@lievclouds/dsh-cortex 0.4.4 → 1.0.0

package/src/cortex-ui/renderer/lib/miniappApi.ts

@@ -0,0 +1,459 @@
+/**
+ * Typed client for the mini-program reverse-engineering routes.
+ *
+ * Contract: `.tmp/miniapp-contract.md` §3.7 — every route lives under
+ * `/cortex-api/cortex`, talks JSON and uses the host `{error, code}` envelope
+ * for non-2xx responses. The page calls these wrappers directly (instead of
+ * `CortexApi`) because the miniapp feature is plugin-host-only and does not
+ * exist in the upstream Cortex IPC surface.
+ */
+
+const BASE = '/cortex-api/cortex'
+
+export class MiniappApiError extends Error {
+  code: string
+
+  constructor(message: string, code: string) {
+    super(message)
+    this.name = 'MiniappApiError'
+    this.code = code
+  }
+}
+
+export type MiniappStatus = 'detected' | 'decrypting' | 'unpacked' | 'unsupported' | 'failed'
+
+export const MINIAPP_STATUSES: readonly MiniappStatus[] = [
+  'detected',
+  'decrypting',
+  'unpacked',
+  'unsupported',
+  'failed'
+]
+
+export type MiniappFormat = 'plain' | 'v1mmwx' | 'unknown'
+
+export type MiniappKind = 'app' | 'plugin' | 'library' | 'unknown'
+
+/** One detected package group (all packages of one appid+version). */
+export interface MiniappRow {
+  id: string
+  appid: string
+  app_name: string
+  kind?: MiniappKind
+  version: string
+  root_kind: string
+  package_dir: string
+  size_bytes: number
+  file_count: number
+  format: MiniappFormat | string
+  status: MiniappStatus
+  unpacked_path: string
+  error: string
+  detected_at: string
+  updated_at: string
+  version_count?: number
+  is_latest?: boolean
+  has_analysis?: boolean
+  /** Number of WeChat user-cache copies collapsed into this row. */
+  source_count?: number
+}
+
+export interface MiniappListResponse {
+  miniapps: MiniappRow[]
+  total: number
+  appCount: number
+  customRoots: string[]
+  workspaceRoot: string
+  lastScanAt: string | null
+}
+
+export interface MiniappScanError {
+  root?: string
+  path?: string
+  message: string
+}
+
+export interface MiniappScanRoot {
+  kind: string
+  path: string
+  exists: boolean
+  filesFound?: number
+  errors?: number
+}
+
+export interface MiniappScanResponse {
+  ok: boolean
+  scannedAt: string
+  totalSources: number
+  totalPackages: number
+  added: number
+  updated: number
+  unchanged: number
+  errors: MiniappScanError[]
+  roots?: MiniappScanRoot[]
+  appCount?: number
+  miniapps: MiniappRow[]
+}
+
+export interface MiniappRoot {
+  kind: string
+  path: string
+  label: string
+  exists: boolean
+}
+
+export interface MiniappRootsResponse {
+  roots: MiniappRoot[]
+  customRoots: string[]
+}
+
+export interface MiniappVersion {
+  id: string
+  version: string
+  status: MiniappStatus
+  format: string
+  size_bytes: number
+  file_count: number
+  updated_at: string
+  unpacked_path: string
+  source_count?: number
+}
+
+export interface MiniappManifestTotals {
+  packages?: number
+  files?: number
+  bytes?: number
+  skipped?: number
+  conflicts?: number
+  unsupportedPackages?: number
+}
+
+export interface MiniappManifest {
+  appid?: string
+  version?: string
+  generatedAt?: string
+  packages?: Array<{ file: string; size: number; format: string; entries: number; bytes: number }>
+  totals?: MiniappManifestTotals
+  files?: Array<{ path: string; size: number }>
+  conflicts?: Array<{ path: string; keptFrom: string; ignoredFrom: string }>
+  error?: string
+}
+
+export interface MiniappFileStats {
+  total: number
+  text: number
+  binary: number
+  bytes: number
+}
+
+export interface MiniappAnalysis {
+  appid: string
+  version: string
+  generatedAt: string
+  files: MiniappFileStats
+  byExtension: Array<{ ext: string; count: number; bytes: number }>
+  pages: string[]
+  subPackages: Array<{ root: string; pages: string[] }>
+  domains: Array<{ host: string; count: number; examples: string[]; files: string[] }>
+  endpoints: Array<{ path: string; method?: string; count: number; files: string[] }>
+  secrets: Array<{
+    info_type: string
+    name: string
+    value_masked: string
+    value?: string
+    source: string
+    line: number
+    potential_impact?: string
+  }>
+  parameters: Array<{
+    name: string
+    endpoint: string
+    location: string
+    values: string[]
+    pattern?: string
+    source: string
+  }>
+  largestFiles: Array<{ path: string; size: number }>
+  warnings: string[]
+}
+
+export interface MiniappExtractedCounts {
+  domains: number
+  endpoints: number
+  secrets: number
+  parameters: number
+}
+
+export interface MiniappDetailResponse {
+  miniapp: MiniappRow & { versions: MiniappVersion[] }
+  manifest: MiniappManifest | null
+  analysis: MiniappAnalysis | null
+  overviewText: string
+  extractedCounts: MiniappExtractedCounts
+}
+
+export interface MiniappUnpackTotals {
+  packages?: number
+  files?: number
+  bytes?: number
+  skipped?: number
+  conflicts?: number
+}
+
+export interface MiniappUnpackResponse {
+  ok: boolean
+  status: MiniappStatus
+  miniapp: MiniappRow
+  manifest: MiniappManifest | null
+  totals: MiniappUnpackTotals
+  error: string
+}
+
+export interface MiniappAnalyzeResponse {
+  ok: boolean
+  analysis: MiniappAnalysis | null
+  overviewText: string
+  counts: MiniappExtractedCounts
+}
+
+export interface MiniappTreeEntry {
+  name: string
+  path: string
+  type: 'file' | 'dir'
+  size: number
+}
+
+export interface MiniappTreeResponse {
+  path: string
+  entries: MiniappTreeEntry[]
+}
+
+export interface MiniappFileMatch {
+  line: number
+  text: string
+}
+
+export interface MiniappFileResponse {
+  path: string
+  content: string
+  offset: number
+  limit: number
+  loadedLines?: number
+  totalLines: number
+  hasMore?: boolean
+  truncated: boolean
+  sourceTruncated?: boolean
+  matches?: MiniappFileMatch[]
+  matchCount?: number
+  matchTruncated?: boolean
+  size: number
+  binary: boolean
+  formatted?: boolean
+  language?: string
+}
+
+export interface MiniappSearchMatch {
+  file: string
+  line: number
+  text: string
+}
+
+export interface MiniappSearchResponse {
+  matches: MiniappSearchMatch[]
+  scanned: number
+  truncated: boolean
+  query: string
+}
+
+export interface MiniappImportAsset {
+  host_port: string
+  created: boolean
+  interfaces: number
+  leaks: number
+  parameters: number
+}
+
+export interface MiniappImportResponse {
+  ok: boolean
+  project: string
+  assets: MiniappImportAsset[]
+  totals: { assets: number; interfaces: number; leaks: number; parameters: number }
+  warnings: string[]
+}
+
+export interface MiniappOpenResponse {
+  ok: boolean
+  path: string
+}
+
+export interface MiniappListParams {
+  search?: string
+  status?: MiniappStatus | ''
+}
+
+function toQuery(query: Record<string, unknown> | undefined): string {
+  if (!query) return ''
+  const params = new URLSearchParams()
+  for (const key of Object.keys(query)) {
+    const value = query[key]
+    if (value === undefined || value === null || value === '') continue
+    params.set(key, String(value))
+  }
+  const text = params.toString()
+  return text ? `?${text}` : ''
+}
+
+async function request<T>(path: string, init?: { method?: string; json?: unknown }): Promise<T> {
+  const method = (init && init.method) || 'GET'
+  const options: RequestInit = {
+    method,
+    credentials: 'same-origin',
+    cache: 'no-store',
+    headers: { Accept: 'application/json' }
+  }
+  if (init && init.json !== undefined) {
+    options.body = JSON.stringify(init.json)
+    ;(options.headers as Record<string, string>)['Content-Type'] = 'application/json'
+  }
+  const response = await fetch(BASE + path, options)
+  if (!response.ok) {
+    let payload: {
+      error?: string
+      message?: string
+      code?: string
+      details?: { code?: string }
+    } | null = null
+    try {
+      payload = await response.json()
+    } catch {
+      /* non-JSON error */
+    }
+    // The host envelope uses a generic `BAD_REQUEST` code and puts the specific
+    // reason (e.g. `BINARY_FILE`) in `details.code`; prefer the specific one so
+    // callers can branch on it without parsing messages.
+    const specific = payload?.details?.code
+    throw new MiniappApiError(
+      String(payload?.error || payload?.message || `HTTP ${response.status}`),
+      String(specific || payload?.code || `HTTP_${response.status}`)
+    )
+  }
+  if (response.status === 204) return undefined as T
+  const text = await response.text()
+  if (!text) return undefined as T
+  return JSON.parse(text) as T
+}
+
+const encodeId = (id: string): string => encodeURIComponent(id)
+
+export function listMiniapps(params: MiniappListParams = {}): Promise<MiniappListResponse> {
+  return request<MiniappListResponse>(`/miniapps${toQuery({ search: params.search, status: params.status })}`)
+}
+
+export function scanMiniapps(customRoots: string[] = []): Promise<MiniappScanResponse> {
+  return request<MiniappScanResponse>('/miniapps/scan', { method: 'POST', json: { customRoots } })
+}
+
+export function listMiniappRoots(): Promise<MiniappRootsResponse> {
+  return request<MiniappRootsResponse>('/miniapps/roots')
+}
+
+export function setMiniappRoots(
+  roots: string[],
+  mode: 'replace' | 'append' = 'append'
+): Promise<MiniappRootsResponse> {
+  return request<MiniappRootsResponse>('/miniapps/roots', { method: 'POST', json: { roots, mode } })
+}
+
+export function getMiniapp(id: string): Promise<MiniappDetailResponse> {
+  return request<MiniappDetailResponse>(`/miniapps/${encodeId(id)}`)
+}
+
+export function unpackMiniapp(id: string): Promise<MiniappUnpackResponse> {
+  return request<MiniappUnpackResponse>(`/miniapps/${encodeId(id)}/unpack`, {
+    method: 'POST',
+    json: {}
+  })
+}
+
+export function analyzeMiniapp(id: string): Promise<MiniappAnalyzeResponse> {
+  return request<MiniappAnalyzeResponse>(`/miniapps/${encodeId(id)}/analyze`, {
+    method: 'POST',
+    json: {}
+  })
+}
+
+export function getMiniappTree(id: string, path = ''): Promise<MiniappTreeResponse> {
+  return request<MiniappTreeResponse>(`/miniapps/${encodeId(id)}/tree${toQuery({ path })}`)
+}
+
+export function readMiniappFile(
+  id: string,
+  path: string,
+  offset = 0,
+  limit = 2000,
+  maxBytes = 1024 * 1024,
+  find = '',
+  findRegex = false
+): Promise<MiniappFileResponse> {
+  return request<MiniappFileResponse>(
+    `/miniapps/${encodeId(id)}/file${toQuery({
+      path,
+      offset,
+      limit,
+      maxBytes,
+      find,
+      findRegex: findRegex ? 1 : 0
+    })}`
+  )
+}
+
+export interface MiniappSearchParams {
+  query: string
+  regex?: boolean
+  glob?: string
+  maxResults?: number
+}
+
+export function searchMiniappFiles(
+  id: string,
+  params: MiniappSearchParams
+): Promise<MiniappSearchResponse> {
+  return request<MiniappSearchResponse>(
+    `/miniapps/${encodeId(id)}/search${toQuery({
+      query: params.query,
+      regex: params.regex ? 1 : 0,
+      glob: params.glob,
+      maxResults: params.maxResults
+    })}`
+  )
+}
+
+export function importMiniappAssets(
+  id: string,
+  input: { project_name?: string; host_port?: string } = {}
+): Promise<MiniappImportResponse> {
+  return request<MiniappImportResponse>(`/miniapps/${encodeId(id)}/import-assets`, {
+    method: 'POST',
+    json: input
+  })
+}
+
+export function openMiniappDir(id: string): Promise<MiniappOpenResponse> {
+  return request<MiniappOpenResponse>(`/miniapps/${encodeId(id)}/open`, {
+    method: 'POST',
+    json: {}
+  })
+}
+
+export function renameMiniapp(id: string, appName: string): Promise<{ ok: boolean; miniapp: MiniappRow }> {
+  return request<{ ok: boolean; miniapp: MiniappRow }>(`/miniapps/${encodeId(id)}/name`, {
+    method: 'POST',
+    json: { app_name: appName }
+  })
+}
+
+export function toMiniappErrorMessage(error: unknown): string {
+  if (error instanceof Error) return error.message
+  if (typeof error === 'string') return error
+  return String(error)
+}

package/src/cortex-ui/renderer/lib/navigation.ts

@@ -1,4 +1,4 @@
-import { Bot, Boxes, Brain, FlaskConical, Network, Orbit, ShieldAlert, type LucideIcon } from 'lucide-react'
+import { Bot, Boxes, Brain, FlaskConical, Network, Orbit, PackageSearch, ShieldAlert, Zap, type LucideIcon } from 'lucide-react'
 
 export type AppPage =
   | 'dashboard'
@@ -8,6 +8,8 @@ export type AppPage =
   | 'snapshots'
   | 'mcp'
   | 'retest'
+  | 'fuzzer'
+  | 'miniapps'
   | 'ai-config'
 
 /** Cross-page deep link used by the nebula inspector ("view full details"). */
@@ -37,6 +39,8 @@ export const NAV_ITEMS: readonly NavItem[] = [
   { page: 'assets', labelKey: 'nav.assets', icon: Boxes },
   { page: 'snapshots', labelKey: 'nav.snapshots', icon: Brain },
   { page: 'retest', labelKey: 'nav.retest', icon: FlaskConical },
+  { page: 'fuzzer', labelKey: 'nav.fuzzer', icon: Zap },
+  { page: 'miniapps', labelKey: 'nav.miniapps', icon: PackageSearch },
   { page: 'ai-config', labelKey: 'retest.aiConfig.nav', icon: Bot }
 ]
 
@@ -65,6 +69,14 @@ export const PAGE_META: Record<AppPage, { titleKey: string; descriptionKey: stri
     titleKey: 'nav.retest',
     descriptionKey: 'retest.page.repeaterSubtitle'
   },
+  fuzzer: {
+    titleKey: 'nav.fuzzer',
+    descriptionKey: 'fuzzer.page.description'
+  },
+  miniapps: {
+    titleKey: 'nav.miniapps',
+    descriptionKey: 'miniapp.page.description'
+  },
   'ai-config': {
     titleKey: 'retest.aiConfig.nav',
     descriptionKey: 'retest.aiConfig.description'

package/src/cortex-ui/renderer/lib/repeaterRaw.ts

@@ -0,0 +1,102 @@
+/**
+ * Raw HTTP request helpers shared by the single Repeater and the Fuzzer.
+ *
+ * The request editor uses the Burp-style raw form:
+ *
+ *   POST /api/login HTTP/1.1
+ *   Host: target
+ *   Content-Type: application/json
+ *
+ *   {"user":"demo"}
+ *
+ * Fuzzer injection points are marked inline with paired `§` characters, e.g.
+ * `id=§1§`. Nothing in this module talks to the network.
+ */
+
+export interface ParsedRawRequest {
+  method: string
+  url: string
+  headers: Record<string, string>
+  body: string
+}
+
+/**
+ * Protocol-level headers copied from a report are re-derived by the outbound
+ * request (Host from the URL, length/connection by the HTTP client). Dropping
+ * them here keeps raw requests sendable without a validation error.
+ */
+export const DERIVED_HEADERS = new Set([
+  'host',
+  'content-length',
+  'connection',
+  'transfer-encoding',
+  'upgrade',
+  'keep-alive',
+  'proxy-connection'
+])
+
+/** Parse a Burp-like raw request into the typed repeater payload. */
+export function parseRawRequest(text: string): ParsedRawRequest {
+  const lines = text.replace(/\r\n/g, '\n').split('\n')
+  const requestLine = (lines.shift() ?? '').trim()
+  const match = /^([A-Za-z]+)\s+(\S+)\s+HTTP\/\d(?:\.\d)?$/.exec(requestLine)
+  if (match === null) throw new Error('请求行必须形如：GET /path HTTP/1.1')
+  const headers: Record<string, string> = {}
+  let index = 0
+  for (; index < lines.length; index += 1) {
+    const line = lines[index]
+    if (line === undefined) break
+    if (line.trim() === '') {
+      index += 1
+      break
+    }
+    const colon = line.indexOf(':')
+    if (colon <= 0) throw new Error(`请求头不合法：${line}`)
+    const name = line.slice(0, colon).trim()
+    const value = line.slice(colon + 1).trim()
+    if (name !== '') headers[name] = value
+  }
+  const body = lines.slice(index).join('\n')
+  return { method: match[1].toUpperCase(), url: match[2], headers, body }
+}
+
+/** Serialize the typed payload back into the raw editor form. */
+export function serializeRawRequest(request: {
+  method: string
+  url: string
+  headers: Record<string, string>
+  body?: string
+}): string {
+  const lines = [`${request.method.toUpperCase()} ${request.url} HTTP/1.1`]
+  for (const [name, value] of Object.entries(request.headers)) lines.push(`${name}: ${value}`)
+  const body = request.body ?? ''
+  if (body !== '') lines.push('', body)
+  return lines.join('\n')
+}
+
+/** Copy a header map without the protocol-level headers the Host re-derives. */
+export function stripDerivedHeaders(headers: Record<string, string>): Record<string, string> {
+  return Object.fromEntries(
+    Object.entries(headers).filter(([name]) => !DERIVED_HEADERS.has(name.toLowerCase()))
+  )
+}
+
+/**
+ * Pretty-print a JSON request body while keeping the request line and headers
+ * untouched. Returns null when the request has no body or the body is not JSON.
+ */
+export function formatRequestBody(raw: string): string | null {
+  const text = raw.replace(/\r\n/g, '\n')
+  const separator = text.indexOf('\n\n')
+  if (separator < 0) return null
+  const head = text.slice(0, separator)
+  const body = text.slice(separator + 2).trim()
+  if (body === '') return null
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(body)
+  } catch {
+    return null
+  }
+  return `${head}\n\n${JSON.stringify(parsed, null, 2)}`
+}