feat: prepare 0.3.3 worker llm agent and ui enhancements

db/companies.go

@@ -323,8 +323,8 @@ func (s *CompanyStore) AddScope(companyID int64, lines []string, reason string)
 	return s.AddScopeInputs(companyID, inputs, reason)
 }
 
-// AddScopeInputs inserts structured scope rules. Empty kinds retain the legacy
-// domain/IP/CIDR auto-detection used by AddScope.
+// AddScopeInputs inserts structured scope rules. Empty kinds use the automatic
+// CIDR/IP/ICP/domain/keyword classification used by AddScope.
 func (s *CompanyStore) AddScopeInputs(companyID int64, inputs []ScopeInput, reason string) (added, skipped, invalid int, errors []string) {
 	added, skipped, invalid, validationErrors, err := s.AddScopeInputsChecked(companyID, inputs, reason)
 	if err != nil {
@@ -604,6 +604,11 @@ func (s *CompanyStore) UpdateScopeInputsChecked(companyID int64, inputs []ScopeI
 		return 0, 0, nil, err
 	}
 	rules, invalid, errs := parseScopeInputs(inputs)
+	if invalid > 0 {
+		return 0, invalid, errs, &CompanyScopeValidationError{Message: fmt.Sprintf(
+			"企业范围包含 %d 条无效规则，未覆盖原有范围", invalid,
+		)}
+	}
 	if err := validateParsedScopeBounds(rules); err != nil {
 		return 0, invalid, errs, err
 	}

db/companies_test.go

@@ -255,6 +255,23 @@ func TestUpdateScope(t *testing.T) {
 	if len(scope) != 1 || scope[0].Domain != "new-domain.com" {
 		t.Errorf("UpdateScope: expected new-domain.com only, got %+v", scope)
 	}
+
+	// Invalid replacement input must not turn a partial validation response into
+	// a destructive replacement of the existing rules.
+	added, invalid, validationErrors, err := cs.UpdateScopeInputsChecked(id, []ScopeInput{
+		{Kind: "domain", Value: "co.uk"},
+	}, "invalid replacement")
+	var validationErr *CompanyScopeValidationError
+	if added != 0 || invalid != 1 || len(validationErrors) != 1 || !errors.As(err, &validationErr) {
+		t.Fatalf("invalid replacement: added=%d invalid=%d validation=%v err=%v", added, invalid, validationErrors, err)
+	}
+	scope, err = cs.GetScope(id)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(scope) != 1 || scope[0].Domain != "new-domain.com" {
+		t.Fatalf("invalid replacement changed existing scope: %+v", scope)
+	}
 }
 
 func TestUpdateScopeRollsBackOnInsertFailure(t *testing.T) {

db/company_scope.go

@@ -3,14 +3,16 @@ package db
 import (
 	"fmt"
 	"net"
+	"net/url"
 	"strings"
 	"unicode"
 
+	"golang.org/x/net/idna"
 	"golang.org/x/net/publicsuffix"
 )
 
 // ParsedScope is one parsed asset-scope entry. Its kind selects Domain, Net, or Value.
-// Used internally by ParseScopeLine / ParseScopeLines (passed to CompanyStore).
+// Used internally by the company scope parsers and CompanyStore.
 type ParsedScope struct {
 	Kind   string // "domain" | "ip" | "cidr" | "icp" | "keyword"
 	Domain string // normalized registrable/root domain (kind=domain)
@@ -20,7 +22,7 @@ type ParsedScope struct {
 }
 
 // ScopeInput is the structured API form for a company scope rule. Empty Kind
-// preserves the legacy one-line auto detection for domain/IP/CIDR clients.
+// uses the same automatic classification as the single-textarea UI.
 type ScopeInput struct {
 	Kind  string `json:"kind,omitempty"`
 	Value string `json:"value"`
@@ -41,13 +43,56 @@ func normalizeKeyword(value string) string {
 	return strings.ToLower(strings.Join(strings.Fields(value), " "))
 }
 
+func looksLikeIPAddress(value string) bool {
+	value = strings.TrimSpace(value)
+	if strings.Contains(value, "://") || strings.IndexFunc(value, unicode.IsSpace) >= 0 {
+		return false
+	}
+	if strings.Count(value, ":") >= 2 {
+		// Require an IPv6-looking prefix. This still catches malformed values such
+		// as 2001:db8::zz without treating ordinary colon-delimited keywords as IPs.
+		parts := strings.Split(value, ":")
+		validSegments := 0
+		for _, part := range parts {
+			if part == "" {
+				if validSegments > 0 || strings.HasPrefix(value, "::") {
+					return true
+				}
+				continue
+			}
+			if len(part) > 4 {
+				return false
+			}
+			for _, r := range part {
+				if !((r >= '0' && r <= '9') || (r >= 'a' && r <= 'f') || (r >= 'A' && r <= 'F')) {
+					return false
+				}
+			}
+			validSegments++
+			if validSegments >= 2 {
+				return true
+			}
+		}
+		return false
+	}
+	if !strings.Contains(value, ".") {
+		return false
+	}
+	for _, r := range value {
+		if r != '.' && (r < '0' || r > '9') {
+			return false
+		}
+	}
+	return true
+}
+
 // ParseScopeInput validates an explicitly typed rule. Legacy callers can omit
-// Kind and retain the existing domain/IP/CIDR auto-detection behavior.
+// Kind and use the same automatic classification as the single-textarea UI.
 func ParseScopeInput(input ScopeInput) (ParsedScope, error) {
 	kind := strings.ToLower(strings.TrimSpace(input.Kind))
 	raw := strings.TrimSpace(input.Value)
 	if kind == "" {
-		return ParseScopeLine(raw)
+		return ParseAutoScopeLine(raw)
 	}
 	switch kind {
 	case "domain", "ip", "cidr":
@@ -76,6 +121,93 @@ func ParseScopeInput(input ScopeInput) (ParsedScope, error) {
 	}
 }
 
+// ParseAutoScopeLine classifies one untyped textarea line. Network-looking and
+// domain-looking values remain strict so malformed ranges do not silently become
+// Agent keywords; all other non-empty text is a keyword.
+func ParseAutoScopeLine(line string) (ParsedScope, error) {
+	raw := strings.TrimSpace(line)
+	if raw == "" {
+		return ParsedScope{}, fmt.Errorf("空行")
+	}
+
+	if _, _, err := net.ParseCIDR(raw); err == nil {
+		return ParseScopeLine(raw)
+	}
+	if ip := net.ParseIP(raw); ip != nil {
+		return ParseScopeLine(raw)
+	}
+	if slash := strings.LastIndexByte(raw, '/'); slash > 0 {
+		address := strings.TrimSpace(raw[:slash])
+		if net.ParseIP(address) != nil || looksLikeIPAddress(address) {
+			return ParsedScope{Raw: raw}, fmt.Errorf("无效 CIDR: %s", raw)
+		}
+	}
+
+	if looksLikeIPAddress(raw) {
+		return ParsedScope{Raw: raw}, fmt.Errorf("无效 IP: %s", raw)
+	}
+
+	looksLikeDomain := strings.Contains(raw, "://") ||
+		(strings.Contains(raw, ".") && strings.IndexFunc(raw, unicode.IsSpace) < 0)
+	if looksLikeDomain {
+		return ParseScopeLine(raw)
+	}
+	lower := strings.ToLower(raw)
+	if strings.Contains(lower, "icp") || strings.Contains(raw, "备案") {
+		return ParseScopeInput(ScopeInput{Kind: "icp", Value: raw})
+	}
+	return ParseScopeInput(ScopeInput{Kind: "keyword", Value: raw})
+}
+
+func scopeHostname(raw string) (string, error) {
+	candidate := strings.TrimSpace(raw)
+	if candidate == "" {
+		return "", fmt.Errorf("主机名为空")
+	}
+	if strings.HasPrefix(candidate, "//") {
+		candidate = "http:" + candidate
+	} else if !strings.Contains(candidate, "://") {
+		candidate = "http://" + candidate
+	}
+	parsed, err := url.Parse(candidate)
+	if err != nil || parsed.Host == "" {
+		if err == nil {
+			err = fmt.Errorf("缺少主机名")
+		}
+		return "", err
+	}
+	host := strings.TrimSuffix(strings.TrimSpace(parsed.Hostname()), ".")
+	if host == "" {
+		return "", fmt.Errorf("主机名为空")
+	}
+	if ip := net.ParseIP(host); ip != nil {
+		return ip.String(), nil
+	}
+	host, err = idna.Lookup.ToASCII(host)
+	if err != nil {
+		return "", err
+	}
+	host = strings.ToLower(host)
+	if len(host) > 253 {
+		return "", fmt.Errorf("域名超过 253 个字符")
+	}
+	labels := strings.Split(host, ".")
+	if len(labels) < 2 {
+		return "", fmt.Errorf("域名至少需要两个标签")
+	}
+	for _, label := range labels {
+		if label == "" || len(label) > 63 || label[0] == '-' || label[len(label)-1] == '-' {
+			return "", fmt.Errorf("域名标签无效")
+		}
+		for _, r := range label {
+			if !((r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') || r == '-') {
+				return "", fmt.Errorf("域名包含无效字符")
+			}
+		}
+	}
+	return host, nil
+}
+
 // ParseScopeLine classifies and validates one scope line (root domain / IP /
 // CIDR). Guardrails reject bare TLDs and over-broad networks so a rule can never
 // swallow the internet. IP ranges must be expressed as CIDR.
@@ -85,12 +217,8 @@ func ParseScopeLine(line string) (ParsedScope, error) {
 	if raw == "" {
 		return r, fmt.Errorf("空行")
 	}
-	s := raw
-	if i := strings.Index(s, "://"); i >= 0 { // strip scheme if a URL was pasted
-		s = s[i+3:]
-	}
-	// CIDR first — it contains '/', which the path-strip below would remove.
-	if _, ipnet, err := net.ParseCIDR(s); err == nil {
+	// CIDR first because URL parsing treats its slash as a path separator.
+	if _, ipnet, err := net.ParseCIDR(raw); err == nil {
 		ones, bits := ipnet.Mask.Size()
 		if bits == 32 && ones < 16 {
 			return r, fmt.Errorf("网段过宽(IPv4 需 >= /16): %s", raw)
@@ -101,12 +229,8 @@ func ParseScopeLine(line string) (ParsedScope, error) {
 		r.Kind, r.Net = "cidr", ipnet.String()
 		return r, nil
 	}
-	// Strip any path and :port remnants for host-like inputs.
-	if i := strings.IndexByte(s, '/'); i >= 0 {
-		s = s[:i]
-	}
 	// Single IP.
-	if ip := net.ParseIP(strings.TrimSpace(s)); ip != nil {
+	if ip := net.ParseIP(raw); ip != nil {
 		r.Kind = "ip"
 		if ip.To4() != nil {
 			r.Net = ip.String() + "/32"
@@ -115,37 +239,30 @@ func ParseScopeLine(line string) (ParsedScope, error) {
 		}
 		return r, nil
 	}
-	if host, _, ok := strings.Cut(s, ":"); ok { // host:port → host
-		s = host
+	host, err := scopeHostname(raw)
+	if err != nil {
+		return r, fmt.Errorf("无法识别为有效域名/IP/CIDR: %s", raw)
+	}
+	if ip := net.ParseIP(host); ip != nil {
+		r.Kind = "ip"
+		if ip.To4() != nil {
+			r.Net = ip.String() + "/32"
+		} else {
+			r.Net = ip.String() + "/128"
+		}
+		return r, nil
+	}
+	if looksLikeIPAddress(host) {
+		return r, fmt.Errorf("无效 IP: %s", raw)
 	}
 	if strings.Contains(raw, "-") && strings.Count(raw, ".") >= 6 {
 		return r, fmt.Errorf("IP 段请用 CIDR 表示(如 1.2.3.0/24): %s", raw)
 	}
 	// Domain (registrable). Reject bare TLDs / public suffixes.
-	d := DomainKey(s)
-	if d == "" || !strings.Contains(d, ".") {
-		return r, fmt.Errorf("无法识别为根域名/IP/CIDR: %s", raw)
-	}
+	d := DomainKey(host)
 	if suf, icann := publicsuffix.PublicSuffix(d); icann && suf == d {
 		return r, fmt.Errorf("不能用裸 TLD 作为范围: %s", raw)
 	}
 	r.Kind, r.Domain = "domain", d
 	return r, nil
 }
-
-// ParseScopeLines parses a whole text block (one entry per line), returning the
-// valid rules and the invalid lines (with reasons) so the caller can report both.
-func ParseScopeLines(text string) (rules []ParsedScope, invalid []string) {
-	for _, ln := range strings.Split(text, "\n") {
-		if strings.TrimSpace(ln) == "" {
-			continue
-		}
-		r, err := ParseScopeLine(ln)
-		if err != nil {
-			invalid = append(invalid, err.Error())
-			continue
-		}
-		rules = append(rules, r)
-	}
-	return rules, invalid
-}

db/company_scope_test.go

@@ -40,6 +40,65 @@ func TestParseScopeLine(t *testing.T) {
 	}
 }
 
+func TestParseAutoScopeLine(t *testing.T) {
+	cases := []struct {
+		name       string
+		input      string
+		kind       string
+		normalized string
+		wantErr    bool
+	}{
+		{name: "domain", input: "example.com", kind: "domain", normalized: "example.com"},
+		{name: "url", input: "https://sub.example.com/path", kind: "domain", normalized: "sub.example.com"},
+		{name: "url query", input: "https://example.com/path?source=x", kind: "domain", normalized: "example.com"},
+		{name: "url credentials", input: "https://user:[email protected]/path", kind: "domain", normalized: "example.com"},
+		{name: "url ip", input: "http://203.0.113.10/path", kind: "ip", normalized: "203.0.113.10/32"},
+		{name: "ipv4", input: "203.0.113.10", kind: "ip", normalized: "203.0.113.10/32"},
+		{name: "ipv6", input: "2001:db8::10", kind: "ip", normalized: "2001:db8::10/128"},
+		{name: "cidr", input: "198.51.100.0/24", kind: "cidr", normalized: "198.51.100.0/24"},
+		{name: "icp latin", input: "京 ICP备 123号", kind: "icp", normalized: "京icp备123号"},
+		{name: "icp chinese", input: "沪网备案 9988", kind: "icp", normalized: "沪网备案9988"},
+		{name: "icp domain", input: "icp.example.com", kind: "domain", normalized: "icp.example.com"},
+		{name: "icp url query", input: "https://example.com/path?icp=1", kind: "domain", normalized: "example.com"},
+		{name: "keyword", input: "  ACME   Security  ", kind: "keyword", normalized: "acme security"},
+		{name: "colon keyword", input: "ACME: Cloud: Security", kind: "keyword", normalized: "acme: cloud: security"},
+		{name: "empty", input: "  ", wantErr: true},
+		{name: "invalid cidr", input: "10.0.0.0/not-a-prefix", wantErr: true},
+		{name: "invalid ipv4", input: "999.0.0.1", wantErr: true},
+		{name: "invalid ipv6", input: "2001:db8::zz", wantErr: true},
+		{name: "invalid ipv6 cidr", input: "2001:db8::zz/64", wantErr: true},
+		{name: "overbroad cidr", input: "10.0.0.0/8", wantErr: true},
+		{name: "bare suffix", input: "co.uk", wantErr: true},
+		{name: "empty domain label", input: "foo..example.com", wantErr: true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			rule, err := ParseAutoScopeLine(tc.input)
+			if tc.wantErr {
+				if err == nil {
+					t.Fatalf("ParseAutoScopeLine(%q) = %+v, want error", tc.input, rule)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("ParseAutoScopeLine(%q): %v", tc.input, err)
+			}
+			if rule.Kind != tc.kind {
+				t.Fatalf("kind=%q want %q", rule.Kind, tc.kind)
+			}
+			got := rule.Value
+			if rule.Kind == "domain" {
+				got = rule.Domain
+			} else if rule.Kind == "ip" || rule.Kind == "cidr" {
+				got = rule.Net
+			}
+			if got != tc.normalized {
+				t.Fatalf("normalized=%q want %q", got, tc.normalized)
+			}
+		})
+	}
+}
+
 func TestExplicitCompanyAttributionSurvivesScopeRebuild(t *testing.T) {
 	d, as, cs := testSetup(t)
 	defer d.Close()
@@ -277,13 +336,6 @@ func TestCompanyScopeAttribution(t *testing.T) {
 		t.Fatalf("pre-scope asset should be unattributed, got %v", *preCompanyID)
 	}
 
-	rules, invalid := ParseScopeLines(root + "\n198.51.100.0/24\nco.uk")
-	if len(rules) != 2 {
-		t.Fatalf("want 2 valid rules, got %d (%+v)", len(rules), rules)
-	}
-	if len(invalid) != 1 {
-		t.Fatalf("want 1 invalid line, got %v", invalid)
-	}
 	cs.AddScope(cid, []string{root, "198.51.100.0/24"}, "unit test")
 
 	mustCid := func(id int64, want int64, label string) {