Commit Graph
5 Commits
Author SHA1 Message Date
Autumn-27 289cf6a24f fix(security): jwt.key 移出可浏览工作区(存项目根,自动从 data 迁移)
工作空间文件管理器的根目录是 dataDir(s.m.dir),而 jwt.key 原来就存在
dataDir/jwt.key —— 会被列出/下载(签名密钥泄露→可伪造 token)/删除(重启重生
成→全体登出)。

- loadOrCreateJWTKey(keyDir, dataDir):密钥改存 keyDir/jwt.key;若旧 data/jwt.key
  仍在,启动时迁移(保留密钥不登出、删旧文件从工作区消失)
- New() 增加 keyDir 参数;生产传 config.BaseDir()(项目根),在 dataDir 之外,
  wsResolve 的路径限定使其不可列/读/下载/删
- 测试传临时目录,隔离且不触发迁移;.gitignore 忽略根目录 /jwt.key

注:项目根在 Docker 里不持久化,容器重建会重新生成密钥、需重新登录(单人系统可接受)。
2026-08-11 10:56:39 -04:00
Autumn-27 052c35a954 Merge PR #18: delete traffic targets and LLM task conversations from UI (laohuan12138)
- Traffic 页:按 host 多选精确批量删 + 子串删 + 删后 _blobs 内容寻址块 GC 回收;新增 GET /api/traffic/hosts
- LLM 记录页:按 task_id 下拉选择 + 按任务删除
- 修复 host 选择器 Popover 高度渲染;.gitignore 加 /dist/
- 新增 traffic/traffic_test.go(DeleteHost/DeleteHostsExact/Hosts/GC 共 4 个测试)

本地已验证:go build/vet、traffic 测试、前端 tsc/build 均通过;与当前 main 无冲突。
2026-08-11 09:38:12 -04:00
Autumn-27 37bb386f97 build(bench): 新增 tsecbench 测评环境
- Dockerfile.bench / docker-compose.bench.yml:tsecbench 测评镜像与编排
- bench/entrypoint.sh、seed.sh:容器入口与任务种子脚本
- bench/prompts/*:测评用 planner/worker/challenge 提示词
- bench/.env.example、kali_tools.txt:配置模板与工具清单(真实 .env 仍被忽略)
2026-08-11 09:20:29 -04:00
FileShare Developer c76d0f4c93 feat: delete traffic targets and LLM task conversations from UI
Add delete controls to the Traffic and LLM Records pages so users can
purge recorded data without hand-editing the data volume.

Traffic page:
- Host target picker (Popover with checkboxes + select-all toggle)
- Exact-match batch delete for multiple hosts (DELETE /api/traffic/hosts)
- Substring delete for the host-filter input (DELETE /api/traffic?host=)
- Orphaned content-addressed blob garbage collection after deletes
- Distinct-hosts endpoint (GET /api/traffic/hosts) for the picker

LLM Records page:
- Task picker dropdown (distinct task_id + record counts)
- Per-task delete (DELETE /api/llm/records?task=)

Other:
- Add /dist/ to .gitignore (build artifact)
- Extend traffic_test.go with DeleteHost, DeleteHostsExact, Hosts tests
- Fix Popover render bug (replace ScrollArea that broke height calc)
- Remove fade/zoom animation on the host picker Popover
2026-08-10 11:10:58 +08:00
Autumn-27andClaude Opus 4.8 0ef8561411 chore: ARTEX 初始化
ARTEX — AI 自主渗透测试系统(Go 后端 + Next.js 前端,单二进制内嵌)。

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-07-26 04:27:45 -04:00