@lievclouds/dsh-cortex 0.3.9 → 0.4.2

package/index.js

@@ -46,9 +46,12 @@ export function apply(ctx, config) {
             'When the user asks for ANY authorized penetration-testing work (渗透测试 / SRC / 漏洞挖掘 / 安全评估 / 资产与接口侦察 / 内网横向 / 漏洞复测), use the Cortex tools proactively instead of relying on memory:',
             '- Reuse memory first: `cortex_list_snapshots` + `cortex_get_snapshot` for task progress, `cortex_list_vulns` + `cortex_get_asset` for existing findings/assets; `cortex_list_assets` before repeating recon.',
             '- Persist confirmed findings: dedupe with `cortex_list_vulns`, then `cortex_save_vuln` (reproduction_steps in Markdown).',
-            '- Persist recon context: `cortex_sync_asset_info` (mode=merge) for fingerprints, interfaces (raw HTTP), leaks and test parameters.',
+            '- Persist recon context: `cortex_sync_asset_info` (mode=merge) for fingerprints, interfaces (canonical fields path/method/params/request), leaked_infos (info_type/value/source/potential_impact) and test_parameters (name/endpoint/location/values/source); aliases are normalized but the canonical shape is preferred.',
             '- Status / retest: `cortex_update_vuln_status`, `cortex_append_retest` (append-only, never overwrite original evidence).',
-            '- Summaries: `cortex_internal_overview`, `cortex_graph_summary`.',
+            '- Task progress (认知快照): at task milestones, before context compaction and at session end call `cortex_save_snapshot` (project, phase, targets, unfinished tasks, failed paths, tested interfaces, notes, next steps); pass session_id to update an existing snapshot.',
+            '- Project names: reuse the existing project string exactly (list the assets or the audit first). Variants such as `上海春芝堂 SRC` and `上海春芝堂_SRC` are merged defensively, but do not invent a new spelling.',
+            '- Data completeness is mandatory: before finishing a phase call `cortex_audit_completeness`, then fill every gap — every asset must carry interfaces (path/method/params/request), leaked_infos (info_type/value/source/potential_impact) and test_parameters (name/endpoint/location/values/source); every confirmed finding must be saved with Markdown reproduction_steps; internal hosts/services/footholds/credentials/pivots go through `cortex_sync_internal_scope`.',
+            '- Summaries / audit: `cortex_internal_overview`, `cortex_graph_summary`, `cortex_audit_completeness`.',
             'Do not skip these calls merely because no skill was loaded. If a tool call fails, report the failure; never claim a record was saved without a successful result.',
             'Examples: “列出 Cortex 里的高危漏洞”, “把刚才确认的漏洞写入 Cortex”, “把 127.0.0.1:8080 的接口同步到资产库”, “把 VULN-… 标记为已确认并追加复测结论”.',
           ].join('\n'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lievclouds/dsh-cortex",
-  "version": "0.3.9",
+  "version": "0.4.2",
   "description": "Cortex workbench for DeepSeek Harness: the original Cortex UI (vulnerabilities, assets, internal operations, Memory Nebula, snapshots, retest) as a native DSH panel, plus 12 native agent tools so DSH conversations use the local Cortex SQLite without MCP.",
   "type": "module",
   "main": "index.js",

package/src/cortex-ui/dsh/api.ts

@@ -112,7 +112,16 @@ export function createCortexApi(): CortexApi {
       patch(`/vulns/${encodeURIComponent(input.id)}/status`, { status: input.status }),
     deleteVulnerability: (id) => del(`/vulns/${encodeURIComponent(id)}`),
     deleteVulnerabilities: (ids) => post('/vulns/delete-many', { ids }),
-    exportVulnerabilities: (ids) => post('/vulns/export', { ids }),
+    exportVulnerabilities: async (ids) => {
+      const response = await post('/vulns/export', { ids })
+      const files = Array.isArray(response?.files) ? response.files : []
+      const savedPaths = Array.isArray(response?.savedPaths) ? response.savedPaths : []
+      return {
+        cancelled: response?.cancelled === true || files.length === 0,
+        files: files.map((file) => (file && typeof file.filename === 'string' ? file.filename : String(file))),
+        savedPaths: savedPaths.filter((path) => typeof path === 'string'),
+      }
+    },
 
     // ---------------------------------------------------------------- assets
     listAssets: (filters) => get('/assets', filters as Record<string, unknown>),

package/src/cortex-ui/dsh/entry.tsx

@@ -1,6 +1,7 @@
 // Bundle entry for the ported Cortex UI. Built by esbuild into an IIFE global
 // (`__DSH_CORTEX_UI__`); the DSH wrapper client.js mounts it inside a Shadow DOM
 // so the original Tailwind stylesheet never touches the DSH shell.
+import { Component, type ReactNode } from 'react'
 import { createRoot } from 'react-dom/client'
 import App from '../renderer/App'
 import { setPortalContainer } from './portal'
@@ -9,6 +10,80 @@ export interface CortexUiHandle {
   destroy(): void
 }
 
+interface BoundaryState {
+  error: Error | null
+}
+
+/**
+ * Last line of defence: a render crash in any page used to unmount the whole
+ * React tree and leave a blank white panel. Show the error and a reload button
+ * instead so the failure is visible and recoverable.
+ */
+class CortexErrorBoundary extends Component<{ children: ReactNode }, BoundaryState> {
+  state: BoundaryState = { error: null }
+
+  static getDerivedStateFromError(error: Error): BoundaryState {
+    return { error }
+  }
+
+  componentDidCatch(error: Error): void {
+    console.error('[dsh-cortex] Cortex renderer crashed', error)
+  }
+
+  render(): ReactNode {
+    if (this.state.error === null) return this.props.children
+    return (
+      <div
+        style={{
+          display: 'flex',
+          flexDirection: 'column',
+          alignItems: 'center',
+          justifyContent: 'center',
+          gap: 12,
+          height: '100%',
+          padding: 24,
+          fontFamily: 'Inter, "Microsoft YaHei UI", sans-serif',
+          fontSize: 13,
+          color: '#334155',
+          background: '#f8fafc',
+        }}
+      >
+        <strong style={{ fontSize: 15 }}>Cortex 面板渲染失败</strong>
+        <pre
+          style={{
+            maxWidth: '90%',
+            maxHeight: '40vh',
+            overflow: 'auto',
+            whiteSpace: 'pre-wrap',
+            fontSize: 11.5,
+            padding: 10,
+            border: '1px solid #e2e8f0',
+            borderRadius: 8,
+            background: '#ffffff',
+            color: '#b91c1c',
+          }}
+        >
+          {String(this.state.error.message || this.state.error)}
+        </pre>
+        <button
+          type="button"
+          onClick={() => window.location.reload()}
+          style={{
+            padding: '6px 14px',
+            border: '1px solid #cbd5e1',
+            borderRadius: 6,
+            background: '#ffffff',
+            fontSize: 12,
+            cursor: 'pointer',
+          }}
+        >
+          重新加载页面
+        </button>
+      </div>
+    )
+  }
+}
+
 /**
  * Mount the original Cortex renderer into `host`.
  * `css` is the Tailwind build with fonts inlined as data URLs.
@@ -32,7 +107,11 @@ export function mount(host: HTMLElement, css: string): CortexUiHandle {
   document.documentElement.lang = document.documentElement.lang || 'zh-CN'
 
   const root = createRoot(rootElement)
-  root.render(<App />)
+  root.render(
+    <CortexErrorBoundary>
+      <App />
+    </CortexErrorBoundary>,
+  )
 
   return {
     destroy() {

package/src/cortex-ui/renderer/components/asset/AssetDetail.tsx

@@ -33,6 +33,8 @@ import { AssetInternalEntry, scopeForEntry } from '@renderer/components/internal
 import {
   INTERFACE_METHOD_STYLES,
   buildInterfaceRequest,
+  normalizeDisplayInterfaces,
+  normalizeDisplayTestParameters,
   techStackTags
 } from '@renderer/lib/assets'
 import { apiUnavailableMessage, getApi, toErrorMessage } from '@renderer/lib/api'
@@ -353,9 +355,9 @@ export function AssetDetail({
   }, [assetProjectName, dataVersion, retryKey, internalRetryKey, t])
 
   const interfaces = asset
-    ? (asset.interfaces ?? normalizeAssetInterfaces([], asset.interface_dir))
+    ? normalizeDisplayInterfaces(asset.interfaces ?? normalizeAssetInterfaces([], asset.interface_dir))
     : []
-  const testParameters = asset?.test_parameters ?? []
+  const testParameters = asset ? normalizeDisplayTestParameters(asset.test_parameters) : []
   const tags = asset ? techStackTags(asset.tech_stack) : []
   const internalScope =
     asset === null

package/src/cortex-ui/renderer/components/asset/AssetTable.tsx

@@ -23,12 +23,15 @@ interface AssetTableProps {
 const thBase =
   'sticky top-0 z-10 border-b border-border bg-background px-3 py-2 text-left text-[11px] font-medium text-foreground/70'
 
-/** Table cells share the hairline bottom border; the last row drops it. */
+/** Table cells share a fixed row height and the hairline bottom border. */
 function cellClass(last: boolean, extra?: string): string {
-  return cn('border-b border-border px-3 py-2.5 align-middle', last && 'border-b-0', extra)
+  return cn('h-14 border-b border-border px-3 py-2 align-middle', last && 'border-b-0', extra)
 }
 
-/** Technology fingerprints render as one complete chip per technology. */
+/**
+ * Fixed single-line fingerprint summary: list rows keep one constant height, so
+ * a long stack is clipped with an ellipsis instead of growing the row.
+ */
 function TechStackTags({ techStack }: { techStack: string }) {
   const { t } = useI18n()
   const tags = techStackTags(techStack)
@@ -36,23 +39,14 @@ function TechStackTags({ techStack }: { techStack: string }) {
     return <span className="text-[11px] text-muted-foreground">{t('asset.value.notRecorded')}</span>
   }
 
-  const visibleTags = tags.slice(0, 4)
-  const hiddenCount = tags.length - visibleTags.length
-
+  const label = tags.join(' · ')
   return (
-    <span className="flex flex-wrap items-center gap-1">
-      {visibleTags.map((tag) => (
-        <span
-          key={tag}
-          title={tag}
-          className="inline-block max-w-full break-words rounded border border-border bg-sidebar px-1.5 py-0.5 font-mono text-[11px] leading-relaxed text-foreground/75"
-        >
-          {tag}
-        </span>
-      ))}
-      {hiddenCount > 0 ? (
-        <span className="font-mono text-[11px] tabular-nums text-foreground/60">+{hiddenCount}</span>
-      ) : null}
+    <span
+      className="block truncate font-mono text-[11px] leading-5 text-foreground/75"
+      title={label}
+      data-testid="asset-tech-stack"
+    >
+      {label}
     </span>
   )
 }
@@ -83,28 +77,28 @@ function TableSkeleton() {
           <tbody>
             {[0, 1, 2, 3, 4, 5].map((index) => (
               <tr key={index}>
-                <td className="border-b border-border px-3 py-3.5">
+                <td className="h-14 border-b border-border px-3 py-0">
                   <Skeleton className="h-3.5 w-[182px]" />
                 </td>
-                <td className="border-b border-border px-3 py-3.5">
+                <td className="h-14 border-b border-border px-3 py-0">
                   <Skeleton className="h-3 w-[92px]" />
                 </td>
-                <td className="border-b border-border px-3 py-3.5">
+                <td className="h-14 border-b border-border px-3 py-0">
                   <Skeleton className="h-3 w-[68%]" />
                 </td>
-                <td className="border-b border-border px-3 py-3.5">
+                <td className="h-14 border-b border-border px-3 py-0">
                   <Skeleton className="mx-auto h-[22px] w-[56px] rounded-full" />
                 </td>
-                <td className="border-b border-border px-3 py-3.5">
+                <td className="h-14 border-b border-border px-3 py-0">
                   <Skeleton className="mx-auto h-3 w-5" />
                 </td>
-                <td className="border-b border-border px-3 py-3.5">
+                <td className="h-14 border-b border-border px-3 py-0">
                   <Skeleton className="mx-auto h-3 w-5" />
                 </td>
-                <td className="border-b border-border px-3 py-3.5">
+                <td className="h-14 border-b border-border px-3 py-0">
                   <Skeleton className="mx-auto h-3 w-5" />
                 </td>
-                <td className="border-b border-border px-3 py-3.5">
+                <td className="h-14 border-b border-border px-3 py-0">
                   <Skeleton className="h-3 w-[62px]" />
                 </td>
                 <td className="border-b border-border py-3 pr-4" />

package/src/cortex-ui/renderer/components/asset/TestParameterList.tsx

@@ -67,7 +67,9 @@ function TestParameterCard({
 }) {
   const { t, locationLabel } = useI18n()
   const { copied, copy } = useCopy()
-  const valuesText = testParameterValuesText(parameter.values)
+  const values = parameter.values ?? []
+  const relatedVulnIds = parameter.related_vuln_ids ?? []
+  const valuesText = testParameterValuesText(values)
 
   return (
     <article
@@ -120,11 +122,11 @@ function TestParameterCard({
         <div className="min-w-0">
           <p className="text-[11px] font-medium text-foreground/70">
             {t('asset.parameter.values')}
-            {parameter.values.length > 0 ? ` · ${parameter.values.length}` : ''}
+            {values.length > 0 ? ` · ${values.length}` : ''}
           </p>
-          {parameter.values.length > 0 ? (
+          {values.length > 0 ? (
             <div className="mt-1 flex flex-wrap gap-1">
-              {parameter.values.map((value, index) => (
+              {values.map((value, index) => (
                 <span
                   key={`${value}-${index}`}
                   data-testid="asset-test-parameter-value"
@@ -153,13 +155,13 @@ function TestParameterCard({
           />
         ) : null}
 
-        {parameter.related_vuln_ids.length > 0 ? (
+        {relatedVulnIds.length > 0 ? (
           <div className="min-w-0">
             <p className="text-[11px] font-medium text-foreground/70">
               {t('asset.parameter.relatedVulns')}
             </p>
             <div className="mt-1 flex flex-wrap gap-1.5">
-              {parameter.related_vuln_ids.map((vulnId) => (
+              {relatedVulnIds.map((vulnId) => (
                 <Button
                   key={vulnId}
                   variant="outline"

package/src/cortex-ui/renderer/components/retest/RepeaterPanel.tsx

@@ -8,7 +8,8 @@ import { useI18n } from '@renderer/i18n'
 import { getApi } from '@renderer/lib/api'
 import {
   defaultRequestIndex,
-  extractRepeaterRequests
+  extractRepeaterRequests,
+  resolveRepeaterUrl
 } from '@renderer/lib/retestRequest'
 
 interface RepeaterPanelProps {
@@ -159,7 +160,7 @@ export function RepeaterPanel({ vuln, loading }: RepeaterPanelProps) {
       const response = await api.sendRepeaterRequest({
         vulnId: vuln.id,
         method: parsed.method,
-        url: parsed.url,
+        url: resolveRepeaterUrl(parsed.url, vuln.target_url),
         headers: parsed.headers,
         ...(parsed.body === '' ? {} : { body: parsed.body }),
         followRedirects

package/src/cortex-ui/renderer/components/vuln/VulnDetail.tsx

@@ -262,7 +262,13 @@ export function VulnDetail({
     setExporting(true)
     try {
       const result = await api.exportVulnerabilities([detail.id])
-      if (!result.cancelled) toast.success(t('vuln.toast.exported'))
+      if (!result.cancelled) {
+        const savedPath = result.savedPaths?.[0]
+        toast.success(
+          t('vuln.toast.exported'),
+          savedPath ? { description: t('vuln.toast.exportedPath', { path: savedPath }) } : undefined
+        )
+      }
     } catch (cause) {
       toast.error(t('vuln.toast.exportFailed', { error: toErrorMessage(cause, t) }))
     } finally {

package/src/cortex-ui/renderer/i18n/messages/vuln.ts

@@ -91,6 +91,7 @@ export const vulnMessages: MessageBundle = {
     'vuln.copy.codeBlockDone': '已复制代码块',
     'vuln.toast.exportedMany': '已导出 {count} 份 Markdown 报告',
     'vuln.toast.exported': 'Markdown 报告已导出',
+    'vuln.toast.exportedPath': '已保存到：{path}',
     'vuln.toast.exportFailed': '导出失败：{error}',
     'vuln.toast.deleted': '已删除 {id}',
     'vuln.toast.bulkDeleted': '已删除 {count} 条漏洞',
@@ -201,6 +202,7 @@ export const vulnMessages: MessageBundle = {
     'vuln.copy.codeBlockDone': 'Code block copied',
     'vuln.toast.exportedMany': 'Exported {count} Markdown reports',
     'vuln.toast.exported': 'Markdown report exported',
+    'vuln.toast.exportedPath': 'Saved to: {path}',
     'vuln.toast.exportFailed': 'Export failed: {error}',
     'vuln.toast.deleted': 'Deleted {id}',
     'vuln.toast.bulkDeleted': 'Deleted {count} vulnerabilities',

package/src/cortex-ui/renderer/lib/assets.ts

@@ -192,3 +192,121 @@ export function testParameterValuesText(values: readonly string[]): string {
     .filter((value) => value.length > 0)
     .join('\n')
 }
+
+/* ------------------------------------------------------------------------- */
+/* Defensive normalization for agent-written asset JSON                      */
+/* ------------------------------------------------------------------------- */
+
+/** Derive the query string / body from a captured raw HTTP request. */
+export function extractDisplayParamsFromRaw(raw: string | undefined): string {
+  const source = (raw ?? '').replace(/\r\n/g, '\n').trim()
+  if (source.length === 0) return ''
+  const lines = source.split('\n')
+  const requestLine = lines[0] ?? ''
+  const queryIndex = requestLine.indexOf('?')
+  const query = queryIndex >= 0 ? requestLine.slice(queryIndex).trim() : ''
+  const separator = source.indexOf('\n\n')
+  const body = separator >= 0 ? source.slice(separator + 2).trim() : ''
+  return [query, body].filter((part) => part.length > 0).join('\n')
+}
+
+/**
+ * The Host normalizes asset rows before serving them, but cached responses from
+ * older plugin builds (or an MCP-era database) may still contain aliases such as
+ * `raw` / `param` / `where` / `example`. Normalizing again in the renderer keeps
+ * the drawer and the memory graph crash-free instead of blanking the panel.
+ */
+export function normalizeDisplayInterfaces(raw: unknown): AssetInterface[] {
+  const list = Array.isArray(raw) ? raw : []
+  const result: AssetInterface[] = []
+  for (const value of list) {
+    if (typeof value === 'string') {
+      if (value.trim().length > 0) result.push({ path: value.trim() })
+      continue
+    }
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) continue
+    const item = value as Record<string, unknown>
+    const path = [item.path, item.url, item.route, item.endpoint]
+      .map((entry) => (typeof entry === 'string' ? entry.trim() : ''))
+      .find((entry) => entry.length > 0)
+    if (!path) continue
+    const entry: AssetInterface = { path }
+    const method = typeof item.method === 'string' ? item.method.trim().toUpperCase() : ''
+    if ((INTERFACE_METHOD_STYLES as Record<string, string>)[method]) {
+      entry.method = method as AssetInterface['method']
+    }
+    const request = [item.request, item.raw, item.http]
+      .map((candidate) => (typeof candidate === 'string' ? candidate : ''))
+      .find((candidate) => candidate.trim().length > 0)
+    const params =
+      [item.params, item.parameters, item.query, item.data]
+        .map((candidate) => (typeof candidate === 'string' ? candidate.trim() : ''))
+        .find((candidate) => candidate.length > 0) || extractDisplayParamsFromRaw(request)
+    if (params) entry.params = params
+    if (request) entry.request = request
+    result.push(entry)
+  }
+  return result
+}
+
+/** Canonical test-parameter candidates from aliased agent records. */
+export function normalizeDisplayTestParameters(raw: unknown): TestParameterCandidate[] {
+  const list = Array.isArray(raw) ? raw : []
+  const result: TestParameterCandidate[] = []
+  const seen = new Set<string>()
+  for (const value of list) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) continue
+    const item = value as Record<string, unknown>
+    const pickText = (names: string[]): string => {
+      for (const name of names) {
+        const candidate = item[name]
+        if (typeof candidate === 'string' && candidate.trim().length > 0) return candidate.trim()
+      }
+      return ''
+    }
+    const name = pickText(['name', 'param', 'key'])
+    const endpoint = pickText(['endpoint', 'interface', 'api', 'path'])
+    const rawValues = Array.isArray(item.values) ? item.values : []
+    const values = (rawValues.length > 0 ? rawValues : [pickText(['example', 'value', 'sample'])])
+      .filter((entry): entry is string | number => typeof entry === 'string' || typeof entry === 'number')
+      .map(String)
+      .slice(0, 50)
+    if (name.length === 0 && endpoint.length === 0 && values.length === 0) continue
+    const locationRaw = pickText(['location', 'where', 'in']).toLowerCase()
+    const locationAliases: Record<string, string> = {
+      json: 'body',
+      form: 'body',
+      formdata: 'body',
+      post: 'body',
+      querystring: 'query',
+      url: 'query',
+      headers: 'header',
+      cookies: 'cookie',
+    }
+    const mappedLocation = locationAliases[locationRaw] || locationRaw
+    const location = (
+      ['path', 'query', 'body', 'header', 'cookie'].includes(mappedLocation) ? mappedLocation : 'query'
+    ) as TestParameterCandidate['location']
+    const source = pickText(['source', 'file', 'interface', 'endpoint']) || endpoint || '(unknown)'
+    const key = `${endpoint}\u0000${name}\u0000${location}`
+    if (seen.has(key)) continue
+    seen.add(key)
+    const entry: TestParameterCandidate = {
+      name: name || 'value',
+      endpoint: endpoint || source || '(unknown)',
+      location,
+      values,
+      source,
+      tested: item.tested === true,
+      related_vuln_ids: Array.isArray(item.related_vuln_ids)
+        ? item.related_vuln_ids.filter((entry): entry is string => typeof entry === 'string')
+        : [],
+    }
+    const pattern = pickText(['pattern'])
+    if (pattern) entry.pattern = pattern
+    const notes = pickText(['notes', 'note'])
+    if (notes) entry.notes = notes
+    result.push(entry)
+  }
+  return result
+}

package/src/cortex-ui/renderer/lib/retestRequest.ts

@@ -11,6 +11,23 @@ export interface RepeaterRequestCandidate {
 
 const REQUEST_LINE = /^([A-Z]+)\s+(\S+)\s+HTTP\/\d(?:\.\d)?$/
 
+/**
+ * Raw report requests carry only the origin-form path (`GET /api/x HTTP/1.1`),
+ * but the Host send API requires an absolute URL. Resolve against the finding's
+ * target so http-only targets stay http and https targets stay https.
+ */
+export function resolveRepeaterUrl(rawUrl: string, targetUrl: string): string {
+  const value = rawUrl.trim()
+  if (/^https?:\/\//i.test(value)) return value
+  try {
+    const target = new URL(targetUrl)
+    if (value.startsWith('//')) return `${target.protocol}${value}`
+    return new URL(value, target).href
+  } catch {
+    return value
+  }
+}
+
 function normalizePath(input: string): string {
   try {
     if (/^https?:\/\//i.test(input)) return new URL(input).pathname

package/src/cortex-ui/renderer/pages/DashboardPage.tsx

@@ -313,11 +313,15 @@ export function DashboardPage({
     setExporting(true)
     try {
       const result = await api.exportVulnerabilities(ids)
+      const savedPath = result.savedPaths?.[0]
       if (!result.cancelled) {
-        toast.success(
+        const message =
           result.files.length > 1
             ? t('vuln.toast.exportedMany', { count: result.files.length })
             : t('vuln.toast.exported')
+        toast.success(
+          message,
+          savedPath ? { description: t('vuln.toast.exportedPath', { path: savedPath }) } : undefined
         )
       }
     } catch (cause) {

package/src/cortex-ui/shared/types.ts

@@ -1020,8 +1020,10 @@ export interface DeleteVulnsResult {
 
 export interface ExportReportsResult {
   cancelled: boolean
-  /** Absolute paths of the written Markdown files. */
+  /** File names (or absolute paths for desktop transports) of exported reports. */
   files: string[]
+  /** DSH Host also writes reports under ~/.cortex/exports and returns them here. */
+  savedPaths?: string[]
 }
 
 export interface SeedDemoResult {

package/src/cortex-ui/shared/web.ts

@@ -72,6 +72,8 @@ export interface WebExportFile {
 /** Response of `POST /api/vulns/export`; the browser downloads these, nothing is written server-side. */
 export interface WebExportResponse {
   files: WebExportFile[]
+  /** Optional Host-side saved copies (`~/.cortex/exports/...`) for desktop builds. */
+  savedPaths?: string[]
 }
 
 /**

package/src/host/cortex/assets.js

@@ -21,6 +21,12 @@ import {
   sendJson,
 } from '../http.js'
 import { jsonArray, likePattern, text, vulnListItem } from './vulns.js'
+import {
+  normalizeInterfaces,
+  normalizeLeaks,
+  normalizeProjectName,
+  normalizeTestParameters,
+} from './normalize-asset.js'
 
 const ASSET_STATUSES = ['Alive', 'Dead', 'WAF_Blocked']
 const HTTP_METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS', 'HEAD']
@@ -51,71 +57,22 @@ function bool01(value) {
 }
 
 /**
- * Normalize stored `interfaces` to the shared `AssetInterface[]` shape.
- * @param {unknown} raw
+ * Normalize stored asset JSON to the canonical shared shapes. Agent-written
+ * records may use aliases (raw/request, type/file, param/where/example); the
+ * shared normalizers keep the drawer and the memory graph crash-free.
  */
 function interfaceList(raw) {
-  const out = []
-  for (const item of jsonArray(raw)) {
-    if (typeof item === 'string') {
-      if (item.trim().length > 0) out.push({ path: item.trim() })
-      continue
-    }
-    if (item === null || typeof item !== 'object' || Array.isArray(item)) continue
-    const path = text(item.path).trim()
-    if (path.length === 0) continue
-    /** @type {Record<string, any>} */
-    const entry = { path }
-    if (typeof item.method === 'string' && HTTP_METHODS.includes(item.method)) entry.method = item.method
-    if (typeof item.params === 'string' && item.params.length > 0) entry.params = item.params
-    if (typeof item.request === 'string' && item.request.length > 0) entry.request = item.request
-    out.push(entry)
-  }
-  return out
+  return normalizeInterfaces(raw)
 }
 
 /** @param {unknown} raw */
 function leakedInfoList(raw) {
-  const out = []
-  for (const item of jsonArray(raw)) {
-    if (item === null || typeof item !== 'object' || Array.isArray(item)) continue
-    const infoType = text(item.info_type ?? item.infoType)
-    out.push({
-      info_type: LEAKED_INFO_TYPES.includes(infoType) ? infoType : 'Other',
-      value: text(item.value),
-      source: text(item.source),
-      potential_impact: text(item.potential_impact ?? item.potentialImpact),
-    })
-  }
-  return out
+  return normalizeLeaks(raw)
 }
 
 /** @param {unknown} raw */
 function testParameterList(raw) {
-  const out = []
-  for (const item of jsonArray(raw)) {
-    if (item === null || typeof item !== 'object' || Array.isArray(item)) continue
-    const location = text(item.location)
-    /** @type {Record<string, any>} */
-    const entry = {
-      name: text(item.name),
-      endpoint: text(item.endpoint),
-      location: TEST_PARAMETER_LOCATIONS.includes(location) ? location : 'query',
-      values: jsonArray(item.values)
-        .filter((value) => typeof value === 'string' || typeof value === 'number')
-        .map((value) => String(value)),
-      source: text(item.source),
-      tested: item.tested === true,
-    }
-    if (typeof item.pattern === 'string' && item.pattern.length > 0) entry.pattern = item.pattern
-    if (typeof item.notes === 'string' && item.notes.length > 0) entry.notes = item.notes
-    const related = jsonArray(item.related_vuln_ids ?? item.relatedVulnIds).filter(
-      (value) => typeof value === 'string',
-    )
-    if (related.length > 0) entry.related_vuln_ids = related
-    out.push(entry)
-  }
-  return out
+  return normalizeTestParameters(raw)
 }
 
 /**
@@ -153,7 +110,7 @@ function assetListItem(row) {
   return {
     host_port: text(source.host_port),
     host: text(source.host),
-    project_name: text(source.project_name),
+    project_name: normalizeProjectName(text(source.project_name)),
     tech_stack: text(source.tech_stack),
     auth_required: bool01(source.auth_required),
     status: ASSET_STATUSES.includes(text(source.status)) ? text(source.status) : 'Alive',
@@ -173,7 +130,7 @@ function assetContext(row) {
   return {
     host_port: text(source.host_port),
     host: text(source.host),
-    project_name: text(source.project_name),
+    project_name: normalizeProjectName(text(source.project_name)),
     tech_stack: text(source.tech_stack),
     auth_required: bool01(source.auth_required),
     status: ASSET_STATUSES.includes(text(source.status)) ? text(source.status) : 'Alive',