wechatbridge-cli 1.7.0__tar.gz → 1.7.2__tar.gz

{wechatbridge_cli-1.7.0 → wechatbridge_cli-1.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: wechatbridge-cli
-Version: 1.7.0
+Version: 1.7.2
 Summary: Bridge WeChat messages to agy, Grok Build, or Codex CLIs — text/image/file/voice in, CLI replies and generated files back.
 Author: WeChatBridge contributors
 License: MIT

{wechatbridge_cli-1.7.0 → wechatbridge_cli-1.7.2}/tests/test_hardening.py

@@ -2983,5 +2983,261 @@ class TestAgyStreamRetry(unittest.IsolatedAsyncioTestCase):
         mock_sleep.assert_not_awaited()
 
 
+class TestAuditHardeningFixes(unittest.IsolatedAsyncioTestCase):
+    """Regression tests for deep-audit security and correctness fixes."""
+
+    def setUp(self):
+        from wechatbridge.config import config as cfg
+        self._cfg = cfg
+        self._tmp = tempfile.TemporaryDirectory()
+        self.session_base = self._tmp.name
+        self._orig_base = cfg.session_base_dir
+        self._orig_backend = cfg.backend
+        cfg.session_base_dir = self.session_base
+
+    def tearDown(self):
+        self._cfg.session_base_dir = self._orig_base
+        self._cfg.backend = self._orig_backend
+        self._tmp.cleanup()
+
+    async def test_agy_send_artifacts_allows_session_dir_and_blocks_sensitive_or_hardlink(self):
+        from wechatbridge import main as main_mod
+        from wechatbridge.runner_common import ensure_session_dir
+
+        self._cfg.backend = "agy"
+        uid = "u-agy-sec"
+        sdir = ensure_session_dir(uid)
+
+        # Normal artifact directly in session_dir (should be allowed)
+        good_file = os.path.join(sdir, "report.pdf")
+        with open(good_file, "wb") as f:
+            f.write(b"%PDF-1.4 ok")
+
+        # Normal artifact in .gemini/antigravity-cli/scratch (should be allowed)
+        scratch_dir = os.path.join(sdir, ".gemini", "antigravity-cli", "scratch")
+        os.makedirs(scratch_dir, exist_ok=True)
+        scratch_file = os.path.join(scratch_dir, "chart.png")
+        with open(scratch_file, "wb") as f:
+            f.write(b"PNGDATA")
+
+        # Sensitive files inside session_dir (must be blocked)
+        prefs_file = os.path.join(sdir, "prefs.json")
+        with open(prefs_file, "w") as f:
+            f.write('{"model": "gemini-4-argon"}')
+        gemini_dir = os.path.join(sdir, ".gemini")
+        os.makedirs(gemini_dir, exist_ok=True)
+        token_file = os.path.join(gemini_dir, "antigravity-oauth-token")
+        with open(token_file, "w") as f:
+            f.write("secret-oauth-token")
+
+        # Hardlink inside session_dir pointing to external file (must be blocked)
+        ext_file = os.path.join(self.session_base, "external_secret.txt")
+        with open(ext_file, "w") as f:
+            f.write("top-secret")
+        hardlink_file = os.path.join(sdir, "linked.txt")
+        os.link(ext_file, hardlink_file)
+
+        client = mock.MagicMock()
+        client.state.baseurl = "https://ilink"
+        client.state.bot_token = "tok"
+        client.send_media = AsyncMock(return_value=True)
+        client.send_message = AsyncMock(return_value=True)
+
+        await main_mod.send_artifacts_back(
+            artifacts=[
+                ("report.pdf", good_file),
+                ("chart.png", scratch_file),
+                ("prefs.json", prefs_file),
+                ("antigravity-oauth-token", token_file),
+                ("linked.txt", hardlink_file),
+            ],
+            client=client,
+            from_user=uid,
+            context_token="ctx",
+        )
+
+        sent_paths = [c.kwargs["path"] for c in client.send_media.await_args_list]
+        self.assertEqual(
+            sent_paths,
+            [os.path.realpath(good_file), os.path.realpath(scratch_file)],
+        )
+
+    def test_agy_extract_artifacts_balanced_parens_and_model_tsv_parsing(self):
+        from wechatbridge import agy as agy_mod
+
+        text = (
+            "已生成 [report (1).pdf](file:///tmp/sess/report%20(1).pdf) "
+            "和 [v2 [final].docx](file:///tmp/sess/v2%20[final].docx)。"
+        )
+        arts = agy_mod.extract_artifacts(text)
+        self.assertEqual(
+            arts,
+            [
+                ("report (1).pdf", "/tmp/sess/report (1).pdf"),
+                ("v2 [final].docx", "/tmp/sess/v2 [final].docx"),
+            ],
+        )
+
+        tsv_models = (
+            "gemini-4-argon\tGemini 3.1 Pro (High)\n"
+            "claude-opus-4-6-thinking\tClaude Opus 4.6 (Thinking)\n"
+        )
+        self.assertEqual(
+            agy_mod._parse_agy_model_ids(tsv_models),
+            ["gemini-4-argon", "claude-opus-4-6-thinking"],
+        )
+
+    async def test_planning_and_fast_toggle_and_clear_resets_mode(self):
+        from wechatbridge import agy as agy_mod
+        from wechatbridge.runner_common import load_prefs
+
+        uid = "u-toggle"
+        r1 = await agy_mod.handle_slash_command("/planning", uid)
+        self.assertIn("已开启规划模式", r1)
+        self.assertEqual(load_prefs(uid).get("mode"), "plan")
+
+        # Calling /planning again toggles it off
+        r2 = await agy_mod.handle_slash_command("/planning", uid)
+        self.assertIn("已关闭规划模式", r2)
+        self.assertEqual(load_prefs(uid).get("mode"), "")
+
+        # Enable again and verify /clear resets sticky mode
+        await agy_mod.handle_slash_command("/planning", uid)
+        self.assertEqual(load_prefs(uid).get("mode"), "plan")
+        await agy_mod.handle_slash_command("/clear", uid)
+        self.assertEqual(load_prefs(uid).get("mode"), "")
+
+        # /fast off
+        await agy_mod.handle_slash_command("/fast", uid)
+        self.assertEqual(load_prefs(uid).get("effort"), "low")
+        r_fast_off = await agy_mod.handle_slash_command("/fast off", uid)
+        self.assertIn("已关闭快速模式", r_fast_off)
+        self.assertEqual(load_prefs(uid).get("effort"), "")
+
+    def test_sanitize_prompt_at_paths_allows_session_and_add_dirs_blocks_external(self):
+        from wechatbridge.runner_common import _sanitize_prompt_at_paths, ensure_session_dir
+
+        sdir = ensure_session_dir("u-at")
+        extra_dir = os.path.join(self.session_base, "allowed_extra")
+        os.makedirs(extra_dir, exist_ok=True)
+        prompt = (
+            f"请看 @{sdir}/img.png 和 @{extra_dir}/doc.md "
+            "不要读 @/etc/passwd 或 @../../etc/shadow"
+        )
+        sanitized = _sanitize_prompt_at_paths(prompt, sdir, extra_roots=[extra_dir])
+        self.assertIn(f"@{sdir}/img.png", sanitized)
+        self.assertIn(f"@{extra_dir}/doc.md", sanitized)
+        self.assertNotIn("/etc/passwd", sanitized)
+        self.assertNotIn("/etc/shadow", sanitized)
+        self.assertEqual(sanitized.count("[blocked-path]"), 2)
+
+    async def test_ilink_get_updates_raises_on_5xx_and_encrypt_roundtrip(self):
+        import httpx
+        from wechatbridge.ilink import ILinkClient, _encrypt_aes_ecb, _decrypt_aes_ecb
+
+        key = os.urandom(16)
+        for length in (0, 1, 15, 16, 17, 32, 100):
+            raw = os.urandom(length)
+            enc = _encrypt_aes_ecb(raw, key)
+            self.assertEqual(_decrypt_aes_ecb(enc, key), raw)
+
+        client = ILinkClient()
+        try:
+            req = httpx.Request("POST", "https://ilink/ilink/bot/getupdates")
+            resp_502 = httpx.Response(502, request=req)
+            client.http_client.post = AsyncMock(
+                side_effect=httpx.HTTPStatusError("502 Bad Gateway", request=req, response=resp_502)
+            )
+            client.state.clear = mock.MagicMock()
+            with self.assertRaises(httpx.HTTPStatusError):
+                await client.get_updates("buf1", "https://ilink", "tok")
+            client.state.clear.assert_not_called()
+        finally:
+            await client.close()
+
+    async def test_price_http_error_does_not_leak_url_or_appkey(self):
+        import httpx
+        from wechatbridge import price as price_mod
+
+        req = httpx.Request(
+            "GET",
+            "https://openapi.dataoke.com/api/goods/get-goods-details?appKey=SECRET_DT_KEY_123&id=1",
+        )
+        err = httpx.ConnectError(
+            "Connection failed for https://openapi.dataoke.com/api?appKey=SECRET_DT_KEY_123",
+            request=req,
+        )
+        with mock.patch.object(price_mod, "dt_configured", return_value=True), \
+             mock.patch.object(price_mod, "query_tb_item", side_effect=err):
+            reply = await price_mod.handle_price_query({"kind": "tb_item", "item_id": "1"})
+        self.assertNotIn("SECRET_DT_KEY_123", reply)
+        self.assertIn("比价接口请求失败", reply)
+
+        with self.assertRaises(ValueError):
+            price_mod._resolve_short_link("http://127.0.0.1:8080/admin")
+        self.assertFalse(price_mod._is_allowed_short_url("https://evil.u.jd.com/abc"))
+        self.assertFalse(price_mod._is_allowed_short_url("https://a.3.cn/xyz"))
+        self.assertTrue(price_mod._is_allowed_short_url("https://u.jd.com/abc"))
+
+    def test_ensure_user_gemini_refreshes_stale_oauth_token_and_blocks_copied_secrets(self):
+        from wechatbridge import agy as agy_mod
+        from wechatbridge.runner_common import is_sensitive_artifact_path, _sanitize_prompt_at_paths
+
+        fake_host_home = os.path.join(self.session_base, "host_home")
+        host_agy = os.path.join(fake_host_home, ".gemini", "antigravity-cli")
+        os.makedirs(host_agy, exist_ok=True)
+        src_token = os.path.join(host_agy, "antigravity-oauth-token")
+        with open(src_token, "w") as f:
+            f.write("old-token-value-111111")
+
+        def _fake_expanduser(p: str) -> str:
+            if p.startswith("~/"):
+                return os.path.join(fake_host_home, p[2:])
+            return p
+
+        with mock.patch("os.path.expanduser", side_effect=_fake_expanduser):
+            sdir = agy_mod.ensure_user_gemini("u-tok-refresh")
+            dst_token = os.path.join(sdir, ".gemini", "antigravity-cli", "antigravity-oauth-token")
+            with open(dst_token) as f:
+                self.assertEqual(f.read(), "old-token-value-111111")
+
+            # Make dst older and update src token
+            os.utime(dst_token, (1000.0, 1000.0))
+            with open(src_token, "w") as f:
+                f.write("refreshed-token-value-222222")
+            os.utime(src_token, (2000.0, 2000.0))
+
+            agy_mod.ensure_user_gemini("u-tok-refresh")
+            with open(dst_token) as f:
+                self.assertEqual(f.read(), "refreshed-token-value-222222")
+
+        # Renamed / copied credentials must still be blocked by is_sensitive_artifact_path
+        copied_secret = os.path.join(sdir, "token.copy")
+        with open(copied_secret, "w") as f:
+            f.write("refreshed-token-value-222222")
+        self.assertTrue(is_sensitive_artifact_path(copied_secret, sdir))
+
+        auth_bak = os.path.join(sdir, "auth.json.bak")
+        with open(auth_bak, "w") as f:
+            f.write("{}")
+        self.assertTrue(is_sensitive_artifact_path(auth_bak, sdir))
+
+        scratch_settings = os.path.join(sdir, ".gemini", "antigravity-cli", "scratch", "settings.json")
+        os.makedirs(os.path.dirname(scratch_settings), exist_ok=True)
+        with open(scratch_settings, "w") as f:
+            f.write("{}")
+        self.assertTrue(is_sensitive_artifact_path(scratch_settings, sdir))
+
+        # @<path> sanitization for bare sensitive names, URL-encoded traversal, and URLs
+        p_out = _sanitize_prompt_at_paths(
+            "read @prefs.json @auth.json.bak @..%2f..%2fetc%2fpasswd @https://evil.com/a",
+            sdir,
+        )
+        self.assertEqual(
+            p_out,
+            "read [blocked-path] [blocked-path] [blocked-path] [blocked-path]",
+        )
+
+
 if __name__ == "__main__":
     unittest.main()

wechatbridge_cli-1.7.2/tests/test_price.py

@@ -0,0 +1,186 @@
+"""Price module contract tests (stdlib unittest only).
+
+These pin the *external* contracts that cannot be exercised without real
+API keys: the JD gateway signature rule, the Dataoke signature rule, the
+correct Dataoke endpoints/params for taokouling parsing and goods detail,
+and response parsing against sample payloads shaped like the real APIs.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import os
+import unittest
+from unittest import mock
+
+os.environ.setdefault("JDUNION_APP_KEY", "test_jd_key")
+os.environ.setdefault("JDUNION_APP_SECRET", "test_jd_secret")
+os.environ.setdefault("DATAOKE_APP_KEY", "test_dt_key")
+os.environ.setdefault("DATAOKE_APP_SECRET", "test_dt_secret")
+
+from wechatbridge import price as price_mod
+
+
+class TestJdSign(unittest.TestCase):
+    def test_secret_wraps_both_ends(self):
+        params = {
+            "method": "jd.union.open.goods.query",
+            "app_key": "test_jd_key",
+            "access_token": "",
+            "timestamp": "2026-11-01 19:00:00",
+            "format": "json",
+            "v": "1.0",
+            "sign_method": "md5",
+            "360buy_param_json": '{"skuIds":["123"]}',
+        }
+        plain = "".join(f"{k}{v}" for k, v in sorted(params.items()))
+        expected = hashlib.md5(
+            ("test_jd_secret" + plain + "test_jd_secret").encode("utf-8")
+        ).hexdigest().upper()
+        self.assertEqual(price_mod._jd_sign(dict(params)), expected)
+
+    def test_jd_query_parses_sample_payload(self):
+        sample = {
+            "jd_union_open_goods_query_reslt": {
+                "code": "0",
+                "data": [
+                    {
+                        "skuName": "Sample Widget 2000",
+                        "priceInfo": {"price": 129.0, "lowestPrice": 99.0},
+                        "couponInfo": {
+                            "couponList": [
+                                {"discount": 20.0, "quota": 100.0, "endTime": "2026-11-11 23:59:59"}
+                            ]
+                        },
+                        "imageInfo": {"imageList": ["https://img.example/x.jpg"]},
+                        "shopInfo": {"shopName": "Sample Shop"},
+                        "materialUrl": "https://item.jd.com/123.html",
+                    }
+                ],
+            }
+        }
+        with mock.patch.object(price_mod, "_jd_call", return_value=sample):
+            res = price_mod.query_jd_sku("123")
+        self.assertEqual(res.title, "Sample Widget 2000")
+        self.assertEqual(res.price, 129.0)
+        self.assertEqual(res.lowest_price, 99.0)
+        self.assertEqual(res.net_price(), 109.0)
+        card = res.card()
+        self.assertIn("到手价: ¥109", card)
+        self.assertIn("历史最低: ¥99", card)
+
+
+class TestDataokeSignAndCalls(unittest.TestCase):
+    def test_dt_sign_matches_sdk_algorithm(self):
+        params = {"goodsId": "789", "appKey": "test_dt_key", "version": "v2.0.0"}
+        plain = "&".join(f"{k}={v}" for k, v in sorted(params.items()))
+        expected = hashlib.md5(
+            (plain + "&key=test_dt_secret").encode("utf-8")
+        ).hexdigest().upper()
+        self.assertEqual(price_mod._dt_sign(dict(params)), expected)
+
+    def test_dt_call_attaches_appkey_version_and_sign(self):
+        captured = {}
+
+        class FakeResp:
+            def raise_for_status(self):
+                pass
+
+            def json(self):
+                return {"code": 0, "data": {"ok": True}}
+
+        def fake_get(url, params=None, timeout=None):
+            captured["url"] = url
+            captured["params"] = dict(params or {})
+            return FakeResp()
+
+        with mock.patch.object(price_mod.httpx, "get", side_effect=fake_get):
+            out = price_mod._dt_call("/goods/get-goods-details", {"goodsId": "789"})
+        self.assertEqual(out, {"ok": True})
+        self.assertEqual(captured["params"]["appKey"], "test_dt_key")
+        self.assertEqual(captured["params"]["version"], "v2.0.0")
+        unsigned = {k: v for k, v in captured["params"].items() if k != "sign"}
+        self.assertEqual(captured["params"]["sign"], price_mod._dt_sign(unsigned))
+
+    def test_dt_call_raises_on_nonzero_code(self):
+        class FakeResp:
+            def raise_for_status(self):
+                pass
+
+            def json(self):
+                return {"code": 1, "msg": "sign error"}
+
+        with mock.patch.object(price_mod.httpx, "get", return_value=FakeResp()):
+            with self.assertRaises(ValueError):
+                price_mod._dt_call("/goods/get-goods-details", {"goodsId": "1"})
+
+    def test_resolve_tkl_uses_parse_content_endpoint(self):
+        captured = {}
+
+        def fake_call(path, params):
+            captured["path"] = path
+            captured["params"] = dict(params)
+            return {"goodsId": "789456"}
+
+        with mock.patch.object(price_mod, "_dt_call", side_effect=fake_call):
+            out = price_mod.resolve_tkl("CZ0001 aBcd12")
+        self.assertEqual(captured["path"], "/tb-service/parse-content")
+        self.assertEqual(captured["params"]["content"], "CZ0001 aBcd12")
+        self.assertEqual(out["goodsId"], "789456")
+
+    def test_query_tb_item_sends_goods_id_and_parses(self):
+        captured = {}
+        sample_data = {
+            "goods": {
+                "goodsName": "TB Sample",
+                "actualPrice": 59.9,
+                "originalPrice": 79.9,
+                "quanPrice": 10.0,
+                "quanReceiveCondition": 50.0,
+                "quanEndTime": "2026-11-11 00:00:00",
+                "shopName": "TB Shop",
+                "goodsImage": "https://img.example/y.jpg",
+                "goodsUrl": "https://detail.tmall.com/item.htm?id=789",
+            }
+        }
+
+        def fake_call(path, params):
+            captured["path"] = path
+            captured["params"] = dict(params)
+            return sample_data
+
+        with mock.patch.object(price_mod, "_dt_call", side_effect=fake_call):
+            res = price_mod.query_tb_item("789")
+        self.assertEqual(captured["params"], {"goodsId": "789"})
+        self.assertEqual(res.title, "TB Sample")
+        self.assertEqual(res.price, 59.9)
+        self.assertEqual(res.net_price(), 49.9)
+
+    def test_dt_configured_requires_secret(self):
+        with mock.patch.object(price_mod, "_DT_APP_SECRET", ""):
+            self.assertFalse(price_mod.dt_configured())
+        with mock.patch.object(price_mod, "_DT_APP_SECRET", "x"):
+            self.assertTrue(price_mod.dt_configured())
+
+
+class TestDetectTrigger(unittest.TestCase):
+    def test_samples(self):
+        cases = [
+            ("看看 https://u.jd.com/AbCdEf 不错", "jd_short"),
+            ("8.8￥CZ0001 aBcd12￥ 打开淘宝", "tkl"),
+            ("https://item.jd.com/100012043978.html", "jd_item"),
+            ("https://detail.tmall.com/item.htm?id=789456123", "tb_item"),
+            ("https://m.tb.cn/h.abc123", "tb_short"),
+            ("今天天气不错", None),
+        ]
+        for text, kind in cases:
+            got = price_mod.detect_price_trigger(text)
+            if kind is None:
+                self.assertIsNone(got, msg=text)
+            else:
+                self.assertIsNotNone(got, msg=text)
+                self.assertEqual(got["kind"], kind, msg=text)
+
+
+if __name__ == "__main__":
+    unittest.main()

{wechatbridge_cli-1.7.0 → wechatbridge_cli-1.7.2}/wechatbridge/__init__.py

@@ -1,2 +1,2 @@
 """WeChatBridge — bridge WeChat messages to agy, Grok Build, or Codex CLIs."""
-__version__ = "1.7.0"
+__version__ = "1.7.2"