		t.Focused.Base = t.Focused.Base.BorderForeground(border)
+		t.Focused.Card = t.Focused.Base
+		t.Focused.Title = t.Focused.Title.Foreground(primary).Bold(true)
+		t.Focused.NoteTitle = t.Focused.NoteTitle.Foreground(primary).Bold(true).MarginBottom(1)
+		t.Focused.Description = t.Focused.Description.Foreground(dim)
+		t.Focused.Directory = t.Focused.Directory.Foreground(primary)
+		t.Focused.File = t.Focused.File.Foreground(text)
+		t.Focused.ErrorIndicator = t.Focused.ErrorIndicator.Foreground(danger)
+		t.Focused.ErrorMessage = t.Focused.ErrorMessage.Foreground(danger)
+		t.Focused.SelectSelector = t.Focused.SelectSelector.Foreground(accent)
+		t.Focused.NextIndicator = t.Focused.NextIndicator.Foreground(accent)
+		t.Focused.PrevIndicator = t.Focused.PrevIndicator.Foreground(accent)
+		t.Focused.Option = t.Focused.Option.Foreground(text)
+		t.Focused.MultiSelectSelector = t.Focused.MultiSelectSelector.Foreground(accent)
+		t.Focused.SelectedOption = t.Focused.SelectedOption.Foreground(success)
+		t.Focused.SelectedPrefix = t.Focused.SelectedPrefix.Foreground(success)
+		t.Focused.UnselectedOption = t.Focused.UnselectedOption.Foreground(text)
+		t.Focused.UnselectedPrefix = t.Focused.UnselectedPrefix.Foreground(faint)
 
-	t.Focused.FocusedButton = t.Focused.FocusedButton.Foreground(text).Background(primary)
-	t.Focused.Next = t.Focused.FocusedButton
-	t.Focused.BlurredButton = t.Focused.BlurredButton.Foreground(text).Background(paletteModV1(current.Default, 100))
+		t.Focused.FocusedButton = t.Focused.FocusedButton.Foreground(text).Background(primary)
+		t.Focused.Next = t.Focused.FocusedButton
+		t.Focused.BlurredButton = t.Focused.BlurredButton.Foreground(text).Background(paletteMod(current.Default, 100))
 
-	t.Focused.TextInput.Cursor = t.Focused.TextInput.Cursor.Foreground(primary)
-	t.Focused.TextInput.Placeholder = t.Focused.TextInput.Placeholder.Foreground(faint)
-	t.Focused.TextInput.Prompt = t.Focused.TextInput.Prompt.Foreground(accent)
+		t.Focused.TextInput.Cursor = t.Focused.TextInput.Cursor.Foreground(primary)
+		t.Focused.TextInput.Placeholder = t.Focused.TextInput.Placeholder.Foreground(faint)
+		t.Focused.TextInput.Prompt = t.Focused.TextInput.Prompt.Foreground(accent)
 
-	// Blurred styles (same palette, but without the focused border/indicators).
-	t.Blurred = t.Focused
-	t.Blurred.Base = t.Blurred.Base.BorderStyle(lipgloss.HiddenBorder())
-	t.Blurred.Card = t.Blurred.Base
-	t.Blurred.MultiSelectSelector = lipgloss.NewStyle().SetString("  ")
-	t.Blurred.NextIndicator = lipgloss.NewStyle()
-	t.Blurred.PrevIndicator = lipgloss.NewStyle()
+		// Blurred styles (same palette, but without the focused border/indicators).
+		t.Blurred = t.Focused
+		t.Blurred.Base = t.Blurred.Base.BorderStyle(lipgloss.HiddenBorder())
+		t.Blurred.Card = t.Blurred.Base
+		t.Blurred.MultiSelectSelector = lipgloss.NewStyle().SetString("  ")
+		t.Blurred.NextIndicator = lipgloss.NewStyle()
+		t.Blurred.PrevIndicator = lipgloss.NewStyle()
 
-	// Group styles.
-	t.Group.Title = t.Focused.Title
-	t.Group.Description = t.Focused.Description
+		// Group styles.
+		t.Group.Title = t.Focused.Title
+		t.Group.Description = t.Focused.Description
 
-	return t
+		return t
+	})
 }
 
-func paletteColorV1(p Palette) lipgloss.TerminalColor {
+func paletteColor(p Palette) color.Color {
 	if p.Default != "" {
 		return lipgloss.Color(p.Default)
 	}
 	return lipgloss.Color("#ffffff")
 }
 
-func paletteModV1(p Palette, mod int) lipgloss.TerminalColor {
+func paletteMod(p Palette, mod int) color.Color {
 	if mod != 0 {
 		if v, ok := p.Mods[mod]; ok && v != "" {
 			return lipgloss.Color(v)
 		}
 	}
-	return paletteColorV1(p)
+	return paletteColor(p)
 }

client/transport/connect_mode.go

@@ -0,0 +1,73 @@
+package transport
+
+import (
+	"errors"
+	"sync"
+
+	"google.golang.org/grpc"
+)
+
+// MultiplayerConnectMode controls how the client reaches multiplayer.
+type MultiplayerConnectMode int
+
+const (
+	MultiplayerConnectAuto MultiplayerConnectMode = iota
+	MultiplayerConnectDisableWG
+	MultiplayerConnectRequireWG
+)
+
+type connectionCloser interface {
+	Close() error
+}
+
+var (
+	multiplayerConnectModeMu sync.RWMutex
+	multiplayerConnectMode   = MultiplayerConnectAuto
+	connClosers              sync.Map // *grpc.ClientConn -> connectionCloser
+)
+
+// SetMultiplayerConnectMode configures future multiplayer client dials.
+func SetMultiplayerConnectMode(mode MultiplayerConnectMode) {
+	multiplayerConnectModeMu.Lock()
+	multiplayerConnectMode = mode
+	multiplayerConnectModeMu.Unlock()
+}
+
+func getMultiplayerConnectMode() MultiplayerConnectMode {
+	multiplayerConnectModeMu.RLock()
+	mode := multiplayerConnectMode
+	multiplayerConnectModeMu.RUnlock()
+	return mode
+}
+
+func registerConnCloser(conn *grpc.ClientConn, closer connectionCloser) {
+	if conn == nil || closer == nil {
+		return
+	}
+	connClosers.Store(conn, closer)
+}
+
+func unregisterConnCloser(conn *grpc.ClientConn) connectionCloser {
+	if conn == nil {
+		return nil
+	}
+	if closer, ok := connClosers.LoadAndDelete(conn); ok {
+		return closer.(connectionCloser)
+	}
+	return nil
+}
+
+// CloseGRPCConnection closes a client connection and any transport-specific
+// resources attached to it, such as the multiplayer WireGuard tunnel.
+func CloseGRPCConnection(conn *grpc.ClientConn) error {
+	if conn == nil {
+		return nil
+	}
+
+	var errs []error
+	if closer := unregisterConnCloser(conn); closer != nil {
+		errs = append(errs, closer.Close())
+	}
+	errs = append(errs, conn.Close())
+	return errors.Join(errs...)
+}

client/transport/mtls.go

@@ -22,6 +22,7 @@ import (
 	"context"
 	"crypto/tls"
 	"crypto/x509"
+	"errors"
 	"fmt"
 	"log"
 	"os"
@@ -50,6 +51,13 @@ type TokenAuth struct {
 	token string
 }
 
+type multiplayerDialStrategy int
+
+const (
+	multiplayerDialDirect multiplayerDialStrategy = iota
+	multiplayerDialWireGuard
+)
+
 // Return value is mapped to request headers.
 func (t TokenAuth) GetRequestMetadata(ctx context.Context, in ...string) (map[string]string, error) {
 	return map[string]string{
@@ -63,10 +71,56 @@ func (TokenAuth) RequireTransportSecurity() bool {
 
 // MTLSConnect - Connect to the sliver server
 func MTLSConnect(config *assets.ClientConfig) (rpcpb.SliverRPCClient, *grpc.ClientConn, error) {
-	tlsConfig, err := getTLSConfig(config.CACertificate, config.Certificate, config.PrivateKey)
+	strategy, err := selectMultiplayerDialStrategy(config)
 	if err != nil {
 		return nil, nil, err
 	}
+
+	switch strategy {
+	case multiplayerDialWireGuard:
+		return wireGuardMTLSConnect(config)
+	default:
+		return directMTLSConnect(config)
+	}
+}
+
+func selectMultiplayerDialStrategy(config *assets.ClientConfig) (multiplayerDialStrategy, error) {
+	if config == nil {
+		return multiplayerDialDirect, errors.New("client config is required")
+	}
+
+	switch getMultiplayerConnectMode() {
+	case MultiplayerConnectDisableWG:
+		return multiplayerDialDirect, nil
+	case MultiplayerConnectRequireWG:
+		if err := validateWireGuardConfig(config); err != nil {
+			return multiplayerDialDirect, err
+		}
+		return multiplayerDialWireGuard, nil
+	default:
+		if config.WG == nil {
+			return multiplayerDialDirect, nil
+		}
+		if err := validateWireGuardConfig(config); err != nil {
+			return multiplayerDialDirect, err
+		}
+		return multiplayerDialWireGuard, nil
+	}
+}
+
+func directMTLSConnect(config *assets.ClientConfig) (rpcpb.SliverRPCClient, *grpc.ClientConn, error) {
+	options, err := newMTLSDialOptions(config)
+	if err != nil {
+		return nil, nil, err
+	}
+	return dialRPCClient(fmt.Sprintf("%s:%d", config.LHost, config.LPort), options, nil)
+}
+
+func newMTLSDialOptions(config *assets.ClientConfig) ([]grpc.DialOption, error) {
+	tlsConfig, err := getTLSConfig(config.CACertificate, config.Certificate, config.PrivateKey)
+	if err != nil {
+		return nil, err
+	}
 	transportCreds := credentials.NewTLS(tlsConfig)
 	callCreds := credentials.PerRPCCredentials(TokenAuth{token: config.Token})
 	options := []grpc.DialOption{
@@ -78,11 +132,18 @@ func MTLSConnect(config *assets.ClientConfig) (rpcpb.SliverRPCClient, *grpc.Clie
 	if kp, ok := getKeepaliveParams(); ok {
 		options = append(options, grpc.WithKeepaliveParams(kp))
 	}
+	return options, nil
+}
 
-	connection, err := grpc.NewClient(fmt.Sprintf("%s:%d", config.LHost, config.LPort), options...)
+func dialRPCClient(target string, options []grpc.DialOption, closer connectionCloser) (rpcpb.SliverRPCClient, *grpc.ClientConn, error) {
+	connection, err := grpc.NewClient(target, options...)
 	if err != nil {
+		if closer != nil {
+			_ = closer.Close()
+		}
 		return nil, nil, err
 	}
+	registerConnCloser(connection, closer)
 
 	// Preserve the legacy grpc.DialContext + grpc.WithBlock behavior: block
 	// until the channel becomes READY or the timeout expires.
@@ -97,7 +158,7 @@ func MTLSConnect(config *assets.ClientConfig) (rpcpb.SliverRPCClient, *grpc.Clie
 			break
 		}
 		if !connection.WaitForStateChange(ctx, state) {
-			_ = connection.Close()
+			_ = CloseGRPCConnection(connection)
 			return nil, nil, ctx.Err()
 		}
 	}

client/transport/mtls_test.go

@@ -0,0 +1,89 @@
+package transport
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/bishopfox/sliver/client/assets"
+)
+
+func TestSelectMultiplayerDialStrategyLegacyConfigUsesDirectMTLS(t *testing.T) {
+	setTestMultiplayerConnectMode(t, MultiplayerConnectAuto)
+
+	strategy, err := selectMultiplayerDialStrategy(&assets.ClientConfig{})
+	if err != nil {
+		t.Fatalf("select dial strategy: %v", err)
+	}
+	if strategy != multiplayerDialDirect {
+		t.Fatalf("expected direct mTLS strategy, got %v", strategy)
+	}
+}
+
+func TestSelectMultiplayerDialStrategyRequireWGRejectsMissingWGConfig(t *testing.T) {
+	setTestMultiplayerConnectMode(t, MultiplayerConnectRequireWG)
+
+	_, err := selectMultiplayerDialStrategy(&assets.ClientConfig{})
+	if !errors.Is(err, ErrMissingWireGuardConfig) {
+		t.Fatalf("expected missing WG config error, got %v", err)
+	}
+}
+
+func TestSelectMultiplayerDialStrategyRejectsIncompleteWGConfig(t *testing.T) {
+	setTestMultiplayerConnectMode(t, MultiplayerConnectAuto)
+
+	_, err := selectMultiplayerDialStrategy(&assets.ClientConfig{
+		WG: &assets.ClientWGConfig{
+			ServerPubKey: "server-pub",
+			ClientIP:     "100.64.0.2",
+		},
+	})
+	if !errors.Is(err, ErrIncompleteWireGuardConfig) {
+		t.Fatalf("expected incomplete WG config error, got %v", err)
+	}
+}
+
+func TestSelectMultiplayerDialStrategyUsesWireGuardWhenConfigComplete(t *testing.T) {
+	setTestMultiplayerConnectMode(t, MultiplayerConnectAuto)
+
+	strategy, err := selectMultiplayerDialStrategy(&assets.ClientConfig{
+		WG: &assets.ClientWGConfig{
+			ServerPubKey:     "server-pub",
+			ClientPrivateKey: "client-priv",
+			ClientIP:         "100.64.0.2",
+		},
+	})
+	if err != nil {
+		t.Fatalf("select dial strategy: %v", err)
+	}
+	if strategy != multiplayerDialWireGuard {
+		t.Fatalf("expected WireGuard strategy, got %v", strategy)
+	}
+}
+
+func TestSelectMultiplayerDialStrategyDisableWGOverridesCompleteConfig(t *testing.T) {
+	setTestMultiplayerConnectMode(t, MultiplayerConnectDisableWG)
+
+	strategy, err := selectMultiplayerDialStrategy(&assets.ClientConfig{
+		WG: &assets.ClientWGConfig{
+			ServerPubKey:     "server-pub",
+			ClientPrivateKey: "client-priv",
+			ClientIP:         "100.64.0.2",
+		},
+	})
+	if err != nil {
+		t.Fatalf("select dial strategy: %v", err)
+	}
+	if strategy != multiplayerDialDirect {
+		t.Fatalf("expected direct strategy when WG is disabled, got %v", strategy)
+	}
+}
+
+func setTestMultiplayerConnectMode(t *testing.T, mode MultiplayerConnectMode) {
+	t.Helper()
+
+	previous := getMultiplayerConnectMode()
+	SetMultiplayerConnectMode(mode)
+	t.Cleanup(func() {
+		SetMultiplayerConnectMode(previous)
+	})
+}

client/transport/wireguard.go

@@ -0,0 +1,184 @@
+package transport
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/netip"
+	"strconv"
+	"strings"
+	"sync"
+
+	"github.com/bishopfox/sliver/client/assets"
+	"github.com/bishopfox/sliver/protobuf/rpcpb"
+	"golang.zx2c4.com/wireguard/conn"
+	"golang.zx2c4.com/wireguard/device"
+	"google.golang.org/grpc"
+)
+
+const (
+	multiplayerWireGuardDefaultServerIP = "100.65.0.1"
+	multiplayerWireGuardMTU             = 1420
+	multiplayerWireGuardKeepalive       = 25
+)
+
+var (
+	ErrMissingWireGuardConfig    = errors.New("operator config has no wg block")
+	ErrIncompleteWireGuardConfig = errors.New("operator config has incomplete wg block")
+)
+
+type wireGuardTunnel struct {
+	dev *device.Device
+	net *transportNet
+
+	closeOnce sync.Once
+}
+
+func (t *wireGuardTunnel) Close() error {
+	if t == nil {
+		return nil
+	}
+	t.closeOnce.Do(func() {
+		if t.dev != nil {
+			t.dev.Close()
+		}
+	})
+	return nil
+}
+
+func (t *wireGuardTunnel) DialContext(ctx context.Context, address string) (net.Conn, error) {
+	if t == nil || t.net == nil {
+		return nil, errors.New("wireguard tunnel is not initialized")
+	}
+	return t.net.DialContext(ctx, "tcp", address)
+}
+
+func wireGuardMTLSConnect(config *assets.ClientConfig) (rpcpb.SliverRPCClient, *grpc.ClientConn, error) {
+	tunnel, target, err := newWireGuardTunnel(config)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	options, err := newMTLSDialOptions(config)
+	if err != nil {
+		_ = tunnel.Close()
+		return nil, nil, err
+	}
+	options = append(options, grpc.WithContextDialer(func(ctx context.Context, addr string) (net.Conn, error) {
+		return tunnel.DialContext(ctx, addr)
+	}))
+
+	return dialRPCClient(target, options, tunnel)
+}
+
+func newWireGuardTunnel(config *assets.ClientConfig) (*wireGuardTunnel, string, error) {
+	if err := validateWireGuardConfig(config); err != nil {
+		return nil, "", err
+	}
+	if config.LPort <= 0 || 65535 < config.LPort {
+		return nil, "", fmt.Errorf("invalid multiplayer port %d", config.LPort)
+	}
+
+	clientIP, err := netip.ParseAddr(strings.TrimSpace(config.WG.ClientIP))
+	if err != nil {
+		return nil, "", fmt.Errorf("invalid wireguard client IP %q: %w", config.WG.ClientIP, err)
+	}
+
+	serverIPValue := strings.TrimSpace(config.WG.ServerIP)
+	if serverIPValue == "" {
+		serverIPValue = multiplayerWireGuardDefaultServerIP
+	}
+	serverIP, err := netip.ParseAddr(serverIPValue)
+	if err != nil {
+		return nil, "", fmt.Errorf("invalid wireguard server IP %q: %w", serverIPValue, err)
+	}
+
+	endpoint, err := resolveWireGuardEndpoint(config.LHost, config.LPort)
+	if err != nil {
+		return nil, "", err
+	}
+
+	tun, tNet, err := createTransportNetTUN([]netip.Addr{clientIP}, multiplayerWireGuardMTU)
+	if err != nil {
+		return nil, "", err
+	}
+
+	dev := device.NewDevice(tun, conn.NewDefaultBind(), device.NewLogger(device.LogLevelSilent, "[client/wg] "))
+	wgConf := bytes.NewBuffer(nil)
+	fmt.Fprintf(wgConf, "private_key=%s\n", strings.TrimSpace(config.WG.ClientPrivateKey))
+	fmt.Fprintf(wgConf, "public_key=%s\n", strings.TrimSpace(config.WG.ServerPubKey))
+	fmt.Fprintf(wgConf, "endpoint=%s\n", endpoint.String())
+	fmt.Fprintf(wgConf, "allowed_ip=%s\n", multiplayerWireGuardAllowedIP(serverIP))
+	fmt.Fprintf(wgConf, "persistent_keepalive_interval=%d\n", multiplayerWireGuardKeepalive)
+
+	if err := dev.IpcSetOperation(bufio.NewReader(wgConf)); err != nil {
+		dev.Close()
+		return nil, "", err
+	}
+	if err := dev.Up(); err != nil {
+		dev.Close()
+		return nil, "", err
+	}
+
+	target := net.JoinHostPort(serverIP.String(), strconv.Itoa(config.LPort))
+	return &wireGuardTunnel{dev: dev, net: tNet}, target, nil
+}
+
+func validateWireGuardConfig(config *assets.ClientConfig) error {
+	if config == nil {
+		return errors.New("client config is required")
+	}
+	if config.WG == nil {
+		return ErrMissingWireGuardConfig
+	}
+
+	missing := make([]string, 0, 3)
+	if strings.TrimSpace(config.WG.ServerPubKey) == "" {
+		missing = append(missing, "server_pub_key")
+	}
+	if strings.TrimSpace(config.WG.ClientPrivateKey) == "" {
+		missing = append(missing, "client_private_key")
+	}
+	if strings.TrimSpace(config.WG.ClientIP) == "" {
+		missing = append(missing, "client_ip")
+	}
+	if len(missing) != 0 {
+		return fmt.Errorf("%w: missing %s", ErrIncompleteWireGuardConfig, strings.Join(missing, ", "))
+	}
+	return nil
+}
+
+func resolveWireGuardEndpoint(host string, port int) (netip.AddrPort, error) {
+	host = strings.Trim(strings.TrimSpace(host), "[]")
+	if host == "" {
+		return netip.AddrPort{}, errors.New("wireguard endpoint host is required")
+	}
+
+	if addr, err := netip.ParseAddr(host); err == nil {
+		return netip.AddrPortFrom(addr, uint16(port)), nil
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), defaultTimeout)
+	defer cancel()
+
+	ips, err := net.DefaultResolver.LookupNetIP(ctx, "ip", host)
+	if err != nil {
+		return netip.AddrPort{}, fmt.Errorf("failed to resolve wireguard endpoint %q: %w", host, err)
+	}
+	for _, ip := range ips {
+		if ip.IsValid() {
+			return netip.AddrPortFrom(ip, uint16(port)), nil
+		}
+	}
+	return netip.AddrPort{}, fmt.Errorf("wireguard endpoint %q did not resolve to a usable IP", host)
+}
+
+func multiplayerWireGuardAllowedIP(addr netip.Addr) string {
+	if addr.Is6() {
+		return fmt.Sprintf("%s/128", addr)
+	}
+	return fmt.Sprintf("%s/32", addr)
+}

client/transport/wireguard_netstack.go

@@ -0,0 +1,226 @@
+package transport
+
+import (
+	"context"
+	"crypto/rand"
+	"fmt"
+	"math/big"
+	insecurerand "math/rand"
+	"net"
+	"net/netip"
+	"os"
+	"syscall"
+
+	"golang.zx2c4.com/wireguard/tun"
+	"gvisor.dev/gvisor/pkg/buffer"
+	"gvisor.dev/gvisor/pkg/tcpip"
+	"gvisor.dev/gvisor/pkg/tcpip/adapters/gonet"
+	"gvisor.dev/gvisor/pkg/tcpip/header"
+	"gvisor.dev/gvisor/pkg/tcpip/link/channel"
+	"gvisor.dev/gvisor/pkg/tcpip/network/ipv4"
+	"gvisor.dev/gvisor/pkg/tcpip/network/ipv6"
+	"gvisor.dev/gvisor/pkg/tcpip/stack"
+	"gvisor.dev/gvisor/pkg/tcpip/transport/icmp"
+	"gvisor.dev/gvisor/pkg/tcpip/transport/tcp"
+	"gvisor.dev/gvisor/pkg/tcpip/transport/udp"
+)
+
+type transportTun struct {
+	ep             *channel.Endpoint
+	stack          *stack.Stack
+	events         chan tun.Event
+	notifyHandle   *channel.NotificationHandle
+	incomingPacket chan *buffer.View
+	mtu            int
+	hasV4          bool
+	hasV6          bool
+}
+
+type transportNet transportTun
+
+func createTransportNetTUN(localAddresses []netip.Addr, mtu int) (tun.Device, *transportNet, error) {
+	n, err := rand.Int(rand.Reader, big.NewInt(0xFFFFFFFF))
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to create random number: %w", err)
+	}
+	clock := tcpip.NewStdClock()
+	rng := insecurerand.New(insecurerand.NewSource(n.Int64()))
+
+	opts := stack.Options{
+		NetworkProtocols:   []stack.NetworkProtocolFactory{ipv4.NewProtocol, ipv6.NewProtocol},
+		TransportProtocols: []stack.TransportProtocolFactory{tcp.NewProtocol, udp.NewProtocol, icmp.NewProtocol6, icmp.NewProtocol4},
+		HandleLocal:        true,
+		IPTables:           stack.DefaultTables(clock, rng),
+	}
+	dev := &transportTun{
+		ep:             channel.New(1024, uint32(mtu), ""),
+		stack:          stack.New(opts),
+		events:         make(chan tun.Event, 10),
+		incomingPacket: make(chan *buffer.View),
+		mtu:            mtu,
+	}
+
+	sackEnabledOpt := tcpip.TCPSACKEnabled(true)
+	if tcpipErr := dev.stack.SetTransportProtocolOption(tcp.ProtocolNumber, &sackEnabledOpt); tcpipErr != nil {
+		return nil, nil, fmt.Errorf("could not enable TCP SACK: %v", tcpipErr)
+	}
+
+	dev.notifyHandle = dev.ep.AddNotify(dev)
+	if tcpipErr := dev.stack.CreateNIC(1, dev.ep); tcpipErr != nil {
+		return nil, nil, fmt.Errorf("CreateNIC: %v", tcpipErr)
+	}
+
+	for _, ip := range localAddresses {
+		var protoNumber tcpip.NetworkProtocolNumber
+		if ip.Is4() {
+			protoNumber = ipv4.ProtocolNumber
+		} else if ip.Is6() {
+			protoNumber = ipv6.ProtocolNumber
+		}
+		protoAddr := tcpip.ProtocolAddress{
+			Protocol:          protoNumber,
+			AddressWithPrefix: tcpip.AddrFromSlice(ip.AsSlice()).WithPrefix(),
+		}
+		if tcpipErr := dev.stack.AddProtocolAddress(1, protoAddr, stack.AddressProperties{}); tcpipErr != nil {
+			return nil, nil, fmt.Errorf("AddProtocolAddress(%v): %v", ip, tcpipErr)
+		}
+		if ip.Is4() {
+			dev.hasV4 = true
+		} else if ip.Is6() {
+			dev.hasV6 = true
+		}
+	}
+
+	if dev.hasV4 {
+		dev.stack.AddRoute(tcpip.Route{Destination: header.IPv4EmptySubnet, NIC: 1})
+	}
+	if dev.hasV6 {
+		dev.stack.AddRoute(tcpip.Route{Destination: header.IPv6EmptySubnet, NIC: 1})
+	}
+
+	dev.events <- tun.EventUp
+	return dev, (*transportNet)(dev), nil
+}
+
+func (tun *transportTun) Name() (string, error) {
+	return "go", nil
+}
+
+func (tun *transportTun) File() *os.File {
+	return nil
+}
+
+func (tun *transportTun) Events() <-chan tun.Event {
+	return tun.events
+}
+
+func (tun *transportTun) Read(buf [][]byte, sizes []int, offset int) (int, error) {
+	view, ok := <-tun.incomingPacket
+	if !ok {
+		return 0, os.ErrClosed
+	}
+
+	n, err := view.Read(buf[0][offset:])
+	if err != nil {
+		return 0, err
+	}
+	sizes[0] = n
+	return 1, nil
+}
+
+func (tun *transportTun) Write(buf [][]byte, offset int) (int, error) {
+	for _, buf := range buf {
+		packet := buf[offset:]
+		if len(packet) == 0 {
+			continue
+		}
+
+		pkb := stack.NewPacketBuffer(stack.PacketBufferOptions{Payload: buffer.MakeWithData(packet)})
+		switch packet[0] >> 4 {
+		case 4:
+			tun.ep.InjectInbound(header.IPv4ProtocolNumber, pkb)
+		case 6:
+			tun.ep.InjectInbound(header.IPv6ProtocolNumber, pkb)
+		default:
+			return 0, syscall.EAFNOSUPPORT
+		}
+	}
+	return len(buf), nil
+}
+
+func (tun *transportTun) WriteNotify() {
+	pkt := tun.ep.Read()
+	if pkt == nil {
+		return
+	}
+
+	view := pkt.ToView()
+	pkt.DecRef()
+
+	tun.incomingPacket <- view
+}
+
+func (tun *transportTun) Close() error {
+	tun.stack.RemoveNIC(1)
+	tun.stack.Close()
+	tun.ep.RemoveNotify(tun.notifyHandle)
+	tun.ep.Close()
+
+	if tun.events != nil {
+		close(tun.events)
+	}
+	if tun.incomingPacket != nil {
+		close(tun.incomingPacket)
+	}
+
+	return nil
+}
+
+func (tun *transportTun) MTU() (int, error) {
+	return tun.mtu, nil
+}
+
+func (tun *transportTun) BatchSize() int {
+	return 1
+}
+
+func convertTransportFullAddr(endpoint netip.AddrPort) (tcpip.FullAddress, tcpip.NetworkProtocolNumber) {
+	var protoNumber tcpip.NetworkProtocolNumber
+	if endpoint.Addr().Is4() {
+		protoNumber = ipv4.ProtocolNumber
+	} else {
+		protoNumber = ipv6.ProtocolNumber
+	}
+	return tcpip.FullAddress{
+		NIC:  1,
+		Addr: tcpip.AddrFromSlice(endpoint.Addr().AsSlice()),
+		Port: endpoint.Port(),
+	}, protoNumber
+}
+
+func (netstack *transportNet) DialContextTCPAddrPort(ctx context.Context, addr netip.AddrPort) (*gonet.TCPConn, error) {
+	fa, pn := convertTransportFullAddr(addr)
+	return gonet.DialContextTCP(ctx, netstack.stack, fa, pn)
+}
+
+func (netstack *transportNet) DialContext(ctx context.Context, network, address string) (net.Conn, error) {
+	switch network {
+	case "tcp", "tcp4", "tcp6":
+	default:
+		return nil, fmt.Errorf("unsupported network %q", network)
+	}
+
+	host, portString, err := net.SplitHostPort(address)
+	if err != nil {
+		return nil, err
+	}
+	port, err := net.LookupPort("tcp", portString)
+	if err != nil {
+		return nil, err
+	}
+	addr, err := netip.ParseAddr(host)
+	if err != nil {
+		return nil, err
+	}
+	return netstack.DialContextTCPAddrPort(ctx, netip.AddrPortFrom(addr, uint16(port)))
+}

docs/docs.go

@@ -0,0 +1,109 @@
+package docs
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2026  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"embed"
+	"io/fs"
+	"path"
+	"strings"
+)
+
+const (
+	markdownDir  = "sliver-docs/pages/docs/md"
+	asciinemaDir = "sliver-docs/public/asciinema"
+)
+
+var (
+	// rawFS stores embedded docs content from the Sliver docs site.
+	//go:embed sliver-docs/pages/docs/md/*.md sliver-docs/public/asciinema/*
+	rawFS embed.FS
+
+	// FS provides access to the embedded markdown docs rooted at the md directory.
+	FS = mustSubFS(rawFS, markdownDir)
+
+	// AsciinemaFS provides access to the embedded asciinema recordings.
+	AsciinemaFS = mustSubFS(rawFS, asciinemaDir)
+)
+
+// Doc is a single embedded markdown document.
+type Doc struct {
+	Name    string `json:"name"`
+	Content string `json:"content"`
+}
+
+// Docs mirrors the JSON shape used by the docs site.
+type Docs struct {
+	Docs []Doc `json:"docs"`
+}
+
+// All returns every embedded markdown document.
+func All() (Docs, error) {
+	entries, err := fs.ReadDir(FS, ".")
+	if err != nil {
+		return Docs{}, err
+	}
+
+	docs := make([]Doc, 0, len(entries))
+	for _, entry := range entries {
+		if entry.IsDir() || path.Ext(entry.Name()) != ".md" {
+			continue
+		}
+
+		content, err := fs.ReadFile(FS, entry.Name())
+		if err != nil {
+			return Docs{}, err
+		}
+
+		docs = append(docs, Doc{
+			Name:    strings.TrimSuffix(entry.Name(), path.Ext(entry.Name())),
+			Content: string(content),
+		})
+	}
+	return Docs{Docs: docs}, nil
+}
+
+// Read returns the embedded markdown for a doc name, with or without the .md suffix.
+func Read(name string) (string, error) {
+	if !strings.HasSuffix(name, ".md") {
+		name += ".md"
+	}
+
+	content, err := fs.ReadFile(FS, name)
+	if err != nil {
+		return "", err
+	}
+	return string(content), nil
+}
+
+// ReadAsciinema returns the embedded asciinema recording, with or without the .cast suffix.
+func ReadAsciinema(name string) ([]byte, error) {
+	if !strings.HasSuffix(name, ".cast") {
+		name += ".cast"
+	}
+	return fs.ReadFile(AsciinemaFS, name)
+}
+
+func mustSubFS(embedded fs.FS, dir string) fs.FS {
+	sub, err := fs.Sub(embedded, dir)
+	if err != nil {
+		panic(err)
+	}
+	return sub
+}

docs/docs_test.go

@@ -0,0 +1,139 @@
+package docs
+
+import (
+	"io/fs"
+	"os"
+	"path/filepath"
+	"sort"
+	"testing"
+)
+
+func TestAllMatchesEmbeddedMarkdownSources(t *testing.T) {
+	dirEntries, err := os.ReadDir("sliver-docs/pages/docs/md")
+	if err != nil {
+		t.Fatalf("read markdown source directory: %v", err)
+	}
+
+	expected := make(map[string]string, len(dirEntries))
+	for _, entry := range dirEntries {
+		if entry.IsDir() || filepath.Ext(entry.Name()) != ".md" {
+			continue
+		}
+
+		content, err := os.ReadFile(filepath.Join("sliver-docs/pages/docs/md", entry.Name()))
+		if err != nil {
+			t.Fatalf("read markdown source %q: %v", entry.Name(), err)
+		}
+		expected[entry.Name()] = string(content)
+	}
+
+	embeddedEntries, err := fs.ReadDir(FS, ".")
+	if err != nil {
+		t.Fatalf("read embedded directory: %v", err)
+	}
+	if len(embeddedEntries) != len(expected) {
+		t.Fatalf("embedded entry count = %d, want %d", len(embeddedEntries), len(expected))
+	}
+
+	docs, err := All()
+	if err != nil {
+		t.Fatalf("All(): %v", err)
+	}
+	if len(docs.Docs) != len(expected) {
+		t.Fatalf("All() doc count = %d, want %d", len(docs.Docs), len(expected))
+	}
+
+	gotNames := make([]string, 0, len(docs.Docs))
+	for _, doc := range docs.Docs {
+		filename := doc.Name + ".md"
+		gotNames = append(gotNames, doc.Name)
+
+		expectedContent, ok := expected[filename]
+		if !ok {
+			t.Fatalf("unexpected embedded doc %q", filename)
+		}
+		if doc.Content != expectedContent {
+			t.Fatalf("embedded content mismatch for %q", filename)
+		}
+	}
+
+	wantNames := make([]string, 0, len(expected))
+	for filename := range expected {
+		wantNames = append(wantNames, filename[:len(filename)-len(filepath.Ext(filename))])
+	}
+	sort.Strings(gotNames)
+	sort.Strings(wantNames)
+	for i := range gotNames {
+		if gotNames[i] != wantNames[i] {
+			t.Fatalf("embedded names mismatch at index %d: got %q want %q", i, gotNames[i], wantNames[i])
+		}
+	}
+}
+
+func TestReadAcceptsDocNameWithoutSuffix(t *testing.T) {
+	want, err := os.ReadFile(filepath.Join("sliver-docs/pages/docs/md", "Getting Started.md"))
+	if err != nil {
+		t.Fatalf("read source doc: %v", err)
+	}
+
+	got, err := Read("Getting Started")
+	if err != nil {
+		t.Fatalf("Read(): %v", err)
+	}
+	if got != string(want) {
+		t.Fatal("Read() returned unexpected content")
+	}
+}
+
+func TestAsciinemaFSMatchesEmbeddedSources(t *testing.T) {
+	dirEntries, err := os.ReadDir("sliver-docs/public/asciinema")
+	if err != nil {
+		t.Fatalf("read asciinema source directory: %v", err)
+	}
+
+	expected := make(map[string][]byte, len(dirEntries))
+	for _, entry := range dirEntries {
+		if entry.IsDir() || filepath.Ext(entry.Name()) != ".cast" {
+			continue
+		}
+
+		content, err := os.ReadFile(filepath.Join("sliver-docs/public/asciinema", entry.Name()))
+		if err != nil {
+			t.Fatalf("read asciinema source %q: %v", entry.Name(), err)
+		}
+		expected[entry.Name()] = content
+	}
+
+	embeddedEntries, err := fs.ReadDir(AsciinemaFS, ".")
+	if err != nil {
+		t.Fatalf("read embedded asciinema directory: %v", err)
+	}
+	if len(embeddedEntries) != len(expected) {
+		t.Fatalf("embedded asciinema entry count = %d, want %d", len(embeddedEntries), len(expected))
+	}
+
+	for filename, want := range expected {
+		got, err := fs.ReadFile(AsciinemaFS, filename)
+		if err != nil {
+			t.Fatalf("read embedded asciinema %q: %v", filename, err)
+		}
+		if string(got) != string(want) {
+			t.Fatalf("embedded asciinema mismatch for %q", filename)
+		}
+	}
+}
+
+func TestReadAsciinemaAcceptsNameWithoutSuffix(t *testing.T) {
+	want, err := os.ReadFile(filepath.Join("sliver-docs/public/asciinema", "intro.cast"))
+	if err != nil {
+		t.Fatalf("read source asciinema: %v", err)
+	}
+
+	got, err := ReadAsciinema("intro")
+	if err != nil {
+		t.Fatalf("ReadAsciinema(): %v", err)
+	}
+	if string(got) != string(want) {
+		t.Fatal("ReadAsciinema() returned unexpected content")
+	}
+}

docs/sliver-ai-agentic-loop.md

@@ -0,0 +1,232 @@
+# Sliver AI Agentic Loop
+
+## Goal
+
+Port the example agentic loop from `examples/codex/codex-rs` into Sliver's AI chat so the server can:
+
+- run a multi-step Responses API turn
+- emit turn and item lifecycle events similar to Codex
+- persist reasoning and tool-call items for sync and restoration
+- keep those non-chat items out of the model context window
+- render the new items in the client TUI
+
+## How The Codex Example Loop Works
+
+The Codex example splits the loop into three layers.
+
+### 1. Provider/Protocol Layer
+
+The protocol layer receives raw model events such as:
+
+- turn started / completed / failed
+- reasoning deltas and completed reasoning items
+- command/tool begin and end notifications
+- assistant messages
+
+These provider events are fine-grained and often arrive as partial updates.
+
+### 2. Event Processor Layer
+
+`event_processor_with_jsonl_output.rs` converts the raw provider stream into a stable thread event model.
+
+The important behaviors are:
+
+- a turn gets a lifecycle: `turn.started`, then `turn.completed` or `turn.failed`
+- each logical item gets a stable id
+- begin/end pairs are folded into a single item lifecycle
+- reasoning is emitted as its own item type
+- tool calls and command executions are emitted as their own item types
+- active items can be updated in place before completion
+
+This is the key abstraction that makes the TUI and persisted history simple.
+
+### 3. TUI Layer
+
+The Codex TUI consumes those stable events rather than reloading the whole thread.
+
+That lets it:
+
+- append new items incrementally
+- update an existing in-flight item in place
+- keep the transcript stable while a turn runs
+- restore the same item types from stored history later
+
+## Sliver Port
+
+Sliver ports the same shape, adapted to its existing RPC and database model.
+
+### Conversation State
+
+`AIConversation` now stores:
+
+- `ActiveTurnID`
+- `TurnState`
+- `TargetSessionID`
+- `TargetBeaconID`
+
+The turn fields let clients restore "waiting", "completed", and "failed" state without inferring it from the last chat message.
+
+The target fields bind a conversation to the active session or beacon so server-side tools can default to the conversation target.
+
+### Message State
+
+`AIConversationMessage` now stores:
+
+- `Kind`: chat, reasoning, or tool call
+- `Visibility`: context or UI-only
+- `IncludeInContext`: whether the block should be replayed into the provider context window
+- `State`: in progress, completed, or failed
+- `TurnID`
+- `ItemID`
+- tool call metadata: name, arguments, result, error text, tool call id
+
+This keeps one ordered transcript table while still distinguishing chat context from UI-only telemetry.
+
+### UI-Only Persistence
+
+Reasoning, tool-call, and intermediate assistant chat items can be stored as normal conversation messages with `Visibility = UI_ONLY`.
+
+That gives Sliver:
+
+- cross-client sync through the existing conversation storage path
+- transcript restoration after reconnect or TUI restart
+- ordered replay of an entire turn, including intermediate items
+
+At the same time, the model context builder keys off `IncludeInContext`, so UI visibility and provider visibility are now independent.
+
+### Event Model
+
+Sliver now publishes `AIConversationEvent` payloads instead of raw `AIConversation` snapshots.
+
+Supported event types:
+
+- `CONVERSATION_UPDATED`
+- `CONVERSATION_DELETED`
+- `TURN_STARTED`
+- `TURN_COMPLETED`
+- `TURN_FAILED`
+- `MESSAGE_STARTED`
+- `MESSAGE_UPDATED`
+- `MESSAGE_COMPLETED`
+
+Each event can carry:
+
+- a conversation summary
+- a single message/item
+- the turn id
+- optional error text
+
+This mirrors the Codex pattern of stable turn and item lifecycle events.
+
+## Server Turn Flow
+
+For each new user message:
+
+1. The user chat message is saved as a normal context-visible chat item.
+2. The server resolves runtime provider/model settings.
+3. A new turn id is generated and persisted with `TURN_STARTED`.
+4. If the runtime supports the Responses API loop, Sliver runs the agentic loop.
+5. Reasoning items are persisted as completed UI-only reasoning blocks.
+6. Tool calls are persisted as in-progress UI-only tool blocks, executed locally, then updated in place to completed or failed.
+7. Intermediate assistant chat blocks on tool-use turns are persisted as UI-only chat items with `IncludeInContext = false`.
+8. Tool outputs are fed back into the Responses API with `previous_response_id`.
+9. When the model returns final assistant text, that assistant message is persisted as a normal context-visible chat item with `IncludeInContext = true`.
+10. The conversation turn state is cleared with `TURN_COMPLETED`.
+
+If anything fails:
+
+- a UI-only failed system message is persisted
+- the conversation is marked `TURN_FAILED`
+- the failure remains visible in the transcript without polluting future model context
+
+## Tool Surface
+
+The first port exposes a safe read-only tool set:
+
+- `list_sessions_and_beacons`
+- `fs_ls`
+- `fs_cat`
+- `fs_pwd`
+
+Why read-only first:
+
+- it proves the loop, storage, eventing, and TUI behavior
+- it avoids surprising destructive remote actions in the first server-side tool release
+
+Filesystem tools accept explicit `session_id` or `beacon_id`, but when omitted they fall back to the conversation target.
+
+Beacon-backed tools wait for task completion on the server before emitting the completed item update.
+
+## Context Filtering
+
+Only chat messages with:
+
+- `Kind = CHAT`
+- `IncludeInContext = true`
+
+are included in future provider requests.
+
+That means these items are excluded from the model context window:
+
+- reasoning blocks
+- tool call blocks
+- UI-only intermediate assistant chat blocks
+- failed system status blocks
+
+This is the main rule that preserves transcript richness without degrading prompt quality.
+
+## TUI Behavior
+
+The AI TUI now consumes `AIConversationEvent` incrementally.
+
+Instead of reloading the whole conversation for every server event, it:
+
+- merges conversation summaries into the sidebar
+- upserts messages in place by message id or item id
+- updates waiting state from `TurnState`
+- removes deleted conversations immediately
+
+Reasoning and tool-call blocks render as dedicated dark-grey transcript boxes.
+
+### Reasoning Blocks
+
+Reasoning blocks show:
+
+- the `Reasoning` label
+- the persisted reasoning text
+- item state metadata
+
+### Tool Call Blocks
+
+Tool blocks show:
+
+- `Tool: <name>`
+- arguments
+- result
+- error text when present
+- item state metadata
+
+These blocks are restored exactly like chat messages because they are stored in the same ordered transcript.
+
+## Restore And Sync
+
+Because UI-only items live in the database:
+
+- another Sliver client can attach to the same conversation and see the full turn history
+- reconnecting the TUI restores reasoning and tool-call blocks
+- turn state survives restart, so "in progress" and "failed" status can be reconstructed from persisted conversation metadata
+
+## Differences From Codex
+
+This port intentionally differs from the example in a few places.
+
+- Sliver currently uses non-streaming Responses API requests, so reasoning items arrive as completed items rather than token deltas.
+- Tool execution is currently a bounded read-only server-side function set, not the full Codex local tool surface.
+- Sliver persists intermediate items in its conversation DB rather than only in a transient thread runtime.
+
+The important invariant is still the same:
+
+- turn lifecycle is explicit
+- item lifecycle is explicit
+- UI-only items are persisted and replayable
+- only context-visible chat reaches the model

docs/sliver-docs/pages/docs/md/Aliases and Extensions.md

@@ -1,5 +1,18 @@
 Sliver allows an operator to extend the local client console and its features by adding new commands based on third party tools. The easiest way to install an alias or extension is using the [armory](/docs?name=Armory).
 
+## Server AI Access
+
+Aliases and extensions used from the client console still live under `~/.sliver-client/aliases` and `~/.sliver-client/extensions`.
+
+The server-side AI agent uses a separate store under `~/.sliver/ai/aliases` and `~/.sliver/ai/extensions`. To make a package available to the AI agent, copy the unpacked package directory into the matching server-side path so the manifest and payload artifacts are present together. For example:
+
+- `~/.sliver/ai/aliases/Rubeus/alias.json`
+- `~/.sliver/ai/aliases/Rubeus/Rubeus.exe`
+- `~/.sliver/ai/extensions/nanodump/extension.json`
+- `~/.sliver/ai/extensions/nanodump/nanodump.x64.o`
+
+There is currently no dedicated UI for this workflow. The AI agent can search and execute only the packages that have been copied into these server-side directories.
+
 #### Aliases Command Parsing
 
 **⚠️ IMPORTANT:** It's important to understand that all alias commands have certain Sliver shell flags (those that appear in `--help`). Your Sliver shell commands are lexically parsed by the Sliver shell first, and only unnamed positional arguments are passed to the alias code. This means you may need to escape certain arguments in order for them to be correctly parsed.

docs/sliver-docs/pages/docs/md/Armory.md

@@ -4,6 +4,8 @@ The armory downloads packages from `github.com` and `api.github.com` so you'll n
 
 Aliases and extensions are installed on the "sliver client"-side, and thus are not shared among operators in [multiplayer mode](/docs?name=Multi-player+Mode).
 
+The server-side AI agent uses a separate store under `~/.sliver/ai/aliases` and `~/.sliver/ai/extensions`. If you want the AI agent to discover and execute an alias or extension, copy the unpacked package directory (the manifest plus its artifacts) into the matching server-side path. There is currently no dedicated UI or install command for the AI store.
+
 You can also use `armory install all` to install _everything_ if you really want to.
 
 ## The Official Armory
@@ -44,6 +46,8 @@ You remove packages installed from the `armory` using the `aliases rm` and `exte
 
 Installed alias and extension files are stored in `~/.sliver-client/` by default if you want to manually remove a package simply delete its corresponding directory and restart the client.
 
+If you also copied a package into the server-side AI store, remove that copy separately from `~/.sliver/ai/aliases` or `~/.sliver/ai/extensions`.
+
 ## Private Armories
 
 Sliver has experimental support for self-hosted private armories, but I have not gotten around to testing and writing the documentation for these, so you'll have to read through the source code to figure out how they work for now. I'll eventually update this documentation and release a reference implementation. If you do play around with this, just know the design is subject to change before becoming a real feature.

docs/sliver-docs/pages/docs/md/BOF and COFF Support.md

@@ -6,7 +6,7 @@ BOF support is provided via the [COFF Loader](https://github.com/sliverarmory/CO
 
 The easiest way to install a BOF extension, for example [`nanodump`](https://github.com/sliverarmory/nanodump), is using the [armory](/docs?name=Armory) package manager:
 
-**IMPORTANT:** BOF Extensions are installed per-sliver client, they are not stored on the server. Thus extensions are not shared across operators, each operator must install the extension to use it.
+**IMPORTANT:** BOF extensions are still installed per-sliver client for normal operator use, so they are not shared across operators automatically. If you want the server-side AI agent to use a BOF, copy the unpacked BOF directory into `~/.sliver/ai/extensions` on the server as well, and copy any dependency such as `coff-loader` into that same server-side AI store.
 
 ```
 sliver > armory install nanodump
@@ -114,6 +114,8 @@ Looking at the script we can see the BOF requires a single integer argument. The
 
 Once the manifest is defined load it into your client using `extensions load`, locally loaded extensions do not need to be cryptographically signed. The paths in the manifest should be relative to the manifest file, parent directories are not allowed.
 
+If you want the server-side AI agent to discover and run the same BOF, copy that unpacked directory into `~/.sliver/ai/extensions/<name>/` so the `extension.json` file and `.o` artifact are available on the server.
+
 More details can be found on the [Aliases & Extensions](/docs?name=Aliases+and+Extensions) page.
 
 **IMPORTANT:** For BOF extensions to be properly detected by the Sliver client, the `path` must use the `.o` file extension.

docs/sliver-docs/pages/docs/md/Configuration Files.md

@@ -21,6 +21,16 @@ grpc:
     keepalive:
         min_time_seconds: 30
         permit_without_stream: true
+ai:
+    provider: ""
+    model: ""
+    thinking_level: ""
+    anthropic:
+        api_key: ""
+        base_url: ""
+    openai:
+        api_key: ""
+        base_url: ""
 watch_tower: null
 go_proxy: ""
 http_default:
@@ -51,6 +61,12 @@ cxx: {}
 - `grpc.keepalive` - gRPC keepalive enforcement configuration.
   - `min_time_seconds` - Minimum time (seconds) between client pings before sending GOAWAY (`too_many_pings`).
   - `permit_without_stream` - Allow client pings when there are no active streams.
+- `ai` - Optional server-side AI defaults and provider credentials.
+  - `provider` - Default AI provider (`openai` or `anthropic`).
+  - `model` - Optional default model identifier.
+  - `thinking_level` - Optional reasoning level (for example `low`, `medium`, `high`, or `disabled`).
+  - `anthropic.api_key` / `openai.api_key` - Provider API key.
+  - `anthropic.base_url` / `openai.base_url` - Optional provider API endpoint override.
 - `watch_tower` - Optional API keys for Watchtower integrations.
   - `vt_api_key` - VirusTotal API key.
   - `xforce_api_key` - IBM X-Force API key.

docs/sliver-docs/pages/docs/md/MCP.md

@@ -47,6 +47,10 @@ sliver > mcp start --transport http
 
 [*] Starting MCP server (http) on 127.0.0.1:8080
 [*] Endpoint: http://127.0.0.1:8080/mcp
+[*] Auth Header: Authorization
+[*] Auth Token: 6f90c3b3c6058fa59f570e281f3f8d39
 ```
 
-You can use `mcp stop` to stop the server, see `mcp start --help` for additional options when starting the MCP server. Authentication is not yet supported for MCP over HTTP/SSE.
+You can use `mcp stop` to stop the server, see `mcp start --help` for additional options when starting the MCP server.
+
+On first HTTP/SSE use, Sliver generates a random 128-bit token and saves it to `~/.sliver-client/mcp.yaml`. Every MCP HTTP/SSE request must include that token exactly in the `Authorization` header. If `mcp.yaml` already exists, the listener will only start when the token is at least 8 characters long.

go.mod

@@ -1,6 +1,6 @@
 module github.com/bishopfox/sliver
 
-go 1.25.6
+go 1.25.8
 
 replace github.com/rsteube/carapace v0.36.3 => github.com/reeflective/carapace v0.46.3-0.20231214181515-27e49f3c3b69
 
@@ -9,7 +9,11 @@ replace github.com/reeflective/readline => github.com/moloch--/readline v0.0.0-2
 replace github.com/reeflective/console => github.com/moloch--/console v0.0.0-20260129035459-883dcb25c701
 
 require (
-	charm.land/lipgloss/v2 v2.0.0
+	charm.land/bubbles/v2 v2.0.0
+	charm.land/fantasy v0.8.1
+	charm.land/glamour/v2 v2.0.0
+	charm.land/huh/v2 v2.0.3
+	charm.land/lipgloss/v2 v2.0.2
 	filippo.io/age v1.3.1
 	github.com/Binject/binjection v0.0.0-20210701074423-605d46e35deb
 	github.com/Binject/debug v0.0.0-20230508195519-26db73212a7a
@@ -18,11 +22,6 @@ require (
 	github.com/SherClockHolmes/webpush-go v1.4.0
 	github.com/alecthomas/chroma v0.10.0
 	github.com/alecthomas/chroma/v2 v2.23.1
-	github.com/charmbracelet/bubbles v0.21.1-0.20250623103423-23b8fd6302d7
-	github.com/charmbracelet/bubbletea v1.3.10
-	github.com/charmbracelet/huh v0.8.0
-	github.com/charmbracelet/huh/spinner v0.0.0-20251215014908-6f7d32faaff3
-	github.com/charmbracelet/lipgloss v1.1.0
 	github.com/cheggaaa/pb/v3 v3.1.7
 	github.com/chromedp/cdproto v0.0.0-20250803210736-d308e07a266d
 	github.com/chromedp/chromedp v0.14.1
@@ -35,7 +34,7 @@ require (
 	github.com/hashicorp/yamux v0.1.2
 	github.com/jedib0t/go-pretty/v6 v6.7.8
 	github.com/kbinani/screenshot v0.0.0-20250624051815-089614a94018
-	github.com/klauspost/compress v1.18.1
+	github.com/klauspost/compress v1.18.4
 	github.com/lesnuages/go-winio v0.4.19
 	github.com/lesnuages/snitch v0.6.0
 	github.com/mattn/go-sqlite3 v1.14.32
@@ -48,7 +47,7 @@ require (
 	github.com/reeflective/console v0.1.25
 	github.com/reeflective/readline v1.1.4
 	github.com/rsteube/carapace v0.50.2
-	github.com/sirupsen/logrus v1.9.3
+	github.com/sirupsen/logrus v1.9.4
 	github.com/sliverarmory/beignet v0.0.3
 	github.com/sliverarmory/malasada v0.0.3
 	github.com/sliverarmory/wasm-donut v0.0.3
@@ -60,17 +59,17 @@ require (
 	github.com/ulikunitz/xz v0.5.15
 	github.com/xlab/treeprint v1.2.0
 	github.com/yiya1989/sshkrb5 v0.0.1
-	golang.org/x/crypto v0.46.0
-	golang.org/x/exp v0.0.0-20251209150349-8475f28825e9
-	golang.org/x/mod v0.31.0
-	golang.org/x/net v0.48.0
-	golang.org/x/sys v0.41.0
-	golang.org/x/term v0.38.0
-	golang.org/x/text v0.32.0
+	golang.org/x/crypto v0.49.0
+	golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa
+	golang.org/x/mod v0.33.0
+	golang.org/x/net v0.52.0
+	golang.org/x/sys v0.42.0
+	golang.org/x/term v0.41.0
+	golang.org/x/text v0.35.0
 	golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10
-	google.golang.org/api v0.257.0
-	google.golang.org/grpc v1.77.0
+	google.golang.org/api v0.269.0
+	google.golang.org/grpc v1.79.3
 	google.golang.org/protobuf v1.36.11
 	gorm.io/driver/mysql v1.6.0
 	gorm.io/driver/postgres v1.6.0
@@ -85,37 +84,39 @@ require (
 require (
 	cel.dev/expr v0.25.1 // indirect
 	cloud.google.com/go v0.123.0 // indirect
-	cloud.google.com/go/auth v0.17.0 // indirect
+	cloud.google.com/go/auth v0.18.2 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
-	cloud.google.com/go/firestore v1.20.0 // indirect
+	cloud.google.com/go/firestore v1.21.0 // indirect
 	cloud.google.com/go/iam v1.5.3 // indirect
-	cloud.google.com/go/longrunning v0.7.0 // indirect
+	cloud.google.com/go/longrunning v0.8.0 // indirect
 	cloud.google.com/go/monitoring v1.24.3 // indirect
-	cloud.google.com/go/storage v1.58.0 // indirect
+	cloud.google.com/go/storage v1.60.0 // indirect
 	filippo.io/hpke v0.4.0 // indirect
 	firebase.google.com/go/v4 v4.18.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.54.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.54.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 // indirect
 	github.com/MicahParks/keyfunc v1.9.0 // indirect
 	github.com/PagerDuty/go-pagerduty v1.8.0 // indirect
 	github.com/RocketChat/Rocket.Chat.Go.SDK v0.0.0-20250718055228-285ecf400b48 // indirect
 	github.com/appleboy/go-fcm v1.2.6 // indirect
 	github.com/atc0005/go-teams-notify/v2 v2.14.0 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.5 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.16 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.16 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.16 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.16 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.5 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.11 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.19 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.19 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.19 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.19 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ses v1.34.17 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.0.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.0.7 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sns v1.39.10 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.30.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.12 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.41.5 // indirect
-	github.com/aws/smithy-go v1.24.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.30.12 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.16 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.41.8 // indirect
+	github.com/aws/smithy-go v1.24.2 // indirect
+	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/bahlo/generic-list-go v0.2.0 // indirect
 	github.com/blinkbean/dingtalk v1.1.3 // indirect
 	github.com/bradfitz/gomemcache v0.0.0-20250403215159-8d39553ac7cf // indirect
@@ -124,22 +125,27 @@ require (
 	github.com/caarlos0/go-reddit/v3 v3.0.1 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/charmbracelet/anthropic-sdk-go v0.0.0-20260223140439-63879b0b8dab // indirect
 	github.com/charmbracelet/ultraviolet v0.0.0-20260205113103-524a6607adb8 // indirect
+	github.com/charmbracelet/x/exp/ordered v0.1.0 // indirect
+	github.com/charmbracelet/x/exp/slice v0.0.0-20250904123553-b4e2667e5ad5 // indirect
+	github.com/charmbracelet/x/json v0.2.0 // indirect
 	github.com/charmbracelet/x/termios v0.1.1 // indirect
 	github.com/charmbracelet/x/windows v0.2.2 // indirect
 	github.com/clipperhouse/displaywidth v0.11.0 // indirect
-	github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 // indirect
+	github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 // indirect
 	github.com/creachadair/msync v0.7.1 // indirect
 	github.com/cschomburg/go-pushbullet v0.0.0-20171206132031-67759df45fbb // indirect
 	github.com/dghubble/oauth1 v0.7.3 // indirect
 	github.com/dghubble/sling v1.4.2 // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
 	github.com/drswork/go-twitter v0.0.0-20221107160839-dea1b6ed53d7 // indirect
-	github.com/envoyproxy/go-control-plane/envoy v1.36.0 // indirect
-	github.com/envoyproxy/protoc-gen-validate v1.3.0 // indirect
+	github.com/envoyproxy/go-control-plane/envoy v1.37.0 // indirect
+	github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/fatih/structs v1.1.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.3 // indirect
 	github.com/go-lark/lark v1.16.0 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
@@ -148,29 +154,39 @@ require (
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-redis/redis/v8 v8.11.6-0.20220405070650-99c79f7041fc // indirect
 	github.com/go-telegram-bot-api/telegram-bot-api v4.6.4+incompatible // indirect
+	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
+	github.com/goccy/go-yaml v1.19.2 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
 	github.com/golang-jwt/jwt/v5 v5.3.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.7 // indirect
-	github.com/googleapis/gax-go/v2 v2.15.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.12 // indirect
+	github.com/googleapis/gax-go/v2 v2.17.0 // indirect
+	github.com/gorilla/css v1.0.1 // indirect
 	github.com/gorilla/websocket v1.5.3 // indirect
 	github.com/gregdel/pushover v1.4.0 // indirect
 	github.com/invopop/jsonschema v0.13.0 // indirect
 	github.com/jordan-wright/email v4.0.1-0.20210109023952-943e75fe5223+incompatible // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/kaptinlin/go-i18n v0.2.3 // indirect
+	github.com/kaptinlin/jsonpointer v0.4.9 // indirect
+	github.com/kaptinlin/jsonschema v0.6.10 // indirect
+	github.com/kaptinlin/messageformat-go v0.4.9 // indirect
 	github.com/kevinburke/go-types v0.0.0-20240719050749-165e75e768f7 // indirect
 	github.com/kevinburke/rest v0.0.0-20250718180114-1a15e4f2364f // indirect
 	github.com/kevinburke/twilio-go v0.0.0-20250718182727-5fe7adc01f29 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.10 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/line/line-bot-sdk-go v7.8.0+incompatible // indirect
 	github.com/mailgun/errors v0.4.0 // indirect
 	github.com/mailgun/mailgun-go/v5 v5.8.1 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/microcosm-cc/bluemonday v1.0.27 // indirect
 	github.com/mileusna/viber v1.0.1 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/oapi-codegen/runtime v1.1.2 // indirect
+	github.com/openai/openai-go/v2 v2.7.1 // indirect
 	github.com/pires/go-proxyproto v0.8.1 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
@@ -194,24 +210,27 @@ require (
 	github.com/utahta/go-linenotify v0.5.0 // indirect
 	github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect
 	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
+	github.com/yuin/goldmark v1.7.13 // indirect
+	github.com/yuin/goldmark-emoji v1.0.5 // indirect
 	go.mau.fi/util v0.9.3 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/detectors/gcp v1.39.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.64.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0 // indirect
-	go.opentelemetry.io/otel v1.39.0 // indirect
-	go.opentelemetry.io/otel/metric v1.39.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.39.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.39.0 // indirect
-	go.opentelemetry.io/otel/trace v1.39.0 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.40.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.65.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 // indirect
+	go.opentelemetry.io/otel v1.40.0 // indirect
+	go.opentelemetry.io/otel/metric v1.40.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.40.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.40.0 // indirect
+	go.opentelemetry.io/otel/trace v1.40.0 // indirect
 	google.golang.org/appengine/v2 v2.0.6 // indirect
-	google.golang.org/genproto v0.0.0-20251202230838-ff82c1b0f217 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
+	google.golang.org/genai v1.49.0 // indirect
+	google.golang.org/genproto v0.0.0-20260226221140-a57be14db171 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 // indirect
 	gopkg.in/go-playground/validator.v9 v9.31.0 // indirect
 )
 
 require (
-	charm.land/bubbletea/v2 v2.0.0
+	charm.land/bubbletea/v2 v2.0.2
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	filippo.io/edwards25519 v1.1.0 // indirect
 	github.com/Binject/shellcode v0.0.0-20191101084904-a8a90e7d4563 // indirect
@@ -223,16 +242,15 @@ require (
 	github.com/atotto/clipboard v0.1.4 // indirect
 	github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0 // indirect
 	github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.41.0 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.32.5 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.41.3 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.32.11 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssm v1.65.1 // indirect
-	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/carapace-sh/carapace v1.11.0
 	github.com/carapace-sh/carapace-shlex v1.1.1 // indirect
 	github.com/catppuccin/go v0.3.0 // indirect
 	github.com/charmbracelet/colorprofile v0.4.2
 	github.com/charmbracelet/x/ansi v0.11.6
-	github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
+	github.com/charmbracelet/x/exp/charmtone v0.0.0-20260109001716-2fbdffcb221f
 	github.com/charmbracelet/x/exp/strings v0.0.0-20240722160745-212f7b056ed0 // indirect
 	github.com/charmbracelet/x/term v0.2.2 // indirect
 	github.com/chromedp/sysutil v1.1.0 // indirect
@@ -244,12 +262,11 @@ require (
 	github.com/demisto/goxforce v0.0.0-20160322194047-db8357535b1d // indirect
 	github.com/dlclark/regexp2 v1.11.5 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
 	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/gaissmai/bart v0.25.0 // indirect
 	github.com/gen2brain/shm v0.1.1 // indirect
 	github.com/glebarez/go-sqlite v1.22.0 // indirect
-	github.com/go-json-experiment/json v0.0.0-20250910080747-cc2cfa0554c3 // indirect
+	github.com/go-json-experiment/json v0.0.0-20251027170946-4849db3c2f7e // indirect
 	github.com/go-sql-driver/mysql v1.9.3 // indirect
 	github.com/gobwas/httphead v0.1.0 // indirect
 	github.com/gobwas/pool v0.2.1 // indirect
@@ -272,21 +289,18 @@ require (
 	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/jsimonetti/rtnetlink v1.4.2 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
-	github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
+	github.com/lucasb-eyer/go-colorful v1.3.0
 	github.com/lxn/win v0.0.0-20210218163916-a377121e959e // indirect
-	github.com/mark3labs/mcp-go v0.43.2
+	github.com/mark3labs/mcp-go v0.45.0
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/mattn/go-localereader v0.0.1 // indirect
 	github.com/mattn/go-runewidth v0.0.20 // indirect
 	github.com/mdlayher/netlink v1.8.0 // indirect
 	github.com/mdlayher/socket v0.5.1 // indirect
 	github.com/mitchellh/go-ps v1.0.0 // indirect
 	github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
 	github.com/moloch--/go-keystone v0.0.2
-	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
-	github.com/muesli/termenv v0.16.0 // indirect
 	github.com/ncruces/go-strftime v0.1.9 // indirect
 	github.com/ncruces/julianday v1.0.0 // indirect
 	github.com/olekukonko/tablewriter v0.0.5 // indirect
@@ -306,15 +320,16 @@ require (
 	github.com/thedevsaddam/gojsonq/v2 v2.5.2 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
+	github.com/zeebo/xxh3 v1.1.0
 	go4.org/mem v0.0.0-20240501181205-ae6ca9944745 // indirect
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba // indirect
-	golang.org/x/oauth2 v0.34.0 // indirect
-	golang.org/x/sync v0.19.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/time v0.14.0
-	golang.org/x/tools v0.40.0 // indirect
+	golang.org/x/tools v0.42.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	golang.zx2c4.com/wireguard/windows v0.5.3 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260316180232-0b37fe3546d5 // indirect
 	gopkg.in/jcmturner/aescts.v1 v1.0.1 // indirect
 	gopkg.in/jcmturner/dnsutils.v1 v1.0.1 // indirect
 	gopkg.in/jcmturner/goidentity.v3 v3.0.0 // indirect

go.sum

@@ -4,31 +4,39 @@ c2sp.org/CCTV/age v0.0.0-20251208015420-e9274a7bdbfd h1:ZLsPO6WdZ5zatV4UfVpr7oAw
 c2sp.org/CCTV/age v0.0.0-20251208015420-e9274a7bdbfd/go.mod h1:SrHC2C7r5GkDk8R+NFVzYy/sdj0Ypg9htaPXQq5Cqeo=
 cel.dev/expr v0.25.1 h1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4=
 cel.dev/expr v0.25.1/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
-charm.land/bubbletea/v2 v2.0.0 h1:p0d6CtWyJXJ9GfzMpUUqbP/XUUhhlk06+vCKWmox1wQ=
-charm.land/bubbletea/v2 v2.0.0/go.mod h1:3LRff2U4WIYXy7MTxfbAQ+AdfM3D8Xuvz2wbsOD9OHQ=
-charm.land/lipgloss/v2 v2.0.0 h1:sd8N/B3x892oiOjFfBQdXBQp3cAkvjGaU5TvVZC3ivo=
-charm.land/lipgloss/v2 v2.0.0/go.mod h1:w6SnmsBFBmEFBodiEDurGS/sdUY/u1+v72DqUzc6J14=
+charm.land/bubbles/v2 v2.0.0 h1:tE3eK/pHjmtrDiRdoC9uGNLgpopOd8fjhEe31B/ai5s=
+charm.land/bubbles/v2 v2.0.0/go.mod h1:rCHoleP2XhU8um45NTuOWBPNVHxnkXKTiZqcclL/qOI=
+charm.land/bubbletea/v2 v2.0.2 h1:4CRtRnuZOdFDTWSff9r8QFt/9+z6Emubz3aDMnf/dx0=
+charm.land/bubbletea/v2 v2.0.2/go.mod h1:3LRff2U4WIYXy7MTxfbAQ+AdfM3D8Xuvz2wbsOD9OHQ=
+charm.land/fantasy v0.8.1 h1:2zQovDrd26g+/X2+/6bMomTX54HmZWNNHWeorDO0WRo=
+charm.land/fantasy v0.8.1/go.mod h1:KJ8vjy9FH7G2aeR/fL+os2uFHkQ4js2+UJVbsUKCXYM=
+charm.land/glamour/v2 v2.0.0 h1:IDBoqLEy7Hdpb9VOXN+khLP/XSxtJy1VsHuW/yF87+U=
+charm.land/glamour/v2 v2.0.0/go.mod h1:kjq9WB0s8vuUYZNYey2jp4Lgd9f4cKdzAw88FZtpj/w=
+charm.land/huh/v2 v2.0.3 h1:2cJsMqEPwSywGHvdlKsJyQKPtSJLVnFKyFbsYZTlLkU=
+charm.land/huh/v2 v2.0.3/go.mod h1:93eEveeeqn47MwiC3tf+2atZ2l7Is88rAtmZNZ8x9Wc=
+charm.land/lipgloss/v2 v2.0.2 h1:xFolbF8JdpNkM2cEPTfXEcW1p6NRzOWTSamRfYEw8cs=
+charm.land/lipgloss/v2 v2.0.2/go.mod h1:KjPle2Qd3YmvP1KL5OMHiHysGcNwq6u83MUjYkFvEkM=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=
 cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU=
-cloud.google.com/go/auth v0.17.0 h1:74yCm7hCj2rUyyAocqnFzsAYXgJhrG26XCFimrc/Kz4=
-cloud.google.com/go/auth v0.17.0/go.mod h1:6wv/t5/6rOPAX4fJiRjKkJCvswLwdet7G8+UGXt7nCQ=
+cloud.google.com/go/auth v0.18.2 h1:+Nbt5Ev0xEqxlNjd6c+yYUeosQ5TtEUaNcN/3FozlaM=
+cloud.google.com/go/auth v0.18.2/go.mod h1:xD+oY7gcahcu7G2SG2DsBerfFxgPAJz17zz2joOFF3M=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
 cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
-cloud.google.com/go/firestore v1.20.0 h1:JLlT12QP0fM2SJirKVyu2spBCO8leElaW0OOtPm6HEo=
-cloud.google.com/go/firestore v1.20.0/go.mod h1:jqu4yKdBmDN5srneWzx3HlKrHFWFdlkgjgQ6BKIOFQo=
+cloud.google.com/go/firestore v1.21.0 h1:BhopUsx7kh6NFx77ccRsHhrtkbJUmDAxNY3uapWdjcM=
+cloud.google.com/go/firestore v1.21.0/go.mod h1:1xH6HNcnkf/gGyR8udd6pFO4Z7GWJSwLKQMx/u6UrP4=
 cloud.google.com/go/iam v1.5.3 h1:+vMINPiDF2ognBJ97ABAYYwRgsaqxPbQDlMnbHMjolc=
 cloud.google.com/go/iam v1.5.3/go.mod h1:MR3v9oLkZCTlaqljW6Eb2d3HGDGK5/bDv93jhfISFvU=
-cloud.google.com/go/logging v1.13.1 h1:O7LvmO0kGLaHY/gq8cV7T0dyp6zJhYAOtZPX4TF3QtY=
-cloud.google.com/go/logging v1.13.1/go.mod h1:XAQkfkMBxQRjQek96WLPNze7vsOmay9H5PqfsNYDqvw=
-cloud.google.com/go/longrunning v0.7.0 h1:FV0+SYF1RIj59gyoWDRi45GiYUMM3K1qO51qoboQT1E=
-cloud.google.com/go/longrunning v0.7.0/go.mod h1:ySn2yXmjbK9Ba0zsQqunhDkYi0+9rlXIwnoAf+h+TPY=
+cloud.google.com/go/logging v1.13.2 h1:qqlHCBvieJT9Cdq4QqYx1KPadCQ2noD4FK02eNqHAjA=
+cloud.google.com/go/logging v1.13.2/go.mod h1:zaybliM3yun1J8mU2dVQ1/qDzjbOqEijZCn6hSBtKak=
+cloud.google.com/go/longrunning v0.8.0 h1:LiKK77J3bx5gDLi4SMViHixjD2ohlkwBi+mKA7EhfW8=
+cloud.google.com/go/longrunning v0.8.0/go.mod h1:UmErU2Onzi+fKDg2gR7dusz11Pe26aknR4kHmJJqIfk=
 cloud.google.com/go/monitoring v1.24.3 h1:dde+gMNc0UhPZD1Azu6at2e79bfdztVDS5lvhOdsgaE=
 cloud.google.com/go/monitoring v1.24.3/go.mod h1:nYP6W0tm3N9H/bOw8am7t62YTzZY+zUeQ+Bi6+2eonI=
-cloud.google.com/go/storage v1.58.0 h1:PflFXlmFJjG/nBeR9B7pKddLQWaFaRWx4uUi/LyNxxo=
-cloud.google.com/go/storage v1.58.0/go.mod h1:cMWbtM+anpC74gn6qjLh+exqYcfmB9Hqe5z6adx+CLI=
+cloud.google.com/go/storage v1.60.0 h1:oBfZrSOCimggVNz9Y/bXY35uUcts7OViubeddTTVzQ8=
+cloud.google.com/go/storage v1.60.0/go.mod h1:q+5196hXfejkctrnx+VYU8RKQr/L3c0cBIlrjmiAKE0=
 cloud.google.com/go/trace v1.11.7 h1:kDNDX8JkaAG3R2nq1lIdkb7FCSi1rCmsEtKVsty7p+U=
 cloud.google.com/go/trace v1.11.7/go.mod h1:TNn9d5V3fQVf6s4SCveVMIBS2LJUqo73GACmq/Tky0s=
 filippo.io/age v1.3.1 h1:hbzdQOJkuaMEpRCLSN1/C5DX74RPcNCk6oqhKMXmZi0=
@@ -54,14 +62,14 @@ github.com/Binject/universal v0.0.0-20220519011857-bea739e758c0/go.mod h1:J3XDRl
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c h1:pxW6RcqyfI9/kWtOwnv/G+AzdKuy2ZrqINhenH4HyNs=
 github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0 h1:sBEjpZlNHzK1voKq9695PJSX2o5NEXl7/OL3coiIY0c=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0/go.mod h1:P4WPRUkOhJC13W//jWpyfJNDAIpvRbAUIYLX/4jtlE0=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.54.0 h1:lhhYARPUu3LmHysQ/igznQphfzynnqI3D75oUyw1HXk=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.54.0/go.mod h1:l9rva3ApbBpEJxSNYnwT9N4CDLrWgtq3u8736C5hyJw=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.54.0 h1:xfK3bbi6F2RDtaZFtUdKO3osOBIhNb+xTs8lFW6yx9o=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.54.0/go.mod h1:vB2GH9GAYYJTO3mEn8oYwzEdhlayZIdQz6zdzgUIRvA=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.54.0 h1:s0WlVbf9qpvkh1c/uDAPElam0WrL7fHRIidgZJ7UqZI=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.54.0/go.mod h1:Mf6O40IAyB9zR/1J8nGDDPirZQQPbYJni8Yisy7NTMc=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 h1:DHa2U07rk8syqvCge0QIGMCE1WxGj9njT44GH7zNJLQ=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0/go.mod h1:P4WPRUkOhJC13W//jWpyfJNDAIpvRbAUIYLX/4jtlE0=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 h1:UnDZ/zFfG1JhH/DqxIZYU/1CUAlTUScoXD/LcM2Ykk8=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0/go.mod h1:IA1C1U7jO/ENqm/vhi7V9YYpBsp+IMyqNrEN94N7tVc=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0 h1:7t/qx5Ost0s0wbA/VDrByOooURhp+ikYwv20i9Y07TQ=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0/go.mod h1:vB2GH9GAYYJTO3mEn8oYwzEdhlayZIdQz6zdzgUIRvA=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 h1:0s6TxfCu2KHkkZPnBfsQ2y5qia0jl3MMrmBhu3nCOYk=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0/go.mod h1:Mf6O40IAyB9zR/1J8nGDDPirZQQPbYJni8Yisy7NTMc=
 github.com/Jeffail/gabs v1.4.0 h1://5fYRRTq1edjfIrQGvdkcd22pkYUrHZ5YC/H2GJVAo=
 github.com/Jeffail/gabs v1.4.0/go.mod h1:6xMvQMK4k33lb7GUUpaAPh6nKMmemQeg5d4gn7/bOXc=
 github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ4pzQ=
@@ -112,44 +120,46 @@ github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0 h1:JjwxKkxzcBk4k8147g0e
 github.com/awgh/cppgo v0.0.0-20210224085512-3d24bca8edc0/go.mod h1:IbERvuyb387Hppp8hX0SQTFt/mkej8+OhuS8L0nC2CI=
 github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4 h1:cIAK2NNf2yafdgpFRNJrgZMwvy61BEVpGoHc2n4/yWs=
 github.com/awgh/rawreader v0.0.0-20200626064944-56820a9c6da4/go.mod h1:SalMPBCab3yuID8nIhLfzwoBV+lBRyaC7NhuN8qL8xE=
-github.com/aws/aws-sdk-go-v2 v1.41.0 h1:tNvqh1s+v0vFYdA1xq0aOJH+Y5cRyZ5upu6roPgPKd4=
-github.com/aws/aws-sdk-go-v2 v1.41.0/go.mod h1:MayyLB8y+buD9hZqkCW3kX1AKq07Y5pXxtgB+rRFhz0=
-github.com/aws/aws-sdk-go-v2/config v1.32.5 h1:pz3duhAfUgnxbtVhIK39PGF/AHYyrzGEyRD9Og0QrE8=
-github.com/aws/aws-sdk-go-v2/config v1.32.5/go.mod h1:xmDjzSUs/d0BB7ClzYPAZMmgQdrodNjPPhd6bGASwoE=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.5 h1:xMo63RlqP3ZZydpJDMBsH9uJ10hgHYfQFIk1cHDXrR4=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.5/go.mod h1:hhbH6oRcou+LpXfA/0vPElh/e0M3aFeOblE1sssAAEk=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.16 h1:80+uETIWS1BqjnN9uJ0dBUaETh+P1XwFy5vwHwK5r9k=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.16/go.mod h1:wOOsYuxYuB/7FlnVtzeBYRcjSRtQpAW0hCP7tIULMwo=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.16 h1:rgGwPzb82iBYSvHMHXc8h9mRoOUBZIGFgKb9qniaZZc=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.16/go.mod h1:L/UxsGeKpGoIj6DxfhOWHWQ/kGKcd4I1VncE4++IyKA=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.16 h1:1jtGzuV7c82xnqOVfx2F0xmJcOw5374L7N6juGW6x6U=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.16/go.mod h1:M2E5OQf+XLe+SZGmmpaI2yy+J326aFf6/+54PoxSANc=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 h1:WKuaxf++XKWlHWu9ECbMlha8WOEGm0OUEZqm4K/Gcfk=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4/go.mod h1:ZWy7j6v1vWGmPReu0iSGvRiise4YI5SkR3OHKTZ6Wuc=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4 h1:0ryTNEdJbzUCEWkVXEXoqlXV72J5keC1GvILMOuD00E=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.4/go.mod h1:HQ4qwNZh32C3CBeO6iJLQlgtMzqeG17ziAA/3KDJFow=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.16 h1:oHjJHeUy0ImIV0bsrX0X91GkV5nJAyv1l1CC9lnO0TI=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.16/go.mod h1:iRSNGgOYmiYwSCXxXaKb9HfOEj40+oTKn8pTxMlYkRM=
+github.com/aws/aws-sdk-go-v2 v1.41.3 h1:4kQ/fa22KjDt13QCy1+bYADvdgcxpfH18f0zP542kZA=
+github.com/aws/aws-sdk-go-v2 v1.41.3/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.5 h1:zWFmPmgw4sveAYi1mRqG+E/g0461cJ5M4bJ8/nc6d3Q=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.5/go.mod h1:nVUlMLVV8ycXSb7mSkcNu9e3v/1TJq2RTlrPwhYWr5c=
+github.com/aws/aws-sdk-go-v2/config v1.32.11 h1:ftxI5sgz8jZkckuUHXfC/wMUc8u3fG1vQS0plr2F2Zs=
+github.com/aws/aws-sdk-go-v2/config v1.32.11/go.mod h1:twF11+6ps9aNRKEDimksp923o44w/Thk9+8YIlzWMmo=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.11 h1:NdV8cwCcAXrCWyxArt58BrvZJ9pZ9Fhf9w6Uh5W3Uyc=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.11/go.mod h1:30yY2zqkMPdrvxBqzI9xQCM+WrlrZKSOpSJEsylVU+8=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.19 h1:INUvJxmhdEbVulJYHI061k4TVuS3jzzthNvjqvVvTKM=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.19/go.mod h1:FpZN2QISLdEBWkayloda+sZjVJL+e9Gl0k1SyTgcswU=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.19 h1:/sECfyq2JTifMI2JPyZ4bdRN77zJmr6SrS1eL3augIA=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.19/go.mod h1:dMf8A5oAqr9/oxOfLkC/c2LU/uMcALP0Rgn2BD5LWn0=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.19 h1:AWeJMk33GTBf6J20XJe6qZoRSJo0WfUhsMdUKhoODXE=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.19/go.mod h1:+GWrYoaAsV7/4pNHpwh1kiNLXkKaSoppxQq9lbH8Ejw=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.5 h1:clHU5fm//kWS1C2HgtgWxfQbFbx4b6rx+5jzhgX9HrI=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.5/go.mod h1:O3h0IK87yXci+kg6flUKzJnWeziQUKciKrLjcatSNcY=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.6 h1:XAq62tBTJP/85lFD5oqOOe7YYgWxY9LvWq8plyDvDVg=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.6/go.mod h1:x0nZssQ3qZSnIcePWLvcoFisRXJzcTVvYpAAdYX8+GI=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.19 h1:X1Tow7suZk9UCJHE1Iw9GMZJJl0dAnKXXP1NaSDHwmw=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.19/go.mod h1:/rARO8psX+4sfjUQXp5LLifjUt8DuATZ31WptNJTyQA=
 github.com/aws/aws-sdk-go-v2/service/ses v1.34.17 h1:XR7CtY988tck2Bhuy1JP4FsV8z0OAwjuh+gb7nAy8/M=
 github.com/aws/aws-sdk-go-v2/service/ses v1.34.17/go.mod h1:2CspeTVldnJdRixX36SzTZuoIpjyKlfeXyB7/JB5KGk=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.4 h1:HpI7aMmJ+mm1wkSHIA2t5EaFFv5EFYXePW30p1EIrbQ=
-github.com/aws/aws-sdk-go-v2/service/signin v1.0.4/go.mod h1:C5RdGMYGlfM0gYq/tifqgn4EbyX99V15P2V3R+VHbQU=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.7 h1:Y2cAXlClHsXkkOvWZFXATr34b0hxxloeQu/pAZz2row=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.7/go.mod h1:idzZ7gmDeqeNrSPkdbtMp9qWMgcBwykA7P7Rzh5DXVU=
 github.com/aws/aws-sdk-go-v2/service/sns v1.39.10 h1:wqErrLzV3iERQ7dbZbKQS0gOM6ngxZtmPwKyRGn+Krc=
 github.com/aws/aws-sdk-go-v2/service/sns v1.39.10/go.mod h1:OiwBtRz6QlQyt69WLBMvSiyfgI7cOd6xSJ9ThTMjI5M=
 github.com/aws/aws-sdk-go-v2/service/ssm v1.65.1 h1:TFg6XiS7EsHN0/jpV3eVNczZi/sPIVP5jxIs+euIESQ=
 github.com/aws/aws-sdk-go-v2/service/ssm v1.65.1/go.mod h1:OIezd9K0sM/64DDP4kXx/i0NdgXu6R5KE6SCsIPJsjc=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.7 h1:eYnlt6QxnFINKzwxP5/Ucs1vkG7VT3Iezmvfgc2waUw=
-github.com/aws/aws-sdk-go-v2/service/sso v1.30.7/go.mod h1:+fWt2UHSb4kS7Pu8y+BMBvJF0EWx+4H0hzNwtDNRTrg=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.12 h1:AHDr0DaHIAo8c9t1emrzAlVDFp+iMMKnPdYy6XO4MCE=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.12/go.mod h1:GQ73XawFFiWxyWXMHWfhiomvP3tXtdNar/fi8z18sx0=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.5 h1:SciGFVNZ4mHdm7gpD1dgZYnCuVdX1s+lFTg4+4DOy70=
-github.com/aws/aws-sdk-go-v2/service/sts v1.41.5/go.mod h1:iW40X4QBmUxdP+fZNOpfmkdMZqsovezbAeO+Ubiv2pk=
-github.com/aws/smithy-go v1.24.0 h1:LpilSUItNPFr1eY85RYgTIg5eIEPtvFbskaFcmmIUnk=
-github.com/aws/smithy-go v1.24.0/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
-github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
-github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
-github.com/aymanbagabas/go-udiff v0.4.0 h1:TKnLPh7IbnizJIBKFWa9mKayRUBQ9Kh1BPCk6w2PnYM=
-github.com/aymanbagabas/go-udiff v0.4.0/go.mod h1:0L9PGwj20lrtmEMeyw4WKJ/TMyDtvAoK9bf2u/mNo3w=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.12 h1:iSsvB9EtQ09YrsmIc44Heqlx5ByGErqhPK1ZQLppias=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.12/go.mod h1:fEWYKTRGoZNl8tZ77i61/ccwOMJdGxwOhWCkp6TXAr0=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.16 h1:EnUdUqRP1CNzt2DkV67tJx6XDN4xlfBFm+bzeNOQVb0=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.16/go.mod h1:Jic/xv0Rq/pFNCh3WwpH4BEqdbSAl+IyHro8LbibHD8=
+github.com/aws/aws-sdk-go-v2/service/sts v1.41.8 h1:XQTQTF75vnug2TXS8m7CVJfC2nniYPZnO1D4Np761Oo=
+github.com/aws/aws-sdk-go-v2/service/sts v1.41.8/go.mod h1:Xgx+PR1NUOjNmQY+tRMnouRp83JRM8pRMw/vCaVhPkI=
+github.com/aws/smithy-go v1.24.2 h1:FzA3bu/nt/vDvmnkg+R8Xl46gmzEDam6mZ1hzmwXFng=
+github.com/aws/smithy-go v1.24.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/aymanbagabas/go-udiff v0.4.1 h1:OEIrQ8maEeDBXQDoGCbbTTXYJMYRCRO1fnodZ12Gv5o=
+github.com/aymanbagabas/go-udiff v0.4.1/go.mod h1:0L9PGwj20lrtmEMeyw4WKJ/TMyDtvAoK9bf2u/mNo3w=
+github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuPk=
+github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
 github.com/bahlo/generic-list-go v0.2.0 h1:5sz/EEAK+ls5wF+NeqDpk5+iNdMDXrh3z3nPnH1Wvgk=
 github.com/bahlo/generic-list-go v0.2.0/go.mod h1:2KvAjgMlE5NNynlg/5iLrrCCZ2+5xWbdbCW3pNTGyYg=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
@@ -176,40 +186,38 @@ github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA
 github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/charmbracelet/bubbles v0.21.1-0.20250623103423-23b8fd6302d7 h1:JFgG/xnwFfbezlUnFMJy0nusZvytYysV4SCS2cYbvws=
-github.com/charmbracelet/bubbles v0.21.1-0.20250623103423-23b8fd6302d7/go.mod h1:ISC1gtLcVilLOf23wvTfoQuYbW2q0JevFxPfUzZ9Ybw=
-github.com/charmbracelet/bubbletea v1.3.10 h1:otUDHWMMzQSB0Pkc87rm691KZ3SWa4KUlvF9nRvCICw=
-github.com/charmbracelet/bubbletea v1.3.10/go.mod h1:ORQfo0fk8U+po9VaNvnV95UPWA1BitP1E0N6xJPlHr4=
+github.com/charmbracelet/anthropic-sdk-go v0.0.0-20260223140439-63879b0b8dab h1:J7XQLgl9sefgTnTGrmX3xqvp5o6MCiBzEjGv5igAlc4=
+github.com/charmbracelet/anthropic-sdk-go v0.0.0-20260223140439-63879b0b8dab/go.mod h1:hqlYqR7uPKOKfnNeicUbZp0Ps0GeYFlKYtwh5HGDCx8=
 github.com/charmbracelet/colorprofile v0.4.2 h1:BdSNuMjRbotnxHSfxy+PCSa4xAmz7szw70ktAtWRYrY=
 github.com/charmbracelet/colorprofile v0.4.2/go.mod h1:0rTi81QpwDElInthtrQ6Ni7cG0sDtwAd4C4le060fT8=
-github.com/charmbracelet/huh v0.8.0 h1:Xz/Pm2h64cXQZn/Jvele4J3r7DDiqFCNIVteYukxDvY=
-github.com/charmbracelet/huh v0.8.0/go.mod h1:5YVc+SlZ1IhQALxRPpkGwwEKftN/+OlJlnJYlDRFqN4=
-github.com/charmbracelet/huh/spinner v0.0.0-20251215014908-6f7d32faaff3 h1:KUeWGoKnmyrLaDIa0smE6pK5eFMZWNIxPGweQR12iLg=
-github.com/charmbracelet/huh/spinner v0.0.0-20251215014908-6f7d32faaff3/go.mod h1:OMqKat/mm9a/qOnpuNOPyYO9bPzRNnmzLnRZT5KYltg=
-github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=
-github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30=
 github.com/charmbracelet/ultraviolet v0.0.0-20260205113103-524a6607adb8 h1:eyFRbAmexyt43hVfeyBofiGSEmJ7krjLOYt/9CF5NKA=
 github.com/charmbracelet/ultraviolet v0.0.0-20260205113103-524a6607adb8/go.mod h1:SQpCTRNBtzJkwku5ye4S3HEuthAlGy2n9VXZnWkEW98=
 github.com/charmbracelet/x/ansi v0.11.6 h1:GhV21SiDz/45W9AnV2R61xZMRri5NlLnl6CVF7ihZW8=
 github.com/charmbracelet/x/ansi v0.11.6/go.mod h1:2JNYLgQUsyqaiLovhU2Rv/pb8r6ydXKS3NIttu3VGZQ=
-github.com/charmbracelet/x/cellbuf v0.0.15 h1:ur3pZy0o6z/R7EylET877CBxaiE1Sp1GMxoFPAIztPI=
-github.com/charmbracelet/x/cellbuf v0.0.15/go.mod h1:J1YVbR7MUuEGIFPCaaZ96KDl5NoS0DAWkskup+mOY+Q=
-github.com/charmbracelet/x/conpty v0.1.0 h1:4zc8KaIcbiL4mghEON8D72agYtSeIgq8FSThSPQIb+U=
-github.com/charmbracelet/x/conpty v0.1.0/go.mod h1:rMFsDJoDwVmiYM10aD4bH2XiRgwI7NYJtQgl5yskjEQ=
+github.com/charmbracelet/x/conpty v0.1.1 h1:s1bUxjoi7EpqiXysVtC+a8RrvPPNcNvAjfi4jxsAuEs=
+github.com/charmbracelet/x/conpty v0.1.1/go.mod h1:OmtR77VODEFbiTzGE9G1XiRJAga6011PIm4u5fTNZpk=
 github.com/charmbracelet/x/errors v0.0.0-20240508181413-e8d8b6e2de86 h1:JSt3B+U9iqk37QUU2Rvb6DSBYRLtWqFqfxf8l5hOZUA=
 github.com/charmbracelet/x/errors v0.0.0-20240508181413-e8d8b6e2de86/go.mod h1:2P0UgXMEa6TsToMSuFqKFQR+fZTO9CNGUNokkPatT/0=
+github.com/charmbracelet/x/exp/charmtone v0.0.0-20260109001716-2fbdffcb221f h1:OKFNbG2sSmgpQW9EC3gYNG+QrcQ4+wWYjzfmJvWkkDo=
+github.com/charmbracelet/x/exp/charmtone v0.0.0-20260109001716-2fbdffcb221f/go.mod h1:nsExn0DGyX0lh9LwLHTn2Gg+hafdzfSXnC+QmEJTZFY=
 github.com/charmbracelet/x/exp/golden v0.0.0-20250806222409-83e3a29d542f h1:pk6gmGpCE7F3FcjaOEKYriCvpmIN4+6OS/RD0vm4uIA=
 github.com/charmbracelet/x/exp/golden v0.0.0-20250806222409-83e3a29d542f/go.mod h1:IfZAMTHB6XkZSeXUqriemErjAWCCzT0LwjKFYCZyw0I=
+github.com/charmbracelet/x/exp/ordered v0.1.0 h1:55/qLwjIh0gL0Vni+QAWk7T/qRVP6sBf+2agPBgnOFE=
+github.com/charmbracelet/x/exp/ordered v0.1.0/go.mod h1:5UHwmG+is5THxMyCJHNPCn2/ecI07aKNrW+LcResjJ8=
+github.com/charmbracelet/x/exp/slice v0.0.0-20250904123553-b4e2667e5ad5 h1:DTSZxdV9qQagD4iGcAt9RgaRBZtJl01bfKgdLzUzUPI=
+github.com/charmbracelet/x/exp/slice v0.0.0-20250904123553-b4e2667e5ad5/go.mod h1:vI5nDVMWi6veaYH+0Fmvpbe/+cv/iJfMntdh+N0+Tms=
 github.com/charmbracelet/x/exp/strings v0.0.0-20240722160745-212f7b056ed0 h1:qko3AQ4gK1MTS/de7F5hPGx6/k1u0w4TeYmBFwzYVP4=
 github.com/charmbracelet/x/exp/strings v0.0.0-20240722160745-212f7b056ed0/go.mod h1:pBhA0ybfXv6hDjQUZ7hk1lVxBiUbupdw5R31yPUViVQ=
+github.com/charmbracelet/x/json v0.2.0 h1:DqB+ZGx2h+Z+1s98HOuOyli+i97wsFQIxP2ZQANTPrQ=
+github.com/charmbracelet/x/json v0.2.0/go.mod h1:opFIflx2YgXgi49xVUu8gEQ21teFAxyMwvOiZhIvWNM=
 github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=
 github.com/charmbracelet/x/term v0.2.2/go.mod h1:kF8CY5RddLWrsgVwpw4kAa6TESp6EB5y3uxGLeCqzAI=
 github.com/charmbracelet/x/termios v0.1.1 h1:o3Q2bT8eqzGnGPOYheoYS8eEleT5ZVNYNy8JawjaNZY=
 github.com/charmbracelet/x/termios v0.1.1/go.mod h1:rB7fnv1TgOPOyyKRJ9o+AsTU/vK5WHJ2ivHeut/Pcwo=
 github.com/charmbracelet/x/windows v0.2.2 h1:IofanmuvaxnKHuV04sC0eBy/smG6kIKrWG2/jYn2GuM=
 github.com/charmbracelet/x/windows v0.2.2/go.mod h1:/8XtdKZzedat74NQFn0NGlGL4soHB0YQZrETF96h75k=
-github.com/charmbracelet/x/xpty v0.1.2 h1:Pqmu4TEJ8KeA9uSkISKMU3f+C1F6OGBn8ABuGlqCbtI=
-github.com/charmbracelet/x/xpty v0.1.2/go.mod h1:XK2Z0id5rtLWcpeNiMYBccNNBrP2IJnzHI0Lq13Xzq4=
+github.com/charmbracelet/x/xpty v0.1.3 h1:eGSitii4suhzrISYH50ZfufV3v085BXQwIytcOdFSsw=
+github.com/charmbracelet/x/xpty v0.1.3/go.mod h1:poPYpWuLDBFCKmKLDnhBp51ATa0ooD8FhypRwEFtH3Y=
 github.com/cheggaaa/pb/v3 v3.1.7 h1:2FsIW307kt7A/rz/ZI2lvPO+v3wKazzE4K/0LtTWsOI=
 github.com/cheggaaa/pb/v3 v3.1.7/go.mod h1:/Ji89zfVPeC/u5j8ukD0MBPHt2bzTYp74lQ7KlgFWTQ=
 github.com/chromedp/cdproto v0.0.0-20250803210736-d308e07a266d h1:ZtA1sedVbEW7EW80Iz2GR3Ye6PwbJAJXjv7D74xG6HU=
@@ -229,8 +237,8 @@ github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3
 github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
 github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 h1:6xNmx7iTtyBRev0+D/Tv1FZd4SCg8axKApyNyRsAt/w=
-github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5/go.mod h1:KdCmV+x/BuvyMxRnYBlmVaq4OLiKW6iRQfvC62cvdkI=
+github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 h1:aBangftG7EVZoUb69Os8IaYg++6uMOdKK83QtkkvJik=
+github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2/go.mod h1:qwXFYgsP6T7XnJtbKlf1HP8AjxZZyzxMmc+Lq5GjlU4=
 github.com/coder/websocket v1.8.14 h1:9L0p0iKiNOibykf283eHkKUHHrpG7f65OE3BhhO7v9g=
 github.com/coder/websocket v1.8.14/go.mod h1:NX3SzP+inril6yawo5CQXx8+fk145lPDC6pumgx0mVg=
 github.com/coreos/go-iptables v0.8.0 h1:MPc2P89IhuVpLI7ETL/2tx3XZ61VeICZjYqDEgNsPRc=
@@ -268,6 +276,8 @@ github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYC
 github.com/dlclark/regexp2 v1.4.0/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55kozfMjCc=
 github.com/dlclark/regexp2 v1.11.5 h1:Q/sSnsKerHeCkc/jSTNq1oCm7KiVgUMZRDUoRu0JQZQ=
 github.com/dlclark/regexp2 v1.11.5/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/dnaeon/go-vcr v1.2.0 h1:zHCHvJYTMh1N7xnV7zf1m1GPBF9Ad0Jk/whtQ1663qI=
+github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ=
 github.com/drswork/go-twitter v0.0.0-20221107160839-dea1b6ed53d7 h1:uh1GSejOhVPRQmoXZxY82TiewZB8QXiaP1skL7Nun3Y=
 github.com/drswork/go-twitter v0.0.0-20221107160839-dea1b6ed53d7/go.mod h1:ncTaGuXc5v7AuiVekeJ0Nwh8Bf4cudukoj0qM/15UZE=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
@@ -275,17 +285,15 @@ github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+m
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/go-control-plane v0.13.5-0.20251024222203-75eaa193e329 h1:K+fnvUM0VZ7ZFJf0n4L/BRlnsb9pL/GuDG6FqaH+PwM=
-github.com/envoyproxy/go-control-plane v0.13.5-0.20251024222203-75eaa193e329/go.mod h1:Alz8LEClvR7xKsrq3qzoc4N0guvVNSS8KmSChGYr9hs=
-github.com/envoyproxy/go-control-plane/envoy v1.36.0 h1:yg/JjO5E7ubRyKX3m07GF3reDNEnfOboJ0QySbH736g=
-github.com/envoyproxy/go-control-plane/envoy v1.36.0/go.mod h1:ty89S1YCCVruQAm9OtKeEkQLTb+Lkz0k8v9W0Oxsv98=
+github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA=
+github.com/envoyproxy/go-control-plane v0.14.0/go.mod h1:NcS5X47pLl/hfqxU70yPwL9ZMkUlwlKxtAohpi2wBEU=
+github.com/envoyproxy/go-control-plane/envoy v1.37.0 h1:u3riX6BoYRfF4Dr7dwSOroNfdSbEPe9Yyl09/B6wBrQ=
+github.com/envoyproxy/go-control-plane/envoy v1.37.0/go.mod h1:DReE9MMrmecPy+YvQOAOHNYMALuowAnbjjEMkkWOi6A=
 github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 h1:/G9QYbddjL25KvtKTv3an9lx6VBE2cnb8wp1vEGNYGI=
 github.com/envoyproxy/go-control-plane/ratelimit v0.1.0/go.mod h1:Wk+tMFAFbCXaJPzVVHnPgRKdUdwW/KdbRt94AzgRee4=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/envoyproxy/protoc-gen-validate v1.3.0 h1:TvGH1wof4H33rezVKWSpqKz5NXWg5VPuZ0uONDT6eb4=
-github.com/envoyproxy/protoc-gen-validate v1.3.0/go.mod h1:HvYl7zwPa5mffgyeTUHA9zHIH36nmrm7oCbo4YKoSWA=
-github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=
-github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
+github.com/envoyproxy/protoc-gen-validate v1.3.3 h1:MVQghNeW+LZcmXe7SY1V36Z+WFMDjpqGAGacLe2T0ds=
+github.com/envoyproxy/protoc-gen-validate v1.3.3/go.mod h1:TsndJ/ngyIdQRhMcVVGDDHINPLWB7C82oDArY51KfB0=
 github.com/fatih/color v1.12.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
 github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
 github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
@@ -297,8 +305,8 @@ github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHk
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
-github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
-github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
 github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/gaissmai/bart v0.25.0 h1:eqiokVPqM3F94vJ0bTHXHtH91S8zkKL+bKh+BsGOsJM=
@@ -315,8 +323,8 @@ github.com/go-chi/chi/v5 v5.2.3 h1:WQIt9uxdsAbgIYgid+BpYc+liqQZGMHRaUwp0JUcvdE=
 github.com/go-chi/chi/v5 v5.2.3/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
 github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs=
 github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
-github.com/go-json-experiment/json v0.0.0-20250910080747-cc2cfa0554c3 h1:02WINGfSX5w0Mn+F28UyRoSt9uvMhKguwWMlOAh6U/0=
-github.com/go-json-experiment/json v0.0.0-20250910080747-cc2cfa0554c3/go.mod h1:uNVvRXArCGbZ508SxYYTC5v1JWoz2voff5pm25jU1Ok=
+github.com/go-json-experiment/json v0.0.0-20251027170946-4849db3c2f7e h1:Lf/gRkoycfOBPa42vU2bbgPurFong6zXeFtPoxholzU=
+github.com/go-json-experiment/json v0.0.0-20251027170946-4849db3c2f7e/go.mod h1:uNVvRXArCGbZ508SxYYTC5v1JWoz2voff5pm25jU1Ok=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
 github.com/go-lark/lark v1.16.0 h1:U6BwkLM9wrZedSM7cIiMofganr8PCvJN+M75w2lf2Gg=
 github.com/go-lark/lark v1.16.0/go.mod h1:6ltbSztPZRT6IaO9ZIQyVaY5pVp/KeMizDYtfZkU+vM=
@@ -346,6 +354,8 @@ github.com/go-telegram-bot-api/telegram-bot-api v4.6.4+incompatible h1:2cauKuaEL
 github.com/go-telegram-bot-api/telegram-bot-api v4.6.4+incompatible/go.mod h1:qf9acutJ8cwBUhm1bqgz6Bei9/C/c93FPDljKWwsOgM=
 github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
 github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
+github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
+github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/go4org/plan9netshell v0.0.0-20250324183649-788daa080737 h1:cf60tHxREO3g1nroKr2osU3JWZsJzkfi7rEg+oAB0Lo=
 github.com/go4org/plan9netshell v0.0.0-20250324183649-788daa080737/go.mod h1:MIS0jDzbU/vuM9MC4YnBITCv+RYuTRq8dJzmCrFsK9g=
 github.com/gobwas/httphead v0.1.0 h1:exrUm0f4YX0L7EBwZHuCF4GDp8aJfVeBrlLQrs6NqWU=
@@ -354,6 +364,8 @@ github.com/gobwas/pool v0.2.1 h1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=
 github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
 github.com/gobwas/ws v1.4.0 h1:CTaoG1tojrh4ucGPcoJFiAQUAsEWekEWvLy7GsVNqGs=
 github.com/gobwas/ws v1.4.0/go.mod h1:G3gNqMNtPppf5XUz7O4shetPpcZ1VJ7zt18dlUeakrc=
+github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
+github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/godbus/dbus/v5 v5.1.1-0.20230522191255-76236955d466 h1:sQspH8M4niEijh3PFscJRLDnkL547IeP7kpPe3uUhEg=
 github.com/godbus/dbus/v5 v5.1.1-0.20230522191255-76236955d466/go.mod h1:ZiQxhyQ+bbbfxUKVvjfO498oPYvtYhZzycal3G/NHmU=
@@ -413,12 +425,14 @@ github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0
 github.com/google/uuid v0.0.0-20171113160352-8c31c18f31ed/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.3.7 h1:zrn2Ee/nWmHulBx5sAVrGgAa0f2/R35S4DJwfFaUPFQ=
-github.com/googleapis/enterprise-certificate-proxy v0.3.7/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
-github.com/googleapis/gax-go/v2 v2.15.0 h1:SyjDc1mGgZU5LncH8gimWo9lW1DtIfPibOG81vgd/bo=
-github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc=
+github.com/googleapis/enterprise-certificate-proxy v0.3.12 h1:Fg+zsqzYEs1ZnvmcztTYxhgCBsx3eEhEwQ1W/lHq/sQ=
+github.com/googleapis/enterprise-certificate-proxy v0.3.12/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg=
+github.com/googleapis/gax-go/v2 v2.17.0 h1:RksgfBpxqff0EZkDWYuz9q/uWsTVz+kf43LsZ1J6SMc=
+github.com/googleapis/gax-go/v2 v2.17.0/go.mod h1:mzaqghpQp4JDh3HvADwrat+6M3MOIDp5YKHhb9PAgDY=
 github.com/gopackage/ddp v0.0.0-20170117053602-652027933df4 h1:4EZlYQIiyecYJlUbVkFXCXHz1QPhVXcHnQKAzBTPfQo=
 github.com/gopackage/ddp v0.0.0-20170117053602-652027933df4/go.mod h1:lEO7XoHJ/xNRBCxrn4h/CEB67h0kW1B0t4ooP2yrjUA=
+github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
+github.com/gorilla/css v1.0.1/go.mod h1:BvnYkspnSzMmwRK+b8/xgNPLiIuNZr6vbZBTPQ2A3b0=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
 github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
@@ -470,8 +484,9 @@ github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD
 github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
 github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
 github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
-github.com/joho/godotenv v1.3.0 h1:Zjp+RcGpHhGlrMbJzXTrZZPrWj+1vfm90La1wgB6Bhc=
 github.com/joho/godotenv v1.3.0/go.mod h1:7hK45KPybAkOC6peb+G5yklZfMxEjkZhHbwpqxOKXbg=
+github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
+github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
 github.com/jordan-wright/email v4.0.1-0.20210109023952-943e75fe5223+incompatible h1:jdpOPRN1zP63Td1hDQbZW73xKmzDvZHzVdNYxhnTMDA=
 github.com/jordan-wright/email v4.0.1-0.20210109023952-943e75fe5223+incompatible/go.mod h1:1c7szIrayyPPB/987hsnvNzLushdWf4o/79s3P08L8A=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
@@ -479,6 +494,14 @@ github.com/jsimonetti/rtnetlink v1.4.2 h1:Df9w9TZ3npHTyDn0Ev9e1uzmN2odmXd0QX+J5G
 github.com/jsimonetti/rtnetlink v1.4.2/go.mod h1:92s6LJdE+1iOrw+F2/RO7LYI2Qd8pPpFNNUYW06gcoM=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/kaptinlin/go-i18n v0.2.3 h1:jyN/YOXXLcnGRBLdU+a8+6782B97fWE5aQqAHtvvk8Q=
+github.com/kaptinlin/go-i18n v0.2.3/go.mod h1:O+Ax4HkMO0Jt4OaP4E4WCx0PAADeWkwk8Jgt9bjAU1w=
+github.com/kaptinlin/jsonpointer v0.4.9 h1:o//bYf4PCvnMJIIX8bIg77KB6DO3wBPAabRyPRKh680=
+github.com/kaptinlin/jsonpointer v0.4.9/go.mod h1:9y0LgXavlmVE5FSHShY5LRlURJJVhbyVJSRWkilrTqA=
+github.com/kaptinlin/jsonschema v0.6.10 h1:CYded7nrwVu7pU1GaIjtd9dSzgqZjh7+LTKFaWqS08I=
+github.com/kaptinlin/jsonschema v0.6.10/go.mod h1:ZXZ4K5KrRmCCF1i6dgvBsQifl+WTb8XShKj0NpQNrz8=
+github.com/kaptinlin/messageformat-go v0.4.9 h1:FR5j5n4aL4nG0afKn9vvANrKxLu7HjmbhJnw5ogIwAQ=
+github.com/kaptinlin/messageformat-go v0.4.9/go.mod h1:qZzrGrlvWDz2KyyvN3dOWcK9PVSRV1BnfnNU+zB/RWc=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
 github.com/kbinani/screenshot v0.0.0-20250624051815-089614a94018 h1:NQYgMY188uWrS+E/7xMVpydsI48PMHcc7SfR4OxkDF4=
@@ -491,8 +514,10 @@ github.com/kevinburke/twilio-go v0.0.0-20250718182727-5fe7adc01f29 h1:AZ5D/KUEro
 github.com/kevinburke/twilio-go v0.0.0-20250718182727-5fe7adc01f29/go.mod h1:Z7bqFOTtIqCCIO+uPtod7Fp3gPMR8aTCcp5Pe8D+3fE=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.18.1 h1:bcSGx7UbpBqMChDtsF28Lw6v/G94LPrrbMbdC3JH2co=
-github.com/klauspost/compress v1.18.1/go.mod h1:ZQFFVG+MdnR0P+l6wpXgIL4NTtwiKIdBnrBd8Nrxr+0=
+github.com/klauspost/compress v1.18.4 h1:RPhnKRAQ4Fh8zU2FY/6ZFDwTVTxgJ/EMydqSTzE9a2c=
+github.com/klauspost/compress v1.18.4/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
+github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
+github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kortschak/wol v0.0.0-20200729010619-da482cc4850a h1:+RR6SqnTkDLWyICxS1xpjCi/3dhyV+TgZwA6Ww3KncQ=
 github.com/kortschak/wol v0.0.0-20200729010619-da482cc4850a/go.mod h1:YTtCCM3ryyfiu4F7t8HQ1mxvp1UBdWM2r6Xa+nGWvDk=
@@ -528,6 +553,8 @@ github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/mark3labs/mcp-go v0.43.2 h1:21PUSlWWiSbUPQwXIJ5WKlETixpFpq+WBpbMGDSVy/I=
 github.com/mark3labs/mcp-go v0.43.2/go.mod h1:YnJfOL382MIWDx1kMY+2zsRHU/q78dBg9aFb8W6Thdw=
+github.com/mark3labs/mcp-go v0.45.0 h1:s0S8qR/9fWaQ3pHxz7pm1uQ0DrswoSnRIxKIjbiQtkc=
+github.com/mark3labs/mcp-go v0.45.0/go.mod h1:YnJfOL382MIWDx1kMY+2zsRHU/q78dBg9aFb8W6Thdw=
 github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
@@ -537,8 +564,6 @@ github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/
 github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
-github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
 github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/mattn/go-runewidth v0.0.20 h1:WcT52H91ZUAwy8+HUkdM3THM6gXqXuLJi9O3rjcQQaQ=
 github.com/mattn/go-runewidth v0.0.20/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
@@ -552,6 +577,8 @@ github.com/mdlayher/sdnotify v1.0.0 h1:Ma9XeLVN/l0qpyx1tNeMSeTjCPH6NtuD6/N9XdTlQ
 github.com/mdlayher/sdnotify v1.0.0/go.mod h1:HQUmpM4XgYkhDLtd+Uad8ZFK1T9D5+pNxnXQjCeJlGE=
 github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos=
 github.com/mdlayher/socket v0.5.1/go.mod h1:TjPLHI1UgwEv5J1B5q0zTZq12A/6H7nKmtTanQE37IQ=
+github.com/microcosm-cc/bluemonday v1.0.27 h1:MpEUotklkwCSLeH+Qdx1VJgNqLlpY2KXwXFM08ygZfk=
+github.com/microcosm-cc/bluemonday v1.0.27/go.mod h1:jFi9vgW+H7c3V0lb6nR74Ib/DIB5OBs92Dimizgw2cA=
 github.com/miekg/dns v1.1.70 h1:DZ4u2AV35VJxdD9Fo9fIWm119BsQL5cZU1cQ9s0LkqA=
 github.com/miekg/dns v1.1.70/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
 github.com/mileusna/viber v1.0.1 h1:gWB6/lKoWYVxkH0Jb8jRnGIRZ/9DEM7RBZRJHRfdYWs=
@@ -577,12 +604,8 @@ github.com/moloch--/readline v0.0.0-20260129035512-cb5b3e87d51a h1:Q69DxLWF+Z8oI
 github.com/moloch--/readline v0.0.0-20260129035512-cb5b3e87d51a/go.mod h1:CwNkh9BmFBBCSO6mdDaNWb34rOqQsI9eYbxyqvOEazY=
 github.com/moloch--/sgn v0.0.5 h1:92GFaRpe+353uhqzFiNKXKgmTiD4dBxnvb8gd4MaV/g=
 github.com/moloch--/sgn v0.0.5/go.mod h1:FyWfCtdynywgLmVR71vTJztZ3WkGSkR91Y4EOijUutE=
-github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=
-github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6/go.mod h1:CJlz5H+gyd6CUWT45Oy4q24RdLyn7Md9Vj2/ldJBSIo=
 github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
 github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
-github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
-github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/nbio/st v0.0.0-20140626010706-e9e8d9816f32/go.mod h1:9wM+0iRr9ahx58uYLpLIr5fm8diHn0JbqRycJi6w0Ms=
@@ -617,9 +640,13 @@ github.com/onsi/gomega v1.17.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAl
 github.com/onsi/gomega v1.18.1/go.mod h1:0q+aL8jAiMXy9hbwj2mr5GziHiwhAIQpFmmtT5hitRs=
 github.com/onsi/gomega v1.19.0 h1:4ieX6qQjPP/BfC3mpsAtIGGlxTWPeA3Inl/7DtXw1tw=
 github.com/onsi/gomega v1.19.0/go.mod h1:LY+I3pBVzYsTBU1AnDwOSxaYi9WoWiqgwooUqq9yPro=
+github.com/openai/openai-go/v2 v2.7.1 h1:/tfvTJhfv7hTSL8mWwc5VL4WLLSDL5yn9VqVykdu9r8=
+github.com/openai/openai-go/v2 v2.7.1/go.mod h1:jrJs23apqJKKbT+pqtFgNKpRju/KP9zpUTZhz3GElQE=
 github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
 github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde h1:x0TT0RDC7UhAVbbWWBzr41ElhJx5tXPWkIHA2HWPRuw=
 github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde/go.mod h1:nZgzbfBr3hhjoZnS66nKrHmduYNpc34ny7RK4z5/HM0=
+github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
+github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pierrec/lz4/v4 v4.1.21 h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ=
 github.com/pierrec/lz4/v4 v4.1.21/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pires/go-proxyproto v0.8.1 h1:9KEixbdJfhrbtjpz/ZwCdWDD2Xem0NZ38qMYaASJgp0=
@@ -669,8 +696,8 @@ github.com/silenceper/wechat/v2 v2.1.11/go.mod h1:7Iu3EhQYVtDUJAj+ZVRy8yom75ga7a
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
-github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
+github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
 github.com/slack-go/slack v0.17.3 h1:zV5qO3Q+WJAQ/XwbGfNFrRMaJ5T/naqaonyPV/1TP4g=
 github.com/slack-go/slack v0.17.3/go.mod h1:X+UqOufi3LYQHDnMG1vxf0J8asC6+WllXrVrhl8/Prk=
 github.com/sliverarmory/beignet v0.0.3 h1:ssR6AK9lirVulHZhQMyMmVAi0FcFwWxlh9LwKCJQ4X0=
@@ -788,30 +815,39 @@ github.com/yosida95/uritemplate/v3 v3.0.2/go.mod h1:ILOh0sOhIJR3+L/8afwt/kE++YT0
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/yuin/goldmark v1.7.1/go.mod h1:uzxRWxtg69N339t3louHJ7+O03ezfj6PlliRlaOzY1E=
+github.com/yuin/goldmark v1.7.13 h1:GPddIs617DnBLFFVJFgpo1aBfe/4xcvMc3SB5t/D0pA=
+github.com/yuin/goldmark v1.7.13/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
+github.com/yuin/goldmark-emoji v1.0.5 h1:EMVWyCGPlXJfUXBXpuMu+ii3TIaxbVBnEX9uaDC4cIk=
+github.com/yuin/goldmark-emoji v1.0.5/go.mod h1:tTkZEbwu5wkPmgTcitqddVxY9osFZiavD+r4AzQrh1U=
 github.com/yuin/gopher-lua v0.0.0-20220504180219-658193537a64 h1:5mLPGnFdSsevFRFc9q3yYbBkB6tsm4aCwwQV/j1JQAQ=
 github.com/yuin/gopher-lua v0.0.0-20220504180219-658193537a64/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
+github.com/zeebo/assert v1.3.0 h1:g7C04CbJuIDKNPFHmsk4hwZDO5O+kntRxzaUoNXj+IQ=
+github.com/zeebo/assert v1.3.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
+github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=
+github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=
 go.mau.fi/util v0.9.3 h1:aqNF8KDIN8bFpFbybSk+mEBil7IHeBwlujfyTnvP0uU=
 go.mau.fi/util v0.9.3/go.mod h1:krWWfBM1jWTb5f8NCa2TLqWMQuM81X7TGQjhMjBeXmQ=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/detectors/gcp v1.39.0 h1:kWRNZMsfBHZ+uHjiH4y7Etn2FK26LAGkNFw7RHv1DhE=
-go.opentelemetry.io/contrib/detectors/gcp v1.39.0/go.mod h1:t/OGqzHBa5v6RHZwrDBJ2OirWc+4q/w2fTbLZwAKjTk=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.64.0 h1:RN3ifU8y4prNWeEnQp2kRRHz8UwonAEYZl8tUzHEXAk=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.64.0/go.mod h1:habDz3tEWiFANTo6oUE99EmaFUrCNYAAg3wiVmusm70=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0 h1:ssfIgGNANqpVFCndZvcuyKbl0g+UAVcbBcqGkG28H0Y=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0/go.mod h1:GQ/474YrbE4Jx8gZ4q5I4hrhUzM6UPzyrqJYV2AqPoQ=
-go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48=
-go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.38.0 h1:wm/Q0GAAykXv83wzcKzGGqAnnfLFyFe7RslekZuv+VI=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.38.0/go.mod h1:ra3Pa40+oKjvYh+ZD3EdxFZZB0xdMfuileHAm4nNN7w=
-go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0=
-go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs=
-go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18=
-go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE=
-go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8=
-go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew=
-go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI=
-go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA=
+go.opentelemetry.io/contrib/detectors/gcp v1.40.0 h1:Awaf8gmW99tZTOWqkLCOl6aw1/rxAWVlHsHIZ3fT2sA=
+go.opentelemetry.io/contrib/detectors/gcp v1.40.0/go.mod h1:99OY9ZCqyLkzJLTh5XhECpLRSxcZl+ZDKBEO+jMBFR4=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.65.0 h1:XmiuHzgJt067+a6kwyAzkhXooYVv3/TOw9cM2VfJgUM=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.65.0/go.mod h1:KDgtbWKTQs4bM+VPUr6WlL9m/WXcmkCcBlIzqxPGzmI=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0 h1:7iP2uCb7sGddAr30RRS6xjKy7AZ2JtTOPA3oolgVSw8=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.65.0/go.mod h1:c7hN3ddxs/z6q9xwvfLPk+UHlWRQyaeR1LdgfL/66l0=
+go.opentelemetry.io/otel v1.40.0 h1:oA5YeOcpRTXq6NN7frwmwFR0Cn3RhTVZvXsP4duvCms=
+go.opentelemetry.io/otel v1.40.0/go.mod h1:IMb+uXZUKkMXdPddhwAHm6UfOwJyh4ct1ybIlV14J0g=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.39.0 h1:5gn2urDL/FBnK8OkCfD1j3/ER79rUuTYmCvlXBKeYL8=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.39.0/go.mod h1:0fBG6ZJxhqByfFZDwSwpZGzJU671HkwpWaNe2t4VUPI=
+go.opentelemetry.io/otel/metric v1.40.0 h1:rcZe317KPftE2rstWIBitCdVp89A2HqjkxR3c11+p9g=
+go.opentelemetry.io/otel/metric v1.40.0/go.mod h1:ib/crwQH7N3r5kfiBZQbwrTge743UDc7DTFVZrrXnqc=
+go.opentelemetry.io/otel/sdk v1.40.0 h1:KHW/jUzgo6wsPh9At46+h4upjtccTmuZCFAc9OJ71f8=
+go.opentelemetry.io/otel/sdk v1.40.0/go.mod h1:Ph7EFdYvxq72Y8Li9q8KebuYUr2KoeyHx0DRMKrYBUE=
+go.opentelemetry.io/otel/sdk/metric v1.40.0 h1:mtmdVqgQkeRxHgRv4qhyJduP3fYJRMX4AtAlbuWdCYw=
+go.opentelemetry.io/otel/sdk/metric v1.40.0/go.mod h1:4Z2bGMf0KSK3uRjlczMOeMhKU2rhUqdWNoKcYrtcBPg=
+go.opentelemetry.io/otel/trace v1.40.0 h1:WA4etStDttCSYuhwvEa8OP8I5EWu24lkOzp+ZYblVjw=
+go.opentelemetry.io/otel/trace v1.40.0/go.mod h1:zeAhriXecNGP/s2SEG3+Y8X9ujcJOTqQ5RgdEJcawiA=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
 go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
@@ -832,11 +868,13 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
-golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
+golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
+golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
+golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
+golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20251209150349-8475f28825e9 h1:MDfG8Cvcqlt9XXrmEiD4epKn7VJHZO84hejP9Jmp0MM=
-golang.org/x/exp v0.0.0-20251209150349-8475f28825e9/go.mod h1:EPRbTFwzwjXj9NpYyyrvenVh9Y+GFeEvMNh7Xuz7xgU=
+golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa h1:Zt3DZoOFFYkKhDT3v7Lm9FDMEV06GpzjG2jrqW+QTE0=
+golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa/go.mod h1:K79w1Vqn7PoiZn+TkNpx3BUWUQksGO3JcVX6qIjytmA=
 golang.org/x/exp/typeparams v0.0.0-20240314144324-c7f7c6466f7f h1:phY1HzDcf18Aq9A8KkmRtY9WvOFIxN8wgfvy6Zm1DV8=
 golang.org/x/exp/typeparams v0.0.0-20240314144324-c7f7c6466f7f/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
 golang.org/x/image v0.27.0 h1:C8gA4oWU/tKkdCfYT6T2u4faJu3MeNS5O8UPWlPF61w=
@@ -852,8 +890,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
-golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
+golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
+golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
 golang.org/x/net v0.0.0-20171115151908-9dfe39835686/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -875,11 +913,13 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
-golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
+golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
+golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
+golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
+golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
-golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
+golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
+golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20171101214715-fd80eb99c8f6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -895,6 +935,8 @@ golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
 golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190204203706-41f3e6584952/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -918,7 +960,6 @@ golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210217105451-b926d437f341/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220330033206-e17cdc41300f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -934,8 +975,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
-golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -945,8 +986,10 @@ golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q=
-golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg=
+golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
+golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
+golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
+golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -960,8 +1003,10 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
-golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
+golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
+golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
+golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
+golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -978,8 +1023,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA=
-golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
+golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
+golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -994,28 +1039,34 @@ golang.zx2c4.com/wireguard/windows v0.5.3 h1:On6j2Rpn3OEMXqBq00QEDC7bWSZrPIHKIus
 golang.zx2c4.com/wireguard/windows v0.5.3/go.mod h1:9TEe8TJmtwyQebdFwAkEWOPr3prrtqm+REGFifP60hI=
 gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
 gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
-google.golang.org/api v0.257.0 h1:8Y0lzvHlZps53PEaw+G29SsQIkuKrumGWs9puiexNAA=
-google.golang.org/api v0.257.0/go.mod h1:4eJrr+vbVaZSqs7vovFd1Jb/A6ml6iw2e6FBYf3GAO4=
+google.golang.org/api v0.269.0 h1:qDrTOxKUQ/P0MveH6a7vZ+DNHxJQjtGm/uvdbdGXCQg=
+google.golang.org/api v0.269.0/go.mod h1:N8Wpcu23Tlccl0zSHEkcAZQKDLdquxK+l9r2LkwAauE=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine/v2 v2.0.6 h1:LvPZLGuchSBslPBp+LAhihBeGSiRh1myRoYK4NtuBIw=
 google.golang.org/appengine/v2 v2.0.6/go.mod h1:WoEXGoXNfa0mLvaH5sV3ZSGXwVmy8yf7Z1JKf3J3wLI=
+google.golang.org/genai v1.49.0 h1:Se+QJaH2GYK1aaR1o5S38mlU2GD5FnVvP76nfkV7LH0=
+google.golang.org/genai v1.49.0/go.mod h1:A3kkl0nyBjyFlNjgxIwKq70julKbIxpSxqKO5gw/gmk=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20200423170343-7949de9c1215/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20251202230838-ff82c1b0f217 h1:GvESR9BIyHUahIb0NcTum6itIWtdoglGX+rnGxm2934=
-google.golang.org/genproto v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:yJ2HH4EHEDTd3JiLmhds6NkJ17ITVYOdV3m3VKOnws0=
-google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 h1:fCvbg86sFXwdrl5LgVcTEvNC+2txB5mgROGmRL5mrls=
-google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:+rXWjjaukWZun3mLfjmVnQi18E1AsFbDN9QdJ5YXLto=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 h1:gRkg/vSppuSQoDjxyiGfN4Upv/h/DQmIR10ZU8dh4Ww=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
+google.golang.org/genproto v0.0.0-20260226221140-a57be14db171 h1:RxhCsti413yL0IjU9dVvuTbCISo8gs3RW1jPMStck+4=
+google.golang.org/genproto v0.0.0-20260226221140-a57be14db171/go.mod h1:uhvzakVEqAuXU3TC2JCsxIRe5f77l+JySE3EqPoMyqM=
+google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 h1:tu/dtnW1o3wfaxCOjSLn5IRX4YDcJrtlpzYkhHhGaC4=
+google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171/go.mod h1:M5krXqk4GhBKvB596udGL3UyjL4I1+cTbK0orROM9ng=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260316180232-0b37fe3546d5 h1:aJmi6DVGGIStN9Mobk/tZOOQUBbj0BPjZjjnOdoZKts=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260316180232-0b37fe3546d5/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
-google.golang.org/grpc v1.77.0 h1:wVVY6/8cGA6vvffn+wWK5ToddbgdU3d8MNENr4evgXM=
-google.golang.org/grpc v1.77.0/go.mod h1:z0BY1iVj0q8E1uSQCjL9cppRj+gnZjzDnzV0dHhrNig=
+google.golang.org/grpc v1.79.1 h1:zGhSi45ODB9/p3VAawt9a+O/MULLl9dpizzNNpq7flY=
+google.golang.org/grpc v1.79.1/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
+google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=
+google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=

implant/sliver/handlers/pivot-handlers.go

@@ -119,17 +119,20 @@ func pivotStopListenerHandler(envelope *pb.Envelope, connection *transports.Conn
 }
 
 func pivotPeerEnvelopeHandler(envelope *pb.Envelope, connection *transports.Connection) {
-	sent, err := pivots.SendToPeer(envelope)
+	nextPeerID, sent, err := pivots.SendToPeer(envelope)
 	if !sent {
 		// {{if .Config.Debug}}
 		log.Printf("Send to peer failed, report peer failure upstream ...")
 		// {{end}}
+		if nextPeerID == 0 {
+			return
+		}
 		errStr := ""
 		if err != nil {
 			errStr = err.Error()
 		}
 		data, _ := proto.Marshal(&pb.PivotPeerFailure{
-			PeerID: pivots.MyPeerID,
+			PeerID: nextPeerID,
 			Type:   pb.PeerFailureType_SEND_FAILURE,
 			Err:    errStr,
 		})

implant/sliver/pivots/pivots.go

@@ -145,14 +145,14 @@ func StopListener(id uint32) {
 }
 
 // SendToPeer - Forward an envelope to a peer
-func SendToPeer(envelope *pb.Envelope) (bool, error) {
+func SendToPeer(envelope *pb.Envelope) (int64, bool, error) {
 	pivotPeerEnvelope := &pb.PivotPeerEnvelope{}
 	err := proto.Unmarshal(envelope.Data, pivotPeerEnvelope)
 	if err != nil {
 		// {{if .Config.Debug}}
 		log.Printf("Failed to unmarshal peer envelope: %s", err)
 		// {{end}}
-		return false, err
+		return 0, false, err
 	}
 
 	// {{if .Config.Debug}}
@@ -164,7 +164,7 @@ func SendToPeer(envelope *pb.Envelope) (bool, error) {
 		// {{if .Config.Debug}}
 		log.Printf("Failed to find next peer id: %s", err)
 		// {{end}}
-		return false, err
+		return 0, false, err
 	}
 
 	sent := false // Controls iteration of outer loop
@@ -183,9 +183,9 @@ func SendToPeer(envelope *pb.Envelope) (bool, error) {
 		// {{if .Config.Debug}}
 		log.Printf("Failed to find peer with id %d", nextPeerID)
 		// {{end}}
-		return false, errors.New("peer not found")
+		return nextPeerID, false, errors.New("peer not found")
 	}
-	return sent, nil
+	return nextPeerID, sent, nil
 }
 
 func findNextPeerID(pivotPeerEnvelope *pb.PivotPeerEnvelope) (int64, error) {

implant/sliver/version/linux_version_helpers.go

@@ -0,0 +1,139 @@
+package version
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"fmt"
+	"os"
+	"strings"
+)
+
+type linuxVersionInfo struct {
+	Sysname string
+	Release string
+	Version string
+	Machine string
+}
+
+func readLinuxOSRelease() string {
+	paths := []string{"/etc/os-release", "/usr/lib/os-release"}
+	for _, path := range paths {
+		data, err := os.ReadFile(path)
+		if err != nil {
+			continue
+		}
+		if osRelease := buildLinuxOSRelease(parseLinuxOSRelease(string(data))); osRelease != "" {
+			return osRelease
+		}
+	}
+	return ""
+}
+
+func parseLinuxOSRelease(content string) map[string]string {
+	values := make(map[string]string)
+	for _, line := range strings.Split(content, "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		key, value, ok := strings.Cut(line, "=")
+		if !ok || key == "" {
+			continue
+		}
+		key = strings.TrimSpace(key)
+		value = unescapeLinuxOSReleaseValue(unquoteLinuxOSReleaseValue(strings.TrimSpace(value)))
+		values[key] = value
+	}
+	return values
+}
+
+func unquoteLinuxOSReleaseValue(s string) string {
+	if len(s) < 2 {
+		return s
+	}
+	if (s[0] == '"' || s[0] == '\'') && s[0] == s[len(s)-1] {
+		return s[1 : len(s)-1]
+	}
+	return s
+}
+
+func unescapeLinuxOSReleaseValue(s string) string {
+	return strings.NewReplacer(
+		`\$`, `$`,
+		`\"`, `"`,
+		`\'`, `'`,
+		`\\`, `\`,
+		"\\`", "`",
+	).Replace(s)
+}
+
+func buildLinuxOSRelease(values map[string]string) string {
+	name := values["NAME"]
+	version := values["VERSION"]
+	if version == "" {
+		version = values["VERSION_ID"]
+	}
+	if name != "" && version != "" {
+		return fmt.Sprintf("%s %s", name, version)
+	}
+	if values["PRETTY_NAME"] != "" {
+		return values["PRETTY_NAME"]
+	}
+	return name
+}
+
+func normalizeLinuxArch(arch string) string {
+	arch = strings.TrimSpace(arch)
+	if arch == "" {
+		return ""
+	}
+	switch strings.ToLower(arch) {
+	case "amd64":
+		return "x86_64"
+	case "i386", "i486", "i586", "i686", "x86":
+		return "x86"
+	default:
+		return arch
+	}
+}
+
+func formatLinuxDetailedVersion(osRelease string, versionInfo linuxVersionInfo) string {
+	parts := make([]string, 0, 3)
+	if osRelease != "" {
+		parts = append(parts, osRelease)
+	} else if versionInfo.Sysname != "" {
+		parts = append(parts, versionInfo.Sysname)
+	}
+
+	kernelParts := make([]string, 0, 2)
+	if versionInfo.Release != "" {
+		kernelParts = append(kernelParts, versionInfo.Release)
+	}
+	if versionInfo.Version != "" {
+		kernelParts = append(kernelParts, versionInfo.Version)
+	}
+	if len(kernelParts) > 0 {
+		parts = append(parts, fmt.Sprintf("kernel %s", strings.Join(kernelParts, " ")))
+	}
+
+	if arch := normalizeLinuxArch(versionInfo.Machine); arch != "" {
+		parts = append(parts, arch)
+	}
+	return strings.Join(parts, " ")
+}

implant/sliver/version/linux_version_helpers_test.go

@@ -0,0 +1,100 @@
+package version
+
+import "testing"
+
+func TestParseLinuxOSRelease(t *testing.T) {
+	content := "# comment\n" +
+		"NAME=\"Ubuntu\"\n" +
+		"VERSION=\"24.04.2 LTS (Noble Numbat)\"\n" +
+		"PRETTY_NAME=\"Ubuntu 24.04.2 LTS\"\n" +
+		"SPECIAL=\"quoted \\\"value\\\" \\$HOME \\`uname\\`\"\n"
+
+	values := parseLinuxOSRelease(content)
+
+	if got, want := values["NAME"], "Ubuntu"; got != want {
+		t.Fatalf("NAME = %q, want %q", got, want)
+	}
+	if got, want := values["VERSION"], "24.04.2 LTS (Noble Numbat)"; got != want {
+		t.Fatalf("VERSION = %q, want %q", got, want)
+	}
+	if got, want := values["PRETTY_NAME"], "Ubuntu 24.04.2 LTS"; got != want {
+		t.Fatalf("PRETTY_NAME = %q, want %q", got, want)
+	}
+	if got, want := values["SPECIAL"], "quoted \"value\" $HOME `uname`"; got != want {
+		t.Fatalf("SPECIAL = %q, want %q", got, want)
+	}
+}
+
+func TestBuildLinuxOSRelease(t *testing.T) {
+	testCases := []struct {
+		name   string
+		values map[string]string
+		want   string
+	}{
+		{
+			name: "prefers name and version",
+			values: map[string]string{
+				"NAME":        "Ubuntu",
+				"VERSION":     "24.04.2 LTS (Noble Numbat)",
+				"PRETTY_NAME": "Ubuntu 24.04.2 LTS",
+			},
+			want: "Ubuntu 24.04.2 LTS (Noble Numbat)",
+		},
+		{
+			name: "falls back to version id",
+			values: map[string]string{
+				"NAME":       "Alpine Linux",
+				"VERSION_ID": "3.21.3",
+			},
+			want: "Alpine Linux 3.21.3",
+		},
+		{
+			name: "falls back to pretty name",
+			values: map[string]string{
+				"PRETTY_NAME": "Fedora Linux 41 (Workstation Edition)",
+			},
+			want: "Fedora Linux 41 (Workstation Edition)",
+		},
+		{
+			name: "falls back to name",
+			values: map[string]string{
+				"NAME": "Linux",
+			},
+			want: "Linux",
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			if got := buildLinuxOSRelease(testCase.values); got != testCase.want {
+				t.Fatalf("buildLinuxOSRelease() = %q, want %q", got, testCase.want)
+			}
+		})
+	}
+}
+
+func TestFormatLinuxDetailedVersion(t *testing.T) {
+	version := formatLinuxDetailedVersion("Ubuntu 24.04.2 LTS (Noble Numbat)", linuxVersionInfo{
+		Release: "6.8.0-57-generic",
+		Version: "#59-Ubuntu SMP PREEMPT_DYNAMIC Fri Feb 14 18:29:04 UTC 2025",
+		Machine: "amd64",
+	})
+
+	want := "Ubuntu 24.04.2 LTS (Noble Numbat) kernel 6.8.0-57-generic #59-Ubuntu SMP PREEMPT_DYNAMIC Fri Feb 14 18:29:04 UTC 2025 x86_64"
+	if version != want {
+		t.Fatalf("formatLinuxDetailedVersion() = %q, want %q", version, want)
+	}
+}
+
+func TestFormatLinuxDetailedVersionFallback(t *testing.T) {
+	version := formatLinuxDetailedVersion("", linuxVersionInfo{
+		Sysname: "Linux",
+		Release: "6.12.0",
+		Machine: "i686",
+	})
+
+	want := "Linux kernel 6.12.0 x86"
+	if version != want {
+		t.Fatalf("formatLinuxDetailedVersion() = %q, want %q", version, want)
+	}
+}

implant/sliver/version/version_generic.go

@@ -1,4 +1,4 @@
-//go:build !darwin && !(windows && (amd64 || 386)) && !(linux && (amd64 || 386))
+//go:build !darwin && !linux && !(windows && (amd64 || 386))
 
 package version
 

implant/sliver/version/version_linux.go

@@ -1,4 +1,4 @@
-//go:build amd64 || 386
+//go:build linux
 
 package version
 
@@ -21,132 +21,36 @@ package version
 */
 
 import (
-	"fmt"
+	"bytes"
 	//{{if .Config.Debug}}
 	"log"
 	//{{end}}
-	"os"
-	"strings"
-	"syscall"
+
+	"golang.org/x/sys/unix"
 )
 
-func getString(input [65]int8) string {
-	var buf [65]byte
-	for i, b := range input {
-		buf[i] = byte(b)
+func linuxNullTerminatedString(input []byte) string {
+	if index := bytes.IndexByte(input, 0); index >= 0 {
+		input = input[:index]
 	}
-	ver := string(buf[:])
-	if i := strings.Index(ver, "\x00"); i != -1 {
-		ver = ver[:i]
-	}
-	return ver
-}
-
-func readOSRelease() string {
-	paths := []string{"/etc/os-release", "/usr/lib/os-release"}
-	for _, path := range paths {
-		data, err := os.ReadFile(path)
-		if err != nil {
-			continue
-		}
-		return buildOSRelease(parseOSRelease(string(data)))
-	}
-	return ""
-}
-
-func parseOSRelease(content string) map[string]string {
-	values := make(map[string]string)
-	for _, line := range strings.Split(content, "\n") {
-		line = strings.TrimSpace(line)
-		if line == "" || strings.HasPrefix(line, "#") {
-			continue
-		}
-		key, value, ok := strings.Cut(line, "=")
-		if !ok || key == "" {
-			continue
-		}
-		key = strings.TrimSpace(key)
-		value = unescape(unquote(strings.TrimSpace(value)))
-		values[key] = value
-	}
-	return values
-}
-
-func unquote(s string) string {
-	if len(s) < 2 {
-		return s
-	}
-	if (s[0] == '"' || s[0] == '\'') && s[0] == s[len(s)-1] {
-		return s[1 : len(s)-1]
-	}
-	return s
-}
-
-func unescape(s string) string {
-	return strings.NewReplacer(
-		`\$`, `$`,
-		`\"`, `"`,
-		`\'`, `'`,
-		`\\`, `\`,
-		"\\`", "`",
-	).Replace(s)
-}
-
-func buildOSRelease(values map[string]string) string {
-	name := values["NAME"]
-	version := values["VERSION"]
-	if version == "" {
-		version = values["VERSION_ID"]
-	}
-	if name != "" && version != "" {
-		return fmt.Sprintf("%s %s", name, version)
-	}
-	return values["PRETTY_NAME"]
-}
-
-func normalizeArch(arch string) string {
-	arch = strings.TrimSpace(arch)
-	if arch == "" {
-		return ""
-	}
-	switch strings.ToLower(arch) {
-	case "amd64":
-		return "x86_64"
-	case "i386", "i486", "i586", "i686", "x86":
-		return "x86"
-	default:
-		return arch
-	}
-}
-
-func formatDetailedVersion(osRelease, kernel, arch string) string {
-	parts := make([]string, 0, 3)
-	if osRelease != "" {
-		parts = append(parts, osRelease)
-	}
-	if kernel != "" {
-		parts = append(parts, fmt.Sprintf("kernel %s", kernel))
-	}
-	if arch != "" {
-		parts = append(parts, arch)
-	}
-	return strings.Join(parts, " ")
+	return string(input)
 }
 
 // GetVersion returns the os version information
 func GetVersion() string {
-	osRelease := readOSRelease()
-	var uname syscall.Utsname
-	if err := syscall.Uname(&uname); err != nil {
+	osRelease := readLinuxOSRelease()
+	var uname unix.Utsname
+	if err := unix.Uname(&uname); err != nil {
 		//{{if .Config.Debug}}
 		log.Printf("error getting OS version: %v", err)
 		//{{end}}
 		return osRelease
 	}
-	if osRelease == "" {
-		osRelease = getString(uname.Sysname)
-	}
-	kernel := getString(uname.Release)
-	arch := normalizeArch(getString(uname.Machine))
-	return formatDetailedVersion(osRelease, kernel, arch)
+
+	return formatLinuxDetailedVersion(osRelease, linuxVersionInfo{
+		Sysname: linuxNullTerminatedString(uname.Sysname[:]),
+		Release: linuxNullTerminatedString(uname.Release[:]),
+		Version: linuxNullTerminatedString(uname.Version[:]),
+		Machine: linuxNullTerminatedString(uname.Machine[:]),
+	})
 }

protobuf/clientpb/client.proto

@@ -456,6 +456,7 @@ message ListenerJob {
 message MultiplayerListenerReq {
   string Host = 1;
   uint32 Port = 2;
+  bool WireGuard = 3;
 }
 
 message MTLSListenerReq {
@@ -1407,6 +1408,138 @@ message CrackFileChunk {
   bytes Data = 9;
 }
 
+// [ AI ] ----------------------------------------
+
+message AIProviderConfigs {
+  repeated AIProviderConfig Providers = 1;
+  AIConfigSummary Config = 2;
+}
+
+message AIProviderConfig {
+  string Name = 1;
+  bool Configured = 2;
+}
+
+message AIConfigSummary {
+  string Provider = 1;
+  string Model = 2;
+  string ThinkingLevel = 3;
+  bool Valid = 4;
+  string Error = 5;
+  string SystemPrompt = 6;
+}
+
+message AIConversationReq {
+  string ID = 1;
+  bool IncludeMessages = 2;
+}
+
+message AIConversations {
+  repeated AIConversation Conversations = 1;
+}
+
+enum AIConversationTurnState {
+  AI_TURN_STATE_IDLE = 0;
+  AI_TURN_STATE_IN_PROGRESS = 1;
+  AI_TURN_STATE_FAILED = 2;
+}
+
+enum AIConversationMessageKind {
+  AI_MESSAGE_KIND_CHAT = 0;
+  AI_MESSAGE_KIND_REASONING = 1;
+  AI_MESSAGE_KIND_TOOL_CALL = 2;
+}
+
+enum AIConversationMessageVisibility {
+  AI_MESSAGE_VISIBILITY_CONTEXT = 0;
+  AI_MESSAGE_VISIBILITY_UI_ONLY = 1;
+}
+
+enum AIConversationMessageState {
+  AI_MESSAGE_STATE_COMPLETED = 0;
+  AI_MESSAGE_STATE_IN_PROGRESS = 1;
+  AI_MESSAGE_STATE_FAILED = 2;
+}
+
+enum AIConversationEventType {
+  AI_CONVERSATION_EVENT_TYPE_UNKNOWN = 0;
+  AI_CONVERSATION_EVENT_TYPE_CONVERSATION_UPDATED = 1;
+  AI_CONVERSATION_EVENT_TYPE_CONVERSATION_DELETED = 2;
+  AI_CONVERSATION_EVENT_TYPE_TURN_STARTED = 3;
+  AI_CONVERSATION_EVENT_TYPE_TURN_COMPLETED = 4;
+  AI_CONVERSATION_EVENT_TYPE_TURN_FAILED = 5;
+  AI_CONVERSATION_EVENT_TYPE_MESSAGE_STARTED = 6;
+  AI_CONVERSATION_EVENT_TYPE_MESSAGE_UPDATED = 7;
+  AI_CONVERSATION_EVENT_TYPE_MESSAGE_COMPLETED = 8;
+}
+
+message AIContextWindowUsage {
+  int64 InputTokens = 1;
+  int64 OutputTokens = 2;
+  int64 TotalTokens = 3;
+  int64 ContextWindowTokens = 4;
+  bool ContextWindowTokensEstimated = 5;
+}
+
+message AIConversation {
+  string ID = 1;
+  int64 CreatedAt = 2;
+  int64 UpdatedAt = 3;
+  string OperatorName = 4;
+  string Provider = 5;
+  string Model = 6;
+  string Title = 7;
+  string Summary = 8;
+  string SystemPrompt = 9;
+  repeated AIConversationMessage Messages = 10;
+  string ActiveTurnID = 11;
+  AIConversationTurnState TurnState = 12;
+  string TargetSessionID = 13;
+  string TargetBeaconID = 14;
+  string ThinkingLevel = 15;
+  AIContextWindowUsage ContextWindowUsage = 16;
+}
+
+message AIConversationMessages {
+  string ConversationID = 1;
+  repeated AIConversationMessage Messages = 2;
+}
+
+message AIConversationMessage {
+  string ID = 1;
+  string ConversationID = 2;
+  int64 CreatedAt = 3;
+  int64 UpdatedAt = 4;
+  string OperatorName = 5;
+  string Provider = 6;
+  string Model = 7;
+  uint32 Sequence = 8;
+  string Role = 9;
+  string Content = 10;
+  string ProviderMessageID = 11;
+  string FinishReason = 12;
+  AIConversationMessageKind Kind = 13;
+  AIConversationMessageVisibility Visibility = 14;
+  AIConversationMessageState State = 15;
+  string TurnID = 16;
+  string ItemID = 17;
+  string ToolCallID = 18;
+  string ToolName = 19;
+  string ToolArguments = 20;
+  string ToolResult = 21;
+  string ErrorText = 22;
+  optional bool IncludeInContext = 23;
+}
+
+message AIConversationEvent {
+  AIConversationEventType EventType = 1;
+  string ConversationID = 2;
+  string TurnID = 3;
+  string ErrorText = 4;
+  AIConversation Conversation = 5;
+  AIConversationMessage Message = 6;
+}
+
 // watchtower 
 message MonitoringProviders {
   repeated MonitoringProvider providers = 1;

protobuf/commonpb/common.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
-// 	protoc        v6.33.4
+// 	protoc-gen-go v1.36.11
+// 	protoc        v7.34.1
 // source: commonpb/common.proto
 
 package commonpb
@@ -11,6 +11,7 @@ import (
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -21,18 +22,16 @@ const (
 )
 
 type Empty struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Empty) Reset() {
 	*x = Empty{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_commonpb_common_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_commonpb_common_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Empty) String() string {
@@ -43,7 +42,7 @@ func (*Empty) ProtoMessage() {}
 
 func (x *Empty) ProtoReflect() protoreflect.Message {
 	mi := &file_commonpb_common_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -60,23 +59,20 @@ func (*Empty) Descriptor() ([]byte, []int) {
 
 // Request - Common fields used in all gRPC requests
 type Request struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Async         bool                   `protobuf:"varint,1,opt,name=Async,proto3" json:"Async,omitempty"`
+	Timeout       int64                  `protobuf:"varint,2,opt,name=Timeout,proto3" json:"Timeout,omitempty"`
+	BeaconID      string                 `protobuf:"bytes,8,opt,name=BeaconID,proto3" json:"BeaconID,omitempty"`
+	SessionID     string                 `protobuf:"bytes,9,opt,name=SessionID,proto3" json:"SessionID,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Async     bool   `protobuf:"varint,1,opt,name=Async,proto3" json:"Async,omitempty"`
-	Timeout   int64  `protobuf:"varint,2,opt,name=Timeout,proto3" json:"Timeout,omitempty"`
-	BeaconID  string `protobuf:"bytes,8,opt,name=BeaconID,proto3" json:"BeaconID,omitempty"`
-	SessionID string `protobuf:"bytes,9,opt,name=SessionID,proto3" json:"SessionID,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Request) Reset() {
 	*x = Request{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_commonpb_common_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_commonpb_common_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Request) String() string {
@@ -87,7 +83,7 @@ func (*Request) ProtoMessage() {}
 
 func (x *Request) ProtoReflect() protoreflect.Message {
 	mi := &file_commonpb_common_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -131,26 +127,24 @@ func (x *Request) GetSessionID() string {
 }
 
 // Response - Common fields used in all gRPC responses. Note that the Err field
-//            only used when the implant needs to return an error to the server.
-//            Client<->Server comms should use normal gRPC error handling.
+//
+//	only used when the implant needs to return an error to the server.
+//	Client<->Server comms should use normal gRPC error handling.
 type Response struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Err           string                 `protobuf:"bytes,1,opt,name=Err,proto3" json:"Err,omitempty"`
+	Async         bool                   `protobuf:"varint,2,opt,name=Async,proto3" json:"Async,omitempty"`
+	BeaconID      string                 `protobuf:"bytes,8,opt,name=BeaconID,proto3" json:"BeaconID,omitempty"`
+	TaskID        string                 `protobuf:"bytes,9,opt,name=TaskID,proto3" json:"TaskID,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Err      string `protobuf:"bytes,1,opt,name=Err,proto3" json:"Err,omitempty"`
-	Async    bool   `protobuf:"varint,2,opt,name=Async,proto3" json:"Async,omitempty"`
-	BeaconID string `protobuf:"bytes,8,opt,name=BeaconID,proto3" json:"BeaconID,omitempty"`
-	TaskID   string `protobuf:"bytes,9,opt,name=TaskID,proto3" json:"TaskID,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Response) Reset() {
 	*x = Response{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_commonpb_common_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_commonpb_common_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Response) String() string {
@@ -161,7 +155,7 @@ func (*Response) ProtoMessage() {}
 
 func (x *Response) ProtoReflect() protoreflect.Message {
 	mi := &file_commonpb_common_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -206,21 +200,18 @@ func (x *Response) GetTaskID() string {
 
 // File - A basic file data type
 type File struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Name          string                 `protobuf:"bytes,1,opt,name=Name,proto3" json:"Name,omitempty"`
+	Data          []byte                 `protobuf:"bytes,2,opt,name=Data,proto3" json:"Data,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Name string `protobuf:"bytes,1,opt,name=Name,proto3" json:"Name,omitempty"`
-	Data []byte `protobuf:"bytes,2,opt,name=Data,proto3" json:"Data,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *File) Reset() {
 	*x = File{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_commonpb_common_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_commonpb_common_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *File) String() string {
@@ -231,7 +222,7 @@ func (*File) ProtoMessage() {}
 
 func (x *File) ProtoReflect() protoreflect.Message {
 	mi := &file_commonpb_common_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -262,26 +253,23 @@ func (x *File) GetData() []byte {
 
 // Process - A basic process data type
 type Process struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Pid           int32                  `protobuf:"varint,1,opt,name=Pid,proto3" json:"Pid,omitempty"`
+	Ppid          int32                  `protobuf:"varint,2,opt,name=Ppid,proto3" json:"Ppid,omitempty"`
+	Executable    string                 `protobuf:"bytes,3,opt,name=Executable,proto3" json:"Executable,omitempty"`
+	Owner         string                 `protobuf:"bytes,4,opt,name=Owner,proto3" json:"Owner,omitempty"`
+	Architecture  string                 `protobuf:"bytes,7,opt,name=Architecture,proto3" json:"Architecture,omitempty"`
+	SessionID     int32                  `protobuf:"varint,5,opt,name=SessionID,proto3" json:"SessionID,omitempty"`
+	CmdLine       []string               `protobuf:"bytes,6,rep,name=CmdLine,proto3" json:"CmdLine,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Pid          int32    `protobuf:"varint,1,opt,name=Pid,proto3" json:"Pid,omitempty"`
-	Ppid         int32    `protobuf:"varint,2,opt,name=Ppid,proto3" json:"Ppid,omitempty"`
-	Executable   string   `protobuf:"bytes,3,opt,name=Executable,proto3" json:"Executable,omitempty"`
-	Owner        string   `protobuf:"bytes,4,opt,name=Owner,proto3" json:"Owner,omitempty"`
-	Architecture string   `protobuf:"bytes,7,opt,name=Architecture,proto3" json:"Architecture,omitempty"`
-	SessionID    int32    `protobuf:"varint,5,opt,name=SessionID,proto3" json:"SessionID,omitempty"`
-	CmdLine      []string `protobuf:"bytes,6,rep,name=CmdLine,proto3" json:"CmdLine,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Process) Reset() {
 	*x = Process{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_commonpb_common_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_commonpb_common_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *Process) String() string {
@@ -292,7 +280,7 @@ func (*Process) ProtoMessage() {}
 
 func (x *Process) ProtoReflect() protoreflect.Message {
 	mi := &file_commonpb_common_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -358,21 +346,18 @@ func (x *Process) GetCmdLine() []string {
 
 // EnvVar - Environment variable K/V
 type EnvVar struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Key           string                 `protobuf:"bytes,1,opt,name=Key,proto3" json:"Key,omitempty"`
+	Value         string                 `protobuf:"bytes,2,opt,name=Value,proto3" json:"Value,omitempty"`
 	unknownFields protoimpl.UnknownFields
-
-	Key   string `protobuf:"bytes,1,opt,name=Key,proto3" json:"Key,omitempty"`
-	Value string `protobuf:"bytes,2,opt,name=Value,proto3" json:"Value,omitempty"`
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *EnvVar) Reset() {
 	*x = EnvVar{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_commonpb_common_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_commonpb_common_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *EnvVar) String() string {
@@ -383,7 +368,7 @@ func (*EnvVar) ProtoMessage() {}
 
 func (x *EnvVar) ProtoReflect() protoreflect.Message {
 	mi := &file_commonpb_common_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -414,62 +399,51 @@ func (x *EnvVar) GetValue() string {
 
 var File_commonpb_common_proto protoreflect.FileDescriptor
 
-var file_commonpb_common_proto_rawDesc = []byte{
-	0x0a, 0x15, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70, 0x62, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f,
-	0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x08, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70,
-	0x62, 0x22, 0x07, 0x0a, 0x05, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x73, 0x0a, 0x07, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x41, 0x73, 0x79, 0x6e, 0x63, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x41, 0x73, 0x79, 0x6e, 0x63, 0x12, 0x18, 0x0a, 0x07, 0x54,
-	0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x07, 0x54, 0x69,
-	0x6d, 0x65, 0x6f, 0x75, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x42, 0x65, 0x61, 0x63, 0x6f, 0x6e, 0x49,
-	0x44, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x42, 0x65, 0x61, 0x63, 0x6f, 0x6e, 0x49,
-	0x44, 0x12, 0x1c, 0x0a, 0x09, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x44, 0x18, 0x09,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x44, 0x22,
-	0x66, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x45,
-	0x72, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x45, 0x72, 0x72, 0x12, 0x14, 0x0a,
-	0x05, 0x41, 0x73, 0x79, 0x6e, 0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x41, 0x73,
-	0x79, 0x6e, 0x63, 0x12, 0x1a, 0x0a, 0x08, 0x42, 0x65, 0x61, 0x63, 0x6f, 0x6e, 0x49, 0x44, 0x18,
-	0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x42, 0x65, 0x61, 0x63, 0x6f, 0x6e, 0x49, 0x44, 0x12,
-	0x16, 0x0a, 0x06, 0x54, 0x61, 0x73, 0x6b, 0x49, 0x44, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x06, 0x54, 0x61, 0x73, 0x6b, 0x49, 0x44, 0x22, 0x2e, 0x0a, 0x04, 0x46, 0x69, 0x6c, 0x65, 0x12,
-	0x12, 0x0a, 0x04, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x4e,
-	0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x44, 0x61, 0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0c, 0x52, 0x04, 0x44, 0x61, 0x74, 0x61, 0x22, 0xc1, 0x01, 0x0a, 0x07, 0x50, 0x72, 0x6f, 0x63,
-	0x65, 0x73, 0x73, 0x12, 0x10, 0x0a, 0x03, 0x50, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05,
-	0x52, 0x03, 0x50, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x50, 0x70, 0x69, 0x64, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x05, 0x52, 0x04, 0x50, 0x70, 0x69, 0x64, 0x12, 0x1e, 0x0a, 0x0a, 0x45, 0x78, 0x65,
-	0x63, 0x75, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x45,
-	0x78, 0x65, 0x63, 0x75, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x4f, 0x77, 0x6e,
-	0x65, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x12,
-	0x22, 0x0a, 0x0c, 0x41, 0x72, 0x63, 0x68, 0x69, 0x74, 0x65, 0x63, 0x74, 0x75, 0x72, 0x65, 0x18,
-	0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x41, 0x72, 0x63, 0x68, 0x69, 0x74, 0x65, 0x63, 0x74,
-	0x75, 0x72, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x44,
-	0x18, 0x05, 0x20, 0x01, 0x28, 0x05, 0x52, 0x09, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49,
-	0x44, 0x12, 0x18, 0x0a, 0x07, 0x43, 0x6d, 0x64, 0x4c, 0x69, 0x6e, 0x65, 0x18, 0x06, 0x20, 0x03,
-	0x28, 0x09, 0x52, 0x07, 0x43, 0x6d, 0x64, 0x4c, 0x69, 0x6e, 0x65, 0x22, 0x30, 0x0a, 0x06, 0x45,
-	0x6e, 0x76, 0x56, 0x61, 0x72, 0x12, 0x10, 0x0a, 0x03, 0x4b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x03, 0x4b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x56, 0x61, 0x6c, 0x75, 0x65,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x2f, 0x5a,
-	0x2d, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x62, 0x69, 0x73, 0x68,
-	0x6f, 0x70, 0x66, 0x6f, 0x78, 0x2f, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x2f, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70, 0x62, 0x62, 0x06,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+const file_commonpb_common_proto_rawDesc = "" +
+	"\n" +
+	"\x15commonpb/common.proto\x12\bcommonpb\"\a\n" +
+	"\x05Empty\"s\n" +
+	"\aRequest\x12\x14\n" +
+	"\x05Async\x18\x01 \x01(\bR\x05Async\x12\x18\n" +
+	"\aTimeout\x18\x02 \x01(\x03R\aTimeout\x12\x1a\n" +
+	"\bBeaconID\x18\b \x01(\tR\bBeaconID\x12\x1c\n" +
+	"\tSessionID\x18\t \x01(\tR\tSessionID\"f\n" +
+	"\bResponse\x12\x10\n" +
+	"\x03Err\x18\x01 \x01(\tR\x03Err\x12\x14\n" +
+	"\x05Async\x18\x02 \x01(\bR\x05Async\x12\x1a\n" +
+	"\bBeaconID\x18\b \x01(\tR\bBeaconID\x12\x16\n" +
+	"\x06TaskID\x18\t \x01(\tR\x06TaskID\".\n" +
+	"\x04File\x12\x12\n" +
+	"\x04Name\x18\x01 \x01(\tR\x04Name\x12\x12\n" +
+	"\x04Data\x18\x02 \x01(\fR\x04Data\"\xc1\x01\n" +
+	"\aProcess\x12\x10\n" +
+	"\x03Pid\x18\x01 \x01(\x05R\x03Pid\x12\x12\n" +
+	"\x04Ppid\x18\x02 \x01(\x05R\x04Ppid\x12\x1e\n" +
+	"\n" +
+	"Executable\x18\x03 \x01(\tR\n" +
+	"Executable\x12\x14\n" +
+	"\x05Owner\x18\x04 \x01(\tR\x05Owner\x12\"\n" +
+	"\fArchitecture\x18\a \x01(\tR\fArchitecture\x12\x1c\n" +
+	"\tSessionID\x18\x05 \x01(\x05R\tSessionID\x12\x18\n" +
+	"\aCmdLine\x18\x06 \x03(\tR\aCmdLine\"0\n" +
+	"\x06EnvVar\x12\x10\n" +
+	"\x03Key\x18\x01 \x01(\tR\x03Key\x12\x14\n" +
+	"\x05Value\x18\x02 \x01(\tR\x05ValueB/Z-github.com/bishopfox/sliver/protobuf/commonpbb\x06proto3"
 
 var (
 	file_commonpb_common_proto_rawDescOnce sync.Once
-	file_commonpb_common_proto_rawDescData = file_commonpb_common_proto_rawDesc
+	file_commonpb_common_proto_rawDescData []byte
 )
 
 func file_commonpb_common_proto_rawDescGZIP() []byte {
 	file_commonpb_common_proto_rawDescOnce.Do(func() {
-		file_commonpb_common_proto_rawDescData = protoimpl.X.CompressGZIP(file_commonpb_common_proto_rawDescData)
+		file_commonpb_common_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_commonpb_common_proto_rawDesc), len(file_commonpb_common_proto_rawDesc)))
 	})
 	return file_commonpb_common_proto_rawDescData
 }
 
 var file_commonpb_common_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
-var file_commonpb_common_proto_goTypes = []interface{}{
+var file_commonpb_common_proto_goTypes = []any{
 	(*Empty)(nil),    // 0: commonpb.Empty
 	(*Request)(nil),  // 1: commonpb.Request
 	(*Response)(nil), // 2: commonpb.Response
@@ -490,85 +464,11 @@ func file_commonpb_common_proto_init() {
 	if File_commonpb_common_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_commonpb_common_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Empty); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_commonpb_common_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Request); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_commonpb_common_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Response); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_commonpb_common_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*File); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_commonpb_common_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Process); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_commonpb_common_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*EnvVar); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_commonpb_common_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_commonpb_common_proto_rawDesc), len(file_commonpb_common_proto_rawDesc)),
 			NumEnums:      0,
 			NumMessages:   6,
 			NumExtensions: 0,
@@ -579,7 +479,6 @@ func file_commonpb_common_proto_init() {
 		MessageInfos:      file_commonpb_common_proto_msgTypes,
 	}.Build()
 	File_commonpb_common_proto = out.File
-	file_commonpb_common_proto_rawDesc = nil
 	file_commonpb_common_proto_goTypes = nil
 	file_commonpb_common_proto_depIdxs = nil
 }

protobuf/dnspb/dns.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
-// 	protoc        v6.33.4
+// 	protoc-gen-go v1.36.11
+// 	protoc        v7.34.1
 // source: dnspb/dns.proto
 
 package dnspb
@@ -11,6 +11,7 @@ import (
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
 	sync "sync"
+	unsafe "unsafe"
 )
 
 const (
@@ -84,29 +85,25 @@ func (DNSMessageType) EnumDescriptor() ([]byte, []int) {
 	return file_dnspb_dns_proto_rawDescGZIP(), []int{0}
 }
 
-//
-//NOTE: DNS is very space sensitive so certain fields are re-purposed
-//depending on the DNSMessageType.
+// NOTE: DNS is very space sensitive so certain fields are re-purposed
+// depending on the DNSMessageType.
 type DNSMessage struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Type          DNSMessageType         `protobuf:"varint,1,opt,name=Type,proto3,enum=dnspb.DNSMessageType" json:"Type,omitempty"`
+	ID            uint32                 `protobuf:"varint,2,opt,name=ID,proto3" json:"ID,omitempty"`       // 8 bit message id + 24 bit dns session ID
+	Start         uint32                 `protobuf:"varint,3,opt,name=Start,proto3" json:"Start,omitempty"` // Bytes start at
+	Stop          uint32                 `protobuf:"varint,4,opt,name=Stop,proto3" json:"Stop,omitempty"`   // Bytes stop at
+	Size          uint32                 `protobuf:"varint,5,opt,name=Size,proto3" json:"Size,omitempty"`   // Total size
+	Data          []byte                 `protobuf:"bytes,6,opt,name=Data,proto3" json:"Data,omitempty"`    // Actual data
 	unknownFields protoimpl.UnknownFields
-
-	Type  DNSMessageType `protobuf:"varint,1,opt,name=Type,proto3,enum=dnspb.DNSMessageType" json:"Type,omitempty"`
-	ID    uint32         `protobuf:"varint,2,opt,name=ID,proto3" json:"ID,omitempty"`       // 8 bit message id + 24 bit dns session ID
-	Start uint32         `protobuf:"varint,3,opt,name=Start,proto3" json:"Start,omitempty"` // Bytes start at
-	Stop  uint32         `protobuf:"varint,4,opt,name=Stop,proto3" json:"Stop,omitempty"`   // Bytes stop at
-	Size  uint32         `protobuf:"varint,5,opt,name=Size,proto3" json:"Size,omitempty"`   // Total size
-	Data  []byte         `protobuf:"bytes,6,opt,name=Data,proto3" json:"Data,omitempty"`    // Actual data
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *DNSMessage) Reset() {
 	*x = DNSMessage{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_dnspb_dns_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
+	mi := &file_dnspb_dns_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
 }
 
 func (x *DNSMessage) String() string {
@@ -117,7 +114,7 @@ func (*DNSMessage) ProtoMessage() {}
 
 func (x *DNSMessage) ProtoReflect() protoreflect.Message {
 	mi := &file_dnspb_dns_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
+	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
 			ms.StoreMessageInfo(mi)
@@ -176,47 +173,42 @@ func (x *DNSMessage) GetData() []byte {
 
 var File_dnspb_dns_proto protoreflect.FileDescriptor
 
-var file_dnspb_dns_proto_rawDesc = []byte{
-	0x0a, 0x0f, 0x64, 0x6e, 0x73, 0x70, 0x62, 0x2f, 0x64, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x12, 0x05, 0x64, 0x6e, 0x73, 0x70, 0x62, 0x22, 0x99, 0x01, 0x0a, 0x0a, 0x44, 0x4e, 0x53,
-	0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x12, 0x29, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x15, 0x2e, 0x64, 0x6e, 0x73, 0x70, 0x62, 0x2e, 0x44, 0x4e,
-	0x53, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x54, 0x79,
-	0x70, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x49, 0x44, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x02,
-	0x49, 0x44, 0x12, 0x14, 0x0a, 0x05, 0x53, 0x74, 0x61, 0x72, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x0d, 0x52, 0x05, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x53, 0x74, 0x6f, 0x70,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x53, 0x74, 0x6f, 0x70, 0x12, 0x12, 0x0a, 0x04,
-	0x53, 0x69, 0x7a, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x53, 0x69, 0x7a, 0x65,
-	0x12, 0x12, 0x0a, 0x04, 0x44, 0x61, 0x74, 0x61, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04,
-	0x44, 0x61, 0x74, 0x61, 0x2a, 0x83, 0x01, 0x0a, 0x0e, 0x44, 0x4e, 0x53, 0x4d, 0x65, 0x73, 0x73,
-	0x61, 0x67, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x07, 0x0a, 0x03, 0x4e, 0x4f, 0x50, 0x10, 0x00,
-	0x12, 0x08, 0x0a, 0x04, 0x49, 0x4e, 0x49, 0x54, 0x10, 0x02, 0x12, 0x08, 0x0a, 0x04, 0x50, 0x4f,
-	0x4c, 0x4c, 0x10, 0x03, 0x12, 0x09, 0x0a, 0x05, 0x43, 0x4c, 0x4f, 0x53, 0x45, 0x10, 0x04, 0x12,
-	0x0c, 0x0a, 0x08, 0x4d, 0x41, 0x4e, 0x49, 0x46, 0x45, 0x53, 0x54, 0x10, 0x06, 0x12, 0x13, 0x0a,
-	0x0f, 0x44, 0x41, 0x54, 0x41, 0x5f, 0x54, 0x4f, 0x5f, 0x49, 0x4d, 0x50, 0x4c, 0x41, 0x4e, 0x54,
-	0x10, 0x07, 0x12, 0x15, 0x0a, 0x11, 0x44, 0x41, 0x54, 0x41, 0x5f, 0x46, 0x52, 0x4f, 0x4d, 0x5f,
-	0x49, 0x4d, 0x50, 0x4c, 0x41, 0x4e, 0x54, 0x10, 0x08, 0x12, 0x09, 0x0a, 0x05, 0x43, 0x4c, 0x45,
-	0x41, 0x52, 0x10, 0x09, 0x22, 0x04, 0x08, 0x01, 0x10, 0x01, 0x42, 0x2c, 0x5a, 0x2a, 0x67, 0x69,
-	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x62, 0x69, 0x73, 0x68, 0x6f, 0x70, 0x66,
-	0x6f, 0x78, 0x2f, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x75, 0x66, 0x2f, 0x64, 0x6e, 0x73, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
+const file_dnspb_dns_proto_rawDesc = "" +
+	"\n" +
+	"\x0fdnspb/dns.proto\x12\x05dnspb\"\x99\x01\n" +
+	"\n" +
+	"DNSMessage\x12)\n" +
+	"\x04Type\x18\x01 \x01(\x0e2\x15.dnspb.DNSMessageTypeR\x04Type\x12\x0e\n" +
+	"\x02ID\x18\x02 \x01(\rR\x02ID\x12\x14\n" +
+	"\x05Start\x18\x03 \x01(\rR\x05Start\x12\x12\n" +
+	"\x04Stop\x18\x04 \x01(\rR\x04Stop\x12\x12\n" +
+	"\x04Size\x18\x05 \x01(\rR\x04Size\x12\x12\n" +
+	"\x04Data\x18\x06 \x01(\fR\x04Data*\x83\x01\n" +
+	"\x0eDNSMessageType\x12\a\n" +
+	"\x03NOP\x10\x00\x12\b\n" +
+	"\x04INIT\x10\x02\x12\b\n" +
+	"\x04POLL\x10\x03\x12\t\n" +
+	"\x05CLOSE\x10\x04\x12\f\n" +
+	"\bMANIFEST\x10\x06\x12\x13\n" +
+	"\x0fDATA_TO_IMPLANT\x10\a\x12\x15\n" +
+	"\x11DATA_FROM_IMPLANT\x10\b\x12\t\n" +
+	"\x05CLEAR\x10\t\"\x04\b\x01\x10\x01B,Z*github.com/bishopfox/sliver/protobuf/dnspbb\x06proto3"
 
 var (
 	file_dnspb_dns_proto_rawDescOnce sync.Once
-	file_dnspb_dns_proto_rawDescData = file_dnspb_dns_proto_rawDesc
+	file_dnspb_dns_proto_rawDescData []byte
 )
 
 func file_dnspb_dns_proto_rawDescGZIP() []byte {
 	file_dnspb_dns_proto_rawDescOnce.Do(func() {
-		file_dnspb_dns_proto_rawDescData = protoimpl.X.CompressGZIP(file_dnspb_dns_proto_rawDescData)
+		file_dnspb_dns_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_dnspb_dns_proto_rawDesc), len(file_dnspb_dns_proto_rawDesc)))
 	})
 	return file_dnspb_dns_proto_rawDescData
 }
 
 var file_dnspb_dns_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
 var file_dnspb_dns_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
-var file_dnspb_dns_proto_goTypes = []interface{}{
+var file_dnspb_dns_proto_goTypes = []any{
 	(DNSMessageType)(0), // 0: dnspb.DNSMessageType
 	(*DNSMessage)(nil),  // 1: dnspb.DNSMessage
 }
@@ -234,25 +226,11 @@ func file_dnspb_dns_proto_init() {
 	if File_dnspb_dns_proto != nil {
 		return
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_dnspb_dns_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DNSMessage); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_dnspb_dns_proto_rawDesc,
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_dnspb_dns_proto_rawDesc), len(file_dnspb_dns_proto_rawDesc)),
 			NumEnums:      1,
 			NumMessages:   1,
 			NumExtensions: 0,
@@ -264,7 +242,6 @@ func file_dnspb_dns_proto_init() {
 		MessageInfos:      file_dnspb_dns_proto_msgTypes,
 	}.Build()
 	File_dnspb_dns_proto = out.File
-	file_dnspb_dns_proto_rawDesc = nil
 	file_dnspb_dns_proto_goTypes = nil
 	file_dnspb_dns_proto_depIdxs = nil
 }

protobuf/rpcpb/services.proto

@@ -31,6 +31,17 @@ service SliverRPC {
   rpc MonitorListConfig(commonpb.Empty) returns (clientpb.MonitoringProviders);
   rpc MonitorAddConfig(clientpb.MonitoringProvider) returns (commonpb.Response);
   rpc MonitorDelConfig(clientpb.MonitoringProvider) returns (commonpb.Response);
+
+  // *** AI ***
+  rpc GetAIProviders(commonpb.Empty) returns (clientpb.AIProviderConfigs);
+  rpc GetAIConversations(commonpb.Empty) returns (clientpb.AIConversations);
+  rpc GetAIConversation(clientpb.AIConversationReq) returns (clientpb.AIConversation);
+  rpc SaveAIConversation(clientpb.AIConversation) returns (clientpb.AIConversation);
+  rpc DeleteAIConversation(clientpb.AIConversationReq) returns (commonpb.Empty);
+  rpc GetAIConversationMessages(clientpb.AIConversationReq)
+      returns (clientpb.AIConversationMessages);
+  rpc SaveAIConversationMessage(clientpb.AIConversationMessage)
+      returns (clientpb.AIConversationMessage);
     
   // *** Listeners ***
   rpc StartMTLSListener(clientpb.MTLSListenerReq) returns (clientpb.ListenerJob);

server/ai/agentic_loop.go

@@ -0,0 +1,592 @@
+package ai
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	openai "github.com/openai/openai-go/v2"
+	openairesponses "github.com/openai/openai-go/v2/responses"
+	"github.com/openai/openai-go/v2/shared"
+)
+
+const maxAgenticLoopIterations = 100
+
+// AgenticToolDefinition describes a custom function tool exposed to the model.
+type AgenticToolDefinition struct {
+	Name        string
+	Description string
+	Parameters  map[string]any
+}
+
+// AgenticToolExecutor executes model-requested tools for a conversation turn.
+type AgenticToolExecutor interface {
+	ToolDefinitions() []AgenticToolDefinition
+	CallTool(context.Context, string, string) (string, error)
+}
+
+// AgenticEventSink persists and publishes non-context-window UI items.
+type AgenticEventSink interface {
+	ChatMessage(context.Context, AgenticChatMessage) error
+	ReasoningItem(context.Context, AgenticReasoningItem) error
+	ToolCallStarted(context.Context, AgenticToolCall) error
+	ToolCallCompleted(context.Context, AgenticToolCallResult) error
+}
+
+// AgenticChatMessage is a provider-emitted assistant or system chat block.
+type AgenticChatMessage struct {
+	ItemID           string
+	Role             string
+	Content          string
+	Status           string
+	UIOnly           bool
+	IncludeInContext bool
+}
+
+// AgenticReasoningItem is a completed reasoning item emitted by the provider.
+type AgenticReasoningItem struct {
+	ItemID           string
+	Summary          string
+	Content          string
+	EncryptedContent string
+	Status           string
+}
+
+// AgenticToolCall is a provider-emitted function tool call.
+type AgenticToolCall struct {
+	ItemID    string
+	CallID    string
+	Name      string
+	Arguments string
+	Status    string
+}
+
+// AgenticToolCallResult is the resolved tool call state after local execution.
+type AgenticToolCallResult struct {
+	AgenticToolCall
+	Output string
+	Error  error
+}
+
+// SupportsAgenticConversation reports whether the configured runtime can run the
+// Responses API tool loop used by the Sliver AI chat.
+func SupportsAgenticConversation(runtime *RuntimeConfig) bool {
+	if runtime == nil || !runtime.UseResponsesAPI {
+		return false
+	}
+
+	switch NormalizeProviderName(runtime.Provider) {
+	case ProviderOpenAI, ProviderOpenAICompat, ProviderOpenRouter:
+		return true
+	default:
+		return false
+	}
+}
+
+// CompleteConversationAgentic runs a Codex-style Responses API loop that emits
+// reasoning and tool-call items between the user prompt and the final assistant
+// reply. The returned completion is the assistant message that should be stored
+// in the conversation context window.
+func CompleteConversationAgentic(
+	ctx context.Context,
+	runtime *RuntimeConfig,
+	conversation *clientpb.AIConversation,
+	tools AgenticToolExecutor,
+	sink AgenticEventSink,
+) (*Completion, error) {
+	if runtime == nil {
+		return nil, fmt.Errorf("AI runtime config is required")
+	}
+	if conversation == nil {
+		return nil, fmt.Errorf("AI conversation is required")
+	}
+	if !SupportsAgenticConversation(runtime) {
+		return nil, fmt.Errorf("AI provider %q does not support the agentic Responses API loop", runtime.Provider)
+	}
+
+	systemPrompt, messages, err := conversationHistory(conversation)
+	if err != nil {
+		return nil, err
+	}
+
+	client := newOpenAIClient(openAIRequestOptions(runtime)...)
+	currentInput := buildResponseInput(systemPrompt, messages)
+	toolParams := appendOpenAIResponseTools(runtime, buildAgenticToolParams(tools))
+	previousResponseID := ""
+	var maxUsage *ContextWindowUsage
+
+	for step := 0; step < maxAgenticLoopIterations; step++ {
+		params := openairesponses.ResponseNewParams{
+			Input: openairesponses.ResponseNewParamsInputUnion{
+				OfInputItemList: currentInput,
+			},
+			Model: shared.ResponsesModel(runtime.Model),
+		}
+		if previousResponseID != "" {
+			params.PreviousResponseID = openai.String(previousResponseID)
+		}
+		if len(toolParams) > 0 {
+			params.Tools = toolParams
+			params.ParallelToolCalls = openai.Bool(false)
+		}
+		if runtime.MaxOutputTokens > 0 {
+			params.MaxOutputTokens = openai.Int(runtime.MaxOutputTokens)
+		}
+		if runtime.Temperature != nil {
+			params.Temperature = openai.Float(*runtime.Temperature)
+		}
+		if runtime.TopP != nil {
+			params.TopP = openai.Float(*runtime.TopP)
+		}
+		if reasoning, ok := responseReasoningParam(runtime); ok {
+			params.Reasoning = reasoning
+		}
+
+		response, err := client.responses.New(ctx, params)
+		if err != nil {
+			return nil, formatOpenAIError(runtime.Provider, err)
+		}
+
+		maxUsage = mergeContextWindowUsage(maxUsage, resolveContextWindowUsage(
+			ctx,
+			runtime,
+			fallbackString(response.Model, runtime.Model),
+			response.Usage.InputTokens,
+			response.Usage.OutputTokens,
+			response.Usage.TotalTokens,
+		))
+		previousResponseID = strings.TrimSpace(response.ID)
+		nextInput := make(openairesponses.ResponseInputParam, 0)
+		finalTexts := make([]string, 0, len(response.Output))
+		chatItems := make([]AgenticChatMessage, 0)
+
+		for _, item := range response.Output {
+			switch output := item.AsAny().(type) {
+			case openairesponses.ResponseReasoningItem:
+				if sink != nil {
+					if err := sink.ReasoningItem(ctx, AgenticReasoningItem{
+						ItemID:           strings.TrimSpace(output.ID),
+						Summary:          responseReasoningSummary(output),
+						Content:          responseReasoningContent(output),
+						EncryptedContent: strings.TrimSpace(output.EncryptedContent),
+						Status:           strings.TrimSpace(string(output.Status)),
+					}); err != nil {
+						return nil, err
+					}
+				}
+
+			case openairesponses.ResponseFunctionToolCall:
+				toolCall := AgenticToolCall{
+					ItemID:    strings.TrimSpace(output.ID),
+					CallID:    strings.TrimSpace(output.CallID),
+					Name:      strings.TrimSpace(output.Name),
+					Arguments: strings.TrimSpace(output.Arguments),
+					Status:    strings.TrimSpace(string(output.Status)),
+				}
+				if sink != nil {
+					if err := sink.ToolCallStarted(ctx, toolCall); err != nil {
+						return nil, err
+					}
+				}
+
+				toolOutput, toolErr := agenticToolOutput(ctx, tools, toolCall)
+				if sink != nil {
+					if err := sink.ToolCallCompleted(ctx, AgenticToolCallResult{
+						AgenticToolCall: toolCall,
+						Output:          toolOutput,
+						Error:           toolErr,
+					}); err != nil {
+						return nil, err
+					}
+				}
+
+				nextInput = append(nextInput, openairesponses.ResponseInputItemParamOfFunctionCallOutput(toolCall.CallID, toolOutput))
+
+			case openairesponses.ResponseOutputMessage:
+				if text := strings.TrimSpace(responseOutputMessageText(output)); text != "" {
+					chatItems = append(chatItems, AgenticChatMessage{
+						ItemID:           strings.TrimSpace(output.ID),
+						Role:             strings.TrimSpace(string(output.Role)),
+						Content:          text,
+						Status:           strings.TrimSpace(string(output.Status)),
+						IncludeInContext: true,
+					})
+					finalTexts = append(finalTexts, text)
+				}
+			}
+		}
+
+		if len(nextInput) > 0 {
+			if sink != nil {
+				for _, chatItem := range chatItems {
+					chatItem.UIOnly = true
+					chatItem.IncludeInContext = false
+					if err := sink.ChatMessage(ctx, chatItem); err != nil {
+						return nil, err
+					}
+				}
+			}
+			currentInput = nextInput
+			continue
+		}
+
+		finalText := joinTextBlocks(finalTexts)
+		if finalText == "" {
+			finalText = strings.TrimSpace(response.OutputText())
+		}
+		if finalText == "" {
+			return nil, fmt.Errorf("%s response did not include assistant text", runtime.Provider)
+		}
+
+		return &Completion{
+			Provider:           runtime.Provider,
+			Model:              fallbackString(response.Model, runtime.Model),
+			Content:            finalText,
+			ProviderMessageID:  strings.TrimSpace(response.ID),
+			FinishReason:       responseFinishReason(response),
+			ContextWindowUsage: maxUsage,
+		}, nil
+	}
+
+	return nil, fmt.Errorf("AI agent loop exceeded %d provider steps", maxAgenticLoopIterations)
+}
+
+func buildAgenticToolParams(tools AgenticToolExecutor) []openairesponses.ToolUnionParam {
+	if tools == nil {
+		return nil
+	}
+
+	definitions := tools.ToolDefinitions()
+	if len(definitions) == 0 {
+		return nil
+	}
+
+	params := make([]openairesponses.ToolUnionParam, 0, len(definitions))
+	for _, definition := range definitions {
+		name := strings.TrimSpace(definition.Name)
+		if name == "" {
+			continue
+		}
+		tool := openairesponses.ToolParamOfFunction(name, normalizeOpenAIStrictSchema(definition.Parameters), true)
+		if description := strings.TrimSpace(definition.Description); description != "" && tool.OfFunction != nil {
+			tool.OfFunction.Description = openai.String(description)
+		}
+		params = append(params, tool)
+	}
+	if len(params) == 0 {
+		return nil
+	}
+	return params
+}
+
+func normalizeOpenAIStrictSchema(schema map[string]any) map[string]any {
+	if len(schema) == 0 {
+		return map[string]any{
+			"type":                 "object",
+			"properties":           map[string]any{},
+			"required":             []string{},
+			"additionalProperties": false,
+		}
+	}
+
+	cloned, ok := cloneJSONValue(schema).(map[string]any)
+	if !ok || cloned == nil {
+		return schema
+	}
+
+	normalizeOpenAIStrictSchemaNode(cloned)
+	return cloned
+}
+
+func normalizeOpenAIStrictSchemaNode(node map[string]any) {
+	if node == nil {
+		return
+	}
+
+	if properties, ok := schemaProperties(node); ok {
+		required := schemaRequiredSet(node["required"])
+		names := make([]string, 0, len(properties))
+		for name, rawProperty := range properties {
+			names = append(names, name)
+
+			property, ok := rawProperty.(map[string]any)
+			if !ok || property == nil {
+				continue
+			}
+			if !required[name] {
+				makeJSONSchemaNullable(property)
+			}
+			normalizeOpenAIStrictSchemaNode(property)
+		}
+		sort.Strings(names)
+		node["required"] = names
+		if _, exists := node["additionalProperties"]; !exists {
+			node["additionalProperties"] = false
+		}
+	}
+
+	if items, ok := node["items"].(map[string]any); ok {
+		normalizeOpenAIStrictSchemaNode(items)
+	}
+
+	for _, key := range []string{"anyOf", "allOf", "oneOf"} {
+		variants, ok := node[key].([]any)
+		if !ok {
+			continue
+		}
+		for _, rawVariant := range variants {
+			variant, ok := rawVariant.(map[string]any)
+			if !ok || variant == nil {
+				continue
+			}
+			normalizeOpenAIStrictSchemaNode(variant)
+		}
+	}
+}
+
+func schemaProperties(node map[string]any) (map[string]any, bool) {
+	if node == nil {
+		return nil, false
+	}
+
+	rawProperties, ok := node["properties"]
+	if !ok {
+		return nil, false
+	}
+
+	properties, ok := rawProperties.(map[string]any)
+	if !ok {
+		return nil, false
+	}
+	return properties, true
+}
+
+func schemaRequiredSet(raw any) map[string]bool {
+	required := map[string]bool{}
+	switch values := raw.(type) {
+	case []string:
+		for _, value := range values {
+			value = strings.TrimSpace(value)
+			if value != "" {
+				required[value] = true
+			}
+		}
+	case []any:
+		for _, rawValue := range values {
+			value, ok := rawValue.(string)
+			if !ok {
+				continue
+			}
+			value = strings.TrimSpace(value)
+			if value != "" {
+				required[value] = true
+			}
+		}
+	}
+	return required
+}
+
+func makeJSONSchemaNullable(node map[string]any) {
+	if node == nil {
+		return
+	}
+
+	switch value := node["type"].(type) {
+	case string:
+		value = strings.TrimSpace(value)
+		if value != "" && value != "null" {
+			node["type"] = []string{value, "null"}
+		}
+	case []string:
+		if !stringSliceContains(value, "null") {
+			node["type"] = append(append([]string(nil), value...), "null")
+		}
+	case []any:
+		if !anyStringSliceContains(value, "null") {
+			node["type"] = append(append([]any(nil), value...), "null")
+		}
+	default:
+		if _, ok := node["anyOf"]; ok {
+			appendSchemaVariant(node, "anyOf", map[string]any{"type": "null"})
+		} else if _, ok := node["properties"]; ok {
+			node["type"] = []string{"object", "null"}
+		} else if _, ok := node["items"]; ok {
+			node["type"] = []string{"array", "null"}
+		}
+	}
+
+	if enum, ok := nullableEnum(node["enum"]); ok {
+		node["enum"] = enum
+	}
+}
+
+func appendSchemaVariant(node map[string]any, key string, variant map[string]any) {
+	if node == nil || variant == nil {
+		return
+	}
+
+	rawVariants, ok := node[key].([]any)
+	if !ok {
+		node[key] = []any{variant}
+		return
+	}
+	for _, rawVariant := range rawVariants {
+		existing, ok := rawVariant.(map[string]any)
+		if !ok || existing == nil {
+			continue
+		}
+		if len(existing) == len(variant) {
+			matched := true
+			for variantKey, variantValue := range variant {
+				if existing[variantKey] != variantValue {
+					matched = false
+					break
+				}
+			}
+			if matched {
+				return
+			}
+		}
+	}
+	node[key] = append(rawVariants, variant)
+}
+
+func nullableEnum(raw any) (any, bool) {
+	switch values := raw.(type) {
+	case []any:
+		for _, value := range values {
+			if value == nil {
+				return values, true
+			}
+		}
+		return append(append([]any(nil), values...), nil), true
+	case []string:
+		enum := make([]any, 0, len(values)+1)
+		for _, value := range values {
+			enum = append(enum, value)
+		}
+		enum = append(enum, nil)
+		return enum, true
+	default:
+		return nil, false
+	}
+}
+
+func stringSliceContains(values []string, needle string) bool {
+	for _, value := range values {
+		if strings.TrimSpace(value) == needle {
+			return true
+		}
+	}
+	return false
+}
+
+func anyStringSliceContains(values []any, needle string) bool {
+	for _, rawValue := range values {
+		value, ok := rawValue.(string)
+		if ok && strings.TrimSpace(value) == needle {
+			return true
+		}
+	}
+	return false
+}
+
+func cloneJSONValue(value any) any {
+	switch typed := value.(type) {
+	case map[string]any:
+		cloned := make(map[string]any, len(typed))
+		for key, nested := range typed {
+			cloned[key] = cloneJSONValue(nested)
+		}
+		return cloned
+	case []any:
+		cloned := make([]any, len(typed))
+		for idx, nested := range typed {
+			cloned[idx] = cloneJSONValue(nested)
+		}
+		return cloned
+	case []string:
+		cloned := make([]string, len(typed))
+		copy(cloned, typed)
+		return cloned
+	default:
+		return typed
+	}
+}
+
+func responseOutputMessageText(message openairesponses.ResponseOutputMessage) string {
+	parts := make([]string, 0, len(message.Content))
+	for _, content := range message.Content {
+		switch part := content.AsAny().(type) {
+		case openairesponses.ResponseOutputText:
+			if text := strings.TrimSpace(part.Text); text != "" {
+				parts = append(parts, text)
+			}
+		case openairesponses.ResponseOutputRefusal:
+			if refusal := strings.TrimSpace(part.Refusal); refusal != "" {
+				parts = append(parts, refusal)
+			}
+		}
+	}
+	return joinTextBlocks(parts)
+}
+
+func responseReasoningSummary(item openairesponses.ResponseReasoningItem) string {
+	summaries := make([]string, 0, len(item.Summary))
+	for _, summary := range item.Summary {
+		if text := strings.TrimSpace(summary.Text); text != "" {
+			summaries = append(summaries, text)
+		}
+	}
+	return joinTextBlocks(summaries)
+}
+
+func responseReasoningContent(item openairesponses.ResponseReasoningItem) string {
+	content := make([]string, 0, len(item.Content))
+	for _, block := range item.Content {
+		if text := strings.TrimSpace(block.Text); text != "" {
+			content = append(content, text)
+		}
+	}
+	return joinTextBlocks(content)
+}
+
+func agenticToolOutput(ctx context.Context, tools AgenticToolExecutor, toolCall AgenticToolCall) (string, error) {
+	if tools == nil {
+		err := fmt.Errorf("tool executor is not configured")
+		return agenticToolErrorJSON(err), err
+	}
+
+	output, err := tools.CallTool(ctx, toolCall.Name, toolCall.Arguments)
+	if err != nil {
+		return agenticToolErrorJSON(err), err
+	}
+
+	output = strings.TrimSpace(output)
+	if output == "" {
+		empty, marshalErr := json.Marshal(map[string]any{"ok": true})
+		if marshalErr != nil {
+			return `{"ok":true}`, nil
+		}
+		return string(empty), nil
+	}
+	return output, nil
+}
+
+func agenticToolErrorJSON(err error) string {
+	payload := map[string]any{
+		"ok":    false,
+		"error": "tool call failed",
+	}
+	if err != nil && strings.TrimSpace(err.Error()) != "" {
+		payload["error"] = truncateForError(err.Error())
+	}
+	data, marshalErr := json.Marshal(payload)
+	if marshalErr != nil {
+		return `{"ok":false,"error":"tool call failed"}`
+	}
+	return string(data)
+}

server/ai/agentic_loop_test.go

@@ -0,0 +1,137 @@
+package ai
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+)
+
+type staticAgenticToolExecutor struct {
+	definitions []AgenticToolDefinition
+}
+
+func (s staticAgenticToolExecutor) ToolDefinitions() []AgenticToolDefinition {
+	return s.definitions
+}
+
+func (staticAgenticToolExecutor) CallTool(_ context.Context, _ string, _ string) (string, error) {
+	return "", nil
+}
+
+func TestBuildAgenticToolParamsNormalizesStrictOpenAISchemas(t *testing.T) {
+	params := buildAgenticToolParams(staticAgenticToolExecutor{
+		definitions: []AgenticToolDefinition{
+			{
+				Name: "fs_ls",
+				Parameters: map[string]any{
+					"type": "object",
+					"properties": map[string]any{
+						"session_id": map[string]any{"type": "string"},
+						"beacon_id":  map[string]any{"type": "string"},
+						"path":       map[string]any{"type": "string"},
+					},
+					"additionalProperties": false,
+				},
+			},
+		},
+	})
+	if len(params) != 1 || params[0].OfFunction == nil {
+		t.Fatalf("expected one function tool param, got %+v", params)
+	}
+
+	parameters := params[0].OfFunction.Parameters
+	required := schemaRequiredSet(parameters["required"])
+	for _, field := range []string{"session_id", "beacon_id", "path"} {
+		if !required[field] {
+			t.Fatalf("expected strict schema to require %q, got %#v", field, parameters["required"])
+		}
+	}
+
+	properties, ok := parameters["properties"].(map[string]any)
+	if !ok {
+		t.Fatalf("expected strict schema properties map, got %#v", parameters["properties"])
+	}
+	for _, field := range []string{"session_id", "beacon_id", "path"} {
+		property, ok := properties[field].(map[string]any)
+		if !ok {
+			t.Fatalf("expected property %q to be a schema object, got %#v", field, properties[field])
+		}
+		typeValues, ok := property["type"].([]string)
+		if !ok {
+			t.Fatalf("expected property %q type to be []string, got %#v", field, property["type"])
+		}
+		if !stringSliceContains(typeValues, "string") || !stringSliceContains(typeValues, "null") {
+			t.Fatalf("expected property %q to allow string and null, got %#v", field, typeValues)
+		}
+	}
+}
+
+func TestCompleteConversationAgenticRequestsReasoningSummaryForOpenAI(t *testing.T) {
+	type capturedRequest struct {
+		Body string
+	}
+
+	requests := make(chan capturedRequest, 1)
+	restoreClient := SetHTTPClientForTests(&http.Client{
+		Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
+			defer r.Body.Close()
+
+			payload, err := io.ReadAll(r.Body)
+			if err != nil {
+				t.Fatalf("read request body: %v", err)
+			}
+
+			requests <- capturedRequest{Body: string(payload)}
+			return jsonResponse(http.StatusOK, `{
+				"id": "resp_123",
+				"model": "gpt-5.4",
+				"status": "completed",
+				"output": [
+					{
+						"type": "message",
+						"id": "msg_123",
+						"role": "assistant",
+						"content": [
+							{"type": "output_text", "text": "Done."}
+						]
+					}
+				]
+			}`), nil
+		}),
+	})
+	defer restoreClient()
+
+	completion, err := CompleteConversationAgentic(context.Background(), &RuntimeConfig{
+		Provider:        ProviderOpenAI,
+		Model:           "gpt-5.4",
+		UseResponsesAPI: true,
+		ThinkingLevel:   "high",
+		APIKey:          "openai-key",
+	}, &clientpb.AIConversation{
+		Messages: []*clientpb.AIConversationMessage{
+			{Role: "user", Content: "Say hi."},
+		},
+	}, nil, nil)
+	if err != nil {
+		t.Fatalf("complete agentic conversation: %v", err)
+	}
+
+	request := <-requests
+	for _, fragment := range []string{
+		`"type":"web_search"`,
+		`"search_context_size":"medium"`,
+		`"effort":"high"`,
+		`"summary":"auto"`,
+	} {
+		if !strings.Contains(request.Body, fragment) {
+			t.Fatalf("expected agentic request body to contain %q, got %s", fragment, request.Body)
+		}
+	}
+	if completion.Content != "Done." {
+		t.Fatalf("unexpected completion content: %q", completion.Content)
+	}
+}

server/ai/ai.go

@@ -0,0 +1,235 @@
+package ai
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2026  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/server/configs"
+)
+
+const (
+	ProviderAnthropic    = "anthropic"
+	ProviderGoogle       = "google"
+	ProviderOpenAI       = "openai"
+	ProviderOpenAICompat = "openai-compat"
+	ProviderOpenRouter   = "openrouter"
+)
+
+var (
+	// ErrUnsupportedProvider - Returned when an AI provider is unknown.
+	ErrUnsupportedProvider = errors.New("unsupported AI provider")
+)
+
+// Provider - Provider metadata derived from server configuration.
+type Provider struct {
+	Name   string
+	Config *configs.AIProviderConfig
+}
+
+// SupportedProviders - Returns the currently supported server-side AI providers.
+func SupportedProviders() []string {
+	return []string{
+		ProviderAnthropic,
+		ProviderGoogle,
+		ProviderOpenAI,
+		ProviderOpenAICompat,
+		ProviderOpenRouter,
+	}
+}
+
+// NormalizeProviderName - Convert user supplied provider names to canonical identifiers.
+func NormalizeProviderName(name string) string {
+	normalized := strings.ToLower(strings.TrimSpace(name))
+	switch normalized {
+	case "gemini":
+		return ProviderGoogle
+	case "openai_compat", "openaicompat", "openai-compatible":
+		return ProviderOpenAICompat
+	default:
+		return normalized
+	}
+}
+
+// IsSupportedProvider - Indicates whether the provider is supported by the server scaffolding.
+func IsSupportedProvider(name string) bool {
+	switch NormalizeProviderName(name) {
+	case ProviderAnthropic, ProviderGoogle, ProviderOpenAI, ProviderOpenAICompat, ProviderOpenRouter:
+		return true
+	default:
+		return false
+	}
+}
+
+// ProviderFromConfig - Resolve a configured provider by name.
+func ProviderFromConfig(name string) (*Provider, error) {
+	cfg := configs.GetServerConfig()
+	if cfg == nil || cfg.AI == nil {
+		return nil, ErrUnsupportedProvider
+	}
+
+	switch NormalizeProviderName(name) {
+	case ProviderAnthropic:
+		return &Provider{Name: ProviderAnthropic, Config: cfg.AI.Anthropic}, nil
+	case ProviderGoogle:
+		return &Provider{Name: ProviderGoogle, Config: cfg.AI.Google}, nil
+	case ProviderOpenAI:
+		return &Provider{Name: ProviderOpenAI, Config: cfg.AI.OpenAI}, nil
+	case ProviderOpenAICompat:
+		return &Provider{Name: ProviderOpenAICompat, Config: cfg.AI.OpenAICompat}, nil
+	case ProviderOpenRouter:
+		return &Provider{Name: ProviderOpenRouter, Config: cfg.AI.OpenRouter}, nil
+	default:
+		return nil, ErrUnsupportedProvider
+	}
+}
+
+// ConfiguredProviders - Return provider availability without exposing configured secrets.
+func ConfiguredProviders() []*clientpb.AIProviderConfig {
+	return ConfiguredProvidersFromConfig(configs.GetServerConfig())
+}
+
+// ConfiguredProvidersFromConfig - Return provider availability for a specific config.
+func ConfiguredProvidersFromConfig(cfg *configs.ServerConfig) []*clientpb.AIProviderConfig {
+	providers := make([]*clientpb.AIProviderConfig, 0, len(SupportedProviders()))
+	for _, name := range SupportedProviders() {
+		providerConfig := aiProviderConfig(cfg, name)
+		providers = append(providers, &clientpb.AIProviderConfig{
+			Name:       name,
+			Configured: isProviderConfigured(name, providerConfig),
+		})
+	}
+	return providers
+}
+
+// SafeConfigSummary - Return the client-safe AI configuration summary.
+func SafeConfigSummary() *clientpb.AIConfigSummary {
+	return SafeConfigSummaryFromConfig(configs.GetServerConfig())
+}
+
+// SafeConfigSummaryFromConfig - Return the client-safe AI configuration summary for a specific config.
+func SafeConfigSummaryFromConfig(cfg *configs.ServerConfig) *clientpb.AIConfigSummary {
+	summary := &clientpb.AIConfigSummary{}
+	if cfg != nil && cfg.AI != nil {
+		summary.ThinkingLevel = strings.TrimSpace(cfg.AI.ThinkingLevel)
+		summary.SystemPrompt = strings.TrimSpace(cfg.AI.SystemPrompt)
+	}
+
+	provider, providerConfig := selectedProviderConfig(cfg)
+	summary.Provider = provider
+	summary.Model = configuredDefaultModel(provider, selectedAIConfig(cfg), providerConfig)
+
+	switch {
+	case cfg == nil || cfg.AI == nil:
+		summary.Error = "server AI is not configured; run `ai-config` on the server"
+	case provider == "":
+		summary.Error = "server AI is missing a configured provider; run `ai-config` on the server"
+	case !isProviderConfigured(provider, providerConfig):
+		summary.Error = missingProviderConfigError(provider)
+	default:
+		summary.Valid = true
+	}
+
+	return summary
+}
+
+func selectedProviderConfig(cfg *configs.ServerConfig) (string, *configs.AIProviderConfig) {
+	if cfg == nil || cfg.AI == nil {
+		return "", nil
+	}
+
+	explicitProvider := NormalizeProviderName(cfg.AI.Provider)
+	if IsSupportedProvider(explicitProvider) {
+		return explicitProvider, aiProviderConfig(cfg, explicitProvider)
+	}
+
+	for _, provider := range SupportedProviders() {
+		providerConfig := aiProviderConfig(cfg, provider)
+		if isProviderConfigured(provider, providerConfig) {
+			return provider, providerConfig
+		}
+	}
+
+	return "", nil
+}
+
+func aiProviderConfig(cfg *configs.ServerConfig, provider string) *configs.AIProviderConfig {
+	if cfg == nil || cfg.AI == nil {
+		return nil
+	}
+
+	switch NormalizeProviderName(provider) {
+	case ProviderAnthropic:
+		return cfg.AI.Anthropic
+	case ProviderGoogle:
+		return cfg.AI.Google
+	case ProviderOpenAI:
+		return cfg.AI.OpenAI
+	case ProviderOpenAICompat:
+		return cfg.AI.OpenAICompat
+	case ProviderOpenRouter:
+		return cfg.AI.OpenRouter
+	default:
+		return nil
+	}
+}
+
+func isProviderConfigured(provider string, providerConfig *configs.AIProviderConfig) bool {
+	if providerConfig == nil {
+		return false
+	}
+
+	switch NormalizeProviderName(provider) {
+	case ProviderAnthropic:
+		return strings.TrimSpace(providerConfig.APIKey) != "" ||
+			providerConfig.UseBedrock ||
+			(strings.TrimSpace(providerConfig.Project) != "" && strings.TrimSpace(providerConfig.Location) != "")
+	case ProviderGoogle:
+		return strings.TrimSpace(providerConfig.APIKey) != "" ||
+			(strings.TrimSpace(providerConfig.Project) != "" && strings.TrimSpace(providerConfig.Location) != "")
+	case ProviderOpenAI:
+		return strings.TrimSpace(providerConfig.APIKey) != ""
+	case ProviderOpenAICompat:
+		return strings.TrimSpace(providerConfig.BaseURL) != ""
+	case ProviderOpenRouter:
+		return strings.TrimSpace(providerConfig.APIKey) != ""
+	default:
+		return false
+	}
+}
+
+func missingProviderConfigError(provider string) string {
+	switch NormalizeProviderName(provider) {
+	case ProviderAnthropic:
+		return "server AI provider \"anthropic\" needs an API key, Bedrock mode, or a Vertex project/location; run `ai-config` on the server"
+	case ProviderGoogle:
+		return "server AI provider \"google\" needs a Gemini API key or a Vertex project/location; run `ai-config` on the server"
+	case ProviderOpenAI:
+		return "server AI provider \"openai\" is missing an API key; run `ai-config` on the server"
+	case ProviderOpenAICompat:
+		return "server AI provider \"openai-compat\" is missing a base URL; run `ai-config` on the server"
+	case ProviderOpenRouter:
+		return "server AI provider \"openrouter\" is missing an API key; run `ai-config` on the server"
+	default:
+		return fmt.Sprintf("server AI provider %q is not fully configured; run `ai-config` on the server", provider)
+	}
+}

server/ai/ai_test.go

@@ -0,0 +1,164 @@
+package ai
+
+import (
+	"testing"
+
+	"github.com/bishopfox/sliver/server/configs"
+)
+
+func TestSafeConfigSummaryFromConfigUsesExplicitConfiguredProvider(t *testing.T) {
+	cfg := &configs.ServerConfig{
+		AI: &configs.AIConfig{
+			Provider:      ProviderOpenAI,
+			ThinkingLevel: "high",
+			SystemPrompt:  "Stay concise.",
+			OpenAI:        &configs.AIProviderConfig{APIKey: "openai-key", Models: []string{"gpt-test", "gpt-test-mini"}},
+			Anthropic:     &configs.AIProviderConfig{APIKey: "anthropic-key"},
+		},
+	}
+
+	summary := SafeConfigSummaryFromConfig(cfg)
+	if !summary.GetValid() {
+		t.Fatalf("expected config to be valid, got error %q", summary.GetError())
+	}
+	if summary.GetProvider() != ProviderOpenAI {
+		t.Fatalf("expected provider %q, got %q", ProviderOpenAI, summary.GetProvider())
+	}
+	if summary.GetModel() != "gpt-test" {
+		t.Fatalf("expected model %q, got %q", "gpt-test", summary.GetModel())
+	}
+	if summary.GetThinkingLevel() != "high" {
+		t.Fatalf("expected thinking level %q, got %q", "high", summary.GetThinkingLevel())
+	}
+	if summary.GetSystemPrompt() != "Stay concise." {
+		t.Fatalf("expected system prompt %q, got %q", "Stay concise.", summary.GetSystemPrompt())
+	}
+}
+
+func TestSafeConfigSummaryFromConfigFallsBackToLegacySharedModel(t *testing.T) {
+	cfg := &configs.ServerConfig{
+		AI: &configs.AIConfig{
+			Provider: ProviderOpenAI,
+			Model:    "legacy-model",
+			OpenAI:   &configs.AIProviderConfig{APIKey: "openai-key"},
+		},
+	}
+
+	summary := SafeConfigSummaryFromConfig(cfg)
+	if summary.GetModel() != "legacy-model" {
+		t.Fatalf("expected legacy model %q, got %q", "legacy-model", summary.GetModel())
+	}
+}
+
+func TestSafeConfigSummaryFromConfigFallsBackToConfiguredProvider(t *testing.T) {
+	cfg := &configs.ServerConfig{
+		AI: &configs.AIConfig{
+			OpenAI:       &configs.AIProviderConfig{},
+			OpenAICompat: &configs.AIProviderConfig{},
+			OpenRouter:   &configs.AIProviderConfig{},
+			Google:       &configs.AIProviderConfig{},
+			Anthropic:    &configs.AIProviderConfig{APIKey: "anthropic-key"},
+		},
+	}
+
+	summary := SafeConfigSummaryFromConfig(cfg)
+	if !summary.GetValid() {
+		t.Fatalf("expected fallback config to be valid, got error %q", summary.GetError())
+	}
+	if summary.GetProvider() != ProviderAnthropic {
+		t.Fatalf("expected provider fallback %q, got %q", ProviderAnthropic, summary.GetProvider())
+	}
+}
+
+func TestSafeConfigSummaryFromConfigRejectsExplicitProviderWithoutAPIKey(t *testing.T) {
+	cfg := &configs.ServerConfig{
+		AI: &configs.AIConfig{
+			Provider:  ProviderOpenAI,
+			OpenAI:    &configs.AIProviderConfig{},
+			Anthropic: &configs.AIProviderConfig{APIKey: "anthropic-key"},
+		},
+	}
+
+	summary := SafeConfigSummaryFromConfig(cfg)
+	if summary.GetValid() {
+		t.Fatal("expected config to be invalid")
+	}
+	if summary.GetProvider() != ProviderOpenAI {
+		t.Fatalf("expected provider %q, got %q", ProviderOpenAI, summary.GetProvider())
+	}
+	expected := "server AI provider \"openai\" is missing an API key; run `ai-config` on the server"
+	if summary.GetError() != expected {
+		t.Fatalf("expected error %q, got %q", expected, summary.GetError())
+	}
+}
+
+func TestSafeConfigSummaryFromConfigAcceptsGoogleVertexConfiguration(t *testing.T) {
+	cfg := &configs.ServerConfig{
+		AI: &configs.AIConfig{
+			Provider: ProviderGoogle,
+			Google: &configs.AIProviderConfig{
+				Project:  "vertex-project",
+				Location: "us-central1",
+			},
+		},
+	}
+
+	summary := SafeConfigSummaryFromConfig(cfg)
+	if !summary.GetValid() {
+		t.Fatalf("expected google vertex config to be valid, got error %q", summary.GetError())
+	}
+	if summary.GetProvider() != ProviderGoogle {
+		t.Fatalf("expected provider %q, got %q", ProviderGoogle, summary.GetProvider())
+	}
+}
+
+func TestSafeConfigSummaryFromConfigAcceptsOpenAICompatBaseURL(t *testing.T) {
+	cfg := &configs.ServerConfig{
+		AI: &configs.AIConfig{
+			Provider: ProviderOpenAICompat,
+			OpenAICompat: &configs.AIProviderConfig{
+				BaseURL: "http://127.0.0.1:11434/v1",
+			},
+		},
+	}
+
+	summary := SafeConfigSummaryFromConfig(cfg)
+	if !summary.GetValid() {
+		t.Fatalf("expected openai-compat config to be valid, got error %q", summary.GetError())
+	}
+	if summary.GetProvider() != ProviderOpenAICompat {
+		t.Fatalf("expected provider %q, got %q", ProviderOpenAICompat, summary.GetProvider())
+	}
+}
+
+func TestConfiguredProvidersFromConfigReportsAvailabilityOnly(t *testing.T) {
+	cfg := &configs.ServerConfig{
+		AI: &configs.AIConfig{
+			Anthropic:    &configs.AIProviderConfig{},
+			Google:       &configs.AIProviderConfig{Project: "vertex-project", Location: "us-central1"},
+			OpenAI:       &configs.AIProviderConfig{APIKey: "openai-key"},
+			OpenAICompat: &configs.AIProviderConfig{BaseURL: "http://127.0.0.1:8080/v1"},
+			OpenRouter:   &configs.AIProviderConfig{},
+		},
+	}
+
+	providers := ConfiguredProvidersFromConfig(cfg)
+	if len(providers) != len(SupportedProviders()) {
+		t.Fatalf("expected %d providers, got %d", len(SupportedProviders()), len(providers))
+	}
+	if providers[0].GetName() != ProviderAnthropic || providers[0].GetConfigured() {
+		t.Fatalf("expected anthropic to be present and unconfigured, got %+v", providers[0])
+	}
+	if providers[1].GetName() != ProviderGoogle || !providers[1].GetConfigured() {
+		t.Fatalf("expected google to be present and configured, got %+v", providers[1])
+	}
+	if providers[2].GetName() != ProviderOpenAI || !providers[2].GetConfigured() {
+		t.Fatalf("expected openai to be present and configured, got %+v", providers[2])
+	}
+	if providers[3].GetName() != ProviderOpenAICompat || !providers[3].GetConfigured() {
+		t.Fatalf("expected openai-compat to be present and configured, got %+v", providers[3])
+	}
+	if providers[4].GetName() != ProviderOpenRouter || providers[4].GetConfigured() {
+		t.Fatalf("expected openrouter to be present and unconfigured, got %+v", providers[4])
+	}
+}

server/ai/completion.go

@@ -0,0 +1,423 @@
+package ai
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/server/configs"
+	"github.com/bishopfox/sliver/util/clientpbutil"
+)
+
+const (
+	defaultOpenAIModel       = "gpt-5.2"
+	defaultAnthropicModel    = "claude-sonnet-4-0"
+	defaultGoogleModel       = "gemini-2.5-pro"
+	defaultOpenRouterModel   = "openai/gpt-5"
+	defaultCompletionTimeout = 2 * time.Minute
+)
+
+var httpClient = &http.Client{Timeout: defaultCompletionTimeout}
+
+// SetHTTPClientForTests swaps the provider HTTP client and returns a restore function.
+func SetHTTPClientForTests(client *http.Client) func() {
+	previous := httpClient
+	if client == nil {
+		client = &http.Client{Timeout: defaultCompletionTimeout}
+	}
+	httpClient = client
+	return func() {
+		httpClient = previous
+	}
+}
+
+// RuntimeConfig captures the provider settings used for a single completion run.
+type RuntimeConfig struct {
+	Provider         string
+	Model            string
+	ThinkingLevel    string
+	MaxOutputTokens  int64
+	Temperature      *float64
+	TopP             *float64
+	TopK             *int64
+	PresencePenalty  *float64
+	FrequencyPenalty *float64
+
+	APIKey          string
+	BaseURL         string
+	Headers         map[string]string
+	UserAgent       string
+	Organization    string
+	Project         string
+	Location        string
+	SkipAuth        bool
+	UseResponsesAPI bool
+	UseBedrock      bool
+}
+
+// Completion contains the persisted assistant response details.
+type Completion struct {
+	Provider           string
+	Model              string
+	Content            string
+	ProviderMessageID  string
+	FinishReason       string
+	ContextWindowUsage *ContextWindowUsage
+}
+
+type providerMessage struct {
+	Role    string
+	Content string
+}
+
+// ResolveRuntimeConfig derives the provider settings for a stored conversation.
+func ResolveRuntimeConfig(cfg *configs.ServerConfig, conversation *clientpb.AIConversation) (*RuntimeConfig, error) {
+	runtime := &RuntimeConfig{
+		ThinkingLevel: normalizeThinkingLevel(cfg),
+	}
+	var providerConfig *configs.AIProviderConfig
+	if cfg != nil && cfg.AI != nil {
+		runtime.MaxOutputTokens = cfg.AI.MaxOutputTokens
+		runtime.Temperature = copyOptionalFloat(cfg.AI.Temperature)
+		runtime.TopP = copyOptionalFloat(cfg.AI.TopP)
+		runtime.TopK = copyOptionalInt(cfg.AI.TopK)
+		runtime.PresencePenalty = copyOptionalFloat(cfg.AI.PresencePenalty)
+		runtime.FrequencyPenalty = copyOptionalFloat(cfg.AI.FrequencyPenalty)
+	}
+
+	if conversation != nil {
+		runtime.Provider = NormalizeProviderName(conversation.GetProvider())
+		runtime.Model = strings.TrimSpace(conversation.GetModel())
+		if thinkingLevel := NormalizeThinkingLevelValue(conversation.GetThinkingLevel()); thinkingLevel != "" {
+			runtime.ThinkingLevel = thinkingLevel
+		}
+	}
+
+	if runtime.Provider == "" {
+		selectedProvider, selectedProviderConfig := selectedProviderConfig(cfg)
+		runtime.Provider = selectedProvider
+		providerConfig = selectedProviderConfig
+		applyProviderRuntimeConfig(runtime, providerConfig)
+	} else {
+		if !IsSupportedProvider(runtime.Provider) {
+			return runtime, fmt.Errorf("unsupported AI provider %q", runtime.Provider)
+		}
+		providerConfig = aiProviderConfig(cfg, runtime.Provider)
+		applyProviderRuntimeConfig(runtime, providerConfig)
+	}
+
+	if runtime.Model == "" {
+		runtime.Model = configuredDefaultModel(runtime.Provider, selectedAIConfig(cfg), providerConfig)
+	}
+	runtime.UseResponsesAPI = useResponsesAPI(runtime.Provider, providerConfig)
+
+	switch {
+	case runtime.Provider == "":
+		return runtime, fmt.Errorf("server AI provider is not configured; run `ai-config` on the server")
+	case !IsSupportedProvider(runtime.Provider):
+		return runtime, fmt.Errorf("unsupported AI provider %q", runtime.Provider)
+	case !runtimeProviderConfigured(runtime):
+		return runtime, errors.New(missingProviderConfigError(runtime.Provider))
+	case runtime.Model == "":
+		return runtime, fmt.Errorf("server AI provider %q is missing a model; update `ai.%s.models` or choose a provider default", runtime.Provider, providerConfigKey(runtime.Provider))
+	case !completionDriverAvailable(runtime):
+		return runtime, missingDriverError(runtime)
+	default:
+		return runtime, nil
+	}
+}
+
+// CompleteConversation sends the stored conversation history to the provider and returns the assistant reply.
+func CompleteConversation(ctx context.Context, runtime *RuntimeConfig, conversation *clientpb.AIConversation) (*Completion, error) {
+	if runtime == nil {
+		return nil, fmt.Errorf("AI runtime config is required")
+	}
+	if conversation == nil {
+		return nil, fmt.Errorf("AI conversation is required")
+	}
+
+	systemPrompt, messages, err := conversationHistory(conversation)
+	if err != nil {
+		return nil, err
+	}
+
+	driver, err := selectCompletionDriver(runtime)
+	if err != nil {
+		return nil, err
+	}
+
+	return driver.CompleteConversation(ctx, runtime, &completionRequest{
+		SystemPrompt: systemPrompt,
+		Messages:     messages,
+	})
+}
+
+func conversationHistory(conversation *clientpb.AIConversation) (string, []providerMessage, error) {
+	if conversation == nil {
+		return "", nil, fmt.Errorf("AI conversation is required")
+	}
+
+	systemPrompt := strings.TrimSpace(conversation.GetSystemPrompt())
+	messages := make([]providerMessage, 0, len(conversation.GetMessages()))
+	for _, message := range conversation.GetMessages() {
+		if message == nil {
+			continue
+		}
+		if !clientpbutil.AIConversationMessageIncludesContext(message) {
+			continue
+		}
+		if message.GetKind() != clientpb.AIConversationMessageKind_AI_MESSAGE_KIND_CHAT {
+			continue
+		}
+
+		role := strings.ToLower(strings.TrimSpace(message.GetRole()))
+		content := strings.TrimSpace(message.GetContent())
+		if content == "" {
+			continue
+		}
+
+		switch role {
+		case "user", "assistant":
+			messages = append(messages, providerMessage{
+				Role:    role,
+				Content: content,
+			})
+		case "system":
+			if systemPrompt == "" {
+				systemPrompt = content
+			}
+		default:
+			continue
+		}
+	}
+
+	if len(messages) == 0 {
+		return systemPrompt, nil, fmt.Errorf("AI conversation has no user or assistant messages")
+	}
+	if messages[len(messages)-1].Role != "user" {
+		return systemPrompt, nil, fmt.Errorf("AI conversation is not awaiting an assistant response")
+	}
+
+	return systemPrompt, messages, nil
+}
+
+func defaultModelForProvider(provider string) string {
+	switch NormalizeProviderName(provider) {
+	case ProviderOpenAI:
+		return defaultOpenAIModel
+	case ProviderAnthropic:
+		return defaultAnthropicModel
+	case ProviderGoogle:
+		return defaultGoogleModel
+	case ProviderOpenRouter:
+		return defaultOpenRouterModel
+	default:
+		return ""
+	}
+}
+
+func configuredDefaultModel(provider string, aiConfig *configs.AIConfig, providerConfig *configs.AIProviderConfig) string {
+	if providerConfig != nil {
+		for _, model := range providerConfig.Models {
+			model = strings.TrimSpace(model)
+			if model != "" {
+				return model
+			}
+		}
+	}
+	if aiConfig != nil {
+		if legacyModel := strings.TrimSpace(aiConfig.Model); legacyModel != "" {
+			return legacyModel
+		}
+	}
+	return defaultModelForProvider(provider)
+}
+
+func providerConfigKey(provider string) string {
+	switch NormalizeProviderName(provider) {
+	case ProviderOpenAICompat:
+		return "openai_compat"
+	default:
+		return NormalizeProviderName(provider)
+	}
+}
+
+func selectedAIConfig(cfg *configs.ServerConfig) *configs.AIConfig {
+	if cfg == nil {
+		return nil
+	}
+	return cfg.AI
+}
+
+func completionDriverAvailable(runtime *RuntimeConfig) bool {
+	_, err := selectCompletionDriver(runtime)
+	return err == nil
+}
+
+func missingDriverError(runtime *RuntimeConfig) error {
+	if runtime == nil {
+		return fmt.Errorf("AI runtime config is required")
+	}
+	_, err := selectCompletionDriver(runtime)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func NormalizeThinkingLevelValue(value string) string {
+	switch strings.ToLower(strings.TrimSpace(value)) {
+	case "low", "medium", "high", "xhigh", "disabled":
+		return strings.ToLower(strings.TrimSpace(value))
+	default:
+		return ""
+	}
+}
+
+func normalizeThinkingLevel(cfg *configs.ServerConfig) string {
+	if cfg == nil || cfg.AI == nil {
+		return ""
+	}
+	return NormalizeThinkingLevelValue(cfg.AI.ThinkingLevel)
+}
+
+func applyProviderRuntimeConfig(runtime *RuntimeConfig, providerConfig *configs.AIProviderConfig) {
+	if runtime == nil || providerConfig == nil {
+		return
+	}
+	runtime.APIKey = strings.TrimSpace(providerConfig.APIKey)
+	runtime.BaseURL = strings.TrimSpace(providerConfig.BaseURL)
+	runtime.Headers = copyStringMap(providerConfig.Headers)
+	runtime.UserAgent = strings.TrimSpace(providerConfig.UserAgent)
+	runtime.Organization = strings.TrimSpace(providerConfig.Organization)
+	runtime.Project = strings.TrimSpace(providerConfig.Project)
+	runtime.Location = strings.TrimSpace(providerConfig.Location)
+	runtime.SkipAuth = providerConfig.SkipAuth
+	if providerConfig.UseResponsesAPI != nil {
+		runtime.UseResponsesAPI = *providerConfig.UseResponsesAPI
+	}
+	runtime.UseBedrock = providerConfig.UseBedrock
+}
+
+func useResponsesAPI(provider string, providerConfig *configs.AIProviderConfig) bool {
+	if providerConfig != nil && providerConfig.UseResponsesAPI != nil {
+		return *providerConfig.UseResponsesAPI
+	}
+	return NormalizeProviderName(provider) == ProviderOpenAI
+}
+
+func providerHeaders(runtime *RuntimeConfig) map[string]string {
+	if runtime == nil {
+		return nil
+	}
+
+	if len(runtime.Headers) == 0 && runtime.UserAgent == "" {
+		return nil
+	}
+
+	headers := make(map[string]string, len(runtime.Headers)+1)
+	for key, value := range runtime.Headers {
+		if strings.TrimSpace(key) == "" || strings.TrimSpace(value) == "" {
+			continue
+		}
+		headers[key] = value
+	}
+	if runtime.UserAgent != "" {
+		headers["User-Agent"] = runtime.UserAgent
+	}
+	if len(headers) == 0 {
+		return nil
+	}
+	return headers
+}
+
+func runtimeProviderConfigured(runtime *RuntimeConfig) bool {
+	if runtime == nil {
+		return false
+	}
+	switch runtime.Provider {
+	case ProviderAnthropic:
+		return runtime.APIKey != "" ||
+			runtime.UseBedrock ||
+			(runtime.Project != "" && runtime.Location != "")
+	case ProviderGoogle:
+		return runtime.APIKey != "" ||
+			(runtime.Project != "" && runtime.Location != "")
+	case ProviderOpenAI:
+		return runtime.APIKey != ""
+	case ProviderOpenAICompat:
+		return runtime.BaseURL != ""
+	case ProviderOpenRouter:
+		return runtime.APIKey != ""
+	default:
+		return false
+	}
+}
+
+func copyOptionalFloat(value *float64) *float64 {
+	if value == nil {
+		return nil
+	}
+	normalized := *value
+	return &normalized
+}
+
+func copyOptionalInt(value *int64) *int64 {
+	if value == nil {
+		return nil
+	}
+	normalized := *value
+	return &normalized
+}
+
+func copyStringMap(values map[string]string) map[string]string {
+	if len(values) == 0 {
+		return nil
+	}
+	copied := make(map[string]string, len(values))
+	for key, value := range values {
+		key = strings.TrimSpace(key)
+		value = strings.TrimSpace(value)
+		if key == "" || value == "" {
+			continue
+		}
+		copied[key] = value
+	}
+	if len(copied) == 0 {
+		return nil
+	}
+	return copied
+}
+
+func joinTextBlocks(blocks []string) string {
+	var filtered []string
+	for _, block := range blocks {
+		block = strings.TrimSpace(block)
+		if block == "" {
+			continue
+		}
+		filtered = append(filtered, block)
+	}
+	return strings.Join(filtered, "\n\n")
+}
+
+func truncateForError(value string) string {
+	const maxLen = 512
+	value = strings.TrimSpace(value)
+	if len(value) <= maxLen {
+		return value
+	}
+	return strings.TrimSpace(value[:maxLen]) + "..."
+}
+
+func fallbackString(value string, fallback string) string {
+	value = strings.TrimSpace(value)
+	if value != "" {
+		return value
+	}
+	return strings.TrimSpace(fallback)
+}

server/ai/completion_test.go

@@ -0,0 +1,764 @@
+package ai
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/server/configs"
+	"github.com/openai/openai-go/v2/shared"
+)
+
+func TestCompleteConversationOpenAIUsesConfiguredCredentialsAndSettings(t *testing.T) {
+	type capturedRequest struct {
+		Path          string
+		Authorization string
+		Body          string
+	}
+
+	requests := make(chan capturedRequest, 1)
+	restoreClient := SetHTTPClientForTests(&http.Client{
+		Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
+			defer r.Body.Close()
+
+			payload, err := io.ReadAll(r.Body)
+			if err != nil {
+				t.Fatalf("read request body: %v", err)
+			}
+
+			requests <- capturedRequest{
+				Path:          r.URL.Path,
+				Authorization: r.Header.Get("Authorization"),
+				Body:          string(payload),
+			}
+
+			return jsonResponse(http.StatusOK, `{
+			"id": "resp_123",
+			"model": "gpt-5.2",
+			"status": "completed",
+			"usage": {
+				"input_tokens": 12000,
+				"input_tokens_details": {},
+				"output_tokens": 6000,
+				"output_tokens_details": {},
+				"total_tokens": 18000
+			},
+			"output": [
+				{
+					"type": "message",
+					"role": "assistant",
+					"content": [
+						{"type": "output_text", "text": "OpenAI assistant reply"}
+					]
+				}
+			]
+		}`), nil
+		}),
+	})
+	defer restoreClient()
+
+	cfg := &configs.ServerConfig{
+		AI: &configs.AIConfig{
+			Provider:      ProviderOpenAI,
+			ThinkingLevel: "high",
+			OpenAI: &configs.AIProviderConfig{
+				APIKey:          "openai-key",
+				BaseURL:         "https://openai.example/proxy/v1",
+				UseResponsesAPI: boolPtr(true),
+			},
+			Anthropic: &configs.AIProviderConfig{},
+		},
+	}
+	conversation := &clientpb.AIConversation{
+		Provider:     ProviderOpenAI,
+		SystemPrompt: "Keep it brief.",
+		Messages: []*clientpb.AIConversationMessage{
+			{Role: "assistant", Content: "Earlier answer."},
+			{Role: "user", Content: "Explain the workflow."},
+		},
+	}
+
+	runtime, err := ResolveRuntimeConfig(cfg, conversation)
+	if err != nil {
+		t.Fatalf("resolve runtime config: %v", err)
+	}
+	if runtime.Model != defaultOpenAIModel {
+		t.Fatalf("unexpected default openai model: got=%q want=%q", runtime.Model, defaultOpenAIModel)
+	}
+
+	completion, err := CompleteConversation(context.Background(), runtime, conversation)
+	if err != nil {
+		t.Fatalf("complete conversation: %v", err)
+	}
+
+	request := <-requests
+	if request.Path != "/proxy/v1/responses" {
+		t.Fatalf("unexpected openai request path: got=%q want=%q", request.Path, "/proxy/v1/responses")
+	}
+	if request.Authorization != "Bearer openai-key" {
+		t.Fatalf("unexpected authorization header: %q", request.Authorization)
+	}
+	for _, fragment := range []string{
+		`"model":"gpt-5.2"`,
+		`"type":"web_search"`,
+		`"search_context_size":"medium"`,
+		`"effort":"high"`,
+		`"summary":"auto"`,
+		`"Keep it brief."`,
+		`"Earlier answer."`,
+		`"Explain the workflow."`,
+	} {
+		if !strings.Contains(request.Body, fragment) {
+			t.Fatalf("expected openai request body to contain %q, got %s", fragment, request.Body)
+		}
+	}
+
+	if completion.Content != "OpenAI assistant reply" {
+		t.Fatalf("unexpected completion content: %q", completion.Content)
+	}
+	if completion.ProviderMessageID != "resp_123" {
+		t.Fatalf("unexpected provider message id: %q", completion.ProviderMessageID)
+	}
+	if completion.ContextWindowUsage == nil {
+		t.Fatal("expected context window usage to be captured")
+	}
+	if completion.ContextWindowUsage.TotalTokens != 18000 {
+		t.Fatalf("unexpected total tokens: %d", completion.ContextWindowUsage.TotalTokens)
+	}
+	if completion.ContextWindowUsage.ContextWindowTokens != openAIFrontierContextWindowTokens {
+		t.Fatalf("unexpected context window tokens: %d", completion.ContextWindowUsage.ContextWindowTokens)
+	}
+}
+
+func TestCompleteConversationOpenAIUsesDefaultBaseURLWhenUnset(t *testing.T) {
+	type capturedRequest struct {
+		Path          string
+		Authorization string
+		Body          string
+	}
+
+	requests := make(chan capturedRequest, 1)
+	restoreClient := SetHTTPClientForTests(&http.Client{
+		Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
+			defer r.Body.Close()
+
+			payload, err := io.ReadAll(r.Body)
+			if err != nil {
+				t.Fatalf("read request body: %v", err)
+			}
+
+			requests <- capturedRequest{
+				Path:          r.URL.Path,
+				Authorization: r.Header.Get("Authorization"),
+				Body:          string(payload),
+			}
+
+			return jsonResponse(http.StatusOK, `{
+			"id": "resp_default_base",
+			"model": "gpt-5.4",
+			"status": "completed",
+			"output": [
+				{
+					"type": "message",
+					"role": "assistant",
+					"content": [
+						{"type": "output_text", "text": "OpenAI default-base reply"}
+					]
+				}
+			]
+		}`), nil
+		}),
+	})
+	defer restoreClient()
+
+	cfg := &configs.ServerConfig{
+		AI: &configs.AIConfig{
+			Provider: ProviderOpenAI,
+			OpenAI: &configs.AIProviderConfig{
+				Models:          []string{"gpt-5.4"},
+				APIKey:          "openai-key",
+				UseResponsesAPI: boolPtr(true),
+			},
+			Anthropic: &configs.AIProviderConfig{},
+		},
+	}
+	conversation := &clientpb.AIConversation{
+		Provider: ProviderOpenAI,
+		Model:    "gpt-5.4",
+		Messages: []*clientpb.AIConversationMessage{
+			{Role: "user", Content: "Say hi."},
+		},
+	}
+
+	runtime, err := ResolveRuntimeConfig(cfg, conversation)
+	if err != nil {
+		t.Fatalf("resolve runtime config: %v", err)
+	}
+	if runtime.BaseURL != "" {
+		t.Fatalf("expected openai runtime base url to remain unset, got %q", runtime.BaseURL)
+	}
+
+	completion, err := CompleteConversation(context.Background(), runtime, conversation)
+	if err != nil {
+		t.Fatalf("complete conversation: %v", err)
+	}
+
+	request := <-requests
+	if request.Path != "/v1/responses" {
+		t.Fatalf("unexpected openai default-base request path: got=%q want=%q", request.Path, "/v1/responses")
+	}
+	if request.Authorization != "Bearer openai-key" {
+		t.Fatalf("unexpected authorization header: %q", request.Authorization)
+	}
+	if !strings.Contains(request.Body, `"Say hi."`) {
+		t.Fatalf("expected openai request body to contain the user prompt, got %s", request.Body)
+	}
+	if completion.Content != "OpenAI default-base reply" {
+		t.Fatalf("unexpected completion content: %q", completion.Content)
+	}
+	if completion.ProviderMessageID != "resp_default_base" {
+		t.Fatalf("unexpected provider message id: %q", completion.ProviderMessageID)
+	}
+}
+
+func TestCompleteConversationOpenAIChatEnablesWebSearch(t *testing.T) {
+	type capturedRequest struct {
+		Path          string
+		Authorization string
+		Body          string
+	}
+
+	requests := make(chan capturedRequest, 1)
+	restoreClient := SetHTTPClientForTests(&http.Client{
+		Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
+			defer r.Body.Close()
+
+			payload, err := io.ReadAll(r.Body)
+			if err != nil {
+				t.Fatalf("read request body: %v", err)
+			}
+
+			requests <- capturedRequest{
+				Path:          r.URL.Path,
+				Authorization: r.Header.Get("Authorization"),
+				Body:          string(payload),
+			}
+
+			return jsonResponse(http.StatusOK, `{
+			"id": "chatcmpl_openai_123",
+			"object": "chat.completion",
+			"model": "gpt-5.4",
+			"usage": {
+				"prompt_tokens": 32000,
+				"completion_tokens": 4000,
+				"total_tokens": 36000
+			},
+			"choices": [
+				{
+					"index": 0,
+					"finish_reason": "stop",
+					"message": {
+						"role": "assistant",
+						"content": "OpenAI chat reply"
+					}
+				}
+			]
+		}`), nil
+		}),
+	})
+	defer restoreClient()
+
+	cfg := &configs.ServerConfig{
+		AI: &configs.AIConfig{
+			Provider: ProviderOpenAI,
+			OpenAI: &configs.AIProviderConfig{
+				Models:          []string{"gpt-5.4"},
+				APIKey:          "openai-key",
+				UseResponsesAPI: boolPtr(false),
+			},
+			Anthropic: &configs.AIProviderConfig{},
+		},
+	}
+	conversation := &clientpb.AIConversation{
+		Provider: ProviderOpenAI,
+		Model:    "gpt-5.4",
+		Messages: []*clientpb.AIConversationMessage{
+			{Role: "user", Content: "Say hi."},
+		},
+	}
+
+	runtime, err := ResolveRuntimeConfig(cfg, conversation)
+	if err != nil {
+		t.Fatalf("resolve runtime config: %v", err)
+	}
+	if runtime.UseResponsesAPI {
+		t.Fatal("expected openai runtime to use chat completions for this test")
+	}
+
+	completion, err := CompleteConversation(context.Background(), runtime, conversation)
+	if err != nil {
+		t.Fatalf("complete conversation: %v", err)
+	}
+
+	request := <-requests
+	if request.Path != "/v1/chat/completions" {
+		t.Fatalf("unexpected openai chat request path: got=%q want=%q", request.Path, "/v1/chat/completions")
+	}
+	if request.Authorization != "Bearer openai-key" {
+		t.Fatalf("unexpected authorization header: %q", request.Authorization)
+	}
+	for _, fragment := range []string{
+		`"model":"gpt-5.4"`,
+		`"web_search_options":{"search_context_size":"medium"}`,
+		`"Say hi."`,
+	} {
+		if !strings.Contains(request.Body, fragment) {
+			t.Fatalf("expected openai chat request body to contain %q, got %s", fragment, request.Body)
+		}
+	}
+	if completion.Content != "OpenAI chat reply" {
+		t.Fatalf("unexpected completion content: %q", completion.Content)
+	}
+	if completion.ProviderMessageID != "chatcmpl_openai_123" {
+		t.Fatalf("unexpected provider message id: %q", completion.ProviderMessageID)
+	}
+	if completion.ContextWindowUsage == nil {
+		t.Fatal("expected openai chat usage to be captured")
+	}
+	if completion.ContextWindowUsage.TotalTokens != 36000 {
+		t.Fatalf("unexpected openai chat total tokens: %d", completion.ContextWindowUsage.TotalTokens)
+	}
+	if completion.ContextWindowUsage.ContextWindowTokens != openAI5_4ContextWindowTokens {
+		t.Fatalf("unexpected openai chat context window tokens: %d", completion.ContextWindowUsage.ContextWindowTokens)
+	}
+}
+
+func TestResolveRuntimeConfigAnthropicRequiresAnInstalledDriver(t *testing.T) {
+	cfg := &configs.ServerConfig{
+		AI: &configs.AIConfig{
+			Provider:      ProviderAnthropic,
+			ThinkingLevel: "medium",
+			Anthropic: &configs.AIProviderConfig{
+				APIKey:  "anthropic-key",
+				BaseURL: "https://anthropic.example/edge",
+			},
+			OpenAI: &configs.AIProviderConfig{},
+		},
+	}
+
+	runtime, err := ResolveRuntimeConfig(cfg, &clientpb.AIConversation{Provider: ProviderAnthropic})
+	if runtime.Model != defaultAnthropicModel {
+		t.Fatalf("unexpected default anthropic model: got=%q want=%q", runtime.Model, defaultAnthropicModel)
+	}
+	if err == nil {
+		t.Fatal("expected anthropic runtime resolution to require a dedicated driver")
+	}
+	if !strings.Contains(err.Error(), `provider "anthropic"`) || !strings.Contains(err.Error(), "SDK driver") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
+
+func TestResolveRuntimeConfigOpenAICompatAllowsBaseURLWithoutAPIKey(t *testing.T) {
+	cfg := &configs.ServerConfig{
+		AI: &configs.AIConfig{
+			Provider: ProviderOpenAICompat,
+			OpenAICompat: &configs.AIProviderConfig{
+				Models:  []string{"gpt-oss-120b"},
+				BaseURL: "http://127.0.0.1:8080/v1",
+			},
+		},
+	}
+
+	runtime, err := ResolveRuntimeConfig(cfg, &clientpb.AIConversation{
+		Provider: ProviderOpenAICompat,
+	})
+	if err != nil {
+		t.Fatalf("resolve runtime config: %v", err)
+	}
+	if runtime.Provider != ProviderOpenAICompat {
+		t.Fatalf("expected provider %q, got %q", ProviderOpenAICompat, runtime.Provider)
+	}
+	if runtime.BaseURL != "http://127.0.0.1:8080/v1" {
+		t.Fatalf("expected openai-compat base url, got %q", runtime.BaseURL)
+	}
+	if runtime.APIKey != "" {
+		t.Fatalf("expected openai-compat api key to remain empty, got %q", runtime.APIKey)
+	}
+}
+
+func TestResolveRuntimeConfigUsesConversationThinkingOverride(t *testing.T) {
+	cfg := &configs.ServerConfig{
+		AI: &configs.AIConfig{
+			Provider:      ProviderOpenAI,
+			ThinkingLevel: "high",
+			OpenAI: &configs.AIProviderConfig{
+				Models:          []string{"gpt-5.4"},
+				APIKey:          "openai-key",
+				UseResponsesAPI: boolPtr(true),
+			},
+			Anthropic: &configs.AIProviderConfig{},
+		},
+	}
+
+	runtime, err := ResolveRuntimeConfig(cfg, &clientpb.AIConversation{
+		Provider:      ProviderOpenAI,
+		ThinkingLevel: "disabled",
+	})
+	if err != nil {
+		t.Fatalf("resolve runtime config: %v", err)
+	}
+	if runtime.ThinkingLevel != "disabled" {
+		t.Fatalf("expected conversation thinking override %q, got %q", "disabled", runtime.ThinkingLevel)
+	}
+}
+
+func TestReasoningEffortForThinkingLevelSupportsXHigh(t *testing.T) {
+	effort, ok := reasoningEffortForThinkingLevel("xhigh")
+	if !ok {
+		t.Fatal("expected xhigh reasoning effort to be supported")
+	}
+	if string(effort) != "xhigh" {
+		t.Fatalf("expected reasoning effort %q, got %q", "xhigh", effort)
+	}
+}
+
+func TestResponseReasoningParamSkipsSummaryForOpenAICompat(t *testing.T) {
+	reasoning, ok := responseReasoningParam(&RuntimeConfig{
+		Provider:      ProviderOpenAICompat,
+		ThinkingLevel: "high",
+	})
+	if !ok {
+		t.Fatal("expected response reasoning params to be available")
+	}
+	if reasoning.Effort != shared.ReasoningEffortHigh {
+		t.Fatalf("expected reasoning effort %q, got %q", shared.ReasoningEffortHigh, reasoning.Effort)
+	}
+	if reasoning.Summary != "" {
+		t.Fatalf("expected openai-compatible runtime to skip reasoning summary, got %q", reasoning.Summary)
+	}
+}
+
+func TestCompleteConversationOpenAICompatUsesBaseURLWithoutAuth(t *testing.T) {
+	type capturedRequest struct {
+		Path          string
+		Authorization string
+		Body          string
+	}
+
+	requests := make(chan capturedRequest, 1)
+	restoreClient := SetHTTPClientForTests(&http.Client{
+		Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
+			defer r.Body.Close()
+
+			payload, err := io.ReadAll(r.Body)
+			if err != nil {
+				t.Fatalf("read request body: %v", err)
+			}
+
+			requests <- capturedRequest{
+				Path:          r.URL.Path,
+				Authorization: r.Header.Get("Authorization"),
+				Body:          string(payload),
+			}
+
+			return jsonResponse(http.StatusOK, `{
+			"id": "chatcmpl_123",
+			"object": "chat.completion",
+			"model": "gpt-oss-120b",
+			"choices": [
+				{
+					"index": 0,
+					"finish_reason": "stop",
+					"message": {
+						"role": "assistant",
+						"content": "OpenAI-compatible assistant reply"
+					}
+				}
+			],
+			"usage": {
+				"prompt_tokens": 10,
+				"completion_tokens": 5,
+				"total_tokens": 15
+			}
+		}`), nil
+		}),
+	})
+	defer restoreClient()
+
+	cfg := &configs.ServerConfig{
+		AI: &configs.AIConfig{
+			Provider: ProviderOpenAICompat,
+			OpenAICompat: &configs.AIProviderConfig{
+				Models:  []string{"gpt-oss-120b"},
+				BaseURL: "http://127.0.0.1:8080/v1",
+			},
+		},
+	}
+	conversation := &clientpb.AIConversation{
+		Provider: ProviderOpenAICompat,
+		Messages: []*clientpb.AIConversationMessage{
+			{Role: "user", Content: "Say hi."},
+		},
+	}
+
+	runtime, err := ResolveRuntimeConfig(cfg, conversation)
+	if err != nil {
+		t.Fatalf("resolve runtime config: %v", err)
+	}
+
+	completion, err := CompleteConversation(context.Background(), runtime, conversation)
+	if err != nil {
+		t.Fatalf("complete conversation: %v", err)
+	}
+
+	request := <-requests
+	if request.Path != "/v1/chat/completions" {
+		t.Fatalf("unexpected openai-compatible request path: got=%q want=%q", request.Path, "/v1/chat/completions")
+	}
+	if request.Authorization != "" {
+		t.Fatalf("expected no authorization header for unauthenticated openai-compatible endpoint, got %q", request.Authorization)
+	}
+	if !strings.Contains(request.Body, `"Say hi."`) {
+		t.Fatalf("expected openai-compatible request body to contain the user prompt, got %s", request.Body)
+	}
+	if completion.Content != "OpenAI-compatible assistant reply" {
+		t.Fatalf("unexpected completion content: %q", completion.Content)
+	}
+	if completion.ProviderMessageID != "chatcmpl_123" {
+		t.Fatalf("unexpected provider message id: %q", completion.ProviderMessageID)
+	}
+}
+
+func TestCompleteConversationOpenRouterUsesDefaultBaseURL(t *testing.T) {
+	type capturedRequest struct {
+		Path          string
+		Authorization string
+		Body          string
+	}
+
+	requests := make(chan capturedRequest, 1)
+	restoreClient := SetHTTPClientForTests(&http.Client{
+		Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
+			defer r.Body.Close()
+
+			payload, err := io.ReadAll(r.Body)
+			if err != nil {
+				t.Fatalf("read request body: %v", err)
+			}
+
+			requests <- capturedRequest{
+				Path:          r.URL.Path,
+				Authorization: r.Header.Get("Authorization"),
+				Body:          string(payload),
+			}
+
+			return jsonResponse(http.StatusOK, `{
+			"id": "chatcmpl_or_123",
+			"object": "chat.completion",
+			"model": "openai/gpt-5",
+			"usage": {
+				"prompt_tokens": 14000,
+				"completion_tokens": 2000,
+				"total_tokens": 16000
+			},
+			"choices": [
+				{
+					"index": 0,
+					"finish_reason": "stop",
+					"message": {
+						"role": "assistant",
+						"content": "OpenRouter assistant reply"
+					}
+				}
+			]
+		}`), nil
+		}),
+	})
+	defer restoreClient()
+
+	cfg := &configs.ServerConfig{
+		AI: &configs.AIConfig{
+			Provider:      ProviderOpenRouter,
+			ThinkingLevel: "medium",
+			OpenRouter: &configs.AIProviderConfig{
+				APIKey: "openrouter-key",
+			},
+		},
+	}
+	conversation := &clientpb.AIConversation{
+		Provider: ProviderOpenRouter,
+		Messages: []*clientpb.AIConversationMessage{
+			{Role: "user", Content: "Say hi."},
+		},
+	}
+
+	runtime, err := ResolveRuntimeConfig(cfg, conversation)
+	if err != nil {
+		t.Fatalf("resolve runtime config: %v", err)
+	}
+	if runtime.Model != defaultOpenRouterModel {
+		t.Fatalf("unexpected default openrouter model: got=%q want=%q", runtime.Model, defaultOpenRouterModel)
+	}
+
+	completion, err := CompleteConversation(context.Background(), runtime, conversation)
+	if err != nil {
+		t.Fatalf("complete conversation: %v", err)
+	}
+
+	request := <-requests
+	if request.Path != "/api/v1/chat/completions" {
+		t.Fatalf("unexpected openrouter request path: got=%q want=%q", request.Path, "/api/v1/chat/completions")
+	}
+	if request.Authorization != "Bearer openrouter-key" {
+		t.Fatalf("unexpected authorization header: %q", request.Authorization)
+	}
+	for _, fragment := range []string{
+		`"model":"openai/gpt-5"`,
+		`"Say hi."`,
+	} {
+		if !strings.Contains(request.Body, fragment) {
+			t.Fatalf("expected openrouter request body to contain %q, got %s", fragment, request.Body)
+		}
+	}
+	if completion.Content != "OpenRouter assistant reply" {
+		t.Fatalf("unexpected completion content: %q", completion.Content)
+	}
+	if completion.ProviderMessageID != "chatcmpl_or_123" {
+		t.Fatalf("unexpected provider message id: %q", completion.ProviderMessageID)
+	}
+	if completion.ContextWindowUsage == nil {
+		t.Fatal("expected openrouter usage to be captured")
+	}
+	if completion.ContextWindowUsage.TotalTokens != 16000 {
+		t.Fatalf("unexpected openrouter total tokens: %d", completion.ContextWindowUsage.TotalTokens)
+	}
+	if completion.ContextWindowUsage.ContextWindowTokens != openAIFrontierContextWindowTokens {
+		t.Fatalf("unexpected openrouter context window tokens: %d", completion.ContextWindowUsage.ContextWindowTokens)
+	}
+}
+
+func TestConversationHistoryUsesExplicitContextFlagIndependentlyOfVisibility(t *testing.T) {
+	systemPrompt, messages, err := conversationHistory(&clientpb.AIConversation{
+		SystemPrompt: "Stay concise.",
+		Messages: []*clientpb.AIConversationMessage{
+			{
+				Role:             "assistant",
+				Content:          "Visible in the transcript but excluded from context.",
+				Kind:             clientpb.AIConversationMessageKind_AI_MESSAGE_KIND_CHAT,
+				Visibility:       clientpb.AIConversationMessageVisibility_AI_MESSAGE_VISIBILITY_CONTEXT,
+				IncludeInContext: boolPtr(false),
+			},
+			{
+				Role:             "assistant",
+				Content:          "UI-only but still included in context.",
+				Kind:             clientpb.AIConversationMessageKind_AI_MESSAGE_KIND_CHAT,
+				Visibility:       clientpb.AIConversationMessageVisibility_AI_MESSAGE_VISIBILITY_UI_ONLY,
+				IncludeInContext: boolPtr(true),
+			},
+			{
+				Role:             "user",
+				Content:          "What changed?",
+				Kind:             clientpb.AIConversationMessageKind_AI_MESSAGE_KIND_CHAT,
+				Visibility:       clientpb.AIConversationMessageVisibility_AI_MESSAGE_VISIBILITY_CONTEXT,
+				IncludeInContext: boolPtr(true),
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("conversationHistory: %v", err)
+	}
+	if systemPrompt != "Stay concise." {
+		t.Fatalf("unexpected system prompt: %q", systemPrompt)
+	}
+	if len(messages) != 2 {
+		t.Fatalf("unexpected message count: got=%d want=%d", len(messages), 2)
+	}
+	if messages[0].Content != "UI-only but still included in context." {
+		t.Fatalf("unexpected retained assistant message: %+v", messages[0])
+	}
+	if messages[1].Role != "user" || messages[1].Content != "What changed?" {
+		t.Fatalf("unexpected trailing user message: %+v", messages[1])
+	}
+}
+
+func TestConversationHistoryTreatsLeadingSystemMessageAsSystemPrompt(t *testing.T) {
+	systemPrompt, messages, err := conversationHistory(&clientpb.AIConversation{
+		Messages: []*clientpb.AIConversationMessage{
+			{
+				Role:             "system",
+				Content:          "Stay concise.",
+				Kind:             clientpb.AIConversationMessageKind_AI_MESSAGE_KIND_CHAT,
+				Visibility:       clientpb.AIConversationMessageVisibility_AI_MESSAGE_VISIBILITY_CONTEXT,
+				IncludeInContext: boolPtr(true),
+			},
+			{
+				Role:             "user",
+				Content:          "What changed?",
+				Kind:             clientpb.AIConversationMessageKind_AI_MESSAGE_KIND_CHAT,
+				Visibility:       clientpb.AIConversationMessageVisibility_AI_MESSAGE_VISIBILITY_CONTEXT,
+				IncludeInContext: boolPtr(true),
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("conversationHistory: %v", err)
+	}
+	if systemPrompt != "Stay concise." {
+		t.Fatalf("unexpected system prompt: %q", systemPrompt)
+	}
+	if len(messages) != 1 {
+		t.Fatalf("unexpected message count: got=%d want=%d", len(messages), 1)
+	}
+	if messages[0].Role != "user" || messages[0].Content != "What changed?" {
+		t.Fatalf("unexpected trailing user message: %+v", messages[0])
+	}
+}
+
+func TestConversationHistoryFallsBackToVisibilityWhenContextFlagIsUnset(t *testing.T) {
+	_, messages, err := conversationHistory(&clientpb.AIConversation{
+		Messages: []*clientpb.AIConversationMessage{
+			{
+				Role:       "assistant",
+				Content:    "Legacy context-visible message.",
+				Kind:       clientpb.AIConversationMessageKind_AI_MESSAGE_KIND_CHAT,
+				Visibility: clientpb.AIConversationMessageVisibility_AI_MESSAGE_VISIBILITY_CONTEXT,
+			},
+			{
+				Role:       "user",
+				Content:    "Legacy prompt.",
+				Kind:       clientpb.AIConversationMessageKind_AI_MESSAGE_KIND_CHAT,
+				Visibility: clientpb.AIConversationMessageVisibility_AI_MESSAGE_VISIBILITY_CONTEXT,
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("conversationHistory: %v", err)
+	}
+	if len(messages) != 2 {
+		t.Fatalf("unexpected legacy message count: got=%d want=%d", len(messages), 2)
+	}
+	if messages[0].Content != "Legacy context-visible message." {
+		t.Fatalf("unexpected legacy assistant message: %+v", messages[0])
+	}
+}
+
+type roundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f(req)
+}
+
+func jsonResponse(statusCode int, body string) *http.Response {
+	return &http.Response{
+		StatusCode: statusCode,
+		Header:     http.Header{"Content-Type": []string{"application/json"}},
+		Body:       io.NopCloser(strings.NewReader(body)),
+	}
+}
+
+func boolPtr(value bool) *bool {
+	return &value
+}

server/ai/context_window.go

@@ -0,0 +1,312 @@
+package ai
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/url"
+	"strings"
+	"sync"
+	"time"
+)
+
+const (
+	openAIFrontierContextWindowTokens     = 400000
+	openAIChatContextWindowTokens         = 128000
+	openAI4_1ContextWindowTokens          = 1047576
+	openAI5_4ContextWindowTokens          = 1050000
+	openAIReasoningContextWindowTokens    = 200000
+	openAIRealtimeContextWindowTokens     = 32000
+	openAIRealtimeMiniContextWindowTokens = 16000
+	openRouterContextWindowCacheTTL       = 6 * time.Hour
+)
+
+// ContextWindowUsage captures the provider-reported token usage for a turn and,
+// when available, the model context window used to render the client-side meter.
+type ContextWindowUsage struct {
+	InputTokens                  int64
+	OutputTokens                 int64
+	TotalTokens                  int64
+	ContextWindowTokens          int64
+	ContextWindowTokensEstimated bool
+}
+
+func newContextWindowUsage(inputTokens, outputTokens, totalTokens, windowTokens int64, estimated bool) *ContextWindowUsage {
+	if inputTokens == 0 && outputTokens == 0 && totalTokens == 0 {
+		return nil
+	}
+	return &ContextWindowUsage{
+		InputTokens:                  inputTokens,
+		OutputTokens:                 outputTokens,
+		TotalTokens:                  totalTokens,
+		ContextWindowTokens:          windowTokens,
+		ContextWindowTokensEstimated: estimated,
+	}
+}
+
+func cloneContextWindowUsage(usage *ContextWindowUsage) *ContextWindowUsage {
+	if usage == nil {
+		return nil
+	}
+	cloned := *usage
+	return &cloned
+}
+
+func contextWindowUsageRank(usage *ContextWindowUsage) (int64, int64, int64) {
+	if usage == nil {
+		return 0, 0, 0
+	}
+	return usage.TotalTokens, usage.InputTokens, usage.OutputTokens
+}
+
+func mergeContextWindowUsage(current *ContextWindowUsage, candidate *ContextWindowUsage) *ContextWindowUsage {
+	if candidate == nil {
+		return cloneContextWindowUsage(current)
+	}
+	if current == nil {
+		return cloneContextWindowUsage(candidate)
+	}
+
+	result := cloneContextWindowUsage(current)
+	currentTotal, currentInput, currentOutput := contextWindowUsageRank(result)
+	candidateTotal, candidateInput, candidateOutput := contextWindowUsageRank(candidate)
+	if candidateTotal > currentTotal ||
+		(candidateTotal == currentTotal && candidateInput > currentInput) ||
+		(candidateTotal == currentTotal && candidateInput == currentInput && candidateOutput > currentOutput) {
+		result = cloneContextWindowUsage(candidate)
+	}
+
+	if result.ContextWindowTokens == 0 && candidate.ContextWindowTokens > 0 {
+		result.ContextWindowTokens = candidate.ContextWindowTokens
+		result.ContextWindowTokensEstimated = candidate.ContextWindowTokensEstimated
+	}
+	if result.ContextWindowTokens > 0 && result.ContextWindowTokensEstimated &&
+		candidate.ContextWindowTokens > 0 && !candidate.ContextWindowTokensEstimated {
+		result.ContextWindowTokens = candidate.ContextWindowTokens
+		result.ContextWindowTokensEstimated = false
+	}
+
+	return result
+}
+
+func resolveContextWindowUsage(ctx context.Context, runtime *RuntimeConfig, model string, inputTokens, outputTokens, totalTokens int64) *ContextWindowUsage {
+	windowTokens, estimated := resolveContextWindowTokens(ctx, runtime, model)
+	return newContextWindowUsage(inputTokens, outputTokens, totalTokens, windowTokens, estimated)
+}
+
+func resolveContextWindowTokens(ctx context.Context, runtime *RuntimeConfig, model string) (int64, bool) {
+	model = normalizeContextWindowModelID(model)
+	if model == "" {
+		return 0, false
+	}
+
+	if tokens := openAIKnownContextWindowTokens(model); tokens > 0 {
+		return tokens, true
+	}
+
+	if openRouterCompatibleRuntime(runtime) {
+		if tokens, ok := openRouterContextWindowTokens(ctx, runtime, model); ok {
+			return tokens, false
+		}
+	}
+
+	return 0, false
+}
+
+func openAIKnownContextWindowTokens(model string) int64 {
+	model = normalizeContextWindowModelID(model)
+	switch {
+	case model == "codex-mini-latest":
+		return openAIReasoningContextWindowTokens
+	case strings.HasPrefix(model, "o3"), strings.HasPrefix(model, "o4-"):
+		return openAIReasoningContextWindowTokens
+	case strings.HasPrefix(model, "gpt-5.4"):
+		return openAI5_4ContextWindowTokens
+	case strings.HasPrefix(model, "gpt-4.1"):
+		return openAI4_1ContextWindowTokens
+	case strings.HasPrefix(model, "gpt-5.1-chat"), strings.HasPrefix(model, "gpt-5-chat"):
+		return openAIChatContextWindowTokens
+	case strings.HasPrefix(model, "gpt-5"):
+		return openAIFrontierContextWindowTokens
+	case strings.HasPrefix(model, "gpt-4o-mini-realtime"):
+		return openAIRealtimeMiniContextWindowTokens
+	case strings.HasPrefix(model, "gpt-4o-realtime"):
+		return openAIRealtimeContextWindowTokens
+	case strings.HasPrefix(model, "gpt-4o"), strings.HasPrefix(model, "chatgpt-4o"):
+		return openAIChatContextWindowTokens
+	case strings.Contains(model, "gpt-4-turbo"):
+		return openAIChatContextWindowTokens
+	case strings.HasPrefix(model, "gpt-4"):
+		return 8192
+	default:
+		return 0
+	}
+}
+
+func normalizeContextWindowModelID(model string) string {
+	model = strings.ToLower(strings.TrimSpace(model))
+	if idx := strings.Index(model, "/"); idx >= 0 {
+		model = model[idx+1:]
+	}
+	if idx := strings.Index(model, ":"); idx >= 0 {
+		model = model[:idx]
+	}
+	return strings.TrimSpace(model)
+}
+
+func openRouterCompatibleRuntime(runtime *RuntimeConfig) bool {
+	if runtime == nil {
+		return false
+	}
+	switch NormalizeProviderName(runtime.Provider) {
+	case ProviderOpenRouter:
+		return true
+	case ProviderOpenAICompat:
+		baseURL := strings.ToLower(strings.TrimSpace(openAIBaseURL(runtime)))
+		return strings.Contains(baseURL, "openrouter.ai")
+	default:
+		return false
+	}
+}
+
+type openRouterModelsResponse struct {
+	Data []openRouterModel `json:"data"`
+}
+
+type openRouterModel struct {
+	ID          string `json:"id"`
+	TopProvider struct {
+		ContextLength int64 `json:"context_length"`
+	} `json:"top_provider"`
+}
+
+type cachedOpenRouterContextWindow struct {
+	tokens    int64
+	expiresAt time.Time
+}
+
+var openRouterContextWindowCache = struct {
+	sync.RWMutex
+	entries map[string]cachedOpenRouterContextWindow
+}{
+	entries: map[string]cachedOpenRouterContextWindow{},
+}
+
+func openRouterContextWindowTokens(ctx context.Context, runtime *RuntimeConfig, model string) (int64, bool) {
+	model = normalizeContextWindowModelID(model)
+	if model == "" {
+		return 0, false
+	}
+
+	cacheKey := openRouterContextWindowCacheKey(runtime, model)
+	if tokens, ok := cachedOpenRouterContextWindowTokens(cacheKey); ok {
+		return tokens, true
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, openRouterModelsURL(runtime), nil)
+	if err != nil {
+		return 0, false
+	}
+	if runtime != nil && !runtime.SkipAuth && strings.TrimSpace(runtime.APIKey) != "" {
+		req.Header.Set("Authorization", "Bearer "+strings.TrimSpace(runtime.APIKey))
+	}
+	for key, value := range providerHeaders(runtime) {
+		req.Header.Set(key, value)
+	}
+
+	resp, err := httpClient.Do(req)
+	if err != nil {
+		return 0, false
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return 0, false
+	}
+
+	payload := &openRouterModelsResponse{}
+	if err := json.NewDecoder(resp.Body).Decode(payload); err != nil {
+		return 0, false
+	}
+
+	for _, candidate := range payload.Data {
+		candidateID := normalizeContextWindowModelID(candidate.ID)
+		if candidateID != model {
+			continue
+		}
+		if candidate.TopProvider.ContextLength <= 0 {
+			return 0, false
+		}
+		storeOpenRouterContextWindowTokens(cacheKey, candidate.TopProvider.ContextLength)
+		return candidate.TopProvider.ContextLength, true
+	}
+
+	return 0, false
+}
+
+func openRouterModelsURL(runtime *RuntimeConfig) string {
+	baseURL := strings.TrimSpace(openAIBaseURL(runtime))
+	if baseURL == "" {
+		baseURL = defaultOpenRouterBaseURL
+	}
+
+	parsed, err := url.Parse(baseURL)
+	if err != nil || parsed == nil {
+		return defaultOpenRouterBaseURL + "/models"
+	}
+
+	path := strings.TrimRight(parsed.Path, "/")
+	switch {
+	case strings.HasSuffix(path, "/chat/completions"):
+		path = strings.TrimSuffix(path, "/chat/completions")
+	case strings.HasSuffix(path, "/responses"):
+		path = strings.TrimSuffix(path, "/responses")
+	case path == "":
+		path = "/api/v1"
+	}
+	if !strings.HasSuffix(path, "/models") {
+		path += "/models"
+	}
+	parsed.Path = path
+	parsed.RawQuery = ""
+	parsed.Fragment = ""
+	return parsed.String()
+}
+
+func openRouterContextWindowCacheKey(runtime *RuntimeConfig, model string) string {
+	return openRouterModelsURL(runtime) + "|" + normalizeContextWindowModelID(model)
+}
+
+func cachedOpenRouterContextWindowTokens(cacheKey string) (int64, bool) {
+	if cacheKey == "" {
+		return 0, false
+	}
+
+	now := time.Now()
+	openRouterContextWindowCache.RLock()
+	cached, ok := openRouterContextWindowCache.entries[cacheKey]
+	openRouterContextWindowCache.RUnlock()
+	if !ok || cached.tokens <= 0 || now.After(cached.expiresAt) {
+		if ok && now.After(cached.expiresAt) {
+			openRouterContextWindowCache.Lock()
+			delete(openRouterContextWindowCache.entries, cacheKey)
+			openRouterContextWindowCache.Unlock()
+		}
+		return 0, false
+	}
+
+	return cached.tokens, true
+}
+
+func storeOpenRouterContextWindowTokens(cacheKey string, tokens int64) {
+	if cacheKey == "" || tokens <= 0 {
+		return
+	}
+
+	openRouterContextWindowCache.Lock()
+	openRouterContextWindowCache.entries[cacheKey] = cachedOpenRouterContextWindow{
+		tokens:    tokens,
+		expiresAt: time.Now().Add(openRouterContextWindowCacheTTL),
+	}
+	openRouterContextWindowCache.Unlock()
+}

server/ai/context_window_test.go

@@ -0,0 +1,50 @@
+package ai
+
+import (
+	"context"
+	"net/http"
+	"testing"
+)
+
+func TestResolveContextWindowUsageOpenRouterUsesModelsAPIForUnknownModels(t *testing.T) {
+	openRouterContextWindowCache.Lock()
+	openRouterContextWindowCache.entries = map[string]cachedOpenRouterContextWindow{}
+	openRouterContextWindowCache.Unlock()
+
+	requests := make(chan string, 1)
+	restoreClient := SetHTTPClientForTests(&http.Client{
+		Transport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
+			requests <- r.URL.Path
+			return jsonResponse(http.StatusOK, `{
+				"data": [
+					{
+						"id": "anthropic/claude-sonnet-4-0",
+						"top_provider": {
+							"context_length": 200000
+						}
+					}
+				]
+			}`), nil
+		}),
+	})
+	defer restoreClient()
+
+	usage := resolveContextWindowUsage(context.Background(), &RuntimeConfig{
+		Provider: ProviderOpenRouter,
+		APIKey:   "openrouter-key",
+	}, "anthropic/claude-sonnet-4-0", 24000, 1000, 25000)
+	if usage == nil {
+		t.Fatal("expected context window usage")
+	}
+	if usage.ContextWindowTokens != 200000 {
+		t.Fatalf("unexpected context window tokens: %d", usage.ContextWindowTokens)
+	}
+	if usage.ContextWindowTokensEstimated {
+		t.Fatal("expected OpenRouter model lookup to be treated as exact")
+	}
+
+	requestPath := <-requests
+	if requestPath != "/api/v1/models" {
+		t.Fatalf("unexpected models lookup path: %q", requestPath)
+	}
+}

server/ai/driver.go

@@ -0,0 +1,38 @@
+package ai
+
+import (
+	"context"
+	"fmt"
+)
+
+type completionRequest struct {
+	SystemPrompt string
+	Messages     []providerMessage
+}
+
+type sdkDriver interface {
+	Name() string
+	Supports(*RuntimeConfig) bool
+	CompleteConversation(context.Context, *RuntimeConfig, *completionRequest) (*Completion, error)
+}
+
+var completionDrivers = []sdkDriver{
+	newOpenAIDriver(),
+}
+
+func selectCompletionDriver(runtime *RuntimeConfig) (sdkDriver, error) {
+	if runtime == nil {
+		return nil, fmt.Errorf("AI runtime config is required")
+	}
+
+	for _, driver := range completionDrivers {
+		if driver.Supports(runtime) {
+			return driver, nil
+		}
+	}
+
+	return nil, fmt.Errorf(
+		"server AI provider %q does not have an available SDK driver; use openai, openai-compat, or openrouter, or add a driver in server/ai",
+		runtime.Provider,
+	)
+}

server/ai/openai_driver.go

@@ -0,0 +1,389 @@
+package ai
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+
+	openai "github.com/openai/openai-go/v2"
+	"github.com/openai/openai-go/v2/option"
+	openairesponses "github.com/openai/openai-go/v2/responses"
+	"github.com/openai/openai-go/v2/shared"
+)
+
+const (
+	openAIDriverName         = "openai-go"
+	defaultOpenRouterBaseURL = "https://openrouter.ai/api/v1"
+	openAIWebSearchContext   = "medium"
+)
+
+type openAIDriver struct{}
+
+type openAIClient struct {
+	chat      openai.ChatCompletionService
+	responses openairesponses.ResponseService
+}
+
+func newOpenAIDriver() sdkDriver {
+	return &openAIDriver{}
+}
+
+func (d *openAIDriver) Name() string {
+	return openAIDriverName
+}
+
+func (d *openAIDriver) Supports(runtime *RuntimeConfig) bool {
+	if runtime == nil {
+		return false
+	}
+
+	switch NormalizeProviderName(runtime.Provider) {
+	case ProviderOpenAI, ProviderOpenAICompat, ProviderOpenRouter:
+		return true
+	default:
+		return false
+	}
+}
+
+func (d *openAIDriver) CompleteConversation(ctx context.Context, runtime *RuntimeConfig, request *completionRequest) (*Completion, error) {
+	if runtime == nil {
+		return nil, fmt.Errorf("AI runtime config is required")
+	}
+	if request == nil {
+		return nil, fmt.Errorf("AI completion request is required")
+	}
+
+	client := newOpenAIClient(openAIRequestOptions(runtime)...)
+	if runtime.UseResponsesAPI {
+		return d.completeResponses(ctx, client, runtime, request)
+	}
+	return d.completeChat(ctx, client, runtime, request)
+}
+
+func newOpenAIClient(opts ...option.RequestOption) *openAIClient {
+	return &openAIClient{
+		chat:      openai.NewChatCompletionService(opts...),
+		responses: openairesponses.NewResponseService(opts...),
+	}
+}
+
+func openAIRequestOptions(runtime *RuntimeConfig) []option.RequestOption {
+	opts := []option.RequestOption{
+		option.WithHTTPClient(httpClient),
+		option.WithRequestTimeout(defaultCompletionTimeout),
+		option.WithMaxRetries(0),
+	}
+
+	if runtime != nil && NormalizeProviderName(runtime.Provider) == ProviderOpenAI {
+		opts = append(opts, option.WithEnvironmentProduction())
+	}
+	if baseURL := openAIBaseURL(runtime); baseURL != "" {
+		opts = append(opts, option.WithBaseURL(baseURL))
+	}
+	if runtime != nil {
+		if runtime.APIKey != "" {
+			opts = append(opts, option.WithAPIKey(runtime.APIKey))
+		}
+		if runtime.Organization != "" {
+			opts = append(opts, option.WithOrganization(runtime.Organization))
+		}
+		if runtime.Project != "" {
+			opts = append(opts, option.WithProject(runtime.Project))
+		}
+		for key, value := range providerHeaders(runtime) {
+			opts = append(opts, option.WithHeader(key, value))
+		}
+		if runtime.TopK != nil && NormalizeProviderName(runtime.Provider) != ProviderOpenAI {
+			opts = append(opts, option.WithJSONSet("top_k", *runtime.TopK))
+		}
+	}
+
+	return opts
+}
+
+func openAIBaseURL(runtime *RuntimeConfig) string {
+	if runtime == nil {
+		return ""
+	}
+
+	if runtime.BaseURL != "" {
+		return runtime.BaseURL
+	}
+	if NormalizeProviderName(runtime.Provider) == ProviderOpenRouter {
+		return defaultOpenRouterBaseURL
+	}
+	return ""
+}
+
+func openAIWebSearchEnabled(runtime *RuntimeConfig) bool {
+	return runtime != nil && NormalizeProviderName(runtime.Provider) == ProviderOpenAI
+}
+
+func appendOpenAIResponseTools(runtime *RuntimeConfig, tools []openairesponses.ToolUnionParam) []openairesponses.ToolUnionParam {
+	if !openAIWebSearchEnabled(runtime) {
+		return tools
+	}
+
+	for _, tool := range tools {
+		if tool.OfWebSearch != nil || tool.OfWebSearchPreview != nil {
+			return tools
+		}
+	}
+
+	webSearch := openairesponses.ToolParamOfWebSearch(openairesponses.WebSearchToolTypeWebSearch)
+	if webSearch.OfWebSearch != nil {
+		webSearch.OfWebSearch.SearchContextSize = openairesponses.WebSearchToolSearchContextSizeMedium
+	}
+
+	return append(append([]openairesponses.ToolUnionParam{}, tools...), webSearch)
+}
+
+func applyOpenAIChatWebSearch(runtime *RuntimeConfig, params *openai.ChatCompletionNewParams) {
+	if params == nil || !openAIWebSearchEnabled(runtime) {
+		return
+	}
+
+	params.WebSearchOptions = openai.ChatCompletionNewParamsWebSearchOptions{
+		SearchContextSize: openAIWebSearchContext,
+	}
+}
+
+func (d *openAIDriver) completeResponses(ctx context.Context, client *openAIClient, runtime *RuntimeConfig, request *completionRequest) (*Completion, error) {
+	params := openairesponses.ResponseNewParams{
+		Input: openairesponses.ResponseNewParamsInputUnion{
+			OfInputItemList: buildResponseInput(request.SystemPrompt, request.Messages),
+		},
+		Model: shared.ResponsesModel(runtime.Model),
+	}
+	if tools := appendOpenAIResponseTools(runtime, nil); len(tools) > 0 {
+		params.Tools = tools
+	}
+	if runtime.MaxOutputTokens > 0 {
+		params.MaxOutputTokens = openai.Int(runtime.MaxOutputTokens)
+	}
+	if runtime.Temperature != nil {
+		params.Temperature = openai.Float(*runtime.Temperature)
+	}
+	if runtime.TopP != nil {
+		params.TopP = openai.Float(*runtime.TopP)
+	}
+	if reasoning, ok := responseReasoningParam(runtime); ok {
+		params.Reasoning = reasoning
+	}
+
+	response, err := client.responses.New(ctx, params)
+	if err != nil {
+		return nil, formatOpenAIError(runtime.Provider, err)
+	}
+
+	content := strings.TrimSpace(response.OutputText())
+	if content == "" {
+		return nil, fmt.Errorf("%s response did not include assistant text", runtime.Provider)
+	}
+
+	model := fallbackString(response.Model, runtime.Model)
+	return &Completion{
+		Provider:          runtime.Provider,
+		Model:             model,
+		Content:           content,
+		ProviderMessageID: strings.TrimSpace(response.ID),
+		FinishReason:      responseFinishReason(response),
+		ContextWindowUsage: resolveContextWindowUsage(
+			ctx,
+			runtime,
+			model,
+			response.Usage.InputTokens,
+			response.Usage.OutputTokens,
+			response.Usage.TotalTokens,
+		),
+	}, nil
+}
+
+func (d *openAIDriver) completeChat(ctx context.Context, client *openAIClient, runtime *RuntimeConfig, request *completionRequest) (*Completion, error) {
+	params := openai.ChatCompletionNewParams{
+		Messages: buildChatMessages(request.SystemPrompt, request.Messages),
+		Model:    shared.ChatModel(runtime.Model),
+	}
+	applyOpenAIChatWebSearch(runtime, &params)
+	if runtime.MaxOutputTokens > 0 {
+		if NormalizeProviderName(runtime.Provider) == ProviderOpenAI {
+			params.MaxCompletionTokens = openai.Int(runtime.MaxOutputTokens)
+		} else {
+			params.MaxTokens = openai.Int(runtime.MaxOutputTokens)
+		}
+	}
+	if runtime.Temperature != nil {
+		params.Temperature = openai.Float(*runtime.Temperature)
+	}
+	if runtime.TopP != nil {
+		params.TopP = openai.Float(*runtime.TopP)
+	}
+	if runtime.PresencePenalty != nil {
+		params.PresencePenalty = openai.Float(*runtime.PresencePenalty)
+	}
+	if runtime.FrequencyPenalty != nil {
+		params.FrequencyPenalty = openai.Float(*runtime.FrequencyPenalty)
+	}
+	if effort, ok := reasoningEffortForThinkingLevel(runtime.ThinkingLevel); ok {
+		params.ReasoningEffort = effort
+	}
+
+	response, err := client.chat.New(ctx, params)
+	if err != nil {
+		return nil, formatOpenAIError(runtime.Provider, err)
+	}
+
+	content, finishReason := extractChatCompletionResult(response)
+	if content == "" {
+		return nil, fmt.Errorf("%s response did not include assistant text", runtime.Provider)
+	}
+
+	model := fallbackString(response.Model, runtime.Model)
+	return &Completion{
+		Provider:          runtime.Provider,
+		Model:             model,
+		Content:           content,
+		ProviderMessageID: strings.TrimSpace(response.ID),
+		FinishReason:      finishReason,
+		ContextWindowUsage: resolveContextWindowUsage(
+			ctx,
+			runtime,
+			model,
+			response.Usage.PromptTokens,
+			response.Usage.CompletionTokens,
+			response.Usage.TotalTokens,
+		),
+	}, nil
+}
+
+func buildResponseInput(systemPrompt string, messages []providerMessage) openairesponses.ResponseInputParam {
+	input := make(openairesponses.ResponseInputParam, 0, len(messages)+1)
+	if strings.TrimSpace(systemPrompt) != "" {
+		input = append(input, openairesponses.ResponseInputItemParamOfMessage(strings.TrimSpace(systemPrompt), openairesponses.EasyInputMessageRoleSystem))
+	}
+	for _, message := range messages {
+		input = append(input, openairesponses.ResponseInputItemParamOfMessage(message.Content, responseMessageRole(message.Role)))
+	}
+	return input
+}
+
+func buildChatMessages(systemPrompt string, messages []providerMessage) []openai.ChatCompletionMessageParamUnion {
+	chatMessages := make([]openai.ChatCompletionMessageParamUnion, 0, len(messages)+1)
+	if strings.TrimSpace(systemPrompt) != "" {
+		chatMessages = append(chatMessages, openai.SystemMessage(strings.TrimSpace(systemPrompt)))
+	}
+	for _, message := range messages {
+		switch strings.ToLower(strings.TrimSpace(message.Role)) {
+		case "assistant":
+			chatMessages = append(chatMessages, openai.AssistantMessage(message.Content))
+		default:
+			chatMessages = append(chatMessages, openai.UserMessage(message.Content))
+		}
+	}
+	return chatMessages
+}
+
+func responseMessageRole(role string) openairesponses.EasyInputMessageRole {
+	switch strings.ToLower(strings.TrimSpace(role)) {
+	case "assistant":
+		return openairesponses.EasyInputMessageRoleAssistant
+	default:
+		return openairesponses.EasyInputMessageRoleUser
+	}
+}
+
+func extractChatCompletionResult(response *openai.ChatCompletion) (string, string) {
+	if response == nil || len(response.Choices) == 0 {
+		return "", ""
+	}
+
+	for _, choice := range response.Choices {
+		content := strings.TrimSpace(choice.Message.Content)
+		if content == "" {
+			continue
+		}
+		finishReason := strings.TrimSpace(choice.FinishReason)
+		if finishReason == "" {
+			finishReason = "completed"
+		}
+		return content, finishReason
+	}
+
+	return "", ""
+}
+
+func responseFinishReason(response *openairesponses.Response) string {
+	if response == nil {
+		return ""
+	}
+
+	if response.Status == openairesponses.ResponseStatusIncomplete && strings.TrimSpace(response.IncompleteDetails.Reason) != "" {
+		return strings.TrimSpace(response.IncompleteDetails.Reason)
+	}
+
+	finishReason := strings.TrimSpace(string(response.Status))
+	if finishReason == "" {
+		return "completed"
+	}
+	return finishReason
+}
+
+func reasoningEffortForThinkingLevel(thinkingLevel string) (shared.ReasoningEffort, bool) {
+	switch strings.ToLower(strings.TrimSpace(thinkingLevel)) {
+	case "low":
+		return shared.ReasoningEffortLow, true
+	case "medium":
+		return shared.ReasoningEffortMedium, true
+	case "high":
+		return shared.ReasoningEffortHigh, true
+	case "xhigh":
+		return shared.ReasoningEffort("xhigh"), true
+	default:
+		return "", false
+	}
+}
+
+func responseReasoningParam(runtime *RuntimeConfig) (shared.ReasoningParam, bool) {
+	effort, ok := reasoningEffortForThinkingLevel(runtime.ThinkingLevel)
+	if !ok {
+		return shared.ReasoningParam{}, false
+	}
+
+	reasoning := shared.ReasoningParam{Effort: effort}
+	switch NormalizeProviderName(runtime.Provider) {
+	case ProviderOpenAI, ProviderOpenRouter:
+		// Native OpenAI-style Responses backends can return a reasoning summary
+		// for UI-only transcript blocks. Use "auto" because summary modes are
+		// model-specific; hard-coding "concise" can suppress summaries on models
+		// that only expose a different summarizer.
+		reasoning.Summary = shared.ReasoningSummaryAuto
+	}
+
+	return reasoning, true
+}
+
+func formatOpenAIError(provider string, err error) error {
+	if err == nil {
+		return nil
+	}
+
+	var apiErr *openai.Error
+	if errors.As(err, &apiErr) {
+		message := strings.TrimSpace(apiErr.Message)
+		if message == "" {
+			message = strings.TrimSpace(apiErr.RawJSON())
+		}
+		if message == "" {
+			message = strings.TrimSpace(err.Error())
+		}
+		if apiErr.StatusCode > 0 {
+			return fmt.Errorf("%s API request failed with HTTP %d: %s", provider, apiErr.StatusCode, truncateForError(message))
+		}
+		if message != "" {
+			return fmt.Errorf("%s API request failed: %s", provider, truncateForError(message))
+		}
+	}
+
+	return err
+}

server/assets/ai.go

@@ -0,0 +1,41 @@
+package assets
+
+import (
+	"os"
+	"path/filepath"
+)
+
+const (
+	// AIDirName stores server-side AI helper data under the Sliver root.
+	AIDirName = "ai"
+
+	// AIAliasesDirName stores aliases made available to the server-side AI agent.
+	AIAliasesDirName = "aliases"
+
+	// AIExtensionsDirName stores extensions made available to the server-side AI agent.
+	AIExtensionsDirName = "extensions"
+)
+
+// GetAIDir returns the server-side AI data directory: ~/.sliver/ai
+func GetAIDir() string {
+	return ensureAIDir(filepath.Join(GetRootAppDir(), AIDirName))
+}
+
+// GetAIAliasesDir returns the server-side AI alias directory: ~/.sliver/ai/aliases
+func GetAIAliasesDir() string {
+	return ensureAIDir(filepath.Join(GetAIDir(), AIAliasesDirName))
+}
+
+// GetAIExtensionsDir returns the server-side AI extension directory: ~/.sliver/ai/extensions
+func GetAIExtensionsDir() string {
+	return ensureAIDir(filepath.Join(GetAIDir(), AIExtensionsDirName))
+}
+
+func ensureAIDir(dir string) string {
+	if _, err := os.Stat(dir); os.IsNotExist(err) {
+		if err := os.MkdirAll(dir, 0o700); err != nil {
+			setupLog.Fatalf("Cannot create AI data dir %s", err)
+		}
+	}
+	return dir
+}

server/assets/assets-helpers.go

@@ -36,6 +36,7 @@ import (
 	"path/filepath"
 	"regexp"
 	"runtime"
+	"strconv"
 	"strings"
 
 	protobufs "github.com/bishopfox/sliver/protobuf"
@@ -435,12 +436,10 @@ func unzipSkipTopLevel(dst string, z *zip.Reader) error {
 
 func xorPBRawBytes(src []byte) []byte {
 	var (
-		fileAst                   *ast.File
-		err                       error
-		sliverpbVarName           = "file_sliverpb_sliver_proto_rawDesc"
-		sliverPbProtoInitFuncName = "file_sliverpb_sliver_proto_init"
-		fset                      = token.NewFileSet()
-		parserMode                = parser.ParseComments
+		fileAst    *ast.File
+		err        error
+		fset       = token.NewFileSet()
+		parserMode = parser.ParseComments
 	)
 	fileAst, err = parser.ParseFile(fset, "", src, parserMode)
 	if err != nil {
@@ -455,154 +454,70 @@ func xorPBRawBytes(src []byte) []byte {
 	}
 
 	ast.Inspect(fileAst, func(n ast.Node) bool {
-		switch node := n.(type) {
-		// Look for the protobuf init function and decode the XORed
-		// data at the top of the function
-		case *ast.FuncDecl:
-			// add an ast.AssignStmt at the top of the function Body
-			// that calls the xor function on the file_sliverpb_sliver_proto_rawDesc object
-			if node.Name.Name == sliverPbProtoInitFuncName {
-				newStmt := &ast.AssignStmt{
-					Lhs: []ast.Expr{
-						ast.NewIdent(sliverpbVarName),
-					},
-					Tok: token.ASSIGN,
-					Rhs: []ast.Expr{
-						&ast.CallExpr{
-							Fun: ast.NewIdent("xor"),
-							Args: []ast.Expr{
-								ast.NewIdent(sliverpbVarName),
-								ast.NewIdent("xorKey"),
-							},
-						},
-					},
-				}
-				node.Body.List = append([]ast.Stmt{newStmt}, node.Body.List...)
+		node, ok := n.(*ast.GenDecl)
+		if !ok {
+			return true
+		}
+		for _, spec := range node.Specs {
+			valueSpec, ok := spec.(*ast.ValueSpec)
+			if !ok {
+				continue
 			}
+			for valueIndex, id := range valueSpec.Names {
+				if !strings.HasSuffix(id.Name, "_rawDesc") || strings.HasSuffix(id.Name, "_rawDescData") {
+					continue
+				}
+				if valueIndex >= len(valueSpec.Values) {
+					continue
+				}
 
-		// Look for the protobuf rawDesc variable and XOR each byte
-		case *ast.GenDecl:
-			for _, spec := range node.Specs {
-				switch spec := spec.(type) {
-				case *ast.ValueSpec:
-					for _, id := range spec.Names {
-						if id.Name == sliverpbVarName {
-							values := spec.Values[0].(*ast.CompositeLit).Elts
-							// XOR each value of the slice
-							for i, v := range values {
-								elt := v.(*ast.BasicLit)
-								elt.Value = xorByte(elt.Value, xorKey[i%len(xorKey)])
-							}
-
-						}
+				switch rawDesc := valueSpec.Values[valueIndex].(type) {
+				case *ast.CompositeLit:
+					for i, v := range rawDesc.Elts {
+						elt := v.(*ast.BasicLit)
+						elt.Value = xorByte(elt.Value, xorKey[i%len(xorKey)])
+					}
+					valueSpec.Values[valueIndex] = &ast.CallExpr{
+						Fun: ast.NewIdent("xorBytes"),
+						Args: []ast.Expr{
+							rawDesc,
+							ast.NewIdent("xorKey"),
+						},
 					}
 				default:
+					offset := 0
+					if xorStringExpr(rawDesc, xorKey, &offset) {
+						node.Tok = token.VAR
+						valueSpec.Values[valueIndex] = &ast.CallExpr{
+							Fun: ast.NewIdent("xorString"),
+							Args: []ast.Expr{
+								rawDesc,
+								ast.NewIdent("xorKey"),
+							},
+						}
+					}
 				}
 			}
-		default:
 		}
 		return true
 	})
 
-	// Add the XOR function to the AST
-	fileAst.Decls = append(fileAst.Decls, ast.Decl(&ast.FuncDecl{
-		Name: ast.NewIdent("xor"),
-		Type: &ast.FuncType{
-			Params: &ast.FieldList{
-				List: []*ast.Field{
-					{
-						Names: []*ast.Ident{ast.NewIdent("input")},
-						Type:  ast.NewIdent("[]byte"),
-					},
-					{
-						Names: []*ast.Ident{ast.NewIdent("key")},
-						Type:  ast.NewIdent("[]byte"),
-					},
-				},
-			},
-			Results: &ast.FieldList{
-				List: []*ast.Field{
-					{
-						Type: ast.NewIdent("[]byte"),
-					},
-				},
-			},
-		},
-		Body: &ast.BlockStmt{
-			List: []ast.Stmt{
-				&ast.AssignStmt{
-					Lhs: []ast.Expr{
-						ast.NewIdent("out"),
-					},
-					Tok: token.DEFINE,
-					Rhs: []ast.Expr{
-						&ast.CallExpr{
-							Fun: ast.NewIdent("make"),
-							Args: []ast.Expr{
-								&ast.ArrayType{
-									Elt: ast.NewIdent("byte"),
-								},
-								&ast.CallExpr{
-									Fun: ast.NewIdent("len"),
-									Args: []ast.Expr{
-										ast.NewIdent("input"),
-									},
-								},
-							},
-						},
-					},
-				},
-				&ast.RangeStmt{
-					Key:   ast.NewIdent("i"),
-					Value: ast.NewIdent("_"),
-					Tok:   token.DEFINE,
-					X:     ast.NewIdent("input"),
-					Body: &ast.BlockStmt{
-						List: []ast.Stmt{
-							&ast.AssignStmt{
-								Lhs: []ast.Expr{
-									&ast.IndexExpr{
-										X:     ast.NewIdent("out"),
-										Index: ast.NewIdent("i"),
-									},
-								},
-								Tok: token.ASSIGN,
-								Rhs: []ast.Expr{
-									&ast.BinaryExpr{
-										X: &ast.IndexExpr{
-											X:     ast.NewIdent("input"),
-											Index: ast.NewIdent("i"),
-										},
-										Op: token.XOR,
-										Y: &ast.IndexExpr{
-											X: ast.NewIdent("key"),
-											Index: &ast.BinaryExpr{
-												X: &ast.Ident{
-													Name: "i",
-												},
-												Op: token.REM,
-												Y: &ast.CallExpr{
-													Fun: ast.NewIdent("len"),
-													Args: []ast.Expr{
-														ast.NewIdent("key"),
-													},
-												},
-											},
-										},
-									},
-								},
-							},
-						},
-					},
-				},
-				&ast.ReturnStmt{
-					Results: []ast.Expr{
-						ast.NewIdent("out"),
-					},
-				},
-			},
-		},
-	}))
+	fileAst.Decls = append(fileAst.Decls,
+		parseHelperDecl(`func xorBytes(input []byte, key []byte) []byte {
+	out := make([]byte, len(input))
+	for i := range input {
+		out[i] = input[i] ^ key[i%len(key)]
+	}
+	return out
+}`),
+		parseHelperDecl(`func xorString(input string, key []byte) string {
+	out := make([]byte, len(input))
+	for i := 0; i < len(input); i++ {
+		out[i] = input[i] ^ key[i%len(key)]
+	}
+	return string(out)
+}`),
+	)
 
 	xorTokens := make([]ast.Expr, len(xorKey))
 	// map xorKey to a slice of ast.BasicLit
@@ -635,6 +550,14 @@ func xorPBRawBytes(src []byte) []byte {
 	return outBuff.Bytes()
 }
 
+func parseHelperDecl(src string) ast.Decl {
+	fileAst, err := parser.ParseFile(token.NewFileSet(), "", "package assets\n"+src, 0)
+	if err != nil {
+		panic(err)
+	}
+	return fileAst.Decls[0]
+}
+
 func xorByte(raw string, key byte) string {
 	// strip 0x
 	raw = raw[2:]
@@ -650,6 +573,37 @@ func xorByte(raw string, key byte) string {
 	return fmt.Sprintf("0x%s", newByte)
 }
 
+func xorStringExpr(expr ast.Expr, key [8]byte, offset *int) bool {
+	switch node := expr.(type) {
+	case *ast.BasicLit:
+		if node.Kind != token.STRING {
+			return false
+		}
+		raw, err := strconv.Unquote(node.Value)
+		if err != nil {
+			panic(err)
+		}
+		rawBytes := []byte(raw)
+		for i := range rawBytes {
+			rawBytes[i] ^= key[(*offset+i)%len(key)]
+		}
+		*offset += len(rawBytes)
+		node.Value = strconv.Quote(string(rawBytes))
+		return true
+	case *ast.BinaryExpr:
+		if node.Op != token.ADD {
+			return false
+		}
+		leftOkay := xorStringExpr(node.X, key, offset)
+		rightOkay := xorStringExpr(node.Y, key, offset)
+		return leftOkay && rightOkay
+	case *ast.ParenExpr:
+		return xorStringExpr(node.X, key, offset)
+	default:
+		return false
+	}
+}
+
 func unzip(src string, dest string) ([]string, error) {
 
 	var filenames []string

server/c2/wireguard.go

@@ -48,7 +48,7 @@ import (
 
 var (
 	wgLog = log.NamedLogger("c2", "wg")
-	tunIP = "100.64.0.1" // Don't let user configure this for now
+	tunIP = certs.C2WireGuardServerIP // Don't let user configure this for now
 )
 
 const (
@@ -195,12 +195,7 @@ func handleKeyExchangeConnection(conn net.Conn) {
 	wgLog.Infof("Handling connection to key exchange listener")
 
 	defer conn.Close()
-	ip, err := generate.GenerateUniqueIP()
-	if err != nil {
-		wgLog.Errorf("Failed to generate unique IP: %s", err)
-	}
-
-	implantPrivKey, _, err := certs.ImplantGenerateWGKeys(ip.String())
+	ip, implantPrivKey, _, err := generate.GenerateUniqueWGPeerKeys()
 	if err != nil {
 		wgLog.Errorf("Failed to generate new wg keys: %s", err)
 	}
@@ -210,7 +205,7 @@ func handleKeyExchangeConnection(conn net.Conn) {
 		wgLog.Errorf("Failed to retrieve existing wg server keys: %s", err)
 	} else {
 		wgLog.Infof("Successfully generated new wg keys")
-		message := implantPrivKey + "|" + serverPubKey + "|" + string(ip)
+		message := implantPrivKey + "|" + serverPubKey + "|" + ip
 		wgLog.Debugf("Sending new wg keys and IP: %s", message)
 		conn.Write([]byte(message))
 	}