main.py

#!/usr/bin/env python3
"""tchkiller — 基于 claude-agent-sdk 的智能渗透 Agent"""

VERSION = "1.0.2"

import argparse
import asyncio
import json
import re
import sys
import os
from datetime import datetime
from pathlib import Path
from time import time

from claude_agent_sdk import (
    query,
    ClaudeAgentOptions,
    ResultMessage,
    AssistantMessage,
    UserMessage,
    SystemMessage,
    StreamEvent,
    RateLimitEvent,
    TextBlock,
    ToolUseBlock,
    ToolResultBlock,
    CLINotFoundError,
    CLIConnectionError,
    CLIJSONDecodeError,
    ProcessError,
)
from claude_agent_sdk.types import AgentDefinition

from prompt.system import build_system_prompt, build_target_prompt, VULN_LABELS
from prompt.judge import build_judge_prompt, JUDGE_OUTPUT_FORMAT
from providers import ProviderManager
from hooks import build_safety_hooks, reset_bypass_counter

# 统一 flag 匹配正则 — 所有检测点共用，避免不一致
FLAG_PATTERN = re.compile(r'flag\{[^}]+\}', re.IGNORECASE)

# MCP 调试日志（写入 /tmp/ 确保可见）
_DEBUG_LOG = Path("/tmp/tchkiller_mcp_debug.log")


def _mcp_log(msg: str):
    try:
        ts = datetime.now().strftime("%H:%M:%S.%f")[:-3]
        with open(_DEBUG_LOG, "a", encoding="utf-8") as f:
            f.write(f"[{ts}] [main] {msg}\n")
    except Exception:
        pass


def _timeline_append(run_dir: Path, entry: dict):
    """追加一条记录到 timeline.jsonl"""
    try:
        entry.setdefault("ts", time())
        with open(run_dir / "timeline.jsonl", "a", encoding="utf-8") as f:
            f.write(json.dumps(entry, ensure_ascii=False) + "\n")
    except Exception:
        pass


def _extract_tool_result_text(block: ToolResultBlock) -> tuple[str, bool]:
    """从 ToolResultBlock 提取文本和错误状态，返回 (text, is_error)"""
    content = block.content
    is_error = getattr(block, "is_error", False)
    if isinstance(content, str):
        text = content[:250]
    elif isinstance(content, list) and content:
        text = content[0].get("text", "")[:250] if isinstance(content[0], dict) else str(content[0])[:250]
    else:
        text = "(empty)"
    return text, is_error


def _ensure_system_path(env: dict) -> None:
    """确保 PATH 包含标准系统目录 + 用户本地目录，防止 subagent 找不到工具"""
    home = Path.home()
    std_dirs = [
        str(home / ".local" / "bin"),          # pip install --user
        "/usr/local/sbin", "/usr/local/bin", "/usr/sbin", "/usr/bin", "/sbin", "/bin",
    ]
    # pipx venvs: 当前 venv 的 bin 路径（如 claude-agent-sdk venv 里的 tccli, ldeep 等）
    pipx_venv_bin = str(home / ".local" / "share" / "pipx" / "venvs" / "claude-agent-sdk" / "bin")
    if Path(pipx_venv_bin).is_dir():
        std_dirs.insert(0, pipx_venv_bin)
    current = env.get("PATH", "")
    existing = set(current.split(":")) if current else set()
    missing = [d for d in std_dirs if d not in existing]
    if missing:
        env["PATH"] = current + (":" if current else "") + ":".join(missing)


def _format_duration(seconds: float) -> str:
    """格式化秒数为可读时间字符串"""
    minutes, secs = divmod(int(seconds), 60)
    hours, minutes = divmod(minutes, 60)
    return f"{hours}h{minutes:02d}m{secs:02d}s" if hours else f"{minutes}m{secs:02d}s"


def _init_provider_manager(args) -> ProviderManager:
    """初始化 API provider 管理器"""
    config_path = ROOT / args.providers_config
    pm = ProviderManager(config_path)
    if pm.available:
        if args.provider:
            if not pm.select(args.provider):
                print(f"  ⚠️ Provider '{args.provider}' 未找到，可用: {', '.join(p.name for p in pm._providers)}")
                sys.exit(1)
        print(f"  🔌 API Providers ({pm.count} 个):\n{pm.list_providers()}")
    return pm


def _apply_provider_env(env: dict, pm: ProviderManager) -> dict:
    """将当前 provider 的配置注入到环境变量中（覆盖 settings.json 的值）"""
    if pm.available:
        env.update(pm.get_env())
    return env


def _build_report(
    args, run_dir: Path, result_msg: ResultMessage | None,
    tool_calls_count: int = 0, tool_errors_count: int = 0,
    rounds: list | None = None,
) -> dict:
    """构建结构化运行报告"""
    report = {
        "version": VERSION,
        "target": args.target,
        "mode": args.mode,
        "team": getattr(args, "team", False),
        "model": args.model,
        "orchestrator": getattr(args, "orchestrator", False),
        "start_time": datetime.now().isoformat(),
        "duration_s": 0,
        "duration_api_s": 0,
        "total_cost_usd": 0,
        "usage": {"input_tokens": 0, "output_tokens": 0},
        "num_turns": 0,
        "stop_reason": None,
        "is_error": False,
        "vulns_count": 0,
        "evidence_count": 0,
        "flag_found": False,
        "flag_value": None,
        "tool_calls_count": tool_calls_count,
        "tool_errors_count": tool_errors_count,
    }

    if result_msg:
        report["duration_s"] = (result_msg.duration_ms or 0) / 1000
        report["duration_api_s"] = (result_msg.duration_api_ms or 0) / 1000
        report["total_cost_usd"] = result_msg.total_cost_usd or 0
        report["num_turns"] = result_msg.num_turns
        report["stop_reason"] = result_msg.stop_reason
        report["is_error"] = result_msg.is_error
        if result_msg.usage:
            report["usage"] = {
                "input_tokens": result_msg.usage.get("input_tokens", 0),
                "output_tokens": result_msg.usage.get("output_tokens", 0),
            }

    # 漏洞和证据统计
    vulns_json = run_dir / "vulns.json"
    if vulns_json.exists():
        try:
            vulns = json.loads(vulns_json.read_text(encoding="utf-8"))
            report["vulns_count"] = len(vulns)
        except Exception:
            pass
    evidence_dir = run_dir / "evidence"
    if evidence_dir.exists():
        report["evidence_count"] = len([f for f in evidence_dir.glob("*.md") if f.name != "index.md"])

    # Flag 检测
    if evidence_dir.exists():
        for f in evidence_dir.glob("*.md"):
            try:
                content = f.read_text(encoding="utf-8", errors="replace")
                m = FLAG_PATTERN.findall(content)
                if m:
                    report["flag_found"] = True
                    report["flag_value"] = m[-1]
                    break
            except Exception:
                pass

    if rounds:
        report["rounds"] = rounds

    return report


# 项目根目录
ROOT = Path(__file__).parent.resolve()


def parse_args():
    p = argparse.ArgumentParser(description="tchkiller — AI 渗透测试 Agent")
    p.add_argument("target", nargs="?", default=None, help="目标地址 (e.g. testfire.net, 192.168.1.0/24)")
    p.add_argument(
        "-m", "--mode",
        choices=["src_hunt", "cve_cloud", "network", "domain", "auto"],
        default="auto",
        help="赛区模式 (default: auto)",
    )
    p.add_argument("--model", default="sonnet", help="主模型 (default: sonnet)")
    p.add_argument("--max-turns", type=int, default=150, help="最大轮次 (default: 150)")
    p.add_argument("--thinking-tokens", type=int, default=10000, help="Thinking token 预算")
    p.add_argument("--config", default="config.yaml", help="配置文件路径")
    p.add_argument("--scope", nargs="*", help="额外授权范围 (域名/IP)")
    p.add_argument("--team", action="store_true", help="启用 Agent Teams 模式（CC 原生多 agent 协作）")
    p.add_argument("--prompt", type=str, default=None, help="附加提示词（追加到场景 prompt 之后，不替换）")
    p.add_argument("--hint", type=str, default=None, help="官方提示（高优先级独立注入，不混入 extra_prompt）")
    p.add_argument("--orchestrator", action="store_true", help="启用决策 agent 架构（多轮评估）")
    p.add_argument("--max-rounds", type=int, default=3, help="[orchestrator] 最大渗透轮数 (default: 3)")
    p.add_argument("--round-timeout", type=int, default=30, help="[orchestrator] 单轮超时分钟数 (default: 30)")
    p.add_argument("--total-timeout", type=int, default=None, help="[orchestrator] 总超时分钟数 (default: 自动计算)")
    p.add_argument("--judge-model", default="MiniMax-M2.7-highspeed", help="[orchestrator] 决策 agent 模型 (default: MiniMax-M2.7-highspeed)")
    p.add_argument("--provider", type=str, default=None, help="指定 API provider 名称 (见 providers.yaml)")
    p.add_argument("--providers-config", type=str, default="providers.json", help="providers 配置文件路径")
    p.add_argument("--profile", type=str, default=None, help="漏洞排除 profile (见 profiles/*.yaml，如 real-pentest)")
    p.add_argument("--exclude", type=str, default=None, help="排除漏洞类型，逗号分隔 (如 xss,open_redirect,tls_ssl)")
    p.add_argument("--browser", action="store_true", help="启用 Playwright 浏览器 MCP（需已安装 @playwright/mcp）")
    p.add_argument("--check", action="store_true", help="检查运行环境依赖是否安装完整")
    p.add_argument("--deep", action="store_true", help="深度检查：实际运行每个工具验证可用性 (配合 --check 使用)")
    p.add_argument("--check-providers", action="store_true", help="测试所有 API provider 可用性（模型连通性 + 余额）")
    p.add_argument("-v", "--verbose", action="store_true", help="详细输出")
    return p.parse_args()


def check_environment(deep: bool = False):
    """检查运行环境依赖是否安装完整"""
    import shutil

    checks = []

    # 1. Python version
    py_ver = f"{sys.version_info.major}.{sys.version_info.minor}.{sys.version_info.micro}"
    checks.append(("Python >= 3.10", sys.version_info >= (3, 10), py_ver))

    # 2. Claude Code CLI
    claude_bin = shutil.which("claude")
    checks.append(("Claude Code CLI", claude_bin is not None, claude_bin or "未安装"))

    # 3. claude-agent-sdk
    try:
        import claude_agent_sdk
        sdk_ver = getattr(claude_agent_sdk, "__version__", "installed")
        checks.append(("claude-agent-sdk", True, sdk_ver))
    except ImportError:
        checks.append(("claude-agent-sdk", False, "pip install claude-agent-sdk"))

    # 4. PyYAML
    try:
        import yaml
        checks.append(("PyYAML", True, yaml.__version__))
    except ImportError:
        checks.append(("PyYAML", False, "pip install pyyaml"))

    # 5. vulndb index
    vulndb_path = ROOT / "vulndb.sqlite"
    vulndb_ok = vulndb_path.exists() and vulndb_path.stat().st_size > 0
    if vulndb_ok:
        import sqlite3
        try:
            conn = sqlite3.connect(str(vulndb_path))
            count = conn.execute("SELECT COUNT(*) FROM vulns").fetchone()[0]
            conn.close()
            checks.append(("vulndb 索引", True, f"{count} 条漏洞"))
        except Exception:
            checks.append(("vulndb 索引", False, "运行 python3 vulndb_index.py 重建"))
    else:
        checks.append(("vulndb 索引", False, "运行 python3 vulndb_index.py 构建"))

    # 6. Playwright MCP (optional)
    npx_bin = shutil.which("npx")
    if npx_bin:
        import subprocess
        try:
            result = subprocess.run(
                ["npm", "list", "-g", "@playwright/mcp"],
                capture_output=True, timeout=15,
            )
            pw_ok = result.returncode == 0
        except Exception:
            pw_ok = False
        checks.append(("@playwright/mcp (可选)", pw_ok,
                        "已安装" if pw_ok else "npm install -g @playwright/mcp"))
    else:
        checks.append(("@playwright/mcp (可选)", False, "需先安装 Node.js + npm"))

    # 7. Common tools
    for tool, pkg in [("curl", "curl"), ("ffuf", "ffuf")]:
        found = shutil.which(tool)
        checks.append((tool, found is not None, found or f"未安装 ({pkg})"))

    # 7b. Runtime / Language checks
    import subprocess as _sp_rt
    # Docker
    docker_bin = shutil.which("docker")
    if docker_bin:
        try:
            _r = _sp_rt.run([docker_bin, "--version"], capture_output=True, text=True, timeout=5)
            _dv = _r.stdout.strip().split(",")[0] if _r.returncode == 0 else docker_bin
            checks.append(("Docker", True, _dv))
        except Exception:
            checks.append(("Docker", True, docker_bin))
    else:
        checks.append(("Docker", False, "未安装 → https://docs.docker.com/engine/install/"))
    # Go
    go_bin = shutil.which("go")
    if go_bin:
        try:
            _r = _sp_rt.run([go_bin, "version"], capture_output=True, text=True, timeout=5)
            _gv = _r.stdout.strip() if _r.returncode == 0 else go_bin
            checks.append(("Go", True, _gv))
        except Exception:
            checks.append(("Go", True, go_bin))
    else:
        checks.append(("Go", False, "未安装 → apt install golang-go 或 https://go.dev/dl/"))
    # Python3
    py3_bin = shutil.which("python3")
    if py3_bin:
        try:
            _r = _sp_rt.run([py3_bin, "--version"], capture_output=True, text=True, timeout=5)
            _pv = _r.stdout.strip() if _r.returncode == 0 else py3_bin
            checks.append(("Python3", True, _pv))
        except Exception:
            checks.append(("Python3", True, py3_bin))
    else:
        checks.append(("Python3", False, "未安装 → apt install python3"))
    # Ruby
    ruby_bin = shutil.which("ruby")
    if ruby_bin:
        try:
            _r = _sp_rt.run([ruby_bin, "--version"], capture_output=True, text=True, timeout=5)
            _rv = _r.stdout.strip() if _r.returncode == 0 else ruby_bin
            checks.append(("Ruby", True, _rv))
        except Exception:
            checks.append(("Ruby", True, ruby_bin))
    else:
        checks.append(("Ruby", False, "未安装 → apt install ruby-full"))

    # 8. nc/ncat (any variant)
    nc_bin = shutil.which("ncat") or shutil.which("nc") or shutil.which("netcat")
    checks.append(("nc/ncat", nc_bin is not None, nc_bin or "未安装 (apt install ncat)"))

    # 9. Pentest tools (skills/tool/* 对应的工具)
    pentest_tools = [
        ("nuclei",     "go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest"),
        ("naabu",      "go install -v github.com/projectdiscovery/naabu/v2/cmd/naabu@latest"),
        ("katana",     "go install -v github.com/projectdiscovery/katana/cmd/katana@latest"),
        ("subfinder",  "go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest"),
        ("spray",      "https://github.com/chainreactors/spray/releases"),
        ("gogo",       "https://github.com/chainreactors/gogo/releases"),
        ("zombie",     "https://github.com/chainreactors/zombie/releases"),
        ("xray",       "https://github.com/chaitin/xray/releases"),
        ("msfconsole", "apt install metasploit-framework"),
        ("nmap",       "apt install nmap"),
        ("sqlmap",     "apt install sqlmap"),
        ("hashcat",    "apt install hashcat"),
        ("iox",        "https://github.com/EddieIvan01/iox/releases"),
        ("cdk",        "https://github.com/cdk-team/CDK/releases"),
        ("k8spider",   "https://github.com/Esonhugh/k8spider/releases"),
        ("ingressnightmare", "https://github.com/Esonhugh/ingressNightmare-CVE-2025-1974-exps/releases"),
        ("kubectl",    "https://dl.k8s.io/release/stable.txt"),
        ("kubeletctl", "https://github.com/cyberark/kubeletctl/releases"),
        ("peirates",   "https://github.com/inguardians/peirates/releases"),
        ("etcdctl",    "https://github.com/etcd-io/etcd/releases"),
        ("tccli",      "pip install tccli"),
        ("ligolo-proxy", "https://github.com/nicocha30/ligolo-ng/releases"),
        ("linpeas",    "https://github.com/peass-ng/PEASS-ng/releases"),
        ("lsassy",     "pip install lsassy"),
        ("donpapi",    "pip install donpapi"),
        ("pywhisker",  "f8x -ad 或 git clone https://github.com/ShutdownRepo/pywhisker"),
        ("dfscoerce",  "f8x -ad 或 git clone https://github.com/Wh04m1001/DFSCoerce"),
        ("shadowcoerce", "f8x -ad 或 git clone https://github.com/ShutdownRepo/ShadowCoerce"),
        ("gpowned",    "f8x -ad 或 git clone https://github.com/X-C3LL/GPOwned"),
        ("gpp-decrypt", "pip install gpp-decrypt"),
        ("ccupp",      "git clone https://github.com/WangYihang/ccupp && cd ccupp && pipx install ."),
        ("githacker",  "pip install GitHacker"),
    ]
    for tool, install_hint in pentest_tools:
        found = shutil.which(tool)
        checks.append((f"{tool} (渗透)", found is not None, found or f"未安装 → {install_hint}"))

    # 9b. httpx — 必须是 ProjectDiscovery 版本，不是 Python httpx
    import subprocess as _sp
    httpx_bin = shutil.which("httpx")
    httpx_ok = False
    httpx_detail = "未安装 → go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest"
    if httpx_bin:
        try:
            r = _sp.run([httpx_bin, "-version"], capture_output=True, text=True, timeout=5)
            ver_out = (r.stdout + r.stderr).lower()
            if "projectdiscovery" in ver_out or "httpx.runner" in ver_out:
                httpx_ok = True
                httpx_detail = httpx_bin
            else:
                httpx_detail = f"发现 {httpx_bin} 但不是 ProjectDiscovery 版本 → go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest"
        except Exception:
            httpx_detail = f"发现 {httpx_bin} 但无法验证版本 → go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest"
    checks.append(("httpx (渗透)", httpx_ok, httpx_detail))

    # 9c. 多二进制名工具（有多个可能的命令名）
    multi_bin_tools = [
        ("CrackMapExec", ["crackmapexec", "cme"], "https://github.com/Porchetta-Industries/CrackMapExec"),
        ("NetExec",      ["nxc", "netexec"],      "https://github.com/Pennyw0rth/NetExec"),
        ("impacket",     ["impacket-secretsdump", "secretsdump.py", "impacket-smbclient"],
                         "pip install impacket / https://github.com/fortra/impacket"),
        ("certipy",      ["certipy", "certipy-ad"], "pip install certipy-ad"),
        ("Adinfo",       ["Adinfo"],               "https://github.com/lzzbb/Adinfo/releases"),
        ("Responder",    ["responder", "Responder.py", "responder.py"],
                         "https://github.com/lgandx/Responder"),
        ("bloodhound-python", ["bloodhound-python", "bloodhound"],
                         "pip install bloodhound"),
        ("kerbrute",     ["kerbrute"],             "https://github.com/ropnop/kerbrute/releases"),
        ("Coercer",      ["coercer"],              "pip install coercer"),
        ("ldeep",        ["ldeep"],                "pip install ldeep"),
        ("enum4linux-ng", ["enum4linux-ng"],        "pip install enum4linux-ng"),
        ("john",         ["john"],                 "apt install john"),
        ("evil-winrm",   ["evil-winrm"],           "gem install evil-winrm"),
        ("bloodyAD",     ["bloodyAD", "bloodyadpy"], "pip install bloodyAD"),
        ("mitm6",        ["mitm6"],                "pip install mitm6"),
        ("ldapsearch",   ["ldapsearch"],           "apt install ldap-utils"),
        ("xfreerdp",     ["xfreerdp", "xfreerdp3"],  "apt install freerdp2-x11 / freerdp3-x11"),
        ("proxychains",  ["proxychains4", "proxychains"], "apt install proxychains4"),
        ("sliver-client", ["sliver", "sliver-client"], "https://github.com/BishopFox/sliver/wiki/Getting-Started"),
        ("sliver-server", ["sliver-server"],          "https://github.com/BishopFox/sliver/wiki/Getting-Started"),
        ("gMSADumper",   ["gMSADumper.py", "gMSADumper"], "https://github.com/micahvandeusen/gMSADumper"),
        ("pypykatz",     ["pypykatz"],              "pip install pypykatz"),
        ("nps/npc",      ["npc", "nps"],            "https://github.com/ehang-io/nps/releases"),
        ("Exegol",       ["exegol"],                "pip install exegol"),
        ("docker",       ["docker"],                "https://docs.docker.com/engine/install/"),
    ]
    for label, bins, install_hint in multi_bin_tools:
        found_bin = None
        for b in bins:
            found_bin = shutil.which(b)
            if found_bin:
                break
        # sliver-server 常安装在 /root/sliver-server，不在 PATH 中
        if not found_bin and label == "sliver-server":
            _ss = Path.home() / "sliver-server"
            if _ss.is_file():
                found_bin = str(_ss)
        checks.append((f"{label} (渗透)", found_bin is not None,
                        found_bin or f"未安装 → {install_hint}"))

    # 9d. Python 库检查（无 CLI 命令，仅 import 检测）
    try:
        import minikerberos as _mk
        checks.append(("minikerberos (渗透)", True, f"已安装 ({_mk.__version__})" if hasattr(_mk, '__version__') else "已安装"))
    except ImportError:
        checks.append(("minikerberos (渗透)", False, "未安装 → pip install minikerberos"))

    # 9f. /pentest/ 目录工具检查（git clone 安装，无 PATH 二进制）
    _pentest_dir_tools = [
        ("PetitPotam",         "PetitPotam/PetitPotam.py",                   "f8x -ad"),
        ("noPac",              "noPac/noPac.py",                             "f8x -ad"),
        ("zerologon",          "CVE-2020-1472/cve-2020-1472-exploit.py",     "f8x -ad"),
        ("pyGPOAbuse",         "pyGPOAbuse/pygpoabuse.py",                   "f8x -ad"),
        ("targetedKerberoast", "targetedKerberoast/targetedKerberoast.py",   "f8x -ad"),
        ("PassTheCert",        "PassTheCert/Python/passthecert.py",          "f8x -ad"),
        ("krbrelayx",          "krbrelayx/krbrelayx.py",                     "f8x -ad"),
    ]
    _pentest_base = Path("/pentest")
    for _label, _rel, _hint in _pentest_dir_tools:
        _p = _pentest_base / _rel
        checks.append((f"{_label} (渗透)", _p.is_file(), str(_p) if _p.is_file() else f"未安装 → {_hint}"))

    # 9e. docker compose 检查（子命令，无法用 which 检测）
    import subprocess as _sp2
    _dc_bin = shutil.which("docker-compose")
    if _dc_bin:
        checks.append(("docker-compose (渗透)", True, _dc_bin))
    else:
        try:
            _r = _sp2.run(["docker", "compose", "version"], capture_output=True, text=True, timeout=5)
            if _r.returncode == 0:
                _ver = _r.stdout.strip().split()[-1] if _r.stdout.strip() else ""
                checks.append(("docker-compose (渗透)", True, f"docker compose {_ver}"))
            else:
                checks.append(("docker-compose (渗透)", False, "未安装 → apt install docker-compose-plugin"))
        except Exception:
            checks.append(("docker-compose (渗透)", False, "未安装 → apt install docker-compose-plugin"))

    # 10. 资源库检查：nuclei-templates + AboutSecurity 字典库
    nuclei_tpl_dir = Path.home() / "nuclei-templates"
    if nuclei_tpl_dir.is_dir():
        tpl_count = sum(1 for _ in nuclei_tpl_dir.rglob("*.yaml"))
        checks.append(("nuclei-templates (资源)", True, f"{nuclei_tpl_dir} ({tpl_count} 模板)"))
    else:
        checks.append(("nuclei-templates (资源)", False,
                        f"未找到 → nuclei -update-templates 或 git clone https://github.com/projectdiscovery/nuclei-templates ~/nuclei-templates"))

    about_sec_dir = Path("/pentest/AboutSecurity/Dic")
    if not about_sec_dir.is_dir():
        # 开发环境 fallback
        about_sec_dir = ROOT / "../../public/AboutSecurity/Dic" if (ROOT / "../../public/AboutSecurity/Dic").is_dir() else None
    if about_sec_dir and about_sec_dir.is_dir():
        dic_count = sum(1 for _ in about_sec_dir.rglob("*.txt"))
        checks.append(("AboutSecurity 字典库 (资源)", True, f"{about_sec_dir.resolve()} ({dic_count} 字典)"))
    else:
        checks.append(("AboutSecurity 字典库 (资源)", False,
                        "未找到 /pentest/AboutSecurity/Dic → git clone AboutSecurity 到 /pentest/ 下"))

    # 11. 投递物仓库检查 (arsenal)
    _ARSENAL_TOOLS = [
        ("fscan",  "https://github.com/shadow1ng/fscan/releases",    None),
        ("gogo",   "https://github.com/chainreactors/gogo/releases", None),
        ("zombie", "https://github.com/chainreactors/zombie/releases", None),
        ("spray",  "https://github.com/chainreactors/spray/releases", None),
        ("cdk",      "https://github.com/cdk-team/CDK/releases",       ["linux_amd64", "linux_arm64"]),
        ("k8spider",   "https://github.com/Esonhugh/k8spider/releases",    None),
        ("ingressnightmare", "https://github.com/Esonhugh/ingressNightmare-CVE-2025-1974-exps/releases", None),
        ("kubeletctl", "https://github.com/cyberark/kubeletctl/releases",  None),
        ("peirates",   "https://github.com/inguardians/peirates/releases", ["linux_amd64", "linux_arm64"]),
        ("etcdctl",    "https://github.com/etcd-io/etcd/releases",         None),
        ("kubectl",    "https://dl.k8s.io",                                None),
        ("iox",        "https://github.com/EddieIvan01/iox/releases",     None),
        ("frpc",   "https://github.com/fatedier/frp/releases",       None),
        ("chisel", "https://github.com/jpillora/chisel/releases",    None),
        ("ligolo-agent", "https://github.com/nicocha30/ligolo-ng/releases", None),
        ("linpeas",  "https://github.com/peass-ng/PEASS-ng/releases",  ["linux_amd64", "linux_arm64"]),
        ("winpeas",  "https://github.com/peass-ng/PEASS-ng/releases",  ["_any_"]),
        ("GodPotato", "https://github.com/BeichenDream/GodPotato/releases", ["_any_"]),
        ("mimikatz", "https://github.com/gentilkiwi/mimikatz/releases", ["_any_"]),
        ("SharpHound", "https://github.com/BloodHoundAD/SharpHound/releases", ["_any_"]),
        ("PrintSpoofer", "https://github.com/itm4n/PrintSpoofer/releases", ["_any_"]),
        ("SharpWMI", "https://github.com/QAX-A-Team/sharpwmi/releases", ["_any_"]),
        ("SharPersist", "https://github.com/mandiant/SharPersist/releases", ["_any_"]),
        ("StandIn", "https://github.com/FuzzySecurity/StandIn/releases", ["_any_"]),
    ]
    _ARSENAL_PLATFORMS = ["linux_amd64", "linux_arm64", "windows_amd64"]

    # 读取 config 中的 arsenal_dir，默认 /pentest/arsenal
    arsenal_dir = Path("/pentest/arsenal")
    try:
        import yaml as _yaml
        cfg_path = ROOT / "config.yaml"
        if cfg_path.exists():
            with open(cfg_path) as _f:
                _cfg = _yaml.safe_load(_f) or {}
            if _cfg.get("arsenal_dir"):
                arsenal_dir = Path(_cfg["arsenal_dir"])
    except Exception:
        pass

    if arsenal_dir.is_dir():
        arsenal_summary = []
        for tool_name, dl_url, tool_plats in _ARSENAL_TOOLS:
            tool_dir = arsenal_dir / tool_name
            plats = tool_plats or _ARSENAL_PLATFORMS
            if not tool_dir.is_dir():
                arsenal_summary.append(f"{tool_name}: 缺失")
                continue
            found_plats = []
            for plat in plats:
                if plat == "_any_":
                    # Windows-only tools: just check directory has files
                    if any(tool_dir.iterdir()):
                        found_plats.append(plat)
                else:
                    # 匹配 fscan_linux_amd64, fscan_linux_amd64.exe, cdk_linux_amd64 等
                    matches = list(tool_dir.glob(f"*{plat}*"))
                    if matches:
                        found_plats.append(plat)
            if len(found_plats) == len(plats):
                arsenal_summary.append(f"{tool_name}: ✓")
            else:
                missing = [p for p in plats if p not in found_plats]
                arsenal_summary.append(f"{tool_name}: 缺 {','.join(missing)}")

        all_complete = all("✓" in s for s in arsenal_summary)
        summary_str = " | ".join(arsenal_summary)
        checks.append(("投递物仓库 (arsenal)", all_complete, summary_str))
    else:
        checks.append(("投递物仓库 (arsenal)", False,
                        f"未找到 {arsenal_dir} → mkdir -p {arsenal_dir}/{{fscan,gogo,zombie,spray,cdk,k8spider,ingressnightmare,kubeletctl,peirates,etcdctl,kubectl,iox,frpc,chisel,ligolo-agent,linpeas,winpeas,GodPotato,mimikatz,SharpHound,PrintSpoofer,SharpWMI,SharPersist,StandIn}} 并下载各平台二进制"))

    # ── 深度检查 (--deep): 实际运行每个工具，检测架构不兼容 / Python 依赖缺失 / 动态库缺失 ──
    if deep:
        import concurrent.futures
        import subprocess as _sp_deep

        _STARTUP_FAIL_PATTERNS = [
            "exec format error",
            "cannot execute binary file",
            "cannot execute",
            "modulenotfounderror",
            "importerror",
            "cannot open shared object file",
            "error while loading shared libraries",
        ]
        # 跳过：非工具类检查 / 已在基础检查中运行过 --version
        _DEEP_SKIP_KEYWORDS = (
            "(资源)", "(arsenal)", "minikerberos", "Python >=", "Python3",
            "playwright", "anthropic", "PyYAML", "vulndb", "Docker",
            "docker-compose", "Go", "Ruby",
        )

        _deep_targets = []  # (idx, label, binary, is_pyscript)
        for _i, (_nm, _ok, _dt) in enumerate(checks):
            if not _ok:
                continue
            if any(kw in _nm for kw in _DEEP_SKIP_KEYWORDS):
                continue
            _bin = _dt.strip()
            if not _bin.startswith("/"):
                continue
            if not Path(_bin).is_file():
                continue
            _deep_targets.append((_i, _nm, _bin, _bin.endswith(".py")))

        def _deep_verify(item):
            idx, label, binary, is_py = item
            try:
                cmd = ["python3", binary, "--help"] if is_py else [binary, "--version"]
                r = _sp_deep.run(cmd, capture_output=True, text=True, timeout=10)
                # exit 126/127 = 无法执行
                if r.returncode in (126, 127):
                    combined = ((r.stderr or "") + " " + (r.stdout or "")).lower()
                    if "exec format error" in combined:
                        return (idx, False, "架构不兼容 (Exec format error)")
                    return (idx, False, f"无法执行 (exit {r.returncode})")
                # exit 0 = 正常
                if r.returncode == 0:
                    return (idx, True, None)
                # exit != 0: 检查是否为启动失败（依赖/架构问题）
                combined = ((r.stderr or "") + " " + (r.stdout or "")).lower()
                # 输出量大（>300字符）= 工具成功启动并打印了帮助/用法，非零退出仅因缺少必选参数
                if len(combined) > 300:
                    return (idx, True, None)
                for pat in _STARTUP_FAIL_PATTERNS:
                    if pat in combined:
                        for line in (r.stderr or "").split("\n"):
                            if pat in line.lower():
                                return (idx, False, line.strip()[:100])
                        return (idx, False, pat)
                # 非零退出但无启动失败模式 → 工具可启动，只是不支持 --version
                return (idx, True, None)
            except OSError as e:
                if getattr(e, "errno", 0) == 8:  # ENOEXEC
                    return (idx, False, "架构不兼容 (Exec format error)")
                return (idx, False, f"OS 错误: {e}")
            except _sp_deep.TimeoutExpired:
                return (idx, True, None)  # 超时 = 至少能启动
            except Exception as e:
                return (idx, False, f"异常: {str(e)[:80]}")

        if _deep_targets:
            print(f"\n🔬 深度检查：验证 {len(_deep_targets)} 个工具实际可运行...")
            _deep_fails = []
            with concurrent.futures.ThreadPoolExecutor(max_workers=10) as _pool:
                _deep_results = list(_pool.map(_deep_verify, _deep_targets))
            for _idx, _dok, _reason in _deep_results:
                if not _dok:
                    _n, _, _d = checks[_idx]
                    checks[_idx] = (_n, False, f"{_d} ⛔ {_reason}")
                    _deep_fails.append((_n, _reason))
            if _deep_fails:
                print(f"\n  ⚠️  {len(_deep_fails)} 个工具不可用:")
                for _n, _r in _deep_fails:
                    print(f"    ❌ {_n}: {_r}")
            else:
                print(f"  ✅ 全部 {len(_deep_targets)} 个工具验证通过")
            print()

    # Print results
    print(f"\n🔍 tchkiller v{VERSION} 环境检查\n")
    all_ok = True
    for name, ok, detail in checks:
        if ok:
            icon = "✅"
        elif "(可选)" in name or "(渗透)" in name or "(资源)" in name or "(arsenal)" in name:
            icon = "⚠️"
        else:
            icon = "❌"
            all_ok = False
        print(f"  {icon} {name:<30s} {detail}")

    print()
    if all_ok:
        print("✅ 所有必要依赖已就绪！")
    else:
        print("⚠️  部分必要依赖缺失，请按提示安装")
    print()
    return all_ok


def check_providers(args) -> bool:
    """测试所有 API provider 的可用性：发送最小 chat completion 请求"""
    import concurrent.futures
    import json
    import time
    try:
        from urllib.request import Request, urlopen
        from urllib.error import HTTPError, URLError
    except ImportError:
        print("❌ urllib 不可用")
        return False

    config_path = ROOT / args.providers_config
    if not config_path.exists():
        print(f"❌ 未找到 providers 配置: {config_path}")
        return False

    with open(config_path, encoding="utf-8") as f:
        data = json.load(f)

    providers = [p for p in data.get("providers", []) if p.get("enabled", True)]
    if not providers:
        print("⚠️  providers.json 中无可用 provider")
        return False

    print(f"\n🔌 测试 {len(providers)} 个 API Provider 可用性...\n")

    def _test_provider(p):
        name = p["name"]
        base_url = p["base_url"].rstrip("/")
        api_key = p["api_key"]
        # 取第一个可用模型
        models = p.get("models", {})
        model = models.get("haiku") or models.get("sonnet") or models.get("opus") or "test"

        # 优先尝试 Anthropic Messages API，失败再 fallback OpenAI Chat Completions
        attempts = [
            ("Anthropic", f"{base_url}/v1/messages",
             json.dumps({"model": model, "messages": [{"role": "user", "content": "hi"}], "max_tokens": 5}).encode(),
             {"Content-Type": "application/json", "x-api-key": api_key, "anthropic-version": "2023-06-01"}),
            ("OpenAI", f"{base_url}/v1/chat/completions",
             json.dumps({"model": model, "messages": [{"role": "user", "content": "hi"}], "max_tokens": 5, "stream": False}).encode(),
             {"Content-Type": "application/json", "Authorization": f"Bearer {api_key}"}),
        ]

        working_fmt = None
        for api_fmt, url, body, headers in attempts:
            req = Request(url, data=body, headers=headers)
            t0 = time.time()
            try:
                resp = urlopen(req, timeout=30)
                latency = time.time() - t0
                resp_body = resp.read().decode()
                try:
                    rj = json.loads(resp_body)
                    usage = rj.get("usage", {})
                    tok_info = ""
                    if usage:
                        tok_total = usage.get("total_tokens") or usage.get("input_tokens", 0) + usage.get("output_tokens", 0)
                        tok_info = f" tokens={tok_total}"
                    has_content = rj.get("content") or rj.get("choices")
                    if has_content:
                        working_fmt = (api_fmt, latency, tok_info, headers)
                        break
                    return (name, True, f"⚠️ {model} | {latency:.1f}s | 响应无内容: {resp_body[:100]}")
                except json.JSONDecodeError:
                    return (name, False, f"❌ 非 JSON 响应: {resp_body[:100]}")
            except HTTPError as e:
                latency = time.time() - t0
                err_body = ""
                try:
                    err_body = e.read().decode()[:200]
                except Exception:
                    pass
                code = e.code
                if code == 404:
                    continue  # 该格式不支持，尝试下一种
                if code == 429:
                    return (name, False, f"❌ 限流 (429) | {latency:.1f}s | {err_body}")
                elif code == 402:
                    return (name, False, f"❌ 余额不足 (402) | {err_body}")
                elif code == 401 or code == 403:
                    return (name, False, f"❌ 认证失败 ({code}) | {err_body}")
                else:
                    return (name, False, f"❌ HTTP {code} | {latency:.1f}s | {err_body}")
            except URLError as e:
                return (name, False, f"❌ 连接失败: {e.reason}")
            except TimeoutError:
                return (name, False, f"❌ 超时 (>30s)")
            except Exception as e:
                return (name, False, f"❌ {type(e).__name__}: {str(e)[:80]}")

        if not working_fmt:
            return (name, False, f"❌ Anthropic/OpenAI 两种格式均返回 404")

        api_fmt, latency, tok_info, base_headers = working_fmt

        # Phase 2: streaming + tool_use 多轮兼容性测试（模拟 claude-agent-sdk 实际调用方式）
        tool_ok, tool_detail = _test_tool_use_streaming(name, base_url, api_key, model, api_fmt, base_headers)
        if tool_ok:
            return (name, True, f"✅ {model} ({api_fmt}) | {latency:.1f}s{tok_info} | streaming+tool ✅")
        else:
            return (name, False,
                    f"⚠️ {model} ({api_fmt}) | {latency:.1f}s{tok_info} | "
                    f"❌ {tool_detail}")

    def _test_tool_use_streaming(name, base_url, api_key, model, api_fmt, base_headers):
        """模拟 claude-agent-sdk 的实际调用: streaming + tool_use + multi-turn tool_result"""
        if api_fmt != "Anthropic":
            # OpenAI 格式暂不做深度测试
            return True, ""

        url = f"{base_url}/v1/messages"
        tool_def = {
            "name": "get_time",
            "description": "Get current time in ISO format",
            "input_schema": {"type": "object", "properties": {}, "required": []}
        }

        # ── Step 1: streaming + tool_use 请求 ──
        body1 = json.dumps({
            "model": model, "max_tokens": 200, "stream": True,
            "tools": [tool_def],
            "messages": [{"role": "user", "content": "What time is it? You must call the get_time tool."}],
        }).encode()
        headers = {**base_headers}

        req1 = Request(url, data=body1, headers=headers)
        try:
            resp1 = urlopen(req1, timeout=30)
        except HTTPError as e:
            err = ""
            try:
                err = e.read().decode()[:200]
            except Exception:
                pass
            return False, f"streaming 请求失败: HTTP {e.code} {err}"
        except Exception as e:
            return False, f"streaming 连接失败: {e}"

        # 解析 SSE 流，提取完整响应
        tool_use_id = None
        try:
            raw = resp1.read().decode("utf-8", errors="replace")
            # 从 SSE data 行中提取 JSON events
            for line in raw.split("\n"):
                line = line.strip()
                if not line.startswith("data: "):
                    continue
                data = line[6:]
                if data == "[DONE]":
                    break
                try:
                    evt = json.loads(data)
                except json.JSONDecodeError:
                    return False, f"streaming SSE JSON 解析失败: {data[:100]}"
                # 查找 tool_use content_block
                evt_type = evt.get("type", "")
                if evt_type == "content_block_start":
                    cb = evt.get("content_block", {})
                    if cb.get("type") == "tool_use":
                        tool_use_id = cb.get("id")
                # message_delta 包含 stop_reason
                if evt_type == "message_delta":
                    delta = evt.get("delta", {})
                    if delta.get("stop_reason") == "tool_use" and not tool_use_id:
                        # 某些代理可能不按标准发送 content_block_start
                        pass
        except Exception as e:
            return False, f"streaming 响应读取失败: {type(e).__name__}: {str(e)[:80]}"

        if not tool_use_id:
            # 模型可能直接文本回复而非调用工具 — streaming 本身是正常的
            return True, ""

        # ── Step 2: 多轮 tool_result 请求（这是 MiniMax 容易崩的地方）──
        body2 = json.dumps({
            "model": model, "max_tokens": 200, "stream": True,
            "tools": [tool_def],
            "messages": [
                {"role": "user", "content": "What time is it? Call get_time."},
                {"role": "assistant", "content": [
                    {"type": "tool_use", "id": tool_use_id, "name": "get_time", "input": {}}
                ]},
                {"role": "user", "content": [
                    {"type": "tool_result", "tool_use_id": tool_use_id, "content": "2025-01-01T12:00:00Z"}
                ]},
            ],
        }).encode()

        req2 = Request(url, data=body2, headers=headers)
        try:
            resp2 = urlopen(req2, timeout=30)
        except HTTPError as e:
            err = ""
            try:
                err = e.read().decode()[:200]
            except Exception:
                pass
            return False, f"多轮 tool_result 请求失败: HTTP {e.code} {err}"
        except Exception as e:
            return False, f"多轮 tool_result 连接失败: {e}"

        try:
            raw2 = resp2.read().decode("utf-8", errors="replace")
            got_text = False
            for line in raw2.split("\n"):
                line = line.strip()
                if not line.startswith("data: "):
                    continue
                data = line[6:]
                if data == "[DONE]":
                    break
                try:
                    evt = json.loads(data)
                    got_text = True
                except json.JSONDecodeError:
                    return False, f"多轮 streaming JSON 解析失败 (实际运行会 Failed to parse JSON): {data[:100]}"
            if not got_text:
                return False, f"多轮 streaming 无有效数据"
            return True, ""
        except Exception as e:
            return False, f"多轮 streaming 读取失败: {type(e).__name__}: {str(e)[:80]}"

    with concurrent.futures.ThreadPoolExecutor(max_workers=len(providers)) as pool:
        results = list(pool.map(_test_provider, providers))

    all_ok = True
    for p, (name, ok, detail) in zip(providers, results):
        icon = "✅" if ok else "❌"
        url_short = p["base_url"].rstrip("/")
        print(f"  {icon} {name:<25s} {url_short}")
        print(f"     {detail}")
        if not ok:
            all_ok = False

    print()
    if all_ok:
        print(f"✅ 全部 {len(providers)} 个 provider 可用！")
    else:
        failed = sum(1 for _, ok, _ in results if not ok)
        passed = len(results) - failed
        print(f"⚠️  {failed}/{len(providers)} 个 provider 不可用，{passed} 个正常")
    print()
    return all_ok


def load_config(config_path: str) -> dict:
    """加载 YAML 配置文件"""
    path = ROOT / config_path
    if not path.exists():
        return {}
    try:
        import yaml
        with open(path) as f:
            return yaml.safe_load(f) or {}
    except ImportError:
        # 无 pyyaml 时返回空配置
        return {}


# 快捷别名 → 展开为具体漏洞类型
_EXCLUSION_ALIASES = {
    "xss": ["xss_reflected", "xss_stored", "xss_dom", "xss"],
    "tls": ["tls_ssl"],
    "tls_ssl": ["tls_ssl"],
    "header": ["missing_header"],
    "cookie": ["cookie_security"],
    "redirect": ["open_redirect"],
    "info": ["info_disclosure"],
    "session": ["session_mgmt"],
}


def resolve_exclusions(args) -> list[str]:
    """解析 --profile 和 --exclude 参数，返回排除的漏洞类型列表"""
    excluded = set()

    # 1) 从 profile YAML 加载
    if args.profile:
        profile_path = ROOT / "profiles" / f"{args.profile}.yaml"
        if not profile_path.exists():
            profile_path = ROOT / "profiles" / f"{args.profile}.yml"
        if profile_path.exists():
            try:
                import yaml
                with open(profile_path) as f:
                    prof = yaml.safe_load(f) or {}
                for v in prof.get("exclude_vulns", []):
                    for expanded in _EXCLUSION_ALIASES.get(v, [v]):
                        excluded.add(expanded)
            except ImportError:
                # pyyaml 未安装，用简单解析器处理
                with open(profile_path, encoding="utf-8") as f:
                    for line in f:
                        line = line.strip()
                        if line.startswith("- "):
                            v = line[2:].strip()
                            if v:
                                for expanded in _EXCLUSION_ALIASES.get(v, [v]):
                                    excluded.add(expanded)
            except Exception as e:
                print(f"⚠️ 读取 profile {args.profile} 失败: {e}")
        else:
            print(f"⚠️ Profile 不存在: {profile_path}")

    # 2) 从 --exclude CLI 参数追加
    if args.exclude:
        for v in args.exclude.split(","):
            v = v.strip().lower()
            if v:
                for expanded in _EXCLUSION_ALIASES.get(v, [v]):
                    excluded.add(expanded)

    return sorted(excluded)


def setup_output_dir(target: str) -> Path:
    """创建本次运行的输出目录"""
    ts = datetime.now().strftime("%Y%m%d-%H%M%S")
    safe_target = target.replace("://", "_").replace("/", "_").replace(":", "_")
    run_dir = ROOT / "output" / f"{ts}-{safe_target}"
    run_dir.mkdir(parents=True, exist_ok=True)
    (run_dir / "evidence").mkdir(exist_ok=True)

    # CC 从 cwd 加载 .claude/skills/<name>/SKILL.md（二级扁平结构）
    claude_skills_src = ROOT / ".claude" / "skills"
    claude_dir = run_dir / ".claude"
    claude_dir.mkdir(exist_ok=True)
    skills_link = claude_dir / "skills"
    if claude_skills_src.exists() and not skills_link.exists():
        skills_link.symlink_to(claude_skills_src.resolve())

    # 复制项目根的 CLAUDE.md 和 AUTHORIZATION.md 到 run_dir
    import shutil
    claude_md_src = ROOT / "CLAUDE.md"
    claude_md_dst = run_dir / "CLAUDE.md"
    if claude_md_src.exists() and not claude_md_dst.exists():
        shutil.copy2(claude_md_src, claude_md_dst)

    auth_md_src = ROOT / "AUTHORIZATION.md"
    auth_md_dst = run_dir / "AUTHORIZATION.md"
    if auth_md_src.exists() and not auth_md_dst.exists():
        shutil.copy2(auth_md_src, auth_md_dst)

    # 创建 .curlrc 让 curl 默认忽略 SSL 证书 + 静默模式
    curlrc = run_dir / ".curlrc"
    if not curlrc.exists():
        curlrc.write_text("--insecure\n--silent\n", encoding="utf-8")

    return run_dir


def _build_mcp_servers(mcp_server_script: str, mcp_env: dict, browser: bool = False) -> dict:
    """构建 MCP servers 配置，可选启用 Playwright 浏览器"""
    servers = {
        "tchkiller": {
            "command": sys.executable,
            "args": [mcp_server_script],
            "env": mcp_env,
        }
    }
    if browser:
        import shutil, subprocess
        # 渗透测试必备参数：headless + 忽略 HTTPS 错误 + 隔离模式
        pw_args = ["--headless", "--ignore-https-errors", "--isolated", "--browser", "chromium"]
        # 继承关键环境变量，确保子进程能正常运行
        pw_env = {
            k: v for k, v in os.environ.items()
            if k in ("PATH", "HOME", "USER", "NODE_PATH", "DISPLAY",
                      "PLAYWRIGHT_BROWSERS_PATH", "XDG_RUNTIME_DIR")
            and v
        }
        # Linux root 需要禁用 Chromium sandbox，通过环境变量传递
        if sys.platform == "linux" and os.getuid() == 0:
            pw_env["PLAYWRIGHT_CHROMIUM_SANDBOX"] = "0"
        # 优先用 node 直接运行全局安装的 cli.js（避免 npx 冷启动延迟）
        pw_cli = None
        try:
            result = subprocess.run(
                ["npm", "root", "-g"], capture_output=True, text=True, timeout=5,
            )
            if result.returncode == 0:
                candidate = Path(result.stdout.strip()) / "@playwright" / "mcp" / "cli.js"
                if candidate.exists():
                    pw_cli = str(candidate)
                    # 检测 cli.js 是否支持 --stdio 参数（v0.0.23+ 默认 SSE，需显式指定 stdio）
                    try:
                        help_result = subprocess.run(
                            ["node", pw_cli, "--help"],
                            capture_output=True, text=True, timeout=5,
                        )
                        if "--stdio" in (help_result.stdout + help_result.stderr):
                            pw_args = ["--stdio"] + pw_args
                            _mcp_log("Browser MCP: detected --stdio flag support, adding to args")
                    except Exception:
                        pass
        except Exception:
            pass

        if pw_cli and shutil.which("node"):
            servers["browser"] = {
                "command": "node",
                "args": [pw_cli] + pw_args,
                "env": pw_env,
            }
        else:
            # npx 路径也需要检查是否需要 --stdio
            try:
                help_result = subprocess.run(
                    ["npx", "@playwright/mcp", "--help"],
                    capture_output=True, text=True, timeout=10,
                )
                if "--stdio" in (help_result.stdout + help_result.stderr):
                    pw_args = ["--stdio"] + pw_args
            except Exception:
                pass
            servers["browser"] = {
                "command": "npx",
                "args": ["@playwright/mcp"] + pw_args,
                "env": pw_env,
            }
        _mcp_log(f"Browser MCP config: cmd={servers['browser']['command']} args={servers['browser']['args']}")
    return servers


def _preflight_browser_mcp(servers: dict) -> bool:
    """预检 browser MCP server 是否能正常启动并响应 MCP initialize 握手。
    返回 True 表示可用，False 表示不可用（会打印诊断信息）。
    """
    if "browser" not in servers:
        return False
    import subprocess as sp
    import select
    import threading

    cfg = servers["browser"]
    cmd = [cfg["command"]] + cfg["args"]
    env = {**os.environ, **cfg.get("env", {})}

    # MCP initialize 请求（JSON-RPC over stdio）— 直接发裸 JSON + 换行
    init_req = json.dumps({"jsonrpc": "2.0", "id": 1, "method": "initialize",
                           "params": {"protocolVersion": "2024-11-05",
                                      "capabilities": {},
                                      "clientInfo": {"name": "tchkiller-preflight", "version": "1.0"}}})

    try:
        print(f"  🔍 Browser MCP 预检: {' '.join(cmd)}")
        proc = sp.Popen(cmd, stdin=sp.PIPE, stdout=sp.PIPE, stderr=sp.PIPE, env=env)

        # 写入 initialize 请求，然后关闭 stdin 触发 server 响应
        proc.stdin.write((init_req + "\n").encode())
        proc.stdin.flush()
        proc.stdin.close()

        # 用线程读取 stdout（避免阻塞），等待最多 15 秒
        stdout_chunks = []
        stderr_chunks = []

        def _read_stdout():
            try:
                data = proc.stdout.read()
                if data:
                    stdout_chunks.append(data)
            except Exception:
                pass

        def _read_stderr():
            try:
                data = proc.stderr.read()
                if data:
                    stderr_chunks.append(data)
            except Exception:
                pass

        t_out = threading.Thread(target=_read_stdout, daemon=True)
        t_err = threading.Thread(target=_read_stderr, daemon=True)
        t_out.start()
        t_err.start()

        # 等待响应（最多 15 秒）
        t_out.join(timeout=15)
        t_err.join(timeout=2)

        # 关闭进程
        try:
            proc.kill()
            proc.wait(timeout=3)
        except Exception:
            pass

        stdout_text = b"".join(stdout_chunks).decode(errors="replace").strip()
        stderr_text = b"".join(stderr_chunks).decode(errors="replace").strip()
        _mcp_log(f"Browser preflight stdout: {stdout_text[:500]}")
        _mcp_log(f"Browser preflight stderr: {stderr_text[:500]}")

        if "result" in stdout_text and "capabilities" in stdout_text:
            print("  ✅ Browser MCP 预检通过")
            return True
        else:
            print(f"  ⚠️ Browser MCP 预检失败: 未收到有效 initialize 响应")
            if stdout_text:
                print(f"     stdout: {stdout_text[:300]}")
            if stderr_text:
                print(f"     stderr: {stderr_text[:300]}")
            if not stdout_text and not stderr_text:
                print(f"     (进程无任何输出，可能 Playwright 未正确安装或浏览器启动失败)")
            return False
    except Exception as e:
        print(f"  ⚠️ Browser MCP 预检异常: {e}")
        try:
            proc.kill()
        except Exception:
            pass
        return False


def _build_team_agents(target: str, exclusions: list[str] | None = None, browser: bool = False) -> dict | None:
    """从 prompt/agents/*.md 加载 Agent Teams 子代理定义，支持 {target}、{exclusions}、{browser_guide} 占位符"""
    _agents_dir = Path(__file__).parent / "prompt" / "agents"

    # 构建排除列表文本
    if exclusions:
        vuln_list = ", ".join(VULN_LABELS.get(v, v) for v in exclusions)
        excl_text = f"\n## 排除漏洞类型\n以下漏洞类型**不在本次测试范围内**，请跳过，不要花时间测试：\n⛔ {vuln_list}\n"
    else:
        excl_text = ""

    # 浏览器工具指南（仅 --browser 启用时注入）
    if browser:
        _browser_guides = {
            "recon": "## 工具选择（browser 已启用）\n- 常规 HTTP 请求、Header 分析、端口探测 → curl/nc（更快）\n- JS 渲染的 SPA 页面、需要看完整 DOM → browser 工具\n- 优先 curl，curl 拿到的内容不完整（空白页面、JS 框架壳）再用 browser",
            "analyze": "## 工具选择（browser 已启用）\n- API 参数测试、Header 注入 → curl（精确控制请求）\n- 多步登录流程、CSRF token 自动处理、表单交互 → browser 工具\n- DOM-based XSS 检测、JS 动态 API 发现 → browser 工具\n- 优先 curl，需要维持复杂 session 或分析 JS 渲染内容时用 browser",
            "exploit": "## 工具选择（browser 已启用）\n- Payload 发送、畸形请求构造、二进制协议 → curl（完全控制 HTTP）\n- 需要 JS 执行环境的 XSS 验证 → browser 工具（可观察 alert/DOM 变化）\n- 需要维持登录 session 的多步利用链 → browser 工具\n- 优先 curl，curl 能完成的利用不要用 browser（更快且证据更清晰）",
        }
    else:
        _browser_guides = {}

    # Skills Library section injected into all sub-agent prompts
    _skills_section = """

## Skills Library (Proven Attack Techniques)
You have access to a skills library with 160+ proven security techniques.

### How to Use
- `Skill(skill="skill-name")` — Load and follow a proven methodology
- `list_skills(keyword="topic")` — Search for applicable skills by topic
- `search_vulndb(query="product version")` → `read_vuln(id="...")` — Query known CVEs

### MANDATORY: After Identifying Tech Stack
When you identify the target's technology, IMMEDIATELY:
1. `list_skills(keyword="{technology}")` — find relevant attack skills
2. `search_vulndb(query="{product} {version}")` — find known CVEs
3. Load the most relevant skill before attempting exploitation
"""

    def _load(name: str) -> str:
        f = _agents_dir / f"{name}.md"
        if f.exists():
            text = f.read_text(encoding="utf-8", errors="replace")
            text = text.replace("{target}", target).replace("{exclusions}", excl_text).replace("{browser_guide}", _browser_guides.get(name, ""))
            text += _skills_section
            return text
        return f"你是{name}专家。对 {target} 进行渗透测试。{excl_text}{_skills_section}"

    return {
        "recon": AgentDefinition(
            description="侦察专家 — 负责目标枚举、端口扫描、目录爆破、技术栈识别",
            prompt=_load("recon"),
            model="sonnet",
        ),
        "analyze": AgentDefinition(
            description="功能分析专家 — 深入分析复杂功能点，识别业务逻辑漏洞和隐藏攻击面",
            prompt=_load("analyze"),
            model="sonnet",
        ),
        "exploit": AgentDefinition(
            description="漏洞利用专家 — 负责漏洞发现、验证和利用",
            prompt=_load("exploit"),
            model="sonnet",
        ),
    }


async def run(args):
    run_start_time = datetime.now()
    # 清空旧的调试日志
    try:
        _DEBUG_LOG.write_text(f"=== tchkiller v{VERSION} MCP Debug Log ===\n", encoding="utf-8")
    except Exception:
        pass

    config = load_config(args.config)
    run_dir = setup_output_dir(args.target)

    # 构建作用域
    scope = [args.target]
    if args.scope:
        scope.extend(args.scope)
    if config.get("scope"):
        scope.extend(config["scope"])

    # 继承当前环境 + 从 CC settings.json 读取 env + tchkiller 变量
    env = {**os.environ}

    # 读取 ~/.claude/settings.json 中的 env 配置
    cc_settings_path = Path.home() / ".claude" / "settings.json"
    if cc_settings_path.exists():
        try:
            import json
            with open(cc_settings_path) as f:
                cc_settings = json.load(f)
            if "env" in cc_settings:
                env.update({k: str(v) for k, v in cc_settings["env"].items()})
        except Exception:
            pass

    # Provider failover 支持：如果有 providers.yaml，其配置覆盖 settings.json
    pm = _init_provider_manager(args)
    _apply_provider_env(env, pm)

    env.update({
        "TCHKILLER_TARGET": args.target,
        "TCHKILLER_SCOPE": ",".join(scope),
        "TCHKILLER_OUTPUT_DIR": str(run_dir),
        "TCHKILLER_MODE": args.mode,
        "IS_SANDBOX": "1",
        "CURL_HOME": str(run_dir),  # curl 读取 run_dir/.curlrc → 默认 -sk
    })
    _ensure_system_path(env)

    # 同步设置到当前进程环境（MCP 工具是 in-process 运行的，需要从 os.environ 读取）
    os.environ["TCHKILLER_OUTPUT_DIR"] = str(run_dir)
    os.environ["TCHKILLER_TARGET"] = args.target
    os.environ["TCHKILLER_SCOPE"] = ",".join(scope)

    # 构建系统提示词
    system_prompt = build_system_prompt(
        mode=args.mode,
        target=args.target,
        scope=scope,
    )

    # 构建 MCP 工具服务器配置（STDIO 模式 — 每个 CC 实例/子代理都会启动自己的 mcp_server.py）
    mcp_server_script = str(ROOT / "mcp_server.py")
    mcp_env = {
        "TCHKILLER_OUTPUT_DIR": str(run_dir),
        "TCHKILLER_TARGET": args.target,
        "TCHKILLER_SCOPE": ",".join(scope),
        "TCHKILLER_MODE": args.mode,
    }

    mcp_servers = _build_mcp_servers(mcp_server_script, mcp_env, getattr(args, 'browser', False))

    # Browser MCP 预检
    if getattr(args, 'browser', False) and "browser" in mcp_servers:
        if not _preflight_browser_mcp(mcp_servers):
            print("  ⚠️ 禁用 Browser MCP，回退到纯 curl 模式")
            del mcp_servers["browser"]

    agents = _build_team_agents(args.target, getattr(args, '_exclude_vulns', None), getattr(args, 'browser', False) and "browser" in mcp_servers) if args.team else None

    options = ClaudeAgentOptions(
        system_prompt={
            "type": "preset",
            "preset": "claude_code",
            "append": system_prompt,
        },
        setting_sources=["project"],
        mcp_servers=mcp_servers,
        permission_mode="bypassPermissions",
        model=args.model,
        max_turns=args.max_turns,
        max_thinking_tokens=args.thinking_tokens,
        cwd=str(run_dir),
        env=env,
        hooks=build_safety_hooks(project_root=str(ROOT)),
        **({"agents": agents} if agents else {}),
    )

    target_prompt = build_target_prompt(
        args.target, args.mode, team=args.team,
        extra_prompt=args.prompt,
        exclude_vulns=getattr(args, '_exclude_vulns', None),
        browser=getattr(args, 'browser', False),
        hint=getattr(args, 'hint', None),
    )
    system_prompt = system_prompt.encode("utf-8", errors="replace").decode("utf-8")
    target_prompt = target_prompt.encode("utf-8", errors="replace").decode("utf-8")

    # 保存 prompt 到输出目录供审计
    prompt_audit = run_dir / "prompt_audit.md"
    prompt_audit.write_text(
        f"# Prompt Audit\n\n"
        f"## System Prompt (append)\n\n```\n{system_prompt}\n```\n\n"
        f"## User Prompt\n\n```\n{target_prompt}\n```\n",
        encoding="utf-8",
    )

    print(f"{'='*60}")
    print(f"  🦊 tchkiller v{VERSION} — AI 渗透测试 Agent")
    print(f"{'='*60}")
    print(f"  目标: {args.target}")
    print(f"  模式: {args.mode}")
    print(f"  团队: {'✅ Agent Teams' if args.team else '❌ 单 Agent'}")
    print(f"  模型: {args.model}")
    print(f"  轮次: {args.max_turns}")
    print(f"  输出: {run_dir}")
    # 检查 skills 是否可用
    skills_dir = run_dir / ".claude" / "skills"
    if skills_dir.exists():
        skill_count = sum(1 for _ in skills_dir.iterdir())
        print(f"  技巧: {skill_count} skills ✅")
    else:
        print(f"  技巧: ❌ 未找到 .claude/skills/")
    if args._exclude_vulns:
        print(f"  排除: ⛔ {', '.join(args._exclude_vulns)}")
    print(f"  审计: {prompt_audit}")
    print(f"{'='*60}")
    if args.verbose:
        print(f"\n{'─'*60}")
        print(f"📋 User Prompt:\n{target_prompt}")
        print(f"{'─'*60}\n")

    _mcp_log(f"Starting query: target={args.target} mode={args.mode}")

    reset_bypass_counter()
    result_msg = None
    done = False
    tool_calls_count = 0
    tool_errors_count = 0
    async for msg in query(prompt=target_prompt, options=options):
        if done:
            continue  # 主任务已完成，静默消费剩余消息让 generator 自然结束
        if isinstance(msg, AssistantMessage):
            # Collect assistant text for timeline
            _asst_texts = []
            for _b in msg.content:
                if isinstance(_b, TextBlock) and _b.text:
                    _asst_texts.append(_b.text)
            _asst_preview = " ".join(_asst_texts)[:500] if _asst_texts else ""

            if msg.usage:
                _tl_entry = {
                    "round": 0, "type": "assistant_msg",
                    "token_in": msg.usage.get("input_tokens", 0),
                    "token_out": msg.usage.get("output_tokens", 0),
                }
                if _asst_preview:
                    _tl_entry["text_preview"] = _asst_preview
                _timeline_append(run_dir, _tl_entry)
            for block in msg.content:
                if isinstance(block, TextBlock):
                    if args.verbose:
                        print(f"[assistant] {block.text[:250]}")
                elif isinstance(block, ToolUseBlock):
                    tool_calls_count += 1
                    input_preview = ', '.join(f'{k}={v!r}' for k, v in (block.input or {}).items())[:120]
                    print(f"  🔧 {block.name}({input_preview})")
                    _mcp_log(f"ToolUse: {block.name}({input_preview})")
                    _timeline_append(run_dir, {
                        "round": 0, "type": "tool_call",
                        "name": block.name, "input_preview": input_preview,
                        "tool_use_id": block.id,
                    })
                elif isinstance(block, ToolResultBlock):
                    text, is_error = _extract_tool_result_text(block)
                    if is_error:
                        tool_errors_count += 1
                        print(f"  ❌ 工具错误: {text}")
                        _mcp_log(f"ToolResult ERROR: {text}")
                    else:
                        print(f"  ✅ {text[:120]}")
                        _mcp_log(f"ToolResult OK: {text[:250]}")
                    _timeline_append(run_dir, {
                        "round": 0, "type": "tool_result",
                        "tool_use_id": getattr(block, "tool_use_id", ""),
                        "is_error": is_error, "output_preview": text[:1000],
                    })
        elif isinstance(msg, UserMessage):
            # 处理 UserMessage 中的 ToolResultBlock（MCP 工具结果的主要来源）
            content_blocks = msg.content if isinstance(msg.content, list) else []
            for block in content_blocks:
                if isinstance(block, ToolResultBlock):
                    text, is_error = _extract_tool_result_text(block)
                    tool_use_id = getattr(block, "tool_use_id", "")
                    if is_error:
                        tool_errors_count += 1
                        print(f"  ❌ 工具错误: {text}")
                        _mcp_log(f"UserMsg ToolResult ERROR (id={tool_use_id}): {text}")
                    else:
                        print(f"  ✅ {text[:120]}")
                        _mcp_log(f"UserMsg ToolResult OK (id={tool_use_id}): {text[:250]}")
                    _timeline_append(run_dir, {
                        "round": 0, "type": "tool_result",
                        "tool_use_id": tool_use_id,
                        "is_error": is_error, "output_preview": text[:1000],
                        "source": "user_message",
                    })
        elif isinstance(msg, ResultMessage):
            result_msg = msg
            duration_s = msg.duration_ms / 1000 if msg.duration_ms else 0
            duration_api_s = msg.duration_api_ms / 1000 if msg.duration_api_ms else 0
            tool_exec_s = max(0, duration_s - duration_api_s)
            time_str = _format_duration(duration_s)
            print(f"\n{'='*60}")
            if msg.is_error:
                print(f"  ⚠️ 任务异常结束: {msg.result or 'unknown error'}")
            else:
                print(f"  ✅ 任务完成")
            print(f"  ⏱ 耗时: {time_str} ({msg.num_turns} 轮)")
            if duration_api_s > 0:
                if duration_api_s > duration_s:
                    print(f"  ⚡ AI: {_format_duration(duration_api_s)} (并发累计，含 sub-agent)")
                else:
                    api_pct = duration_api_s / duration_s * 100
                    print(f"  ⚡ AI: {_format_duration(duration_api_s)} / 工具: {_format_duration(tool_exec_s)} ({api_pct:.0f}% AI)")
            if msg.total_cost_usd is not None:
                print(f"  💰 费用: ${msg.total_cost_usd:.2f}")
            if msg.usage:
                in_tok = msg.usage.get("input_tokens", 0)
                out_tok = msg.usage.get("output_tokens", 0)
                if in_tok or out_tok:
                    print(f"  📊 Token: {in_tok:,} in / {out_tok:,} out")
            print(f"  🔧 工具调用: {tool_calls_count} 次 (错误 {tool_errors_count})")
            print(f"  📂 输出目录: {run_dir}")
            evidence_files = list((run_dir / "evidence").glob("*.md"))
            print(f"  🔍 证据文件: {len(evidence_files)} 个")
            vulns_json = run_dir / "vulns.json"
            if vulns_json.exists():
                vulns = json.loads(vulns_json.read_text())
                print(f"  🎯 漏洞报告: {len(vulns)} 个")
            print(f"  📝 调试日志: {_DEBUG_LOG}")
            if msg.stop_reason:
                print(f"  🏁 停止原因: {msg.stop_reason}")
            print(f"{'='*60}")
            done = True
        elif isinstance(msg, RateLimitEvent):
            _timeline_append(run_dir, {
                "round": 0, "type": "rate_limit",
                "resets_at": getattr(msg, "resets_at", None),
                "utilization": getattr(msg, "utilization", None),
            })
            if args.verbose:
                print(f"  ⏳ Rate limit event")
        elif isinstance(msg, StreamEvent):
            if args.verbose and hasattr(msg, "type"):
                print(f"  [stream] {msg.type}")

    # 写入 report.json
    report = _build_report(args, run_dir, result_msg, tool_calls_count, tool_errors_count)
    report["start_time"] = run_start_time.isoformat()
    report["end_time"] = datetime.now().isoformat()
    try:
        (run_dir / "report.json").write_text(json.dumps(report, ensure_ascii=False, indent=2), encoding="utf-8")
        print(f"  📋 报告: {run_dir / 'report.json'}")
    except Exception:
        pass

    return result_msg  # 返回 ResultMessage 供 orchestrator 使用


def _build_pentest_options(args, system_prompt, run_dir, env, mcp_env, agents, max_turns=None, browser=None):
    """构建渗透 agent 的 ClaudeAgentOptions"""
    mcp_server_script = str(ROOT / "mcp_server.py")
    use_browser = browser if browser is not None else getattr(args, 'browser', False)
    mcp_servers = _build_mcp_servers(mcp_server_script, mcp_env, use_browser)
    return ClaudeAgentOptions(
        system_prompt={
            "type": "preset",
            "preset": "claude_code",
            "append": system_prompt,
        },
        setting_sources=["project"],
        mcp_servers=mcp_servers,
        permission_mode="bypassPermissions",
        model=args.model,
        max_turns=max_turns or args.max_turns,
        max_thinking_tokens=args.thinking_tokens,
        cwd=str(run_dir),
        env=env,
        hooks=build_safety_hooks(project_root=str(ROOT)),
        **({"agents": agents} if agents else {}),
    )


def collect_round_results(run_dir: Path, agent_log: str) -> dict:
    """收集渗透 agent 一轮的执行结果"""
    results = {"vulns": [], "evidence_files": [], "flag_found": False, "flag_value": None}

    # 读取 vulns.json
    vulns_json = run_dir / "vulns.json"
    if vulns_json.exists():
        try:
            results["vulns"] = json.loads(vulns_json.read_text(encoding="utf-8"))
        except Exception:
            pass

    # 读取 evidence 文件列表
    evidence_dir = run_dir / "evidence"
    if evidence_dir.exists():
        results["evidence_files"] = sorted([
            f.name for f in evidence_dir.glob("*.md") if f.name != "index.md"
        ])

    # 搜索 flag (大小写不敏感)
    flag_matches = FLAG_PATTERN.findall(agent_log)
    if flag_matches:
        results["flag_found"] = True
        results["flag_value"] = flag_matches[-1]
    elif evidence_dir.exists():
        for f in evidence_dir.glob("*.md"):
            try:
                content = f.read_text(encoding="utf-8", errors="replace")
                m = FLAG_PATTERN.findall(content)
                if m:
                    results["flag_found"] = True
                    results["flag_value"] = m[-1]
                    break
            except Exception:
                pass

    # Fallback: check PostToolUse hook flag detection file
    if not results["flag_found"]:
        detection_file = Path(os.environ.get("FLAG_DETECTION_FILE",
                                              "/tmp/tchkiller_flag_detected.txt"))
        if detection_file.exists():
            try:
                lines = detection_file.read_text(encoding="utf-8").strip().splitlines()
                if lines:
                    # Format: "timestamp | tool_name | flag{...}"
                    last_flag = lines[-1].split("|")[-1].strip()
                    if FLAG_PATTERN.match(last_flag):
                        results["flag_found"] = True
                        results["flag_value"] = last_flag
                        results["flag_source"] = "hook_detection"
                        print(f"  🚨 Flag detected by hook but NOT submitted by agent: {last_flag}")
            except Exception:
                pass

    return results


async def run_pentest_round(args, system_prompt, target_prompt, run_dir, env, mcp_env, agents, round_timeout_s, max_turns=None, current_round=1, browser=None):
    """执行一轮渗透 agent，带超时控制。返回 (ResultMessage, agent_log, timed_out, round_metrics)"""
    options = _build_pentest_options(args, system_prompt, run_dir, env, mcp_env, agents, max_turns, browser=browser)

    reset_bypass_counter()
    result_msg = None
    agent_log_lines = []
    done = False
    tool_calls_count = 0
    tool_errors_count = 0
    last_stream_event_time = time()  # 追踪 parent stream 最后活跃时间
    api_stalled = False  # 心跳检测到 API 完全无响应时设置

    STALL_TIMEOUT = 300  # 5 分钟无任何活动判定为 API 死亡

    async def _run_query():
        nonlocal result_msg, done, tool_calls_count, tool_errors_count, last_stream_event_time
        async for msg in query(prompt=target_prompt, options=options):
            if done:
                continue
            last_stream_event_time = time()
            if isinstance(msg, AssistantMessage):
                # Collect assistant text for timeline
                _asst_texts2 = []
                for _b2 in msg.content:
                    if isinstance(_b2, TextBlock) and _b2.text:
                        _asst_texts2.append(_b2.text)
                _asst_preview2 = " ".join(_asst_texts2)[:500] if _asst_texts2 else ""

                if msg.usage:
                    _tl_entry2 = {
                        "round": current_round, "type": "assistant_msg",
                        "token_in": msg.usage.get("input_tokens", 0),
                        "token_out": msg.usage.get("output_tokens", 0),
                    }
                    if _asst_preview2:
                        _tl_entry2["text_preview"] = _asst_preview2
                    _timeline_append(run_dir, _tl_entry2)
                for block in msg.content:
                    if isinstance(block, TextBlock):
                        agent_log_lines.append(block.text)
                        if args.verbose:
                            print(f"[assistant] {block.text[:250]}")
                    elif isinstance(block, ToolUseBlock):
                        tool_calls_count += 1
                        input_preview = ', '.join(f'{k}={v!r}' for k, v in (block.input or {}).items())[:120]
                        print(f"  🔧 {block.name}({input_preview})")
                        _mcp_log(f"ToolUse: {block.name}({input_preview})")
                        _timeline_append(run_dir, {
                            "round": current_round, "type": "tool_call",
                            "name": block.name, "input_preview": input_preview,
                            "tool_use_id": block.id,
                            "agent_context": "sub_agent" if block.id and "_bdrk_" in block.id else "parent",
                        })
                    elif isinstance(block, ToolResultBlock):
                        text, is_error = _extract_tool_result_text(block)
                        if is_error:
                            tool_errors_count += 1
                            print(f"  ❌ 工具错误: {text}")
                        else:
                            print(f"  ✅ {text[:120]}")
                        agent_log_lines.append(text)
                        _timeline_append(run_dir, {
                            "round": current_round, "type": "tool_result",
                            "tool_use_id": getattr(block, "tool_use_id", ""),
                            "is_error": is_error, "output_preview": text[:1000],
                        })
            elif isinstance(msg, UserMessage):
                content_blocks = msg.content if isinstance(msg.content, list) else []
                for block in content_blocks:
                    if isinstance(block, ToolResultBlock):
                        text, is_error = _extract_tool_result_text(block)
                        tool_use_id = getattr(block, "tool_use_id", "")
                        if is_error:
                            tool_errors_count += 1
                            print(f"  ❌ 工具错误: {text}")
                            _mcp_log(f"UserMsg ToolResult ERROR (id={tool_use_id}): {text}")
                        else:
                            print(f"  ✅ {text[:120]}")
                            _mcp_log(f"UserMsg ToolResult OK (id={tool_use_id}): {text[:250]}")
                        agent_log_lines.append(text)
                        _timeline_append(run_dir, {
                            "round": current_round, "type": "tool_result",
                            "tool_use_id": tool_use_id,
                            "is_error": is_error, "output_preview": text[:1000],
                            "source": "user_message",
                        })
            elif isinstance(msg, ResultMessage):
                result_msg = msg
                if msg.is_error:
                    stop_reason = getattr(msg, "stop_reason", "") or ""
                    if stop_reason == "tool_use":
                        print(f"\n  ⚠️ Agent 在工具调用中被中断 (可能达到 turn 上限)")
                    else:
                        print(f"\n  ⚠️ Agent 返回错误: {msg.result or stop_reason or 'unknown'}")
                done = True
            elif isinstance(msg, RateLimitEvent):
                _timeline_append(run_dir, {
                    "round": current_round, "type": "rate_limit",
                    "resets_at": getattr(msg, "resets_at", None),
                    "utilization": getattr(msg, "utilization", None),
                })
                if args.verbose:
                    print(f"  ⏳ Rate limit event")
            elif isinstance(msg, StreamEvent):
                if args.verbose and hasattr(msg, "type"):
                    print(f"  [stream] {msg.type}")

    # 心跳在独立线程中运行（避免 SDK query() 可能同步阻塞事件循环导致 asyncio.sleep 无法调度）
    import threading
    heartbeat_stop = threading.Event()

    def _heartbeat_thread():
        """独立线程心跳 — 不受 asyncio 事件循环阻塞影响"""
        nonlocal api_stalled
        silence_threshold = 15
        interval = 30
        last_reported_line = ""
        print(f"  [heartbeat] 心跳监控启动 (间隔 {interval}s)", flush=True)
        while not heartbeat_stop.is_set():
            heartbeat_stop.wait(interval)
            if heartbeat_stop.is_set():
                break
            silent_s = time() - last_stream_event_time
            if silent_s < silence_threshold:
                continue

            mcp_active = False
            mcp_summary = ""
            try:
                mcp_mtime = _DEBUG_LOG.stat().st_mtime
                mcp_age = time() - mcp_mtime
                if mcp_age < interval + 5:
                    mcp_active = True
                    with open(_DEBUG_LOG, "rb") as f:
                        f.seek(0, 2)
                        fsize = f.tell()
                        pos = max(0, fsize - 512)
                        f.seek(pos)
                        tail = f.read().decode("utf-8", errors="replace")
                    last_line = tail.strip().rsplit("\n", 1)[-1] if tail.strip() else ""
                    if last_line and last_line != last_reported_line:
                        last_reported_line = last_line
                        import re as _re
                        m = _re.search(r'\[([a-z_]+)\]\s+(.{0,60})', last_line)
                        if m:
                            mcp_summary = f"{m.group(1)}: {m.group(2).strip()}"
            except FileNotFoundError:
                pass
            except Exception:
                pass

            silent_min = silent_s / 60
            if mcp_active:
                print(f"  Sub-agents 活跃中 ({silent_min:.0f}min 无 parent 输出){' — ' + mcp_summary if mcp_summary else ''}", flush=True)
            else:
                subproc_active = False
                try:
                    import subprocess
                    result = subprocess.run(
                        ["pgrep", "-f", "claude.*--permission-mode"],
                        capture_output=True, timeout=3,
                    )
                    subproc_active = result.returncode == 0
                except Exception:
                    pass

                if subproc_active:
                    print(f"  Sub-agents 工具执行中 ({silent_min:.0f}min 无 parent 输出，claude 进程活跃)", flush=True)
                else:
                    print(f"  Agent 思考中... ({silent_min:.0f}min 无输出)", flush=True)

            # API 死亡检测
            if not mcp_active and silent_s >= STALL_TIMEOUT:
                subproc_alive = False
                try:
                    import subprocess
                    result = subprocess.run(
                        ["pgrep", "-f", "claude.*--permission-mode"],
                        capture_output=True, timeout=3,
                    )
                    subproc_alive = result.returncode == 0
                except Exception:
                    pass
                if subproc_alive:
                    print(f"  ⏳ MCP 静默但 claude 进程活跃 ({silent_min:.0f}min)，继续等待...", flush=True)
                    continue
                print(f"\n  🚨 API 疑似无响应 ({silent_s/60:.0f}min 完全无活动)，强制结束本轮", flush=True)
                api_stalled = True
                return

    wall_start = time()
    timed_out = False
    heartbeat_t = threading.Thread(target=_heartbeat_thread, daemon=True)
    heartbeat_t.start()
    try:
        query_task = asyncio.ensure_future(asyncio.wait_for(_run_query(), timeout=round_timeout_s))

        # 等待 query 完成或心跳检测到 API 死亡
        while not query_task.done():
            await asyncio.sleep(1)
            if api_stalled and not query_task.done():
                query_task.cancel()
                try:
                    await query_task
                except (asyncio.CancelledError, asyncio.TimeoutError):
                    pass
                timed_out = True
                break
        else:
            # query_task 正常完成，检查异常
            try:
                query_task.result()
            except asyncio.TimeoutError:
                timed_out = True
                print(f"\n  ⏰ 单轮超时 ({round_timeout_s // 60}min)，强制结束本轮")
            except asyncio.CancelledError:
                pass
            except Exception as e:
                # SDK 泛型异常（含 429 rate_limit、额度耗尽、turn limit、buffer overflow 等）
                err_text = str(e)
                is_turn_limit = "exit code 1" in err_text and "message reader" in err_text.lower()
                is_buffer_overflow = "maximum buffer size" in err_text or "exceeded maximum buffer" in err_text
                is_recoverable = is_turn_limit or is_buffer_overflow
                if is_turn_limit:
                    print(f"\n  ⚠️ Agent 达到 turn 上限 ({max_turns or args.max_turns} turns)，本轮正常结束")
                elif is_buffer_overflow:
                    print(f"\n  ⚠️ Agent 工具返回数据过大 (>1MB)，SDK buffer 溢出，本轮结束")
                else:
                    print(f"\n  ⚠️ Agent 异常退出: {err_text[:120]}")
                if not result_msg:
                    result_msg = type("_ErrResult", (), {
                        "is_error": not is_recoverable,
                        "result": err_text if not is_recoverable else f"{'turn_limit' if is_turn_limit else 'buffer_overflow'} ({tool_calls_count} turns)",
                        "stop_reason": "turn_limit" if is_turn_limit else ("buffer_overflow" if is_buffer_overflow else "exception"),
                        "num_turns": tool_calls_count,
                        "duration_ms": (time() - wall_start) * 1000,
                        "duration_api_ms": 0,
                        "usage": {},
                        "total_cost_usd": 0,
                        "session_id": "",
                    })()
    finally:
        done = True
        heartbeat_stop.set()
        heartbeat_t.join(timeout=5)
    wall_duration_s = time() - wall_start

    agent_log = "\n".join(agent_log_lines)
    round_metrics = {
        "tool_calls": tool_calls_count,
        "tool_errors": tool_errors_count,
        "wall_duration_s": wall_duration_s,
        "api_stalled": api_stalled,
    }
    return result_msg, agent_log, timed_out, round_metrics


async def preflight_check(env: dict, model: str = "sonnet", timeout: int = 45) -> tuple[bool, str]:
    """轻量级 API 可用性检查。直接 HTTP 请求 Anthropic Messages API，不依赖 claude CLI 或 settings.json。"""
    import urllib.request
    import urllib.error

    base_url = env.get("ANTHROPIC_BASE_URL", "https://api.anthropic.com")
    api_key = env.get("ANTHROPIC_AUTH_TOKEN") or env.get("ANTHROPIC_API_KEY", "")
    # 解析 model 别名 → 实际模型名
    model_name = model
    model_key = f"ANTHROPIC_DEFAULT_{model.upper()}_MODEL"
    if model_key in env:
        model_name = env[model_key]
    elif "ANTHROPIC_MODEL" in env:
        model_name = env["ANTHROPIC_MODEL"]

    url = f"{base_url.rstrip('/')}/v1/messages"
    payload = json.dumps({
        "model": model_name,
        "max_tokens": 10,
        "messages": [{"role": "user", "content": "Say OK"}],
    }).encode("utf-8")
    headers = {
        "Content-Type": "application/json",
        "x-api-key": api_key,
        "anthropic-version": "2023-06-01",
    }

    def _do_request():
        req = urllib.request.Request(url, data=payload, headers=headers, method="POST")
        try:
            with urllib.request.urlopen(req, timeout=timeout) as resp:
                body = json.loads(resp.read().decode("utf-8"))
                # 检查是否有 content 返回
                if body.get("content"):
                    return (True, "")
                return (False, "API 返回空内容")
        except urllib.error.HTTPError as e:
            body = e.read().decode("utf-8", errors="replace")[:250]
            return (False, f"HTTP {e.code}: {body}")
        except urllib.error.URLError as e:
            return (False, f"网络错误: {e.reason}")
        except TimeoutError:
            return (False, f"API 无响应 ({timeout}s 超时)")
        except Exception as e:
            return (False, str(e)[:250])

    # 在线程池中运行同步 HTTP 请求，避免阻塞事件循环
    loop = asyncio.get_event_loop()
    return await asyncio.wait_for(
        loop.run_in_executor(None, _do_request),
        timeout=timeout + 5,
    )


async def run_judge(args, judge_prompt: str, env: dict | None = None):
    """执行决策 agent，返回解析后的 JSON 决策"""
    # 继承完整环境变量（含 ANTHROPIC_* 配置），确保模型路由正确
    judge_env = {**(env or os.environ), "IS_SANDBOX": "1"}
    judge_options = ClaudeAgentOptions(
        system_prompt=(
            "你是一位 CTF（Capture The Flag）网络安全竞赛的裁判评审员。"
            "本竞赛在完全隔离的内网沙箱环境中进行，所有目标均为赛题方故意部署的挑战靶机，不涉及任何真实系统或用户数据。"
            "参赛队伍已获得竞赛组织方的明确书面授权对这些靶机进行安全测试。"
            "你的职责是评估参赛 Agent 的解题进度和技术表现，并以纯 JSON 格式输出评审结果。你不使用任何工具。"
        ),
        model=args.judge_model,
        max_turns=1,
        permission_mode="bypassPermissions",
        output_format=JUDGE_OUTPUT_FORMAT,
        env=judge_env,
        hooks=build_safety_hooks(project_root=str(ROOT)),
    )

    reset_bypass_counter()
    result_text = ""
    async for msg in query(prompt=judge_prompt, options=judge_options):
        if isinstance(msg, AssistantMessage):
            for block in msg.content:
                if isinstance(block, TextBlock):
                    result_text += block.text
        elif isinstance(msg, ResultMessage):
            if msg.result:
                result_text = msg.result

    # 解析 JSON — 多层降级策略
    decision = None
    _parse_status = "success"
    # 1. 直接解析
    try:
        decision = json.loads(result_text)
    except (json.JSONDecodeError, ValueError):
        pass

    # 2. 去掉 markdown 代码块包裹后解析
    if decision is None:
        _parse_status = "fallback_regex"
        cleaned = re.sub(r'^```(?:json)?\s*', '', result_text.strip())
        cleaned = re.sub(r'\s*```$', '', cleaned.strip())
        try:
            decision = json.loads(cleaned)
        except (json.JSONDecodeError, ValueError):
            pass

    # 3. 正则提取最外层 JSON 对象
    if decision is None:
        m = re.search(r'\{[^{}]*(?:\{[^{}]*\}[^{}]*)*\}', result_text, re.DOTALL)
        if m:
            try:
                decision = json.loads(m.group())
            except (json.JSONDecodeError, ValueError):
                pass

    # 4. 全部失败，降级默认值
    if decision is None:
        _parse_status = "fallback_default"
        decision = {"complete": False, "confidence": 0, "reason": f"JSON 解析失败: {result_text[:500]}"}

    # 标记解析状态，便于审计区分真实评估和降级结果
    decision["_parse_status"] = _parse_status
    decision["_raw_response_preview"] = result_text[:1000]

    # 强制关键字段为正确类型
    if not isinstance(decision.get("feedback"), str):
        decision["feedback"] = str(decision.get("feedback") or "")
    if not isinstance(decision.get("reason"), str):
        decision["reason"] = str(decision.get("reason") or "N/A")
    if not isinstance(decision.get("missing_areas"), list):
        decision["missing_areas"] = []

    return decision


async def run_orchestrator(args):
    """决策 agent 架构：多轮渗透 + 评估循环"""
    total_start = time()

    # 确定总超时：未指定时按 max_rounds * (round_timeout + judge开销) 自动推算
    total_timeout_min = args.total_timeout
    if total_timeout_min is None:
        judge_overhead_min = 5  # 每轮 judge + 调度开销预留
        total_timeout_min = args.max_rounds * (args.round_timeout + judge_overhead_min)
    total_timeout_s = total_timeout_min * 60
    round_timeout_s = args.round_timeout * 60

    # --- 和 run() 相同的初始化部分 ---
    try:
        _DEBUG_LOG.write_text(f"=== tchkiller v{VERSION} Orchestrator Debug Log ===\n", encoding="utf-8")
    except Exception:
        pass

    config = load_config(args.config)
    run_dir = setup_output_dir(args.target)

    scope = [args.target]
    if args.scope:
        scope.extend(args.scope)
    if config.get("scope"):
        scope.extend(config["scope"])

    env = {**os.environ}
    cc_settings_path = Path.home() / ".claude" / "settings.json"
    if cc_settings_path.exists():
        try:
            with open(cc_settings_path) as f:
                cc_settings = json.load(f)
            if "env" in cc_settings:
                env.update({k: str(v) for k, v in cc_settings["env"].items()})
        except Exception:
            pass

    # Provider failover 支持
    pm = _init_provider_manager(args)
    _apply_provider_env(env, pm)
    # Provider 配置的 judge 模型覆盖默认值
    if pm.available and pm.get_judge_model():
        args.judge_model = pm.get_judge_model()

    env.update({
        "TCHKILLER_TARGET": args.target,
        "TCHKILLER_SCOPE": ",".join(scope),
        "TCHKILLER_OUTPUT_DIR": str(run_dir),
        "TCHKILLER_MODE": args.mode,
        "IS_SANDBOX": "1",
        "CURL_HOME": str(run_dir),
    })
    _ensure_system_path(env)
    os.environ["TCHKILLER_OUTPUT_DIR"] = str(run_dir)
    os.environ["TCHKILLER_TARGET"] = args.target
    os.environ["TCHKILLER_SCOPE"] = ",".join(scope)

    system_prompt = build_system_prompt(mode=args.mode, target=args.target, scope=scope)

    mcp_env = {
        "TCHKILLER_OUTPUT_DIR": str(run_dir),
        "TCHKILLER_TARGET": args.target,
        "TCHKILLER_SCOPE": ",".join(scope),
        "TCHKILLER_MODE": args.mode,
    }

    agents = _build_team_agents(args.target, getattr(args, '_exclude_vulns', None), getattr(args, 'browser', False)) if args.team else None

    # Browser MCP 预检（orchestrator 模式，只检查一次）
    _browser_available = getattr(args, 'browser', False)
    if _browser_available:
        mcp_server_script = str(ROOT / "mcp_server.py")
        _test_servers = _build_mcp_servers(mcp_server_script, mcp_env, browser=True)
        if not _preflight_browser_mcp(_test_servers):
            print("  ⚠️ 禁用 Browser MCP，回退到纯 curl 模式")
            _browser_available = False
        # 用实际可用状态重建 agents
        if not _browser_available and args.team:
            agents = _build_team_agents(args.target, getattr(args, '_exclude_vulns', None), browser=False)

    system_prompt = system_prompt.encode("utf-8", errors="replace").decode("utf-8")

    # orchestrator 模式下单轮 max_turns 默认 150（用户可通过 --max-turns 覆盖）
    round_max_turns = args.max_turns

    # --- Banner ---
    print(f"{'='*60}")
    print(f"  🦊 tchkiller v{VERSION} — AI 渗透测试 Agent [Orchestrator]")
    print(f"{'='*60}")
    print(f"  目标: {args.target}")
    print(f"  模式: {args.mode}")
    print(f"  团队: {'✅ Agent Teams' if args.team else '❌ 单 Agent'}")
    print(f"  模型: {args.model}  |  决策模型: {args.judge_model}")
    print(f"  轮次: 最多 {args.max_rounds} 轮  |  单轮 {round_max_turns} turns / {args.round_timeout}min")
    print(f"  总超时: {total_timeout_min}min")
    if pm.available:
        print(f"  API: {pm.current.name} ({pm.count} providers, failover {'启用' if pm.count > 1 else '无冗余'})")
    print(f"  输出: {run_dir}")
    skills_dir = run_dir / ".claude" / "skills"
    if skills_dir.exists():
        skill_count = sum(1 for _ in skills_dir.iterdir())
        print(f"  技巧: {skill_count} skills ✅")
    if args._exclude_vulns:
        print(f"  排除: ⛔ {', '.join(args._exclude_vulns)}")
    print(f"{'='*60}")

    # --- Preflight: 启动前验证 API 可用性 ---
    if pm.available:
        pm.reset_failover_count()
        while True:
            print(f"\n  🔌 Preflight 检查 API ({pm.current.name})...")
            ok, err = await preflight_check(env, model=args.model)
            if ok:
                print(f"  ✅ API 可用")
                break
            print(f"  ❌ API 不可用: {err}")
            # 临时性错误：同一 provider 重试 2 次
            if pm.should_retry(err):
                retried = False
                for retry_i in range(2):
                    delay = pm.retry_delay(retry_i, err)
                    print(f"  🔁 临时性错误，{delay:.0f}s 后重试 ({retry_i+1}/2)...")
                    await asyncio.sleep(delay)
                    ok2, err2 = await preflight_check(env, model=args.model)
                    if ok2:
                        print(f"  ✅ API 重试成功")
                        retried = True
                        break
                    print(f"  ❌ 重试失败: {err2}")
                if retried:
                    break
                print(f"  ❌ {pm.current.name} 重试耗尽")
            # 重试失败或确定性错误 → failover
            if pm.failover(err):
                _apply_provider_env(env, pm)
                if pm.get_judge_model():
                    args.judge_model = pm.get_judge_model()
                continue
            print(f"  ❌ 所有 provider 不可用，终止")
            return

    # --- Orchestrator 主循环 ---
    all_round_results = []
    final_decision = None
    prev_judge_decision = None  # 跨轮 judge 记忆
    judge_feedback = None
    missing = []
    all_missing_areas = []  # 跨轮累积的遗漏方向
    recommended_skills = []
    attack_commands = []

    def _write_final_report():
        """Write report.json — called in both normal and crash paths."""
        nonlocal all_round_results, final_decision
        total_elapsed = time() - total_start
        total_rounds = len(all_round_results)
        total_vulns = len(all_round_results[-1]["vulns"]) if all_round_results else 0
        total_cost = sum(r.get("_report_entry", {}).get("cost_usd", 0) for r in all_round_results)
        total_tool_calls = sum(r.get("_report_entry", {}).get("tool_calls", 0) for r in all_round_results)
        total_tool_errors = sum(r.get("_report_entry", {}).get("tool_errors", 0) for r in all_round_results)
        total_duration_api_s = sum(r.get("_report_entry", {}).get("duration_api_s", 0) for r in all_round_results)
        total_turns = sum(r.get("_report_entry", {}).get("num_turns", 0) for r in all_round_results if isinstance(r.get("_report_entry", {}).get("num_turns"), int))
        any_flag = any(r.get("flag_found") for r in all_round_results)

        rounds_data = [r.get("_report_entry", {}) for r in all_round_results]
        for i, rd in enumerate(rounds_data):
            if i < len(all_round_results):
                judge_file = run_dir / f"judge_round{rd.get('round', i+1)}.json"
                if judge_file.exists():
                    try:
                        jd = json.loads(judge_file.read_text(encoding="utf-8"))
                        rd["judge_decision"] = {"complete": jd.get("complete"), "confidence": jd.get("confidence")}
                    except Exception:
                        pass

        report = {
            "version": VERSION,
            "target": args.target,
            "mode": args.mode,
            "team": getattr(args, "team", False),
            "model": args.model,
            "orchestrator": True,
            "start_time": datetime.fromtimestamp(total_start).isoformat(),
            "end_time": datetime.now().isoformat(),
            "duration_s": total_elapsed,
            "duration_api_s": total_duration_api_s,
            "total_cost_usd": total_cost,
            "usage": {"input_tokens": 0, "output_tokens": 0},
            "num_turns": total_turns,
            "stop_reason": final_decision.get("reason", "max_rounds") if final_decision else "crash",
            "is_error": not all_round_results,
            "vulns_count": total_vulns,
            "evidence_count": len([f for f in (run_dir / "evidence").glob("*.md") if f.name != "index.md"]) if (run_dir / "evidence").exists() else 0,
            "flag_found": any_flag,
            "flag_value": next((r["flag_value"] for r in all_round_results if r.get("flag_found")), None),
            "tool_calls_count": total_tool_calls,
            "tool_errors_count": total_tool_errors,
            "rounds": rounds_data,
        }
        try:
            (run_dir / "report.json").write_text(json.dumps(report, ensure_ascii=False, indent=2), encoding="utf-8")
            print(f"  📋 报告: {run_dir / 'report.json'}")
        except Exception:
            pass

    for current_round in range(1, args.max_rounds + 1):
        elapsed = time() - total_start
        remaining = total_timeout_s - elapsed
        if remaining <= 60:
            print(f"\n⏰ 总超时已到 ({total_timeout_min}min)，终止")
            break

        # 限制本轮超时不超过剩余时间
        effective_round_timeout = min(round_timeout_s, remaining - 30)

        print(f"\n{'─'*60}")
        print(f"  🔄 第 {current_round}/{args.max_rounds} 轮渗透")
        print(f"  ⏱ 已用 {elapsed/60:.1f}min / {total_timeout_min}min")
        if judge_feedback:
            print(f"  📋 决策反馈: {str(judge_feedback)[:100]}")
        print(f"{'─'*60}")

        # 构建本轮 target prompt
        target_prompt = build_target_prompt(
            args.target, args.mode, team=args.team,
            extra_prompt=args.prompt,
            exclude_vulns=getattr(args, '_exclude_vulns', None),
            browser=getattr(args, 'browser', False),
            round_num=current_round,
            hint=getattr(args, 'hint', None),
        )

        # 第 2+ 轮注入上轮摘要 + 决策反馈（增强版 v1.1.0）
        if current_round > 1 and all_round_results:
            # ── 条件式 recon 策略：根据 R1 侦察充分程度决定是否禁止 ──
            prev_result = all_round_results[-1]
            prev_ev_files = prev_result.get("evidence_files", [])
            recon_indicators = ["端点", "版本", "endpoint", "port", "service", "url", "api", "http", "login", "admin", "凭据", "配置", "网络"]
            recon_ev_count = sum(1 for ef in prev_ev_files if any(kw in ef.lower() for kw in recon_indicators))
            recon_sufficient = len(prev_ev_files) >= 3 and recon_ev_count >= 1
            if recon_sufficient:
                recon_policy = ("前轮已完成充分侦察和功能分析，**本轮禁止再做侦察/端口扫描/目录枚举**。\n"
                                "直接根据下方注入的证据和命令，派发 exploit agent 执行攻击。")
            else:
                recon_policy = ("前轮侦察信息不足（证据较少或缺少关键攻击面信息），**本轮允许补充侦察**。\n"
                                "可以派发 recon sub-agent 对遗漏的攻击面进行补充探测，然后再执行漏洞利用。")
            target_prompt = target_prompt.replace("{recon_policy}", recon_policy)

            # 收集所有轮次的漏洞（累积）
            all_vulns = []
            for rr in all_round_results:
                all_vulns.extend(rr.get("vulns", []))

            injection = "\n\n## ⚠️ 这是第 {round} 轮渗透，前 {prev} 轮的信息如下\n".format(
                round=current_round, prev=current_round - 1
            )

            # ── Fix 5: R2+ 强制 evidence_read（放在最前面） ──
            if current_round >= 2:
                prev_result = all_round_results[-1]
                ev_files = prev_result.get("evidence_files", [])
                if ev_files:
                    # 提取最关键的 evidence（含 "源码"/"策略"/"漏洞"/"Lambda"/"IAM"/"flag" 关键词）
                    priority_keywords = ["源码", "策略", "漏洞", "lambda", "iam", "flag", "policy", "handler", "source", "code"]
                    priority_evs = []
                    other_evs = []
                    for ef in ev_files:
                        if any(kw in ef.lower() for kw in priority_keywords):
                            priority_evs.append(ef)
                        else:
                            other_evs.append(ef)
                    # 优先读取关键 evidence，最多 3 个
                    must_read = (priority_evs + other_evs)[:3]
                    injection += "\n### 🚨 第一步：必须读取前轮关键证据（禁止跳过）\n"
                    injection += "在执行任何其他操作之前，**必须先执行以下命令**读取前轮积累的关键发现：\n"
                    for i, ef in enumerate(must_read, 1):
                        # 使用文件名（去掉 .md 后缀）作为 evidence ID，而非循环索引
                        ev_id = ef.rsplit(".", 1)[0] if ef.endswith(".md") else ef
                        injection += f"{i}. `evidence_read(id=\"{ev_id}\")`  ← {ef}\n"
                    injection += "\n读完后再决定攻击方向，**禁止重复前轮已做过的侦察工作**。\n"

            # ── Fix 1: attack_commands（最高优先级） ──
            if attack_commands:
                injection += "\n### ⚡ 必须立即执行的命令（按顺序，由评审官指定）\n"
                injection += "以下命令由决策评审官根据前轮分析直接指定，**本轮必须优先执行这些命令**：\n"
                for i, cmd in enumerate(attack_commands[:5], 1):
                    injection += f"{i}. ```{cmd}```\n"
                injection += "\n执行完以上命令后，根据结果决定下一步。\n"

            # ── Fix 3: Skill 强制加载 ──
            if recommended_skills:
                injection += "\n### 📚 必须加载的技巧（本轮第一步执行）\n"
                injection += "⚠️ **在执行任何攻击之前，必须先加载以下技巧**：\n"
                for s in recommended_skills[:3]:
                    injection += f"- 执行: `Skill(skill=\"{s}\")`\n"

            # ── Fix 2: Evidence 关键发现摘要（按严重性排序） ──
            prev_result = all_round_results[-1]
            ev_files = prev_result.get("evidence_files", [])
            if ev_files:
                evidence_dir = run_dir / "evidence"
                if evidence_dir.exists():
                    # 按严重性排序：🔴 CRITICAL > 🟠 HIGH > 🟡 MEDIUM > ⚪ INFO
                    severity_order = {"🔴": 0, "CRITICAL": 0, "🟠": 1, "HIGH": 1, "🟡": 2, "MEDIUM": 2, "⚪": 3, "INFO": 3}
                    def _ev_sort_key(fname):
                        fpath = evidence_dir / fname
                        if fpath.exists():
                            try:
                                head = fpath.read_text(encoding="utf-8", errors="replace")[:200]
                                for marker, order in severity_order.items():
                                    if marker in head:
                                        return order
                            except Exception:
                                pass
                        return 4
                    sorted_evs = sorted(ev_files, key=_ev_sort_key)
                    injection += "\n### 📋 前轮关键发现摘要（禁止重复这些工作）\n"
                    for ef in sorted_evs[:10]:
                        ef_path = evidence_dir / ef
                        if ef_path.exists():
                            try:
                                lines = ef_path.read_text(encoding="utf-8", errors="replace").split("\n")[:5]
                                summary = " ".join(l.strip().lstrip("# -") for l in lines if l.strip())[:150]
                                injection += f"- **{ef}**: {summary}\n"
                            except Exception:
                                injection += f"- {ef}\n"

            # 去重漏洞列表（endpoint + vuln_type 维度）
            if all_vulns:
                from urllib.parse import urlparse
                injection += "\n### 已发现漏洞（去重后）\n"
                seen_keys = set()
                deduped_vulns = []
                for v in all_vulns:
                    title = v.get("title", v.get("type", ""))
                    url = v.get("url", "")
                    # 简化分类: 取 title 关键词 + endpoint
                    title_lower = title.lower()
                    parsed = urlparse(url if "://" in url else f"http://x{url}")
                    path = parsed.path.rstrip("/").lower() or "/"
                    # 漏洞类型关键词提取
                    vtype = "other"
                    for kw in ["sql", "xss", "idor", "csrf", "ssrf", "traversal", "lfi",
                               "disclosure", "logic", "auth", "brute", "header", "inject", "redirect"]:
                        if kw in title_lower:
                            vtype = kw
                            break
                    key = f"{vtype}:{path}"
                    if key not in seen_keys:
                        seen_keys.add(key)
                        deduped_vulns.append(v)

                for i, v in enumerate(deduped_vulns[:30], 1):
                    title = v.get("title", v.get("type", "未命名"))
                    severity = v.get("severity", "")
                    url = v.get("url", "")
                    injection += f"{i}. [{severity}] {title} — {url}\n"
                injection += f"\n**注意**: 以上 {len(deduped_vulns)} 个漏洞已确认，不要重复测试这些端点的相同漏洞类型。专注于遗漏方向。\n"

            # ── Fix 4: 决策 Agent 反馈（压缩版） ──
            if judge_feedback or all_missing_areas:
                injection += "\n### 决策 Agent 反馈\n"
                if judge_feedback:
                    fb = str(judge_feedback)[:300]
                    injection += f"{fb}\n"
                if all_missing_areas:
                    injection += "\n### 遗漏的测试方向（跨轮累积，必须优先测试）\n"
                    for i, area in enumerate(all_missing_areas[:5], 1):
                        injection += f"{i}. {area}\n"

            injection += "\n请根据反馈继续未完成的工作，不要重复已做过的测试。\n"

            # ── 结构化失败历史（从 timeline.jsonl 提取） ──
            failure_history = []
            timeline_file = run_dir / "timeline.jsonl"
            if timeline_file.exists():
                try:
                    tool_calls_map = {}
                    for line in timeline_file.read_text(encoding="utf-8", errors="replace").splitlines():
                        if not line.strip():
                            continue
                        try:
                            entry = json.loads(line)
                        except Exception:
                            continue
                        if entry.get("type") == "tool_call":
                            tool_calls_map[entry.get("tool_use_id", "")] = {
                                "name": entry.get("name", ""),
                                "input": entry.get("input_preview", ""),
                            }
                        elif entry.get("type") == "tool_result" and entry.get("is_error"):
                            tid = entry.get("tool_use_id", "")
                            call_info = tool_calls_map.get(tid, {})
                            output = entry.get("output_preview", "")[:100]
                            failure_history.append({
                                "tool": call_info.get("name", "unknown"),
                                "input": call_info.get("input", "")[:80],
                                "error": output,
                            })
                except Exception:
                    pass

            if failure_history:
                seen_failures = set()
                deduped_failures = []
                for fh in failure_history:
                    key = f"{fh['tool']}:{fh['error'][:40]}"
                    if key not in seen_failures:
                        seen_failures.add(key)
                        deduped_failures.append(fh)

                injection += "\n### 🚫 前轮失败操作记录（禁止重复）\n"
                injection += "以下操作在前轮中已失败，**禁止用相同或相似参数再次尝试**，必须换方式绕过：\n"
                for i, fh in enumerate(deduped_failures[:10], 1):
                    injection += f"{i}. `{fh['tool']}({fh['input']})` → 失败: {fh['error']}\n"
                injection += "\n"
            else:
                injection += """
### 🚫 禁止重复失败操作
- 前轮返回权限拒绝/认证失败的命令，**禁止用相同参数再次尝试**，需要尝试换一种方式绕过
- 前轮连续 3 次以上失败的同类操作（枚举/扫描/爆破），本轮禁止继续，切换攻击路径
- 已经读取过的文件/证据内容，不要重复读取，直接使用已有信息
"""

            target_prompt += injection

        target_prompt = target_prompt.encode("utf-8", errors="replace").decode("utf-8")

        # 保存本轮 prompt 审计
        prompt_audit = run_dir / f"prompt_audit_round{current_round}.md"
        audit_content = (
            f"# Prompt Audit — Round {current_round}\n\n"
            f"## System Prompt (append)\n\n```\n{system_prompt}\n```\n\n"
            f"## User Prompt\n\n```\n{target_prompt}\n```\n"
        )
        # 保存 sub-agent prompt（如果 team 模式）
        if agents:
            for agent_name, agent_def in agents.items():
                audit_content += f"\n\n## Sub-Agent: {agent_name}\n\n```\n{agent_def.prompt}\n```\n"
        prompt_audit.write_text(audit_content, encoding="utf-8")

        if args.verbose:
            print(f"\n{'─'*40}")
            print(f"📋 User Prompt (Round {current_round}):\n{target_prompt}")
            print(f"{'─'*40}\n")

        # 阶段 1: 渗透 Agent（带 failover 支持）
        pm.reset_failover_count()
        _pentest_retry_count = 0  # 同一 provider 重试计数
        while True:
            try:
                result_msg, agent_log, timed_out, round_metrics = await run_pentest_round(
                    args, system_prompt, target_prompt, run_dir, env, mcp_env, agents,
                    round_timeout_s=int(effective_round_timeout),
                    max_turns=round_max_turns,
                    current_round=current_round,
                    browser=_browser_available,
                )
                # 检查 ResultMessage 是否为 API 错误（额度耗尽等不抛异常的情况）
                if result_msg and result_msg.is_error:
                    err_hint = str(result_msg.result or result_msg.stop_reason or "unknown error")
                    # 0 turns 且 is_error 通常是 API 认证/额度问题
                    if (result_msg.num_turns == 0 or pm.should_failover(err_hint)):
                        # 临时性错误：同一 provider 重试
                        if pm.should_retry(err_hint) and _pentest_retry_count < 2:
                            _pentest_retry_count += 1
                            delay = pm.retry_delay(_pentest_retry_count - 1, err_hint)
                            print(f"  🔁 临时性错误，{delay:.0f}s 后同 provider 重试 ({_pentest_retry_count}/2): {err_hint[:60]}")
                            continue
                        # 重试耗尽或确定性错误 → failover
                        if pm.available and pm.failover(err_hint):
                            _apply_provider_env(env, pm)
                            if pm.get_judge_model():
                                args.judge_model = pm.get_judge_model()
                            _pentest_retry_count = 0
                            continue
                # 检查心跳检测到的 API 死亡
                if round_metrics.get("api_stalled"):
                    # API 卡死也先重试一次
                    if _pentest_retry_count < 1:
                        _pentest_retry_count += 1
                        print(f"  🔁 API 无响应，3s 后同 provider 重试 ({_pentest_retry_count}/2)")
                        await asyncio.sleep(3)
                        continue
                    if pm.available and pm.failover("API 无响应 (5min 完全无活动)"):
                        _apply_provider_env(env, pm)
                        if pm.get_judge_model():
                            args.judge_model = pm.get_judge_model()
                        _pentest_retry_count = 0
                        continue
                # 0-turn crash recovery: if agent produced 0 tool calls, retry
                if (not timed_out and not round_metrics.get("api_stalled")
                        and round_metrics.get("tool_calls", 0) == 0
                        and _pentest_retry_count < 2):
                    _pentest_retry_count += 1
                    backoff = 5 * _pentest_retry_count
                    print(f"  🔁 0-turn crash detected, retrying in {backoff}s ({_pentest_retry_count}/2)")
                    await asyncio.sleep(backoff)
                    continue
                break  # 成功或无法 failover，退出重试循环
            except (ProcessError, CLIConnectionError, Exception) as e:
                err_msg = str(e)
                # 临时性错误：同一 provider 重试
                if pm.available and pm.should_retry(err_msg) and _pentest_retry_count < 2:
                    _pentest_retry_count += 1
                    delay = pm.retry_delay(_pentest_retry_count - 1, err_msg)
                    print(f"  🔁 临时性错误，{delay:.0f}s 后同 provider 重试 ({_pentest_retry_count}/2): {err_msg[:60]}")
                    continue
                # 重试耗尽或确定性错误 → failover
                if pm.available and pm.should_failover(err_msg) and pm.failover(err_msg):
                    _apply_provider_env(env, pm)
                    if pm.get_judge_model():
                        args.judge_model = pm.get_judge_model()
                    _pentest_retry_count = 0
                    continue  # 用新 provider 重试本轮
                raise  # 无法 failover，抛出原错误

        # 收集结果
        round_results = collect_round_results(run_dir, agent_log)

        # 提取 ResultMessage 统计
        pentest_stats = {}
        wall_duration_s = round_metrics.get("wall_duration_s", 0)
        round_report_entry = {
            "round": current_round,
            "tool_calls": round_metrics["tool_calls"],
            "tool_errors": round_metrics["tool_errors"],
        }
        if result_msg:
            duration_s = result_msg.duration_ms / 1000 if result_msg.duration_ms else 0
            duration_api_s = result_msg.duration_api_ms / 1000 if result_msg.duration_api_ms else 0
            tool_exec_s = max(0, duration_s - duration_api_s)
            # 使用挂钟时间作为主显示，SDK duration 作为参考
            display_duration = wall_duration_s if wall_duration_s > 0 else duration_s
            pentest_stats = {
                "duration": _format_duration(display_duration),
                "num_turns": result_msg.num_turns,
                "cost": f"${result_msg.total_cost_usd:.2f}" if result_msg.total_cost_usd else "N/A",
                "stop_reason": result_msg.stop_reason or "N/A",
                "is_error": result_msg.is_error,
            }
            print(f"\n  📊 本轮: {_format_duration(wall_duration_s)}, {pentest_stats['num_turns']} turns, {pentest_stats['cost']}")
            # 若挂钟时间与 SDK 时间差异大（sub-agent 场景），显示两者
            if wall_duration_s > duration_s * 1.5 and duration_s > 0:
                print(f"  ⏱ Parent agent: {_format_duration(duration_s)} / 含 sub-agents: {_format_duration(wall_duration_s)}")
            if duration_api_s > 0:
                if duration_api_s > duration_s:
                    print(f"  ⚡ AI: {_format_duration(duration_api_s)} (并发累计，含 sub-agent)")
                else:
                    api_pct = duration_api_s / duration_s * 100
                    print(f"  ⚡ AI: {_format_duration(duration_api_s)} / 工具: {_format_duration(tool_exec_s)} ({api_pct:.0f}% AI)")
            print(f"  🔧 工具调用: {round_metrics['tool_calls']} 次 (错误 {round_metrics['tool_errors']})")
            round_report_entry.update({
                "duration_s": wall_duration_s if wall_duration_s > 0 else duration_s,
                "duration_api_s": duration_api_s,
                "duration_sdk_s": duration_s,
                "cost_usd": result_msg.total_cost_usd or 0,
                "num_turns": result_msg.num_turns,
                "stop_reason": result_msg.stop_reason,
                "vulns_found": len(round_results.get("vulns", [])),
            })
        elif timed_out:
            pentest_stats = {"duration": _format_duration(wall_duration_s) if wall_duration_s > 0 else f"{args.round_timeout}min (超时)", "num_turns": "N/A", "cost": "N/A", "stop_reason": "timeout", "is_error": False}
            print(f"\n  📊 本轮: {pentest_stats['duration']} (超时)")
            print(f"  🔧 工具调用: {round_metrics['tool_calls']} 次 (错误 {round_metrics['tool_errors']})")
            round_report_entry.update({"duration_s": wall_duration_s if wall_duration_s > 0 else effective_round_timeout, "stop_reason": "timeout", "vulns_found": len(round_results.get("vulns", []))})

        round_results.update(pentest_stats)
        round_results["_report_entry"] = round_report_entry
        all_round_results.append(round_results)

        print(f"  🔍 漏洞: {len(round_results['vulns'])} 个  |  证据: {len(round_results['evidence_files'])} 个  |  Flag: {'✅' if round_results['flag_found'] else '❌'}")

        # Flag 检测：仅记录，不提前退出（可能是假 flag，需要 comp/runner 通过平台 API 验证）
        if round_results["flag_found"]:
            print(f"\n  🔍 检测到疑似 flag: {round_results['flag_value']}（等待平台验证，继续攻击）")

        # 检查是否还有轮次 & 时间
        elapsed = time() - total_start
        if current_round >= args.max_rounds:
            print(f"\n  📊 已达最大轮数 ({args.max_rounds})，跳过决策评估")
            break
        if elapsed > total_timeout_s - 120:
            print(f"\n  ⏰ 剩余时间不足，跳过决策评估")
            break

        # 阶段 2: 决策 Agent（带重试）
        print(f"\n  🤖 决策 Agent 评估中...")
        judge_prompt = build_judge_prompt(
            target=args.target,
            mode=args.mode,
            task_description=args.prompt,
            current_round=current_round,
            max_rounds=args.max_rounds,
            elapsed_min=elapsed / 60,
            total_timeout_min=total_timeout_min,
            pentest_result=pentest_stats,
            run_dir=run_dir,
            agent_log=agent_log,
            hint=getattr(args, 'hint', None),
            prev_decision=prev_judge_decision,
        )

        decision = None
        _judge_retry_count = 0
        _judge_call_env = env  # judge 专用 env，拒绝重试时独立切换不影响渗透 agent
        while decision is None:
            try:
                decision = await asyncio.wait_for(
                    run_judge(args, judge_prompt, env=_judge_call_env),
                    timeout=120,  # 决策 agent 最多 2 分钟
                )
                # ── 拒绝检测：Claude 安全拒绝会返回 "JSON 解析失败: I appreciate..." ──
                if ("JSON 解析失败" in decision.get("reason", "")
                        and _judge_retry_count < 3
                        and pm.available and hasattr(pm, '_providers')):
                    _orig_model = args.judge_model
                    _switched = False
                    for _pi, _p in enumerate(pm._providers):
                        if _pi == pm._current_idx:
                            continue
                        _alt_judge = _p.models.get("judge")
                        if _alt_judge and _alt_judge != _orig_model:
                            _judge_retry_count += 1
                            # 构建独立 env 仅供 judge 使用，不修改主 env
                            _judge_call_env = {**env, **_p.to_env()}
                            args.judge_model = _alt_judge
                            print(f"  🔁 Judge 拒绝响应，切换备用模型 {_alt_judge} ({_judge_retry_count}/3)")
                            decision = None
                            _switched = True
                            break
                    if not _switched and decision is not None:
                        print(f"  ⚠️ Judge 拒绝响应，无备用模型可用")
            except asyncio.TimeoutError:
                # 超时是临时性错误，重试
                if _judge_retry_count < 3:
                    _judge_retry_count += 1
                    delay = pm.retry_delay(_judge_retry_count - 1, "timeout")
                    print(f"  🔁 决策 Agent 超时，{delay:.0f}s 后重试 ({_judge_retry_count}/3)")
                    continue
                print(f"  ⚠️ 决策 Agent 超时（重试耗尽），默认继续下一轮")
                decision = {"complete": False, "confidence": 0, "reason": "judge timeout", "feedback": "继续测试", "missing_areas": []}
            except (ProcessError, CLIConnectionError) as e:
                err_msg = str(e)
                # 临时性错误：同一 provider 重试
                if pm.should_retry(err_msg) and _judge_retry_count < 3:
                    _judge_retry_count += 1
                    delay = pm.retry_delay(_judge_retry_count - 1, err_msg)
                    print(f"  🔁 决策 Agent 临时错误，{delay:.0f}s 后重试 ({_judge_retry_count}/3): {err_msg[:60]}")
                    continue
                # 重试耗尽或确定性错误 → failover
                if pm.available and pm.should_failover(err_msg) and pm.failover(err_msg):
                    _apply_provider_env(env, pm)
                    _judge_call_env = env  # failover 后同步更新 judge env
                    if pm.get_judge_model():
                        args.judge_model = pm.get_judge_model()
                    _judge_retry_count = 0
                    continue  # 用新 provider 重试 judge
                print(f"  ⚠️ 决策 Agent 异常: {e}")
                decision = {"complete": False, "confidence": 0, "reason": f"judge error: {e}", "feedback": "继续测试", "missing_areas": []}
            except Exception as e:
                # 未知异常重试
                if _judge_retry_count < 3:
                    _judge_retry_count += 1
                    print(f"  🔁 决策 Agent 异常，3s 后重试 ({_judge_retry_count}/3): {e}")
                    await asyncio.sleep(3)
                    continue
                print(f"  ⚠️ 决策 Agent 异常: {e}")
                decision = {"complete": False, "confidence": 0, "reason": f"judge error: {e}", "feedback": "继续测试", "missing_areas": []}

        final_decision = decision
        is_complete = decision.get("complete", False)
        confidence = decision.get("confidence", 0)
        reason = str(decision.get("reason") or "N/A")
        judge_feedback = str(decision.get("feedback") or "")
        missing = decision.get("missing_areas", [])
        if not isinstance(missing, list):
            missing = []
        # 跨轮累积 missing_areas（去重）
        for area in missing:
            if area and area not in all_missing_areas:
                all_missing_areas.append(area)
        recommended_skills = decision.get("recommended_skills", [])
        if not isinstance(recommended_skills, list):
            recommended_skills = []
        attack_commands = decision.get("attack_commands", [])
        if not isinstance(attack_commands, list):
            attack_commands = []

        print(f"  📋 决策: {'✅ 完成' if is_complete else '🔄 继续'}  (信心: {confidence:.0%})")
        # 优先显示 feedback（judge 通常把详细理由写在 feedback，reason 留 N/A）
        display_reason = judge_feedback if judge_feedback and reason in ("N/A", "") else reason
        print(f"  💬 理由: {display_reason[:250]}")
        if missing:
            print(f"  📎 遗漏: {', '.join(str(m) for m in missing[:3])}")
        if attack_commands:
            print(f"  ⚡ 命令: {len(attack_commands)} 条")
        if recommended_skills:
            print(f"  📚 推荐技巧: {', '.join(str(s) for s in recommended_skills[:5])}")
        hint_alignment = decision.get("hint_alignment")
        if hint_alignment:
            print(f"  🔑 提示对齐: {str(hint_alignment)[:150]}")

        # 保存本轮决策供下轮 judge 参考
        prev_judge_decision = decision

        # Timeline: judge decision
        _timeline_append(run_dir, {
            "round": current_round, "type": "judge_decision",
            "complete": is_complete,
            "confidence": decision.get("confidence"),
            "vulns_found": len(decision.get("found_vulnerabilities", [])),
            "feedback_preview": str(decision.get("feedback", ""))[:200],
        })

        # 保存决策记录
        decision_log = run_dir / f"judge_round{current_round}.json"
        decision_log.write_text(json.dumps(decision, ensure_ascii=False, indent=2), encoding="utf-8")

        # judge 判定完成：不再以日志中的 flag 作为退出依据（可能是假 flag）
        # 真正的退出由 comp/runner.py 通过平台 API 验证 flag 后触发 solved_event
        if is_complete:
            print(f"  ℹ️ judge 判定完成，但继续深挖（剩余 {args.max_rounds - current_round} 轮，防止假 flag）")
            # 仍然使用 judge 的 feedback/missing_areas 指导下一轮

    # --- 最终报告 ---
    total_elapsed = time() - total_start
    total_min = total_elapsed / 60
    total_rounds = len(all_round_results)
    total_vulns = len(all_round_results[-1]["vulns"]) if all_round_results else 0

    # 汇总各轮指标
    total_cost = sum(r.get("_report_entry", {}).get("cost_usd", 0) for r in all_round_results)
    total_tool_calls = sum(r.get("_report_entry", {}).get("tool_calls", 0) for r in all_round_results)
    total_tool_errors = sum(r.get("_report_entry", {}).get("tool_errors", 0) for r in all_round_results)
    total_duration_api_s = sum(r.get("_report_entry", {}).get("duration_api_s", 0) for r in all_round_results)
    total_turns = sum(r.get("_report_entry", {}).get("num_turns", 0) for r in all_round_results if isinstance(r.get("_report_entry", {}).get("num_turns"), int))

    print(f"\n{'='*60}")
    print(f"  🏁 Orchestrator 最终报告")
    print(f"{'='*60}")
    print(f"  总轮次: {total_rounds}/{args.max_rounds}")
    print(f"  总耗时: {total_min:.1f}min")
    if total_duration_api_s > 0:
        if total_duration_api_s > total_elapsed:
            print(f"  ⚡ AI: {_format_duration(total_duration_api_s)} (并发累计，含 sub-agent)")
        else:
            tool_exec_s = max(0, total_elapsed - total_duration_api_s)
            api_pct = total_duration_api_s / total_elapsed * 100
            print(f"  ⚡ AI: {_format_duration(total_duration_api_s)} / 工具: {_format_duration(tool_exec_s)} ({api_pct:.0f}% AI)")
    print(f"  💰 总费用: ${total_cost:.2f}")
    print(f"  🔧 工具调用: {total_tool_calls} 次 (错误 {total_tool_errors})")
    print(f"  漏洞数: {total_vulns}")
    any_flag = any(r.get("flag_found") for r in all_round_results)
    if any_flag:
        print(f"  Flag: ✅ 找到")
    if final_decision:
        print(f"  决策: {final_decision.get('reason', 'N/A')[:120]}")
    print(f"  输出: {run_dir}")
    print(f"{'='*60}")

    _write_final_report()


def main():
    args = parse_args()

    # --check: 环境检查模式，不需要 target
    if getattr(args, 'check', False):
        ok = check_environment(deep=getattr(args, 'deep', False))
        sys.exit(0 if ok else 1)

    # --check-providers: API provider 可用性测试
    if getattr(args, 'check_providers', False):
        ok = check_providers(args)
        sys.exit(0 if ok else 1)

    # 正常模式需要 target
    if not args.target:
        print("❌ 请指定目标地址，或使用 --check 检查环境")
        sys.exit(1)

    # 解析漏洞排除偏好
    args._exclude_vulns = resolve_exclusions(args)
    try:
        if args.orchestrator:
            asyncio.run(run_orchestrator(args))
        else:
            asyncio.run(run(args))
    except KeyboardInterrupt:
        print("\n⚠️ 用户中断")
        sys.exit(1)
    except CLINotFoundError:
        print("\n❌ 找不到 Claude CLI (claude)，请确认已安装并在 PATH 中")
        sys.exit(2)
    except ProcessError as e:
        print(f"\n❌ Claude CLI 进程异常退出: {e}")
        sys.exit(3)
    except CLIConnectionError as e:
        print(f"\n❌ 与 Claude CLI 通信失败: {e}")
        sys.exit(4)
    except CLIJSONDecodeError as e:
        print(f"\n❌ Claude CLI 输出解析失败: {e}")
        sys.exit(5)


if __name__ == "__main__":
    main()