Commit Graph
11 Commits
Author SHA1 Message Date
BaaRai aaf966872a feat: each test package runs on its own database
agent, db, server and evidence serialized on one shared test database via an advisory lock, while evidence, llmrec and traffic-style packages could still run against it in parallel; under full-suite load that window produced a real SQLSTATE 40P01 deadlock in the blackboard direct-source test. TestMain in every PG-using package now rewrites ARTEX_PG_DSN to a per-package database (created automatically by ensureDatabase), so packages neither contend nor need to serialize; the advisory lock stays as an in-package safety net. llmrec gains the TestMain it lacked, which also gives its requires-isolated-DSN tests a truly isolated database inside ./... runs.
2026-10-12 18:43:29 +02:00
BaaRai e233c02314 Translate all Chinese text to English
Comments, doc comments, UI labels, log and error messages, LLM prompt
strings, markdown docs, test data and assertions. Identifiers, enum
keys, routes, placeholders and code structure are unchanged.

Notes:
- docs/漏洞流量证据.md renamed to docs/vulnerability-traffic-evidence.md
- tests that exercised CJK specific handling (GBK zip names, Chinese
  full text search) now use ASCII equivalents; go build passes and the
  test suite matches the pre translation baseline (remaining failures
  need a PostgreSQL DSN and fail identically on the original)
- frontend mention syntax now uses English kinds (finding, asset, ...)
  matching the backend, chat mentions tests pass
2026-10-08 23:14:34 +02:00
Autumn-27 66b7006c69 fix bug 2026-10-07 07:45:28 -04:00
Autumn-27 5825b3f80c feat(intercept): 新增内置拦截规则「删除类接口路径」
内置的 HTTP 破坏性规则只认 DELETE 方法(curl -X DELETE、requests.delete(、
method:'DELETE'),路径类规则的词表又只有 /clear /wipe /flush /purge /truncate
/drop /destroy /factory-reset /reset-all。而多数应用的删除接口用 GET/POST 就能
触发,于是 `curl 'http://t/api/user/delete?id=1'` 不命中任何内置规则,会真实删掉
目标数据。

补一条 deny 规则覆盖 /delete /del /remove /unlink /erase /destroy,允许
/deleteAll、/delete_user、/delete-user 这类后缀形式(destroy 是重复覆盖:v1 那条
不允许后缀,/destroyAll 是漏的)。动词后强制跟分隔符,/delivery、/details、
/delta、/delegate 不会被误拦。

种子走独立标记位 intercept_default_rules_v3,已有实例升级后也会拿到——改 v1 的
字面量对老库无效(标记位已是 done)。插入带 WHERE NOT EXISTS 兜底,标记位丢失也
不会插重复。正则提为包级常量,配纯正则单测(不依赖 DB)覆盖命中与误伤两侧。
2026-09-30 04:12:57 -04:00
Autumn-27 228674a2ce feat: 新增资产拦截规则(全局黑名单)增删改查
新增独立于命令拦截(intercept_rules)的资产拦截功能,仅提供规则的
存储与管理;具体匹配/拦截逻辑另行实现。

- db: 新增 asset_intercept_rules 表(schema.sql,幂等)与 CRUD 层
  (db/asset_intercept.go);kind 支持全等/模糊的 域名·IP·URL 及 CIDR
- db: 首启动 seed 内置模糊拦截政府(.gov/.gov.cn)与教育(.edu/.edu.cn)
  网站,settings 标记位门控,可禁用/删除且重启不复活
- server: /api/asset-intercept/rules 的 list/create/update/delete/toggle;
  cidr、exact_ip 做格式校验
- web: 新增「资产拦截」页(/system/intercept/assets)与侧边栏入口、
  api 与类型定义
2026-09-19 07:58:23 -04:00
pphua 7df4406d44 fix: prevent OOM when archiving large tasks 2026-08-28 15:25:20 +08:00
pphua 0f465825da feat(tasks): add runtime controls and inherited context 2026-08-24 19:29:00 +08:00
pphua 259a0ae965 同步 2026-08-24 14:14:15 +08:00
Autumn-27 46b7cdbeed feat: spawn_task 补 seed_first_intent + 破坏性/外泄 gating 移入可删除的 DB 拦截规则
- spawn_task 新增 seed_first_intent 参数(默认 false),与 HTTP createTask 对齐;
  简单任务可开启直接下发一条种子意图开跑测试
- guard.go 删除写死的 reDestructive/reExfil gating,preToolUse 仅记审计后走拦截规则
- db 新增 seedDefaultInterceptRulesV2:破坏性系统命令(默认开)/数据外泄管道(默认关)
  以普通[内置]规则 seed,可禁用可删除;独立 v2 迁移标志兼容老库
2026-08-15 05:30:47 -04:00
Autumn-27andClaude Opus 4.8 3f798ec74e chore(docker): 预装 Playwright MCP/CLI 及 chromium
镜像内全局预装 @playwright/mcp、@playwright/cli、playwright,并
`playwright install --with-deps chromium` 预置浏览器及系统依赖,运行时
不再联网下载。browser MCP 启动参数去掉 -y 与 @latest(改用已装好的本地版本)。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-28 11:52:53 -04:00
Autumn-27andClaude Opus 4.8 0ef8561411 chore: ARTEX 初始化
ARTEX — AI 自主渗透测试系统(Go 后端 + Next.js 前端,单二进制内嵌)。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-26 04:27:45 -04:00