@kenhkl/agent-moss 0.13.0 → 0.14.0

package/dist/server.js

@@ -632,7 +632,7 @@ function loadMC() {
   try {
     const rt = (init_runtime_config(), __toCommonJS(runtime_config_exports));
     if (rules.length > 0 && typeof rt.hasRuntimeConfig === "function" && rt.hasRuntimeConfig()) {
-      const rtRules = rt.loadRuntimeConfig()?.L2_4?.ltl_rules?.rules || [];
+      const rtRules = rt.loadRuntimeConfig()?.L2_2?.ltl_rules?.rules || [];
       const enabledById = {};
       for (const r of rtRules) if (r?.id) enabledById[r.id] = r.enabled !== false;
       for (const r of rules) if (r?.id && r.id in enabledById) r.enabled = enabledById[r.id];
@@ -680,7 +680,8 @@ function _loadSensitivePathScope(scope) {
     path: sp.path,
     riskLevel: sp.risk_level,
     desc: sp.desc,
-    credential: sp.deny_mode === "deny_both" ? true : void 0
+    credential: sp.deny_mode === "deny_both" ? true : void 0,
+    dirDelOnly: sp.dir_del_only === true ? true : void 0
   }));
 }
 function isWriteOperation(actionType, actionDetail, writeKeywords = WRITE_KEYWORDS) {
@@ -778,7 +779,7 @@ function runLogicCheck(input) {
             riskType: "intent_deviation",
             confidence: 85,
             source: "logic_rule",
-            violatedLayers: ["2"]
+            violatedLayers: ["L2.1"]
           };
         }
       }
@@ -802,7 +803,7 @@ function runLogicCheck(input) {
           riskType: "privilege_escalation",
           confidence: 85,
           source: "logic_rule",
-          violatedLayers: ["2"]
+          violatedLayers: ["L2.1"]
         };
       }
     }
@@ -854,7 +855,7 @@ function checkComboChain(actionHistory, actionDetailRaw) {
         riskType: "combo_chain",
         confidence: 85,
         source: "logic_rule",
-        violatedLayers: ["2"]
+        violatedLayers: ["L2.1"]
       };
     }
   }
@@ -979,7 +980,7 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
       riskType: "read_before_write",
       confidence: 85,
       source: "logic_rule",
-      violatedLayers: ["2"]
+      violatedLayers: ["L2.1"]
     };
   }
   return null;
@@ -999,7 +1000,7 @@ function checkPasswordConsent(actionType, actionDetail, actionHistory) {
     riskType: "consent_missing",
     confidence: 85,
     source: "logic_rule",
-    violatedLayers: ["2"]
+    violatedLayers: ["L2.1"]
   };
 }
 function checkUserDeletionConsent(actionType, actionDetail, actionHistory) {
@@ -1017,7 +1018,7 @@ function checkUserDeletionConsent(actionType, actionDetail, actionHistory) {
     riskType: "consent_missing",
     confidence: 85,
     source: "logic_rule",
-    violatedLayers: ["2"]
+    violatedLayers: ["L2.1"]
   };
 }
 function containsPrivilegeEscalation(actionDetail) {
@@ -1077,7 +1078,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
           riskType: "file_access",
           confidence: 95,
           source: "logic_rule",
-          violatedLayers: ["2"],
+          violatedLayers: ["L2.1"],
           isCredential: true
         };
       }
@@ -1093,7 +1094,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
             riskType: "file_access",
             confidence: 95,
             source: "logic_rule",
-            violatedLayers: ["2"]
+            violatedLayers: ["L2.1"]
           };
         }
       }
@@ -1107,7 +1108,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
     riskType: "file_access",
     confidence: 70,
     source: "logic_rule",
-    violatedLayers: ["2"]
+    violatedLayers: ["L2.1"]
   };
 }
 var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, WRITE_KEYWORDS, WRITE_COMMAND_RES, READ_ONLY_COMMANDS, DEVNULL_REDIRECT_RE, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
@@ -1119,7 +1120,7 @@ var init_logic_rules = __esm({
     init_rules_loader();
     ROOT_SENSITIVE_PATHS = _loadSensitivePathScope("root");
     HOME_SENSITIVE_PATHS = _loadSensitivePathScope("home");
-    CREDENTIAL_PATHS = _loadSensitivePathScope("credential").map(({ path: path6, riskLevel, desc }) => ({ path: path6, riskLevel, desc, credential: true }));
+    CREDENTIAL_PATHS = _loadSensitivePathScope("credential").map(({ path: path6, riskLevel, desc, dirDelOnly }) => ({ path: path6, riskLevel, desc, credential: true, dirDelOnly }));
     NON_WRITE_TOOLS = /* @__PURE__ */ new Set([
       "ask_user_question",
       "glob",
@@ -1470,7 +1471,7 @@ function emptyRuntimeConfig() {
     L1_rules: {},
     L2_rules: {},
     L3_skills: {},
-    L2_4: {},
+    L2_2: {},
     agent_rules: {},
     scenario_rules: {}
   };
@@ -1498,7 +1499,7 @@ function loadRuntimeConfig() {
       L1_rules: merged.L1_rules || {},
       L2_rules: merged.L2_rules || {},
       L3_skills: merged.L3_skills || {},
-      L2_4: merged.L2_4 || {},
+      L2_2: merged.L2_2 || {},
       agent_rules: merged.agent_rules || {},
       scenario_rules: merged.scenario_rules || {}
     };
@@ -1551,6 +1552,7 @@ function getEnabledL2SensitivePaths(runtime) {
     const out = { path: r.path || "", risk_level: r.risk_level || "", desc: r.desc || "", deny_mode: r.deny_mode || "deny_write" };
     if (r.credential) out.credential = true;
     if (r.read_only) out.read_only = true;
+    if (r.dir_del_only) out.dir_del_only = true;
     return out;
   });
 }
@@ -1659,6 +1661,7 @@ function _l2SensitivePathsToRules() {
       builtin: true
     };
     _syncDenyModeFields(rule);
+    if (sp.dirDelOnly) rule.dir_del_only = true;
     return rule;
   });
 }
@@ -1875,7 +1878,7 @@ function generateSourceDefaults() {
       user_custom: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49 L2 \u903B\u8F91\u89C4\u5219", rules: [] }
     },
     L3_skills: _l3SkillsToRules(),
-    L2_4: _ltlRulesToRuntime(),
+    L2_2: _ltlRulesToRuntime(),
     agent_rules: _agentRulesToDefaults(),
     scenario_rules: _scenarioRulesToDefaults()
   };
@@ -2063,7 +2066,11 @@ function mergeConfig(userCfg, srcDefaults) {
   );
   _mergeRuleCategories(cfg, srcDefaults, "L1_rules");
   _mergeRuleCategories(cfg, srcDefaults, "L2_rules");
-  _mergeRuleCategories(cfg, srcDefaults, "L2_4");
+  if (!cfg.L2_2 && cfg.L2_4) {
+    cfg.L2_2 = cfg.L2_4;
+    delete cfg.L2_4;
+  }
+  _mergeRuleCategories(cfg, srcDefaults, "L2_2");
   _mergeSkillCategories(cfg, srcDefaults, "L3_skills");
   _mergeAgentRules(cfg, srcDefaults);
   _mergeAgentRules(cfg, srcDefaults, "scenario_rules");
@@ -2683,7 +2690,7 @@ function runHeuristicCheck(input) {
             riskType: "sensitive_action",
             confidence: 90,
             source: "heuristic",
-            violatedLayers: ["1.1"]
+            violatedLayers: ["L1.1"]
           };
         }
       }
@@ -2693,8 +2700,10 @@ function runHeuristicCheck(input) {
   const scanDetail = normalizePathSegments(stripLiteralTextSegments(input.aNext.actionDetail));
   const scanCommand = `${input.aNext.actionType}: ${scanDetail}`;
   let topRiskType = "";
+  const exemptKeygen = isSshKeygenGenerate(input.aNext.actionDetail);
   for (const rule of DANGEROUS_PATTERNS) {
     if (rule.pattern.test(scanCommand)) {
+      if (exemptKeygen && rule.riskType === "file_access") continue;
       matched.push(rule.description);
       if (severityRank(rule.severity) > severityRank(highestSeverity)) {
         highestSeverity = rule.severity;
@@ -2736,10 +2745,26 @@ function runHeuristicCheck(input) {
   const detailL = input.aNext.actionDetail.toLowerCase();
   const isExcludedType = SENSITIVE_EXCLUDED_PREFIXES.some((p) => actionTypeL.startsWith(p));
   const dangerousResult = checkDangerousPatterns(actionTypeL, detailL);
-  if (dangerousResult) return dangerousResult;
-  if (!isExcludedType) {
-    const pathResult = checkSensitivePath(detailL, input.cwd || "/", agentExt);
-    if (pathResult) return pathResult;
+  const pathResult = isExcludedType ? null : checkSensitivePath(detailL, input.cwd || "/", agentExt);
+  const homeResult = checkHomeDeletion(actionTypeL, detailL);
+  const mergeResults = [dangerousResult, pathResult, homeResult].filter(Boolean);
+  if (mergeResults.length > 0) {
+    let best = mergeResults[0];
+    for (const r of mergeResults) {
+      if (severityRank(r.riskLevel) > severityRank(best.riskLevel)) best = r;
+    }
+    if (severityRank(highestSeverity) > severityRank(best.riskLevel)) {
+      return {
+        allowed: false,
+        reason: `\u68C0\u6D4B\u5230\u9AD8\u5371\u64CD\u4F5C: ${matched.join(", ")}`,
+        riskLevel: highestSeverity,
+        riskType: highestRiskType,
+        confidence: 95,
+        source: "heuristic",
+        violatedLayers: ["L1.1"]
+      };
+    }
+    return best;
   }
   if (matched.length > 0) {
     return {
@@ -2749,8 +2774,7 @@ function runHeuristicCheck(input) {
       riskType: highestRiskType,
       confidence: 95,
       source: "heuristic",
-      violatedLayers: ["1.1"]
-      // 对齐 py coordinator.py:165（L1.1 = 命中高危命令模式/注入关键词）
+      violatedLayers: ["L1.1"]
     };
   }
   const lateralResult = checkLateralMovement(detailL);
@@ -2878,6 +2902,7 @@ function isSearchActionType(actionType) {
 function checkSensitivePath(command, cwd, agentExt) {
   const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
   const isWriteOpFlag = isWriteOperation("", command);
+  const keygenGenerate = isSshKeygenGenerate(command);
   const pathScanText = normalizePathSegments(stripLiteralTextSegments(command));
   const pathMatches = (text, path6) => {
     const parts = path6.split(/(\(\?!.*?\))/);
@@ -2890,6 +2915,7 @@ function checkSensitivePath(command, cwd, agentExt) {
   };
   for (const sp of ROOT_SENSITIVE_PATHS) {
     if (pathMatches(pathScanText, sp.path.toLowerCase())) {
+      if (keygenGenerate) continue;
       if (sp.path === "/dev/random") {
         if (isWriteOpFlag) {
           continue;
@@ -2901,7 +2927,7 @@ function checkSensitivePath(command, cwd, agentExt) {
           riskType: "file_access",
           confidence: 90,
           source: "heuristic",
-          violatedLayers: ["1.1"]
+          violatedLayers: ["L1.1"]
         };
       }
       if (!isWriteOpFlag && !sp.credential) {
@@ -2914,16 +2940,51 @@ function checkSensitivePath(command, cwd, agentExt) {
         riskType: "file_access",
         confidence: 90,
         source: "heuristic",
-        violatedLayers: ["1.1"],
+        violatedLayers: ["L1.1"],
         isCredential: !!sp.credential
       };
     }
   }
   for (const sp of HOME_SENSITIVE_PATHS) {
     const expanded = `${expandedCwd}/${sp.path}`;
-    const pathRe = sp.path.endsWith(".pub") ? new RegExp(sp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i") : new RegExp(sp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "(?!\\.pub)", "i");
-    const expandedRe = sp.path.endsWith(".pub") ? new RegExp(expanded.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i") : new RegExp(expanded.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "(?!\\.pub)", "i");
-    if (pathRe.test(pathScanText) || expandedRe.test(pathScanText)) {
+    let pPath = sp.path;
+    if (!sp.path.endsWith(".pub")) pPath = `${sp.path}(?!\\.pub)`;
+    let dirPrefixMatch = null;
+    if (sp.dirDelOnly) {
+      const dirRe = (t) => new RegExp(`(?:^|[\\s/\\\\'"])${t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:/|[\\s'"\\\\]|$)`, "i");
+      dirPrefixMatch = dirRe(sp.path).test(pathScanText) || dirRe(expanded.toLowerCase()).test(pathScanText);
+    }
+    const pathReMatch = sp.dirDelOnly ? !!dirPrefixMatch : pathMatches(pathScanText, pPath);
+    const expandedReMatch = sp.dirDelOnly ? false : pathMatches(pathScanText, expanded + (sp.path.endsWith(".pub") ? "" : "(?!\\.pub)"));
+    if (pathReMatch || expandedReMatch) {
+      if (keygenGenerate) continue;
+      if (sp.dirDelOnly) {
+        if (isDeleteActionForDir(command, sp.path)) {
+          return {
+            allowed: false,
+            reason: `\u5220\u9664\u654F\u611F\u76EE\u5F55: ${sp.desc} (${sp.path})`,
+            riskLevel: sp.riskLevel,
+            riskType: "file_access",
+            confidence: 90,
+            source: "heuristic",
+            violatedLayers: ["L1.1"],
+            isCredential: !!sp.credential
+          };
+        }
+        if (isArchiveReadOfDir(command, sp.path)) {
+          return {
+            allowed: false,
+            reason: `\u5F52\u6863/\u590D\u5236\u8BFB\u53D6\u654F\u611F\u76EE\u5F55: ${sp.desc} (${sp.path})`,
+            riskLevel: sp.riskLevel,
+            riskType: "file_access",
+            confidence: 90,
+            source: "heuristic",
+            violatedLayers: ["L1.1"],
+            isCredential: !!sp.credential
+          };
+        }
+        continue;
+      }
       if (!isWriteOpFlag && !sp.credential) {
         continue;
       }
@@ -2934,7 +2995,7 @@ function checkSensitivePath(command, cwd, agentExt) {
         riskType: "file_access",
         confidence: 90,
         source: "heuristic",
-        violatedLayers: ["1.1"],
+        violatedLayers: ["L1.1"],
         isCredential: !!sp.credential
       };
     }
@@ -2957,7 +3018,7 @@ function checkSensitivePath(command, cwd, agentExt) {
           riskType: "file_access",
           confidence: 90,
           source: "heuristic",
-          violatedLayers: ["1.1"],
+          violatedLayers: ["L1.1"],
           isCredential: !!sp.credential
         };
       }
@@ -2974,7 +3035,7 @@ function checkSensitivePath(command, cwd, agentExt) {
         riskType: "file_access",
         confidence: 90,
         source: "heuristic",
-        violatedLayers: ["1.1"],
+        violatedLayers: ["L1.1"],
         isCredential: true
       };
     }
@@ -2987,18 +3048,142 @@ function checkSensitivePath(command, cwd, agentExt) {
       riskType: "file_access",
       confidence: 90,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
   return null;
 }
+function isHomeValue(path6) {
+  let p = path6.trim().toLowerCase();
+  if (p.startsWith("$(") && p.endsWith(")")) {
+    const inner = p.slice(2, -1).trim();
+    return HOME_TARGET_RE.test(" " + inner);
+  }
+  if (/^\/home\/[^/\s]+\/?$/.test(p)) return true;
+  return HOME_TARGET_RE.test(" " + p);
+}
+function isDeleteCommand(seg) {
+  const s = seg.trimStart();
+  if (/^(?:rm|rmdir|unlink)\b/i.test(s)) return true;
+  return /删除|移除/.test(s);
+}
+function homeEscapeTarget(seg) {
+  const low = seg.toLowerCase();
+  const re = /(?:~|(?:\$home|\$\{home\})|\/home\/[a-z0-9_.-]+)/g;
+  let m;
+  while ((m = re.exec(low)) !== null) {
+    const endIdx = m.index + m[0].length;
+    const tail = low.slice(endIdx);
+    if (!tail) continue;
+    let token = tail.trimStart().split(/\s+/)[0] || "";
+    token = token.split("&&")[0].split("||")[0].split(";")[0].replace(/\/+$/, "");
+    token = token.replace(/^['"]|['"]$/g, "");
+    const segments = token.split("/").filter((s) => s && s !== ".");
+    if (!segments.some((s) => s === "..")) continue;
+    let depth = 0;
+    let minDepth = 0;
+    for (const s of segments) {
+      depth += s === ".." ? -1 : 1;
+      minDepth = Math.min(minDepth, depth);
+    }
+    if (minDepth < 0) return true;
+    if (depth <= 0) return true;
+  }
+  return false;
+}
+function checkHomeDeletion(actionType, actionDetail) {
+  if (actionType !== "bash" && actionType !== "executebash" && actionType !== "terminal-executebash") return null;
+  const segs = actionDetail.split(/&&|\|\||;|\n/).map((s) => s.trim()).filter(Boolean);
+  for (const seg of segs) {
+    if (!isDeleteCommand(seg)) continue;
+    if (HOME_TARGET_RE.test(seg) || homeEscapeTarget(seg)) {
+      return {
+        allowed: false,
+        reason: "\u68C0\u6D4B\u5230\u5220\u9664\u4E3B\u76EE\u5F55 (~/$HOME) \u64CD\u4F5C",
+        riskLevel: "high",
+        riskType: "script_execution",
+        confidence: 90,
+        source: "heuristic",
+        violatedLayers: ["L1.1"]
+      };
+    }
+  }
+  const assigned = {};
+  for (const m of actionDetail.matchAll(HOME_ASSIGN_RE)) assigned[m[1]] = m[2];
+  for (const [varName, path6] of Object.entries(assigned)) {
+    if (!isHomeValue(path6)) continue;
+    const varRefRe = new RegExp(`(?:${escapeRegExp(varName)}|\\$\\{${escapeRegExp(varName)}\\})`);
+    for (const seg of segs) {
+      if (!isDeleteCommand(seg)) continue;
+      if (varRefRe.test(seg)) {
+        return {
+          allowed: false,
+          reason: `\u68C0\u6D4B\u5230\u901A\u8FC7\u53D8\u91CF ${varName}\uFF08=${path6}\uFF0C\u4E3B\u76EE\u5F55\uFF09\u6267\u884C\u5220\u9664`,
+          riskLevel: "high",
+          riskType: "script_execution",
+          confidence: 90,
+          source: "heuristic",
+          violatedLayers: ["L1.1"]
+        };
+      }
+    }
+  }
+  return null;
+}
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function isDeleteActionForDir(command, dirPath) {
+  const low = command.toLowerCase();
+  const dpath = dirPath.toLowerCase();
+  if (new RegExp(`\\b(?:rm|unlink|rmdir)\\b[^&|;]*?${escapeRegExp(dpath)}`, "i").test(low)) {
+    return true;
+  }
+  if (new RegExp(`(?:\u5220\u9664|\u79FB\u9664)[^\\n;|&]*?${escapeRegExp(dpath)}`).test(low)) {
+    return true;
+  }
+  for (const seg of low.split(/&&|\|\||;|\n/)) {
+    const fw = (seg.trim().split(/\s+/)[0] || "").toLowerCase();
+    if ((fw === "rm" || fw === "unlink" || fw === "rmdir") && low.includes(dpath)) {
+      return true;
+    }
+  }
+  return false;
+}
+function isArchiveReadOfDir(command, dirPath) {
+  const low = command.toLowerCase();
+  const dpath = dirPath.toLowerCase();
+  for (const seg of low.split(/&&|\|\||;|\n/)) {
+    const s = seg.trim();
+    if (!s || !s.includes(dpath)) continue;
+    const parts = s.split(/\s+/);
+    const fw = parts[0] || "";
+    if (fw === "zip") return true;
+    if (fw === "tar") {
+      if (/(?:^|\s)-[a-zA-Z]*x|--extract/.test(s)) continue;
+      return true;
+    }
+    if (fw === "cp" || fw === "rsync") {
+      const segPaths = s.match(/[/~][^\s;|&><'"]*/g) || [];
+      if (segPaths.length && segPaths[0].includes(dpath)) return true;
+    }
+  }
+  return false;
+}
+function isSshKeygenGenerate(command) {
+  const low = command.toLowerCase();
+  if (!low.includes("ssh-keygen")) return false;
+  if (!/(?:^|\s)-t\s+\S+/.test(low)) return false;
+  if (/(?:^|\s)-\S*[ylpB]\S*/.test(low)) return false;
+  return true;
+}
 function checkDangerousPatterns(actionType, actionDetail) {
   if (actionType === "file_write" || actionType === "file_edit") return null;
   const scan = stripHeredocContent(actionDetail);
   const TEMP_DIRS = ["/tmp", "/var/tmp", "/run", "/dev/shm"];
   const isTempPath = TEMP_DIRS.some(
     (td) => new RegExp(`(?:^|[\\s/])${td.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[\\s/]|$)`).test(actionDetail)
-  );
+  ) || /(?:^|[\s;]|&&\s*|\|\|\s*)var\/tmp(?:[/\s;]|$)/.test(actionDetail);
   const wildcardDeleteRe = /(?:\brm\b|\b(r?mdir|del|delete|remove|rmdir|unlink)\b|\b删除\b|\b移除\b)[\s\S]{0,40}?[*?]|[*?][\s\S]{0,40}?\b(?:rm|del|delete|remove|rmdir|unlink)\b|rm\s+-[a-zA-Z]*[rf][a-zA-Z]*\s+\S*[*?]/i;
   if (!isTempPath && wildcardDeleteRe.test(scan)) {
     return {
@@ -3008,7 +3193,7 @@ function checkDangerousPatterns(actionType, actionDetail) {
       riskType: "script_execution",
       confidence: 90,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
   const findWriteMatch = actionDetail.match(
@@ -3023,10 +3208,10 @@ function checkDangerousPatterns(actionType, actionDetail) {
       riskType: "script_execution",
       confidence: 90,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
-  if (/>\s*\/etc\//.test(actionDetail) || />\s*\/boot\//.test(actionDetail)) {
+  if (/>\s*['"]?\/etc\//.test(actionDetail) || />\s*['"]?\/boot\//.test(actionDetail) || />\s*['"]?\/proc\//.test(actionDetail)) {
     return {
       allowed: false,
       reason: "\u68C0\u6D4B\u5230\u91CD\u5B9A\u5411\u8986\u76D6\u5199\u5165\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55",
@@ -3034,7 +3219,7 @@ function checkDangerousPatterns(actionType, actionDetail) {
       riskType: "file_access",
       confidence: 95,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
   if (/>\s*\/dev\/(sd|hd|nvme|vd|loop|mem|kmsg|port|zero|random|urandom|full|core)/i.test(actionDetail)) {
@@ -3045,7 +3230,7 @@ function checkDangerousPatterns(actionType, actionDetail) {
       riskType: "file_access",
       confidence: 90,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
   return null;
@@ -3136,13 +3321,13 @@ function checkLateralMovement(actionDetail) {
         riskType: "lateral_movement",
         confidence: 80,
         source: "heuristic",
-        violatedLayers: ["1.1"]
+        violatedLayers: ["L1.1"]
       };
     }
   }
   return null;
 }
-var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES;
+var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES, HOME_TARGET_RE, HOME_ASSIGN_RE;
 var init_heuristic = __esm({
   "src/engine/heuristic.ts"() {
     "use strict";
@@ -3172,6 +3357,8 @@ var init_heuristic = __esm({
     })();
     SENSITIVE_EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
     SEARCH_ACTION_PREFIXES = ["search-", "web-", "browser-", "query-", "websearch", "web_search"];
+    HOME_TARGET_RE = /(?:^|[\s="'($])(?:~|(?:\$home|\$\{home\}))(?:\/(?:\.\*|\*|\.)?)?(?=[\s"';}|&)]|$)/i;
+    HOME_ASSIGN_RE = /([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(~[A-Za-z0-9_./-]*|\$HOME[A-Za-z0-9_./-]*|\$\{HOME\}[A-Za-z0-9_./-]*|\/home\/[^\s;|&]+|\$\((?:[^()]|\([^()]*\))*\))(?=\s|;|$|\||&)/gi;
   }
 });
 
@@ -3350,112 +3537,6 @@ var init_token_stats = __esm({
   }
 });
 
-// src/engine/formal-engine/decode.ts
-var decode_exports = {};
-__export(decode_exports, {
-  allCandidates: () => allCandidates,
-  decodeBase64Literals: () => decodeBase64Literals,
-  decodeUrlAndNumeric: () => decodeUrlAndNumeric,
-  matchStageAny: () => matchStageAny
-});
-function isValidBase64Token(tok) {
-  if (tok.length < 8) return false;
-  if (!(tok.length % 4 === 0 || tok.endsWith("==") || tok.endsWith("="))) return false;
-  return true;
-}
-function isPrintable(s) {
-  for (let i = 0; i < s.length; i++) {
-    const c = s.charCodeAt(i);
-    if (c < 32 || c > 126) return false;
-  }
-  return true;
-}
-function decodeBase64Literals(text) {
-  const out = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const m of text.matchAll(B64_TOKEN_RE)) {
-    const tok = m[0];
-    if (!isValidBase64Token(tok)) continue;
-    if (!/[A-Z]/.test(tok) || !/[a-z]/.test(tok)) continue;
-    try {
-      const padded = tok + "=".repeat((4 - tok.length % 4) % 4);
-      const bin = Buffer.from(padded, "base64");
-      const s = bin.toString("utf8");
-      if (s && isPrintable(s) && !seen.has(s)) {
-        seen.add(s);
-        out.push(s);
-      }
-    } catch {
-    }
-  }
-  return out;
-}
-function decodeUrlAndNumeric(text) {
-  const out = [];
-  let s = text;
-  for (let i = 0; i < 3; i++) {
-    let nxt = s;
-    try {
-      nxt = decodeURIComponent(s);
-    } catch {
-      break;
-    }
-    if (nxt === s) break;
-    s = nxt;
-  }
-  if (s !== text) out.push(s);
-  if (/\\[0-7]{3}/.test(text)) {
-    let expanded = "";
-    try {
-      expanded = text.replace(/\\[0-7]{3}/g, (m) => String.fromCharCode(parseInt(m.slice(1), 8)));
-    } catch {
-    }
-    if (expanded && expanded !== text) out.push(expanded);
-  }
-  if (/\\x[0-9a-fA-F]{2}/.test(text)) {
-    let expanded = "";
-    try {
-      expanded = text.replace(/\\x[0-9a-fA-F]{2}/g, (m) => String.fromCharCode(parseInt(m.slice(2), 16)));
-    } catch {
-    }
-    if (expanded && expanded !== text) out.push(expanded);
-  }
-  return out;
-}
-function allCandidates(detail, max = 8) {
-  const cands = [detail];
-  cands.push(...decodeBase64Literals(detail));
-  cands.push(...decodeUrlAndNumeric(detail));
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const c of cands) {
-    if (seen.has(c) || c.length > 4096) continue;
-    seen.add(c);
-    out.push(c);
-    if (out.length >= max) break;
-  }
-  return out;
-}
-function matchStageAny(detail, stages) {
-  for (const cand of allCandidates(detail)) {
-    for (const [name, pats] of Object.entries(stages)) {
-      for (const p of pats) {
-        p.lastIndex = 0;
-        if (p.test(cand)) return name;
-      }
-    }
-  }
-  return "";
-}
-var B64_TOKEN_RE;
-var init_decode = __esm({
-  "src/engine/formal-engine/decode.ts"() {
-    "use strict";
-    init_esm_shims();
-    B64_TOKEN_RE = /[A-Za-z0-9+/]+={0,2}/g;
-  }
-});
-
 // node_modules/better-sqlite3/lib/util.js
 var require_util = __commonJS({
   "node_modules/better-sqlite3/lib/util.js"(exports) {
@@ -4283,7 +4364,7 @@ var AnalyzeRequestSchema = z.object({
   session_history: z.array(z.object({
     session_id: z.string(),
     action_history: z.array(ActionItemSchema).default([])
-  })).default([]).describe("Multi-session historical actions (optional): for L2.4 formal engine cross-session combo-chain / sensitive-data-flow verification. Provided by caller (incl. future agentgate)."),
+  })).default([]).describe("Multi-session historical actions (optional): for L2.2 formal engine cross-session combo-chain / sensitive-data-flow verification. Provided by caller (incl. future agentgate)."),
   a_next: ActionItemSchema.describe("Next action to be executed"),
   reason: z.string().default("").describe("Reason for executing this action"),
   os_type: z.string().default("").describe("OS type: 'linux', 'windows', or empty for auto-detect"),
@@ -4300,7 +4381,9 @@ var AnalyzeResponseSchema = z.object({
   policy: z.string().default(""),
   violated_policy: z.string().default(""),
   confidence: z.number().int().min(0).max(100).default(100),
-  analysis_duration_ms: z.number().default(0)
+  analysis_duration_ms: z.number().default(0),
+  // 组合攻击链反例路径：每步 [session_id, seq, stage, timestamp]，含真实发生时间
+  violation_chain: z.array(z.array(z.union([z.string(), z.number()]).nullable())).default([])
 });
 var HealthResponseSchema = z.object({
   status: z.string().default("healthy"),
@@ -4563,6 +4646,7 @@ ${result.scriptContent}
 init_esm_shims();
 init_heuristic();
 init_logic_rules();
+init_inline_analyzer();
 import { statSync as statSync2, existsSync as existsSync9 } from "fs";
 import { resolve as resolve8, join as join6, isAbsolute as isAbsolute2 } from "path";
 import { homedir as homedir4 } from "os";
@@ -6177,6 +6261,13 @@ function extractScriptPath2(command) {
   return null;
 }
 function extractScriptPathWithArgs(command) {
+  const inline = command.match(/(?:^|\s|&&|\|\|)\s*(?:bash|\/bin\/bash|sh|zsh)\s+-c\s*(['"])([\s\S]*?)\1/i);
+  if (inline) {
+    const inner = inline[2];
+    const realPath = extractScriptPath2(inner);
+    if (realPath) return { path: realPath, args: [] };
+    return { path: null, args: [] };
+  }
   const scriptPath = extractScriptPath2(command);
   if (!scriptPath) return { path: null, args: [] };
   const idx = command.indexOf(scriptPath);
@@ -6190,11 +6281,59 @@ function extractScriptPathWithArgs(command) {
   }
   return { path: scriptPath, args };
 }
+function looksLikeScriptPath(tok) {
+  const t = tok.trim().replace(/^['"]|['"]$/g, "");
+  if (!t) return false;
+  const low = t.toLowerCase();
+  if (["bash", "sh", "zsh", "dash", "python", "python3", "perl", "ruby", "node", "php", "lua"].includes(low)) return false;
+  if (/\.(sh|bash|py|pl|rb|js|php|lua)$/.test(low)) return true;
+  if (t.includes("/") && !t.startsWith("-")) return true;
+  return false;
+}
 function extractInlineScriptPath(actionDetail) {
+  const code = extractInlineCode(actionDetail);
+  if (code) {
+    const candidates = [];
+    const osRe = /os\.(?:system|popen)\s*\(\s*(['"])(.*?)\1\s*\)/gi;
+    let m;
+    while ((m = osRe.exec(code)) !== null) candidates.push(m[2]);
+    const subListRe = /subprocess\.(?:run|call|Popen|check_output|check_call)\s*\(\s*\[(.*?)\]/gi;
+    while ((m = subListRe.exec(code)) !== null) candidates.push(m[1]);
+    const subShellRe = /subprocess\.(?:run|call|Popen|check_output|check_call)\s*\(\s*(['"])(.*?)\1[^)]*?shell\s*=\s*true/gi;
+    while ((m = subShellRe.exec(code)) !== null) candidates.push(m[2]);
+    for (const cand of candidates) {
+      const tokens = cand.includes(",") ? cand.split(/\s*,\s*/).map((t) => t.trim().replace(/^['"]|['"]$/g, "")) : cand.split(/\s+/);
+      for (const tok of tokens) {
+        if (looksLikeScriptPath(tok)) {
+          try {
+            const resolved = resolvePath2(tok.replace(/^['"]|['"]$/g, ""));
+            if (existsSync9(resolved)) {
+              const stat = statSync2(resolved);
+              if (stat.isFile()) return resolved;
+            }
+          } catch {
+          }
+        }
+      }
+    }
+    const openRe = /open\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+    while ((m = openRe.exec(code)) !== null) {
+      const p = m[1];
+      try {
+        const resolved = resolvePath2(p);
+        if (existsSync9(resolved)) {
+          const stat = statSync2(resolved);
+          if (stat.isFile()) return resolved;
+        }
+      } catch {
+      }
+    }
+    return null;
+  }
   const re = /open\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
-  let m;
-  while ((m = re.exec(actionDetail)) !== null) {
-    const p = m[1];
+  let m2;
+  while ((m2 = re.exec(actionDetail)) !== null) {
+    const p = m2[1];
     let resolved;
     try {
       resolved = resolvePath2(p);
@@ -6579,7 +6718,7 @@ async function analyzeWithLLM(prompt, config) {
         riskType: riskType || "",
         confidence: typeof parsed.confidence === "number" ? Math.min(100, Math.max(0, parsed.confidence)) : 70,
         source: "llm",
-        violatedLayers: ["3"]
+        violatedLayers: ["L3.1"]
       };
     } catch (err) {
       if (abortController.signal.aborted) {
@@ -7140,7 +7279,111 @@ init_esm_shims();
 // src/engine/formal-engine/builder.ts
 init_esm_shims();
 init_rules_loader();
-init_decode();
+
+// src/engine/formal-engine/decode.ts
+init_esm_shims();
+var B64_TOKEN_RE = /[A-Za-z0-9+/]+={0,2}/g;
+function isValidBase64Token(tok) {
+  if (tok.length < 8) return false;
+  if (!(tok.length % 4 === 0 || tok.endsWith("==") || tok.endsWith("="))) return false;
+  return true;
+}
+function isPrintable(s) {
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c < 32 || c > 126) return false;
+  }
+  return true;
+}
+function decodeBase64Literals(text) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const m of text.matchAll(B64_TOKEN_RE)) {
+    const tok = m[0];
+    if (!isValidBase64Token(tok)) continue;
+    if (!/[A-Z]/.test(tok) || !/[a-z]/.test(tok)) continue;
+    try {
+      const padded = tok + "=".repeat((4 - tok.length % 4) % 4);
+      const bin = Buffer.from(padded, "base64");
+      const s = bin.toString("utf8");
+      if (s && isPrintable(s) && !seen.has(s)) {
+        seen.add(s);
+        out.push(s);
+      }
+    } catch {
+    }
+  }
+  return out;
+}
+var QUOTED_STR_RE = /('(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"|`(?:[^`\\]|\\.)*`)/g;
+var OUTPUT_CMDS = /* @__PURE__ */ new Set(["echo", "printf", "print"]);
+function stripStringLiterals(text) {
+  const m = text.match(/\s*([A-Za-z_][\w-]*|\/?[\w./-]+)\b/);
+  if (!m) return text;
+  const cmd = m[1].split("/").pop().toLowerCase();
+  if (!OUTPUT_CMDS.has(cmd)) return text;
+  return text.replace(QUOTED_STR_RE, "");
+}
+function decodeUrlAndNumeric(text) {
+  const out = [];
+  let s = text;
+  for (let i = 0; i < 3; i++) {
+    let nxt = s;
+    try {
+      nxt = decodeURIComponent(s);
+    } catch {
+      break;
+    }
+    if (nxt === s) break;
+    s = nxt;
+  }
+  if (s !== text) out.push(s);
+  if (/\\[0-7]{3}/.test(text)) {
+    let expanded = "";
+    try {
+      expanded = text.replace(/\\[0-7]{3}/g, (m) => String.fromCharCode(parseInt(m.slice(1), 8)));
+    } catch {
+    }
+    if (expanded && expanded !== text) out.push(expanded);
+  }
+  if (/\\x[0-9a-fA-F]{2}/.test(text)) {
+    let expanded = "";
+    try {
+      expanded = text.replace(/\\x[0-9a-fA-F]{2}/g, (m) => String.fromCharCode(parseInt(m.slice(2), 16)));
+    } catch {
+    }
+    if (expanded && expanded !== text) out.push(expanded);
+  }
+  return out;
+}
+function allCandidates(detail, max = 8) {
+  const shell = stripStringLiterals(detail);
+  const cands = [shell];
+  cands.push(...decodeBase64Literals(shell));
+  cands.push(...decodeUrlAndNumeric(shell));
+  cands.push(...decodeBase64Literals(detail));
+  cands.push(...decodeUrlAndNumeric(detail));
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const c of cands) {
+    if (seen.has(c) || c.length > 4096) continue;
+    seen.add(c);
+    out.push(c);
+    if (out.length >= max) break;
+  }
+  return out;
+}
+function matchStageAny(detail, stages) {
+  for (const cand of allCandidates(detail)) {
+    for (const [name, pats] of Object.entries(stages)) {
+      for (const p of pats) {
+        p.lastIndex = 0;
+        if (p.test(cand)) return name;
+      }
+    }
+  }
+  return "";
+}
 
 // src/engine/formal-engine/ltl.ts
 init_esm_shims();
@@ -7174,11 +7417,7 @@ function compileAps(apPatterns) {
 }
 function labelEvent(actionDetail) {
   if (!AP_RE) compileAps(loadMC().ap_patterns || {});
-  let candidates = [actionDetail];
-  try {
-    candidates = (init_decode(), __toCommonJS(decode_exports)).allCandidates(actionDetail);
-  } catch {
-  }
+  const candidates = allCandidates(actionDetail);
   const hits = /* @__PURE__ */ new Set();
   for (const [name, pats] of Object.entries(AP_RE || {})) {
     for (const c of candidates) {
@@ -7505,7 +7744,7 @@ function checkSensitiveDataFlow(graph) {
     const n = nodes[i];
     if (tainted.has(i) && EXFIL_RE.test(n.actionDetail)) {
       violations.push({
-        propertyId: "sensitive-data-exfil",
+        propertyId: "sensitive-data-flow",
         reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${tainted.get(i)} \u2192 ${n.sessionId}#${n.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
         riskLevel: "critical",
         path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
@@ -7556,7 +7795,7 @@ function checkNeverExfilAfterPrivesc(graph) {
     if (pre) {
       const post = nodes[firstEv];
       return [{
-        propertyId: "no-privesc-then-exfil",
+        propertyId: "no-exfil-after-privesc",
         reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\xAC\u25C7EXFIL)",
         riskLevel: "critical",
         path: [
@@ -7572,7 +7811,7 @@ function checkNeverExfilAfterPrivesc(graph) {
     for (let j = i + 1; j < nodes.length; j++) {
       if (isExfilNode(nodes[j])) {
         violations.push({
-          propertyId: "no-privesc-then-exfil",
+          propertyId: "no-exfil-after-privesc",
           reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\xAC\u25C7EXFIL)",
           riskLevel: "critical",
           path: [
@@ -7605,7 +7844,7 @@ function checkNeverExfilAfterCred(graph) {
     if (pre) {
       const post = nodes[firstEv];
       return [{
-        propertyId: "no-cred-then-exfil",
+        propertyId: "no-exfil-after-credential",
         reason: "\u8BFB\u53D6\u51ED\u636E\u540E\u51FA\u73B0\u5916\u4F20\uFF0C\u8FDD\u53CD \u25A1(CRED\u2192\xAC\u25C7EXFIL)",
         riskLevel: "critical",
         path: [
@@ -7621,7 +7860,7 @@ function checkNeverExfilAfterCred(graph) {
     for (let j = i + 1; j < nodes.length; j++) {
       if (isExfilNode(nodes[j])) {
         violations.push({
-          propertyId: "no-cred-then-exfil",
+          propertyId: "no-exfil-after-credential",
           reason: "\u8BFB\u53D6\u51ED\u636E\u540E\u51FA\u73B0\u5916\u4F20\uFF0C\u8FDD\u53CD \u25A1(CRED\u2192\xAC\u25C7EXFIL)",
           riskLevel: "critical",
           path: [
@@ -7691,7 +7930,7 @@ function checkLowIntegrityCommandExec(graph) {
     const n = nodes[i];
     if (lowAt.has(i) && isComputeNode(n)) {
       violations.push({
-        propertyId: "low-integrity-controls-command-exec",
+        propertyId: "low-integrity-command-exec",
         reason: `\u4F4E\u5B8C\u6574\u6027\u6570\u636E\u63A7\u5236\u547D\u4EE4\u6267\u884C\uFF1A${lowAt.get(i)} \u2192 ${n.sessionId}#${n.seq} \u6267\u884C\u4E0D\u53EF\u4FE1\u5185\u5BB9`,
         riskLevel: "critical",
         path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
@@ -7738,7 +7977,7 @@ function checkCrossSessionReachability(graph) {
       const srcIdx = Math.min(...sources);
       const srcDesc = nodes[srcIdx].actionDetail.slice(0, 40);
       violations.push({
-        propertyId: "cross-session-reachability",
+        propertyId: "low-integrity-reachability",
         reason: `\u4F4E\u5B8C\u6574\u6027\u6E90\u7ECF\u8DE8 session \u6570\u636E\u94FE\u591A\u8DF3\u5230\u8FBE\u5F53\u524D\u6267\u884C\uFF08\u6E90: ${srcDesc} \u2192 ${n.sessionId}#${n.seq}\uFF09`,
         riskLevel: "high",
         path: nodes.slice(-3).map((m) => ({ sessionId: m.sessionId, seq: m.seq, detail: m.actionDetail.slice(0, 60) }))
@@ -7790,17 +8029,17 @@ function checkSensitiveDataAggregation(graph) {
   return violations;
 }
 var ALL_PROPERTIES = [
-  { id: "cross-session-chain", check: checkCrossSessionChain },
-  { id: "sensitive-data-flow", check: checkSensitiveDataFlow },
-  { id: "cross-session-reachability", check: checkCrossSessionReachability },
-  { id: "no-privesc-then-exfil", check: checkNeverExfilAfterPrivesc },
-  { id: "no-cred-then-exfil", check: checkNeverExfilAfterCred },
+  { id: "cross-session-chain", check: checkCrossSessionChain, shortName: "P1" },
+  { id: "sensitive-data-flow", check: checkSensitiveDataFlow, shortName: "P2" },
+  { id: "low-integrity-reachability", check: checkCrossSessionReachability, shortName: "P3" },
+  { id: "no-exfil-after-privesc", check: checkNeverExfilAfterPrivesc, shortName: "P4" },
+  { id: "no-exfil-after-credential", check: checkNeverExfilAfterCred, shortName: "P5" },
   // L2.2 模型检测（通用 LTL 求值器，mc_rules.json 单一事实源；witness 语义见 ltl.ts）
-  { id: "mc-ltl-rules", check: checkMCRules },
-  // Rule 5 低完整性控制命令执行（integrity 维度，站点 L2.1 最有区分度的检测之一）
-  { id: "low-integrity-command-exec", check: checkLowIntegrityCommandExec },
-  // Rule 12 敏感数据聚合外传（egress 聚合 ≥2 事件源）
-  { id: "sensitive-data-aggregation", check: checkSensitiveDataAggregation }
+  { id: "mc-ltl-rules", check: checkMCRules, shortName: "P6" },
+  // P7 低完整性控制命令执行（integrity 维度，站点 L2.1 最有区分度的检测之一）
+  { id: "low-integrity-command-exec", check: checkLowIntegrityCommandExec, shortName: "P7" },
+  // P8 敏感数据聚合外传（egress 聚合 ≥2 事件源）
+  { id: "sensitive-data-aggregation", check: checkSensitiveDataAggregation, shortName: "P8" }
 ];
 
 // src/engine/formal-engine/engine.ts
@@ -7863,11 +8102,41 @@ var FormalEngine = class {
 // src/engine/formal-engine/stateful.ts
 init_esm_shims();
 init_rules_loader();
-init_decode();
 var DESTROY_RE = /\b(?:pkill|kill)\b|systemctl\s+stop|service\s+stop|crontab\s+-r|rm\s+-[rf]?\s+/i;
 var NEVER_ACTIVATED_RE = /\b(?:not\s+found|no\s+such\s+file|command\s+not\s+found|refused|failed\s+to\s+(?:start|bind|listen)|address\s+already\s+in\s+use)\b/i;
 var CRED_FILE_RE2 = /(known_hosts|\.ssh|id_rsa|\/etc\/shadow|\/etc\/passwd|credentials)/i;
-var EXFIL_RE2 = /https?:\/\/|scp\s+.*@|rsync\s+.*@/i;
+var EXFIL_RE2 = /https?:\/\/(?!127\.\d+\.\d+\.\d+|0\.0\.0\.0|localhost|\[?::1\]?)|scp\s+.*@|rsync\s+.*@/i;
+var PORT_RE = /(?:-p\s+(\d{1,5})|-p(\d{1,5})|:(\d{1,5})\b)/i;
+var BARE_PORT_RE = /(?<=^|\s)(\d{1,5})(?=\s|$)/g;
+var SOCK_RE = /([\w./-]*(?:\/tmp\/|\/var\/run\/|\.sock\b)[\w./-]*)/;
+var UNIT_RE = /systemctl\s+(?:start|enable|restart)\s+([\w.-]+)/i;
+var PORT_STAGE_RE = /LISTEN|PERSIST|SCAN/;
+function extractInstances(actionDetail, stage) {
+  const out = [];
+  if (PORT_STAGE_RE.test(stage)) {
+    const d = actionDetail;
+    let m;
+    const re = new RegExp(PORT_RE.source, "gi");
+    while ((m = re.exec(d)) !== null) {
+      const p = m[1] || m[2] || m[3];
+      if (p && Number(p) > 0 && Number(p) <= 65535) out.push(`port:${p}`);
+    }
+    if (/SCAN/.test(stage)) {
+      const bareRe = new RegExp(BARE_PORT_RE.source, "g");
+      while ((m = bareRe.exec(d)) !== null) {
+        if (m[1] && Number(m[1]) > 0 && Number(m[1]) <= 65535) out.push(`port:${m[1]}`);
+      }
+    }
+    m = SOCK_RE.exec(d);
+    if (m && m[1]) out.push(`sock:${m[1]}`);
+    m = UNIT_RE.exec(d);
+    if (m && m[1]) out.push(`unit:${m[1]}`);
+  }
+  return out;
+}
+function buckKey(chainId, inst) {
+  return inst ? `${chainId}@@${inst}` : chainId;
+}
 var STAGES_PATTERNS = null;
 var CHAINS = null;
 function loadRules() {
@@ -7910,7 +8179,11 @@ function lifecycleFor(detail, stage, isError) {
   return "";
 }
 var MAX_NODES = 1e5;
-var StatefulChainTracker = class {
+var StatefulChainTracker = class _StatefulChainTracker {
+  /** 本地接收时刻（实时路径无 called_at 时的兜底时间戳，ISO）。 */
+  static now() {
+    return (/* @__PURE__ */ new Date()).toISOString();
+  }
   agentId;
   nodes_ = [];
   ptr = {};
@@ -7932,10 +8205,14 @@ var StatefulChainTracker = class {
     for (const chain of chains) {
       const stages = chain.stages || [];
       if (stages.length === 0) continue;
-      const matched = this.ptr[String(chain.id || "")] || 0;
+      const cid = String(chain.id || "");
+      let matched = this.ptr[cid] || 0;
+      for (const [k, v] of Object.entries(this.ptr)) {
+        if (k.startsWith(`${cid}@@`) && v > matched && v < stages.length) matched = v;
+      }
       if (matched > 0 && matched < stages.length) {
         const pf = {
-          chainId: String(chain.id || ""),
+          chainId: cid,
           stages,
           matched,
           riskLevel: String(chain.riskLevel || chain.risk_level || "high"),
@@ -8011,8 +8288,10 @@ var StatefulChainTracker = class {
       actionDetail: ad,
       stage,
       resources: extractResources2(ad),
+      instances: extractInstances(ad, stage),
       isError,
-      lifecycle: lifecycleFor(ad, stage, isError)
+      lifecycle: lifecycleFor(ad, stage, isError),
+      timestamp: typeof action.calledAt === "string" ? action.calledAt : _StatefulChainTracker.now()
     };
     this.nodes_.push(node);
     this.seqNext += 1;
@@ -8020,11 +8299,19 @@ var StatefulChainTracker = class {
   }
   recordLifecycle(node) {
     if (node.lifecycle === "dead") {
-      let hit = false;
+      const clearedInsts = [];
+      for (const inst of node.instances) {
+        const key = `inst:${inst}`;
+        if (key in this.aliveResources) {
+          delete this.aliveResources[key];
+          clearedInsts.push(inst);
+        }
+      }
+      let pathHit = false;
       for (const r of node.resources) {
         if (r in this.aliveResources) {
           delete this.aliveResources[r];
-          hit = true;
+          pathHit = true;
         }
       }
       const detail = node.actionDetail;
@@ -8032,16 +8319,30 @@ var StatefulChainTracker = class {
         const base = r.split("/").pop() || "";
         if (base && detail.includes(base)) {
           delete this.aliveResources[r];
-          hit = true;
+          pathHit = true;
         }
       }
-      if (hit) this.resetChainsOnDestroy();
+      if (clearedInsts.length > 0 && !pathHit) {
+        for (const inst of clearedInsts) this.resetChainsForInstance(inst);
+      } else {
+        this.resetChainsOnDestroy();
+      }
       return;
     }
     if (node.lifecycle === "alive") {
       for (const r of node.resources) {
         this.aliveResources[r] = node.seq;
       }
+      for (const inst of node.instances) {
+        this.aliveResources[`inst:${inst}`] = node.seq;
+      }
+    }
+  }
+  /** 只重置指定实例在全部链上的进度（不影响其他端口/资源）。 */
+  resetChainsForInstance(inst) {
+    const key = buckKey("", inst).slice(2);
+    for (const k of Object.keys(this.ptr)) {
+      if (k.endsWith(`@@${inst}`)) this.ptr[k] = 0;
     }
   }
   resetChainsOnDestroy() {
@@ -8049,6 +8350,29 @@ var StatefulChainTracker = class {
       this.ptr[cid] = 0;
     }
   }
+  /**
+   * 当前节点应推进的链桶集合。
+   * - 有实例节点（LISTEN/PERSIST 带端口/socket/unit）→ 只推自己的实例桶；
+   *   同时为所有链的该实例建立桶（若首次出现）。
+   * - 无实例节点（EXEC/SCAN 等中间段）→ 推全局桶 + 所有当前活跃实例桶
+   *   （信息不足时保守推进一切可能，避免漏判）。
+   */
+  targetsForNode(node, chainId) {
+    const insts = node.instances;
+    if (insts.length > 0) {
+      const active = insts.filter((i) => this.aliveResources[`inst:${i}`] !== void 0);
+      if (active.length > 0) return active.map((i) => buckKey(chainId, i));
+      return [chainId];
+    }
+    const targets = [chainId];
+    for (const k of Object.keys(this.aliveResources)) {
+      if (k.startsWith("inst:")) {
+        const inst = k.slice("inst:".length);
+        targets.push(`${chainId}@@${inst}`);
+      }
+    }
+    return targets;
+  }
   advanceChains(node) {
     if (node.lifecycle === "dead") return null;
     if (node.lifecycle === "never_activated") {
@@ -8062,23 +8386,32 @@ var StatefulChainTracker = class {
       const stages = chain.stages || [];
       if (stages.length === 0) continue;
       const cid = String(chain.id || "");
-      const cur = this.ptr[cid] || 0;
-      if (cur < stages.length && stages[cur] === stage) {
-        this.ptr[cid] = cur + 1;
-        if (cur + 1 >= stages.length) {
-          return {
-            chainId: cid,
-            stages,
-            riskLevel: String(chain.riskLevel || chain.risk_level || "high"),
-            reason: String(chain.reason || "\u68C0\u6D4B\u5230\u7EC4\u5408\u653B\u51FB\u94FE"),
-            path: this.chainPath(stages)
-          };
+      const targets = this.targetsForNode(node, cid);
+      for (const key of targets) {
+        const cur = this.ptr[key] || 0;
+        if (cur < stages.length && stages[cur] === stage) {
+          this.ptr[key] = cur + 1;
+          if (cur + 1 >= stages.length) {
+            return {
+              chainId: cid,
+              stages,
+              riskLevel: String(chain.riskLevel || chain.risk_level || "high"),
+              reason: String(chain.reason || "\u68C0\u6D4B\u5230\u7EC4\u5408\u653B\u51FB\u94FE"),
+              path: this.chainPath(stages)
+            };
+          }
         }
       }
     }
     return null;
   }
   invalidateChainOnFailure(node) {
+    if (node.instances.length > 0) {
+      for (const inst of node.instances) {
+        this.resetChainsForInstance(inst);
+      }
+      return;
+    }
     const failed = new Set(node.resources);
     if (failed.size === 0) return;
     const { chains } = loadRules();
@@ -8094,7 +8427,7 @@ var StatefulChainTracker = class {
     let want = stages[0];
     for (const n of this.nodes_) {
       if (n.stage === want) {
-        path6.push({ sessionId: n.sessionId, seq: n.seq, stage: n.stage });
+        path6.push({ sessionId: n.sessionId, seq: n.seq, stage: n.stage, timestamp: n.timestamp });
         const idx = stages.indexOf(n.stage);
         if (idx + 1 < stages.length) {
           want = stages[idx + 1];
@@ -8130,7 +8463,7 @@ var StatefulChainTracker = class {
     if (!this.tainted.has(node.seq)) return [];
     if (EXFIL_RE2.test(node.actionDetail)) {
       return [{
-        property_id: "sensitive-data-exfil",
+        property_id: "sensitive-data-flow",
         reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${this.taintSource(node)} \u2192 ${node.sessionId}#${node.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
         risk_level: "critical",
         path: [[node.sessionId, node.seq, node.actionDetail.slice(0, 60)]]
@@ -8172,8 +8505,12 @@ var StatefulChainTracker = class {
         actionDetail: String(raw.actionDetail || ""),
         stage: String(raw.stage || ""),
         resources: [...raw.resources || []],
+        instances: [...raw.instances || []],
+        // 旧快照无此字段 → 空
         isError: Boolean(raw.isError),
-        lifecycle: String(raw.lifecycle || "")
+        lifecycle: String(raw.lifecycle || ""),
+        timestamp: typeof raw.timestamp === "string" ? raw.timestamp : null
+        // 旧快照无此字段 → null
       });
     }
     this.seqNext = Number(snapshot.seq_next || this.nodes_.length);
@@ -8402,7 +8739,7 @@ async function runAnalysis(input) {
             riskType: node.l1RiskType,
             confidence: 90,
             source: "heuristic_script_scan",
-            violatedLayers: ["1.1-script"]
+            violatedLayers: ["L1.2"]
           };
         }
       }
@@ -8520,7 +8857,7 @@ async function runAnalysis(input) {
             riskType: inlineJudgment.riskType,
             confidence: 90,
             source: "logic_rule",
-            violatedLayers: ["1.2"]
+            violatedLayers: ["L2.1"]
           };
         }
         return {
@@ -8553,7 +8890,7 @@ async function runAnalysis(input) {
         console.warn(
           `[AgentMoss] \u5F62\u5F0F\u5316\u9A8C\u8BC1 observe\uFF08\u53EA\u8BB0\u5F55\u4E0D\u62E6\u622A\uFF09: property=${v?.propertyId ?? "?"} risk=${v?.riskLevel ?? "?"} path_len=${v?.path?.length ?? 0} reason=${(v?.reason ?? "?").slice(0, 200)}`
         );
-        observedFormalLayers.push("2.4");
+        observedFormalLayers.push("L2.2");
       } else {
         return {
           allowed: false,
@@ -8562,7 +8899,7 @@ async function runAnalysis(input) {
           riskType: "formal_verification",
           confidence: 90,
           source: "formal_engine",
-          violatedLayers: ["2.4"]
+          violatedLayers: ["L2.2"]
         };
       }
     }
@@ -8579,7 +8916,7 @@ async function runAnalysis(input) {
           riskType: node.l2RiskType,
           confidence: 85,
           source: "logic_rule_script_scan",
-          violatedLayers: ["1.2-script"]
+          violatedLayers: ["L2.3"]
         };
       }
     }
@@ -8666,7 +9003,7 @@ async function runAnalysis(input) {
       riskType: "",
       confidence: 60,
       source: "llm_failure_fallback",
-      violatedLayers: ["3"]
+      violatedLayers: ["L3.1"]
     };
   }
   if (!llmResult.allowed && llmResult.confidence && llmResult.confidence >= 90 && _brainExtractor) {
@@ -9035,7 +9372,7 @@ async function analyzeRoute(c) {
         const judgment = incMatchedToDeny(inc);
         if (judgment) {
           const layers = [...result.violatedLayers];
-          if (!layers.includes("2.4-stateful")) layers.push("2.4-stateful");
+          if (!layers.includes("L2.2-stateful")) layers.push("L2.2-stateful");
           console.error(
             `[AgentMoss] stateful \u589E\u91CF\u62E6\u622A: agent=${agentId || "-"} property=${judgment.property_id} risk=${judgment.risk_level}`
           );
@@ -9049,7 +9386,8 @@ async function analyzeRoute(c) {
               policy: "",
               violated_policy: "",
               confidence: 90,
-              analysis_duration_ms: Math.round((performance.now() - t0) * 10) / 10
+              analysis_duration_ms: Math.round((performance.now() - t0) * 10) / 10,
+              violation_chain: judgment.violation_chain
             })
           );
         }
@@ -9088,17 +9426,20 @@ function getChainStateStoreFor(_agentId) {
 }
 function incMatchedToDeny(inc) {
   if (inc.matched) {
+    const chain = (inc.matched.path || []).map((p) => [p.sessionId, p.seq, p.stage, p.timestamp]);
     return {
       property_id: "cross-" + inc.matched.chainId,
       reason: inc.matched.reason,
-      risk_level: inc.matched.riskLevel
+      risk_level: inc.matched.riskLevel,
+      violation_chain: chain
     };
   }
   if (inc.exfil && inc.exfil.length > 0) {
     return {
-      property_id: "sensitive-data-exfil",
+      property_id: "sensitive-data-flow",
       reason: inc.exfil[0].reason,
-      risk_level: inc.exfil[0].risk_level
+      risk_level: inc.exfil[0].risk_level,
+      violation_chain: []
     };
   }
   return null;
@@ -9224,7 +9565,7 @@ function createConsoleRouter() {
     const rc = updateLayerEnabled(body.layer_key, body.enabled);
     return c.json({ layers: rc.layers, env_overrides: getEnvOverrides() });
   });
-  function getL24View() {
+  function getL22View() {
     const ltlHuman = {
       "mc-ltl-001": "\u5148\u8BFB\u53D6\u4E86\u51ED\u636E/\u5BC6\u94A5\uFF0C\u4E4B\u540E\u51FA\u73B0\u7F51\u7EDC\u5916\u4F20",
       "mc-ltl-002": "\u5148\u4E0B\u8F7D/\u83B7\u53D6\u4E86\u6587\u4EF6\uFF0C\u4E4B\u540E\u6267\u884C\u4E86\u6587\u4EF6",
@@ -9255,9 +9596,9 @@ function createConsoleRouter() {
       }))
     };
   }
-  function withL24View(rc) {
-    if (rc && rc.L2_4 && typeof rc.L2_4 === "object" && !Array.isArray(rc.L2_4)) {
-      const cat = rc.L2_4.ltl_rules;
+  function withL22View(rc) {
+    if (rc && rc.L2_2 && typeof rc.L2_2 === "object" && !Array.isArray(rc.L2_2)) {
+      const cat = rc.L2_2.ltl_rules;
       const rls = cat && cat.rules || [];
       const ltlHumanLocal = {
         "mc-ltl-001": "\u5148\u8BFB\u53D6\u4E86\u51ED\u636E/\u5BC6\u94A5\uFF0C\u4E4B\u540E\u51FA\u73B0\u7F51\u7EDC\u5916\u4F20",
@@ -9272,7 +9613,7 @@ function createConsoleRouter() {
         "mc-ltl-010": "\u5B89\u88C5\u4E86\u6301\u4E45\u5316\u673A\u5236\uFF08crontab/systemd/.bashrc \u7B49\uFF09\uFF0C\u9700\u5BA1\u6279",
         "mc-ctl-001": "\u4EFB\u4F55\u60C5\u51B5\u4E0B\u4E0D\u5141\u8BB8\u6E05\u9664\u65E5\u5FD7\uFF08\u5B89\u5168\u5E95\u7EBF\uFF09"
       };
-      rc.L2_4 = {
+      rc.L2_2 = {
         enabled_via: "L2_logic_rules",
         description: "\u65F6\u5E8F\u4E0E\u6570\u636E\u6D41\u653B\u51FB\u68C0\u6D4B\uFF08L2.2 \u6A21\u578B\u68C0\u6D4B\uFF09",
         ltl_rules: rls.map((r) => ({
@@ -9291,22 +9632,22 @@ function createConsoleRouter() {
   }
   console2.get("/api/rules", (c) => {
     const rc = loadRuntimeConfig();
-    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules, L2_4: getL24View() });
+    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules, L2_2: getL22View() });
   });
   console2.put("/api/rules/enabled", async (c) => {
     const b = await c.req.json();
     const rc = updateRuleEnabled(b.layer, b.category, b.rule_id, b.enabled);
-    return c.json(withL24View(rc));
+    return c.json(withL22View(rc));
   });
   console2.put("/api/rules/deny_mode", async (c) => {
     const b = await c.req.json();
     const rc = updateRuleDenyMode(b.layer, b.category, b.rule_id, b.deny_mode);
-    return c.json(withL24View(rc));
+    return c.json(withL22View(rc));
   });
   console2.put("/api/rules/skip_l3", async (c) => {
     const b = await c.req.json();
     const rc = updateRuleSkipL3(b.layer, b.category, b.rule_id, b.skip_l3_on_disabled);
-    return c.json(withL24View(rc));
+    return c.json(withL22View(rc));
   });
   console2.put("/api/categories/enabled", async (c) => {
     const b = await c.req.json();
@@ -9456,7 +9797,7 @@ function createConsoleRouter() {
   });
   console2.get("/api/config", (c) => {
     const rc = loadRuntimeConfig();
-    return c.json({ ...rc, L2_4: getL24View() });
+    return c.json({ ...rc, L2_2: getL22View() });
   });
   console2.get("/api/env-overrides", (c) => {
     return c.json({ overrides: getEnvOverrides() });
@@ -9536,4 +9877,14 @@ export {
 //! 顺序即 fail-closed 短路优先级：verify 逐个执行，首个返回违规的性质成为
 //! first_violation，后续不再评估。调整顺序影响判定归属，须与 Python
 //! properties.py ALL_PROPERTIES 保持一致并双端测试确认。
+//!
+//! shortName（P1~P8 连续短名）与 id（语义化英文）对照（与 Python 一致）：
+//!   P1 cross-session-chain          跨会话组合链
+//!   P2 sensitive-data-flow          敏感数据传播
+//!   P3 low-integrity-reachability   低完整性数据流可达
+//!   P4 no-exfil-after-privesc       提权后禁外传
+//!   P5 no-exfil-after-credential    凭据后禁外传
+//!   P6 mc-ltl-rules                 LTL 模型检测
+//!   P7 low-integrity-command-exec   低完整性命令执行
+//!   P8 sensitive-data-aggregation   敏感数据聚合外传
 //# sourceMappingURL=server.js.map