From b513b656aad29fb6ee3f5efea87fd6ab7ecf0639 Mon Sep 17 00:00:00 2001 From: Autumn-27 <53844290+Autumn-27@users.noreply.github.com> Date: Mon, 7 Sep 2026 10:43:38 -0400 Subject: [PATCH] =?UTF-8?q?feat(proxy):=20=E6=96=B0=E5=A2=9E=E5=85=A8?= =?UTF-8?q?=E5=B1=80=E5=87=BA=E5=8F=A3=E4=BB=A3=E7=90=86=E9=85=8D=E7=BD=AE?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 所有目标流量可经统一的全局代理出网(http/https/socks5,支持 user:pass): - 开启流量捕获时,作为 MITM 记录代理的上游(流量照录再经代理出网); 拦截与透传两条路径都走上游,不泄露源 IP。 - 关闭捕获时,直接注入 agent 的 bash 环境与 WebFetch;proxyEnv 增加 ALL_PROXY 以支持 socks5。 配置存于 settings KV 表(无需迁移),前端系统配置页新增「全局代理」卡片。 与网络搜索代理、LLM 代理相互独立。 --- agent/prompt_test.go | 30 +++++--- agent/proxyenv_test.go | 51 +++++++++++++ agent/worker.go | 31 +++++--- server/manager.go | 83 ++++++++++++++++++--- server/server.go | 10 +++ traffic/proxy_test.go | 59 +++++++++++++++ traffic/traffic.go | 58 ++++++++++++-- web/src/app/(main)/system/settings/page.tsx | 57 ++++++++++++++ web/src/lib/mock/data.ts | 1 + web/src/lib/types.ts | 3 + 10 files changed, 349 insertions(+), 34 deletions(-) create mode 100644 agent/proxyenv_test.go create mode 100644 traffic/proxy_test.go diff --git a/agent/prompt_test.go b/agent/prompt_test.go index 66d7fe4..549ef1d 100644 --- a/agent/prompt_test.go +++ b/agent/prompt_test.go @@ -43,21 +43,33 @@ func TestRenderSystemOverrideAndFallback(t *testing.T) { } // worker dual-text via {{if .ProxyAddr}} in a user template, plus the code tail: - // [B] trafficTool present only with a proxy, [C] artifact spec always present. + // [B] trafficTool present only when RECORDING (caCert set — the MITM is on, so + // the traffic_* tools exist), [C] artifact spec always present. The trafficTool + // block is gated on the CA (arg 2), NOT on ProxyAddr — a global egress proxy + // with capture off routes traffic but records nothing. PromptOverride = func(k string) (string, bool) { return "{{if .ProxyAddr}}走代理 {{.ProxyAddr}}{{else}}手动{{end}}", true } - withProxy := workerSystem("127.0.0.1:8080", "/data", "/data") - if !strings.HasPrefix(withProxy, "走代理 127.0.0.1:8080") { - t.Fatalf("worker proxy branch body: %q", withProxy) + recording := workerSystem("127.0.0.1:8080", "/ca.pem", "/data", "/data") + if !strings.HasPrefix(recording, "走代理 127.0.0.1:8080") { + t.Fatalf("worker proxy branch body: %q", recording) } - if !strings.Contains(withProxy, "traffic_search") { - t.Fatalf("worker with proxy should inject trafficTool: %q", withProxy) + if !strings.Contains(recording, "traffic_search") { + t.Fatalf("worker while recording should inject trafficTool: %q", recording) } - if !strings.Contains(withProxy, "中间产物输出规约") { - t.Fatalf("worker missing artifact tail: %q", withProxy) + if !strings.Contains(recording, "中间产物输出规约") { + t.Fatalf("worker missing artifact tail: %q", recording) } - noProxy := workerSystem("", "/data", "/data") + // Egress proxy set but capture OFF (no CA): the ProxyAddr template branch still + // renders, but the trafficTool block must NOT — those tools are not registered. + egressOnly := workerSystem("127.0.0.1:8080", "", "/data", "/data") + if !strings.HasPrefix(egressOnly, "走代理 127.0.0.1:8080") { + t.Fatalf("worker egress-only branch body: %q", egressOnly) + } + if strings.Contains(egressOnly, "traffic_search") { + t.Fatalf("worker without recording must NOT inject trafficTool: %q", egressOnly) + } + noProxy := workerSystem("", "", "/data", "/data") if !strings.HasPrefix(noProxy, "手动") { t.Fatalf("worker no-proxy branch body: %q", noProxy) } diff --git a/agent/proxyenv_test.go b/agent/proxyenv_test.go new file mode 100644 index 0000000..421010d --- /dev/null +++ b/agent/proxyenv_test.go @@ -0,0 +1,51 @@ +package agent + +import ( + "strings" + "testing" +) + +func TestProxyEnvEmptyIsNil(t *testing.T) { + if env := proxyEnv("", ""); env != nil { + t.Fatalf("proxyEnv(\"\", \"\") = %v, want nil (direct)", env) + } +} + +func TestProxyEnvSetsAllProxyForSocks5(t *testing.T) { + // Capture-off egress path: a socks5 proxy, no MITM CA. ALL_PROXY must be set + // (curl reads socks5 only from there), and no CA vars should appear. + env := proxyEnv("socks5://10.0.0.1:1080", "") + has := func(prefix string) bool { + for _, e := range env { + if strings.HasPrefix(e, prefix) { + return true + } + } + return false + } + for _, want := range []string{"HTTP_PROXY=", "HTTPS_PROXY=", "ALL_PROXY=", "all_proxy="} { + if !has(want) { + t.Errorf("proxyEnv missing %s: %v", want, env) + } + } + if has("SSL_CERT_FILE=") || has("CURL_CA_BUNDLE=") { + t.Errorf("proxyEnv without CA must not inject CA vars: %v", env) + } +} + +func TestProxyEnvInjectsCAWhenRecording(t *testing.T) { + env := proxyEnv("http://127.0.0.1:8788", "/data/ca.pem") + has := func(prefix string) bool { + for _, e := range env { + if strings.HasPrefix(e, prefix) { + return true + } + } + return false + } + for _, want := range []string{"SSL_CERT_FILE=", "CURL_CA_BUNDLE=", "REQUESTS_CA_BUNDLE=", "NODE_EXTRA_CA_CERTS="} { + if !has(want) { + t.Errorf("proxyEnv with CA missing %s: %v", want, env) + } + } +} diff --git a/agent/worker.go b/agent/worker.go index 6b9a24a..51e2586 100644 --- a/agent/worker.go +++ b/agent/worker.go @@ -164,11 +164,14 @@ func (w *Worker) SetProxy(addr, caCert string) { w.proxyAddr, w.proxyCACert = ad func (w *Worker) SetWebSearch(o WebSearchOpts) { w.webSearch = o } // proxyEnv builds the Bash-subprocess env that routes child-command HTTP through -// the recording proxy and makes the common toolchain trust its MITM CA — so tools -// need no manual -x/--proxy/-k. Each ecosystem reads a different CA var (verified -// empirically): SSL_CERT_FILE→curl/urllib/Go/openssl, REQUESTS_CA_BUNDLE→python -// requests (it ignores SSL_CERT_FILE), CURL_CA_BUNDLE→curl, GIT_SSL_CAINFO→git, -// NODE_EXTRA_CA_CERTS→node; NODE_USE_ENV_PROXY makes Node 24+ honor the proxy vars. +// the egress proxy (the recording MITM when capture is on, or the global proxy +// directly when it is off) and, only when a MITM CA is present, makes the common +// toolchain trust it — so tools need no manual -x/--proxy/-k. Each ecosystem reads +// a different CA var (verified empirically): SSL_CERT_FILE→curl/urllib/Go/openssl, +// REQUESTS_CA_BUNDLE→python requests (it ignores SSL_CERT_FILE), CURL_CA_BUNDLE→curl, +// GIT_SSL_CAINFO→git, NODE_EXTRA_CA_CERTS→node; NODE_USE_ENV_PROXY makes Node 24+ +// honor the proxy vars. ALL_PROXY is set too so a socks5 egress proxy (which curl +// only reads from ALL_PROXY, not HTTP(S)_PROXY) works in the capture-off path. // Empty proxyAddr → nil (direct, unchanged env). func proxyEnv(proxyAddr, caCert string) []string { if proxyAddr == "" { @@ -177,6 +180,7 @@ func proxyEnv(proxyAddr, caCert string) []string { env := []string{ "HTTP_PROXY=" + proxyAddr, "HTTPS_PROXY=" + proxyAddr, "http_proxy=" + proxyAddr, "https_proxy=" + proxyAddr, + "ALL_PROXY=" + proxyAddr, "all_proxy=" + proxyAddr, // socks5 egress: curl reads only this "NODE_USE_ENV_PROXY=1", // Node 24+: honor HTTP(S)_PROXY in built-in fetch/http } if caCert != "" { @@ -215,9 +219,12 @@ const workerDefaultTmpl = `你是一个授权渗透测试系统的"执行者"(wo 只在授权范围内操作；若系统提示顶部附有【操作约束】，那是最高优先级红线——任何命令/探测在执行前先自检是否违反，违反即不做（哪怕它落在你领到的意图里）。完成本意图后用一句话总结你做了什么、写回了哪些事实。务实、克制、聚焦这一条意图。` // workerTrafficBlock is 段 [B]: the traffic-tool note, code-injected only when -// traffic capture is on (proxyAddr set). Not stored, not editable. -func workerTrafficBlock(proxyAddr string) string { - if proxyAddr == "" { +// traffic capture (recording) is on — i.e. the traffic_* tools actually exist. +// Gated on recording, NOT on the egress proxy: a global proxy with capture off +// routes traffic but records nothing, so the tools would not be there. Not stored, +// not editable. +func workerTrafficBlock(recording bool) string { + if !recording { return "" } return "\n\n**流量工具**：\n- traffic_search / traffic_get / traffic_blob：回看响应、找已访问过的资源，**先查流量、不要重复 curl 同一 URL**。traffic_search **必须指定 host**、默认只回 3 条极轻量索引(id/method/url/status/resp_len，无响应内容)，需要更多显式调大 limit；可用 body_contains 在请求/响应正文里做全文搜索(至少 3 字符，支持子串和中文，如找密码/密钥/报错/内网地址)；要看某条原文用 traffic_get(id)，其中超大正文显示为 @blob sha256:，用 traffic_blob(hash) 分段取全文。" @@ -254,9 +261,11 @@ func ensureRunDir(base string, taskID, intentID int64) string { // cmdOutDir is the SDK large-tool-output spill dir under an agent's run dir. func cmdOutDir(dir string) string { return filepath.Join(dir, "cmd-output") } -func workerSystem(proxyAddr, dataDir, runDir string) string { +func workerSystem(proxyAddr, caCert, dataDir, runDir string) string { body := renderSystem("worker", workerDefaultTmpl, WorkerVars{ProxyAddr: proxyAddr, DataDir: dataDir, Now: nowStr()}) - return body + workerTrafficBlock(proxyAddr) + workerArtifactSpec(runDir) + // caCert is present only when the recording MITM is on, which is exactly when + // the traffic_* tools are registered — so it gates the traffic-tool note. + return body + workerTrafficBlock(caCert != "") + workerArtifactSpec(runDir) } // renderIntentTask formats the claimed intent for the worker's launch USER message: @@ -351,7 +360,7 @@ func (w *Worker) execute(ctx context.Context, name string, taskID int64, as *db. // 压缩。本次意图的专属工作目录 /tasks//i，引擎侧先建好。 runDir := ensureRunDir(w.workDir, taskID, intent.ID) overview := renderWorkerGraphOverview(tsx.graphOverviewData()) - sysBody := workerSystem(w.proxyAddr, w.workDir, runDir) + sysBody := workerSystem(w.proxyAddr, w.proxyCACert, w.workDir, runDir) if w.wantConstraints() { sysBody += constraintBlock(ts) // 操作约束(若有)注入系统提示,worker 执行时严格遵守 } diff --git a/server/manager.go b/server/manager.go index 7001c97..df46d7e 100644 --- a/server/manager.go +++ b/server/manager.go @@ -240,6 +240,11 @@ type Manager struct { braveKey string tavilyKey string webSearchProxy string + // globalProxy is the egress proxy all target traffic routes through + // (http/https/socks5, optional user:pass). Empty = direct. When traffic + // capture is on it becomes the MITM's upstream; when capture is off it is + // injected into agent bash env / WebFetch directly. See ProxyAddr. + globalProxy string } // Settings keys the UI toggles at runtime. @@ -250,8 +255,12 @@ const ( settingBraveKey = "brave_search_api_key" settingTavilyKey = "tavily_search_api_key" settingWebSearchProxy = "web_search_proxy" - settingWorkers = "workers" - settingLLMRecord = "llm_record" + // settingGlobalProxy is the global egress proxy for all target traffic + // (http/https/socks5). Empty = direct. Distinct from web_search_proxy (which + // only routes the search backend) and the per-profile LLM proxy. + settingGlobalProxy = "global_proxy" + settingWorkers = "workers" + settingLLMRecord = "llm_record" // LLM 轮询(故障转移)。默认关闭——开启后走「全局激活配置」的 agent 在当前配置 // 不可用(余额不足/key 失效/限流/服务异常)时自动切到下一个配置。 // settingLLMPoolBindFallback 仅在轮询开启时有意义:默认关闭,即 agent/任务显式 @@ -407,6 +416,17 @@ func NewManager(dir, proxyAddr string) (*Manager, error) { if v, ok, _ := pg.GetSetting(settingWebSearchProxy); ok { m.webSearchProxy = v } + // Global egress proxy (default: direct). When capture is on, feed it to the + // MITM as its upstream so recorded traffic exits through it; when capture is + // off, ProxyAddr hands it to agents directly (bash env / WebFetch). + if v, ok, _ := pg.GetSetting(settingGlobalProxy); ok { + m.globalProxy = strings.TrimSpace(v) + } + if m.traffic != nil { + if err := m.traffic.SetUpstreamProxy(m.globalProxy); err != nil { + log.Printf("[proxy] 全局代理 %q 无效，已忽略: %v", m.globalProxy, err) + } + } m.enrich = enrich.New(m.assets, m.ProxyAddr, 4) // Reconcile the seeded browser MCP with the persisted capture state, so a // restart with capture already on keeps Playwright routed through the proxy. @@ -673,17 +693,28 @@ func (m *Manager) Assets() *pgdb.AssetStore { return m.assets } func (m *Manager) PG() *pgdb.DB { return m.pg } func (m *Manager) Traffic() *traffic.Traffic { return m.traffic } -// ProxyAddr returns the recording proxy address agents route through — empty when -// traffic capture is off, so no proxy is injected (agent runs direct, no recording). +// ProxyAddr returns the egress proxy address agents route target traffic through: +// - capture ON → the recording MITM proxy (which itself exits via the global +// proxy when one is set); agents also get its CA (see ProxyCACert). +// - capture OFF → the global egress proxy directly (empty CA — real target +// certs), or "" when no global proxy is set (direct, no recording). +// +// So the global proxy takes effect in both modes: at the MITM's upstream when +// capturing, in the agent's own bash env / WebFetch when not. func (m *Manager) ProxyAddr() string { - if m.traffic == nil || !m.TrafficEnabled() { - return "" + if m.traffic != nil && m.TrafficEnabled() { + return m.traffic.ProxyAddr() } - return m.traffic.ProxyAddr() + m.mu.RLock() + defer m.mu.RUnlock() + return m.globalProxy } -// ProxyCACert returns the recording proxy's CA cert path (empty when no proxy or -// traffic capture is off), which WebFetch trusts to verify HTTPS through the MITM. +// ProxyCACert returns the CA cert path agents must trust to verify HTTPS through +// the egress proxy. Non-empty ONLY when traffic capture is on (the MITM re-signs +// certs): the global proxy used directly (capture off) is a plain forwarder that +// preserves real target certs, so no custom CA is needed there. Its emptiness is +// also the worker's "recording off" signal (see workerSystem). func (m *Manager) ProxyCACert() string { if m.traffic == nil || !m.TrafficEnabled() { return "" @@ -691,6 +722,40 @@ func (m *Manager) ProxyCACert() string { return m.traffic.CACertPath() } +// GlobalProxy returns the configured global egress proxy URL (empty = direct). +func (m *Manager) GlobalProxy() string { + m.mu.RLock() + defer m.mu.RUnlock() + return m.globalProxy +} + +// SetGlobalProxy validates, persists and applies the global egress proxy +// (http/https/socks5, optional user:pass; empty = direct). It updates the MITM's +// upstream immediately; callers must rebuild agents (applyLLM) afterwards so the +// capture-off path (bash env / WebFetch) picks up the change too. +func (m *Manager) SetGlobalProxy(raw string) error { + raw = strings.TrimSpace(raw) + if raw != "" { + if _, err := traffic.ValidateProxyURL(raw); err != nil { + return err + } + } + if err := m.pg.SetSetting(settingGlobalProxy, raw); err != nil { + return err + } + m.mu.Lock() + m.globalProxy = raw + m.mu.Unlock() + if m.traffic != nil { + if err := m.traffic.SetUpstreamProxy(raw); err != nil { + return err + } + } + // Keep the browser MCP's egress in sync with the new global proxy too. + m.syncBrowserMCPProxy() + return nil +} + func (m *Manager) Close() error { m.mu.Lock() defer m.mu.Unlock() diff --git a/server/server.go b/server/server.go index 5caabad..0e44d38 100644 --- a/server/server.go +++ b/server/server.go @@ -3106,6 +3106,7 @@ func (s *Server) settingsPayload() map[string]any { "brave_key_set": strings.TrimSpace(braveKey) != "", "tavily_key_set": strings.TrimSpace(tavilyKey) != "", "web_search_proxy": proxy, // 独立出口代理(http/https/socks5)，空=直连 + "global_proxy": s.m.GlobalProxy(), // 全局出口代理(http/https/socks5)，所有目标流量走它，空=直连 "python_interpreter": strings.TrimSpace(pyStored), // 用户/自动设的值(空=用运行时检测) "workers": s.m.Workers(), // 并发工作 agent 数(默认3)；对之后启动的任务生效 "task_concurrency_enabled": concOn, // 任务并发上限开关(默认关) @@ -3148,6 +3149,7 @@ func (s *Server) putSettings(w http.ResponseWriter, r *http.Request) { BraveKey *string `json:"brave_search_api_key"` TavilyKey *string `json:"tavily_search_api_key"` WebSearchProxy *string `json:"web_search_proxy"` // 独立出口代理(http/https/socks5)；null=不改，""=清空 + GlobalProxy *string `json:"global_proxy"` // 全局出口代理(http/https/socks5)；null=不改，""=清空(直连) PythonInterp *string `json:"python_interpreter"` // 自定义脚本工具的 python 解释器路径 Workers *int `json:"workers"` // 并发工作 agent 数(>0)；对之后启动的任务生效 // 任务并发上限:同时「运行中」的任务数上限。关闭=不限;开启后新建任务超限则排队,有空位自动启动。 @@ -3243,6 +3245,14 @@ func (s *Server) putSettings(w http.ResponseWriter, r *http.Request) { } changed = true } + if req.GlobalProxy != nil { + // Validation failure (bad scheme/host) is a client error, not a 500. + if err := s.m.SetGlobalProxy(*req.GlobalProxy); err != nil { + writeErr(w, 400, err.Error()) + return + } + changed = true // capture-off egress is baked into agents at build time → rebuild + } if req.WebSearchEnabled != nil || req.WebSearchBackend != nil || req.BraveKey != nil || req.TavilyKey != nil || req.WebSearchProxy != nil { // Fill unspecified fields from current state so a partial PUT doesn't reset them. on, backend, _, _, _ := s.m.WebSearch() diff --git a/traffic/proxy_test.go b/traffic/proxy_test.go new file mode 100644 index 0000000..fbf867b --- /dev/null +++ b/traffic/proxy_test.go @@ -0,0 +1,59 @@ +package traffic + +import "testing" + +func TestValidateProxyURL(t *testing.T) { + ok := []string{ + "http://127.0.0.1:8080", + "https://proxy.example.com:3128", + "socks5://10.0.0.1:1080", + "socks5://user:pass@10.0.0.1:1080", + } + for _, raw := range ok { + if _, err := ValidateProxyURL(raw); err != nil { + t.Errorf("ValidateProxyURL(%q) unexpected error: %v", raw, err) + } + } + bad := []string{ + "127.0.0.1:8080", // no scheme + "ftp://host:21", // unsupported scheme + "http://", // no host + "socks4://10.0.0.1:1080", // unsupported scheme + } + for _, raw := range bad { + if _, err := ValidateProxyURL(raw); err == nil { + t.Errorf("ValidateProxyURL(%q) expected error, got nil", raw) + } + } +} + +func TestSetUpstreamProxyStoreClear(t *testing.T) { + tr := &Traffic{} + if got := tr.upstream.Load(); got != nil { + t.Fatalf("initial upstream = %v, want nil", got) + } + if err := tr.SetUpstreamProxy("socks5://user:pass@10.0.0.1:1080"); err != nil { + t.Fatalf("SetUpstreamProxy: %v", err) + } + u := tr.upstream.Load() + if u == nil || u.Scheme != "socks5" || u.Host != "10.0.0.1:1080" { + t.Fatalf("stored upstream = %v, want socks5://10.0.0.1:1080", u) + } + if pw, _ := u.User.Password(); u.User.Username() != "user" || pw != "pass" { + t.Fatalf("stored upstream lost credentials: %v", u) + } + // Empty clears back to direct. + if err := tr.SetUpstreamProxy(" "); err != nil { + t.Fatalf("SetUpstreamProxy(clear): %v", err) + } + if got := tr.upstream.Load(); got != nil { + t.Fatalf("after clear upstream = %v, want nil", got) + } + // Invalid value is rejected and does not mutate current state. + if err := tr.SetUpstreamProxy("nope://x"); err == nil { + t.Fatal("SetUpstreamProxy(invalid) expected error") + } + if got := tr.upstream.Load(); got != nil { + t.Fatalf("invalid set mutated upstream to %v, want nil", got) + } +} diff --git a/traffic/traffic.go b/traffic/traffic.go index d7a2b7f..c90fc03 100644 --- a/traffic/traffic.go +++ b/traffic/traffic.go @@ -76,7 +76,7 @@ CREATE INDEX IF NOT EXISTS idx_blob_refs_ex ON blob_refs(exchange_id); // must degrade to "no full-text search" rather than take the whole recorder down. // trigram (not the default unicode61) is required for two reasons this subsystem // depends on: it matches arbitrary substrings — "ssw0r" finds "P@ssw0rd" — and it -// handles CJK, which unicode61 does not tokenize. Contentless (content='') keeps +// handles CJK, which unicode61 does not tokenize. Contentless (content=”) keeps // only the index, since the text itself lives in exchange_bodies; contentless_delete // lets rows be deleted without replaying the original text back in. const ftsSchema = `CREATE VIRTUAL TABLE IF NOT EXISTS ex_fts USING fts5( @@ -120,6 +120,11 @@ type Traffic struct { // reason; connections to them are tunneled transparently (fail-open) so the // request still reaches the target — unrecorded — instead of being killed. pass sync.Map // hostname(string) -> struct{} + // upstream is the global egress proxy every captured request is forwarded + // through (nil = dial targets directly). Both the intercepted and the + // transparent-passthrough paths honor it (go-mitmproxy's getUpstreamConn), + // so no host escapes it. Hot-swappable at runtime via SetUpstreamProxy. + upstream atomic.Pointer[url.URL] } // Open initializes the traffic tree, blob store and SQLite index under dir. @@ -159,12 +164,15 @@ func Open(dir, addr string) (*Traffic, error) { db.Close() return nil, err } - // Dial targets DIRECTLY. go-mitmproxy's default upstream uses + // Upstream selection. By default (no global egress proxy set) targets are + // dialed DIRECTLY: go-mitmproxy's own default upstream uses // http.ProxyFromEnvironment, so an HTTP_PROXY/HTTPS_PROXY in the environment // (a VPN/system proxy) would make it forward target requests through that - // external proxy — which can't reach the target → 502. We capture target - // traffic directly, never via the host's proxy. - p.SetUpstreamProxy(func(*http.Request) (*url.URL, error) { return nil, nil }) + // external proxy — which can't reach the target → 502. Returning nil forces + // a direct dial. When a global egress proxy IS configured (SetUpstreamProxy), + // every captured request — intercepted AND transparently tunneled — is + // forwarded through it instead, so no host leaks the real source IP. + p.SetUpstreamProxy(func(*http.Request) (*url.URL, error) { return t.upstream.Load(), nil }) // Fail-open: MITM every host by default, EXCEPT ones a prior request proved we // can't intercept without breaking (see maybePassthrough). Those are tunneled // transparently so the request still reaches the target instead of being killed. @@ -189,6 +197,46 @@ func hostOnly(hostport string) string { // ProxyAddr returns the address workers should set as HTTP(S)_PROXY. func (t *Traffic) ProxyAddr() string { return "http://127.0.0.1" + t.addr } +// SetUpstreamProxy points every captured request at a global egress proxy +// (http/https/socks5, optional user:pass in the URL). An empty raw string clears +// it, restoring direct dialing. The change is atomic and takes effect on the next +// connection — no restart, no proxy rebuild. go-mitmproxy dials all three schemes +// itself, so socks5 works uniformly here regardless of the target tool. +func (t *Traffic) SetUpstreamProxy(raw string) error { + if strings.TrimSpace(raw) == "" { + t.upstream.Store(nil) + return nil + } + u, err := ValidateProxyURL(raw) + if err != nil { + return err + } + t.upstream.Store(u) + return nil +} + +// ValidateProxyURL parses and checks a proxy URL (http/https/socks5, optional +// user:pass), returning the parsed URL. Exposed so callers can validate a global +// proxy before persisting it even when the traffic proxy itself is disabled. +func ValidateProxyURL(raw string) (*url.URL, error) { + raw = strings.TrimSpace(raw) + u, err := url.Parse(raw) + if err != nil { + return nil, fmt.Errorf("解析代理地址 %q: %w", raw, err) + } + switch u.Scheme { + case "http", "https", "socks5": + case "": + return nil, fmt.Errorf("代理 %q 缺少协议(用 http://、https:// 或 socks5://)", raw) + default: + return nil, fmt.Errorf("不支持的代理协议 %q(用 http、https 或 socks5)", u.Scheme) + } + if u.Host == "" { + return nil, fmt.Errorf("代理 %q 缺少主机地址", raw) + } + return u, nil +} + // CACertPath returns the PEM CA cert clients must trust to verify HTTPS through // the MITM proxy (go-mitmproxy writes it here on first start). func (t *Traffic) CACertPath() string { diff --git a/web/src/app/(main)/system/settings/page.tsx b/web/src/app/(main)/system/settings/page.tsx index ec9d734..5a94837 100644 --- a/web/src/app/(main)/system/settings/page.tsx +++ b/web/src/app/(main)/system/settings/page.tsx @@ -26,6 +26,8 @@ export default function SystemSettingsPage() { const [savingTavilyKey, setSavingTavilyKey] = React.useState(false); const [proxyInput, setProxyInput] = React.useState(""); const [savingProxy, setSavingProxy] = React.useState(false); + const [globalProxyInput, setGlobalProxyInput] = React.useState(""); + const [savingGlobalProxy, setSavingGlobalProxy] = React.useState(false); const [testing, setTesting] = React.useState(false); const [loaded, setLoaded] = React.useState(false); const [saving, setSaving] = React.useState(false); @@ -46,6 +48,7 @@ export default function SystemSettingsPage() { setBraveKeySet(!!s.brave_key_set); setTavilyKeySet(!!s.tavily_key_set); setProxyInput(s.web_search_proxy || ""); + setGlobalProxyInput(s.global_proxy || ""); setPyInterp(s.python_interpreter || ""); setWorkers(String(s.workers ?? 3)); setInjectPlanner(s.constraints_inject_planner !== false); @@ -180,6 +183,18 @@ export default function SystemSettingsPage() { .finally(() => setSavingProxy(false)); }; + const saveGlobalProxy = () => { + setSavingGlobalProxy(true); + api + .setSettings({ global_proxy: globalProxyInput.trim() }) + .then((s) => { + apply(s); + toast.success(globalProxyInput.trim() ? "已保存全局代理" : "已清除全局代理（改为直连）"); + }) + .catch((e) => toast.error("保存失败：" + (e as Error).message)) + .finally(() => setSavingGlobalProxy(false)); + }; + // Run a real "test" search ("test") against the CURRENT form values (backend + // proxy + entered key), falling back to saved values server-side. Toasts result. const runTest = () => { @@ -241,6 +256,48 @@ export default function SystemSettingsPage() { + + + + + 全局代理 + + + 所有 Agent 的目标流量经此代理出网（隐藏源 IP / 走跳板）。支持 http / https / socks5，可带{" "} + user:pass 认证。留空=直连。 +
+ 开启流量捕获时，它作为记录代理的上游（流量仍全量落库，再经此代理出网）；关闭捕获时，直接注入 + Agent 的 bash / WebFetch 出网。与网络搜索代理、LLM 代理相互独立。 +
+ 提示：socks5 在关闭捕获时依赖各命令行工具对 ALL_PROXY 的支持（curl 可用，部分工具可能忽略）； + 若主要用 socks5，建议开启流量捕获——此路径由 MITM 亲自拨号，工具无感知、稳定生效。 + + + + +
+ setGlobalProxyInput(e.target.value)} + /> + +
+

+ {globalProxyInput.trim() + ? "已配置 · 所有目标流量经此代理出网" + : "未配置 · 目标流量直连出网"} +

+ + + diff --git a/web/src/lib/mock/data.ts b/web/src/lib/mock/data.ts index 7dfeabf..be0e186 100644 --- a/web/src/lib/mock/data.ts +++ b/web/src/lib/mock/data.ts @@ -3315,6 +3315,7 @@ export const settings: Settings = { brave_key_set: false, tavily_key_set: true, web_search_proxy: "", + global_proxy: "", python_interpreter: "/usr/bin/python3", workers: 3, llm_pool_enabled: true, diff --git a/web/src/lib/types.ts b/web/src/lib/types.ts index 4fdd53f..55b0ec8 100644 --- a/web/src/lib/types.ts +++ b/web/src/lib/types.ts @@ -866,6 +866,9 @@ export interface Settings { tavily_search_api_key?: string; // 独立出口代理(http/https/socks5)，用于访问搜索端点；与记录流量的 MITM 代理无关。空=直连。 web_search_proxy?: string; + // 全局出口代理(http/https/socks5，可带 user:pass)，所有目标流量走它。开启流量捕获时作为 + // MITM 上游；关闭捕获时直接注入 agent 的 bash/WebFetch。空=直连。 + global_proxy?: string; python_interpreter?: string; // 自定义脚本工具的 python 解释器路径(空=运行时检测) workers?: number; // 并发工作 agent 数(默认3)；对之后启动的任务生效 // 任务并发上限:同时「运行中」的任务数上限。关闭=不限;开启后新建任务超限则排队,有空位自动启动。