Finding — D2: exploit mode half-wired (P4 Pertinence)

The selection prompt offers exploit, and the full mode exists
(MODES["exploit"], SYSTEM_EXPLOIT, get_system_prompt branch,
modes/_selection.txt classifies attack/chat/exploit), but detection
threw the classification away and the opt help omitted it.

Root cause

• secator/tasks/ai.py:764 (pre-change) — _detect_mode accepted only
  ("attack", "chat") from the intent LLM; an exploit verdict hit the
  else and reverted to old_mode or "chat". Since D4's fast_detect_mode
  already defers exploit-ish prompts to the LLM, the LLM could return
  exploit — it was just discarded here.
• secator/tasks/ai.py:74 — mode opt help hardcoded "Mode: attack or chat".

Changes

• _detect_mode: accept any mode in MODES (adds exploit; attack/chat
  behavior identical). secator/tasks/ai.py:764
• mode opt help derived from MODES.keys() — single source of truth, no
  drift (f"Mode: {', '.join(MODES)}"). secator/tasks/ai.py:74
• Imported MODES into the task module (DRY; no third hardcoded mode tuple).

No change to the exploit SAFETY posture — exploit still runs through the same
PermissionEngine/guardrails; only detection + docs changed.

Exploit prompt is real

secator/ai/prompts/modes/exploit.txt is a full 43-line template (persona =
"exploitation verification specialist", methodology, add_finding
exploitation-report flow, ${guardrails}/${isolation} constraints).
get_system_prompt("exploit", ...) renders with no leftover ${include} or
$template_var placeholders (D1's $query_types/$output_types_reference
substitution covers exploit too).

Tests

Added focused tests (tests/unit/test_ai_task_opts.py,
tests/unit/test_ai_prompts.py):

• LLM _detect_mode verdict of exploit now sets self.mode == "exploit"
  (previously fell back to chat).
• attack / chat / unknown verdicts unchanged (unknown → chat fallback).
• get_system_prompt("exploit") renders clean (no unresolved placeholders).
• mode opt help lists every mode incl. exploit.

Baseline vs after (test_ai_loop.py test_ai_session.py test_ai_prompts.py):
baseline 12 failed / 85 passed → after 12 failed / 86 passed. The 12
failures are identical pre-existing env failures (shfmt/safecmd sandbox), not
regressions; the +1 pass is the new exploit-render test.

Related smells (not fixed here)

• secator/ai/prompts.py:248 — if mode in ("attack", "exploit"): hardcodes
  the "uses library reference" set; a new library-using mode would need a
  manual edit. Candidate to derive from mode config.
• secator/tasks/ai.py:66 — class docstring still says "(attack or chat
  mode)"; omits exploit.
• secator/ai/prompts/modes/_selection.txt hardcodes the three mode names in
  prose — can drift from MODES if a mode is added/removed.

🤖 Generated with Claude Code