fix: preserve nmap script arguments when selecting scan options

internal/security/executor.go

@@ -576,9 +576,12 @@ func (e *Executor) buildCommandArgs(toolName string, toolConfig *config.ToolConf
 		if hasScanType {
 			scanTypeArgs := e.parseAdditionalArgs(scanTypeValue)
 			if len(scanTypeArgs) > 0 {
-				// 对于 nmap，scan_type 应该替换默认的扫描类型参数
-				// 由于我们已经跳过了默认的 args，现在需要将 scan_type 插入到合适位置
-				// 找到 target 参数的位置（通常是最后一个位置参数）
+				if toolName == "nmap" {
+					// Keep each option next to its value (especially --script).
+					// Nmap accepts scan options before all other arguments.
+					return append(scanTypeArgs, cmdArgs...)
+				}
+				// Preserve the existing insertion rule for other tools using scan_type.
 				insertPos := len(cmdArgs)
 				for i := len(cmdArgs) - 1; i >= 0; i-- {
 					// target 通常是最后一个非标志参数

internal/security/nmap_argument_order_test.go

@@ -0,0 +1,34 @@
+package security
+
+import (
+	"cyberstrike-ai/internal/config"
+	"gopkg.in/yaml.v3"
+	"os"
+	"reflect"
+	"testing"
+)
+
+func TestNmapScanTypeDoesNotSplitScriptOptionAndValue(t *testing.T) {
+	data, err := os.ReadFile("../../tools/nmap.yaml")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var tool config.ToolConfig
+	if err := yaml.Unmarshal(data, &tool); err != nil {
+		t.Fatal(err)
+	}
+	executor, _ := setupTestExecutor(t)
+	for _, tc := range []struct {
+		additional, script string
+		expected           []string
+	}{
+		{"-Pn --script http-headers,http-title,http-server-header", "", []string{"-sT", "-sV", "-sC", "-p", "18081", "192.0.2.1", "-Pn", "--script", "http-headers,http-title,http-server-header"}},
+		{"-Pn --max-retries 3", "http-title", []string{"-sT", "-sV", "-sC", "-p", "18081", "--script", "http-title", "192.0.2.1", "-Pn", "--max-retries", "3"}},
+	} {
+		args := map[string]interface{}{"target": "192.0.2.1", "ports": "18081", "scan_type": "-sT -sV -sC", "additional_args": tc.additional, "nse_scripts": tc.script}
+		actual := executor.buildCommandArgs("nmap", &tool, args)
+		if !reflect.DeepEqual(actual, tc.expected) {
+			t.Fatalf("argument ordering: got %v want %v", actual, tc.expected)
+		}
+	}
+}