dsh-pentester 2.2.0 → 2.4.0

package/README.md

@@ -4,19 +4,67 @@
 
 **唯一事实来源是 [`docs/plan.md`](docs/plan.md)**；架构视图见 [`docs/architecture.md`](docs/architecture.md)，磁盘布局见 [`docs/workspace.md`](docs/workspace.md)，领域术语见 [`CONTEXT.md`](CONTEXT.md)。
 
+欢迎提交issues和PR。
+
+详细英文文档见 [docs/README.md](docs/README.md)。
+
 ## 心智模型
 
 ```
 User ⇄ DSH Root Session（pentester persona preset）
    → Root 是唯一 Orchestrator：判断缺口、派发 Delegation、决定推进/回溯阶段
-   → Root 工具面 4 个：pentester_delegate / pentester_cancel_delegation /
-     pentester_advance_stage / pentester_rollback_stage
+   → Root 工具面 5 个：pentester_start / pentester_delegate /
+     pentester_cancel_delegation / pentester_advance_stage / pentester_rollback_stage
+   → pentester_start 是唯一 bootstrap 入口（mode: new | restart）
    → Root 每次 reasoning 前注入 compact run state（target/branch/stage/delegations）
-Delegation（并行多个）= 各一个 DSH child session（AgentProfile + 不可变 task_prompt）
+Delegation（并行多个）= 各一个 DSH continuable child session（AgentProfile + 不可变 task_prompt）
    → Worker 工具只有 pentester_container_exec（dockerode；Root 不可见）
-   → Worker 写完 result.md 即完成任务（完成标志）；缺失 → failed
+   → Worker 写/更新 result.md 作为当前可交付结果（continuable child 跨轮持续）
 Deliverable = 文件（workspace/stages/<NN>-<stage>/delegations/D-00N/）
 ```
+## docker based toolbox
+> 设置界面
+<img width="931" height="802" alt="image" src="https://github.com/user-attachments/assets/f79e9fd8-c2d2-43ff-92f7-3455ee26866a" />
+
+仅通过dockerode与docker daemon交互，定期文件同步，允许远程docker server，可降低本机资源占用。
+
+工具集详见 docker/kali
+
+## 展示
+> 渗透测试模式
+<img width="951" height="747" alt="image" src="https://github.com/user-attachments/assets/5eee1abc-016f-4455-ace9-b924b7e1a43e" />
+
+> 授权确认
+<img width="957" height="792" alt="image" src="https://github.com/user-attachments/assets/105802e6-3174-4237-81a8-714560b959b4" />
+
+> 问题诊断
+<img width="1031" height="808" alt="image" src="https://github.com/user-attachments/assets/bff95a27-d206-4d77-8b1f-4f0325e1d1db" />
+
+> 使用docker镜像
+<img width="994" height="670" alt="image" src="https://github.com/user-attachments/assets/d8eaf503-3e8c-4731-bdfc-9f666280909f" />
+
+
+> 看板与子代理
+<img width="1036" height="828" alt="image" src="https://github.com/user-attachments/assets/88b816b5-2c56-4cf2-b729-14098c3f3d6a" />
+
+> 各个TAB
+<img width="1049" height="801" alt="image" src="https://github.com/user-attachments/assets/9af17570-ae6e-4a29-b752-1f9252d8b08a" />
+
+> 时间轴阶段拓扑
+<img width="1057" height="818" alt="image" src="https://github.com/user-attachments/assets/022ea438-7432-49d5-9901-969797248b77" />
+
+> 阶段产出
+<img width="1052" height="797" alt="image" src="https://github.com/user-attachments/assets/2a1c6ba5-4755-490c-b4d3-96f2e2ba600a" />
+
+> 子代理自动汇合推进
+<img width="1019" height="783" alt="image" src="https://github.com/user-attachments/assets/30cf3fed-2d26-4564-bc32-9f963d152008" />
+
+> 报告
+<img width="1069" height="799" alt="image" src="https://github.com/user-attachments/assets/757586aa-939b-40d7-81c6-dfa5ccb07ae9" />
+
+<img width="1049" height="793" alt="image" src="https://github.com/user-attachments/assets/40ff4485-45f0-4021-b6b5-a410279ce307" />
+
+[查看报告](docs/test-report.md)
 
 ## 准备
 
@@ -28,7 +76,7 @@ npm install -g @deepseek-ai/dsh
 
 准备docker镜像
 ```bash
-docker pull fb0sh/dsh-pentester-kali:1.0.0
+docker pull fb0sh/dsh-pentester-kali:latest
 ```
 
 ## 安装
@@ -46,7 +94,7 @@ dsh plugin --profile web add github:fb0sh/dsh-pentester
 
 | 目录/文件 | 职责 |
 | --- | --- |
-| `src/` | model/stages/profiles/store、workspace/git、dsh/delegations/tools/worker-tools、docker/（host/connection/images/runtime）、rpc/settings-store、targets、migrate、index |
+| `src/` | model/stages/profiles/store、workspace/git、dsh/delegations/tools/worker-tools、docker/（host/connection/images/runtime）、rpc/settings-store、targets、migrate、host-manifest、invocations、build-id、index |
 | `src/pentest/` | pre-engagement/assets/findings 领域逻辑 |
 | `src/ui/client/` | Settings 的 "Pentester Config" 页（Docker Engine / Toolbox Image） |
 | `src/ui-view/` | Pentester 数据面板（invocations snapshot / binding / RPC） |

package/agents/vulnerability/profile.yml

@@ -8,9 +8,12 @@ systemPrompt: |
   Method: verify candidate issues from the threat model in priority order.
   Every candidate finding must carry reproducible evidence (command + output
   kept in evidence/), a confidence level, and a recommended validation
-  approach. Write findings.md (and supporting files) into your delegation
-  directory /workspace/stages/<NN>-<stage>/delegations/<D-XXX>/ (artifacts/
-  for final outputs, evidence/ for proof, work/ for scratch). Distinguish
+  approach. Write findings to:
+    artifacts/findings.json  — structured array of finding entries
+    artifacts/findings.md    — human-readable full details
+  Each finding entry in findings.json should have: id, title, severity,
+  affectedAsset, confidence. A delegation may produce multiple findings.
+  Distinguish
   confirmed facts from inference. Stay strictly inside the recorded targets
   and RoE. Never modify .git/, .dsh-pentester/, other delegation directories
   or target/. Never run git commands. When the task is finished, write

package/lib/build-id.json

@@ -1 +1 @@
-{"buildId":"2.2.0+478786d","version":"2.2.0","sha":"478786d"}
+{"buildId":"2.4.0+3a85fc6","version":"2.4.0","sha":"3a85fc6"}