fix: respect limited scan goals and retain asset completion instructions

web/static/i18n/en-US.json

@@ -1466,6 +1466,7 @@
     "executeNow": "Run immediately after creation",
     "confirmSend": "Send",
     "confirmCreate": "Create tasks",
+    "scanCompletionInstruction": "Stop probing once the task above is satisfied and report the available evidence. Call complete_asset_scan(id={{asset_id}}) to record this asset scan time and related results. This record update does not expand the requested probing scope.",
     "defaultScanPrompt": "Perform an authorized security scan of {{target}} (asset ID: {{asset_id}}). Save confirmed findings with record_vulnerability, then call complete_asset_scan(id={{asset_id}}) to update the last scan time and related vulnerability count.",
     "selectAssetsFirst": "Select assets first",
     "promptRequired": "Enter a user prompt",

web/static/i18n/ru-RU.json

@@ -1478,6 +1478,7 @@
     "executeNow": "Запустить сразу после создания",
     "confirmSend": "Отправить",
     "confirmCreate": "Создать задачи",
+    "scanCompletionInstruction": "После достижения указанной цели прекратите проверки и сообщите полученные результаты. Вызовите complete_asset_scan(id={{asset_id}}), чтобы записать время проверки актива и связанные результаты. Эта запись не расширяет область проверки.",
     "defaultScanPrompt": "Выполните авторизованное сканирование безопасности {{target}} (ID актива: {{asset_id}}). Сохраните подтверждённые находки через record_vulnerability, затем вызовите complete_asset_scan(id={{asset_id}}), чтобы обновить время последнего сканирования и число связанных уязвимостей.",
     "selectAssetsFirst": "Сначала выберите активы",
     "promptRequired": "Введите запрос пользователя",

web/static/i18n/zh-CN.json

@@ -1454,6 +1454,7 @@
     "executeNow": "创建后立即执行",
     "confirmSend": "确认发送",
     "confirmCreate": "创建任务",
+    "scanCompletionInstruction": "达到上述任务目标后停止探测，如实报告已有结果；调用 complete_asset_scan(id={{asset_id}}) 回写本次资产扫描时间和关联结果。此记录动作不扩大上述探测范围。",
     "defaultScanPrompt": "请对资产 {{target}}（资产ID：{{asset_id}}）进行授权安全扫描，优先检查暴露服务、已知漏洞、弱口令和常见 Web 风险；通过 record_vulnerability 保存确认的漏洞，完成后调用 complete_asset_scan(id={{asset_id}}) 回写上次扫描时间和相关漏洞。",
     "selectAssetsFirst": "请先选择资产",
     "promptRequired": "请输入用户提示词",

web/static/js/asset-scan-prompt.test.cjs

@@ -0,0 +1,20 @@
+const fs=require('node:fs');
+const vm=require('node:vm');
+const test=require('node:test');
+const assert=require('node:assert/strict');
+const source=fs.readFileSync('web/static/js/assets.js','utf8');
+const start=source.indexOf('function renderAssetScanPrompt(');
+const ctx={assetTargetLabel:a=>a.host,assetT:(key,fallback,values)=>fallback.replaceAll('{{asset_id}}',values.asset_id)};
+vm.createContext(ctx);
+vm.runInContext(source.slice(start,source.indexOf('function commonAssetProjectId(',start)),ctx);
+test('custom limited checks retain their scope and asset completion instruction',()=>{
+ const prompt=ctx.renderAssetScanPrompt('只读核验 {{target}}:{{port}} 的连通性和指纹；不枚举路径。',{id:'test-only-asset',host:'192.0.2.42',port:8080});
+ assert.ok(prompt.startsWith('只读核验 192.0.2.42:8080 的连通性和指纹；不枚举路径。'));
+ assert.ok(prompt.includes('complete_asset_scan(id=test-only-asset)'));
+ assert.doesNotMatch(prompt,/弱口令|WAF|record_vulnerability/);
+});
+test('existing completion instructions are not duplicated and missing asset IDs are not invented',()=>{
+ const prompt='核验后 complete_asset_scan(id={{asset_id}})';
+ assert.equal(ctx.renderAssetScanPrompt(prompt,{id:'test-only-asset',host:'192.0.2.42'}),'核验后 complete_asset_scan(id=test-only-asset)');
+ assert.equal(ctx.renderAssetScanPrompt('只读核验 {{target}}',{host:'192.0.2.42'}),'只读核验 192.0.2.42');
+});

web/static/js/assets.js

@@ -1131,7 +1131,10 @@ function renderAssetScanPrompt(template, asset) {
     const values = {
         asset_id: asset.id || '', target: assetTargetLabel(asset), host: asset.host || '', ip: asset.ip || '', domain: asset.domain || '', port: asset.port || ''
     };
-    return Object.keys(values).reduce((text, key) => text.replaceAll(`{{${key}}}`, String(values[key])), template);
+    const prompt = Object.keys(values).reduce((text, key) => text.replaceAll(`{{${key}}}`, String(values[key])), template);
+    if (!asset.id || prompt.includes('complete_asset_scan')) return prompt;
+    const completion = assetT('assets.scanCompletionInstruction', '达到上述任务目标后停止探测，如实报告已有结果；调用 complete_asset_scan(id={{asset_id}}) 回写本次资产扫描时间和关联结果。此记录动作不扩大上述探测范围。', { asset_id: String(asset.id) });
+    return `${prompt}\n\n${completion}`;
 }
 
 function commonAssetProjectId(assets) {