How abc2lab/abcdef2lab works
ABC2LAB is a developing, locally oriented web-security diagnosis product, initially focused on horizontal IDOR checks. The intended flow is operator setup and candidate review, controlled HTTP execution, comparison of normal and cross-account reads, evidence-backed judgment, then stored results shown in the UI. The README explicitly cautions that these stages are not yet fully connected end to end; the graph preserves that distinction. Source excerpts show the worker/engine runtime and selected supporting modules, while several other connections below are documented capabilities rather than inspected call paths.
Main entry points: worker.go Planner and worker · engine.go Exploration engine · manager.go Task manager · diagnostic.go Diagnostic reports
Components 19
Task runtime
- Backend startup
cmd/artex/main.go - Task API
server/server.go - Exploration engine
server/engine.go - Task manager
server/manager.go - Planner and worker
agent/worker.go
Execution controls
- Request guard
guard/guard.go - HTTP transmission
transmit/http.go - Controlled proxy
e2proxy/execution.go
Evidence and results
- IDOR comparison
idor/verifier.go - Judgment oracle
oracle/oracle.go - Evidence binding
evidencebind/check.go - Diagnostic reports
report/diagnostic.go - Remediation guidance
remediation/remediation.go - Traffic evidence
traffic/traffic.go
Model and persistence
- PostgreSQL data
db/db.go - Model policy
llmpolicy/policy.go - Model-call recording
llmrec/llmrec.go
User interface
- Diagnosis UI
web/src/abc2lab-ui/lib/engine.ts
Other components
- Operator
Connections 21
- Operator → Diagnosis UI: reviews and steers
- Diagnosis UI → Task API: calls task API
- Backend startup → Task API: starts backend
cmd/artex/main.go - Task API → Exploration engine: controls tasks
- Exploration engine → Task manager: manages tasks
server/engine.go - Exploration engine → Planner and worker: runs work
server/engine.go - Task manager → PostgreSQL data: persists task state
server/manager.go - Task manager → Traffic evidence: starts recorder
server/manager.go - Planner and worker → Request guard: gates tool calls
agent/worker.go - Request guard → HTTP transmission: authorizes requests
- HTTP transmission → Controlled proxy: executes HTTP
- Controlled proxy → IDOR comparison: supplies observations
- IDOR comparison → Judgment oracle: compares reads
- Judgment oracle → Evidence binding: checks evidence
- Evidence binding → Diagnostic reports: supports findings
- Diagnostic reports → Diagnosis UI: shows results
- Diagnostic reports → Remediation guidance: offers guidance
- Traffic evidence → PostgreSQL data: stores observations
traffic/traffic.go - Model policy → Planner and worker: configures model access
- Planner and worker → Model-call recording: records model calls
- Model-call recording → PostgreSQL data: writes usage records
llmrec/llmrec.go