feat: per-module timeouts, config validate, CLI polish and core refactors

AGENTS.md

@@ -9,7 +9,7 @@ ScanForge is a Go CLI that orchestrates external recon/security tools into a sin
 - Every scanner is a `modules.Module` (`internal/modules/module.go`) declaring `Name()`, `Description()`, `Requires()`, `Produces()`, and `Run(ctx, *RunContext, runner.Executor)`.
 - `internal/orchestrator` builds a DAG from the modules selected by a profile, rejects duplicate producers/cycles/unresolvable deps at build time, then executes ready modules in waves (concurrent per wave, in profile-declared order for determinism). Upstream failure marks dependents `skipped` rather than aborting.
 - New scanner integrations: add `internal/modules/<tool>/<tool>.go`, then wire it into `buildRegistry()` in `internal/app/app.go` (modules take `cfg.ToolPath("<tool>")`). Follow `internal/modules/dnsx/dnsx.go` as the pattern.
-- Scope enforcement is the central security boundary. `internal/modules/context.go` `filterArtifact` is the single choke point: every line-oriented text artifact named in `scopedTextArtifacts` (subdomains, resolved_hosts, alive_urls, crawled_urls, open_ports, historical_urls) is filtered against the scope before any downstream module reads it; rejections land in `00_meta/scope-rejections.jsonl`. Adding a module that produces one of these artifacts needs no extra wiring. Never re-derive targets by parsing tool output directly.
+- Scope enforcement is the central security boundary. `internal/modules/context.go` `filterArtifact` is the single choke point: every line-oriented text artifact declared with `Scoped: true` (or named in the legacy `scopedTextArtifacts` allowlist: subdomains, resolved_hosts, alive_urls, crawled_urls, open_ports, historical_urls, attack_surface_urls) is filtered against the scope before any downstream module reads it; rejections land in `00_meta/scope-rejections.jsonl`. New modules producing host/URL/IP/host:port list artifacts must set `Artifact.Scoped: true` — do not rely on the allowlist alone. Raw tool outputs (JSONL/XML) and derived data (wordlists, paths, secrets) must NOT set `Scoped`. Never re-derive targets by parsing tool output directly.
 - Modules must execute through the injected `runner.Executor` (never `os/exec` directly); `--dry-run` selects `NewDryRunExecutor`, which records commands without network access.
 - `scanforge plan TARGET --preset deep` prints the validated waves without running anything — use it to sanity-check profiles before `run`.
 - `scanforge.yaml` is user config (gitignored); `scope.txt` is an example scope file (also gitignored). Scope is mandatory, config is not. Runs land in `runs/<target>/<timestamp>/` (dirs `00_meta/`…`06_vulns/`, plus `report.json`/`report.md`).

docs/USAGE.md

@@ -64,6 +64,16 @@ profiles:
     - nuclei
 ```
 
+Per-module time limits are set under `module_timeouts` with Go durations. A
+module exceeding its limit is killed and reported as failed, and its
+dependents are skipped; unset modules keep their own default:
+
+```yaml
+module_timeouts:
+  nuclei: 45m
+  katana: 20m
+```
+
 ## Built-in nuclei templates
 
 `--nuclei-include-custom` adds the templates bundled in the `templates/`

docs/fr/USAGE.md

@@ -64,6 +64,17 @@ profiles:
     - nuclei
 ```
 
+Les limites de temps par module se configurent sous `module_timeouts` avec des
+durées Go. Un module qui dépasse sa limite est tué et signalé comme échoué, et
+ses dépendants sont marqués `skipped` ; les modules sans limite gardent leur
+défaut :
+
+```yaml
+module_timeouts:
+  nuclei: 45m
+  katana: 20m
+```
+
 ## Templates nuclei intégrés
 
 `--nuclei-include-custom` ajoute au run nuclei les templates livrés dans le

docs/zh/USAGE.md

@@ -60,6 +60,16 @@ profiles:
     - nuclei
 ```
 
+每个模块的时间限制在 `module_timeouts` 下配置，使用 Go 时长格式。超过限制的
+模块会被终止并标记为失败，其依赖模块会被标记为 `skipped`；未配置的模块使用
+各自的默认值：
+
+```yaml
+module_timeouts:
+  nuclei: 45m
+  katana: 20m
+```
+
 ## 推荐流程
 
 首先检查依赖和计划：