update PLUGINS

DATA/SYSTEM/ANALYSIS/System.md

@@ -10,12 +10,13 @@ Schema 的调查报告。
 
 输入格式：
 
-HumanMessage 是一个紧凑 JSON 对象，顶层有三个字段：`knowledge`、`case` 和 `discussions`。
+HumanMessage 是一个紧凑 JSON 对象，顶层有三个必选字段：`knowledge`、`case` 和 `discussions`，以及一个可选字段 `user_input`。
 
 - `case` 是当前需要研判的主要对象。
 - `knowledge.records` 是分析前检索到的内部知识补充。每条记录可能包含 `id`、`row_id`、`title`、`source`、`tags`、`expires_at` 和 `body`。`body` 字段可能包含 Markdown 内容；这些 Markdown 只属于该条知识记录本身。
 - `knowledge.keywords` 是根据当前 Case 生成、用于检索这些知识记录的搜索关键词。
 - `discussions` 是分析员在案件上的评论和回复列表。每条包含 `message`（评论文本）、`created_at`、`created_by`（作者）、`reply_to_author`、`mentions`（被提及的用户列表）和 `attachments`（附件列表，含 `filename`、`ext`、`filesize`、`download_url`）。将 discussions 作为补充上下文——可能包含分析员假设、手动标注的 IOC、误报理由或结构化字段中未捕获的操作备注。
+- `user_input`（可选）是分析师触发 Playbook 时提供的额外指引。如果存在，请结合用户输入来调整分析重点 — 它可能包含关注的特定指标、补充背景或分析师的初步假设。
 
 Knowledge 可能包含 Case 中不可直接看到的内部上下文，例如资产角色、负责人、业务重要性、测试 IP、蜜罐、白名单、已知良性行为、策略、SOP 或响应处置建议。当 Knowledge 有助于解释 Case 或会改变研判结论时，应使用相关 Knowledge；不要把无关 Knowledge 强行写入报告。
 

DATA/SYSTEM/ANALYSIS/System_EN.md

@@ -9,12 +9,13 @@ Your role is not to restate the raw fields, but to form a case judgment based on
 
 Input format:
 
-The human message is a compact JSON object with three top-level fields: `knowledge`, `case`, and `discussions`.
+The human message is a compact JSON object with three required top-level fields: `knowledge`, `case`, and `discussions`. An optional fourth field `user_input` may also be present.
 
 - `case` is the primary investigation object.
 - `knowledge.records` contains supplemental internal knowledge retrieved before analysis. Each record may include `id`, `row_id`, `title`, `source`, `tags`, `expires_at`, and `body`. The `body` field may contain Markdown content; treat it as the content of that knowledge record.
 - `knowledge.keywords` contains the search keywords generated from the current Case and used to retrieve the knowledge records.
 - `discussions` is a list of analyst comments and replies on the case. Each item contains `message` (comment text), `created_at`, `created_by` (author name), `reply_to_author`, `mentions` (list of mentioned user names), and `attachments` (list of file attachments with `filename`, `ext`, `filesize`, `download_url`). Use discussions as supplementary context — they may contain analyst hypotheses, manually noted IOCs, false positive rationale, or operational notes not captured in structured fields.
+- `user_input` (optional) is additional guidance provided by the analyst when triggering the playbook. If present, use it to inform your analysis — it may specify indicators of interest, supplementary context, or the analyst's initial hypothesis.
 
 Knowledge may include internal context not directly visible in the Case, such as asset role, owner, business criticality, test IPs, honeypots, whitelists, known benign behavior, policy, SOP, or response guidance. Use relevant Knowledge when it helps interpret the Case or changes the assessment. Do not force unrelated Knowledge into the report.
 

PLAYBOOKS/Investigation.py

@@ -32,7 +32,8 @@ class Playbook(BasePlaybook):
         knowledge_keywords = extract_knowledge_keywords(case_json)
         knowledge_records = search_knowledge_records(knowledge_keywords)
         discussions = Case.get_discussions_by_row_id(case_row_id) or []
-        analysis_input_json = build_analysis_input_json(case_json, knowledge_keywords, knowledge_records, discussions)
+        user_input = self.param_user_input or ""
+        analysis_input_json = build_analysis_input_json(case_json, knowledge_keywords, knowledge_records, discussions, user_input)
         report = generate_investigation_report(analysis_input_json)
         analysis_record = build_analysis_record(
             trigger=trigger,

PLUGINS/SIRP/analysis.py

@@ -150,7 +150,7 @@ def search_knowledge_records(keywords: List[str]) -> List[dict[str, Any]]:
 
 
 def build_analysis_input_json(case_json: str, knowledge_keywords: List[str], knowledge_records: List[dict[str, Any]],
-                              discussions: List[dict[str, Any]] | None = None) -> str:
+                              discussions: List[dict[str, Any]] | None = None, user_input: str = "") -> str:
     try:
         case_data = json.loads(case_json)
     except json.JSONDecodeError:
@@ -164,6 +164,8 @@ def build_analysis_input_json(case_json: str, knowledge_keywords: List[str], kno
         "case": case_data,
         "discussions": discussions or [],
     }
+    if user_input:
+        payload["user_input"] = user_input
     analysis_input_json = json.dumps(payload, ensure_ascii=False, separators=(",", ":"))
     estimated_tokens = len(analysis_input_json) // 3
     logger.info(