fix: harden runtime lifecycle and input handling

.github/workflows/ci.yaml

@@ -19,11 +19,16 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.24.13"
+          go-version: "1.25.0"
           cache: false
+
+      - name: Show Go version
+        run: go version
 
-      - name: Go mod tidy
-        run: go mod tidy
+      - name: Verify Go module files
+        run: |
+          go mod tidy
+          git diff --exit-code -- go.mod go.sum
 
       - name: Install embedded build assets
         run: go run ./scripts/pre_install.go
@@ -50,21 +55,34 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.24.13"
+          go-version: "1.25.0"
           cache: false
+
+      - name: Show Go version
+        run: go version
 
-      - name: Go mod tidy
-        run: go mod tidy
+      - name: Verify Go module files
+        run: |
+          go mod tidy
+          git diff --exit-code -- go.mod go.sum
 
       - name: Install embedded build assets
         run: go run ./scripts/pre_install.go
 
-      - name: Race detection — core, parser, stream
+      - name: Race detection — client, core, parser, RPC, listener, stream
         run: >-
-          go test -race -count=1 -timeout 300s
-          ./server/internal/core
-          ./server/internal/parser/...
-          ./server/internal/stream
+          go test -race -count=1 -timeout 300s
+          ./client/core/...
+          ./server/internal/core
+          ./server/internal/parser/...
+          ./server/internal/stream
+          ./server/listener
+          ./server/rpc
+
+      - name: Parser fuzz smoke tests
+        run: |
+          go test ./server/internal/parser/malefic -run=^$ -fuzz=^FuzzMaleficParserReadHeader$ -fuzztime=5s
+          go test ./server/internal/parser/malefic -run=^$ -fuzz=^FuzzMaleficParserParse$ -fuzztime=5s
 
   mock_implant:
     runs-on: ubuntu-22.04
@@ -77,11 +95,16 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.24.13"
+          go-version: "1.25.0"
           cache: false
+
+      - name: Show Go version
+        run: go version
 
-      - name: Go mod tidy
-        run: go mod tidy
+      - name: Verify Go module files
+        run: |
+          go mod tidy
+          git diff --exit-code -- go.mod go.sum
 
       - name: Install embedded build assets
         run: go run ./scripts/pre_install.go
@@ -107,11 +130,16 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.24.13"
+          go-version: "1.25.0"
           cache: false
+
+      - name: Show Go version
+        run: go version
 
-      - name: Go mod tidy
-        run: go mod tidy
+      - name: Verify Go module files
+        run: |
+          go mod tidy
+          git diff --exit-code -- go.mod go.sum
 
       - name: Install embedded build assets
         run: go run ./scripts/pre_install.go

.github/workflows/nightly.yaml

@@ -23,7 +23,10 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.24.13"
+          go-version: "1.25.0"
+
+      - name: Show Go version
+        run: go version
 
       - name: Configure Git
         run: |

.github/workflows/realimplant.yaml

@@ -22,9 +22,12 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.24.13"
+          go-version: "1.25.0"
           cache: false
 
+      - name: Show Go version
+        run: go version
+
       - name: Validate real implant environment
         shell: pwsh
         run: |
@@ -38,6 +41,9 @@ jobs:
       - name: Go mod tidy
         run: go mod tidy
 
+      - name: Verify Go module files
+        run: git diff --exit-code -- go.mod go.sum
+
       - name: Real implant E2E tests
         shell: pwsh
         run: |

.github/workflows/releaser.yaml

@@ -24,8 +24,10 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.24.13"
-      - run: go version
+          go-version: "1.25.0"
+
+      - name: Show Go version
+        run: go version
 
       - name: Configure Git
         run: |
@@ -75,4 +77,3 @@ jobs:
             dist/vsix/iom.vsix
         env:
           GITHUB_TOKEN: ${{ secrets.PAT_TOKEN }}
-

.github/workflows/update-search-index.yaml

@@ -53,9 +53,12 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.24.13"
+          go-version: "1.25.0"
           cache: false
 
+      - name: Show Go version
+        run: go version
+
       - name: Update community submodule to latest
         run: |
           git config --global url."https://${{ secrets.PAT_TOKEN }}@github.com/".insteadOf "https://github.com/"

client/command/build/artifact_command_test.go

@@ -48,12 +48,16 @@ func TestArtifactPublishAddsWebsiteContent(t *testing.T) {
 	}
 
 	calls := h.Recorder.Calls()
-	if len(calls) != 1 || calls[0].Method != "AddWebsiteContent" {
+	if len(calls) != 2 || calls[0].Method != "DownloadArtifact" || calls[1].Method != "AddWebsiteContent" {
 		t.Fatalf("calls = %#v", calls)
 	}
-	add := calls[0].Request.(*clientpb.Website)
+	download := calls[0].Request.(*clientpb.Artifact)
+	if download.Name != "demo-artifact" {
+		t.Fatalf("download artifact request = %#v", download)
+	}
+	add := calls[1].Request.(*clientpb.Website)
 	content := add.Contents["/payload.bin"]
-	if add.Name != "site-a" || content == nil || content.GetType() != consts.ArtifactWebcontent || content.GetFile() != "demo-artifact" {
+	if add.Name != "site-a" || content == nil || string(content.Content) != "artifact-bin" {
 		t.Fatalf("add website content request = %#v", add)
 	}
 }

client/command/build/commands.go

@@ -630,13 +630,13 @@ artifact prune --failed --older-than 720h
 func Register(con *core.Console) {
 	// EventCallback requires initialized Server; skip in doc-gen mode (genlua)
 	if con.Server != nil {
-		con.EventCallback[consts.CtrlArtifactDownload] = func(event *clientpb.Event) {
+		con.SetEventCallback(consts.CtrlArtifactDownload, func(event *clientpb.Event) {
 			err := WriteOriginArtifact(con, event.Job.Name)
 			if err != nil {
 				con.Log.Errorf("write artifact %s error: %s", event.Job.Name, err)
 				return
 			}
-		}
+		})
 	}
 	con.RegisterServerFunc("search_artifact",
 		SearchArtifact,

client/command/implant.go

@@ -105,10 +105,11 @@ func makeRunners(implantCmd *cobra.Command, con *core.Console) (pre, post func(c
 			return nil
 		}
 		sid, _ := cmd.Flags().GetString("use")
-		if sid == "" && con.ActiveTarget.Session == nil {
+		activeSession := con.ActiveTarget.Get()
+		if sid == "" && activeSession == nil {
 			return fmt.Errorf("no implant to run command on")
-		} else if sid == "" && con.ActiveTarget.Session != nil {
-			sid = con.ActiveTarget.Session.SessionId
+		} else if sid == "" {
+			sid = activeSession.SessionId
 		}
 
 		var session *client.Session

client/command/listener/pipeline_integration_test.go

@@ -87,9 +87,9 @@ func TestStopPipelineCmdUsesDatabaseResolution(t *testing.T) {
 	}
 
 	testsupport.WaitForCondition(t, 5*time.Second, func() bool {
-		_, ok := clientHarness.Console.Pipelines["tcp-stop"]
-		return !ok
-	}, "client pipeline cache to remove stopped pipeline")
+		pipeline, err := clientHarness.Console.FindCachedPipeline("tcp-stop", nil)
+		return err == nil && !pipeline.GetEnable()
+	}, "client pipeline cache to retain stopped pipeline as disabled")
 
 	model, err := h.GetPipeline("tcp-stop", h.ListenerID())
 	if err != nil {

client/command/website/webcontent.go

@@ -2,14 +2,15 @@ package website
 
 import (
 	"errors"
-	"github.com/chainreactors/IoM-go/consts"
+
 	"github.com/chainreactors/IoM-go/proto/client/clientpb"
 	"github.com/chainreactors/malice-network/client/core"
+	"github.com/chainreactors/malice-network/helper/utils/fileutils"
+	"github.com/chainreactors/malice-network/helper/utils/output"
 	"github.com/chainreactors/malice-network/helper/utils/pe"
 	"github.com/chainreactors/tui"
 	"github.com/evertras/bubble-table/table"
 	"github.com/spf13/cobra"
-	"net/url"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -235,30 +236,24 @@ func AddArtifactContentCmd(cmd *cobra.Command, con *core.Console) error {
 
 func AddArtifactContent(con *core.Console, artifactName, websiteName, format, rdi, webPath, contentType, name, comment, auth string) (*clientpb.WebContent, error) {
 	rpcFormat := normalizeArtifactContentFormat(format)
+	artifact, err := con.Rpc.DownloadArtifact(con.Context(), &clientpb.Artifact{
+		Name:   artifactName,
+		Format: rpcFormat,
+		Rdi:    rdi,
+	})
+	if err != nil {
+		return nil, err
+	}
+	if len(artifact.Bin) == 0 {
+		return nil, errors.New("artifact maybe not download in server")
+	}
 	if name == "" {
 		name = artifactName
 	}
-
-	resolvedWebsite, listenerID, _ := resolveWebsiteTarget(con, websiteName)
-	website := &clientpb.Website{
-		Name:       resolvedWebsite,
-		ListenerId: listenerID,
-		Contents: map[string]*clientpb.WebContent{
-			webPath: {
-				WebsiteId:   resolvedWebsite,
-				ListenerId:  listenerID,
-				File:        artifactName,
-				Path:        webPath,
-				Type:        consts.ArtifactWebcontent,
-				Url:         artifactContentOptions(rpcFormat, rdi),
-				ContentType: contentType,
-				Name:        name,
-				Comment:     comment,
-				Auth:        auth,
-			},
-		},
+	if webPath == "" {
+		webPath = defaultArtifactWebPath(artifact, artifactName, rpcFormat)
 	}
-	return con.Rpc.AddWebsiteContent(con.Context(), website)
+	return AddWebContentData(con, websiteName, artifact.Bin, webPath, contentType, name, comment, auth)
 }
 
 func normalizeArtifactContentFormat(format string) string {
@@ -268,15 +263,25 @@ func normalizeArtifactContentFormat(format string) string {
 	return format
 }
 
-func artifactContentOptions(format, rdi string) string {
-	values := url.Values{}
-	if format != "" {
-		values.Set("format", format)
+func defaultArtifactWebPath(artifact *clientpb.Artifact, fallbackName, format string) string {
+	name := artifact.GetName()
+	if name == "" {
+		name = fallbackName
+	}
+	ext := artifact.GetFormat()
+	if f, ok := output.SupportedFormats[strings.ToLower(format)]; ok && f.Extension != "" {
+		ext = f.Extension
+	}
+	if ext == "" {
+		ext, _ = fileutils.GetExtensionByBytes(artifact.GetBin())
+	}
+	if ext != "" && !strings.HasPrefix(ext, ".") {
+		ext = "." + ext
 	}
-	if rdi != "" {
-		values.Set("rdi", rdi)
+	if ext != "" && strings.HasSuffix(strings.ToLower(name), strings.ToLower(ext)) {
+		ext = ""
 	}
-	return values.Encode()
+	return "/" + name + ext
 }
 
 // RemoveWebContentCmd - 删除网站内容