Commit Graph

49 Commits

Author SHA1 Message Date
vinland100 b373692577 Fix capitalization issues and handle cases where the answer is "none".
Build and Push CodeReview / build (push) Waiting to run Details
2026-01-12 14:04:12 +08:00
vinland100 a98e3e531b Fixed the issue of infinite loop outputting the same content in the Agent audit mode, and resolved the problem of incomplete display of the frontend Activity log in Agent audit mode.
Build and Push CodeReview / build (push) Waiting to run Details
2026-01-12 13:39:48 +08:00
vinland100 6c2a15ad90 Optimize parallel LLM calls while addressing the circular issue in Agent auditing.
Build and Push CodeReview / build (push) Has been cancelled Details
2026-01-09 17:30:18 +08:00
vinland100 a11542c4bf Configure unified file extensions, exclude directories, and exclude files.
Build and Push CodeReview / build (push) Waiting to run Details
2026-01-09 16:28:27 +08:00
vinland100 3ce3767938 Change the log time to China
Build and Push CodeReview / build (push) Waiting to run Details
2026-01-09 13:23:49 +08:00
vinland100 0e2a7dfa87 Modify the Agent audit logic to prevent infinite loops until the loop limit is triggered.
Build and Push CodeReview / build (push) Waiting to run Details
2026-01-08 14:53:34 +08:00
lintsinghua 15605fea16 refactor(agent): 移除LangGraph工作流并迁移到动态Agent树架构
重构Agent服务架构,从基于LangGraph的状态图迁移到动态Agent树结构。主要变更包括:
- 删除graph模块及相关测试
- 更新agent/__init__.py导入和文档
- 在projects端点添加对新AgentTask模型的统计支持
- 简化工作流描述为START→Orchestrator→[Recon/Analysis/Verification]→Report→END

新架构使用OrchestratorAgent作为编排层,动态调度子Agent完成任务,提高灵活性和可扩展性。
2025-12-25 17:58:14 +08:00
lintsinghua 39e2f43210 feat(agent): 增强API错误处理机制
添加对API错误的分类处理,包括速率限制、配额用尽、认证和连接错误
在base.py中标记API错误前缀,orchestrator.py中实现重试逻辑
litellm_adapter.py中完善错误类型识别和用户友好提示
2025-12-25 17:35:31 +08:00
lintsinghua c7632afdab feat: 为文件操作和代码解析添加异步支持
将同步的文件读取、代码解析和分块操作改为异步实现,使用 asyncio.to_thread 将 CPU 密集型操作放到线程池执行,避免阻塞事件循环。主要修改包括:
- 在 TreeSitterParser 和 CodeSplitter 中添加异步解析方法
- 修改 CodeIndexer 使用异步文件读取和分块
- 为 FileReadTool 和 FileSearchTool 添加异步文件读取支持
2025-12-25 17:20:42 +08:00
vinland100 e4f1391a28 merge: 同步上游 v3.0.0 并更新 uv 依赖锁文件 2025-12-25 11:45:52 +08:00
rockmelodies 91290802a8 在 GoTestTool 类的 _build_wrapper_code 方法中,第 770 行有语法错误。
以修复
2025-12-24 17:39:24 +08:00
lintsinghua b0f17d50db docs(agent): 添加防止幻觉的验证指南和使用警告
在多个agent文件中添加详细的防止幻觉验证指南,包括:
1. 必须验证文件存在性和代码匹配性
2. 禁止猜测文件路径和行号
3. 知识库示例与实际代码的区分警告
4. 添加语言检测功能以提醒语言不匹配情况
2025-12-19 19:14:23 +08:00
lintsinghua 80704fdcb4 feat(agent): 增强文件路径验证防止幻觉报告
添加文件路径验证规则和检查逻辑,确保漏洞报告中的文件真实存在
移除LLM响应中的Markdown格式标记,统一解析处理
更新报告工具和端点以支持项目根目录验证
2025-12-19 19:08:36 +08:00
lintsinghua 8fe96a83cf feat(agent): 使用用户配置的LLM参数替代硬编码值
重构所有Agent和LLM服务,移除硬编码的temperature和max_tokens参数
添加get_analysis_config函数统一处理分析配置
在LLM测试接口中显示用户保存的配置参数
前端调试面板默认显示LLM测试详细信息
2025-12-19 16:08:26 +08:00
lintsinghua 22b1610825 feat(agent): 新增通用代码执行工具和函数提取工具
添加 RunCodeTool 和 ExtractFunctionTool 用于 LLM 驱动的漏洞验证
放宽沙箱命令限制以支持更灵活的测试
更新验证代理提示词以优先使用动态代码验证
2025-12-18 15:03:30 +08:00
lintsinghua 1b495edb99 feat(agent): 扩展事件管理器的调试日志范围并增强工具调用循环检测
添加 tool_call, tool_result 和 llm_action 到重要事件调试日志
实现智能循环检测机制,当工具重复调用超过3次时进行干预
2025-12-18 01:53:05 +08:00
lintsinghua d62fd25fa6 feat(agent): 增强安全工具路径处理逻辑和错误提示
- 新增智能路径解析函数 _smart_resolve_target_path 处理常见路径问题
- 改进 Semgrep、Bandit 等工具的错误处理和日志输出
- 更新工具描述文档,明确路径使用规范
- 在 docker-compose 中添加 SANDBOX_IMAGE 配置
- 优化项目根目录检测逻辑,自动处理单层嵌套目录
2025-12-17 19:22:00 +08:00
lintsinghua dbf03c5ac3 refactor(沙箱工具): 将沙箱镜像配置改为从settings读取
默认镜像配置改为从settings.SANDBOX_IMAGE读取,提高配置灵活性
2025-12-17 18:07:11 +08:00
lintsinghua f1796ca044 fix(docker): 禁用代理环境变量防止网络干扰
在 Docker 容器配置中禁用 HTTP/HTTPS 代理环境变量,防止代理设置干扰容器网络连接
同时优化 sandbox 工具的环境变量处理逻辑
2025-12-17 15:33:53 +08:00
google-labs-jules[bot] 1c0ec2b13d feat: enhance Gitea support and merge upstream v3.0.0
- Merge upstream v3.0.0 changes
- Fix security vulnerabilities (SSRF, Path Traversal) by introducing `parse_repository_url` utility
- Fix token leakage and handling in `scanner.py` and `projects.py`
- Fix `NameError` in `scanner.py`
- Fix `frontend/docker-entrypoint.sh` API URL escaping
- Standardize Gitea token naming to `gitea_token`
2025-12-17 03:02:42 +00:00
lintsinghua a980fa34e1 fix(agent): 修复任务取消和LLM流式处理的多项问题
修复任务取消后仍可能标记为完成的问题,增加全局取消检查回调
移除事件管理器的人为延迟,防止队列堆积
为LLM流式调用增加超时机制和安全检查
增加验证阶段超时时间至10分钟
2025-12-16 22:47:04 +08:00
lintsinghua 6c080fc5d6 feat(agent): 增加漏洞文件统计功能并优化agent提示词
- 在AgentTask模型中添加files_with_findings字段统计有漏洞发现的文件数
- 更新前后端接口和界面展示漏洞文件统计
- 优化各Agent的系统提示词,移除冗余内容并增强工具使用约束
- 增加LLM的max_tokens至8192避免截断
- 添加生产环境docker-compose配置和更新README部署说明
2025-12-16 22:08:45 +08:00
lintsinghua cd79242b3e feat: 一键部署沙箱 + Docker 镜像发布工作流
- docker-compose: 移除沙箱 profiles 配置,支持一键 docker compose up -d
- pyproject.toml: 迁移 dev-dependencies 到 dependency-groups (PEP 735)
- 新增 docker-publish.yml 工作流,支持手动发布镜像(不创建 tag)
- 优化 orchestrator 和 verification agent

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-16 20:00:00 +08:00
lintsinghua f71b8da7df feat(embedding): 支持前端配置嵌入模型的API密钥
refactor(agent): 改进任务取消逻辑,确保子Agent被正确取消
- 移除asyncio.shield()以允许取消信号传播
- 增加更频繁的取消状态检查
- 添加日志记录子Agent取消情况

feat(nginx): 添加前端构建产物和nginx配置的挂载

refactor(rag): 优化代码索引器的日志输出和元数据处理
- 添加索引文件数量的调试日志
- 将元数据字段提升到顶级以便检索

fix(parser): 修复AST定义提取中的方法识别问题
- 区分函数和方法定义
- 优化遍历逻辑避免重复匹配
2025-12-16 19:42:44 +08:00
lintsinghua 5974323a71 feat(agent): 实现任务取消和超时处理机制
添加对Agent任务的取消和超时处理支持,包括:
- 在工具执行、子Agent运行和项目初始化阶段检查取消状态
- 为不同工具和Agent类型设置合理的超时时间
- 使用asyncio实现取消检查和超时控制
- 优化取消响应速度,减少资源浪费
2025-12-16 17:31:29 +08:00
lintsinghua e2109647bf feat(agent): 增强任务执行流程和实时日志反馈
- 在任务执行流程中添加实时事件反馈,包括克隆进度和索引进度
- 实现 RAG v2.0 智能索引功能,支持模型变更检测和增量更新
- 改进文件工具兼容性,支持 path 参数作为 directory 别名
- 扩展前端事件处理逻辑,支持更多事件类型显示
- 修复 tree-sitter 版本兼容性问题
2025-12-16 16:56:09 +08:00
lintsinghua 5f07403850 feat(agent): 增强 RAG 配置和工具集成
- 扩展嵌入模型配置选项,支持独立 API Key 和 Base URL
- 重构 RAG 初始化逻辑,支持用户自定义嵌入配置
- 新增语义搜索工具并集成到 Recon 和 Analysis Agent
- 完善系统提示,明确不同代码搜索工具的使用场景
2025-12-16 13:57:27 +08:00
lintsinghua 3639b3a13e fix(agent): 修复工具执行结果处理中的 None 值问题
修复 AgentTool 和外部工具类中结果处理逻辑,确保 data 字段不为 None
添加调试日志和错误处理,改进工具执行失败时的反馈信息
统一所有工具类的错误处理格式,避免前端显示 "None" 字符串
2025-12-15 10:24:58 +08:00
lintsinghua cdf360dcf7 feat: 增加文件上传大小限制至500MB并优化大文件处理
增加ZIP文件上传大小限制从100MB到500MB
在agent工具中添加失败调用追踪和自动跳过机制
优化大文件读取性能,支持流式处理指定行范围
2025-12-15 09:21:37 +08:00
lintsinghua 2df1b39e08 feat: Introduce Kunlun agent tool, add Docker and sandbox environment checks, and update agent services and frontend dialogs. 2025-12-15 02:00:34 +08:00
lintsinghua c64eddac7c feat(agent): 新增多语言代码测试和漏洞验证工具并增强错误处理
新增 PHP、Python、JavaScript 等多语言代码测试工具和命令注入、SQL 注入等专用漏洞验证工具
优化错误处理逻辑,提供更详细的错误信息和堆栈跟踪
增强 JSON 解析器,优先使用 json-repair 库处理复杂格式
改进 Agent 响应解析逻辑,更健壮地提取思考内容和操作指令
完善沙箱管理器的初始化和错误处理机制
2025-12-14 17:20:54 +08:00
lintsinghua a85cdb687d refactor(agent): 重构Agent架构并实现动态Agent树
feat(sandbox): 增强沙箱工具的错误处理和日志记录
test(verification): 添加沙箱验证工具的独立测试脚本
docs: 删除过时的文档和测试文件
2025-12-14 14:52:06 +08:00
lintsinghua e29231cc73 feat(安全扫描): 扩展高风险文件模式和危险模式库支持更多语言和文件类型
增加对Swift、Kotlin、Rust等语言的支持
添加iOS和Android相关配置文件类型
补充移动端开发中常见的安全风险模式
2025-12-14 14:00:04 +08:00
lintsinghua 95929a467b feat(沙箱): 强制使用沙箱验证并增强沙箱功能
- 移除 LLM 模拟验证工具,强制使用沙箱进行漏洞验证
- 增强沙箱容器配置,添加/tmp挂载点
- 扩展沙箱基础镜像,增加多种语言环境支持
- 添加RCE漏洞验证脚本用于测试沙箱功能
- 更新验证Agent的系统提示,明确必须使用沙箱工具
2025-12-14 12:43:44 +08:00
lintsinghua 189274fd56 feat(sandbox): 重构安全工具以使用沙箱环境执行
重构所有安全工具(Semgrep, Bandit等)使用Docker沙箱环境执行,提升安全隔离性
更新Dockerfile基础镜像并集成常用安全扫描工具
添加沙箱管理器的工具命令执行方法,支持资源限制和临时文件系统
2025-12-14 00:07:04 +08:00
lintsinghua d449e2ba78 Fix: Improve agent stream stability by preventing unnecessary reconnections and correctly draining buffered events. 2025-12-13 20:21:30 +08:00
lintsinghua 507fe393d1 fix(agent): 改进沙盒工具初始化的日志记录
添加更详细的成功和失败日志信息,包括工具列表和完整的异常堆栈
2025-12-13 18:58:30 +08:00
lintsinghua 4e4dd05ddb feat(agent): 增强漏洞发现处理流程和前端兼容性
- 后端添加对旧事件类型'finding'的兼容支持
- 改进漏洞发现标准化和去重逻辑
- 新增PoC生成要求和相关字段
- 优化沙箱配置初始化流程
- 前端添加ADD_FINDING操作和状态管理
- 增强事件流处理和序列号过滤
- 改进历史事件加载和SSE连接逻辑
- 添加漏洞验证状态和PoC信息到报告
2025-12-13 18:45:05 +08:00
lintsinghua 6d98f29fa6 feat: 新增安全工具集成和漏洞知识库扩展
- 添加 Bandit 和 Safety 安全工具到依赖项
- 新增 CSRF、业务逻辑和开放重定向漏洞知识文档
- 实现安全工具一键安装脚本和文档
- 改进模式匹配工具支持直接文件扫描
- 增强遥测模块和 Agent 审计功能
- 修复验证节点中 findings 合并逻辑
- 优化前端 Agent 审计界面和状态展示
2025-12-13 12:35:03 +08:00
lintsinghua 3db20a3afb feat(agent): enhance error handling and project scope filtering
- Downgrade Python version from 3.13 to 3.11.12 for compatibility
- Improve empty LLM response handling with better diagnostics and retry logic in AnalysisAgent
- Add detailed logging for empty response retries with token count and iteration tracking
- Implement fallback result generation instead of immediate failure on consecutive empty responses
- Enhance stream error handling with partial content recovery and error message propagation
- Add comprehensive exception handling in stream_llm_call to prevent error suppression
- Implement project scope filtering to ensure consistent filtered views across Orchestrator and sub-agents
- Track filtered files and directories separately when target_files are specified
- Add scope_limited flag and scope_message to project structure for transparency
- Remove manual progress_percentage setting and rely on computed property for COMPLETED status
- Improve code comments with diagnostic markers (🔥) for critical sections
2025-12-12 16:36:39 +08:00
lintsinghua eed111c04d chore: reduce logging verbosity and clean up file formatting
- Change logger.info to logger.debug in agent_tasks.py streaming and tree endpoints
- Disable SQLAlchemy echo mode in database session configuration
- Suppress uvicorn access logs and LiteLLM INFO level logging in main application
- Remove LogViewer component and LogsPage from frontend
- Add trailing newlines to multiple backend configuration and model files
- Update frontend routing to remove logs page reference
- Improve application startup logging clarity by filtering verbose third-party logs
2025-12-12 15:50:48 +08:00
lintsinghua f05c0073e1 feat(agent): implement comprehensive agent architecture with knowledge base and persistence layer
- Add database migrations for agent checkpoints and tree node tracking
- Implement core agent execution framework with executor, state management, and message handling
- Create knowledge base system with framework-specific modules (Django, FastAPI, Flask, Express, React, Supabase)
- Add vulnerability knowledge modules covering authentication, cryptography, injection, XSS, XXE, SSRF, path traversal, deserialization, and race conditions
- Introduce new agent tools: thinking tool, reporting tool, and agent-specific utilities
- Implement LLM memory compression and prompt caching for improved performance
- Add agent registry and persistence layer for checkpoint management
- Refactor agent implementations (analysis, recon, verification, orchestrator) with enhanced capabilities
- Remove legacy agent implementations (analysis_v2, react_agent)
- Update API endpoints for agent task creation and project management
- Add frontend components for agent task creation and enhanced audit UI
- Consolidate agent service architecture with improved separation of concerns
- This refactoring provides a scalable foundation for multi-agent collaboration with knowledge-driven decision making and state persistence
2025-12-12 15:27:12 +08:00
lintsinghua 147dfbaf5e feat(agent): enhance streaming with in-memory event manager and fallback polling
- Implement dual-mode streaming: prioritize in-memory EventManager for running tasks with thinking_token support
- Add fallback to database polling for completed tasks without thinking_token replay capability
- Introduce SSE event formatter utility for consistent event serialization across streaming modes
- Add 10ms micro-delay for thinking_token events to ensure proper TCP packet separation and frontend incremental rendering
- Refactor stream_agent_with_thinking endpoint to support both runtime and historical event streaming
- Update event filtering logic to handle both in-memory and database event sources
- Improve logging with debug markers for thinking_token tracking and stream mode selection
- Optimize polling intervals: 0.3s for running tasks, 2.0s for completed tasks
- Reduce idle timeout from 10 minutes to 1 minute for completed task streams
- Update frontend useAgentStream hook to handle unified event format from dual-mode streaming
- Enhance AgentAudit UI to properly display streamed events from both sources
2025-12-12 10:39:32 +08:00
lintsinghua 70776ee5fd feat: Introduce structured agent collaboration with `TaskHandoff` and `analysis_v2` agent, updating core agent logic, tools, and audit UI. 2025-12-11 23:29:04 +08:00
lintsinghua 8938a8a3c9 feat(agent): enhance agent functionality with LLM-driven decision-making and event handling
- Introduce LLM-driven decision-making across various agents, allowing for dynamic adjustments based on real-time analysis.
- Implement new event types for LLM thinking, decisions, actions, and observations to enrich the event streaming experience.
- Update agent task responses to include additional metrics for better tracking of task progress and outcomes.
- Refactor UI components to highlight LLM-related events and improve user interaction during audits.
- Enhance API endpoints to support new event structures and improve overall error handling.
2025-12-11 21:14:32 +08:00
lintsinghua 58c918f557 feat(agent): implement streaming support for agent events and enhance UI components
- Introduce streaming capabilities for agent events, allowing real-time updates during audits.
- Add new hooks for managing agent stream events in React components.
- Enhance the AgentAudit page to display LLM thinking processes and tool call details in real-time.
- Update API endpoints to support streaming event data and improve error handling.
- Refactor UI components for better organization and user experience during audits.
2025-12-11 20:33:46 +08:00
lintsinghua a43ebf1793 refactor(agent): update task completion fields and enhance status handling
- Rename 'finished_at' to 'completed_at' in AgentTaskResponse and related functions for clarity.
- Introduce 'RUNNING' status in AgentTaskStatus to better represent task states.
- Update task configuration handling in AgentRunner to improve initialization logic.
- Enhance UI to reflect new 'RUNNING' and 'REPORTING' statuses in the AgentAudit component.
2025-12-11 19:26:47 +08:00
lintsinghua 129112e4d7 refactor(agent): rename metadata fields and enhance task configuration
- Rename 'metadata' columns to 'event_metadata' and 'finding_metadata' for clarity in database schema.
- Update AgentRunner to construct task configuration from task fields, ensuring default values are applied.
- Improve UI to handle potential null values for progress percentage and security score, enhancing user experience.
2025-12-11 19:23:21 +08:00
lintsinghua 9bc114af1f feat(agent): implement Agent audit module with LangGraph integration
- Introduce new Agent audit functionality for autonomous code security analysis and vulnerability verification.
- Add API endpoints for managing Agent tasks and configurations.
- Implement UI components for Agent mode selection and embedding model configuration.
- Enhance the overall architecture with a focus on RAG (Retrieval-Augmented Generation) for improved code semantic search.
- Create a sandbox environment for secure execution of vulnerability tests.
- Update documentation to include details on the new Agent audit features and usage instructions.
2025-12-11 19:09:10 +08:00