mirror of
https://github.com/BaaRai/ARTEX.git
synced 2026-11-13 11:40:53 +08:00
BaaRai
4c62b57bcc
Toolbox layer pins bbot v3.0.2 (AGPL-3.0, same license as ARTEX; standalone CLI dependency, not linked code) in its own venv with module dependencies preinstalled via --install-all-deps, so scans never need pip under a program egress allowlist. Build-time gate dry-runs a dep-heavy module sample twice: the first primes the dependency check, the second must be free of Installing and ERRR lines or the build fails. The bbot-recon skill gates usage on program policy: passive zero-touch mode via seeds-only scans (-s, no -t) when scanners are banned, active-safe and loud module sets when the program allows them, scope discipline with blacklist and strict-scope, --no-deps mandatory on every run, JSONL ingestion into facts and finding candidates with bbot findings treated as leads that still need independent verification. Closes #117