@lievclouds/dsh-cortex 0.3.9 → 0.4.1

package/index.js

@@ -46,9 +46,12 @@ export function apply(ctx, config) {
             'When the user asks for ANY authorized penetration-testing work (渗透测试 / SRC / 漏洞挖掘 / 安全评估 / 资产与接口侦察 / 内网横向 / 漏洞复测), use the Cortex tools proactively instead of relying on memory:',
             '- Reuse memory first: `cortex_list_snapshots` + `cortex_get_snapshot` for task progress, `cortex_list_vulns` + `cortex_get_asset` for existing findings/assets; `cortex_list_assets` before repeating recon.',
             '- Persist confirmed findings: dedupe with `cortex_list_vulns`, then `cortex_save_vuln` (reproduction_steps in Markdown).',
-            '- Persist recon context: `cortex_sync_asset_info` (mode=merge) for fingerprints, interfaces (raw HTTP), leaks and test parameters.',
+            '- Persist recon context: `cortex_sync_asset_info` (mode=merge) for fingerprints, interfaces (canonical fields path/method/params/request), leaked_infos (info_type/value/source/potential_impact) and test_parameters (name/endpoint/location/values/source); aliases are normalized but the canonical shape is preferred.',
             '- Status / retest: `cortex_update_vuln_status`, `cortex_append_retest` (append-only, never overwrite original evidence).',
-            '- Summaries: `cortex_internal_overview`, `cortex_graph_summary`.',
+            '- Task progress (认知快照): at task milestones, before context compaction and at session end call `cortex_save_snapshot` (project, phase, targets, unfinished tasks, failed paths, tested interfaces, notes, next steps); pass session_id to update an existing snapshot.',
+            '- Project names: reuse the existing project string exactly (list the assets or the audit first). Variants such as `上海春芝堂 SRC` and `上海春芝堂_SRC` are merged defensively, but do not invent a new spelling.',
+            '- Data completeness is mandatory: before finishing a phase call `cortex_audit_completeness`, then fill every gap — every asset must carry interfaces (path/method/params/request), leaked_infos (info_type/value/source/potential_impact) and test_parameters (name/endpoint/location/values/source); every confirmed finding must be saved with Markdown reproduction_steps; internal hosts/services/footholds/credentials/pivots go through `cortex_sync_internal_scope`.',
+            '- Summaries / audit: `cortex_internal_overview`, `cortex_graph_summary`, `cortex_audit_completeness`.',
             'Do not skip these calls merely because no skill was loaded. If a tool call fails, report the failure; never claim a record was saved without a successful result.',
             'Examples: “列出 Cortex 里的高危漏洞”, “把刚才确认的漏洞写入 Cortex”, “把 127.0.0.1:8080 的接口同步到资产库”, “把 VULN-… 标记为已确认并追加复测结论”.',
           ].join('\n'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lievclouds/dsh-cortex",
-  "version": "0.3.9",
+  "version": "0.4.1",
   "description": "Cortex workbench for DeepSeek Harness: the original Cortex UI (vulnerabilities, assets, internal operations, Memory Nebula, snapshots, retest) as a native DSH panel, plus 12 native agent tools so DSH conversations use the local Cortex SQLite without MCP.",
   "type": "module",
   "main": "index.js",

package/src/cortex-ui/dsh/entry.tsx

@@ -1,6 +1,7 @@
 // Bundle entry for the ported Cortex UI. Built by esbuild into an IIFE global
 // (`__DSH_CORTEX_UI__`); the DSH wrapper client.js mounts it inside a Shadow DOM
 // so the original Tailwind stylesheet never touches the DSH shell.
+import { Component, type ReactNode } from 'react'
 import { createRoot } from 'react-dom/client'
 import App from '../renderer/App'
 import { setPortalContainer } from './portal'
@@ -9,6 +10,80 @@ export interface CortexUiHandle {
   destroy(): void
 }
 
+interface BoundaryState {
+  error: Error | null
+}
+
+/**
+ * Last line of defence: a render crash in any page used to unmount the whole
+ * React tree and leave a blank white panel. Show the error and a reload button
+ * instead so the failure is visible and recoverable.
+ */
+class CortexErrorBoundary extends Component<{ children: ReactNode }, BoundaryState> {
+  state: BoundaryState = { error: null }
+
+  static getDerivedStateFromError(error: Error): BoundaryState {
+    return { error }
+  }
+
+  componentDidCatch(error: Error): void {
+    console.error('[dsh-cortex] Cortex renderer crashed', error)
+  }
+
+  render(): ReactNode {
+    if (this.state.error === null) return this.props.children
+    return (
+      <div
+        style={{
+          display: 'flex',
+          flexDirection: 'column',
+          alignItems: 'center',
+          justifyContent: 'center',
+          gap: 12,
+          height: '100%',
+          padding: 24,
+          fontFamily: 'Inter, "Microsoft YaHei UI", sans-serif',
+          fontSize: 13,
+          color: '#334155',
+          background: '#f8fafc',
+        }}
+      >
+        <strong style={{ fontSize: 15 }}>Cortex 面板渲染失败</strong>
+        <pre
+          style={{
+            maxWidth: '90%',
+            maxHeight: '40vh',
+            overflow: 'auto',
+            whiteSpace: 'pre-wrap',
+            fontSize: 11.5,
+            padding: 10,
+            border: '1px solid #e2e8f0',
+            borderRadius: 8,
+            background: '#ffffff',
+            color: '#b91c1c',
+          }}
+        >
+          {String(this.state.error.message || this.state.error)}
+        </pre>
+        <button
+          type="button"
+          onClick={() => window.location.reload()}
+          style={{
+            padding: '6px 14px',
+            border: '1px solid #cbd5e1',
+            borderRadius: 6,
+            background: '#ffffff',
+            fontSize: 12,
+            cursor: 'pointer',
+          }}
+        >
+          重新加载页面
+        </button>
+      </div>
+    )
+  }
+}
+
 /**
  * Mount the original Cortex renderer into `host`.
  * `css` is the Tailwind build with fonts inlined as data URLs.
@@ -32,7 +107,11 @@ export function mount(host: HTMLElement, css: string): CortexUiHandle {
   document.documentElement.lang = document.documentElement.lang || 'zh-CN'
 
   const root = createRoot(rootElement)
-  root.render(<App />)
+  root.render(
+    <CortexErrorBoundary>
+      <App />
+    </CortexErrorBoundary>,
+  )
 
   return {
     destroy() {

package/src/cortex-ui/renderer/components/asset/AssetDetail.tsx

@@ -33,6 +33,8 @@ import { AssetInternalEntry, scopeForEntry } from '@renderer/components/internal
 import {
   INTERFACE_METHOD_STYLES,
   buildInterfaceRequest,
+  normalizeDisplayInterfaces,
+  normalizeDisplayTestParameters,
   techStackTags
 } from '@renderer/lib/assets'
 import { apiUnavailableMessage, getApi, toErrorMessage } from '@renderer/lib/api'
@@ -353,9 +355,9 @@ export function AssetDetail({
   }, [assetProjectName, dataVersion, retryKey, internalRetryKey, t])
 
   const interfaces = asset
-    ? (asset.interfaces ?? normalizeAssetInterfaces([], asset.interface_dir))
+    ? normalizeDisplayInterfaces(asset.interfaces ?? normalizeAssetInterfaces([], asset.interface_dir))
     : []
-  const testParameters = asset?.test_parameters ?? []
+  const testParameters = asset ? normalizeDisplayTestParameters(asset.test_parameters) : []
   const tags = asset ? techStackTags(asset.tech_stack) : []
   const internalScope =
     asset === null

package/src/cortex-ui/renderer/components/asset/TestParameterList.tsx

@@ -67,7 +67,9 @@ function TestParameterCard({
 }) {
   const { t, locationLabel } = useI18n()
   const { copied, copy } = useCopy()
-  const valuesText = testParameterValuesText(parameter.values)
+  const values = parameter.values ?? []
+  const relatedVulnIds = parameter.related_vuln_ids ?? []
+  const valuesText = testParameterValuesText(values)
 
   return (
     <article
@@ -120,11 +122,11 @@ function TestParameterCard({
         <div className="min-w-0">
           <p className="text-[11px] font-medium text-foreground/70">
             {t('asset.parameter.values')}
-            {parameter.values.length > 0 ? ` · ${parameter.values.length}` : ''}
+            {values.length > 0 ? ` · ${values.length}` : ''}
           </p>
-          {parameter.values.length > 0 ? (
+          {values.length > 0 ? (
             <div className="mt-1 flex flex-wrap gap-1">
-              {parameter.values.map((value, index) => (
+              {values.map((value, index) => (
                 <span
                   key={`${value}-${index}`}
                   data-testid="asset-test-parameter-value"
@@ -153,13 +155,13 @@ function TestParameterCard({
           />
         ) : null}
 
-        {parameter.related_vuln_ids.length > 0 ? (
+        {relatedVulnIds.length > 0 ? (
           <div className="min-w-0">
             <p className="text-[11px] font-medium text-foreground/70">
               {t('asset.parameter.relatedVulns')}
             </p>
             <div className="mt-1 flex flex-wrap gap-1.5">
-              {parameter.related_vuln_ids.map((vulnId) => (
+              {relatedVulnIds.map((vulnId) => (
                 <Button
                   key={vulnId}
                   variant="outline"

package/src/cortex-ui/renderer/lib/assets.ts

@@ -192,3 +192,121 @@ export function testParameterValuesText(values: readonly string[]): string {
     .filter((value) => value.length > 0)
     .join('\n')
 }
+
+/* ------------------------------------------------------------------------- */
+/* Defensive normalization for agent-written asset JSON                      */
+/* ------------------------------------------------------------------------- */
+
+/** Derive the query string / body from a captured raw HTTP request. */
+export function extractDisplayParamsFromRaw(raw: string | undefined): string {
+  const source = (raw ?? '').replace(/\r\n/g, '\n').trim()
+  if (source.length === 0) return ''
+  const lines = source.split('\n')
+  const requestLine = lines[0] ?? ''
+  const queryIndex = requestLine.indexOf('?')
+  const query = queryIndex >= 0 ? requestLine.slice(queryIndex).trim() : ''
+  const separator = source.indexOf('\n\n')
+  const body = separator >= 0 ? source.slice(separator + 2).trim() : ''
+  return [query, body].filter((part) => part.length > 0).join('\n')
+}
+
+/**
+ * The Host normalizes asset rows before serving them, but cached responses from
+ * older plugin builds (or an MCP-era database) may still contain aliases such as
+ * `raw` / `param` / `where` / `example`. Normalizing again in the renderer keeps
+ * the drawer and the memory graph crash-free instead of blanking the panel.
+ */
+export function normalizeDisplayInterfaces(raw: unknown): AssetInterface[] {
+  const list = Array.isArray(raw) ? raw : []
+  const result: AssetInterface[] = []
+  for (const value of list) {
+    if (typeof value === 'string') {
+      if (value.trim().length > 0) result.push({ path: value.trim() })
+      continue
+    }
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) continue
+    const item = value as Record<string, unknown>
+    const path = [item.path, item.url, item.route, item.endpoint]
+      .map((entry) => (typeof entry === 'string' ? entry.trim() : ''))
+      .find((entry) => entry.length > 0)
+    if (!path) continue
+    const entry: AssetInterface = { path }
+    const method = typeof item.method === 'string' ? item.method.trim().toUpperCase() : ''
+    if ((INTERFACE_METHOD_STYLES as Record<string, string>)[method]) {
+      entry.method = method as AssetInterface['method']
+    }
+    const request = [item.request, item.raw, item.http]
+      .map((candidate) => (typeof candidate === 'string' ? candidate : ''))
+      .find((candidate) => candidate.trim().length > 0)
+    const params =
+      [item.params, item.parameters, item.query, item.data]
+        .map((candidate) => (typeof candidate === 'string' ? candidate.trim() : ''))
+        .find((candidate) => candidate.length > 0) || extractDisplayParamsFromRaw(request)
+    if (params) entry.params = params
+    if (request) entry.request = request
+    result.push(entry)
+  }
+  return result
+}
+
+/** Canonical test-parameter candidates from aliased agent records. */
+export function normalizeDisplayTestParameters(raw: unknown): TestParameterCandidate[] {
+  const list = Array.isArray(raw) ? raw : []
+  const result: TestParameterCandidate[] = []
+  const seen = new Set<string>()
+  for (const value of list) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) continue
+    const item = value as Record<string, unknown>
+    const pickText = (names: string[]): string => {
+      for (const name of names) {
+        const candidate = item[name]
+        if (typeof candidate === 'string' && candidate.trim().length > 0) return candidate.trim()
+      }
+      return ''
+    }
+    const name = pickText(['name', 'param', 'key'])
+    const endpoint = pickText(['endpoint', 'interface', 'api', 'path'])
+    const rawValues = Array.isArray(item.values) ? item.values : []
+    const values = (rawValues.length > 0 ? rawValues : [pickText(['example', 'value', 'sample'])])
+      .filter((entry): entry is string | number => typeof entry === 'string' || typeof entry === 'number')
+      .map(String)
+      .slice(0, 50)
+    if (name.length === 0 && endpoint.length === 0 && values.length === 0) continue
+    const locationRaw = pickText(['location', 'where', 'in']).toLowerCase()
+    const locationAliases: Record<string, string> = {
+      json: 'body',
+      form: 'body',
+      formdata: 'body',
+      post: 'body',
+      querystring: 'query',
+      url: 'query',
+      headers: 'header',
+      cookies: 'cookie',
+    }
+    const mappedLocation = locationAliases[locationRaw] || locationRaw
+    const location = (
+      ['path', 'query', 'body', 'header', 'cookie'].includes(mappedLocation) ? mappedLocation : 'query'
+    ) as TestParameterCandidate['location']
+    const source = pickText(['source', 'file', 'interface', 'endpoint']) || endpoint || '(unknown)'
+    const key = `${endpoint}\u0000${name}\u0000${location}`
+    if (seen.has(key)) continue
+    seen.add(key)
+    const entry: TestParameterCandidate = {
+      name: name || 'value',
+      endpoint: endpoint || source || '(unknown)',
+      location,
+      values,
+      source,
+      tested: item.tested === true,
+      related_vuln_ids: Array.isArray(item.related_vuln_ids)
+        ? item.related_vuln_ids.filter((entry): entry is string => typeof entry === 'string')
+        : [],
+    }
+    const pattern = pickText(['pattern'])
+    if (pattern) entry.pattern = pattern
+    const notes = pickText(['notes', 'note'])
+    if (notes) entry.notes = notes
+    result.push(entry)
+  }
+  return result
+}

package/src/host/cortex/assets.js

@@ -21,6 +21,12 @@ import {
   sendJson,
 } from '../http.js'
 import { jsonArray, likePattern, text, vulnListItem } from './vulns.js'
+import {
+  normalizeInterfaces,
+  normalizeLeaks,
+  normalizeProjectName,
+  normalizeTestParameters,
+} from './normalize-asset.js'
 
 const ASSET_STATUSES = ['Alive', 'Dead', 'WAF_Blocked']
 const HTTP_METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS', 'HEAD']
@@ -51,71 +57,22 @@ function bool01(value) {
 }
 
 /**
- * Normalize stored `interfaces` to the shared `AssetInterface[]` shape.
- * @param {unknown} raw
+ * Normalize stored asset JSON to the canonical shared shapes. Agent-written
+ * records may use aliases (raw/request, type/file, param/where/example); the
+ * shared normalizers keep the drawer and the memory graph crash-free.
  */
 function interfaceList(raw) {
-  const out = []
-  for (const item of jsonArray(raw)) {
-    if (typeof item === 'string') {
-      if (item.trim().length > 0) out.push({ path: item.trim() })
-      continue
-    }
-    if (item === null || typeof item !== 'object' || Array.isArray(item)) continue
-    const path = text(item.path).trim()
-    if (path.length === 0) continue
-    /** @type {Record<string, any>} */
-    const entry = { path }
-    if (typeof item.method === 'string' && HTTP_METHODS.includes(item.method)) entry.method = item.method
-    if (typeof item.params === 'string' && item.params.length > 0) entry.params = item.params
-    if (typeof item.request === 'string' && item.request.length > 0) entry.request = item.request
-    out.push(entry)
-  }
-  return out
+  return normalizeInterfaces(raw)
 }
 
 /** @param {unknown} raw */
 function leakedInfoList(raw) {
-  const out = []
-  for (const item of jsonArray(raw)) {
-    if (item === null || typeof item !== 'object' || Array.isArray(item)) continue
-    const infoType = text(item.info_type ?? item.infoType)
-    out.push({
-      info_type: LEAKED_INFO_TYPES.includes(infoType) ? infoType : 'Other',
-      value: text(item.value),
-      source: text(item.source),
-      potential_impact: text(item.potential_impact ?? item.potentialImpact),
-    })
-  }
-  return out
+  return normalizeLeaks(raw)
 }
 
 /** @param {unknown} raw */
 function testParameterList(raw) {
-  const out = []
-  for (const item of jsonArray(raw)) {
-    if (item === null || typeof item !== 'object' || Array.isArray(item)) continue
-    const location = text(item.location)
-    /** @type {Record<string, any>} */
-    const entry = {
-      name: text(item.name),
-      endpoint: text(item.endpoint),
-      location: TEST_PARAMETER_LOCATIONS.includes(location) ? location : 'query',
-      values: jsonArray(item.values)
-        .filter((value) => typeof value === 'string' || typeof value === 'number')
-        .map((value) => String(value)),
-      source: text(item.source),
-      tested: item.tested === true,
-    }
-    if (typeof item.pattern === 'string' && item.pattern.length > 0) entry.pattern = item.pattern
-    if (typeof item.notes === 'string' && item.notes.length > 0) entry.notes = item.notes
-    const related = jsonArray(item.related_vuln_ids ?? item.relatedVulnIds).filter(
-      (value) => typeof value === 'string',
-    )
-    if (related.length > 0) entry.related_vuln_ids = related
-    out.push(entry)
-  }
-  return out
+  return normalizeTestParameters(raw)
 }
 
 /**
@@ -153,7 +110,7 @@ function assetListItem(row) {
   return {
     host_port: text(source.host_port),
     host: text(source.host),
-    project_name: text(source.project_name),
+    project_name: normalizeProjectName(text(source.project_name)),
     tech_stack: text(source.tech_stack),
     auth_required: bool01(source.auth_required),
     status: ASSET_STATUSES.includes(text(source.status)) ? text(source.status) : 'Alive',
@@ -173,7 +130,7 @@ function assetContext(row) {
   return {
     host_port: text(source.host_port),
     host: text(source.host),
-    project_name: text(source.project_name),
+    project_name: normalizeProjectName(text(source.project_name)),
     tech_stack: text(source.tech_stack),
     auth_required: bool01(source.auth_required),
     status: ASSET_STATUSES.includes(text(source.status)) ? text(source.status) : 'Alive',