agent-bypass 2.20.1 → 2.22.0

package/tests/test_regressions.py

@@ -153,5 +153,409 @@ class JsripSameSiteTests(unittest.TestCase):
         self.assertFalse(self.js.same_site("https://example.com", "https://wwwexample.com/a.js"))
 
 
+class DshInstallerTests(unittest.TestCase):
+    """DeepSeek Harness：技能安装 + Ck 模式预设注入（临时 HOME，离线）。"""
+
+    DSH_ENV = ("DSH_HOME", "DSH_PROFILE", "DSH_AGENTS_HOME", "DSH_APP_PATH", "DSH_ASAR_PATH")
+
+    def _node(self, *args, home):
+        env = dict(os.environ)
+        env["HOME"] = home
+        for k in self.DSH_ENV:
+            env.pop(k, None)
+        return _tmp_run(["node", str(ROOT / "bin" / "install.js"), *args], env=env)
+
+    def _seed(self, home, patch_text="[]\n"):
+        prof = Path(home) / ".dsh" / "profiles" / "desktop"
+        prof.mkdir(parents=True, exist_ok=True)
+        f = prof / "cordis.patch.yml"
+        f.write_text(patch_text, encoding="utf-8")
+        return f
+
+    def test_install_idempotent_and_persona_dollar_preserved(self):
+        with tempfile.TemporaryDirectory() as home:
+            patch = self._seed(home)
+            r1 = self._node("--dsh", home=home)
+            self.assertEqual(r1.returncode, 0, r1.stdout + r1.stderr)
+            skill = Path(home) / ".agents" / "skills" / "agent-bypass" / "SKILL.md"
+            self.assertTrue(skill.exists(), "DSH 技能应安装到 ~/.agents/skills")
+            text = patch.read_text(encoding="utf-8")
+            self.assertEqual(text.count("agent-bypass:dsh-preset-begin"), 1)
+            self.assertEqual(text.count("id: preset-ck"), 1)
+            self.assertIn("Ck 万能执行员", text)
+            # $$ 不能被 String.replace 的替换串语义吃掉（PHP 变量变量）
+            self.assertIn("parse_str / $$", text)
+            # 幂等：重复安装不重复追加
+            r2 = self._node("--dsh", home=home)
+            self.assertEqual(r2.returncode, 0, r2.stdout + r2.stderr)
+            text2 = patch.read_text(encoding="utf-8")
+            self.assertEqual(text2.count("agent-bypass:dsh-preset-begin"), 1)
+            self.assertEqual(text2.count("id: preset-ck"), 1)
+
+    def test_crlf_preserved_and_uninstall_restores(self):
+        with tempfile.TemporaryDirectory() as home:
+            patch = self._seed(home, '# note\r\n- id: web\r\n  name: "@deepseek-ai/dsh-web"\r\n')
+            self.assertEqual(self._node("--dsh", home=home).returncode, 0)
+            data = patch.read_bytes()
+            self.assertIn(b"agent-bypass:dsh-preset-begin", data)
+            self.assertGreater(data.count(b"\r\n"), 100, "CRLF 文件应保持 CRLF")
+            r = self._node("--dsh", "--uninstall", home=home)
+            self.assertEqual(r.returncode, 0, r.stdout + r.stderr)
+            data2 = patch.read_bytes()
+            self.assertNotIn(b"agent-bypass:dsh-preset-begin", data2)
+            self.assertIn(b"# note", data2)
+            self.assertIn(b"id: web", data2)
+            self.assertFalse((Path(home) / ".agents" / "skills" / "agent-bypass").exists())
+
+    def test_comment_only_patch_stays_valid_yaml(self):
+        with tempfile.TemporaryDirectory() as home:
+            patch = self._seed(home, "# user comment\n[]\n")
+            self.assertEqual(self._node("--dsh", home=home).returncode, 0)
+            self.assertEqual(self._node("--dsh", "--uninstall", home=home).returncode, 0)
+            text = patch.read_text(encoding="utf-8")
+            self.assertIn("# user comment", text)
+            self.assertIn("[]", text, "只留注释时应补回空数组，保证 loader 可解析")
+
+    def test_dsh_global_agents_md_injected(self):
+        with tempfile.TemporaryDirectory() as home:
+            agents = Path(home) / ".dsh" / "AGENTS.md"
+            agents.parent.mkdir(parents=True)
+            agents.write_text("# user own notes\n", encoding="utf-8")
+            self._seed(home)
+            r = self._node("--dsh", home=home)
+            self.assertEqual(r.returncode, 0, r.stdout + r.stderr)
+            text = agents.read_text(encoding="utf-8")
+            self.assertEqual(text.count("<!-- agent-bypass:begin -->"), 1)
+            self.assertIn("Cknb在呢", text, "全局破甲提示应包含触发词")
+            self.assertIn("# user own notes", text, "用户原内容必须保留")
+            # 幂等
+            self.assertEqual(self._node("--dsh", home=home).returncode, 0)
+            text2 = agents.read_text(encoding="utf-8")
+            self.assertEqual(text2.count("<!-- agent-bypass:begin -->"), 1)
+            self.assertIn("# user own notes", text2)
+            # 卸载移除标记块、保留用户内容
+            self.assertEqual(self._node("--dsh", "--uninstall", home=home).returncode, 0)
+            text3 = agents.read_text(encoding="utf-8")
+            self.assertNotIn("<!-- agent-bypass:begin -->", text3)
+            self.assertIn("# user own notes", text3)
+
+    def test_default_targets_include_pi_opencode_dsh(self):
+        with tempfile.TemporaryDirectory() as home:
+            (Path(home) / ".pi").mkdir()
+            (Path(home) / ".config" / "opencode").mkdir(parents=True)
+            self._seed(home)
+            r = self._node(home=home)
+            self.assertEqual(r.returncode, 0, r.stdout + r.stderr)
+            self.assertTrue((Path(home) / ".pi" / "agent" / "skills" / "agent-bypass" / "SKILL.md").exists())
+            self.assertTrue((Path(home) / ".config" / "opencode" / "skills" / "agent-bypass" / "SKILL.md").exists())
+            self.assertTrue((Path(home) / ".agents" / "skills" / "agent-bypass" / "SKILL.md").exists())
+            patch_text = (Path(home) / ".dsh" / "profiles" / "desktop" / "cordis.patch.yml").read_text(encoding="utf-8")
+            self.assertIn("id: preset-ck", patch_text)
+            self.assertIn("dsh", r.stdout + r.stderr)
+
+
+class DoctorTests(unittest.TestCase):
+    """--doctor 环境自检：只读、不写任何文件。"""
+
+    def test_doctor_readonly(self):
+        with tempfile.TemporaryDirectory() as home:
+            env = dict(os.environ)
+            env["HOME"] = home
+            for k in ("DSH_HOME", "DSH_PROFILE", "DSH_AGENTS_HOME", "DSH_APP_PATH", "DSH_ASAR_PATH"):
+                env.pop(k, None)
+            r = _tmp_run(["node", str(ROOT / "bin" / "install.js"), "--doctor"], env=env)
+            self.assertEqual(r.returncode, 0, r.stdout + r.stderr)
+            out = r.stdout + r.stderr
+            self.assertIn("环境自检", out)
+            self.assertIn("平台", out)
+            self.assertIn("包管理器", out)
+            # 只读：临时 HOME 不应产生任何文件
+            self.assertEqual(list(Path(home).rglob("*")), [], "doctor 不应写文件")
+
+
+class NetDnsScanOriginTests(unittest.TestCase):
+    """fake-IP/TUN：netdns 判定 + portscan 解析守卫 + origin_trace 解析（全部离线）。"""
+
+    @classmethod
+    def setUpClass(cls):
+        sys.path.insert(0, str(SCRIPTS))
+        import netdns
+        import portscan
+        import origin_trace
+        cls.nd = netdns
+        cls.ps = portscan
+        cls.ot = origin_trace
+
+    def test_fake_ip_ranges(self):
+        for ip in ("198.18.0.5", "198.19.255.1", "240.1.2.3", "198.51.100.7", "203.0.113.9"):
+            self.assertTrue(self.nd.is_fake_ip(ip), ip)
+        for ip in ("1.1.1.1", "8.8.8.8", "192.168.1.1", "10.0.0.1"):
+            self.assertFalse(self.nd.is_fake_ip(ip), ip)
+
+    def test_parse_dns_json(self):
+        sample = ('{"Answer":[{"type":1,"data":"93.184.216.34"},'
+                  '{"type":28,"data":"2606:2800::1"},{"type":1,"data":"198.18.0.1"}]}')
+        self.assertEqual(self.nd._parse_dns_json(sample, "A"), ["93.184.216.34", "198.18.0.1"])
+        self.assertEqual(self.nd._parse_dns_json(sample, "AAAA"), ["2606:2800::1"])
+        self.assertEqual(self.nd._parse_dns_json("not-json", "A"), [])
+
+    def test_portscan_split_host_fake_guard(self):
+        self.assertEqual(self.ps.split_host("https://example.com:8443/x"), ("example.com", 8443))
+        self.assertEqual(self.ps.split_host("1.2.3.4"), ("1.2.3.4", None))
+        self.assertIsNone(self.ps.split_host("bad host")[0])
+        self.assertTrue(self.ps.is_fake_ip("198.18.1.2"))
+        ip, src, fake = self.ps.resolve_target("198.18.1.2", mode="auto")
+        self.assertEqual((ip, src), ("198.18.1.2", "ip"))
+        self.assertEqual(fake, [])
+
+    def test_origin_trace_parsers(self):
+        ct = '[{"name_value":"a.example.com\\n*.example.com\\nother.test"}]'
+        self.assertEqual(self.ot.parse_crtsh(ct, "example.com"), ["a.example.com", "example.com"])
+        self.assertEqual(self.ot.extract_title("<title>  Hi   There </title>"), "Hi There")
+        self.assertEqual(self.ot.cdn_markers({"cf-ray": "x", "server": "nginx"}), ["cf-ray"])
+        base = {"title": "X", "server": "nginx", "status": "HTTP/1.1 200 OK", "cdn": ["cf-ray"]}
+        cand = {"title": "X", "server": "nginx", "status": "HTTP/1.1 200 OK", "cdn": [], "cert_domain_ok": True}
+        score, reasons = self.ot.score_candidate(base, cand)
+        self.assertGreaterEqual(score, 5)
+        self.assertIn("title", reasons)
+        self.assertLess(self.ot.score_candidate(base, {"cdn": ["cf-ray"]})[0], score)
+
+    def test_doh_shell_syntax(self):
+        sh = shutil.which("sh")
+        if not sh:
+            self.skipTest("no sh")
+        r = _tmp_run([sh, "-n", str(SCRIPTS / "doh_resolve.sh")])
+        self.assertEqual(r.returncode, 0, r.stderr)
+
+
+class SkillCompactTests(unittest.TestCase):
+    """SKILL.md 体积/去重回归：防止再次膨胀。"""
+
+    def test_skill_structure_and_size(self):
+        skill = (ROOT / "SKILL.md").read_text(encoding="utf-8")
+        self.assertEqual(skill.count("<!-- module:"), 35)
+        self.assertNotIn("## 修正对照", skill, "重复的修正对照表已移除，勿再加回")
+        self.assertLess(len(skill.encode("utf-8")), 132000, "SKILL.md 体积超限（保持精简，长内容放 references/）")
+
+
+class HangProtectionTests(unittest.TestCase):
+    """防卡死：DNS 硬超时、扫描总时限、溯源预算/同名 CDN 扣分（全部离线）。"""
+
+    @classmethod
+    def setUpClass(cls):
+        sys.path.insert(0, str(SCRIPTS))
+        import netdns, portscan, origin_trace
+        cls.nd = netdns
+        cls.ps = portscan
+        cls.ot = origin_trace
+
+    def test_system_resolve_hard_timeout(self):
+        import time as _t
+        orig = self.nd._system_resolve_impl
+        self.nd._system_resolve_impl = lambda name: (_t.sleep(3), ["1.2.3.4"])[1]
+        t0 = _t.monotonic()
+        try:
+            ips = self.nd.system_resolve("example.com", timeout=0.2)
+        finally:
+            self.nd._system_resolve_impl = orig
+        self.assertEqual(ips, [])
+        self.assertLess(_t.monotonic() - t0, 1.5, "system_resolve 必须有硬超时，不能挂住")
+
+    def test_portscan_total_deadline(self):
+        import asyncio, time as _t
+        found, timed_out = asyncio.run(
+            self.ps.scan("127.0.0.1", [9, 10], conc=1, timeout=0.05,
+                         deadline=_t.monotonic() - 1))
+        self.assertEqual(found, [])
+        self.assertTrue(timed_out)
+
+    def test_origin_same_cdn_penalty(self):
+        base = {"title": "X", "server": "nginx", "status": "HTTP/1.1 200 OK", "cdn": ["cf-ray"]}
+        cand_cdn = {"title": "X", "server": "nginx", "status": "HTTP/1.1 200 OK", "cdn": ["cf-ray"]}
+        cand_origin = {"title": "X", "server": "nginx", "status": "HTTP/1.1 200 OK", "cdn": []}
+        s_cdn, r_cdn = self.ot.score_candidate(base, cand_cdn)
+        s_org, r_org = self.ot.score_candidate(base, cand_origin)
+        self.assertIn("same-cdn", r_cdn)
+        self.assertLess(s_cdn, s_org)
+
+    def test_passive_ct_parsers(self):
+        cs = '[{"dns_names":["www.example.com","*.example.com","x.test"]}]'
+        self.assertEqual(self.ot.parse_certspotter(cs, "example.com"), ["www.example.com", "example.com"])
+        otx = ('{"passive_dns":[{"hostname":"mail.example.com","address":"1.2.3.4"},'
+               '{"hostname":"x.test","address":"9.9.9.9"},'
+               '{"hostname":"cdn.example.com","address":"198.18.0.9"}]}')
+        hosts, ips = self.ot.parse_otx(otx, "example.com")
+        self.assertIn("mail.example.com", hosts)
+        self.assertEqual(ips, ["1.2.3.4"], "被动 DNS 的 fake-IP 应被过滤")
+        hosts, ips = self.ot.parse_hackertarget("vpn.example.com,5.6.7.8\nAPI count exceeded", "example.com")
+        self.assertEqual(hosts, ["vpn.example.com"])
+        self.assertEqual(ips, ["5.6.7.8"])
+        self.assertEqual(self.ot.parse_anubis('["a.example.com","b.test"]', "example.com"), ["a.example.com"])
+        self.assertEqual(self.ot.parse_rapiddns("<td>oa.example.com</td><td>x.test</td>", "example.com"),
+                         ["oa.example.com"])
+        for src in ("crt.sh", "certspotter", "otx", "hackertarget", "anubis", "rapiddns"):
+            self.assertIn(src, self.ot.CT_SOURCES)
+
+    def test_ct_multi_source_fallback(self):
+        def fake(name, domain, timeout):
+            if name == "crt.sh":
+                raise RuntimeError("502 Bad Gateway")
+            return (["s1.example.com", "s2.example.com"], ["1.2.3.4"])
+        orig = self.ot._ct_fetch
+        self.ot._ct_fetch = fake
+        try:
+            hosts, ips, status = self.ot.fetch_passive_names(
+                "example.com", sources=["crt.sh", "otx"], budget=5)
+        finally:
+            self.ot._ct_fetch = orig
+        self.assertEqual(hosts, ["s1.example.com", "s2.example.com"])
+        self.assertEqual(ips, ["1.2.3.4"])
+        self.assertIn("失败", status["crt.sh"], "单源 502 应被记录并跳过")
+
+    def test_origin_bad_flag_rejected(self):
+        r = _tmp_run([sys.executable, str(SCRIPTS / "origin_trace.py"), "--bogus"])
+        self.assertEqual(r.returncode, 2)
+
+
+class PivotQueryTests(unittest.TestCase):
+    """搜索引警扩面：murmur3/favicon hash、7 引擎查询生成、CLI JSON（离线）。"""
+
+    @classmethod
+    def setUpClass(cls):
+        sys.path.insert(0, str(SCRIPTS))
+        import pivot_queries
+        cls.pq = pivot_queries
+
+    def test_murmur3_known_vectors(self):
+        self.assertEqual(self.pq.murmur3_32(b""), 0)
+        self.assertEqual(self.pq.murmur3_32(b"foo"), -156908512)
+        self.assertEqual(self.pq.murmur3_32(b"hello"), 613153351)
+
+    def test_favicon_hash_wiring(self):
+        import base64
+        data = b"\x89PNG\r\n\x1a\nfake-favicon-bytes"
+        hb, hr = self.pq.favicon_hashes(data)
+        self.assertEqual(hb, self.pq.murmur3_32(base64.b64encode(data)))
+        self.assertEqual(hr, self.pq.murmur3_32(data))
+
+    def test_build_queries_across_engines(self):
+        info = {"domain": "t.com", "ip": "1.2.3.4", "cidr": "1.2.3.0/24", "cert": "t.com",
+                "title": "Admin", "body": "uniq", "asn": "AS13335", "port": 8443, "icon_hash": -123}
+        q = self.pq.build_queries(info)
+        for eng in ("fofa", "shodan", "quake", "zoomeye", "hunter", "censys", "netlas"):
+            self.assertIn(eng, q)
+        self.assertIn('ip="1.2.3.4"', q["fofa"])
+        self.assertIn('icon_hash="-123"', q["fofa"])
+        self.assertIn("http.favicon.hash:-123", q["shodan"])
+        self.assertIn("net:1.2.3.0/24", q["shodan"])
+        self.assertIn('cert:"t.com"', q["quake"])
+        self.assertIn("cidr:1.2.3.0/24", q["zoomeye"])
+        self.assertIn('web.title="Admin"', q["hunter"])
+
+    def test_cli_json_and_favicon_file(self):
+        with tempfile.TemporaryDirectory() as d:
+            fav = Path(d) / "favicon.ico"
+            data = b"\x00\x01\x02fake"
+            fav.write_bytes(data)
+            r = _tmp_run([sys.executable, str(SCRIPTS / "pivot_queries.py"),
+                          "--domain", "t.com", "--ip", "1.2.3.4",
+                          "--favicon", str(fav), "--json"])
+            self.assertEqual(r.returncode, 0, r.stderr)
+            payload = json.loads(r.stdout)
+            self.assertEqual(payload["input"]["icon_hash"], self.pq.favicon_hashes(data)[0])
+            self.assertTrue(payload["queries"]["fofa"])
+            self.assertTrue(payload["scan_templates"])
+
+    def test_cli_rejects_empty_input(self):
+        r = _tmp_run([sys.executable, str(SCRIPTS / "pivot_queries.py")])
+        self.assertEqual(r.returncode, 2)
+
+
+class EnvChainTests(unittest.TestCase):
+    """多路径攻击：.env 解析/分类/脱敏/链生成（离线）。"""
+
+    SAMPLE = "\n".join([
+        "APP_ENV=production",
+        "DB_HOST=10.0.0.5",
+        "DB_PORT=3306",
+        "DB_USER=appuser",
+        "DB_PASSWORD=SuperSecret1",
+        "REDIS_HOST=10.0.0.6",
+        "REDIS_PASSWORD=redispass",
+        "AWS_ACCESS_KEY_ID=AKIAFAKE123",
+        "AWS_SECRET_ACCESS_KEY=fakesecret",
+        "JWT_SECRET=jwtsecret123",
+        "SMTP_HOST=smtp.example.com",
+        "SSH_USER=deploy",
+    ]) + "\n"
+
+    @classmethod
+    def setUpClass(cls):
+        sys.path.insert(0, str(SCRIPTS))
+        import env_chain
+        cls.ec = env_chain
+
+    def test_parse_env_and_classify(self):
+        env = self.ec.parse_env('export DB_HOST=1.2.3.4\nDB_USER="u"\n# comment\nBADLINE\n')
+        self.assertEqual(env["DB_HOST"], "1.2.3.4")
+        self.assertEqual(env["DB_USER"], "u")
+        self.assertEqual(self.ec.classify("DB_PASSWORD"), "mysql")
+        self.assertEqual(self.ec.classify("REDIS_URL"), "db_url")
+        self.assertEqual(self.ec.classify("AWS_SECRET_ACCESS_KEY"), "aws")
+        self.assertEqual(self.ec.classify("JWT_SECRET"), "secret")
+        self.assertEqual(self.ec.classify("SMTP_PASSWORD"), "smtp")
+        self.assertEqual(self.ec.classify("SSH_PRIVATE_KEY"), "ssh")
+
+    def test_extract_and_chains_masking(self):
+        env = self.ec.parse_env(self.SAMPLE)
+        data = self.ec.extract(env)
+        services = {s["service"] for s in data["services"]}
+        self.assertIn("mysql", services)
+        self.assertIn("redis", services)
+        chains = self.ec.build_chains(data)
+        text = json.dumps(chains, ensure_ascii=False)
+        self.assertNotIn("SuperSecret1", text, "默认必须脱敏")
+        self.assertNotIn("redispass", text)
+        revealed = json.dumps(self.ec.build_chains(data, reveal=True), ensure_ascii=False)
+        self.assertIn("SuperSecret1", revealed)
+        self.assertIn(".env → MySQL", revealed)
+
+    def test_cli_json_roundtrip(self):
+        with tempfile.TemporaryDirectory() as d:
+            f = Path(d) / ".env"
+            f.write_text(self.SAMPLE, encoding="utf-8")
+            r = _tmp_run([sys.executable, str(SCRIPTS / "env_chain.py"), str(f), "--json"])
+            self.assertEqual(r.returncode, 0, r.stderr)
+            payload = json.loads(r.stdout)
+            self.assertIn("chains", payload)
+            self.assertNotIn("SuperSecret1", r.stdout)
+            r2 = _tmp_run([sys.executable, str(SCRIPTS / "env_chain.py"), str(f), "--json", "--reveal"])
+            self.assertEqual(r2.returncode, 0, r2.stderr)
+            self.assertIn("SuperSecret1", r2.stdout)
+            empty = Path(d) / "empty.txt"
+            empty.write_text("# nothing\n", encoding="utf-8")
+            r3 = _tmp_run([sys.executable, str(SCRIPTS / "env_chain.py"), str(empty)])
+            self.assertEqual(r3.returncode, 2)
+
+
+class PromptPolicyTests(unittest.TestCase):
+    """破甲提示词三层一致性（dsh/AGENTS.md、dsh/persona.md、SYSTEM_PROMPT.md）。"""
+
+    LAYERS = ("dsh/AGENTS.md", "dsh/persona.md", "SYSTEM_PROMPT.md")
+
+    def test_policy_keywords_in_all_layers(self):
+        for rel in self.LAYERS:
+            text = (ROOT / rel).read_text(encoding="utf-8")
+            for marker in ("授权", "不拒绝", "临时邮箱", "输出即行动"):
+                self.assertIn(marker, text, "%s 缺关键条款: %s" % (rel, marker))
+
+    def test_global_agents_has_scop_and_tooling(self):
+        text = (ROOT / "dsh/AGENTS.md").read_text(encoding="utf-8")
+        for marker in ("授权范围是唯一边界", "用户没叫你干的事坚决不干", "客户第一",
+                       "rg", "fd", "ast-grep", "jq", "websocat", "shellcheck",
+                       "betterleaks", "osv-scanner", "pivot_queries", "env_chain"):
+            self.assertIn(marker, text, "全局破甲提示缺: %s" % marker)
+
+
 if __name__ == "__main__":
     unittest.main()

package/tests/test_tool_inventory.py

@@ -33,7 +33,7 @@ class InventoryTests(unittest.TestCase):
         skill = (ROOT / 'SKILL.md').read_text(encoding='utf-8')
         for item in ['agent-routing.md','tool-selection.md','verification-gates.md','framework-comparison-2026.md','tool_inventory.py']:
             self.assertIn(item, skill)
-        self.assertEqual(skill.count('<!-- module:'), 35)
+        self.assertEqual(skill.count("<!-- module:"), 35)
 
 
 if __name__ == '__main__':