fix(scope): add_task_scope 支持 host:port 目标,入库前剥端口

ip/root_domain/subdomain 三类范围入库前统一 stripHostPort:
- ip 带端口(如 10.0.188.136:3000)之前直接报"无效 ip/cidr"
- 域名带端口更隐蔽,不报错却存下匹配不到资产的垃圾键

Co-Authored-By: Claude Opus 4.8 <[email protected]>

db/task_scope.go

@@ -22,6 +22,19 @@ type TaskScope struct {
 	Reason    string `json:"reason,omitempty"`
 }
 
+// stripHostPort drops a trailing :port from a host:port / ip:port / [ipv6]:port
+// value, returning the bare host. Bare hosts, bare IPs (v4 or v6, whose colons make
+// them ambiguous), and anything not in host:port form are returned unchanged. Scope
+// is host/net based, so the port from a target like "10.0.188.136:3000" or
+// "api.example.com:8080" is simply discarded rather than baked into the key.
+func stripHostPort(v string) string {
+	v = strings.TrimSpace(v)
+	if host, _, err := net.SplitHostPort(v); err == nil {
+		return host
+	}
+	return v
+}
+
 // ipToHostCIDR turns a bare IP into its single-host CIDR (/32 or /128). "" if invalid.
 func ipToHostCIDR(ip string) string {
 	ip = strings.TrimSpace(ip)
@@ -132,7 +145,7 @@ func (s *AssetStore) AddAgentScope(taskID int64, kind, value, reason string) (Ta
 		}
 		ts.CompanyID = &comp.ID
 	case "root_domain":
-		d := DomainKey(value)
+		d := DomainKey(stripHostPort(value))
 		root, _ := RootDomain(d)
 		if root == "" {
 			root = d
@@ -142,7 +155,7 @@ func (s *AssetStore) AddAgentScope(taskID int64, kind, value, reason string) (Ta
 		}
 		ts.Domain = root
 	case "subdomain":
-		d := DomainKey(value)
+		d := DomainKey(stripHostPort(value))
 		if d == "" {
 			return ts, fmt.Errorf("无效子域: %s", value)
 		}
@@ -150,7 +163,7 @@ func (s *AssetStore) AddAgentScope(taskID int64, kind, value, reason string) (Ta
 	case "ip", "cidr":
 		v := value
 		if !strings.Contains(v, "/") {
-			v = ipToHostCIDR(v)
+			v = ipToHostCIDR(stripHostPort(v))
 			ts.Kind = "ip"
 		} else {
 			ts.Kind = "cidr"