Metadata-Version: 2.4
Name: navig-devnet
Version: 0.5.0
Summary: Developer/ops network inspection: DNS/WHOIS/SSL lookups and an SSRF-guarded HTTP repeater — its own navig-devnet command, and `navig devnet` inside navig.
Author-email: NAVIG Development Team <opensource@navig.run>
License-Expression: Apache-2.0
Project-URL: Homepage, https://navig.run
Project-URL: Documentation, https://navig.run/docs
Keywords: navig,cli,agent,network,dns,whois,ssl,devops,plugin
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Utilities
Classifier: Topic :: System :: Networking
Requires-Python: >=3.10
Description-Content-Type: text/markdown
Requires-Dist: navig-sdk>=2.7.0
Requires-Dist: typer>=0.14.0
Requires-Dist: rich>=13.7.0
Requires-Dist: dnspython>=2.6.0
Requires-Dist: httpx>=0.27

# navig-devnet

<!-- navig:plugin-card:start -->
<!-- Generated by scripts/gen_plugin_catalog.py — edit the plugin's pyproject.toml, not this block. -->

> Developer/ops network inspection: DNS/WHOIS/SSL lookups and an SSRF-guarded HTTP repeater — its own navig-devnet command, and `navig devnet` inside navig.

**Works on its own** — its own CLI, no navig required · v0.5.0 · not on PyPI yet (install from source below)

**On its own** (no navig needed)

```bash
pip install "git+https://github.com/navig-run/plugins#subdirectory=navig-devnet"
navig-devnet --help   # no navig needed
```

**With navig**

```bash
pip install "git+https://github.com/navig-run/plugins#subdirectory=navig-devnet"
navig devnet --help
```

<details><summary>Commands</summary>

| Command | What it does |
|---|---|
| `navig devnet api` | Discover and parse an OpenAPI/Swagger spec; list its endpoints. |
| `navig devnet crawl` | Map a site: a polite, same-origin, robots-respecting read-only crawl. |
| `navig devnet diff` | Compare two recorded responses (status, headers, body). |
| `navig devnet dns` | Resolve DNS records (MX/TXT/NS/… with dnspython; A/AAAA always). |
| `navig devnet history` | List recent repeater requests in this space. |
| `navig devnet http` | Send an HTTP request and read the full response (the repeater). |
| `navig devnet ssl` | Read a server's TLS certificate (issuer, validity, SANs, days left). |
| `navig devnet whois` | WHOIS registration record (bare-TCP; no system whois binary needed). |

</details>

<!-- navig:plugin-card:end -->

Developer/ops **network inspection** for [NAVIG](https://navig.run) — the first
slice of the DevNet Lab. Runs standalone (`navig-devnet`) or inside navig
(`navig devnet`), and the agent can call the same lookups.

## What's here

**Lookups (read-only):**

| Command | Agent tool | What it does |
|---|---|---|
| `navig devnet dns <domain> [--type MX] [--resolver 1.1.1.1]` | `net_dns` | Resolve DNS records (A/AAAA always; MX/TXT/NS/CNAME/SOA/CAA/PTR/SRV with dnspython) |
| `navig devnet ssl <host> [--port 443]` | `net_ssl` | Read a server's TLS certificate: issuer, validity, days-left, SANs |
| `navig devnet whois <domain>` | `net_whois` | WHOIS record (bare-TCP; no system whois binary needed) |

The lookups resolve names and read a server's own certificate — nothing sends a
payload or mutates a target.

**HTTP repeater:**

| Command | Agent tool | What it does |
|---|---|---|
| `navig devnet http <METHOD> <url> [-H "K: V"] [-d body] [--no-redirect]` | `net_http` | Send/edit/resend a request; read status, headers, timing, body |
| `navig devnet history [-n 20]` | — | Recent requests in this space |
| `navig devnet diff <#> <#>` | — | Compare two recorded responses |

The repeater is **SSRF-guarded** (shared with navig via navig-sdk): the initial
URL and every redirect hop are re-validated, so a 302 to a private/metadata
address is blocked, not followed. Private/internal targets need `--allow-private`
(or `net.ssrf.allow_private_network`). The `net_http` agent tool is classified
**dangerous** — the agent asks before sending on your behalf. Add `--json` to any
command for machine-readable output.

**Crawl & API discovery (read-only):**

| Command | Agent tool | What it does |
|---|---|---|
| `navig devnet crawl <url> [--pages 25] [--depth 2] [--off-origin] [--ignore-robots]` | `net_crawl` | Map a site: a polite same-origin, robots-respecting GET crawl → pages with status, title and links |
| `navig devnet api <url>` | `net_api_discover` | Find and parse an OpenAPI/Swagger spec (well-known locations) → title, servers, endpoints |

Both are **read-only** (GET-only) and **SSRF-guarded** like the repeater — private/
internal targets need `--allow-private`. The crawl honours `robots.txt` by default,
stays on the start URL's origin, and caps pages/depth so it maps a service rather
than hammering it. `net_crawl`/`net_api_discover` are **safe** agent tools (no
payload, no mutation).

## Per-space activation

`devnet` is a toggleable module. A workspace scopes it through its `space.json`:

```json
{ "modules_disabled": ["devnet"] }   // off in this space: no CLI verb, no agent tools
{ "modules_enabled":  ["devnet"] }   // force on in this space
```

The toggle governs the `devnet` CLI verb, the `devnet` agent toolset, and (later)
the DevNet Lab tile together — not just a sidebar view.

## Roadmap

HTTP repeater, browser traffic inspection (headers/bodies + a DevNet Lab OS
tile), crawl/API-discovery, and — owner-approved and authorization-gated —
active scanning and an intercepting proxy (DANGEROUS + owner-only, per the
engagement authorization record). See the project plan.

## Install

```bash
pip install navig-devnet          # standalone
# or, with navig:
pip install "navig[devnet]"
```
