@lievclouds/dsh-cortex 0.5.4 → 1.0.0

package/index.js

@@ -15,6 +15,12 @@ export const name = 'dsh-cortex'
 export const inject = ['webServer', 'tools']
 
 export function apply(ctx, config) {
+  // The mini-program scanner also looks for WeChat's `Documents\xwechat_files`
+  // data directory on other drives. This is opt-in so tests and embedders with
+  // a synthetic env stay hermetic.
+  if (process.env.CORTEX_MINIAPP_EXTRA_DRIVES === undefined) {
+    process.env.CORTEX_MINIAPP_EXTRA_DRIVES = '1'
+  }
   let host
   try {
     host = createCortexHost({ config })
@@ -52,6 +58,7 @@ export function apply(ctx, config) {
             '- Project names: reuse the existing project string exactly (list the assets or the audit first). Variants such as `上海春芝堂 SRC` and `上海春芝堂_SRC` are merged defensively, but do not invent a new spelling.',
             '- Data completeness is mandatory: before finishing a phase call `cortex_audit_completeness`, then fill every gap — every asset must carry interfaces (path/method/params/request), leaked_infos (info_type/value/source/potential_impact) and test_parameters (name/endpoint/location/values/source); every confirmed finding must be saved with Markdown reproduction_steps; internal hosts/services/footholds/credentials/pivots go through `cortex_sync_internal_scope`.',
             '- Summaries / audit: `cortex_internal_overview`, `cortex_graph_summary`, `cortex_audit_completeness`.',
+            '- Mini-program reversing (小程序逆向 / wxapkg): when the user asks about a WeChat mini program, scan first with `cortex_scan_miniapps`, then `cortex_list_miniapps` → `cortex_unpack_miniapp` → `cortex_get_miniapp_overview` → `cortex_search_miniapp` / `cortex_read_miniapp_file`; persist extracted domains/interfaces/secrets/test parameters with `cortex_import_miniapp_assets`. Only authorized packages; package content stays local; never execute unpacked JS/HTML. Report the real unpack status (unpacked / unsupported / failed) instead of assuming success. The tools expose the unpacked workspace: `cortex_search_miniapp` covers every text file and `cortex_read_miniapp_file` pages through any text file (max 200 lines / 100 KiB per call — pass `offset` to continue), while binaries are never returned. If the user names a mini program directly, resolve it via `cortex_list_miniapps` (match app_name or appid), unpack when needed, then read/search — no need to ask for internal ids.',
             'Do not skip these calls merely because no skill was loaded. If a tool call fails, report the failure; never claim a record was saved without a successful result.',
             'Examples: “列出 Cortex 里的高危漏洞”, “把刚才确认的漏洞写入 Cortex”, “把 127.0.0.1:8080 的接口同步到资产库”, “把 VULN-… 标记为已确认并追加复测结论”.',
           ].join('\n'),

package/locale/en.json

@@ -1,6 +1,6 @@
-{
-  "meta": {
-    "title": "Cortex",
-    "description": "The original Cortex workbench inside DeepSeek Harness: vulnerability board, internal operations, memory nebula graph, assets, snapshots and retest, plus 12 native cortex_* agent tools. No MCP needed."
-  }
-}
+{
+  "meta": {
+    "title": "Cortex",
+    "description": "The original Cortex workbench in DeepSeek Harness: vulnerability board, internal operations, Memory Nebula, assets, snapshots, retest, Web Fuzzer and mini-program reversing (wxapkg detect/decrypt/unpack/analyze), with 22 native cortex_* agent tools and no MCP."
+  }
+}

package/locale/zh.json

@@ -1,6 +1,6 @@
-{
-  "meta": {
-    "title": "Cortex",
-    "description": "在 DeepSeek Harness 内使用原版 Cortex 工作台：漏洞看板、内网作战、记忆星云图谱、资产库、认知快照与漏洞复测；内置 12 个 cortex_* Agent 工具，无需 MCP。"
-  }
-}
+{
+  "meta": {
+    "title": "Cortex",
+    "description": "在 DeepSeek Harness 内使用原版 Cortex 工作台：漏洞看板、内网作战、记忆星云图谱、资产库、认知快照、漏洞复测、Web Fuzzer 与小程序逆向（wxapkg 解密/解包/分析），内置 22 个 cortex_* Agent 工具，无需 MCP。"
+  }
+}

package/package.json

@@ -1,110 +1,115 @@
-{
-  "name": "@lievclouds/dsh-cortex",
-  "version": "0.5.4",
-  "description": "Cortex workbench for DeepSeek Harness: the original Cortex UI (vulnerabilities, assets, internal operations, Memory Nebula, snapshots, retest) as a native DSH panel, plus 12 native agent tools so DSH conversations use the local Cortex SQLite without MCP.",
-  "type": "module",
-  "main": "index.js",
-  "license": "MIT",
-  "author": {
-    "name": "Revcloudi",
-    "url": "https://github.com/Revcloudi"
-  },
-  "homepage": "https://github.com/Revcloudi/Cortex/tree/main/dsh-cortex#readme",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Revcloudi/Cortex.git",
-    "directory": "dsh-cortex"
-  },
-  "bugs": {
-    "url": "https://github.com/Revcloudi/Cortex/issues"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "keywords": [
-    "dsh-plugin",
-    "deepseek-harness",
-    "dsh",
-    "cordis",
-    "cortex",
-    "pentest",
-    "vulnerability-management",
-    "asset-management",
-    "sqlite",
-    "nebula"
-  ],
-  "exports": {
-    ".": "./index.js",
-    "./client": "./client.js",
-    "./cordis.patch.yml": "./cordis.patch.yml",
-    "./locale/*.json": "./locale/*.json",
-    "./icon": "./icon.svg",
-    "./package.json": "./package.json"
-  },
-  "files": [
-    "index.js",
-    "client.js",
-    "src",
-    "cordis.patch.yml",
-    "locale",
-    "icon.svg",
-    "README.md",
-    "LICENSE"
-  ],
-  "engines": {
-    "node": ">=22.19.0"
-  },
-  "scripts": {
-    "build": "node scripts/build-host-graph.mjs && node scripts/build-cortex-ui.mjs",
-    "build:graph": "node scripts/build-host-graph.mjs",
-    "build:client": "node scripts/build-cortex-ui.mjs",
-    "smoke": "node scripts/smoke-cortex-ui.mjs",
-    "test": "node --test",
-    "test:host": "node --test \"test/host/**/*.test.mjs\"",
-    "pack:check": "npm pack --dry-run",
-    "publish:npm": "npm publish --access public"
-  },
-  "dsh": {
-    "bundle": {
-      "patch": "./cordis.patch.yml"
-    },
-    "client": {
-      "platform": "web",
-      "immediately": true,
-      "inject": [
-        "@deepseek-ai/dsh-client-ui-sidebar",
-        "@deepseek-ai/dsh-client-locale"
-      ]
-    }
-  },
-  "devDependencies": {
-    "@fontsource-variable/inter": "5.3.0",
-    "@fontsource-variable/jetbrains-mono": "5.3.0",
-    "@radix-ui/react-dialog": "1.3.1",
-    "@radix-ui/react-select": "^2.4.1",
-    "@radix-ui/react-tabs": "1.2.1",
-    "@radix-ui/react-tooltip": "1.4.1",
-    "autoprefixer": "10.6.2",
-    "class-variance-authority": "0.7.1",
-    "clsx": "2.1.1",
-    "esbuild": "0.28.2",
-    "jsdom": "^31.0.0",
-    "lucide-react": "1.65.0",
-    "postcss": "8.5.32",
-    "react": "18.3.1",
-    "react-dom": "18.3.1",
-    "react-force-graph-3d": "^1.29.2",
-    "react-markdown": "^10.1.0",
-    "react-syntax-highlighter": "^16.1.2",
-    "remark-gfm": "^4.0.1",
-    "sonner": "2.0.8",
-    "tailwind-merge": "3.7.0",
-    "tailwindcss": "3.4.19",
-    "three": "^0.187.0",
-    "zod": "4.6.7"
-  },
-  "dependencies": {
-    "docx": "^9.15.3",
-    "pdfkit": "^0.20.2"
-  }
-}
+{
+  "name": "@lievclouds/dsh-cortex",
+  "version": "1.0.0",
+  "description": "Cortex workbench for DeepSeek Harness: the original Cortex UI (vulnerabilities, assets, internal operations, Memory Nebula, snapshots, retest, Web Fuzzer, mini-program reversing) as a native DSH panel, plus 22 native agent tools so DSH conversations use the local Cortex SQLite without MCP.",
+  "type": "module",
+  "main": "index.js",
+  "license": "MIT",
+  "author": {
+    "name": "Revcloudi",
+    "url": "https://github.com/Revcloudi"
+  },
+  "homepage": "https://github.com/Revcloudi/Cortex/tree/main/dsh-cortex#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Revcloudi/Cortex.git",
+    "directory": "dsh-cortex"
+  },
+  "bugs": {
+    "url": "https://github.com/Revcloudi/Cortex/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "asset-management",
+    "cordis",
+    "cortex",
+    "deepseek-harness",
+    "dsh",
+    "dsh-plugin",
+    "fuzzer",
+    "miniapp",
+    "nebula",
+    "pentest",
+    "reverse-engineering",
+    "sqlite",
+    "vulnerability-management",
+    "wechat-mini-program",
+    "wxapkg"
+  ],
+  "exports": {
+    ".": "./index.js",
+    "./client": "./client.js",
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./locale/*.json": "./locale/*.json",
+    "./icon": "./icon.svg",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "index.js",
+    "client.js",
+    "src",
+    "cordis.patch.yml",
+    "locale",
+    "icon.svg",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22.19.0"
+  },
+  "scripts": {
+    "build": "node scripts/build-host-graph.mjs && node scripts/build-cortex-ui.mjs",
+    "build:graph": "node scripts/build-host-graph.mjs",
+    "build:client": "node scripts/build-cortex-ui.mjs",
+    "smoke": "node scripts/smoke-cortex-ui.mjs",
+    "test": "node --test",
+    "test:host": "node --test \"test/host/**/*.test.mjs\"",
+    "pack:check": "npm pack --dry-run",
+    "publish:npm": "npm publish --access public"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "immediately": true,
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-sidebar",
+        "@deepseek-ai/dsh-client-locale"
+      ]
+    }
+  },
+  "devDependencies": {
+    "@fontsource-variable/inter": "5.3.0",
+    "@fontsource-variable/jetbrains-mono": "5.3.0",
+    "@radix-ui/react-dialog": "1.3.1",
+    "@radix-ui/react-select": "^2.4.1",
+    "@radix-ui/react-tabs": "1.2.1",
+    "@radix-ui/react-tooltip": "1.4.1",
+    "autoprefixer": "10.6.2",
+    "class-variance-authority": "0.7.1",
+    "clsx": "2.1.1",
+    "esbuild": "0.28.2",
+    "jsdom": "^31.0.0",
+    "lucide-react": "1.65.0",
+    "postcss": "8.5.32",
+    "react": "18.3.1",
+    "react-dom": "18.3.1",
+    "react-force-graph-3d": "^1.29.2",
+    "react-markdown": "^10.1.0",
+    "react-syntax-highlighter": "^16.1.2",
+    "remark-gfm": "^4.0.1",
+    "sonner": "2.0.8",
+    "tailwind-merge": "3.7.0",
+    "tailwindcss": "3.4.19",
+    "three": "^0.187.0",
+    "zod": "4.6.7"
+  },
+  "dependencies": {
+    "docx": "^9.15.3",
+    "pdfkit": "^0.20.2"
+  }
+}

package/src/cortex-ui/dsh/css-overrides.css

@@ -138,3 +138,11 @@
  */
 
 
+
+/* Mini-program search / file-path fields keep a static look while focused:
+ * no outline, ring, shadow or border-colour change. */
+.dshc-cortex-root .dshc-flat-input:focus,
+.dshc-cortex-root .dshc-flat-input:focus-visible {
+  outline: none !important;
+  box-shadow: none !important;
+}

package/src/cortex-ui/renderer/App.tsx

@@ -30,6 +30,24 @@ const RetestPage = lazy(async () => {
   return { default: module.RetestPage }
 })
 
+/**
+ * The dedicated Web Fuzzer page stays out of the first-screen bundle for the
+ * same reason as the retest lab: it is a desktop-only workbench.
+ */
+const FuzzerPage = lazy(async () => {
+  const module = await import('@renderer/pages/FuzzerPage')
+  return { default: module.FuzzerPage }
+})
+
+/**
+ * Mini-program reverse engineering is desktop-only too (it reads local WeChat
+ * caches through the Host), so it stays out of the first-screen bundle.
+ */
+const MiniappPage = lazy(async () => {
+  const module = await import('@renderer/pages/MiniappPage')
+  return { default: module.MiniappPage }
+})
+
 export default function App() {
   const [page, setPage] = useState<AppPage>('dashboard')
   const [dataVersion, setDataVersion] = useState(0)
@@ -96,6 +114,14 @@ export default function App() {
                   <Suspense fallback={<RetestPageFallback />}>
                     <RetestPage dataVersion={dataVersion} />
                   </Suspense>
+                ) : page === 'fuzzer' ? (
+                  <Suspense fallback={<RetestPageFallback />}>
+                    <FuzzerPage dataVersion={dataVersion} />
+                  </Suspense>
+                ) : page === 'miniapps' ? (
+                  <Suspense fallback={<MiniappPageFallback />}>
+                    <MiniappPage dataVersion={dataVersion} />
+                  </Suspense>
                 ) : page === 'ai-config' && !IS_WEB_RUNTIME ? (
                   <AiConfigPage />
                 ) : null}
@@ -159,3 +185,16 @@ function RetestPageFallback() {
     </div>
   )
 }
+
+/** Light-weight fallback while the desktop-only mini-program chunk loads. */
+function MiniappPageFallback() {
+  const { t } = useI18n()
+  return (
+    <div className="flex h-full w-full items-center justify-center">
+      <div className="flex items-center gap-2.5 text-[12px] text-muted-foreground">
+        <Loader2 aria-hidden="true" className="h-4 w-4 animate-spin" />
+        {t('common.loading')}
+      </div>
+    </div>
+  )
+}

package/src/cortex-ui/renderer/components/miniapp/FileTree.tsx

@@ -0,0 +1,161 @@
+import { useCallback, useEffect, useState, type ReactNode } from 'react'
+import { ChevronDown, ChevronRight, File, Folder, Loader2 } from 'lucide-react'
+import {
+  getMiniappTree,
+  toMiniappErrorMessage,
+  type MiniappTreeEntry
+} from '@renderer/lib/miniappApi'
+import { formatBytes } from '@renderer/lib/format'
+import { useI18n } from '@renderer/i18n'
+import { cn } from '@renderer/lib/utils'
+
+interface FileTreeProps {
+  miniappId: string
+  /** Called with the relative path when a file leaf is clicked. */
+  onOpenFile: (path: string) => void
+}
+
+interface DirState {
+  entries: MiniappTreeEntry[] | null
+  loading: boolean
+  error: string | null
+}
+
+/**
+ * Lazy directory tree of an unpacked mini program.
+ *
+ * Only the root directory is fetched on mount; every expanded directory is
+ * fetched exactly once and then cached for the lifetime of the mount. The
+ * detail sheet keys the component by source id so switching sources resets the
+ * cache instead of showing another app's tree.
+ */
+export function FileTree({ miniappId, onOpenFile }: FileTreeProps) {
+  const { t } = useI18n()
+  const [dirs, setDirs] = useState<Record<string, DirState>>({})
+  const [expanded, setExpanded] = useState<Record<string, boolean>>({})
+
+  const loadDir = useCallback(
+    async (path: string) => {
+      setDirs((prev) => ({
+        ...prev,
+        [path]: { entries: prev[path]?.entries ?? null, loading: true, error: null }
+      }))
+      try {
+        const result = await getMiniappTree(miniappId, path)
+        setDirs((prev) => ({
+          ...prev,
+          [path]: { entries: result.entries ?? [], loading: false, error: null }
+        }))
+      } catch (cause) {
+        setDirs((prev) => ({
+          ...prev,
+          [path]: { entries: null, loading: false, error: toMiniappErrorMessage(cause) }
+        }))
+      }
+    },
+    [miniappId]
+  )
+
+  useEffect(() => {
+    setDirs({})
+    setExpanded({})
+    void loadDir('')
+  }, [loadDir])
+
+  const toggleDir = (path: string) => {
+    if (expanded[path] === true) {
+      setExpanded((prev) => ({ ...prev, [path]: false }))
+      return
+    }
+    setExpanded((prev) => ({ ...prev, [path]: true }))
+    const state = dirs[path]
+    if (state === undefined || (state.entries === null && !state.loading)) void loadDir(path)
+  }
+
+  const renderDir = (path: string, depth: number): ReactNode => {
+    const state = dirs[path]
+    if (state === undefined) return null
+    const indent = { paddingLeft: `${8 + depth * 14}px` }
+    if (state.loading && state.entries === null) {
+      return (
+        <li className="flex items-center gap-1.5 py-1 text-[11px] text-muted-foreground" style={indent}>
+          <Loader2 aria-hidden="true" className="h-3 w-3 animate-spin" />
+          {t('miniapp.file.loading')}
+        </li>
+      )
+    }
+    if (state.error !== null) {
+      return (
+        <li className="py-1 pr-2 text-[11px] text-red-700" style={indent}>
+          {t('miniapp.file.treeError', { error: state.error })}
+        </li>
+      )
+    }
+    const entries = state.entries ?? []
+    if (entries.length === 0) {
+      return (
+        <li className="py-1 text-[11px] text-muted-foreground" style={indent}>
+          {t('miniapp.file.empty')}
+        </li>
+      )
+    }
+    return entries.map((entry) =>
+      entry.type === 'dir' ? (
+        <li key={entry.path}>
+          <button
+            type="button"
+            aria-expanded={expanded[entry.path] === true}
+            onClick={() => toggleDir(entry.path)}
+            className="flex w-full items-center gap-1.5 py-1 pr-2 text-left text-[11.5px] text-foreground transition-colors hover:bg-sidebar focus-visible:bg-accent-soft focus-visible:outline-none"
+            style={indent}
+          >
+            {expanded[entry.path] === true ? (
+              <ChevronDown aria-hidden="true" className="h-3 w-3 shrink-0 text-muted-foreground" />
+            ) : (
+              <ChevronRight aria-hidden="true" className="h-3 w-3 shrink-0 text-muted-foreground" />
+            )}
+            <Folder aria-hidden="true" className="h-3 w-3 shrink-0 text-muted-foreground" />
+            <span className="truncate font-mono">{entry.name}</span>
+          </button>
+          {expanded[entry.path] === true ? (
+            <ul>{renderDir(entry.path, depth + 1)}</ul>
+          ) : null}
+        </li>
+      ) : (
+        <li key={entry.path}>
+          <button
+            type="button"
+            data-miniapp-file={entry.path}
+            onClick={() => onOpenFile(entry.path)}
+            className="flex w-full items-center gap-1.5 py-1 pr-2 text-left text-[11.5px] text-muted-foreground transition-colors hover:bg-sidebar hover:text-foreground focus-visible:bg-accent-soft focus-visible:text-foreground focus-visible:outline-none"
+            style={indent}
+          >
+            <File aria-hidden="true" className="ml-4 h-3 w-3 shrink-0" />
+            <span className="truncate font-mono">{entry.name}</span>
+            {entry.size > 0 ? (
+              <span className="ml-auto shrink-0 pl-2 font-mono text-[10px] tabular-nums text-muted-foreground/70">
+                {formatBytes(entry.size)}
+              </span>
+            ) : null}
+          </button>
+        </li>
+      )
+    )
+  }
+
+  return (
+    <div
+      data-testid="miniapp-file-tree"
+      className={cn(
+        'flex h-full w-full min-h-0 flex-col overflow-hidden rounded-md border border-border bg-background'
+      )}
+    >
+      <div className="shrink-0 border-b border-border px-3 py-1.5 font-mono text-[10px] uppercase tracking-[0.14em] text-muted-foreground">
+        {t('miniapp.file.root')}
+      </div>
+      <ul className="min-h-0 flex-1 overflow-y-auto py-1 [scrollbar-gutter:stable]">
+        {renderDir('', 0)}
+      </ul>
+    </div>
+  )
+}