@kenhkl/agent-moss 0.17.7 → 0.17.10

package/dist/engine/coordinator.d.ts

@@ -1,3 +1,37 @@
+interface AttackChainNode {
+    session_id: string;
+    seq: number;
+    stage: string;
+    action_detail: string;
+    resources: string[];
+    /** 节点在性质中的角色：source/carrier/sink（P2），或阶段名（P1） */
+    role?: string;
+    /** 是否为违例见证节点（当前动作补全链 / 触发外传） */
+    witness?: boolean;
+}
+interface AttackChainEdge {
+    from: number;
+    to: number;
+    type: 'next' | 'data';
+    label?: string;
+}
+/** 性质表达式 token：token 文本 + 对应节点下标（可为多个）。 */
+interface AttackChainExprToken {
+    token: string;
+    node_index: number | number[];
+}
+/** 结构化攻击链图（前端 SVG 渲染的数据契约，与 Python 端逐字段对齐）。 */
+interface AttackChainGraph {
+    /** 性质元信息（前端展示"违反了哪条性质"） */
+    property_id?: string;
+    property_short?: string;
+    property_name?: string;
+    /** 性质表达式与节点位置的对应关系 */
+    property_expression?: AttackChainExprToken[];
+    nodes: AttackChainNode[];
+    edges: AttackChainEdge[];
+}
+
 /** Security judgment result from a single analysis layer */
 interface SecurityJudgment {
     allowed: boolean;
@@ -8,6 +42,10 @@ interface SecurityJudgment {
     source: string;
     violatedLayers: string[];
     isCredential?: boolean;
+    /** 组合式拦截的结构化攻击链（前端可视化用） */
+    violationGraph?: AttackChainGraph | null;
+    /** 兼容旧调用方：反例路径数组 */
+    violationChain?: unknown[];
 }
 
 /** 把命令按 shell 的连接符切成若干段，去掉空白段。
@@ -43,6 +81,7 @@ interface AnalysisInput {
      *  由调用方（含未来 agentgate 非侵入式采集）提供。 */
     sessionHistory?: {
         sessionId?: string;
+        instanceId?: string;
         actionHistory: {
             actionType: string;
             actionDetail: string;
@@ -52,12 +91,15 @@ interface AnalysisInput {
     aNext: {
         actionType: string;
         actionDetail: string;
+        instanceId?: string;
     };
     reason: string;
     osType: string;
     cwd: string;
     /** 调用方 agent 标识（如 'xiaoo' / 'opencode' / 'opendesk'）。空 = 通用模式。 */
     agentId: string;
+    /** 调用方实例标识（安装级）。仅用于展示层脱敏：同实例节点不隐藏。 */
+    instanceId?: string;
     /** 调用方场景标识（如 'bank'），用于加载场景定制规则（客户沙箱的目录访问边界/禁 ssh 等）。
      *  空时兜底环境变量 AGENT_MOSS_SCENARIO（部署级，客户沙箱设一次，所有请求生效）。 */
     scenarioId?: string;

package/dist/engine/coordinator.js

@@ -8369,7 +8369,7 @@ function markIntegrity(actionDetail) {
   }
   return { integrity: "medium", isLowSource: false };
 }
-function initNode(sessionId, seq, actionType, actionDetail, timestamp, agentId = "") {
+function initNode(sessionId, seq, actionType, actionDetail, timestamp, agentId = "", instanceId = "") {
   const { integrity, isLowSource } = markIntegrity(actionDetail);
   return {
     sessionId,
@@ -8378,13 +8378,14 @@ function initNode(sessionId, seq, actionType, actionDetail, timestamp, agentId =
     actionDetail,
     stage: markStage(actionDetail),
     agentId: agentId || void 0,
+    instanceId: instanceId || void 0,
     resources: extractResources(actionDetail),
     integrity,
     isLowSource,
     timestamp: timestamp || void 0
   };
 }
-function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId = "") {
+function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId = "", instanceId = "") {
   const nodes = [];
   const edges = [];
   const stageFlags = /* @__PURE__ */ new Set();
@@ -8395,7 +8396,8 @@ function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId
       actionType: String(a.actionType || ""),
       actionDetail: ad,
       calledAt: a.calledAt || void 0,
-      agentId: a.agentId || agentId || void 0
+      agentId: a.agentId || agentId || void 0,
+      instanceId: a.instanceId || instanceId || void 0
     });
   }
   if (aNext) {
@@ -8403,11 +8405,12 @@ function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId
       actionType: String(aNext.actionType || ""),
       actionDetail: String(aNext.actionDetail || ""),
       calledAt: aNext.calledAt || void 0,
-      agentId: aNext.agentId || agentId || void 0
+      agentId: aNext.agentId || agentId || void 0,
+      instanceId: aNext.instanceId || instanceId || void 0
     });
   }
   details.forEach((d, seq) => {
-    const node = initNode(sessionId, seq, d.actionType, d.actionDetail, d.calledAt, d.agentId || "");
+    const node = initNode(sessionId, seq, d.actionType, d.actionDetail, d.calledAt, d.agentId || "", d.instanceId || "");
     nodes.push(node);
     if (node.stage) stageFlags.add(node.stage);
   });
@@ -8419,12 +8422,18 @@ function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId
 function buildMultiSessionGraph(sessions, aNext) {
   const mg = { sessions: [], crossEdges: [] };
   if (!sessions || sessions.length === 0) {
-    mg.sessions.push(buildSessionGraph([], aNext, "current"));
+    mg.sessions.push(buildSessionGraph([], aNext, "current", "", aNext?.instanceId || ""));
     return mg;
   }
   for (const s of sessions) {
     const sid = String(s.sessionId || "s");
-    mg.sessions.push(buildSessionGraph(s.actionHistory || [], void 0, sid, s.agentId || ""));
+    mg.sessions.push(buildSessionGraph(
+      s.actionHistory || [],
+      void 0,
+      sid,
+      s.agentId || "",
+      s.instanceId || ""
+    ));
   }
   if (aNext) {
     const last = mg.sessions[mg.sessions.length - 1];
@@ -8435,13 +8444,14 @@ function buildMultiSessionGraph(sessions, aNext) {
         String(aNext.actionType || ""),
         String(aNext.actionDetail || ""),
         aNext.calledAt || void 0,
-        aNext.agentId || ""
+        aNext.agentId || "",
+        aNext.instanceId || ""
       ));
       if (last.nodes.length > 1) {
         last.edges.push({ src: last.nodes.length - 2, dst: last.nodes.length - 1, kind: "next" });
       }
     } else {
-      mg.sessions.push(buildSessionGraph([], aNext, "current"));
+      mg.sessions.push(buildSessionGraph([], aNext, "current", "", aNext.instanceId || ""));
     }
   }
   addCrossDataEdges(mg);
@@ -8483,6 +8493,34 @@ function allNodesFlat(mg) {
 // src/engine/formal-engine/properties.ts
 init_esm_shims();
 init_rules_loader();
+function graphFromPath(nodes, path5, edgeType = "next", propertyMeta, roles, witnessLast = true, propertyExpression) {
+  const byKey = /* @__PURE__ */ new Map();
+  for (const n of nodes) byKey.set(`${n.sessionId}#${n.seq}`, n);
+  const gNodes = [];
+  const gEdges = [];
+  for (const item of path5) {
+    const n = byKey.get(`${item.sessionId}#${item.seq}`);
+    gNodes.push({
+      session_id: item.sessionId,
+      seq: item.seq,
+      stage: n ? n.stage : "",
+      action_detail: n ? n.actionDetail : item.detail,
+      resources: n ? [...n.resources].sort() : [],
+      instance_id: n ? n.instanceId || "" : ""
+    });
+    if (gNodes.length > 1) {
+      gEdges.push({ from: gNodes.length - 2, to: gNodes.length - 1, type: edgeType });
+    }
+  }
+  (roles || []).forEach((role, i) => {
+    if (i < gNodes.length && role) gNodes[i].role = role;
+  });
+  if (witnessLast && gNodes.length > 0) gNodes[gNodes.length - 1].witness = true;
+  const out = { nodes: gNodes, edges: gEdges };
+  if (propertyMeta) Object.assign(out, propertyMeta);
+  if (propertyExpression) out.property_expression = propertyExpression;
+  return out;
+}
 function parseTs(ts) {
   if (!ts) return null;
   const t = Date.parse(String(ts).trim());
@@ -8543,7 +8581,12 @@ function checkCrossSessionChain(graph) {
         propertyId: "cross-" + chain.id,
         reason: chain.reason,
         riskLevel: chain.riskLevel,
-        path: path5
+        path: path5,
+        graph: graphFromPath(nodes, path5, "next", {
+          property_id: "cross-" + chain.id,
+          property_short: "P1",
+          property_name: "\u8DE8\u4F1A\u8BDD\u7EC4\u5408\u94FE"
+        }, stages, true, stages.map((s, i) => ({ token: s, node_index: i })))
       });
       return violations;
     } else {
@@ -8563,7 +8606,12 @@ function checkCrossSessionChain(graph) {
           propertyId: "cross-" + chain.id,
           reason: chain.reason,
           riskLevel: chain.riskLevel,
-          path: path5
+          path: path5,
+          graph: graphFromPath(nodes, path5, "next", {
+            property_id: "cross-" + chain.id,
+            property_short: "P1",
+            property_name: "\u8DE8\u4F1A\u8BDD\u7EC4\u5408\u94FE"
+          }, stages, true, stages.map((s, i) => ({ token: s, node_index: i })))
         });
       }
     }
@@ -8578,10 +8626,15 @@ function checkSensitiveDataFlow(graph) {
   for (let i = 0; i < nodes.length; i++) {
     const n = nodes[i];
     if (n.stage === "CRED" && [...n.resources].some((r) => CRED_FILE_RE.test(r))) {
-      tainted.set(i, `${n.sessionId}#${n.seq} \u8BBF\u95EE ${[...n.resources][0]}`);
+      tainted.set(i, {
+        source: `${n.sessionId}#${n.seq} \u8BBF\u95EE ${[...n.resources][0]}`,
+        parent: null
+      });
     }
   }
   if (tainted.size === 0) return violations;
+  const taintEdges = /* @__PURE__ */ new Map();
+  const edgeKey = (p, c) => `${p}:${c}`;
   const edges = allEdges(graph);
   let changed = true;
   while (changed) {
@@ -8592,7 +8645,8 @@ function checkSensitiveDataFlow(graph) {
         const dstRes = nodes[e.dst].resources;
         for (const r of srcRes) {
           if (dstRes.has(r)) {
-            tainted.set(e.dst, tainted.get(e.src));
+            tainted.set(e.dst, { source: tainted.get(e.src).source, parent: e.src });
+            taintEdges.set(edgeKey(e.src, e.dst), r);
             changed = true;
             break;
           }
@@ -8600,16 +8654,76 @@ function checkSensitiveDataFlow(graph) {
       }
     }
   }
+  const tracePath = (idx) => {
+    const chain = [idx];
+    const seen = /* @__PURE__ */ new Set([idx]);
+    while (true) {
+      const parent = tainted.get(chain[chain.length - 1])?.parent;
+      if (parent === void 0 || parent === null || seen.has(parent)) break;
+      chain.push(parent);
+      seen.add(parent);
+    }
+    return chain.reverse();
+  };
+  const taintGraph = (chain) => {
+    const gNodes = [];
+    const gEdges = [];
+    chain.forEach((ni, k) => {
+      const n = nodes[ni];
+      const role = k === 0 ? "source" : k === chain.length - 1 ? "sink" : "carrier";
+      gNodes.push({
+        session_id: n.sessionId,
+        seq: n.seq,
+        stage: n.stage,
+        action_detail: n.actionDetail,
+        resources: [...n.resources].sort(),
+        role,
+        instance_id: n.instanceId || ""
+      });
+      if (k > 0) {
+        const prev = chain[k - 1];
+        gEdges.push({
+          from: k - 1,
+          to: k,
+          type: "data",
+          label: taintEdges.get(edgeKey(prev, ni)) || ""
+        });
+      }
+    });
+    if (gNodes.length > 0) gNodes[gNodes.length - 1].witness = true;
+    const expr = [{ token: "CRED", node_index: 0 }];
+    if (chain.length > 2) {
+      expr.push({
+        token: "\u5171\u4EAB\u8F7D\u4F53",
+        node_index: Array.from({ length: chain.length - 2 }, (_, i) => i + 1)
+      });
+    }
+    expr.push({ token: "EXFIL", node_index: chain.length - 1 });
+    return {
+      property_id: "sensitive-data-flow",
+      property_short: "P2",
+      property_name: "\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20",
+      property_expression: expr,
+      nodes: gNodes,
+      edges: gEdges
+    };
+  };
   const witness = graph.witnessIdx;
   const candidates = witness !== void 0 ? [witness] : nodes.map((_, i) => i);
   for (const i of candidates) {
     const n = nodes[i];
     if (tainted.has(i) && EXFIL_RE.test(n.actionDetail)) {
+      const chain = tracePath(i);
       violations.push({
         propertyId: "sensitive-data-flow",
-        reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${tainted.get(i)} \u2192 ${n.sessionId}#${n.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
+        reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${tainted.get(i).source} \u2192 ${n.sessionId}#${n.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
         riskLevel: "critical",
-        path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
+        path: chain.map((j) => ({
+          sessionId: nodes[j].sessionId,
+          seq: nodes[j].seq,
+          detail: nodes[j].actionDetail.slice(0, 60)
+        })),
+        graph: taintGraph(chain)
       });
       if (witness !== void 0) return violations;
     }
@@ -9332,12 +9446,21 @@ async function runAnalysis(input) {
         formalSessions.push({
           sessionId: s.sessionId || "s",
           ...s.agentId ? { agentId: s.agentId } : {},
+          ...s.instanceId ? { instanceId: s.instanceId } : {},
           actionHistory: s.actionHistory || []
         });
       }
     }
-    formalSessions.push({ sessionId: "current", agentId: input.agentId, actionHistory: input.actionHistory });
-    const formalResult = formalEngine.verify(formalSessions, input.aNext);
+    formalSessions.push({
+      sessionId: "current",
+      agentId: input.agentId,
+      instanceId: input.instanceId || "",
+      actionHistory: input.actionHistory
+    });
+    const formalResult = formalEngine.verify(formalSessions, {
+      ...input.aNext,
+      instanceId: input.instanceId || ""
+    });
     if (!formalResult.verified) {
       const v = formalResult.violations[0];
       if (isFormalObserveMode()) {
@@ -9353,7 +9476,9 @@ async function runAnalysis(input) {
           riskType: "formal_verification",
           confidence: 90,
           source: "formal_engine",
-          violatedLayers: ["L2.2"]
+          violatedLayers: ["L2.2"],
+          violationGraph: v?.graph ?? null,
+          violationChain: (v?.path ?? []).map((p) => [p.sessionId, p.seq, p.detail])
         };
       }
     }