proxyctl 0.5.0__tar.gz → 0.5.2__tar.gz

{proxyctl-0.5.0 → proxyctl-0.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proxyctl
-Version: 0.5.0
+Version: 0.5.2
 Summary: Proxy configuration lifecycle management for macOS and Linux
 Project-URL: Homepage, https://github.com/crhan/proxyctl
 Project-URL: Issues, https://github.com/crhan/proxyctl/issues

{proxyctl-0.5.0 → proxyctl-0.5.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "proxyctl"
-version = "0.5.0"
+version = "0.5.2"
 description = "Proxy configuration lifecycle management for macOS and Linux"
 readme = "README.md"
 requires-python = ">=3.10"

{proxyctl-0.5.0 → proxyctl-0.5.2}/src/proxyctl/cli.py

@@ -266,16 +266,17 @@ def get_engine_version(backend_name: str) -> dict | None:
         dict 或 None（binary 找不到 / -v 失败 / 解析失败）:
             {
               "binary":     "/opt/homebrew/bin/mihomo",
-              "version":    "1.19.25",
+              "version":    "1.19.25",           # 始终不带 v 前缀（规范化）
               "platform":   "darwin arm64",
               "go_version": "1.26.3",
-              "build_date": "2026-05-16",
+              "build_date": "2026-05-16",        # ISO 取日期段；非 ISO 保留原样
               "raw":        "Mihomo Meta 1.19.25 darwin arm64 with go1.26.3 2026-05-16T14:37:07Z",
             }
 
-    mihomo -v 输出范本:
-        Mihomo Meta 1.19.25 darwin arm64 with go1.26.3 2026-05-16T14:37:07Z
-        Use tags: with_gvisor
+    mihomo -v 输出在不同构建里有两种格式（v0.5.2 起两种都兼容）:
+        1) ISO 风：    Mihomo Meta 1.19.25 darwin arm64 with go1.26.3 2026-05-16T14:37:07Z
+        2) v 前缀 + Unix `date` 风：
+                       Mihomo Meta v1.19.10 linux amd64 with go1.24.3 Sat May 31 07:51:30 UTC 2025
 
     sing-box version 输出范本 (供后续扩展):
         sing-box version 1.10.0
@@ -298,16 +299,25 @@ def get_engine_version(backend_name: str) -> dict | None:
         return None
     raw = out.split("\n", 1)[0].strip()
     info: dict = {"binary": binary, "raw": raw}
-    # 匹配 mihomo: "Mihomo Meta 1.19.25 darwin arm64 with go1.26.3 2026-05-16T14:37:07Z"
+    # 匹配两种 mihomo -v 格式（详见 docstring）。build_date 用 (.+)$ 贪婪到行尾，
+    # 容纳 Unix `date` 的 "Sat May 31 07:51:30 UTC 2025" 多字段写法。
     m = re.match(
-        r"^\S+\s+\S+\s+(\S+)\s+(\S+\s+\S+)\s+with\s+go(\S+)\s+(\S+)",
+        r"^\S+\s+\S+\s+(\S+)\s+(\S+\s+\S+)\s+with\s+go(\S+)\s+(.+)$",
         raw,
     )
     if m:
-        info["version"] = m.group(1)
+        # version 规范化：剥掉可能的 v 前缀，避免渲染层重复加 v（→ "vv1.19.10"）
+        info["version"] = m.group(1).lstrip("v")
         info["platform"] = m.group(2)
         info["go_version"] = m.group(3)
-        info["build_date"] = m.group(4).split("T")[0]
+        date_raw = m.group(4).strip()
+        # ISO 8601 时间戳（YYYY-MM-DDTHH:MM:SS...）取日期段；
+        # Unix `date` 多字段格式（如 "Sat May 31 07:51:30 UTC 2025"）保留原样。
+        # 必须正则强校验：不能用 "T" in date_raw，否则 "UTC" 会被误判 → 截断。
+        if re.match(r"^\d{4}-\d{2}-\d{2}T", date_raw):
+            info["build_date"] = date_raw.split("T")[0]
+        else:
+            info["build_date"] = date_raw
     else:
         # 兜底：能拿到 raw 就行，version 字段留空让 agent 自己处理
         info["version"] = None

{proxyctl-0.5.0 → proxyctl-0.5.2}/src/proxyctl/explain.py

@@ -1949,24 +1949,33 @@ _SUGGESTION_DOCS: dict[str, dict] = {
     # ── Controller / Engine / Data 5 条 ────────────────────────────────
     "controller.empty_secret": {
         "summary": (
-            "Clash API secret 为空字符串。本地连接没影响，但若 controller bind "
-            "到非环回地址（见 controller.public_bind），任何人都能调你的 API。"
+            "Clash API bind 公网（0.0.0.0 或局域网 IP）且 secret 为空——"
+            "**任何人都能调你的 API**：切换节点、读取节点列表、改路由。"
+            "v0.5.1+ 此规则仅在公网 bind 时触发；127.0.0.1 + 空 secret 不报。"
         ),
         "edit": (
-            "  # 在 mihomo config.yaml 加：\n"
-            "  secret: <一段 >= 16 字符的随机字符串，用 openssl rand -hex 16 生成>"
+            "  # 优先：把 bind 改回环回（推荐，本机用够了）\n"
+            "  #   external-controller: 127.0.0.1:9090\n"
+            "  # 或：配强 secret\n"
+            "  #   secret: <用 openssl rand -hex 24 生成>"
         ),
-        "verify": "grep -E '^secret:' ~/.config/mihomo/config.yaml",
-        "next_commands": ["explain subscription"],
+        "verify": "grep -E '^secret:|^external-controller:' ~/.config/mihomo/config.yaml",
+        "next_commands": ["explain suggestion:controller.public_bind"],
     },
     "controller.weak_secret": {
         "summary": (
-            "Clash API secret 长度 < 16。本地用没事，但若不慎暴露到局域网，"
-            "短 secret 容易爆破。"
+            "Clash API bind 公网（0.0.0.0 或局域网 IP）且 secret < 16 字符 → "
+            "暴露面 + 弱认证 = 易爆破。**v0.5.1+ 此规则仅在公网 bind 时触发**；"
+            "bind 127.0.0.1 时 secret 强度无意义（attack surface 不存在），不报。"
         ),
-        "edit": "  # 用 openssl rand -hex 24 重新生成一段强 secret",
-        "verify": "grep -E '^secret:' ~/.config/mihomo/config.yaml",
-        "next_commands": ["explain suggestion:controller.empty_secret"],
+        "edit": (
+            "  # 优先：bind 改回环回\n"
+            "  #   external-controller: 127.0.0.1:9090\n"
+            "  # 或：升级 secret\n"
+            "  #   secret: <用 openssl rand -hex 24 生成的强 secret>"
+        ),
+        "verify": "grep -E '^secret:|^external-controller:' ~/.config/mihomo/config.yaml",
+        "next_commands": ["explain suggestion:controller.public_bind"],
     },
     "controller.public_bind": {
         "summary": (

{proxyctl-0.5.0 → proxyctl-0.5.2}/src/proxyctl/suggest_rules.py

@@ -109,7 +109,18 @@ def _is_public_bind(host: str | None) -> bool:
 
 
 def controller_rules(cfg: dict[str, Any]) -> list[dict[str, Any]]:
-    """3 条 controller 规则。cfg 来自 inspect_engine_config。"""
+    """controller 规则 — v0.5.1 修复复合判定 bug。
+
+    哥 2026-05-19 指出的设计问题："只有本机才能访问为什么还要看密钥复杂度？"
+
+    旧逻辑（v0.5.0）独立判断 empty_secret / weak_secret / public_bind，
+    导致 bind=127.0.0.1 + secret 短也会触发 weak_secret advisory ——
+    但本地 attack surface 不存在，规则属于误报。
+
+    新逻辑（v0.5.1）：以 attack surface 为单一判定轴。
+      bind 127.0.0.1 → 任何 secret（含空）都不报
+      bind public    → 视 secret 强度报 warn / advisory，public_bind 永远 warn
+    """
     if not cfg.get("config_exists"):
         return []
     out: list[dict[str, Any]] = []
@@ -117,44 +128,61 @@ def controller_rules(cfg: dict[str, Any]) -> list[dict[str, Any]]:
     port = cfg.get("controller_port")
     secret = cfg.get("controller_secret")
 
-    # empty_secret —— 空字符串或字段不存在但 controller 已配置
-    if (host or port) and (secret == "" or secret is None):
-        # 仅在 controller 已经配置时报告（避免完全没用 API 的用户被打扰）
+    # controller 未配置时整组规则跳过
+    if not (host or port):
+        return out
+
+    public = _is_public_bind(host)
+
+    # 127.0.0.1 / ::1 → attack surface 不存在，secret 强度不评估
+    if not public:
+        return out
+
+    # ── 以下分支仅当 bind 暴露给非本机时触发 ─────────────────────────
+
+    # public_bind 本身永远报 warn（明确告诉用户"你的 API 暴露给了外面"）
+    out.append({
+        "id": "controller.public_bind",
+        "severity": "warn",
+        "actor": "user",
+        "title": f"Clash API bind 到非环回地址：{host}",
+        "evidence": {"controller_host": host, "controller_port": port},
+        "doc": "suggestion:controller.public_bind",
+        "since": "0.5.0",
+    })
+
+    if secret == "" or secret is None:
+        # 公网 bind + 无认证 = 任何人可控制代理 → warn
         out.append({
             "id": "controller.empty_secret",
             "severity": "warn",
             "actor": "user",
-            "title": "Clash API secret 为空",
+            "title": f"Clash API bind 公网（{host}）但 secret 为空",
             "evidence": {
                 "controller_host": host,
                 "controller_port": port,
                 "secret_set": False,
             },
-            "fix_command": "proxyctl explain subscription",
+            "fix_command": "proxyctl explain suggestion:controller.empty_secret",
             "doc": "suggestion:controller.empty_secret",
             "since": "0.5.0",
         })
-    elif secret and len(secret) < 16:
+    elif len(secret) < 16:
+        # 公网 bind + 弱 secret = 易爆破 → advisory（有 secret 总比无好，
+        # 但应该升级）
         out.append({
             "id": "controller.weak_secret",
             "severity": "advisory",
             "actor": "user",
-            "title": f"Clash API secret 过短（长度 {len(secret)} < 16）",
-            "evidence": {"secret_length": len(secret)},
+            "title": (f"Clash API bind 公网（{host}）且 secret 仅 "
+                      f"{len(secret)} 字符（< 16）"),
+            "evidence": {
+                "controller_host": host,
+                "secret_length": len(secret),
+            },
             "doc": "suggestion:controller.weak_secret",
             "since": "0.5.0",
         })
-
-    if _is_public_bind(host):
-        out.append({
-            "id": "controller.public_bind",
-            "severity": "warn",
-            "actor": "user",
-            "title": f"Clash API bind 到非环回地址：{host}",
-            "evidence": {"controller_host": host, "controller_port": port},
-            "doc": "suggestion:controller.public_bind",
-            "since": "0.5.0",
-        })
     return out