bingo-ai 6.2.330__tar.gz → 6.2.332__tar.gz

{bingo_ai-6.2.330 → bingo_ai-6.2.332}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bingo-ai
-Version: 6.2.330
+Version: 6.2.332
 Summary: AI-powered red team terminal — Zero-Hallucination · WAF bypass · XSS·Upload·SSRF·OAuth·GraphQL·Smuggling exploit chains · CVE/Exploit KB (trickest+exploitarium) · role-based testing · vuln manager · attack chain · HITL · LLM Orchestrator · multi-model · multi-language
 Author-email: bingook <bingook@users.noreply.github.com>
 License: MIT

{bingo_ai-6.2.330 → bingo_ai-6.2.332}/bingo/__init__.py

@@ -1,2 +1,2 @@
 """Bingo — Hacker-style AI Terminal"""
-__version__ = "6.2.330"
+__version__ = "6.2.332"

{bingo_ai-6.2.330 → bingo_ai-6.2.332}/bingo/ui/terminal.py

@@ -552,6 +552,10 @@ class BingoTerminal:
         self._detect_network_env()
         # v6.2.330: http_request SSL 연속 실패 카운터 — 2회 이상 시 curl 전환 유도
         self._http_ssl_fail_count: int = 0
+        # v6.2.331: 보고서 중복 생성 방지 플래그
+        self._report_generated: bool = False
+        # v6.2.331: 세션 중 타겟 HTML/JS에서 발견된 허용 도메인 집합
+        self._session_allowed_domains: set[str] = set()
 
         # /retry 용 마지막 실행 결과 캐시
         self._last_exec_result: str = ""
@@ -4105,6 +4109,10 @@ class BingoTerminal:
                     if not cmd:
                         output = "[ERROR] No command provided"
                     else:
+                        # v6.2.332: macOS grep -P → grep -E 자동 변환 (BSD grep -P 미지원)
+                        import platform as _plt
+                        if _plt.system() == "Darwin" and "grep" in cmd and "-P" in cmd:
+                            cmd = re.sub(r'(\s-\w*)P\b', lambda m: m.group(1) + 'E', cmd)
                         # Target drift guard: check URLs in bash commands
                         drift_blocked = self._check_target_drift_in_text(cmd)
                         if drift_blocked:
@@ -4128,6 +4136,28 @@ class BingoTerminal:
                         # Check for 198.18.x.x contamination
                         if _vpn_spoof and re.search(r"\b198\.1[89]\.\d+\.\d+\b", output):
                             output += "\n\n[WARNING] VPN virtual IP detected in output — DNS leak detected"
+                        # v6.2.331: bash_exec 출력에서 도메인 추출 → 세션 허용 집합 등록 (Bug1)
+                        try:
+                            import tldextract as _tld
+                            _tgt_raw = getattr(self, "_current_target", "") or ""
+                            _tgt_host = _tgt_raw.split("//")[-1].split("/")[0]
+                            _tgt_ext = _tld.extract(_tgt_host)
+                            _tgt_regd = f"{_tgt_ext.domain}.{_tgt_ext.suffix}" if _tgt_ext.domain and _tgt_ext.suffix else _tgt_host
+                            for _dm in re.findall(r'https?://([a-zA-Z0-9][-a-zA-Z0-9.]*\.[a-zA-Z]{2,})', output):
+                                _ext = _tld.extract(_dm)
+                                _regd = f"{_ext.domain}.{_ext.suffix}" if _ext.domain and _ext.suffix else _dm
+                                if _regd and _regd != _tgt_regd:
+                                    self._session_allowed_domains.add(_regd)
+                                    self._session_allowed_domains.add(_dm)
+                        except Exception:
+                            pass
+                        # v6.2.331: bash_exec 출력을 FactRegistry에 등록 (Bug4)
+                        try:
+                            _pg = self._phantom_guard
+                            if _pg is not None and hasattr(_pg, "pre_register_exec_output"):
+                                _pg.pre_register_exec_output(output)
+                        except Exception:
+                            pass
                 elif name == "python_exec":
                     code = args.get("code", "")
                     timeout = args.get("timeout", 180)
@@ -4209,7 +4239,24 @@ class BingoTerminal:
                             _is_target_ip = (request_host == _resolved_ip) if _resolved_ip else False
                             _is_cf_domain = bool(_resolved_ip and self._is_cf_ip(_resolved_ip))
                             if req_domain != tgt_domain and request_host != target_host:
-                                if _is_target_ip and self._check_ip_direct_accessible(request_host):
+                                _session_allowed_http = getattr(self, "_session_allowed_domains", set())
+                                if req_domain in _session_allowed_http or request_host in _session_allowed_http:
+                                    # v6.2.332: CDN 도메인 — 정적 자산만 허용, API/로그인 차단
+                                    _req_path = parsed.path.lower()
+                                    _req_method = (method or "GET").upper()
+                                    _cdn_api = bool(re.search(r'/api/|/login|/admin|/auth|/user/|/account|/register|/logout|/signin|/signup|/pass|/member', _req_path))
+                                    _cdn_mut = _req_method in ("POST", "PUT", "DELETE", "PATCH")
+                                    if _cdn_api or _cdn_mut:
+                                        output = (
+                                            f"[ERROR] CDN/연관 도메인 API 접근 차단: {request_host}\n"
+                                            f"타겟: {target_url}\n"
+                                            f"CDN 도메인({request_host})은 정적 자산(CSS/JS/img) 조회만 허용됩니다.\n"
+                                            f"API/로그인 테스트는 실제 타겟({target_host})에 직접 수행하세요."
+                                        )
+                                        self.console.print(f"[{THEME['dim']}]  🚫 CDN 도메인 API 차단: {request_host}[/]")
+                                        results.append({"id": tc.id, "name": name, "output": output})
+                                        continue
+                                elif _is_target_ip and self._check_ip_direct_accessible(request_host):
                                     pass  # resolved IP + accessible
                                 elif _is_cf_domain and self._check_ip_direct_accessible(request_host, domain=target_host):
                                     pass  # CF domain: origin IP verified via Host header
@@ -4246,6 +4293,21 @@ class BingoTerminal:
                             # Check for 198.18.x.x contamination in response
                             if _vpn_spoof and ("198.18." in output or "198.19." in output):
                                 output += "\n\n[WARNING] VPN virtual IP detected in response — may indicate DNS leak"
+                            # v6.2.332: http_request 응답에서 도메인 추출 → _session_allowed_domains
+                            try:
+                                import tldextract as _tld2
+                                _tgt_raw2 = getattr(self, "_current_target", "") or ""
+                                _tgt_host2 = _tgt_raw2.split("//")[-1].split("/")[0]
+                                _tgt_ext2 = _tld2.extract(_tgt_host2)
+                                _tgt_regd2 = f"{_tgt_ext2.domain}.{_tgt_ext2.suffix}" if _tgt_ext2.domain and _tgt_ext2.suffix else _tgt_host2
+                                for _dm2 in re.findall(r'https?://([a-zA-Z0-9][-a-zA-Z0-9.]*\.[a-zA-Z]{2,})', resp.text[:6000]):
+                                    _ext2 = _tld2.extract(_dm2)
+                                    _regd2 = f"{_ext2.domain}.{_ext2.suffix}" if _ext2.domain and _ext2.suffix else _dm2
+                                    if _regd2 and _regd2 != _tgt_regd2:
+                                        self._session_allowed_domains.add(_regd2)
+                                        self._session_allowed_domains.add(_dm2)
+                            except Exception:
+                                pass
                 else:
                     output = f"[ERROR] Unknown tool: {name}"
             except subprocess.TimeoutExpired:
@@ -4346,6 +4408,8 @@ class BingoTerminal:
             "exploit-db.com", "github.com", "pastebin.com",
             "dnsdb.info", "bgp.he.net", "whois.domaintools.com",
         }
+        # v6.2.331: 세션 중 타겟 HTML/JS에서 발견된 허용 도메인 (CDN, 결제 API 등)
+        _session_allowed = getattr(self, "_session_allowed_domains", set())
 
         _resolved_ip = getattr(self, "_target_resolved_ip", None)
         _is_cf_domain = bool(_resolved_ip and self._is_cf_ip(_resolved_ip))
@@ -4364,6 +4428,20 @@ class BingoTerminal:
                 continue
             if req_domain in _OSINT_ALLOWED:
                 continue
+            # v6.2.332: CDN/연관 도메인 — 정적 자산만 허용, API/로그인 차단
+            if req_domain in _session_allowed or found_host in _session_allowed:
+                _full_url = match.group(0)
+                _cdn_path = _full_url.split(found_host, 1)[-1].split("?")[0].lower() if found_host in _full_url else ""
+                _cdn_api = bool(re.search(r'/api/|/login|/admin|/auth|/user/|/account|/register|/logout|/signin|/signup|/pass|/member', _cdn_path))
+                _cdn_post = bool(re.search(r'-X\s*(POST|PUT|DELETE|PATCH)\b|--data\b|--json\b|-d\s+["\'{]', text, re.IGNORECASE))
+                if _cdn_api or _cdn_post:
+                    return (
+                        f"[ERROR] CDN/연관 도메인 API 접근 차단: {found_host}\n"
+                        f"타겟: {self._current_target}\n"
+                        f"CDN 도메인({found_host})은 정적 자산(CSS/JS/img) 조회만 허용됩니다.\n"
+                        f"API/로그인 테스트는 실제 타겟({target_host})에 직접 수행하세요."
+                    )
+                continue
             # CF 도메인: 새 IP가 Host헤더로 origin 검증되면 허용
             if _is_cf_domain and re.match(r'^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$', found_host):
                 if self._check_ip_direct_accessible(found_host, domain=target_host):
@@ -8793,7 +8871,7 @@ class BingoTerminal:
 
         _fc_mode = self._get_fc_tools() is not None
         _fc_nudge_count = 0
-        _FC_NUDGE_MAX = 10  # Increased: discovery phases often need multiple prose iterations
+        _FC_NUDGE_MAX = 3  # v6.2.331: 3회 연속 도구 미호출 시 강제 종료 (기존 10회)
         _http_ssl_fail_count = 0  # Track consecutive http_request SSL failures
 
         while True:
@@ -8844,15 +8922,29 @@ class BingoTerminal:
                         self._finalize_runtime("hard_loop_cap_reached")
                         break
                     if _fc_nudge_count > _FC_NUDGE_MAX:
-                        # Model persistently refuses to use tool calls — fall through to legacy
-                        _fc_mode = False
-                        continue
+                        # 3회 연속 도구 미호출 → 보고서 생성 후 종료 (v6.2.331)
+                        _lang_idle = getattr(self.config, "lang", "en")
+                        _idle_msg = {
+                            "ko": "⛔ 도구 호출 없이 텍스트만 3회 연속 — 더 이상 진행 불가. 보고서를 생성합니다.",
+                            "zh": "⛔ 连续3次无工具调用 — 无法继续，正在生成报告。",
+                            "en": "⛔ 3 consecutive text-only turns — cannot continue. Generating report.",
+                        }.get(_lang_idle, "⛔ Idle loop detected — generating report.")
+                        self.console.print(f"\n[{THEME['error']}]{_idle_msg}[/]")
+                        self._finalize_runtime("useful_action_frontier_exhausted")
+                        break
                     _lang = getattr(self.config, "lang", "en")
-                    _fc_nudge = {
-                        "ko": "실행할 명령이 있으면 bash_exec/python_exec/http_request 도구를 사용하세요. 코드블록은 실행되지 않습니다.",
-                        "zh": "请使用 bash_exec/python_exec/http_request 工具执行命令，代码块不会被执行。",
-                        "en": "Use bash_exec/python_exec/http_request tools to execute. Code blocks in text are not executed.",
-                    }.get(_lang, "Use tools to execute commands. Text code blocks are not executed.")
+                    if _fc_nudge_count >= 2:
+                        _fc_nudge = {
+                            "ko": "⚠️ 경고: 도구 없이 텍스트만 생성 중입니다. 지금 즉시 bash_exec 또는 http_request로 명령을 실행하세요.",
+                            "zh": "⚠️ 警告：连续无工具调用。立即用 bash_exec 或 http_request 执行命令，不需要文字说明。",
+                            "en": "⚠️ WARNING: Text-only output detected. Call bash_exec or http_request NOW with a concrete command.",
+                        }.get(_lang, "⚠️ Call a tool NOW. No more prose.")
+                    else:
+                        _fc_nudge = {
+                            "ko": "실행할 명령이 있으면 bash_exec/python_exec/http_request 도구를 사용하세요. 코드블록은 실행되지 않습니다.",
+                            "zh": "请使用 bash_exec/python_exec/http_request 工具执行命令，代码块不会被执行。",
+                            "en": "Use bash_exec/python_exec/http_request tools to execute. Code blocks in text are not executed.",
+                        }.get(_lang, "Use tools to execute commands. Text code blocks are not executed.")
                     self.history.append(Message(role="user", content=_fc_nudge))
                     from ..models.registry import ModelRegistry as _MR_fc
                     _mc_fc = self.config.get_active_model_config()
@@ -11733,6 +11825,10 @@ class BingoTerminal:
 
     def _auto_generate_report(self, terminal_reason: str = "completed", provider_failure=None) -> None:
         """Write one deterministic report from the canonical evidence snapshot."""
+        # v6.2.331: 동일 세션에서 두 번 호출 방지
+        if getattr(self, "_report_generated", False):
+            return
+        self._report_generated = True
         from pathlib import Path
         # datetime 클래스는 파일 최상단 'from datetime import datetime'으로 이미 임포트됨.
         # 여기서 'import datetime' (모듈)을 하면 클래스를 덮어써서

{bingo_ai-6.2.330 → bingo_ai-6.2.332}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "bingo-ai"
-version = "6.2.330"
+version = "6.2.332"
 description = "AI-powered red team terminal — Zero-Hallucination · WAF bypass · XSS·Upload·SSRF·OAuth·GraphQL·Smuggling exploit chains · CVE/Exploit KB (trickest+exploitarium) · role-based testing · vuln manager · attack chain · HITL · LLM Orchestrator · multi-model · multi-language"
 readme = "README.md"
 requires-python = ">=3.12"