[WuShang-d]

What this adds

Add SegScope · 使用痕迹分析 as a built-in CasOS marketplace application, with its source in apps/segscope-viz, Docker/Helm packaging, and an image build workflow. The app connects to an authorized Linux lab machine over SSH, uploads fixed scripts, reports progress, retrieves validated result files, and displays the analysis in simple or professional views.

This application is based on SegScope. Selected upstream sources are pinned to 32d6885b0bc8c0ab2f79c207cdfba056e8ae055d; the MIT license, per-file hashes and attribution are retained. The UI, bounded runners, SSH job controller and result parsers are additions. The short runs use different parameters from the upstream research experiments.

• E1: sandboxed browser capture for four public websites, with a held-out classification report and confusion matrix.
• E3: short prefetch measurement with all 512 candidates; no privileged ground-truth reads.
• E4: the original LLVM plugin on a lightweight benchmark, comparing runtime and size. No kernel module or active-interrupt experiment.
• E2: existing-file analysis only; automatic execution remains disabled.
• The home breadcrumb and header name return to the connection page from project details or professional mode, retaining existing results. An in-flight connection probe cannot navigate the user away again after returning home.
• Address history stays in the current browser, with a delete button beside each address. Accounts, passwords and private keys are not stored in this history.
• Fix switching from a completed website check to another project: task state is scoped to its experiment and job ID, and completion rendering requires an actual matching result. Previously the transition could read undefined.metadata and blank the page.

Packaging

The runtime image is non-root, supports a read-only root filesystem and persists jobs in /data. The marketplace template requires an actual published image address. The workflow builds PRs without publishing and publishes an amd64 GHCR image on related default-branch changes; maintainers will need to confirm package visibility after the first publication. This PR does not claim the image is already public or the app already listed.

Validation

• go build ./... and go vet ./... for CasOS.
• Real CasOS built-in template loader: metadata, required image and four Kubernetes objects loaded successfully.
• App Go build/vet, production frontend build, pinned runner hash verification, parser/address-history checks, Helm lint and rendering.
• Browser regression: completed E1 → E2 → E3 → E4 → E1 and back to home; address creation, selection, deletion and refresh; breadcrumb and header navigation back to the connection page.
• Real bounded E1/E3/E4 execution on an authorized Linux host; cancellation, changed SSH identity and result transfer checks.
• amd64 image started under containerd as UID65532 with read-only root, writable job data and default capabilities removed.

Screenshots

Screenshots are committed in apps/segscope-viz/docs/images. The website result is from an actual short run and is not a paper result; the address in the history screenshot is a documentation-only example.