Changelog

Major Changes

• Fact-Extraction Architecture: Custom validation layer prevents hallucinations by grounding all answers in actual tool output
• Model Upgrade: Switched to Qwen 2.5 14B (Q5_K_M GGUF) via llama-cpp-python. No Ollama required
• Metasploit Integration (Enterprise): Full module browser, Ruby metadata parser, source code viewer, RC script builder, and interactive msfconsole launcher
• Validated Accuracy: 9.27/10 average across all 6 Pro tools, tested against real engagements
• PyInstaller EXE: Pro and Enterprise ship as self-contained Windows EXEs. No Python setup required
• Airgapped Licensing: HMAC-based offline licence validation

New Features

• YARA detection analysis: 9.84/10 accuracy (5/5 tests)
• NetExec (NXC) analysis: 9.2/10 accuracy
• PCAP network analysis tool page
• Ask Syd AI chat on every tool page
• Auto-detect CPU cores (no longer hardcoded to 16 threads)
• Thread-safe Tkinter UI: all background updates via self.after(0, callback)
• Token budget management: 8192 context window with intelligent truncation
• LLM inference lock: prevents concurrent model access from multiple tool tabs

Metasploit (Enterprise, 3 Phases)

• Phase 1: Knowledge base (20 docs), fact extractor, GUI page, Ask Syd chat
• Phase 2: Module browser: split-pane treeview, Ruby metadata parser, source code viewer, CVE search normalisation, "Ask Syd About Module"
• Phase 3: Launch tab: RC script builder, interactive msfconsole via subprocess, live output streaming, ANSI stripping, Save/Load .rc files, "Use Output" for analysis

Bug Fixes

• Thread safety: all Tkinter ops from background threads fixed
• Exploit deduplication in Metasploit module browser
• Hashdump whitespace parsing
• CVE count/score extraction
• Service deduplication in Nmap analysis
• Token overflow handling for large tool outputs
• Interactive command input for msfconsole (--no-readline flag)

Accuracy Scores (Production Tested)