chenchaoyi
diff --git a/‎CHANGELOG.md‎
Lines changed: 102 additions & 0 deletions b/‎CHANGELOG.md‎
Lines changed: 102 additions & 0 deletions
diff --git a/‎README.md‎
Lines changed: 91 additions & 0 deletions b/‎README.md‎
Lines changed: 91 additions & 0 deletions
diff --git a/‎docs/zh/CHANGELOG.md‎
Lines changed: 86 additions & 0 deletions b/‎docs/zh/CHANGELOG.md‎
Lines changed: 86 additions & 0 deletions
@@ -11,6 +11,108 @@ behaviours between releases.
 
 ## [Unreleased]
 
+## [1.7.0] — 2026-05-23
+
+Minor release. **LAN identification expansion** — the LAN view now
+recognises far more devices on a typical CN home / office network
+by layering four new identification sources on top of the existing
+ARP + ICMP + OUI + Bonjour stack: multi-tier IEEE OUI registry
+lookup, NBNS / SSDP / active mDNS probes, ICMP TTL fingerprinting,
+and a rules-table device-class classifier. The probe layer is
+scene-gated — `home` / `office` / `audit` default to active,
+`public` defaults to passive but offers a one-shot consent override
+via the new uppercase `P` keybinding (with 2-second cooldown +
+JSONL audit event).
+
+The LAN row layout reorganises per a UX benchmark of Fing Desktop:
+the class column moves to the leftmost data position (it carries
+more signal than vendor when scanning a list), and rows whose
+`first_seen < 24 h` are prefixed with a `[new]` chip so unfamiliar
+devices stand out.
+
+### Added
+- **Multi-tier IEEE OUI registry.** Three bundled JSON files
+  (`wifi_ouis.json` MA-L, `wifi_ouis_ma_m.json` MA-M,
+  `wifi_ouis_ma_s.json` MA-S) — 57 211 vendor mappings total. The
+  lookup function tries 36-bit → 28-bit → 24-bit, longest prefix
+  wins. CN white-label IoT vendors (Tuya / Aqara / Tapo / Imou)
+  that only registered MA-S sub-allocations now resolve to their
+  real brand. `scripts/refresh_ouis.py` extended with
+  `--source ieee|wireshark|auto` — auto-falls back to the
+  Wireshark `manuf` mirror when IEEE direct is unreachable
+  (CN-network-friendly default).
+- **Vendor display normalization.** Raw IEEE strings get stripped
+  of trailing corporate-form tokens (`CO., LTD`, `CORPORATION`,
+  `INC`, `TECHNOLOGIES`) and leading geographic prefixes
+  (`SHENZHEN`, `HANGZHOU`, `BEIJING`); titlecased with acronym
+  preservation (`HP`, `IBM`, `ASUS`, `H3C`, `TP-Link`).
+  `NEW H3C TECHNOLOGIES CO., LTD` → `New H3C`. Raw form
+  preserved on a dim continuation line in the detail modal.
+- **Active LAN discovery layer** (new module
+  `src/diting/lan_probes.py`): NBNS Status Query (RFC 1002
+  wildcard `*`), SSDP M-SEARCH, active mDNS browse for the
+  `_services._dns-sd._meta._tcp.local.` record, plus optional
+  HTTP fetch of UPnP `LOCATION` XML for `friendlyName` +
+  `modelName`. All three phases run concurrently via
+  `asyncio.gather`, each fail-soft on exception. Zero new
+  third-party deps — stdlib `socket` + `urllib` + `xml.etree`
+  (defused against external entities). No new TCC permissions.
+- **Scene-gated active probing.**
+  `scene_defaults()["lan_active_probe"]` is `True` for home /
+  office / audit, `False` for public. `DITING_LAN_PROBE=0|1`
+  overrides; `DITING_LAN_UPNP_FETCH=0|1` separately gates the
+  LOCATION-XML fetch.
+- **Public-scene one-shot consent override.** Uppercase `P` in
+  the LAN view opens `LANProbeConsentScreen` enumerating exactly
+  what packets will be sent and the consequences (other guests'
+  devices, IDS flagging, captive-portal disconnect). Confirm with
+  `y` after a **2-second cooldown** to run ONE active-probe
+  sweep; cooldown defeats muscle-memory press-through.
+  Subsequent sweeps revert to passive; re-press `P` to re-consent.
+- **`LANActiveProbeConsentedEvent` JSONL event.** Written on each
+  consent press, carrying `scene`, `ssid`, and the planned packet
+  counts. Audit-only — never emitted for scene-default or
+  env-forced probing.
+- **`[probing]` subtitle chip.** Shows in the LAN view's subtitle
+  while a consented one-shot probe sweep is queued; clears when
+  the resulting snapshot lands.
+- **TTL fingerprint.** `_ping_one` now also parses the ICMP echo's
+  `ttl=N` segment; `LANHost.ttl` carries the raw value,
+  `LANHost.ttl_class` carries the coarse bucket (`unix` = 50-64,
+  `windows` = 100-128, `router` = 200-255, None otherwise).
+  Surfaces in the detail modal's Network section as
+  `TTL 64 (unix)`. Zero additional traffic.
+- **Device-class classifier** (new module
+  `src/diting/lan_classify.py`). Pure function over the augmented
+  LANHost returns one of 12 classes: `phone | tablet | laptop | desktop |
+  tv | camera | smart-home | printer | nas | gaming | speaker |
+  router`, or None. Total function — never raises on any field
+  combination.
+- **LAN row layout: class column + `[new]` chip.** Per Fing UX
+  benchmark, the class column is the leftmost data column (it
+  disambiguates faster than vendor — a "New H3C" OUI can be a
+  router, AP, switch, or IoT bridge). Rows with `first_seen <
+  24 h` carry a `[new]` chip in dim cyan; self / gateway never
+  carry the chip.
+- **Detail modal — Class + TTL + Active-discovery rows.**
+  Identity section gains `Class:` (when classifier fires); new
+  Active-discovery section consolidates NBNS name, UPnP server
+  header, UPnP friendlyName, UPnP modelName. Network section
+  gains `TTL: <value> (<class>)` when ICMP returned a TTL.
+- **EN ↔ ZH i18n** for every new string: 11 class names, 2 TTL
+  classes, `[new]` / `[probing]` chips, full consent modal copy.
+
+### Documentation
+- **`README.md` + `docs/zh/README.md`** gain a `## LAN
+  identification` section covering the multi-tier OUI, the four
+  enrichment layers, the scene-gating matrix, and the
+  public-scene consent flow with an ASCII mock of the modal.
+
+### Spec
+- Single OpenSpec change `expand-lan-identification` (proposal +
+  design.md + tasks.md + seven spec deltas: `lan-inventory`,
+  `scenes`, `events`, `event-log`, `tui-shell`, `i18n`, `cli`).
+
 ## [1.6.0] — 2026-05-22
 
 Minor release. **Scene awareness** — diting now carries an explicit
 
@@ -209,6 +209,97 @@ reads office-mode noise as "expected baseline" rather than
 `--ble-presence-gate D` continues to override the scene's gate
 when you want fine control for one session.
 
+## LAN identification
+
+The LAN view (fourth `n` press) discovers every host on the local
+/24 via ARP + ICMP sweep, then enriches each row through a layered
+identification stack:
+
+- **Multi-tier OUI lookup** — IEEE MA-L (24-bit) → MA-M (28-bit) →
+  MA-S (36-bit), longest prefix wins. The bundled JSONs together
+  carry ~57k vendor mappings, so small white-label IoT vendors
+  (Tuya / Aqara / Tapo / Imou …) that only registered MA-S
+  sub-allocations still resolve to a real name.
+- **Vendor normalization** — the raw IEEE string is shortened for
+  display (`NEW H3C TECHNOLOGIES CO., LTD` → `New H3C`,
+  `SHENZHEN BILIAN ELECTRONIC CO.,LTD` → `Bilian`). The original
+  text is preserved on a dim continuation line in the detail modal.
+- **Reverse DNS + Bonjour cross-reference** — `gethostbyaddr`
+  hostname when the router publishes PTR records, plus a sweep of
+  the live Bonjour state for any device matching this IP.
+- **Active discovery** — NBNS Status Query (UDP 137 unicast),
+  SSDP M-SEARCH (UDP 1900 multicast), and an mDNS browse query
+  for the meta-service record. Optionally fetches the UPnP
+  LOCATION XML for `friendlyName` + `modelName`. Layered on top
+  so a host that publishes neither Bonjour nor reverse DNS — most
+  Windows machines, IP cameras, smart TVs, NAS — still becomes
+  identifiable.
+- **TTL fingerprint** — the ICMP echo already returns a TTL value;
+  diting buckets it into `unix` (50-64), `windows` (100-128), or
+  `router` (200-255). Surfaces in the detail modal as e.g.
+  `TTL 64 (unix)`.
+- **Device class** — a rules-table classifier consumes vendor,
+  Bonjour categories, NBNS / UPnP fields, and TTL to assign one
+  of: `phone | tablet | laptop | desktop | tv | camera | smart-home |
+  printer | nas | gaming | speaker | router`. Rendered as the
+  leftmost data column on each row.
+
+Rows whose `first_seen < 24 h` are prefixed with a `[new]` chip
+so unfamiliar devices stand out at a glance.
+
+### Active probing is scene-aware
+
+The active-discovery layer is the one piece of LAN identification
+that **sends packets to other hosts**. To stay polite about that,
+diting gates the layer through the active scene:
+
+| Scene    | NBNS + SSDP + mDNS-meta | Why                                                                                  |
+|----------|--------------------------|--------------------------------------------------------------------------------------|
+| `home`   | on by default            | Your own network. Probes go to devices you bought.                                   |
+| `office` | on by default            | Corp networks already see this traffic from every other device.                      |
+| `audit`  | on by default            | You're actively investigating; probe everything.                                     |
+| `public` | **off by default**       | Coffee shops / hotels / airports — you don't own the network, other guests do.       |
+
+Two env vars override the scene default at startup:
+
+- `DITING_LAN_PROBE=0|1` — force probing off / on regardless of
+  scene.
+- `DITING_LAN_UPNP_FETCH=0|1` — gate the optional HTTP fetch of
+  UPnP LOCATION URLs (set to `0` to keep M-SEARCH on but skip the
+  follow-up fetch). Default on.
+
+### Public-scene one-shot consent
+
+In `public` scene the LAN view binds uppercase **`P`** to a
+consent modal:
+
+```
+┌─ Active LAN probing ──────────────────────────────────┐
+│  Scene: public        Network: HotelGuest             │
+│                                                       │
+│  Active probing sends UDP packets to OTHER hosts on   │
+│  this network:                                        │
+│    · NBNS UDP 137 unicast                             │
+│    · SSDP M-SEARCH UDP 1900 multicast                 │
+│    · mDNS UDP 5353 multicast                          │
+│                                                       │
+│  On a public network you accept that:                 │
+│    · other guests' devices receive your probes        │
+│    · hotel / airport IDS may flag this as scanning    │
+│    · captive portals may rate-limit or disconnect     │
+│                                                       │
+│  One-shot probe. Re-confirm next time.                │
+│                                                       │
+│  [ esc cancel ]   [ wait 2s ]                         │
+└───────────────────────────────────────────────────────┘
+```
+
+Press `y` after a 2-second cooldown (defeats muscle-memory
+press-through) to run **one** active-probe sweep and write a
+`lan_active_probe_consented` line to your JSONL log. Subsequent
+sweeps revert to passive — every press of `P` re-opens the
+modal, no sticky state.
+
 ## The name
 
 **diting (谛听)** is a mythical beast in Chinese Buddhist lore —
 
@@ -10,6 +10,92 @@
 
 ## [Unreleased]
 
+## [1.7.0] — 2026-05-23
+
+Minor release。**LAN 识别能力扩展** —— LAN 视图现在能识别国内
+家庭 / 办公网里更多种类的设备。在原有的 ARP + ICMP + OUI +
+Bonjour 栈之上叠加了四层新识别源：多层级 IEEE OUI 注册表查询、
+NBNS / SSDP / 主动 mDNS 探测、ICMP TTL 指纹，以及一张规则表
+驱动的设备分类器。探测层按 scene 门控 —— `home` / `office` /
+`audit` 默认主动，`public` 默认 passive，但通过新加的大写 `P`
+键提供"用户自担"的单次确认开关（含 2 秒冷却 + JSONL 审计事件）。
+
+LAN 行的列布局参考 Fing Desktop 重新组织：class 列移到最左侧
+（在扫描列表时，分类比厂商更有信息量），首次出现时间 < 24 小时
+的行前面带 `[新]` chip，陌生设备一眼能挑出来。
+
+### 新增
+- **多层级 IEEE OUI 注册表。** 三个 bundled JSON 文件
+  （`wifi_ouis.json` MA-L，`wifi_ouis_ma_m.json` MA-M，
+  `wifi_ouis_ma_s.json` MA-S）—— 一共 57 211 条厂商映射。查询
+  函数按 36 位 → 28 位 → 24 位走，最长前缀胜出。CN 小白牌
+  IoT 厂商（Tuya / Aqara / Tapo / Imou）只在 MA-S 注册过子段，
+  这下能解析到真实品牌了。`scripts/refresh_ouis.py` 新增
+  `--source ieee|wireshark|auto` —— IEEE 直连失败时自动 fallback
+  到 Wireshark `manuf` 镜像（CN 网络友好默认行为）。
+- **厂商名规范化。** 把 IEEE 原文剥掉公司形态尾缀
+  （`CO., LTD` / `CORPORATION` / `INC` / `TECHNOLOGIES`）和
+  开头的地理前缀（`SHENZHEN` / `HANGZHOU` / `BEIJING`），
+  titlecase 同时保留缩写（`HP` / `IBM` / `ASUS` / `H3C` /
+  `TP-Link`）。`NEW H3C TECHNOLOGIES CO., LTD` → `New H3C`。
+  详情模态里以 dim 续行保留 IEEE 原文以便核对。
+- **主动 LAN 探测层**（新模块 `src/diting/lan_probes.py`）：
+  NBNS Status Query（RFC 1002 通配符 `*`）、SSDP M-SEARCH、
+  主动 mDNS browse 查询 `_services._dns-sd._meta._tcp.local.`
+  记录，可选地 HTTP 拉取 UPnP `LOCATION` XML 提取
+  `friendlyName` + `modelName`。三个 phase 通过
+  `asyncio.gather` 并发，每个独立 fail-soft。零新第三方依赖
+  —— 全用 stdlib `socket` + `urllib` + `xml.etree`（已防外部
+  实体）。无新 TCC 权限。
+- **主动探测按 scene 门控。**
+  `scene_defaults()["lan_active_probe"]` 在 home / office /
+  audit 是 `True`，在 public 是 `False`。`DITING_LAN_PROBE=0|1`
+  覆盖；`DITING_LAN_UPNP_FETCH=0|1` 单独控制 LOCATION-XML
+  HTTP 拉取。
+- **Public scene 单次确认开关。** LAN 视图下大写 `P` 打开
+  `LANProbeConsentScreen`，明确列出会发什么包（NBNS UDP 137
+  unicast / SSDP UDP 1900 multicast / mDNS UDP 5353 multicast）
+  和后果（其他客人设备会收到、IDS 可能告警、captive portal
+  可能限速或踢出）。等 **2 秒冷却** 后按 `y` 运行**一次**
+  主动探测 sweep；冷却用来防误触。之后所有 sweep 都回到
+  passive；要再扫一次需要重新按 `P` 重新确认。
+- **`LANActiveProbeConsentedEvent` JSONL 事件。** 每次按下 `y`
+  确认时写一条，带 `scene` / `ssid` / 即将发送的包数。仅审计
+  用 —— scene 默认开或 env 强制开的探测不写。
+- **`[探测中]` subtitle chip。** 在 LAN 视图的 subtitle 里显示，
+  从用户确认开始到结果 snapshot 到达。
+- **TTL 指纹。** `_ping_one` 现在解析 ICMP 回包里的 `ttl=N`；
+  `LANHost.ttl` 保留原值，`LANHost.ttl_class` 是分桶（`unix`
+  = 50-64，`windows` = 100-128，`router` = 200-255，其他 None）。
+  详情模态的 Network 段显示 `TTL 64 (unix)`。零额外流量。
+- **设备分类器**（新模块 `src/diting/lan_classify.py`）。
+  一张规则表消费 vendor / Bonjour 类目 / NBNS / UPnP 字段 / TTL，
+  输出 12 类之一：`phone | tablet | laptop | desktop | tv | camera |
+  smart-home | printer | nas | gaming | speaker | router` 或
+  None。纯函数 —— 对任何字段组合都不抛。
+- **LAN 行布局：class 列 + `[new]` chip。** 按 Fing UX 实证，
+  class 列放到 vendor **左侧**（"New H3C" OUI 可以是路由器 /
+  AP / 交换机 / IoT 桥，class 比 vendor 区分得更快）。
+  `first_seen < 24h` 的行带 dim cyan 的 `[新]` chip；
+  self / gateway 永不带。
+- **详情模态：Class + TTL + Active discovery 段。**
+  Identity 段新增 `Class:` 行（分类器命中时）；新的
+  Active discovery 段汇总 NBNS 名 / UPnP server 头 / UPnP
+  friendlyName / UPnP modelName。Network 段新增
+  `TTL: <值> (<class>)`（TTL 已知时）。
+- **EN ↔ ZH i18n** 覆盖每个新字符串：11 个 class 名、2 个 TTL
+  class、`[新]` / `[探测中]` chip、整个确认模态的所有文案。
+
+### 文档
+- **`README.md` + `docs/zh/README.md`** 新增 `## LAN 识别能力`
+  章节，覆盖多层级 OUI、四层富集机制、scene 门控矩阵、Public
+  scene 的确认流程（含模态 ASCII mock）。
+
+### 规范
+- 一个 OpenSpec change `expand-lan-identification`（proposal +
+  design.md + tasks.md + 七个 spec delta：`lan-inventory`、
+  `scenes`、`events`、`event-log`、`tui-shell`、`i18n`、`cli`）。
+
 ## [1.6.0] — 2026-05-22
 
 Minor release。**场景感知** —— diting 现在明确知道「你身处什么