feat(dashboard): local web Hunt Dashboard (/dashboard)

[shivsin25]

What & why

A hunt's state is scattered across memory/leads/<target>.jsonl, recon/, findings/, reports/, screenshot gallery.html files, and hunt-memory/*.jsonl. Nothing shows it all at once, so stale high-priority leads rot (Critical Rule 6) and the memory flywheel stays invisible (TODO-6). This adds one live web view over all of it.

Naming note: this is distinct from tools/dashboard.py (the in-terminal ANSI progress TUI). This is the persistent web view of accumulated hunt state, named hunt_dashboard.py to avoid any collision. The existing TUI is untouched.

What it adds

• tools/hunt_dashboard.py — pure-stdlib (zero new deps, same tech as demo/app.py):
  • serve — live local server (/, /api/state JSON, safe /file viewer), auto-refresh.
  • export — a single self-contained HTML snapshot (shareable as report evidence).
  • collect_state() / render_dashboard() are pure given a root dir, so they're unit-tested without a running server.
• Views: stat tiles - lead board (untouched-first, stale HIGH-priority alert) - recon surface - findings/reports - screenshot galleries - memory flywheel.
• /dashboard slash command + CLAUDE.md command-table and tools-list entries.

Security

• Binds to 127.0.0.1 only.
• Every recon-derived value is HTML-escaped — recon data is attacker-controlled, so the dashboard can't become a stored-XSS sink.
• /file is path-traversal guarded (resolves under repo root only) and extension-allowlisted.

Tests

• 16 tests in tests/test_hunt_dashboard.py — collection, rendering, XSS-escaping, live/static modes, traversal guard, CLI export. All green.
• Additive only: 4 files changed, 824 insertions(+), nothing deleted; the existing TUI and its tests are byte-untouched.

Try it

python tools/hunt_dashboard.py serve      # http://127.0.0.1:8777
python tools/hunt_dashboard.py export -o dashboard.html

[shuvonsec]

Nice work - clean zero-dep stdlib dashboard, and safe_path (realpath + commonpath + extension allowlist) is solid. Verified 16 tests pass. Two security asks before merge, one minor:

1. (security) /file serves allow-listed .html raw as text/html. Any .html under root (a recon/PoC-captured HTTP response saved as .html) then runs as live JS in the dashboard's own origin, which also exposes /api/state + /file same-origin with no auth = data-exfil XSS. Please serve untrusted .html as text/plain (or escape it), not passthrough.
2. (security) serve accepts --host 0.0.0.0 and does no Host-header check, so the unauthenticated server can be exposed / hit via DNS-rebinding from a malicious page. Add a loopback Host-header allowlist and warn loudly when --host is non-loopback.
3. (minor) collect_recon(root) runs 3x per page load (once for state, twice in the totals set-expr). Compute once and reuse.

[shivsin25]

Thanks for the sharp review, @shuvonsec — both security points are spot on. Fixed in 33dce87:

1. /file HTML → data-exfil XSS. You're right: a recon/PoC-captured response saved as .html would run as live JS in our own origin (with /api/state + /file same-origin, no auth). /file now serves all .html as text/plain with X-Content-Type-Options: nosniff — no passthrough, captured HTML is inert and can't parse/execute. Added a live test that saves a hostile <script>fetch('/api/state')…exfil</script> as .html and asserts it comes back text/plain + nosniff, never as HTML.

2. DNS-rebinding via --host 0.0.0.0 + no Host check. Added a Host-header allow-list (loopback + the bind host + any --allow-host); every request with a foreign Host gets a 403 before any local state is read — so a page that rebinds its domain to 127.0.0.1 still sends Host: evil.example and is rejected. Binding to a non-loopback --host now prints a loud warning that the unauthenticated dashboard is being network-exposed, and tells you which Host values are accepted. Tests cover loopback-accept / foreign-reject (incl. a live Host: evil.example → 403).

3. collect_recon 3×. Good catch — now computed once in collect_state and reused for both recon and the totals.

21 tests pass. Ready for another look