thefound

name	thefound
description	Master entry point for the full crypto recon pipeline. Handles URLs (web) and APK files (.apk/.apkm/.xapk). Drives the entire pipeline automatically from goal to working Python code — no intermediate stops.

thefound — Autonomous Pipeline Entry Point

Core Principle

Run everything automatically. User states a goal, pipeline drives itself to completion. No asking "which finding do you want?" mid-way. No waiting for permission between phases. Stop only when the user's stated goal is fully achieved.

Input Detection — Route Immediately

User gives URL  → invoke crypto-recon-orchestrator (full web pipeline)
User gives .apk / .apkm / .xapk file → invoke crypto-recon-apk (full APK pipeline)
User gives .har file → invoke crypto-recon-har first, then crypto-recon-building
No input → ask ONCE: "Berikan URL atau path APK file"

Do NOT ask for clarification if input is clear. Route immediately.

What "Done" Means

The pipeline is complete when:

1. All specialists have finished scanning
2. Final report is written: output/[target]/final/[target].md
3. The user's stated goal artifact exists:
   • "cari signing / encryption / crypto" → reconstruct_*.py with Python signing function
   • "bikin script" / "flow lengkap" → flow_*.py with complete API flow
   • "cari aja" / "analisis" → report is sufficient, offer next steps

Pipeline Map

/thefound <target>
         │
         ├─ URL ──────────────────────────────────────────────────────────────────────┐
         │                                                                            │
         │  [auto] crypto-recon-plans    ← understand goal (no blocking questions)   │
         │  [auto] crypto-recon-fetch    ← download all JS/WASM                      │
         │  [auto] crypto-recon-deobf    ← beautify + sourcemap + decode             │
         │  [auto] crypto-recon-detector ← web2 / web3 / hybrid?                    │
         │  [PARALLEL] 10 specialists    ← all run simultaneously                    │
         │  [auto] crypto-recon-report   ← write final report                        │
         │  [auto] crypto-recon-reconstruct ← reconstruct best finding to Python     │
         │  [auto] crypto-recon-building ← build complete flow script if goal says so│
         │                                                                            │
         └─ APK ──────────────────────────────────────────────────────────────────────┘
            [auto] extract base.apk from bundle if needed
            [auto] python tools/apk_decompile.py  ← jadx + apktool (if not cached)
            [PARALLEL] 15 agents: apk-java + 10 crypto specialists + 3 flow mappers
            [auto] crypto-recon-report   ← write final report
            [auto] crypto-recon-reconstruct ← reconstruct signing/crypto to Python
            [auto] crypto-recon-building ← build complete flow script if goal says so

Goal Inference (no asking)

Extract the user's intent from their initial message:

User says	Inferred goal	Auto-proceed to
"cari signing" / "gimana sign"	Find signing → Python function	reconstruct → stop
"reverse crypto" / "cari encryption"	Find all crypto	report → reconstruct best finding
"bikin script login" / "flow lengkap"	Full working script	reconstruct → building → stop
"analisis aja" / just URL/APK	Map all crypto	report → offer options
"debug" / "401 terus"	Fix existing signature	debugging
"pentest" / "cek vuln" / "test RCE/SQLi/IDOR"	Vulnerability testing	pentest (needs flow script first)

After Pipeline Completes

Print one clean summary:

=== DONE ===
Target:  [name]
Report:  output/[name]/final/[name].md
Script:  output/[name]/final/reconstruct_signing.py  (if produced)
Flow:    output/[name]/final/flow_complete.py         (if produced)

Findings: 3 HIGH (signing: HMAC-SHA256, AES-CBC, RSA pubkey)

Next:
  "debug" → verify script against live API
  "flow lengkap" → build full register/login/request flow
  "lihat [ClassName]" → read specific Java class

Do NOT ask "which finding do you want?" — pick automatically based on goal.