feat: v0.6.0 — rand, quota, stdin support, Bitcoin IOC extraction, file flags

[alex27riva]

Summary

• New rand command: cryptographically secure random string generation (base64, hex subcommands, configurable length)
• New quota command: check remaining API quota for VirusTotal, AbuseIPDB, and URLScan
• strings command: now reads from stdin when no file is given; renamed flags (-n min-length, --unicode for non-ASCII mode)
• ip command: accepts IP from stdin (echo 1.2.3.4 | soc-cli ip)
• defang / fang commands: new --file / -f flag to process a list of IOCs from a file
• extract-ioc command: extracts Bitcoin addresses, new --no-domains flag, filters false-positive domains with common file extensions, cleaner code structure
• url-scan command: --visibility flag (public/unlisted/private), --debug flag for structured slog output, proper HTTP status error handling
• Windows ARM64 support added to build.sh
• Makefile replaces dev-build.sh with make dev / make build targets
• AGENTS.md added for AI coding assistant guidance
• Version bumped to v0.6.0

Test plan

• soc-cli rand base64 32 and soc-cli rand hex 16 produce correct-length output
• soc-cli quota shows quota for each configured API key
• echo 1.2.3.4 | soc-cli ip works without positional arg
• soc-cli defang -f demo/defanged_ips.txt defangs each line
• soc-cli fang -f demo/defanged_ips.txt re-fangs each line
• soc-cli extract-ioc demo/incident_report.txt extracts Bitcoin addresses
• soc-cli extract-ioc demo/incident_report.txt --no-domains suppresses domain output
• soc-cli strings demo/test_strings.bin extracts ASCII strings from binary
• cat demo/test_strings.bin | soc-cli strings works via stdin
• soc-cli url-scan --visibility public <url> uses correct visibility
• make dev builds successfully

🤖 Generated with Claude Code