From 2df1b39e0893b41f9360c5bc8cafb595b6859494 Mon Sep 17 00:00:00 2001
From: lintsinghua <lintsinghua@users.noreply.github.com>
Date: Mon, 15 Dec 2025 02:00:34 +0800
Subject: [PATCH] feat: Introduce Kunlun agent tool, add Docker and sandbox
 environment checks, and update agent services and frontend dialogs.

---
 backend/app/api/v1/endpoints/agent_tasks.py   |   41 +-
 backend/app/services/agent/agents/analysis.py |  138 +-
 backend/app/services/agent/config.py          |    9 +
 backend/app/services/agent/graph/runner.py    |   87 +-
 .../services/agent/prompts/system_prompts.py  |  199 +-
 backend/app/services/agent/tools/__init__.py  |    8 +
 .../services/agent/tools/external_tools.py    |  137 +-
 .../app/services/agent/tools/kunlun_tool.py   |  723 +++++++
 .../app/services/agent/tools/sandbox_tool.py  |   29 +-
 backend/check_docker_direct.py                |   16 +
 backend/check_sandbox.py                      |   31 +
 backend/pyproject.toml                        |  233 ++-
 backend/requirements-lock.txt                 |  434 +++-
 backend/requirements.txt                      |   26 +
 .../components/audit/FileSelectionDialog.tsx  |    4 +-
 .../components/reports/ExportReportDialog.tsx |  104 +-
 .../reports/InstantExportDialog.tsx           |  121 +-
 frontend/src/components/ui/dialog.tsx         |  213 +-
 .../components/ReportExportDialog.tsx         | 1830 +++++++++++++----
 frontend/src/pages/Projects.tsx               |    6 +-
 frontend/src/pages/PromptManager.tsx          |    2 +-
 frontend/src/pages/RecycleBin.tsx             |    4 +-
 tools.txt                                     |  102 +
 23 files changed, 3580 insertions(+), 917 deletions(-)
 create mode 100644 backend/app/services/agent/tools/kunlun_tool.py
 create mode 100644 backend/check_docker_direct.py
 create mode 100644 backend/check_sandbox.py
 create mode 100644 tools.txt

diff --git a/backend/app/api/v1/endpoints/agent_tasks.py b/backend/app/api/v1/endpoints/agent_tasks.py
index fb76ebe..a98f7cb 100644
--- a/backend/app/api/v1/endpoints/agent_tasks.py
+++ b/backend/app/api/v1/endpoints/agent_tasks.py
@@ -234,9 +234,17 @@ async def _execute_agent_task(task_id: str):
     from app.services.agent.event_manager import EventManager, AgentEventEmitter
     from app.services.llm.service import LLMService
     from app.services.agent.core import agent_registry
+    from app.services.agent.tools import SandboxManager
     from app.core.config import settings
     import time
     
+    # 🔥 在任务最开始就初始化 Docker 沙箱管理器
+    # 这样可以确保整个任务生命周期内使用同一个管理器，并且尽早发现 Docker 问题
+    logger.info(f"🚀 Starting execution for task {task_id}")
+    sandbox_manager = SandboxManager()
+    await sandbox_manager.initialize()
+    logger.info(f"🐳 Global Sandbox Manager initialized (Available: {sandbox_manager.is_available})")
+    
     async with async_session_factory() as db:
         orchestrator = None
         start_time = time.time()
@@ -275,11 +283,12 @@ async def _execute_agent_task(task_id: str):
             # 创建 LLM 服务
             llm_service = LLMService(user_config=user_config)
             
-            # 初始化工具集 - 传递排除模式和目标文件
+            # 初始化工具集 - 传递排除模式和目标文件以及预初始化的 sandbox_manager
             tools = await _initialize_tools(
                 project_root, 
                 llm_service, 
                 user_config,
+                sandbox_manager=sandbox_manager,
                 exclude_patterns=task.exclude_patterns,
                 target_files=task.target_files,
             )
@@ -535,6 +544,7 @@ async def _initialize_tools(
     project_root: str, 
     llm_service, 
     user_config: Optional[Dict[str, Any]],
+    sandbox_manager: Any, # 传递预初始化的 SandboxManager
     exclude_patterns: Optional[List[str]] = None,
     target_files: Optional[List[str]] = None,
 ) -> Dict[str, Dict[str, Any]]:
@@ -544,6 +554,7 @@ async def _initialize_tools(
         project_root: 项目根目录
         llm_service: LLM 服务
         user_config: 用户配置
+        sandbox_manager: 沙箱管理器
         exclude_patterns: 排除模式列表
         target_files: 目标文件列表
     """
@@ -551,6 +562,7 @@ async def _initialize_tools(
         FileReadTool, FileSearchTool, ListFilesTool,
         PatternMatchTool, CodeAnalysisTool, DataFlowAnalysisTool,
         SemgrepTool, BanditTool, GitleaksTool,
+        NpmAuditTool, SafetyTool, TruffleHogTool, OSVScannerTool,  # 🔥 Added missing tools
         ThinkTool, ReflectTool,
         CreateVulnerabilityReportTool,
         VulnerabilityValidationTool,
@@ -572,6 +584,14 @@ async def _initialize_tools(
     # Recon 工具
     recon_tools = {
         **base_tools,
+        # 🔥 外部侦察工具 (Recon 阶段也需要使用这些工具来收集初步信息)
+        "semgrep_scan": SemgrepTool(project_root, sandbox_manager),
+        "bandit_scan": BanditTool(project_root, sandbox_manager),
+        "gitleaks_scan": GitleaksTool(project_root, sandbox_manager),
+        "npm_audit": NpmAuditTool(project_root, sandbox_manager),
+        "safety_scan": SafetyTool(project_root, sandbox_manager),
+        "trufflehog_scan": TruffleHogTool(project_root, sandbox_manager),
+        "osv_scan": OSVScannerTool(project_root, sandbox_manager),
     }
     
     # Analysis 工具
@@ -587,10 +607,14 @@ async def _initialize_tools(
         "pattern_match": PatternMatchTool(project_root),
         # 数据流分析
         "dataflow_analysis": DataFlowAnalysisTool(llm_service),
-        # 外部安全工具
-        "semgrep_scan": SemgrepTool(project_root),
-        "bandit_scan": BanditTool(project_root),
-        "gitleaks_scan": GitleaksTool(project_root),
+        # 外部安全工具 (传入共享的 sandbox_manager)
+        "semgrep_scan": SemgrepTool(project_root, sandbox_manager),
+        "bandit_scan": BanditTool(project_root, sandbox_manager),
+        "gitleaks_scan": GitleaksTool(project_root, sandbox_manager),
+        "npm_audit": NpmAuditTool(project_root, sandbox_manager),
+        "safety_scan": SafetyTool(project_root, sandbox_manager),
+        "trufflehog_scan": TruffleHogTool(project_root, sandbox_manager),
+        "osv_scan": OSVScannerTool(project_root, sandbox_manager),
         # 安全知识查询
         "query_security_knowledge": SecurityKnowledgeQueryTool(),
         "get_vulnerability_knowledge": GetVulnerabilityKnowledgeTool(),
@@ -599,7 +623,7 @@ async def _initialize_tools(
     # Verification 工具
     # 🔥 导入沙箱工具
     from app.services.agent.tools import (
-        SandboxTool, SandboxHttpTool, VulnerabilityVerifyTool, SandboxManager,
+        SandboxTool, SandboxHttpTool, VulnerabilityVerifyTool,
         # 多语言代码测试工具
         PhpTestTool, PythonTestTool, JavaScriptTestTool, JavaTestTool,
         GoTestTool, RubyTestTool, ShellTestTool, UniversalCodeTestTool,
@@ -609,11 +633,6 @@ async def _initialize_tools(
         UniversalVulnTestTool,
     )
 
-    # 🔥 初始化沙箱管理器
-    sandbox_manager = SandboxManager()
-    await sandbox_manager.initialize()
-    logger.info(f"✅ Sandbox initialized (available: {sandbox_manager.is_available})")
-
     verification_tools = {
         **base_tools,
         # 🔥 沙箱验证工具
diff --git a/backend/app/services/agent/agents/analysis.py b/backend/app/services/agent/agents/analysis.py
index e222a60..d4c9868 100644
--- a/backend/app/services/agent/agents/analysis.py
+++ b/backend/app/services/agent/agents/analysis.py
@@ -34,44 +34,111 @@ ANALYSIS_SYSTEM_PROMPT = """你是 DeepAudit 的漏洞分析 Agent，一个**自
 4. 判断是否是真实漏洞
 5. 动态调整分析方向
 
-## 你可以使用的工具
+## ⚠️ 核心原则：优先使用外部专业工具！
 
-### 🚀 智能扫描工具（推荐优先使用）
-- **smart_scan**: 智能批量安全扫描 ⭐ 首选工具！
+**外部工具优先级最高！** 必须首先使用外部安全工具进行扫描，它们有：
+- 经过验证的专业规则库
+- 更低的误报率
+- 更全面的漏洞检测能力
+
+## 🔧 工具优先级（必须按此顺序使用）
+
+### 第一优先级：外部专业安全工具 ⭐⭐⭐ 【必须首先使用！】
+- **semgrep_scan**: 全语言静态分析 - **每次分析必用**
+  参数: target_path (str), rules (str: "auto" 或 "p/security-audit")
+  示例: {"target_path": ".", "rules": "auto"}
+
+- **bandit_scan**: Python 安全扫描 - **Python项目必用**
+  参数: target_path (str), severity (str)
+  示例: {"target_path": ".", "severity": "medium"}
+
+- **gitleaks_scan**: 密钥泄露检测 - **每次分析必用**
+  参数: target_path (str)
+  示例: {"target_path": "."}
+
+- **safety_scan**: Python 依赖漏洞 - **有 requirements.txt 时必用**
+  参数: requirements_file (str)
+  示例: {"requirements_file": "requirements.txt"}
+
+- **npm_audit**: Node.js 依赖漏洞 - **有 package.json 时必用**
+  参数: target_path (str)
+  示例: {"target_path": "."}
+
+- **kunlun_scan**: 深度代码审计（Kunlun-M）
+  参数: target_path (str), language (str: "php"|"javascript")
+  示例: {"target_path": ".", "language": "php"}
+
+### 第二优先级：智能扫描工具 ⭐⭐
+- **smart_scan**: 智能批量安全扫描
   参数: target (str), quick_mode (bool), focus_vulnerabilities (list)
   示例: {"target": ".", "quick_mode": true}
-  
+
 - **quick_audit**: 快速文件审计
   参数: file_path (str), deep_analysis (bool)
   示例: {"file_path": "app/views.py", "deep_analysis": true}
 
-### 文件操作
-- **read_file**: 读取文件内容
+### 第三优先级：内置分析工具 ⭐
+- **pattern_match**: 危险模式匹配（外部工具不可用时的备选）
+  参数: scan_file (str) 或 code (str), pattern_types (list)
+  示例: {"scan_file": "app/models.py", "pattern_types": ["sql_injection"]}
+
+- **dataflow_analysis**: 数据流追踪
+  参数: source_code (str), variable_name (str)
+
+### 辅助工具
+- **read_file**: 读取文件内容验证发现
   参数: file_path (str), start_line (int), end_line (int)
 - **list_files**: 列出目录文件
   参数: directory (str), pattern (str)
 - **search_code**: 代码关键字搜索
   参数: keyword (str), max_results (int)
-
-### 深度分析
-- **pattern_match**: 危险模式匹配（支持直接扫描文件）
-  参数: scan_file (str) 或 code (str), pattern_types (list)
-  示例: {"scan_file": "app/models.py", "pattern_types": ["sql_injection"]}
-- **dataflow_analysis**: 数据流追踪
-  参数: source_code (str), variable_name (str)
-
-### 外部静态分析工具
-- **semgrep_scan**: Semgrep 静态分析
-  参数: target_path (str), rules (str)
-- **bandit_scan**: Python 安全扫描
-  参数: target_path (str)
-- **gitleaks_scan**: Git 密钥泄露扫描
-  参数: target_path (str)
-
-### 安全知识查询
 - **query_security_knowledge**: 查询安全知识库
 - **get_vulnerability_knowledge**: 获取漏洞知识
 
+## 📋 推荐分析流程（严格按此执行！）
+
+### 第一步：外部工具全面扫描（60%时间）⚡ 最重要！
+根据项目技术栈，**必须首先**执行以下外部工具：
+
+```
+# 所有项目必做
+Action: semgrep_scan
+Action Input: {"target_path": ".", "rules": "auto"}
+
+Action: gitleaks_scan
+Action Input: {"target_path": "."}
+
+# Python 项目必做
+Action: bandit_scan
+Action Input: {"target_path": ".", "severity": "medium"}
+
+Action: safety_scan
+Action Input: {"requirements_file": "requirements.txt"}
+
+# Node.js 项目必做
+Action: npm_audit
+Action Input: {"target_path": "."}
+```
+
+### 第二步：分析外部工具结果（25%时间）
+对外部工具发现的问题进行深入分析：
+- 使用 `read_file` 查看完整代码上下文
+- 使用 `dataflow_analysis` 追踪数据流
+- 验证是否为真实漏洞，排除误报
+
+### 第三步：补充扫描（10%时间）
+如果外部工具覆盖不足，使用内置工具补充：
+- `smart_scan` 综合扫描
+- `pattern_match` 模式匹配
+
+### 第四步：汇总报告（5%时间）
+整理所有发现，输出 Final Answer
+
+## ⚠️ 重要提醒
+1. **不要跳过外部工具！** 即使内置工具可能更快，外部工具的检测能力更强
+2. **Docker依赖**：外部工具需要Docker环境，如果返回"Docker不可用"，再使用内置工具
+3. **并行执行**：可以连续调用多个外部工具
+
 ## 工作方式
 每一步，你需要输出：
 
@@ -111,21 +178,6 @@ Final Answer: [JSON 格式的漏洞报告]
 }
 ```
 
-## ⭐ 推荐分析策略
-1. **第一步：智能扫描**
-   使用 smart_scan 快速获取项目安全概览
-   示例: {"target": ".", "quick_mode": true}
-
-2. **第二步：重点审计**
-   对 smart_scan 发现的高风险文件使用 quick_audit 深入分析
-   示例: {"file_path": "发现的高风险文件", "deep_analysis": true}
-
-3. **第三步：验证分析**
-   使用 read_file 查看完整上下文，用 dataflow_analysis 追踪数据流
-
-4. **第四步：汇总报告**
-   整理所有发现，输出 Final Answer
-
 ## 重点关注的漏洞类型
 - SQL 注入 (query, execute, raw SQL)
 - XSS (innerHTML, document.write, v-html)
@@ -136,12 +188,12 @@ Final Answer: [JSON 格式的漏洞报告]
 - 不安全的反序列化 (pickle, yaml.load, eval)
 
 ## 重要原则
-1. **质量优先** - 宁可深入分析几个真实漏洞，不要浅尝辄止报告大量误报
-2. **上下文分析** - 看到可疑代码要读取上下文，理解完整逻辑
-3. **自主判断** - 不要机械相信工具输出，要用你的专业知识判断
-4. **持续探索** - 发现一个问题后，思考是否有相关问题
+1. **外部工具优先** - 首先使用 semgrep、bandit 等专业工具
+2. **质量优先** - 宁可深入分析几个真实漏洞，不要浅尝辄止报告大量误报
+3. **上下文分析** - 看到可疑代码要读取上下文，理解完整逻辑
+4. **自主判断** - 不要机械相信工具输出，要用你的专业知识判断
 
-现在开始你的安全分析！"""
+现在开始你的安全分析！首先使用外部工具进行全面扫描。"""
 
 
 @dataclass
diff --git a/backend/app/services/agent/config.py b/backend/app/services/agent/config.py
index 6de4675..4a2c43b 100644
--- a/backend/app/services/agent/config.py
+++ b/backend/app/services/agent/config.py
@@ -125,6 +125,11 @@ class AgentConfig(BaseSettings):
         default=True,
         description="Enable OSV scanner"
     )
+    # Kunlun-M (MIT License - https://github.com/LoRexxar/Kunlun-M)
+    kunlun_enabled: bool = Field(
+        default=True,
+        description="Enable Kunlun-M static code analyzer"
+    )
 
     # External Tool Timeouts
     semgrep_timeout_seconds: int = Field(
@@ -139,6 +144,10 @@ class AgentConfig(BaseSettings):
         default=60,
         description="Timeout for Gitleaks scanner"
     )
+    kunlun_timeout_seconds: int = Field(
+        default=600,
+        description="Timeout for Kunlun-M scanner (10 minutes for deep analysis)"
+    )
 
     # ============ Rate Limiting ============
     rate_limit_enabled: bool = Field(
diff --git a/backend/app/services/agent/graph/runner.py b/backend/app/services/agent/graph/runner.py
index f50d88c..31f41cd 100644
--- a/backend/app/services/agent/graph/runner.py
+++ b/backend/app/services/agent/graph/runner.py
@@ -204,6 +204,8 @@ class AgentRunner:
             CommandInjectionTestTool, SqlInjectionTestTool, XssTestTool,
             PathTraversalTestTool, SstiTestTool, DeserializationTestTool,
             UniversalVulnTestTool,
+            # Kunlun-M 静态代码分析工具 (MIT License)
+            KunlunMTool, KunlunRuleListTool, KunlunPluginTool,
         )
         # 🔥 导入知识查询工具
         from app.services.agent.knowledge import (
@@ -214,7 +216,34 @@ class AgentRunner:
         # 🔥 获取排除模式和目标文件
         exclude_patterns = self.task.exclude_patterns or []
         target_files = self.task.target_files or None
-        
+
+        # ============ 🔥 提前初始化 SandboxManager（供所有外部工具共享）============
+        self.sandbox_manager = None
+        try:
+            from app.services.agent.tools.sandbox_tool import SandboxConfig
+            sandbox_config = SandboxConfig(
+                image=settings.SANDBOX_IMAGE,
+                memory_limit=settings.SANDBOX_MEMORY_LIMIT,
+                cpu_limit=settings.SANDBOX_CPU_LIMIT,
+                timeout=settings.SANDBOX_TIMEOUT,
+                network_mode=settings.SANDBOX_NETWORK_MODE,
+            )
+            self.sandbox_manager = SandboxManager(config=sandbox_config)
+            # 🔥 必须调用 initialize() 来连接 Docker
+            await self.sandbox_manager.initialize()
+            logger.info(f"✅ SandboxManager initialized early (Docker available: {self.sandbox_manager.is_available})")
+        except Exception as e:
+            logger.warning(f"❌ Early Sandbox Manager initialization failed: {e}")
+            import traceback
+            logger.warning(f"Traceback: {traceback.format_exc()}")
+            # 尝试创建默认管理器作为后备
+            try:
+                self.sandbox_manager = SandboxManager()
+                await self.sandbox_manager.initialize()
+                logger.info(f"⚠️ Created fallback SandboxManager (Docker available: {self.sandbox_manager.is_available})")
+            except Exception as e2:
+                logger.error(f"❌ Failed to create fallback SandboxManager: {e2}")
+
         # ============ 基础工具（所有 Agent 共享）============
         base_tools = {
             "read_file": FileReadTool(self.project_root, exclude_patterns, target_files),
@@ -225,11 +254,18 @@ class AgentRunner:
         
         # ============ Recon Agent 专属工具 ============
         # 职责：信息收集、项目结构分析、技术栈识别
+        # 🔥 新增：外部工具也可用于Recon阶段的快速扫描
         self.recon_tools = {
             **base_tools,
             "search_code": FileSearchTool(self.project_root, exclude_patterns, target_files),
             # 🔥 新增：反思工具
             "reflect": ReflectTool(),
+            # 🔥 外部安全工具（共享 SandboxManager 实例）
+            "semgrep_scan": SemgrepTool(self.project_root, self.sandbox_manager),
+            "bandit_scan": BanditTool(self.project_root, self.sandbox_manager),
+            "gitleaks_scan": GitleaksTool(self.project_root, self.sandbox_manager),
+            "safety_scan": SafetyTool(self.project_root, self.sandbox_manager),
+            "npm_audit": NpmAuditTool(self.project_root, self.sandbox_manager),
         }
         
         # RAG 工具（Recon 用于语义搜索）
@@ -246,14 +282,18 @@ class AgentRunner:
             # TODO: code_analysis 工具暂时禁用，因为 LLM 调用经常失败
             # "code_analysis": CodeAnalysisTool(self.llm_service),
             "dataflow_analysis": DataFlowAnalysisTool(self.llm_service),
-            # 外部静态分析工具
-            "semgrep_scan": SemgrepTool(self.project_root),
-            "bandit_scan": BanditTool(self.project_root),
-            "gitleaks_scan": GitleaksTool(self.project_root),
-            "trufflehog_scan": TruffleHogTool(self.project_root),
-            "npm_audit": NpmAuditTool(self.project_root),
-            "safety_scan": SafetyTool(self.project_root),
-            "osv_scan": OSVScannerTool(self.project_root),
+            # 🔥 外部静态分析工具（共享 SandboxManager 实例）
+            "semgrep_scan": SemgrepTool(self.project_root, self.sandbox_manager),
+            "bandit_scan": BanditTool(self.project_root, self.sandbox_manager),
+            "gitleaks_scan": GitleaksTool(self.project_root, self.sandbox_manager),
+            "trufflehog_scan": TruffleHogTool(self.project_root, self.sandbox_manager),
+            "npm_audit": NpmAuditTool(self.project_root, self.sandbox_manager),
+            "safety_scan": SafetyTool(self.project_root, self.sandbox_manager),
+            "osv_scan": OSVScannerTool(self.project_root, self.sandbox_manager),
+            # 🔥 Kunlun-M 静态代码分析工具 (MIT License - https://github.com/LoRexxar/Kunlun-M)
+            "kunlun_scan": KunlunMTool(self.project_root),
+            "kunlun_list_rules": KunlunRuleListTool(self.project_root),
+            "kunlun_plugin": KunlunPluginTool(self.project_root),
             # 🔥 新增：反思工具
             "reflect": ReflectTool(),
             # 🔥 新增：安全知识查询工具（基于RAG）
@@ -276,35 +316,8 @@ class AgentRunner:
             # 🔥 新增：反思工具
             "reflect": ReflectTool(),
         }
-        
-        # 沙箱工具（仅 Verification Agent 可用）
-        self.sandbox_manager = None
-        try:
-            from app.services.agent.tools.sandbox_tool import SandboxConfig
-            sandbox_config = SandboxConfig(
-                image=settings.SANDBOX_IMAGE,
-                memory_limit=settings.SANDBOX_MEMORY_LIMIT,
-                cpu_limit=settings.SANDBOX_CPU_LIMIT,
-                timeout=settings.SANDBOX_TIMEOUT,
-                network_mode=settings.SANDBOX_NETWORK_MODE,
-            )
-            self.sandbox_manager = SandboxManager(config=sandbox_config)
-            # 🔥 必须调用 initialize() 来连接 Docker
-            await self.sandbox_manager.initialize()
-        except Exception as e:
-            logger.warning(f"❌ Sandbox Manager initialization failed: {e}")
-            import traceback
-            logger.warning(f"Traceback: {traceback.format_exc()}")
-            # 尝试创建默认管理器作为后备
-            try:
-                self.sandbox_manager = SandboxManager()
-                # 🔥 同样需要调用 initialize()
-                await self.sandbox_manager.initialize()
-                logger.info("⚠️ Created fallback SandboxManager (Docker might be unavailable)")
-            except Exception as e2:
-                logger.error(f"❌ Failed to create fallback SandboxManager: {e2}")
 
-        # 始终注册沙箱工具，即使 Docker 不可用（工具内部会检查）
+        # 🔥 注册沙箱工具（使用提前初始化的 SandboxManager）
         if self.sandbox_manager:
             # 🔥 沙箱核心工具
             self.verification_tools["sandbox_exec"] = SandboxTool(self.sandbox_manager)
diff --git a/backend/app/services/agent/prompts/system_prompts.py b/backend/app/services/agent/prompts/system_prompts.py
index efcd467..52bfbd6 100644
--- a/backend/app/services/agent/prompts/system_prompts.py
+++ b/backend/app/services/agent/prompts/system_prompts.py
@@ -102,26 +102,104 @@ TOOL_USAGE_GUIDE = """
 <tool_usage_guide>
 ## 工具使用指南
 
-### 分析流程
+### ⚠️ 核心原则：优先使用外部专业工具
 
-1. **初始侦察** - 了解项目结构
-   - 使用 list_files 了解目录布局
-   - 识别主要入口点和配置文件
-   - 确定技术栈和框架
+**外部工具优先级最高！** 外部安全工具（Semgrep、Bandit、Gitleaks、Kunlun-M 等）是经过业界验证的专业工具，具有：
+- 更全面的规则库和漏洞检测能力
+- 更低的误报率
+- 更专业的安全分析算法
+- 持续更新的安全规则
 
-2. **智能扫描** - 快速发现热点
-   - smart_scan: 综合扫描发现高风险区域
-   - pattern_match: 识别危险代码模式
-   - semgrep_scan/bandit_scan: 静态分析
+**必须优先调用外部工具，而非依赖内置的模式匹配！**
 
-3. **深度分析** - 验证发现
-   - read_file: 读取完整上下文
-   - dataflow_analysis: 追踪数据流
-   - search_code: 搜索相关代码
+### 🔧 工具优先级（从高到低）
 
-4. **知识查询** - 获取专业知识
-   - query_security_knowledge: 搜索安全知识库
-   - get_vulnerability_knowledge: 获取特定漏洞信息
+#### 第一优先级：外部专业安全工具 ⭐⭐⭐
+| 工具 | 用途 | 何时使用 |
+|------|------|---------|
+| `semgrep_scan` | 多语言静态分析 | **每次分析必用**，支持30+语言，OWASP规则 |
+| `bandit_scan` | Python安全扫描 | Python项目**必用**，检测注入/反序列化等 |
+| `gitleaks_scan` | 密钥泄露检测 | **每次分析必用**，检测150+种密钥类型 |
+| `kunlun_scan` | 深度代码审计 | 大型项目推荐，支持PHP/Java/JS深度分析 |
+| `npm_audit` | Node.js依赖漏洞 | package.json项目**必用** |
+| `safety_scan` | Python依赖漏洞 | requirements.txt项目**必用** |
+| `osv_scan` | 开源漏洞扫描 | 多语言依赖检查 |
+| `trufflehog_scan` | 深度密钥扫描 | 需要验证密钥有效性时使用 |
+
+#### 第二优先级：智能扫描工具 ⭐⭐
+| 工具 | 用途 |
+|------|------|
+| `smart_scan` | 综合智能扫描，快速定位高风险区域 |
+| `quick_audit` | 快速审计模式 |
+
+#### 第三优先级：内置分析工具 ⭐
+| 工具 | 用途 |
+|------|------|
+| `pattern_match` | 正则模式匹配（外部工具不可用时的备选） |
+| `dataflow_analysis` | 数据流追踪验证 |
+| `code_analysis` | 代码结构分析 |
+
+#### 辅助工具
+| 工具 | 用途 |
+|------|------|
+| `list_files` | 了解项目结构 |
+| `read_file` | 读取文件内容验证发现 |
+| `search_code` | 搜索相关代码 |
+| `query_security_knowledge` | 查询安全知识库 |
+
+### 📋 推荐分析流程
+
+#### 第一步：快速侦察（5%时间）
+```
+Action: list_files
+Action Input: {"path": "."}
+```
+了解项目结构、技术栈、入口点
+
+#### 第二步：外部工具全面扫描（60%时间）⚡重点！
+**根据技术栈选择对应工具，并行执行多个扫描：**
+
+```
+# 通用项目（必做）
+Action: semgrep_scan
+Action Input: {"target_path": ".", "rules": "p/security-audit"}
+
+Action: gitleaks_scan
+Action Input: {"target_path": "."}
+
+# Python项目（必做）
+Action: bandit_scan
+Action Input: {"target_path": ".", "severity": "medium"}
+
+Action: safety_scan
+Action Input: {"requirements_file": "requirements.txt"}
+
+# Node.js项目（必做）
+Action: npm_audit
+Action Input: {"target_path": "."}
+
+# 大型项目（推荐）
+Action: kunlun_scan
+Action Input: {"target_path": ".", "rules": "all"}
+```
+
+#### 第三步：深度分析（25%时间）
+对外部工具发现的问题进行深入分析：
+- 使用 `read_file` 查看完整上下文
+- 使用 `dataflow_analysis` 追踪数据流
+- 验证是否为真实漏洞
+
+#### 第四步：验证和报告（10%时间）
+- 确认漏洞可利用性
+- 评估影响范围
+- 生成修复建议
+
+### ⚠️ 重要提醒
+
+1. **不要跳过外部工具！** 即使内置模式匹配可能更快，外部工具的检测能力更强
+2. **并行执行**：可以同时调用多个不相关的外部工具以提高效率
+3. **Docker依赖**：外部工具需要Docker环境，如果Docker不可用，再回退到内置工具
+4. **结果整合**：综合多个工具的结果，交叉验证提高准确性
 
 ### 工具调用格式
 
@@ -268,22 +346,43 @@ ANALYSIS_SYSTEM_PROMPT = f"""你是 DeepAudit 的漏洞分析 Agent，一个专
 
 ## 分析策略
 
-### 第一步：快速扫描
-使用 smart_scan 或 pattern_match 快速识别高风险区域
+### ⚠️ 核心原则：外部工具优先！
 
-### 第二步：深度分析
-对可疑代码进行上下文分析：
-- 读取相关文件
-- 追踪数据流
-- 理解业务逻辑
+**必须首先使用外部专业安全工具进行扫描！** 这些工具有经过验证的规则库和更低的误报率。
 
-### 第三步：验证判断
-- 确认是否为真实漏洞
-- 评估可利用性
-- 确定置信度
+### 第一步：外部工具全面扫描（最重要！）⭐⭐⭐
+**根据项目技术栈，选择并执行以下工具：**
 
-### 第四步：报告发现
-输出结构化的漏洞报告
+**所有项目必做：**
+- `semgrep_scan`: 使用规则 "p/security-audit" 或 "p/owasp-top-ten" 进行全面扫描
+- `gitleaks_scan`: 检测密钥泄露
+
+**Python项目必做：**
+- `bandit_scan`: Python专用安全扫描
+- `safety_scan`: 依赖漏洞检查
+
+**Node.js项目必做：**
+- `npm_audit`: 依赖漏洞检查
+
+**大型项目推荐：**
+- `kunlun_scan`: Kunlun-M深度代码审计
+- `osv_scan`: 开源漏洞扫描
+
+### 第二步：分析外部工具结果
+对外部工具发现的问题进行深入分析：
+- 使用 `read_file` 查看完整代码上下文
+- 使用 `dataflow_analysis` 追踪数据流
+- 理解业务逻辑，排除误报
+
+### 第三步：补充扫描（仅在需要时）
+如果外部工具覆盖不足，使用内置工具补充：
+- `smart_scan`: 综合智能扫描
+- `pattern_match`: 正则模式匹配
+
+### 第四步：验证和报告
+- 确认漏洞可利用性
+- 评估实际影响
+- 输出结构化的漏洞报告
 
 ## 输出格式
 
@@ -330,25 +429,31 @@ VERIFICATION_SYSTEM_PROMPT = f"""你是 DeepAudit 的验证 Agent，负责验证
 
 ## 验证方法
 
-### 1. 上下文验证
+### 1. 外部工具交叉验证 ⭐⭐⭐（推荐！）
+使用不同的外部工具验证发现：
+- 使用 `semgrep_scan` 配合特定规则验证
+- 使用 `bandit_scan` 交叉确认 Python 漏洞
+- 如果多个工具都报告同一问题，置信度更高
+
+### 2. 上下文验证
 - 检查完整的代码上下文
 - 理解数据处理逻辑
 - 验证安全控制是否存在
 
-### 2. 数据流验证
+### 3. 数据流验证
 - 追踪从输入到输出的完整路径
 - 识别中间的验证和过滤
 - 确认是否存在有效的安全控制
 
-### 3. 配置验证
+### 4. 配置验证
 - 检查安全配置
 - 验证框架安全特性
 - 评估防护措施
 
-### 4. 模式验证
-- 对比已知漏洞模式
-- 检查类似代码位置
-- 评估误报可能性
+### 5. 沙箱验证（高置信度漏洞）
+- 使用 `sandbox_execute` 或漏洞专用测试工具
+- 构造 PoC 验证可利用性
+- 记录验证结果
 
 ## 输出格式
 
@@ -359,6 +464,7 @@ Final Answer: {{
             "original_finding": {{...}},
             "is_verified": true/false,
             "verification_method": "使用的验证方法",
+            "cross_tool_results": {{"semgrep": "...", "bandit": "..."}},
             "evidence": "验证证据",
             "final_severity": "最终严重程度",
             "final_confidence": 0.95,
@@ -380,15 +486,21 @@ RECON_SYSTEM_PROMPT = f"""你是 DeepAudit 的侦察 Agent，负责收集和分
 1. 分析项目结构和技术栈
 2. 识别关键入口点
 3. 发现配置文件和敏感区域
-4. 提供初步风险评估
+4. **推荐需要使用的外部安全工具**
+5. 提供初步风险评估
 
 ## 侦察目标
 
-### 1. 技术栈识别
+### 1. 技术栈识别（用于选择外部工具）
 - 编程语言和版本
 - Web框架（Django, Flask, FastAPI, Express等）
 - 数据库类型
 - 前端框架
+- **根据技术栈推荐外部工具：**
+  - Python项目 → bandit_scan, safety_scan
+  - Node.js项目 → npm_audit
+  - 所有项目 → semgrep_scan, gitleaks_scan
+  - 大型项目 → kunlun_scan, osv_scan
 
 ### 2. 入口点发现
 - HTTP路由和API端点
@@ -433,6 +545,11 @@ Final Answer: {{
         "frameworks": [...],
         "databases": [...]
     }},
+    "recommended_tools": {{
+        "must_use": ["semgrep_scan", "gitleaks_scan", ...],
+        "recommended": ["kunlun_scan", ...],
+        "reason": "基于项目技术栈的推荐理由"
+    }},
     "entry_points": [
         {{"type": "...", "file": "...", "line": ..., "method": "..."}}
     ],
@@ -448,6 +565,12 @@ Final Answer: {{
 
 ## ⚠️ 重要输出要求
 
+### recommended_tools 格式要求（新增！）
+**必须**根据项目技术栈推荐外部工具：
+- `must_use`: 必须使用的工具列表
+- `recommended`: 推荐使用的工具列表
+- `reason`: 推荐理由
+
 ### high_risk_areas 格式要求
 每个高风险区域**必须**包含具体的文件路径，格式为：
 - `"app.py:36 - SECRET_KEY 硬编码"`
diff --git a/backend/app/services/agent/tools/__init__.py b/backend/app/services/agent/tools/__init__.py
index d9ad13f..9690918 100644
--- a/backend/app/services/agent/tools/__init__.py
+++ b/backend/app/services/agent/tools/__init__.py
@@ -79,6 +79,9 @@ from .agent_tools import (
 # 🔥 新增：智能扫描工具
 from .smart_scan_tool import SmartScanTool, QuickAuditTool
 
+# 🔥 新增：Kunlun-M 静态代码分析工具 (MIT License)
+from .kunlun_tool import KunlunMTool, KunlunRuleListTool, KunlunPluginTool
+
 __all__ = [
     # 基础
     "AgentTool",
@@ -156,4 +159,9 @@ __all__ = [
     # 🔥 智能扫描工具
     "SmartScanTool",
     "QuickAuditTool",
+
+    # 🔥 Kunlun-M 工具 (MIT License - https://github.com/LoRexxar/Kunlun-M)
+    "KunlunMTool",
+    "KunlunRuleListTool",
+    "KunlunPluginTool",
 ]
diff --git a/backend/app/services/agent/tools/external_tools.py b/backend/app/services/agent/tools/external_tools.py
index 777127a..01418c1 100644
--- a/backend/app/services/agent/tools/external_tools.py
+++ b/backend/app/services/agent/tools/external_tools.py
@@ -25,8 +25,8 @@ class SemgrepInput(BaseModel):
     """Semgrep 扫描输入"""
     target_path: str = Field(description="要扫描的目录或文件路径（相对于项目根目录）")
     rules: Optional[str] = Field(
-        default="auto",
-        description="规则集: auto, p/security-audit, p/owasp-top-ten, p/r2c-security-audit, 或自定义规则文件路径"
+        default="p/security-audit",
+        description="规则集: p/security-audit, p/owasp-top-ten, p/r2c-security-audit, 或自定义规则文件路径"
     )
     severity: Optional[str] = Field(
         default=None,
@@ -51,7 +51,6 @@ class SemgrepTool(AgentTool):
     """
     
     AVAILABLE_RULESETS = [
-        "auto",
         "p/security-audit",
         "p/owasp-top-ten",
         "p/r2c-security-audit",
@@ -68,11 +67,13 @@ class SemgrepTool(AgentTool):
         "p/command-injection",
     ]
     
-    def __init__(self, project_root: str):
+    def __init__(self, project_root: str, sandbox_manager: Optional["SandboxManager"] = None):
         super().__init__()
-        self.project_root = project_root
-        self.sandbox_manager = SandboxManager()
-    
+        # 🔥 将相对路径转换为绝对路径，Docker 需要绝对路径
+        self.project_root = os.path.abspath(project_root)
+        # 🔥 使用共享的 SandboxManager 实例，避免重复初始化
+        self.sandbox_manager = sandbox_manager or SandboxManager()
+
     @property
     def name(self) -> str:
         return "semgrep_scan"
@@ -103,7 +104,7 @@ Semgrep 是业界领先的静态分析工具，支持 30+ 种编程语言。
     async def _execute(
         self,
         target_path: str = ".",
-        rules: str = "auto",
+        rules: str = "p/security-audit",
         severity: Optional[str] = None,
         max_results: int = 50,
         **kwargs
@@ -112,7 +113,7 @@ Semgrep 是业界领先的静态分析工具，支持 30+ 种编程语言。
         # 确保 Docker 可用
         await self.sandbox_manager.initialize()
         if not self.sandbox_manager.is_available:
-             return ToolResult(success=False, error="Docker 沙箱不可用，无法执行 Semgrep")
+            return ToolResult(success=False, error=f"Semgrep unavailable: {self.sandbox_manager.get_diagnosis()}")
 
         # 构建命令 (相对于 /workspace)
         # 注意: target_path 是相对于 project_root 的
@@ -121,7 +122,8 @@ Semgrep 是业界领先的静态分析工具，支持 30+ 种编程语言。
         cmd = ["semgrep", "--json", "--quiet"]
         
         if rules == "auto":
-            cmd.extend(["--config", "auto"])
+            # 🔥 Fallback if user explicitly requests 'auto', but prefer security-audit
+            cmd.extend(["--config", "p/security-audit"])
         elif rules.startswith("p/"):
             cmd.extend(["--config", rules])
         else:
@@ -139,7 +141,8 @@ Semgrep 是业界领先的静态分析工具，支持 30+ 种编程语言。
             result = await self.sandbox_manager.execute_tool_command(
                 command=cmd_str,
                 host_workdir=self.project_root,
-                timeout=300
+                timeout=300,
+                network_mode="bridge"  # 🔥 Semgrep 需要网络来下载规则
             )
             
             if not result["success"] and result["exit_code"] != 1:  # 1 means findings were found
@@ -230,11 +233,13 @@ class BanditTool(AgentTool):
     - 不安全的反序列化
     """
     
-    def __init__(self, project_root: str):
+    def __init__(self, project_root: str, sandbox_manager: Optional["SandboxManager"] = None):
         super().__init__()
-        self.project_root = project_root
-        self.sandbox_manager = SandboxManager()
-    
+        # 🔥 将相对路径转换为绝对路径，Docker 需要绝对路径
+        self.project_root = os.path.abspath(project_root)
+        # 🔥 使用共享的 SandboxManager 实例，避免重复初始化
+        self.sandbox_manager = sandbox_manager or SandboxManager()
+
     @property
     def name(self) -> str:
         return "bandit_scan"
@@ -271,10 +276,10 @@ Bandit 是 Python 专用的安全分析工具，由 OpenStack 安全团队开发
         # 确保 Docker 可用
         await self.sandbox_manager.initialize()
         if not self.sandbox_manager.is_available:
-             return ToolResult(success=False, error="Docker 沙箱不可用")
+            return ToolResult(success=False, error=f"Bandit unavailable: {self.sandbox_manager.get_diagnosis()}")
 
         safe_target_path = target_path if not target_path.startswith("/") else target_path.lstrip("/")
-        
+
         # 构建命令
         severity_map = {"low": "l", "medium": "m", "high": "h"}
         confidence_map = {"low": "l", "medium": "m", "high": "h"}
@@ -360,11 +365,13 @@ class GitleaksTool(AgentTool):
     - JWT secrets
     """
     
-    def __init__(self, project_root: str):
+    def __init__(self, project_root: str, sandbox_manager: Optional["SandboxManager"] = None):
         super().__init__()
-        self.project_root = project_root
-        self.sandbox_manager = SandboxManager()
-    
+        # 🔥 将相对路径转换为绝对路径，Docker 需要绝对路径
+        self.project_root = os.path.abspath(project_root)
+        # 🔥 使用共享的 SandboxManager 实例，避免重复初始化
+        self.sandbox_manager = sandbox_manager or SandboxManager()
+
     @property
     def name(self) -> str:
         return "gitleaks_scan"
@@ -402,30 +409,36 @@ Gitleaks 是专业的密钥检测工具，支持 150+ 种密钥类型。
         # 确保 Docker 可用
         await self.sandbox_manager.initialize()
         if not self.sandbox_manager.is_available:
-             return ToolResult(success=False, error="Docker 沙箱不可用")
+            return ToolResult(success=False, error=f"Gitleaks unavailable: {self.sandbox_manager.get_diagnosis()}")
 
         safe_target_path = target_path if not target_path.startswith("/") else target_path.lstrip("/")
-        
-        # 构建命令 using . as source because we are mounted to /workspace
-        # But if user specified a subdirectory, we append it.
-        # Actually gitleaks detects pwd by default if source is .
-        
-        cmd = ["gitleaks", "detect", "--source", safe_target_path, "-f", "json"]
+
+        # 🔥 修复：新版 gitleaks 需要使用 --report-path 输出到文件
+        # 使用 /tmp 目录（tmpfs 可写）
+        cmd = [
+            "gitleaks", "detect",
+            "--source", safe_target_path,
+            "--report-format", "json",
+            "--report-path", "/tmp/gitleaks-report.json",
+            "--exit-code", "0"  # 🔥 不要因为发现密钥而返回非零退出码
+        ]
         if no_git:
             cmd.append("--no-git")
-        
-        cmd_str = " ".join(cmd)
-        
+
+        # 执行 gitleaks 并读取报告文件
+        cmd_str = " ".join(cmd) + " && cat /tmp/gitleaks-report.json"
+
         try:
             result = await self.sandbox_manager.execute_tool_command(
                 command=cmd_str,
                 host_workdir=self.project_root,
-                timeout=120
+                timeout=180  # 🔥 增加超时时间
             )
-            
-            # Gitleaks returns 1 if secrets found
-            if result['exit_code'] not in [0, 1]:
-                 return ToolResult(success=False, error=f"Gitleaks 执行失败: {result['stderr'][:300]}")
+
+            if result['exit_code'] != 0:
+                # 🔥 修复：错误信息可能在 error 或 stderr 中
+                error_msg = result.get('error') or result.get('stderr', '')[:300] or '未知错误'
+                return ToolResult(success=False, error=f"Gitleaks 执行失败: {error_msg}")
 
             stdout = result['stdout']
             
@@ -502,11 +515,13 @@ class NpmAuditTool(AgentTool):
     扫描 Node.js 项目的依赖漏洞，基于 npm 官方漏洞数据库。
     """
     
-    def __init__(self, project_root: str):
+    def __init__(self, project_root: str, sandbox_manager: Optional["SandboxManager"] = None):
         super().__init__()
-        self.project_root = project_root
-        self.sandbox_manager = SandboxManager()
-    
+        # 🔥 将相对路径转换为绝对路径，Docker 需要绝对路径
+        self.project_root = os.path.abspath(project_root)
+        # 🔥 使用共享的 SandboxManager 实例，避免重复初始化
+        self.sandbox_manager = sandbox_manager or SandboxManager()
+
     @property
     def name(self) -> str:
         return "npm_audit"
@@ -536,7 +551,7 @@ class NpmAuditTool(AgentTool):
         # 确保 Docker 可用
         await self.sandbox_manager.initialize()
         if not self.sandbox_manager.is_available:
-             return ToolResult(success=False, error="Docker 沙箱不可用")
+            return ToolResult(success=False, error=f"npm audit unavailable: {self.sandbox_manager.get_diagnosis()}")
 
         # 这里的 target_path 是相对于 project_root 的
         # 防止空路径
@@ -645,11 +660,13 @@ class SafetyTool(AgentTool):
     检查 Python 依赖中的已知安全漏洞。
     """
     
-    def __init__(self, project_root: str):
+    def __init__(self, project_root: str, sandbox_manager: Optional["SandboxManager"] = None):
         super().__init__()
-        self.project_root = project_root
-        self.sandbox_manager = SandboxManager()
-    
+        # 🔥 将相对路径转换为绝对路径，Docker 需要绝对路径
+        self.project_root = os.path.abspath(project_root)
+        # 🔥 使用共享的 SandboxManager 实例，避免重复初始化
+        self.sandbox_manager = sandbox_manager or SandboxManager()
+
     @property
     def name(self) -> str:
         return "safety_scan"
@@ -677,7 +694,7 @@ class SafetyTool(AgentTool):
         # 确保 Docker 可用
         await self.sandbox_manager.initialize()
         if not self.sandbox_manager.is_available:
-             return ToolResult(success=False, error="Docker 沙箱不可用")
+            return ToolResult(success=False, error=f"Safety unavailable: {self.sandbox_manager.get_diagnosis()}")
 
         full_path = os.path.join(self.project_root, requirements_file)
         if not os.path.exists(full_path):
@@ -768,11 +785,13 @@ class TruffleHogTool(AgentTool):
     并可以验证密钥是否仍然有效。
     """
     
-    def __init__(self, project_root: str):
+    def __init__(self, project_root: str, sandbox_manager: Optional["SandboxManager"] = None):
         super().__init__()
-        self.project_root = project_root
-        self.sandbox_manager = SandboxManager()
-    
+        # 🔥 将相对路径转换为绝对路径，Docker 需要绝对路径
+        self.project_root = os.path.abspath(project_root)
+        # 🔥 使用共享的 SandboxManager 实例，避免重复初始化
+        self.sandbox_manager = sandbox_manager or SandboxManager()
+
     @property
     def name(self) -> str:
         return "trufflehog_scan"
@@ -804,10 +823,10 @@ TruffleHog 可以扫描代码和 Git 历史，并验证密钥是否有效。
         # 确保 Docker 可用
         await self.sandbox_manager.initialize()
         if not self.sandbox_manager.is_available:
-             return ToolResult(success=False, error="Docker 沙箱不可用")
+            return ToolResult(success=False, error=f"TruffleHog unavailable: {self.sandbox_manager.get_diagnosis()}")
 
         safe_target_path = target_path if not target_path.startswith("/") else target_path.lstrip("/")
-        
+
         cmd = ["trufflehog", "filesystem", safe_target_path, "--json"]
         if only_verified:
             cmd.append("--only-verified")
@@ -879,11 +898,13 @@ class OSVScannerTool(AgentTool):
     支持多种包管理器和锁文件。
     """
     
-    def __init__(self, project_root: str):
+    def __init__(self, project_root: str, sandbox_manager: Optional["SandboxManager"] = None):
         super().__init__()
-        self.project_root = project_root
-        self.sandbox_manager = SandboxManager()
-    
+        # 🔥 将相对路径转换为绝对路径，Docker 需要绝对路径
+        self.project_root = os.path.abspath(project_root)
+        # 🔥 使用共享的 SandboxManager 实例，避免重复初始化
+        self.sandbox_manager = sandbox_manager or SandboxManager()
+
     @property
     def name(self) -> str:
         return "osv_scan"
@@ -920,10 +941,10 @@ Google 开源的漏洞扫描工具，使用 OSV (Open Source Vulnerabilities) 
         # 确保 Docker 可用
         await self.sandbox_manager.initialize()
         if not self.sandbox_manager.is_available:
-             return ToolResult(success=False, error="Docker 沙箱不可用")
+            return ToolResult(success=False, error=f"OSV-Scanner unavailable: {self.sandbox_manager.get_diagnosis()}")
 
         safe_target_path = target_path if not target_path.startswith("/") else target_path.lstrip("/")
-        
+
         # OSV-Scanner
         cmd = ["osv-scanner", "--json", "-r", safe_target_path]
         cmd_str = " ".join(cmd)
diff --git a/backend/app/services/agent/tools/kunlun_tool.py b/backend/app/services/agent/tools/kunlun_tool.py
new file mode 100644
index 0000000..fcd1e30
--- /dev/null
+++ b/backend/app/services/agent/tools/kunlun_tool.py
@@ -0,0 +1,723 @@
+"""
+Kunlun-M 静态代码分析工具集成
+
+Kunlun-M (昆仑镜) 是一款开源的静态代码安全审计工具，
+支持 PHP、JavaScript 等语言的语义分析和漏洞检测。
+
+MIT License
+Copyright (c) 2017 Feei. <feei@feei.cn> All rights reserved
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+原始项目: https://github.com/LoRexxar/Kunlun-M
+"""
+
+import asyncio
+import json
+import logging
+import os
+import sys
+import tempfile
+import subprocess
+from typing import Optional, List, Dict, Any
+from pydantic import BaseModel, Field
+from pathlib import Path
+
+from .base import AgentTool, ToolResult
+
+logger = logging.getLogger(__name__)
+
+# Kunlun-M 安装路径（相对于项目根目录）
+KUNLUN_M_PATH = os.path.join(
+    os.path.dirname(os.path.dirname(os.path.dirname(os.path.dirname(os.path.dirname(os.path.dirname(__file__)))))),
+    "Kunlun-M-master"
+)
+
+
+class KunlunScanInput(BaseModel):
+    """Kunlun-M 扫描输入"""
+    target_path: str = Field(
+        description="要扫描的目录或文件路径（相对于项目根目录）"
+    )
+    language: Optional[str] = Field(
+        default=None,
+        description="指定扫描语言: php, javascript, solidity, chromeext。不指定则自动检测"
+    )
+    rules: Optional[str] = Field(
+        default=None,
+        description="指定规则ID，多个规则用逗号分隔，如: 1000,1001,1002"
+    )
+    tamper: Optional[str] = Field(
+        default=None,
+        description="指定 tamper 名称，用于自定义修复函数检测"
+    )
+    include_unconfirmed: bool = Field(
+        default=False,
+        description="是否包含未确认的漏洞（疑似漏洞）"
+    )
+    max_results: int = Field(
+        default=50,
+        description="最大返回结果数"
+    )
+
+
+class KunlunRuleListInput(BaseModel):
+    """Kunlun-M 规则列表输入"""
+    language: Optional[str] = Field(
+        default=None,
+        description="按语言过滤规则: php, javascript, solidity, chromeext"
+    )
+
+
+class KunlunMTool(AgentTool):
+    """
+    Kunlun-M (昆仑镜) 静态代码安全审计工具
+
+    特点：
+    - 语义分析：深度AST分析，减少误报
+    - 多语言支持：PHP、JavaScript 语义分析，Solidity、Chrome Extension 基础扫描
+    - 函数回溯：支持污点追踪和数据流分析
+    - 丰富的规则库：覆盖 OWASP Top 10 等常见漏洞
+
+    支持的漏洞类型：
+    - SQL 注入
+    - XSS 跨站脚本
+    - 命令注入
+    - 代码执行
+    - 文件包含
+    - 文件上传
+    - 反序列化
+    - SSRF
+    - XXE
+    - 等等...
+
+    使用场景：
+    - PHP 代码深度安全审计
+    - JavaScript 代码安全扫描
+    - 智能合约安全检查
+    - Chrome 扩展安全审计
+
+    原始项目: https://github.com/LoRexxar/Kunlun-M
+    License: MIT
+    """
+
+    SUPPORTED_LANGUAGES = ["php", "javascript", "solidity", "chromeext"]
+
+    def __init__(self, project_root: str):
+        super().__init__()
+        self.project_root = project_root
+        self.kunlun_path = KUNLUN_M_PATH
+        self._initialized = False
+        self._db_initialized = False
+
+    @property
+    def name(self) -> str:
+        return "kunlun_scan"
+
+    @property
+    def description(self) -> str:
+        return """使用 Kunlun-M (昆仑镜) 进行静态代码安全审计。
+Kunlun-M 是一款专注于代码安全审计的工具，特别擅长 PHP 和 JavaScript 的语义分析。
+
+支持的语言：
+- php: PHP 语义分析（最完善）
+- javascript: JavaScript 语义分析
+- solidity: 智能合约基础扫描
+- chromeext: Chrome 扩展安全检查
+
+主要功能：
+- 深度 AST 语义分析
+- 污点追踪和函数回溯
+- 自定义规则和 tamper 支持
+- 支持识别常见安全漏洞
+
+使用场景：
+- 对 PHP/JS 代码进行深度安全审计
+- 检测 SQL 注入、XSS、命令注入等漏洞
+- 分析代码中的危险函数调用
+- 追踪用户输入的传播路径"""
+
+    @property
+    def args_schema(self):
+        return KunlunScanInput
+
+    async def _ensure_initialized(self) -> bool:
+        """确保 Kunlun-M 已初始化"""
+        if self._initialized:
+            return True
+
+        # 检查 Kunlun-M 是否存在
+        if not os.path.exists(self.kunlun_path):
+            logger.error(f"Kunlun-M not found at {self.kunlun_path}")
+            return False
+
+        kunlun_py = os.path.join(self.kunlun_path, "kunlun.py")
+        if not os.path.exists(kunlun_py):
+            logger.error(f"kunlun.py not found at {kunlun_py}")
+            return False
+
+        # 检查数据库是否已初始化
+        db_path = os.path.join(self.kunlun_path, "db.sqlite3")
+        if not os.path.exists(db_path):
+            logger.info("Kunlun-M database not found, initializing...")
+            try:
+                await self._initialize_database()
+            except Exception as e:
+                logger.error(f"Failed to initialize Kunlun-M database: {e}")
+                return False
+
+        self._initialized = True
+        return True
+
+    async def _initialize_database(self):
+        """初始化 Kunlun-M 数据库"""
+        # 复制 settings.py
+        settings_bak = os.path.join(self.kunlun_path, "Kunlun_M", "settings.py.bak")
+        settings_py = os.path.join(self.kunlun_path, "Kunlun_M", "settings.py")
+
+        if os.path.exists(settings_bak) and not os.path.exists(settings_py):
+            import shutil
+            shutil.copy(settings_bak, settings_py)
+
+        # 运行初始化命令
+        init_cmd = [
+            sys.executable,
+            os.path.join(self.kunlun_path, "kunlun.py"),
+            "init", "initialize"
+        ]
+
+        process = await asyncio.create_subprocess_exec(
+            *init_cmd,
+            cwd=self.kunlun_path,
+            stdout=asyncio.subprocess.PIPE,
+            stderr=asyncio.subprocess.PIPE,
+            env={**os.environ, "DJANGO_SETTINGS_MODULE": "Kunlun_M.settings"}
+        )
+
+        stdout, stderr = await asyncio.wait_for(process.communicate(), timeout=120)
+
+        if process.returncode != 0:
+            raise Exception(f"Database init failed: {stderr.decode()}")
+
+        # 加载规则
+        load_cmd = [
+            sys.executable,
+            os.path.join(self.kunlun_path, "kunlun.py"),
+            "config", "load"
+        ]
+
+        process = await asyncio.create_subprocess_exec(
+            *load_cmd,
+            cwd=self.kunlun_path,
+            stdout=asyncio.subprocess.PIPE,
+            stderr=asyncio.subprocess.PIPE,
+            env={**os.environ, "DJANGO_SETTINGS_MODULE": "Kunlun_M.settings"}
+        )
+
+        stdout, stderr = await asyncio.wait_for(process.communicate(), timeout=120)
+
+        self._db_initialized = True
+        logger.info("Kunlun-M database initialized successfully")
+
+    async def _execute(
+        self,
+        target_path: str = ".",
+        language: Optional[str] = None,
+        rules: Optional[str] = None,
+        tamper: Optional[str] = None,
+        include_unconfirmed: bool = False,
+        max_results: int = 50,
+        **kwargs
+    ) -> ToolResult:
+        """执行 Kunlun-M 扫描"""
+
+        # 确保初始化
+        if not await self._ensure_initialized():
+            return ToolResult(
+                success=False,
+                error="Kunlun-M 未正确安装或初始化失败。请确保 Kunlun-M-master 目录存在且依赖已安装。"
+            )
+
+        # 构建完整目标路径
+        if target_path.startswith("/"):
+            full_target = target_path
+        else:
+            full_target = os.path.join(self.project_root, target_path)
+
+        if not os.path.exists(full_target):
+            return ToolResult(
+                success=False,
+                error=f"目标路径不存在: {target_path}"
+            )
+
+        # 构建扫描命令
+        cmd = [
+            sys.executable,
+            os.path.join(self.kunlun_path, "kunlun.py"),
+            "scan",
+            "-t", full_target,
+            "-o", "json"  # JSON 输出格式
+        ]
+
+        # 添加语言参数
+        if language:
+            if language.lower() not in self.SUPPORTED_LANGUAGES:
+                return ToolResult(
+                    success=False,
+                    error=f"不支持的语言: {language}。支持: {', '.join(self.SUPPORTED_LANGUAGES)}"
+                )
+            cmd.extend(["-l", language.lower()])
+
+        # 添加规则参数
+        if rules:
+            cmd.extend(["-r", rules])
+
+        # 添加 tamper 参数
+        if tamper:
+            cmd.extend(["-tp", tamper])
+
+        # 包含未确认漏洞
+        if include_unconfirmed:
+            cmd.append("-uc")
+
+        try:
+            # 创建临时输出文件
+            with tempfile.NamedTemporaryFile(mode='w', suffix='.json', delete=False) as f:
+                output_file = f.name
+
+            # 修改命令使用输出文件
+            cmd.extend(["-o", output_file])
+
+            logger.debug(f"Running Kunlun-M: {' '.join(cmd)}")
+
+            # 执行扫描
+            process = await asyncio.create_subprocess_exec(
+                *cmd,
+                cwd=self.kunlun_path,
+                stdout=asyncio.subprocess.PIPE,
+                stderr=asyncio.subprocess.PIPE,
+                env={**os.environ, "DJANGO_SETTINGS_MODULE": "Kunlun_M.settings"}
+            )
+
+            stdout, stderr = await asyncio.wait_for(
+                process.communicate(),
+                timeout=600  # 10 分钟超时
+            )
+
+            stdout_text = stdout.decode('utf-8', errors='ignore')
+            stderr_text = stderr.decode('utf-8', errors='ignore')
+
+            # 解析结果
+            findings = await self._parse_results(stdout_text, stderr_text, output_file)
+
+            # 清理临时文件
+            try:
+                os.unlink(output_file)
+            except:
+                pass
+
+            if not findings:
+                return ToolResult(
+                    success=True,
+                    data="🛡️ Kunlun-M 扫描完成，未发现安全问题",
+                    metadata={
+                        "findings_count": 0,
+                        "target": target_path,
+                        "language": language
+                    }
+                )
+
+            # 格式化输出
+            output = self._format_findings(findings[:max_results], target_path)
+
+            return ToolResult(
+                success=True,
+                data=output,
+                metadata={
+                    "findings_count": len(findings),
+                    "target": target_path,
+                    "language": language,
+                    "findings": findings[:10]  # 只在 metadata 中保存前10个
+                }
+            )
+
+        except asyncio.TimeoutError:
+            return ToolResult(
+                success=False,
+                error="Kunlun-M 扫描超时（10分钟）"
+            )
+        except Exception as e:
+            logger.error(f"Kunlun-M scan error: {e}", exc_info=True)
+            return ToolResult(
+                success=False,
+                error=f"扫描执行失败: {str(e)}"
+            )
+
+    async def _parse_results(
+        self,
+        stdout: str,
+        stderr: str,
+        output_file: str
+    ) -> List[Dict[str, Any]]:
+        """解析 Kunlun-M 扫描结果"""
+        findings = []
+
+        # 尝试从输出文件读取 JSON
+        try:
+            if os.path.exists(output_file):
+                with open(output_file, 'r', encoding='utf-8') as f:
+                    data = json.load(f)
+                    if isinstance(data, list):
+                        findings.extend(data)
+                    elif isinstance(data, dict) and 'vulnerabilities' in data:
+                        findings.extend(data['vulnerabilities'])
+        except Exception as e:
+            logger.debug(f"Failed to parse output file: {e}")
+
+        # 如果没有 JSON 输出，尝试从 stdout 解析
+        if not findings and stdout:
+            # 尝试提取 JSON 部分
+            try:
+                json_start = stdout.find('[')
+                json_end = stdout.rfind(']') + 1
+                if json_start >= 0 and json_end > json_start:
+                    json_str = stdout[json_start:json_end]
+                    findings = json.loads(json_str)
+            except:
+                pass
+
+            # 尝试解析表格格式输出
+            if not findings:
+                findings = self._parse_table_output(stdout)
+
+        return findings
+
+    def _parse_table_output(self, output: str) -> List[Dict[str, Any]]:
+        """解析 Kunlun-M 表格格式输出"""
+        findings = []
+        lines = output.split('\n')
+
+        for line in lines:
+            # 匹配漏洞行格式: | index | CVI-xxxx | rule_name | language | file:line | ...
+            if '|' in line and 'CVI' in line:
+                parts = [p.strip() for p in line.split('|') if p.strip()]
+                if len(parts) >= 6:
+                    try:
+                        finding = {
+                            "id": parts[1],  # CVI-xxxx
+                            "rule_name": parts[2],
+                            "language": parts[3],
+                            "location": parts[4],
+                            "author": parts[5] if len(parts) > 5 else "",
+                            "code": parts[6] if len(parts) > 6 else "",
+                            "analysis": parts[7] if len(parts) > 7 else "",
+                        }
+                        findings.append(finding)
+                    except:
+                        pass
+
+        return findings
+
+    def _format_findings(self, findings: List[Dict[str, Any]], target: str) -> str:
+        """格式化漏洞发现"""
+        output_parts = [
+            f"🔍 Kunlun-M 扫描结果",
+            f"目标: {target}",
+            f"发现 {len(findings)} 个潜在安全问题:\n"
+        ]
+
+        severity_icons = {
+            "CRITICAL": "🔴",
+            "HIGH": "🟠",
+            "MEDIUM": "🟡",
+            "LOW": "🟢",
+            "INFO": "⚪"
+        }
+
+        for i, finding in enumerate(findings, 1):
+            # 获取严重程度
+            severity = finding.get("severity", "MEDIUM")
+            if isinstance(severity, int):
+                if severity >= 9:
+                    severity = "CRITICAL"
+                elif severity >= 6:
+                    severity = "HIGH"
+                elif severity >= 3:
+                    severity = "MEDIUM"
+                else:
+                    severity = "LOW"
+
+            icon = severity_icons.get(severity.upper(), "⚪")
+
+            output_parts.append(f"\n{icon} [{i}] {finding.get('rule_name', 'Unknown')}")
+            output_parts.append(f"   ID: {finding.get('id', 'N/A')}")
+            output_parts.append(f"   语言: {finding.get('language', 'N/A')}")
+
+            location = finding.get('location') or finding.get('file_path', '')
+            line_number = finding.get('line_number', '')
+            if location:
+                if line_number:
+                    output_parts.append(f"   位置: {location}:{line_number}")
+                else:
+                    output_parts.append(f"   位置: {location}")
+
+            code = finding.get('code') or finding.get('code_content', '')
+            if code:
+                code_preview = code[:100].strip().replace('\n', ' ')
+                output_parts.append(f"   代码: {code_preview}")
+
+            analysis = finding.get('analysis', '')
+            if analysis:
+                output_parts.append(f"   分析: {analysis}")
+
+        return "\n".join(output_parts)
+
+
+class KunlunRuleListTool(AgentTool):
+    """
+    查看 Kunlun-M 可用的扫描规则
+
+    可以按语言过滤规则，了解支持检测的漏洞类型。
+    """
+
+    def __init__(self, project_root: str):
+        super().__init__()
+        self.project_root = project_root
+        self.kunlun_path = KUNLUN_M_PATH
+
+    @property
+    def name(self) -> str:
+        return "kunlun_list_rules"
+
+    @property
+    def description(self) -> str:
+        return """查看 Kunlun-M 可用的扫描规则。
+
+可以按语言过滤：
+- php: PHP 规则
+- javascript: JavaScript 规则
+- solidity: 智能合约规则
+- chromeext: Chrome 扩展规则
+
+返回规则ID、名称、描述等信息，帮助选择合适的规则进行扫描。"""
+
+    @property
+    def args_schema(self):
+        return KunlunRuleListInput
+
+    async def _execute(
+        self,
+        language: Optional[str] = None,
+        **kwargs
+    ) -> ToolResult:
+        """列出可用规则"""
+
+        if not os.path.exists(self.kunlun_path):
+            return ToolResult(
+                success=False,
+                error="Kunlun-M 未安装"
+            )
+
+        # 构建命令
+        cmd = [
+            sys.executable,
+            os.path.join(self.kunlun_path, "kunlun.py"),
+            "show", "rule"
+        ]
+
+        if language:
+            cmd.extend(["-k", language.lower()])
+
+        try:
+            process = await asyncio.create_subprocess_exec(
+                *cmd,
+                cwd=self.kunlun_path,
+                stdout=asyncio.subprocess.PIPE,
+                stderr=asyncio.subprocess.PIPE,
+                env={**os.environ, "DJANGO_SETTINGS_MODULE": "Kunlun_M.settings"}
+            )
+
+            stdout, stderr = await asyncio.wait_for(
+                process.communicate(),
+                timeout=60
+            )
+
+            output = stdout.decode('utf-8', errors='ignore')
+
+            if not output.strip():
+                return ToolResult(
+                    success=True,
+                    data="未找到匹配的规则" if language else "规则列表为空，请先运行初始化",
+                    metadata={"language": language}
+                )
+
+            return ToolResult(
+                success=True,
+                data=f"📋 Kunlun-M 规则列表{f' ({language})' if language else ''}:\n\n{output}",
+                metadata={"language": language}
+            )
+
+        except asyncio.TimeoutError:
+            return ToolResult(
+                success=False,
+                error="获取规则列表超时"
+            )
+        except Exception as e:
+            return ToolResult(
+                success=False,
+                error=f"获取规则列表失败: {str(e)}"
+            )
+
+
+class KunlunPluginInput(BaseModel):
+    """Kunlun-M 插件输入"""
+    plugin_name: str = Field(
+        description="插件名称: php_unserialize_chain_tools (PHP反序列化链分析), entrance_finder (入口点发现)"
+    )
+    target_path: str = Field(
+        description="要分析的目标路径（相对于项目根目录）"
+    )
+    depth: int = Field(
+        default=3,
+        description="分析深度（仅对 entrance_finder 有效）"
+    )
+
+
+class KunlunPluginTool(AgentTool):
+    """
+    Kunlun-M 插件工具
+
+    提供额外的分析功能：
+    - php_unserialize_chain_tools: 自动化寻找 PHP 反序列化链
+    - entrance_finder: 发现 PHP 代码中的入口点/路由
+    """
+
+    AVAILABLE_PLUGINS = {
+        "php_unserialize_chain_tools": "PHP 反序列化链分析工具，用于发现潜在的反序列化攻击链",
+        "entrance_finder": "入口点发现工具，帮助找到 PHP 代码中的入口页面和路由",
+    }
+
+    def __init__(self, project_root: str):
+        super().__init__()
+        self.project_root = project_root
+        self.kunlun_path = KUNLUN_M_PATH
+
+    @property
+    def name(self) -> str:
+        return "kunlun_plugin"
+
+    @property
+    def description(self) -> str:
+        return """运行 Kunlun-M 插件进行专项分析。
+
+可用插件：
+- php_unserialize_chain_tools: 自动分析 PHP 反序列化链，寻找 POP 链
+- entrance_finder: 发现 PHP 入口点和路由
+
+使用场景：
+- 分析 PHP 框架的反序列化漏洞利用链
+- 快速定位大型 PHP 项目的入口文件"""
+
+    @property
+    def args_schema(self):
+        return KunlunPluginInput
+
+    async def _execute(
+        self,
+        plugin_name: str,
+        target_path: str = ".",
+        depth: int = 3,
+        **kwargs
+    ) -> ToolResult:
+        """执行插件"""
+
+        if plugin_name not in self.AVAILABLE_PLUGINS:
+            return ToolResult(
+                success=False,
+                error=f"未知插件: {plugin_name}。可用插件: {', '.join(self.AVAILABLE_PLUGINS.keys())}"
+            )
+
+        if not os.path.exists(self.kunlun_path):
+            return ToolResult(
+                success=False,
+                error="Kunlun-M 未安装"
+            )
+
+        # 构建完整目标路径
+        if target_path.startswith("/"):
+            full_target = target_path
+        else:
+            full_target = os.path.join(self.project_root, target_path)
+
+        if not os.path.exists(full_target):
+            return ToolResult(
+                success=False,
+                error=f"目标路径不存在: {target_path}"
+            )
+
+        # 构建命令
+        cmd = [
+            sys.executable,
+            os.path.join(self.kunlun_path, "kunlun.py"),
+            "plugin", plugin_name,
+            "-t", full_target
+        ]
+
+        if plugin_name == "entrance_finder":
+            cmd.extend(["-l", str(depth)])
+
+        try:
+            process = await asyncio.create_subprocess_exec(
+                *cmd,
+                cwd=self.kunlun_path,
+                stdout=asyncio.subprocess.PIPE,
+                stderr=asyncio.subprocess.PIPE,
+                env={**os.environ, "DJANGO_SETTINGS_MODULE": "Kunlun_M.settings"}
+            )
+
+            stdout, stderr = await asyncio.wait_for(
+                process.communicate(),
+                timeout=300  # 5 分钟超时
+            )
+
+            output = stdout.decode('utf-8', errors='ignore')
+
+            if not output.strip():
+                return ToolResult(
+                    success=True,
+                    data=f"插件 {plugin_name} 执行完成，未发现结果",
+                    metadata={"plugin": plugin_name, "target": target_path}
+                )
+
+            return ToolResult(
+                success=True,
+                data=f"🔌 Kunlun-M 插件 [{plugin_name}] 分析结果:\n\n{output}",
+                metadata={"plugin": plugin_name, "target": target_path}
+            )
+
+        except asyncio.TimeoutError:
+            return ToolResult(
+                success=False,
+                error=f"插件 {plugin_name} 执行超时"
+            )
+        except Exception as e:
+            return ToolResult(
+                success=False,
+                error=f"插件执行失败: {str(e)}"
+            )
diff --git a/backend/app/services/agent/tools/sandbox_tool.py b/backend/app/services/agent/tools/sandbox_tool.py
index 72831be..78fbee5 100644
--- a/backend/app/services/agent/tools/sandbox_tool.py
+++ b/backend/app/services/agent/tools/sandbox_tool.py
@@ -40,6 +40,7 @@ class SandboxManager:
         self.config = config or SandboxConfig()
         self._docker_client = None
         self._initialized = False
+        self._init_error = None
     
     async def initialize(self):
         """初始化 Docker 客户端"""
@@ -49,25 +50,34 @@ class SandboxManager:
 
         try:
             import docker
-            logger.info("🔄 Attempting to connect to Docker...")
+            logger.info(f"🔄 Attempting to connect to Docker... (lib: {docker.__file__})")
             self._docker_client = docker.from_env()
             # 测试连接
             self._docker_client.ping()
             self._initialized = True
+            self._init_error = None
             logger.info("✅ Docker sandbox manager initialized successfully")
         except ImportError as e:
             logger.error(f"❌ Docker library not installed: {e}")
             self._docker_client = None
+            self._init_error = f"ImportError: {e}"
         except Exception as e:
             logger.warning(f"❌ Docker not available: {e}")
             import traceback
             logger.warning(f"Docker connection traceback: {traceback.format_exc()}")
             self._docker_client = None
+            self._init_error = f"{type(e).__name__}: {str(e)}"
     
     @property
     def is_available(self) -> bool:
         """检查 Docker 是否可用"""
         return self._docker_client is not None
+        
+    def get_diagnosis(self) -> str:
+        """获取诊断信息"""
+        if self.is_available:
+            return "Docker Service Available"
+        return f"Docker Service Unavailable. Error: {self._init_error or 'Not initialized'}"
     
     async def execute_command(
         self,
@@ -211,12 +221,20 @@ class SandboxManager:
             }
         
         timeout = timeout or self.config.timeout
-        
+
         try:
+            # 🔥 清除代理环境变量的方式：在命令前添加 unset
+            # 因为设置空字符串会导致工具尝试解析空 URI 而出错
+            unset_proxy_prefix = "unset HTTP_PROXY HTTPS_PROXY http_proxy https_proxy; "
+            wrapped_command = unset_proxy_prefix + command
+
+            # 用户传入的环境变量
+            container_env = env or {}
+
             # 准备容器配置
             container_config = {
                 "image": self.config.image,
-                "command": ["sh", "-c", command],
+                "command": ["sh", "-c", wrapped_command],
                 "detach": True,
                 "mem_limit": self.config.memory_limit,
                 "cpu_period": 100000,
@@ -228,10 +246,11 @@ class SandboxManager:
                     host_workdir: {"bind": "/workspace", "mode": "ro"}, # 只读挂载项目代码
                 },
                 "tmpfs": {
-                    "/home/sandbox": "rw,size=100m,mode=1777"
+                    "/home/sandbox": "rw,size=100m,mode=1777",
+                    "/tmp": "rw,size=100m,mode=1777"  # 🔥 添加 /tmp 目录供工具写入临时文件
                 },
                 "working_dir": "/workspace",
-                "environment": env or {},
+                "environment": container_env,  # 🔥 用户传入的环境变量
                 "cap_drop": ["ALL"],
                 "security_opt": ["no-new-privileges:true"],
             }
diff --git a/backend/check_docker_direct.py b/backend/check_docker_direct.py
new file mode 100644
index 0000000..95394d9
--- /dev/null
+++ b/backend/check_docker_direct.py
@@ -0,0 +1,16 @@
+
+import sys
+try:
+    import docker
+    print(f"Docker module: {docker.__file__}")
+    client = docker.from_env()
+    print("Client created")
+    client.ping()
+    print("Docker is available and ping successful")
+    print(f"Docker version: {client.version()}")
+except ImportError:
+    print("Docker library not installed")
+except Exception as e:
+    print(f"Docker unavailable: {e}")
+    import traceback
+    traceback.print_exc()
diff --git a/backend/check_sandbox.py b/backend/check_sandbox.py
new file mode 100644
index 0000000..c5f092b
--- /dev/null
+++ b/backend/check_sandbox.py
@@ -0,0 +1,31 @@
+
+import asyncio
+import logging
+import sys
+import os
+
+# Add backend to path
+sys.path.append(os.getcwd())
+
+# Configure logging
+logging.basicConfig(level=logging.INFO)
+
+from app.services.agent.tools.sandbox_tool import SandboxManager
+
+async def main():
+    print("Checking SandboxManager...")
+    mgr = SandboxManager()
+    await mgr.initialize()
+    print(f"Is available: {mgr.is_available}")
+    print(f"Diagnosis: {mgr.get_diagnosis()}")
+    
+    if mgr.is_available:
+        print("Docker client created successfully.")
+        try:
+            ver = mgr._docker_client.version()
+            print(f"Docker version: {ver}")
+        except Exception as e:
+            print(f"Error getting version: {e}")
+
+if __name__ == "__main__":
+    asyncio.run(main())
diff --git a/backend/pyproject.toml b/backend/pyproject.toml
index ad61443..7066ce7 100644
--- a/backend/pyproject.toml
+++ b/backend/pyproject.toml
@@ -1,28 +1,211 @@
 [project]
 name = "deepaudit-backend"
-version = "2.0.0-beta.7"
-description = "DeepAudit Backend API"
-requires-python = ">=3.13"
-dependencies = [
-    "fastapi>=0.100.0",
-    "uvicorn[standard]",
-    "sqlalchemy>=2.0.0",
-    "asyncpg",
-    "alembic",
-    "pydantic>=2.0.0",
-    "pydantic-settings",
-    "passlib[bcrypt]",
-    "python-jose[cryptography]",
-    "python-multipart",
-    "httpx",
-    "email-validator",
-    "greenlet",
-    "bcrypt<5.0.0",
-    "litellm>=1.0.0",
-    "reportlab>=4.0.0",
-    "weasyprint>=66.0",
-    "jinja2>=3.1.6",
-    "json-repair>=0.30.0",
-    "bandit>=1.9.2",
-    "safety>=3.7.0",
+version = "3.0.0"
+description = "DeepAudit Backend API - AI-Powered Code Security Audit Platform"
+requires-python = ">=3.11,<3.13"
+readme = "README.md"
+license = { text = "MIT" }
+authors = [
+    { name = "DeepAudit Team" }
+]
+keywords = ["security", "audit", "code-review", "vulnerability", "ai", "llm"]
+
+dependencies = [
+    # ============ Web Framework ============
+    "fastapi>=0.100.0",
+    "uvicorn[standard]>=0.23.0",
+    "sse-starlette>=1.8.2",
+
+    # ============ Database ============
+    "sqlalchemy>=2.0.0",
+    "asyncpg>=0.29.0",
+    "alembic>=1.13.0",
+    "greenlet>=3.0.0",
+
+    # ============ Data Validation ============
+    "pydantic>=2.0.0",
+    "pydantic-settings>=2.0.0",
+    "email-validator>=2.1.0",
+
+    # ============ Authentication ============
+    "passlib[bcrypt]>=1.7.4",
+    "python-jose[cryptography]>=3.3.0",
+    "python-multipart>=0.0.6",
+    "bcrypt>=4.0.0,<5.0.0",
+
+    # ============ HTTP Client ============
+    "httpx>=0.25.0",
+
+    # ============ LLM Integration ============
+    "litellm>=1.0.0",
+    "tiktoken>=0.5.2",
+
+    # ============ Report Generation ============
+    "reportlab>=4.0.0",
+    "weasyprint>=60.0",
+    "jinja2>=3.1.6",
+
+    # ============ Utilities ============
+    "json-repair>=0.30.0",
+    "aiofiles>=23.2.1",
+
+    # ============ LangChain & LangGraph ============
+    "langchain>=0.1.0",
+    "langchain-community>=0.0.20",
+    "langchain-openai>=0.0.5",
+    "langgraph>=0.0.40",
+
+    # ============ Vector Database ============
+    "chromadb>=0.4.22",
+
+    # ============ Code Parsing ============
+    "tree-sitter>=0.21.0",
+    "tree-sitter-languages>=1.10.0",
+    "pygments>=2.17.0",
+
+    # ============ Docker Sandbox ============
+    "docker>=7.0.0",
+
+    # ============ Security Tools ============
+    "bandit>=1.7.0",
+    "safety>=2.3.0",
+    "pip-audit>=2.6.0",
+
+    # ============ Kunlun-M Dependencies (MIT License) ============
+    # https://github.com/LoRexxar/Kunlun-M
+    "pyjsparser>=2.7.1",
+    "phply>=1.2.6",
+    "esprima>=4.0.1",
+    "jsbeautifier>=1.14.0",
+    "colorlog>=6.0.0",
+    "portalocker>=2.0.0",
+    "prettytable>=3.0.0",
+    "rarfile>=4.0",
+    "beautifulsoup4>=4.12.0",
+    "django>=4.2.0",
+]
+
+[project.optional-dependencies]
+# MySQL support for Kunlun-M web mode
+mysql = ["mysqlclient>=2.2.0"]
+
+# Development tools
+dev = [
+    "pytest>=7.4.0",
+    "pytest-asyncio>=0.21.0",
+    "pytest-cov>=4.1.0",
+    "black>=23.0.0",
+    "ruff>=0.1.0",
+    "mypy>=1.5.0",
+    "pre-commit>=3.5.0",
+]
+
+# Documentation
+docs = [
+    "mkdocs>=1.5.0",
+    "mkdocs-material>=9.4.0",
+    "mkdocstrings[python]>=0.23.0",
+]
+
+[project.urls]
+Homepage = "https://github.com/your-org/deepaudit"
+Documentation = "https://docs.deepaudit.io"
+Repository = "https://github.com/your-org/deepaudit"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["app"]
+
+# ============ Tool Configurations ============
+
+[tool.black]
+line-length = 100
+target-version = ["py311", "py312", "py313"]
+exclude = '''
+/(
+    \.git
+    | \.hg
+    | \.mypy_cache
+    | \.tox
+    | \.venv
+    | _build
+    | buck-out
+    | build
+    | dist
+    | migrations
+)/
+'''
+
+[tool.ruff]
+line-length = 100
+target-version = "py311"
+exclude = [
+    ".git",
+    ".hg",
+    ".mypy_cache",
+    ".tox",
+    ".venv",
+    "_build",
+    "buck-out",
+    "build",
+    "dist",
+    "migrations",
+]
+
+[tool.ruff.lint]
+select = [
+    "E",   # pycodestyle errors
+    "W",   # pycodestyle warnings
+    "F",   # Pyflakes
+    "I",   # isort
+    "B",   # flake8-bugbear
+    "C4",  # flake8-comprehensions
+    "UP",  # pyupgrade
+]
+ignore = [
+    "E501",  # line too long (handled by black)
+    "B008",  # do not perform function calls in argument defaults
+    "C901",  # too complex
+]
+
+[tool.mypy]
+python_version = "3.11"
+warn_return_any = true
+warn_unused_ignores = true
+disallow_untyped_defs = true
+exclude = [
+    "migrations/",
+    ".venv/",
+]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+asyncio_mode = "auto"
+addopts = "-v --tb=short"
+
+[tool.coverage.run]
+source = ["app"]
+omit = ["*/migrations/*", "*/tests/*"]
+
+[tool.coverage.report]
+exclude_lines = [
+    "pragma: no cover",
+    "def __repr__",
+    "raise NotImplementedError",
+    "if TYPE_CHECKING:",
+]
+
+# ============ UV Configuration ============
+
+[tool.uv]
+dev-dependencies = [
+    "pytest>=7.4.0",
+    "pytest-asyncio>=0.21.0",
+    "pytest-cov>=4.1.0",
+    "black>=23.0.0",
+    "ruff>=0.1.0",
+    "mypy>=1.5.0",
 ]
diff --git a/backend/requirements-lock.txt b/backend/requirements-lock.txt
index cb03ddb..b3307b9 100644
--- a/backend/requirements-lock.txt
+++ b/backend/requirements-lock.txt
@@ -1,9 +1,13 @@
 # This file was autogenerated by uv via the following command:
-#    uv pip compile requirements.txt -o requirements-lock.txt
+#    uv pip compile requirements.txt -o requirements-lock.txt --python-version 3.12
+aiofiles==25.1.0
+    # via -r requirements.txt
 aiohappyeyeballs==2.6.1
     # via aiohttp
 aiohttp==3.13.2
-    # via litellm
+    # via
+    #   langchain-community
+    #   litellm
 aiosignal==1.4.0
     # via aiohttp
 alembic==1.17.2
@@ -16,8 +20,11 @@ anyio==4.11.0
     # via
     #   httpx
     #   openai
+    #   sse-starlette
     #   starlette
     #   watchfiles
+asgiref==3.11.0
+    # via django
 asyncpg==0.31.0
     # via -r requirements.txt
 attrs==25.4.0
@@ -25,16 +32,34 @@ attrs==25.4.0
     #   aiohttp
     #   jsonschema
     #   referencing
+authlib==1.6.6
+    # via safety
+backoff==2.2.1
+    # via posthog
+bandit==1.9.2
+    # via -r requirements.txt
 bcrypt==4.3.0
     # via
     #   -r requirements.txt
+    #   chromadb
     #   passlib
+beautifulsoup4==4.14.3
+    # via -r requirements.txt
+boolean-py==5.0
+    # via license-expression
 brotli==1.2.0
     # via fonttools
+build==1.3.0
+    # via chromadb
+cachecontrol==0.14.4
+    # via pip-audit
+cachetools==6.2.3
+    # via google-auth
 certifi==2025.11.12
     # via
     #   httpcore
     #   httpx
+    #   kubernetes
     #   requests
 cffi==2.0.0
     # via
@@ -44,29 +69,67 @@ charset-normalizer==3.4.4
     # via
     #   reportlab
     #   requests
+chromadb==1.3.7
+    # via -r requirements.txt
 click==8.3.1
     # via
     #   litellm
+    #   nltk
+    #   safety
+    #   typer
     #   typer-slim
     #   uvicorn
+coloredlogs==15.0.1
+    # via onnxruntime
+colorlog==6.10.1
+    # via -r requirements.txt
 cryptography==46.0.3
-    # via python-jose
+    # via
+    #   authlib
+    #   python-jose
 cssselect2==0.8.0
     # via weasyprint
+cyclonedx-python-lib==11.6.0
+    # via pip-audit
+dataclasses-json==0.6.7
+    # via langchain-community
+defusedxml==0.7.1
+    # via py-serializable
 distro==1.9.0
-    # via openai
+    # via
+    #   openai
+    #   posthog
+django==6.0
+    # via -r requirements.txt
 dnspython==2.8.0
     # via email-validator
+docker==7.1.0
+    # via -r requirements.txt
+dparse==0.6.4
+    # via
+    #   safety
+    #   safety-schemas
+durationpy==0.10
+    # via kubernetes
 ecdsa==0.19.1
     # via python-jose
+editorconfig==0.17.1
+    # via jsbeautifier
 email-validator==2.3.0
     # via -r requirements.txt
+esprima==4.0.1
+    # via -r requirements.txt
 fastapi==0.122.0
     # via -r requirements.txt
 fastuuid==0.14.0
     # via litellm
 filelock==3.20.0
-    # via huggingface-hub
+    # via
+    #   cachecontrol
+    #   huggingface-hub
+    #   safety
+flatbuffers==25.9.23
+    # via onnxruntime
 fonttools==4.61.0
     # via weasyprint
 frozenlist==1.8.0
@@ -75,10 +138,17 @@ frozenlist==1.8.0
     #   aiosignal
 fsspec==2025.12.0
     # via huggingface-hub
+google-auth==2.43.0
+    # via kubernetes
+googleapis-common-protos==1.72.0
+    # via opentelemetry-exporter-otlp-proto-grpc
 greenlet==3.3.0
     # via -r requirements.txt
 grpcio==1.67.1
-    # via litellm
+    # via
+    #   chromadb
+    #   litellm
+    #   opentelemetry-exporter-otlp-proto-grpc
 h11==0.16.0
     # via
     #   httpcore
@@ -92,11 +162,19 @@ httptools==0.7.1
 httpx==0.28.1
     # via
     #   -r requirements.txt
+    #   chromadb
     #   huggingface-hub
+    #   langgraph-sdk
+    #   langsmith
     #   litellm
     #   openai
+    #   safety
+httpx-sse==0.4.3
+    # via langchain-community
 huggingface-hub==1.2.1
     # via tokenizers
+humanfriendly==10.0
+    # via coloredlogs
 idna==3.11
     # via
     #   anyio
@@ -105,66 +183,251 @@ idna==3.11
     #   requests
     #   yarl
 importlib-metadata==8.7.0
-    # via litellm
+    # via
+    #   litellm
+    #   opentelemetry-api
+importlib-resources==6.5.2
+    # via chromadb
 jinja2==3.1.6
     # via
     #   -r requirements.txt
     #   litellm
+    #   safety
 jiter==0.12.0
     # via openai
+joblib==1.5.2
+    # via nltk
+jsbeautifier==1.15.4
+    # via -r requirements.txt
 json-repair==0.54.2
     # via -r requirements.txt
+jsonpatch==1.33
+    # via langchain-core
+jsonpointer==3.0.0
+    # via jsonpatch
 jsonschema==4.25.1
-    # via litellm
+    # via
+    #   chromadb
+    #   litellm
 jsonschema-specifications==2025.9.1
     # via jsonschema
+kubernetes==34.1.0
+    # via chromadb
+langchain==1.1.3
+    # via -r requirements.txt
+langchain-classic==1.0.0
+    # via langchain-community
+langchain-community==0.4.1
+    # via -r requirements.txt
+langchain-core==1.2.0
+    # via
+    #   langchain
+    #   langchain-classic
+    #   langchain-community
+    #   langchain-openai
+    #   langchain-text-splitters
+    #   langgraph
+    #   langgraph-checkpoint
+    #   langgraph-prebuilt
+langchain-openai==1.1.3
+    # via -r requirements.txt
+langchain-text-splitters==1.1.0
+    # via langchain-classic
+langgraph==1.0.5
+    # via
+    #   -r requirements.txt
+    #   langchain
+langgraph-checkpoint==3.0.1
+    # via
+    #   langgraph
+    #   langgraph-prebuilt
+langgraph-prebuilt==1.0.5
+    # via langgraph
+langgraph-sdk==0.3.0
+    # via langgraph
+langsmith==0.4.59
+    # via
+    #   langchain-classic
+    #   langchain-community
+    #   langchain-core
+license-expression==30.4.4
+    # via cyclonedx-python-lib
 litellm==1.80.8
     # via -r requirements.txt
 mako==1.3.10
     # via alembic
+markdown-it-py==4.0.0
+    # via rich
 markupsafe==3.0.3
     # via
     #   jinja2
     #   mako
+marshmallow==3.26.1
+    # via
+    #   dataclasses-json
+    #   safety
+mdurl==0.1.2
+    # via markdown-it-py
+mmh3==5.2.0
+    # via chromadb
+mpmath==1.3.0
+    # via sympy
+msgpack==1.1.2
+    # via cachecontrol
 multidict==6.7.0
     # via
     #   aiohttp
     #   yarl
+mypy-extensions==1.1.0
+    # via typing-inspect
+nltk==3.9.2
+    # via safety
+numpy==2.3.5
+    # via
+    #   chromadb
+    #   langchain-community
+    #   onnxruntime
+oauthlib==3.3.1
+    # via requests-oauthlib
+onnxruntime==1.23.2
+    # via chromadb
 openai==2.9.0
-    # via litellm
+    # via
+    #   langchain-openai
+    #   litellm
+opentelemetry-api==1.39.1
+    # via
+    #   chromadb
+    #   opentelemetry-exporter-otlp-proto-grpc
+    #   opentelemetry-sdk
+    #   opentelemetry-semantic-conventions
+opentelemetry-exporter-otlp-proto-common==1.39.1
+    # via opentelemetry-exporter-otlp-proto-grpc
+opentelemetry-exporter-otlp-proto-grpc==1.39.1
+    # via chromadb
+opentelemetry-proto==1.39.1
+    # via
+    #   opentelemetry-exporter-otlp-proto-common
+    #   opentelemetry-exporter-otlp-proto-grpc
+opentelemetry-sdk==1.39.1
+    # via
+    #   chromadb
+    #   opentelemetry-exporter-otlp-proto-grpc
+opentelemetry-semantic-conventions==0.60b1
+    # via opentelemetry-sdk
+orjson==3.11.5
+    # via
+    #   chromadb
+    #   langgraph-sdk
+    #   langsmith
+ormsgpack==1.12.1
+    # via langgraph-checkpoint
+overrides==7.7.0
+    # via chromadb
+packageurl-python==0.17.6
+    # via cyclonedx-python-lib
 packaging==25.0
-    # via huggingface-hub
+    # via
+    #   build
+    #   dparse
+    #   huggingface-hub
+    #   langchain-core
+    #   langsmith
+    #   marshmallow
+    #   onnxruntime
+    #   pip-audit
+    #   pip-requirements-parser
+    #   safety
+    #   safety-schemas
 passlib==1.7.4
     # via -r requirements.txt
+phply==1.2.6
+    # via -r requirements.txt
 pillow==12.0.0
     # via
     #   reportlab
     #   weasyprint
+pip==25.3
+    # via pip-api
+pip-api==0.0.34
+    # via pip-audit
+pip-audit==2.10.0
+    # via -r requirements.txt
+pip-requirements-parser==32.0.1
+    # via pip-audit
+platformdirs==4.5.1
+    # via pip-audit
+ply==3.11
+    # via phply
+portalocker==3.2.0
+    # via -r requirements.txt
+posthog==5.4.0
+    # via chromadb
+prettytable==3.17.0
+    # via -r requirements.txt
 propcache==0.4.1
     # via
     #   aiohttp
     #   yarl
+protobuf==6.33.2
+    # via
+    #   googleapis-common-protos
+    #   onnxruntime
+    #   opentelemetry-proto
+py-serializable==2.1.0
+    # via cyclonedx-python-lib
 pyasn1==0.6.1
     # via
+    #   pyasn1-modules
     #   python-jose
     #   rsa
+pyasn1-modules==0.4.2
+    # via google-auth
+pybase64==1.4.3
+    # via chromadb
 pycparser==2.23
     # via cffi
 pydantic==2.12.4
     # via
     #   -r requirements.txt
+    #   chromadb
     #   fastapi
+    #   langchain
+    #   langchain-classic
+    #   langchain-core
+    #   langgraph
+    #   langsmith
     #   litellm
     #   openai
     #   pydantic-settings
+    #   safety
+    #   safety-schemas
 pydantic-core==2.41.5
     # via pydantic
 pydantic-settings==2.12.0
-    # via -r requirements.txt
+    # via
+    #   -r requirements.txt
+    #   langchain-community
 pydyf==0.12.1
     # via weasyprint
+pygments==2.19.2
+    # via
+    #   -r requirements.txt
+    #   rich
+pyjsparser==2.7.1
+    # via -r requirements.txt
+pyparsing==3.2.5
+    # via pip-requirements-parser
 pyphen==0.17.2
     # via weasyprint
+pypika==0.48.9
+    # via chromadb
+pyproject-hooks==1.2.0
+    # via build
+python-dateutil==2.9.0.post0
+    # via
+    #   kubernetes
+    #   posthog
 python-dotenv==1.2.1
     # via
     #   litellm
@@ -176,40 +439,114 @@ python-multipart==0.0.20
     # via -r requirements.txt
 pyyaml==6.0.3
     # via
+    #   bandit
+    #   chromadb
     #   huggingface-hub
+    #   kubernetes
+    #   langchain-classic
+    #   langchain-community
+    #   langchain-core
     #   uvicorn
+rarfile==4.2
+    # via -r requirements.txt
 referencing==0.37.0
     # via
     #   jsonschema
     #   jsonschema-specifications
 regex==2025.11.3
-    # via tiktoken
+    # via
+    #   nltk
+    #   tiktoken
 reportlab==4.4.5
     # via -r requirements.txt
 requests==2.32.5
-    # via tiktoken
+    # via
+    #   cachecontrol
+    #   docker
+    #   kubernetes
+    #   langchain-classic
+    #   langchain-community
+    #   langsmith
+    #   pip-audit
+    #   posthog
+    #   requests-oauthlib
+    #   requests-toolbelt
+    #   safety
+    #   tiktoken
+requests-oauthlib==2.0.0
+    # via kubernetes
+requests-toolbelt==1.0.0
+    # via langsmith
+rich==14.2.0
+    # via
+    #   bandit
+    #   chromadb
+    #   pip-audit
+    #   typer
 rpds-py==0.30.0
     # via
     #   jsonschema
     #   referencing
 rsa==4.9.1
-    # via python-jose
+    # via
+    #   google-auth
+    #   python-jose
+ruamel-yaml==0.18.16
+    # via
+    #   safety
+    #   safety-schemas
+ruamel-yaml-clib==0.2.15
+    # via ruamel-yaml
+safety==3.7.0
+    # via -r requirements.txt
+safety-schemas==0.0.16
+    # via safety
 shellingham==1.5.4
-    # via huggingface-hub
+    # via
+    #   huggingface-hub
+    #   typer
 six==1.17.0
-    # via ecdsa
+    # via
+    #   ecdsa
+    #   jsbeautifier
+    #   kubernetes
+    #   posthog
+    #   python-dateutil
 sniffio==1.3.1
     # via
     #   anyio
     #   openai
+sortedcontainers==2.4.0
+    # via cyclonedx-python-lib
+soupsieve==2.8
+    # via beautifulsoup4
 sqlalchemy==2.0.44
     # via
     #   -r requirements.txt
     #   alembic
+    #   langchain-classic
+    #   langchain-community
+sqlparse==0.5.4
+    # via django
+sse-starlette==3.0.3
+    # via -r requirements.txt
 starlette==0.50.0
     # via fastapi
+stevedore==5.6.0
+    # via bandit
+sympy==1.14.0
+    # via onnxruntime
+tenacity==9.1.2
+    # via
+    #   chromadb
+    #   langchain-community
+    #   langchain-core
+    #   safety
 tiktoken==0.12.0
-    # via litellm
+    # via
+    #   -r requirements.txt
+    #   langchain-openai
+    #   litellm
 tinycss2==1.5.1
     # via
     #   cssselect2
@@ -217,36 +554,85 @@ tinycss2==1.5.1
 tinyhtml5==2.0.0
     # via weasyprint
 tokenizers==0.22.1
-    # via litellm
+    # via
+    #   chromadb
+    #   litellm
+tomli==2.3.0
+    # via pip-audit
+tomli-w==1.2.0
+    # via pip-audit
+tomlkit==0.13.3
+    # via safety
 tqdm==4.67.1
     # via
+    #   chromadb
     #   huggingface-hub
+    #   nltk
     #   openai
+tree-sitter==0.25.2
+    # via
+    #   -r requirements.txt
+    #   tree-sitter-languages
+tree-sitter-languages==1.10.2
+    # via -r requirements.txt
+typer==0.20.0
+    # via
+    #   chromadb
+    #   safety
 typer-slim==0.20.0
     # via huggingface-hub
 typing-extensions==4.15.0
     # via
+    #   aiosignal
     #   alembic
+    #   anyio
+    #   beautifulsoup4
+    #   chromadb
+    #   cyclonedx-python-lib
     #   fastapi
     #   huggingface-hub
+    #   langchain-core
     #   openai
+    #   opentelemetry-api
+    #   opentelemetry-exporter-otlp-proto-grpc
+    #   opentelemetry-sdk
+    #   opentelemetry-semantic-conventions
     #   pydantic
     #   pydantic-core
+    #   referencing
+    #   safety
+    #   safety-schemas
     #   sqlalchemy
+    #   starlette
+    #   typer
     #   typer-slim
+    #   typing-inspect
     #   typing-inspection
+typing-inspect==0.9.0
+    # via dataclasses-json
 typing-inspection==0.4.2
     # via
     #   pydantic
     #   pydantic-settings
-urllib3==2.6.0
-    # via requests
+urllib3==2.3.0
+    # via
+    #   docker
+    #   kubernetes
+    #   requests
+uuid-utils==0.12.0
+    # via
+    #   langchain-core
+    #   langsmith
 uvicorn==0.38.0
-    # via -r requirements.txt
+    # via
+    #   -r requirements.txt
+    #   chromadb
 uvloop==0.22.1
     # via uvicorn
 watchfiles==1.1.1
     # via uvicorn
+wcwidth==0.2.14
+    # via prettytable
 weasyprint==67.0
     # via -r requirements.txt
 webencodings==0.5.1
@@ -254,11 +640,17 @@ webencodings==0.5.1
     #   cssselect2
     #   tinycss2
     #   tinyhtml5
+websocket-client==1.9.0
+    # via kubernetes
 websockets==15.0.1
     # via uvicorn
+xxhash==3.6.0
+    # via langgraph
 yarl==1.22.0
     # via aiohttp
 zipp==3.23.0
     # via importlib-metadata
 zopfli==0.4.0
     # via fonttools
+zstandard==0.25.0
+    # via langsmith
diff --git a/backend/requirements.txt b/backend/requirements.txt
index 708fb5e..a42c7c9 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -65,3 +65,29 @@ safety>=2.3.0
 # 依赖漏洞扫描
 pip-audit>=2.6.0
 
+# ============ Kunlun-M 依赖 (MIT License) ============
+# https://github.com/LoRexxar/Kunlun-M
+# Kunlun-M 是静态代码安全审计工具，支持 PHP/JS 语义分析
+
+# PHP/JS 解析器
+pyjsparser>=2.7.1
+phply>=1.2.6
+esprima>=4.0.1
+jsbeautifier>=1.14.0
+
+# 工具库
+colorlog>=6.0.0
+portalocker>=2.0.0
+prettytable>=3.0.0
+rarfile>=4.0
+
+# HTML 解析
+beautifulsoup4>=4.12.0
+
+# Django (Kunlun-M 数据库)
+django>=4.2.0
+
+# MySQL 客户端 (可选，用于 Kunlun-M Web 模式)
+# 如需 MySQL 支持，请安装: pip install mysqlclient
+# 注意: mysqlclient 需要系统级 MySQL 开发库
+
diff --git a/frontend/src/components/audit/FileSelectionDialog.tsx b/frontend/src/components/audit/FileSelectionDialog.tsx
index 1410b15..d58b8e2 100644
--- a/frontend/src/components/audit/FileSelectionDialog.tsx
+++ b/frontend/src/components/audit/FileSelectionDialog.tsx
@@ -449,7 +449,7 @@ export default function FileSelectionDialog({
 
     return (
         <Dialog open={open} onOpenChange={onOpenChange}>
-            <DialogContent className="!max-w-[1000px] !w-[95vw] max-h-[85vh] flex flex-col cyber-card p-0 bg-[#0c0c12]">
+            <DialogContent className="!max-w-[1000px] !w-[95vw] max-h-[85vh] flex flex-col cyber-card p-0 bg-[#0c0c12] !fixed">
                 <DialogHeader className="cyber-card-header flex-shrink-0">
                     <div className="flex items-center gap-3">
                         <FolderOpen className="w-5 h-5 text-primary" />
@@ -464,7 +464,7 @@ export default function FileSelectionDialog({
                     )}
                 </DialogHeader>
 
-                <div className="p-5 flex-1 flex flex-col min-h-0 space-y-3">
+                <div className="p-5 flex-1 flex flex-col min-h-0 space-y-3 overflow-y-auto">
                     {/* 工具栏 */}
                     <div className="flex items-center gap-2 flex-wrap">
                         {/* 搜索框 */}
diff --git a/frontend/src/components/reports/ExportReportDialog.tsx b/frontend/src/components/reports/ExportReportDialog.tsx
index e1f690d..9341cdb 100644
--- a/frontend/src/components/reports/ExportReportDialog.tsx
+++ b/frontend/src/components/reports/ExportReportDialog.tsx
@@ -60,91 +60,49 @@ export default function ExportReportDialog({
         }
     };
 
-    const formats = [
-        {
-            value: "json" as ExportFormat,
-            label: "JSON 格式",
-            description: "结构化数据，适合程序处理和集成",
-            icon: FileJson,
-            color: "text-amber-400",
-            bgColor: "bg-amber-500/20",
-            borderColor: "border-amber-500/30"
-        },
-        {
-            value: "pdf" as ExportFormat,
-            label: "PDF 格式",
-            description: "专业报告，适合打印和分享",
-            icon: FileText,
-            color: "text-rose-400",
-            bgColor: "bg-rose-500/20",
-            borderColor: "border-rose-500/30"
-        }
-    ];
-
     return (
         <Dialog open={open} onOpenChange={onOpenChange}>
-            <DialogContent className="sm:max-w-[600px] cyber-card p-0 bg-[#0c0c12]">
-                <DialogHeader className="cyber-card-header">
-                    <div className="flex items-center gap-3">
+            <DialogContent className="sm:max-w-[600px] bg-[#0c0c12] border-gray-700">
+                <DialogHeader>
+                    <DialogTitle className="flex items-center gap-3 text-lg font-bold uppercase tracking-wider text-white">
                         <Download className="w-5 h-5 text-primary" />
-                        <DialogTitle className="text-lg font-bold uppercase tracking-wider text-white">
-                            导出审计报告
-                        </DialogTitle>
-                    </div>
+                        导出审计报告
+                    </DialogTitle>
+                    <DialogDescription className="text-gray-400 font-mono text-xs">
+                        选择报告格式并导出完整的代码审计结果
+                    </DialogDescription>
                 </DialogHeader>
-                <DialogDescription className="px-6 pt-4 text-gray-400 font-mono text-xs">
-                    选择报告格式并导出完整的代码审计结果
-                </DialogDescription>
 
-                <div className="p-6">
+                <div className="py-4">
                     <RadioGroup
                         value={selectedFormat}
                         onValueChange={(value) => setSelectedFormat(value as ExportFormat)}
                         className="space-y-4"
                     >
-                        {formats.map((format) => {
-                            const Icon = format.icon;
-                            const isSelected = selectedFormat === format.value;
-
-                            return (
-                                <div key={format.value} className="relative">
-                                    <RadioGroupItem
-                                        value={format.value}
-                                        id={format.value}
-                                        className="peer sr-only"
-                                    />
-                                    <Label
-                                        htmlFor={format.value}
-                                        className={`flex items-start space-x-4 p-4 border cursor-pointer transition-all rounded font-mono ${isSelected
-                                            ? "border-primary bg-primary/10"
-                                            : "border-gray-700 bg-gray-900/30 hover:bg-gray-800/50 hover:border-gray-600"
-                                            }`}
-                                    >
-                                        <div
-                                            className={`w-12 h-12 flex items-center justify-center rounded ${isSelected ? "bg-primary/20 border border-primary/50" : format.bgColor + " border " + format.borderColor
-                                                }`}
-                                        >
-                                            <Icon className={`w-6 h-6 ${isSelected ? "text-primary" : format.color}`} />
-                                        </div>
-                                        <div className="flex-1">
-                                            <div className="flex items-center justify-between mb-1">
-                                                <h4 className={`font-bold uppercase ${isSelected ? "text-primary" : "text-gray-200"}`}>
-                                                    {format.label}
-                                                </h4>
-                                                {isSelected && (
-                                                    <div className="w-3 h-3 bg-primary rounded-full shadow-[0_0_10px_rgba(255,107,44,0.5)]" />
-                                                )}
-                                            </div>
-                                            <p className="text-xs text-gray-500">{format.description}</p>
-                                        </div>
-                                    </Label>
+                        <div className="flex items-center space-x-3 p-4 border border-gray-700 rounded bg-gray-900/30 cursor-pointer hover:bg-gray-800/50">
+                            <RadioGroupItem value="json" id="json" />
+                            <Label htmlFor="json" className="flex items-center gap-3 cursor-pointer flex-1">
+                                <FileJson className="w-5 h-5 text-amber-400" />
+                                <div>
+                                    <div className="font-bold text-gray-200">JSON 格式</div>
+                                    <div className="text-xs text-gray-500">结构化数据，适合程序处理和集成</div>
                                 </div>
-                            );
-                        })}
+                            </Label>
+                        </div>
+                        <div className="flex items-center space-x-3 p-4 border border-gray-700 rounded bg-gray-900/30 cursor-pointer hover:bg-gray-800/50">
+                            <RadioGroupItem value="pdf" id="pdf" />
+                            <Label htmlFor="pdf" className="flex items-center gap-3 cursor-pointer flex-1">
+                                <FileText className="w-5 h-5 text-rose-400" />
+                                <div>
+                                    <div className="font-bold text-gray-200">PDF 格式</div>
+                                    <div className="text-xs text-gray-500">专业报告，适合打印和分享</div>
+                                </div>
+                            </Label>
+                        </div>
                     </RadioGroup>
 
                     {/* 报告预览信息 */}
-                    <div className="mt-6 cyber-card p-0">
+                    <div className="mt-6 border border-gray-700 rounded bg-gray-900/30">
                         <div className="px-4 py-2 border-b border-gray-800 bg-gray-900/50 flex items-center gap-2">
                             <Terminal className="w-3 h-3 text-primary" />
                             <h4 className="font-bold text-gray-300 uppercase text-xs">报告内容预览</h4>
@@ -180,19 +138,17 @@ export default function ExportReportDialog({
                     </div>
                 </div>
 
-                <DialogFooter className="p-4 border-t border-gray-800 bg-gray-900/50 flex justify-end gap-3">
+                <DialogFooter className="border-t border-gray-800 pt-4">
                     <Button
                         variant="outline"
                         onClick={() => onOpenChange(false)}
                         disabled={isExporting}
-                        className="cyber-btn-outline h-10"
                     >
                         取消
                     </Button>
                     <Button
                         onClick={handleExport}
                         disabled={isExporting}
-                        className="cyber-btn-primary h-10 font-bold uppercase"
                     >
                         {isExporting ? (
                             <>
diff --git a/frontend/src/components/reports/InstantExportDialog.tsx b/frontend/src/components/reports/InstantExportDialog.tsx
index 3d7b13d..917c842 100644
--- a/frontend/src/components/reports/InstantExportDialog.tsx
+++ b/frontend/src/components/reports/InstantExportDialog.tsx
@@ -68,105 +68,54 @@ export default function InstantExportDialog({
         }
     };
 
-    const formats = [
-        {
-            value: "json" as ExportFormat,
-            label: "JSON 格式",
-            description: "结构化数据，适合程序处理和集成",
-            icon: FileJson,
-            color: "text-amber-400",
-            bgColor: "bg-amber-500/20",
-            borderColor: "border-amber-500/30",
-            disabled: false
-        },
-        {
-            value: "pdf" as ExportFormat,
-            label: "PDF 格式",
-            description: analysisId ? "专业报告，适合打印和分享" : "需要先保存到历史记录",
-            icon: FileText,
-            color: "text-rose-400",
-            bgColor: "bg-rose-500/20",
-            borderColor: "border-rose-500/30",
-            disabled: !analysisId
-        }
-    ];
+    const isPdfDisabled = !analysisId;
 
     return (
         <Dialog open={open} onOpenChange={onOpenChange}>
-            <DialogContent className="sm:max-w-[600px] cyber-card p-0 bg-[#0c0c12]">
-                <DialogHeader className="cyber-card-header">
-                    <div className="flex items-center gap-3">
+            <DialogContent className="sm:max-w-[600px] bg-[#0c0c12] border-gray-700">
+                <DialogHeader>
+                    <DialogTitle className="flex items-center gap-3 text-lg font-bold uppercase tracking-wider text-white">
                         <Download className="w-5 h-5 text-primary" />
-                        <DialogTitle className="text-lg font-bold uppercase tracking-wider text-white">
-                            导出分析报告
-                        </DialogTitle>
-                    </div>
+                        导出分析报告
+                    </DialogTitle>
+                    <DialogDescription className="text-gray-400 font-mono text-xs">
+                        选择报告格式并导出代码分析结果
+                    </DialogDescription>
                 </DialogHeader>
-                <DialogDescription className="px-6 pt-4 text-gray-400 font-mono text-xs">
-                    选择报告格式并导出代码分析结果
-                </DialogDescription>
 
-                <div className="p-6">
+                <div className="py-4">
                     <RadioGroup
                         value={selectedFormat}
                         onValueChange={(value) => setSelectedFormat(value as ExportFormat)}
                         className="space-y-4"
                     >
-                        {formats.map((format) => {
-                            const Icon = format.icon;
-                            const isSelected = selectedFormat === format.value;
-
-                            return (
-                                <div key={format.value} className="relative">
-                                    <RadioGroupItem
-                                        value={format.value}
-                                        id={format.value}
-                                        className="peer sr-only"
-                                        disabled={format.disabled}
-                                    />
-                                    <Label
-                                        htmlFor={format.value}
-                                        className={`flex items-start space-x-4 p-4 border cursor-pointer transition-all rounded font-mono ${
-                                            format.disabled
-                                                ? "border-gray-800 bg-gray-900/20 cursor-not-allowed opacity-50"
-                                                : isSelected
-                                                    ? "border-primary bg-primary/10"
-                                                    : "border-gray-700 bg-gray-900/30 hover:bg-gray-800/50 hover:border-gray-600"
-                                        }`}
-                                    >
-                                        <div
-                                            className={`w-12 h-12 flex items-center justify-center rounded ${
-                                                format.disabled
-                                                    ? "bg-gray-800 border border-gray-700"
-                                                    : isSelected
-                                                        ? "bg-primary/20 border border-primary/50"
-                                                        : format.bgColor + " border " + format.borderColor
-                                            }`}
-                                        >
-                                            <Icon className={`w-6 h-6 ${format.disabled ? "text-gray-600" : isSelected ? "text-primary" : format.color}`} />
-                                        </div>
-                                        <div className="flex-1">
-                                            <div className="flex items-center justify-between mb-1">
-                                                <h4 className={`font-bold uppercase ${format.disabled ? "text-gray-600" : isSelected ? "text-primary" : "text-gray-200"}`}>
-                                                    {format.label}
-                                                </h4>
-                                                {isSelected && !format.disabled && (
-                                                    <div className="w-3 h-3 bg-primary rounded-full shadow-[0_0_10px_rgba(255,107,44,0.5)]" />
-                                                )}
-                                            </div>
-                                            <p className={`text-xs ${format.disabled ? "text-gray-600" : "text-gray-500"}`}>
-                                                {format.disabled && <AlertTriangle className="w-3 h-3 inline mr-1 text-amber-500" />}
-                                                {format.description}
-                                            </p>
-                                        </div>
-                                    </Label>
+                        <div className="flex items-center space-x-3 p-4 border border-gray-700 rounded bg-gray-900/30 cursor-pointer hover:bg-gray-800/50">
+                            <RadioGroupItem value="json" id="json" />
+                            <Label htmlFor="json" className="flex items-center gap-3 cursor-pointer flex-1">
+                                <FileJson className="w-5 h-5 text-amber-400" />
+                                <div>
+                                    <div className="font-bold text-gray-200">JSON 格式</div>
+                                    <div className="text-xs text-gray-500">结构化数据，适合程序处理和集成</div>
                                 </div>
-                            );
-                        })}
+                            </Label>
+                        </div>
+                        <div className={`flex items-center space-x-3 p-4 border border-gray-700 rounded bg-gray-900/30 ${isPdfDisabled ? 'opacity-50 cursor-not-allowed' : 'cursor-pointer hover:bg-gray-800/50'}`}>
+                            <RadioGroupItem value="pdf" id="pdf" disabled={isPdfDisabled} />
+                            <Label htmlFor="pdf" className={`flex items-center gap-3 flex-1 ${isPdfDisabled ? 'cursor-not-allowed' : 'cursor-pointer'}`}>
+                                <FileText className="w-5 h-5 text-rose-400" />
+                                <div>
+                                    <div className="font-bold text-gray-200">PDF 格式</div>
+                                    <div className="text-xs text-gray-500">
+                                        {isPdfDisabled && <AlertTriangle className="w-3 h-3 inline mr-1 text-amber-500" />}
+                                        {isPdfDisabled ? "需要先保存到历史记录" : "专业报告，适合打印和分享"}
+                                    </div>
+                                </div>
+                            </Label>
+                        </div>
                     </RadioGroup>
 
                     {/* 报告预览信息 */}
-                    <div className="mt-6 cyber-card p-0">
+                    <div className="mt-6 border border-gray-700 rounded bg-gray-900/30">
                         <div className="px-4 py-2 border-b border-gray-800 bg-gray-900/50 flex items-center gap-2">
                             <Terminal className="w-3 h-3 text-primary" />
                             <h4 className="font-bold text-gray-300 uppercase text-xs">报告内容预览</h4>
@@ -192,19 +141,17 @@ export default function InstantExportDialog({
                     </div>
                 </div>
 
-                <DialogFooter className="p-4 border-t border-gray-800 bg-gray-900/50 flex justify-end gap-3">
+                <DialogFooter className="border-t border-gray-800 pt-4">
                     <Button
                         variant="outline"
                         onClick={() => onOpenChange(false)}
                         disabled={isExporting}
-                        className="cyber-btn-outline h-10"
                     >
                         取消
                     </Button>
                     <Button
                         onClick={handleExport}
                         disabled={isExporting || (selectedFormat === "pdf" && !analysisId)}
-                        className="cyber-btn-primary h-10 font-bold uppercase"
                     >
                         {isExporting ? (
                             <>
diff --git a/frontend/src/components/ui/dialog.tsx b/frontend/src/components/ui/dialog.tsx
index 38d6698..9491446 100644
--- a/frontend/src/components/ui/dialog.tsx
+++ b/frontend/src/components/ui/dialog.tsx
@@ -1,135 +1,122 @@
-"use client";
+"use client"
 
-import * as React from "react";
-import * as DialogPrimitive from "@radix-ui/react-dialog";
-import { XIcon } from "lucide-react";
+import * as React from "react"
+import * as DialogPrimitive from "@radix-ui/react-dialog"
+import { X } from "lucide-react"
 
-import { cn } from "@/shared/utils/utils";
+import { cn } from "@/shared/utils/utils"
 
-function Dialog({
-  ...props
-}: React.ComponentProps<typeof DialogPrimitive.Root>) {
-  return <DialogPrimitive.Root data-slot="dialog" {...props} />;
-}
+const Dialog = DialogPrimitive.Root
 
-function DialogTrigger({
-  ...props
-}: React.ComponentProps<typeof DialogPrimitive.Trigger>) {
-  return <DialogPrimitive.Trigger data-slot="dialog-trigger" {...props} />;
-}
+const DialogTrigger = DialogPrimitive.Trigger
 
-function DialogPortal({
-  ...props
-}: React.ComponentProps<typeof DialogPrimitive.Portal>) {
-  return <DialogPrimitive.Portal data-slot="dialog-portal" {...props} />;
-}
+const DialogPortal = DialogPrimitive.Portal
 
-function DialogClose({
-  ...props
-}: React.ComponentProps<typeof DialogPrimitive.Close>) {
-  return <DialogPrimitive.Close data-slot="dialog-close" {...props} />;
-}
+const DialogClose = DialogPrimitive.Close
 
-function DialogOverlay({
-  className,
-  ...props
-}: React.ComponentProps<typeof DialogPrimitive.Overlay>) {
-  return (
-    <DialogPrimitive.Overlay
-      data-slot="dialog-overlay"
+const DialogOverlay = React.forwardRef<
+  React.ElementRef<typeof DialogPrimitive.Overlay>,
+  React.ComponentPropsWithoutRef<typeof DialogPrimitive.Overlay>
+>(({ className, ...props }, ref) => (
+  <DialogPrimitive.Overlay
+    ref={ref}
+    className={cn(
+      "fixed inset-0 z-50 bg-black/80 data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0",
+      className
+    )}
+    {...props}
+  />
+))
+DialogOverlay.displayName = DialogPrimitive.Overlay.displayName
+
+const DialogContent = React.forwardRef<
+  React.ElementRef<typeof DialogPrimitive.Content>,
+  React.ComponentPropsWithoutRef<typeof DialogPrimitive.Content>
+>(({ className, children, ...props }, ref) => (
+  <DialogPortal>
+    <DialogOverlay />
+    <DialogPrimitive.Content
+      ref={ref}
       className={cn(
-        "data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 fixed inset-0 z-50 bg-black/50",
+        "fixed left-[50%] top-[50%] z-50 grid w-full max-w-lg translate-x-[-50%] translate-y-[-50%] gap-4 border bg-background p-6 shadow-lg duration-200 data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[state=closed]:slide-out-to-left-1/2 data-[state=closed]:slide-out-to-top-[48%] data-[state=open]:slide-in-from-left-1/2 data-[state=open]:slide-in-from-top-[48%] sm:rounded-lg",
         className
       )}
       {...props}
-    />
-  );
-}
+    >
+      {children}
+      <DialogPrimitive.Close className="absolute right-4 top-4 rounded-sm opacity-70 ring-offset-background transition-opacity hover:opacity-100 focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2 disabled:pointer-events-none data-[state=open]:bg-accent data-[state=open]:text-muted-foreground">
+        <X className="h-4 w-4" />
+        <span className="sr-only">Close</span>
+      </DialogPrimitive.Close>
+    </DialogPrimitive.Content>
+  </DialogPortal>
+))
+DialogContent.displayName = DialogPrimitive.Content.displayName
 
-function DialogContent({
-  className,
-  children,
-  ...props
-}: React.ComponentProps<typeof DialogPrimitive.Content>) {
-  return (
-    <DialogPortal data-slot="dialog-portal">
-      <DialogOverlay />
-      <DialogPrimitive.Content
-        data-slot="dialog-content"
-        className={cn(
-          "bg-background data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 fixed top-[50%] left-[50%] z-50 grid w-full max-w-[calc(100%-2rem)] translate-x-[-50%] translate-y-[-50%] gap-4 rounded-lg border p-6 shadow-lg duration-200 sm:max-w-lg",
-          className
-        )}
-        {...props}
-      >
-        {children}
-        <DialogPrimitive.Close className="ring-offset-background focus:ring-ring data-[state=open]:bg-accent data-[state=open]:text-muted-foreground absolute top-4 right-4 rounded-xs opacity-70 transition-opacity hover:opacity-100 focus:ring-2 focus:ring-offset-2 focus:outline-hidden disabled:pointer-events-none [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4">
-          <XIcon />
-          <span className="sr-only">Close</span>
-        </DialogPrimitive.Close>
-      </DialogPrimitive.Content>
-    </DialogPortal>
-  );
-}
-
-function DialogHeader({ className, ...props }: React.ComponentProps<"div">) {
-  return (
-    <div
-      data-slot="dialog-header"
-      className={cn("flex flex-col gap-2 text-center sm:text-left", className)}
-      {...props}
-    />
-  );
-}
-
-function DialogFooter({ className, ...props }: React.ComponentProps<"div">) {
-  return (
-    <div
-      data-slot="dialog-footer"
-      className={cn(
-        "flex flex-col-reverse gap-2 sm:flex-row sm:justify-end",
-        className
-      )}
-      {...props}
-    />
-  );
-}
-
-function DialogTitle({
+const DialogHeader = ({
   className,
   ...props
-}: React.ComponentProps<typeof DialogPrimitive.Title>) {
-  return (
-    <DialogPrimitive.Title
-      data-slot="dialog-title"
-      className={cn("text-lg leading-none font-semibold", className)}
-      {...props}
-    />
-  );
-}
+}: React.HTMLAttributes<HTMLDivElement>) => (
+  <div
+    className={cn(
+      "flex flex-col space-y-1.5 text-center sm:text-left",
+      className
+    )}
+    {...props}
+  />
+)
+DialogHeader.displayName = "DialogHeader"
 
-function DialogDescription({
+const DialogFooter = ({
   className,
   ...props
-}: React.ComponentProps<typeof DialogPrimitive.Description>) {
-  return (
-    <DialogPrimitive.Description
-      data-slot="dialog-description"
-      className={cn("text-muted-foreground text-sm", className)}
-      {...props}
-    />
-  );
-}
+}: React.HTMLAttributes<HTMLDivElement>) => (
+  <div
+    className={cn(
+      "flex flex-col-reverse sm:flex-row sm:justify-end sm:space-x-2",
+      className
+    )}
+    {...props}
+  />
+)
+DialogFooter.displayName = "DialogFooter"
+
+const DialogTitle = React.forwardRef<
+  React.ElementRef<typeof DialogPrimitive.Title>,
+  React.ComponentPropsWithoutRef<typeof DialogPrimitive.Title>
+>(({ className, ...props }, ref) => (
+  <DialogPrimitive.Title
+    ref={ref}
+    className={cn(
+      "text-lg font-semibold leading-none tracking-tight",
+      className
+    )}
+    {...props}
+  />
+))
+DialogTitle.displayName = DialogPrimitive.Title.displayName
+
+const DialogDescription = React.forwardRef<
+  React.ElementRef<typeof DialogPrimitive.Description>,
+  React.ComponentPropsWithoutRef<typeof DialogPrimitive.Description>
+>(({ className, ...props }, ref) => (
+  <DialogPrimitive.Description
+    ref={ref}
+    className={cn("text-sm text-muted-foreground", className)}
+    {...props}
+  />
+))
+DialogDescription.displayName = DialogPrimitive.Description.displayName
 
 export {
   Dialog,
-  DialogClose,
-  DialogContent,
-  DialogDescription,
-  DialogFooter,
-  DialogHeader,
-  DialogOverlay,
   DialogPortal,
-  DialogTitle,
+  DialogOverlay,
+  DialogClose,
   DialogTrigger,
-};
+  DialogContent,
+  DialogHeader,
+  DialogFooter,
+  DialogTitle,
+  DialogDescription,
+}
diff --git a/frontend/src/pages/AgentAudit/components/ReportExportDialog.tsx b/frontend/src/pages/AgentAudit/components/ReportExportDialog.tsx
index f57479d..ef9cb20 100644
--- a/frontend/src/pages/AgentAudit/components/ReportExportDialog.tsx
+++ b/frontend/src/pages/AgentAudit/components/ReportExportDialog.tsx
@@ -1,10 +1,11 @@
 /**
- * Report Export Dialog Component
+ * Report Export Dialog Component - Enhanced Version
  * Full-featured report export with preview and multi-format support
- * Cassette futurism aesthetic
+ * Deep UI/UX optimization with modern design patterns
+ * Cassette futurism aesthetic with glassmorphism accents
  */
 
-import { useState, useEffect, useCallback, memo } from "react";
+import { useState, useEffect, useCallback, memo, useMemo, useRef } from "react";
 import { marked } from "marked";
 import {
   Dialog,
@@ -12,10 +13,11 @@ import {
   DialogHeader,
   DialogTitle,
 } from "@/components/ui/dialog";
-import { Tabs, TabsList, TabsTrigger, TabsContent } from "@/components/ui/tabs";
 import { Button } from "@/components/ui/button";
 import { Badge } from "@/components/ui/badge";
+import { toast } from "sonner";
 import { ScrollArea } from "@/components/ui/scroll-area";
+import { Switch } from "@/components/ui/switch";
 import {
   FileText,
   FileJson,
@@ -31,6 +33,17 @@ import {
   Shield,
   Bug,
   CheckCircle2,
+  Sparkles,
+  Settings2,
+  ChevronDown,
+  ChevronUp,
+  Search,
+  X,
+  Keyboard,
+  FileDown,
+  Zap,
+  TrendingUp,
+  Clock,
 } from "lucide-react";
 import { apiClient } from "@/shared/api/serverClient";
 import { downloadAgentReport } from "@/shared/api/agentTasks";
@@ -54,34 +67,61 @@ interface ReportPreview {
   error: string | null;
 }
 
+interface ExportOptions {
+  includeCodeSnippets: boolean;
+  includeRemediation: boolean;
+  includeMetadata: boolean;
+  compactMode: boolean;
+}
+
 // ============ Constants ============
 
 const FORMAT_CONFIG: Record<ReportFormat, {
   label: string;
+  description: string;
   icon: React.ReactNode;
   extension: string;
   mime: string;
+  color: string;
+  bgColor: string;
 }> = {
   markdown: {
     label: "Markdown",
-    icon: <FileText className="w-4 h-4" />,
+    description: "可编辑文档格式",
+    icon: <FileText className="w-5 h-5" />,
     extension: ".md",
     mime: "text/markdown",
+    color: "text-sky-400",
+    bgColor: "bg-sky-500/10 border-sky-500/30",
   },
   json: {
     label: "JSON",
-    icon: <FileJson className="w-4 h-4" />,
+    description: "结构化数据格式",
+    icon: <FileJson className="w-5 h-5" />,
     extension: ".json",
     mime: "application/json",
+    color: "text-amber-400",
+    bgColor: "bg-amber-500/10 border-amber-500/30",
   },
   html: {
     label: "HTML",
-    icon: <FileCode className="w-4 h-4" />,
+    description: "网页展示格式",
+    icon: <FileCode className="w-5 h-5" />,
     extension: ".html",
     mime: "text/html",
+    color: "text-emerald-400",
+    bgColor: "bg-emerald-500/10 border-emerald-500/30",
   },
 };
 
+// 默认导出选项
+const DEFAULT_EXPORT_OPTIONS: ExportOptions = {
+  includeCodeSnippets: true,
+  includeRemediation: true,
+  includeMetadata: true,
+  compactMode: false,
+};
+
 // ============ Helper Functions ============
 
 function getSeverityColor(severity: string): string {
@@ -103,72 +143,356 @@ function formatBytes(bytes: number): string {
   return `${parseFloat((bytes / Math.pow(k, i)).toFixed(1))} ${sizes[i]}`;
 }
 
+// 获取安全评分颜色
+function getScoreColor(score: number): { text: string; bg: string; glow: string } {
+  if (score >= 80) return { text: "text-emerald-400", bg: "stroke-emerald-500", glow: "drop-shadow-[0_0_8px_rgba(16,185,129,0.5)]" };
+  if (score >= 60) return { text: "text-amber-400", bg: "stroke-amber-500", glow: "drop-shadow-[0_0_8px_rgba(245,158,11,0.5)]" };
+  if (score >= 40) return { text: "text-orange-400", bg: "stroke-orange-500", glow: "drop-shadow-[0_0_8px_rgba(249,115,22,0.5)]" };
+  return { text: "text-rose-400", bg: "stroke-rose-500", glow: "drop-shadow-[0_0_8px_rgba(244,63,94,0.5)]" };
+}
+
 // ============ Sub Components ============
 
-// Report stats summary - uses task statistics for reliability
-const ReportStats = memo(function ReportStats({
+// 环形进度条组件
+const CircularProgress = memo(function CircularProgress({
+  value,
+  size = 80,
+  strokeWidth = 6,
+  className = "",
+}: {
+  value: number;
+  size?: number;
+  strokeWidth?: number;
+  className?: string;
+}) {
+  const radius = (size - strokeWidth) / 2;
+  const circumference = radius * 2 * Math.PI;
+  const offset = circumference - (value / 100) * circumference;
+  const colors = getScoreColor(value);
+
+  return (
+    <div className={`relative inline-flex items-center justify-center ${className}`}>
+      <svg width={size} height={size} className="-rotate-90">
+        {/* Background circle */}
+        <circle
+          cx={size / 2}
+          cy={size / 2}
+          r={radius}
+          fill="none"
+          stroke="currentColor"
+          strokeWidth={strokeWidth}
+          className="text-slate-800/50"
+        />
+        {/* Progress circle */}
+        <circle
+          cx={size / 2}
+          cy={size / 2}
+          r={radius}
+          fill="none"
+          strokeWidth={strokeWidth}
+          strokeDasharray={circumference}
+          strokeDashoffset={offset}
+          strokeLinecap="round"
+          className={`${colors.bg} ${colors.glow} transition-all duration-1000 ease-out`}
+        />
+      </svg>
+      <div className="absolute inset-0 flex flex-col items-center justify-center">
+        <span className={`text-xl font-bold font-mono ${colors.text}`}>
+          {value.toFixed(0)}
+        </span>
+        <span className="text-[8px] text-slate-500 uppercase tracking-wider">分</span>
+      </div>
+    </div>
+  );
+});
+
+// 增强统计卡片组件
+const EnhancedStatsPanel = memo(function EnhancedStatsPanel({
   task,
 }: {
   task: AgentTask;
-  findings: AgentFinding[]; // Keep for API compatibility, but use task stats
+  findings: AgentFinding[];
 }) {
-  // Use task's reliable statistics instead of computing from findings array
-  // This ensures consistency even when findings array is empty or not loaded
   const totalFindings = task.findings_count || 0;
   const criticalAndHigh = (task.critical_count || 0) + (task.high_count || 0);
   const verified = task.verified_count || 0;
+  const score = task.security_score || 0;
+
+  const stats = [
+    {
+      icon: <Bug className="w-4 h-4" />,
+      label: "漏洞总数",
+      value: totalFindings,
+      color: "text-white",
+      iconColor: "text-rose-400",
+      trend: totalFindings > 0 ? "up" : null,
+    },
+    {
+      icon: <AlertTriangle className="w-4 h-4" />,
+      label: "高危问题",
+      value: criticalAndHigh,
+      color: criticalAndHigh > 0 ? "text-rose-400" : "text-slate-400",
+      iconColor: "text-orange-400",
+      trend: criticalAndHigh > 0 ? "critical" : null,
+    },
+    {
+      icon: <CheckCircle2 className="w-4 h-4" />,
+      label: "已验证",
+      value: verified,
+      color: "text-emerald-400",
+      iconColor: "text-emerald-400",
+      trend: null,
+    },
+  ];
 
   return (
-    <div className="grid grid-cols-4 gap-2 mb-4">
-      <div className="p-2.5 rounded bg-slate-900/60 border border-slate-700/40">
-        <div className="flex items-center gap-1.5 mb-1">
-          <Shield className="w-3 h-3 text-emerald-400" />
-          <span className="text-[9px] text-slate-500 uppercase tracking-wider">Score</span>
-        </div>
-        <div className="text-lg font-bold font-mono text-emerald-400">
-          {task.security_score?.toFixed(0) || "N/A"}
-        </div>
+    <div className="flex items-stretch gap-4">
+      {/* 环形安全评分 */}
+      <div className="flex items-center justify-center p-3 rounded-xl bg-gradient-to-br from-slate-800/60 to-slate-900/60 border border-slate-700/40 backdrop-blur-sm">
+        <CircularProgress value={score} size={72} strokeWidth={5} />
       </div>
 
-      <div className="p-2.5 rounded bg-slate-900/60 border border-slate-700/40">
-        <div className="flex items-center gap-1.5 mb-1">
-          <Bug className="w-3 h-3 text-rose-400" />
-          <span className="text-[9px] text-slate-500 uppercase tracking-wider">Findings</span>
-        </div>
-        <div className="text-lg font-bold font-mono text-white">
-          {totalFindings}
-        </div>
-      </div>
+      {/* 统计数字网格 */}
+      <div className="flex-1 grid grid-cols-3 gap-2">
+        {stats.map((stat, index) => (
+          <div
+            key={index}
+            className="relative p-3 rounded-xl bg-gradient-to-br from-slate-800/40 to-slate-900/40 border border-slate-700/30 backdrop-blur-sm group hover:border-slate-600/50 transition-all duration-300"
+          >
+            <div className="flex items-center gap-2 mb-1.5">
+              <div className={`${stat.iconColor} opacity-80`}>
+                {stat.icon}
+              </div>
+              <span className="text-[10px] text-slate-500 uppercase tracking-wider font-medium">
+                {stat.label}
+              </span>
+            </div>
+            <div className="flex items-baseline gap-1">
+              <span className={`text-2xl font-bold font-mono ${stat.color}`}>
+                {stat.value}
+              </span>
+              {stat.trend === "critical" && stat.value > 0 && (
+                <Zap className="w-3 h-3 text-rose-400 animate-pulse" />
+              )}
+            </div>
 
-      <div className="p-2.5 rounded bg-slate-900/60 border border-slate-700/40">
-        <div className="flex items-center gap-1.5 mb-1">
-          <AlertTriangle className="w-3 h-3 text-orange-400" />
-          <span className="text-[9px] text-slate-500 uppercase tracking-wider">Critical</span>
-        </div>
-        <div className="text-lg font-bold font-mono text-rose-400">
-          {criticalAndHigh}
-        </div>
+            {/* 悬浮光效 */}
+            <div className="absolute inset-0 rounded-xl bg-gradient-to-r from-primary/0 via-primary/5 to-primary/0 opacity-0 group-hover:opacity-100 transition-opacity duration-500" />
+          </div>
+        ))}
       </div>
+    </div>
+  );
+});
 
-      <div className="p-2.5 rounded bg-slate-900/60 border border-slate-700/40">
-        <div className="flex items-center gap-1.5 mb-1">
-          <CheckCircle2 className="w-3 h-3 text-teal-400" />
-          <span className="text-[9px] text-slate-500 uppercase tracking-wider">Verified</span>
+// 格式选择卡片组件
+const FormatSelector = memo(function FormatSelector({
+  activeFormat,
+  onFormatChange,
+}: {
+  activeFormat: ReportFormat;
+  onFormatChange: (format: ReportFormat) => void;
+}) {
+  return (
+    <div className="grid grid-cols-3 gap-3">
+      {(Object.keys(FORMAT_CONFIG) as ReportFormat[]).map((format) => {
+        const config = FORMAT_CONFIG[format];
+        const isActive = format === activeFormat;
+
+        return (
+          <button
+            key={format}
+            onClick={() => onFormatChange(format)}
+            className={`
+              relative p-4 rounded-xl border transition-all duration-300 text-left group
+              ${isActive
+                ? `${config.bgColor} border-opacity-100 shadow-lg`
+                : "bg-slate-800/30 border-slate-700/30 hover:border-slate-600/50 hover:bg-slate-800/50"
+              }
+            `}
+          >
+            {/* 选中指示器 */}
+            {isActive && (
+              <div className="absolute -top-1 -right-1 w-5 h-5 rounded-full bg-primary flex items-center justify-center shadow-lg shadow-primary/30">
+                <Check className="w-3 h-3 text-white" />
+              </div>
+            )}
+
+            <div className={`mb-2 ${isActive ? config.color : "text-slate-400 group-hover:text-slate-300"}`}>
+              {config.icon}
+            </div>
+
+            <div className={`text-sm font-semibold mb-0.5 ${isActive ? "text-white" : "text-slate-300"}`}>
+              {config.label}
+            </div>
+            <div className="text-[10px] text-slate-500">
+              {config.description}
+            </div>
+
+            {/* 底部装饰线 */}
+            <div
+              className={`
+                absolute bottom-0 left-1/2 -translate-x-1/2 h-0.5 rounded-full transition-all duration-300
+                ${isActive ? "w-12 bg-gradient-to-r from-transparent via-primary to-transparent" : "w-0"}
+              `}
+            />
+          </button>
+        );
+      })}
+    </div>
+  );
+});
+
+// 导出选项面板
+const ExportOptionsPanel = memo(function ExportOptionsPanel({
+  options,
+  onOptionsChange,
+  expanded,
+  onToggle,
+}: {
+  options: ExportOptions;
+  onOptionsChange: (options: ExportOptions) => void;
+  expanded: boolean;
+  onToggle: () => void;
+}) {
+  const optionItems = [
+    { key: "includeCodeSnippets", label: "包含代码片段", description: "导出相关的代码示例" },
+    { key: "includeRemediation", label: "包含修复建议", description: "导出漏洞修复方案" },
+    { key: "includeMetadata", label: "包含元数据", description: "导出任务和文件信息" },
+    { key: "compactMode", label: "紧凑模式", description: "减少空白和间距" },
+  ];
+
+  return (
+    <div className="rounded-xl border border-slate-700/40 bg-slate-800/20 overflow-hidden">
+      <button
+        onClick={onToggle}
+        className="w-full flex items-center justify-between p-3 hover:bg-slate-700/20 transition-colors"
+      >
+        <div className="flex items-center gap-2">
+          <Settings2 className="w-4 h-4 text-slate-400" />
+          <span className="text-sm font-medium text-slate-300">导出选项</span>
         </div>
-        <div className="text-lg font-bold font-mono text-teal-400">
-          {verified}
+        {expanded ? (
+          <ChevronUp className="w-4 h-4 text-slate-500" />
+        ) : (
+          <ChevronDown className="w-4 h-4 text-slate-500" />
+        )}
+      </button>
+
+      <div
+        className={`
+          grid transition-all duration-300 ease-out
+          ${expanded ? "grid-rows-[1fr] opacity-100" : "grid-rows-[0fr] opacity-0"}
+        `}
+      >
+        <div className="overflow-hidden">
+          <div className="p-3 pt-0 space-y-2">
+            {optionItems.map((item) => (
+              <label
+                key={item.key}
+                className="flex items-center justify-between p-2 rounded-lg hover:bg-slate-700/20 cursor-pointer transition-colors"
+              >
+                <div className="flex-1">
+                  <div className="text-xs font-medium text-slate-300">{item.label}</div>
+                  <div className="text-[10px] text-slate-500">{item.description}</div>
+                </div>
+                <Switch
+                  checked={options[item.key as keyof ExportOptions]}
+                  onCheckedChange={(checked) =>
+                    onOptionsChange({ ...options, [item.key]: checked })
+                  }
+                  className="data-[state=checked]:bg-primary"
+                />
+              </label>
+            ))}
+          </div>
         </div>
       </div>
     </div>
   );
 });
 
-// Markdown preview renderer
+// 搜索栏组件
+const PreviewSearchBar = memo(function PreviewSearchBar({
+  searchQuery,
+  onSearchChange,
+  matchCount,
+  onClear,
+}: {
+  searchQuery: string;
+  onSearchChange: (query: string) => void;
+  matchCount: number;
+  onClear: () => void;
+}) {
+  return (
+    <div className="flex items-center gap-2 px-3 py-2 bg-slate-800/30 border-b border-slate-700/30">
+      <Search className="w-3.5 h-3.5 text-slate-500" />
+      <input
+        type="text"
+        value={searchQuery}
+        onChange={(e) => onSearchChange(e.target.value)}
+        placeholder="搜索预览内容..."
+        className="flex-1 bg-transparent text-xs text-slate-300 placeholder:text-slate-600 outline-none"
+      />
+      {searchQuery && (
+        <>
+          <span className="text-[10px] text-slate-500 font-mono">
+            {matchCount} 匹配
+          </span>
+          <button
+            onClick={onClear}
+            className="p-1 rounded hover:bg-slate-700/50 text-slate-500 hover:text-slate-300 transition-colors"
+          >
+            <X className="w-3 h-3" />
+          </button>
+        </>
+      )}
+    </div>
+  );
+});
+
+// 骨架屏加载组件
+const PreviewSkeleton = memo(function PreviewSkeleton() {
+  return (
+    <div className="space-y-4 animate-pulse">
+      <div className="h-6 bg-slate-700/30 rounded w-3/4" />
+      <div className="space-y-2">
+        <div className="h-4 bg-slate-700/20 rounded w-full" />
+        <div className="h-4 bg-slate-700/20 rounded w-5/6" />
+        <div className="h-4 bg-slate-700/20 rounded w-4/6" />
+      </div>
+      <div className="h-20 bg-slate-700/20 rounded" />
+      <div className="space-y-2">
+        <div className="h-4 bg-slate-700/20 rounded w-full" />
+        <div className="h-4 bg-slate-700/20 rounded w-3/4" />
+      </div>
+      <div className="h-16 bg-slate-700/20 rounded" />
+    </div>
+  );
+});
+
+// Markdown preview renderer - Enhanced with search highlighting
 const MarkdownPreview = memo(function MarkdownPreview({
   content,
+  searchQuery = "",
 }: {
   content: string;
+  searchQuery?: string;
 }) {
+  // 高亮搜索匹配文本
+  const highlightText = useCallback((text: string, query: string) => {
+    if (!query) return text;
+    const regex = new RegExp(`(${query.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')})`, 'gi');
+    const parts = text.split(regex);
+    return parts.map((part, i) =>
+      regex.test(part) ? (
+        <mark key={i} className="bg-primary/40 text-white px-0.5 rounded">{part}</mark>
+      ) : (
+        part
+      )
+    );
+  }, []);
+
   // Simple markdown to styled elements renderer
   const renderMarkdown = (text: string) => {
     const lines = text.split("\n");
@@ -182,15 +506,35 @@ const MarkdownPreview = memo(function MarkdownPreview({
       if (line.startsWith("```")) {
         if (inCodeBlock) {
           elements.push(
-            <div key={`code-${index}`} className="my-3 rounded bg-black/50 border border-slate-700/50 overflow-hidden">
-              <div className="flex items-center justify-between px-3 py-1.5 bg-slate-800/50 border-b border-slate-700/50">
-                <span className="text-[10px] text-slate-500 uppercase tracking-wider font-mono">
-                  {codeLanguage || "code"}
-                </span>
+            <div key={`code-${index}`} className="my-4 rounded-xl bg-[#0d1117] border border-slate-700/50 overflow-hidden shadow-lg">
+              <div className="flex items-center justify-between px-4 py-2 bg-gradient-to-r from-slate-800/80 to-slate-800/40 border-b border-slate-700/50">
+                <div className="flex items-center gap-2">
+                  <div className="flex gap-1.5">
+                    <div className="w-2.5 h-2.5 rounded-full bg-rose-500/80" />
+                    <div className="w-2.5 h-2.5 rounded-full bg-amber-500/80" />
+                    <div className="w-2.5 h-2.5 rounded-full bg-emerald-500/80" />
+                  </div>
+                  <span className="text-[10px] text-slate-400 uppercase tracking-wider font-mono ml-2">
+                    {codeLanguage || "code"}
+                  </span>
+                </div>
+                <Terminal className="w-3.5 h-3.5 text-slate-500" />
+              </div>
+              <div className="relative">
+                {/* 行号 */}
+                <div className="absolute left-0 top-0 bottom-0 w-10 bg-slate-900/50 border-r border-slate-700/30 select-none">
+                  <div className="p-3 text-[10px] font-mono text-slate-600 leading-5">
+                    {codeContent.map((_, i) => (
+                      <div key={i}>{i + 1}</div>
+                    ))}
+                  </div>
+                </div>
+                <pre className="p-3 pl-14 text-xs font-mono text-slate-300 overflow-x-auto leading-5">
+                  {codeContent.map((codeLine, i) => (
+                    <div key={i}>{highlightText(codeLine, searchQuery) || " "}</div>
+                  ))}
+                </pre>
               </div>
-              <pre className="p-3 text-xs font-mono text-slate-300 overflow-x-auto">
-                {codeContent.join("\n")}
-              </pre>
             </div>
           );
           codeContent = [];
@@ -208,63 +552,68 @@ const MarkdownPreview = memo(function MarkdownPreview({
         return;
       }
 
-      // Headers
+      // Headers with decorative elements
       if (line.startsWith("# ")) {
         elements.push(
-          <h1 key={index} className="text-xl font-bold text-white mt-6 mb-3 pb-2 border-b border-slate-700/50">
-            {line.slice(2)}
+          <h1 key={index} className="text-xl font-bold text-white mt-8 mb-4 pb-3 border-b border-slate-700/50 flex items-center gap-3">
+            <span className="w-1 h-6 bg-primary rounded-full" />
+            {highlightText(line.slice(2), searchQuery)}
           </h1>
         );
         return;
       }
       if (line.startsWith("## ")) {
         elements.push(
-          <h2 key={index} className="text-lg font-bold text-white mt-5 mb-2">
-            {line.slice(3)}
+          <h2 key={index} className="text-lg font-bold text-white mt-6 mb-3 flex items-center gap-2">
+            <Sparkles className="w-4 h-4 text-primary/60" />
+            {highlightText(line.slice(3), searchQuery)}
           </h2>
         );
         return;
       }
       if (line.startsWith("### ")) {
         elements.push(
-          <h3 key={index} className="text-base font-semibold text-slate-200 mt-4 mb-2">
-            {line.slice(4)}
+          <h3 key={index} className="text-base font-semibold text-slate-200 mt-5 mb-2 pl-2 border-l-2 border-slate-600">
+            {highlightText(line.slice(4), searchQuery)}
           </h3>
         );
         return;
       }
 
-      // Horizontal rule
+      // Horizontal rule with style
       if (line.match(/^---+$/)) {
         elements.push(
-          <hr key={index} className="my-4 border-slate-700/50" />
+          <div key={index} className="my-6 flex items-center gap-3">
+            <div className="flex-1 h-px bg-gradient-to-r from-transparent via-slate-700 to-transparent" />
+            <div className="w-1.5 h-1.5 rounded-full bg-slate-700" />
+            <div className="flex-1 h-px bg-gradient-to-r from-transparent via-slate-700 to-transparent" />
+          </div>
         );
         return;
       }
 
-      // List items
+      // List items with better styling
       if (line.match(/^[-*]\s/)) {
         elements.push(
-          <div key={index} className="flex gap-2 text-sm text-slate-300 ml-2 my-0.5">
-            <span className="text-primary">•</span>
-            <span>{line.slice(2)}</span>
+          <div key={index} className="flex gap-3 text-sm text-slate-300 ml-3 my-1 group">
+            <span className="text-primary mt-1.5 text-xs group-hover:scale-125 transition-transform">●</span>
+            <span className="flex-1">{highlightText(line.slice(2), searchQuery)}</span>
           </div>
         );
         return;
       }
 
       // Bold text handling
-      let processedLine = line;
       if (line.includes("**")) {
         const parts = line.split(/\*\*(.+?)\*\*/g);
         const lineElements = parts.map((part, i) => {
           if (i % 2 === 1) {
-            return <strong key={i} className="text-white font-semibold">{part}</strong>;
+            return <strong key={i} className="text-white font-semibold">{highlightText(part, searchQuery)}</strong>;
           }
-          return part;
+          return highlightText(part, searchQuery);
         });
         elements.push(
-          <p key={index} className="text-sm text-slate-300 my-1">
+          <p key={index} className="text-sm text-slate-300 my-1.5 leading-relaxed">
             {lineElements}
           </p>
         );
@@ -273,14 +622,14 @@ const MarkdownPreview = memo(function MarkdownPreview({
 
       // Empty lines
       if (line.trim() === "") {
-        elements.push(<div key={index} className="h-2" />);
+        elements.push(<div key={index} className="h-3" />);
         return;
       }
 
       // Regular paragraphs
       elements.push(
-        <p key={index} className="text-sm text-slate-300 my-1">
-          {processedLine}
+        <p key={index} className="text-sm text-slate-300 my-1.5 leading-relaxed">
+          {highlightText(line, searchQuery)}
         </p>
       );
     });
@@ -295,33 +644,102 @@ const MarkdownPreview = memo(function MarkdownPreview({
   );
 });
 
-// JSON preview with syntax highlighting
+// JSON preview with enhanced syntax highlighting
 const JsonPreview = memo(function JsonPreview({
   content,
+  searchQuery = "",
 }: {
   content: string;
+  searchQuery?: string;
 }) {
   const highlightJson = (json: string) => {
     try {
       const parsed = JSON.parse(json);
       const formatted = JSON.stringify(parsed, null, 2);
 
-      return formatted
+      // 处理搜索高亮
+      let result = formatted
         .replace(/"([^"]+)":/g, '<span class="text-violet-400">"$1"</span>:')
         .replace(/: "([^"]+)"/g, ': <span class="text-emerald-400">"$1"</span>')
-        .replace(/: (\d+)/g, ': <span class="text-amber-400">$1</span>')
+        .replace(/: (\d+\.?\d*)/g, ': <span class="text-amber-400">$1</span>')
         .replace(/: (true|false)/g, ': <span class="text-sky-400">$1</span>')
         .replace(/: (null)/g, ': <span class="text-slate-500">$1</span>');
+
+      if (searchQuery) {
+        const regex = new RegExp(`(${searchQuery.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')})`, 'gi');
+        result = result.replace(regex, '<mark class="bg-primary/40 text-white px-0.5 rounded">$1</mark>');
+      }
+
+      return result;
     } catch {
       return json;
     }
   };
 
+  const lines = content.split('\n');
+
   return (
-    <pre
-      className="text-xs font-mono text-slate-300 whitespace-pre-wrap"
-      dangerouslySetInnerHTML={{ __html: highlightJson(content) }}
-    />
+    <div className="relative">
+      {/* 行号区域 */}
+      <div className="absolute left-0 top-0 bottom-0 w-10 bg-slate-900/30 border-r border-slate-700/30 select-none">
+        <div className="py-3 text-[10px] font-mono text-slate-600 text-right pr-2 leading-5">
+          {lines.map((_, i) => (
+            <div key={i}>{i + 1}</div>
+          ))}
+        </div>
+      </div>
+      <pre
+        className="text-xs font-mono text-slate-300 whitespace-pre-wrap pl-14 py-3 leading-5"
+        dangerouslySetInnerHTML={{ __html: highlightJson(content) }}
+      />
+    </div>
+  );
+});
+
+// HTML预览组件（增强版）
+const HtmlPreview = memo(function HtmlPreview({
+  content,
+  searchQuery = "",
+}: {
+  content: string;
+  searchQuery?: string;
+}) {
+  const truncatedContent = content.slice(0, 5000);
+  const isTruncated = content.length > 5000;
+
+  // 简单的语法高亮
+  const highlightHtml = (html: string) => {
+    let result = html
+      .replace(/&/g, '&amp;')
+      .replace(/</g, '&lt;')
+      .replace(/>/g, '&gt;')
+      .replace(/(&lt;\/?[a-zA-Z][a-zA-Z0-9]*)/g, '<span class="text-rose-400">$1</span>')
+      .replace(/(\s[a-zA-Z-]+)=/g, '<span class="text-amber-400">$1</span>=')
+      .replace(/"([^"]*)"/g, '"<span class="text-emerald-400">$1</span>"')
+      .replace(/(&lt;!DOCTYPE[^&]*&gt;)/gi, '<span class="text-slate-500">$1</span>');
+
+    if (searchQuery) {
+      const regex = new RegExp(`(${searchQuery.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')})`, 'gi');
+      result = result.replace(regex, '<mark class="bg-primary/40 text-white px-0.5 rounded">$1</mark>');
+    }
+
+    return result;
+  };
+
+  return (
+    <div className="relative">
+      <pre
+        className="text-xs font-mono text-slate-400 whitespace-pre-wrap leading-5"
+        dangerouslySetInnerHTML={{ __html: highlightHtml(truncatedContent) }}
+      />
+      {isTruncated && (
+        <div className="mt-4 pt-4 border-t border-slate-700/30 text-center">
+          <span className="text-xs text-slate-500 bg-slate-800/50 px-3 py-1.5 rounded-full">
+            已截断显示，完整内容请下载查看
+          </span>
+        </div>
+      )}
+    </div>
   );
 });
 
@@ -333,6 +751,7 @@ export const ReportExportDialog = memo(function ReportExportDialog({
   task,
   findings,
 }: ReportExportDialogProps) {
+  // 基础状态
   const [activeFormat, setActiveFormat] = useState<ReportFormat>("markdown");
   const [preview, setPreview] = useState<ReportPreview>({
     content: "",
@@ -342,56 +761,68 @@ export const ReportExportDialog = memo(function ReportExportDialog({
   });
   const [copied, setCopied] = useState(false);
   const [downloading, setDownloading] = useState(false);
+  const [downloadSuccess, setDownloadSuccess] = useState(false);
+
+  // 增强功能状态
+  const [searchQuery, setSearchQuery] = useState("");
+  const [exportOptions, setExportOptions] = useState<ExportOptions>(DEFAULT_EXPORT_OPTIONS);
+  const [optionsExpanded, setOptionsExpanded] = useState(false);
+
+  // 预览缓存
+  const previewCache = useRef<Map<ReportFormat, string>>(new Map());
+
+  // 计算搜索匹配数
+  const searchMatchCount = useMemo(() => {
+    if (!searchQuery || !preview.content) return 0;
+    const regex = new RegExp(searchQuery.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'gi');
+    return (preview.content.match(regex) || []).length;
+  }, [searchQuery, preview.content]);
 
   // Fetch report content for preview
-  const fetchPreview = useCallback(async (format: ReportFormat) => {
+  const fetchPreview = useCallback(async (format: ReportFormat, forceRefresh = false) => {
     if (!task) return;
 
+    // 检查缓存
+    if (!forceRefresh && previewCache.current.has(format)) {
+      setPreview({
+        content: previewCache.current.get(format)!,
+        format,
+        loading: false,
+        error: null,
+      });
+      return;
+    }
+
     setPreview(prev => ({ ...prev, loading: true, error: null }));
 
     try {
-      // For JSON, fetch from backend API to ensure data consistency
-      // The backend properly queries findings from the database
+      let content = "";
+
       if (format === "json") {
         const response = await apiClient.get(`/agent-tasks/${task.id}/report`, {
           params: { format: "json" },
         });
-
-        setPreview({
-          content: JSON.stringify(response.data, null, 2),
-          format: "json",
-          loading: false,
-          error: null,
-        });
-        return;
-      }
-
-      // For HTML, generate from markdown
-      if (format === "html") {
+        content = JSON.stringify(response.data, null, 2);
+      } else if (format === "html") {
         const mdResponse = await apiClient.get(`/agent-tasks/${task.id}/report`, {
           params: { format: "markdown" },
           responseType: "text",
         });
-
-        const htmlContent = await generateHtmlReport(mdResponse.data, task);
-        setPreview({
-          content: htmlContent,
-          format: "html",
-          loading: false,
-          error: null,
+        content = await generateHtmlReport(mdResponse.data, task);
+      } else {
+        const response = await apiClient.get(`/agent-tasks/${task.id}/report`, {
+          params: { format: "markdown" },
+          responseType: "text",
         });
-        return;
+        content = response.data;
       }
 
-      // For Markdown, fetch from server
-      const response = await apiClient.get(`/agent-tasks/${task.id}/report`, {
-        params: { format: "markdown" },
-        responseType: "text",
-      });
+      // 缓存结果
+      previewCache.current.set(format, content);
 
       setPreview({
-        content: response.data,
-        format: "markdown",
+        content,
+        format,
         loading: false,
         error: null,
       });
@@ -400,163 +831,667 @@ export const ReportExportDialog = memo(function ReportExportDialog({
       setPreview(prev => ({
         ...prev,
         loading: false,
-        error: "Failed to load report preview",
+        error: "加载预览失败，请重试",
       }));
     }
-  }, [task, findings]);
+  }, [task]);
 
   // Generate HTML report from markdown
   const generateHtmlReport = async (markdown: string, task: AgentTask): Promise<string> => {
-    // Parse markdown to HTML using marked
     const contentHtml = await marked.parse(markdown);
+    const score = task.security_score || 0;
+    const scoreDisplay = score.toFixed(0);
+    const totalFindings = task.findings_count || 0;
+    const criticalCount = task.critical_count || 0;
+    const highCount = task.high_count || 0;
+    const mediumCount = task.medium_count || 0;
+    const lowCount = task.low_count || 0;
+    const verifiedCount = task.verified_count || 0;
+    const taskName = task.name || `Task ${task.id.slice(0, 8)}`;
+    const generateDate = new Date().toLocaleString('zh-CN', {
+      year: 'numeric',
+      month: '2-digit',
+      day: '2-digit',
+      hour: '2-digit',
+      minute: '2-digit'
+    });
+
+    // 计算评分等级和颜色
+    const getScoreGrade = (s: number) => {
+      if (s >= 90) return { grade: 'A', color: '#10b981', bg: 'rgba(16, 185, 129, 0.1)' };
+      if (s >= 80) return { grade: 'B', color: '#22c55e', bg: 'rgba(34, 197, 94, 0.1)' };
+      if (s >= 70) return { grade: 'C', color: '#eab308', bg: 'rgba(234, 179, 8, 0.1)' };
+      if (s >= 60) return { grade: 'D', color: '#f97316', bg: 'rgba(249, 115, 22, 0.1)' };
+      return { grade: 'F', color: '#ef4444', bg: 'rgba(239, 68, 68, 0.1)' };
+    };
+    const scoreInfo = getScoreGrade(score);
+
+    // SVG 圆环进度条
+    const circumference = 2 * Math.PI * 40; // r=40 (smaller)
+    const strokeDashoffset = circumference - (score / 100) * circumference;
 
     return `<!DOCTYPE html>
 <html lang="zh-CN">
 <head>
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>安全审计报告 - ${task.name || task.id}</title>
+  <title>安全审计报告 - ${taskName}</title>
   <style>
     :root {
+      --bg-body: #06060a;
       --bg-primary: #0a0a0f;
-      --bg-secondary: #0d0d12;
-      --bg-tertiary: #1a1a24;
-      --text-primary: #ffffff;
+      --bg-secondary: #0f0f15;
+      --bg-tertiary: #16161f;
+      --bg-card: #12121a;
+      --text-primary: #f8fafc;
       --text-secondary: #94a3b8;
-      --accent: #FF6B2C;
-      --border: #2d2d3d;
-      --success: #34d399;
-      --warning: #fbbf24;
-      --error: #fb7185;
-      --code-bg: #1e1e2e;
+      --text-muted: #64748b;
+      --accent: #ff6b2c;
+      --accent-glow: rgba(255, 107, 44, 0.2);
+      --border: #1e293b;
+      --border-light: #334155;
+      --success: #10b981;
+      --critical: #dc2626;
+      --critical-bg: rgba(220, 38, 38, 0.12);
+      --high: #f97316;
+      --high-bg: rgba(249, 115, 22, 0.1);
+      --medium: #eab308;
+      --medium-bg: rgba(234, 179, 8, 0.08);
+      --low: #3b82f6;
+      --low-bg: rgba(59, 130, 246, 0.08);
+      --info: #6366f1;
+      --info-bg: rgba(99, 102, 241, 0.08);
+      --code-bg: #0d1117;
     }
-    * { box-sizing: border-box; margin: 0; padding: 0; }
+
+    *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+    html { scroll-behavior: smooth; }
+
     body {
-      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
-      background: var(--bg-primary);
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+      background: var(--bg-body);
       color: var(--text-secondary);
       line-height: 1.6;
-      padding: 2rem;
-      max-width: 900px;
-      margin: 0 auto;
+      font-size: 14px;
     }
-    
-    /* Typography */
-    h1, h2, h3, h4, h5, h6 {
+
+    .container { max-width: 900px; margin: 0 auto; padding: 0 1.5rem; }
+
+    /* Header */
+    .header {
+      background: linear-gradient(135deg, var(--bg-primary), var(--bg-secondary));
+      border-bottom: 1px solid var(--border);
+      padding: 1.25rem 0;
+      position: relative;
+    }
+
+    .header::before {
+      content: "";
+      position: absolute;
+      top: -50%;
+      right: -10%;
+      width: 300px;
+      height: 300px;
+      background: radial-gradient(circle, var(--accent-glow) 0%, transparent 70%);
+      pointer-events: none;
+    }
+
+    .header-content {
+      position: relative;
+      display: flex;
+      justify-content: space-between;
+      align-items: center;
+    }
+
+    .brand {
+      display: flex;
+      align-items: center;
+      gap: 0.5rem;
+    }
+
+    .brand-logo {
+      width: 28px;
+      height: 28px;
+      background: linear-gradient(135deg, var(--accent), #ff8f5a);
+      border-radius: 6px;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      font-weight: 800;
+      font-size: 0.9rem;
+      color: white;
+    }
+
+    .brand-text { font-size: 1rem; font-weight: 700; color: var(--text-primary); }
+
+    .header-title {
+      font-size: 1.25rem;
+      font-weight: 700;
       color: var(--text-primary);
-      margin-top: 2rem;
-      margin-bottom: 1rem;
-      font-weight: 600;
+      text-align: center;
+      flex: 1;
+      margin: 0 1rem;
     }
-    h1 { font-size: 2rem; border-bottom: 2px solid var(--accent); padding-bottom: 0.5rem; }
-    h2 { font-size: 1.5rem; border-bottom: 1px solid var(--border); padding-bottom: 0.5rem; }
-    h3 { font-size: 1.25rem; color: var(--text-primary); margin-top: 1.5rem; }
-    
-    p { margin-bottom: 1rem; }
-    
+
+    .header-meta {
+      text-align: right;
+      font-size: 0.7rem;
+      color: var(--text-muted);
+    }
+
+    /* Stats Section */
+    .stats-section {
+      padding: 1rem 0;
+      background: var(--bg-primary);
+      border-bottom: 1px solid var(--border);
+    }
+
+    .stats-grid {
+      display: flex;
+      align-items: center;
+      gap: 1.25rem;
+    }
+
+    .score-ring-container {
+      display: flex;
+      align-items: center;
+      gap: 0.75rem;
+      padding: 0.75rem 1rem;
+      background: var(--bg-card);
+      border-radius: 12px;
+      border: 1px solid var(--border);
+    }
+
+    .score-ring {
+      position: relative;
+      width: 56px;
+      height: 56px;
+    }
+
+    .score-ring svg {
+      transform: rotate(-90deg);
+      width: 56px;
+      height: 56px;
+    }
+
+    .score-ring-bg { fill: none; stroke: var(--border); stroke-width: 5; }
+    .score-ring-progress {
+      fill: none;
+      stroke: ${scoreInfo.color};
+      stroke-width: 5;
+      stroke-linecap: round;
+      stroke-dasharray: ${circumference};
+      stroke-dashoffset: ${strokeDashoffset};
+      filter: drop-shadow(0 0 4px ${scoreInfo.color}40);
+    }
+
+    .score-ring-content {
+      position: absolute;
+      inset: 0;
+      display: flex;
+      flex-direction: column;
+      align-items: center;
+      justify-content: center;
+    }
+
+    .score-value {
+      font-size: 1.1rem;
+      font-weight: 800;
+      color: ${scoreInfo.color};
+      line-height: 1;
+      font-family: 'SF Mono', monospace;
+    }
+
+    .score-grade {
+      font-size: 0.55rem;
+      font-weight: 600;
+      color: ${scoreInfo.color};
+      background: ${scoreInfo.bg};
+      padding: 0.1rem 0.3rem;
+      border-radius: 3px;
+      margin-top: 0.15rem;
+    }
+
+    .score-label {
+      font-size: 0.65rem;
+      color: var(--text-muted);
+      text-transform: uppercase;
+      letter-spacing: 0.05em;
+    }
+
+    .stats-cards {
+      display: flex;
+      gap: 0.5rem;
+      flex: 1;
+    }
+
+    .stat-card {
+      flex: 1;
+      background: var(--bg-card);
+      border: 1px solid var(--border);
+      border-radius: 8px;
+      padding: 0.6rem 0.75rem;
+    }
+
+    .stat-card-header {
+      display: flex;
+      align-items: center;
+      gap: 0.4rem;
+      margin-bottom: 0.25rem;
+    }
+
+    .stat-card-icon {
+      width: 18px;
+      height: 18px;
+      border-radius: 4px;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      font-size: 0.65rem;
+      font-weight: 700;
+    }
+
+    .stat-card-icon.critical { background: var(--critical-bg); color: var(--critical); }
+    .stat-card-icon.high { background: var(--high-bg); color: var(--high); }
+    .stat-card-icon.total { background: var(--info-bg); color: var(--info); }
+    .stat-card-icon.verified { background: rgba(16,185,129,0.1); color: var(--success); }
+
+    .stat-card-label { font-size: 0.6rem; color: var(--text-muted); text-transform: uppercase; letter-spacing: 0.05em; }
+    .stat-card-value { font-size: 1.25rem; font-weight: 700; color: var(--text-primary); font-family: 'SF Mono', monospace; line-height: 1; }
+    .stat-card-value.critical { color: var(--critical); }
+    .stat-card-value.high { color: var(--high); }
+
+    /* Severity Bar */
+    .severity-section {
+      padding: 0.75rem 0;
+      background: var(--bg-primary);
+    }
+
+    .severity-bar-wrap {
+      display: flex;
+      align-items: center;
+      gap: 1rem;
+    }
+
+    .severity-bar-title {
+      font-size: 0.65rem;
+      color: var(--text-muted);
+      text-transform: uppercase;
+      white-space: nowrap;
+    }
+
+    .severity-bar {
+      flex: 1;
+      display: flex;
+      height: 6px;
+      border-radius: 3px;
+      overflow: hidden;
+      background: var(--border);
+    }
+
+    .severity-segment { height: 100%; }
+    .severity-segment.critical { background: var(--critical); }
+    .severity-segment.high { background: var(--high); }
+    .severity-segment.medium { background: var(--medium); }
+    .severity-segment.low { background: var(--low); }
+
+    .severity-legend {
+      display: flex;
+      gap: 0.75rem;
+    }
+
+    .severity-legend-item {
+      display: flex;
+      align-items: center;
+      gap: 0.25rem;
+      font-size: 0.6rem;
+      color: var(--text-muted);
+    }
+
+    .severity-dot { width: 6px; height: 6px; border-radius: 50%; }
+    .severity-dot.critical { background: var(--critical); }
+    .severity-dot.high { background: var(--high); }
+    .severity-dot.medium { background: var(--medium); }
+    .severity-dot.low { background: var(--low); }
+
+    /* Main Content */
+    .main-content {
+      padding: 1.5rem 0;
+      background: var(--bg-body);
+    }
+
+    .content-wrapper {
+      background: var(--bg-primary);
+      border-radius: 12px;
+      border: 1px solid var(--border);
+      padding: 1.5rem;
+    }
+
+    /* Typography */
+    h1, h2, h3, h4 {
+      color: var(--text-primary);
+      font-weight: 600;
+      letter-spacing: -0.01em;
+    }
+
+    h1 {
+      font-size: 1.25rem;
+      margin: 1.5rem 0 0.75rem;
+      padding-bottom: 0.5rem;
+      border-bottom: 2px solid var(--accent);
+      display: flex;
+      align-items: center;
+      gap: 0.5rem;
+    }
+
+    h1::before { content: "§"; color: var(--accent); font-weight: 400; }
+
+    h2 {
+      font-size: 1.1rem;
+      margin: 1.25rem 0 0.5rem;
+      padding-bottom: 0.35rem;
+      border-bottom: 1px solid var(--border);
+    }
+
+    h2::before { content: "//"; color: var(--accent); margin-right: 0.35rem; font-weight: 400; opacity: 0.7; }
+
+    h3 {
+      font-size: 1rem;
+      margin: 1rem 0 0.4rem;
+      padding-left: 0.75rem;
+      border-left: 2px solid var(--accent);
+    }
+
+    h4 { font-size: 0.9rem; margin: 0.75rem 0 0.35rem; color: var(--text-secondary); }
+
+    p { margin-bottom: 0.6rem; font-size: 0.875rem; }
+
+    /* Code Blocks */
+    pre {
+      background: var(--code-bg);
+      border: 1px solid var(--border);
+      border-radius: 8px;
+      margin: 0.75rem 0;
+      overflow: hidden;
+      font-size: 0.8rem;
+    }
+
+    pre::before {
+      content: "CODE";
+      display: block;
+      background: var(--bg-tertiary);
+      padding: 0.35rem 0.75rem;
+      font-size: 0.6rem;
+      color: var(--text-muted);
+      text-transform: uppercase;
+      letter-spacing: 0.05em;
+      border-bottom: 1px solid var(--border);
+    }
+
+    pre code {
+      display: block;
+      padding: 0.75rem;
+      overflow-x: auto;
+      line-height: 1.5;
+    }
+
+    code {
+      font-family: 'SF Mono', 'Monaco', 'Consolas', monospace;
+      font-size: 0.85em;
+      color: #e2e8f0;
+    }
+
+    p code, li code, td code {
+      background: var(--bg-tertiary);
+      color: var(--accent);
+      padding: 0.15em 0.35em;
+      border-radius: 4px;
+      font-size: 0.8em;
+      border: 1px solid var(--border);
+    }
+
     /* Tables */
     table {
       width: 100%;
       border-collapse: collapse;
-      margin: 1.5rem 0;
-      background: var(--bg-secondary);
+      margin: 0.75rem 0;
+      background: var(--bg-card);
       border-radius: 8px;
       overflow: hidden;
       border: 1px solid var(--border);
+      font-size: 0.8rem;
     }
-    th, td {
-      padding: 0.75rem 1rem;
+
+    th {
+      padding: 0.6rem 0.75rem;
       text-align: left;
+      font-weight: 600;
+      font-size: 0.65rem;
+      color: var(--text-secondary);
+      text-transform: uppercase;
+      background: var(--bg-tertiary);
       border-bottom: 1px solid var(--border);
     }
-    th {
-      background: var(--bg-tertiary);
-      color: var(--text-primary);
-      font-weight: 600;
-      text-transform: uppercase;
-      font-size: 0.85rem;
-      letter-spacing: 0.05em;
+
+    td {
+      padding: 0.5rem 0.75rem;
+      border-bottom: 1px solid var(--border);
     }
+
     tr:last-child td { border-bottom: none; }
     tr:hover td { background: rgba(255, 255, 255, 0.02); }
-    
-    /* Code Blocks */
-    pre {
-      background: var(--code-bg);
-      padding: 1rem;
-      border-radius: 8px;
-      overflow-x: auto;
-      margin: 1rem 0;
-      border: 1px solid var(--border);
-    }
-    code {
-      font-family: 'SF Mono', 'Menlo', 'Monaco', 'Courier New', monospace;
-      font-size: 0.9em;
-      color: #e2e8f0;
-    }
-    p code, li code, td code {
-      background: rgba(255, 255, 255, 0.1);
-      padding: 0.2em 0.4em;
-      border-radius: 4px;
-      font-size: 0.85em;
-      color: #e2e8f0;
-    }
-    
+
     /* Lists */
-    ul, ol { margin-left: 1.5rem; margin-bottom: 1rem; }
-    li { margin-bottom: 0.5rem; }
-    
+    ul, ol { margin: 0.5rem 0 0.5rem 1.25rem; }
+    li { margin-bottom: 0.25rem; font-size: 0.875rem; }
+    li::marker { color: var(--accent); }
+
     /* Blockquotes */
     blockquote {
-      border-left: 4px solid var(--accent);
-      padding-left: 1rem;
-      margin: 1rem 0;
-      color: var(--text-secondary);
-      font-style: italic;
-      background: rgba(255, 107, 44, 0.05);
-      padding: 0.5rem 0.5rem 0.5rem 1rem;
-      border-radius: 0 4px 4px 0;
+      margin: 0.75rem 0;
+      padding: 0.6rem 1rem;
+      background: var(--bg-card);
+      border-left: 3px solid var(--accent);
+      border-radius: 0 8px 8px 0;
+      font-size: 0.85rem;
     }
-    
+
+    blockquote p:last-child { margin-bottom: 0; }
+
     /* Links */
     a { color: var(--accent); text-decoration: none; }
     a:hover { text-decoration: underline; }
-    
-    /* Horizontal Rule */
+
+    /* HR */
     hr {
-      border: 0;
+      border: none;
       height: 1px;
-      background: var(--border);
-      margin: 2rem 0;
+      background: linear-gradient(90deg, transparent, var(--border), transparent);
+      margin: 1.5rem 0;
     }
-    
-    /* Utilities */
+
     strong { color: var(--text-primary); font-weight: 600; }
-    em { color: var(--text-secondary); }
-    
-    /* Print Styles */
+    em { color: var(--text-muted); }
+
+    /* Footer */
+    .report-footer {
+      padding: 1rem 0;
+      background: var(--bg-primary);
+      border-top: 1px solid var(--border);
+      text-align: center;
+    }
+
+    .footer-content {
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      gap: 0.5rem;
+      font-size: 0.7rem;
+      color: var(--text-muted);
+    }
+
+    .footer-brand {
+      display: flex;
+      align-items: center;
+      gap: 0.35rem;
+      color: var(--text-secondary);
+      font-weight: 600;
+    }
+
+    .footer-brand-icon {
+      width: 16px;
+      height: 16px;
+      background: linear-gradient(135deg, var(--accent), #ff8f5a);
+      border-radius: 4px;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      font-size: 0.6rem;
+      color: white;
+      font-weight: 800;
+    }
+
+    /* Responsive */
+    @media (max-width: 768px) {
+      .container { padding: 0 1rem; }
+      .stats-grid { flex-direction: column; gap: 0.75rem; }
+      .score-ring-container { width: 100%; justify-content: center; }
+      .stats-cards { flex-wrap: wrap; }
+      .stat-card { min-width: calc(50% - 0.25rem); }
+      .severity-bar-wrap { flex-direction: column; align-items: stretch; gap: 0.5rem; }
+      .severity-legend { justify-content: center; }
+      .content-wrapper { padding: 1rem; }
+    }
+
+    /* Print */
     @media print {
-      body {
-        background: white;
-        color: black;
-        max-width: 100%;
-        padding: 0;
+      :root {
+        --bg-body: #fff;
+        --bg-primary: #fff;
+        --bg-secondary: #f8fafc;
+        --bg-tertiary: #f1f5f9;
+        --bg-card: #fff;
+        --text-primary: #0f172a;
+        --text-secondary: #475569;
+        --text-muted: #64748b;
+        --border: #e2e8f0;
+        --code-bg: #f8fafc;
       }
-      h1, h2, h3, strong { color: black; }
-      pre, code { background: #f1f5f9; color: black; border-color: #e2e8f0; }
-      table { border-color: #e2e8f0; }
-      th { background: #f8fafc; color: black; border-bottom-color: #cbd5e1; }
-      td { border-bottom-color: #e2e8f0; }
-      p code, li code, td code { background: #f1f5f9; color: #0f172a; }
-      a { color: #2563eb; text-decoration: underline; }
+      body { background: white; font-size: 11pt; }
+      .header::before { display: none; }
+      .content-wrapper { border: none; padding: 0; }
+      pre { break-inside: avoid; }
+      code { color: #1e293b; }
+      p code, li code { background: #f1f5f9; color: #c2410c; }
+      a { color: #2563eb; }
     }
   </style>
 </head>
 <body>
-  ${contentHtml}
-  
-  <footer style="margin-top: 4rem; padding-top: 2rem; border-top: 1px solid var(--border); text-align: center; font-size: 0.875rem; color: var(--text-secondary);">
-    <p>生成于 ${new Date().toLocaleString('zh-CN')} &bull; DeepAudit 安全审计系统</p>
+  <header class="header">
+    <div class="container">
+      <div class="header-content">
+        <div class="brand">
+          <div class="brand-logo">D</div>
+          <span class="brand-text">DeepAudit</span>
+        </div>
+        <h1 class="header-title">${taskName}</h1>
+        <div class="header-meta">${generateDate}</div>
+      </div>
+    </div>
+  </header>
+
+  <section class="stats-section">
+    <div class="container">
+      <div class="stats-grid">
+        <div class="score-ring-container">
+          <div class="score-ring">
+            <svg viewBox="0 0 56 56">
+              <circle class="score-ring-bg" cx="28" cy="28" r="23"></circle>
+              <circle class="score-ring-progress" cx="28" cy="28" r="23"></circle>
+            </svg>
+            <div class="score-ring-content">
+              <span class="score-value">${scoreDisplay}</span>
+              <span class="score-grade">${scoreInfo.grade}</span>
+            </div>
+          </div>
+          <span class="score-label">安全评分</span>
+        </div>
+        <div class="stats-cards">
+          <div class="stat-card">
+            <div class="stat-card-header">
+              <div class="stat-card-icon total">∑</div>
+              <span class="stat-card-label">总数</span>
+            </div>
+            <div class="stat-card-value">${totalFindings}</div>
+          </div>
+          <div class="stat-card">
+            <div class="stat-card-header">
+              <div class="stat-card-icon critical">!</div>
+              <span class="stat-card-label">严重</span>
+            </div>
+            <div class="stat-card-value critical">${criticalCount}</div>
+          </div>
+          <div class="stat-card">
+            <div class="stat-card-header">
+              <div class="stat-card-icon high">▲</div>
+              <span class="stat-card-label">高危</span>
+            </div>
+            <div class="stat-card-value high">${highCount}</div>
+          </div>
+          <div class="stat-card">
+            <div class="stat-card-header">
+              <div class="stat-card-icon verified">✓</div>
+              <span class="stat-card-label">验证</span>
+            </div>
+            <div class="stat-card-value" style="color:var(--success)">${verifiedCount}</div>
+          </div>
+        </div>
+      </div>
+    </div>
+  </section>
+
+  <section class="severity-section">
+    <div class="container">
+      <div class="severity-bar-wrap">
+        <span class="severity-bar-title">分布</span>
+        <div class="severity-bar">
+          ${totalFindings > 0 ? `
+            <div class="severity-segment critical" style="width:${(criticalCount/totalFindings)*100}%"></div>
+            <div class="severity-segment high" style="width:${(highCount/totalFindings)*100}%"></div>
+            <div class="severity-segment medium" style="width:${(mediumCount/totalFindings)*100}%"></div>
+            <div class="severity-segment low" style="width:${(lowCount/totalFindings)*100}%"></div>
+          ` : ''}
+        </div>
+        <div class="severity-legend">
+          <div class="severity-legend-item"><div class="severity-dot critical"></div>${criticalCount}</div>
+          <div class="severity-legend-item"><div class="severity-dot high"></div>${highCount}</div>
+          <div class="severity-legend-item"><div class="severity-dot medium"></div>${mediumCount}</div>
+          <div class="severity-legend-item"><div class="severity-dot low"></div>${lowCount}</div>
+        </div>
+      </div>
+    </div>
+  </section>
+
+  <main class="main-content">
+    <div class="container">
+      <div class="content-wrapper">
+        ${contentHtml}
+      </div>
+    </div>
+  </main>
+
+  <footer class="report-footer">
+    <div class="container">
+      <div class="footer-content">
+        <div class="footer-brand">
+          <div class="footer-brand-icon">D</div>
+          DeepAudit
+        </div>
+        <span>·</span>
+        <span>${generateDate}</span>
+      </div>
+    </div>
   </footer>
 </body>
 </html>`;
@@ -569,64 +1504,95 @@ export const ReportExportDialog = memo(function ReportExportDialog({
     }
   }, [open, activeFormat, task, fetchPreview]);
 
+  // 清除缓存当对话框关闭时
+  useEffect(() => {
+    if (!open) {
+      previewCache.current.clear();
+      setSearchQuery("");
+      setDownloadSuccess(false);
+    }
+  }, [open]);
+
+  // 键盘快捷键
+  useEffect(() => {
+    if (!open) return;
+
+    const handleKeyDown = (e: KeyboardEvent) => {
+      // Ctrl/Cmd + C 复制
+      if ((e.metaKey || e.ctrlKey) && e.key === 'c' && !window.getSelection()?.toString()) {
+        e.preventDefault();
+        handleCopy();
+      }
+      // Ctrl/Cmd + S 下载
+      if ((e.metaKey || e.ctrlKey) && e.key === 's') {
+        e.preventDefault();
+        handleDownload();
+      }
+      // Ctrl/Cmd + F 搜索
+      if ((e.metaKey || e.ctrlKey) && e.key === 'f') {
+        e.preventDefault();
+        // 聚焦搜索框（如果存在）
+      }
+      // 数字键 1-3 切换格式
+      if (e.key === '1') setActiveFormat('markdown');
+      if (e.key === '2') setActiveFormat('json');
+      if (e.key === '3') setActiveFormat('html');
+    };
+
+    window.addEventListener('keydown', handleKeyDown);
+    return () => window.removeEventListener('keydown', handleKeyDown);
+  }, [open, preview.content]);
+
   // Handle copy to clipboard
   const handleCopy = async () => {
+    if (!preview.content) return;
     try {
       await navigator.clipboard.writeText(preview.content);
       setCopied(true);
+      toast.success("已复制到剪贴板");
       setTimeout(() => setCopied(false), 2000);
     } catch (err) {
       console.error("Failed to copy:", err);
+      toast.error("复制失败");
     }
   };
 
   // Handle download
   const handleDownload = async () => {
-    if (!task || !findings && activeFormat !== "json") return; // Allow json even if findings empty? Actually backend handles it.
+    if (!task) return;
 
     setDownloading(true);
     try {
-      let content = "";
-      let filename = `audit_report_${task.id.substring(0, 8)}`;
-      let mimeType = "text/plain";
+      let content = preview.content;
+      let filename = `audit_report_${task.name || task.id.substring(0, 8)}_${new Date().toISOString().slice(0, 10)}`;
+      const config = FORMAT_CONFIG[activeFormat];
 
-      if (activeFormat === "markdown") {
-        content = preview.content; // Use cached preview
-        // Fallback if preview failed? Re-fetch.
-        if (!content) {
+      // 如果预览内容为空，重新获取
+      if (!content) {
+        if (activeFormat === "json") {
+          const response = await apiClient.get(`/agent-tasks/${task.id}/report`, {
+            params: { format: "json" },
+          });
+          content = JSON.stringify(response.data, null, 2);
+        } else if (activeFormat === "html") {
+          const mdResponse = await apiClient.get(`/agent-tasks/${task.id}/report`, {
+            params: { format: "markdown" },
+            responseType: "text",
+          });
+          content = await generateHtmlReport(mdResponse.data, task);
+        } else {
           const response = await apiClient.get(`/agent-tasks/${task.id}/report`, {
             params: { format: "markdown" },
             responseType: "text",
           });
           content = response.data;
         }
-        filename += ".md";
-      } else if (activeFormat === "json") {
-        // Fetch JSON directly from backend
-        const response = await apiClient.get(`/agent-tasks/${task.id}/report`, {
-          params: { format: "json" },
-          responseType: "json", // Important: axios parses JSON
-        });
-        // Pretty print JSON
-        content = JSON.stringify(response.data, null, 2);
-        filename += ".json";
-        mimeType = "application/json";
-      } else if (activeFormat === "html") { // HTML
-        if (preview.content && preview.format === "html") {
-          content = preview.content;
-        } else {
-          const response = await apiClient.get(`/agent-tasks/${task.id}/report`, {
-            params: { format: "markdown" },
-            responseType: "text",
-          });
-          content = await generateHtmlReport(response.data, task);
-        }
-        filename += ".html";
-        mimeType = "text/html";
       }
 
+      filename += config.extension;
+
       // Create download trigger
-      const blob = new Blob([content], { type: mimeType });
+      const blob = new Blob([content], { type: config.mime });
       const url = URL.createObjectURL(blob);
       const a = document.createElement("a");
       a.href = url;
@@ -636,10 +1602,17 @@ export const ReportExportDialog = memo(function ReportExportDialog({
       document.body.removeChild(a);
       URL.revokeObjectURL(url);
 
-      onOpenChange(false);
+      // 显示成功状态
+      setDownloadSuccess(true);
+      toast.success(`报告已导出为 ${config.label} 格式`);
+
+      // 延迟关闭
+      setTimeout(() => {
+        onOpenChange(false);
+      }, 1000);
     } catch (err) {
       console.error("Download failed:", err);
-      // Ideally show toast error here
+      toast.error("导出报告失败，请重试");
     } finally {
       setDownloading(false);
     }
@@ -649,192 +1622,255 @@ export const ReportExportDialog = memo(function ReportExportDialog({
 
   return (
     <Dialog open={open} onOpenChange={onOpenChange}>
-      <DialogContent className="max-w-4xl h-[85vh] bg-[#0a0a0f] border-slate-700/50 p-0 gap-0 overflow-hidden">
-        {/* Header */}
-        <div className="px-5 py-4 border-b border-slate-700/50 bg-gradient-to-r from-[#0d0d12] to-[#0a0a0f]">
-          <DialogHeader>
-            <div className="flex items-center gap-3">
-              <div className="p-2 rounded bg-primary/10 border border-primary/30">
-                <FileText className="w-5 h-5 text-primary" />
+      <DialogContent className="max-w-5xl h-[90vh] bg-gradient-to-b from-[#0a0a0f] to-[#0d0d14] border-slate-700/50 p-0 gap-0 overflow-hidden shadow-2xl shadow-black/50">
+        {/* Header - 增强设计 */}
+        <div className="relative px-6 py-5 border-b border-slate-700/50 bg-gradient-to-r from-[#0d0d12] via-[#0f0f16] to-[#0d0d12]">
+          {/* 装饰性背景元素 */}
+          <div className="absolute inset-0 overflow-hidden">
+            <div className="absolute -top-20 -right-20 w-40 h-40 bg-primary/5 rounded-full blur-3xl" />
+            <div className="absolute -bottom-10 -left-10 w-32 h-32 bg-sky-500/5 rounded-full blur-2xl" />
+          </div>
+
+          <DialogHeader className="relative">
+            <div className="flex items-center justify-between">
+              <div className="flex items-center gap-4">
+                <div className="relative p-3 rounded-xl bg-gradient-to-br from-primary/20 to-primary/5 border border-primary/30 shadow-lg shadow-primary/10">
+                  <FileDown className="w-6 h-6 text-primary" />
+                  <div className="absolute -top-1 -right-1 w-3 h-3 rounded-full bg-emerald-500 border-2 border-[#0a0a0f] animate-pulse" />
+                </div>
+                <div>
+                  <DialogTitle className="text-xl font-bold text-white flex items-center gap-2">
+                    导出审计报告
+                    <Sparkles className="w-4 h-4 text-primary/60" />
+                  </DialogTitle>
+                  <p className="text-xs text-slate-500 mt-1 font-mono flex items-center gap-2">
+                    <Clock className="w-3 h-3" />
+                    {task.name || `Task ${task.id.slice(0, 8)}`}
+                  </p>
+                </div>
               </div>
-              <div>
-                <DialogTitle className="text-lg font-bold text-white">
-                  Export Audit Report
-                </DialogTitle>
-                <p className="text-xs text-slate-500 mt-0.5 font-mono">
-                  Task: {task.name || task.id.slice(0, 8)}
-                </p>
+
+              {/* 快捷键提示 */}
+              <div className="hidden md:flex items-center gap-2 text-[10px] text-slate-600">
+                <div className="flex items-center gap-1 px-2 py-1 rounded bg-slate-800/50 border border-slate-700/30">
+                  <Keyboard className="w-3 h-3" />
+                  <span>⌘S 下载</span>
+                </div>
+                <div className="flex items-center gap-1 px-2 py-1 rounded bg-slate-800/50 border border-slate-700/30">
+                  <span>1-3 切换</span>
+                </div>
               </div>
             </div>
           </DialogHeader>
         </div>
 
-        {/* Stats Summary */}
-        <div className="px-5 py-3 border-b border-slate-700/40 bg-[#0b0b10]">
-          <ReportStats task={task} findings={findings} />
-        </div>
+        {/* 主体内容区域 */}
+        <div className="flex-1 flex flex-col overflow-hidden">
+          {/* Stats Summary - 增强统计卡片 */}
+          <div className="px-6 py-4 border-b border-slate-700/30 bg-[#0b0b10]/80">
+            <EnhancedStatsPanel task={task} findings={findings} />
+          </div>
 
-        {/* Format Tabs & Content */}
-        <Tabs
-          value={activeFormat}
-          onValueChange={(v) => setActiveFormat(v as ReportFormat)}
-          className="flex flex-col flex-1 overflow-hidden"
-        >
-          {/* Tab List */}
-          <div className="px-5 py-2 border-b border-slate-700/40 bg-[#0d0d12]">
-            <div className="flex items-center justify-between">
-              <TabsList className="bg-slate-800/50 p-1 h-9">
-                {(Object.keys(FORMAT_CONFIG) as ReportFormat[]).map((format) => {
-                  const config = FORMAT_CONFIG[format];
-                  return (
-                    <TabsTrigger
-                      key={format}
-                      value={format}
-                      className="px-3 py-1.5 text-xs font-mono uppercase tracking-wider data-[state=active]:bg-primary/20 data-[state=active]:text-primary transition-colors"
-                    >
-                      <span className="flex items-center gap-1.5">
-                        {config.icon}
-                        {config.label}
+          {/* 两栏布局：左侧配置，右侧预览 */}
+          <div className="flex-1 flex min-h-0">
+            {/* 左侧：格式选择和配置 */}
+            <div className="w-72 flex-shrink-0 border-r border-slate-700/30 bg-[#0a0a0e]/50 p-4 space-y-4 overflow-y-auto">
+              {/* 格式选择 */}
+              <div>
+                <h3 className="text-xs font-semibold text-slate-400 uppercase tracking-wider mb-3 flex items-center gap-2">
+                  <FileText className="w-3.5 h-3.5" />
+                  选择格式
+                </h3>
+                <FormatSelector
+                  activeFormat={activeFormat}
+                  onFormatChange={setActiveFormat}
+                />
+              </div>
+
+              {/* 导出选项 */}
+              <ExportOptionsPanel
+                options={exportOptions}
+                onOptionsChange={setExportOptions}
+                expanded={optionsExpanded}
+                onToggle={() => setOptionsExpanded(!optionsExpanded)}
+              />
+
+              {/* 格式信息 */}
+              <div className="p-3 rounded-xl bg-slate-800/30 border border-slate-700/30">
+                <div className="flex items-center gap-2 mb-2">
+                  <div className={FORMAT_CONFIG[activeFormat].color}>
+                    {FORMAT_CONFIG[activeFormat].icon}
+                  </div>
+                  <span className="text-sm font-medium text-white">
+                    {FORMAT_CONFIG[activeFormat].label}
+                  </span>
+                </div>
+                <p className="text-[11px] text-slate-500 leading-relaxed">
+                  {activeFormat === "markdown" && "Markdown格式便于编辑和版本控制，可用任何文本编辑器打开。"}
+                  {activeFormat === "json" && "JSON格式包含完整的结构化数据，适合程序处理和数据分析。"}
+                  {activeFormat === "html" && "HTML格式可直接在浏览器中查看，包含完整样式和布局。"}
+                </p>
+              </div>
+            </div>
+
+            {/* 右侧：预览区域 */}
+            <div className="flex-1 flex flex-col min-h-0 bg-[#0d0d12]">
+              {/* 预览工具栏 */}
+              <div className="flex-shrink-0 flex items-center justify-between px-4 py-2.5 border-b border-slate-700/30 bg-slate-800/20">
+                <div className="flex items-center gap-3">
+                  <div className="flex items-center gap-2">
+                    <Eye className="w-4 h-4 text-slate-500" />
+                    <span className="text-xs text-slate-400 font-medium">预览</span>
+                  </div>
+                  <Badge className="text-[10px] bg-slate-700/50 text-slate-400 border-0 font-mono">
+                    {formatBytes(preview.content.length)}
+                  </Badge>
+                </div>
+
+                <div className="flex items-center gap-2">
+                  {/* 搜索框 */}
+                  <div className="flex items-center gap-2 px-2.5 py-1.5 rounded-lg bg-slate-800/50 border border-slate-700/30">
+                    <Search className="w-3.5 h-3.5 text-slate-500" />
+                    <input
+                      type="text"
+                      value={searchQuery}
+                      onChange={(e) => setSearchQuery(e.target.value)}
+                      placeholder="搜索..."
+                      className="w-24 bg-transparent text-xs text-slate-300 placeholder:text-slate-600 outline-none"
+                    />
+                    {searchQuery && (
+                      <span className="text-[10px] text-slate-500 font-mono">
+                        {searchMatchCount}
                       </span>
-                    </TabsTrigger>
-                  );
-                })}
-              </TabsList>
+                    )}
+                  </div>
 
-              {/* Actions */}
-              <div className="flex items-center gap-2">
-                <Button
-                  variant="ghost"
-                  size="sm"
-                  onClick={handleCopy}
-                  disabled={preview.loading || !preview.content}
-                  className="h-8 px-2.5 text-xs text-slate-400 hover:text-white"
-                >
-                  {copied ? (
-                    <Check className="w-3.5 h-3.5 mr-1.5 text-emerald-400" />
+                  {/* 操作按钮 */}
+                  <Button
+                    variant="ghost"
+                    size="sm"
+                    onClick={handleCopy}
+                    disabled={preview.loading || !preview.content}
+                    className="h-8 px-2.5 text-xs text-slate-400 hover:text-white hover:bg-slate-700/50"
+                  >
+                    {copied ? (
+                      <Check className="w-3.5 h-3.5 mr-1.5 text-emerald-400" />
+                    ) : (
+                      <Copy className="w-3.5 h-3.5 mr-1.5" />
+                    )}
+                    {copied ? "已复制" : "复制"}
+                  </Button>
+
+                  <Button
+                    variant="ghost"
+                    size="sm"
+                    onClick={() => fetchPreview(activeFormat, true)}
+                    disabled={preview.loading}
+                    className="h-8 px-2.5 text-xs text-slate-400 hover:text-white hover:bg-slate-700/50"
+                  >
+                    <RefreshCw className={`w-3.5 h-3.5 mr-1.5 ${preview.loading ? 'animate-spin' : ''}`} />
+                    刷新
+                  </Button>
+                </div>
+              </div>
+
+              {/* 预览内容 */}
+              <div className="flex-1 min-h-0 overflow-hidden">
+                <ScrollArea className="h-full">
+                  <div className="p-5">
+                  {preview.loading ? (
+                    <PreviewSkeleton />
+                  ) : preview.error ? (
+                    <div className="flex items-center justify-center py-16">
+                      <div className="flex flex-col items-center gap-4 text-center">
+                        <div className="p-4 rounded-full bg-amber-500/10 border border-amber-500/30">
+                          <AlertTriangle className="w-8 h-8 text-amber-400" />
+                        </div>
+                        <div>
+                          <p className="text-sm text-slate-300 font-medium mb-1">加载失败</p>
+                          <p className="text-xs text-slate-500">{preview.error}</p>
+                        </div>
+                        <Button
+                          variant="outline"
+                          size="sm"
+                          onClick={() => fetchPreview(activeFormat, true)}
+                          className="mt-2"
+                        >
+                          <RefreshCw className="w-3.5 h-3.5 mr-1.5" />
+                          重试
+                        </Button>
+                      </div>
+                    </div>
                   ) : (
-                    <Copy className="w-3.5 h-3.5 mr-1.5" />
+                    <div className="rounded-xl border border-slate-700/40 overflow-hidden bg-[#0a0a0e]">
+                      <div className="p-5 min-h-[300px]">
+                        {activeFormat === "markdown" && (
+                          <MarkdownPreview content={preview.content} searchQuery={searchQuery} />
+                        )}
+                        {activeFormat === "json" && (
+                          <JsonPreview content={preview.content} searchQuery={searchQuery} />
+                        )}
+                        {activeFormat === "html" && (
+                          <HtmlPreview content={preview.content} searchQuery={searchQuery} />
+                        )}
+                      </div>
+                    </div>
                   )}
-                  {copied ? "Copied" : "Copy"}
-                </Button>
-
-                <Button
-                  variant="ghost"
-                  size="sm"
-                  onClick={() => fetchPreview(activeFormat)}
-                  disabled={preview.loading}
-                  className="h-8 px-2.5 text-xs text-slate-400 hover:text-white"
-                >
-                  <RefreshCw className={`w-3.5 h-3.5 mr-1.5 ${preview.loading ? 'animate-spin' : ''}`} />
-                  Refresh
-                </Button>
+                </div>
+                </ScrollArea>
               </div>
             </div>
           </div>
+        </div>
 
-          {/* Preview Content */}
-          <div className="flex-1 overflow-hidden">
-            {(Object.keys(FORMAT_CONFIG) as ReportFormat[]).map((format) => (
-              <TabsContent
-                key={format}
-                value={format}
-                className="h-full m-0 data-[state=inactive]:hidden"
-              >
-                <ScrollArea className="h-full">
-                  <div className="p-5">
-                    {preview.loading ? (
-                      <div className="flex items-center justify-center py-12">
-                        <div className="flex flex-col items-center gap-3">
-                          <Loader2 className="w-8 h-8 text-primary animate-spin" />
-                          <span className="text-sm text-slate-500">Loading preview...</span>
-                        </div>
-                      </div>
-                    ) : preview.error ? (
-                      <div className="flex items-center justify-center py-12">
-                        <div className="flex flex-col items-center gap-3 text-center">
-                          <AlertTriangle className="w-8 h-8 text-amber-400" />
-                          <span className="text-sm text-slate-400">{preview.error}</span>
-                          <Button
-                            variant="outline"
-                            size="sm"
-                            onClick={() => fetchPreview(activeFormat)}
-                            className="mt-2"
-                          >
-                            <RefreshCw className="w-3.5 h-3.5 mr-1.5" />
-                            Retry
-                          </Button>
-                        </div>
-                      </div>
-                    ) : (
-                      <div className="bg-[#0d0d12] rounded-lg border border-slate-700/40 overflow-hidden">
-                        {/* Preview header */}
-                        <div className="flex items-center justify-between px-4 py-2 bg-slate-800/30 border-b border-slate-700/40">
-                          <div className="flex items-center gap-2">
-                            <Eye className="w-3.5 h-3.5 text-slate-500" />
-                            <span className="text-[10px] text-slate-500 uppercase tracking-wider font-mono">
-                              Preview
-                            </span>
-                          </div>
-                          <Badge className="text-[9px] bg-slate-700/50 text-slate-400 border-0">
-                            {formatBytes(preview.content.length)}
-                          </Badge>
-                        </div>
-
-                        {/* Preview content */}
-                        <div className="p-4 max-h-[45vh] overflow-y-auto custom-scrollbar">
-                          {format === "markdown" && <MarkdownPreview content={preview.content} />}
-                          {format === "json" && <JsonPreview content={preview.content} />}
-                          {format === "html" && (
-                            <div className="text-xs font-mono text-slate-400 whitespace-pre-wrap">
-                              {preview.content.slice(0, 3000)}
-                              {preview.content.length > 3000 && (
-                                <span className="text-slate-600">... (truncated for preview)</span>
-                              )}
-                            </div>
-                          )}
-                        </div>
-                      </div>
-                    )}
-                  </div>
-                </ScrollArea>
-              </TabsContent>
-            ))}
-          </div>
-        </Tabs>
-
-        {/* Footer */}
-        <div className="px-5 py-4 border-t border-slate-700/50 bg-[#0d0d12]">
+        {/* Footer - 增强设计 */}
+        <div className="px-6 py-4 border-t border-slate-700/50 bg-gradient-to-r from-[#0d0d12] via-[#0f0f16] to-[#0d0d12]">
           <div className="flex items-center justify-between">
-            <div className="flex items-center gap-2 text-xs text-slate-500">
-              <Terminal className="w-3.5 h-3.5" />
-              <span className="font-mono">
-                Export as {FORMAT_CONFIG[activeFormat].label} ({FORMAT_CONFIG[activeFormat].extension})
-              </span>
+            <div className="flex items-center gap-3 text-xs text-slate-500">
+              <div className={`flex items-center gap-2 px-3 py-1.5 rounded-lg border ${FORMAT_CONFIG[activeFormat].bgColor}`}>
+                <span className={FORMAT_CONFIG[activeFormat].color}>
+                  {FORMAT_CONFIG[activeFormat].icon}
+                </span>
+                <span className="font-mono">
+                  {FORMAT_CONFIG[activeFormat].label} ({FORMAT_CONFIG[activeFormat].extension})
+                </span>
+              </div>
             </div>
 
             <div className="flex items-center gap-3">
               <Button
                 variant="ghost"
                 onClick={() => onOpenChange(false)}
-                className="h-9 px-4 text-sm text-slate-400 hover:text-white"
+                className="h-10 px-5 text-sm text-slate-400 hover:text-white"
               >
-                Cancel
+                取消
               </Button>
 
               <Button
                 onClick={handleDownload}
                 disabled={downloading || preview.loading || !preview.content}
-                className="h-9 px-5 bg-primary hover:bg-primary/90 text-sm font-medium"
+                className={`
+                  h-10 px-6 text-sm font-medium transition-all duration-300
+                  ${downloadSuccess
+                    ? "bg-emerald-600 hover:bg-emerald-600"
+                    : "bg-primary hover:bg-primary/90"
+                  }
+                `}
               >
                 {downloading ? (
                   <>
                     <Loader2 className="w-4 h-4 mr-2 animate-spin" />
-                    Exporting...
+                    导出中...
+                  </>
+                ) : downloadSuccess ? (
+                  <>
+                    <Check className="w-4 h-4 mr-2" />
+                    导出成功
                   </>
                 ) : (
                   <>
                     <Download className="w-4 h-4 mr-2" />
-                    Download {FORMAT_CONFIG[activeFormat].label}
+                    下载 {FORMAT_CONFIG[activeFormat].label}
                   </>
                 )}
               </Button>
diff --git a/frontend/src/pages/Projects.tsx b/frontend/src/pages/Projects.tsx
index bd3b6ca..55af2f5 100644
--- a/frontend/src/pages/Projects.tsx
+++ b/frontend/src/pages/Projects.tsx
@@ -423,7 +423,7 @@ export default function Projects() {
             初始化项目
           </Button>
         </DialogTrigger>
-        <DialogContent className="max-w-2xl max-h-[85vh] overflow-y-auto cyber-card border-gray-700 bg-[#0c0c12] p-0">
+        <DialogContent className="max-w-2xl max-h-[85vh] !overflow-y-auto cyber-card border-gray-700 bg-[#0c0c12] p-0 !fixed">
           {/* Terminal Header */}
           <div className="flex items-center gap-2 px-4 py-3 bg-[#0a0a0f] border-b border-gray-800/50">
             <div className="flex items-center gap-1.5">
@@ -934,7 +934,7 @@ export default function Projects() {
 
       {/* Edit Dialog */}
       <Dialog open={showEditDialog} onOpenChange={setShowEditDialog}>
-        <DialogContent className="max-w-2xl cyber-card border-gray-700 bg-[#0c0c12] p-0">
+        <DialogContent className="max-w-2xl cyber-card border-gray-700 bg-[#0c0c12] p-0 !fixed">
           {/* Terminal Header */}
           <div className="flex items-center gap-2 px-4 py-3 bg-[#0a0a0f] border-b border-gray-800/50">
             <div className="flex items-center gap-1.5">
@@ -1185,7 +1185,7 @@ export default function Projects() {
 
       {/* Delete Dialog */}
       <AlertDialog open={showDeleteDialog} onOpenChange={setShowDeleteDialog}>
-        <AlertDialogContent className="cyber-card border-gray-700 bg-[#0c0c12] p-0">
+        <AlertDialogContent className="cyber-card border-gray-700 bg-[#0c0c12] p-0 !fixed">
           {/* Terminal Header */}
           <div className="flex items-center gap-2 px-4 py-3 bg-rose-500/10 border-b border-rose-500/30">
             <div className="flex items-center gap-1.5">
diff --git a/frontend/src/pages/PromptManager.tsx b/frontend/src/pages/PromptManager.tsx
index 351825c..80565f8 100644
--- a/frontend/src/pages/PromptManager.tsx
+++ b/frontend/src/pages/PromptManager.tsx
@@ -401,7 +401,7 @@ export default function PromptManager() {
 
       {/* Test Dialog */}
       <Dialog open={showTestDialog} onOpenChange={setShowTestDialog}>
-        <DialogContent className="!max-w-6xl w-[90vw] max-h-[90vh] overflow-y-auto cyber-card p-0 bg-[#0c0c12]">
+        <DialogContent className="!max-w-6xl w-[90vw] max-h-[90vh] !overflow-y-auto cyber-card p-0 bg-[#0c0c12] !fixed">
           <DialogHeader className="cyber-card-header">
             <Sparkles className="w-5 h-5 text-violet-400" />
             <DialogTitle className="text-lg font-bold uppercase tracking-wider text-white">
diff --git a/frontend/src/pages/RecycleBin.tsx b/frontend/src/pages/RecycleBin.tsx
index 38b8b4b..41be023 100644
--- a/frontend/src/pages/RecycleBin.tsx
+++ b/frontend/src/pages/RecycleBin.tsx
@@ -262,7 +262,7 @@ export default function RecycleBin() {
 
       {/* Restore Dialog */}
       <AlertDialog open={showRestoreDialog} onOpenChange={setShowRestoreDialog}>
-        <AlertDialogContent className="cyber-card p-0 bg-[#0c0c12] max-w-md">
+        <AlertDialogContent className="cyber-card p-0 bg-[#0c0c12] max-w-md !fixed">
           <AlertDialogHeader className="cyber-card-header">
             <RotateCcw className="w-5 h-5 text-emerald-400" />
             <AlertDialogTitle className="text-lg font-bold uppercase tracking-wider text-white">
@@ -288,7 +288,7 @@ export default function RecycleBin() {
 
       {/* Permanent Delete Dialog */}
       <AlertDialog open={showPermanentDeleteDialog} onOpenChange={setShowPermanentDeleteDialog}>
-        <AlertDialogContent className="cyber-card p-0 bg-[#0c0c12] max-w-md">
+        <AlertDialogContent className="cyber-card p-0 bg-[#0c0c12] max-w-md !fixed">
           <AlertDialogHeader className="p-4 border-b border-rose-500/30 bg-rose-500/10 flex flex-row items-center gap-2">
             <AlertTriangle className="w-5 h-5 text-rose-400" />
             <AlertDialogTitle className="text-lg font-bold uppercase tracking-wider text-rose-400">
diff --git a/tools.txt b/tools.txt
new file mode 100644
index 0000000..1a165dd
--- /dev/null
+++ b/tools.txt
@@ -0,0 +1,102 @@
+代码阅读IDE  集成开发环境（IDE、Integrated Development Environment）主要用于提供应用程序开发的环境、通常包括编辑器、编译器、调试器等。Chocolat  C++、PHP、Ruby、Haskell  https://chocolatapp.com/  Mac OS X   Mac系统上一款强大的文本编辑器
+    Eclipse-aptana  PHP、Javascript、AJAX、Adobe AIR、Apple iPhone、Ruby on Rails  http://www.aptana.com/   Windows、Mac OS X   一个非常强大、开源、JavaScript-focused的AJAX开发IDE
+    netbeans  PHP、C、C++、JavaScript、Ruby、Groovy、Grails  https://netbeans.org/index_zh_CN.html   Windows、Mac OS X 、 Linux   开放源代码的Java IDE
+    Coda  HTML、PHP、JavaScript、CSS  https://www.panic.com/coda/  Mac OS X   界面漂亮、操作简单的网页开发工具
+    Editplus  HTML、、PHP、Java、 C、C++、CSS、ASP、Perl、JavaScript、 VBScript、Python、 Ruby on Rails  https://www.editplus.com/  Windows  小巧但是功能强大的可处理文本、HTML和程序语言的Windows编辑器
+    Anjuta  C、C++  http://anjuta.org/  Linux  一个建立在GNU/Linux下为C、C++提供编译的集成开发环境
+    kDevelop   C、 C++、 Python、 QML、JavaScript and PHP  https://www.kdevelop.org/   Windows、Mac OS X 、 Linux   一个自由、开放源代码 的 IDE（集成开发环境
+    Ultimate  C、C++  https://www.ultimatepp.org/   Windows、 Linux   一个C ++跨平台快速应用程序开发框架
+    C-Free  C、C++  http://www.programarts.com/cfree_en/download.htm  Windows  一款C/C++集成开发环境（IDE）
+    visual-mingw  C、C++  http://visual-mingw.sourceforge.net/  Windows  一个可自由使用和自由发布的Windows特定头文件和使用GNU工具集导入库的集合
+    Eclipse CDT  C、C++  http://www.eclipse.org/cdt/   Windows、Mac OS X   Eclipse的CDT搭建标准的C/C++开发环境
+    espresso  HTML、XML、 CSS、JavaScript  https://espresso.en.softonic.com/mac   Windows、Mac OS X   强大的HTML、XML、CSS和JavaScript的Web开发工具
+    visual-web-developer-express  C#、Visual Basic、F#、C++、HTML、JavaScript、TypeScript、Python 等  https://www.visualstudio.com/zh-hans/vs/visual-studio-express/?rr=http%3A%2F%2Fwww.csdn.net%2Farticle%2F2012-02-15%2F311835   Windows、Mac OS X   一款非常好用且功能强大的web应用程序开发工具
+    IntelliJ IDEA  Java  http://www.jetbrains.com/webstorm/   Windows、Mac OS X 、 Linux   业界被公认为最好的java开发工具之一
+    Codelite  C、C++、PHP 、Node.js  https://codelite.org/   Windows、 Linux   一个功能强大的开源、C/C++编程语言的跨平台ID
+    Zend Studio  PHP  http://www.zend.com/en/products/studio   Windows、Mac OS X 、 Linux   Zend Technologies公司开发的PHP语言集成开发环境(IDE)
+    GNU Emacs  All  http://www.gnu.org/software/emacs/download.html   Windows、Mac OS X   著名的集成开发环境和文本编辑器
+    E-TextEditor  All  https://e-texteditor.en.softonic.com/download  Windows  一款新概念的窗口本文编辑软件
+    Notepad++   All  https://notepad-plus-plus.org/  Windows  Windows操作系统下的一套文本编辑器
+    Bbedit  All  http://www.barebones.com/products/bbedit/  Mac OS X   一款适用于Mac操作系统的软件
+    TextMate  All  http://macromates.com/  Mac OS X   Mac下的著名的文本编辑器软件
+    textpad  All  https://www.textpad.com/  Windows  一个强大的替代 Windows 记事本 Notepad 的文本编辑器
+    SUBLIME TEXT  All  http://www.sublimetext.com/   Windows、Mac OS X 、 Linux   一个代码编辑器、也是HTML和散文先进的文本编辑器
+    skEdit   All  https://skedit.en.softonic.com/mac  Mac OS X   Mac HTML和文本编辑器
+    ATOM  All  https://atom.io/   Windows、Mac OS X 、 Linux   github专门为程序员推出的一个跨平台文本编辑器
+    GEANY  C、CPP、Java、Python、PHP、 HTML、 DocBook、 Perl、 LateX 和 Bash脚本  http://www.geany.org/   Windows、Mac OS X 、 Linux   一个小巧的使用GTK+2开发的跨平台的开源集成开发环境
+    JEDIT  All  http://www.jedit.org/   Windows、Mac OS X 、 Linux   一个用Java语言开发的文本编辑器
+    VIM  All  http://www.vim.org/   Windows、Mac OS X 、 Linux   一个类似于Vi的著名的功能强大、高度可定制的文本编辑器
+    PSPAD  All  http://www.pspad.com/en/  Windows  功能非常强大的代码浏览器
+    komodo-ide  Python、Perl、PHP 、Ruby  https://www.activestate.com/komodo-ide   Windows、Mac OS X 、 Linux   一个独特的特性是常规表达式调试器
+
+商业代码审计工具  在源代码的静态安全审计中、使用自动化工具代替人工漏洞挖掘、可以显著提高审计工作的效率。学会利用自动化代码审计工具、是每一个代码审计人员必备的能力。Fortify SCA  Java、JSP、ASP.NET、C#、VB.NET、C、C++、COBOL、ColdFusion  https://www.fortify.com   Windows、Mac OS X 、 Linux   是一个静态的、白盒的软件源代码安全测试工具
+    Checkmarx CxSuite  JAVA、ASP.NET（C#、VB.NET）、JavaScript、Jscript、C、C++、APEX等语言  http://www.dumasoftware.com/corporate01.asp   Windows、Mac OS X 、 Linux   一个独特的源代码分析解决方案
+    360代码卫士  C、C++、C#、Objective-C、Java、JSP、JavaScript、PHP、Python、Cobol等  http://b.360.cn/codesafe/intro.html   Windows、Mac OS X 、 Linux   360企业安全集团基于多年源代码安全实践经验开发的新一代源代码安全检测系统
+    RIPS  PHP  https://sourceforge.net/projects/rips-scanner/   Windows、Mac OS X 、 Linux   PHP代码审计系统
+    VCG（VisualCodeGrepper）  C、C++、C#、VB、PHP、Java、PL、SQL  http://downloads.informer.com/visualcodegrepper/   Windows、Mac OS X 、 Linux   免费代码安全审计工具
+    blackduck（protex、Codecenter、和Export）  All  https://www.blackducksoftware.com/   Windows、Mac OS X 、 Linux   是一款对源代码进行扫描、审计和代码管理的软件工具。
+
+代码扫描工具  静态源代码检查工具，能对源代码进行全面的分析  Coverity Prevent  C、C++、C#、JAVA  http://www.coverity.com/index.html   Windows、Mac OS X 、 Linux   开发测试领域的领导者
+    Rational Purify  C、C++、Java  http://www-01.ibm.com/software/awdtools/purify/  Windows  是一个面向VC, VB或者Java开发的测试Visual C/C++ 和Java 代码中与内存有关的错误，确保整个应用程序的质量和可靠性
+    pc-lint  C、C++  http://www.gimpel.com/html/pcl.htm   Windows  GIMPEL SOFTWARE公司开发的C/C++软件代码静态分析工具
+    Cppcheck  C、C++  http://cppcheck.sourceforge.net/   Windows、Mac OS X    一种C/C++代码缺陷静态检查工具
+    Klocwork Insight  C、C++ 、Java  http://www.klocwork.com/products/insight.asp   Windows、 Linux   使用高度的解析手法（Truepath™）让到现在为止的调试和测试方法很难检测出来的错误在早期可以检出，使软件的信赖性提高并提高测试的效率
+    PolySpace  Client/Server  C、C++  http://www.mathworks.cn/   Windows、Mac OS X    可以识别 C 和 C++ 代码中的运行时错误、并发问题、安全漏洞和其他缺陷
+    cqual  C、C++  http://www.cs.umd.edu/~jfoster/cqual/   Windows、Mac OS X 、 Linux   一种基于类型的分析工具，它为指定和检查C程序的属性提供了一种轻量级的实用机制
+    ITS4  C\C++  http://www.cigital.com/its4/   Windows  一个静态检测源代码的工具，它是基于词法分析的
+    flawfinder  C、C++  http://www.dwheeler.com/flawfinder/   Windows、Mac OS X 、 Linux   应用在代码是否有漏洞，是否存在被攻击的可能。
+    Splint  C  http://www.splint.org/   Windows  应用在分析代码是否符合编程规范
+    MOPS  C  http://www.cs.berkeley.edu/~daw/mops/  Unix  是在C程序中查找安全漏洞并验证是否符合防御性编程规则的工具
+    BLAST  C  http://mtc.epfl.ch/software-tools/blast/   Windows、 Linux   C程序的软件模型检查器
+    Frama-C  C  http://frama-c.cea.fr/   Windows、Mac OS X 、 Linux   一个用来分析 C 代码的工具，它收集了很多静态统计技术
+    FindBugs  Java  http://findbugs.sourceforge.net/   Windows、Mac OS X 、 Linux   一个静态分析工具，它检查类或者 JAR 文件
+    Checkstyle  Java  http://checkstyle.sourceforge.net/   Windows、Mac OS X 、 Linux   SourceForge下的一个项目，提供了一个帮助JAVA开发人员遵守某些编码规范的工具
+     Eclipse-Jtest  Java  http://www.parasoft.com/jsp/cn/support.jsp   Windows、Mac OS X 、 Linux   一款优秀的 Java 代码优化和测试工具
+    PMD  Java  http://pmd.sourceforge.net/   Windows、Mac OS X 、 Linux   一种开源分析Java代码错误的工具
+    QJ-Pro  Java  http://qjpro.sourceforge.net/   Windows、Mac OS X 、 Linux   一个全面的软件检测工具
+    Jint  Java  http://artho.com/jlint/   Windows  通过进行数据流分析和构建锁图来检查您的Java代码并发现错误
+    Hammurapi  Java  http://www.hammurapi.biz/hammurapi-biz/ef/xmenu/hammurapi-group/index.html   Windows、Mac OS X 、 Linux   一个开源的代码审查/评审(review)工具
+    Dependency Finder  Java  http://depfind.sourceforge.net/   Windows、Mac OS X 、 Linux   一个java依赖分析工具
+    Classycle  Java  http://classycle.sourceforge.net/   Windows  可以分析静态类和Java应用程序或库的包依赖性，生成XML报表
+    JDepend  Java  http://www.clarkware.com/software/JDepend.html   Windows、Mac OS X 、 Linux   一个开放源代码的可以用来评价Java程序质量的优秀工具
+    LAPSE  Java  http://www.owasp.org/index.php/Category:OWASP_LAPSE_Project   Windows、Mac OS X 、 Linux   向开发人员和审计人员提供一种用于检测Java EE应用程序中的漏洞的工具
+    JSLint  JavaScript  http://www.jslint.com/   Windows、Mac OS X 、 Linux   基于Web的验证JavaScript错误代码的工具
+    J3Unit  JavaScript  http://j3unit.sourceforge.net/   Windows、Mac OS X 、 Linux   一个面向对象的JavaScript单元测试框架
+    JSHint  JavaScript  http://jshint.com/   Windows、Mac OS X 、 Linux   JSLint的一个更加灵活，可配置的一个版本
+    JSCS  JavaScript  http://jscs.info/   Windows、Mac OS X 、 Linux   一个代码风格检查器
+    ESLint  JavaScript  http://eslint.org/   Windows、Mac OS X 、 Linux   易于拓展的，具有大量的自定义规则，并且很容易通过插件的形式来安装
+    Regular Expression Tool  JavaScript  http://erik.eae.net/playground/regexp/regexp.html   Windows、Mac OS X 、 Linux   一款在线工具，用来测试您的正则表达式代码是否正确
+    JSLitmus  JavaScript  http://broofa.com/Tools/JSLitmus/   Windows、Mac OS X 、 Linux   是款轻量级的工具，用来测试JavaScript执行性能情况，采用直观的API
+    JavaScript Regular Expression Tester  JavaScript  http://broofa.com/Tools/JSLitmus/   Windows、Mac OS X 、 Linux   是在浏览器中使用JavaScript来测试JavaScript正则表达式的
+    Exakat  PHP  https://www.exakat.io/  Mac OS X   提供从PHP 5.2到PHP 7.2-dev的实时PHP静态分析器
+    PHPSecurityScanner  PHP  https://sourceforge.net/projects/securityscanner/   Linux   扫描PHP代码中是否有存在漏洞
+    PHPMD  PHP  https://phpmd.org/   Windows、Mac OS X 、 Linux   探测PHP源代码中一些潜在的问题
+    PHPStan  PHP  https://packagist.org/packages/phpstan/phpstan   Windows、Mac OS X 、 Linux   一款 PHP 静态分析工具，它专注于在代码中发现错误而不实际运行它
+    PhpSecInfo  PHP  http://phpsec.org/projects/phpsecinfo/   Windows、Mac OS X 、 Linux   相当于phpinfo（）函数，它报告有关PHP环境的安全信息
+    StyleCop  C#  http://stylecop.codeplex.com/releases/view/79972   Windows  微软的一个开源的静态代码分析工具,检查c#代码一致性和编码风格
+    FxCop  C#  https://msdn.microsoft.com/library/bb429476   Windows  微软的代码分析工具，以微软内部使用的.NET编码规范为参照，找出源代码中潜在的设计和编写缺陷
+    PyChecker  Python  http://pychecker.sourceforge.net/  Linux  Python代码的静态分析工具
+    Pylint  Python  https://www.pylint.org/   Windows、Mac OS X 、 Linux   一个高阶的Python代码分析工具
+    Bandit  Python  https://wiki.openstack.org/wiki/Security/Projects/Bandit   Windows、Mac OS X 、 Linux   一款Python源码分析框架，可用于Python代码的安全性分析
+
+反编译工具  高级语言源程序经过编译变成可执行文件，反编译就是逆过程。jd-gui  Java  http://jd.benow.ca/   Windows、Mac OS X 、 Linux   一个用 C++ 开发的 Java 反编译工具
+    Eclips-Jadclipse  Java  http://sourceforge.net/projects/jadclipse/   Windows、Mac OS X 、 Linux   Jad的Eclipse插件，是一款非常实用而且方便地Java反编译插件
+    jad  Java  http://varaneckas.com/jad/   Windows、Mac OS X 、 Linux   一款使用非常广泛地Java反编译工具
+    jdec  Java  http://jdec.sourceforge.net/   Windows、Mac OS X 、 Linux   一个Java反编译器
+    uuDeJava  Java  http://www.uuware.com/uudejava_cn.htm   Windows、Mac OS X 、 Linux   Java Class文件的反编译工具
+    Minjava  Java  https://code.google.com/p/minjava/   Windows、Mac OS X 、 Linux   一个 Java 反向工程软件
+    Java Decompiler  Java  http://jd.benow.ca/   Windows、Mac OS X 、 Linux   一个Java反编译器
+    Reflector  C#  http://www.red-gate.com/products/dotnet-development/reflector/   Windows、Mac OS X  可将·NET程序集中的中间语言反编译成C#或者Visual Basic代码
+    ILSpy  C#  http://ilspy.NET/   Windows、Mac OS X  一个开源的.net反编译软件，使用十分方便
+    dnSpy  C#  https://github.com/0xd4d/dnSpy/blame/master/dnSpy.sln   Windows、Mac OS X  .net反编译工具
+    JetBrains dotPeek  C#  http://www.jetbrains.com/decompiler/  Windows  .NET反编译工具
+    Telerik JustDecompile   C#  http://www.telerik.com/products/decompiler.aspx  Windows  一款非常实用的.net反编译工具
+    Retargetable Decompiler  C、pyhton  https://retdec.com/  Windows  一个可重定位的反编译器
+    Easy Python Decompiler  pyhton  https://sourceforge.net/projects/easypythondecompiler/files/?source=navbar  Windows  python字节码反编译器，反编译pyc＆pyo文件
+    uncompyle2  pyhton2.7  https://github.com/Mysterie/uncompyle2  Windows  Python 2.7的反编译工具
+    exescope  C++  http://www.softpedia.com/get/Programming/File-Editors/eXeScope.shtml  Windows  能在没有资源文件的情况下分析，显示不同的信息，重写可执行文件的资源
+  
+  C、C++通过编译把文本形式源代码翻译为机器语言形式的目标文件的，再通过链接把目标文件、操作系统的启动代码和用到的库文件进行组织，形成最终生成可执行代码。OllyDBG  C、C++  http://www.ollydbg.de/  Windows  一个新的动态追踪工具
+    c32asm  C、C++  http://www.c32asm.com/  Windows  具有反汇编模式和十六进制编辑模式，能跟踪exe文件的断点，也可直接修改软件内部代码。
+    W32Dasm  C、C++  http://www.softpedia.com/get/Programming/Debuggers-Decompilers-Dissasemblers/WDASM.shtml  Windows  一个静态反汇编工具，也是破解人常用的工具之一
+    Hex Rays Ida  C、C++  https://www.hex-rays.com/   Windows、Mac OS X 、 Linux   一款调试工具的模拟器，可以更好的反汇编和更有深层分析
\ No newline at end of file