@baimingtao/lbs-agent 1.0.0

package/extensions/skills/optional/research/darwinian-evolver/scripts/show_snapshot.py

@@ -0,0 +1,92 @@
+"""
+show_snapshot.py — Dump the population from a darwinian-evolver snapshot pickle.
+
+Usage:
+    python show_snapshot.py PATH/TO/iteration_N.pkl [--field prompt_template]
+
+The script is intentionally Organism-agnostic: it walks `org.__dict__` and prints
+all str fields. By default it shows `prompt_template` if present; pass --field to
+target a different attribute (e.g. `regex_pattern`, `sql_query`, `code_block`).
+"""
+from __future__ import annotations
+
+import argparse
+import pickle
+import sys
+from pathlib import Path
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser()
+    ap.add_argument("snapshot", type=Path)
+    ap.add_argument(
+        "--field",
+        default=None,
+        help="Organism attribute to display. Defaults to the first str field found.",
+    )
+    ap.add_argument("--top", type=int, default=None, help="Show only top N by score.")
+    ap.add_argument(
+        "--i-trust-this-file",
+        action="store_true",
+        help=(
+            "Required acknowledgement that the snapshot is from a trusted source. "
+            "pickle.loads executes arbitrary code embedded in the file (RCE) and "
+            "must NEVER be run on snapshots received from untrusted parties."
+        ),
+    )
+    args = ap.parse_args()
+
+    if not args.snapshot.exists():
+        sys.exit(f"snapshot not found: {args.snapshot}")
+
+    if not args.i_trust_this_file:
+        sys.exit(
+            "refusing to unpickle: pickle.loads is equivalent to executing arbitrary "
+            "code from the snapshot file. Only proceed if you created/control this "
+            "file, then re-run with --i-trust-this-file.\n"
+            f"  file: {args.snapshot}"
+        )
+
+    print(
+        f"WARNING: unpickling {args.snapshot} — this executes code embedded in the "
+        "file. Only safe for snapshots you produced yourself.",
+        file=sys.stderr,
+    )
+
+    # 外部 pickle 封装了一个字典；内部 pickle 包含实际的 organism
+    # 对象，这些对象必须能通过其原始的点分路径导入。如果你
+    # 运行了自定义的 driver，在调用此方法之前，请确保其模块位于 sys.path 中。
+    outer = pickle.loads(args.snapshot.read_bytes())  # noqa: S301 — gated by --i-trust-this-file
+    if not isinstance(outer, dict) or "population_snapshot" not in outer:
+        sys.exit("not a darwinian-evolver snapshot (no population_snapshot key)")
+    inner = pickle.loads(outer["population_snapshot"])  # noqa: S301 — gated by --i-trust-this-file
+    pairs = inner["organisms"]  # (Organism, EvaluationResult) 的列表
+
+    print(f"# organisms: {len(pairs)}\n")
+    ranked = sorted(pairs, key=lambda p: getattr(p[1], "score", 0) or 0, reverse=True)
+    if args.top:
+        ranked = ranked[: args.top]
+
+    for i, (org, res) in enumerate(ranked):
+        score = getattr(res, "score", float("nan"))
+        print(f"=== rank {i} score={score:.3f} ===")
+        # 挑选字段
+        field = args.field
+        if field is None:
+            for k, v in vars(org).items():
+                if isinstance(v, str) and not k.startswith("_") and k not in {"id",}:
+                    field = k
+                    break
+        val = getattr(org, field, None) if field else None
+        if val is None:
+            print(f"  (no string field; org fields: {list(vars(org).keys())})")
+        else:
+            print(f"  {field} ({len(val)} chars):")
+            for ln in val.splitlines()[:30]:
+                print(f"    {ln}")
+        print()
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/extensions/skills/optional/research/darwinian-evolver/templates/custom_problem_template.py

@@ -0,0 +1,240 @@
+"""
+Template: a custom darwinian-evolver problem.
+
+Copy this file, fill in the THREE marked spots (Organism, Evaluator, Mutator),
+then run it as a driver script. The skeleton handles all the wiring so you only
+write the domain-specific logic.
+
+To run:
+    cd ~/.hermes/cache/darwinian-evolver/darwinian_evolver
+    OPENROUTER_API_KEY=... uv run --with openai python /path/to/this_file.py \
+        --num_iterations 3 --num_parents_per_iteration 2 \
+        --output_dir /tmp/my_problem
+
+The pattern mirrors `scripts/parrot_openrouter.py` (the working reference).
+"""
+from __future__ import annotations
+
+import argparse
+import os
+import sys
+from pathlib import Path
+
+from openai import OpenAI
+
+# 上游类型（AGPL — 在生产环境中通过子进程调用；在此处导入
+# 对于用户拥有的技能侧驱动程序脚本没有问题）。
+from darwinian_evolver.cli_common import (
+    build_hyperparameter_config_from_args,
+    parse_learning_log_view_type,
+    register_hyperparameter_args,
+)
+from darwinian_evolver.evolve_problem_loop import EvolveProblemLoop
+from darwinian_evolver.learning_log import LearningLogEntry
+from darwinian_evolver.problem import (
+    EvaluationFailureCase,
+    EvaluationResult,
+    Evaluator,
+    Mutator,
+    Organism,
+    Problem,
+)
+
+DEFAULT_MODEL = os.environ.get("EVOLVER_MODEL", "openai/gpt-4o-mini")
+
+
+def _client() -> OpenAI:
+    key = os.environ.get("OPENROUTER_API_KEY")
+    if not key:
+        sys.exit("OPENROUTER_API_KEY is not set")
+    return OpenAI(api_key=key, base_url="https://openrouter.ai/api/v1")
+
+
+def _prompt_llm(prompt: str, max_tokens: int = 1024) -> str:
+    try:
+        r = _client().chat.completions.create(
+            model=DEFAULT_MODEL,
+            max_tokens=max_tokens,
+            messages=[{"role": "user", "content": prompt}],
+        )
+        return r.choices[0].message.content or ""
+    except Exception as e:
+        # 绝不能让一次糟糕的 LLM 响应导致运行中断。
+        return f"<LLM_ERROR: {type(e).__name__}: {e}>"
+
+
+# ---------------------------------------------------------------------------
+# 1. 生物体 (ORGANISM) — 你正在进化的对象。
+# ---------------------------------------------------------------------------
+class MyOrganism(Organism):
+    # TODO: 替换为你的 artifact 字段。常见结构：
+    #   prompt_template: str
+    #   regex_pattern: str
+    #   sql_query: str
+    #   code_block: str
+    artifact: str
+
+    def run(self, *inputs) -> str:
+        """Exercise the organism on a test input. Return whatever your
+        evaluator wants to score."""
+        # TODO: 实现此功能。对于 prompt 进化，这通常会调用 _prompt_llm
+        # 并使用针对输入渲染的 artifact。对于 regex/SQL，它会
+        # 调用 `re.findall(self.artifact, input)` / 执行 SQL / 等等。
+        raise NotImplementedError
+
+
+# ---------------------------------------------------------------------------
+# 2. 评估器 (EVALUATOR) — 为生物体打分，并暴露变异器可以从中学习的错误。
+# ---------------------------------------------------------------------------
+class MyFailureCase(EvaluationFailureCase):
+    # TODO: 提供足够的上下文，以便 LLM 诊断故障。
+    input: str
+    expected: str
+    actual: str
+
+
+class MyEvaluator(Evaluator[MyOrganism, EvaluationResult, MyFailureCase]):
+    # 拆分你的数据集。变异器只能看到可训练集；保留集用于检测过拟合。
+    TRAINABLE = [
+        # TODO: (input, expected) 元组列表
+        # ("input1", "expected1"),
+    ]
+    HOLDOUT = [
+        # TODO: 变异器永远不会看到的独立集合
+    ]
+
+    def evaluate(self, organism: MyOrganism) -> EvaluationResult:
+        train_fails: list[MyFailureCase] = []
+        hold_fails: list[MyFailureCase] = []
+        for i, (inp, expected) in enumerate(self.TRAINABLE):
+            actual = organism.run(inp)
+            if actual != expected:
+                train_fails.append(MyFailureCase(
+                    input=inp, expected=expected, actual=actual,
+                    data_point_id=f"trainable_{i}",
+                ))
+        for i, (inp, expected) in enumerate(self.HOLDOUT):
+            actual = organism.run(inp)
+            if actual != expected:
+                hold_fails.append(MyFailureCase(
+                    input=inp, expected=expected, actual=actual,
+                    data_point_id=f"holdout_{i}",
+                ))
+        n_total = len(self.TRAINABLE) + len(self.HOLDOUT)
+        n_ok = n_total - len(train_fails) - len(hold_fails)
+        return EvaluationResult(
+            score=n_ok / n_total if n_total else 0.0,
+            trainable_failure_cases=train_fails,
+            holdout_failure_cases=hold_fails,
+            # 始终可行。进化器只会拦截完全损坏的生物体；
+            # 0 分的生物体是可以接受的，只是被抽样的频率会降低。
+            is_viable=True,
+        )
+
+
+# ---------------------------------------------------------------------------
+# 3. 变异器 (MUTATOR) — LLM 根据失败案例提出改进后的生物体。
+# ---------------------------------------------------------------------------
+class MyMutator(Mutator[MyOrganism, MyFailureCase]):
+    PROMPT = """
+The current artifact is:
+```
+{artifact}
+```
+
+On this input:
+```
+{input}
+```
+it produced:
+```
+{actual}
+```
+but we wanted:
+```
+{expected}
+```
+
+Diagnose what went wrong, then propose an improved version of the artifact.
+Put the new version in the LAST triple-backtick block of your response.
+""".strip()
+
+    def mutate(
+        self,
+        organism: MyOrganism,
+        failure_cases: list[MyFailureCase],
+        learning_log_entries: list[LearningLogEntry],
+    ) -> list[MyOrganism]:
+        fc = failure_cases[0]
+        prompt = self.PROMPT.format(
+            artifact=organism.artifact,
+            input=fc.input,
+            actual=fc.actual,
+            expected=fc.expected,
+        )
+        resp = _prompt_llm(prompt)
+        parts = resp.split("```")
+        if len(parts) < 3:
+            return []
+        new_artifact = parts[-2].strip()
+        # 移除开头的语言标记，例如 "python\n" 或 "sql\n"
+        if "\n" in new_artifact:
+            first_line, rest = new_artifact.split("\n", 1)
+            if first_line and not first_line.startswith(" ") and len(first_line) < 20:
+                new_artifact = rest
+        return [MyOrganism(artifact=new_artifact)]
+
+
+# ---------------------------------------------------------------------------
+# 驱动程序 — 填充 EvolveProblemLoop 样板代码。在典型的运行中，你不需要
+# 修改此行以下的任何内容。
+# ---------------------------------------------------------------------------
+def make_problem() -> Problem:
+    initial = MyOrganism(artifact="TODO: starting artifact here")  # TODO
+    return Problem[MyOrganism, EvaluationResult, MyFailureCase](
+        evaluator=MyEvaluator(),
+        mutators=[MyMutator()],
+        initial_organism=initial,
+    )
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser()
+    register_hyperparameter_args(ap.add_argument_group("hyperparameters"))
+    ap.add_argument("--num_iterations", type=int, default=3)
+    ap.add_argument("--mutator_concurrency", type=int, default=2)
+    ap.add_argument("--evaluator_concurrency", type=int, default=2)
+    ap.add_argument("--output_dir", type=str, required=True)
+    args = ap.parse_args()
+
+    out = Path(args.output_dir)
+    out.mkdir(parents=True, exist_ok=True)
+    (out / "snapshots").mkdir(exist_ok=True)
+
+    hp = build_hyperparameter_config_from_args(args)
+    loop = EvolveProblemLoop(
+        problem=make_problem(),
+        learning_log_view_type=parse_learning_log_view_type(hp.learning_log_view_type),
+        num_parents_per_iteration=hp.num_parents_per_iteration,
+        mutator_concurrency=args.mutator_concurrency,
+        evaluator_concurrency=args.evaluator_concurrency,
+        fixed_midpoint_score=hp.fixed_midpoint_score,
+        midpoint_score_percentile=hp.midpoint_score_percentile,
+        sharpness=hp.sharpness,
+        novelty_weight=hp.novelty_weight,
+        batch_size=hp.batch_size,
+        should_verify_mutations=hp.verify_mutations,
+    )
+
+    print("Evaluating initial organism...")
+    for snap in loop.run(num_iterations=args.num_iterations):
+        (out / "snapshots" / f"iteration_{snap.iteration}.pkl").write_bytes(snap.snapshot)
+        _, best = snap.best_organism_result
+        print(f"iter={snap.iteration} pop={snap.population_size} best_score={best.score:.3f}")
+
+    print(f"\nDone. Results in: {out}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/extensions/skills/optional/research/domain-intel/SKILL.md

@@ -0,0 +1,97 @@
+---
+name: domain-intel
+description: 使用 Python 标准库进行被动域名侦察。包括子域名发现、SSL 证书检查、WHOIS 查询、DNS 记录、域名可用性检查以及批量多域名分析。无需 API 密钥。
+platforms: [linux, macos, windows]
+---
+
+# Domain Intelligence — 被动 OSINT
+
+仅使用 Python 标准库进行被动域名侦察。
+**零依赖。零 API 密钥。支持 Linux、macOS 和 Windows。**
+
+## 辅助脚本
+
+该 skill 包含 `scripts/domain_intel.py` — 一个用于所有域名情报操作的完整 CLI 工具。
+
+```bash
+# Subdomain discovery via Certificate Transparency logs
+python3 SKILL_DIR/scripts/domain_intel.py subdomains example.com
+
+# SSL certificate inspection (expiry, cipher, SANs, issuer)
+python3 SKILL_DIR/scripts/domain_intel.py ssl example.com
+
+# WHOIS lookup (registrar, dates, name servers — 100+ TLDs)
+python3 SKILL_DIR/scripts/domain_intel.py whois example.com
+
+# DNS records (A, AAAA, MX, NS, TXT, CNAME)
+python3 SKILL_DIR/scripts/domain_intel.py dns example.com
+
+# Domain availability check (passive: DNS + WHOIS + SSL signals)
+python3 SKILL_DIR/scripts/domain_intel.py available coolstartup.io
+
+# Bulk analysis — multiple domains, multiple checks in parallel
+python3 SKILL_DIR/scripts/domain_intel.py bulk example.com github.com google.com
+python3 SKILL_DIR/scripts/domain_intel.py bulk example.com github.com --checks ssl,dns
+```
+
+`SKILL_DIR` 是包含此 SKILL.md 文件的目录。所有输出均为结构化的 JSON。
+
+## 可用命令
+
+| 命令 | 功能描述 | 数据源 |
+| --------- | ------------- | ------------- |
+| `subdomains` | 从证书日志中查找子域名 | crt.sh (HTTPS) |
+| `ssl` | 检查 TLS 证书详情 | 直连目标 TCP:443 |
+| `whois` | 注册信息、注册商、日期 | WHOIS 服务器 (TCP:43) |
+| `dns` | A、AAAA、MX、NS、TXT、CNAME 记录 | 系统 DNS + Google DoH |
+| `available` | 检查域名是否已注册 | DNS + WHOIS + SSL 信号 |
+| `bulk` | 对多个域名运行多项检查 | 以上所有 |
+
+## 何时使用此工具与内置工具
+
+- **使用此 skill** 解决基础设施问题：子域名、SSL 证书、WHOIS、DNS 记录、可用性
+- **使用 `web_search`** 对域名/公司的业务进行一般性研究
+- **使用 `web_extract`** 获取网页的实际内容
+- **使用 `terminal` 配合 `curl -I`** 进行简单的“URL 是否可访问”检查
+
+| 任务 | 更好的工具 | 原因 |
+| ------ | ------------- | ----- |
+| "example.com 是做什么的？" | `web_extract` | 获取页面内容，而不是 DNS/WHOIS 数据 |
+| "查找关于某公司的信息" | `web_search` | 一般性研究，而非特定于域名 |
+| "这个网站安全吗？" | `web_search` | 信誉检查需要网络上下文 |
+| "检查 URL 是否可访问" | `terminal` 配合 `curl -I` | 简单的 HTTP 检查 |
+| "查找 X 的子域名" | **此 skill** | 唯一的被动数据源 |
+| "SSL 证书何时过期？" | **此 skill** | 内置工具无法检查 TLS |
+| "谁注册了这个域名？" | **此 skill** | 网络搜索中不包含 WHOIS 数据 |
+| "coolstartup.io 可用吗？" | **此 skill** | 基于 DNS+WHOIS+SSL 的被动可用性探测 |
+
+## 平台兼容性
+
+纯 Python 标准库（`socket`、`ssl`、`urllib`、`json`、`concurrent.futures`）。
+在 Linux、macOS 和 Windows 上的工作方式完全相同，无任何依赖。
+
+- **crt.sh 查询** 使用 HTTPS（端口 443） — 适用于大多数防火墙之后
+- **WHOIS 查询** 使用 TCP 端口 43 — 在严格的网络环境下可能会被阻止
+- **DNS 查询** 使用 Google DoH（HTTPS）进行 MX/NS/TXT 解析 — 对防火墙友好
+- **SSL 检查** 连接到目标的 443 端口 — 唯一的“主动”操作
+
+## 数据源
+
+所有查询均为**被动**方式 — 不进行端口扫描，不进行漏洞测试：
+
+- **crt.sh** — Certificate Transparency logs（证书透明度日志，用于子域名发现，仅限 HTTPS）
+- **WHOIS servers**（WHOIS 服务器） — 直接通过 TCP 连接 100 多个权威 TLD 注册商
+- **Google DNS-over-HTTPS** — 解析 MX、NS、TXT、CNAME 记录（对防火墙友好）
+- **System DNS**（系统 DNS） — 解析 A/AAAA 记录
+- **SSL check**（SSL 检查） 是唯一的“主动”操作（通过 TCP 连接到 target:443）
+
+## 说明
+
+- WHOIS 查询使用 TCP 端口 43 — 在限制严格的网络中可能会被阻止
+- 部分 WHOIS 服务器会隐去注册人信息 (GDPR) — 需向用户说明这一点
+- 对于非常受欢迎的域名（拥有数千个证书），crt.sh 的查询可能会很慢 — 需设定合理的预期
+- 可用性检查基于启发式方法（3 种被动信号） — 不像注册商 API 那样具有权威性
+
+---
+
+*由 [@FurkanL0](https://github.com/FurkanL0) 贡献*