@lievclouds/dsh-cortex 0.3.4 → 0.3.9

package/index.js

@@ -41,14 +41,16 @@ export function apply(ctx, config) {
           name: 'dsh-cortex.tools',
           order: 500,
           text: [
-            '## Cortex (dsh-cortex plugin, no MCP needed)',
-            'The local Cortex database (schema v5) is available through native tools. The old `mcp__cortex__*` servers/skills are not required; prefer the `cortex_*` tools whenever the user mentions Cortex, 漏洞库/漏洞, 资产, 快照, 内网作战 or 记忆星云.',
-            '- Cortex findings: `cortex_list_vulns` / `cortex_get_vuln`; save with `cortex_save_vuln` (dedupe by host first).',
+            '## Cortex (dsh-cortex plugin, always active)',
+            'This plugin is installed and injects this guide automatically: the cortex_* tools below are available in every conversation without a skill or an MCP server.',
+            'When the user asks for ANY authorized penetration-testing work (渗透测试 / SRC / 漏洞挖掘 / 安全评估 / 资产与接口侦察 / 内网横向 / 漏洞复测), use the Cortex tools proactively instead of relying on memory:',
+            '- Reuse memory first: `cortex_list_snapshots` + `cortex_get_snapshot` for task progress, `cortex_list_vulns` + `cortex_get_asset` for existing findings/assets; `cortex_list_assets` before repeating recon.',
+            '- Persist confirmed findings: dedupe with `cortex_list_vulns`, then `cortex_save_vuln` (reproduction_steps in Markdown).',
+            '- Persist recon context: `cortex_sync_asset_info` (mode=merge) for fingerprints, interfaces (raw HTTP), leaks and test parameters.',
             '- Status / retest: `cortex_update_vuln_status`, `cortex_append_retest` (append-only, never overwrite original evidence).',
-            '- Assets: `cortex_list_assets`, `cortex_get_asset`, `cortex_sync_asset_info` (fingerprints, interfaces, leaks, test parameters).',
-            '- Snapshots / internal / nebula: `cortex_list_snapshots`, `cortex_get_snapshot`, `cortex_internal_overview`, `cortex_graph_summary`.',
-            'Examples that should call the tools: “列出 Cortex 里的高危漏洞”, “把刚才确认的漏洞写入 Cortex”, “把 127.0.0.1:8080 的接口同步到资产库”, “把 VULN-… 标记为已确认并追加复测结论”.',
-            'If a tools call fails, report the failure; never claim a record was stored without a successful result.',
+            '- Summaries: `cortex_internal_overview`, `cortex_graph_summary`.',
+            'Do not skip these calls merely because no skill was loaded. If a tool call fails, report the failure; never claim a record was saved without a successful result.',
+            'Examples: “列出 Cortex 里的高危漏洞”, “把刚才确认的漏洞写入 Cortex”, “把 127.0.0.1:8080 的接口同步到资产库”, “把 VULN-… 标记为已确认并追加复测结论”.',
           ].join('\n'),
         }),
       'dsh-cortex: usage prompt',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lievclouds/dsh-cortex",
-  "version": "0.3.4",
+  "version": "0.3.9",
   "description": "Cortex workbench for DeepSeek Harness: the original Cortex UI (vulnerabilities, assets, internal operations, Memory Nebula, snapshots, retest) as a native DSH panel, plus 12 native agent tools so DSH conversations use the local Cortex SQLite without MCP.",
   "type": "module",
   "main": "index.js",

package/src/cortex-ui/dsh/css-overrides.css

@@ -99,6 +99,14 @@
   border: 3px solid transparent;
 }
 
+/* DSH draws its native window buttons above the page in the top-right corner.
+   Right-hand inspector sheets start at the very top edge, so their header
+   actions (export / close) ended up underneath those buttons. Move every sheet
+   below that band; the overlay still dims the area behind it. */
+.dshc-cortex-root .sheet-content {
+  top: calc(0.875rem + 2.25rem);
+}
+
 /* ------------------------------------------------------------------------- */
 /* DSH shell adaptations                                                     */
 /* ------------------------------------------------------------------------- */

package/src/cortex-ui/renderer/components/asset/DeleteAssetDialog.tsx

@@ -2,6 +2,7 @@ import * as DialogPrimitive from '@radix-ui/react-dialog'
 import { Loader2, Trash2 } from 'lucide-react'
 import { Button } from '@renderer/components/ui/button'
 import { useI18n } from '@renderer/i18n'
+import { getPortalContainer } from '../../../dsh/portal'
 
 interface DeleteAssetDialogProps {
   open: boolean
@@ -27,8 +28,8 @@ export function DeleteAssetDialog({
   const { t } = useI18n()
 
   return (
-    <DialogPrimitive.Root open={open} onOpenChange={onOpenChange}>
-      <DialogPrimitive.Portal>
+    <DialogPrimitive.Root open={open} onOpenChange={onOpenChange} modal={false}>
+      <DialogPrimitive.Portal container={getPortalContainer()}>
         <DialogPrimitive.Overlay className="sheet-overlay fixed inset-0 z-[70] bg-[hsl(224_18%_10%/0.3)]" />
         <DialogPrimitive.Content className="fixed left-1/2 top-1/2 z-[70] w-[min(420px,calc(100vw-2rem))] -translate-x-1/2 -translate-y-1/2 rounded-xl border border-border bg-background p-5 shadow-panel focus:outline-none focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-ring">
           <DialogPrimitive.Title className="text-[16px] font-medium tracking-tight text-foreground">

package/src/cortex-ui/renderer/components/poc/PocConfigPanel.tsx

@@ -37,6 +37,7 @@ import { usePocErrorMessage } from '@renderer/components/poc/usePocErrorMessage'
 import { getApi } from '@renderer/lib/api'
 import { useI18n } from '@renderer/i18n'
 import { cn } from '@renderer/lib/utils'
+import { getPortalContainer } from '../../../dsh/portal'
 
 interface PocConfigPanelProps {
   open: boolean
@@ -122,8 +123,8 @@ export function PocConfigPanel({
       : null
 
   return (
-    <DialogPrimitive.Root open={open} onOpenChange={onOpenChange}>
-      <DialogPrimitive.Portal>
+    <DialogPrimitive.Root open={open} onOpenChange={onOpenChange} modal={false}>
+      <DialogPrimitive.Portal container={getPortalContainer()}>
         <DialogPrimitive.Overlay className="sheet-overlay fixed inset-0 z-[85] bg-[hsl(224_18%_10%/0.3)]" />
         <DialogPrimitive.Content
           data-testid="retest-config-panel"

package/src/cortex-ui/renderer/components/retest/RetestProxyDialog.tsx

@@ -5,6 +5,7 @@ import type { PocConfigView } from '@shared/poc'
 import { ProxySection } from '@renderer/components/poc/PocConfigPanel'
 import { useI18n } from '@renderer/i18n'
 import { getApi } from '@renderer/lib/api'
+import { getPortalContainer } from '../../../dsh/portal'
 
 interface RetestProxyDialogProps {
   open: boolean
@@ -43,8 +44,8 @@ export function RetestProxyDialog({ open, onOpenChange }: RetestProxyDialogProps
   }, [open, t])
 
   return (
-    <DialogPrimitive.Root open={open} onOpenChange={onOpenChange}>
-      <DialogPrimitive.Portal>
+    <DialogPrimitive.Root open={open} onOpenChange={onOpenChange} modal={false}>
+      <DialogPrimitive.Portal container={getPortalContainer()}>
         <DialogPrimitive.Overlay className="sheet-overlay fixed inset-0 z-[85] bg-[hsl(224_18%_10%/0.3)]" />
         <DialogPrimitive.Content className="sheet-content fixed left-1/2 top-1/2 z-[90] flex max-h-[88vh] w-[calc(100vw-32px)] max-w-[560px] -translate-x-1/2 -translate-y-1/2 flex-col overflow-hidden rounded-xl border border-border bg-background">
           <div className="flex shrink-0 items-start justify-between gap-3 border-b border-border px-5 py-4">

package/src/cortex-ui/renderer/components/snapshot/DeleteSnapshotDialog.tsx

@@ -6,6 +6,7 @@ import type { SnapshotSession } from '@shared/types'
 import { Button } from '@renderer/components/ui/button'
 import { apiUnavailableMessage, getApi, toErrorMessage } from '@renderer/lib/api'
 import { useI18n } from '@renderer/i18n'
+import { getPortalContainer } from '../../../dsh/portal'
 
 interface DeleteSnapshotDialogProps {
   open: boolean
@@ -56,13 +57,14 @@ export function DeleteSnapshotDialog({
   }
 
   return (
-    <DialogPrimitive.Root
+    <DialogPrimitive.Root
+      modal={false}
       open={open}
       onOpenChange={(next) => {
         if (!pending) onOpenChange(next)
       }}
     >
-      <DialogPrimitive.Portal>
+      <DialogPrimitive.Portal container={getPortalContainer()}>
         <DialogPrimitive.Overlay className="sheet-overlay fixed inset-0 z-[70] bg-[hsl(224_18%_10%/0.3)]" />
         <DialogPrimitive.Content className="fixed left-1/2 top-1/2 z-[70] w-[min(440px,calc(100vw-2rem))] -translate-x-1/2 -translate-y-1/2 rounded-xl border border-border bg-background p-5 shadow-panel focus:outline-none focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-ring">
           <DialogPrimitive.Title className="text-[16px] font-medium tracking-tight text-foreground">

package/src/cortex-ui/renderer/components/vuln/BulkDeleteDialog.tsx

@@ -2,6 +2,7 @@ import * as DialogPrimitive from '@radix-ui/react-dialog'
 import { Loader2, Trash2 } from 'lucide-react'
 import { Button } from '@renderer/components/ui/button'
 import { useI18n } from '@renderer/i18n'
+import { getPortalContainer } from '../../../dsh/portal'
 
 interface BulkDeleteDialogProps {
   open: boolean
@@ -22,8 +23,8 @@ export function BulkDeleteDialog({
   const { t } = useI18n()
 
   return (
-    <DialogPrimitive.Root open={open} onOpenChange={onOpenChange}>
-      <DialogPrimitive.Portal>
+    <DialogPrimitive.Root open={open} onOpenChange={onOpenChange} modal={false}>
+      <DialogPrimitive.Portal container={getPortalContainer()}>
         <DialogPrimitive.Overlay className="sheet-overlay fixed inset-0 z-[70] bg-[hsl(224_18%_10%/0.3)]" />
         <DialogPrimitive.Content className="fixed left-1/2 top-1/2 z-[70] w-[min(420px,calc(100vw-2rem))] -translate-x-1/2 -translate-y-1/2 rounded-xl border border-border bg-background p-5 shadow-panel focus:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-ring">
           <DialogPrimitive.Title className="text-[16px] font-medium tracking-tight text-foreground">

package/src/cortex-ui/renderer/components/vuln/ConfirmDeleteDialog.tsx

@@ -2,6 +2,7 @@ import * as DialogPrimitive from '@radix-ui/react-dialog'
 import { Loader2, Trash2 } from 'lucide-react'
 import { Button } from '@renderer/components/ui/button'
 import { useI18n } from '@renderer/i18n'
+import { getPortalContainer } from '../../../dsh/portal'
 
 interface ConfirmDeleteDialogProps {
   open: boolean
@@ -22,8 +23,8 @@ export function ConfirmDeleteDialog({
   const { t } = useI18n()
 
   return (
-    <DialogPrimitive.Root open={open} onOpenChange={onOpenChange}>
-      <DialogPrimitive.Portal>
+    <DialogPrimitive.Root open={open} onOpenChange={onOpenChange} modal={false}>
+      <DialogPrimitive.Portal container={getPortalContainer()}>
         <DialogPrimitive.Overlay className="sheet-overlay fixed inset-0 z-[70] bg-[hsl(224_18%_10%/0.3)]" />
         <DialogPrimitive.Content className="fixed left-1/2 top-1/2 z-[70] w-[min(420px,calc(100vw-2rem))] -translate-x-1/2 -translate-y-1/2 rounded-xl border border-border bg-background p-5 shadow-panel focus:outline-none focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-ring">
           <DialogPrimitive.Title className="text-[16px] font-medium tracking-tight text-foreground">

package/src/host/cortex/index.js

@@ -85,6 +85,9 @@ const ROUTES = [
 
   { pattern: /^\/snapshots$/, methods: { GET: snapshots.handleList } },
   { pattern: /^\/snapshots\/([^/]+)\/archive$/, methods: { POST: snapshots.handleArchive } },
+  // Both spellings exist: the vendored renderer's original Web API uses
+  // `/restore`, while the desktop contract names it `restore-previous`.
+  { pattern: /^\/snapshots\/([^/]+)\/restore$/, methods: { POST: snapshots.handleRestorePrevious } },
   {
     pattern: /^\/snapshots\/([^/]+)\/restore-previous$/,
     methods: { POST: snapshots.handleRestorePrevious },
@@ -132,19 +135,21 @@ function assertWriteFence(req, method) {
   }
   const headers = (req && req.headers) || {}
   const origin = headers.origin
+  const fetchSite = String(headers['sec-fetch-site'] || '').trim().toLowerCase()
   if (origin !== undefined && origin !== null && String(origin).trim().length > 0) {
     if (!isLoopbackOrigin(String(origin))) {
-      throw forbidden('FORBIDDEN_ORIGIN', 'write request origin is not allowed')
+      // DSH renders the plugin from the custom `dsh-app://app` origin; its
+      // same-origin DELETE carries `Sec-Fetch-Site: same-origin`, which is the
+      // signal we trust (a cross-site page would report cross-site).
+      if (fetchSite !== 'same-origin' && fetchSite !== 'none') {
+        throw forbidden('FORBIDDEN_ORIGIN', 'write request origin is not allowed')
+      }
     }
   }
-  const fetchSite = headers['sec-fetch-site']
-  if (fetchSite !== undefined && fetchSite !== null && String(fetchSite).trim().length > 0) {
-    const site = String(fetchSite).trim().toLowerCase()
-    if (site !== 'same-origin' && site !== 'none') {
-      throw forbidden('FORBIDDEN_ORIGIN', 'cross-site write requests are not allowed', {
-        header: 'Sec-Fetch-Site',
-      })
-    }
+  if (fetchSite.length > 0 && fetchSite !== 'same-origin' && fetchSite !== 'none') {
+    throw forbidden('FORBIDDEN_ORIGIN', 'cross-site write requests are not allowed', {
+      header: 'Sec-Fetch-Site',
+    })
   }
 }
 

package/src/host/http.js

@@ -135,7 +135,14 @@ export function assertSameOriginWrite(req) {
   const origin = headers.origin
   if (origin !== undefined && origin !== null && String(origin).trim().length > 0) {
     if (!isLoopbackOrigin(String(origin))) {
-      throw forbidden('FORBIDDEN_ORIGIN', 'write request origin is not allowed')
+      // The DSH page origin is the custom `dsh-app://app` scheme, not a
+      // loopback http(s) origin. Its same-origin fetch still carries
+      // `Sec-Fetch-Site: same-origin`; trust that rather than the scheme, so
+      // UI writes are not rejected while cross-site pages stay blocked.
+      const site = String(headers['sec-fetch-site'] || '').trim().toLowerCase()
+      if (site !== 'same-origin' && site !== 'none') {
+        throw forbidden('FORBIDDEN_ORIGIN', 'write request origin is not allowed')
+      }
     }
   }