@lievclouds/dsh-cortex 0.4.1 → 0.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lievclouds/dsh-cortex",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Cortex workbench for DeepSeek Harness: the original Cortex UI (vulnerabilities, assets, internal operations, Memory Nebula, snapshots, retest) as a native DSH panel, plus 12 native agent tools so DSH conversations use the local Cortex SQLite without MCP.",
   "type": "module",
   "main": "index.js",

package/src/cortex-ui/dsh/api.ts

@@ -112,7 +112,16 @@ export function createCortexApi(): CortexApi {
       patch(`/vulns/${encodeURIComponent(input.id)}/status`, { status: input.status }),
     deleteVulnerability: (id) => del(`/vulns/${encodeURIComponent(id)}`),
     deleteVulnerabilities: (ids) => post('/vulns/delete-many', { ids }),
-    exportVulnerabilities: (ids) => post('/vulns/export', { ids }),
+    exportVulnerabilities: async (ids) => {
+      const response = await post('/vulns/export', { ids })
+      const files = Array.isArray(response?.files) ? response.files : []
+      const savedPaths = Array.isArray(response?.savedPaths) ? response.savedPaths : []
+      return {
+        cancelled: response?.cancelled === true || files.length === 0,
+        files: files.map((file) => (file && typeof file.filename === 'string' ? file.filename : String(file))),
+        savedPaths: savedPaths.filter((path) => typeof path === 'string'),
+      }
+    },
 
     // ---------------------------------------------------------------- assets
     listAssets: (filters) => get('/assets', filters as Record<string, unknown>),

package/src/cortex-ui/renderer/components/asset/AssetTable.tsx

@@ -23,12 +23,15 @@ interface AssetTableProps {
 const thBase =
   'sticky top-0 z-10 border-b border-border bg-background px-3 py-2 text-left text-[11px] font-medium text-foreground/70'
 
-/** Table cells share the hairline bottom border; the last row drops it. */
+/** Table cells share a fixed row height and the hairline bottom border. */
 function cellClass(last: boolean, extra?: string): string {
-  return cn('border-b border-border px-3 py-2.5 align-middle', last && 'border-b-0', extra)
+  return cn('h-14 border-b border-border px-3 py-2 align-middle', last && 'border-b-0', extra)
 }
 
-/** Technology fingerprints render as one complete chip per technology. */
+/**
+ * Fixed single-line fingerprint summary: list rows keep one constant height, so
+ * a long stack is clipped with an ellipsis instead of growing the row.
+ */
 function TechStackTags({ techStack }: { techStack: string }) {
   const { t } = useI18n()
   const tags = techStackTags(techStack)
@@ -36,23 +39,14 @@ function TechStackTags({ techStack }: { techStack: string }) {
     return <span className="text-[11px] text-muted-foreground">{t('asset.value.notRecorded')}</span>
   }
 
-  const visibleTags = tags.slice(0, 4)
-  const hiddenCount = tags.length - visibleTags.length
-
+  const label = tags.join(' · ')
   return (
-    <span className="flex flex-wrap items-center gap-1">
-      {visibleTags.map((tag) => (
-        <span
-          key={tag}
-          title={tag}
-          className="inline-block max-w-full break-words rounded border border-border bg-sidebar px-1.5 py-0.5 font-mono text-[11px] leading-relaxed text-foreground/75"
-        >
-          {tag}
-        </span>
-      ))}
-      {hiddenCount > 0 ? (
-        <span className="font-mono text-[11px] tabular-nums text-foreground/60">+{hiddenCount}</span>
-      ) : null}
+    <span
+      className="block truncate font-mono text-[11px] leading-5 text-foreground/75"
+      title={label}
+      data-testid="asset-tech-stack"
+    >
+      {label}
     </span>
   )
 }
@@ -83,28 +77,28 @@ function TableSkeleton() {
           <tbody>
             {[0, 1, 2, 3, 4, 5].map((index) => (
               <tr key={index}>
-                <td className="border-b border-border px-3 py-3.5">
+                <td className="h-14 border-b border-border px-3 py-0">
                   <Skeleton className="h-3.5 w-[182px]" />
                 </td>
-                <td className="border-b border-border px-3 py-3.5">
+                <td className="h-14 border-b border-border px-3 py-0">
                   <Skeleton className="h-3 w-[92px]" />
                 </td>
-                <td className="border-b border-border px-3 py-3.5">
+                <td className="h-14 border-b border-border px-3 py-0">
                   <Skeleton className="h-3 w-[68%]" />
                 </td>
-                <td className="border-b border-border px-3 py-3.5">
+                <td className="h-14 border-b border-border px-3 py-0">
                   <Skeleton className="mx-auto h-[22px] w-[56px] rounded-full" />
                 </td>
-                <td className="border-b border-border px-3 py-3.5">
+                <td className="h-14 border-b border-border px-3 py-0">
                   <Skeleton className="mx-auto h-3 w-5" />
                 </td>
-                <td className="border-b border-border px-3 py-3.5">
+                <td className="h-14 border-b border-border px-3 py-0">
                   <Skeleton className="mx-auto h-3 w-5" />
                 </td>
-                <td className="border-b border-border px-3 py-3.5">
+                <td className="h-14 border-b border-border px-3 py-0">
                   <Skeleton className="mx-auto h-3 w-5" />
                 </td>
-                <td className="border-b border-border px-3 py-3.5">
+                <td className="h-14 border-b border-border px-3 py-0">
                   <Skeleton className="h-3 w-[62px]" />
                 </td>
                 <td className="border-b border-border py-3 pr-4" />

package/src/cortex-ui/renderer/components/retest/RepeaterPanel.tsx

@@ -8,7 +8,8 @@ import { useI18n } from '@renderer/i18n'
 import { getApi } from '@renderer/lib/api'
 import {
   defaultRequestIndex,
-  extractRepeaterRequests
+  extractRepeaterRequests,
+  resolveRepeaterUrl
 } from '@renderer/lib/retestRequest'
 
 interface RepeaterPanelProps {
@@ -159,7 +160,7 @@ export function RepeaterPanel({ vuln, loading }: RepeaterPanelProps) {
       const response = await api.sendRepeaterRequest({
         vulnId: vuln.id,
         method: parsed.method,
-        url: parsed.url,
+        url: resolveRepeaterUrl(parsed.url, vuln.target_url),
         headers: parsed.headers,
         ...(parsed.body === '' ? {} : { body: parsed.body }),
         followRedirects

package/src/cortex-ui/renderer/components/vuln/VulnDetail.tsx

@@ -262,7 +262,13 @@ export function VulnDetail({
     setExporting(true)
     try {
       const result = await api.exportVulnerabilities([detail.id])
-      if (!result.cancelled) toast.success(t('vuln.toast.exported'))
+      if (!result.cancelled) {
+        const savedPath = result.savedPaths?.[0]
+        toast.success(
+          t('vuln.toast.exported'),
+          savedPath ? { description: t('vuln.toast.exportedPath', { path: savedPath }) } : undefined
+        )
+      }
     } catch (cause) {
       toast.error(t('vuln.toast.exportFailed', { error: toErrorMessage(cause, t) }))
     } finally {

package/src/cortex-ui/renderer/i18n/messages/vuln.ts

@@ -91,6 +91,7 @@ export const vulnMessages: MessageBundle = {
     'vuln.copy.codeBlockDone': '已复制代码块',
     'vuln.toast.exportedMany': '已导出 {count} 份 Markdown 报告',
     'vuln.toast.exported': 'Markdown 报告已导出',
+    'vuln.toast.exportedPath': '已保存到：{path}',
     'vuln.toast.exportFailed': '导出失败：{error}',
     'vuln.toast.deleted': '已删除 {id}',
     'vuln.toast.bulkDeleted': '已删除 {count} 条漏洞',
@@ -201,6 +202,7 @@ export const vulnMessages: MessageBundle = {
     'vuln.copy.codeBlockDone': 'Code block copied',
     'vuln.toast.exportedMany': 'Exported {count} Markdown reports',
     'vuln.toast.exported': 'Markdown report exported',
+    'vuln.toast.exportedPath': 'Saved to: {path}',
     'vuln.toast.exportFailed': 'Export failed: {error}',
     'vuln.toast.deleted': 'Deleted {id}',
     'vuln.toast.bulkDeleted': 'Deleted {count} vulnerabilities',

package/src/cortex-ui/renderer/lib/retestRequest.ts

@@ -11,6 +11,23 @@ export interface RepeaterRequestCandidate {
 
 const REQUEST_LINE = /^([A-Z]+)\s+(\S+)\s+HTTP\/\d(?:\.\d)?$/
 
+/**
+ * Raw report requests carry only the origin-form path (`GET /api/x HTTP/1.1`),
+ * but the Host send API requires an absolute URL. Resolve against the finding's
+ * target so http-only targets stay http and https targets stay https.
+ */
+export function resolveRepeaterUrl(rawUrl: string, targetUrl: string): string {
+  const value = rawUrl.trim()
+  if (/^https?:\/\//i.test(value)) return value
+  try {
+    const target = new URL(targetUrl)
+    if (value.startsWith('//')) return `${target.protocol}${value}`
+    return new URL(value, target).href
+  } catch {
+    return value
+  }
+}
+
 function normalizePath(input: string): string {
   try {
     if (/^https?:\/\//i.test(input)) return new URL(input).pathname

package/src/cortex-ui/renderer/pages/DashboardPage.tsx

@@ -313,11 +313,15 @@ export function DashboardPage({
     setExporting(true)
     try {
       const result = await api.exportVulnerabilities(ids)
+      const savedPath = result.savedPaths?.[0]
       if (!result.cancelled) {
-        toast.success(
+        const message =
           result.files.length > 1
             ? t('vuln.toast.exportedMany', { count: result.files.length })
             : t('vuln.toast.exported')
+        toast.success(
+          message,
+          savedPath ? { description: t('vuln.toast.exportedPath', { path: savedPath }) } : undefined
         )
       }
     } catch (cause) {

package/src/cortex-ui/shared/types.ts

@@ -1020,8 +1020,10 @@ export interface DeleteVulnsResult {
 
 export interface ExportReportsResult {
   cancelled: boolean
-  /** Absolute paths of the written Markdown files. */
+  /** File names (or absolute paths for desktop transports) of exported reports. */
   files: string[]
+  /** DSH Host also writes reports under ~/.cortex/exports and returns them here. */
+  savedPaths?: string[]
 }
 
 export interface SeedDemoResult {

package/src/cortex-ui/shared/web.ts

@@ -72,6 +72,8 @@ export interface WebExportFile {
 /** Response of `POST /api/vulns/export`; the browser downloads these, nothing is written server-side. */
 export interface WebExportResponse {
   files: WebExportFile[]
+  /** Optional Host-side saved copies (`~/.cortex/exports/...`) for desktop builds. */
+  savedPaths?: string[]
 }
 
 /**

package/src/host/cortex/vulns.js

@@ -34,6 +34,9 @@ import {
 } from '../http.js'
 import * as dto from '../dto.js'
 import { buildVulnReport, reportFilename } from '../reports.js'
+import { mkdirSync, writeFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
 
 const SEVERITIES = ['Critical', 'High', 'Medium', 'Low', 'Info']
 const STATUSES = ['Confirmed', 'Inconclusive', 'Retest_Passed']
@@ -497,7 +500,7 @@ export async function handleExport({ req, res, holder, bumpRev }) {
   const body = await readJsonBody(req)
   const ids = requireIdList(body, 'ids', MAX_EXPORT_IDS)
   if (ids.length === 0) {
-    sendJson(res, 200, { cancelled: true, files: [] })
+    sendJson(res, 200, { cancelled: true, files: [], savedPaths: [] })
     return
   }
   const db = holder.db
@@ -525,9 +528,36 @@ export async function handleExport({ req, res, holder, bumpRev }) {
       content: buildVulnReport(detail, related),
     })
   }
+  // The DSH desktop WebView may block browser downloads, so the Host also
+  // writes the Markdown reports to ~/.cortex/exports/<timestamp>/ and returns
+  // the absolute paths. The renderer still attempts a normal download, but the
+  // toast can then point at a real file that always exists.
+  const savedPaths = []
+  if (files.length > 0) {
+    try {
+      const exportRoot = process.env.CORTEX_EXPORT_DIR || join(homedir(), '.cortex', 'exports')
+      const stamp = new Date()
+        .toISOString()
+        .replace(/[-:]/g, '')
+        .replace(/\..+$/, '')
+        .replace('T', '-')
+      const exportDir = join(exportRoot, stamp)
+      mkdirSync(exportDir, { recursive: true })
+      for (let index = 0; index < files.length; index += 1) {
+        const file = files[index]
+        const safeName = String(file.filename).replace(/[<>:"/\\|?*\u0000-\u001f]/g, '_').slice(0, 120) || file.id
+        const target = join(exportDir, `${String(index + 1).padStart(2, '0')}-${safeName.endsWith('.md') ? safeName : `${safeName}.md`}`)
+        writeFileSync(target, file.content, 'utf8')
+        savedPaths.push(target)
+      }
+    } catch {
+      // Filesystem failure must not break the export response; the inline
+      // files still let the browser download attempt proceed.
+    }
+  }
   // Export is a read-only projection: no revision bump.
   void bumpRev
-  sendJson(res, 200, { cancelled: files.length === 0, files })
+  sendJson(res, 200, { cancelled: files.length === 0, files, savedPaths })
 }
 
 export { SEVERITIES, STATUSES, REALM_FILTERS, VULN_ORDER }