@gpzhang2001/sharpkit-ui 0.2.1

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 gpzhang2001
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,20 @@
+# @gpzhang2001/sharpkit-ui
+
+Web UI 卡片：keyed toolview 富卡 + pentest locale 字典。唯一需要构建产物的包（浏览器加载，exports["./client"] = lib/client.js + `dsh.client` 声明）。
+
+## 卡片（tool.call.toolview，按 wire 工具名 keyed）
+
+- **exec_command** → 终端卡：`sh/pty` 前缀 + 命令行 + 输出滚动区（monospace）
+- **view_image** → 截图卡：路径 + "image attached to the result" 提示
+- **create_vulnerability_report / create_dependency_report** → 发现卡：severity 色标（critical→info 五档）+ 标题 + report_id
+
+客户端纪律：卡片只从 slot 传入的持久 call slice 派生（禁 I/O/时钟/随机/会话读取）；payload 解析失败回退为空——回放安全由构造保证。locale 走 typed 字典（zh 键集 + en 完整对账）。
+
+## 构建与验证
+
+- `pnpm bundle`（tsdown，平台模块表 external + `window.__ModuleLoader__` handoff）
+- 已验证：`dsh web --patch <mount>` 启动后，index 启动图含 `@gpzhang2001/sharpkit-ui/client.js`；按图请求精确 combo 返回 200 且包含本包注册字节
+
+## 会话节点（ConversationNode）
+
+findings 流 / agent 图谱 / 进度业务卡属 ConversationNode 层，将在后续版本提供。

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,48 @@
+# Third-Party Notices
+
+This project builds on and derives assets from the following upstream
+projects. Their licenses and attribution requirements are acknowledged here
+as required by Apache-2.0 §4.
+
+## strix — https://github.com/usestrix/strix
+
+Copyright 2025 OmniSecure Inc. Licensed under the Apache License, Version 2.0.
+
+sharpkit is an independent TypeScript reimplementation of strix's pentest
+domain assets on the DeepSeek Harness plugin architecture (no strix code is
+executed; no Python runtime is required). The following files are carried
+**verbatim or near-verbatim** from strix and remain subject to the above
+notice:
+
+| sharpkit path | Origin | Changes |
+| --- | --- | --- |
+| `packages/preset/src/system_prompt.jinja` | `strix/agents/prompts/system_prompt.jinja` | none (byte-identical template) |
+| `packages/skills/skills/**` (75 knowledge packs, 11 categories) | `strix/strix/skills/**` | none (migrated verbatim) |
+| `sandbox-image/caido_api.py` | `strix/strix/tools/proxy/caido_api.py` | none (byte-identical) |
+| `sandbox-image/docker-entrypoint.sh` | `strix/containers/docker-entrypoint.sh` | none (byte-identical) |
+| `sandbox-image/Dockerfile` | `strix/containers/Dockerfile` | COPY source paths adapted to the standalone context; added overridable `GOPROXY`/`KALI_MIRROR` build args |
+| `packages/preset/src/skills.ts` | `strix/strix/skills/__init__.py` | reimplemented in TypeScript (selection/validation semantics) |
+
+The following subsystems are **semantic ports** (behavior-preserving
+reimplementation, no verbatim text): the SARIF writer and vulnerability
+artifact writers (`packages/tool-reporting/src/{sarif,writers,state}.ts` ←
+`strix/report/*`), the reporting/analysis tool schemas
+(`packages/tool-reporting`, `packages/tool-analysis` ← `strix/tools/*`), the
+Caido client (`packages/tool-proxy/src/client.ts` ← the client half of
+`strix/tools/proxy/caido_api.py`), the sandbox session manager
+(`packages/sandbox` ← `strix/runtime/*`), and the scan-mode preset semantics
+(`packages/preset` ← `strix/agents/factory.py` + `core/inputs.py`).
+
+## DeepSeek Harness (dsh) — https://github.com/deepseek-ai/deepseek-harness
+
+MIT License. Copyright (c) DeepSeek.
+
+dsh is a runtime dependency only (`@deepseek-ai/dsh-*` npm packages); no dsh
+source is embedded or modified in this repository.
+
+## Sandbox image components
+
+The built `sharpkit-sandbox` image bundles Kali Linux and third-party security
+tools (nmap, sqlmap, nuclei, Caido, agent-browser, chromium, and others), each
+under its own license inside the image. Distributing a built image is the
+operator's responsibility; this repository ships only the build recipe.

package/lib/client.js

@@ -0,0 +1,202 @@
+window.__ModuleLoader__.load({
+	id: "@gpzhang2001/sharpkit-ui",
+	factory: (require) => {
+		var module = { exports: {} };
+		var exports = module.exports;
+		Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+		let react_jsx_runtime = require("react/jsx-runtime");
+		//#region src/client/PentestRows.tsx
+		/** Best-effort JSON parse for durable call payloads. */
+		function parsePayload(raw) {
+			if (typeof raw !== "string") return {};
+			try {
+				const parsed = JSON.parse(raw);
+				return typeof parsed === "object" && parsed !== null ? parsed : {};
+			} catch {
+				return {};
+			}
+		}
+		/** Extract the newest text content from a result payload array. */
+		function lastText(value) {
+			if (Array.isArray(value)) for (let index = value.length - 1; index >= 0; index--) {
+				const item = value[index];
+				if (typeof item === "object" && item !== null && item["text"] !== void 0) return String(item["text"]);
+			}
+			return "";
+		}
+		/** Terminal-style card for exec_command. */
+		function ExecRow(props) {
+			const payload = parsePayload(props.call?.arguments);
+			const cmd = String(payload["cmd"] ?? "");
+			const output = lastText(props.result?.content);
+			const isTTY = payload["tty"] === true;
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				style: {
+					fontFamily: "monospace",
+					fontSize: "0.86em",
+					borderLeft: "3px solid #58b7ff",
+					background: "rgba(88,183,255,0.06)",
+					borderRadius: 4,
+					overflow: "hidden"
+				},
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					style: {
+						padding: "4px 8px",
+						opacity: .85
+					},
+					children: [
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							style: { color: "#58b7ff" },
+							children: isTTY ? "pty" : "sh"
+						}),
+						" $ ",
+						cmd
+					]
+				}), output !== "" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("pre", {
+					style: {
+						margin: 0,
+						padding: "4px 8px",
+						borderTop: "1px solid rgba(128,128,128,0.25)",
+						whiteSpace: "pre-wrap",
+						maxHeight: 320,
+						overflowY: "auto"
+					},
+					children: output
+				})]
+			});
+		}
+		/** Severity-colored card for create_vulnerability_report / dependency findings. */
+		const SEVERITY_COLORS = {
+			critical: "#e5534b",
+			high: "#e5863b",
+			medium: "#d4a72c",
+			low: "#57ab5a",
+			info: "#539bf5"
+		};
+		function FindingRow(props) {
+			const payload = parsePayload(props.result?.meta ?? props.result?.content);
+			const severity = String(payload["severity"] ?? "info").toLowerCase();
+			const color = SEVERITY_COLORS[severity] ?? "#539bf5";
+			const title = String(payload["title"] ?? payload["message"] ?? "finding");
+			const reportId = String(payload["report_id"] ?? "");
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				style: {
+					borderLeft: `3px solid ${color}`,
+					padding: "4px 8px",
+					borderRadius: 4
+				},
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						style: {
+							color,
+							fontWeight: 600,
+							textTransform: "uppercase",
+							fontSize: "0.8em"
+						},
+						children: severity
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						style: { marginLeft: 8 },
+						children: title
+					}),
+					reportId !== "" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						style: {
+							marginLeft: 8,
+							opacity: .5,
+							fontSize: "0.85em"
+						},
+						children: reportId
+					})
+				]
+			});
+		}
+		/** Screenshot card for view_image. */
+		function ViewImageRow(props) {
+			const payload = parsePayload(props.call?.arguments);
+			const path = String(payload["path"] ?? "");
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+				style: {
+					borderLeft: "3px solid #8a7ff0",
+					padding: "4px 8px",
+					borderRadius: 4,
+					fontFamily: "monospace",
+					fontSize: "0.86em"
+				},
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						style: { color: "#8a7ff0" },
+						children: "screenshot"
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						style: {
+							marginLeft: 8,
+							opacity: .75
+						},
+						children: path
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						style: {
+							marginLeft: 8,
+							opacity: .4,
+							fontSize: "0.85em"
+						},
+						children: "image attached to the result"
+					})
+				]
+			});
+		}
+		//#endregion
+		//#region src/client/locales.ts
+		/** `pentest` namespace dictionaries (key-set source of truth: zh). */
+		const NS = "pentest";
+		const zh = {
+			"exec.label": "沙箱命令",
+			"finding.label": "漏洞发现",
+			"screenshot.label": "截图"
+		};
+		const en = {
+			"exec.label": "Sandbox command",
+			"finding.label": "Finding",
+			"screenshot.label": "Screenshot"
+		};
+		//#endregion
+		//#region src/client/index.ts
+		/** Required client services: the slot registry and the locale registry. */
+		const inject = ["slots", "locale"];
+		/** Client plugin body: register dictionaries and the keyed tool rows. */
+		function apply(ctx) {
+			ctx.effect(() => ctx.locale.register(NS, {
+				zh,
+				en
+			}), "pentest-ui: dictionaries");
+			ctx.slots.inject("tool.call.toolview", () => {
+				ctx.slots.register({
+					name: "tool.call.toolview",
+					key: "exec_command",
+					locale: NS
+				}, ExecRow);
+				ctx.slots.register({
+					name: "tool.call.toolview",
+					key: "view_image",
+					locale: NS
+				}, ViewImageRow);
+				ctx.slots.register({
+					name: "tool.call.toolview",
+					key: "create_vulnerability_report",
+					locale: NS
+				}, FindingRow);
+				ctx.slots.register({
+					name: "tool.call.toolview",
+					key: "create_dependency_report",
+					locale: NS
+				}, FindingRow);
+			});
+		}
+		//#endregion
+		exports.apply = apply;
+		exports.inject = inject;
+		return module.exports;
+	}
+});
+
+//# sourceMappingURL=client.js.map

package/lib/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","names":[],"sources":["../src/client/PentestRows.tsx","../src/client/locales.ts","../src/client/index.ts"],"sourcesContent":["/**\n * Pentest toolview cards, browser half (M5): presenter-derived, replay-safe\n * rows keyed by wire tool name. Each card renders only from the durable\n * call slice the slot owner passes — no I/O, no clock, no session reads\n * (client discipline); malformed payloads fall back to the generic text.\n */\nimport type { ToolCallViewProps } from '@deepseek-ai/dsh-client-ui-tool/client'\n\n/** Best-effort JSON parse for durable call payloads. */\nfunction parsePayload(raw: unknown): Record<string, unknown> {\n  if (typeof raw !== 'string') return {}\n  try {\n    const parsed = JSON.parse(raw) as unknown\n    return typeof parsed === 'object' && parsed !== null ? parsed as Record<string, unknown> : {}\n  } catch {\n    return {}\n  }\n}\n\n/** Extract the newest text content from a result payload array. */\nfunction lastText(value: unknown): string {\n  if (Array.isArray(value)) {\n    for (let index = value.length - 1; index >= 0; index--) {\n      const item = value[index]\n      if (typeof item === 'object' && item !== null && (item as Record<string, unknown>)['text'] !== undefined) {\n        return String((item as Record<string, unknown>)['text'])\n      }\n    }\n  }\n  return ''\n}\n\n/** Terminal-style card for exec_command. */\nexport function ExecRow(props: ToolCallViewProps) {\n  const payload = parsePayload(props.call?.arguments)\n  const cmd = String(payload['cmd'] ?? '')\n  const output = lastText(props.result?.content)\n  const isTTY = payload['tty'] === true\n  return (\n    <div style={{ fontFamily: 'monospace', fontSize: '0.86em', borderLeft: '3px solid #58b7ff', background: 'rgba(88,183,255,0.06)', borderRadius: 4, overflow: 'hidden' }}>\n      <div style={{ padding: '4px 8px', opacity: 0.85 }}>\n        <span style={{ color: '#58b7ff' }}>{isTTY ? 'pty' : 'sh'}</span>\n        {' $ '}\n        {cmd}\n      </div>\n      {output !== '' && (\n        <pre style={{ margin: 0, padding: '4px 8px', borderTop: '1px solid rgba(128,128,128,0.25)', whiteSpace: 'pre-wrap', maxHeight: 320, overflowY: 'auto' }}>{output}</pre>\n      )}\n    </div>\n  )\n}\n\n/** Severity-colored card for create_vulnerability_report / dependency findings. */\nconst SEVERITY_COLORS: Record<string, string> = {\n  critical: '#e5534b',\n  high: '#e5863b',\n  medium: '#d4a72c',\n  low: '#57ab5a',\n  info: '#539bf5',\n}\n\nexport function FindingRow(props: ToolCallViewProps) {\n  const payload = parsePayload(props.result?.meta ?? props.result?.content)\n  const severity = String(payload['severity'] ?? 'info').toLowerCase()\n  const color = SEVERITY_COLORS[severity] ?? '#539bf5'\n  const title = String(payload['title'] ?? payload['message'] ?? 'finding')\n  const reportId = String(payload['report_id'] ?? '')\n  return (\n    <div style={{ borderLeft: `3px solid ${color}`, padding: '4px 8px', borderRadius: 4 }}>\n      <span style={{ color, fontWeight: 600, textTransform: 'uppercase', fontSize: '0.8em' }}>{severity}</span>\n      <span style={{ marginLeft: 8 }}>{title}</span>\n      {reportId !== '' && <span style={{ marginLeft: 8, opacity: 0.5, fontSize: '0.85em' }}>{reportId}</span>}\n    </div>\n  )\n}\n\n/** Screenshot card for view_image. */\nexport function ViewImageRow(props: ToolCallViewProps) {\n  const payload = parsePayload(props.call?.arguments)\n  const path = String(payload['path'] ?? '')\n  return (\n    <div style={{ borderLeft: '3px solid #8a7ff0', padding: '4px 8px', borderRadius: 4, fontFamily: 'monospace', fontSize: '0.86em' }}>\n      <span style={{ color: '#8a7ff0' }}>screenshot</span>\n      <span style={{ marginLeft: 8, opacity: 0.75 }}>{path}</span>\n      <span style={{ marginLeft: 8, opacity: 0.4, fontSize: '0.85em' }}>image attached to the result</span>\n    </div>\n  )\n}\n","/** `pentest` namespace dictionaries (key-set source of truth: zh). */\n\nexport const NS = 'pentest'\n\nexport const zh = {\n  'exec.label': '沙箱命令',\n  'finding.label': '漏洞发现',\n  'screenshot.label': '截图',\n} satisfies Record<string, string>\n\nexport type PentestKey = keyof typeof zh\n\nexport const en = {\n  'exec.label': 'Sandbox command',\n  'finding.label': 'Finding',\n  'screenshot.label': 'Screenshot',\n} satisfies Record<PentestKey, string>\n","/**\n * Pentest UI, browser half (M5): keyed toolview cards for the wire tools\n * (exec_command, view_image, create_vulnerability_report,\n * create_dependency_report) plus the pentest locale dictionaries. Pure\n * derivation from durable call slices — replay-safe by construction.\n */\nimport type { Context as ClientContext } from '@deepseek-ai/cordis'\nimport type {} from '@deepseek-ai/dsh-client-locale/client'\nimport type {} from '@deepseek-ai/dsh-client-ui-renderer/client'\nimport { ExecRow, FindingRow, ViewImageRow } from './PentestRows.tsx'\nimport { en, NS, zh, type PentestKey } from './locales.ts'\n\ndeclare module '@deepseek-ai/dsh-client-ui-slots' {\n  interface LocaleNamespaceMap {\n    /** The pentest toolview copy. */\n    pentest: PentestKey\n  }\n}\n\n/** Required client services: the slot registry and the locale registry. */\nexport const inject = ['slots', 'locale']\n\n/** Client plugin body: register dictionaries and the keyed tool rows. */\nexport function apply(ctx: ClientContext): void {\n  ctx.effect(() => ctx.locale.register(NS, { zh, en }), 'pentest-ui: dictionaries')\n  ctx.slots.inject('tool.call.toolview', () => {\n    ctx.slots.register({ name: 'tool.call.toolview', key: 'exec_command', locale: NS }, ExecRow)\n    ctx.slots.register({ name: 'tool.call.toolview', key: 'view_image', locale: NS }, ViewImageRow)\n    ctx.slots.register({ name: 'tool.call.toolview', key: 'create_vulnerability_report', locale: NS }, FindingRow)\n    ctx.slots.register({ name: 'tool.call.toolview', key: 'create_dependency_report', locale: NS }, FindingRow)\n  })\n}\n"],"mappings":";;;;;;;;;EASA,SAAS,aAAa,KAAuC;GAC3D,IAAI,OAAO,QAAQ,UAAU,OAAO,CAAC;GACrC,IAAI;IACF,MAAM,SAAS,KAAK,MAAM,GAAG;IAC7B,OAAO,OAAO,WAAW,YAAY,WAAW,OAAO,SAAoC,CAAC;GAC9F,QAAQ;IACN,OAAO,CAAC;GACV;EACF;;EAGA,SAAS,SAAS,OAAwB;GACxC,IAAI,MAAM,QAAQ,KAAK,GACrB,KAAK,IAAI,QAAQ,MAAM,SAAS,GAAG,SAAS,GAAG,SAAS;IACtD,MAAM,OAAO,MAAM;IACnB,IAAI,OAAO,SAAS,YAAY,SAAS,QAAS,KAAiC,YAAY,KAAA,GAC7F,OAAO,OAAQ,KAAiC,OAAO;GAE3D;GAEF,OAAO;EACT;;EAGA,SAAgB,QAAQ,OAA0B;GAChD,MAAM,UAAU,aAAa,MAAM,MAAM,SAAS;GAClD,MAAM,MAAM,OAAO,QAAQ,UAAU,EAAE;GACvC,MAAM,SAAS,SAAS,MAAM,QAAQ,OAAO;GAC7C,MAAM,QAAQ,QAAQ,WAAW;GACjC,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;IAAK,OAAO;KAAE,YAAY;KAAa,UAAU;KAAU,YAAY;KAAqB,YAAY;KAAyB,cAAc;KAAG,UAAU;IAAS;IAArK,UAAA,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;KAAK,OAAO;MAAE,SAAS;MAAW,SAAS;KAAK;KAAhD,UAAA;MACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;OAAM,OAAO,EAAE,OAAO,UAAU;OAAI,UAAA,QAAQ,QAAQ;MAAW,CAAA;MAC9D;MACA;KACE;IACJ,CAAA,GAAA,WAAW,MACV,iBAAA,GAAA,kBAAA,IAAA,CAAC,OAAD;KAAK,OAAO;MAAE,QAAQ;MAAG,SAAS;MAAW,WAAW;MAAoC,YAAY;MAAY,WAAW;MAAK,WAAW;KAAO;KAAI,UAAA;IAAY,CAAA,CAErK;;EAET;;EAGA,MAAM,kBAA0C;GAC9C,UAAU;GACV,MAAM;GACN,QAAQ;GACR,KAAK;GACL,MAAM;EACR;EAEA,SAAgB,WAAW,OAA0B;GACnD,MAAM,UAAU,aAAa,MAAM,QAAQ,QAAQ,MAAM,QAAQ,OAAO;GACxE,MAAM,WAAW,OAAO,QAAQ,eAAe,MAAM,CAAC,CAAC,YAAY;GACnE,MAAM,QAAQ,gBAAgB,aAAa;GAC3C,MAAM,QAAQ,OAAO,QAAQ,YAAY,QAAQ,cAAc,SAAS;GACxE,MAAM,WAAW,OAAO,QAAQ,gBAAgB,EAAE;GAClD,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;IAAK,OAAO;KAAE,YAAY,aAAa;KAAS,SAAS;KAAW,cAAc;IAAE;IAApF,UAAA;KACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;MAAM,OAAO;OAAE;OAAO,YAAY;OAAK,eAAe;OAAa,UAAU;MAAQ;MAAI,UAAA;KAAe,CAAA;KACxG,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;MAAM,OAAO,EAAE,YAAY,EAAE;MAAI,UAAA;KAAY,CAAA;KAC5C,aAAa,MAAM,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;MAAM,OAAO;OAAE,YAAY;OAAG,SAAS;OAAK,UAAU;MAAS;MAAI,UAAA;KAAe,CAAA;IACnG;;EAET;;EAGA,SAAgB,aAAa,OAA0B;GACrD,MAAM,UAAU,aAAa,MAAM,MAAM,SAAS;GAClD,MAAM,OAAO,OAAO,QAAQ,WAAW,EAAE;GACzC,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;IAAK,OAAO;KAAE,YAAY;KAAqB,SAAS;KAAW,cAAc;KAAG,YAAY;KAAa,UAAU;IAAS;IAAhI,UAAA;KACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;MAAM,OAAO,EAAE,OAAO,UAAU;MAAG,UAAA;KAAgB,CAAA;KACnD,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;MAAM,OAAO;OAAE,YAAY;OAAG,SAAS;MAAK;MAAI,UAAA;KAAW,CAAA;KAC3D,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;MAAM,OAAO;OAAE,YAAY;OAAG,SAAS;OAAK,UAAU;MAAS;MAAG,UAAA;KAAkC,CAAA;IACjG;;EAET;;;;ECrFA,MAAa,KAAK;EAElB,MAAa,KAAK;GAChB,cAAc;GACd,iBAAiB;GACjB,oBAAoB;EACtB;EAIA,MAAa,KAAK;GAChB,cAAc;GACd,iBAAiB;GACjB,oBAAoB;EACtB;;;;ECIA,MAAa,SAAS,CAAC,SAAS,QAAQ;;EAGxC,SAAgB,MAAM,KAA0B;GAC9C,IAAI,aAAa,IAAI,OAAO,SAAS,IAAI;IAAE;IAAI;GAAG,CAAC,GAAG,0BAA0B;GAChF,IAAI,MAAM,OAAO,4BAA4B;IAC3C,IAAI,MAAM,SAAS;KAAE,MAAM;KAAsB,KAAK;KAAgB,QAAQ;IAAG,GAAG,OAAO;IAC3F,IAAI,MAAM,SAAS;KAAE,MAAM;KAAsB,KAAK;KAAc,QAAQ;IAAG,GAAG,YAAY;IAC9F,IAAI,MAAM,SAAS;KAAE,MAAM;KAAsB,KAAK;KAA+B,QAAQ;IAAG,GAAG,UAAU;IAC7G,IAAI,MAAM,SAAS;KAAE,MAAM;KAAsB,KAAK;KAA4B,QAAQ;IAAG,GAAG,UAAU;GAC5G,CAAC;EACH"}

package/lib/index.d.ts

@@ -0,0 +1,10 @@
+//#region src/index.d.ts
+var [apply] = [
+	0,
+	() => [],
+	[]
+];
+//#endregion
+export { apply };
+
+//# sourceMappingURL=index.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.ts","names":[],"sources":["../src/index.d.ts"],"sourcesContent":["/**\n * Pentest UI package, node half: the client half ships built artifacts via\n * exports[\"./client\"] and the dsh.client declaration; no host behavior.\n * @module @gpzhang2001/sharpkit-ui\n */\n/** No host-side behavior. */\nexport declare function apply(): void;\n"],"mappings":";AAAA,IAAW,CAAC,SAAS;CAAC;OAAS,CAAC;CAAG,CAAC;AAAC"}

package/lib/index.js

@@ -0,0 +1,12 @@
+//#region src/index.ts
+/**
+* Pentest UI package, node half: the client half ships built artifacts via
+* exports["./client"] and the dsh.client declaration; no host behavior.
+* @module @gpzhang2001/sharpkit-ui
+*/
+/** No host-side behavior. */
+function apply() {}
+//#endregion
+export { apply };
+
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["/**\n * Pentest UI package, node half: the client half ships built artifacts via\n * exports[\"./client\"] and the dsh.client declaration; no host behavior.\n * @module @gpzhang2001/sharpkit-ui\n */\n\n/** No host-side behavior. */\nexport function apply(): void {}\n"],"mappings":";;;;;;;AAOA,SAAgB,QAAc,CAAC"}

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@gpzhang2001/sharpkit-ui",
+  "description": "Pentest Web UI cards: keyed toolviews for exec/screenshots/findings + pentest locale dictionaries",
+  "version": "0.2.1",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/gpzhang2001/sharpkit.git",
+    "directory": "packages/ui"
+  },
+  "type": "module",
+  "license": "Apache-2.0",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./src/*": "./src/*",
+    "./client": "./lib/client.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "src",
+    "lib",
+    "LICENSE",
+    "THIRD_PARTY_NOTICES.md"
+  ],
+  "dsh": {
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-renderer"
+      ],
+      "platform": "web"
+    }
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.2",
+    "@deepseek-ai/dsh-client-locale": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-tool": "0.1.2-rc.1",
+    "@types/react": "~18.3.1",
+    "react": "^18.2.0",
+    "tsdown": "^0.22.2"
+  },
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "scripts": {
+    "build": "cp ../../LICENSE ../../THIRD_PARTY_NOTICES.md . && tsdown && mv -f lib/index.ts lib/index.d.ts && mv -f lib/index.ts.map lib/index.d.ts.map"
+  }
+}

package/src/client/PentestRows.tsx

@@ -0,0 +1,88 @@
+/**
+ * Pentest toolview cards, browser half (M5): presenter-derived, replay-safe
+ * rows keyed by wire tool name. Each card renders only from the durable
+ * call slice the slot owner passes — no I/O, no clock, no session reads
+ * (client discipline); malformed payloads fall back to the generic text.
+ */
+import type { ToolCallViewProps } from '@deepseek-ai/dsh-client-ui-tool/client'
+
+/** Best-effort JSON parse for durable call payloads. */
+function parsePayload(raw: unknown): Record<string, unknown> {
+  if (typeof raw !== 'string') return {}
+  try {
+    const parsed = JSON.parse(raw) as unknown
+    return typeof parsed === 'object' && parsed !== null ? parsed as Record<string, unknown> : {}
+  } catch {
+    return {}
+  }
+}
+
+/** Extract the newest text content from a result payload array. */
+function lastText(value: unknown): string {
+  if (Array.isArray(value)) {
+    for (let index = value.length - 1; index >= 0; index--) {
+      const item = value[index]
+      if (typeof item === 'object' && item !== null && (item as Record<string, unknown>)['text'] !== undefined) {
+        return String((item as Record<string, unknown>)['text'])
+      }
+    }
+  }
+  return ''
+}
+
+/** Terminal-style card for exec_command. */
+export function ExecRow(props: ToolCallViewProps) {
+  const payload = parsePayload(props.call?.arguments)
+  const cmd = String(payload['cmd'] ?? '')
+  const output = lastText(props.result?.content)
+  const isTTY = payload['tty'] === true
+  return (
+    <div style={{ fontFamily: 'monospace', fontSize: '0.86em', borderLeft: '3px solid #58b7ff', background: 'rgba(88,183,255,0.06)', borderRadius: 4, overflow: 'hidden' }}>
+      <div style={{ padding: '4px 8px', opacity: 0.85 }}>
+        <span style={{ color: '#58b7ff' }}>{isTTY ? 'pty' : 'sh'}</span>
+        {' $ '}
+        {cmd}
+      </div>
+      {output !== '' && (
+        <pre style={{ margin: 0, padding: '4px 8px', borderTop: '1px solid rgba(128,128,128,0.25)', whiteSpace: 'pre-wrap', maxHeight: 320, overflowY: 'auto' }}>{output}</pre>
+      )}
+    </div>
+  )
+}
+
+/** Severity-colored card for create_vulnerability_report / dependency findings. */
+const SEVERITY_COLORS: Record<string, string> = {
+  critical: '#e5534b',
+  high: '#e5863b',
+  medium: '#d4a72c',
+  low: '#57ab5a',
+  info: '#539bf5',
+}
+
+export function FindingRow(props: ToolCallViewProps) {
+  const payload = parsePayload(props.result?.meta ?? props.result?.content)
+  const severity = String(payload['severity'] ?? 'info').toLowerCase()
+  const color = SEVERITY_COLORS[severity] ?? '#539bf5'
+  const title = String(payload['title'] ?? payload['message'] ?? 'finding')
+  const reportId = String(payload['report_id'] ?? '')
+  return (
+    <div style={{ borderLeft: `3px solid ${color}`, padding: '4px 8px', borderRadius: 4 }}>
+      <span style={{ color, fontWeight: 600, textTransform: 'uppercase', fontSize: '0.8em' }}>{severity}</span>
+      <span style={{ marginLeft: 8 }}>{title}</span>
+      {reportId !== '' && <span style={{ marginLeft: 8, opacity: 0.5, fontSize: '0.85em' }}>{reportId}</span>}
+    </div>
+  )
+}
+
+/** Screenshot card for view_image. */
+export function ViewImageRow(props: ToolCallViewProps) {
+  const payload = parsePayload(props.call?.arguments)
+  const path = String(payload['path'] ?? '')
+  return (
+    <div style={{ borderLeft: '3px solid #8a7ff0', padding: '4px 8px', borderRadius: 4, fontFamily: 'monospace', fontSize: '0.86em' }}>
+      <span style={{ color: '#8a7ff0' }}>screenshot</span>
+      <span style={{ marginLeft: 8, opacity: 0.75 }}>{path}</span>
+      <span style={{ marginLeft: 8, opacity: 0.4, fontSize: '0.85em' }}>image attached to the result</span>
+    </div>
+  )
+}

package/src/client/index.ts

@@ -0,0 +1,32 @@
+/**
+ * Pentest UI, browser half (M5): keyed toolview cards for the wire tools
+ * (exec_command, view_image, create_vulnerability_report,
+ * create_dependency_report) plus the pentest locale dictionaries. Pure
+ * derivation from durable call slices — replay-safe by construction.
+ */
+import type { Context as ClientContext } from '@deepseek-ai/cordis'
+import type {} from '@deepseek-ai/dsh-client-locale/client'
+import type {} from '@deepseek-ai/dsh-client-ui-renderer/client'
+import { ExecRow, FindingRow, ViewImageRow } from './PentestRows.tsx'
+import { en, NS, zh, type PentestKey } from './locales.ts'
+
+declare module '@deepseek-ai/dsh-client-ui-slots' {
+  interface LocaleNamespaceMap {
+    /** The pentest toolview copy. */
+    pentest: PentestKey
+  }
+}
+
+/** Required client services: the slot registry and the locale registry. */
+export const inject = ['slots', 'locale']
+
+/** Client plugin body: register dictionaries and the keyed tool rows. */
+export function apply(ctx: ClientContext): void {
+  ctx.effect(() => ctx.locale.register(NS, { zh, en }), 'pentest-ui: dictionaries')
+  ctx.slots.inject('tool.call.toolview', () => {
+    ctx.slots.register({ name: 'tool.call.toolview', key: 'exec_command', locale: NS }, ExecRow)
+    ctx.slots.register({ name: 'tool.call.toolview', key: 'view_image', locale: NS }, ViewImageRow)
+    ctx.slots.register({ name: 'tool.call.toolview', key: 'create_vulnerability_report', locale: NS }, FindingRow)
+    ctx.slots.register({ name: 'tool.call.toolview', key: 'create_dependency_report', locale: NS }, FindingRow)
+  })
+}

package/src/client/locales.ts

@@ -0,0 +1,17 @@
+/** `pentest` namespace dictionaries (key-set source of truth: zh). */
+
+export const NS = 'pentest'
+
+export const zh = {
+  'exec.label': '沙箱命令',
+  'finding.label': '漏洞发现',
+  'screenshot.label': '截图',
+} satisfies Record<string, string>
+
+export type PentestKey = keyof typeof zh
+
+export const en = {
+  'exec.label': 'Sandbox command',
+  'finding.label': 'Finding',
+  'screenshot.label': 'Screenshot',
+} satisfies Record<PentestKey, string>

package/src/index.ts

@@ -0,0 +1,8 @@
+/**
+ * Pentest UI package, node half: the client half ships built artifacts via
+ * exports["./client"] and the dsh.client declaration; no host behavior.
+ * @module @gpzhang2001/sharpkit-ui
+ */
+
+/** No host-side behavior. */
+export function apply(): void {}