Add bug bounty mode with strict scope enforcement.

Introduce bug bounty policy models, CLI/API policy inputs, session policy persistence, and planner plus runtime scope gates that block out-of-scope invocations before tool execution.

Author: Av7danger

README.md

@@ -114,13 +114,18 @@ secnodeapi --target https://api.example.com/swagger.json --auth-header "Authoriz
 secnodeapi --target https://api.example.com/swagger.json --proxy http://127.0.0.1:8080 --insecure
 secnodeapi --target https://api.example.com/swagger.json --mode agent --request-budget 500 --max-iterations 6
 secnodeapi --target https://api.example.com/swagger.json --mode microservices
+secnodeapi --target https://api.example.com --mode bugbounty --program "Acme BBP" --scope host:api.example.com --scope path:/api --bb-instruction "Only test assigned API assets"
+```
+
+```bash
+secnodeapi-tui --target https://api.example.com --backend local
+secnodeapi-tui --target https://api.example.com --backend remote --api-base-url http://127.0.0.1:8000
 ```
 
 ### Key options
 
 - `--target` URL or local path to OpenAPI schema (required)
-- `--mode` `agent` (default) or `legacy` execution pipeline
-- `--mode` `agent`, `legacy`, or `microservices`
+- `--mode` `agent`, `legacy`, `microservices`, `greybox`, or `bugbounty`
 - `--concurrency` concurrent request workers
 - `--auth-header` single inline auth header
 - `--auth-file` JSON file of auth headers
@@ -133,6 +138,25 @@ secnodeapi --target https://api.example.com/swagger.json --mode microservices
 - `--max-iterations` max plan/execute loops in agent mode
 - `--proxy` route traffic via proxy
 - `--insecure` disable TLS verification for controlled environments
+- `--scope` bug bounty scope entries (`host:`, `path:`, `method:`, `deny-host:`, `deny-path:`)
+- `--scope-file` JSON scope config for bug bounty mode
+- `--bb-instruction` repeatable bug bounty instruction passed to planning and enforcement
+- `--program` bug bounty program identifier for session metadata
+
+TUI command highlights:
+
+- `/scan <target>` create and run a scan session
+- `/skill <name>` run a selected skill
+- `/sessions` list saved snapshots from `~/.api-agent/sessions`
+- `/load <session-id>` load a saved snapshot into TUI panels
+
+### Bug bounty strict scope mode
+
+`--mode bugbounty` enables strict scope enforcement. When this mode is active, out-of-scope invocations are blocked at both planning and runtime.
+
+- Scope is required via `--scope` or `--scope-file`
+- Rules are persisted with the session policy
+- Any invocation outside allowed host/path/method constraints is rejected before tool execution
 
 ## Output