@lievclouds/dsh-cortex 0.4.2 → 0.4.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lievclouds/dsh-cortex",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "Cortex workbench for DeepSeek Harness: the original Cortex UI (vulnerabilities, assets, internal operations, Memory Nebula, snapshots, retest) as a native DSH panel, plus 12 native agent tools so DSH conversations use the local Cortex SQLite without MCP.",
   "type": "module",
   "main": "index.js",

package/src/cortex-ui/dsh/api.ts

@@ -112,8 +112,11 @@ export function createCortexApi(): CortexApi {
       patch(`/vulns/${encodeURIComponent(input.id)}/status`, { status: input.status }),
     deleteVulnerability: (id) => del(`/vulns/${encodeURIComponent(id)}`),
     deleteVulnerabilities: (ids) => post('/vulns/delete-many', { ids }),
-    exportVulnerabilities: async (ids) => {
-      const response = await post('/vulns/export', { ids })
+    exportVulnerabilities: async (ids, outputDir) => {
+      const response = await post('/vulns/export', {
+        ids,
+        ...(outputDir && outputDir.trim() !== '' ? { outputDir: outputDir.trim() } : {}),
+      })
       const files = Array.isArray(response?.files) ? response.files : []
       const savedPaths = Array.isArray(response?.savedPaths) ? response.savedPaths : []
       return {

package/src/cortex-ui/renderer/components/vuln/ExportReportDialog.tsx

@@ -0,0 +1,120 @@
+import * as DialogPrimitive from '@radix-ui/react-dialog'
+import { Download, FolderOpen, Loader2 } from 'lucide-react'
+import { useEffect, useState } from 'react'
+import { Button } from '@renderer/components/ui/button'
+import { useI18n } from '@renderer/i18n'
+import { getPortalContainer } from '../../../dsh/portal'
+
+const STORAGE_KEY = 'cortex.export.dir'
+
+function isAbsoluteLike(value: string): boolean {
+  const trimmed = value.trim()
+  if (trimmed.startsWith('~')) return true
+  if (/^[A-Za-z]:[\\/]/.test(trimmed)) return true
+  if (trimmed.startsWith('\\\\') || trimmed.startsWith('//')) return true
+  return trimmed.startsWith('/')
+}
+
+interface ExportReportDialogProps {
+  open: boolean
+  /** Number of reports being exported, for the title/confirm label. */
+  count: number
+  pending: boolean
+  onOpenChange: (open: boolean) => void
+  onConfirm: (outputDir: string | undefined) => void
+}
+
+/**
+ * Export-path picker. The DSH WebView cannot open a native directory picker, so
+ * the user types an absolute directory (or leaves it empty for the default
+ * `~/.cortex/exports/<timestamp>/`); the Host writes the Markdown there.
+ */
+export function ExportReportDialog({
+  open,
+  count,
+  pending,
+  onOpenChange,
+  onConfirm
+}: ExportReportDialogProps) {
+  const { t } = useI18n()
+  const [directory, setDirectory] = useState('')
+  const [invalid, setInvalid] = useState(false)
+
+  useEffect(() => {
+    if (!open) return
+    const stored = window.localStorage.getItem(STORAGE_KEY) ?? ''
+    setDirectory(stored)
+    setInvalid(false)
+  }, [open])
+
+  const confirm = (): void => {
+    const trimmed = directory.trim()
+    if (trimmed !== '' && !isAbsoluteLike(trimmed)) {
+      setInvalid(true)
+      return
+    }
+    if (trimmed !== '') window.localStorage.setItem(STORAGE_KEY, trimmed)
+    else window.localStorage.removeItem(STORAGE_KEY)
+    onConfirm(trimmed === '' ? undefined : trimmed)
+  }
+
+  return (
+    <DialogPrimitive.Root open={open} onOpenChange={onOpenChange} modal={false}>
+      <DialogPrimitive.Portal container={getPortalContainer()}>
+        <DialogPrimitive.Overlay className="sheet-overlay fixed inset-0 z-[70] bg-[hsl(224_18%_10%/0.3)]" />
+        <DialogPrimitive.Content
+          data-testid="export-report-dialog"
+          className="fixed left-1/2 top-1/2 z-[70] w-[min(480px,calc(100vw-2rem))] -translate-x-1/2 -translate-y-1/2 rounded-xl border border-border bg-background p-5 shadow-panel focus:outline-none focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-ring"
+        >
+          <DialogPrimitive.Title className="text-[16px] font-medium tracking-tight text-foreground">
+            {t('vuln.export.title')}
+          </DialogPrimitive.Title>
+          <DialogPrimitive.Description className="mt-1.5 text-[12.5px] leading-relaxed text-muted-foreground">
+            {t('vuln.export.description', { count })}
+          </DialogPrimitive.Description>
+
+          <label
+            htmlFor="export-output-dir"
+            className="mt-4 flex items-center gap-1.5 text-[11.5px] font-medium text-foreground"
+          >
+            <FolderOpen aria-hidden="true" className="h-3.5 w-3.5 text-muted-foreground" />
+            {t('vuln.export.dirLabel')}
+          </label>
+          <input
+            id="export-output-dir"
+            data-testid="export-output-dir"
+            value={directory}
+            spellCheck={false}
+            disabled={pending}
+            placeholder={t('vuln.export.dirPlaceholder')}
+            onChange={(event) => {
+              setDirectory(event.target.value)
+              if (invalid) setInvalid(false)
+            }}
+            onKeyDown={(event) => {
+              if (event.key === 'Enter') confirm()
+            }}
+            className="mt-1.5 h-9 w-full rounded-md border border-border bg-background px-2.5 font-mono text-[11.5px] text-foreground placeholder:text-muted-foreground/70 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+          />
+          <p className={invalid ? 'mt-1.5 text-[10.5px] text-red-700' : 'mt-1.5 text-[10.5px] text-muted-foreground'}>
+            {invalid ? t('vuln.export.dirInvalid') : t('vuln.export.dirHint')}
+          </p>
+
+          <div className="mt-5 flex items-center justify-end gap-2">
+            <Button variant="outline" size="sm" onClick={() => onOpenChange(false)} disabled={pending}>
+              {t('common.cancel')}
+            </Button>
+            <Button size="sm" onClick={confirm} disabled={pending} className="gap-1.5">
+              {pending ? (
+                <Loader2 aria-hidden="true" className="h-3.5 w-3.5 animate-spin" />
+              ) : (
+                <Download aria-hidden="true" className="h-3.5 w-3.5" />
+              )}
+              {pending ? t('vuln.detail.exporting') : t('vuln.export.confirm')}
+            </Button>
+          </div>
+        </DialogPrimitive.Content>
+      </DialogPrimitive.Portal>
+    </DialogPrimitive.Root>
+  )
+}

package/src/cortex-ui/renderer/components/vuln/VulnDetail.tsx

@@ -27,6 +27,7 @@ import { EmptyState } from '@renderer/components/common/EmptyState'
 import { MarkdownText } from '@renderer/components/common/MarkdownText'
 import { VulnSummary } from './VulnSummary'
 import { ConfirmDeleteDialog } from './ConfirmDeleteDialog'
+import { ExportReportDialog } from './ExportReportDialog'
 import { apiUnavailableMessage, getApi, toErrorMessage } from '@renderer/lib/api'
 import { getPrefetchedVulnerability } from '@renderer/lib/vulnPreload'
 import { formatDateTime, formatVulnType } from '@renderer/lib/format'
@@ -137,6 +138,7 @@ export function VulnDetail({
   const [confirmOpen, setConfirmOpen] = useState(false)
   const [deleting, setDeleting] = useState(false)
   const [exporting, setExporting] = useState(false)
+  const [exportOpen, setExportOpen] = useState(false)
   const [activeTab, setActiveTab] = useState('steps')
 
   const { t, lang, statusLabel } = useI18n()
@@ -252,7 +254,7 @@ export function VulnDetail({
     }
   }
 
-  const handleExport = async () => {
+  const handleExport = async (outputDir?: string) => {
     if (!detail || loading) return
     const api = getApi()
     if (!api) {
@@ -261,7 +263,7 @@ export function VulnDetail({
     }
     setExporting(true)
     try {
-      const result = await api.exportVulnerabilities([detail.id])
+      const result = await api.exportVulnerabilities([detail.id], outputDir)
       if (!result.cancelled) {
         const savedPath = result.savedPaths?.[0]
         toast.success(
@@ -273,6 +275,7 @@ export function VulnDetail({
       toast.error(t('vuln.toast.exportFailed', { error: toErrorMessage(cause, t) }))
     } finally {
       setExporting(false)
+      setExportOpen(false)
     }
   }
 
@@ -295,7 +298,7 @@ export function VulnDetail({
                   variant="ghost"
                   size="sm"
                   data-testid="export-vuln-md"
-                  onClick={() => void handleExport()}
+                  onClick={() => setExportOpen(true)}
                   disabled={loading || exporting}
                   className="h-7 gap-1.5 px-2 text-[11px]"
                 >
@@ -620,6 +623,14 @@ export function VulnDetail({
           onConfirm={() => void handleDelete()}
         />
       ) : null}
+
+      <ExportReportDialog
+        open={exportOpen}
+        count={1}
+        pending={exporting}
+        onOpenChange={setExportOpen}
+        onConfirm={(outputDir) => void handleExport(outputDir)}
+      />
     </>
   )
 }

package/src/cortex-ui/renderer/i18n/messages/vuln.ts

@@ -92,6 +92,13 @@ export const vulnMessages: MessageBundle = {
     'vuln.toast.exportedMany': '已导出 {count} 份 Markdown 报告',
     'vuln.toast.exported': 'Markdown 报告已导出',
     'vuln.toast.exportedPath': '已保存到：{path}',
+    'vuln.export.title': '导出 Markdown 报告',
+    'vuln.export.description': '共 {count} 份报告。可指定导出目录，留空则使用默认目录。',
+    'vuln.export.dirLabel': '导出目录',
+    'vuln.export.dirPlaceholder': '例如 C:\\Users\\you\\Downloads',
+    'vuln.export.dirHint': '留空：~/.cortex/exports/<时间戳>/；支持绝对路径或 ~ 开头路径。',
+    'vuln.export.dirInvalid': '请输入绝对路径（如 C:\\Reports 或 ~/Reports）',
+    'vuln.export.confirm': '导出',
     'vuln.toast.exportFailed': '导出失败：{error}',
     'vuln.toast.deleted': '已删除 {id}',
     'vuln.toast.bulkDeleted': '已删除 {count} 条漏洞',
@@ -203,6 +210,13 @@ export const vulnMessages: MessageBundle = {
     'vuln.toast.exportedMany': 'Exported {count} Markdown reports',
     'vuln.toast.exported': 'Markdown report exported',
     'vuln.toast.exportedPath': 'Saved to: {path}',
+    'vuln.export.title': 'Export Markdown report',
+    'vuln.export.description': '{count} report(s). Choose an output directory, or leave empty to use the default.',
+    'vuln.export.dirLabel': 'Output directory',
+    'vuln.export.dirPlaceholder': 'e.g. C:\\Users\\you\\Downloads',
+    'vuln.export.dirHint': 'Empty: ~/.cortex/exports/<timestamp>/; absolute or ~-prefixed paths are accepted.',
+    'vuln.export.dirInvalid': 'Enter an absolute path (e.g. C:\\Reports or ~/Reports)',
+    'vuln.export.confirm': 'Export',
     'vuln.toast.exportFailed': 'Export failed: {error}',
     'vuln.toast.deleted': 'Deleted {id}',
     'vuln.toast.bulkDeleted': 'Deleted {count} vulnerabilities',

package/src/cortex-ui/renderer/lib/transport/httpClient.ts

@@ -261,7 +261,10 @@ export function createHttpApi(): CortexApi {
      * saves them. Resolves the downloaded file names, or `cancelled` when there
      * was nothing to export (`files: []`).
      */
-    exportVulnerabilities: async (ids: string[]): Promise<ExportReportsResult> => {
+    exportVulnerabilities: async (
+      ids: string[],
+      _outputDir?: string
+    ): Promise<ExportReportsResult> => {
       const response = await request<WebExportResponse>(WEB_API_PATHS.vulnerabilitiesExport, {
         method: 'POST',
         body: ids

package/src/cortex-ui/renderer/pages/DashboardPage.tsx

@@ -15,6 +15,7 @@ import { PaginationBar } from '@renderer/components/vuln/PaginationBar'
 import { VulnTable } from '@renderer/components/vuln/VulnTable'
 import { VulnDetail } from '@renderer/components/vuln/VulnDetail'
 import { BulkDeleteDialog } from '@renderer/components/vuln/BulkDeleteDialog'
+import { ExportReportDialog } from '@renderer/components/vuln/ExportReportDialog'
 import { InternalPage } from '@renderer/pages/InternalPage'
 import { Button } from '@renderer/components/ui/button'
 import { Tabs, TabsContent, TabsList, TabsTrigger } from '@renderer/components/ui/tabs'
@@ -62,6 +63,7 @@ export function DashboardPage({
   const [bulkConfirmOpen, setBulkConfirmOpen] = useState(false)
   const [bulkDeleting, setBulkDeleting] = useState(false)
   const [exporting, setExporting] = useState(false)
+  const [exportOpen, setExportOpen] = useState(false)
 
   const hasLoadedList = useRef(false)
   const searchInputRef = useRef<HTMLInputElement | null>(null)
@@ -302,17 +304,18 @@ export function DashboardPage({
     [items]
   )
 
-  const handleExportSelected = async () => {
+  const handleExportSelected = async (outputDir?: string) => {
     const ids = [...selectedIds]
     if (ids.length === 0) return
     const api = getApi()
     if (!api) {
       toast.error(apiUnavailableMessage(t))
+      setExportOpen(false)
       return
     }
     setExporting(true)
     try {
-      const result = await api.exportVulnerabilities(ids)
+      const result = await api.exportVulnerabilities(ids, outputDir)
       const savedPath = result.savedPaths?.[0]
       if (!result.cancelled) {
         const message =
@@ -328,6 +331,7 @@ export function DashboardPage({
       toast.error(t('vuln.toast.exportFailed', { error: toErrorMessage(cause, t) }))
     } finally {
       setExporting(false)
+      setExportOpen(false)
     }
   }
 
@@ -443,7 +447,7 @@ export function DashboardPage({
                 <Button
                   variant="outline"
                   size="sm"
-                  onClick={() => void handleExportSelected()}
+                  onClick={() => setExportOpen(true)}
                   disabled={exporting}
                   className="gap-1.5"
                 >
@@ -526,6 +530,14 @@ export function DashboardPage({
         onOpenChange={setBulkConfirmOpen}
         onConfirm={() => void handleBulkDelete()}
       />
+
+      <ExportReportDialog
+        open={exportOpen}
+        count={selectedCount}
+        pending={exporting}
+        onOpenChange={setExportOpen}
+        onConfirm={(outputDir) => void handleExportSelected(outputDir)}
+      />
     </>
   )
 }

package/src/cortex-ui/shared/ipc.ts

@@ -158,8 +158,12 @@ export interface CortexApi extends PocApi {
   updateVulnerabilityStatus(input: UpdateVulnStatusRequest): Promise<Vulnerability>
   deleteVulnerability(id: string): Promise<DeleteVulnResult>
   deleteVulnerabilities(ids: string[]): Promise<DeleteVulnsResult>
-  /** Export one or more vulnerability reports as Markdown (save file / pick directory). */
-  exportVulnerabilities(ids: string[]): Promise<ExportReportsResult>
+  /**
+   * Export one or more vulnerability reports as Markdown. `outputDir` is an
+   * absolute directory chosen by the user; omitted/empty means the Host default
+   * (`~/.cortex/exports/<timestamp>/`).
+   */
+  exportVulnerabilities(ids: string[], outputDir?: string): Promise<ExportReportsResult>
   listAssets(filters?: AssetFilters): Promise<AssetListItem[]>
   getAssetDetail(hostPort: string): Promise<AssetContext | null>
   getAssetRelatedVulnerabilities(hostPort: string): Promise<VulnerabilityListItem[]>

package/src/host/cortex/vulns.js

@@ -36,7 +36,7 @@ import * as dto from '../dto.js'
 import { buildVulnReport, reportFilename } from '../reports.js'
 import { mkdirSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
-import { join } from 'node:path'
+import { isAbsolute, join, resolve } from 'node:path'
 
 const SEVERITIES = ['Critical', 'High', 'Medium', 'Low', 'Info']
 const STATUSES = ['Confirmed', 'Inconclusive', 'Retest_Passed']
@@ -499,6 +499,26 @@ export async function handleDeleteMany({ req, res, holder, bumpRev }) {
 export async function handleExport({ req, res, holder, bumpRev }) {
   const body = await readJsonBody(req)
   const ids = requireIdList(body, 'ids', MAX_EXPORT_IDS)
+  /** Optional user-selected output directory (absolute path, `~` allowed). */
+  let requestedDir
+  if (body.outputDir !== undefined) {
+    if (typeof body.outputDir !== 'string') {
+      throw badRequest('outputDir must be a string', { field: 'outputDir' })
+    }
+    const raw = body.outputDir.trim()
+    if (raw.length > 1000) {
+      throw badRequest('outputDir is too long', { field: 'outputDir', max: 1000 })
+    }
+    if (raw.length > 0) {
+      const expanded = raw.startsWith('~')
+        ? join(homedir(), raw.replace(/^~[/\\]?/, ''))
+        : raw
+      if (!isAbsolute(expanded)) {
+        throw badRequest('outputDir must be an absolute path', { field: 'outputDir' })
+      }
+      requestedDir = resolve(expanded)
+    }
+  }
   if (ids.length === 0) {
     sendJson(res, 200, { cancelled: true, files: [], savedPaths: [] })
     return
@@ -541,18 +561,25 @@ export async function handleExport({ req, res, holder, bumpRev }) {
         .replace(/[-:]/g, '')
         .replace(/\..+$/, '')
         .replace('T', '-')
-      const exportDir = join(exportRoot, stamp)
+      const exportDir = requestedDir ?? join(exportRoot, stamp)
       mkdirSync(exportDir, { recursive: true })
       for (let index = 0; index < files.length; index += 1) {
         const file = files[index]
         const safeName = String(file.filename).replace(/[<>:"/\\|?*\u0000-\u001f]/g, '_').slice(0, 120) || file.id
-        const target = join(exportDir, `${String(index + 1).padStart(2, '0')}-${safeName.endsWith('.md') ? safeName : `${safeName}.md`}`)
+        const baseName = safeName.endsWith('.md') ? safeName : `${safeName}.md`
+        const target = join(exportDir, files.length > 1 ? `${String(index + 1).padStart(2, '0')}-${baseName}` : baseName)
         writeFileSync(target, file.content, 'utf8')
         savedPaths.push(target)
       }
-    } catch {
+    } catch (error) {
       // Filesystem failure must not break the export response; the inline
-      // files still let the browser download attempt proceed.
+      // files still let the browser download attempt proceed. A selected
+      // directory failure is reported so the user can correct the path.
+      if (requestedDir !== undefined) {
+        throw badRequest(`cannot write to outputDir: ${error instanceof Error ? error.message : String(error)}`, {
+          field: 'outputDir',
+        })
+      }
     }
   }
   // Export is a read-only projection: no revision bump.