@lievclouds/dsh-cortex 0.3.6 → 0.3.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lievclouds/dsh-cortex",
-  "version": "0.3.6",
+  "version": "0.3.9",
   "description": "Cortex workbench for DeepSeek Harness: the original Cortex UI (vulnerabilities, assets, internal operations, Memory Nebula, snapshots, retest) as a native DSH panel, plus 12 native agent tools so DSH conversations use the local Cortex SQLite without MCP.",
   "type": "module",
   "main": "index.js",

package/src/cortex-ui/renderer/components/asset/DeleteAssetDialog.tsx

@@ -2,6 +2,7 @@ import * as DialogPrimitive from '@radix-ui/react-dialog'
 import { Loader2, Trash2 } from 'lucide-react'
 import { Button } from '@renderer/components/ui/button'
 import { useI18n } from '@renderer/i18n'
+import { getPortalContainer } from '../../../dsh/portal'
 
 interface DeleteAssetDialogProps {
   open: boolean
@@ -27,8 +28,8 @@ export function DeleteAssetDialog({
   const { t } = useI18n()
 
   return (
-    <DialogPrimitive.Root open={open} onOpenChange={onOpenChange}>
-      <DialogPrimitive.Portal>
+    <DialogPrimitive.Root open={open} onOpenChange={onOpenChange} modal={false}>
+      <DialogPrimitive.Portal container={getPortalContainer()}>
         <DialogPrimitive.Overlay className="sheet-overlay fixed inset-0 z-[70] bg-[hsl(224_18%_10%/0.3)]" />
         <DialogPrimitive.Content className="fixed left-1/2 top-1/2 z-[70] w-[min(420px,calc(100vw-2rem))] -translate-x-1/2 -translate-y-1/2 rounded-xl border border-border bg-background p-5 shadow-panel focus:outline-none focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-ring">
           <DialogPrimitive.Title className="text-[16px] font-medium tracking-tight text-foreground">

package/src/cortex-ui/renderer/components/poc/PocConfigPanel.tsx

@@ -37,6 +37,7 @@ import { usePocErrorMessage } from '@renderer/components/poc/usePocErrorMessage'
 import { getApi } from '@renderer/lib/api'
 import { useI18n } from '@renderer/i18n'
 import { cn } from '@renderer/lib/utils'
+import { getPortalContainer } from '../../../dsh/portal'
 
 interface PocConfigPanelProps {
   open: boolean
@@ -122,8 +123,8 @@ export function PocConfigPanel({
       : null
 
   return (
-    <DialogPrimitive.Root open={open} onOpenChange={onOpenChange}>
-      <DialogPrimitive.Portal>
+    <DialogPrimitive.Root open={open} onOpenChange={onOpenChange} modal={false}>
+      <DialogPrimitive.Portal container={getPortalContainer()}>
         <DialogPrimitive.Overlay className="sheet-overlay fixed inset-0 z-[85] bg-[hsl(224_18%_10%/0.3)]" />
         <DialogPrimitive.Content
           data-testid="retest-config-panel"

package/src/cortex-ui/renderer/components/retest/RetestProxyDialog.tsx

@@ -5,6 +5,7 @@ import type { PocConfigView } from '@shared/poc'
 import { ProxySection } from '@renderer/components/poc/PocConfigPanel'
 import { useI18n } from '@renderer/i18n'
 import { getApi } from '@renderer/lib/api'
+import { getPortalContainer } from '../../../dsh/portal'
 
 interface RetestProxyDialogProps {
   open: boolean
@@ -43,8 +44,8 @@ export function RetestProxyDialog({ open, onOpenChange }: RetestProxyDialogProps
   }, [open, t])
 
   return (
-    <DialogPrimitive.Root open={open} onOpenChange={onOpenChange}>
-      <DialogPrimitive.Portal>
+    <DialogPrimitive.Root open={open} onOpenChange={onOpenChange} modal={false}>
+      <DialogPrimitive.Portal container={getPortalContainer()}>
         <DialogPrimitive.Overlay className="sheet-overlay fixed inset-0 z-[85] bg-[hsl(224_18%_10%/0.3)]" />
         <DialogPrimitive.Content className="sheet-content fixed left-1/2 top-1/2 z-[90] flex max-h-[88vh] w-[calc(100vw-32px)] max-w-[560px] -translate-x-1/2 -translate-y-1/2 flex-col overflow-hidden rounded-xl border border-border bg-background">
           <div className="flex shrink-0 items-start justify-between gap-3 border-b border-border px-5 py-4">

package/src/cortex-ui/renderer/components/snapshot/DeleteSnapshotDialog.tsx

@@ -6,6 +6,7 @@ import type { SnapshotSession } from '@shared/types'
 import { Button } from '@renderer/components/ui/button'
 import { apiUnavailableMessage, getApi, toErrorMessage } from '@renderer/lib/api'
 import { useI18n } from '@renderer/i18n'
+import { getPortalContainer } from '../../../dsh/portal'
 
 interface DeleteSnapshotDialogProps {
   open: boolean
@@ -56,13 +57,14 @@ export function DeleteSnapshotDialog({
   }
 
   return (
-    <DialogPrimitive.Root
+    <DialogPrimitive.Root
+      modal={false}
       open={open}
       onOpenChange={(next) => {
         if (!pending) onOpenChange(next)
       }}
     >
-      <DialogPrimitive.Portal>
+      <DialogPrimitive.Portal container={getPortalContainer()}>
         <DialogPrimitive.Overlay className="sheet-overlay fixed inset-0 z-[70] bg-[hsl(224_18%_10%/0.3)]" />
         <DialogPrimitive.Content className="fixed left-1/2 top-1/2 z-[70] w-[min(440px,calc(100vw-2rem))] -translate-x-1/2 -translate-y-1/2 rounded-xl border border-border bg-background p-5 shadow-panel focus:outline-none focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-ring">
           <DialogPrimitive.Title className="text-[16px] font-medium tracking-tight text-foreground">

package/src/cortex-ui/renderer/components/vuln/BulkDeleteDialog.tsx

@@ -2,6 +2,7 @@ import * as DialogPrimitive from '@radix-ui/react-dialog'
 import { Loader2, Trash2 } from 'lucide-react'
 import { Button } from '@renderer/components/ui/button'
 import { useI18n } from '@renderer/i18n'
+import { getPortalContainer } from '../../../dsh/portal'
 
 interface BulkDeleteDialogProps {
   open: boolean
@@ -22,8 +23,8 @@ export function BulkDeleteDialog({
   const { t } = useI18n()
 
   return (
-    <DialogPrimitive.Root open={open} onOpenChange={onOpenChange}>
-      <DialogPrimitive.Portal>
+    <DialogPrimitive.Root open={open} onOpenChange={onOpenChange} modal={false}>
+      <DialogPrimitive.Portal container={getPortalContainer()}>
         <DialogPrimitive.Overlay className="sheet-overlay fixed inset-0 z-[70] bg-[hsl(224_18%_10%/0.3)]" />
         <DialogPrimitive.Content className="fixed left-1/2 top-1/2 z-[70] w-[min(420px,calc(100vw-2rem))] -translate-x-1/2 -translate-y-1/2 rounded-xl border border-border bg-background p-5 shadow-panel focus:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-ring">
           <DialogPrimitive.Title className="text-[16px] font-medium tracking-tight text-foreground">

package/src/cortex-ui/renderer/components/vuln/ConfirmDeleteDialog.tsx

@@ -2,6 +2,7 @@ import * as DialogPrimitive from '@radix-ui/react-dialog'
 import { Loader2, Trash2 } from 'lucide-react'
 import { Button } from '@renderer/components/ui/button'
 import { useI18n } from '@renderer/i18n'
+import { getPortalContainer } from '../../../dsh/portal'
 
 interface ConfirmDeleteDialogProps {
   open: boolean
@@ -22,8 +23,8 @@ export function ConfirmDeleteDialog({
   const { t } = useI18n()
 
   return (
-    <DialogPrimitive.Root open={open} onOpenChange={onOpenChange}>
-      <DialogPrimitive.Portal>
+    <DialogPrimitive.Root open={open} onOpenChange={onOpenChange} modal={false}>
+      <DialogPrimitive.Portal container={getPortalContainer()}>
         <DialogPrimitive.Overlay className="sheet-overlay fixed inset-0 z-[70] bg-[hsl(224_18%_10%/0.3)]" />
         <DialogPrimitive.Content className="fixed left-1/2 top-1/2 z-[70] w-[min(420px,calc(100vw-2rem))] -translate-x-1/2 -translate-y-1/2 rounded-xl border border-border bg-background p-5 shadow-panel focus:outline-none focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-ring">
           <DialogPrimitive.Title className="text-[16px] font-medium tracking-tight text-foreground">

package/src/host/cortex/index.js

@@ -85,6 +85,9 @@ const ROUTES = [
 
   { pattern: /^\/snapshots$/, methods: { GET: snapshots.handleList } },
   { pattern: /^\/snapshots\/([^/]+)\/archive$/, methods: { POST: snapshots.handleArchive } },
+  // Both spellings exist: the vendored renderer's original Web API uses
+  // `/restore`, while the desktop contract names it `restore-previous`.
+  { pattern: /^\/snapshots\/([^/]+)\/restore$/, methods: { POST: snapshots.handleRestorePrevious } },
   {
     pattern: /^\/snapshots\/([^/]+)\/restore-previous$/,
     methods: { POST: snapshots.handleRestorePrevious },
@@ -132,19 +135,21 @@ function assertWriteFence(req, method) {
   }
   const headers = (req && req.headers) || {}
   const origin = headers.origin
+  const fetchSite = String(headers['sec-fetch-site'] || '').trim().toLowerCase()
   if (origin !== undefined && origin !== null && String(origin).trim().length > 0) {
     if (!isLoopbackOrigin(String(origin))) {
-      throw forbidden('FORBIDDEN_ORIGIN', 'write request origin is not allowed')
+      // DSH renders the plugin from the custom `dsh-app://app` origin; its
+      // same-origin DELETE carries `Sec-Fetch-Site: same-origin`, which is the
+      // signal we trust (a cross-site page would report cross-site).
+      if (fetchSite !== 'same-origin' && fetchSite !== 'none') {
+        throw forbidden('FORBIDDEN_ORIGIN', 'write request origin is not allowed')
+      }
     }
   }
-  const fetchSite = headers['sec-fetch-site']
-  if (fetchSite !== undefined && fetchSite !== null && String(fetchSite).trim().length > 0) {
-    const site = String(fetchSite).trim().toLowerCase()
-    if (site !== 'same-origin' && site !== 'none') {
-      throw forbidden('FORBIDDEN_ORIGIN', 'cross-site write requests are not allowed', {
-        header: 'Sec-Fetch-Site',
-      })
-    }
+  if (fetchSite.length > 0 && fetchSite !== 'same-origin' && fetchSite !== 'none') {
+    throw forbidden('FORBIDDEN_ORIGIN', 'cross-site write requests are not allowed', {
+      header: 'Sec-Fetch-Site',
+    })
   }
 }
 

package/src/host/http.js

@@ -135,7 +135,14 @@ export function assertSameOriginWrite(req) {
   const origin = headers.origin
   if (origin !== undefined && origin !== null && String(origin).trim().length > 0) {
     if (!isLoopbackOrigin(String(origin))) {
-      throw forbidden('FORBIDDEN_ORIGIN', 'write request origin is not allowed')
+      // The DSH page origin is the custom `dsh-app://app` scheme, not a
+      // loopback http(s) origin. Its same-origin fetch still carries
+      // `Sec-Fetch-Site: same-origin`; trust that rather than the scheme, so
+      // UI writes are not rejected while cross-site pages stay blocked.
+      const site = String(headers['sec-fetch-site'] || '').trim().toLowerCase()
+      if (site !== 'same-origin' && site !== 'none') {
+        throw forbidden('FORBIDDEN_ORIGIN', 'write request origin is not allowed')
+      }
     }
   }