feat: add live security workbench and managed Kali deployment

[spetro511]

What does this PR do?

This mirrors the upstream workbench contribution in the personal fork so its branch, review state, and follow-up fixes remain visible under spetro511/CyberStrike. It adds live activity, Mission, topology, Nmap history, target notes, structured memory, observer access, and managed Kali deployment.

Tracks CyberStrikeus#135

Mirrors CyberStrikeus#134

Type of change

• Bug fix
• New feature / agent
• Security tool / MCP server / Bolt plugin
• Agent skill / knowledge base
• UI / TUI improvement
• Documentation
• Refactor / performance
• CI / infrastructure

Security impact

• This PR adds or modifies tool execution (shell, file, network)
• This PR changes agent permissions or scope
• This PR modifies authentication / authorization logic
• This PR has no security impact

How did you verify it works?

• bun turbo typecheck
• 102 changed-area backend tests and activity-panel UI tests
• Production Web UI and Linux x64 builds
• Safe and normal Kali browser/API smoke checks

Checklist

• bun turbo typecheck passes
• Tested locally with at least one LLM provider
• PR is focused on a single change
• No secrets, credentials, or API keys in the diff
• Breaking changes are documented (if any)

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[amazon-q-developer]

Summary

This PR adds significant security features including live activity tracking, managed Kali deployment, topology visualization, and observer access. The changes span 72 files with 7,540 additions.

Critical Issues Found

1 Logic Error Identified - A critical indentation error in packages/cyberstrike/src/topology/index.ts (lines 189-241) causes nmap scan processing to only handle one host instead of iterating through all hosts correctly. This breaks the topology generation for network scanning results.

Security Review

The PR implements several security-impacting features:

• Observer role support with read-only access mode added to server authentication
• Topology tracking for network reconnaissance visualization
• Target notes with validated input constraints (max 20K content, max 200 char titles, URL validation)
• Nmap scan import with 10 MiB XML size limit and proper duplicate detection

The security implementations appear sound with proper input validation, size limits, and session isolation through database queries. No hardcoded credentials or exposed secrets detected.

Testing

According to the PR description:

• bun turbo typecheck passes
• 102 backend and UI tests pass
• Production builds verified for Web UI and Linux x64
• Kali browser/API smoke tests completed

Recommendation

Block merge until the indentation/scoping issue in topology generation is fixed. The logic error will cause incorrect topology graphs when processing nmap scan results.

---

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.

---

⚠️ This PR contains more than 30 files. Amazon Q is better at reviewing smaller PRs, and may miss issues in larger changesets.

[amazon-q-developer]

🛑 Logic Error: Inconsistent indentation causes a scope issue that breaks the loop logic. Lines 189-241 are incorrectly indented, placing the entire nmap scan processing logic inside the node creation block instead of at the loop level. This causes only one host to be processed instead of all hosts, and makes the current variable reference the wrong node for routing edges.

Suggested change

	const current = node({
	id: id("host", host.id),
	kind: "host",
	label: host.hostnames[0] ?? host.id,
	source: "nmap",
	status: host.status,
	confidence: host.os[0] ? `${host.os[0].accuracy}%` : undefined,
	data: {
	addresses: host.addresses,
	os: host.os,
	scanID: scan.id,
	scanName: scan.name,
	scannedAt: scan.time,
	},
	})
	for (const port of host.ports) {
	const service = node({
	id: id("service", `${host.id}:${port.protocol}:${port.port}`),
	kind: "service",
	label: `${port.port}/${port.protocol} ${port.service.name ?? port.service.product ?? "unknown"}`,
	source: "nmap",
	status: port.state,
	data: {
	host: host.id,
	port: port.port,
	protocol: port.protocol,
	service: port.service,
	scripts: port.scripts,
	scanID: scan.id,
	},
	})
	edge(current, service, "exposes")
	}
	let prior: string | undefined
	const target = new Set(host.addresses.map((address) => address.address))
	for (const hop of host.trace.toSorted((a, b) => a.ttl - b.ttl)) {
	if (target.has(hop.address)) continue
	const hopNode = node({
	id: id("host", hop.address),
	kind: "host",
	label: hop.host ?? hop.address,
	source: "nmap",
	data: {
	address: hop.address,
	ttl: hop.ttl,
	rtt: hop.rtt,
	scanID: scan.id,
	},
	})
	if (prior) edge(prior, hopNode, "routes_to")
	prior = hopNode
	}
	if (prior) edge(prior, current, "routes_to")
	const current = node({
	id: id("host", host.id),
	kind: "host",
	label: host.hostnames[0] ?? host.id,
	source: "nmap",
	status: host.status,
	confidence: host.os[0] ? `${host.os[0].accuracy}%` : undefined,
	data: {
	addresses: host.addresses,
	os: host.os,
	scanID: scan.id,
	scanName: scan.name,
	scannedAt: scan.time,
	},
	})
	for (const port of host.ports) {
	const service = node({
	id: id("service", `${host.id}:${port.protocol}:${port.port}`),
	kind: "service",
	label: `${port.port}/${port.protocol} ${port.service.name ?? port.service.product ?? "unknown"}`,
	source: "nmap",
	status: port.state,
	data: {
	host: host.id,
	port: port.port,
	protocol: port.protocol,
	service: port.service,
	scripts: port.scripts,
	scanID: scan.id,
	},
	})
	edge(current, service, "exposes")
	}
	let prior: string | undefined
	const target = new Set(host.addresses.map((address) => address.address))
	for (const hop of host.trace.toSorted((a, b) => a.ttl - b.ttl)) {
	if (target.has(hop.address)) continue
	const hopNode = node({
	id: id("host", hop.address),
	kind: "host",
	label: hop.host ?? hop.address,
	source: "nmap",
	data: {
	address: hop.address,
	ttl: hop.ttl,
	rtt: hop.rtt,
	scanID: scan.id,
	},
	})
	if (prior) edge(prior, hopNode, "routes_to")
	prior = hopNode
	}
	if (prior) edge(prior, current, "routes_to")

[spetro511]

@copilot is this correct

[Copilot]

@copilot is this correct

Could you point to the specific code, behavior, or part of the PR description you want verified? The comment alone does not identify what “this” refers to.