@kenhkl/agent-moss 0.17.6 → 0.17.8

package/dist/cli.js

@@ -1258,6 +1258,20 @@ function redactChain(chain, currentSessionId) {
     return step;
   });
 }
+function redactGraph(graph, currentSessionId) {
+  if (!graph) return null;
+  if (chainDetailMode() === "full") return graph;
+  const nodes = (graph.nodes || []).map((n) => {
+    const m = { ...n };
+    if (String(m.session_id ?? "") !== String(currentSessionId)) {
+      m.session_id = "<other-session>";
+      m.action_detail = "<\u5DF2\u9690\u85CF>";
+      m.resources = [];
+    }
+    return m;
+  });
+  return { nodes, edges: graph.edges || [] };
+}
 function sessionSweepThreshold() {
   return envInt("AGENT_MOSS_SESSION_SWEEP_THRESHOLD", 50);
 }
@@ -1340,6 +1354,12 @@ function agentInflight() {
 function boundAgentOf(principal) {
   return principal.startsWith("agent:") ? principal.slice("agent:".length) : "";
 }
+function chainScope() {
+  return (env("AGENT_MOSS_CHAIN_SCOPE", "system") || "system").toLowerCase();
+}
+function chainBucket(agentId = "") {
+  return chainScope() === "agent" ? agentId || "default" : "__system__";
+}
 function rateLimitQps() {
   return envInt("AGENT_MOSS_RATE_LIMIT_QPS", 100);
 }
@@ -1411,6 +1431,8 @@ var init_models = __esm({
       action_history: z.array(ActionItemSchema).default([]).describe("Historical action sequence"),
       session_history: z.array(z.object({
         session_id: z.string(),
+        /** 来源 agent（AgentGate 逐会话带上）：记录在链路径里供告警/取证，不参与链匹配。 */
+        agent_id: z.string().optional(),
         action_history: z.array(ActionItemSchema).default([])
       })).default([]).describe("Multi-session historical actions (optional): for L2.2 formal engine cross-session combo-chain / sensitive-data-flow verification. Provided by caller (incl. future agentgate)."),
       a_next: ActionItemSchema.describe("Next action to be executed"),
@@ -1431,7 +1453,42 @@ var init_models = __esm({
       confidence: z.number().int().min(0).max(100).default(100),
       analysis_duration_ms: z.number().default(0),
       // 组合攻击链反例路径：每步 [session_id, seq, stage, timestamp]，含真实发生时间
-      violation_chain: z.array(z.array(z.union([z.string(), z.number()]).nullable())).default([])
+      violation_chain: z.array(z.array(z.union([z.string(), z.number()]).nullable())).default([]),
+      // 结构化攻击链图（前端可视化）：节点 + 边（next 时序 / data 数据流）
+      violation_graph: z.object({
+        // 性质元信息（前端展示"违反了哪条性质"）
+        property_id: z.string().optional(),
+        property_short: z.string().optional(),
+        property_name: z.string().optional(),
+        // 性质表达式 token → 节点位置（前端展示"表达式对应哪个节点"）
+        property_expression: z.array(
+          z.object({
+            token: z.string(),
+            node_index: z.union([z.number(), z.array(z.number())])
+          })
+        ).optional(),
+        nodes: z.array(
+          z.object({
+            session_id: z.string().default(""),
+            seq: z.number().default(0),
+            stage: z.string().default(""),
+            action_detail: z.string().default(""),
+            resources: z.array(z.string()).default([]),
+            // 节点在性质中的角色：source/carrier/sink（P2）或阶段名（P1）
+            role: z.string().optional(),
+            // 是否为违例见证节点（当前动作补全链 / 触发外传）
+            witness: z.boolean().optional()
+          })
+        ),
+        edges: z.array(
+          z.object({
+            from: z.number(),
+            to: z.number(),
+            type: z.enum(["next", "data"]).default("next"),
+            label: z.string().optional()
+          })
+        )
+      }).nullable().default(null)
     });
     HealthResponseSchema = z.object({
       status: z.string().default("healthy"),
@@ -2999,7 +3056,7 @@ function _scenarioRulesToDefaults() {
   if (!existsSync7(scenDir)) return out;
   let entries;
   try {
-    entries = readdirSync4(scenDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    entries = readdirSync4(scenDir, { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith("__")).map((d) => d.name);
   } catch {
     return out;
   }
@@ -9379,7 +9436,7 @@ function markIntegrity(actionDetail) {
   }
   return { integrity: "medium", isLowSource: false };
 }
-function initNode(sessionId, seq, actionType, actionDetail, timestamp) {
+function initNode(sessionId, seq, actionType, actionDetail, timestamp, agentId = "") {
   const { integrity, isLowSource } = markIntegrity(actionDetail);
   return {
     sessionId,
@@ -9387,13 +9444,14 @@ function initNode(sessionId, seq, actionType, actionDetail, timestamp) {
     actionType,
     actionDetail,
     stage: markStage(actionDetail),
+    agentId: agentId || void 0,
     resources: extractResources(actionDetail),
     integrity,
     isLowSource,
     timestamp: timestamp || void 0
   };
 }
-function buildSessionGraph(actionHistory, aNext, sessionId = "current") {
+function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId = "") {
   const nodes = [];
   const edges = [];
   const stageFlags = /* @__PURE__ */ new Set();
@@ -9403,18 +9461,20 @@ function buildSessionGraph(actionHistory, aNext, sessionId = "current") {
     if (ad) details.push({
       actionType: String(a.actionType || ""),
       actionDetail: ad,
-      calledAt: a.calledAt || void 0
+      calledAt: a.calledAt || void 0,
+      agentId: a.agentId || agentId || void 0
     });
   }
   if (aNext) {
     details.push({
       actionType: String(aNext.actionType || ""),
       actionDetail: String(aNext.actionDetail || ""),
-      calledAt: aNext.calledAt || void 0
+      calledAt: aNext.calledAt || void 0,
+      agentId: aNext.agentId || agentId || void 0
     });
   }
   details.forEach((d, seq) => {
-    const node = initNode(sessionId, seq, d.actionType, d.actionDetail, d.calledAt);
+    const node = initNode(sessionId, seq, d.actionType, d.actionDetail, d.calledAt, d.agentId || "");
     nodes.push(node);
     if (node.stage) stageFlags.add(node.stage);
   });
@@ -9431,7 +9491,7 @@ function buildMultiSessionGraph(sessions, aNext) {
   }
   for (const s of sessions) {
     const sid = String(s.sessionId || "s");
-    mg.sessions.push(buildSessionGraph(s.actionHistory || [], void 0, sid));
+    mg.sessions.push(buildSessionGraph(s.actionHistory || [], void 0, sid, s.agentId || ""));
   }
   if (aNext) {
     const last = mg.sessions[mg.sessions.length - 1];
@@ -9441,7 +9501,8 @@ function buildMultiSessionGraph(sessions, aNext) {
         last.nodes.length,
         String(aNext.actionType || ""),
         String(aNext.actionDetail || ""),
-        aNext.calledAt || void 0
+        aNext.calledAt || void 0,
+        aNext.agentId || ""
       ));
       if (last.nodes.length > 1) {
         last.edges.push({ src: last.nodes.length - 2, dst: last.nodes.length - 1, kind: "next" });
@@ -9499,6 +9560,33 @@ var init_builder = __esm({
 });
 
 // src/engine/formal-engine/properties.ts
+function graphFromPath(nodes, path6, edgeType = "next", propertyMeta, roles, witnessLast = true, propertyExpression) {
+  const byKey = /* @__PURE__ */ new Map();
+  for (const n of nodes) byKey.set(`${n.sessionId}#${n.seq}`, n);
+  const gNodes = [];
+  const gEdges = [];
+  for (const item of path6) {
+    const n = byKey.get(`${item.sessionId}#${item.seq}`);
+    gNodes.push({
+      session_id: item.sessionId,
+      seq: item.seq,
+      stage: n ? n.stage : "",
+      action_detail: n ? n.actionDetail : item.detail,
+      resources: n ? [...n.resources].sort() : []
+    });
+    if (gNodes.length > 1) {
+      gEdges.push({ from: gNodes.length - 2, to: gNodes.length - 1, type: edgeType });
+    }
+  }
+  (roles || []).forEach((role, i) => {
+    if (i < gNodes.length && role) gNodes[i].role = role;
+  });
+  if (witnessLast && gNodes.length > 0) gNodes[gNodes.length - 1].witness = true;
+  const out = { nodes: gNodes, edges: gEdges };
+  if (propertyMeta) Object.assign(out, propertyMeta);
+  if (propertyExpression) out.property_expression = propertyExpression;
+  return out;
+}
 function parseTs(ts) {
   if (!ts) return null;
   const t = Date.parse(String(ts).trim());
@@ -9556,7 +9644,12 @@ function checkCrossSessionChain(graph) {
         propertyId: "cross-" + chain.id,
         reason: chain.reason,
         riskLevel: chain.riskLevel,
-        path: path6
+        path: path6,
+        graph: graphFromPath(nodes, path6, "next", {
+          property_id: "cross-" + chain.id,
+          property_short: "P1",
+          property_name: "\u8DE8\u4F1A\u8BDD\u7EC4\u5408\u94FE"
+        }, stages, true, stages.map((s, i) => ({ token: s, node_index: i })))
       });
       return violations;
     } else {
@@ -9576,7 +9669,12 @@ function checkCrossSessionChain(graph) {
           propertyId: "cross-" + chain.id,
           reason: chain.reason,
           riskLevel: chain.riskLevel,
-          path: path6
+          path: path6,
+          graph: graphFromPath(nodes, path6, "next", {
+            property_id: "cross-" + chain.id,
+            property_short: "P1",
+            property_name: "\u8DE8\u4F1A\u8BDD\u7EC4\u5408\u94FE"
+          }, stages, true, stages.map((s, i) => ({ token: s, node_index: i })))
         });
       }
     }
@@ -9591,10 +9689,15 @@ function checkSensitiveDataFlow(graph) {
   for (let i = 0; i < nodes.length; i++) {
     const n = nodes[i];
     if (n.stage === "CRED" && [...n.resources].some((r) => CRED_FILE_RE.test(r))) {
-      tainted.set(i, `${n.sessionId}#${n.seq} \u8BBF\u95EE ${[...n.resources][0]}`);
+      tainted.set(i, {
+        source: `${n.sessionId}#${n.seq} \u8BBF\u95EE ${[...n.resources][0]}`,
+        parent: null
+      });
     }
   }
   if (tainted.size === 0) return violations;
+  const taintEdges = /* @__PURE__ */ new Map();
+  const edgeKey = (p, c) => `${p}:${c}`;
   const edges = allEdges(graph);
   let changed = true;
   while (changed) {
@@ -9605,7 +9708,8 @@ function checkSensitiveDataFlow(graph) {
         const dstRes = nodes[e.dst].resources;
         for (const r of srcRes) {
           if (dstRes.has(r)) {
-            tainted.set(e.dst, tainted.get(e.src));
+            tainted.set(e.dst, { source: tainted.get(e.src).source, parent: e.src });
+            taintEdges.set(edgeKey(e.src, e.dst), r);
             changed = true;
             break;
           }
@@ -9613,16 +9717,75 @@ function checkSensitiveDataFlow(graph) {
       }
     }
   }
+  const tracePath = (idx) => {
+    const chain = [idx];
+    const seen = /* @__PURE__ */ new Set([idx]);
+    while (true) {
+      const parent = tainted.get(chain[chain.length - 1])?.parent;
+      if (parent === void 0 || parent === null || seen.has(parent)) break;
+      chain.push(parent);
+      seen.add(parent);
+    }
+    return chain.reverse();
+  };
+  const taintGraph = (chain) => {
+    const gNodes = [];
+    const gEdges = [];
+    chain.forEach((ni, k) => {
+      const n = nodes[ni];
+      const role = k === 0 ? "source" : k === chain.length - 1 ? "sink" : "carrier";
+      gNodes.push({
+        session_id: n.sessionId,
+        seq: n.seq,
+        stage: n.stage,
+        action_detail: n.actionDetail,
+        resources: [...n.resources].sort(),
+        role
+      });
+      if (k > 0) {
+        const prev = chain[k - 1];
+        gEdges.push({
+          from: k - 1,
+          to: k,
+          type: "data",
+          label: taintEdges.get(edgeKey(prev, ni)) || ""
+        });
+      }
+    });
+    if (gNodes.length > 0) gNodes[gNodes.length - 1].witness = true;
+    const expr = [{ token: "CRED", node_index: 0 }];
+    if (chain.length > 2) {
+      expr.push({
+        token: "\u5171\u4EAB\u8F7D\u4F53",
+        node_index: Array.from({ length: chain.length - 2 }, (_, i) => i + 1)
+      });
+    }
+    expr.push({ token: "EXFIL", node_index: chain.length - 1 });
+    return {
+      property_id: "sensitive-data-flow",
+      property_short: "P2",
+      property_name: "\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20",
+      property_expression: expr,
+      nodes: gNodes,
+      edges: gEdges
+    };
+  };
   const witness = graph.witnessIdx;
   const candidates = witness !== void 0 ? [witness] : nodes.map((_, i) => i);
   for (const i of candidates) {
     const n = nodes[i];
     if (tainted.has(i) && EXFIL_RE.test(n.actionDetail)) {
+      const chain = tracePath(i);
       violations.push({
         propertyId: "sensitive-data-flow",
-        reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${tainted.get(i)} \u2192 ${n.sessionId}#${n.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
+        reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${tainted.get(i).source} \u2192 ${n.sessionId}#${n.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
         riskLevel: "critical",
-        path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
+        path: chain.map((j) => ({
+          sessionId: nodes[j].sessionId,
+          seq: nodes[j].seq,
+          detail: nodes[j].actionDetail.slice(0, 60)
+        })),
+        graph: taintGraph(chain)
       });
       if (witness !== void 0) return violations;
     }
@@ -10164,6 +10327,12 @@ var init_stateful = __esm({
       nodes_ = [];
       ptr = {};
       tainted = /* @__PURE__ */ new Set();
+      /** taint 传播路径：nodeIdx -> 使该节点染毒的前驱 nodeIdx（CRED 源为 null） */
+      taintParent = /* @__PURE__ */ new Map();
+      /** "parent:child" -> 触发传播的共享资源（图上的 data 边标签） */
+      taintEdgeLabel = /* @__PURE__ */ new Map();
+      /** 资源 -> 首次染毒该资源的节点 seq */
+      taintOrigin = /* @__PURE__ */ new Map();
       /** taint 反索引：资源路径 → 已染毒（O(1) 命中）。 */
       taintedResources = /* @__PURE__ */ new Set();
       aliveResources = {};
@@ -10228,8 +10397,8 @@ var init_stateful = __esm({
       }
       /** 增量推进：把当前动作追加到时间线 → 链指针推进 → 判定。 */
       advance(args) {
-        const { aNext, sessionId = "current", isError = false } = args;
-        const node = this.appendNode(aNext, sessionId, isError);
+        const { aNext, sessionId = "current", isError = false, agentId = "" } = args;
+        const node = this.appendNode(aNext, sessionId, isError, agentId);
         if (!node) {
           return { seq: this.seqNext, node: null, matched: null, pendingPrefixes: this.pendingPrefixes, exfil: [], shouldBlock: false };
         }
@@ -10249,7 +10418,7 @@ var init_stateful = __esm({
           }
         };
       }
-      appendNode(action, sessionId, isError = false) {
+      appendNode(action, sessionId, isError = false, agentId = "") {
         const ad = String(action.actionDetail || "");
         const at = String(action.actionType || "");
         if (!ad) return null;
@@ -10266,6 +10435,7 @@ var init_stateful = __esm({
           resources: extractResources2(ad),
           instances: extractInstances(ad, stage),
           isError,
+          agentId: String(action.agentId || agentId || ""),
           lifecycle: lifecycleFor(ad, stage, isError),
           timestamp: typeof action.calledAt === "string" ? action.calledAt : _StatefulChainTracker.now()
         };
@@ -10373,7 +10543,8 @@ var init_stateful = __esm({
                   stages,
                   riskLevel: String(chain.riskLevel || chain.risk_level || "high"),
                   reason: String(chain.reason || "\u68C0\u6D4B\u5230\u7EC4\u5408\u653B\u51FB\u94FE"),
-                  path: this.chainPath(stages)
+                  path: this.chainPath(stages),
+                  graph: this.buildChainGraph(stages, cid)
                 };
               }
             }
@@ -10403,7 +10574,13 @@ var init_stateful = __esm({
         let want = stages[0];
         for (const n of this.nodes_) {
           if (n.stage === want) {
-            path6.push({ sessionId: n.sessionId, seq: n.seq, stage: n.stage, timestamp: n.timestamp });
+            path6.push({
+              sessionId: n.sessionId,
+              seq: n.seq,
+              stage: n.stage,
+              timestamp: n.timestamp,
+              agentId: n.agentId
+            });
             const idx = stages.indexOf(n.stage);
             if (idx + 1 < stages.length) {
               want = stages[idx + 1];
@@ -10414,21 +10591,69 @@ var init_stateful = __esm({
         }
         return path6;
       }
+      /** 把链路径转成前端可画的结构化图（相邻节点 next 边）。 */
+      buildChainGraph(stages, chainId) {
+        const path6 = this.chainPath(stages);
+        const gNodes = path6.map((p, i) => {
+          const n = this.nodes_.find((x) => x.sessionId === p.sessionId && x.seq === p.seq);
+          return {
+            session_id: p.sessionId,
+            seq: p.seq,
+            stage: p.stage,
+            action_detail: n ? n.actionDetail : "",
+            resources: n ? [...n.resources].sort() : [],
+            role: stages[i] || ""
+          };
+        });
+        const gEdges = [];
+        for (let i = 1; i < gNodes.length; i++) {
+          gEdges.push({ from: i - 1, to: i, type: "next" });
+        }
+        if (gNodes.length > 0) gNodes[gNodes.length - 1].witness = true;
+        return {
+          property_id: "cross-" + chainId,
+          property_short: "P1",
+          property_name: "\u8DE8\u4F1A\u8BDD\u7EC4\u5408\u94FE",
+          property_expression: stages.map((s, i) => ({ token: s, node_index: i })),
+          nodes: gNodes,
+          edges: gEdges
+        };
+      }
       // ---------------- 敏感数据 taint（P2） ----------------
       advanceTaint(node) {
         if (node.lifecycle === "dead") return;
         const idx = node.seq;
         const taintedRes = /* @__PURE__ */ new Set();
+        let parent = null;
+        let label = "";
+        let foundParent = false;
         for (const r of node.resources) {
-          if (this.resourceTainted(r)) taintedRes.add(r);
+          if (this.resourceTainted(r)) {
+            taintedRes.add(r);
+            if (!foundParent) {
+              const origin = this.taintOrigin.get(r);
+              if (origin !== void 0) {
+                parent = origin;
+                label = r;
+                foundParent = true;
+              }
+            }
+          }
         }
         if (node.stage === "CRED" && node.resources.some((r) => CRED_FILE_RE2.test(r))) {
           this.tainted.add(idx);
+          parent = null;
+          label = "";
           for (const r of node.resources) taintedRes.add(r);
         }
         if (taintedRes.size > 0) {
           this.tainted.add(idx);
-          for (const r of taintedRes) this.taintedResources.add(r);
+          this.taintParent.set(idx, parent);
+          if (parent !== null) this.taintEdgeLabel.set(`${parent}:${idx}`, label);
+          for (const r of node.resources) {
+            this.taintedResources.add(r);
+            if (!this.taintOrigin.has(r)) this.taintOrigin.set(r, idx);
+          }
         }
       }
       resourceTainted(resource) {
@@ -10438,16 +10663,84 @@ var init_stateful = __esm({
       checkExfilAfterTaint(node) {
         if (!this.tainted.has(node.seq)) return [];
         if (EXFIL_RE2.test(node.actionDetail)) {
+          const chain = this.traceTaintChain(node.seq);
           return [{
             property_id: "sensitive-data-flow",
-            reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${this.taintSource(node)} \u2192 ${node.sessionId}#${node.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
+            reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${this.taintSource(node, chain)} \u2192 ${node.sessionId}#${node.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
             risk_level: "critical",
-            path: [[node.sessionId, node.seq, node.actionDetail.slice(0, 60)]]
+            path: chain.map((j) => {
+              const n = this.nodes_[j];
+              return [n.sessionId, n.seq, n.actionDetail.slice(0, 60), n.timestamp];
+            }),
+            graph: this.taintGraph(chain)
           }];
         }
         return [];
       }
-      taintSource(node) {
+      /** 沿 taint parent 回溯出 CRED 源 → 当前节点的完整路径。 */
+      traceTaintChain(idx) {
+        const chain = [idx];
+        const seen = /* @__PURE__ */ new Set([idx]);
+        while (true) {
+          const parent = this.taintParent.get(chain[chain.length - 1]);
+          if (parent === void 0 || parent === null || seen.has(parent)) break;
+          chain.push(parent);
+          seen.add(parent);
+        }
+        return chain.reverse();
+      }
+      /** 把 taint 路径转成前端可画的结构化图（data 边带共享资源标签）。 */
+      taintGraph(chain) {
+        const gNodes = [];
+        const gEdges = [];
+        chain.forEach((ni, k) => {
+          const n = this.nodes_[ni];
+          const role = k === 0 ? "source" : k === chain.length - 1 ? "sink" : "carrier";
+          gNodes.push({
+            session_id: n.sessionId,
+            seq: n.seq,
+            stage: n.stage,
+            action_detail: n.actionDetail,
+            resources: [...n.resources].sort(),
+            role
+          });
+          if (k > 0) {
+            const prev = chain[k - 1];
+            gEdges.push({
+              from: k - 1,
+              to: k,
+              type: "data",
+              label: this.taintEdgeLabel.get(`${prev}:${ni}`) || ""
+            });
+          }
+        });
+        if (gNodes.length > 0) gNodes[gNodes.length - 1].witness = true;
+        const expr = [{ token: "CRED", node_index: 0 }];
+        if (chain.length > 2) {
+          expr.push({
+            token: "\u5171\u4EAB\u8F7D\u4F53",
+            node_index: Array.from({ length: chain.length - 2 }, (_, i) => i + 1)
+          });
+        }
+        expr.push({ token: "EXFIL", node_index: chain.length - 1 });
+        return {
+          property_id: "sensitive-data-flow",
+          property_short: "P2",
+          property_name: "\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20",
+          property_expression: expr,
+          nodes: gNodes,
+          edges: gEdges
+        };
+      }
+      taintSource(node, chain = []) {
+        if (chain.length > 0) {
+          const src = this.nodes_[chain[0]];
+          if (src) {
+            for (const r of node.resources) {
+              if (src.resources.includes(r)) return `${src.sessionId}#${src.seq} \u8BBF\u95EE ${r}`;
+            }
+          }
+        }
         const sorted = [...this.tainted].sort((a, b) => a - b);
         for (const i of sorted) {
           if (i === node.seq) continue;
@@ -10466,6 +10759,9 @@ var init_stateful = __esm({
           nodes: this.nodes_.map((n) => ({ ...n, resources: [...n.resources] })),
           ptrs: { ...this.ptr },
           tainted: [...this.tainted].sort((a, b) => a - b),
+          // taint 传播路径（前端攻击链图）；边标签不入快照，重启后可从资源交集重建
+          taint_parent: Object.fromEntries([...this.taintParent.entries()].map(([k, v]) => [String(k), v])),
+          taint_origin: Object.fromEntries([...this.taintOrigin.entries()]),
           alive: { ...this.aliveResources },
           seq_next: this.seqNext
         };
@@ -10477,6 +10773,7 @@ var init_stateful = __esm({
           this.nodes_.push({
             seq: Number(raw.seq || 0),
             sessionId: String(raw.sessionId || ""),
+            agentId: String(raw.agentId || ""),
             actionType: String(raw.actionType || ""),
             actionDetail: String(raw.actionDetail || ""),
             stage: String(raw.stage || ""),
@@ -10492,15 +10789,53 @@ var init_stateful = __esm({
         this.seqNext = Number(snapshot.seq_next || this.nodes_.length);
         this.ptr = Object.fromEntries(Object.entries(snapshot.ptrs || {}).map(([k, v]) => [k, Number(v)]));
         this.tainted = new Set((snapshot.tainted || []).map(Number));
+        this.taintParent = new Map(
+          Object.entries(snapshot.taint_parent || {}).map(
+            ([k, v]) => [Number(k), v === null || v === void 0 ? null : Number(v)]
+          )
+        );
+        this.taintOrigin = new Map(
+          Object.entries(snapshot.taint_origin || {}).map(
+            ([k, v]) => [String(k), Number(v)]
+          )
+        );
+        this.taintEdgeLabel = /* @__PURE__ */ new Map();
         this.taintedResources = /* @__PURE__ */ new Set();
         for (const i of this.tainted) {
           const n = this.nodes_[i];
           if (n) for (const r of n.resources) this.taintedResources.add(r);
         }
+        if (this.tainted.size > 0 && this.taintParent.size === 0) this.rebuildTaintParent();
+        if (this.taintOrigin.size === 0) {
+          for (const i of [...this.tainted].sort((a, b) => a - b)) {
+            const n = this.nodes_[i];
+            if (!n) continue;
+            for (const r of n.resources) {
+              if (!this.taintOrigin.has(r)) this.taintOrigin.set(r, i);
+            }
+          }
+        }
         this.aliveResources = Object.fromEntries(
           Object.entries(snapshot.alive || {}).map(([k, v]) => [k, Number(v)])
         );
       }
+      /** 旧快照无 parent 信息时，按 seq 顺序找最近的资源相交染毒前驱。 */
+      rebuildTaintParent() {
+        for (const i of [...this.tainted].sort((a, b) => a - b)) {
+          const n = this.nodes_[i];
+          if (!n) continue;
+          let parent = null;
+          for (let j = i - 1; j >= 0; j--) {
+            if (!this.tainted.has(j)) continue;
+            const m = this.nodes_[j];
+            if (m && m.resources.some((r) => n.resources.includes(r))) {
+              parent = j;
+              break;
+            }
+          }
+          this.taintParent.set(i, parent);
+        }
+      }
     };
   }
 });
@@ -10583,9 +10918,9 @@ var init_chain_state = __esm({
         delete this.data[agentId];
         this._scheduleWrite();
       }
-      applyAction(agentId, aNext, sessionId, isError = false) {
+      applyAction(agentId, aNext, sessionId, isError = false, sourceAgent = "") {
         const t = this.load(agentId) || new StatefulChainTracker(agentId);
-        const r = t.advance({ aNext, sessionId, isError });
+        const r = t.advance({ aNext, sessionId, isError, agentId: sourceAgent });
         this.save(t);
         return r;
       }
@@ -10900,10 +11235,14 @@ async function runAnalysis(input) {
     const formalSessions = [];
     if (input.sessionHistory) {
       for (const s of input.sessionHistory) {
-        formalSessions.push({ sessionId: s.sessionId || "s", actionHistory: s.actionHistory || [] });
+        formalSessions.push({
+          sessionId: s.sessionId || "s",
+          ...s.agentId ? { agentId: s.agentId } : {},
+          actionHistory: s.actionHistory || []
+        });
       }
     }
-    formalSessions.push({ sessionId: "current", actionHistory: input.actionHistory });
+    formalSessions.push({ sessionId: "current", agentId: input.agentId, actionHistory: input.actionHistory });
     const formalResult = formalEngine.verify(formalSessions, input.aNext);
     if (!formalResult.verified) {
       const v = formalResult.violations[0];
@@ -10920,7 +11259,9 @@ async function runAnalysis(input) {
           riskType: "formal_verification",
           confidence: 90,
           source: "formal_engine",
-          violatedLayers: ["L2.2"]
+          violatedLayers: ["L2.2"],
+          violationGraph: v?.graph ?? null,
+          violationChain: (v?.path ?? []).map((p) => [p.sessionId, p.seq, p.detail])
         };
       }
     }
@@ -11465,7 +11806,9 @@ async function analyzeInner(input, mossLog) {
       violated_layers: judgment.violatedLayers || [],
       policy: "",
       violated_policy: `[${judgment.riskType}] ${judgment.reason}`,
-      confidence: judgment.confidence
+      confidence: judgment.confidence,
+      violation_graph: judgment.violationGraph ?? null,
+      violation_chain: judgment.violationChain ?? []
     };
     mossLog.logResult("Deny", denied.reason);
     return denied;
@@ -11999,6 +12342,8 @@ async function analyzeRoute(c) {
       })),
       sessionHistory: (req.session_history || []).map((s) => ({
         sessionId: s.session_id,
+        // 来源 agent（AgentGate 逐会话带上，用于链路径取证展示；不参与链匹配）
+        ...s.agent_id ? { agentId: s.agent_id } : {},
         actionHistory: (s.action_history || []).map((h) => ({
           actionType: h.action_type,
           actionDetail: h.action_detail,
@@ -12057,10 +12402,14 @@ async function analyzeRoute(c) {
     if (incEnabled === "1" || incEnabled === "true" || incEnabled === "yes" || incEnabled === "on") {
       try {
         const store = getChainStateStoreFor(agentId);
-        const inc = store.applyAction(agentId, {
-          actionType: req.a_next.action_type,
-          actionDetail: req.a_next.action_detail
-        }, req.session_id, Boolean(meta.is_error));
+        const inc = store.applyAction(
+          chainBucket(agentId),
+          { actionType: req.a_next.action_type, actionDetail: req.a_next.action_detail },
+          req.session_id,
+          Boolean(meta.is_error),
+          agentId
+          // 来源：真实 agent（桶 key 可能是 __system__）
+        );
         const judgment = incMatchedToDeny(inc);
         if (judgment) {
           const layers = [...result.violated_layers];
@@ -12080,7 +12429,8 @@ async function analyzeRoute(c) {
               confidence: 90,
               analysis_duration_ms: Math.round((performance.now() - t0) * 10) / 10,
               // 跨会话节点脱敏（时间线按 agent_id 共享，原样返回等于泄露别人的命令原文）
-              violation_chain: redactChain(judgment.violation_chain, req.session_id)
+              violation_chain: redactChain(judgment.violation_chain, req.session_id),
+              violation_graph: redactGraph(judgment.violation_graph, req.session_id)
             })
           );
         }
@@ -12100,7 +12450,9 @@ async function analyzeRoute(c) {
         policy: result.policy,
         violated_policy: result.violated_policy,
         confidence: result.confidence,
-        analysis_duration_ms: Math.round(durationMs * 10) / 10
+        analysis_duration_ms: Math.round(durationMs * 10) / 10,
+        violation_chain: result.violation_chain ?? [],
+        violation_graph: redactGraph(result.violation_graph, req.session_id)
       })
     );
   } catch (err) {
@@ -12125,12 +12477,13 @@ function getChainStateStoreFor(_agentId) {
 }
 function incMatchedToDeny(inc) {
   if (inc.matched) {
-    const chain = (inc.matched.path || []).map((p) => [p.sessionId, p.seq, p.stage, p.timestamp]);
+    const chain = (inc.matched.path || []).map((p) => [p.sessionId, p.seq, p.stage, p.timestamp, p.agentId ?? null]);
     return {
       property_id: "cross-" + inc.matched.chainId,
       reason: inc.matched.reason,
       risk_level: inc.matched.riskLevel,
-      violation_chain: chain
+      violation_chain: chain,
+      violation_graph: inc.matched.graph ?? null
     };
   }
   if (inc.exfil && inc.exfil.length > 0) {
@@ -12138,7 +12491,9 @@ function incMatchedToDeny(inc) {
       property_id: "sensitive-data-flow",
       reason: inc.exfil[0].reason,
       risk_level: inc.exfil[0].risk_level,
-      violation_chain: []
+      // P2 的 path 现在包含 CRED 源 → 中间载体 → 外传点的完整链
+      violation_chain: inc.exfil[0].path ?? [],
+      violation_graph: inc.exfil[0].graph ?? null
     };
   }
   return null;
@@ -12150,9 +12505,10 @@ async function reviewRoute(c) {
     const req = ReviewRequestSchema.parse(body);
     const agentId = req.agent_id || "default";
     const store = getChainStateStoreFor(agentId);
-    let tracker = store.load(agentId);
+    const bucket = chainBucket(agentId);
+    let tracker = store.load(bucket);
     if (!tracker) {
-      tracker = new StatefulChainTracker(agentId);
+      tracker = new StatefulChainTracker(bucket);
     }
     if (req.db_path && !pathWithin(req.db_path, reviewRoots())) {
       return c.json({