Commit Graph

57 Commits

Author SHA1 Message Date
Image 9399c01d8c Merge branch 'v3.0.0' of github.com:lintsinghua/DeepAudit into feature/git_ssh
# Conflicts:
#	backend/app/services/scanner.py
#	backend/uv.lock
#	frontend/src/pages/Projects.tsx
2025-12-25 14:41:09 +08:00
vinland100 e4f1391a28 merge: 同步上游 v3.0.0 并更新 uv 依赖锁文件 2025-12-25 11:45:52 +08:00
Image a79b27a6d2 feat(ssh):新增SSH密钥认证支持,支持通过SSH方式访问Git仓库
新增SSH密钥管理功能,包括生成、查看、测试和删除SSH密钥对。在agent_tasks.py中集成SSH私钥解密和SSH克隆逻辑,支持git@格式的SSH URL。在projects.py中为SSH URL添加文件获取支持。新增ssh_keys.py端点提供完整的SSH密钥API管理。前端Account页面新增SSH密钥管理界面,Projects页面支持选择SSH Key认证类型。新增git_ssh_service.py提供SSH密钥生成、验证和Git SSH操作功能。
2025-12-24 16:08:56 +08:00
lintsinghua c0ac7d0544 feat(报告): 添加任务报告导出功能并优化样式
- 在 AuditTasks 页面添加快速扫描和 Agent 任务的报告导出功能
- 在 ReportExportDialog 中优化颜色样式以支持亮色/暗色模式
- 修复报告生成器中字段为空时的处理逻辑
2025-12-18 23:58:56 +08:00
lintsinghua 87c501b55c refactor(frontend): 简化审计页面UI样式,移除多余动画效果
- 清理代理树节点和日志条目的冗余样式和动画
- 统一颜色和间距设计,优化暗黑模式支持
- 移除背景特效和多余装饰元素,提升性能
2025-12-18 23:11:43 +08:00
lintsinghua cb1cdb77b8 feat(ui): 为暗黑模式添加亮度调整并优化颜色对比度
添加暗黑模式下的亮度调整,优化颜色对比度以提高可读性
更新多个组件的颜色变量以支持亮色和暗色主题
添加可折叠的扫描配置区域以改善用户体验
2025-12-18 22:55:05 +08:00
lintsinghua 3a9dcdbc7a feat(前端): 增强UI组件视觉效果和交互体验
refactor(认证): 支持记住我功能并优化token存储逻辑

style(字体): 更新字体配置增加CJK回退支持

perf(全局样式): 添加新动画效果和视觉增强样式

fix(AlertDialog): 修复portal容器定位问题
2025-12-18 20:47:11 +08:00
lintsinghua 8ee98a20eb style(ui): 统一组件样式,优化视觉设计和交互体验
- 更新颜色系统,使用新的主题变量
- 调整圆角、边框、阴影等视觉样式
- 优化字体大小、间距和排版细节
- 改进表单组件的交互状态
- 增强暗色模式下的显示效果
2025-12-18 19:57:43 +08:00
google-labs-jules[bot] 1c0ec2b13d feat: enhance Gitea support and merge upstream v3.0.0
- Merge upstream v3.0.0 changes
- Fix security vulnerabilities (SSRF, Path Traversal) by introducing `parse_repository_url` utility
- Fix token leakage and handling in `scanner.py` and `projects.py`
- Fix `NameError` in `scanner.py`
- Fix `frontend/docker-entrypoint.sh` API URL escaping
- Standardize Gitea token naming to `gitea_token`
2025-12-17 03:02:42 +00:00
lintsinghua 6c080fc5d6 feat(agent): 增加漏洞文件统计功能并优化agent提示词
- 在AgentTask模型中添加files_with_findings字段统计有漏洞发现的文件数
- 更新前后端接口和界面展示漏洞文件统计
- 优化各Agent的系统提示词,移除冗余内容并增强工具使用约束
- 增加LLM的max_tokens至8192避免截断
- 添加生产环境docker-compose配置和更新README部署说明
2025-12-16 22:08:45 +08:00
vinland100 630b8b1a60 更新README.md,gitea仓库支持获取分支 2025-12-16 18:55:07 +08:00
vinland100 0fb10f6f76 feat: add Gitea repository support 2025-12-16 18:55:07 +08:00
lintsinghua 2bba972272 feat(AgentAudit): 添加进度日志功能支持
添加 progress 日志类型,支持通过 progressKey 更新或添加进度日志
在日志组件中增加进度日志的样式和显示
处理进度消息的匹配和更新逻辑,避免重复添加日志
2025-12-16 18:04:09 +08:00
lintsinghua e2109647bf feat(agent): 增强任务执行流程和实时日志反馈
- 在任务执行流程中添加实时事件反馈,包括克隆进度和索引进度
- 实现 RAG v2.0 智能索引功能,支持模型变更检测和增量更新
- 改进文件工具兼容性,支持 path 参数作为 directory 别名
- 扩展前端事件处理逻辑,支持更多事件类型显示
- 修复 tree-sitter 版本兼容性问题
2025-12-16 16:56:09 +08:00
lintsinghua e531c8808d refactor: standardize dialog component styling and layout for improved consistency and responsiveness. 2025-12-15 16:13:47 +08:00
lintsinghua ba00b718e4 feat: Update deployment configurations, dependency management, and documentation, including a new sandbox build service. 2025-12-15 15:18:55 +08:00
lintsinghua 3639b3a13e fix(agent): 修复工具执行结果处理中的 None 值问题
修复 AgentTool 和外部工具类中结果处理逻辑,确保 data 字段不为 None
添加调试日志和错误处理,改进工具执行失败时的反馈信息
统一所有工具类的错误处理格式,避免前端显示 "None" 字符串
2025-12-15 10:24:58 +08:00
lintsinghua cdf360dcf7 feat: 增加文件上传大小限制至500MB并优化大文件处理
增加ZIP文件上传大小限制从100MB到500MB
在agent工具中添加失败调用追踪和自动跳过机制
优化大文件读取性能,支持流式处理指定行范围
2025-12-15 09:21:37 +08:00
lintsinghua 2df1b39e08 feat: Introduce Kunlun agent tool, add Docker and sandbox environment checks, and update agent services and frontend dialogs. 2025-12-15 02:00:34 +08:00
lintsinghua fc3dce7510 feat: Redesign task tabs in AuditTasks with a card-style layout and add `!important` to input padding. 2025-12-14 21:09:29 +08:00
lintsinghua c64eddac7c feat(agent): 新增多语言代码测试和漏洞验证工具并增强错误处理
新增 PHP、Python、JavaScript 等多语言代码测试工具和命令注入、SQL 注入等专用漏洞验证工具
优化错误处理逻辑,提供更详细的错误信息和堆栈跟踪
增强 JSON 解析器,优先使用 json-repair 库处理复杂格式
改进 Agent 响应解析逻辑,更健壮地提取思考内容和操作指令
完善沙箱管理器的初始化和错误处理机制
2025-12-14 17:20:54 +08:00
lintsinghua 3d4f90c547 feat: Add `marked` for improved Markdown to HTML report generation and refined download handling. 2025-12-13 21:38:11 +08:00
lintsinghua a9a22b91c7 fix: Display aggregated findings for the orchestrator and task, and show sub-agent duration/status in UI. 2025-12-13 21:06:22 +08:00
lintsinghua 2a332d6eda feat: Improve report generation and statistics by normalizing severity comparisons and leveraging backend-calculated task metrics. 2025-12-13 20:42:10 +08:00
lintsinghua d449e2ba78 Fix: Improve agent stream stability by preventing unnecessary reconnections and correctly draining buffered events. 2025-12-13 20:21:30 +08:00
lintsinghua 4e4dd05ddb feat(agent): 增强漏洞发现处理流程和前端兼容性
- 后端添加对旧事件类型'finding'的兼容支持
- 改进漏洞发现标准化和去重逻辑
- 新增PoC生成要求和相关字段
- 优化沙箱配置初始化流程
- 前端添加ADD_FINDING操作和状态管理
- 增强事件流处理和序列号过滤
- 改进历史事件加载和SSE连接逻辑
- 添加漏洞验证状态和PoC信息到报告
2025-12-13 18:45:05 +08:00
lintsinghua 6d98f29fa6 feat: 新增安全工具集成和漏洞知识库扩展
- 添加 Bandit 和 Safety 安全工具到依赖项
- 新增 CSRF、业务逻辑和开放重定向漏洞知识文档
- 实现安全工具一键安装脚本和文档
- 改进模式匹配工具支持直接文件扫描
- 增强遥测模块和 Agent 审计功能
- 修复验证节点中 findings 合并逻辑
- 优化前端 Agent 审计界面和状态展示
2025-12-13 12:35:03 +08:00
lintsinghua e13218a33e style: improve code formatting and consistency in AgentAudit.tsx 2025-12-12 16:21:35 +08:00
lintsinghua eed111c04d chore: reduce logging verbosity and clean up file formatting
- Change logger.info to logger.debug in agent_tasks.py streaming and tree endpoints
- Disable SQLAlchemy echo mode in database session configuration
- Suppress uvicorn access logs and LiteLLM INFO level logging in main application
- Remove LogViewer component and LogsPage from frontend
- Add trailing newlines to multiple backend configuration and model files
- Update frontend routing to remove logs page reference
- Improve application startup logging clarity by filtering verbose third-party logs
2025-12-12 15:50:48 +08:00
lintsinghua f05c0073e1 feat(agent): implement comprehensive agent architecture with knowledge base and persistence layer
- Add database migrations for agent checkpoints and tree node tracking
- Implement core agent execution framework with executor, state management, and message handling
- Create knowledge base system with framework-specific modules (Django, FastAPI, Flask, Express, React, Supabase)
- Add vulnerability knowledge modules covering authentication, cryptography, injection, XSS, XXE, SSRF, path traversal, deserialization, and race conditions
- Introduce new agent tools: thinking tool, reporting tool, and agent-specific utilities
- Implement LLM memory compression and prompt caching for improved performance
- Add agent registry and persistence layer for checkpoint management
- Refactor agent implementations (analysis, recon, verification, orchestrator) with enhanced capabilities
- Remove legacy agent implementations (analysis_v2, react_agent)
- Update API endpoints for agent task creation and project management
- Add frontend components for agent task creation and enhanced audit UI
- Consolidate agent service architecture with improved separation of concerns
- This refactoring provides a scalable foundation for multi-agent collaboration with knowledge-driven decision making and state persistence
2025-12-12 15:27:12 +08:00
lintsinghua 147dfbaf5e feat(agent): enhance streaming with in-memory event manager and fallback polling
- Implement dual-mode streaming: prioritize in-memory EventManager for running tasks with thinking_token support
- Add fallback to database polling for completed tasks without thinking_token replay capability
- Introduce SSE event formatter utility for consistent event serialization across streaming modes
- Add 10ms micro-delay for thinking_token events to ensure proper TCP packet separation and frontend incremental rendering
- Refactor stream_agent_with_thinking endpoint to support both runtime and historical event streaming
- Update event filtering logic to handle both in-memory and database event sources
- Improve logging with debug markers for thinking_token tracking and stream mode selection
- Optimize polling intervals: 0.3s for running tasks, 2.0s for completed tasks
- Reduce idle timeout from 10 minutes to 1 minute for completed task streams
- Update frontend useAgentStream hook to handle unified event format from dual-mode streaming
- Enhance AgentAudit UI to properly display streamed events from both sources
2025-12-12 10:39:32 +08:00
lintsinghua 70776ee5fd feat: Introduce structured agent collaboration with `TaskHandoff` and `analysis_v2` agent, updating core agent logic, tools, and audit UI. 2025-12-11 23:29:04 +08:00
lintsinghua 8938a8a3c9 feat(agent): enhance agent functionality with LLM-driven decision-making and event handling
- Introduce LLM-driven decision-making across various agents, allowing for dynamic adjustments based on real-time analysis.
- Implement new event types for LLM thinking, decisions, actions, and observations to enrich the event streaming experience.
- Update agent task responses to include additional metrics for better tracking of task progress and outcomes.
- Refactor UI components to highlight LLM-related events and improve user interaction during audits.
- Enhance API endpoints to support new event structures and improve overall error handling.
2025-12-11 21:14:32 +08:00
lintsinghua 58c918f557 feat(agent): implement streaming support for agent events and enhance UI components
- Introduce streaming capabilities for agent events, allowing real-time updates during audits.
- Add new hooks for managing agent stream events in React components.
- Enhance the AgentAudit page to display LLM thinking processes and tool call details in real-time.
- Update API endpoints to support streaming event data and improve error handling.
- Refactor UI components for better organization and user experience during audits.
2025-12-11 20:33:46 +08:00
lintsinghua a43ebf1793 refactor(agent): update task completion fields and enhance status handling
- Rename 'finished_at' to 'completed_at' in AgentTaskResponse and related functions for clarity.
- Introduce 'RUNNING' status in AgentTaskStatus to better represent task states.
- Update task configuration handling in AgentRunner to improve initialization logic.
- Enhance UI to reflect new 'RUNNING' and 'REPORTING' statuses in the AgentAudit component.
2025-12-11 19:26:47 +08:00
lintsinghua 129112e4d7 refactor(agent): rename metadata fields and enhance task configuration
- Rename 'metadata' columns to 'event_metadata' and 'finding_metadata' for clarity in database schema.
- Update AgentRunner to construct task configuration from task fields, ensuring default values are applied.
- Improve UI to handle potential null values for progress percentage and security score, enhancing user experience.
2025-12-11 19:23:21 +08:00
lintsinghua 9bc114af1f feat(agent): implement Agent audit module with LangGraph integration
- Introduce new Agent audit functionality for autonomous code security analysis and vulnerability verification.
- Add API endpoints for managing Agent tasks and configurations.
- Implement UI components for Agent mode selection and embedding model configuration.
- Enhance the overall architecture with a focus on RAG (Retrieval-Augmented Generation) for improved code semantic search.
- Create a sandbox environment for secure execution of vulnerability tests.
- Update documentation to include details on the new Agent audit features and usage instructions.
2025-12-11 19:09:10 +08:00
lintsinghua a995bef28c feat(audit): enhance file selection and exclude patterns UI
- Update demo data to mark running task as completed with audit results
- Add reset to defaults button for exclude patterns in CreateTaskDialog
- Implement quick-add buttons for common exclude patterns (.test., .spec., .min., coverage/, docs/, .md)
- Improve exclude patterns input with better placeholder text and visual feedback
- Refactor FileSelectionDialog with tree-based folder structure for better file organization
- Add file type icons (code files, config files, generic files) for improved visual distinction
- Implement folder expansion/collapse functionality with chevron indicators
- Add file filtering by extension and search capabilities
- Enhance UI with better spacing, visual hierarchy, and user guidance
- Improve accessibility with proper icon imports and component organization
2025-12-10 19:20:31 +08:00
lintsinghua 11107ea455 feat(analysis): unify code analysis workflow with default template support
- Consolidate instant analysis to always use analyze_code_with_rules method
- Add use_default_template parameter to automatically select database default template when none specified
- Implement fallback logic to use hardcoded defaults only when no database template available
- Auto-select default prompt template on frontend page load
- Add visual labels for language and template selection dropdowns
- Improve template selector UX by removing empty default option and showing default indicator
- Simplifies analysis flow by removing conditional branching between analyze_code and analyze_code_with_rules
2025-12-09 23:13:06 +08:00
lintsinghua 4d71ed546a feat(prompts-scan): integrate prompt templates and audit rules into scan and analysis workflows
- Add user configuration retrieval with LLM API key decryption in prompt testing endpoint
- Support output language parameter in prompt template testing
- Integrate rule sets and prompt templates into ZIP file scanning process
- Add rule_set_id and prompt_template_id parameters to ScanRequest model
- Implement analyze_code_with_rules method for custom rule-based code analysis
- Add prompt_template_id support to instant analysis endpoint
- Update scan configuration to include rule set and prompt template selection
- Enhance error handling and logging in prompt testing with traceback output
- Extend InstantAnalysisRequest with optional prompt template ID parameter
- Add test code samples utility for prompt template validation
2025-12-09 23:03:08 +08:00
lintsinghua 357b9cc0a7 feat(prompts-rules): add prompt templates and audit rules management
- Add database migration (004) to create prompt_templates, audit_rule_sets, and audit_rules tables with proper indexes
- Create PromptTemplate and AuditRule models with relationships and validation
- Implement prompt template API endpoints for CRUD operations and testing
- Implement audit rules API endpoints for CRUD operations and rule set management
- Add prompt and rules schemas for request/response validation
- Create prompt template initialization service with default system templates
- Integrate LLM service with prompt template system for dynamic prompt selection
- Add frontend pages for PromptManager and AuditRules management
- Add API client utilities for prompts and rules endpoints
- Update API router to include new prompts and rules endpoints
- Update database initialization to seed default templates and rules
- Update sidebar navigation to include new management pages
- Update frontend routes to support new prompt and rules management pages
2025-12-09 21:42:00 +08:00
lintsinghua 14b7c8cccc fix: 修复时间显示问题,使用带时区的UTC时间
- 将所有 datetime.utcnow() 替换为 datetime.now(timezone.utc)
- 修复 completed_at, started_at, updated_at, resolved_at 等时间字段
- 修复 JWT token 过期时间计算
- 修复数据导出和ZIP上传时间戳
- 调整README中项目管理和审计报告图片显示比例
2025-12-09 17:47:34 +08:00
lintsinghua e856ad1a8d chore: rebrand XCodeReviewer to DeepAudit across all files
- Update project name from XCodeReviewer to DeepAudit in CI/CD workflows
- Replace Docker image names and release artifact naming conventions
- Update GitHub repository references in documentation files
- Modify database names and container names in setup instructions
- Update contributor badge and issue tracker links
- Rename frontend logo file from logo_deepaudit.png
- Update environment configuration examples and documentation
- Rebrand all references in CONTRIBUTING.md, DISCLAIMER.md, and README.md
- Update backend configuration and deployment documentation
- Ensure consistent naming across frontend and backend configurations
2025-12-08 21:35:09 +08:00
lintsinghua 07810b309c feat(audit): refactor task creation with file selection and advanced options
- Add FileSelectionDialog component for granular file selection in audit tasks
- Extract task form logic into useTaskForm and useZipFile custom hooks
- Create modular components: BasicConfig, AdvancedOptions, ExcludePatterns, ProjectSelector, ZipFileSection
- Add file listing endpoint GET /projects/{id}/files with branch support
- Add branch listing endpoint GET /projects/{id}/branches for repository projects
- Implement ScanRequest model with file_paths, exclude_patterns, and branch_name fields
- Update scan endpoint to accept selective file scanning and exclude patterns
- Add branch_name and exclude_patterns fields to AuditTask model
- Enhance scanner service with GitHub and GitLab file/branch retrieval functions
- Improve CreateTaskDialog with better UX for repository and ZIP file scanning
- Support per-scan configuration storage in audit tasks
- Refactor repository scan services to handle file selection and branch parameters
2025-12-06 20:47:28 +08:00
lintsinghua f982d6a5e6 feat: 添加演示账户和演示数据,完善项目文档
- 添加演示账户 demo@example.com / demo123
- 创建 6 个演示项目和 15 个审计任务
- 完善 DEPLOYMENT.md、CONFIGURATION.md、LLM_PROVIDERS.md、FAQ.md 文档
- 更新 CONTRIBUTING.md、SECURITY.md、DISCLAIMER.md
- 前端版本号自动从 package.json 读取
- 仪表盘项目概览显示 6 个项目
- 版本号更新为 2.0.0-beta.3
2025-12-05 15:09:39 +08:00
lintsinghua 6fd305eac9 fix: 修复多个问题
- 修复创建ZIP项目时缺少source_type字段的问题
- 修复LiteLLM模型名称被错误解析为effort参数的问题
- 修复登录/注册页面无法正确显示验证错误的问题
- 添加Windows导出PDF需要GTK依赖的说明文档
2025-12-04 16:54:15 +08:00
lintsinghua 9054f0d2c5 feat: v2.0.0-test release
Major changes:
- Backend: Add report generator service with comprehensive analysis
- Backend: Enhanced scan and task endpoints
- Frontend: Refactor instant analysis page and export dialog
- Frontend: Optimize report export service
- Infrastructure: Simplify Dockerfile and update docker-compose
- Docs: Streamline README documentation
- Assets: Add logo with transparent background
2025-11-28 20:34:15 +08:00
lintsinghua c54212a8c9 refactor: 清理IndexedDB相关代码,统一使用后端ZIP存储
- 移除前端废弃的loadZipFile/saveZipFile函数
- ProjectDetail使用scanStoredZipFile替代loadZipFile
- RecycleBin移除手动删除ZIP文件逻辑
- 后端permanently_delete_project自动清理ZIP文件
2025-11-28 18:01:43 +08:00
lintsinghua bfef3b35a6 feat(projects): add ZIP file upload support and source type tracking
- Add source_type field to projects model to distinguish between repository and ZIP sources
- Implement ZIP file storage service with save, load, delete, and metadata operations
- Add database migration to populate source_type for existing projects
- Create ZIP upload endpoint with file handling and metadata tracking
- Add ZIP download endpoint for project file retrieval
- Implement project ZIP info endpoint to check file status and metadata
- Update project creation to support both repository and ZIP source types
- Add project type constants and utility functions for source type handling
- Update database export/import to include source_type field
- Extend frontend components to support ZIP file uploads in project creation
- Add instant analysis page for direct ZIP file scanning without project creation
- Update .gitignore to exclude uploaded ZIP files and metadata
- Enhance project detail and task detail pages with ZIP file management UI
2025-11-28 17:38:12 +08:00
lintsinghua 1fc0ecd14a refactor(frontend): modernize UI components with retro-futuristic styling
- Replace Card, Alert, and Separator components with retro-styled div elements
- Update DatabaseManager with retro-card styling and border-based design
- Refactor health status display to use styled Badge components instead of text
- Remove unused icon imports (Server, FileText) from DatabaseManager
- Clean up inline comments and unnecessary whitespace throughout components
- Simplify error handling by removing redundant console.error statements
- Update Sidebar, SystemConfig, Account, AdminDashboard, and other pages with consistent retro styling
- Apply uppercase font styling and monospace typography to match retro-futuristic theme
- Consolidate component structure across all pages for visual consistency
- Improve code readability by removing excessive blank lines and comments
2025-11-28 16:16:29 +08:00