feat(scan): add -concurrency flag to scan targets in parallel (#367)

* refactor(cli): extract per-target scan into scanTarget

pull the target loop body into scanTarget, which returns a targetScan
holding that target's findings, report rows, scan labels and log files
instead of appending onto run-wide slices. the run loop merges those in
target order and finishRun handles the post-loop notify/silent/report/
summary steps. behavior is identical for the sequential run today; the
isolation is the seam a bounded worker pool needs next.

* feat(cli): scan targets in parallel with -concurrency

add -concurrency N (default 1) to run the per-target scan pool over
several targets at once. scanTarget already returns isolated
accumulators, so workers share only the console: output.SetConcurrent
serializes sink writes and de-animates spinners/progress so parallel
lines stay whole. results merge in input order, and concurrency 1 keeps
the sequential path unchanged.

Author: TBX3D

internal/config/config.go

@@ -40,6 +40,7 @@ type Settings struct {
 	Git               bool
 	Whois             bool
 	Threads           int
+	Concurrency       int
 	Nuclei            bool
 	JavaScript        bool
 	Timeout           time.Duration
@@ -171,6 +172,7 @@ func registerFlags(settings *Settings) *goflags.FlagSet {
 		flagSet.DurationVarP(&settings.Timeout, "timeout", "t", 10*time.Second, "HTTP request timeout"),
 		flagSet.StringVarP(&settings.LogDir, "log", "l", "", "Directory to store logs in"),
 		flagSet.IntVar(&settings.Threads, "threads", 10, "Number of threads to run scans on"),
+		flagSet.IntVar(&settings.Concurrency, "concurrency", 1, "Number of targets to scan in parallel (>1 interleaves console output)"),
 		flagSet.StringVar(&settings.Template, "template", "", "Load scan settings from a template (preset minimal/recon/full, or a local yaml file)"),
 	)
 
@@ -241,5 +243,11 @@ func Parse() *Settings {
 		settings.Threads = minThreads
 	}
 
+	// concurrency bounds the target worker pool; floor it so 0/negative means
+	// sequential rather than a stalled or panicking pool.
+	if settings.Concurrency < 1 {
+		settings.Concurrency = 1
+	}
+
 	return settings
 }

internal/output/output.go

@@ -17,6 +17,7 @@ import (
 	"io"
 	"os"
 	"strings"
+	"sync"
 
 	"github.com/charmbracelet/lipgloss"
 )
@@ -154,6 +155,40 @@ func Silent() bool {
 	return silent
 }
 
+// concurrent is set when multiple targets are scanned in parallel. it serializes
+// sink writes so lines from different targets never garble, and disables live
+// widgets, which cannot share one terminal across goroutines.
+var concurrent bool
+
+// SetConcurrent switches the sink into parallel-safe mode: writes go through a
+// mutex and interactive widgets (spinners, live progress) are gated off. call it
+// once before launching target workers; it is not meant to be toggled back.
+func SetConcurrent(enabled bool) {
+	concurrent = enabled
+	if enabled {
+		sink = &lockingWriter{w: sink}
+	}
+}
+
+// Concurrent reports whether parallel-target mode is active; widget code gates on
+// it so spinners and progress bars stay silent when targets interleave.
+func Concurrent() bool {
+	return concurrent
+}
+
+// lockingWriter serializes concurrent writes to the wrapped sink so one target's
+// line is never interleaved mid-write with another's.
+type lockingWriter struct {
+	mu sync.Mutex
+	w  io.Writer
+}
+
+func (l *lockingWriter) Write(p []byte) (int, error) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	return l.w.Write(p)
+}
+
 // Writer is the current chrome sink (stdout normally, stderr under -silent).
 // callers that render their own chrome (the startup banner) write here so it
 // follows the same routing as everything else.
@@ -286,7 +321,9 @@ func (m *ModuleLogger) Complete(resultCount int, resultType string) {
 // ClearLine clears the current line (for progress bar updates). silent mode is
 // non-interactive, so there's no live line to clear and stdout stays untouched.
 func ClearLine() {
-	if !IsTTY || silent {
+	// under -concurrency there is no single live line to clear, and emitting the
+	// escape would wipe whatever another target just wrote.
+	if !IsTTY || silent || concurrent {
 		return
 	}
 	fmt.Fprint(sink, "\033[2K\r")

internal/output/progress.go

@@ -91,7 +91,9 @@ func (p *Progress) Resume() {
 
 // Done clears the progress bar line
 func (p *Progress) Done() {
-	if apiMode || !IsTTY {
+	// under -concurrency there is no live line to clear (render printed milestones),
+	// and clearing would wipe another target's output.
+	if apiMode || !IsTTY || concurrent {
 		return
 	}
 	ClearLine()
@@ -102,8 +104,9 @@ func (p *Progress) render() {
 		return
 	}
 
-	// In non-TTY mode, print progress at milestones only
-	if !IsTTY {
+	// In non-TTY mode, or under -concurrency, print progress at milestones only
+	// rather than redrawing a live line that parallel targets would corrupt.
+	if !IsTTY || concurrent {
 		current := atomic.LoadInt64(&p.current)
 		total := p.total
 		if total <= 0 {

internal/output/spinner.go

@@ -54,8 +54,9 @@ func (s *Spinner) Start() {
 	s.done = make(chan struct{})
 	s.mu.Unlock()
 
-	// In non-TTY mode, just print the message once
-	if !IsTTY {
+	// In non-TTY mode, or when targets scan in parallel, just print the message
+	// once: a shared animated line can't be driven from concurrent goroutines.
+	if !IsTTY || concurrent {
 		fmt.Fprintf(sink, "    %s...\n", s.message)
 		return
 	}