Complete rewrite and re-architecture Osmedeus Engine in v5

test/testdata/workflows/generate-vuln-report.yaml

@@ -0,0 +1,66 @@
+# Vulnerability Report Generator Workflow
+# Generates a formatted security report using the sample template.
+#
+# Usage:
+#   osmedeus run -m generate-vuln-report -t example.com
+#
+# This workflow assumes you have:
+#   1. Run a scan that populated the database with assets/vulnerabilities
+#   2. The sample-report-template.md exists in your Data directory
+#
+# Template location: {{Data}}/templates/sample-report-template.md
+# Output location: {{Output}}/reports/vulnerability-report.md
+
+name: generate-vuln-report
+kind: module
+description: Generate vulnerability report from scan results
+tags: report,vulnerability,markdown
+
+params:
+  - name: target
+    required: true
+    description: Target that was scanned
+
+steps:
+  # Ensure reports and templates directories exist
+  - name: setup-dirs
+    type: bash
+    command: mkdir -p {{Output}}/reports {{Output}}/templates
+
+  # Generate a summary report with just high-severity findings
+  - name: create-high-severity-template
+    type: bash
+    command: |
+      cat > {{Output}}/templates/high-severity-report.md << 'EOF'
+      # High Severity Findings - {{Workspace}}
+
+      **Target**: {{Target}}
+      **Date**: {{TaskDate}}
+
+      ## Critical & High Vulnerabilities
+
+      ```osm-func
+      db_select_vulnerabilities_filtered("{{Workspace}}", "critical", "", "markdown")
+      ```
+
+      ```osm-func
+      db_select_vulnerabilities_filtered("{{Workspace}}", "high", "", "markdown")
+      ```
+
+      ---
+      *Report generated by Osmedeus*
+      EOF
+
+  - name: generate-high-severity-report
+    type: function
+    function: 'render_markdown_report("{{Output}}/templates/high-severity-report.md", "{{Output}}/reports/high-severity-findings.md")'
+
+  # Log completion
+  - name: report-complete
+    type: function
+    function: 'log_info("Report generated at: {{Output}}/reports/high-severity-findings.md")'
+
+  # Show preview
+  - name: preview-report
+    type: bash
+    command: cat {{Output}}/reports/high-severity-findings.md

test/testdata/workflows/nested/nested-module-1.yaml

@@ -0,0 +1,27 @@
+kind: module
+name: nested-module-1
+description: First nested module for testing param and target sharing
+
+params:
+  - name: paramFromFlowFile
+    default: "not-set"
+
+  - name: anotherParam1
+    default: "{{Output}}/another1-{{TargetSpace}}.txt"
+
+
+steps:
+  - name: echo-target-and-param
+    type: bash
+    command: |
+      echo "Module 1: Target={{Target}}" >> {{anotherParam1}}
+      echo "Module 1: paramFromFlowFile={{paramFromFlowFile}}" >> {{anotherParam1}}
+    exports:
+      module1_completed: "true"
+
+  - name: echo-target-and-param
+    type: bash
+    command: |
+      echo "Module 1: Target={{Target}}" >> {{anotherParam1}}
+    exports:
+      module1_with_target: "module1-{{Target}}"

test/testdata/workflows/nested/nested-module-2.yaml

@@ -0,0 +1,32 @@
+kind: module
+name: nested-module-2
+description: Second nested module for testing export propagation and param inheritance
+
+params:
+  - name: paramFromFlowFile
+    default: "not-set"
+
+  - name: anotherParam2
+    default: "{{Output}}/another2-{{Workspace}}.txt"
+
+  - name: anotherParam3as1
+    default: "{{Output}}/another1-{{TargetSpace}}.txt"
+
+
+steps:
+  - name: verify-exports-and-params
+    type: bash
+    command: |
+      echo "Module 2: Target={{Target}}"
+      echo "Module 2: module1_with_target={{module1_with_target}}"
+      echo "Module 2: paramFromFlowFile={{paramFromFlowFile}}"
+      echo "Module 2: module1_completed={{module1_completed}}"
+
+  - name: verify-exports-and-params
+    type: bash
+    pre_condition: 'fileExists("{{anotherParam3as1}}")'
+    command: |
+      echo "Module 2: paramFromFlowFile={{paramFromFlowFile}}"
+      echo "Module 2: module1_completed={{module1_completed}}"
+      echo "Module 2: anotherParam3as1={{anotherParam3as1}}"
+    

test/testdata/workflows/nested/template-foreach-module.yaml

@@ -0,0 +1,48 @@
+kind: module
+name: template-foreach-module
+description: Test template rendering in foreach steps
+
+params:
+  - name: inputFile
+    default: "{{Output}}/items-{{TargetSpace}}.txt"
+  - name: outputDir
+    default: "{{Output}}/processed-{{TargetSpace}}"
+
+steps:
+  # Create test input file
+  - name: create-input
+    type: bash
+    command: |
+      mkdir -p {{outputDir}}
+      echo -e "item1\nitem2\nitem3" > {{inputFile}}
+    exports:
+      input_ready: "true"
+
+  # Foreach with templated input path
+  - name: foreach-with-templates
+    type: foreach
+    pre_condition: 'fileExists("{{inputFile}}")'
+    input: "{{inputFile}}"
+    variable: item
+    threads: 2
+    step:
+      name: process-item
+      type: bash
+      command: |
+        echo "Processing [[item]] for {{Target}}" >> {{outputDir}}/[[item]].txt
+
+  # Verify results
+  - name: verify-foreach
+    type: bash
+    pre_condition: 'fileExists("{{outputDir}}/item1.txt")'
+    command: |
+      echo "=== Foreach Verification ==="
+      echo "Foreach completed for {{Target}}"
+      echo "inputFile={{inputFile}}"
+      echo "outputDir={{outputDir}}"
+      echo "=== Output Directory ==="
+      ls -la {{outputDir}}/
+      echo "=== Item1 Contents ==="
+      cat {{outputDir}}/item1.txt
+    exports:
+      foreach_verified: "true"

test/testdata/workflows/nested/template-parallel-module.yaml

@@ -0,0 +1,51 @@
+kind: module
+name: template-parallel-module
+description: Test template rendering in parallel-steps
+
+params:
+  - name: parallelOutput
+    default: "{{Output}}/parallel-{{TargetSpace}}"
+
+steps:
+  - name: setup-parallel
+    type: bash
+    command: mkdir -p {{parallelOutput}}
+    exports:
+      parallel_dir: "{{parallelOutput}}"
+
+  - name: parallel-steps-with-templates
+    type: parallel-steps
+    parallel_steps:
+      - name: parallel-bash-1
+        type: bash
+        command: 'echo "Bash 1: {{Target}}" > {{parallelOutput}}/bash1.txt'
+        exports:
+          p1_done: "true"
+
+      - name: parallel-bash-2
+        type: bash
+        command: 'echo "Bash 2: {{TargetSpace}}" > {{parallelOutput}}/bash2.txt'
+        exports:
+          p2_done: "true"
+
+      - name: parallel-function
+        type: function
+        function: 'log_info("Parallel function for {{Target}}")'
+        exports:
+          p3_done: "true"
+
+  - name: verify-parallel
+    type: bash
+    pre_condition: 'fileExists("{{parallelOutput}}/bash1.txt")'
+    command: |
+      echo "=== Parallel Steps Verification ==="
+      echo "parallel_dir={{parallel_dir}}"
+      echo "p1_done={{p1_done}}"
+      echo "p2_done={{p2_done}}"
+      echo "p3_done={{p3_done}}"
+      echo "=== Bash1 Contents ==="
+      cat {{parallelOutput}}/bash1.txt
+      echo "=== Bash2 Contents ==="
+      cat {{parallelOutput}}/bash2.txt
+    exports:
+      all_parallel_done: "{{p1_done}}-{{p2_done}}-{{p3_done}}"

test/testdata/workflows/nested/template-rendering-flow.yaml

@@ -0,0 +1,30 @@
+kind: flow
+name: template-rendering-flow
+description: Flow to test template rendering across all step types and fields
+tags: test,template,rendering
+
+params:
+  - name: flowParam
+    default: "flow-{{Target}}"
+
+dependencies:
+  variables:
+    - name: Target
+      type: domain
+      required: true
+
+modules:
+  - name: basic-rendering
+    path: nested/template-rendering-module.yaml
+    params:
+      customPrefix: "{{flowParam}}-custom"
+
+  - name: foreach-rendering
+    path: nested/template-foreach-module.yaml
+    depends_on:
+      - basic-rendering
+
+  - name: parallel-rendering
+    path: nested/template-parallel-module.yaml
+    depends_on:
+      - foreach-rendering

test/testdata/workflows/nested/template-rendering-module.yaml

@@ -0,0 +1,64 @@
+kind: module
+name: template-rendering-module
+description: Test template rendering in all step fields
+
+params:
+  - name: customPath
+    default: "{{Output}}/custom-{{TargetSpace}}.txt"
+  - name: customPrefix
+    default: "prefix-{{Target}}"
+  - name: customTimeout
+    default: "30"
+
+steps:
+  # 1. Bash step with all templated fields
+  - name: bash-with-templates
+    type: bash
+    pre_condition: 'true'
+    command: |
+      echo "Target: {{Target}}" > {{customPath}}
+      echo "Prefix: {{customPrefix}}" >> {{customPath}}
+    log: "Executing bash with target {{Target}}"
+    exports:
+      bash_output_path: "{{customPath}}"
+      bash_target: "{{Target}}"
+
+  # 2. Function step with templated function calls
+  - name: function-with-templates
+    type: function
+    pre_condition: 'fileExists("{{bash_output_path}}")'
+    function: 'log_info("Processing {{Target}} with path {{customPath}}")'
+    exports:
+      function_result: "processed-{{Target}}"
+
+  # 3. Parallel commands with templates
+  - name: parallel-with-templates
+    type: bash
+    parallel_commands:
+      - 'echo "Parallel 1: {{Target}}" >> {{customPath}}'
+      - 'echo "Parallel 2: {{customPrefix}}" >> {{customPath}}'
+    exports:
+      parallel_done: "true"
+
+  # 4. Step with structured args using templates
+  - name: structured-args-step
+    type: bash
+    command: cat {{customPath}}
+    exports:
+      structured_output: "{{Output}}/combined-{{TargetSpace}}.txt"
+
+  # 5. Final verification step
+  - name: verify-all-templates
+    type: bash
+    pre_condition: 'fileExists("{{customPath}}")'
+    command: |
+      echo "=== Template Rendering Verification ==="
+      echo "bash_output_path={{bash_output_path}}"
+      echo "bash_target={{bash_target}}"
+      echo "function_result={{function_result}}"
+      echo "parallel_done={{parallel_done}}"
+      echo "structured_output={{structured_output}}"
+      echo "=== File Contents ==="
+      cat {{customPath}}
+    exports:
+      all_verified: "true"

test/testdata/workflows/nested/testing-nested-flow.yaml

@@ -0,0 +1,23 @@
+kind: flow
+name: testing-nested-flow
+description: Test flow for nested workflow execution with param and target sharing
+tags: test,nested
+
+params:
+  - name: paramFromFlowFile
+    default: "flow-value"
+
+dependencies:
+  variables:
+    - name: Target
+      type: domain
+      required: true
+
+modules:
+  - name: nested-module-one
+    path: nested/nested-module-1.yaml
+
+  - name: nested-module-two
+    path: nested/nested-module-2.yaml
+    depends_on:
+      - nested-module-one

test/testdata/workflows/sample-report-workflow.yaml

@@ -0,0 +1,113 @@
+# Sample Workflow: Generate Security Report
+# This workflow demonstrates how to use render_markdown_report() function
+# to generate customized security reports from markdown templates.
+#
+# Usage:
+#   osmedeus run -m sample-report-workflow -t example.com
+#
+# Prerequisites:
+#   - Template file should exist at the specified path
+#   - Database should have scan data (assets, vulnerabilities)
+
+name: sample-report-workflow
+kind: module
+description: Generate security report from markdown template
+tags: report,markdown,utility
+
+params:
+  - name: target
+    required: true
+    description: Target domain for the report
+
+# Variables available in templates:
+#   {{Workspace}}  - Current workspace name (usually the target)
+#   {{Target}}     - Target domain
+#   {{Output}}     - Output directory path
+#   {{TaskID}}     - Current task/scan ID
+#   {{TaskDate}}   - Current date
+#   {{Data}}       - External data directory
+#   {{Binaries}}   - External binaries directory
+
+steps:
+  # Step 1: Create the template directory if it doesn't exist
+  - name: setup-template-dir
+    type: bash
+    command: mkdir -p {{Output}}/templates
+
+  # Step 2: Create a simple inline template for demonstration
+  # In production, you would use a pre-existing template file
+  - name: create-demo-template
+    type: bash
+    command: |
+      cat > {{Output}}/templates/demo-report.md << 'TEMPLATE'
+      # Security Scan Report
+
+      **Workspace**: {{Workspace}}
+      **Target**: {{Target}}
+      **Generated**: {{TaskDate}}
+      **Task ID**: {{TaskID}}
+
+      ---
+
+      ## String Functions Demo
+
+      ```osm-func
+      "Uppercase target: " + toUpperCase("{{Target}}")
+      ```
+
+      ```osm-func
+      "Trimmed text: [" + trim("   hello world   ") + "]"
+      ```
+
+      ```osm-func
+      "Target length: " + len("{{Target}}")
+      ```
+
+      ---
+
+      ## Dynamic Content
+
+      | Function | Result |
+      |----------|--------|
+      | UUID | ```osm-func
+      uuid()
+      ``` |
+      | Random String | ```osm-func
+      randomString(8)
+      ``` |
+      | Contains 'example' | ```osm-func
+      contains("{{Target}}", "example")
+      ``` |
+
+      ---
+
+      ## Conditional Logic
+
+      ```osm-func
+      contains("{{Target}}", ".com") ? "Target is a .com domain" : "Target is not a .com domain"
+      ```
+
+      ---
+
+      *Report generated by Osmedeus*
+      TEMPLATE
+
+  # Step 3: Render the markdown report
+  - name: generate-report
+    type: function
+    function: 'render_markdown_report("{{Output}}/templates/demo-report.md", "{{Output}}/security-report.md")'
+
+  # Step 4: Verify the report was created
+  - name: verify-report
+    type: function
+    function: 'fileExists("{{Output}}/security-report.md")'
+
+  # Step 5: Display report path
+  - name: show-report-path
+    type: function
+    function: 'log_info("Report generated at: {{Output}}/security-report.md")'
+
+  # Step 6: Print report preview (first 50 lines)
+  - name: preview-report
+    type: bash
+    command: head -50 {{Output}}/security-report.md

test/testdata/workflows/test-30s-module.yaml

@@ -0,0 +1,24 @@
+name: test-30s-module
+kind: module
+description: Simple module with a single 30 second sleep
+tags: test,sleep,long-running
+
+params:
+  - name: target
+    required: true
+
+steps:
+  - name: start
+    type: bash
+    command: echo "[$(date +%H:%M:%S)] Starting 30s sleep test for {{target}}"
+
+  - name: long-sleep
+    type: bash
+    command: |
+      echo "[$(date +%H:%M:%S)] Sleeping for 30 seconds..."
+      sleep 30
+      echo "[$(date +%H:%M:%S)] Sleep complete!"
+
+  - name: finish
+    type: bash
+    command: echo "[$(date +%H:%M:%S)] Done!"

test/testdata/workflows/test-bash.yaml

@@ -0,0 +1,13 @@
+name: test-bash
+kind: module
+description: Test basic bash execution
+tags: test,bash,quick
+
+params:
+  - name: target
+    required: true
+
+steps:
+  - name: echo-test
+    type: bash
+    command: echo "Hello {{target}}"

test/testdata/workflows/test-bool-precondition.yaml

@@ -0,0 +1,50 @@
+name: test-bool-precondition
+kind: module
+description: Test workflow for boolean params in pre_condition
+tags: test,params,boolean,precondition
+
+params:
+  - name: target
+    required: true
+  - name: run_scan
+    type: bool
+    default: true
+  - name: enable_debug
+    type: bool
+    default: false
+
+steps:
+  - name: always-runs
+    type: bash
+    command: echo "This step always runs for {{target}}"
+
+  # This step only runs when run_scan is true (native boolean check)
+  - name: scan-step
+    type: bash
+    pre_condition: "run_scan"
+    command: echo "SCAN RUNNING - run_scan is true"
+
+  # This step only runs when run_scan is false (negation)
+  - name: skip-scan-step
+    type: bash
+    pre_condition: "!run_scan"
+    command: echo "SCAN SKIPPED - run_scan is false"
+
+  # This step only runs when enable_debug is true
+  - name: debug-step
+    type: bash
+    pre_condition: "enable_debug"
+    command: echo "DEBUG ENABLED"
+
+  # Compound condition: both must be true
+  - name: scan-with-debug
+    type: bash
+    pre_condition: "run_scan && enable_debug"
+    command: echo "SCAN WITH DEBUG MODE"
+
+  - name: summary
+    type: bash
+    command: |
+      echo "=== Pre-condition Test Summary ==="
+      echo "run_scan: {{run_scan}}"
+      echo "enable_debug: {{enable_debug}}"

test/testdata/workflows/test-boolean-params.yaml

@@ -0,0 +1,154 @@
+name: test-boolean-params
+kind: module
+description: Test workflow for validating boolean parameter handling
+tags: test,params,boolean,validation
+
+params:
+  - name: target
+    required: true
+  - name: enable_scan
+    type: bool
+    default: true
+  - name: skip_notify
+    type: bool
+    default: false
+  - name: verbose_mode
+    type: bool
+    default: true
+
+steps:
+  # Step 1: Echo all boolean params for verification
+  - name: print-params
+    type: bash
+    command: |
+      echo "=== Boolean Params Test ==="
+      echo "enable_scan={{enable_scan}}"
+      echo "skip_notify={{skip_notify}}"
+      echo "verbose_mode={{verbose_mode}}"
+      echo "target={{target}}"
+
+  # Step 2: Test enable_scan boolean
+  - name: check-enable-scan
+    type: bash
+    command: "echo 'Checking enable_scan value: {{enable_scan}}'"
+    exports:
+      scan_enabled: "{{enable_scan}}"
+    decision:
+      switch: "{{enable_scan}}"
+      cases:
+        "true":
+          goto: scan-enabled-branch
+        "false":
+          goto: scan-disabled-branch
+
+  # Step 3a: Scan is enabled (enable_scan=true)
+  - name: scan-enabled-branch
+    type: bash
+    command: |
+      echo "SCAN IS ENABLED"
+      echo "Running scan for {{target}}..."
+    exports:
+      scan_status: "ENABLED"
+    decision:
+      switch: "always"
+      cases:
+        "always":
+          goto: check-skip-notify
+
+  # Step 3b: Scan is disabled (enable_scan=false)
+  - name: scan-disabled-branch
+    type: bash
+    command: |
+      echo "SCAN IS DISABLED"
+      echo "Skipping scan for {{target}}"
+    exports:
+      scan_status: "DISABLED"
+
+  # Step 4: Test skip_notify boolean
+  - name: check-skip-notify
+    type: bash
+    command: "echo 'Checking skip_notify value: {{skip_notify}}'"
+    exports:
+      notify_skipped: "{{skip_notify}}"
+    decision:
+      switch: "{{skip_notify}}"
+      cases:
+        "true":
+          goto: notify-skipped-branch
+        "false":
+          goto: notify-enabled-branch
+
+  # Step 5a: Notifications skipped (skip_notify=true)
+  - name: notify-skipped-branch
+    type: bash
+    command: echo "NOTIFICATIONS SKIPPED"
+    exports:
+      notify_status: "SKIPPED"
+    decision:
+      switch: "always"
+      cases:
+        "always":
+          goto: check-verbose-mode
+
+  # Step 5b: Notifications enabled (skip_notify=false)
+  - name: notify-enabled-branch
+    type: bash
+    command: echo "NOTIFICATIONS ENABLED"
+    exports:
+      notify_status: "ENABLED"
+
+  # Step 6: Test verbose_mode boolean
+  - name: check-verbose-mode
+    type: bash
+    command: "echo 'Checking verbose_mode value: {{verbose_mode}}'"
+    exports:
+      is_verbose: "{{verbose_mode}}"
+    decision:
+      switch: "{{verbose_mode}}"
+      cases:
+        "true":
+          goto: verbose-on-branch
+        "false":
+          goto: verbose-off-branch
+
+  # Step 7a: Verbose mode on
+  - name: verbose-on-branch
+    type: bash
+    command: "echo 'VERBOSE MODE: ON'"
+    exports:
+      verbose_status: "ON"
+    decision:
+      switch: "always"
+      cases:
+        "always":
+          goto: final-summary
+
+  # Step 7b: Verbose mode off
+  - name: verbose-off-branch
+    type: bash
+    command: "echo 'VERBOSE MODE: OFF'"
+    exports:
+      verbose_status: "OFF"
+
+  # Step 8: Final summary with all boolean results
+  - name: final-summary
+    type: bash
+    command: |
+      echo "=== Boolean Params Summary ==="
+      echo "Target: {{target}}"
+      echo ""
+      echo "Input Params:"
+      echo "  enable_scan: {{enable_scan}}"
+      echo "  skip_notify: {{skip_notify}}"
+      echo "  verbose_mode: {{verbose_mode}}"
+      echo ""
+      echo "Decision Results:"
+      echo "  Scan Status: {{scan_status}}"
+      echo "  Notify Status: {{notify_status}}"
+      echo "  Verbose Status: {{verbose_status}}"
+      echo ""
+      echo "Boolean Exports:"
+      echo "  scan_enabled: {{scan_enabled}}"
+      echo "  notify_skipped: {{notify_skipped}}"
+      echo "  is_verbose: {{is_verbose}}"
+      echo "=== Test Complete ==="

test/testdata/workflows/test-complex-docker-workflow.yaml

@@ -0,0 +1,218 @@
+name: test-complex-docker-workflow
+kind: module
+description: Complex workflow demonstrating bash, function steps with docker step_runner
+tags: test,docker,comprehensive
+
+params:
+  - name: target
+    required: true
+  - name: output_dir
+    default: /tmp/osm-complex-test
+  - name: threads
+    default: "5"
+
+steps:
+  # Step 1: Setup - Create directories using function
+  - name: setup-workspace
+    type: function
+    log: "Setting up workspace for {{target}}"
+    function: createDir("{{output_dir}}")
+    exports:
+      workspace_created: "output"
+
+  # Step 2: Create input file with bash
+  - name: create-target-list
+    type: bash
+    log: "Creating target list for {{target}}"
+    commands:
+      - mkdir -p {{output_dir}}/targets
+      - |
+        cat > {{output_dir}}/targets/hosts.txt << 'EOF'
+        sub1.{{target}}
+        sub2.{{target}}
+        api.{{target}}
+        www.{{target}}
+        admin.{{target}}
+        EOF
+    exports:
+      target_file: "{{output_dir}}/targets/hosts.txt"
+
+  # Step 3: Docker-based DNS resolution simulation
+  - name: dns-resolve
+    type: remote-bash
+    log: "Resolving DNS for targets in Docker"
+    timeout: 60
+    step_runner: docker
+    step_runner_config:
+      image: alpine:latest
+      env:
+        TARGET_DOMAIN: "{{target}}"
+      volumes:
+        - "{{output_dir}}:/workspace"
+      workdir: /workspace
+    command: |
+      echo "Resolving DNS for $TARGET_DOMAIN"
+      cat /workspace/targets/hosts.txt | while read host; do
+        echo "$host -> 127.0.0.1" >> /workspace/dns-resolved.txt
+      done
+      echo "DNS resolution complete"
+    exports:
+      dns_output: "{{output_dir}}/dns-resolved.txt"
+
+  # Step 4: Parallel docker commands - simulating port scanning
+  - name: parallel-port-scan
+    type: remote-bash
+    log: "Running parallel port scans in Docker"
+    timeout: 120
+    step_runner: docker
+    step_runner_config:
+      image: alpine:latest
+      volumes:
+        - "{{output_dir}}:/workspace"
+    parallel_commands:
+      - 'echo "Scanning ports 1-1000 on {{target}}" && sleep 1 && echo "Port 80 open" > /workspace/ports-1.txt'
+      - 'echo "Scanning ports 1001-2000 on {{target}}" && sleep 1 && echo "Port 443 open" > /workspace/ports-2.txt'
+      - 'echo "Scanning ports 2001-3000 on {{target}}" && sleep 1 && echo "Port 8080 open" > /workspace/ports-3.txt'
+      - 'echo "Scanning ports 3001-4000 on {{target}}" && sleep 1 && echo "Port 3306 open" > /workspace/ports-4.txt'
+
+  # Step 5: Merge port scan results
+  - name: merge-port-results
+    type: bash
+    log: "Merging port scan results"
+    command: cat {{output_dir}}/ports-*.txt > {{output_dir}}/all-ports.txt
+    exports:
+      ports_file: "{{output_dir}}/all-ports.txt"
+
+  # Step 6: Function to check file existence
+  - name: verify-ports-file
+    type: function
+    log: "Verifying ports file exists"
+    function: fileExists("{{ports_file}}")
+    exports:
+      ports_verified: "output"
+
+  # Step 7: Docker-based HTTP probing with parallel steps
+  - name: http-probe-parallel
+    type: parallel-steps
+    log: "Running parallel HTTP probes"
+    parallel_steps:
+      - name: probe-http
+        type: remote-bash
+        step_runner: docker
+        step_runner_config:
+          image: alpine:latest
+          volumes:
+            - "{{output_dir}}:/workspace"
+        command: |
+          echo "Probing HTTP on port 80"
+          echo "http://{{target}}:80 [200]" > /workspace/http-80.txt
+      - name: probe-https
+        type: remote-bash
+        step_runner: docker
+        step_runner_config:
+          image: alpine:latest
+          volumes:
+            - "{{output_dir}}:/workspace"
+        command: |
+          echo "Probing HTTPS on port 443"
+          echo "https://{{target}}:443 [200]" > /workspace/https-443.txt
+      - name: probe-alt
+        type: remote-bash
+        step_runner: docker
+        step_runner_config:
+          image: alpine:latest
+          volumes:
+            - "{{output_dir}}:/workspace"
+        command: |
+          echo "Probing alternate port 8080"
+          echo "http://{{target}}:8080 [404]" > /workspace/http-8080.txt
+
+  # Step 8: Foreach loop with docker - process each subdomain
+  - name: process-subdomains
+    type: foreach
+    log: "Processing each subdomain"
+    input: "{{output_dir}}/targets/hosts.txt"
+    variable: subdomain
+    threads: 3
+    step:
+      name: scan-subdomain
+      type: remote-bash
+      step_runner: docker
+      step_runner_config:
+        image: alpine:latest
+        volumes:
+          - "{{output_dir}}:/workspace"
+      command: |
+        echo "Scanning [[subdomain]]..."
+        echo "[[subdomain]]: status=200, title=Example" >> /workspace/subdomain-results.txt
+
+  # Step 9: Read results with function
+  - name: read-subdomain-results
+    type: function
+    log: "Reading subdomain scan results"
+    function: readFile("{{output_dir}}/subdomain-results.txt")
+    exports:
+      scan_results: "output"
+
+  # Step 10: Decision based routing
+  - name: check-results
+    type: bash
+    log: "Checking scan results"
+    command: wc -l < {{output_dir}}/subdomain-results.txt
+    exports:
+      result_count: "output"
+    decision:
+      switch: "{{result_count}}"
+      cases:
+        "0":
+          goto: _end
+      default:
+        goto: generate-report
+
+  # Step 11: Generate final report in docker
+  - name: generate-report
+    type: remote-bash
+    log: "Generating final report"
+    timeout: 30
+    step_runner: docker
+    step_runner_config:
+      image: alpine:latest
+      volumes:
+        - "{{output_dir}}:/workspace"
+    commands:
+      - echo "=== Scan Report for {{target}} ===" > /workspace/report.txt
+      - echo "" >> /workspace/report.txt
+      - echo "--- DNS Results ---" >> /workspace/report.txt
+      - cat /workspace/dns-resolved.txt >> /workspace/report.txt 2>/dev/null || echo "No DNS results" >> /workspace/report.txt
+      - echo "" >> /workspace/report.txt
+      - echo "--- Open Ports ---" >> /workspace/report.txt
+      - cat /workspace/all-ports.txt >> /workspace/report.txt 2>/dev/null || echo "No ports found" >> /workspace/report.txt
+      - echo "" >> /workspace/report.txt
+      - echo "--- Subdomain Results ---" >> /workspace/report.txt
+      - cat /workspace/subdomain-results.txt >> /workspace/report.txt 2>/dev/null || echo "No subdomain results" >> /workspace/report.txt
+      - echo "" >> /workspace/report.txt
+      - echo "Report generated at $(date)" >> /workspace/report.txt
+    exports:
+      report_file: "{{output_dir}}/report.txt"
+
+  # Step 12: Parallel functions to get file stats
+  - name: get-file-stats
+    type: function
+    log: "Getting file statistics"
+    parallel_functions:
+      - fileLength("{{output_dir}}/report.txt")
+      - fileExists("{{output_dir}}/all-ports.txt")
+      - trim("  {{target}}  ")
+    exports:
+      file_stats: "output"
+
+  # Step 13: Cleanup (optional - controlled by pre_condition)
+  - name: cleanup-temp-files
+    type: bash
+    log: "Cleaning up temporary files"
+    pre_condition: "false"
+    command: rm -rf {{output_dir}}/ports-*.txt
+    on_error:
+      - action: log
+        message: "Cleanup failed but continuing"
+      - action: continue

test/testdata/workflows/test-decision-switch.yaml

@@ -0,0 +1,68 @@
+name: test-decision-switch
+kind: module
+description: Test workflow demonstrating switch/case decision syntax
+
+params:
+  - name: target_type
+    type: string
+    default: "domain"
+
+steps:
+  - name: detect-type
+    type: bash
+    command: echo "{{target_type}}"
+    exports:
+      detected_type: "{{target_type}}"
+    decision:
+      switch: "{{detected_type}}"
+      cases:
+        "domain":
+          goto: subdomain-enum
+        "ip":
+          goto: port-scan
+        "cidr":
+          goto: network-scan
+        "url":
+          goto: web-scan
+      default:
+        goto: generic-recon
+
+  - name: subdomain-enum
+    type: bash
+    command: echo "Running subdomain enumeration for {{target}}"
+    decision:
+      switch: "always"
+      cases:
+        "always":
+          goto: _end
+
+  - name: port-scan
+    type: bash
+    command: echo "Running port scan for {{target}}"
+    decision:
+      switch: "always"
+      cases:
+        "always":
+          goto: _end
+
+  - name: network-scan
+    type: bash
+    command: echo "Running network scan for {{target}}"
+    decision:
+      switch: "always"
+      cases:
+        "always":
+          goto: _end
+
+  - name: web-scan
+    type: bash
+    command: echo "Running web scan for {{target}}"
+    decision:
+      switch: "always"
+      cases:
+        "always":
+          goto: _end
+
+  - name: generic-recon
+    type: bash
+    command: echo "Running generic reconnaissance for {{target}}"

test/testdata/workflows/test-decision.yaml

@@ -0,0 +1,34 @@
+name: test-decision
+kind: module
+description: Test conditional step routing with decision
+tags: test,decision,conditional
+
+params:
+  - name: target
+    required: true
+
+steps:
+  - name: check-condition
+    type: bash
+    command: echo "{{target}}"
+    exports:
+      target_value: "output"
+    decision:
+      switch: "{{target_value}}"
+      cases:
+        "skip":
+          goto: _end
+        "jump":
+          goto: final-step
+
+  - name: middle-step
+    type: bash
+    command: echo "middle executed"
+    exports:
+      middle_output: "output"
+
+  - name: final-step
+    type: bash
+    command: echo "final executed"
+    exports:
+      final_output: "output"

test/testdata/workflows/test-docker-file-outputs.yaml

@@ -0,0 +1,62 @@
+name: test-docker-file-outputs
+kind: module
+description: Test std_file, step_remote_file, and host_output_file with Docker runner
+tags: test,docker,file-output
+
+params:
+  - name: target
+    required: true
+  - name: output_dir
+    default: /tmp/osm-docker-file-test
+
+steps:
+  # Test 1: std_file - capture stdout to local file
+  - name: test-std-file
+    type: remote-bash
+    log: "Testing std_file output capture"
+    step_runner: docker
+    step_runner_config:
+      image: alpine:latest
+    command: 'echo "stdout from docker: {{target}}" && echo "line 2"'
+    std_file: "{{output_dir}}/std_file_output.txt"
+
+  # Test 2: step_remote_file + host_output_file - copy file from container
+  - name: test-remote-file-copy
+    type: remote-bash
+    log: "Testing file copy from Docker container"
+    step_runner: docker
+    step_runner_config:
+      image: alpine:latest
+      persistent: true
+    commands:
+      - 'echo "created in container: {{target}}" > /tmp/container-output.txt'
+      - 'cat /tmp/container-output.txt'
+    step_remote_file: /tmp/container-output.txt
+    host_output_file: "{{output_dir}}/copied_from_container.txt"
+
+  # Test 3: Combined - both std_file and remote file copy
+  - name: test-combined-outputs
+    type: remote-bash
+    log: "Testing combined std_file and remote file copy"
+    step_runner: docker
+    step_runner_config:
+      image: alpine:latest
+      persistent: true
+    commands:
+      - 'echo "Processing target: {{target}}"'
+      - 'echo "result-data-{{target}}" > /tmp/result.txt'
+    std_file: "{{output_dir}}/combined_stdout.txt"
+    step_remote_file: /tmp/result.txt
+    host_output_file: "{{output_dir}}/combined_result.txt"
+
+  # Test 4: Verify files exist on host
+  - name: verify-outputs
+    type: bash
+    log: "Verifying all output files exist"
+    commands:
+      - 'test -f "{{output_dir}}/std_file_output.txt" && echo "std_file: OK"'
+      - 'test -f "{{output_dir}}/copied_from_container.txt" && echo "remote_copy: OK"'
+      - 'test -f "{{output_dir}}/combined_stdout.txt" && echo "combined_stdout: OK"'
+      - 'test -f "{{output_dir}}/combined_result.txt" && echo "combined_result: OK"'
+      - 'cat "{{output_dir}}/std_file_output.txt"'
+      - 'cat "{{output_dir}}/copied_from_container.txt"'

test/testdata/workflows/test-docker-flow.yaml

@@ -0,0 +1,160 @@
+name: test-docker-flow
+kind: flow
+description: Flow orchestrating multiple Docker-based security scanning modules
+tags: test,flow,docker
+
+params:
+  - name: target
+    required: true
+  - name: Output
+    default: /tmp/osm-docker-flow
+  - name: mode
+    default: "full"
+  - name: threads
+    default: "10"
+  - name: skip_vuln_scan
+    default: "false"
+
+modules:
+  # Module 1: Initial reconnaissance
+  - name: recon-module
+    path: modules/test-docker-recon
+    params:
+      target: "{{target}}"
+      output_dir: "{{Output}}/recon"
+      threads: "{{threads}}"
+    on_success:
+      - action: log
+        message: "Reconnaissance completed for {{target}}"
+      - action: export
+        key: recon_complete
+        value: "true"
+    on_error:
+      - action: log
+        message: "Reconnaissance failed for {{target}}"
+      - action: abort
+
+  # Module 2: Subdomain enumeration (depends on recon)
+  - name: subdomain-module
+    path: modules/test-docker-subdomain
+    depends_on:
+      - recon-module
+    params:
+      target: "{{target}}"
+      output_dir: "{{Output}}/subdomains"
+      wordlist: "/usr/share/wordlists/subdomains.txt"
+    condition: "mode == 'full' || mode == 'subdomain'"
+    on_success:
+      - action: export
+        key: subdomains_file
+        value: "{{Output}}/subdomains/all.txt"
+
+  # Module 3: Port scanning (parallel with subdomain)
+  - name: portscan-module
+    path: modules/test-docker-portscan
+    depends_on:
+      - recon-module
+    params:
+      target: "{{target}}"
+      output_dir: "{{Output}}/ports"
+      port_range: "1-10000"
+      rate: "1000"
+    condition: "mode == 'full' || mode == 'portscan'"
+
+  # Module 4: HTTP probing (depends on subdomain results)
+  - name: httpx-module
+    path: modules/test-docker-httpx
+    depends_on:
+      - subdomain-module
+    params:
+      input: "{{subdomains_file}}"
+      output_dir: "{{Output}}/http"
+      threads: "{{threads}}"
+    on_success:
+      - action: export
+        key: alive_hosts
+        value: "{{Output}}/http/alive.txt"
+      - action: export
+        key: httpx_json
+        value: "{{Output}}/http/httpx.json"
+    decision:
+      switch: "{{alive_count}}"
+      cases:
+        "0":
+          goto: report-module
+
+  # Module 5: Technology detection (depends on HTTP probe)
+  - name: tech-detect-module
+    path: modules/test-docker-techdetect
+    depends_on:
+      - httpx-module
+    params:
+      input: "{{alive_hosts}}"
+      output_dir: "{{Output}}/tech"
+
+  # Module 6: Screenshot capture (parallel with tech detection)
+  - name: screenshot-module
+    path: modules/test-docker-screenshot
+    depends_on:
+      - httpx-module
+    params:
+      input: "{{alive_hosts}}"
+      output_dir: "{{Output}}/screenshots"
+      threads: "5"
+
+  # Module 7: Vulnerability scanning (conditional)
+  - name: vulnscan-module
+    path: modules/test-docker-scanning
+    depends_on:
+      - httpx-module
+      - tech-detect-module
+    params:
+      target: "{{target}}"
+      Output: "{{Output}}/vulns"
+      severity: "critical,high,medium"
+      threads: "{{threads}}"
+    condition: "skip_vuln_scan != 'true'"
+    on_error:
+      - action: log
+        message: "Vulnerability scan encountered errors but continuing"
+      - action: continue
+
+  # Module 8: Directory bruteforcing (optional - depends on mode)
+  - name: dirbrute-module
+    path: modules/test-docker-dirbrute
+    depends_on:
+      - httpx-module
+    params:
+      input: "{{alive_hosts}}"
+      output_dir: "{{Output}}/dirs"
+      wordlist: "/usr/share/wordlists/common.txt"
+      threads: "20"
+    condition: "mode == 'full'"
+
+  # Module 9: JavaScript analysis (depends on dir results)
+  - name: js-analysis-module
+    path: modules/test-docker-jsanalysis
+    depends_on:
+      - dirbrute-module
+    params:
+      input: "{{Output}}/dirs/js-files.txt"
+      output_dir: "{{Output}}/js"
+    condition: "mode == 'full'"
+
+  # Module 10: Final report generation
+  - name: report-module
+    path: modules/test-docker-report
+    depends_on:
+      - screenshot-module
+      - vulnscan-module
+      - tech-detect-module
+    params:
+      target: "{{target}}"
+      input_dir: "{{Output}}"
+      output_dir: "{{Output}}/reports"
+      format: "html,json,markdown"
+    on_success:
+      - action: log
+        message: "Flow completed successfully for {{target}}"
+      - action: notify
+        message: "Security assessment complete: {{target}}"

test/testdata/workflows/test-docker-runner.yaml

@@ -0,0 +1,18 @@
+name: test-docker-runner
+kind: module
+description: Test Docker runner execution
+tags: test,runner,docker
+
+runner: docker
+runner_config:
+  image: alpine:latest
+  persistent: false
+
+params:
+  - name: target
+    required: true
+
+steps:
+  - name: check-alpine
+    type: bash
+    command: cat /etc/os-release | grep -i alpine

test/testdata/workflows/test-docker-scanning.yaml

@@ -0,0 +1,319 @@
+name: test-docker-scanning
+kind: module
+description: Realistic security scanning simulation with Docker-based tools
+tags: test,docker,scanning
+
+params:
+  - name: target
+    required: true
+  - name: Output
+    default: /tmp/osm-docker-scan
+  - name: threads
+    default: "10"
+  - name: severity
+    default: "critical,high,medium"
+  - name: rate_limit
+    default: "100"
+
+steps:
+  # Phase 1: Initialization
+  - name: init-workspace
+    type: function
+    log: "Initializing workspace for {{target}}"
+    function: createDir("{{Output}}")
+
+  - name: create-subdirs
+    type: bash
+    log: "Creating output subdirectories"
+    commands:
+      - mkdir -p {{Output}}/recon
+      - mkdir -p {{Output}}/enumeration
+      - mkdir -p {{Output}}/vulnerabilities
+      - mkdir -p {{Output}}/screenshots
+      - mkdir -p {{Output}}/reports
+
+  # Phase 2: Subdomain Enumeration (Docker-based)
+  - name: subdomain-enum
+    type: parallel-steps
+    log: "Running subdomain enumeration tools"
+    parallel_steps:
+      - name: subfinder-scan
+        type: remote-bash
+        timeout: 300
+        step_runner: docker
+        step_runner_config:
+          image: alpine:latest
+          env:
+            TARGET: "{{target}}"
+          volumes:
+            - "{{Output}}:/output"
+          workdir: /output
+        command: |
+          echo "Running subfinder for $TARGET"
+          # Simulating subfinder output
+          cat > /output/recon/subfinder.txt << EOF
+          www.$TARGET
+          api.$TARGET
+          admin.$TARGET
+          mail.$TARGET
+          dev.$TARGET
+          staging.$TARGET
+          test.$TARGET
+          EOF
+          echo "Subfinder found $(wc -l < /output/recon/subfinder.txt) subdomains"
+        exports:
+          subfinder_output: "{{Output}}/recon/subfinder.txt"
+
+      - name: amass-scan
+        type: remote-bash
+        timeout: 600
+        step_runner: docker
+        step_runner_config:
+          image: alpine:latest
+          volumes:
+            - "{{Output}}:/output"
+        command: |
+          echo "Running amass for {{target}}"
+          # Simulating amass output
+          cat > /output/recon/amass.txt << EOF
+          www.{{target}}
+          api.{{target}}
+          cdn.{{target}}
+          assets.{{target}}
+          portal.{{target}}
+          EOF
+          echo "Amass found $(wc -l < /output/recon/amass.txt) subdomains"
+        exports:
+          amass_output: "{{Output}}/recon/amass.txt"
+
+      - name: crtsh-lookup
+        type: remote-bash
+        timeout: 120
+        step_runner: docker
+        step_runner_config:
+          image: alpine:latest
+          volumes:
+            - "{{Output}}:/output"
+        command: |
+          echo "Querying crt.sh for {{target}}"
+          # Simulating crt.sh output
+          cat > /output/recon/crtsh.txt << EOF
+          *.{{target}}
+          www.{{target}}
+          secure.{{target}}
+          EOF
+        exports:
+          crtsh_output: "{{Output}}/recon/crtsh.txt"
+
+  # Phase 3: Merge and deduplicate
+  - name: merge-subdomains
+    type: function
+    log: "Merging subdomain results"
+    function: sortUnique("{{Output}}/recon/*.txt", "{{Output}}/recon/all-subdomains.txt")
+    exports:
+      all_subdomains: "{{Output}}/recon/all-subdomains.txt"
+    on_error:
+      - action: log
+        message: "Failed to merge subdomains, attempting fallback"
+      - action: run
+        step: fallback-merge
+
+  - name: fallback-merge
+    type: bash
+    log: "Fallback merge using bash"
+    pre_condition: "false"
+    command: cat {{Output}}/recon/*.txt | sort -u > {{Output}}/recon/all-subdomains.txt
+
+  # Phase 4: DNS Resolution
+  - name: dns-resolution
+    type: foreach
+    log: "Resolving DNS for discovered subdomains"
+    input: "{{Output}}/recon/all-subdomains.txt"
+    variable: host
+    threads: 5
+    step:
+      name: resolve-host
+      type: remote-bash
+      step_runner: docker
+      step_runner_config:
+        image: alpine:latest
+        volumes:
+          - "{{Output}}:/output"
+      command: |
+        echo "[[host]] -> 127.0.0.1" >> /output/recon/resolved.txt
+
+  # Phase 5: HTTP Probing (Docker-based httpx simulation)
+  - name: http-probe
+    type: remote-bash
+    log: "Probing HTTP endpoints"
+    timeout: 300
+    step_runner: docker
+    step_runner_config:
+      image: alpine:latest
+      env:
+        THREADS: "{{threads}}"
+        RATE: "{{rate_limit}}"
+      volumes:
+        - "{{Output}}:/output"
+    commands:
+      - echo "Running httpx with $THREADS threads at rate $RATE"
+      - |
+        while read subdomain; do
+          echo "{\"url\":\"https://$subdomain\",\"status_code\":200,\"title\":\"Example\",\"tech\":[\"nginx\"]}" >> /output/enumeration/httpx.json
+        done < /output/recon/all-subdomains.txt
+      - echo "HTTP probing complete"
+    exports:
+      httpx_output: "{{Output}}/enumeration/httpx.json"
+
+  # Phase 6: Check results and decide
+  - name: check-alive-hosts
+    type: function
+    log: "Checking alive hosts count"
+    function: fileLength("{{Output}}/enumeration/httpx.json")
+    exports:
+      alive_count: "output"
+    decision:
+      switch: "{{alive_count}}"
+      cases:
+        "0":
+          goto: no-hosts-found
+      default:
+        goto: extract-urls
+
+  - name: no-hosts-found
+    type: bash
+    log: "No alive hosts found"
+    command: echo "No alive hosts found for {{target}}" > {{Output}}/reports/summary.txt
+    decision:
+      switch: "always"
+      cases:
+        "always":
+          goto: _end
+
+  # Phase 7: Extract URLs for scanning
+  - name: extract-urls
+    type: bash
+    log: "Extracting URLs from httpx output"
+    command: |
+      grep -o '"url":"[^"]*"' {{Output}}/enumeration/httpx.json | cut -d'"' -f4 > {{Output}}/enumeration/urls.txt
+    exports:
+      urls_file: "{{Output}}/enumeration/urls.txt"
+
+  # Phase 8: Vulnerability Scanning (Parallel Docker nuclei simulation)
+  - name: vuln-scan
+    type: parallel-steps
+    log: "Running vulnerability scans"
+    parallel_steps:
+      - name: nuclei-critical
+        type: remote-bash
+        timeout: 600
+        step_runner: docker
+        step_runner_config:
+          image: alpine:latest
+          env:
+            SEVERITY: critical
+          volumes:
+            - "{{Output}}:/output"
+        command: |
+          echo "Running nuclei with severity=$SEVERITY"
+          echo "[CRITICAL] CVE-2021-44228 - Log4Shell - https://api.{{target}}" > /output/vulnerabilities/nuclei-critical.txt
+          echo "Critical scan complete"
+        exports:
+          nuclei_critical: "{{Output}}/vulnerabilities/nuclei-critical.txt"
+
+      - name: nuclei-high
+        type: remote-bash
+        timeout: 600
+        step_runner: docker
+        step_runner_config:
+          image: alpine:latest
+          env:
+            SEVERITY: high
+          volumes:
+            - "{{Output}}:/output"
+        command: |
+          echo "Running nuclei with severity=high"
+          cat > /output/vulnerabilities/nuclei-high.txt << EOF
+          [HIGH] SQL Injection - https://admin.{{target}}/login
+          [HIGH] XSS Reflected - https://www.{{target}}/search
+          EOF
+          echo "High severity scan complete"
+        exports:
+          nuclei_high: "{{Output}}/vulnerabilities/nuclei-high.txt"
+
+      - name: nuclei-medium
+        type: remote-bash
+        timeout: 600
+        step_runner: docker
+        step_runner_config:
+          image: alpine:latest
+          volumes:
+            - "{{Output}}:/output"
+        command: |
+          echo "Running nuclei with severity=medium"
+          cat > /output/vulnerabilities/nuclei-medium.txt << EOF
+          [MEDIUM] Missing Security Headers - https://www.{{target}}
+          [MEDIUM] Directory Listing - https://dev.{{target}}/static/
+          [MEDIUM] Outdated Software - https://api.{{target}}
+          EOF
+        exports:
+          nuclei_medium: "{{Output}}/vulnerabilities/nuclei-medium.txt"
+
+  # Phase 9: Screenshot capture (Docker-based)
+  - name: take-screenshots
+    type: foreach
+    log: "Capturing screenshots"
+    input: "{{Output}}/enumeration/urls.txt"
+    variable: url
+    threads: 3
+    step:
+      name: capture-screenshot
+      type: remote-bash
+      step_runner: docker
+      step_runner_config:
+        image: alpine:latest
+        volumes:
+          - "{{Output}}:/output"
+      command: |
+        # Simulate screenshot capture
+        hash=$(echo "[[url]]" | md5sum | cut -c1-8)
+        echo "Screenshot captured: [[url]]" > /output/screenshots/$hash.txt
+
+  # Phase 10: Generate final report
+  - name: generate-report
+    type: remote-bash
+    log: "Generating comprehensive report"
+    timeout: 60
+    step_runner: docker
+    step_runner_config:
+      image: alpine:latest
+      volumes:
+        - "{{Output}}:/output"
+    commands:
+      - |
+        cat > /output/reports/scan-report.md << 'REPORT'
+        # Security Scan Report
+        ## Target: {{target}}
+        ## Generated: $(date)
+
+        ### Summary
+        REPORT
+      - 'echo "- Subdomains Found: $(wc -l < /output/recon/all-subdomains.txt 2>/dev/null || echo 0)" >> /output/reports/scan-report.md'
+      - 'echo "- Alive Hosts: $(wc -l < /output/enumeration/httpx.json 2>/dev/null || echo 0)" >> /output/reports/scan-report.md'
+      - 'echo "" >> /output/reports/scan-report.md'
+      - 'echo "### Vulnerabilities" >> /output/reports/scan-report.md'
+      - 'echo "#### Critical" >> /output/reports/scan-report.md'
+      - 'cat /output/vulnerabilities/nuclei-critical.txt >> /output/reports/scan-report.md 2>/dev/null || echo "None" >> /output/reports/scan-report.md'
+      - 'echo "" >> /output/reports/scan-report.md'
+      - 'echo "#### High" >> /output/reports/scan-report.md'
+      - 'cat /output/vulnerabilities/nuclei-high.txt >> /output/reports/scan-report.md 2>/dev/null || echo "None" >> /output/reports/scan-report.md'
+      - 'echo "" >> /output/reports/scan-report.md'
+      - 'echo "#### Medium" >> /output/reports/scan-report.md'
+      - 'cat /output/vulnerabilities/nuclei-medium.txt >> /output/reports/scan-report.md 2>/dev/null || echo "None" >> /output/reports/scan-report.md'
+    exports:
+      final_report: "{{Output}}/reports/scan-report.md"
+    on_success:
+      - action: log
+        message: "Scan completed successfully for {{target}}"
+      - action: notify
+        message: "Security scan complete: {{target}}"

test/testdata/workflows/test-echo.yaml

@@ -0,0 +1,31 @@
+name: test-echo
+kind: module
+description: Simple echo test module
+tags: test,bash,quick
+
+params:
+  - name: target
+    required: true
+  - name: message
+    default: "Hello from Osmedeus"
+
+steps:
+  - name: echo-target
+    type: bash
+    command: echo "Target is {{target}}"
+
+  - name: echo-message
+    type: bash
+    command: echo "Message is {{message}}"
+
+  - name: echo-basefolder
+    type: bash
+    command: echo "BaseFolder is {{BaseFolder}}"
+
+  - name: echo-output
+    type: bash
+    command: echo "Output is {{Output}}"
+
+  - name: echo-threads
+    type: bash
+    command: echo "threads={{threads}} baseThreads={{baseThreads}}"

test/testdata/workflows/test-example-report.yaml

@@ -0,0 +1,147 @@
+name: test-example-report
+kind: module
+description: Test example report with nested parallel steps with mixed types
+tags: test,parallel,nested
+
+params:
+  - name: target
+    required: true
+
+reports:
+  - name: main-output
+    path: "{{Output}}/sub1.txt"
+    type: text
+    description: Main output file from the workflow
+
+  - name: http-json
+    path: "{{Output}}/http.json"
+    type: json
+    description: Structured JSON output
+
+  - name: markdown-report-report
+    path: "{{Output}}/reports/sample-markdown-report.md"
+    type: markdown
+    description: Markdown report output
+
+steps:
+  - name: setup
+    type: bash
+    commands:
+      - mkdir -p {{Output}}/templates/
+      - 'echo "sub 1: {{target}}" > {{Output}}/sub1.txt'
+      - 'echo "sub 2: {{target}}" > {{Output}}/sub2.txt'
+
+  # Generate a summary report with just high-severity findings
+  - name: create-sample-repo-template
+    type: bash
+    command: |
+      cat > {{Output}}/templates/sample-markdown-report.md << 'EOF'
+      # Sample Repository Findings - {{Workspace}}
+
+      **Target**: {{Target}}
+      **Date**: {{TaskDate}}
+
+
+      ```markdown
+      | ID | Name | Score |
+      | --- | --- | --- |
+      | 1 | Alice | 90 |
+      | 2 | Bob | 85 |
+      | 3 | Charlie | 88 |
+      ```
+
+      ---
+      *Report generated by Osmedeus {{Version}}*
+      EOF
+
+  - name: generate-sample-markdown-report
+    type: function
+    function: 'render_markdown_report("{{Output}}/templates/sample-markdown-report.md", "{{Output}}/reports/sample-markdown-report.md")'
+
+  # Generate a summary report with just high-severity findings
+  - name: create-sample-repo-template
+    type: bash
+    command: |
+      cat > {{Output}}/reports/sample-markdown-report.html << 'EOF'
+      <!DOCTYPE html>
+      <html>
+      <body>
+
+            <style>
+          table {
+              border-collapse: collapse;
+              width: 50%;
+          }
+          th, td {
+              border: 1px solid #333;
+              padding: 8px;
+              text-align: left;
+          }
+          th {
+              background-color: #f2f2f2;
+          }
+          pre {
+              background-color: #eee;
+              padding: 10px;
+          }
+      </style>
+
+      <h1>Sample Image with JavaScript</h1>
+
+          <h2>Example of &lt;pre&gt; Tag</h2>
+            <pre>
+        Name: Roman
+        Course: Web Development
+        Code Sample:
+            function hello() {
+                console.log("Hello, world!");
+            }
+            </pre>
+
+            <h2>Example of &lt;table&gt; Tag</h2>
+            <table>
+                <tr>
+                    <th>ID</th>
+                    <th>Name</th>
+                    <th>Score</th>
+                </tr>
+                <tr>
+                    <td>1</td>
+                    <td>Alice</td>
+                    <td>90</td>
+                </tr>
+                <tr>
+                    <td>2</td>
+                    <td>Bob</td>
+                    <td>85</td>
+                </tr>
+                <tr>
+                    <td>3</td>
+                    <td>Charlie</td>
+                    <td>88</td>
+                </tr>
+            </table>
+
+
+
+      <p id="message">Click the image 👆</p>
+
+      <img src="https://via.placeholder.com/150" id="img">
+
+      <script>
+        document.getElementById("img").onclick = () => alert("Image clicked!");
+      </script>
+
+      </body>
+      </html>
+      EOF
+  - name: store-html-report
+    type: function
+    function: 'store_artifact("{{Output}}/reports/sample-markdown-report.html", "html")'
+
+  - name: generate-http-json
+    type: bash
+    command: curl -s http://httpbin.org/get > {{Output}}/http.json
+
+
+

test/testdata/workflows/test-exports-functions.yaml

@@ -0,0 +1,81 @@
+name: test-exports-functions
+kind: module
+description: Test exports with utility functions like fileLength, contains, fileExists, replace
+tags: test,exports,functions,utility
+
+params:
+  - name: target
+    required: true
+  - name: outputFile
+    type: string
+    default: "{{Output}}/test-output.txt"
+  - name: trimTestFile
+    type: string
+    default: "{{Output}}/trim-test.txt"
+  - name: replaceTestFile
+    type: string
+    default: "{{Output}}/replace-test.txt"
+
+steps:
+  - name: setup
+    type: bash
+    commands:
+      - mkdir -p {{Output}}
+      - printf 'line1\nline2\nline3\nline4\nline5\n' > {{outputFile}}
+      - printf '   trimmed_value   ' > {{trimTestFile}}
+      - printf 'hello,world,test' > {{replaceTestFile}}
+
+  - name: test-filelength
+    type: bash
+    command: echo "Checking file length"
+    exports:
+      line_count: "fileLength('{{outputFile}}')"
+
+  - name: test-trim
+    type: bash
+    command: echo "Checking trim"
+    exports:
+      trimmed_output: "trim(readFile('{{trimTestFile}}'))"
+
+  - name: test-contains-success
+    type: bash
+    command: echo "Checking contains"
+    exports:
+      has_success: "contains('success_completed', 'success')"
+
+  - name: test-contains-failure
+    type: bash
+    command: echo "Checking contains"
+    exports:
+      has_failure: "contains('success_completed', 'failure')"
+
+  - name: test-fileexists-true
+    type: bash
+    command: echo "Checking existence"
+    exports:
+      file_exists: "fileExists('{{outputFile}}')"
+
+  - name: test-fileexists-false
+    type: bash
+    command: echo "Checking nonexistent"
+    exports:
+      missing_file: "fileExists('{{Output}}/nonexistent.txt')"
+
+  - name: test-replace
+    type: bash
+    command: echo "Checking replace"
+    exports:
+      replaced_output: "replace(readFile('{{replaceTestFile}}'), ',', '-')"
+
+  - name: final-summary
+    type: bash
+    command: |
+      echo "=== Exports Functions Summary ==="
+      echo "Trimmed: [{{trimmed_output}}]"
+      echo "Line count: {{line_count}}"
+      echo "Has success: {{has_success}}"
+      echo "Has failure: {{has_failure}}"
+      echo "File exists: {{file_exists}}"
+      echo "Missing file: {{missing_file}}"
+      echo "Replaced: {{replaced_output}}"
+      echo "=== All Exports Verified ==="

test/testdata/workflows/test-flow.yaml

@@ -0,0 +1,17 @@
+name: test-flow
+kind: flow
+description: Simple test flow combining modules
+tags: test,flow,orchestration
+
+params:
+  - name: target
+    required: true
+
+modules:
+  - name: echo-module
+    path: modules/test-echo
+
+  - name: loop-module
+    path: modules/test-loop
+    depends_on:
+      - echo-module

test/testdata/workflows/test-foreach.yaml

@@ -0,0 +1,33 @@
+name: test-foreach
+kind: module
+description: Test foreach loop
+tags: test,foreach,loop
+
+params:
+  - name: target
+    required: true
+
+steps:
+  - name: create-input
+    type: bash
+    commands:
+      - mkdir -p {{Output}}/osm-test
+      - printf 'one\ntwo\nthree\n' > {{Output}}/osm-test/items.txt
+
+  - name: process-items
+    type: foreach
+    input: "{{Output}}/osm-test/items.txt"
+    variable: item
+    threads: 1
+    step:
+      name: process
+      type: bash
+      command: echo "Processing [[item]]" >> {{Output}}/osm-test/output.txt
+
+  - name: verify-output
+    type: bash
+    command: test -f {{Output}}/osm-test/output.txt && wc -l < {{Output}}/osm-test/output.txt
+
+  - name: cleanup
+    type: bash
+    command: rm -rf {{Output}}/osm-test

test/testdata/workflows/test-functions.yaml

@@ -0,0 +1,32 @@
+name: test-functions
+kind: module
+description: Test utility functions
+tags: test,functions,utility
+
+params:
+  - name: target
+    required: true
+
+steps:
+  - name: create-file
+    type: bash
+    command: | 
+      echo "test content" > /tmp/test-{{target}}.txt
+      echo "test content" > /tmp/test-{{target}}.txt
+      echo "test content" > /tmp/test-{{target}}.txt
+
+  - name: check-file
+    type: function
+    function: fileExists("/tmp/test-{{target}}.txt")
+    exports:
+      exists: "output"
+
+  - name: read-file
+    type: function
+    function: readFile("/tmp/test-{{target}}.txt")
+    exports:
+      content: "output"
+
+  - name: cleanup
+    type: bash
+    command: rm -f /tmp/test-{{target}}.txt

test/testdata/workflows/test-heuristics.yaml

@@ -0,0 +1,39 @@
+name: test-heuristics
+kind: module
+description: Test heuristic variable detection
+tags: test,heuristics,variables
+
+params:
+  - name: target
+    required: true
+
+steps:
+  - name: show-target-type
+    type: bash
+    command: echo "TargetType={{TargetType}}"
+
+  - name: show-url-vars
+    type: bash
+    commands:
+      - echo "TargetBaseURL={{TargetBaseURL}}"
+      - echo "TargetRootURL={{TargetRootURL}}"
+      - echo "TargetHostname={{TargetHostname}}"
+      - echo "TargetRootDomain={{TargetRootDomain}}"
+      - echo "TargetHost={{TargetHost}}"
+      - echo "TargetPort={{TargetPort}}"
+      - echo "TargetPath={{TargetPath}}"
+      - echo "TargetFileExt={{TargetFileExt}}"
+      - echo "TargetScheme={{TargetScheme}}"
+
+  - name: show-domain-vars
+    type: bash
+    commands:
+      - echo "TargetIsWildcard={{TargetIsWildcard}}"
+      - echo "TargetResolvedIP={{TargetResolvedIP}}"
+
+  - name: show-space-vars
+    type: bash
+    commands:
+      - echo "TargetSpace={{TargetSpace}}"
+      - echo "HeuristicsCheck={{HeuristicsCheck}}"
+      - echo "Output={{Output}}"

test/testdata/workflows/test-http-exports.yaml

@@ -0,0 +1,161 @@
+kind: module
+name: test-http-exports
+description: Test HTTP step exports with status_code and response_body comparisons using contains and regex_match
+tags: test,http,exports
+
+params:
+  - name: target
+    default: "example.com"
+
+steps:
+  # ==========================================================================
+  # Test 1: Status Code Comparisons
+  # ==========================================================================
+  - name: check-status-200
+    type: http
+    method: GET
+    url: "https://httpbin.org/status/200"
+    timeout: 30
+    log: "Testing status code 200 response"
+    exports:
+      is_200: "check_status_200_http_resp.status_code == 200"
+      is_2xx: "check_status_200_http_resp.status_code >= 200 && check_status_200_http_resp.status_code < 300"
+      not_404: "check_status_200_http_resp.status_code != 404"
+
+  - name: verify-status-exports
+    type: bash
+    command: |
+      echo "=== Status Code Export Tests ==="
+      echo "is_200: {{is_200}}"
+      echo "is_2xx: {{is_2xx}}"
+      echo "not_404: {{not_404}}"
+    log: "Verifying status code exports"
+
+  # ==========================================================================
+  # Test 2: Response Body with contains()
+  # ==========================================================================
+  - name: check-get-contains
+    type: http
+    method: GET
+    url: "https://httpbin.org/get?target={{target}}&foo=bar"
+    headers:
+      User-Agent: "Osmedeus/1.0"
+      Accept: "application/json"
+    timeout: 30
+    log: "Testing contains() with response body"
+    exports:
+      has_args: "contains(check_get_contains_http_resp.response_body, 'args')"
+      has_target: "contains(check_get_contains_http_resp.response_body, '{{target}}')"
+      has_foo_bar: "contains(check_get_contains_http_resp.response_body, 'foo')"
+      has_origin: "contains(check_get_contains_http_resp.response_body, 'origin')"
+      body_not_empty: "check_get_contains_http_resp.response_body != ''"
+
+  - name: verify-contains-exports
+    type: bash
+    command: |
+      echo "=== Contains Export Tests ==="
+      echo "has_args: {{has_args}}"
+      echo "has_target: {{has_target}}"
+      echo "has_foo_bar: {{has_foo_bar}}"
+      echo "has_origin: {{has_origin}}"
+      echo "body_not_empty: {{body_not_empty}}"
+    log: "Verifying contains exports"
+
+  # ==========================================================================
+  # Test 3: Response Body with regex_match()
+  # ==========================================================================
+  - name: check-json-regex
+    type: http
+    method: GET
+    url: "https://httpbin.org/json"
+    headers:
+      Accept: "application/json"
+    timeout: 30
+    log: "Testing regex_match() with JSON response"
+    exports:
+      has_slideshow: "regex_match('slideshow', check_json_regex_http_resp.response_body)"
+      has_title_field: "regex_match('\"title\"', check_json_regex_http_resp.response_body)"
+      has_json_object: "regex_match('^\\s*\\{', check_json_regex_http_resp.response_body)"
+      has_author: "regex_match('author', check_json_regex_http_resp.response_body)"
+
+  - name: verify-regex-exports
+    type: bash
+    command: |
+      echo "=== Regex Match Export Tests ==="
+      echo "has_slideshow: {{has_slideshow}}"
+      echo "has_title_field: {{has_title_field}}"
+      echo "has_json_object: {{has_json_object}}"
+      echo "has_author: {{has_author}}"
+    log: "Verifying regex_match exports"
+
+  # ==========================================================================
+  # Test 4: Combined Conditions
+  # ==========================================================================
+  - name: check-combined
+    type: http
+    method: GET
+    url: "https://httpbin.org/get?scan={{target}}"
+    headers:
+      User-Agent: "Osmedeus/1.0"
+    timeout: 30
+    log: "Testing combined status and body conditions"
+    exports:
+      success_with_args: "check_combined_http_resp.status_code == 200 && contains(check_combined_http_resp.response_body, 'args')"
+      valid_json_response: "check_combined_http_resp.status_code == 200 && regex_match('^\\s*\\{', check_combined_http_resp.response_body)"
+      has_scan_param: "contains(check_combined_http_resp.response_body, 'scan') && contains(check_combined_http_resp.response_body, '{{target}}')"
+
+  - name: verify-combined-exports
+    type: bash
+    command: |
+      echo "=== Combined Condition Tests ==="
+      echo "success_with_args: {{success_with_args}}"
+      echo "valid_json_response: {{valid_json_response}}"
+      echo "has_scan_param: {{has_scan_param}}"
+    log: "Verifying combined condition exports"
+
+  # ==========================================================================
+  # Test 5: POST Request with Body Validation
+  # ==========================================================================
+  - name: check-post-echo
+    type: http
+    method: POST
+    url: "https://httpbin.org/post"
+    headers:
+      Content-Type: "application/json"
+      User-Agent: "Osmedeus/1.0"
+    request_body: '{"target": "{{target}}", "action": "scan", "enabled": true}'
+    timeout: 30
+    log: "Testing POST with response body validation"
+    exports:
+      post_success: "check_post_echo_http_resp.status_code == 200"
+      echoed_target: "contains(check_post_echo_http_resp.response_body, '{{target}}')"
+      echoed_action: "contains(check_post_echo_http_resp.response_body, 'scan')"
+      has_json_field: "regex_match('\"json\"\\s*:', check_post_echo_http_resp.response_body)"
+
+  - name: verify-post-exports
+    type: bash
+    command: |
+      echo "=== POST Export Tests ==="
+      echo "post_success: {{post_success}}"
+      echo "echoed_target: {{echoed_target}}"
+      echo "echoed_action: {{echoed_action}}"
+      echo "has_json_field: {{has_json_field}}"
+    log: "Verifying POST exports"
+
+  # ==========================================================================
+  # Final Summary
+  # ==========================================================================
+  - name: test-summary
+    type: bash
+    command: |
+      echo ""
+      echo "========================================="
+      echo "HTTP Exports Test Summary"
+      echo "========================================="
+      echo "Status Tests: is_200={{is_200}}, is_2xx={{is_2xx}}"
+      echo "Contains Tests: has_args={{has_args}}, has_target={{has_target}}"
+      echo "Regex Tests: has_slideshow={{has_slideshow}}, has_title_field={{has_title_field}}"
+      echo "Combined Tests: success_with_args={{success_with_args}}"
+      echo "POST Tests: post_success={{post_success}}, echoed_target={{echoed_target}}"
+      echo "========================================="
+    log: "Test summary"

test/testdata/workflows/test-http.yaml

@@ -0,0 +1,42 @@
+kind: module
+name: test-http
+description: Test workflow for HTTP step type
+tags: test,http,api
+
+params:
+  - name: target
+    required: true
+  - name: api_url
+    default: "https://httpbin.org"
+
+steps:
+  - name: http-get
+    type: http
+    method: GET
+    url: "{{api_url}}/get?target={{target}}"
+    headers:
+      User-Agent: "Osmedeus/1.0"
+      Accept: "application/json"
+    timeout: 30
+    log: "Making GET request to httpbin"
+
+  - name: verify-get
+    type: bash
+    command: 'echo "GET status: {{http_get_http_resp.status_code}}"'
+    log: "Verifying GET response"
+
+  - name: http-post
+    type: http
+    method: POST
+    url: "{{api_url}}/post"
+    headers:
+      Content-Type: "application/json"
+      User-Agent: "Osmedeus/1.0"
+    request_body: '{"target": "{{target}}", "action": "scan"}'
+    timeout: 30
+    log: "Making POST request to httpbin"
+
+  - name: verify-post
+    type: bash
+    command: 'echo "POST status: {{http_post_http_resp.status_code}}"'
+    log: "Verifying POST response"

test/testdata/workflows/test-jsonl-utils.yaml

@@ -0,0 +1,36 @@
+name: test-jsonl-utils
+kind: module
+description: Test JSONL utility functions
+tags: test,jsonl,utilities
+
+params:
+  - name: target
+    required: true
+
+steps:
+  - name: create-jsonl
+    type: bash
+    command: |
+      mkdir -p {{Output}}
+      cat > {{Output}}/in.jsonl << 'EOF'
+      {"name":"Alice","age":30,"hash":{"body_sha256":"abc"}}
+      {"name":"Bob","age":25}
+      {"name":"Alice","age":30,"hash":{"body_sha256":"abc"}}
+      EOF
+
+  - name: jsonl-filter
+    type: function
+    function: jsonl_filter("{{Output}}/in.jsonl", "{{Output}}/filtered.jsonl", "name,hash.body_sha256")
+
+  - name: jsonl-to-csv
+    type: function
+    function: jsonl_to_csv("{{Output}}/in.jsonl", "{{Output}}/out.csv")
+
+  - name: csv-to-jsonl
+    type: function
+    function: csv_to_jsonl("{{Output}}/out.csv", "{{Output}}/back.jsonl")
+
+  - name: jsonl-unique
+    type: function
+    function: jsonl_unique("{{Output}}/in.jsonl", "{{Output}}/unique.jsonl", "name,hash.body_sha256")
+

test/testdata/workflows/test-llm.yaml

@@ -0,0 +1,128 @@
+kind: module
+name: test-llm
+description: Test LLM step execution
+tags: test,llm,quick
+
+params:
+  - name: target
+    required: true
+    default: example.com
+
+steps:
+  # Basic chat completion
+  - name: basic-chat
+    type: llm
+    log: "Running basic chat completion"
+    messages:
+      - role: user
+        content: "Say hello to {{Target}} in one sentence."
+    timeout: 60
+    exports:
+      greeting: "{{basic_chat_content}}"
+
+  # Chat with system prompt
+  - name: with-system-prompt
+    type: llm
+    log: "Running chat with system prompt"
+    messages:
+      - role: system
+        content: "You are a security analyst. Be concise."
+      - role: user
+        content: "What is {{Target}}?"
+    timeout: 60
+
+  # Step-level config override
+  - name: with-config-override
+    type: llm
+    log: "Running with config override"
+    messages:
+      - role: user
+        content: "Describe {{Target}} briefly."
+    llm_config:
+      max_tokens: 100
+      temperature: 0.3
+    timeout: 60
+
+  # Structured JSON output
+  - name: structured-output
+    type: llm
+    log: "Running with structured JSON output"
+    messages:
+      - role: user
+        content: "Return a JSON object with 'target' and 'type' fields for: {{Target}}"
+    llm_config:
+      response_format:
+        type: json_object
+    timeout: 60
+    exports:
+      json_result: "{{structured_output_content}}"
+
+  # Extra LLM parameters
+  - name: extra-params
+    type: llm
+    log: "Running with extra parameters"
+    messages:
+      - role: user
+        content: "What is {{Target}}?"
+    extra_llm_parameters:
+      top_k: 40
+      repeat_penalty: 1.1
+    timeout: 60
+
+  # Multimodal content (example structure - would need actual image)
+  # - name: multimodal
+  #   type: llm
+  #   log: "Running multimodal analysis"
+  #   messages:
+  #     - role: user
+  #       content:
+  #         - type: text
+  #           text: "What do you see in this image?"
+  #         - type: image_url
+  #           image_url:
+  #             url: "data:image/png;base64,{{screenshot_base64}}"
+  #   timeout: 60
+
+  # Tool call example
+  - name: with-tools
+    type: llm
+    log: "Running with tools"
+    messages:
+      - role: user
+        content: "What DNS records exist for {{Target}}?"
+    tools:
+      - type: function
+        function:
+          name: dns_lookup
+          description: "Look up DNS records for a domain"
+          parameters:
+            type: object
+            properties:
+              domain:
+                type: string
+                description: "The domain to look up"
+              record_type:
+                type: string
+                enum: ["A", "AAAA", "MX", "TXT", "NS", "CNAME"]
+            required:
+              - domain
+    tool_choice: auto
+    timeout: 60
+
+  # Embedding example
+  - name: generate-embedding
+    type: llm
+    log: "Generating embeddings"
+    is_embedding: true
+    embedding_input:
+      - "{{Target}} security analysis"
+      - "vulnerability assessment for {{Target}}"
+    timeout: 60
+    exports:
+      embeddings: "{{generate_embedding_llm_resp}}"
+
+  # Use previous export in next step
+  - name: use-greeting
+    type: bash
+    log: "Using greeting from LLM"
+    command: echo "LLM said - {{greeting}}"

test/testdata/workflows/test-loop.yaml

@@ -0,0 +1,25 @@
+name: test-loop
+kind: module
+description: Test foreach loop with threading
+tags: test,foreach,loop
+
+params:
+  - name: target
+    required: true
+
+steps:
+  - name: create-input
+    type: bash
+    commands:
+      - mkdir -p {{Output}}
+      - printf 'one\ntwo\nthree\nfour\nfive\n' > {{Output}}/items.txt
+
+  - name: process-items
+    type: foreach
+    input: "{{Output}}/items.txt"
+    variable: item
+    threads: 2
+    step:
+      name: process-item
+      type: bash
+      command: echo "Processing [[item]] for {{target}}"

test/testdata/workflows/test-multiline.yaml

@@ -0,0 +1,39 @@
+name: test-multiline
+kind: module
+description: Test multi-line functions and commands
+tags: test,multiline,functions
+
+params:
+  - name: target
+    required: true
+  - name: sleep_time
+    default: "2"
+
+steps:
+  # Multi-line bash command
+  - name: multiline-bash
+    type: bash
+    command: |
+      echo "[$(date +%H:%M:%S)] Phase 1: Starting for {{target}}..."
+      sleep {{sleep_time}}
+      echo "[$(date +%H:%M:%S)] Phase 1 complete"
+
+  # Setup test markdown file
+  - name: setup-markdown
+    type: bash
+    command: |
+      echo "# Test Markdown" > /tmp/test-{{target}}.md
+      echo "This is a test file for **{{target}}**" >> /tmp/test-{{target}}.md
+
+  # Multi-line function with variables and render_markdown_from_file
+  - name: multiline-function
+    type: function
+    function: |
+      var content = render_markdown_from_file("/tmp/test-{{target}}.md");
+      log_info("Rendered: " + content);
+      content
+
+  # Cleanup
+  - name: cleanup
+    type: bash
+    command: rm -f /tmp/test-{{target}}.md

test/testdata/workflows/test-parallel-commands.yaml

@@ -0,0 +1,20 @@
+name: test-parallel-commands
+kind: module
+description: Test parallel bash command execution
+tags: test,parallel,bash
+
+params:
+  - name: target
+    required: true
+
+steps:
+  - name: parallel-echo
+    type: bash
+    parallel_commands:
+      - 'echo "command 1: {{target}}"'
+      - 'echo "command 2: {{target}}"'
+      - 'echo "command 3: {{target}}"'
+
+  - name: verify-output
+    type: bash
+    command: echo "All parallel commands completed for {{target}}"

test/testdata/workflows/test-parallel-functions.yaml

@@ -0,0 +1,26 @@
+name: test-parallel-functions
+kind: module
+description: Test parallel function execution
+tags: test,parallel,functions
+
+params:
+  - name: target
+    required: true
+
+steps:
+  - name: setup-test-file
+    type: bash
+    command: echo "test content" > /tmp/parallel-func-test.txt
+
+  - name: parallel-funcs
+    type: function
+    parallel_functions:
+      - trim("  hello  ")
+      - contains("hello world", "world")
+      - fileExists("/tmp/parallel-func-test.txt")
+    exports:
+      func_results: "output"
+
+  - name: cleanup
+    type: bash
+    command: rm -f /tmp/parallel-func-test.txt

test/testdata/workflows/test-parallel-steps.yaml

@@ -0,0 +1,36 @@
+name: test-parallel-steps
+kind: module
+description: Test nested parallel steps with mixed types
+tags: test,parallel,nested
+
+params:
+  - name: target
+    required: true
+
+steps:
+  - name: setup
+    type: bash
+    command: mkdir -p /tmp/parallel-steps-test
+
+  - name: nested-parallel
+    type: parallel-steps
+    parallel_steps:
+      - name: sub-step-1
+        type: bash
+        command: 'echo "sub 1: {{target}}" > /tmp/parallel-steps-test/sub1.txt'
+      - name: sub-step-2
+        type: bash
+        command: 'echo "sub 2: {{target}}" > /tmp/parallel-steps-test/sub2.txt'
+      - name: sub-step-3
+        type: function
+        function: 'trim("  nested  ")'
+
+  - name: verify-files
+    type: function
+    function: fileExists("/tmp/parallel-steps-test/sub1.txt")
+    exports:
+      file_exists: "output"
+
+  - name: cleanup
+    type: bash
+    command: rm -rf /tmp/parallel-steps-test

test/testdata/workflows/test-params-exports.yaml

@@ -0,0 +1,122 @@
+name: test-params-exports
+kind: module
+description: Test workflow for validating params and step exports
+tags: test,params,exports,validation
+
+params:
+  - name: target
+    required: true
+  - name: enable_feature
+    type: string
+    default: "true"
+  - name: skip_validation
+    type: string
+    default: "false"
+  - name: custom_value
+    type: string
+    default: "default_value"
+
+steps:
+  # Step 1: Check if enable_feature param is true
+  - name: check-enable-feature
+    type: bash
+    command: echo "Checking enable_feature={{enable_feature}}"
+    exports:
+      feature_enabled: "{{enable_feature}}"
+    decision:
+      switch: "{{feature_enabled}}"
+      cases:
+        "true":
+          goto: feature-enabled-step
+        "false":
+          goto: feature-disabled-step
+
+  # Step 2a: Executed when feature is enabled
+  - name: feature-enabled-step
+    type: bash
+    command: echo "Feature is ENABLED"
+    exports:
+      feature_status: "ENABLED"
+    decision:
+      switch: "always"
+      cases:
+        "always":
+          goto: check-skip-validation
+
+  # Step 2b: Executed when feature is disabled
+  - name: feature-disabled-step
+    type: bash
+    command: echo "Feature is DISABLED"
+    exports:
+      feature_status: "DISABLED"
+
+  # Step 3: Check skip_validation param
+  - name: check-skip-validation
+    type: bash
+    command: echo "Checking skip_validation={{skip_validation}}"
+    exports:
+      should_skip: "{{skip_validation}}"
+    decision:
+      switch: "{{should_skip}}"
+      cases:
+        "true":
+          goto: validation-skipped
+        "false":
+          goto: run-validation
+
+  # Step 4a: Validation skipped
+  - name: validation-skipped
+    type: bash
+    command: echo "Validation SKIPPED"
+    exports:
+      validation_result: "SKIPPED"
+    decision:
+      switch: "always"
+      cases:
+        "always":
+          goto: export-custom-value
+
+  # Step 4b: Run validation
+  - name: run-validation
+    type: bash
+    command: echo "Validation PASSED"
+    exports:
+      validation_result: "PASSED"
+
+  # Step 5: Export custom_value param and test variable propagation
+  - name: export-custom-value
+    type: bash
+    command: echo "Custom value={{custom_value}}"
+    exports:
+      exported_custom: "{{custom_value}}"
+
+  # Step 6: Verify all exports are accessible from previous steps
+  - name: verify-exports
+    type: bash
+    command: |
+      echo "=== Export Verification ==="
+      echo "feature_enabled: {{feature_enabled}}"
+      echo "feature_status: {{feature_status}}"
+      echo "validation_result: {{validation_result}}"
+      echo "exported_custom: {{exported_custom}}"
+      echo "target: {{target}}"
+      echo "=== All exports verified ==="
+    exports:
+      verification_complete: "true"
+
+  # Step 7: Final summary with all variables
+  - name: final-summary
+    type: bash
+    command: |
+      echo "=== Workflow Summary ==="
+      echo "Target: {{target}}"
+      echo "Enable Feature Param: {{enable_feature}}"
+      echo "Feature Enabled Export: {{feature_enabled}}"
+      echo "Feature Status: {{feature_status}}"
+      echo "Skip Validation Param: {{skip_validation}}"
+      echo "Should Skip Export: {{should_skip}}"
+      echo "Validation Result: {{validation_result}}"
+      echo "Custom Value Param: {{custom_value}}"
+      echo "Exported Custom: {{exported_custom}}"
+      echo "Verification Complete: {{verification_complete}}"
+      echo "=== End Summary ==="

test/testdata/workflows/test-preferences.yaml

@@ -0,0 +1,31 @@
+name: test-preferences
+kind: module
+description: Test workflow preferences feature - demonstrates setting CLI flags in YAML
+
+# Preferences allow setting CLI-like flags directly in the workflow
+# CLI flags always take precedence over these preferences
+preferences:
+  disable_notifications: true    # Equivalent to --disable-notification
+  disable_logging: false         # Equivalent to --disable-logging
+  heuristics_check: 'none'       # Equivalent to --heuristics-check none
+  ci_output_format: false        # Equivalent to --ci-output-format
+  silent: false                  # Equivalent to --silent
+  repeat: false                  # Equivalent to --repeat
+  repeat_wait_time: '30s'        # Equivalent to --repeat-wait-time 30s
+
+params:
+  - name: message
+    default: "Hello from preferences test"
+
+steps:
+  - name: echo-message
+    type: bash
+    command: 'echo "{{message}}"'
+
+  - name: show-target
+    type: bash
+    command: 'echo "Target is {{Target}}"'
+
+  - name: test-function
+    type: function
+    function: 'log_info("Preferences test completed for {{Target}}")'

test/testdata/workflows/test-remote-bash-docker.yaml

@@ -0,0 +1,40 @@
+name: test-remote-bash-docker
+kind: module
+description: Test remote-bash step type with Docker runner
+tags: test,remote-bash,docker
+
+params:
+  - name: target
+    required: true
+
+steps:
+  - name: check-alpine-docker
+    type: remote-bash
+    log: "Running command in Docker container"
+    step_runner: docker
+    step_runner_config:
+      image: alpine:latest
+    command: cat /etc/os-release | grep -i alpine
+
+  - name: run-multiple-docker
+    type: remote-bash
+    log: "Running multiple commands sequentially"
+    step_runner: docker
+    step_runner_config:
+      image: alpine:latest
+    commands:
+      - 'echo "First command: {{target}}"'
+      - echo "Second command"
+      - hostname
+
+  - name: parallel-docker
+    type: remote-bash
+    log: "Running parallel commands"
+    timeout: 30
+    step_runner: docker
+    step_runner_config:
+      image: alpine:latest
+    parallel_commands:
+      - 'echo "Parallel 1: {{target}}"'
+      - 'echo "Parallel 2: {{target}}"'
+      - 'echo "Parallel 3: {{target}}"'

test/testdata/workflows/test-remote-bash-ssh.yaml

@@ -0,0 +1,57 @@
+name: test-remote-bash-ssh
+kind: module
+description: Test remote-bash step type with SSH runner
+tags: test,remote-bash,ssh
+
+params:
+  - name: target
+    required: true
+  - name: ssh_host
+    default: localhost
+  - name: ssh_port
+    default: "2222"
+  - name: ssh_user
+    default: testuser
+  - name: ssh_password
+    default: testpass
+
+steps:
+  - name: check-ssh-connection
+    type: remote-bash
+    log: "Testing SSH connection"
+    step_runner: ssh
+    step_runner_config:
+      host: "{{ssh_host}}"
+      port: 2222
+      user: "{{ssh_user}}"
+      password: "{{ssh_password}}"
+    command: echo "Hello from SSH" && hostname
+
+  - name: run-multiple-ssh
+    type: remote-bash
+    log: "Running multiple commands via SSH"
+    step_runner: ssh
+    step_runner_config:
+      host: "{{ssh_host}}"
+      port: 2222
+      user: "{{ssh_user}}"
+      password: "{{ssh_password}}"
+    commands:
+      - 'echo "Target: {{target}}"'
+      - whoami
+      - pwd
+
+  - name: parallel-ssh
+    type: remote-bash
+    log: "Running parallel commands via SSH"
+    timeout: 30
+    step_runner: ssh
+    step_runner_config:
+      host: "{{ssh_host}}"
+      port: 2222
+      user: "{{ssh_user}}"
+      password: "{{ssh_password}}"
+    parallel_commands:
+      - echo "Parallel 1"
+      - echo "Parallel 2"
+      - echo "Parallel 3"

test/testdata/workflows/test-reports-params.yaml

@@ -0,0 +1,70 @@
+name: test-reports-params
+kind: module
+description: Test that report paths can reference params with nested template variables
+tags: test,reports,params
+
+params:
+  - name: target
+    required: true
+  - name: dnsFile
+    type: string
+    default: "{{Output}}/probing/dns-{{TargetSpace}}.txt"
+  - name: httpFile
+    type: string
+    default: "{{Output}}/probing/http-results.txt"
+
+reports:
+  - name: dns-results
+    path: "{{dnsFile}}"
+    type: text
+  - name: http-results
+    path: "{{httpFile}}"
+    type: text
+
+steps:
+  - name: setup-directories
+    type: bash
+    commands:
+      - mkdir -p {{Output}}/probing
+
+  - name: create-dns-file
+    type: bash
+    command: |
+      echo "ns1.{{Target}}" > {{dnsFile}}
+      echo "DNS file created at: {{dnsFile}}"
+
+  - name: create-http-file
+    type: bash
+    command: |
+      echo "http://{{Target}}:80" > {{httpFile}}
+      echo "HTTP file created at: {{httpFile}}"
+
+  - name: verify-files
+    type: bash
+    command: |
+      echo "DNS file exists: $(test -f {{dnsFile}} && echo 'yes' || echo 'no')"
+      echo "HTTP file exists: $(test -f {{httpFile}} && echo 'yes' || echo 'no')"
+
+  - name: read-dns-content
+    type: bash
+    command: |
+      echo "=== DNS File Content ==="
+      cat {{dnsFile}}
+      echo "=== End DNS Content ==="
+
+  - name: read-http-content
+    type: bash
+    command: |
+      echo "=== HTTP File Content ==="
+      cat {{httpFile}}
+      echo "=== End HTTP Content ==="
+
+  - name: final-summary
+    type: bash
+    command: |
+      echo "=== Reports Params Summary ==="
+      echo "Target: {{Target}}"
+      echo "TargetSpace: {{TargetSpace}}"
+      echo "DNS File Path: {{dnsFile}}"
+      echo "HTTP File Path: {{httpFile}}"
+      echo "=== All Reports Verified ==="

test/testdata/workflows/test-requirements-fail.yaml

@@ -0,0 +1,21 @@
+name: test-requirements-fail
+kind: module
+description: Test workflow dependency validation (failure case)
+tags: test,requirements,validation
+
+dependencies:
+  commands:
+    - echo
+    - nonexistent-tool-xyz-12345
+  files:
+    - /tmp
+    - /nonexistent/path/xyz
+
+params:
+  - name: target
+    required: true
+
+steps:
+  - name: should-not-reach
+    type: bash
+    command: echo "Should not reach here"

test/testdata/workflows/test-requirements.yaml

@@ -0,0 +1,24 @@
+name: test-requirements
+kind: module
+description: Test workflow dependency validation (success case)
+tags: test,requirements,validation
+
+dependencies:
+  commands:
+    - echo
+    - cat
+  files:
+    - /tmp
+  variables:
+    - name: target
+      type: string
+      required: true
+
+params:
+  - name: target
+    required: true
+
+steps:
+  - name: requirements-passed
+    type: bash
+    command: echo "All requirements satisfied for {{target}}"

test/testdata/workflows/test-runner.yaml

@@ -0,0 +1,20 @@
+name: test-runner
+kind: module
+description: Test runner configuration
+tags: test,runner,host
+
+# This module runs on the local host (default)
+runner: host
+
+params:
+  - name: target
+    required: true
+
+steps:
+  - name: echo-runner-type
+    type: bash
+    command: echo "Running on host with target={{target}}"
+
+  - name: show-hostname
+    type: bash
+    command: hostname

test/testdata/workflows/test-sleep-flow.yaml

@@ -0,0 +1,26 @@
+name: test-sleep-flow
+kind: flow
+description: Flow that orchestrates multiple sleep modules (~60s total)
+tags: test,flow,sleep
+
+params:
+  - name: target
+    required: true
+
+modules:
+  - name: recon-phase
+    path: modules/test-sleep-module
+    params:
+      sleep_time: "10"
+
+  - name: parallel-phase
+    path: modules/test-sleep-parallel
+    depends_on:
+      - recon-phase
+
+  - name: final-phase
+    path: modules/test-sleep-module
+    params:
+      sleep_time: "5"
+    depends_on:
+      - parallel-phase

test/testdata/workflows/test-sleep-module.yaml

@@ -0,0 +1,37 @@
+name: test-sleep-module
+kind: module
+description: Module that simulates long-running tasks with sleep
+tags: test,sleep,simulation
+
+params:
+  - name: target
+    required: true
+  - name: sleep_time
+    default: "5"
+
+steps:
+  - name: start-task
+    type: function
+    function: sleep(2)
+
+  - name: phase-1-sleep
+    type: bash
+    command: echo "[$(date +%H:%M:%S)] Starting long task for {{target}}"
+
+  - name: phase-2-sleep
+    type: bash
+    command: |
+      echo "[$(date +%H:%M:%S)] Phase 2: Simulating scanning..."
+      sleep {{sleep_time}}
+      echo "[$(date +%H:%M:%S)] Phase 2 complete"
+
+  - name: phase-3-sleep
+    type: bash
+    command: |
+      echo "[$(date +%H:%M:%S)] Phase 3: Simulating analysis..."
+      sleep {{sleep_time}}
+      echo "[$(date +%H:%M:%S)] Phase 3 complete"
+
+  - name: finish-task
+    type: bash
+    command: echo "[$(date +%H:%M:%S)] All phases complete for {{target}}"

test/testdata/workflows/test-sleep-parallel.yaml

@@ -0,0 +1,41 @@
+name: test-sleep-parallel
+kind: module
+description: Module that runs parallel sleep tasks
+tags: test,parallel,sleep
+
+params:
+  - name: target
+    required: true
+
+steps:
+  - name: setup
+    type: bash
+    command: echo "[$(date +%H:%M:%S)] Starting parallel sleep test for {{target}}"
+
+  - name: parallel-sleeps
+    type: parallel-steps
+    parallel_steps:
+      - name: sleep-task-a
+        type: bash
+        command: |
+          echo "[$(date +%H:%M:%S)] Task A starting (15s)..."
+          sleep 15
+          echo "[$(date +%H:%M:%S)] Task A complete"
+
+      - name: sleep-task-b
+        type: bash
+        command: |
+          echo "[$(date +%H:%M:%S)] Task B starting (10s)..."
+          sleep 10
+          echo "[$(date +%H:%M:%S)] Task B complete"
+
+      - name: sleep-task-c
+        type: bash
+        command: |
+          echo "[$(date +%H:%M:%S)] Task C starting (5s)..."
+          sleep 5
+          echo "[$(date +%H:%M:%S)] Task C complete"
+
+  - name: finish
+    type: bash
+    command: echo "[$(date +%H:%M:%S)] All parallel tasks complete (took ~15s total)"

test/testdata/workflows/test-ssh-runner.yaml

@@ -0,0 +1,20 @@
+name: test-ssh-runner
+kind: module
+description: Test SSH runner execution
+tags: test,runner,ssh
+
+runner: ssh
+runner_config:
+  host: localhost
+  port: 2222
+  user: testuser
+  password: testpass
+
+params:
+  - name: target
+    required: true
+
+steps:
+  - name: check-remote
+    type: bash
+    command: echo "Hello from SSH" && hostname

test/testdata/workflows/test-structured-args.yaml

@@ -0,0 +1,36 @@
+kind: module
+name: test-structured-args
+description: Test workflow for structured argument fields
+tags: test,bash,args
+
+params:
+  - name: target
+    required: true
+  - name: threads
+    default: "10"
+  - name: rate
+    default: "100"
+  - name: config_file
+    default: "config.yaml"
+
+steps:
+  - name: test-with-all-args
+    type: bash
+    command: "echo 'Running tool'"
+    speed_args: "-t {{threads}} --rate {{rate}}"
+    config_args: "-c {{config_file}}"
+    input_args: "-i {{target}}"
+    output_args: "-o output.txt"
+    log: "Testing structured args with all fields"
+
+  - name: test-with-some-args
+    type: bash
+    command: "echo 'Running second tool'"
+    speed_args: "-t {{threads}}"
+    input_args: "-target {{target}}"
+    log: "Testing structured args with some fields"
+
+  - name: test-without-args
+    type: bash
+    command: "echo 'Hello {{target}}'"
+    log: "Testing without structured args"

test/testdata/workflows/test-target-types.yaml

@@ -0,0 +1,18 @@
+name: test-target-types
+kind: module
+description: Test dependencies target_types with domain and url
+tags: test,dependencies,target-types
+
+params:
+  - name: target
+    required: true
+
+dependencies:
+  target_types:
+    - domain
+    - url
+
+steps:
+  - name: echo-ok
+    type: bash
+    command: echo "OK for {{target}}"

test/testdata/workflows/test-timeout-exceed.yaml

@@ -0,0 +1,14 @@
+name: test-timeout-exceed
+kind: module
+description: Test step timeout exceeded (1s timeout, 10s sleep)
+tags: test,timeout,error
+
+params:
+  - name: target
+    required: true
+
+steps:
+  - name: slow-command
+    type: bash
+    command: sleep 10
+    timeout: 1

test/testdata/workflows/test-timeout.yaml

@@ -0,0 +1,19 @@
+name: test-timeout
+kind: module
+description: Test step timeout handling (success case)
+tags: test,timeout,quick
+
+params:
+  - name: target
+    required: true
+
+steps:
+  - name: quick-command
+    type: bash
+    command: echo "fast command for {{target}}"
+    timeout: 5
+
+  - name: another-quick-command
+    type: bash
+    command: echo "another fast command"
+    timeout: 10

test/testdata/workflows/test-trigger-cron.yaml

@@ -0,0 +1,22 @@
+name: test-trigger-cron
+kind: module
+description: Test cron trigger
+tags: test,trigger,cron
+
+trigger:
+  - name: every-minute
+    on: cron
+    schedule: "* * * * *"
+    enabled: true
+  - name: manual
+    on: manual
+    enabled: true
+
+params:
+  - name: target
+    required: true
+
+steps:
+  - name: log-execution
+    type: bash
+    command: echo "Cron triggered at $(date)" >> /tmp/cron-test.log

test/testdata/workflows/test-trigger-event.yaml

@@ -0,0 +1,27 @@
+name: test-trigger-event
+kind: module
+description: Test event-based trigger
+tags: test,trigger,event
+
+trigger:
+  - name: on-new-asset
+    on: event
+    event:
+      topic: "assets.new"
+      filters:
+        - "event.source == 'test'"
+    input:
+      type: event_data
+      field: "url"
+      name: target
+    enabled: true
+
+    
+params:
+  - name: target
+    required: true
+
+steps:
+  - name: process-asset
+    type: bash
+    command: 'echo "New asset discovered: {{target}}"'

test/testdata/workflows/test-trigger-watch.yaml

@@ -0,0 +1,19 @@
+name: test-trigger-watch
+kind: module
+description: Test file watch trigger
+tags: test,trigger,watch
+
+trigger:
+  - name: watch-files
+    on: watch
+    path: "/tmp/watch-test"
+    enabled: true
+
+params:
+  - name: target
+    required: true
+
+steps:
+  - name: process-change
+    type: bash
+    command: echo "File changed in watch path"