v1.4.1 and v1.4.2 were about the AI loop and the Linux packages. v1.5 is about the surfaces an operator actually lives in: chat, the Network Map, Active Directory, cloud, reverse engineering, the tool inventory, and C2 sessions that survive a restart.
Nothing here auto-runs. Collectors, tool commands, and session ops still wait for a human. The change is that the assistant can point at a real host, a real AD node, or a real finding instead of a paragraph you typed.
Chat that can @mention the workspace
The sidebar composer now pulls live workspace references: hosts, AD nodes, cloud assets, findings, and code artifacts. Type @ and pick the object. Clicking a reference in an older message routes back to the originating workspace and focuses that entity.
Screenshots can be dropped or pasted onto a draft. Local OCR (tesseract, via IPC) extracts up to 2,000 words and folds the text into the prompt so a non-vision model can still read a console capture. Attachments stay in encrypted SQLite with the message. Drafts auto-promote on first send, and a 7-day stale-purge sweep runs from Electron startup.
Network Map: subnets, IPv6, AD overlay
Hosts group by /24 with an explicit Internet boundary node. Overlays switch between topology, exposure, attack-path, and trust. Dual-stack addresses render; OS fingerprint and MAC show in the inspector.
BloodHound and SharpHound computer nodes project onto the same map, with risky-edge overlays (admin-to, can-rdp, can-psremote, allowed-to-delegate). Right-click a host to open a terminal with $T already set, or add it to the in-memory scope store so later collection stays inside the engagement.
AD and cloud, one pivot
Live collectors for BloodHound, SharpHound, and ROADrecon ingest into the AD graph. Kerberoast, AS-REP roast, and hash-crack panels sit next to that graph instead of in a separate window. ROADrecon covers Entra ID: tenants, users, groups, service principals, managed identities, devices.
Cloud Architecture accepts five inventory formats (Azure Resource Graph, AWS Resource Explorer, GCP asset export, generic JSON, BloodHound-azure) and builds an AWS, Azure, or GCP asset graph beside the AD graph. Selecting a cloud asset surfaces the best-matching Entra identity. Selecting an AD node can jump the other way. Confirm a high-impact hybrid link before you write it into the report.
RE, tools, and sessions that persist
Reverse engineering now picks among Ghidra, radare2, IDA Pro, and Binary Ninja, with per-engine availability checks. Decompiled functions show up as virtual children under the source binary. Chat can deep-link a file with ?focus=.
The tools workspace inventories 130+ tools with ATT&CK-aware filters and a default “From Path” view so you see what is actually installed. Send-to-terminal pastes the operator command with placeholders intact.
Command-and-control sessions are no longer a UI mock. Desktop session persistence backs the list with full CRUD. Metasploit and Sliver sessions land through parsers; each op button shows the exact POST endpoint and JSON payload before it fires. Escalate, harvest, lateral movement, persistence, and terminate stay explicit.
What this is not
This is not the current download. Linux AppImage, .deb, and .rpm on the download page are still 1.4.2. v1.5 is the unreleased branch: the changelog dump, the new test files, and the workspace work above. When packages cut, they will pick up the normal auto-update feed.