Skip to content

Releases: projectachilles/ProjectAchilles

Release list

ProjectAchilles v2.0.0

ProjectAchilles v2.0.0 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Apr 20:25
v2.0.0
5424204

Complete platform overhaul — custom agent system, multi-deployment support, Microsoft Defender integration, and release automation.

Added

Agent System

  • Custom Go agent (agent/) with enrollment, heartbeat, task execution, and self-updating
  • Token-based enrollment with configurable TTL and max uses
  • Heartbeat monitoring with real-time system metrics (CPU, memory, disk, uptime)
  • Task queue with priority-based assignment and state machine (pending → assigned → downloading → executing → completed)
  • SHA256 binary verification before execution
  • Stdout/stderr capture with 1MB limit per execution
  • Agent tagging system for filtering and bulk operations
  • Agent admin dashboard with search, filtering, and status indicators
  • Agent soft-delete and status management (active/inactive)
  • Silent auto-polling on Agents and Tasks pages
  • Self-update mechanism — agents poll for new versions and auto-apply
  • System service installation (systemd on Linux, SCM on Windows)
  • Cross-platform support: Windows/Linux × amd64/arm64
  • Agent API key authentication middleware (separate from Clerk)
  • Public binary download endpoint with rate limiting (10 req/15min)
  • macOS support (darwin/amd64, darwin/arm64) with launchd service and ad-hoc code signing via rcodesign
  • Remote uninstall with two-phase cleanup (stop service + remove files)
  • Enhanced --status diagnostics: service state, connection health, config validation
  • Async task execution with Windows Job Objects for orphan process cleanup
  • Azure/Entra ID credential flow for identity-tenant tests
  • Bundle results fan-out for cyber-hygiene and intel-driven multi-stage controls

Build System

  • On-demand Go cross-compilation from the UI
  • Target platform selection (Linux/Windows × amd64/arm64)
  • Windows Authenticode code signing via osslsigncode
  • Multi-certificate management — upload PFX/P12 or generate self-signed (up to 5)
  • Active certificate tracking with label editing
  • Embed dependency detection (//go:embed directive scanning)
  • Embed file upload for tests that embed resources
  • Build caching in ~/.projectachilles/builds/
  • Build metadata tracking (platform, filename, signed status, file size, timestamp)
  • Certificate storage in ~/.projectachilles/certs/cert-<timestamp>/ subdirectories
  • Legacy flat-file certificate migration on first listCertificates() call

Task Scheduling

  • Recurring test execution schedules (once, daily, weekly, monthly)
  • Timezone-aware scheduling with DST handling
  • Randomized execution time option (office hours weekdays, anytime weekends)
  • Per-task Elasticsearch index targeting for result isolation
  • Task notes with version tracking and edit history
  • Copy-to-clipboard for stdout/stderr in task detail view
  • Schedule pause/resume and soft-delete
  • Background scheduler processing with automatic next-run calculation

Analytics

  • 30+ analytics query endpoints covering defense scoring, coverage, and error analysis
  • Defense score trend with rolling-window aggregation (1–90 day windows)
  • Defense score breakdowns by test, technique, category, hostname, severity, and organization
  • Host-test matrix endpoint for heatmap visualization
  • Threat actor coverage metrics
  • Error rate trend analysis with stacked area chart
  • Canonical error code mapping and redesigned error type chart
  • Three-state result classification (Protected / Unprotected / Inconclusive)
  • Paginated execution results with advanced multi-field filtering
  • Available-values catalog endpoints (tests, techniques, hostnames, categories, severities, threat actors, tags, error names, error codes)
  • Multi-index management — list indices, create indices, set active index pattern
  • Canonical test count with rolling 90-day window for stable coverage denominators
  • Nested donut chart for category/subcategory breakdown
  • Clickable hosts in "Others" aggregation with drill-down
  • Forward-fill (LOCF) for defense score trend gaps
  • Environment variable support for Elasticsearch configuration
  • User-configured settings take priority over environment variables
  • Auto-test connection on save for immediate UX feedback
  • Fire-and-forget result ingestion — agent results auto-ingest to ES asynchronously
  • Microsoft Defender integration — Secure Score, Alerts v2, Control Profiles via Graph API
  • 9 Defender analytics endpoints (secure-score, alerts, controls, cross-correlation)
  • Test-alert detection correlation between F0RTIKA results and Defender alerts
  • Dual Defense Score display with real score trend line overlay
  • Risk acceptance for individual security controls
  • Archive executions feature
  • Shared FilterBar across Analytics Dashboard tabs

Alerting & Notifications

  • Threshold-based trend alerting with configurable score drop/absolute thresholds
  • Slack alerting via Block Kit formatted messages
  • Email alerting via Nodemailer with HTML templates
  • Alert settings UI with Slack webhook and SMTP configuration
  • NotificationBell component with alert dropdown in top bar
  • Alert dispatch hooked into result ingestion pipeline

Browser

  • Git-synced test library with automatic repository sync
  • Favorites and recent views with localStorage persistence
  • Version, author, and Git modification dates on test cards
  • Copy-to-clipboard for detection rules and test artifacts
  • Build, sign, and download test binaries from test detail pages
  • Searchable test selector in task creation dialog
  • MITRE ATT&CK coverage matrix with visual technique heatmap
  • Browse overview dashboard with 3-tab layout (overview, matrix, list)
  • Execution drawer for running tests directly from browse page
  • Category legend and metric card subtitles on overview

Docker & Deployment

  • Docker Compose support with multi-service configuration (frontend, backend)
  • Optional Elasticsearch profile (--profile elasticsearch)
  • Elasticsearch seeding service with 1000 synthetic results
  • Interactive setup wizard (setup.sh) with TUI (whiptail/dialog)
  • Non-interactive setup mode for automation
  • ngrok tunnel support with configurable domains
  • ENCRYPTION_SECRET for stable encryption across container restarts
  • Health checks for backend and Elasticsearch services
  • Go toolchain and osslsigncode in Docker image for builds
  • Fly.io deployment with custom domains, volumes, and documentation
  • Render.com deployment with Blueprint and persistent disk
  • Railway deployment with private networking and AGENT_REPO_URL git sync
  • Vercel serverless deployment with Turso, Vercel Blob, and Crons
  • Backend-serverless (backend-serverless/) — independent fork for Vercel
  • Pure-JS certificate generation via node-forge for serverless environments
  • Client-side Blob upload for large binaries on Vercel
  • Upload pre-built binary support for all deployment targets

Frontend

  • Collapsible sidebar layout
  • Dark/light theme improvements with consistent text colors
  • Responsive design updates across all modules
  • Endpoints dashboard redesign with donut charts, task activity, and version metrics
  • Fullscreen expand dialog for task output
  • Collapsible Scheduled Tasks section on Tasks page
  • Rich test info modal in Executions detail panel

Visual Themes

  • Neobrutalism visual theme with hot pink/magenta accent
  • Hacker Terminal visual theme with phosphor scanline effects
  • Green/amber phosphor variant toggle for Hacker Terminal
  • Theme selector in settings

Authentication

  • Clerk authentication with social login (Google, Microsoft, GitHub)
  • RequireAuth component for route protection
  • useAuthenticatedApi hook for automatic JWT injection
  • Session isolation per authenticated user
  • Rate limiting on authentication endpoints (20 req/15min)

Release Management

  • Semi-automated release flow with Claude Code /release command
  • GitHub Actions release workflows for platform and agent binary releases
  • Conventional commit validation hooks
  • CHANGELOG generation from commits via /changelog command
  • Pre-push tag consistency validation

Changed

  • BREAKING: Removed LimaCharlie integration — replaced by custom agent system
  • BREAKING: All routes now require Clerk authentication (Browser was previously public)
  • BREAKING: Endpoints module replaced by Agents module
  • Replaced stacked bar charts with horizontal single-bar layout for clarity
  • Replaced dashboard widgets with simpler alternatives
  • Migrated charts to consistent UI patterns
  • Redistributed analytics filters — date range in tab bar, filter panel in table toolbar
  • ASCII banner updated from "PROJECT" to "ACHILLES"
  • Start script supports --daemon mode for background operation and -k flag for killing existing processes

Fixed

  • SQLite UTC timestamp parsing in timeAgo display
  • Docker env file no longer overrides AGENT_SERVER_URL from env_file
  • Agent build copies source to temp directory for read-only Docker mounts
  • Elasticsearch field mapping queries for enriched fields
  • Index pattern selection persistence across sessions
  • Stacked bar charts showing all data series correctly
  • Analytics setup redirect loop
  • Tab parameter preservation when syncing filter URL params
  • Non-conclusive results excluded from defense score calculations
  • Dashboard data refresh when credentials or index pattern change
  • Non-test data filtered from analytics queries
  • LOCF threshold logic for sparse trend data
  • Synthetic data generator error code distribution
  • Local Docker ES support with no-auth and correct field mappings
  • Elasticsearch Python client pinned to v8 for ES 8.17 compatibility
  • Setup script guarded && conditionals against set -e
  • Setup wizard plain-text newline rendering
  • Delete filter alignment in agent management
  • Windows SCM handshake in agent service installation
  • Agent version reporting
  • Task creator dialog effect stabilization and checkbox visibility
  • Tag API route alignment between frontend and backend
  • Stale task detection — tasks auto-fail when agent goes offline during execution
  • Group-aware pagination for Executions...
Read more
Assets 2
Loading

Achilles Agent 0.6.0

Achilles Agent 0.6.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Apr 20:36
agent-v0.6.0
5d97ce4

Installation

Download the binary for your platform and enroll:

# Linux
chmod +x achilles-agent-linux-amd64
sudo ./achilles-agent-linux-amd64 --enroll TOKEN --server https://your-server.example.com --install

# macOS (Apple Silicon)
chmod +x achilles-agent-darwin-arm64
sudo ./achilles-agent-darwin-arm64 --enroll TOKEN --server https://your-server.example.com --install

# Windows (PowerShell as Administrator)
.\achilles-agent-windows-amd64.exe --enroll TOKEN --server https://your-server.example.com --install

Verify checksums

sha256sum -c SHA256SUMS

First tagged release of the Achilles Agent binary.

Added

  • Custom Go agent with enrollment, heartbeat, task execution, and self-updating
  • Cross-platform support: Windows (amd64), Linux (amd64), macOS (amd64 + arm64)
  • System service installation (systemd on Linux, SCM on Windows, launchd on macOS)
  • Token-based enrollment with configurable TTL and max uses
  • Heartbeat monitoring with real-time system metrics (CPU, memory, disk, uptime)
  • Task queue with priority-based execution and state machine
  • SHA256 binary verification before execution
  • Self-update mechanism — agents poll for new versions and auto-apply
  • Remote uninstall with two-phase cleanup (stop service + remove files)
  • Enhanced --status diagnostics: service state, connection health, config validation
  • Async task execution with Windows Job Objects for orphan process cleanup
  • Azure/Entra ID credential flow for identity-tenant tests
  • Bundle results fan-out for cyber-hygiene and intel-driven multi-stage controls
  • Ad-hoc code signing for macOS via rcodesign
Loading