@kenhkl/agent-moss 0.17.5 → 0.17.7

package/dist/cli.js

@@ -1340,6 +1340,12 @@ function agentInflight() {
 function boundAgentOf(principal) {
   return principal.startsWith("agent:") ? principal.slice("agent:".length) : "";
 }
+function chainScope() {
+  return (env("AGENT_MOSS_CHAIN_SCOPE", "system") || "system").toLowerCase();
+}
+function chainBucket(agentId = "") {
+  return chainScope() === "agent" ? agentId || "default" : "__system__";
+}
 function rateLimitQps() {
   return envInt("AGENT_MOSS_RATE_LIMIT_QPS", 100);
 }
@@ -1411,6 +1417,8 @@ var init_models = __esm({
       action_history: z.array(ActionItemSchema).default([]).describe("Historical action sequence"),
       session_history: z.array(z.object({
         session_id: z.string(),
+        /** 来源 agent（AgentGate 逐会话带上）：记录在链路径里供告警/取证，不参与链匹配。 */
+        agent_id: z.string().optional(),
         action_history: z.array(ActionItemSchema).default([])
       })).default([]).describe("Multi-session historical actions (optional): for L2.2 formal engine cross-session combo-chain / sensitive-data-flow verification. Provided by caller (incl. future agentgate)."),
       a_next: ActionItemSchema.describe("Next action to be executed"),
@@ -2095,12 +2103,19 @@ function hasUserConsent(actionHistory) {
     return t === "ask_user_question" && String(h.output || "").trim().length > 0;
   });
 }
+function hasWeakConsent(actionHistory) {
+  return actionHistory.some((h) => {
+    if (String(h.actionType || "").toLowerCase() !== "ask_user_question") return false;
+    return CONSENT_TOPIC.test(String(h.actionDetail || ""));
+  });
+}
 function checkPasswordConsent(actionType, actionDetail, actionHistory, osType) {
   if (actionType !== "bash") return null;
   const pwdPatterns = runtimeConfigBridge.current?.effectivePasswordPatterns(osType) ?? PASSWORD_MODIFY_PATTERNS;
   const isPasswordModify = pwdPatterns.some((p) => p.test(actionDetail));
   if (!isPasswordModify) return null;
   if (hasUserConsent(actionHistory)) return null;
+  if (hasWeakConsent(actionHistory)) return null;
   return {
     allowed: false,
     reason: "\u6267\u884C\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u5BC6\u7801\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u5BC6\u7801\u4FEE\u6539\u98CE\u9669",
@@ -2117,6 +2132,7 @@ function checkUserDeletionConsent(actionType, actionDetail, actionHistory, osTyp
   const isUserDeletion = udPatterns.some((p) => p.test(actionDetail));
   if (!isUserDeletion) return null;
   if (hasUserConsent(actionHistory)) return null;
+  if (hasWeakConsent(actionHistory)) return null;
   return {
     allowed: false,
     reason: "\u6267\u884C\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u7528\u6237\u5220\u9664\u98CE\u9669",
@@ -2218,7 +2234,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd, osType) {
     violatedLayers: ["L2.1"]
   };
 }
-var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, PSEUDO_FS_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
+var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, PSEUDO_FS_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, CONSENT_TOPIC, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
 var init_logic_rules = __esm({
   "src/engine/logic-rules.ts"() {
     "use strict";
@@ -2305,6 +2321,7 @@ var init_logic_rules = __esm({
         reason: String(c.reason || "\u68C0\u6D4B\u5230\u7EC4\u5408\u653B\u51FB\u94FE")
       }));
     })();
+    CONSENT_TOPIC = /密码|口令|passwd|password|凭据|凭证|用户|账户|账号|userdel|deluser|groupdel/i;
     INLINE_SCRIPT_RE = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
     DIR_TRAVERSAL_KW = loadInline().dir_traversal_keywords ?? [];
     _IFA = loadLogicRules().indirect_file_access ?? {};
@@ -2990,7 +3007,7 @@ function _scenarioRulesToDefaults() {
   if (!existsSync7(scenDir)) return out;
   let entries;
   try {
-    entries = readdirSync4(scenDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    entries = readdirSync4(scenDir, { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith("__")).map((d) => d.name);
   } catch {
     return out;
   }
@@ -9370,7 +9387,7 @@ function markIntegrity(actionDetail) {
   }
   return { integrity: "medium", isLowSource: false };
 }
-function initNode(sessionId, seq, actionType, actionDetail, timestamp) {
+function initNode(sessionId, seq, actionType, actionDetail, timestamp, agentId = "") {
   const { integrity, isLowSource } = markIntegrity(actionDetail);
   return {
     sessionId,
@@ -9378,13 +9395,14 @@ function initNode(sessionId, seq, actionType, actionDetail, timestamp) {
     actionType,
     actionDetail,
     stage: markStage(actionDetail),
+    agentId: agentId || void 0,
     resources: extractResources(actionDetail),
     integrity,
     isLowSource,
     timestamp: timestamp || void 0
   };
 }
-function buildSessionGraph(actionHistory, aNext, sessionId = "current") {
+function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId = "") {
   const nodes = [];
   const edges = [];
   const stageFlags = /* @__PURE__ */ new Set();
@@ -9394,18 +9412,20 @@ function buildSessionGraph(actionHistory, aNext, sessionId = "current") {
     if (ad) details.push({
       actionType: String(a.actionType || ""),
       actionDetail: ad,
-      calledAt: a.calledAt || void 0
+      calledAt: a.calledAt || void 0,
+      agentId: a.agentId || agentId || void 0
     });
   }
   if (aNext) {
     details.push({
       actionType: String(aNext.actionType || ""),
       actionDetail: String(aNext.actionDetail || ""),
-      calledAt: aNext.calledAt || void 0
+      calledAt: aNext.calledAt || void 0,
+      agentId: aNext.agentId || agentId || void 0
     });
   }
   details.forEach((d, seq) => {
-    const node = initNode(sessionId, seq, d.actionType, d.actionDetail, d.calledAt);
+    const node = initNode(sessionId, seq, d.actionType, d.actionDetail, d.calledAt, d.agentId || "");
     nodes.push(node);
     if (node.stage) stageFlags.add(node.stage);
   });
@@ -9422,7 +9442,7 @@ function buildMultiSessionGraph(sessions, aNext) {
   }
   for (const s of sessions) {
     const sid = String(s.sessionId || "s");
-    mg.sessions.push(buildSessionGraph(s.actionHistory || [], void 0, sid));
+    mg.sessions.push(buildSessionGraph(s.actionHistory || [], void 0, sid, s.agentId || ""));
   }
   if (aNext) {
     const last = mg.sessions[mg.sessions.length - 1];
@@ -9432,7 +9452,8 @@ function buildMultiSessionGraph(sessions, aNext) {
         last.nodes.length,
         String(aNext.actionType || ""),
         String(aNext.actionDetail || ""),
-        aNext.calledAt || void 0
+        aNext.calledAt || void 0,
+        aNext.agentId || ""
       ));
       if (last.nodes.length > 1) {
         last.edges.push({ src: last.nodes.length - 2, dst: last.nodes.length - 1, kind: "next" });
@@ -10219,8 +10240,8 @@ var init_stateful = __esm({
       }
       /** 增量推进：把当前动作追加到时间线 → 链指针推进 → 判定。 */
       advance(args) {
-        const { aNext, sessionId = "current", isError = false } = args;
-        const node = this.appendNode(aNext, sessionId, isError);
+        const { aNext, sessionId = "current", isError = false, agentId = "" } = args;
+        const node = this.appendNode(aNext, sessionId, isError, agentId);
         if (!node) {
           return { seq: this.seqNext, node: null, matched: null, pendingPrefixes: this.pendingPrefixes, exfil: [], shouldBlock: false };
         }
@@ -10240,7 +10261,7 @@ var init_stateful = __esm({
           }
         };
       }
-      appendNode(action, sessionId, isError = false) {
+      appendNode(action, sessionId, isError = false, agentId = "") {
         const ad = String(action.actionDetail || "");
         const at = String(action.actionType || "");
         if (!ad) return null;
@@ -10257,6 +10278,7 @@ var init_stateful = __esm({
           resources: extractResources2(ad),
           instances: extractInstances(ad, stage),
           isError,
+          agentId: String(action.agentId || agentId || ""),
           lifecycle: lifecycleFor(ad, stage, isError),
           timestamp: typeof action.calledAt === "string" ? action.calledAt : _StatefulChainTracker.now()
         };
@@ -10394,7 +10416,13 @@ var init_stateful = __esm({
         let want = stages[0];
         for (const n of this.nodes_) {
           if (n.stage === want) {
-            path6.push({ sessionId: n.sessionId, seq: n.seq, stage: n.stage, timestamp: n.timestamp });
+            path6.push({
+              sessionId: n.sessionId,
+              seq: n.seq,
+              stage: n.stage,
+              timestamp: n.timestamp,
+              agentId: n.agentId
+            });
             const idx = stages.indexOf(n.stage);
             if (idx + 1 < stages.length) {
               want = stages[idx + 1];
@@ -10419,7 +10447,7 @@ var init_stateful = __esm({
         }
         if (taintedRes.size > 0) {
           this.tainted.add(idx);
-          for (const r of taintedRes) this.taintedResources.add(r);
+          for (const r of node.resources) this.taintedResources.add(r);
         }
       }
       resourceTainted(resource) {
@@ -10468,6 +10496,7 @@ var init_stateful = __esm({
           this.nodes_.push({
             seq: Number(raw.seq || 0),
             sessionId: String(raw.sessionId || ""),
+            agentId: String(raw.agentId || ""),
             actionType: String(raw.actionType || ""),
             actionDetail: String(raw.actionDetail || ""),
             stage: String(raw.stage || ""),
@@ -10574,9 +10603,9 @@ var init_chain_state = __esm({
         delete this.data[agentId];
         this._scheduleWrite();
       }
-      applyAction(agentId, aNext, sessionId, isError = false) {
+      applyAction(agentId, aNext, sessionId, isError = false, sourceAgent = "") {
         const t = this.load(agentId) || new StatefulChainTracker(agentId);
-        const r = t.advance({ aNext, sessionId, isError });
+        const r = t.advance({ aNext, sessionId, isError, agentId: sourceAgent });
         this.save(t);
         return r;
       }
@@ -10891,10 +10920,14 @@ async function runAnalysis(input) {
     const formalSessions = [];
     if (input.sessionHistory) {
       for (const s of input.sessionHistory) {
-        formalSessions.push({ sessionId: s.sessionId || "s", actionHistory: s.actionHistory || [] });
+        formalSessions.push({
+          sessionId: s.sessionId || "s",
+          ...s.agentId ? { agentId: s.agentId } : {},
+          actionHistory: s.actionHistory || []
+        });
       }
     }
-    formalSessions.push({ sessionId: "current", actionHistory: input.actionHistory });
+    formalSessions.push({ sessionId: "current", agentId: input.agentId, actionHistory: input.actionHistory });
     const formalResult = formalEngine.verify(formalSessions, input.aNext);
     if (!formalResult.verified) {
       const v = formalResult.violations[0];
@@ -11990,6 +12023,8 @@ async function analyzeRoute(c) {
       })),
       sessionHistory: (req.session_history || []).map((s) => ({
         sessionId: s.session_id,
+        // 来源 agent（AgentGate 逐会话带上，用于链路径取证展示；不参与链匹配）
+        ...s.agent_id ? { agentId: s.agent_id } : {},
         actionHistory: (s.action_history || []).map((h) => ({
           actionType: h.action_type,
           actionDetail: h.action_detail,
@@ -12048,10 +12083,14 @@ async function analyzeRoute(c) {
     if (incEnabled === "1" || incEnabled === "true" || incEnabled === "yes" || incEnabled === "on") {
       try {
         const store = getChainStateStoreFor(agentId);
-        const inc = store.applyAction(agentId, {
-          actionType: req.a_next.action_type,
-          actionDetail: req.a_next.action_detail
-        }, req.session_id, Boolean(meta.is_error));
+        const inc = store.applyAction(
+          chainBucket(agentId),
+          { actionType: req.a_next.action_type, actionDetail: req.a_next.action_detail },
+          req.session_id,
+          Boolean(meta.is_error),
+          agentId
+          // 来源：真实 agent（桶 key 可能是 __system__）
+        );
         const judgment = incMatchedToDeny(inc);
         if (judgment) {
           const layers = [...result.violated_layers];
@@ -12116,7 +12155,7 @@ function getChainStateStoreFor(_agentId) {
 }
 function incMatchedToDeny(inc) {
   if (inc.matched) {
-    const chain = (inc.matched.path || []).map((p) => [p.sessionId, p.seq, p.stage, p.timestamp]);
+    const chain = (inc.matched.path || []).map((p) => [p.sessionId, p.seq, p.stage, p.timestamp, p.agentId ?? null]);
     return {
       property_id: "cross-" + inc.matched.chainId,
       reason: inc.matched.reason,
@@ -12141,9 +12180,10 @@ async function reviewRoute(c) {
     const req = ReviewRequestSchema.parse(body);
     const agentId = req.agent_id || "default";
     const store = getChainStateStoreFor(agentId);
-    let tracker = store.load(agentId);
+    const bucket = chainBucket(agentId);
+    let tracker = store.load(bucket);
     if (!tracker) {
-      tracker = new StatefulChainTracker(agentId);
+      tracker = new StatefulChainTracker(bucket);
     }
     if (req.db_path && !pathWithin(req.db_path, reviewRoots())) {
       return c.json({

package/dist/engine/coordinator.js

@@ -1345,12 +1345,19 @@ function hasUserConsent(actionHistory) {
     return t === "ask_user_question" && String(h.output || "").trim().length > 0;
   });
 }
+function hasWeakConsent(actionHistory) {
+  return actionHistory.some((h) => {
+    if (String(h.actionType || "").toLowerCase() !== "ask_user_question") return false;
+    return CONSENT_TOPIC.test(String(h.actionDetail || ""));
+  });
+}
 function checkPasswordConsent(actionType, actionDetail, actionHistory, osType) {
   if (actionType !== "bash") return null;
   const pwdPatterns = runtimeConfigBridge.current?.effectivePasswordPatterns(osType) ?? PASSWORD_MODIFY_PATTERNS;
   const isPasswordModify = pwdPatterns.some((p) => p.test(actionDetail));
   if (!isPasswordModify) return null;
   if (hasUserConsent(actionHistory)) return null;
+  if (hasWeakConsent(actionHistory)) return null;
   return {
     allowed: false,
     reason: "\u6267\u884C\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u5BC6\u7801\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u5BC6\u7801\u4FEE\u6539\u98CE\u9669",
@@ -1367,6 +1374,7 @@ function checkUserDeletionConsent(actionType, actionDetail, actionHistory, osTyp
   const isUserDeletion = udPatterns.some((p) => p.test(actionDetail));
   if (!isUserDeletion) return null;
   if (hasUserConsent(actionHistory)) return null;
+  if (hasWeakConsent(actionHistory)) return null;
   return {
     allowed: false,
     reason: "\u6267\u884C\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u7528\u6237\u5220\u9664\u98CE\u9669",
@@ -1468,7 +1476,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd, osType) {
     violatedLayers: ["L2.1"]
   };
 }
-var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, PSEUDO_FS_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
+var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, PSEUDO_FS_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, CONSENT_TOPIC, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
 var init_logic_rules = __esm({
   "src/engine/logic-rules.ts"() {
     "use strict";
@@ -1555,6 +1563,7 @@ var init_logic_rules = __esm({
         reason: String(c.reason || "\u68C0\u6D4B\u5230\u7EC4\u5408\u653B\u51FB\u94FE")
       }));
     })();
+    CONSENT_TOPIC = /密码|口令|passwd|password|凭据|凭证|用户|账户|账号|userdel|deluser|groupdel/i;
     INLINE_SCRIPT_RE = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
     DIR_TRAVERSAL_KW = loadInline().dir_traversal_keywords ?? [];
     _IFA = loadLogicRules().indirect_file_access ?? {};
@@ -2240,7 +2249,7 @@ function _scenarioRulesToDefaults() {
   if (!existsSync5(scenDir)) return out;
   let entries;
   try {
-    entries = readdirSync4(scenDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    entries = readdirSync4(scenDir, { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith("__")).map((d) => d.name);
   } catch {
     return out;
   }
@@ -8360,7 +8369,7 @@ function markIntegrity(actionDetail) {
   }
   return { integrity: "medium", isLowSource: false };
 }
-function initNode(sessionId, seq, actionType, actionDetail, timestamp) {
+function initNode(sessionId, seq, actionType, actionDetail, timestamp, agentId = "") {
   const { integrity, isLowSource } = markIntegrity(actionDetail);
   return {
     sessionId,
@@ -8368,13 +8377,14 @@ function initNode(sessionId, seq, actionType, actionDetail, timestamp) {
     actionType,
     actionDetail,
     stage: markStage(actionDetail),
+    agentId: agentId || void 0,
     resources: extractResources(actionDetail),
     integrity,
     isLowSource,
     timestamp: timestamp || void 0
   };
 }
-function buildSessionGraph(actionHistory, aNext, sessionId = "current") {
+function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId = "") {
   const nodes = [];
   const edges = [];
   const stageFlags = /* @__PURE__ */ new Set();
@@ -8384,18 +8394,20 @@ function buildSessionGraph(actionHistory, aNext, sessionId = "current") {
     if (ad) details.push({
       actionType: String(a.actionType || ""),
       actionDetail: ad,
-      calledAt: a.calledAt || void 0
+      calledAt: a.calledAt || void 0,
+      agentId: a.agentId || agentId || void 0
     });
   }
   if (aNext) {
     details.push({
       actionType: String(aNext.actionType || ""),
       actionDetail: String(aNext.actionDetail || ""),
-      calledAt: aNext.calledAt || void 0
+      calledAt: aNext.calledAt || void 0,
+      agentId: aNext.agentId || agentId || void 0
     });
   }
   details.forEach((d, seq) => {
-    const node = initNode(sessionId, seq, d.actionType, d.actionDetail, d.calledAt);
+    const node = initNode(sessionId, seq, d.actionType, d.actionDetail, d.calledAt, d.agentId || "");
     nodes.push(node);
     if (node.stage) stageFlags.add(node.stage);
   });
@@ -8412,7 +8424,7 @@ function buildMultiSessionGraph(sessions, aNext) {
   }
   for (const s of sessions) {
     const sid = String(s.sessionId || "s");
-    mg.sessions.push(buildSessionGraph(s.actionHistory || [], void 0, sid));
+    mg.sessions.push(buildSessionGraph(s.actionHistory || [], void 0, sid, s.agentId || ""));
   }
   if (aNext) {
     const last = mg.sessions[mg.sessions.length - 1];
@@ -8422,7 +8434,8 @@ function buildMultiSessionGraph(sessions, aNext) {
         last.nodes.length,
         String(aNext.actionType || ""),
         String(aNext.actionDetail || ""),
-        aNext.calledAt || void 0
+        aNext.calledAt || void 0,
+        aNext.agentId || ""
       ));
       if (last.nodes.length > 1) {
         last.edges.push({ src: last.nodes.length - 2, dst: last.nodes.length - 1, kind: "next" });
@@ -9316,10 +9329,14 @@ async function runAnalysis(input) {
     const formalSessions = [];
     if (input.sessionHistory) {
       for (const s of input.sessionHistory) {
-        formalSessions.push({ sessionId: s.sessionId || "s", actionHistory: s.actionHistory || [] });
+        formalSessions.push({
+          sessionId: s.sessionId || "s",
+          ...s.agentId ? { agentId: s.agentId } : {},
+          actionHistory: s.actionHistory || []
+        });
       }
     }
-    formalSessions.push({ sessionId: "current", actionHistory: input.actionHistory });
+    formalSessions.push({ sessionId: "current", agentId: input.agentId, actionHistory: input.actionHistory });
     const formalResult = formalEngine.verify(formalSessions, input.aNext);
     if (!formalResult.verified) {
       const v = formalResult.violations[0];

package/dist/server.js

@@ -1186,6 +1186,12 @@ function agentInflight() {
 function boundAgentOf(principal) {
   return principal.startsWith("agent:") ? principal.slice("agent:".length) : "";
 }
+function chainScope() {
+  return (env("AGENT_MOSS_CHAIN_SCOPE", "system") || "system").toLowerCase();
+}
+function chainBucket(agentId = "") {
+  return chainScope() === "agent" ? agentId || "default" : "__system__";
+}
 function rateLimitQps() {
   return envInt("AGENT_MOSS_RATE_LIMIT_QPS", 100);
 }
@@ -1845,12 +1851,19 @@ function hasUserConsent(actionHistory) {
     return t === "ask_user_question" && String(h.output || "").trim().length > 0;
   });
 }
+function hasWeakConsent(actionHistory) {
+  return actionHistory.some((h) => {
+    if (String(h.actionType || "").toLowerCase() !== "ask_user_question") return false;
+    return CONSENT_TOPIC.test(String(h.actionDetail || ""));
+  });
+}
 function checkPasswordConsent(actionType, actionDetail, actionHistory, osType) {
   if (actionType !== "bash") return null;
   const pwdPatterns = runtimeConfigBridge.current?.effectivePasswordPatterns(osType) ?? PASSWORD_MODIFY_PATTERNS;
   const isPasswordModify = pwdPatterns.some((p) => p.test(actionDetail));
   if (!isPasswordModify) return null;
   if (hasUserConsent(actionHistory)) return null;
+  if (hasWeakConsent(actionHistory)) return null;
   return {
     allowed: false,
     reason: "\u6267\u884C\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u5BC6\u7801\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u5BC6\u7801\u4FEE\u6539\u98CE\u9669",
@@ -1867,6 +1880,7 @@ function checkUserDeletionConsent(actionType, actionDetail, actionHistory, osTyp
   const isUserDeletion = udPatterns.some((p) => p.test(actionDetail));
   if (!isUserDeletion) return null;
   if (hasUserConsent(actionHistory)) return null;
+  if (hasWeakConsent(actionHistory)) return null;
   return {
     allowed: false,
     reason: "\u6267\u884C\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u7528\u6237\u5220\u9664\u98CE\u9669",
@@ -1968,7 +1982,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd, osType) {
     violatedLayers: ["L2.1"]
   };
 }
-var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, PSEUDO_FS_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
+var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, PSEUDO_FS_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, CONSENT_TOPIC, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
 var init_logic_rules = __esm({
   "src/engine/logic-rules.ts"() {
     "use strict";
@@ -2055,6 +2069,7 @@ var init_logic_rules = __esm({
         reason: String(c.reason || "\u68C0\u6D4B\u5230\u7EC4\u5408\u653B\u51FB\u94FE")
       }));
     })();
+    CONSENT_TOPIC = /密码|口令|passwd|password|凭据|凭证|用户|账户|账号|userdel|deluser|groupdel/i;
     INLINE_SCRIPT_RE = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
     DIR_TRAVERSAL_KW = loadInline().dir_traversal_keywords ?? [];
     _IFA = loadLogicRules().indirect_file_access ?? {};
@@ -2740,7 +2755,7 @@ function _scenarioRulesToDefaults() {
   if (!existsSync7(scenDir)) return out;
   let entries;
   try {
-    entries = readdirSync4(scenDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    entries = readdirSync4(scenDir, { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith("__")).map((d) => d.name);
   } catch {
     return out;
   }
@@ -8855,7 +8870,7 @@ function markIntegrity(actionDetail) {
   }
   return { integrity: "medium", isLowSource: false };
 }
-function initNode(sessionId, seq, actionType, actionDetail, timestamp) {
+function initNode(sessionId, seq, actionType, actionDetail, timestamp, agentId = "") {
   const { integrity, isLowSource } = markIntegrity(actionDetail);
   return {
     sessionId,
@@ -8863,13 +8878,14 @@ function initNode(sessionId, seq, actionType, actionDetail, timestamp) {
     actionType,
     actionDetail,
     stage: markStage(actionDetail),
+    agentId: agentId || void 0,
     resources: extractResources(actionDetail),
     integrity,
     isLowSource,
     timestamp: timestamp || void 0
   };
 }
-function buildSessionGraph(actionHistory, aNext, sessionId = "current") {
+function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId = "") {
   const nodes = [];
   const edges = [];
   const stageFlags = /* @__PURE__ */ new Set();
@@ -8879,18 +8895,20 @@ function buildSessionGraph(actionHistory, aNext, sessionId = "current") {
     if (ad) details.push({
       actionType: String(a.actionType || ""),
       actionDetail: ad,
-      calledAt: a.calledAt || void 0
+      calledAt: a.calledAt || void 0,
+      agentId: a.agentId || agentId || void 0
     });
   }
   if (aNext) {
     details.push({
       actionType: String(aNext.actionType || ""),
       actionDetail: String(aNext.actionDetail || ""),
-      calledAt: aNext.calledAt || void 0
+      calledAt: aNext.calledAt || void 0,
+      agentId: aNext.agentId || agentId || void 0
     });
   }
   details.forEach((d, seq) => {
-    const node = initNode(sessionId, seq, d.actionType, d.actionDetail, d.calledAt);
+    const node = initNode(sessionId, seq, d.actionType, d.actionDetail, d.calledAt, d.agentId || "");
     nodes.push(node);
     if (node.stage) stageFlags.add(node.stage);
   });
@@ -8907,7 +8925,7 @@ function buildMultiSessionGraph(sessions, aNext) {
   }
   for (const s of sessions) {
     const sid = String(s.sessionId || "s");
-    mg.sessions.push(buildSessionGraph(s.actionHistory || [], void 0, sid));
+    mg.sessions.push(buildSessionGraph(s.actionHistory || [], void 0, sid, s.agentId || ""));
   }
   if (aNext) {
     const last = mg.sessions[mg.sessions.length - 1];
@@ -8917,7 +8935,8 @@ function buildMultiSessionGraph(sessions, aNext) {
         last.nodes.length,
         String(aNext.actionType || ""),
         String(aNext.actionDetail || ""),
-        aNext.calledAt || void 0
+        aNext.calledAt || void 0,
+        aNext.agentId || ""
       ));
       if (last.nodes.length > 1) {
         last.edges.push({ src: last.nodes.length - 2, dst: last.nodes.length - 1, kind: "next" });
@@ -9704,8 +9723,8 @@ var init_stateful = __esm({
       }
       /** 增量推进：把当前动作追加到时间线 → 链指针推进 → 判定。 */
       advance(args) {
-        const { aNext, sessionId = "current", isError = false } = args;
-        const node = this.appendNode(aNext, sessionId, isError);
+        const { aNext, sessionId = "current", isError = false, agentId = "" } = args;
+        const node = this.appendNode(aNext, sessionId, isError, agentId);
         if (!node) {
           return { seq: this.seqNext, node: null, matched: null, pendingPrefixes: this.pendingPrefixes, exfil: [], shouldBlock: false };
         }
@@ -9725,7 +9744,7 @@ var init_stateful = __esm({
           }
         };
       }
-      appendNode(action, sessionId, isError = false) {
+      appendNode(action, sessionId, isError = false, agentId = "") {
         const ad = String(action.actionDetail || "");
         const at = String(action.actionType || "");
         if (!ad) return null;
@@ -9742,6 +9761,7 @@ var init_stateful = __esm({
           resources: extractResources2(ad),
           instances: extractInstances(ad, stage),
           isError,
+          agentId: String(action.agentId || agentId || ""),
           lifecycle: lifecycleFor(ad, stage, isError),
           timestamp: typeof action.calledAt === "string" ? action.calledAt : _StatefulChainTracker.now()
         };
@@ -9879,7 +9899,13 @@ var init_stateful = __esm({
         let want = stages[0];
         for (const n of this.nodes_) {
           if (n.stage === want) {
-            path6.push({ sessionId: n.sessionId, seq: n.seq, stage: n.stage, timestamp: n.timestamp });
+            path6.push({
+              sessionId: n.sessionId,
+              seq: n.seq,
+              stage: n.stage,
+              timestamp: n.timestamp,
+              agentId: n.agentId
+            });
             const idx = stages.indexOf(n.stage);
             if (idx + 1 < stages.length) {
               want = stages[idx + 1];
@@ -9904,7 +9930,7 @@ var init_stateful = __esm({
         }
         if (taintedRes.size > 0) {
           this.tainted.add(idx);
-          for (const r of taintedRes) this.taintedResources.add(r);
+          for (const r of node.resources) this.taintedResources.add(r);
         }
       }
       resourceTainted(resource) {
@@ -9953,6 +9979,7 @@ var init_stateful = __esm({
           this.nodes_.push({
             seq: Number(raw.seq || 0),
             sessionId: String(raw.sessionId || ""),
+            agentId: String(raw.agentId || ""),
             actionType: String(raw.actionType || ""),
             actionDetail: String(raw.actionDetail || ""),
             stage: String(raw.stage || ""),
@@ -10059,9 +10086,9 @@ var init_chain_state = __esm({
         delete this.data[agentId];
         this._scheduleWrite();
       }
-      applyAction(agentId, aNext, sessionId, isError = false) {
+      applyAction(agentId, aNext, sessionId, isError = false, sourceAgent = "") {
         const t = this.load(agentId) || new StatefulChainTracker(agentId);
-        const r = t.advance({ aNext, sessionId, isError });
+        const r = t.advance({ aNext, sessionId, isError, agentId: sourceAgent });
         this.save(t);
         return r;
       }
@@ -10376,10 +10403,14 @@ async function runAnalysis(input) {
     const formalSessions = [];
     if (input.sessionHistory) {
       for (const s of input.sessionHistory) {
-        formalSessions.push({ sessionId: s.sessionId || "s", actionHistory: s.actionHistory || [] });
+        formalSessions.push({
+          sessionId: s.sessionId || "s",
+          ...s.agentId ? { agentId: s.agentId } : {},
+          actionHistory: s.actionHistory || []
+        });
       }
     }
-    formalSessions.push({ sessionId: "current", actionHistory: input.actionHistory });
+    formalSessions.push({ sessionId: "current", agentId: input.agentId, actionHistory: input.actionHistory });
     const formalResult = formalEngine.verify(formalSessions, input.aNext);
     if (!formalResult.verified) {
       const v = formalResult.violations[0];
@@ -10747,6 +10778,8 @@ var AnalyzeRequestSchema = z.object({
   action_history: z.array(ActionItemSchema).default([]).describe("Historical action sequence"),
   session_history: z.array(z.object({
     session_id: z.string(),
+    /** 来源 agent（AgentGate 逐会话带上）：记录在链路径里供告警/取证，不参与链匹配。 */
+    agent_id: z.string().optional(),
     action_history: z.array(ActionItemSchema).default([])
   })).default([]).describe("Multi-session historical actions (optional): for L2.2 formal engine cross-session combo-chain / sensitive-data-flow verification. Provided by caller (incl. future agentgate)."),
   a_next: ActionItemSchema.describe("Next action to be executed"),
@@ -11661,6 +11694,8 @@ async function analyzeRoute(c) {
       })),
       sessionHistory: (req.session_history || []).map((s) => ({
         sessionId: s.session_id,
+        // 来源 agent（AgentGate 逐会话带上，用于链路径取证展示；不参与链匹配）
+        ...s.agent_id ? { agentId: s.agent_id } : {},
         actionHistory: (s.action_history || []).map((h) => ({
           actionType: h.action_type,
           actionDetail: h.action_detail,
@@ -11719,10 +11754,14 @@ async function analyzeRoute(c) {
     if (incEnabled === "1" || incEnabled === "true" || incEnabled === "yes" || incEnabled === "on") {
       try {
         const store = getChainStateStoreFor(agentId);
-        const inc = store.applyAction(agentId, {
-          actionType: req.a_next.action_type,
-          actionDetail: req.a_next.action_detail
-        }, req.session_id, Boolean(meta.is_error));
+        const inc = store.applyAction(
+          chainBucket(agentId),
+          { actionType: req.a_next.action_type, actionDetail: req.a_next.action_detail },
+          req.session_id,
+          Boolean(meta.is_error),
+          agentId
+          // 来源：真实 agent（桶 key 可能是 __system__）
+        );
         const judgment = incMatchedToDeny(inc);
         if (judgment) {
           const layers = [...result.violated_layers];
@@ -11788,7 +11827,7 @@ function getChainStateStoreFor(_agentId) {
 }
 function incMatchedToDeny(inc) {
   if (inc.matched) {
-    const chain = (inc.matched.path || []).map((p) => [p.sessionId, p.seq, p.stage, p.timestamp]);
+    const chain = (inc.matched.path || []).map((p) => [p.sessionId, p.seq, p.stage, p.timestamp, p.agentId ?? null]);
     return {
       property_id: "cross-" + inc.matched.chainId,
       reason: inc.matched.reason,
@@ -11813,9 +11852,10 @@ async function reviewRoute(c) {
     const req = ReviewRequestSchema.parse(body);
     const agentId = req.agent_id || "default";
     const store = getChainStateStoreFor(agentId);
-    let tracker = store.load(agentId);
+    const bucket = chainBucket(agentId);
+    let tracker = store.load(bucket);
     if (!tracker) {
-      tracker = new StatefulChainTracker(agentId);
+      tracker = new StatefulChainTracker(bucket);
     }
     if (req.db_path && !pathWithin(req.db_path, reviewRoots())) {
       return c.json({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kenhkl/agent-moss",
-  "version": "0.17.5",
+  "version": "0.17.7",
   "description": "Multi-layer security analysis engine for AI agents (TypeScript)",
   "type": "module",
   "main": "dist/server.js",