What's Changed

• feat(realbench): black-box multi-CVE benchmark suite with deterministic verification by @xalgord in #682
• feat(chart): add Helm chart for Kubernetes deployment by @ummon-v in #683
• release: v4.6.92 by @xalgord in #684

Highlights

• Real-world CVE benchmark suite (#682): Grafana 8.2.2/8.2.7 (CVE-2021-43798, CVE-2021-41174) and Metabase 0.46.6/0.46.6.4 (CVE-2023-38646) digest-pinned fixtures with loopback-only ingress and fixed-version controls. New deterministic verification primitives: verify_path_traversal (literal ../ + control), verify_timing (interleaved pairs, median differential), discover_client_routes + verify_path_template_xss, OAST execution attribution (os-command / runtime-api incl. java.net.URL compound / template-execution; fetch-only callbacks can never prove RCE), verbatim advisory-request replay artifacts, professional assessment workflow with lane delegation and plan/ledger-based completion, fail-closed RCE reporting with in-place upgrades. Single-run evidence: Metabase vulnerable 1/1 (verify_timing 3/3 pair agreement at 5.0s), fixed controls 0 regressions.
• Helm chart (#683): deploy/chart for Kubernetes — optional HPA/Ingress/Gateway API, env.raw|config|secret passthrough, auth + existingSecret, /data PVC. Hardened defaults: serviceAccount.automount: false, documented single-replica statefulness.

Checksums (SHA-256)

9b3ec1fcc82d0b2fb371a0ffe280839f681acfb2acc1eb5ba8ace1c6ddfe12fd  xalgorix-darwin-amd64
3621b9b7c562eacd7ffbf31aba028a44e71246dfaf294f1881c1b432985d0fe0  xalgorix-darwin-arm64
6abb7c57f014e4fa10d475d9d7c1401f8844edfabe06998a91be8289bd2ee7be  xalgorix-linux-amd64
1ce6b40c790863ae39f5240299bdd90e8bbd8bd266c31c75b599554dbb06984e  xalgorix-linux-arm64

What's Changed

• feat(web): expose token-saver flags in dashboard Environment settings by @xalgord in #680
• release: v4.6.91 by @xalgord in #681

Highlights

• Configure the token-saver flags from the dashboard: Settings → Environment (LLM category) now exposes:
• Bounded working context (token saver) (XALGORIX_BOUNDED_CONTEXT) — 40–60% input-token reduction; aged tool-result messages become retrieval stubs with the byte-identical original archived to disk and fetchable via read_tool_output
• Role-scoped specialist tools (token saver) (XALGORIX_ROLE_SCOPED_TOOLS) — 10–20% additional input reduction; role-foreign tool docs withheld from specialist prompts
• Tunables: Bounded context: active window (default 8), Bounded context: archive threshold (bytes) (default 1500)
• No restart required: saving hot-applies to the live runtime config, so new scans pick the flags up immediately.
• Both flags remain default-off. Toggle them in the UI, then watch average_prompt_tokens and resend_amplification_ratio in the scan's Token usage tab.

Checksums (SHA-256)

b3acbca169654717948805120c130d67ba71743f676330c4048a3aa94fe08dcd  xalgorix-darwin-amd64
f44ed9cc72cd6d654d35d5b19a57372b3c62b3c37854aee8366a91fdc3c7c266  xalgorix-darwin-arm64
ab3a43235ff11458a92f832e472dd145e85e3835d37b321f53557c1bcb44c376  xalgorix-linux-amd64
762767b5fce98b6fb1e289df277d7260af404c9f9f0e45393b264972ca8da55c  xalgorix-linux-arm64

What's Changed

• feat(agent): bounded working context with information-complete tool-output archive by @xalgord in #677
• feat(agent): role-scoped tool documentation for delegated specialists by @xalgord in #678
• release: v4.6.90 by @xalgord in #679

Highlights

• Token-Optimization Levers 1 & 2 (flag-gated, default OFF):
• XALGORIX_BOUNDED_CONTEXT=1 — aged tool-result messages become compact retrieval stubs; the complete raw output persists byte-identical under <ScanDir>/tool-outputs/ and is fetchable via the new read_tool_output tool. Targets the measured 37–49x resend amplification (99.3% of token consumption is prompt/input). Expected 40–60% input reduction.
• XALGORIX_ROLE_SCOPED_TOOLS=1 — role-foreign tool documentation is withheld from delegated specialists' prompts (tools stay callable and indexed). Expected 10–20% additional reduction.
• Both flags keep every removed byte reachable — eager resend becomes lazy fetch. Enable on the scanner, then watch average_prompt_tokens and resend_amplification_ratio in the Token usage dashboard tab.
• Tool schema serialization is now deterministically sorted (was randomized per build, defeating provider prefix-cache stability).
• This release is behavior-identical to v4.6.89 until the flags are enabled.

Checksums (SHA-256)

d726f99758a25142392b0d78130315a20f5d2935a62d802be7a9982ce1f59f82  xalgorix-darwin-amd64
4ff0e4b92bf98c839d07532fcf7332994505ffdd8f3d3ca12558c2f5abb80f57  xalgorix-darwin-arm64
84764c3f0cd600275ecd3b8240a62de4675c2663c151a97e53180313617a06e4  xalgorix-linux-amd64
2a7ee60dcc3d1b8640104b8279298ed67d2eb92aca727ed039729bcb2243a8d8  xalgorix-linux-arm64

What's Changed

• feat(observability): expose token attribution diagnostics for production scans by @xalgord in #675
• release: v4.6.89 by @xalgord in #676

Highlights

• Token-Attribution Observability (Production Diagnostics):
• New GET /api/scans/{id}/token-usage endpoint serving per-request token attribution for running and completed scans, with cache metrics reported as null when the provider does not return them (never fabricated).
• Context-growth analysis per scan: first/last/median/p95/max prompt tokens, prompt growth ratio, cumulative prompt tokens, and a resend-amplification heuristic that shows how repeatedly resending accumulated history amplifies input volume.
• Token usage broken down by agent (root, authz-logic, injection-serverside, client-source, verifier) and by active-context source (system, assistant history, tool results, skill results, other user history), plus recovery-loop stats (retries, no-tool, malformed-tool, finish-rejection).
• Compact metadata-only persistence (token-usage.jsonl + token-usage.json) under the scan directory; diagnostics survive scan completion and server restarts and continue across resumed scans.
• [token-analysis] summary logged at scan completion and a redacted one-time MiniMax usage-structure diagnostic (field names only) for streaming and non-streaming calls.
• New Token usage tab in the scan dashboard with a prompt-tokens-per-request chart filterable by agent — runaway context growth is immediately visible.
• Observability only: no changes to prompts, methodology, iterations, compaction, tool outputs, or scan behavior; outbound LLM request invariance is proven by tests.

Checksums (SHA-256)

8aa542238255ca5e5c4af4adbfaa9085033269cb9304fbacfdcc304b6d78178a  xalgorix-darwin-amd64
d0136e8a9661240d5ca57aff29f304b30edeee01549208503a7e54c0ea7dba24  xalgorix-darwin-arm64
f178d1d97496a04570c96664c809df545bde253a1cefe1b9ff28f084a03285b6  xalgorix-linux-amd64
3e99f57cd2a58f7f6b5f50afb1316f61f26a51b95ada55c272acf71af84a964e  xalgorix-linux-arm64

What's Changed

• revert: revert PR #669 (unreachable target early termination) by @xalgord in #673
• release: v4.6.88 by @xalgord in #674

Highlights

• Restored Reliable Scan Execution & Restarts (Pre-PR #669 Baseline):
• Reverted PR #669 which caused scans encountering transient network latency, timeouts, or WAF connection resets to prematurely halt and terminate as finished.
• Restored seamless auto-resume and queue persistence across server restarts and daemon reboots.

Checksums (SHA-256)

2eb7392c6fdab640154c598d29f0af271abb1956abda710ba2ed5f0555ce1d6e  xalgorix-darwin-amd64
6b1c6d83992487fc0696754057c687aa541dbf6fa0657365c9804b450b4e8f6e  xalgorix-darwin-arm64
5166b3d94e9d05e4f864a9d2d87bc1acef1423959d5871e4629bee102dd5c5e3  xalgorix-linux-amd64
962af94cbf8cbda8b8b8ff5477ef392d4d160e54d26b356aad6f19554e055086  xalgorix-linux-arm64

What's Changed

• fix(web): preserve in-flight single-target scans across server restarts by @xalgord in #671
• release: v4.6.87 by @xalgord in #672

Highlights

• Preserve In-Flight Single-Target Scans on Restart:
• Fixes premature termination and false-positive completion of single-target scans on scanner daemon restarts.
• Correctly preserves session records and queue states as server_shutdown instead of marking as finished.
• Guarantees seamless auto-resume of in-flight scans across server updates and reboots.

Checksums (SHA-256)

35408f353dfb395390de70ba1f46006a9f6d913df991aa8fd4d11e4133edec2f  xalgorix-darwin-amd64
d5a305cce5caef47e3532d763bde3dc0a2b53b7a7d0947b32bea0b02820516fd  xalgorix-darwin-arm64
e376df4166c53a54824563c821963de46af1c3961597565b953c4800c48fd27d  xalgorix-linux-amd64
adf63ec13bd67dd80f38dbb29fb37d8fe07ac80926a8325546af70213ff5ce86  xalgorix-linux-arm64

What's Changed

• fix(agent): halt cleanly and allow finish when target becomes unreachable by @xalgord in #669
• release: v4.6.86 by @xalgord in #670

Highlights

• Target Unreachability & Scan Lifecycle:
• Halt and allow finish cleanly when a scan target becomes unreachable, drops connections, or bans the scanner mid-scan (#669).
• Distinguish target-side unreachable/network drops from agent and scanner platform failures.

Checksums (SHA-256)

f39d498fa8d799546e9503a06e495e60f5d3dac0b2f69f03aa5750417baf9e6c  xalgorix-darwin-amd64
d337cdaa33c945c7cdc96366560fe22eda003490bb580c64e923b44155880d5e  xalgorix-darwin-arm64
aadbf87b79f6f20d5a0c4a9d8a2fc570b09ece43cacb7bb751941322c449180b  xalgorix-linux-amd64
7cd0a2a83cfcfbc1a5aeedf74f87857f54f68f7c3e0c70fde2d2a4b1037fdcac  xalgorix-linux-arm64

What's Changed

• fix(web): persist scan token consumption and iterations across server restarts by @xalgord in #667
• Mistral: add support for zai-glm-latest (GLM 5.3) by @ummon-v in #664
• release: v4.6.85 by @xalgord in #668

Highlights

• Scan Token & Iteration Persistence Across Restarts:
  • In-flight iterations, total_tokens, and tool_calls are now persisted in durable QueueState files across server restarts (#667).
  • Enforced monotonic counter guarantees so resumed scans never reset to 0 or decrement counter metrics.
  • Ensured live instance metrics are flushed atomically upon SIGINT/SIGTERM daemon shutdowns.
  • Aggregated completed and running child sub-scan tokens, iterations, and tool calls into wildcard parent scan records.
  • Protected in-memory scan instances during queue recovery from being clobbered by new scan initialization placeholders.
• OpenAI-Compatible Array Content & Mistral zai-glm-latest Support:
  • Added support for typed-part content arrays (e.g. [{"type":"text","text":"..."}]) in OpenAI-compatible API responses, enabling seamless usage of Mistral's latest models including zai-glm-latest (GLM 5.3) (#664).
  • Handles streaming mixed deltas and thinking blocks with full token accounting.

Checksums (SHA-256)

603671ac54035c44403e658ecf22c7f3fa02a7f0b4b28a402a5371b74a967c6f  xalgorix-darwin-amd64
8b8981633fb654d910a24a66b102f897ec49a49eb2088c22f48641568649b14c  xalgorix-darwin-arm64
1167180f4df13df63ffacbd97c8523548e8cb5592629d5dde954195d8abb9031  xalgorix-linux-amd64
e0ccfae240a946497b2ee51d1c37afae77a2678fa6fe0478623b31bfc53918ec  xalgorix-linux-arm64

What's Changed

• feat(agent): optimize LLM token consumption with zero security quality regression by @xalgord in #665
• release: v4.6.84 by @xalgord in #666

Highlights

• LLM Token Efficiency with Zero Security Quality Regression: Comprehensive optimization eliminating redundant token consumption without altering attack surface coverage, vulnerability classes, hypotheses, verification rigor, or evidence contracts (#665).
• Per-Agent Skill & Catalog Deduplication: Context-aware duplicate suppression for read_skill and list_skills with strict coordinator and specialist isolation, canonical alias resolution, SHA-256 hash tracking, and complete re-injection after context compaction or sliding-window pruning.
• Accidental Engine Notice Suppression: Suppressed duplicate unchanged plan briefs in hookPlanner and consecutive browser/curl warnings in hookCurlPreference.
• Multi-Dimensional Token Attribution Tracker: Full observability tracking 20+ dimensions per LLM call across coordinator, specialists, and verifier with aggregated post-scan summaries.
• Provider Cache Telemetry & Invariants: Accurate parsing of MiniMax/OpenAI, Anthropic, and Gemini cache usage without hallucinated estimates, plus prompt caching support.
• Non-Retryable Provider Error Pruning: Immediate abort on HTTP 422, 405, and deterministic provider errors, saving costly retry loops while preserving transient 429 and 5xx retries.

Checksums (SHA-256)

8b07245a3a01ee759927f1c368719739cb921f07f87dd20816253d0843aa9261  xalgorix-darwin-amd64
0b0250dbf0076af67431645b8092e31a1837311c98eaa0a1e56db12ccb68f99b  xalgorix-darwin-arm64
1462d57b8877c331eab0f2fb996647a117f932a3daa359a71496024917e4dddb  xalgorix-linux-amd64
9f22e45d1130e2c30a49460ab5ddeb784359d542d61d95f5d57037d9250d5271  xalgorix-linux-arm64

What's Changed

• feat(agent): add configurable iteration delay (XALGORIX_ITERATION_DELAY) by @xalgord in #662
• release: v4.6.83 by @xalgord in #663

Highlights

• Configurable Agent Iteration Delay: Added XALGORIX_ITERATION_DELAY (category: Runtime, default: 0, range: 0..300s) to Scanner Web UI Settings and environment configuration. Operators can configure a pacing pause in seconds between reasoning turns to control token velocity and conserve rolling-window provider rate limits without affecting tool or network scans.
• Dynamic Runtime Application: Modifying the iteration delay in the Web Settings UI applies immediately to active scans and propagates recursively to running child specialist subagents without requiring a server restart.
• Responsive Cancellation: Sleeping turns use context-aware timers that unblock immediately upon scan pause, stop, or cancellation.

Checksums (SHA-256)

fa1e79d5599da399ab7bbcb4d2d78f1fcc1b2109d8d9fdd08e286e97dd727a91  xalgorix-darwin-amd64
3b67aee2a5ba03d0a243b46a7516ff4ff4b083e4df3f0780eacb1d80dfc917ca  xalgorix-darwin-arm64
0f7f899304009f80e2665e295cd6317353b3f0731ed007e89b0fa39e82d11575  xalgorix-linux-amd64
c79d935e8cad74e384db2b209971fbe494178b1d9295737bfc99e3bbc6ecb662  xalgorix-linux-arm64