v1.1.16

What's New in 1.1.16

Hook Architecture — Native Post-Exploitation Tools

CyberStrike agents don't just call AI tools — they execute real commands on target systems. Hooks are native TypeScript post-exploitation programs that generate and run platform-specific commands (PowerShell, cmd, bash, Python, etc.) on compromised machines. Each hook is a single tool call (e.g. winhook credential_dump) that dispatches to a handler producing OS-native commands with fallback chains when primary tools are unavailable.

Why hooks instead of plain tool calls:

• Native execution — runs actual system commands on the target, not API calls
• Fallback chains — if PowerShell is blocked, falls back to cmd.exe/reg.exe/wmic; if bash is unavailable, tries sh/python3/perl
• Structured output — every finding includes CWE mappings, severity, and evidence for automated reporting
• OPSEC built-in — temp files use TMPDIR with try/finally cleanup, forensic secrets are masked in output, credential values are never exposed in findings

This release massively expands the hook arsenal across all platforms and adds new security domains.

Added

• linuxhook — 120 native TypeScript post-exploitation programs across 9 categories: recon, credentials, privesc, persistence, lateral movement, evasion, exfiltration, network attacks, IPv6. Uses bash/sh/python3/perl fallback chain for maximum target compatibility
• llmhook — 23 LLM security testing programs covering OWASP LLM Top 10: prompt injection, jailbreak (15 techniques), training data extraction, hallucination testing, PII/RBAC bypass, multi-turn attacks, indirect injection, evasion (encoding bypass, guardrail detection, token exhaustion), toxicity/bias testing. 130+ probes/payloads with --format openai|anthropic|generic support
• ci-audit — 8 read-only CI/CD pipeline security programs for GitHub Actions, GitLab CI, Jenkins, CircleCI
• cloud_audit — native cloud security audit tool for internal-network and cloud-security agents
• gcphook — modularized and expanded to 33 GCP post-exploitation programs (from 13)
• LLM security agent (SENTINEL) — proxy-tester-llm tier with methodology engine integration, hackbrowser + generate_report permissions, and llmhook tool registration
• Uninstall wizard — interactive cleanup with running-instance detection and preuninstall hook for package managers
• Skills: linux-postexploit (kill chain + MITRE ATT&CK), ci-assessment
• cve-mcp dynamic CTA — all OS hooks now guide agents to query cve-mcp for discovered services, enabling automatic CVE lookup during post-exploitation

Changed — Major Hook Expansions

• winhook — modular refactor: monolithic file → 16 modules, 12 → 154 programs. Added cmd.exe/reg.exe/wmic fallback for restricted environments where PowerShell is blocked
• machook — modular refactor: monolithic file → 10 modules, 12 → 46 programs. New credential, lateral movement, and evasion handlers
• awshook — expanded from 10 to 92 programs across 7 categories (recon, credentials, privesc, persistence, lateral movement, evasion, exfiltration)
• azurehook — expanded from 8 to 154 programs across 13 categories including CIS Azure Benchmark compliance (18 handlers), M365, Entra ID identity attacks, and impact/disruption handlers
• containerhook — expanded from 7 to 20 Docker container security programs
• kubehook — expanded from 7 to 20 Kubernetes security programs
• iachook — expanded from 8 to 15 Terraform/IaC audit programs
• cipipe (azurehook, kubehook) — converted from Python to native TypeScript
• macos-postexploit skill — updated from 12 to 46 programs

Fixed

• Hackbrowser: shell quoting error in Chromium path detection (nested double-quote collision)
• Hackbrowser: Esc now stops the crawl subprocess — previously continued running in background after session cancel
• Build: bundled migration crash on first-time setup (Drizzle ORM 1.0 missing name field)
• Provider: Vertex AI autoload with GOOGLE_APPLICATION_CREDENTIALS for both Gemini and Claude, EC2 Instance Role auth for Bedrock (#58), full AWS credential chain with IMDS fallback
• Hooks (all platforms): duplicate checkId resolution across all modules, TMPDIR usage for temp files with try/finally cleanup, forensic secret masking in output, user-supplied regex validation, JSON.parse guards on external input, handler dispatch error handling
• Session: content-filter finish reason surfaced as visible error instead of silent exit
• Bash tool: binary output detection and stripping to prevent terminal corruption
• DB: idempotent migration CREATE statements

Security

• fast-xml-parser 5.9.3 → 5.10.1 (DoS via XML parsing)
• dompurify 3.4.11 → 3.4.13 (XSS via hook removal)

Community Contributions

• @csmcguire — EC2 Instance Role auth for Amazon Bedrock (#58)
• @Nislive — LLM security agent (#33)
• @Serhatcck — llmhook refusal/canary detection, llm-security agent tier restructure

v1.1.15

Changelog

All notable changes to CyberStrike are documented in this file.

Format based on Keep a Changelog, versions follow Semantic Versioning.

---

[1.1.15] — 2026-06-23

Added

• eBPF post-exploitation tool — 10 kernel-level programs for the internal-network agent, executed via ebpf <program> after gaining root on Linux targets
  • Credential harvesting: pam_sniff (PAM uprobe — cleartext SSH/sudo/su passwords), ssl_sniff (SSL uprobe — TLS plaintext capture), keylog (TTY kprobe — keystroke capture)
  • Stealth operations: proc_hide (hide processes from ps/top/htop), file_hide (hide files from ls/find), conn_hide (hide connections from netstat/ss)
  • Monitoring: execve_sniff (system-wide process execution tracing), dns_sniff (kernel-level DNS query capture), dep_scan (runtime dependency and vulnerable library scanner)
  • Cleanup: cleanup (enumerate and remove all CyberStrike eBPF programs from target)
• eBPF blind spot monitors — 20 kernel-level detection programs for attack primitives that bypass classical syscall hooks and operate through kernel subsystems invisible to standard monitoring
  • Syscall bypass: io_uring_sniff (io_uring SQE submission monitoring — CONNECT/READ/WRITE/OPENAT via ring buffer bypass, kernel 5.1+)
  • Fileless execution: memfd_exec (memfd_create + execveat AT_EMPTY_PATH correlation — diskless payload delivery detection)
  • Process injection: ptrace_sniff (ATTACH → POKEDATA → SETREGS → CONT injection sequence detection), crossmem_sniff (process_vm_writev/readv cross-process memory injection)
  • Exploit primitives: userfaultfd_sniff (userfaultfd race condition timing primitive detection)
  • Integrity verification: bpf_integrity (bpf() syscall monitoring + bpftool baseline comparison — detect unauthorized BPF program loads, CyberStrike hook tampering)
  • Network manipulation: netlink_sniff (netlink socket message monitoring — route/firewall rule injection detection)
  • Sandbox evasion: seccomp_sniff (prctl/seccomp self-modification — sandbox weakening, process name masquerading, privilege restriction bypass)
  • Memory IPC: mmap_sniff (shared memory via mmap MAP_SHARED/shmget/shmat — covert IPC without syscalls after mapping)
  • Zero-copy transfers: zerocopy_sniff (splice/tee/sendfile64 fd-to-fd data movement invisible to buffer profilers)
  • VDSO side-channels: vdso_sniff (clock_gettime/gettimeofday high-frequency timing + mprotect VDSO page tampering)
  • Kernel keyring: keyring_sniff (add_key/keyctl/request_key — credential storage in kernel keyring evading filesystem monitoring)
  • Namespace escape: namespace_sniff (setns/unshare — container escape, namespace pivoting, single-namespace monitoring bypass)
  • Terminal injection: ioctl_sniff (TIOCSTI keystroke injection, TIOCLINUX, TIOCSCTTY terminal steal — ioctl blind spot)
  • Mount manipulation: mount_sniff (overlay/bind mounts over /etc, /usr, /bin + FUSE mount detection)
  • FUSE hijacking: fuse_sniff (/dev/fuse open + fuse-type mount — file operations bypass kernel VFS)
  • Perf side-channels: perf_sniff (perf_event_open — cache miss/branch misprediction hardware counter abuse)
  • BPF map covert channels: bpfmap_sniff (MAP_CREATE/UPDATE/LOOKUP/DELETE — inter-process data sharing via BPF maps)
  • Dynamic linker injection: ldpreload_sniff (LD_PRELOAD env injection + ld.so.preload/conf write detection)
  • Futex covert channels: futex_sniff (WAIT/WAKE timing-based signaling between processes, busy-wait exploitation)
• ebpf-attacks skill — kill chain methodology with 5 phases: situational awareness, credential harvesting, stealth operations, advanced evasion detection, cleanup. Includes MITRE ATT&CK mappings (T1014, T1040, T1055.008, T1055.012, T1056.001, T1068, T1553, T1556, T1562.001, T1562.004, T1620) and detection considerations
• Windows post-exploitation tool (winhook) — 12 userland programs for the internal-network agent, executed via winhook <program> after gaining Administrator on Windows targets
  • AV/EDR evasion: amsi_bypass (patch AmsiScanBuffer in-memory), etw_blind (patch EtwEventWrite to blind EDR), defender_exclude (add Windows Defender exclusion paths)
  • Credential harvesting: lsass_dump (LSASS memory dump via comsvcs.dll/MiniDumpWriteDump), sam_dump (SAM/SYSTEM/SECURITY registry hive extraction), dpapi_extract (DPAPI secret decryption — browser passwords, WiFi, Vault), credential_prompt (fake CredUI dialog), keylog_win (SetWindowsHookEx keystroke capture), clipboard_sniff (clipboard monitoring)
  • Monitoring: etw_process (process creation tracking), etw_network (network connection tracking)
  • Cleanup: cleanup_win (event log clearing, artifact removal, Defender exclusion rollback)
• macOS post-exploitation tool (machook) — 12 programs for the internal-network agent, executed via machook <program> after gaining root on macOS targets
  • Credential harvesting: keychain_dump (Keychain password extraction via security CLI), chrome_creds (Chrome/Safari credential decryption — PBKDF2 + AES-128-CBC), ssh_keys (SSH private key discovery for all users), tcc_bypass (TCC.db manipulation for camera/mic/FDA access), keylog_mac (CGEventTap keystroke capture)
  • Monitoring: dtrace_exec (process execution tracing), dtrace_net (network connection tracing), dtrace_file (file access tracing)
  • Stealth: xprotect_check (XProtect/MRT/Gatekeeper/SIP/EDR enumeration), gatekeeper_bypass (quarantine xattr removal), log_clear (unified log, ASL, audit log clearing)
  • Cleanup: cleanup_mac (LaunchAgent/Daemon removal, process cleanup, temp file removal)
• windows-postexploit skill — kill chain with AV/EDR evasion → credential harvesting → monitoring → cleanup phases. MITRE ATT&CK mappings (T1003, T1056.001, T1059.001, T1562.001, T1070.001, T1555)
• macos-postexploit skill — kill chain with situational awareness → credential harvesting → monitoring → stealth → cleanup phases. MITRE ATT&CK mappings (T1555.001, T1056.001, T1059.004, T1562.001, T1070.002, T1553.001)
• AWS post-exploitation tool (awshook) — 10 cloud programs for internal-network and cloud-security agents, executed via awshook <program> with valid AWS credentials
  • IAM exploitation: iam_enum (IAM users/roles/groups enumeration + privilege escalation path analysis), iam_privesc (PassRole, AssumeRole, AttachPolicy, CreateAccessKey chains)
  • Data exfiltration: s3_dump (sensitive file discovery via pattern matching + download), secrets_dump (Secrets Manager + SSM Parameter Store extraction), ec2_snapshot (EBS volume snapshot + cross-account sharing)
  • Persistence: lambda_backdoor (layer injection or new backdoor function with admin role)
  • Remote execution: ssm_exec (SSM RunCommand on managed EC2 instances)
  • Credential harvesting: metadata_harvest (EC2 IMDSv1/v2, ECS task metadata, Lambda env credential extraction)
  • Defense evasion: cloudtrail_blind (stop trails, manipulate event selectors, delete logs)
  • Cleanup: cleanup_aws (restore CloudTrail, delete Lambda/IAM/EBS artifacts, clean state file)
• Azure post-exploitation tool (azurehook) — 8 cloud programs for internal-network and cloud-security agents, executed via azurehook <program> with Azure access tokens
  • Entra ID exploitation: entra_enum (users, groups, apps, service principals, directory roles via Graph API), entra_privesc (OAuth2 consent grant, PIM role activation, SP credential injection)
  • Data exfiltration: keyvault_dump (secrets, keys, certificates from all accessible Key Vaults), storage_dump (Blob storage sensitive file discovery + download)
  • Credential harvesting: managed_identity (IMDS token harvest from VM/App Service for ARM, Graph, KeyVault, Storage, SQL), azuread_token (FOCI client ID abuse, token refresh, JWT decode)
  • Persistence: runbook_backdoor (Automation Account Python3 runbook with callback + hourly schedule)
  • Cleanup: cleanup_azure (revoke consent grants, remove SP secrets, delete runbooks/schedules)
• Kubernetes post-exploitation tool (kubehook) — 7 programs for internal-network and cloud-security agents, executed via kubehook <program> with valid kubeconfig
  • Enumeration: k8s_enum (namespaces, pods, services, secrets, RBAC, nodes — 11 resource categories)
  • Credential harvesting: k8s_secrets (Secret extraction + base64 decode across namespaces, TLS cert/dockerconfig/SA token parsing), etcd_dump (direct etcd connection for protobuf-encoded secret extraction)
  • Privilege escalation: k8s_privesc (SA token theft, ClusterRoleBinding creation, TokenRequest API minting)
  • Container escape: k8s_escape (privileged mode, hostPID, hostNetwork, Docker socket, cgroup release_agent — 7 detection vectors)
  • Persistence: k8s_backdoor (privileged DaemonSet on all nodes or CronJob with callback, deployed to kube-system)
  • Cleanup: cleanup_k8s (state file + label selector app=cyberstrike resource removal)
• CI/CD pipeline attack tool (cipipe) — 5 programs for the internal-network agent, executed via cipipe <program> with platform API tokens
  • Secret extraction: gh_secrets (GitHub Actions secret enumeration, workflow log credential scanning, workflow dispatch exfiltration), gitlab_tokens (CI/CD variables, runner tokens, deploy tokens, project access tokens), jenkins_creds (credential API dump + Groovy Script Console extraction with password/SSH key/secret decryption)
  • Pipeline injection: pipeline_inject (GitHub Actions / GitLab CI workflow file injection with env exfiltration to callback URL)
  • Cleanup: cleanup_ci (GitHub/GitLab bra...

v1.1.14

CyberStrike v1.1.14

The biggest release since HackBrowser shipped. v1.1.14 brings a methodology engine, smarter orchestration, massive provider expansion, and a wave of stability fixes that make autonomous pentesting more reliable than ever.

---

Methodology Engine

CyberStrike now ships with a built-in methodology engine. Instead of blindly scanning, agents follow structured attack methodologies — prioritizing high-impact vectors, tracking coverage, and avoiding redundant work.

• /methodology dialog in TUI to inspect current methodology state
• Sidebar digest showing real-time methodology progress
• Intelligent orchestrator delegation based on methodology context

Smarter Agent Orchestration

The orchestrator got a major upgrade. It now delegates tasks to specialized sub-agents with full context awareness — understanding what's been tested, what failed, and what to prioritize next.

• 20 agent bug fixes in a single pass — context handling, prompt formatting, tool routing
• Cumulative token usage tracking across main agent + all sub-agents displayed in TUI
• Sub-agent prompt payloads capped to prevent context overflow

AI Provider & Model Support — 144 Providers, 800+ Models

This release brings official support for Anthropic and DeepSeek's latest models, along with a full upstream provider/model sync that dramatically expands what you can run CyberStrike with.

New Official Support

• Anthropic Claude — Pro/Max subscription support via OAuth (use your included API quota directly)
• DeepSeek V4 — Pro and Flash variants with thinking mode and reasoning effort control
• OpenAI GPT-5 — reasoning summary support for non-chat models
• GitHub Copilot — Enterprise support with responses API routing
• Local LLMs — Ollama, LM Studio with CLI management and UI improvements

Upstream Provider Sync

Full sync with the latest upstream provider registry — CyberStrike now supports 144 providers including:

• Major: Anthropic, OpenAI, Google (Gemini/Vertex), Azure, Amazon Bedrock, Mistral, Cohere, xAI (Grok)
• Performance: Groq, Cerebras, Fireworks AI, Together AI, DeepInfra
• Routing: OpenRouter, Requesty, Helicone, Vercel AI
• Chinese providers: DeepSeek, Alibaba (Qwen), Tencent, Zhipu AI, Kimi, Minimax, Baichuan, SiliconFlow, StepFun
• Cloud: Cloudflare Workers AI, DigitalOcean, Scaleway, OVHCloud, Vultr, Databricks, Snowflake Cortex
• New additions: Venice, Nova, Poolside, Trinity, GitLab AI Gateway, SAP AI Core, and 50+ more

CIS Benchmark Skills — 700+ New Controls

Massive expansion of compliance automation:

• Kubernetes v1.11.1, v1.12.0, v2.0.0
• Docker v1.7.0, v1.8.0
• Apache HTTP Server 2.2 (v3.6.0) and 2.4 (v2.3.0)
• Apache Cassandra 3.11, 4.0, 4.1, 5.0
• Apache Tomcat 10.1
• Ubuntu 18.04, 20.04
• Azure Foundations v5.0.0, Compute v2.0.0, Database v2.0.0, Storage v1.0.0
• Google Cloud Platform Foundation v4.0.0, Container-Optimized OS v1.2.0, Workspace v1.3.0
• MITRE ATT&CK upgraded with Atomic Red Team mappings

All benchmarks reorganized into Cloud_Providers/ and Server_Software/ taxonomy.

HackBrowser Improvements

• Auth failures now surface immediately instead of producing silent empty crawls
• Subscription parity between worker and main process
• Multi-credential headless mode fixes
• Playwright version pinned exactly in postinstall (no more caret-range drift)

Performance & Stability

• Agent init: cold-start eliminated with lightweight directory scan
• First message: 20s → <1s via lazy skill loading
• Log growth: 11GB/3min → <100MB (permission evaluate moved to DEBUG)
• Test suite: 64 pre-existing failures resolved
• Session context: tool-error strings truncated before storage
• Permission system: DeniedError messages capped instead of serializing full ruleset

False Positive Reduction

• Vulnerability deduplication by endpoint + attack vector
• Prompt hardening to block 403/public-endpoint false positives
• Session context integration for smarter assessment

---

Install / Upgrade

bunx @cyberstrike-io/cyberstrike@latest

---

v1.1.13

False Positive Reduction

• Vulnerability deduplication by endpoint + attack vector (eliminates duplicate findings)
• Prompt hardening to block 403/public-endpoint false positives
• Session context integration for smarter vulnerability assessment

Vulnerability Management

• Added endpoint and attack_vector fields to vulnerability tracking
• New tools: web-get-vulnerabilities and web-get-vuln-detail
• Unit tests for dedup, tools, and session context

TUI Improvements

• Copy button in vulnerability detail panel header
• Text selection enabled in vulnerability detail panel

Documentation

• Added HackBrowser section to README
• Expanded proxy tester documentation

v1.1.12

Hackbrowser — Integrated Browser Security Testing

• Autonomous browser-based vulnerability scanner with Playwright integration
• Multi-credential support with manual-login and automated modes
• Live telemetry panel injected into target pages
• Intelligence Layer: priority scoring, journey awareness, out-of-scope filtering
• TUI integration: launch dialog, sidebar status, LLM cost tracking
• /hackbrowser slash command for quick launch
• Headless mode support
• Stop mechanism (/hackbrowser-stop)
• Hackbrowser subprocess isolation from main binary

Performance Improvements

• Agent initialization: 4.3s → ~500ms (lightweight directory scan with Skill.dirsOnly())
• First message response: 19.9s → <1s (lazy skill loading in SkillTool)
• Log file growth: 11GB/3min → <100MB (permission evaluate at DEBUG level + filtered invalid rules)
• Startup warnings: 15,214 duplicate skill warnings silenced (moved to DEBUG)
• Skill permission checks: Eliminated repeated permission checks and index rebuilds

Agent Prompt Improvements

• Reworked agent prompts for web-application, cloud-security, internal-network, and mobile-application testers
• Statically injected WSTG skills into vulnerability tester agents
• Orchestrator web-proxy-agent prompt improvements

Ingest & Normalization Pipeline

• 4-tier URL path normalization pipeline
• Ingest queue with pause/resume support (/qpause, /qresume)
• Strict ingest isolation (Katman 3 hardening)
• Ingest context management with excludeHistory and IngestSummary

Bug Fixes

• Fixed undefined permission rule errors causing TypeError
• Fixed TypeScript agent type mismatch in SkillTool execute context
• Fixed Prettier breaking skill signatures (added .cyberstrike/skill/** to .prettierignore)
• Fixed massive log spam in permission evaluate
• Fixed Playwright external build + npm dependency issues
• Fixed hackbrowser dialog launch bug

v1.1.11

Bug Fixes

• Fixed skill loading performance - eliminated 4.3s cold-start delay
• Fixed first message response time (19.9s → <1s with lazy loading)
• Fixed permission log spam creating 11GB log files
• Fixed duplicate skill warnings (15,214 → DEBUG level)
• Fixed undefined permission rule errors
• Fixed TypeScript agent type errors in skill tool
• Protected SKILL.md files from Prettier formatting (added to .prettierignore)

Performance Improvements

• Agent initialization: 4.3s → ~500ms (lightweight directory scan)
• First message: 19.9s → <1s (lazy skill loading)
• Log files: 11GB/3min → <100MB (debug level + filtered logs)
• Startup: Silenced 15,214 duplicate skill warnings

Technical Details

All performance and bug fixes committed in this release.

v1.1.10

🎯 Major Release: Skills System

Added

Skills System (7,300+ Security Skills)

• MITRE ATT&CK Integration: 691 enterprise techniques with Atomic Red Team tests
  • 332 techniques now include 2,000+ copy-paste ready test commands
  • Coverage: Credential Access, Defense Evasion, Discovery, Execution, Persistence, etc.
  • Example: T1558.003 Kerberoasting (7 Atomic tests), T1003.001 LSASS Memory (5 tests)
• CIS Benchmarks: 1,500+ hardening and compliance checks
  • Cloud Providers: AWS, Azure, GCP, Google Workspace
  • Server Software: Apache HTTP Server 2.2/2.4, Apache Cassandra 3.11/4.0/4.1/5.0, Apache Tomcat 7/8/9/10
  • Container/Orchestration: Docker v1.6/1.7/1.8, Kubernetes
  • Operating Systems: Ubuntu 18.04 LTS, Ubuntu 20.04 LTS
• OWASP WSTG: 125 web application security testing skills
• NIST: Security controls and frameworks
• Lazy Loading: Skills loaded on-demand, zero context pollution

Skill Search & Discovery

• Relevance-based scoring algorithm
• Pagination with feedback
• Search by: keyword, tech_stack, CWE ID, category, tags
• 7,633 skills indexed in-memory

Cloud Security Agent

• CIS skill recommendations integration
• Automated compliance checks

Install

bunx @cyberstrike-io/cyberstrike

npm: https://www.npmjs.com/package/@cyberstrike-io/cyberstrike
Full Changelog: https://github.com/CyberStrikeus/CyberStrike/blob/main/packages/cyberstrike/CHANGELOG.md

v1.1.9

CyberStrike v1.1.9

What's New

Web UI & Remote Access

CyberStrike now ships with a full Web UI accessible from your browser. Run pentests from any device — laptop, tablet, or remote workstation.

• cyberstrike web — Launches CyberStrike with built-in Web UI on localhost:4096
• cyberstrike serve — Headless server mode for remote access via Cloudflare Tunnel
• app.cyberstrike.io — Connect to any CyberStrike instance using the hosted Hub UI. Enter your CF tunnel URL and password to connect from anywhere.
• Hub Connect Screen — First-time users on app.cyberstrike.io see a connect screen to choose localhost or enter a remote tunnel URL
• Password Auth — Set CYBERSTRIKE_SERVER_PASSWORD for remote access. Unicode-safe Basic auth with automatic loopback bypass for local use.

Bolt Tool Discovery in MCP Tab

Bolt security servers now surface their individual tools and MCP servers in CyberStrike's MCP tab:

• Plugin tools (subfinder, nmap, nuclei, etc.) each appear as separate entries with tool counts
• User-configured MCP servers (dnsx, sqlmap, katana, etc.) added via bolt.config.json are also visible
• Each Bolt-sourced tool shows a "bolt" badge identifying the source server

Built-in Security MCP Servers

CyberStrike ships with 3 pre-configured MCP servers for immediate offensive security capability:

• osint (37 tools) — OSINT reconnaissance and intelligence gathering
• cve (23 tools) — CVE/NVD/EPSS/KEV/GHSA/OSV vulnerability intelligence
• github-security (39 tools) — GitHub security scanning with 45 checks

Other Improvements

• CORS and auth fixes for CF tunnel remote access
• Retry provider API calls on 5xx server errors
• Bump minimatch and dompurify for security patches
• MCP/Bolt config persisted to global scope
• Web UI bundled in npm package, auto-installed to ~/.cyberstrike/web/

Install / Upgrade

# Install
curl -fsSL https://bolt.cyberstrike.io/install.sh | bash

# Or via npm
npm install -g @cyberstrike-io/cyberstrike

# Upgrade existing
cyberstrike upgrade

Full Changelog

v1.1.5...v1.1.9

v1.1.5

CyberStrike v1.1.5

Changes

Improvements

• Theme hot-reload support
• Select first item automatically when filtering lists

Bug Fixes

• Clear palette cache on theme change
• Encode non-ASCII directory paths in HTTP headers

Install

curl -fsSL https://bolt.cyberstrike.io/install.sh | bash

Full Changelog: v1.1.4...v1.1.5

v1.1.4

CyberStrike v1.1.4

Changes

Improvements

• Auto-fallback to available port when default port (4096) is busy
• Add --beta flag to install script for beta channel installs

Bug Fixes

• Update @opentui/core and @opentui/solid to 0.1.88
• Fix scoped package names in uninstall script
• Correct npm install commands and domain references on website

Install

curl -fsSL https://bolt.cyberstrike.io/install.sh | bash

Full Changelog: v1.1.3...v1.1.4