@kenhkl/agent-moss 0.13.0 → 0.14.0

package/dist/cli.js

@@ -633,7 +633,7 @@ function loadMC() {
   try {
     const rt = (init_runtime_config(), __toCommonJS(runtime_config_exports));
     if (rules.length > 0 && typeof rt.hasRuntimeConfig === "function" && rt.hasRuntimeConfig()) {
-      const rtRules = rt.loadRuntimeConfig()?.L2_4?.ltl_rules?.rules || [];
+      const rtRules = rt.loadRuntimeConfig()?.L2_2?.ltl_rules?.rules || [];
       const enabledById = {};
       for (const r of rtRules) if (r?.id) enabledById[r.id] = r.enabled !== false;
       for (const r of rules) if (r?.id && r.id in enabledById) r.enabled = enabledById[r.id];
@@ -681,7 +681,8 @@ function _loadSensitivePathScope(scope) {
     path: sp.path,
     riskLevel: sp.risk_level,
     desc: sp.desc,
-    credential: sp.deny_mode === "deny_both" ? true : void 0
+    credential: sp.deny_mode === "deny_both" ? true : void 0,
+    dirDelOnly: sp.dir_del_only === true ? true : void 0
   }));
 }
 function isWriteOperation(actionType, actionDetail, writeKeywords = WRITE_KEYWORDS) {
@@ -779,7 +780,7 @@ function runLogicCheck(input) {
             riskType: "intent_deviation",
             confidence: 85,
             source: "logic_rule",
-            violatedLayers: ["2"]
+            violatedLayers: ["L2.1"]
           };
         }
       }
@@ -803,7 +804,7 @@ function runLogicCheck(input) {
           riskType: "privilege_escalation",
           confidence: 85,
           source: "logic_rule",
-          violatedLayers: ["2"]
+          violatedLayers: ["L2.1"]
         };
       }
     }
@@ -855,7 +856,7 @@ function checkComboChain(actionHistory, actionDetailRaw) {
         riskType: "combo_chain",
         confidence: 85,
         source: "logic_rule",
-        violatedLayers: ["2"]
+        violatedLayers: ["L2.1"]
       };
     }
   }
@@ -980,7 +981,7 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
       riskType: "read_before_write",
       confidence: 85,
       source: "logic_rule",
-      violatedLayers: ["2"]
+      violatedLayers: ["L2.1"]
     };
   }
   return null;
@@ -1000,7 +1001,7 @@ function checkPasswordConsent(actionType, actionDetail, actionHistory) {
     riskType: "consent_missing",
     confidence: 85,
     source: "logic_rule",
-    violatedLayers: ["2"]
+    violatedLayers: ["L2.1"]
   };
 }
 function checkUserDeletionConsent(actionType, actionDetail, actionHistory) {
@@ -1018,7 +1019,7 @@ function checkUserDeletionConsent(actionType, actionDetail, actionHistory) {
     riskType: "consent_missing",
     confidence: 85,
     source: "logic_rule",
-    violatedLayers: ["2"]
+    violatedLayers: ["L2.1"]
   };
 }
 function containsPrivilegeEscalation(actionDetail) {
@@ -1078,7 +1079,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
           riskType: "file_access",
           confidence: 95,
           source: "logic_rule",
-          violatedLayers: ["2"],
+          violatedLayers: ["L2.1"],
           isCredential: true
         };
       }
@@ -1094,7 +1095,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
             riskType: "file_access",
             confidence: 95,
             source: "logic_rule",
-            violatedLayers: ["2"]
+            violatedLayers: ["L2.1"]
           };
         }
       }
@@ -1108,7 +1109,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
     riskType: "file_access",
     confidence: 70,
     source: "logic_rule",
-    violatedLayers: ["2"]
+    violatedLayers: ["L2.1"]
   };
 }
 var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, WRITE_KEYWORDS, WRITE_COMMAND_RES, READ_ONLY_COMMANDS, DEVNULL_REDIRECT_RE, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
@@ -1120,7 +1121,7 @@ var init_logic_rules = __esm({
     init_rules_loader();
     ROOT_SENSITIVE_PATHS = _loadSensitivePathScope("root");
     HOME_SENSITIVE_PATHS = _loadSensitivePathScope("home");
-    CREDENTIAL_PATHS = _loadSensitivePathScope("credential").map(({ path: path6, riskLevel, desc }) => ({ path: path6, riskLevel, desc, credential: true }));
+    CREDENTIAL_PATHS = _loadSensitivePathScope("credential").map(({ path: path6, riskLevel, desc, dirDelOnly }) => ({ path: path6, riskLevel, desc, credential: true, dirDelOnly }));
     NON_WRITE_TOOLS = /* @__PURE__ */ new Set([
       "ask_user_question",
       "glob",
@@ -1471,7 +1472,7 @@ function emptyRuntimeConfig() {
     L1_rules: {},
     L2_rules: {},
     L3_skills: {},
-    L2_4: {},
+    L2_2: {},
     agent_rules: {},
     scenario_rules: {}
   };
@@ -1499,7 +1500,7 @@ function loadRuntimeConfig() {
       L1_rules: merged.L1_rules || {},
       L2_rules: merged.L2_rules || {},
       L3_skills: merged.L3_skills || {},
-      L2_4: merged.L2_4 || {},
+      L2_2: merged.L2_2 || {},
       agent_rules: merged.agent_rules || {},
       scenario_rules: merged.scenario_rules || {}
     };
@@ -1552,6 +1553,7 @@ function getEnabledL2SensitivePaths(runtime) {
     const out = { path: r.path || "", risk_level: r.risk_level || "", desc: r.desc || "", deny_mode: r.deny_mode || "deny_write" };
     if (r.credential) out.credential = true;
     if (r.read_only) out.read_only = true;
+    if (r.dir_del_only) out.dir_del_only = true;
     return out;
   });
 }
@@ -1660,6 +1662,7 @@ function _l2SensitivePathsToRules() {
       builtin: true
     };
     _syncDenyModeFields(rule);
+    if (sp.dirDelOnly) rule.dir_del_only = true;
     return rule;
   });
 }
@@ -1876,7 +1879,7 @@ function generateSourceDefaults() {
       user_custom: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49 L2 \u903B\u8F91\u89C4\u5219", rules: [] }
     },
     L3_skills: _l3SkillsToRules(),
-    L2_4: _ltlRulesToRuntime(),
+    L2_2: _ltlRulesToRuntime(),
     agent_rules: _agentRulesToDefaults(),
     scenario_rules: _scenarioRulesToDefaults()
   };
@@ -2064,7 +2067,11 @@ function mergeConfig(userCfg, srcDefaults) {
   );
   _mergeRuleCategories(cfg, srcDefaults, "L1_rules");
   _mergeRuleCategories(cfg, srcDefaults, "L2_rules");
-  _mergeRuleCategories(cfg, srcDefaults, "L2_4");
+  if (!cfg.L2_2 && cfg.L2_4) {
+    cfg.L2_2 = cfg.L2_4;
+    delete cfg.L2_4;
+  }
+  _mergeRuleCategories(cfg, srcDefaults, "L2_2");
   _mergeSkillCategories(cfg, srcDefaults, "L3_skills");
   _mergeAgentRules(cfg, srcDefaults);
   _mergeAgentRules(cfg, srcDefaults, "scenario_rules");
@@ -2684,7 +2691,7 @@ function runHeuristicCheck(input) {
             riskType: "sensitive_action",
             confidence: 90,
             source: "heuristic",
-            violatedLayers: ["1.1"]
+            violatedLayers: ["L1.1"]
           };
         }
       }
@@ -2694,8 +2701,10 @@ function runHeuristicCheck(input) {
   const scanDetail = normalizePathSegments(stripLiteralTextSegments(input.aNext.actionDetail));
   const scanCommand = `${input.aNext.actionType}: ${scanDetail}`;
   let topRiskType = "";
+  const exemptKeygen = isSshKeygenGenerate(input.aNext.actionDetail);
   for (const rule of DANGEROUS_PATTERNS) {
     if (rule.pattern.test(scanCommand)) {
+      if (exemptKeygen && rule.riskType === "file_access") continue;
       matched.push(rule.description);
       if (severityRank(rule.severity) > severityRank(highestSeverity)) {
         highestSeverity = rule.severity;
@@ -2737,10 +2746,26 @@ function runHeuristicCheck(input) {
   const detailL = input.aNext.actionDetail.toLowerCase();
   const isExcludedType = SENSITIVE_EXCLUDED_PREFIXES.some((p) => actionTypeL.startsWith(p));
   const dangerousResult = checkDangerousPatterns(actionTypeL, detailL);
-  if (dangerousResult) return dangerousResult;
-  if (!isExcludedType) {
-    const pathResult = checkSensitivePath(detailL, input.cwd || "/", agentExt);
-    if (pathResult) return pathResult;
+  const pathResult = isExcludedType ? null : checkSensitivePath(detailL, input.cwd || "/", agentExt);
+  const homeResult = checkHomeDeletion(actionTypeL, detailL);
+  const mergeResults = [dangerousResult, pathResult, homeResult].filter(Boolean);
+  if (mergeResults.length > 0) {
+    let best = mergeResults[0];
+    for (const r of mergeResults) {
+      if (severityRank(r.riskLevel) > severityRank(best.riskLevel)) best = r;
+    }
+    if (severityRank(highestSeverity) > severityRank(best.riskLevel)) {
+      return {
+        allowed: false,
+        reason: `\u68C0\u6D4B\u5230\u9AD8\u5371\u64CD\u4F5C: ${matched.join(", ")}`,
+        riskLevel: highestSeverity,
+        riskType: highestRiskType,
+        confidence: 95,
+        source: "heuristic",
+        violatedLayers: ["L1.1"]
+      };
+    }
+    return best;
   }
   if (matched.length > 0) {
     return {
@@ -2750,8 +2775,7 @@ function runHeuristicCheck(input) {
       riskType: highestRiskType,
       confidence: 95,
       source: "heuristic",
-      violatedLayers: ["1.1"]
-      // 对齐 py coordinator.py:165（L1.1 = 命中高危命令模式/注入关键词）
+      violatedLayers: ["L1.1"]
     };
   }
   const lateralResult = checkLateralMovement(detailL);
@@ -2879,6 +2903,7 @@ function isSearchActionType(actionType) {
 function checkSensitivePath(command, cwd, agentExt) {
   const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
   const isWriteOpFlag = isWriteOperation("", command);
+  const keygenGenerate = isSshKeygenGenerate(command);
   const pathScanText = normalizePathSegments(stripLiteralTextSegments(command));
   const pathMatches = (text, path6) => {
     const parts = path6.split(/(\(\?!.*?\))/);
@@ -2891,6 +2916,7 @@ function checkSensitivePath(command, cwd, agentExt) {
   };
   for (const sp of ROOT_SENSITIVE_PATHS) {
     if (pathMatches(pathScanText, sp.path.toLowerCase())) {
+      if (keygenGenerate) continue;
       if (sp.path === "/dev/random") {
         if (isWriteOpFlag) {
           continue;
@@ -2902,7 +2928,7 @@ function checkSensitivePath(command, cwd, agentExt) {
           riskType: "file_access",
           confidence: 90,
           source: "heuristic",
-          violatedLayers: ["1.1"]
+          violatedLayers: ["L1.1"]
         };
       }
       if (!isWriteOpFlag && !sp.credential) {
@@ -2915,16 +2941,51 @@ function checkSensitivePath(command, cwd, agentExt) {
         riskType: "file_access",
         confidence: 90,
         source: "heuristic",
-        violatedLayers: ["1.1"],
+        violatedLayers: ["L1.1"],
         isCredential: !!sp.credential
       };
     }
   }
   for (const sp of HOME_SENSITIVE_PATHS) {
     const expanded = `${expandedCwd}/${sp.path}`;
-    const pathRe = sp.path.endsWith(".pub") ? new RegExp(sp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i") : new RegExp(sp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "(?!\\.pub)", "i");
-    const expandedRe = sp.path.endsWith(".pub") ? new RegExp(expanded.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i") : new RegExp(expanded.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "(?!\\.pub)", "i");
-    if (pathRe.test(pathScanText) || expandedRe.test(pathScanText)) {
+    let pPath = sp.path;
+    if (!sp.path.endsWith(".pub")) pPath = `${sp.path}(?!\\.pub)`;
+    let dirPrefixMatch = null;
+    if (sp.dirDelOnly) {
+      const dirRe = (t) => new RegExp(`(?:^|[\\s/\\\\'"])${t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:/|[\\s'"\\\\]|$)`, "i");
+      dirPrefixMatch = dirRe(sp.path).test(pathScanText) || dirRe(expanded.toLowerCase()).test(pathScanText);
+    }
+    const pathReMatch = sp.dirDelOnly ? !!dirPrefixMatch : pathMatches(pathScanText, pPath);
+    const expandedReMatch = sp.dirDelOnly ? false : pathMatches(pathScanText, expanded + (sp.path.endsWith(".pub") ? "" : "(?!\\.pub)"));
+    if (pathReMatch || expandedReMatch) {
+      if (keygenGenerate) continue;
+      if (sp.dirDelOnly) {
+        if (isDeleteActionForDir(command, sp.path)) {
+          return {
+            allowed: false,
+            reason: `\u5220\u9664\u654F\u611F\u76EE\u5F55: ${sp.desc} (${sp.path})`,
+            riskLevel: sp.riskLevel,
+            riskType: "file_access",
+            confidence: 90,
+            source: "heuristic",
+            violatedLayers: ["L1.1"],
+            isCredential: !!sp.credential
+          };
+        }
+        if (isArchiveReadOfDir(command, sp.path)) {
+          return {
+            allowed: false,
+            reason: `\u5F52\u6863/\u590D\u5236\u8BFB\u53D6\u654F\u611F\u76EE\u5F55: ${sp.desc} (${sp.path})`,
+            riskLevel: sp.riskLevel,
+            riskType: "file_access",
+            confidence: 90,
+            source: "heuristic",
+            violatedLayers: ["L1.1"],
+            isCredential: !!sp.credential
+          };
+        }
+        continue;
+      }
       if (!isWriteOpFlag && !sp.credential) {
         continue;
       }
@@ -2935,7 +2996,7 @@ function checkSensitivePath(command, cwd, agentExt) {
         riskType: "file_access",
         confidence: 90,
         source: "heuristic",
-        violatedLayers: ["1.1"],
+        violatedLayers: ["L1.1"],
         isCredential: !!sp.credential
       };
     }
@@ -2958,7 +3019,7 @@ function checkSensitivePath(command, cwd, agentExt) {
           riskType: "file_access",
           confidence: 90,
           source: "heuristic",
-          violatedLayers: ["1.1"],
+          violatedLayers: ["L1.1"],
           isCredential: !!sp.credential
         };
       }
@@ -2975,7 +3036,7 @@ function checkSensitivePath(command, cwd, agentExt) {
         riskType: "file_access",
         confidence: 90,
         source: "heuristic",
-        violatedLayers: ["1.1"],
+        violatedLayers: ["L1.1"],
         isCredential: true
       };
     }
@@ -2988,18 +3049,142 @@ function checkSensitivePath(command, cwd, agentExt) {
       riskType: "file_access",
       confidence: 90,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
   return null;
 }
+function isHomeValue(path6) {
+  let p = path6.trim().toLowerCase();
+  if (p.startsWith("$(") && p.endsWith(")")) {
+    const inner = p.slice(2, -1).trim();
+    return HOME_TARGET_RE.test(" " + inner);
+  }
+  if (/^\/home\/[^/\s]+\/?$/.test(p)) return true;
+  return HOME_TARGET_RE.test(" " + p);
+}
+function isDeleteCommand(seg) {
+  const s = seg.trimStart();
+  if (/^(?:rm|rmdir|unlink)\b/i.test(s)) return true;
+  return /删除|移除/.test(s);
+}
+function homeEscapeTarget(seg) {
+  const low = seg.toLowerCase();
+  const re = /(?:~|(?:\$home|\$\{home\})|\/home\/[a-z0-9_.-]+)/g;
+  let m;
+  while ((m = re.exec(low)) !== null) {
+    const endIdx = m.index + m[0].length;
+    const tail = low.slice(endIdx);
+    if (!tail) continue;
+    let token = tail.trimStart().split(/\s+/)[0] || "";
+    token = token.split("&&")[0].split("||")[0].split(";")[0].replace(/\/+$/, "");
+    token = token.replace(/^['"]|['"]$/g, "");
+    const segments = token.split("/").filter((s) => s && s !== ".");
+    if (!segments.some((s) => s === "..")) continue;
+    let depth = 0;
+    let minDepth = 0;
+    for (const s of segments) {
+      depth += s === ".." ? -1 : 1;
+      minDepth = Math.min(minDepth, depth);
+    }
+    if (minDepth < 0) return true;
+    if (depth <= 0) return true;
+  }
+  return false;
+}
+function checkHomeDeletion(actionType, actionDetail) {
+  if (actionType !== "bash" && actionType !== "executebash" && actionType !== "terminal-executebash") return null;
+  const segs = actionDetail.split(/&&|\|\||;|\n/).map((s) => s.trim()).filter(Boolean);
+  for (const seg of segs) {
+    if (!isDeleteCommand(seg)) continue;
+    if (HOME_TARGET_RE.test(seg) || homeEscapeTarget(seg)) {
+      return {
+        allowed: false,
+        reason: "\u68C0\u6D4B\u5230\u5220\u9664\u4E3B\u76EE\u5F55 (~/$HOME) \u64CD\u4F5C",
+        riskLevel: "high",
+        riskType: "script_execution",
+        confidence: 90,
+        source: "heuristic",
+        violatedLayers: ["L1.1"]
+      };
+    }
+  }
+  const assigned = {};
+  for (const m of actionDetail.matchAll(HOME_ASSIGN_RE)) assigned[m[1]] = m[2];
+  for (const [varName, path6] of Object.entries(assigned)) {
+    if (!isHomeValue(path6)) continue;
+    const varRefRe = new RegExp(`(?:${escapeRegExp(varName)}|\\$\\{${escapeRegExp(varName)}\\})`);
+    for (const seg of segs) {
+      if (!isDeleteCommand(seg)) continue;
+      if (varRefRe.test(seg)) {
+        return {
+          allowed: false,
+          reason: `\u68C0\u6D4B\u5230\u901A\u8FC7\u53D8\u91CF ${varName}\uFF08=${path6}\uFF0C\u4E3B\u76EE\u5F55\uFF09\u6267\u884C\u5220\u9664`,
+          riskLevel: "high",
+          riskType: "script_execution",
+          confidence: 90,
+          source: "heuristic",
+          violatedLayers: ["L1.1"]
+        };
+      }
+    }
+  }
+  return null;
+}
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function isDeleteActionForDir(command, dirPath) {
+  const low = command.toLowerCase();
+  const dpath = dirPath.toLowerCase();
+  if (new RegExp(`\\b(?:rm|unlink|rmdir)\\b[^&|;]*?${escapeRegExp(dpath)}`, "i").test(low)) {
+    return true;
+  }
+  if (new RegExp(`(?:\u5220\u9664|\u79FB\u9664)[^\\n;|&]*?${escapeRegExp(dpath)}`).test(low)) {
+    return true;
+  }
+  for (const seg of low.split(/&&|\|\||;|\n/)) {
+    const fw = (seg.trim().split(/\s+/)[0] || "").toLowerCase();
+    if ((fw === "rm" || fw === "unlink" || fw === "rmdir") && low.includes(dpath)) {
+      return true;
+    }
+  }
+  return false;
+}
+function isArchiveReadOfDir(command, dirPath) {
+  const low = command.toLowerCase();
+  const dpath = dirPath.toLowerCase();
+  for (const seg of low.split(/&&|\|\||;|\n/)) {
+    const s = seg.trim();
+    if (!s || !s.includes(dpath)) continue;
+    const parts = s.split(/\s+/);
+    const fw = parts[0] || "";
+    if (fw === "zip") return true;
+    if (fw === "tar") {
+      if (/(?:^|\s)-[a-zA-Z]*x|--extract/.test(s)) continue;
+      return true;
+    }
+    if (fw === "cp" || fw === "rsync") {
+      const segPaths = s.match(/[/~][^\s;|&><'"]*/g) || [];
+      if (segPaths.length && segPaths[0].includes(dpath)) return true;
+    }
+  }
+  return false;
+}
+function isSshKeygenGenerate(command) {
+  const low = command.toLowerCase();
+  if (!low.includes("ssh-keygen")) return false;
+  if (!/(?:^|\s)-t\s+\S+/.test(low)) return false;
+  if (/(?:^|\s)-\S*[ylpB]\S*/.test(low)) return false;
+  return true;
+}
 function checkDangerousPatterns(actionType, actionDetail) {
   if (actionType === "file_write" || actionType === "file_edit") return null;
   const scan = stripHeredocContent(actionDetail);
   const TEMP_DIRS = ["/tmp", "/var/tmp", "/run", "/dev/shm"];
   const isTempPath = TEMP_DIRS.some(
     (td) => new RegExp(`(?:^|[\\s/])${td.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[\\s/]|$)`).test(actionDetail)
-  );
+  ) || /(?:^|[\s;]|&&\s*|\|\|\s*)var\/tmp(?:[/\s;]|$)/.test(actionDetail);
   const wildcardDeleteRe = /(?:\brm\b|\b(r?mdir|del|delete|remove|rmdir|unlink)\b|\b删除\b|\b移除\b)[\s\S]{0,40}?[*?]|[*?][\s\S]{0,40}?\b(?:rm|del|delete|remove|rmdir|unlink)\b|rm\s+-[a-zA-Z]*[rf][a-zA-Z]*\s+\S*[*?]/i;
   if (!isTempPath && wildcardDeleteRe.test(scan)) {
     return {
@@ -3009,7 +3194,7 @@ function checkDangerousPatterns(actionType, actionDetail) {
       riskType: "script_execution",
       confidence: 90,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
   const findWriteMatch = actionDetail.match(
@@ -3024,10 +3209,10 @@ function checkDangerousPatterns(actionType, actionDetail) {
       riskType: "script_execution",
       confidence: 90,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
-  if (/>\s*\/etc\//.test(actionDetail) || />\s*\/boot\//.test(actionDetail)) {
+  if (/>\s*['"]?\/etc\//.test(actionDetail) || />\s*['"]?\/boot\//.test(actionDetail) || />\s*['"]?\/proc\//.test(actionDetail)) {
     return {
       allowed: false,
       reason: "\u68C0\u6D4B\u5230\u91CD\u5B9A\u5411\u8986\u76D6\u5199\u5165\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55",
@@ -3035,7 +3220,7 @@ function checkDangerousPatterns(actionType, actionDetail) {
       riskType: "file_access",
       confidence: 95,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
   if (/>\s*\/dev\/(sd|hd|nvme|vd|loop|mem|kmsg|port|zero|random|urandom|full|core)/i.test(actionDetail)) {
@@ -3046,7 +3231,7 @@ function checkDangerousPatterns(actionType, actionDetail) {
       riskType: "file_access",
       confidence: 90,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
   return null;
@@ -3137,13 +3322,13 @@ function checkLateralMovement(actionDetail) {
         riskType: "lateral_movement",
         confidence: 80,
         source: "heuristic",
-        violatedLayers: ["1.1"]
+        violatedLayers: ["L1.1"]
       };
     }
   }
   return null;
 }
-var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES;
+var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES, HOME_TARGET_RE, HOME_ASSIGN_RE;
 var init_heuristic = __esm({
   "src/engine/heuristic.ts"() {
     "use strict";
@@ -3173,6 +3358,8 @@ var init_heuristic = __esm({
     })();
     SENSITIVE_EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
     SEARCH_ACTION_PREFIXES = ["search-", "web-", "browser-", "query-", "websearch", "web_search"];
+    HOME_TARGET_RE = /(?:^|[\s="'($])(?:~|(?:\$home|\$\{home\}))(?:\/(?:\.\*|\*|\.)?)?(?=[\s"';}|&)]|$)/i;
+    HOME_ASSIGN_RE = /([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(~[A-Za-z0-9_./-]*|\$HOME[A-Za-z0-9_./-]*|\$\{HOME\}[A-Za-z0-9_./-]*|\/home\/[^\s;|&]+|\$\((?:[^()]|\([^()]*\))*\))(?=\s|;|$|\||&)/gi;
   }
 });
 
@@ -4967,6 +5154,13 @@ function extractScriptPath2(command) {
   return null;
 }
 function extractScriptPathWithArgs(command) {
+  const inline = command.match(/(?:^|\s|&&|\|\|)\s*(?:bash|\/bin\/bash|sh|zsh)\s+-c\s*(['"])([\s\S]*?)\1/i);
+  if (inline) {
+    const inner = inline[2];
+    const realPath = extractScriptPath2(inner);
+    if (realPath) return { path: realPath, args: [] };
+    return { path: null, args: [] };
+  }
   const scriptPath = extractScriptPath2(command);
   if (!scriptPath) return { path: null, args: [] };
   const idx = command.indexOf(scriptPath);
@@ -4980,11 +5174,59 @@ function extractScriptPathWithArgs(command) {
   }
   return { path: scriptPath, args };
 }
+function looksLikeScriptPath(tok) {
+  const t = tok.trim().replace(/^['"]|['"]$/g, "");
+  if (!t) return false;
+  const low = t.toLowerCase();
+  if (["bash", "sh", "zsh", "dash", "python", "python3", "perl", "ruby", "node", "php", "lua"].includes(low)) return false;
+  if (/\.(sh|bash|py|pl|rb|js|php|lua)$/.test(low)) return true;
+  if (t.includes("/") && !t.startsWith("-")) return true;
+  return false;
+}
 function extractInlineScriptPath(actionDetail) {
+  const code = extractInlineCode(actionDetail);
+  if (code) {
+    const candidates = [];
+    const osRe = /os\.(?:system|popen)\s*\(\s*(['"])(.*?)\1\s*\)/gi;
+    let m;
+    while ((m = osRe.exec(code)) !== null) candidates.push(m[2]);
+    const subListRe = /subprocess\.(?:run|call|Popen|check_output|check_call)\s*\(\s*\[(.*?)\]/gi;
+    while ((m = subListRe.exec(code)) !== null) candidates.push(m[1]);
+    const subShellRe = /subprocess\.(?:run|call|Popen|check_output|check_call)\s*\(\s*(['"])(.*?)\1[^)]*?shell\s*=\s*true/gi;
+    while ((m = subShellRe.exec(code)) !== null) candidates.push(m[2]);
+    for (const cand of candidates) {
+      const tokens = cand.includes(",") ? cand.split(/\s*,\s*/).map((t) => t.trim().replace(/^['"]|['"]$/g, "")) : cand.split(/\s+/);
+      for (const tok of tokens) {
+        if (looksLikeScriptPath(tok)) {
+          try {
+            const resolved = resolvePath2(tok.replace(/^['"]|['"]$/g, ""));
+            if (existsSync9(resolved)) {
+              const stat = statSync2(resolved);
+              if (stat.isFile()) return resolved;
+            }
+          } catch {
+          }
+        }
+      }
+    }
+    const openRe = /open\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+    while ((m = openRe.exec(code)) !== null) {
+      const p = m[1];
+      try {
+        const resolved = resolvePath2(p);
+        if (existsSync9(resolved)) {
+          const stat = statSync2(resolved);
+          if (stat.isFile()) return resolved;
+        }
+      } catch {
+      }
+    }
+    return null;
+  }
   const re = /open\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
-  let m;
-  while ((m = re.exec(actionDetail)) !== null) {
-    const p = m[1];
+  let m2;
+  while ((m2 = re.exec(actionDetail)) !== null) {
+    const p = m2[1];
     let resolved;
     try {
       resolved = resolvePath2(p);
@@ -5170,6 +5412,7 @@ var init_script_content_analyzer = __esm({
     init_esm_shims();
     init_heuristic();
     init_logic_rules();
+    init_inline_analyzer();
     init_tracker();
     SUSPICIOUS_PATTERNS2 = [
       { name: "curl POST", pattern: /curl\s+(.*\s)?-X\s+POST/i },
@@ -5634,7 +5877,7 @@ async function analyzeWithLLM(prompt, config) {
         riskType: riskType || "",
         confidence: typeof parsed.confidence === "number" ? Math.min(100, Math.max(0, parsed.confidence)) : 70,
         source: "llm",
-        violatedLayers: ["3"]
+        violatedLayers: ["L3.1"]
       };
     } catch (err) {
       if (abortController.signal.aborted) {
@@ -6220,13 +6463,6 @@ var init_brain = __esm({
 });
 
 // src/engine/formal-engine/decode.ts
-var decode_exports = {};
-__export(decode_exports, {
-  allCandidates: () => allCandidates,
-  decodeBase64Literals: () => decodeBase64Literals,
-  decodeUrlAndNumeric: () => decodeUrlAndNumeric,
-  matchStageAny: () => matchStageAny
-});
 function isValidBase64Token(tok) {
   if (tok.length < 8) return false;
   if (!(tok.length % 4 === 0 || tok.endsWith("==") || tok.endsWith("="))) return false;
@@ -6259,6 +6495,13 @@ function decodeBase64Literals(text) {
   }
   return out;
 }
+function stripStringLiterals(text) {
+  const m = text.match(/\s*([A-Za-z_][\w-]*|\/?[\w./-]+)\b/);
+  if (!m) return text;
+  const cmd = m[1].split("/").pop().toLowerCase();
+  if (!OUTPUT_CMDS.has(cmd)) return text;
+  return text.replace(QUOTED_STR_RE, "");
+}
 function decodeUrlAndNumeric(text) {
   const out = [];
   let s = text;
@@ -6292,7 +6535,10 @@ function decodeUrlAndNumeric(text) {
   return out;
 }
 function allCandidates(detail, max = 8) {
-  const cands = [detail];
+  const shell = stripStringLiterals(detail);
+  const cands = [shell];
+  cands.push(...decodeBase64Literals(shell));
+  cands.push(...decodeUrlAndNumeric(shell));
   cands.push(...decodeBase64Literals(detail));
   cands.push(...decodeUrlAndNumeric(detail));
   const seen = /* @__PURE__ */ new Set();
@@ -6316,12 +6562,14 @@ function matchStageAny(detail, stages) {
   }
   return "";
 }
-var B64_TOKEN_RE;
+var B64_TOKEN_RE, QUOTED_STR_RE, OUTPUT_CMDS;
 var init_decode = __esm({
   "src/engine/formal-engine/decode.ts"() {
     "use strict";
     init_esm_shims();
     B64_TOKEN_RE = /[A-Za-z0-9+/]+={0,2}/g;
+    QUOTED_STR_RE = /('(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"|`(?:[^`\\]|\\.)*`)/g;
+    OUTPUT_CMDS = /* @__PURE__ */ new Set(["echo", "printf", "print"]);
   }
 });
 
@@ -6357,11 +6605,7 @@ function compileAps(apPatterns) {
 }
 function labelEvent(actionDetail) {
   if (!AP_RE) compileAps(loadMC().ap_patterns || {});
-  let candidates = [actionDetail];
-  try {
-    candidates = (init_decode(), __toCommonJS(decode_exports)).allCandidates(actionDetail);
-  } catch {
-  }
+  const candidates = allCandidates(actionDetail);
   const hits = /* @__PURE__ */ new Set();
   for (const [name, pats] of Object.entries(AP_RE || {})) {
     for (const c of candidates) {
@@ -6457,6 +6701,7 @@ var init_ltl = __esm({
     init_esm_shims();
     init_rules_loader();
     init_ir();
+    init_decode();
     AP_RE = null;
   }
 });
@@ -6703,7 +6948,7 @@ function checkSensitiveDataFlow(graph) {
     const n = nodes[i];
     if (tainted.has(i) && EXFIL_RE.test(n.actionDetail)) {
       violations.push({
-        propertyId: "sensitive-data-exfil",
+        propertyId: "sensitive-data-flow",
         reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${tainted.get(i)} \u2192 ${n.sessionId}#${n.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
         riskLevel: "critical",
         path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
@@ -6749,7 +6994,7 @@ function checkNeverExfilAfterPrivesc(graph) {
     if (pre) {
       const post = nodes[firstEv];
       return [{
-        propertyId: "no-privesc-then-exfil",
+        propertyId: "no-exfil-after-privesc",
         reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\xAC\u25C7EXFIL)",
         riskLevel: "critical",
         path: [
@@ -6765,7 +7010,7 @@ function checkNeverExfilAfterPrivesc(graph) {
     for (let j = i + 1; j < nodes.length; j++) {
       if (isExfilNode(nodes[j])) {
         violations.push({
-          propertyId: "no-privesc-then-exfil",
+          propertyId: "no-exfil-after-privesc",
           reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\xAC\u25C7EXFIL)",
           riskLevel: "critical",
           path: [
@@ -6798,7 +7043,7 @@ function checkNeverExfilAfterCred(graph) {
     if (pre) {
       const post = nodes[firstEv];
       return [{
-        propertyId: "no-cred-then-exfil",
+        propertyId: "no-exfil-after-credential",
         reason: "\u8BFB\u53D6\u51ED\u636E\u540E\u51FA\u73B0\u5916\u4F20\uFF0C\u8FDD\u53CD \u25A1(CRED\u2192\xAC\u25C7EXFIL)",
         riskLevel: "critical",
         path: [
@@ -6814,7 +7059,7 @@ function checkNeverExfilAfterCred(graph) {
     for (let j = i + 1; j < nodes.length; j++) {
       if (isExfilNode(nodes[j])) {
         violations.push({
-          propertyId: "no-cred-then-exfil",
+          propertyId: "no-exfil-after-credential",
           reason: "\u8BFB\u53D6\u51ED\u636E\u540E\u51FA\u73B0\u5916\u4F20\uFF0C\u8FDD\u53CD \u25A1(CRED\u2192\xAC\u25C7EXFIL)",
           riskLevel: "critical",
           path: [
@@ -6881,7 +7126,7 @@ function checkLowIntegrityCommandExec(graph) {
     const n = nodes[i];
     if (lowAt.has(i) && isComputeNode(n)) {
       violations.push({
-        propertyId: "low-integrity-controls-command-exec",
+        propertyId: "low-integrity-command-exec",
         reason: `\u4F4E\u5B8C\u6574\u6027\u6570\u636E\u63A7\u5236\u547D\u4EE4\u6267\u884C\uFF1A${lowAt.get(i)} \u2192 ${n.sessionId}#${n.seq} \u6267\u884C\u4E0D\u53EF\u4FE1\u5185\u5BB9`,
         riskLevel: "critical",
         path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
@@ -6927,7 +7172,7 @@ function checkCrossSessionReachability(graph) {
       const srcIdx = Math.min(...sources);
       const srcDesc = nodes[srcIdx].actionDetail.slice(0, 40);
       violations.push({
-        propertyId: "cross-session-reachability",
+        propertyId: "low-integrity-reachability",
         reason: `\u4F4E\u5B8C\u6574\u6027\u6E90\u7ECF\u8DE8 session \u6570\u636E\u94FE\u591A\u8DF3\u5230\u8FBE\u5F53\u524D\u6267\u884C\uFF08\u6E90: ${srcDesc} \u2192 ${n.sessionId}#${n.seq}\uFF09`,
         riskLevel: "high",
         path: nodes.slice(-3).map((m) => ({ sessionId: m.sessionId, seq: m.seq, detail: m.actionDetail.slice(0, 60) }))
@@ -6999,17 +7244,17 @@ var init_properties = __esm({
     STRONG_COMPUTE_TYPES = /* @__PURE__ */ new Set(["python", "node", "exec", "terminal", "cmd"]);
     DL_OR_LOW_RE = /curl\s+.*-o\b|wget\s+.*\s+-O\b|curl\s+.*\|\s*(bash|sh|python)|wget\s+.*\|\s*(bash|sh|python)|git\s+clone|docker\s+pull|pip\s+install|npm\s+install|base64\s+-d/i;
     ALL_PROPERTIES = [
-      { id: "cross-session-chain", check: checkCrossSessionChain },
-      { id: "sensitive-data-flow", check: checkSensitiveDataFlow },
-      { id: "cross-session-reachability", check: checkCrossSessionReachability },
-      { id: "no-privesc-then-exfil", check: checkNeverExfilAfterPrivesc },
-      { id: "no-cred-then-exfil", check: checkNeverExfilAfterCred },
+      { id: "cross-session-chain", check: checkCrossSessionChain, shortName: "P1" },
+      { id: "sensitive-data-flow", check: checkSensitiveDataFlow, shortName: "P2" },
+      { id: "low-integrity-reachability", check: checkCrossSessionReachability, shortName: "P3" },
+      { id: "no-exfil-after-privesc", check: checkNeverExfilAfterPrivesc, shortName: "P4" },
+      { id: "no-exfil-after-credential", check: checkNeverExfilAfterCred, shortName: "P5" },
       // L2.2 模型检测（通用 LTL 求值器，mc_rules.json 单一事实源；witness 语义见 ltl.ts）
-      { id: "mc-ltl-rules", check: checkMCRules },
-      // Rule 5 低完整性控制命令执行（integrity 维度，站点 L2.1 最有区分度的检测之一）
-      { id: "low-integrity-command-exec", check: checkLowIntegrityCommandExec },
-      // Rule 12 敏感数据聚合外传（egress 聚合 ≥2 事件源）
-      { id: "sensitive-data-aggregation", check: checkSensitiveDataAggregation }
+      { id: "mc-ltl-rules", check: checkMCRules, shortName: "P6" },
+      // P7 低完整性控制命令执行（integrity 维度，站点 L2.1 最有区分度的检测之一）
+      { id: "low-integrity-command-exec", check: checkLowIntegrityCommandExec, shortName: "P7" },
+      // P8 敏感数据聚合外传（egress 聚合 ≥2 事件源）
+      { id: "sensitive-data-aggregation", check: checkSensitiveDataAggregation, shortName: "P8" }
     ];
   }
 });
@@ -7082,6 +7327,32 @@ var init_engine = __esm({
 });
 
 // src/engine/formal-engine/stateful.ts
+function extractInstances(actionDetail, stage) {
+  const out = [];
+  if (PORT_STAGE_RE.test(stage)) {
+    const d = actionDetail;
+    let m;
+    const re = new RegExp(PORT_RE.source, "gi");
+    while ((m = re.exec(d)) !== null) {
+      const p = m[1] || m[2] || m[3];
+      if (p && Number(p) > 0 && Number(p) <= 65535) out.push(`port:${p}`);
+    }
+    if (/SCAN/.test(stage)) {
+      const bareRe = new RegExp(BARE_PORT_RE.source, "g");
+      while ((m = bareRe.exec(d)) !== null) {
+        if (m[1] && Number(m[1]) > 0 && Number(m[1]) <= 65535) out.push(`port:${m[1]}`);
+      }
+    }
+    m = SOCK_RE.exec(d);
+    if (m && m[1]) out.push(`sock:${m[1]}`);
+    m = UNIT_RE.exec(d);
+    if (m && m[1]) out.push(`unit:${m[1]}`);
+  }
+  return out;
+}
+function buckKey(chainId, inst) {
+  return inst ? `${chainId}@@${inst}` : chainId;
+}
 function loadRules() {
   if (STAGES_PATTERNS !== null && CHAINS !== null) {
     return { stages: STAGES_PATTERNS, chains: CHAINS };
@@ -7121,7 +7392,7 @@ function lifecycleFor(detail, stage, isError) {
   if (detail.includes(">>") || detail.includes(">")) return "alive";
   return "";
 }
-var DESTROY_RE, NEVER_ACTIVATED_RE, CRED_FILE_RE2, EXFIL_RE2, STAGES_PATTERNS, CHAINS, MAX_NODES, StatefulChainTracker;
+var DESTROY_RE, NEVER_ACTIVATED_RE, CRED_FILE_RE2, EXFIL_RE2, PORT_RE, BARE_PORT_RE, SOCK_RE, UNIT_RE, PORT_STAGE_RE, STAGES_PATTERNS, CHAINS, MAX_NODES, StatefulChainTracker;
 var init_stateful = __esm({
   "src/engine/formal-engine/stateful.ts"() {
     "use strict";
@@ -7131,11 +7402,20 @@ var init_stateful = __esm({
     DESTROY_RE = /\b(?:pkill|kill)\b|systemctl\s+stop|service\s+stop|crontab\s+-r|rm\s+-[rf]?\s+/i;
     NEVER_ACTIVATED_RE = /\b(?:not\s+found|no\s+such\s+file|command\s+not\s+found|refused|failed\s+to\s+(?:start|bind|listen)|address\s+already\s+in\s+use)\b/i;
     CRED_FILE_RE2 = /(known_hosts|\.ssh|id_rsa|\/etc\/shadow|\/etc\/passwd|credentials)/i;
-    EXFIL_RE2 = /https?:\/\/|scp\s+.*@|rsync\s+.*@/i;
+    EXFIL_RE2 = /https?:\/\/(?!127\.\d+\.\d+\.\d+|0\.0\.0\.0|localhost|\[?::1\]?)|scp\s+.*@|rsync\s+.*@/i;
+    PORT_RE = /(?:-p\s+(\d{1,5})|-p(\d{1,5})|:(\d{1,5})\b)/i;
+    BARE_PORT_RE = /(?<=^|\s)(\d{1,5})(?=\s|$)/g;
+    SOCK_RE = /([\w./-]*(?:\/tmp\/|\/var\/run\/|\.sock\b)[\w./-]*)/;
+    UNIT_RE = /systemctl\s+(?:start|enable|restart)\s+([\w.-]+)/i;
+    PORT_STAGE_RE = /LISTEN|PERSIST|SCAN/;
     STAGES_PATTERNS = null;
     CHAINS = null;
     MAX_NODES = 1e5;
-    StatefulChainTracker = class {
+    StatefulChainTracker = class _StatefulChainTracker {
+      /** 本地接收时刻（实时路径无 called_at 时的兜底时间戳，ISO）。 */
+      static now() {
+        return (/* @__PURE__ */ new Date()).toISOString();
+      }
       agentId;
       nodes_ = [];
       ptr = {};
@@ -7157,10 +7437,14 @@ var init_stateful = __esm({
         for (const chain of chains) {
           const stages = chain.stages || [];
           if (stages.length === 0) continue;
-          const matched = this.ptr[String(chain.id || "")] || 0;
+          const cid = String(chain.id || "");
+          let matched = this.ptr[cid] || 0;
+          for (const [k, v] of Object.entries(this.ptr)) {
+            if (k.startsWith(`${cid}@@`) && v > matched && v < stages.length) matched = v;
+          }
           if (matched > 0 && matched < stages.length) {
             const pf = {
-              chainId: String(chain.id || ""),
+              chainId: cid,
               stages,
               matched,
               riskLevel: String(chain.riskLevel || chain.risk_level || "high"),
@@ -7236,8 +7520,10 @@ var init_stateful = __esm({
           actionDetail: ad,
           stage,
           resources: extractResources2(ad),
+          instances: extractInstances(ad, stage),
           isError,
-          lifecycle: lifecycleFor(ad, stage, isError)
+          lifecycle: lifecycleFor(ad, stage, isError),
+          timestamp: typeof action.calledAt === "string" ? action.calledAt : _StatefulChainTracker.now()
         };
         this.nodes_.push(node);
         this.seqNext += 1;
@@ -7245,11 +7531,19 @@ var init_stateful = __esm({
       }
       recordLifecycle(node) {
         if (node.lifecycle === "dead") {
-          let hit = false;
+          const clearedInsts = [];
+          for (const inst of node.instances) {
+            const key = `inst:${inst}`;
+            if (key in this.aliveResources) {
+              delete this.aliveResources[key];
+              clearedInsts.push(inst);
+            }
+          }
+          let pathHit = false;
           for (const r of node.resources) {
             if (r in this.aliveResources) {
               delete this.aliveResources[r];
-              hit = true;
+              pathHit = true;
             }
           }
           const detail = node.actionDetail;
@@ -7257,16 +7551,30 @@ var init_stateful = __esm({
             const base = r.split("/").pop() || "";
             if (base && detail.includes(base)) {
               delete this.aliveResources[r];
-              hit = true;
+              pathHit = true;
             }
           }
-          if (hit) this.resetChainsOnDestroy();
+          if (clearedInsts.length > 0 && !pathHit) {
+            for (const inst of clearedInsts) this.resetChainsForInstance(inst);
+          } else {
+            this.resetChainsOnDestroy();
+          }
           return;
         }
         if (node.lifecycle === "alive") {
           for (const r of node.resources) {
             this.aliveResources[r] = node.seq;
           }
+          for (const inst of node.instances) {
+            this.aliveResources[`inst:${inst}`] = node.seq;
+          }
+        }
+      }
+      /** 只重置指定实例在全部链上的进度（不影响其他端口/资源）。 */
+      resetChainsForInstance(inst) {
+        const key = buckKey("", inst).slice(2);
+        for (const k of Object.keys(this.ptr)) {
+          if (k.endsWith(`@@${inst}`)) this.ptr[k] = 0;
         }
       }
       resetChainsOnDestroy() {
@@ -7274,6 +7582,29 @@ var init_stateful = __esm({
           this.ptr[cid] = 0;
         }
       }
+      /**
+       * 当前节点应推进的链桶集合。
+       * - 有实例节点（LISTEN/PERSIST 带端口/socket/unit）→ 只推自己的实例桶；
+       *   同时为所有链的该实例建立桶（若首次出现）。
+       * - 无实例节点（EXEC/SCAN 等中间段）→ 推全局桶 + 所有当前活跃实例桶
+       *   （信息不足时保守推进一切可能，避免漏判）。
+       */
+      targetsForNode(node, chainId) {
+        const insts = node.instances;
+        if (insts.length > 0) {
+          const active = insts.filter((i) => this.aliveResources[`inst:${i}`] !== void 0);
+          if (active.length > 0) return active.map((i) => buckKey(chainId, i));
+          return [chainId];
+        }
+        const targets = [chainId];
+        for (const k of Object.keys(this.aliveResources)) {
+          if (k.startsWith("inst:")) {
+            const inst = k.slice("inst:".length);
+            targets.push(`${chainId}@@${inst}`);
+          }
+        }
+        return targets;
+      }
       advanceChains(node) {
         if (node.lifecycle === "dead") return null;
         if (node.lifecycle === "never_activated") {
@@ -7287,23 +7618,32 @@ var init_stateful = __esm({
           const stages = chain.stages || [];
           if (stages.length === 0) continue;
           const cid = String(chain.id || "");
-          const cur = this.ptr[cid] || 0;
-          if (cur < stages.length && stages[cur] === stage) {
-            this.ptr[cid] = cur + 1;
-            if (cur + 1 >= stages.length) {
-              return {
-                chainId: cid,
-                stages,
-                riskLevel: String(chain.riskLevel || chain.risk_level || "high"),
-                reason: String(chain.reason || "\u68C0\u6D4B\u5230\u7EC4\u5408\u653B\u51FB\u94FE"),
-                path: this.chainPath(stages)
-              };
+          const targets = this.targetsForNode(node, cid);
+          for (const key of targets) {
+            const cur = this.ptr[key] || 0;
+            if (cur < stages.length && stages[cur] === stage) {
+              this.ptr[key] = cur + 1;
+              if (cur + 1 >= stages.length) {
+                return {
+                  chainId: cid,
+                  stages,
+                  riskLevel: String(chain.riskLevel || chain.risk_level || "high"),
+                  reason: String(chain.reason || "\u68C0\u6D4B\u5230\u7EC4\u5408\u653B\u51FB\u94FE"),
+                  path: this.chainPath(stages)
+                };
+              }
             }
           }
         }
         return null;
       }
       invalidateChainOnFailure(node) {
+        if (node.instances.length > 0) {
+          for (const inst of node.instances) {
+            this.resetChainsForInstance(inst);
+          }
+          return;
+        }
         const failed = new Set(node.resources);
         if (failed.size === 0) return;
         const { chains } = loadRules();
@@ -7319,7 +7659,7 @@ var init_stateful = __esm({
         let want = stages[0];
         for (const n of this.nodes_) {
           if (n.stage === want) {
-            path6.push({ sessionId: n.sessionId, seq: n.seq, stage: n.stage });
+            path6.push({ sessionId: n.sessionId, seq: n.seq, stage: n.stage, timestamp: n.timestamp });
             const idx = stages.indexOf(n.stage);
             if (idx + 1 < stages.length) {
               want = stages[idx + 1];
@@ -7355,7 +7695,7 @@ var init_stateful = __esm({
         if (!this.tainted.has(node.seq)) return [];
         if (EXFIL_RE2.test(node.actionDetail)) {
           return [{
-            property_id: "sensitive-data-exfil",
+            property_id: "sensitive-data-flow",
             reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${this.taintSource(node)} \u2192 ${node.sessionId}#${node.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
             risk_level: "critical",
             path: [[node.sessionId, node.seq, node.actionDetail.slice(0, 60)]]
@@ -7397,8 +7737,12 @@ var init_stateful = __esm({
             actionDetail: String(raw.actionDetail || ""),
             stage: String(raw.stage || ""),
             resources: [...raw.resources || []],
+            instances: [...raw.instances || []],
+            // 旧快照无此字段 → 空
             isError: Boolean(raw.isError),
-            lifecycle: String(raw.lifecycle || "")
+            lifecycle: String(raw.lifecycle || ""),
+            timestamp: typeof raw.timestamp === "string" ? raw.timestamp : null
+            // 旧快照无此字段 → null
           });
         }
         this.seqNext = Number(snapshot.seq_next || this.nodes_.length);
@@ -7591,7 +7935,7 @@ async function runAnalysis(input) {
             riskType: node.l1RiskType,
             confidence: 90,
             source: "heuristic_script_scan",
-            violatedLayers: ["1.1-script"]
+            violatedLayers: ["L1.2"]
           };
         }
       }
@@ -7709,7 +8053,7 @@ async function runAnalysis(input) {
             riskType: inlineJudgment.riskType,
             confidence: 90,
             source: "logic_rule",
-            violatedLayers: ["1.2"]
+            violatedLayers: ["L2.1"]
           };
         }
         return {
@@ -7742,7 +8086,7 @@ async function runAnalysis(input) {
         console.warn(
           `[AgentMoss] \u5F62\u5F0F\u5316\u9A8C\u8BC1 observe\uFF08\u53EA\u8BB0\u5F55\u4E0D\u62E6\u622A\uFF09: property=${v?.propertyId ?? "?"} risk=${v?.riskLevel ?? "?"} path_len=${v?.path?.length ?? 0} reason=${(v?.reason ?? "?").slice(0, 200)}`
         );
-        observedFormalLayers.push("2.4");
+        observedFormalLayers.push("L2.2");
       } else {
         return {
           allowed: false,
@@ -7751,7 +8095,7 @@ async function runAnalysis(input) {
           riskType: "formal_verification",
           confidence: 90,
           source: "formal_engine",
-          violatedLayers: ["2.4"]
+          violatedLayers: ["L2.2"]
         };
       }
     }
@@ -7768,7 +8112,7 @@ async function runAnalysis(input) {
           riskType: node.l2RiskType,
           confidence: 85,
           source: "logic_rule_script_scan",
-          violatedLayers: ["1.2-script"]
+          violatedLayers: ["L2.3"]
         };
       }
     }
@@ -7855,7 +8199,7 @@ async function runAnalysis(input) {
       riskType: "",
       confidence: 60,
       source: "llm_failure_fallback",
-      violatedLayers: ["3"]
+      violatedLayers: ["L3.1"]
     };
   }
   if (!llmResult.allowed && llmResult.confidence && llmResult.confidence >= 90 && _brainExtractor) {
@@ -8797,7 +9141,7 @@ var AnalyzeRequestSchema = z.object({
   session_history: z.array(z.object({
     session_id: z.string(),
     action_history: z.array(ActionItemSchema).default([])
-  })).default([]).describe("Multi-session historical actions (optional): for L2.4 formal engine cross-session combo-chain / sensitive-data-flow verification. Provided by caller (incl. future agentgate)."),
+  })).default([]).describe("Multi-session historical actions (optional): for L2.2 formal engine cross-session combo-chain / sensitive-data-flow verification. Provided by caller (incl. future agentgate)."),
   a_next: ActionItemSchema.describe("Next action to be executed"),
   reason: z.string().default("").describe("Reason for executing this action"),
   os_type: z.string().default("").describe("OS type: 'linux', 'windows', or empty for auto-detect"),
@@ -8814,7 +9158,9 @@ var AnalyzeResponseSchema = z.object({
   policy: z.string().default(""),
   violated_policy: z.string().default(""),
   confidence: z.number().int().min(0).max(100).default(100),
-  analysis_duration_ms: z.number().default(0)
+  analysis_duration_ms: z.number().default(0),
+  // 组合攻击链反例路径：每步 [session_id, seq, stage, timestamp]，含真实发生时间
+  violation_chain: z.array(z.array(z.union([z.string(), z.number()]).nullable())).default([])
 });
 var HealthResponseSchema = z.object({
   status: z.string().default("healthy"),
@@ -9198,7 +9544,7 @@ async function analyzeRoute(c) {
         const judgment = incMatchedToDeny(inc);
         if (judgment) {
           const layers = [...result.violatedLayers];
-          if (!layers.includes("2.4-stateful")) layers.push("2.4-stateful");
+          if (!layers.includes("L2.2-stateful")) layers.push("L2.2-stateful");
           console.error(
             `[AgentMoss] stateful \u589E\u91CF\u62E6\u622A: agent=${agentId || "-"} property=${judgment.property_id} risk=${judgment.risk_level}`
           );
@@ -9212,7 +9558,8 @@ async function analyzeRoute(c) {
               policy: "",
               violated_policy: "",
               confidence: 90,
-              analysis_duration_ms: Math.round((performance.now() - t0) * 10) / 10
+              analysis_duration_ms: Math.round((performance.now() - t0) * 10) / 10,
+              violation_chain: judgment.violation_chain
             })
           );
         }
@@ -9251,17 +9598,20 @@ function getChainStateStoreFor(_agentId) {
 }
 function incMatchedToDeny(inc) {
   if (inc.matched) {
+    const chain = (inc.matched.path || []).map((p) => [p.sessionId, p.seq, p.stage, p.timestamp]);
     return {
       property_id: "cross-" + inc.matched.chainId,
       reason: inc.matched.reason,
-      risk_level: inc.matched.riskLevel
+      risk_level: inc.matched.riskLevel,
+      violation_chain: chain
     };
   }
   if (inc.exfil && inc.exfil.length > 0) {
     return {
-      property_id: "sensitive-data-exfil",
+      property_id: "sensitive-data-flow",
       reason: inc.exfil[0].reason,
-      risk_level: inc.exfil[0].risk_level
+      risk_level: inc.exfil[0].risk_level,
+      violation_chain: []
     };
   }
   return null;
@@ -9387,7 +9737,7 @@ function createConsoleRouter() {
     const rc = updateLayerEnabled(body.layer_key, body.enabled);
     return c.json({ layers: rc.layers, env_overrides: getEnvOverrides() });
   });
-  function getL24View() {
+  function getL22View() {
     const ltlHuman = {
       "mc-ltl-001": "\u5148\u8BFB\u53D6\u4E86\u51ED\u636E/\u5BC6\u94A5\uFF0C\u4E4B\u540E\u51FA\u73B0\u7F51\u7EDC\u5916\u4F20",
       "mc-ltl-002": "\u5148\u4E0B\u8F7D/\u83B7\u53D6\u4E86\u6587\u4EF6\uFF0C\u4E4B\u540E\u6267\u884C\u4E86\u6587\u4EF6",
@@ -9418,9 +9768,9 @@ function createConsoleRouter() {
       }))
     };
   }
-  function withL24View(rc) {
-    if (rc && rc.L2_4 && typeof rc.L2_4 === "object" && !Array.isArray(rc.L2_4)) {
-      const cat = rc.L2_4.ltl_rules;
+  function withL22View(rc) {
+    if (rc && rc.L2_2 && typeof rc.L2_2 === "object" && !Array.isArray(rc.L2_2)) {
+      const cat = rc.L2_2.ltl_rules;
       const rls = cat && cat.rules || [];
       const ltlHumanLocal = {
         "mc-ltl-001": "\u5148\u8BFB\u53D6\u4E86\u51ED\u636E/\u5BC6\u94A5\uFF0C\u4E4B\u540E\u51FA\u73B0\u7F51\u7EDC\u5916\u4F20",
@@ -9435,7 +9785,7 @@ function createConsoleRouter() {
         "mc-ltl-010": "\u5B89\u88C5\u4E86\u6301\u4E45\u5316\u673A\u5236\uFF08crontab/systemd/.bashrc \u7B49\uFF09\uFF0C\u9700\u5BA1\u6279",
         "mc-ctl-001": "\u4EFB\u4F55\u60C5\u51B5\u4E0B\u4E0D\u5141\u8BB8\u6E05\u9664\u65E5\u5FD7\uFF08\u5B89\u5168\u5E95\u7EBF\uFF09"
       };
-      rc.L2_4 = {
+      rc.L2_2 = {
         enabled_via: "L2_logic_rules",
         description: "\u65F6\u5E8F\u4E0E\u6570\u636E\u6D41\u653B\u51FB\u68C0\u6D4B\uFF08L2.2 \u6A21\u578B\u68C0\u6D4B\uFF09",
         ltl_rules: rls.map((r) => ({
@@ -9454,22 +9804,22 @@ function createConsoleRouter() {
   }
   console2.get("/api/rules", (c) => {
     const rc = loadRuntimeConfig();
-    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules, L2_4: getL24View() });
+    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules, L2_2: getL22View() });
   });
   console2.put("/api/rules/enabled", async (c) => {
     const b = await c.req.json();
     const rc = updateRuleEnabled(b.layer, b.category, b.rule_id, b.enabled);
-    return c.json(withL24View(rc));
+    return c.json(withL22View(rc));
   });
   console2.put("/api/rules/deny_mode", async (c) => {
     const b = await c.req.json();
     const rc = updateRuleDenyMode(b.layer, b.category, b.rule_id, b.deny_mode);
-    return c.json(withL24View(rc));
+    return c.json(withL22View(rc));
   });
   console2.put("/api/rules/skip_l3", async (c) => {
     const b = await c.req.json();
     const rc = updateRuleSkipL3(b.layer, b.category, b.rule_id, b.skip_l3_on_disabled);
-    return c.json(withL24View(rc));
+    return c.json(withL22View(rc));
   });
   console2.put("/api/categories/enabled", async (c) => {
     const b = await c.req.json();
@@ -9619,7 +9969,7 @@ function createConsoleRouter() {
   });
   console2.get("/api/config", (c) => {
     const rc = loadRuntimeConfig();
-    return c.json({ ...rc, L2_4: getL24View() });
+    return c.json({ ...rc, L2_2: getL22View() });
   });
   console2.get("/api/env-overrides", (c) => {
     return c.json({ overrides: getEnvOverrides() });
@@ -9959,4 +10309,14 @@ if (isMain) {
 //! 顺序即 fail-closed 短路优先级：verify 逐个执行，首个返回违规的性质成为
 //! first_violation，后续不再评估。调整顺序影响判定归属，须与 Python
 //! properties.py ALL_PROPERTIES 保持一致并双端测试确认。
+//!
+//! shortName（P1~P8 连续短名）与 id（语义化英文）对照（与 Python 一致）：
+//!   P1 cross-session-chain          跨会话组合链
+//!   P2 sensitive-data-flow          敏感数据传播
+//!   P3 low-integrity-reachability   低完整性数据流可达
+//!   P4 no-exfil-after-privesc       提权后禁外传
+//!   P5 no-exfil-after-credential    凭据后禁外传
+//!   P6 mc-ltl-rules                 LTL 模型检测
+//!   P7 low-integrity-command-exec   低完整性命令执行
+//!   P8 sensitive-data-aggregation   敏感数据聚合外传
 //# sourceMappingURL=cli.js.map