Commit Graph

18 Commits

Author SHA1 Message Date
lintsinghua 22b1610825 feat(agent): 新增通用代码执行工具和函数提取工具
添加 RunCodeTool 和 ExtractFunctionTool 用于 LLM 驱动的漏洞验证
放宽沙箱命令限制以支持更灵活的测试
更新验证代理提示词以优先使用动态代码验证
2025-12-18 15:03:30 +08:00
lintsinghua d62fd25fa6 feat(agent): 增强安全工具路径处理逻辑和错误提示
- 新增智能路径解析函数 _smart_resolve_target_path 处理常见路径问题
- 改进 Semgrep、Bandit 等工具的错误处理和日志输出
- 更新工具描述文档,明确路径使用规范
- 在 docker-compose 中添加 SANDBOX_IMAGE 配置
- 优化项目根目录检测逻辑,自动处理单层嵌套目录
2025-12-17 19:22:00 +08:00
lintsinghua dbf03c5ac3 refactor(沙箱工具): 将沙箱镜像配置改为从settings读取
默认镜像配置改为从settings.SANDBOX_IMAGE读取,提高配置灵活性
2025-12-17 18:07:11 +08:00
lintsinghua f1796ca044 fix(docker): 禁用代理环境变量防止网络干扰
在 Docker 容器配置中禁用 HTTP/HTTPS 代理环境变量,防止代理设置干扰容器网络连接
同时优化 sandbox 工具的环境变量处理逻辑
2025-12-17 15:33:53 +08:00
lintsinghua e2109647bf feat(agent): 增强任务执行流程和实时日志反馈
- 在任务执行流程中添加实时事件反馈,包括克隆进度和索引进度
- 实现 RAG v2.0 智能索引功能,支持模型变更检测和增量更新
- 改进文件工具兼容性,支持 path 参数作为 directory 别名
- 扩展前端事件处理逻辑,支持更多事件类型显示
- 修复 tree-sitter 版本兼容性问题
2025-12-16 16:56:09 +08:00
lintsinghua 3639b3a13e fix(agent): 修复工具执行结果处理中的 None 值问题
修复 AgentTool 和外部工具类中结果处理逻辑,确保 data 字段不为 None
添加调试日志和错误处理,改进工具执行失败时的反馈信息
统一所有工具类的错误处理格式,避免前端显示 "None" 字符串
2025-12-15 10:24:58 +08:00
lintsinghua cdf360dcf7 feat: 增加文件上传大小限制至500MB并优化大文件处理
增加ZIP文件上传大小限制从100MB到500MB
在agent工具中添加失败调用追踪和自动跳过机制
优化大文件读取性能,支持流式处理指定行范围
2025-12-15 09:21:37 +08:00
lintsinghua 2df1b39e08 feat: Introduce Kunlun agent tool, add Docker and sandbox environment checks, and update agent services and frontend dialogs. 2025-12-15 02:00:34 +08:00
lintsinghua c64eddac7c feat(agent): 新增多语言代码测试和漏洞验证工具并增强错误处理
新增 PHP、Python、JavaScript 等多语言代码测试工具和命令注入、SQL 注入等专用漏洞验证工具
优化错误处理逻辑,提供更详细的错误信息和堆栈跟踪
增强 JSON 解析器,优先使用 json-repair 库处理复杂格式
改进 Agent 响应解析逻辑,更健壮地提取思考内容和操作指令
完善沙箱管理器的初始化和错误处理机制
2025-12-14 17:20:54 +08:00
lintsinghua a85cdb687d refactor(agent): 重构Agent架构并实现动态Agent树
feat(sandbox): 增强沙箱工具的错误处理和日志记录
test(verification): 添加沙箱验证工具的独立测试脚本
docs: 删除过时的文档和测试文件
2025-12-14 14:52:06 +08:00
lintsinghua e29231cc73 feat(安全扫描): 扩展高风险文件模式和危险模式库支持更多语言和文件类型
增加对Swift、Kotlin、Rust等语言的支持
添加iOS和Android相关配置文件类型
补充移动端开发中常见的安全风险模式
2025-12-14 14:00:04 +08:00
lintsinghua 95929a467b feat(沙箱): 强制使用沙箱验证并增强沙箱功能
- 移除 LLM 模拟验证工具,强制使用沙箱进行漏洞验证
- 增强沙箱容器配置,添加/tmp挂载点
- 扩展沙箱基础镜像,增加多种语言环境支持
- 添加RCE漏洞验证脚本用于测试沙箱功能
- 更新验证Agent的系统提示,明确必须使用沙箱工具
2025-12-14 12:43:44 +08:00
lintsinghua 189274fd56 feat(sandbox): 重构安全工具以使用沙箱环境执行
重构所有安全工具(Semgrep, Bandit等)使用Docker沙箱环境执行,提升安全隔离性
更新Dockerfile基础镜像并集成常用安全扫描工具
添加沙箱管理器的工具命令执行方法,支持资源限制和临时文件系统
2025-12-14 00:07:04 +08:00
lintsinghua 6d98f29fa6 feat: 新增安全工具集成和漏洞知识库扩展
- 添加 Bandit 和 Safety 安全工具到依赖项
- 新增 CSRF、业务逻辑和开放重定向漏洞知识文档
- 实现安全工具一键安装脚本和文档
- 改进模式匹配工具支持直接文件扫描
- 增强遥测模块和 Agent 审计功能
- 修复验证节点中 findings 合并逻辑
- 优化前端 Agent 审计界面和状态展示
2025-12-13 12:35:03 +08:00
lintsinghua f05c0073e1 feat(agent): implement comprehensive agent architecture with knowledge base and persistence layer
- Add database migrations for agent checkpoints and tree node tracking
- Implement core agent execution framework with executor, state management, and message handling
- Create knowledge base system with framework-specific modules (Django, FastAPI, Flask, Express, React, Supabase)
- Add vulnerability knowledge modules covering authentication, cryptography, injection, XSS, XXE, SSRF, path traversal, deserialization, and race conditions
- Introduce new agent tools: thinking tool, reporting tool, and agent-specific utilities
- Implement LLM memory compression and prompt caching for improved performance
- Add agent registry and persistence layer for checkpoint management
- Refactor agent implementations (analysis, recon, verification, orchestrator) with enhanced capabilities
- Remove legacy agent implementations (analysis_v2, react_agent)
- Update API endpoints for agent task creation and project management
- Add frontend components for agent task creation and enhanced audit UI
- Consolidate agent service architecture with improved separation of concerns
- This refactoring provides a scalable foundation for multi-agent collaboration with knowledge-driven decision making and state persistence
2025-12-12 15:27:12 +08:00
lintsinghua 70776ee5fd feat: Introduce structured agent collaboration with `TaskHandoff` and `analysis_v2` agent, updating core agent logic, tools, and audit UI. 2025-12-11 23:29:04 +08:00
lintsinghua 58c918f557 feat(agent): implement streaming support for agent events and enhance UI components
- Introduce streaming capabilities for agent events, allowing real-time updates during audits.
- Add new hooks for managing agent stream events in React components.
- Enhance the AgentAudit page to display LLM thinking processes and tool call details in real-time.
- Update API endpoints to support streaming event data and improve error handling.
- Refactor UI components for better organization and user experience during audits.
2025-12-11 20:33:46 +08:00
lintsinghua 9bc114af1f feat(agent): implement Agent audit module with LangGraph integration
- Introduce new Agent audit functionality for autonomous code security analysis and vulnerability verification.
- Add API endpoints for managing Agent tasks and configurations.
- Implement UI components for Agent mode selection and embedding model configuration.
- Enhance the overall architecture with a focus on RAG (Retrieval-Augmented Generation) for improved code semantic search.
- Create a sandbox environment for secure execution of vulnerability tests.
- Update documentation to include details on the new Agent audit features and usage instructions.
2025-12-11 19:09:10 +08:00