PromptOverride, WrapupOverride, WrapupMaxTurnsOverride,
WrapupTaskTimeoutOverride and WrapupTaskTimeoutTurnsOverride are wired
in server.New while restored tasks may already render prompts and build
settlement configs on other goroutines. go test -race ./server reported
races between server.New (server.go:195/207/215) and agent.renderSystem /
resolveWrapup / resolveWrapupTurns.
Same treatment as the tool hooks: unexported variables behind a
sync.RWMutex (one for the prompt hook, one shared by the four wrap-up
hooks), Set* setters and getters, and readers that copy the function
value under the lock and call it outside. A nil hook still means the
built-in default.
TestAgentHooksConcurrentSwap now covers all eight hooks.
server wiring (wireAgentAugment, wireTools) assigned the package-level
hooks agent.ToolAugment and agent.ToolResolve while restored tasks could
already be running AugmentTools on other goroutines. go test -race ./server
reported this as a DATA RACE between agent.AugmentTools and
server.wireAgentAugment.
Each hook is now an unexported variable behind a sync.RWMutex, with a
setter (SetToolAugment, SetToolResolve) and a getter (ToolAugment(),
ToolResolve()). AugmentTools copies the function value through the getter
and calls it outside the lock. A nil hook still means no augmentation /
no resolution, as before.
FindingTrafficBindingEnabled is wired in the same server/assembly.go code
and read on the same AugmentTools path, so it gets the same treatment.
Adds TestAugmentToolsHooksConcurrentSwap, which runs AugmentTools while
the setters swap the hooks, so -race catches an unsynchronised access
without depending on test ordering.
applyMigrations now fails closed, before any write, when a pending
migration has a version below the highest version recorded in
schema_migrations: migrations must be appended, never inserted.
Move the llm_records and llm_usage DDL out of Go constants into embedded
files db/migrations/0001_llm_records.sql and 0002_llm_usage.sql (byte-for-byte
the old constants). Open now applies pending migrations after schema.sql and
before seedBuiltins, under the existing schema advisory lock and on the
lock-holding connection. Each migration runs in its own transaction with its
schema_migrations row (version, name, SHA-256 checksum, applied_at).
Open fails closed when the database has a version missing from the binary, or
an applied migration whose file name or checksum changed. A failing migration
is rolled back and blocks startup; earlier ones stay applied.
EnsureLLMRecordsTable and EnsureLLMUsageTable re-run the embedded files and
keep their transaction-level schema lock; Open never calls them.
restoreArchiveAssets inserted archived service and endpoint rows with
their raw url, and findArchiveAssetNaturalID matched on that raw value.
An archive taken before normalizeURL dropped userinfo therefore restored
http://user:pass@host in clear and duplicated the existing clean row.
Pass row["url"] through normalizeURL for service and endpoint rows
before the natural-identity lookup, so the lookup reuses the clean row
and an insert stores the normalised URL. Other columns keep their
archived values.
UpsertHTTPService and UpsertEndpoint both key assets.url on normalizeURL,
which lowercased scheme and host but kept u.User. A URL passed with
user:pass@ (insert_assets, server imports, sync) was stored verbatim and
the same URL with different credentials produced separate rows.
Set u.User = nil before serialising. Scheme, host, port, path and query
are unchanged; an @ in the path or query is preserved.
Tests: normalizeURL unit cases, plus PG tests for both upserts covering
credential stripping, dedup across different credentials, @ in path,
and an unchanged URL without userinfo.
scanURL kept the userinfo of httpx, ffuf and nuclei URLs, so a line such
as http://user:pass@host/path stored the credentials in assets.url, in
the notable items and in the facts. scanURL now drops u.User before
re-serializing; scheme, host, port, path and query are kept.
The nuclei fact detail also embedded the raw host and matched-at values,
the httpx detail the raw host and the ffuf detail the raw redirect
location. They now go through stripUserinfo, which removes only the
userinfo of a URL or bare host:port and keeps every other byte, so a
value without userinfo is unchanged and fact deduplication is the same.
bbotTyped drops the userinfo of the typed url of an in-scope URL event
before it becomes an asset.
Rows already stored with userinfo are not rewritten here.
A `defer d.Close()` runs when the test function returns, before its
t.Cleanup functions. The cleanups that delete the test's rows then ran on
a closed pool, the error was ignored, and the rows stayed in the database
for the next run. PR #220 fixed three files; this applies the same pattern
to every remaining db test that combines `defer d.Close()` with row
cleanups.
- Close the pool with t.Cleanup, registered before the row cleanups so it
runs last (LIFO).
- Report cleanup errors with t.Errorf through small helpers in
db/cleanup_helpers_test.go. A profile the test already deleted is not an
error.
Test files only. No assertion or production change.
TestPoolProfilesOrder, TestProfileRetryRoundTrip and
TestProfileRetryClampedOnSave closed the pool with defer d.Close(), which
runs before t.Cleanup, so the row-deleting cleanup hit a closed pool and its
error was discarded. The fixed profile names then collided with the
llm_profiles name unique key on the next run. Close via t.Cleanup registered
first, give the profiles per-run names, and report cleanup errors.
TestLLMRetryPolicyRoundTrip had the same ordering and now restores the
setting before the pool closes.
TestCompanyScopeAttribution derived its names from MAX(assets.id) and never
removed its company, so the next pass found the old company holding the same
fixed 198.51.100.0/24 scope and the in-CIDR IP was attributed to it. Use a
time plus random suffix and a per-run /24 from 198.18.0.0/15, delete the
company (its scope cascades) after the assets, and report cleanup errors.
- release job: attest dist/*.zip with actions/attest-build-provenance
(id-token: write, attestations: write; contents stays write for the Release).
- SBOM: syft scans the bin-linux-amd64 binary (embedded Go modules), plus
web/package-lock.json and go.mod/go.sum; artex-<tag>.cdx.json is checked for
pkg:golang and pkg:npm entries and attached next to SHA256SUMS.
- workflow_dispatch dry run: builds, SBOM, attestations and workflow artifacts;
the Release step and the docker job only run on push.
- README: Verifying a release section.
traffic_evidence_snapshots.req_head and resp_head join the secret column registry (AAD per column, enc:v1:). Heads are sealed at insert and opened on every read; the startup key check, the no-key refusal and the idempotent backfill cover them. Archives keep the heads sealed; the import opens them to check the snapshot ID and the insert seals them once.
As for the MCP env (#213), a placeholder in a custom tool's exec keeps the
stored header, proxy or body only while the url (exact string) and the kind
are unchanged. A changed or emptied url, or a kind change, with a resolved
placeholder is refused (400 on the API and the test endpoint, a tool error
for update_custom_tool) before any write and before the test request is
sent. An explicit value with a new url is allowed.
Phase 3 of secrets at rest (#213, #216), same AES-256-GCM scheme and key.
- tools.exec joins the secret columns for system=false rows (AAD
tools.exec): the whole JSON is sealed in the {"__artex_enc":"enc:v1:..."}
envelope, so headers, body, proxy, script code and command are covered;
{} stays {}
- CreateCustomTool and UpdateCustomTool seal it; scanTool opens it, so
GetTool, ListTools and ListCustomTools (and through them customTools,
the platform tools and the test endpoint) see the clear JSON in memory
- the startup backfill, the no-key refusal and the wrong-key check cover
it, for system=false rows only; built-in rows stay in clear for the seeds
API: GET /api/tools returns the header values, proxy and body of a custom
tool masked, with headers_set, proxy_set and body_set. On update (API and
update_custom_tool) the placeholder keeps the stored value, an explicit
value replaces it and "" clears it; on create (API and create_custom_tool)
a placeholder is refused. The test endpoint takes an optional key: the
saved tool's stored values replace the placeholders; the editor sends it.
Phase 2 of secrets at rest (#213), same AES-256-GCM scheme and key.
- llm_profiles.proxy joins the secret columns (AAD llm_profiles.proxy);
scanProfile decrypts it for both column lists, SaveProfile encrypts
it, an empty proxy stays NULL
- brave_search_api_key, tavily_search_api_key, web_search_proxy and
global_proxy are stored encrypted (AAD settings.<key>) through
GetSetting, SetSetting and InsertSettingIfAbsent; other settings stay
in clear
- the startup backfill, the no-key refusal and the wrong-key check
cover the new values; legacy plaintext is read as-is until backfill
API: the proxies are returned masked as a whole (placeholder plus a
*_set flag) by GET /api/settings, GET /api/llm/profiles and GET /api/llm.
On write the placeholder keeps the stored value, an explicit value
replaces it and "" clears it; the placeholder is never stored. The test
and model-list endpoints resolve the placeholder to the stored proxy.
Extends ingest_scan_output with three formats:
- nuclei-jsonl: one tool_output fact per result and an asset for the
scanned target when it is valid; no automatic finding
- httpx-jsonl: one HTTP service asset and one fact per URL
- ffuf-json: one URL asset and one fact per result, read token by token
with encoding/json; a file cut short keeps the complete results
JSONL lines go through readJSONLines, taken from the bbot ingester
(64 KiB per line; longer lines and invalid JSON are skipped and
counted). bbot now uses the same reader, with no behaviour change.
One file yields at most 50000 assets and facts; records past the cap
are counted in over_cap and the result is marked truncated.
A worker can write nmap output with -oX and call ingest_scan_output with
the format and path. The file is parsed deterministically: assets go
through the insert_assets handler, each host becomes one tool_output
fact listing its open ports, and the model gets only counters and at
most 20 notable items per type.
- path is resolved under the run working directory; "..", an absolute
path outside it and a symlink leading outside are refused; 256 MiB cap
- the XML is streamed host by host with encoding/xml; a file cut short
keeps the complete hosts and returns truncated: true
- target text (banners, products, hostnames) is kept only as a
Go-quoted string in the fact detail
- re-ingesting a file upserts the same assets and skips identical facts
Worker-only, like ingest_bbot. nuclei, httpx and ffuf follow separately.
A masked env value keeps the stored secret only while transport, command, args (canonical JSON) and url are unchanged, as notify.PrepareConfigUpdate does for channels. A changed destination with a masked value is refused (400). The credentials tab drops reveal/copy and shows a stored password as "stored, hidden".
Seal the four credential columns with AES-256-GCM (random nonce per value,
AAD "<table>.<column>"): llm_profiles.api_key and task_credentials.password
store "enc:v1:<base64(nonce||ciphertext)>"; mcp_servers.env and
notification_channels.config store {"__artex_enc":"enc:v1:..."} over the
canonical JSON. The db layer encrypts on write and decrypts on read, so agent
tools (LLM provider, MCP, notifier, test credentials) get plaintext
server-side. Decryption failure is an error, never a plaintext fallback.
Key: ARTEX_SECRET_KEY (32 bytes, base64 or hex) or keys/secret.key next to
jwt.key, generated with crypto/rand at first start (0600). Startup refuses
when encrypted values exist and no key is available, and when the key does
not decrypt them. An idempotent backfill under the schema advisory lock
encrypts legacy plaintext rows and logs only a count.
API: MCP env is masked on read and masked placeholders on write keep the
stored value; task credential passwords are masked server-side and a masked
password on write is refused. ARTEX_SECRET_KEY is scrubbed from the process
environment with the other startup secrets.
Dalfox v3.2.4 (Rust) has no -w and exposes a global --rate-limit plus --workers (docs/content/reference/cli.md). Subfinder -t only bounds concurrent DNS lookups in active mode, so the passive line is removed; the generic fallback covers it.
When ARTEX_NOISE_PROFILE is set, the planner, worker, main agent and chat system prompts gain a code-owned block with the profile per-host limits and exact rate/delay flags for the scanners installed in the image. With no profile the block is empty, so every prompt is byte-for-byte unchanged.
README documents the block.
POST /api/intercept/pending/{id}/always-allow derives an argv allow rule from the stored pending row (never from the body), at priority -1000, reusing an identical enabled rule, and leaves the request pending. A code-owned denylist of interpreters, launchers, package managers, orchestration and destructive programs refuses such rules at creation, in the manual rule form, and neutralises argv allow rules at matching; argv deny and ask rules still match.
- A destructive or operator_policy unknown asks, even when read_only is yes.
- An enabled closed judge with no completer wired asks (judge_not_wired)
instead of falling through to allow.
- The argument cap is checked before the review input is built.
- MaxTokens for the closed reply raised to 1536.
- The operator_policy question also covers a whitelist policy that fails to
authorize the action; golden digest updated.
The LLM fallback judge gets a closed mode (default when the judge is on):
the model answers eight code-owned questions with yes|no|unknown and one
evidence line each, in one call; the decision is taken in code. Every
failure (invalid output, missing key, value outside the vocabulary, a
failed call, arguments above the 256 KiB cap) is ask. The custom judge
prompt becomes bounded operator-policy data (8000 runes). The answers are
stored in the intercept audit and shown in the approval detail.
freeform keeps the previous behaviour; defaultJudgeFailAction changes
from allow to ask.
Normalise and length-check ledger fields in db.RecordCoverage, frame the planner gap lines in the data envelope, cap the wrap-up (25) and report (200) gap lists, cap current rows at 2000 per task. Replace the activity budget marker with tasks.end_reason, written with the guarded terminal status and cleared on revive. Generic 500 message in taskCoverage; early return on an empty ledger in the planner block.
Workers record per (surface, risk_area) outcomes with the new record_coverage
tool (reported, no_issue_found, ruled_out, not_applicable, needs_follow_up).
Gaps are needs_follow_up entries, entries missing their required evidence or
reason, and goal vulnclass values with no entry (unrecorded_risk_class), so an
absent finding never reads as a clean target. Completeness marks timeout,
budget wrap-up, pause, abort and running tasks as incomplete with a caveat.
Surfaced in the planner context (one line per round, full gap list on the
timeout/budget wrap-up round), GET /api/tasks/{id}/coverage, the coverage card
and the Markdown report. Follows coverage_enabled; no new env var.
- resetSettledRun clears settling and the budget ledger; a done/failed task
revived to running now plans and claims again (was gated by the old wrap-up).
resetTimeoutRevival calls it. Test: TestResetSettledRunRestartsBudget.
- docker-compose.yml passes the four ARTEX_*_BUDGET_* variables through.
- .env.example and README document the variables, the wrap-up, the in-memory
ledger and the practical floor.
- llmrec: the usage sink runs even without a PostgreSQL recorder; comment fixed.
- BudgetWrapupBlocks allows update_finding_report.
Per-level token/turn budgets: task -> intent (worker run) -> planner round
(counted inside the task). A child's effective budget is
min(own budget, parent's remaining above the wrap-up reserve). When the task
can no longer afford one worker, workers stop claiming intents and the task
settles through one forced wrap-up planner round (the existing settle
sequence, budget words instead of the timeout words).
Config: ARTEX_TASK_BUDGET_TOKENS, ARTEX_TASK_BUDGET_TURNS,
ARTEX_INTENT_BUDGET_TOKENS, ARTEX_INTENT_BUDGET_TURNS. 0 or unset = unlimited;
with all four unset nothing changes.
BaaRai