@lievclouds/dsh-cortex 0.4.1 → 0.4.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lievclouds/dsh-cortex",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "Cortex workbench for DeepSeek Harness: the original Cortex UI (vulnerabilities, assets, internal operations, Memory Nebula, snapshots, retest) as a native DSH panel, plus 12 native agent tools so DSH conversations use the local Cortex SQLite without MCP.",
   "type": "module",
   "main": "index.js",

package/src/cortex-ui/dsh/api.ts

@@ -112,7 +112,19 @@ export function createCortexApi(): CortexApi {
       patch(`/vulns/${encodeURIComponent(input.id)}/status`, { status: input.status }),
     deleteVulnerability: (id) => del(`/vulns/${encodeURIComponent(id)}`),
     deleteVulnerabilities: (ids) => post('/vulns/delete-many', { ids }),
-    exportVulnerabilities: (ids) => post('/vulns/export', { ids }),
+    exportVulnerabilities: async (ids, outputDir) => {
+      const response = await post('/vulns/export', {
+        ids,
+        ...(outputDir && outputDir.trim() !== '' ? { outputDir: outputDir.trim() } : {}),
+      })
+      const files = Array.isArray(response?.files) ? response.files : []
+      const savedPaths = Array.isArray(response?.savedPaths) ? response.savedPaths : []
+      return {
+        cancelled: response?.cancelled === true || files.length === 0,
+        files: files.map((file) => (file && typeof file.filename === 'string' ? file.filename : String(file))),
+        savedPaths: savedPaths.filter((path) => typeof path === 'string'),
+      }
+    },
 
     // ---------------------------------------------------------------- assets
     listAssets: (filters) => get('/assets', filters as Record<string, unknown>),

package/src/cortex-ui/renderer/components/asset/AssetTable.tsx

@@ -23,12 +23,15 @@ interface AssetTableProps {
 const thBase =
   'sticky top-0 z-10 border-b border-border bg-background px-3 py-2 text-left text-[11px] font-medium text-foreground/70'
 
-/** Table cells share the hairline bottom border; the last row drops it. */
+/** Table cells share a fixed row height and the hairline bottom border. */
 function cellClass(last: boolean, extra?: string): string {
-  return cn('border-b border-border px-3 py-2.5 align-middle', last && 'border-b-0', extra)
+  return cn('h-14 border-b border-border px-3 py-2 align-middle', last && 'border-b-0', extra)
 }
 
-/** Technology fingerprints render as one complete chip per technology. */
+/**
+ * Fixed single-line fingerprint summary: list rows keep one constant height, so
+ * a long stack is clipped with an ellipsis instead of growing the row.
+ */
 function TechStackTags({ techStack }: { techStack: string }) {
   const { t } = useI18n()
   const tags = techStackTags(techStack)
@@ -36,23 +39,14 @@ function TechStackTags({ techStack }: { techStack: string }) {
     return <span className="text-[11px] text-muted-foreground">{t('asset.value.notRecorded')}</span>
   }
 
-  const visibleTags = tags.slice(0, 4)
-  const hiddenCount = tags.length - visibleTags.length
-
+  const label = tags.join(' · ')
   return (
-    <span className="flex flex-wrap items-center gap-1">
-      {visibleTags.map((tag) => (
-        <span
-          key={tag}
-          title={tag}
-          className="inline-block max-w-full break-words rounded border border-border bg-sidebar px-1.5 py-0.5 font-mono text-[11px] leading-relaxed text-foreground/75"
-        >
-          {tag}
-        </span>
-      ))}
-      {hiddenCount > 0 ? (
-        <span className="font-mono text-[11px] tabular-nums text-foreground/60">+{hiddenCount}</span>
-      ) : null}
+    <span
+      className="block truncate font-mono text-[11px] leading-5 text-foreground/75"
+      title={label}
+      data-testid="asset-tech-stack"
+    >
+      {label}
     </span>
   )
 }
@@ -83,28 +77,28 @@ function TableSkeleton() {
           <tbody>
             {[0, 1, 2, 3, 4, 5].map((index) => (
               <tr key={index}>
-                <td className="border-b border-border px-3 py-3.5">
+                <td className="h-14 border-b border-border px-3 py-0">
                   <Skeleton className="h-3.5 w-[182px]" />
                 </td>
-                <td className="border-b border-border px-3 py-3.5">
+                <td className="h-14 border-b border-border px-3 py-0">
                   <Skeleton className="h-3 w-[92px]" />
                 </td>
-                <td className="border-b border-border px-3 py-3.5">
+                <td className="h-14 border-b border-border px-3 py-0">
                   <Skeleton className="h-3 w-[68%]" />
                 </td>
-                <td className="border-b border-border px-3 py-3.5">
+                <td className="h-14 border-b border-border px-3 py-0">
                   <Skeleton className="mx-auto h-[22px] w-[56px] rounded-full" />
                 </td>
-                <td className="border-b border-border px-3 py-3.5">
+                <td className="h-14 border-b border-border px-3 py-0">
                   <Skeleton className="mx-auto h-3 w-5" />
                 </td>
-                <td className="border-b border-border px-3 py-3.5">
+                <td className="h-14 border-b border-border px-3 py-0">
                   <Skeleton className="mx-auto h-3 w-5" />
                 </td>
-                <td className="border-b border-border px-3 py-3.5">
+                <td className="h-14 border-b border-border px-3 py-0">
                   <Skeleton className="mx-auto h-3 w-5" />
                 </td>
-                <td className="border-b border-border px-3 py-3.5">
+                <td className="h-14 border-b border-border px-3 py-0">
                   <Skeleton className="h-3 w-[62px]" />
                 </td>
                 <td className="border-b border-border py-3 pr-4" />

package/src/cortex-ui/renderer/components/retest/RepeaterPanel.tsx

@@ -8,7 +8,8 @@ import { useI18n } from '@renderer/i18n'
 import { getApi } from '@renderer/lib/api'
 import {
   defaultRequestIndex,
-  extractRepeaterRequests
+  extractRepeaterRequests,
+  resolveRepeaterUrl
 } from '@renderer/lib/retestRequest'
 
 interface RepeaterPanelProps {
@@ -159,7 +160,7 @@ export function RepeaterPanel({ vuln, loading }: RepeaterPanelProps) {
       const response = await api.sendRepeaterRequest({
         vulnId: vuln.id,
         method: parsed.method,
-        url: parsed.url,
+        url: resolveRepeaterUrl(parsed.url, vuln.target_url),
         headers: parsed.headers,
         ...(parsed.body === '' ? {} : { body: parsed.body }),
         followRedirects

package/src/cortex-ui/renderer/components/vuln/ExportReportDialog.tsx

@@ -0,0 +1,120 @@
+import * as DialogPrimitive from '@radix-ui/react-dialog'
+import { Download, FolderOpen, Loader2 } from 'lucide-react'
+import { useEffect, useState } from 'react'
+import { Button } from '@renderer/components/ui/button'
+import { useI18n } from '@renderer/i18n'
+import { getPortalContainer } from '../../../dsh/portal'
+
+const STORAGE_KEY = 'cortex.export.dir'
+
+function isAbsoluteLike(value: string): boolean {
+  const trimmed = value.trim()
+  if (trimmed.startsWith('~')) return true
+  if (/^[A-Za-z]:[\\/]/.test(trimmed)) return true
+  if (trimmed.startsWith('\\\\') || trimmed.startsWith('//')) return true
+  return trimmed.startsWith('/')
+}
+
+interface ExportReportDialogProps {
+  open: boolean
+  /** Number of reports being exported, for the title/confirm label. */
+  count: number
+  pending: boolean
+  onOpenChange: (open: boolean) => void
+  onConfirm: (outputDir: string | undefined) => void
+}
+
+/**
+ * Export-path picker. The DSH WebView cannot open a native directory picker, so
+ * the user types an absolute directory (or leaves it empty for the default
+ * `~/.cortex/exports/<timestamp>/`); the Host writes the Markdown there.
+ */
+export function ExportReportDialog({
+  open,
+  count,
+  pending,
+  onOpenChange,
+  onConfirm
+}: ExportReportDialogProps) {
+  const { t } = useI18n()
+  const [directory, setDirectory] = useState('')
+  const [invalid, setInvalid] = useState(false)
+
+  useEffect(() => {
+    if (!open) return
+    const stored = window.localStorage.getItem(STORAGE_KEY) ?? ''
+    setDirectory(stored)
+    setInvalid(false)
+  }, [open])
+
+  const confirm = (): void => {
+    const trimmed = directory.trim()
+    if (trimmed !== '' && !isAbsoluteLike(trimmed)) {
+      setInvalid(true)
+      return
+    }
+    if (trimmed !== '') window.localStorage.setItem(STORAGE_KEY, trimmed)
+    else window.localStorage.removeItem(STORAGE_KEY)
+    onConfirm(trimmed === '' ? undefined : trimmed)
+  }
+
+  return (
+    <DialogPrimitive.Root open={open} onOpenChange={onOpenChange} modal={false}>
+      <DialogPrimitive.Portal container={getPortalContainer()}>
+        <DialogPrimitive.Overlay className="sheet-overlay fixed inset-0 z-[70] bg-[hsl(224_18%_10%/0.3)]" />
+        <DialogPrimitive.Content
+          data-testid="export-report-dialog"
+          className="fixed left-1/2 top-1/2 z-[70] w-[min(480px,calc(100vw-2rem))] -translate-x-1/2 -translate-y-1/2 rounded-xl border border-border bg-background p-5 shadow-panel focus:outline-none focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-ring"
+        >
+          <DialogPrimitive.Title className="text-[16px] font-medium tracking-tight text-foreground">
+            {t('vuln.export.title')}
+          </DialogPrimitive.Title>
+          <DialogPrimitive.Description className="mt-1.5 text-[12.5px] leading-relaxed text-muted-foreground">
+            {t('vuln.export.description', { count })}
+          </DialogPrimitive.Description>
+
+          <label
+            htmlFor="export-output-dir"
+            className="mt-4 flex items-center gap-1.5 text-[11.5px] font-medium text-foreground"
+          >
+            <FolderOpen aria-hidden="true" className="h-3.5 w-3.5 text-muted-foreground" />
+            {t('vuln.export.dirLabel')}
+          </label>
+          <input
+            id="export-output-dir"
+            data-testid="export-output-dir"
+            value={directory}
+            spellCheck={false}
+            disabled={pending}
+            placeholder={t('vuln.export.dirPlaceholder')}
+            onChange={(event) => {
+              setDirectory(event.target.value)
+              if (invalid) setInvalid(false)
+            }}
+            onKeyDown={(event) => {
+              if (event.key === 'Enter') confirm()
+            }}
+            className="mt-1.5 h-9 w-full rounded-md border border-border bg-background px-2.5 font-mono text-[11.5px] text-foreground placeholder:text-muted-foreground/70 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+          />
+          <p className={invalid ? 'mt-1.5 text-[10.5px] text-red-700' : 'mt-1.5 text-[10.5px] text-muted-foreground'}>
+            {invalid ? t('vuln.export.dirInvalid') : t('vuln.export.dirHint')}
+          </p>
+
+          <div className="mt-5 flex items-center justify-end gap-2">
+            <Button variant="outline" size="sm" onClick={() => onOpenChange(false)} disabled={pending}>
+              {t('common.cancel')}
+            </Button>
+            <Button size="sm" onClick={confirm} disabled={pending} className="gap-1.5">
+              {pending ? (
+                <Loader2 aria-hidden="true" className="h-3.5 w-3.5 animate-spin" />
+              ) : (
+                <Download aria-hidden="true" className="h-3.5 w-3.5" />
+              )}
+              {pending ? t('vuln.detail.exporting') : t('vuln.export.confirm')}
+            </Button>
+          </div>
+        </DialogPrimitive.Content>
+      </DialogPrimitive.Portal>
+    </DialogPrimitive.Root>
+  )
+}

package/src/cortex-ui/renderer/components/vuln/VulnDetail.tsx

@@ -27,6 +27,7 @@ import { EmptyState } from '@renderer/components/common/EmptyState'
 import { MarkdownText } from '@renderer/components/common/MarkdownText'
 import { VulnSummary } from './VulnSummary'
 import { ConfirmDeleteDialog } from './ConfirmDeleteDialog'
+import { ExportReportDialog } from './ExportReportDialog'
 import { apiUnavailableMessage, getApi, toErrorMessage } from '@renderer/lib/api'
 import { getPrefetchedVulnerability } from '@renderer/lib/vulnPreload'
 import { formatDateTime, formatVulnType } from '@renderer/lib/format'
@@ -137,6 +138,7 @@ export function VulnDetail({
   const [confirmOpen, setConfirmOpen] = useState(false)
   const [deleting, setDeleting] = useState(false)
   const [exporting, setExporting] = useState(false)
+  const [exportOpen, setExportOpen] = useState(false)
   const [activeTab, setActiveTab] = useState('steps')
 
   const { t, lang, statusLabel } = useI18n()
@@ -252,7 +254,7 @@ export function VulnDetail({
     }
   }
 
-  const handleExport = async () => {
+  const handleExport = async (outputDir?: string) => {
     if (!detail || loading) return
     const api = getApi()
     if (!api) {
@@ -261,12 +263,19 @@ export function VulnDetail({
     }
     setExporting(true)
     try {
-      const result = await api.exportVulnerabilities([detail.id])
-      if (!result.cancelled) toast.success(t('vuln.toast.exported'))
+      const result = await api.exportVulnerabilities([detail.id], outputDir)
+      if (!result.cancelled) {
+        const savedPath = result.savedPaths?.[0]
+        toast.success(
+          t('vuln.toast.exported'),
+          savedPath ? { description: t('vuln.toast.exportedPath', { path: savedPath }) } : undefined
+        )
+      }
     } catch (cause) {
       toast.error(t('vuln.toast.exportFailed', { error: toErrorMessage(cause, t) }))
     } finally {
       setExporting(false)
+      setExportOpen(false)
     }
   }
 
@@ -289,7 +298,7 @@ export function VulnDetail({
                   variant="ghost"
                   size="sm"
                   data-testid="export-vuln-md"
-                  onClick={() => void handleExport()}
+                  onClick={() => setExportOpen(true)}
                   disabled={loading || exporting}
                   className="h-7 gap-1.5 px-2 text-[11px]"
                 >
@@ -614,6 +623,14 @@ export function VulnDetail({
           onConfirm={() => void handleDelete()}
         />
       ) : null}
+
+      <ExportReportDialog
+        open={exportOpen}
+        count={1}
+        pending={exporting}
+        onOpenChange={setExportOpen}
+        onConfirm={(outputDir) => void handleExport(outputDir)}
+      />
     </>
   )
 }

package/src/cortex-ui/renderer/i18n/messages/vuln.ts

@@ -91,6 +91,14 @@ export const vulnMessages: MessageBundle = {
     'vuln.copy.codeBlockDone': '已复制代码块',
     'vuln.toast.exportedMany': '已导出 {count} 份 Markdown 报告',
     'vuln.toast.exported': 'Markdown 报告已导出',
+    'vuln.toast.exportedPath': '已保存到：{path}',
+    'vuln.export.title': '导出 Markdown 报告',
+    'vuln.export.description': '共 {count} 份报告。可指定导出目录，留空则使用默认目录。',
+    'vuln.export.dirLabel': '导出目录',
+    'vuln.export.dirPlaceholder': '例如 C:\\Users\\you\\Downloads',
+    'vuln.export.dirHint': '留空：~/.cortex/exports/<时间戳>/；支持绝对路径或 ~ 开头路径。',
+    'vuln.export.dirInvalid': '请输入绝对路径（如 C:\\Reports 或 ~/Reports）',
+    'vuln.export.confirm': '导出',
     'vuln.toast.exportFailed': '导出失败：{error}',
     'vuln.toast.deleted': '已删除 {id}',
     'vuln.toast.bulkDeleted': '已删除 {count} 条漏洞',
@@ -201,6 +209,14 @@ export const vulnMessages: MessageBundle = {
     'vuln.copy.codeBlockDone': 'Code block copied',
     'vuln.toast.exportedMany': 'Exported {count} Markdown reports',
     'vuln.toast.exported': 'Markdown report exported',
+    'vuln.toast.exportedPath': 'Saved to: {path}',
+    'vuln.export.title': 'Export Markdown report',
+    'vuln.export.description': '{count} report(s). Choose an output directory, or leave empty to use the default.',
+    'vuln.export.dirLabel': 'Output directory',
+    'vuln.export.dirPlaceholder': 'e.g. C:\\Users\\you\\Downloads',
+    'vuln.export.dirHint': 'Empty: ~/.cortex/exports/<timestamp>/; absolute or ~-prefixed paths are accepted.',
+    'vuln.export.dirInvalid': 'Enter an absolute path (e.g. C:\\Reports or ~/Reports)',
+    'vuln.export.confirm': 'Export',
     'vuln.toast.exportFailed': 'Export failed: {error}',
     'vuln.toast.deleted': 'Deleted {id}',
     'vuln.toast.bulkDeleted': 'Deleted {count} vulnerabilities',

package/src/cortex-ui/renderer/lib/retestRequest.ts

@@ -11,6 +11,23 @@ export interface RepeaterRequestCandidate {
 
 const REQUEST_LINE = /^([A-Z]+)\s+(\S+)\s+HTTP\/\d(?:\.\d)?$/
 
+/**
+ * Raw report requests carry only the origin-form path (`GET /api/x HTTP/1.1`),
+ * but the Host send API requires an absolute URL. Resolve against the finding's
+ * target so http-only targets stay http and https targets stay https.
+ */
+export function resolveRepeaterUrl(rawUrl: string, targetUrl: string): string {
+  const value = rawUrl.trim()
+  if (/^https?:\/\//i.test(value)) return value
+  try {
+    const target = new URL(targetUrl)
+    if (value.startsWith('//')) return `${target.protocol}${value}`
+    return new URL(value, target).href
+  } catch {
+    return value
+  }
+}
+
 function normalizePath(input: string): string {
   try {
     if (/^https?:\/\//i.test(input)) return new URL(input).pathname

package/src/cortex-ui/renderer/lib/transport/httpClient.ts

@@ -261,7 +261,10 @@ export function createHttpApi(): CortexApi {
      * saves them. Resolves the downloaded file names, or `cancelled` when there
      * was nothing to export (`files: []`).
      */
-    exportVulnerabilities: async (ids: string[]): Promise<ExportReportsResult> => {
+    exportVulnerabilities: async (
+      ids: string[],
+      _outputDir?: string
+    ): Promise<ExportReportsResult> => {
       const response = await request<WebExportResponse>(WEB_API_PATHS.vulnerabilitiesExport, {
         method: 'POST',
         body: ids

package/src/cortex-ui/renderer/pages/DashboardPage.tsx

@@ -15,6 +15,7 @@ import { PaginationBar } from '@renderer/components/vuln/PaginationBar'
 import { VulnTable } from '@renderer/components/vuln/VulnTable'
 import { VulnDetail } from '@renderer/components/vuln/VulnDetail'
 import { BulkDeleteDialog } from '@renderer/components/vuln/BulkDeleteDialog'
+import { ExportReportDialog } from '@renderer/components/vuln/ExportReportDialog'
 import { InternalPage } from '@renderer/pages/InternalPage'
 import { Button } from '@renderer/components/ui/button'
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '@renderer/components/ui/tabs'
@@ -62,6 +63,7 @@ export function DashboardPage({
   const [bulkConfirmOpen, setBulkConfirmOpen] = useState(false)
   const [bulkDeleting, setBulkDeleting] = useState(false)
   const [exporting, setExporting] = useState(false)
+  const [exportOpen, setExportOpen] = useState(false)
 
   const hasLoadedList = useRef(false)
   const searchInputRef = useRef<HTMLInputElement | null>(null)
@@ -302,28 +304,34 @@ export function DashboardPage({
     [items]
   )
 
-  const handleExportSelected = async () => {
+  const handleExportSelected = async (outputDir?: string) => {
     const ids = [...selectedIds]
     if (ids.length === 0) return
     const api = getApi()
     if (!api) {
       toast.error(apiUnavailableMessage(t))
+      setExportOpen(false)
       return
     }
     setExporting(true)
     try {
-      const result = await api.exportVulnerabilities(ids)
+      const result = await api.exportVulnerabilities(ids, outputDir)
+      const savedPath = result.savedPaths?.[0]
       if (!result.cancelled) {
-        toast.success(
+        const message =
           result.files.length > 1
             ? t('vuln.toast.exportedMany', { count: result.files.length })
             : t('vuln.toast.exported')
+        toast.success(
+          message,
+          savedPath ? { description: t('vuln.toast.exportedPath', { path: savedPath }) } : undefined
         )
       }
     } catch (cause) {
       toast.error(t('vuln.toast.exportFailed', { error: toErrorMessage(cause, t) }))
     } finally {
       setExporting(false)
+      setExportOpen(false)
     }
   }
 
@@ -439,7 +447,7 @@ export function DashboardPage({
                 <Button
                   variant="outline"
                   size="sm"
-                  onClick={() => void handleExportSelected()}
+                  onClick={() => setExportOpen(true)}
                   disabled={exporting}
                   className="gap-1.5"
                 >
@@ -522,6 +530,14 @@ export function DashboardPage({
         onOpenChange={setBulkConfirmOpen}
         onConfirm={() => void handleBulkDelete()}
       />
+
+      <ExportReportDialog
+        open={exportOpen}
+        count={selectedCount}
+        pending={exporting}
+        onOpenChange={setExportOpen}
+        onConfirm={(outputDir) => void handleExportSelected(outputDir)}
+      />
     </>
   )
 }

package/src/cortex-ui/shared/ipc.ts

@@ -158,8 +158,12 @@ export interface CortexApi extends PocApi {
   updateVulnerabilityStatus(input: UpdateVulnStatusRequest): Promise<Vulnerability>
   deleteVulnerability(id: string): Promise<DeleteVulnResult>
   deleteVulnerabilities(ids: string[]): Promise<DeleteVulnsResult>
-  /** Export one or more vulnerability reports as Markdown (save file / pick directory). */
-  exportVulnerabilities(ids: string[]): Promise<ExportReportsResult>
+  /**
+   * Export one or more vulnerability reports as Markdown. `outputDir` is an
+   * absolute directory chosen by the user; omitted/empty means the Host default
+   * (`~/.cortex/exports/<timestamp>/`).
+   */
+  exportVulnerabilities(ids: string[], outputDir?: string): Promise<ExportReportsResult>
   listAssets(filters?: AssetFilters): Promise<AssetListItem[]>
   getAssetDetail(hostPort: string): Promise<AssetContext | null>
   getAssetRelatedVulnerabilities(hostPort: string): Promise<VulnerabilityListItem[]>

package/src/cortex-ui/shared/types.ts

@@ -1020,8 +1020,10 @@ export interface DeleteVulnsResult {
 
 export interface ExportReportsResult {
   cancelled: boolean
-  /** Absolute paths of the written Markdown files. */
+  /** File names (or absolute paths for desktop transports) of exported reports. */
   files: string[]
+  /** DSH Host also writes reports under ~/.cortex/exports and returns them here. */
+  savedPaths?: string[]
 }
 
 export interface SeedDemoResult {

package/src/cortex-ui/shared/web.ts

@@ -72,6 +72,8 @@ export interface WebExportFile {
 /** Response of `POST /api/vulns/export`; the browser downloads these, nothing is written server-side. */
 export interface WebExportResponse {
   files: WebExportFile[]
+  /** Optional Host-side saved copies (`~/.cortex/exports/...`) for desktop builds. */
+  savedPaths?: string[]
 }
 
 /**

package/src/host/cortex/vulns.js

@@ -34,6 +34,9 @@ import {
 } from '../http.js'
 import * as dto from '../dto.js'
 import { buildVulnReport, reportFilename } from '../reports.js'
+import { mkdirSync, writeFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { isAbsolute, join, resolve } from 'node:path'
 
 const SEVERITIES = ['Critical', 'High', 'Medium', 'Low', 'Info']
 const STATUSES = ['Confirmed', 'Inconclusive', 'Retest_Passed']
@@ -496,8 +499,28 @@ export async function handleDeleteMany({ req, res, holder, bumpRev }) {
 export async function handleExport({ req, res, holder, bumpRev }) {
   const body = await readJsonBody(req)
   const ids = requireIdList(body, 'ids', MAX_EXPORT_IDS)
+  /** Optional user-selected output directory (absolute path, `~` allowed). */
+  let requestedDir
+  if (body.outputDir !== undefined) {
+    if (typeof body.outputDir !== 'string') {
+      throw badRequest('outputDir must be a string', { field: 'outputDir' })
+    }
+    const raw = body.outputDir.trim()
+    if (raw.length > 1000) {
+      throw badRequest('outputDir is too long', { field: 'outputDir', max: 1000 })
+    }
+    if (raw.length > 0) {
+      const expanded = raw.startsWith('~')
+        ? join(homedir(), raw.replace(/^~[/\\]?/, ''))
+        : raw
+      if (!isAbsolute(expanded)) {
+        throw badRequest('outputDir must be an absolute path', { field: 'outputDir' })
+      }
+      requestedDir = resolve(expanded)
+    }
+  }
   if (ids.length === 0) {
-    sendJson(res, 200, { cancelled: true, files: [] })
+    sendJson(res, 200, { cancelled: true, files: [], savedPaths: [] })
     return
   }
   const db = holder.db
@@ -525,9 +548,43 @@ export async function handleExport({ req, res, holder, bumpRev }) {
       content: buildVulnReport(detail, related),
     })
   }
+  // The DSH desktop WebView may block browser downloads, so the Host also
+  // writes the Markdown reports to ~/.cortex/exports/<timestamp>/ and returns
+  // the absolute paths. The renderer still attempts a normal download, but the
+  // toast can then point at a real file that always exists.
+  const savedPaths = []
+  if (files.length > 0) {
+    try {
+      const exportRoot = process.env.CORTEX_EXPORT_DIR || join(homedir(), '.cortex', 'exports')
+      const stamp = new Date()
+        .toISOString()
+        .replace(/[-:]/g, '')
+        .replace(/\..+$/, '')
+        .replace('T', '-')
+      const exportDir = requestedDir ?? join(exportRoot, stamp)
+      mkdirSync(exportDir, { recursive: true })
+      for (let index = 0; index < files.length; index += 1) {
+        const file = files[index]
+        const safeName = String(file.filename).replace(/[<>:"/\\|?*\u0000-\u001f]/g, '_').slice(0, 120) || file.id
+        const baseName = safeName.endsWith('.md') ? safeName : `${safeName}.md`
+        const target = join(exportDir, files.length > 1 ? `${String(index + 1).padStart(2, '0')}-${baseName}` : baseName)
+        writeFileSync(target, file.content, 'utf8')
+        savedPaths.push(target)
+      }
+    } catch (error) {
+      // Filesystem failure must not break the export response; the inline
+      // files still let the browser download attempt proceed. A selected
+      // directory failure is reported so the user can correct the path.
+      if (requestedDir !== undefined) {
+        throw badRequest(`cannot write to outputDir: ${error instanceof Error ? error.message : String(error)}`, {
+          field: 'outputDir',
+        })
+      }
+    }
+  }
   // Export is a read-only projection: no revision bump.
   void bumpRev
-  sendJson(res, 200, { cancelled: files.length === 0, files })
+  sendJson(res, 200, { cancelled: files.length === 0, files, savedPaths })
 }
 
 export { SEVERITIES, STATUSES, REALM_FILTERS, VULN_ORDER }