@kenhkl/agent-moss 0.17.7 → 0.17.10

package/dist/cli.js

@@ -1246,18 +1246,43 @@ function hardenExistingPaths() {
 function chainDetailMode() {
   return (env("AGENT_MOSS_CHAIN_DETAIL", "redacted") || "redacted").toLowerCase();
 }
-function redactChain(chain, currentSessionId) {
+function redactChain(chain, currentInstanceId = "", currentSessionId = "") {
   if (!chain || chain.length === 0) return [];
   if (chainDetailMode() === "full") return [...chain];
   return chain.map((step) => {
     if (Array.isArray(step) && step.length >= 3) {
       const [sid, seq, , ts] = step;
-      if (String(sid) === String(currentSessionId)) return [...step];
+      const inst = step.length > 5 ? String(step[5] ?? "") : "";
+      const sameInstance = !!(inst && currentInstanceId && inst === String(currentInstanceId));
+      const sameSessionFallback = !inst && !!currentSessionId && String(sid) === String(currentSessionId);
+      if (sameInstance || sameSessionFallback) return [...step];
       return ["<other-session>", seq, "<\u5DF2\u9690\u85CF>", ts ?? ""];
     }
     return step;
   });
 }
+function redactGraph(graph, currentInstanceId = "", currentSessionId = "") {
+  if (!graph) return null;
+  if (chainDetailMode() === "full") return graph;
+  const nodes = (graph.nodes || []).map((n) => {
+    const m = { ...n };
+    const inst = String(m.instance_id ?? "") || "";
+    const sid = String(m.session_id ?? "") || "";
+    const sameInstance = !!(inst && currentInstanceId && inst === String(currentInstanceId));
+    const sameSessionFallback = !inst && !!currentSessionId && sid === String(currentSessionId);
+    if (!(sameInstance || sameSessionFallback)) {
+      m.session_id = "<other-session>";
+      m.action_detail = "<\u5DF2\u9690\u85CF>";
+      m.resources = [];
+    }
+    return m;
+  });
+  const out = { nodes, edges: graph.edges || [] };
+  for (const key of ["property_id", "property_short", "property_name", "property_expression"]) {
+    if (graph[key] !== void 0) out[key] = graph[key];
+  }
+  return out;
+}
 function sessionSweepThreshold() {
   return envInt("AGENT_MOSS_SESSION_SWEEP_THRESHOLD", 50);
 }
@@ -1419,6 +1444,8 @@ var init_models = __esm({
         session_id: z.string(),
         /** 来源 agent（AgentGate 逐会话带上）：记录在链路径里供告警/取证，不参与链匹配。 */
         agent_id: z.string().optional(),
+        /** 来源实例：仅用于展示层脱敏（同实例不隐藏），不参与链匹配。 */
+        instance_id: z.string().optional(),
         action_history: z.array(ActionItemSchema).default([])
       })).default([]).describe("Multi-session historical actions (optional): for L2.2 formal engine cross-session combo-chain / sensitive-data-flow verification. Provided by caller (incl. future agentgate)."),
       a_next: ActionItemSchema.describe("Next action to be executed"),
@@ -1426,6 +1453,7 @@ var init_models = __esm({
       os_type: z.string().default("").describe("OS type: 'linux', 'windows', or empty for auto-detect"),
       cwd: z.string().default("").describe("Current working directory"),
       agent_id: z.string().default("").describe("Caller agent identifier, e.g. 'xiaoo' / 'opencode' / 'opendesk'. Empty = generic mode (no agent-specific rules)."),
+      instance_id: z.string().default("").describe("Agent installation/instance identifier. Used only for display-layer redaction: nodes from the same instance are returned unredacted. Does not affect detection."),
       metadata: z.record(z.unknown()).optional().describe("Extended metadata")
     });
     AnalyzeResponseSchema = z.object({
@@ -1439,7 +1467,44 @@ var init_models = __esm({
       confidence: z.number().int().min(0).max(100).default(100),
       analysis_duration_ms: z.number().default(0),
       // 组合攻击链反例路径：每步 [session_id, seq, stage, timestamp]，含真实发生时间
-      violation_chain: z.array(z.array(z.union([z.string(), z.number()]).nullable())).default([])
+      violation_chain: z.array(z.array(z.union([z.string(), z.number()]).nullable())).default([]),
+      // 结构化攻击链图（前端可视化）：节点 + 边（next 时序 / data 数据流）
+      violation_graph: z.object({
+        // 性质元信息（前端展示"违反了哪条性质"）
+        property_id: z.string().optional(),
+        property_short: z.string().optional(),
+        property_name: z.string().optional(),
+        // 性质表达式 token → 节点位置（前端展示"表达式对应哪个节点"）
+        property_expression: z.array(
+          z.object({
+            token: z.string(),
+            node_index: z.union([z.number(), z.array(z.number())])
+          })
+        ).optional(),
+        nodes: z.array(
+          z.object({
+            session_id: z.string().default(""),
+            seq: z.number().default(0),
+            stage: z.string().default(""),
+            action_detail: z.string().default(""),
+            resources: z.array(z.string()).default([]),
+            // 节点在性质中的角色：source/carrier/sink（P2）或阶段名（P1）
+            role: z.string().optional(),
+            // 是否为违例见证节点（当前动作补全链 / 触发外传）
+            witness: z.boolean().optional(),
+            // 来源实例（仅展示层脱敏：同实例不隐藏）
+            instance_id: z.string().optional()
+          })
+        ),
+        edges: z.array(
+          z.object({
+            from: z.number(),
+            to: z.number(),
+            type: z.enum(["next", "data"]).default("next"),
+            label: z.string().optional()
+          })
+        )
+      }).nullable().default(null)
     });
     HealthResponseSchema = z.object({
       status: z.string().default("healthy"),
@@ -9387,7 +9452,7 @@ function markIntegrity(actionDetail) {
   }
   return { integrity: "medium", isLowSource: false };
 }
-function initNode(sessionId, seq, actionType, actionDetail, timestamp, agentId = "") {
+function initNode(sessionId, seq, actionType, actionDetail, timestamp, agentId = "", instanceId = "") {
   const { integrity, isLowSource } = markIntegrity(actionDetail);
   return {
     sessionId,
@@ -9396,13 +9461,14 @@ function initNode(sessionId, seq, actionType, actionDetail, timestamp, agentId =
     actionDetail,
     stage: markStage(actionDetail),
     agentId: agentId || void 0,
+    instanceId: instanceId || void 0,
     resources: extractResources(actionDetail),
     integrity,
     isLowSource,
     timestamp: timestamp || void 0
   };
 }
-function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId = "") {
+function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId = "", instanceId = "") {
   const nodes = [];
   const edges = [];
   const stageFlags = /* @__PURE__ */ new Set();
@@ -9413,7 +9479,8 @@ function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId
       actionType: String(a.actionType || ""),
       actionDetail: ad,
       calledAt: a.calledAt || void 0,
-      agentId: a.agentId || agentId || void 0
+      agentId: a.agentId || agentId || void 0,
+      instanceId: a.instanceId || instanceId || void 0
     });
   }
   if (aNext) {
@@ -9421,11 +9488,12 @@ function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId
       actionType: String(aNext.actionType || ""),
       actionDetail: String(aNext.actionDetail || ""),
       calledAt: aNext.calledAt || void 0,
-      agentId: aNext.agentId || agentId || void 0
+      agentId: aNext.agentId || agentId || void 0,
+      instanceId: aNext.instanceId || instanceId || void 0
     });
   }
   details.forEach((d, seq) => {
-    const node = initNode(sessionId, seq, d.actionType, d.actionDetail, d.calledAt, d.agentId || "");
+    const node = initNode(sessionId, seq, d.actionType, d.actionDetail, d.calledAt, d.agentId || "", d.instanceId || "");
     nodes.push(node);
     if (node.stage) stageFlags.add(node.stage);
   });
@@ -9437,12 +9505,18 @@ function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId
 function buildMultiSessionGraph(sessions, aNext) {
   const mg = { sessions: [], crossEdges: [] };
   if (!sessions || sessions.length === 0) {
-    mg.sessions.push(buildSessionGraph([], aNext, "current"));
+    mg.sessions.push(buildSessionGraph([], aNext, "current", "", aNext?.instanceId || ""));
     return mg;
   }
   for (const s of sessions) {
     const sid = String(s.sessionId || "s");
-    mg.sessions.push(buildSessionGraph(s.actionHistory || [], void 0, sid, s.agentId || ""));
+    mg.sessions.push(buildSessionGraph(
+      s.actionHistory || [],
+      void 0,
+      sid,
+      s.agentId || "",
+      s.instanceId || ""
+    ));
   }
   if (aNext) {
     const last = mg.sessions[mg.sessions.length - 1];
@@ -9453,13 +9527,14 @@ function buildMultiSessionGraph(sessions, aNext) {
         String(aNext.actionType || ""),
         String(aNext.actionDetail || ""),
         aNext.calledAt || void 0,
-        aNext.agentId || ""
+        aNext.agentId || "",
+        aNext.instanceId || ""
       ));
       if (last.nodes.length > 1) {
         last.edges.push({ src: last.nodes.length - 2, dst: last.nodes.length - 1, kind: "next" });
       }
     } else {
-      mg.sessions.push(buildSessionGraph([], aNext, "current"));
+      mg.sessions.push(buildSessionGraph([], aNext, "current", "", aNext.instanceId || ""));
     }
   }
   addCrossDataEdges(mg);
@@ -9511,6 +9586,34 @@ var init_builder = __esm({
 });
 
 // src/engine/formal-engine/properties.ts
+function graphFromPath(nodes, path6, edgeType = "next", propertyMeta, roles, witnessLast = true, propertyExpression) {
+  const byKey = /* @__PURE__ */ new Map();
+  for (const n of nodes) byKey.set(`${n.sessionId}#${n.seq}`, n);
+  const gNodes = [];
+  const gEdges = [];
+  for (const item of path6) {
+    const n = byKey.get(`${item.sessionId}#${item.seq}`);
+    gNodes.push({
+      session_id: item.sessionId,
+      seq: item.seq,
+      stage: n ? n.stage : "",
+      action_detail: n ? n.actionDetail : item.detail,
+      resources: n ? [...n.resources].sort() : [],
+      instance_id: n ? n.instanceId || "" : ""
+    });
+    if (gNodes.length > 1) {
+      gEdges.push({ from: gNodes.length - 2, to: gNodes.length - 1, type: edgeType });
+    }
+  }
+  (roles || []).forEach((role, i) => {
+    if (i < gNodes.length && role) gNodes[i].role = role;
+  });
+  if (witnessLast && gNodes.length > 0) gNodes[gNodes.length - 1].witness = true;
+  const out = { nodes: gNodes, edges: gEdges };
+  if (propertyMeta) Object.assign(out, propertyMeta);
+  if (propertyExpression) out.property_expression = propertyExpression;
+  return out;
+}
 function parseTs(ts) {
   if (!ts) return null;
   const t = Date.parse(String(ts).trim());
@@ -9568,7 +9671,12 @@ function checkCrossSessionChain(graph) {
         propertyId: "cross-" + chain.id,
         reason: chain.reason,
         riskLevel: chain.riskLevel,
-        path: path6
+        path: path6,
+        graph: graphFromPath(nodes, path6, "next", {
+          property_id: "cross-" + chain.id,
+          property_short: "P1",
+          property_name: "\u8DE8\u4F1A\u8BDD\u7EC4\u5408\u94FE"
+        }, stages, true, stages.map((s, i) => ({ token: s, node_index: i })))
       });
       return violations;
     } else {
@@ -9588,7 +9696,12 @@ function checkCrossSessionChain(graph) {
           propertyId: "cross-" + chain.id,
           reason: chain.reason,
           riskLevel: chain.riskLevel,
-          path: path6
+          path: path6,
+          graph: graphFromPath(nodes, path6, "next", {
+            property_id: "cross-" + chain.id,
+            property_short: "P1",
+            property_name: "\u8DE8\u4F1A\u8BDD\u7EC4\u5408\u94FE"
+          }, stages, true, stages.map((s, i) => ({ token: s, node_index: i })))
         });
       }
     }
@@ -9603,10 +9716,15 @@ function checkSensitiveDataFlow(graph) {
   for (let i = 0; i < nodes.length; i++) {
     const n = nodes[i];
     if (n.stage === "CRED" && [...n.resources].some((r) => CRED_FILE_RE.test(r))) {
-      tainted.set(i, `${n.sessionId}#${n.seq} \u8BBF\u95EE ${[...n.resources][0]}`);
+      tainted.set(i, {
+        source: `${n.sessionId}#${n.seq} \u8BBF\u95EE ${[...n.resources][0]}`,
+        parent: null
+      });
     }
   }
   if (tainted.size === 0) return violations;
+  const taintEdges = /* @__PURE__ */ new Map();
+  const edgeKey = (p, c) => `${p}:${c}`;
   const edges = allEdges(graph);
   let changed = true;
   while (changed) {
@@ -9617,7 +9735,8 @@ function checkSensitiveDataFlow(graph) {
         const dstRes = nodes[e.dst].resources;
         for (const r of srcRes) {
           if (dstRes.has(r)) {
-            tainted.set(e.dst, tainted.get(e.src));
+            tainted.set(e.dst, { source: tainted.get(e.src).source, parent: e.src });
+            taintEdges.set(edgeKey(e.src, e.dst), r);
             changed = true;
             break;
           }
@@ -9625,16 +9744,76 @@ function checkSensitiveDataFlow(graph) {
       }
     }
   }
+  const tracePath = (idx) => {
+    const chain = [idx];
+    const seen = /* @__PURE__ */ new Set([idx]);
+    while (true) {
+      const parent = tainted.get(chain[chain.length - 1])?.parent;
+      if (parent === void 0 || parent === null || seen.has(parent)) break;
+      chain.push(parent);
+      seen.add(parent);
+    }
+    return chain.reverse();
+  };
+  const taintGraph = (chain) => {
+    const gNodes = [];
+    const gEdges = [];
+    chain.forEach((ni, k) => {
+      const n = nodes[ni];
+      const role = k === 0 ? "source" : k === chain.length - 1 ? "sink" : "carrier";
+      gNodes.push({
+        session_id: n.sessionId,
+        seq: n.seq,
+        stage: n.stage,
+        action_detail: n.actionDetail,
+        resources: [...n.resources].sort(),
+        role,
+        instance_id: n.instanceId || ""
+      });
+      if (k > 0) {
+        const prev = chain[k - 1];
+        gEdges.push({
+          from: k - 1,
+          to: k,
+          type: "data",
+          label: taintEdges.get(edgeKey(prev, ni)) || ""
+        });
+      }
+    });
+    if (gNodes.length > 0) gNodes[gNodes.length - 1].witness = true;
+    const expr = [{ token: "CRED", node_index: 0 }];
+    if (chain.length > 2) {
+      expr.push({
+        token: "\u5171\u4EAB\u8F7D\u4F53",
+        node_index: Array.from({ length: chain.length - 2 }, (_, i) => i + 1)
+      });
+    }
+    expr.push({ token: "EXFIL", node_index: chain.length - 1 });
+    return {
+      property_id: "sensitive-data-flow",
+      property_short: "P2",
+      property_name: "\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20",
+      property_expression: expr,
+      nodes: gNodes,
+      edges: gEdges
+    };
+  };
   const witness = graph.witnessIdx;
   const candidates = witness !== void 0 ? [witness] : nodes.map((_, i) => i);
   for (const i of candidates) {
     const n = nodes[i];
     if (tainted.has(i) && EXFIL_RE.test(n.actionDetail)) {
+      const chain = tracePath(i);
       violations.push({
         propertyId: "sensitive-data-flow",
-        reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${tainted.get(i)} \u2192 ${n.sessionId}#${n.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
+        reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${tainted.get(i).source} \u2192 ${n.sessionId}#${n.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
         riskLevel: "critical",
-        path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
+        path: chain.map((j) => ({
+          sessionId: nodes[j].sessionId,
+          seq: nodes[j].seq,
+          detail: nodes[j].actionDetail.slice(0, 60)
+        })),
+        graph: taintGraph(chain)
       });
       if (witness !== void 0) return violations;
     }
@@ -10176,6 +10355,12 @@ var init_stateful = __esm({
       nodes_ = [];
       ptr = {};
       tainted = /* @__PURE__ */ new Set();
+      /** taint 传播路径：nodeIdx -> 使该节点染毒的前驱 nodeIdx（CRED 源为 null） */
+      taintParent = /* @__PURE__ */ new Map();
+      /** "parent:child" -> 触发传播的共享资源（图上的 data 边标签） */
+      taintEdgeLabel = /* @__PURE__ */ new Map();
+      /** 资源 -> 首次染毒该资源的节点 seq */
+      taintOrigin = /* @__PURE__ */ new Map();
       /** taint 反索引：资源路径 → 已染毒（O(1) 命中）。 */
       taintedResources = /* @__PURE__ */ new Set();
       aliveResources = {};
@@ -10226,7 +10411,7 @@ var init_stateful = __esm({
         for (const s of sessions || []) {
           const sid = String(s.sessionId || "s");
           for (const a of s.actionHistory || []) {
-            const node = this.appendNode(a, sid);
+            const node = this.appendNode(a, sid, false, s.agentId || "", s.instanceId || "");
             if (!node) {
               continue;
             }
@@ -10240,8 +10425,8 @@ var init_stateful = __esm({
       }
       /** 增量推进：把当前动作追加到时间线 → 链指针推进 → 判定。 */
       advance(args) {
-        const { aNext, sessionId = "current", isError = false, agentId = "" } = args;
-        const node = this.appendNode(aNext, sessionId, isError, agentId);
+        const { aNext, sessionId = "current", isError = false, agentId = "", instanceId = "" } = args;
+        const node = this.appendNode(aNext, sessionId, isError, agentId, instanceId);
         if (!node) {
           return { seq: this.seqNext, node: null, matched: null, pendingPrefixes: this.pendingPrefixes, exfil: [], shouldBlock: false };
         }
@@ -10261,7 +10446,7 @@ var init_stateful = __esm({
           }
         };
       }
-      appendNode(action, sessionId, isError = false, agentId = "") {
+      appendNode(action, sessionId, isError = false, agentId = "", instanceId = "") {
         const ad = String(action.actionDetail || "");
         const at = String(action.actionType || "");
         if (!ad) return null;
@@ -10279,6 +10464,7 @@ var init_stateful = __esm({
           instances: extractInstances(ad, stage),
           isError,
           agentId: String(action.agentId || agentId || ""),
+          instanceId: String(action.instanceId || instanceId || ""),
           lifecycle: lifecycleFor(ad, stage, isError),
           timestamp: typeof action.calledAt === "string" ? action.calledAt : _StatefulChainTracker.now()
         };
@@ -10386,7 +10572,8 @@ var init_stateful = __esm({
                   stages,
                   riskLevel: String(chain.riskLevel || chain.risk_level || "high"),
                   reason: String(chain.reason || "\u68C0\u6D4B\u5230\u7EC4\u5408\u653B\u51FB\u94FE"),
-                  path: this.chainPath(stages)
+                  path: this.chainPath(stages),
+                  graph: this.buildChainGraph(stages, cid)
                 };
               }
             }
@@ -10421,7 +10608,8 @@ var init_stateful = __esm({
               seq: n.seq,
               stage: n.stage,
               timestamp: n.timestamp,
-              agentId: n.agentId
+              agentId: n.agentId,
+              instanceId: n.instanceId
             });
             const idx = stages.indexOf(n.stage);
             if (idx + 1 < stages.length) {
@@ -10433,21 +10621,70 @@ var init_stateful = __esm({
         }
         return path6;
       }
+      /** 把链路径转成前端可画的结构化图（相邻节点 next 边）。 */
+      buildChainGraph(stages, chainId) {
+        const path6 = this.chainPath(stages);
+        const gNodes = path6.map((p, i) => {
+          const n = this.nodes_.find((x) => x.sessionId === p.sessionId && x.seq === p.seq);
+          return {
+            session_id: p.sessionId,
+            seq: p.seq,
+            stage: p.stage,
+            action_detail: n ? n.actionDetail : "",
+            resources: n ? [...n.resources].sort() : [],
+            role: stages[i] || "",
+            instance_id: p.instanceId || ""
+          };
+        });
+        const gEdges = [];
+        for (let i = 1; i < gNodes.length; i++) {
+          gEdges.push({ from: i - 1, to: i, type: "next" });
+        }
+        if (gNodes.length > 0) gNodes[gNodes.length - 1].witness = true;
+        return {
+          property_id: "cross-" + chainId,
+          property_short: "P1",
+          property_name: "\u8DE8\u4F1A\u8BDD\u7EC4\u5408\u94FE",
+          property_expression: stages.map((s, i) => ({ token: s, node_index: i })),
+          nodes: gNodes,
+          edges: gEdges
+        };
+      }
       // ---------------- 敏感数据 taint（P2） ----------------
       advanceTaint(node) {
         if (node.lifecycle === "dead") return;
         const idx = node.seq;
         const taintedRes = /* @__PURE__ */ new Set();
+        let parent = null;
+        let label = "";
+        let foundParent = false;
         for (const r of node.resources) {
-          if (this.resourceTainted(r)) taintedRes.add(r);
+          if (this.resourceTainted(r)) {
+            taintedRes.add(r);
+            if (!foundParent) {
+              const origin = this.taintOrigin.get(r);
+              if (origin !== void 0) {
+                parent = origin;
+                label = r;
+                foundParent = true;
+              }
+            }
+          }
         }
         if (node.stage === "CRED" && node.resources.some((r) => CRED_FILE_RE2.test(r))) {
           this.tainted.add(idx);
+          parent = null;
+          label = "";
           for (const r of node.resources) taintedRes.add(r);
         }
         if (taintedRes.size > 0) {
           this.tainted.add(idx);
-          for (const r of node.resources) this.taintedResources.add(r);
+          this.taintParent.set(idx, parent);
+          if (parent !== null) this.taintEdgeLabel.set(`${parent}:${idx}`, label);
+          for (const r of node.resources) {
+            this.taintedResources.add(r);
+            if (!this.taintOrigin.has(r)) this.taintOrigin.set(r, idx);
+          }
         }
       }
       resourceTainted(resource) {
@@ -10457,16 +10694,85 @@ var init_stateful = __esm({
       checkExfilAfterTaint(node) {
         if (!this.tainted.has(node.seq)) return [];
         if (EXFIL_RE2.test(node.actionDetail)) {
+          const chain = this.traceTaintChain(node.seq);
           return [{
             property_id: "sensitive-data-flow",
-            reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${this.taintSource(node)} \u2192 ${node.sessionId}#${node.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
+            reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${this.taintSource(node, chain)} \u2192 ${node.sessionId}#${node.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
             risk_level: "critical",
-            path: [[node.sessionId, node.seq, node.actionDetail.slice(0, 60)]]
+            path: chain.map((j) => {
+              const n = this.nodes_[j];
+              return [n.sessionId, n.seq, n.actionDetail.slice(0, 60), n.timestamp, null, n.instanceId];
+            }),
+            graph: this.taintGraph(chain)
           }];
         }
         return [];
       }
-      taintSource(node) {
+      /** 沿 taint parent 回溯出 CRED 源 → 当前节点的完整路径。 */
+      traceTaintChain(idx) {
+        const chain = [idx];
+        const seen = /* @__PURE__ */ new Set([idx]);
+        while (true) {
+          const parent = this.taintParent.get(chain[chain.length - 1]);
+          if (parent === void 0 || parent === null || seen.has(parent)) break;
+          chain.push(parent);
+          seen.add(parent);
+        }
+        return chain.reverse();
+      }
+      /** 把 taint 路径转成前端可画的结构化图（data 边带共享资源标签）。 */
+      taintGraph(chain) {
+        const gNodes = [];
+        const gEdges = [];
+        chain.forEach((ni, k) => {
+          const n = this.nodes_[ni];
+          const role = k === 0 ? "source" : k === chain.length - 1 ? "sink" : "carrier";
+          gNodes.push({
+            session_id: n.sessionId,
+            seq: n.seq,
+            stage: n.stage,
+            action_detail: n.actionDetail,
+            resources: [...n.resources].sort(),
+            role,
+            instance_id: n.instanceId
+          });
+          if (k > 0) {
+            const prev = chain[k - 1];
+            gEdges.push({
+              from: k - 1,
+              to: k,
+              type: "data",
+              label: this.taintEdgeLabel.get(`${prev}:${ni}`) || ""
+            });
+          }
+        });
+        if (gNodes.length > 0) gNodes[gNodes.length - 1].witness = true;
+        const expr = [{ token: "CRED", node_index: 0 }];
+        if (chain.length > 2) {
+          expr.push({
+            token: "\u5171\u4EAB\u8F7D\u4F53",
+            node_index: Array.from({ length: chain.length - 2 }, (_, i) => i + 1)
+          });
+        }
+        expr.push({ token: "EXFIL", node_index: chain.length - 1 });
+        return {
+          property_id: "sensitive-data-flow",
+          property_short: "P2",
+          property_name: "\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20",
+          property_expression: expr,
+          nodes: gNodes,
+          edges: gEdges
+        };
+      }
+      taintSource(node, chain = []) {
+        if (chain.length > 0) {
+          const src = this.nodes_[chain[0]];
+          if (src) {
+            for (const r of node.resources) {
+              if (src.resources.includes(r)) return `${src.sessionId}#${src.seq} \u8BBF\u95EE ${r}`;
+            }
+          }
+        }
         const sorted = [...this.tainted].sort((a, b) => a - b);
         for (const i of sorted) {
           if (i === node.seq) continue;
@@ -10485,6 +10791,9 @@ var init_stateful = __esm({
           nodes: this.nodes_.map((n) => ({ ...n, resources: [...n.resources] })),
           ptrs: { ...this.ptr },
           tainted: [...this.tainted].sort((a, b) => a - b),
+          // taint 传播路径（前端攻击链图）；边标签不入快照，重启后可从资源交集重建
+          taint_parent: Object.fromEntries([...this.taintParent.entries()].map(([k, v]) => [String(k), v])),
+          taint_origin: Object.fromEntries([...this.taintOrigin.entries()]),
           alive: { ...this.aliveResources },
           seq_next: this.seqNext
         };
@@ -10497,6 +10806,8 @@ var init_stateful = __esm({
             seq: Number(raw.seq || 0),
             sessionId: String(raw.sessionId || ""),
             agentId: String(raw.agentId || ""),
+            instanceId: String(raw.instanceId || ""),
+            // 旧快照无此字段 → 空
             actionType: String(raw.actionType || ""),
             actionDetail: String(raw.actionDetail || ""),
             stage: String(raw.stage || ""),
@@ -10512,15 +10823,53 @@ var init_stateful = __esm({
         this.seqNext = Number(snapshot.seq_next || this.nodes_.length);
         this.ptr = Object.fromEntries(Object.entries(snapshot.ptrs || {}).map(([k, v]) => [k, Number(v)]));
         this.tainted = new Set((snapshot.tainted || []).map(Number));
+        this.taintParent = new Map(
+          Object.entries(snapshot.taint_parent || {}).map(
+            ([k, v]) => [Number(k), v === null || v === void 0 ? null : Number(v)]
+          )
+        );
+        this.taintOrigin = new Map(
+          Object.entries(snapshot.taint_origin || {}).map(
+            ([k, v]) => [String(k), Number(v)]
+          )
+        );
+        this.taintEdgeLabel = /* @__PURE__ */ new Map();
         this.taintedResources = /* @__PURE__ */ new Set();
         for (const i of this.tainted) {
           const n = this.nodes_[i];
           if (n) for (const r of n.resources) this.taintedResources.add(r);
         }
+        if (this.tainted.size > 0 && this.taintParent.size === 0) this.rebuildTaintParent();
+        if (this.taintOrigin.size === 0) {
+          for (const i of [...this.tainted].sort((a, b) => a - b)) {
+            const n = this.nodes_[i];
+            if (!n) continue;
+            for (const r of n.resources) {
+              if (!this.taintOrigin.has(r)) this.taintOrigin.set(r, i);
+            }
+          }
+        }
         this.aliveResources = Object.fromEntries(
           Object.entries(snapshot.alive || {}).map(([k, v]) => [k, Number(v)])
         );
       }
+      /** 旧快照无 parent 信息时，按 seq 顺序找最近的资源相交染毒前驱。 */
+      rebuildTaintParent() {
+        for (const i of [...this.tainted].sort((a, b) => a - b)) {
+          const n = this.nodes_[i];
+          if (!n) continue;
+          let parent = null;
+          for (let j = i - 1; j >= 0; j--) {
+            if (!this.tainted.has(j)) continue;
+            const m = this.nodes_[j];
+            if (m && m.resources.some((r) => n.resources.includes(r))) {
+              parent = j;
+              break;
+            }
+          }
+          this.taintParent.set(i, parent);
+        }
+      }
     };
   }
 });
@@ -10603,9 +10952,9 @@ var init_chain_state = __esm({
         delete this.data[agentId];
         this._scheduleWrite();
       }
-      applyAction(agentId, aNext, sessionId, isError = false, sourceAgent = "") {
+      applyAction(agentId, aNext, sessionId, isError = false, sourceAgent = "", instanceId = "") {
         const t = this.load(agentId) || new StatefulChainTracker(agentId);
-        const r = t.advance({ aNext, sessionId, isError, agentId: sourceAgent });
+        const r = t.advance({ aNext, sessionId, isError, agentId: sourceAgent, instanceId });
         this.save(t);
         return r;
       }
@@ -10923,12 +11272,21 @@ async function runAnalysis(input) {
         formalSessions.push({
           sessionId: s.sessionId || "s",
           ...s.agentId ? { agentId: s.agentId } : {},
+          ...s.instanceId ? { instanceId: s.instanceId } : {},
           actionHistory: s.actionHistory || []
         });
       }
     }
-    formalSessions.push({ sessionId: "current", agentId: input.agentId, actionHistory: input.actionHistory });
-    const formalResult = formalEngine.verify(formalSessions, input.aNext);
+    formalSessions.push({
+      sessionId: "current",
+      agentId: input.agentId,
+      instanceId: input.instanceId || "",
+      actionHistory: input.actionHistory
+    });
+    const formalResult = formalEngine.verify(formalSessions, {
+      ...input.aNext,
+      instanceId: input.instanceId || ""
+    });
     if (!formalResult.verified) {
       const v = formalResult.violations[0];
       if (isFormalObserveMode()) {
@@ -10944,7 +11302,9 @@ async function runAnalysis(input) {
           riskType: "formal_verification",
           confidence: 90,
           source: "formal_engine",
-          violatedLayers: ["L2.2"]
+          violatedLayers: ["L2.2"],
+          violationGraph: v?.graph ?? null,
+          violationChain: (v?.path ?? []).map((p) => [p.sessionId, p.seq, p.detail])
         };
       }
     }
@@ -11489,7 +11849,9 @@ async function analyzeInner(input, mossLog) {
       violated_layers: judgment.violatedLayers || [],
       policy: "",
       violated_policy: `[${judgment.riskType}] ${judgment.reason}`,
-      confidence: judgment.confidence
+      confidence: judgment.confidence,
+      violation_graph: judgment.violationGraph ?? null,
+      violation_chain: judgment.violationChain ?? []
     };
     mossLog.logResult("Deny", denied.reason);
     return denied;
@@ -12008,6 +12370,9 @@ async function analyzeRoute(c) {
         `[AgentMoss] \u26A0\uFE0F \u8DE8\u4F1A\u8BDD\u6279\u91CF\u8BBF\u95EE: key=${_sweepKey} \u7A97\u53E3\u5185 ${_sweepN} \u4E2A\u4E0D\u540C session\uFF08\u9608\u503C ${sessionSweepThreshold()}\uFF09`
       );
     }
+    const instanceId = String(
+      req.instance_id || req.metadata?.instance_id || ""
+    );
     const result = await analyze({
       sessionId: req.session_id,
       promptSession: req.prompt_session,
@@ -12023,8 +12388,9 @@ async function analyzeRoute(c) {
       })),
       sessionHistory: (req.session_history || []).map((s) => ({
         sessionId: s.session_id,
-        // 来源 agent（AgentGate 逐会话带上，用于链路径取证展示；不参与链匹配）
+        // 来源 agent/实例（AgentGate 逐会话带上，用于链路径取证/展示脱敏；不参与链匹配）
         ...s.agent_id ? { agentId: s.agent_id } : {},
+        ...s.instance_id ? { instanceId: s.instance_id } : {},
         actionHistory: (s.action_history || []).map((h) => ({
           actionType: h.action_type,
           actionDetail: h.action_detail,
@@ -12048,11 +12414,13 @@ async function analyzeRoute(c) {
       })),
       aNext: {
         actionType: req.a_next.action_type,
-        actionDetail: req.a_next.action_detail
+        actionDetail: req.a_next.action_detail,
+        instanceId
       },
       reason: req.reason,
       osType,
       cwd: req.cwd,
+      instanceId,
       // agent_id：AgentGate V1 normalizer 历史上把 agent_type 塞 metadata，
       // 顶层为空时兜底（OpenDesk 的 agent-moss 需 agent_id 加载专属规则）。
       agentId,
@@ -12088,8 +12456,9 @@ async function analyzeRoute(c) {
           { actionType: req.a_next.action_type, actionDetail: req.a_next.action_detail },
           req.session_id,
           Boolean(meta.is_error),
-          agentId
+          agentId,
           // 来源：真实 agent（桶 key 可能是 __system__）
+          instanceId
         );
         const judgment = incMatchedToDeny(inc);
         if (judgment) {
@@ -12110,7 +12479,8 @@ async function analyzeRoute(c) {
               confidence: 90,
               analysis_duration_ms: Math.round((performance.now() - t0) * 10) / 10,
               // 跨会话节点脱敏（时间线按 agent_id 共享，原样返回等于泄露别人的命令原文）
-              violation_chain: redactChain(judgment.violation_chain, req.session_id)
+              violation_chain: redactChain(judgment.violation_chain, instanceId, req.session_id),
+              violation_graph: redactGraph(judgment.violation_graph, instanceId, req.session_id)
             })
           );
         }
@@ -12130,7 +12500,9 @@ async function analyzeRoute(c) {
         policy: result.policy,
         violated_policy: result.violated_policy,
         confidence: result.confidence,
-        analysis_duration_ms: Math.round(durationMs * 10) / 10
+        analysis_duration_ms: Math.round(durationMs * 10) / 10,
+        violation_chain: result.violation_chain ?? [],
+        violation_graph: redactGraph(result.violation_graph, instanceId, req.session_id)
       })
     );
   } catch (err) {
@@ -12160,7 +12532,8 @@ function incMatchedToDeny(inc) {
       property_id: "cross-" + inc.matched.chainId,
       reason: inc.matched.reason,
       risk_level: inc.matched.riskLevel,
-      violation_chain: chain
+      violation_chain: chain,
+      violation_graph: inc.matched.graph ?? null
     };
   }
   if (inc.exfil && inc.exfil.length > 0) {
@@ -12168,7 +12541,9 @@ function incMatchedToDeny(inc) {
       property_id: "sensitive-data-flow",
       reason: inc.exfil[0].reason,
       risk_level: inc.exfil[0].risk_level,
-      violation_chain: []
+      // P2 的 path 现在包含 CRED 源 → 中间载体 → 外传点的完整链
+      violation_chain: inc.exfil[0].path ?? [],
+      violation_graph: inc.exfil[0].graph ?? null
     };
   }
   return null;