@kenhkl/agent-moss 0.17.7 → 0.17.8

package/dist/cli.js

@@ -1258,6 +1258,20 @@ function redactChain(chain, currentSessionId) {
     return step;
   });
 }
+function redactGraph(graph, currentSessionId) {
+  if (!graph) return null;
+  if (chainDetailMode() === "full") return graph;
+  const nodes = (graph.nodes || []).map((n) => {
+    const m = { ...n };
+    if (String(m.session_id ?? "") !== String(currentSessionId)) {
+      m.session_id = "<other-session>";
+      m.action_detail = "<\u5DF2\u9690\u85CF>";
+      m.resources = [];
+    }
+    return m;
+  });
+  return { nodes, edges: graph.edges || [] };
+}
 function sessionSweepThreshold() {
   return envInt("AGENT_MOSS_SESSION_SWEEP_THRESHOLD", 50);
 }
@@ -1439,7 +1453,42 @@ var init_models = __esm({
       confidence: z.number().int().min(0).max(100).default(100),
       analysis_duration_ms: z.number().default(0),
       // 组合攻击链反例路径：每步 [session_id, seq, stage, timestamp]，含真实发生时间
-      violation_chain: z.array(z.array(z.union([z.string(), z.number()]).nullable())).default([])
+      violation_chain: z.array(z.array(z.union([z.string(), z.number()]).nullable())).default([]),
+      // 结构化攻击链图（前端可视化）：节点 + 边（next 时序 / data 数据流）
+      violation_graph: z.object({
+        // 性质元信息（前端展示"违反了哪条性质"）
+        property_id: z.string().optional(),
+        property_short: z.string().optional(),
+        property_name: z.string().optional(),
+        // 性质表达式 token → 节点位置（前端展示"表达式对应哪个节点"）
+        property_expression: z.array(
+          z.object({
+            token: z.string(),
+            node_index: z.union([z.number(), z.array(z.number())])
+          })
+        ).optional(),
+        nodes: z.array(
+          z.object({
+            session_id: z.string().default(""),
+            seq: z.number().default(0),
+            stage: z.string().default(""),
+            action_detail: z.string().default(""),
+            resources: z.array(z.string()).default([]),
+            // 节点在性质中的角色：source/carrier/sink（P2）或阶段名（P1）
+            role: z.string().optional(),
+            // 是否为违例见证节点（当前动作补全链 / 触发外传）
+            witness: z.boolean().optional()
+          })
+        ),
+        edges: z.array(
+          z.object({
+            from: z.number(),
+            to: z.number(),
+            type: z.enum(["next", "data"]).default("next"),
+            label: z.string().optional()
+          })
+        )
+      }).nullable().default(null)
     });
     HealthResponseSchema = z.object({
       status: z.string().default("healthy"),
@@ -9511,6 +9560,33 @@ var init_builder = __esm({
 });
 
 // src/engine/formal-engine/properties.ts
+function graphFromPath(nodes, path6, edgeType = "next", propertyMeta, roles, witnessLast = true, propertyExpression) {
+  const byKey = /* @__PURE__ */ new Map();
+  for (const n of nodes) byKey.set(`${n.sessionId}#${n.seq}`, n);
+  const gNodes = [];
+  const gEdges = [];
+  for (const item of path6) {
+    const n = byKey.get(`${item.sessionId}#${item.seq}`);
+    gNodes.push({
+      session_id: item.sessionId,
+      seq: item.seq,
+      stage: n ? n.stage : "",
+      action_detail: n ? n.actionDetail : item.detail,
+      resources: n ? [...n.resources].sort() : []
+    });
+    if (gNodes.length > 1) {
+      gEdges.push({ from: gNodes.length - 2, to: gNodes.length - 1, type: edgeType });
+    }
+  }
+  (roles || []).forEach((role, i) => {
+    if (i < gNodes.length && role) gNodes[i].role = role;
+  });
+  if (witnessLast && gNodes.length > 0) gNodes[gNodes.length - 1].witness = true;
+  const out = { nodes: gNodes, edges: gEdges };
+  if (propertyMeta) Object.assign(out, propertyMeta);
+  if (propertyExpression) out.property_expression = propertyExpression;
+  return out;
+}
 function parseTs(ts) {
   if (!ts) return null;
   const t = Date.parse(String(ts).trim());
@@ -9568,7 +9644,12 @@ function checkCrossSessionChain(graph) {
         propertyId: "cross-" + chain.id,
         reason: chain.reason,
         riskLevel: chain.riskLevel,
-        path: path6
+        path: path6,
+        graph: graphFromPath(nodes, path6, "next", {
+          property_id: "cross-" + chain.id,
+          property_short: "P1",
+          property_name: "\u8DE8\u4F1A\u8BDD\u7EC4\u5408\u94FE"
+        }, stages, true, stages.map((s, i) => ({ token: s, node_index: i })))
       });
       return violations;
     } else {
@@ -9588,7 +9669,12 @@ function checkCrossSessionChain(graph) {
           propertyId: "cross-" + chain.id,
           reason: chain.reason,
           riskLevel: chain.riskLevel,
-          path: path6
+          path: path6,
+          graph: graphFromPath(nodes, path6, "next", {
+            property_id: "cross-" + chain.id,
+            property_short: "P1",
+            property_name: "\u8DE8\u4F1A\u8BDD\u7EC4\u5408\u94FE"
+          }, stages, true, stages.map((s, i) => ({ token: s, node_index: i })))
         });
       }
     }
@@ -9603,10 +9689,15 @@ function checkSensitiveDataFlow(graph) {
   for (let i = 0; i < nodes.length; i++) {
     const n = nodes[i];
     if (n.stage === "CRED" && [...n.resources].some((r) => CRED_FILE_RE.test(r))) {
-      tainted.set(i, `${n.sessionId}#${n.seq} \u8BBF\u95EE ${[...n.resources][0]}`);
+      tainted.set(i, {
+        source: `${n.sessionId}#${n.seq} \u8BBF\u95EE ${[...n.resources][0]}`,
+        parent: null
+      });
     }
   }
   if (tainted.size === 0) return violations;
+  const taintEdges = /* @__PURE__ */ new Map();
+  const edgeKey = (p, c) => `${p}:${c}`;
   const edges = allEdges(graph);
   let changed = true;
   while (changed) {
@@ -9617,7 +9708,8 @@ function checkSensitiveDataFlow(graph) {
         const dstRes = nodes[e.dst].resources;
         for (const r of srcRes) {
           if (dstRes.has(r)) {
-            tainted.set(e.dst, tainted.get(e.src));
+            tainted.set(e.dst, { source: tainted.get(e.src).source, parent: e.src });
+            taintEdges.set(edgeKey(e.src, e.dst), r);
             changed = true;
             break;
           }
@@ -9625,16 +9717,75 @@ function checkSensitiveDataFlow(graph) {
       }
     }
   }
+  const tracePath = (idx) => {
+    const chain = [idx];
+    const seen = /* @__PURE__ */ new Set([idx]);
+    while (true) {
+      const parent = tainted.get(chain[chain.length - 1])?.parent;
+      if (parent === void 0 || parent === null || seen.has(parent)) break;
+      chain.push(parent);
+      seen.add(parent);
+    }
+    return chain.reverse();
+  };
+  const taintGraph = (chain) => {
+    const gNodes = [];
+    const gEdges = [];
+    chain.forEach((ni, k) => {
+      const n = nodes[ni];
+      const role = k === 0 ? "source" : k === chain.length - 1 ? "sink" : "carrier";
+      gNodes.push({
+        session_id: n.sessionId,
+        seq: n.seq,
+        stage: n.stage,
+        action_detail: n.actionDetail,
+        resources: [...n.resources].sort(),
+        role
+      });
+      if (k > 0) {
+        const prev = chain[k - 1];
+        gEdges.push({
+          from: k - 1,
+          to: k,
+          type: "data",
+          label: taintEdges.get(edgeKey(prev, ni)) || ""
+        });
+      }
+    });
+    if (gNodes.length > 0) gNodes[gNodes.length - 1].witness = true;
+    const expr = [{ token: "CRED", node_index: 0 }];
+    if (chain.length > 2) {
+      expr.push({
+        token: "\u5171\u4EAB\u8F7D\u4F53",
+        node_index: Array.from({ length: chain.length - 2 }, (_, i) => i + 1)
+      });
+    }
+    expr.push({ token: "EXFIL", node_index: chain.length - 1 });
+    return {
+      property_id: "sensitive-data-flow",
+      property_short: "P2",
+      property_name: "\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20",
+      property_expression: expr,
+      nodes: gNodes,
+      edges: gEdges
+    };
+  };
   const witness = graph.witnessIdx;
   const candidates = witness !== void 0 ? [witness] : nodes.map((_, i) => i);
   for (const i of candidates) {
     const n = nodes[i];
     if (tainted.has(i) && EXFIL_RE.test(n.actionDetail)) {
+      const chain = tracePath(i);
       violations.push({
         propertyId: "sensitive-data-flow",
-        reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${tainted.get(i)} \u2192 ${n.sessionId}#${n.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
+        reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${tainted.get(i).source} \u2192 ${n.sessionId}#${n.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
         riskLevel: "critical",
-        path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
+        path: chain.map((j) => ({
+          sessionId: nodes[j].sessionId,
+          seq: nodes[j].seq,
+          detail: nodes[j].actionDetail.slice(0, 60)
+        })),
+        graph: taintGraph(chain)
       });
       if (witness !== void 0) return violations;
     }
@@ -10176,6 +10327,12 @@ var init_stateful = __esm({
       nodes_ = [];
       ptr = {};
       tainted = /* @__PURE__ */ new Set();
+      /** taint 传播路径：nodeIdx -> 使该节点染毒的前驱 nodeIdx（CRED 源为 null） */
+      taintParent = /* @__PURE__ */ new Map();
+      /** "parent:child" -> 触发传播的共享资源（图上的 data 边标签） */
+      taintEdgeLabel = /* @__PURE__ */ new Map();
+      /** 资源 -> 首次染毒该资源的节点 seq */
+      taintOrigin = /* @__PURE__ */ new Map();
       /** taint 反索引：资源路径 → 已染毒（O(1) 命中）。 */
       taintedResources = /* @__PURE__ */ new Set();
       aliveResources = {};
@@ -10386,7 +10543,8 @@ var init_stateful = __esm({
                   stages,
                   riskLevel: String(chain.riskLevel || chain.risk_level || "high"),
                   reason: String(chain.reason || "\u68C0\u6D4B\u5230\u7EC4\u5408\u653B\u51FB\u94FE"),
-                  path: this.chainPath(stages)
+                  path: this.chainPath(stages),
+                  graph: this.buildChainGraph(stages, cid)
                 };
               }
             }
@@ -10433,21 +10591,69 @@ var init_stateful = __esm({
         }
         return path6;
       }
+      /** 把链路径转成前端可画的结构化图（相邻节点 next 边）。 */
+      buildChainGraph(stages, chainId) {
+        const path6 = this.chainPath(stages);
+        const gNodes = path6.map((p, i) => {
+          const n = this.nodes_.find((x) => x.sessionId === p.sessionId && x.seq === p.seq);
+          return {
+            session_id: p.sessionId,
+            seq: p.seq,
+            stage: p.stage,
+            action_detail: n ? n.actionDetail : "",
+            resources: n ? [...n.resources].sort() : [],
+            role: stages[i] || ""
+          };
+        });
+        const gEdges = [];
+        for (let i = 1; i < gNodes.length; i++) {
+          gEdges.push({ from: i - 1, to: i, type: "next" });
+        }
+        if (gNodes.length > 0) gNodes[gNodes.length - 1].witness = true;
+        return {
+          property_id: "cross-" + chainId,
+          property_short: "P1",
+          property_name: "\u8DE8\u4F1A\u8BDD\u7EC4\u5408\u94FE",
+          property_expression: stages.map((s, i) => ({ token: s, node_index: i })),
+          nodes: gNodes,
+          edges: gEdges
+        };
+      }
       // ---------------- 敏感数据 taint（P2） ----------------
       advanceTaint(node) {
         if (node.lifecycle === "dead") return;
         const idx = node.seq;
         const taintedRes = /* @__PURE__ */ new Set();
+        let parent = null;
+        let label = "";
+        let foundParent = false;
         for (const r of node.resources) {
-          if (this.resourceTainted(r)) taintedRes.add(r);
+          if (this.resourceTainted(r)) {
+            taintedRes.add(r);
+            if (!foundParent) {
+              const origin = this.taintOrigin.get(r);
+              if (origin !== void 0) {
+                parent = origin;
+                label = r;
+                foundParent = true;
+              }
+            }
+          }
         }
         if (node.stage === "CRED" && node.resources.some((r) => CRED_FILE_RE2.test(r))) {
           this.tainted.add(idx);
+          parent = null;
+          label = "";
           for (const r of node.resources) taintedRes.add(r);
         }
         if (taintedRes.size > 0) {
           this.tainted.add(idx);
-          for (const r of node.resources) this.taintedResources.add(r);
+          this.taintParent.set(idx, parent);
+          if (parent !== null) this.taintEdgeLabel.set(`${parent}:${idx}`, label);
+          for (const r of node.resources) {
+            this.taintedResources.add(r);
+            if (!this.taintOrigin.has(r)) this.taintOrigin.set(r, idx);
+          }
         }
       }
       resourceTainted(resource) {
@@ -10457,16 +10663,84 @@ var init_stateful = __esm({
       checkExfilAfterTaint(node) {
         if (!this.tainted.has(node.seq)) return [];
         if (EXFIL_RE2.test(node.actionDetail)) {
+          const chain = this.traceTaintChain(node.seq);
           return [{
             property_id: "sensitive-data-flow",
-            reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${this.taintSource(node)} \u2192 ${node.sessionId}#${node.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
+            reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${this.taintSource(node, chain)} \u2192 ${node.sessionId}#${node.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
             risk_level: "critical",
-            path: [[node.sessionId, node.seq, node.actionDetail.slice(0, 60)]]
+            path: chain.map((j) => {
+              const n = this.nodes_[j];
+              return [n.sessionId, n.seq, n.actionDetail.slice(0, 60), n.timestamp];
+            }),
+            graph: this.taintGraph(chain)
           }];
         }
         return [];
       }
-      taintSource(node) {
+      /** 沿 taint parent 回溯出 CRED 源 → 当前节点的完整路径。 */
+      traceTaintChain(idx) {
+        const chain = [idx];
+        const seen = /* @__PURE__ */ new Set([idx]);
+        while (true) {
+          const parent = this.taintParent.get(chain[chain.length - 1]);
+          if (parent === void 0 || parent === null || seen.has(parent)) break;
+          chain.push(parent);
+          seen.add(parent);
+        }
+        return chain.reverse();
+      }
+      /** 把 taint 路径转成前端可画的结构化图（data 边带共享资源标签）。 */
+      taintGraph(chain) {
+        const gNodes = [];
+        const gEdges = [];
+        chain.forEach((ni, k) => {
+          const n = this.nodes_[ni];
+          const role = k === 0 ? "source" : k === chain.length - 1 ? "sink" : "carrier";
+          gNodes.push({
+            session_id: n.sessionId,
+            seq: n.seq,
+            stage: n.stage,
+            action_detail: n.actionDetail,
+            resources: [...n.resources].sort(),
+            role
+          });
+          if (k > 0) {
+            const prev = chain[k - 1];
+            gEdges.push({
+              from: k - 1,
+              to: k,
+              type: "data",
+              label: this.taintEdgeLabel.get(`${prev}:${ni}`) || ""
+            });
+          }
+        });
+        if (gNodes.length > 0) gNodes[gNodes.length - 1].witness = true;
+        const expr = [{ token: "CRED", node_index: 0 }];
+        if (chain.length > 2) {
+          expr.push({
+            token: "\u5171\u4EAB\u8F7D\u4F53",
+            node_index: Array.from({ length: chain.length - 2 }, (_, i) => i + 1)
+          });
+        }
+        expr.push({ token: "EXFIL", node_index: chain.length - 1 });
+        return {
+          property_id: "sensitive-data-flow",
+          property_short: "P2",
+          property_name: "\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20",
+          property_expression: expr,
+          nodes: gNodes,
+          edges: gEdges
+        };
+      }
+      taintSource(node, chain = []) {
+        if (chain.length > 0) {
+          const src = this.nodes_[chain[0]];
+          if (src) {
+            for (const r of node.resources) {
+              if (src.resources.includes(r)) return `${src.sessionId}#${src.seq} \u8BBF\u95EE ${r}`;
+            }
+          }
+        }
         const sorted = [...this.tainted].sort((a, b) => a - b);
         for (const i of sorted) {
           if (i === node.seq) continue;
@@ -10485,6 +10759,9 @@ var init_stateful = __esm({
           nodes: this.nodes_.map((n) => ({ ...n, resources: [...n.resources] })),
           ptrs: { ...this.ptr },
           tainted: [...this.tainted].sort((a, b) => a - b),
+          // taint 传播路径（前端攻击链图）；边标签不入快照，重启后可从资源交集重建
+          taint_parent: Object.fromEntries([...this.taintParent.entries()].map(([k, v]) => [String(k), v])),
+          taint_origin: Object.fromEntries([...this.taintOrigin.entries()]),
           alive: { ...this.aliveResources },
           seq_next: this.seqNext
         };
@@ -10512,15 +10789,53 @@ var init_stateful = __esm({
         this.seqNext = Number(snapshot.seq_next || this.nodes_.length);
         this.ptr = Object.fromEntries(Object.entries(snapshot.ptrs || {}).map(([k, v]) => [k, Number(v)]));
         this.tainted = new Set((snapshot.tainted || []).map(Number));
+        this.taintParent = new Map(
+          Object.entries(snapshot.taint_parent || {}).map(
+            ([k, v]) => [Number(k), v === null || v === void 0 ? null : Number(v)]
+          )
+        );
+        this.taintOrigin = new Map(
+          Object.entries(snapshot.taint_origin || {}).map(
+            ([k, v]) => [String(k), Number(v)]
+          )
+        );
+        this.taintEdgeLabel = /* @__PURE__ */ new Map();
         this.taintedResources = /* @__PURE__ */ new Set();
         for (const i of this.tainted) {
           const n = this.nodes_[i];
           if (n) for (const r of n.resources) this.taintedResources.add(r);
         }
+        if (this.tainted.size > 0 && this.taintParent.size === 0) this.rebuildTaintParent();
+        if (this.taintOrigin.size === 0) {
+          for (const i of [...this.tainted].sort((a, b) => a - b)) {
+            const n = this.nodes_[i];
+            if (!n) continue;
+            for (const r of n.resources) {
+              if (!this.taintOrigin.has(r)) this.taintOrigin.set(r, i);
+            }
+          }
+        }
         this.aliveResources = Object.fromEntries(
           Object.entries(snapshot.alive || {}).map(([k, v]) => [k, Number(v)])
         );
       }
+      /** 旧快照无 parent 信息时，按 seq 顺序找最近的资源相交染毒前驱。 */
+      rebuildTaintParent() {
+        for (const i of [...this.tainted].sort((a, b) => a - b)) {
+          const n = this.nodes_[i];
+          if (!n) continue;
+          let parent = null;
+          for (let j = i - 1; j >= 0; j--) {
+            if (!this.tainted.has(j)) continue;
+            const m = this.nodes_[j];
+            if (m && m.resources.some((r) => n.resources.includes(r))) {
+              parent = j;
+              break;
+            }
+          }
+          this.taintParent.set(i, parent);
+        }
+      }
     };
   }
 });
@@ -10944,7 +11259,9 @@ async function runAnalysis(input) {
           riskType: "formal_verification",
           confidence: 90,
           source: "formal_engine",
-          violatedLayers: ["L2.2"]
+          violatedLayers: ["L2.2"],
+          violationGraph: v?.graph ?? null,
+          violationChain: (v?.path ?? []).map((p) => [p.sessionId, p.seq, p.detail])
         };
       }
     }
@@ -11489,7 +11806,9 @@ async function analyzeInner(input, mossLog) {
       violated_layers: judgment.violatedLayers || [],
       policy: "",
       violated_policy: `[${judgment.riskType}] ${judgment.reason}`,
-      confidence: judgment.confidence
+      confidence: judgment.confidence,
+      violation_graph: judgment.violationGraph ?? null,
+      violation_chain: judgment.violationChain ?? []
     };
     mossLog.logResult("Deny", denied.reason);
     return denied;
@@ -12110,7 +12429,8 @@ async function analyzeRoute(c) {
               confidence: 90,
               analysis_duration_ms: Math.round((performance.now() - t0) * 10) / 10,
               // 跨会话节点脱敏（时间线按 agent_id 共享，原样返回等于泄露别人的命令原文）
-              violation_chain: redactChain(judgment.violation_chain, req.session_id)
+              violation_chain: redactChain(judgment.violation_chain, req.session_id),
+              violation_graph: redactGraph(judgment.violation_graph, req.session_id)
             })
           );
         }
@@ -12130,7 +12450,9 @@ async function analyzeRoute(c) {
         policy: result.policy,
         violated_policy: result.violated_policy,
         confidence: result.confidence,
-        analysis_duration_ms: Math.round(durationMs * 10) / 10
+        analysis_duration_ms: Math.round(durationMs * 10) / 10,
+        violation_chain: result.violation_chain ?? [],
+        violation_graph: redactGraph(result.violation_graph, req.session_id)
       })
     );
   } catch (err) {
@@ -12160,7 +12482,8 @@ function incMatchedToDeny(inc) {
       property_id: "cross-" + inc.matched.chainId,
       reason: inc.matched.reason,
       risk_level: inc.matched.riskLevel,
-      violation_chain: chain
+      violation_chain: chain,
+      violation_graph: inc.matched.graph ?? null
     };
   }
   if (inc.exfil && inc.exfil.length > 0) {
@@ -12168,7 +12491,9 @@ function incMatchedToDeny(inc) {
       property_id: "sensitive-data-flow",
       reason: inc.exfil[0].reason,
       risk_level: inc.exfil[0].risk_level,
-      violation_chain: []
+      // P2 的 path 现在包含 CRED 源 → 中间载体 → 外传点的完整链
+      violation_chain: inc.exfil[0].path ?? [],
+      violation_graph: inc.exfil[0].graph ?? null
     };
   }
   return null;

package/dist/engine/coordinator.d.ts

@@ -1,3 +1,37 @@
+interface AttackChainNode {
+    session_id: string;
+    seq: number;
+    stage: string;
+    action_detail: string;
+    resources: string[];
+    /** 节点在性质中的角色：source/carrier/sink（P2），或阶段名（P1） */
+    role?: string;
+    /** 是否为违例见证节点（当前动作补全链 / 触发外传） */
+    witness?: boolean;
+}
+interface AttackChainEdge {
+    from: number;
+    to: number;
+    type: 'next' | 'data';
+    label?: string;
+}
+/** 性质表达式 token：token 文本 + 对应节点下标（可为多个）。 */
+interface AttackChainExprToken {
+    token: string;
+    node_index: number | number[];
+}
+/** 结构化攻击链图（前端 SVG 渲染的数据契约，与 Python 端逐字段对齐）。 */
+interface AttackChainGraph {
+    /** 性质元信息（前端展示"违反了哪条性质"） */
+    property_id?: string;
+    property_short?: string;
+    property_name?: string;
+    /** 性质表达式与节点位置的对应关系 */
+    property_expression?: AttackChainExprToken[];
+    nodes: AttackChainNode[];
+    edges: AttackChainEdge[];
+}
+
 /** Security judgment result from a single analysis layer */
 interface SecurityJudgment {
     allowed: boolean;
@@ -8,6 +42,10 @@ interface SecurityJudgment {
     source: string;
     violatedLayers: string[];
     isCredential?: boolean;
+    /** 组合式拦截的结构化攻击链（前端可视化用） */
+    violationGraph?: AttackChainGraph | null;
+    /** 兼容旧调用方：反例路径数组 */
+    violationChain?: unknown[];
 }
 
 /** 把命令按 shell 的连接符切成若干段，去掉空白段。

package/dist/engine/coordinator.js

@@ -8483,6 +8483,33 @@ function allNodesFlat(mg) {
 // src/engine/formal-engine/properties.ts
 init_esm_shims();
 init_rules_loader();
+function graphFromPath(nodes, path5, edgeType = "next", propertyMeta, roles, witnessLast = true, propertyExpression) {
+  const byKey = /* @__PURE__ */ new Map();
+  for (const n of nodes) byKey.set(`${n.sessionId}#${n.seq}`, n);
+  const gNodes = [];
+  const gEdges = [];
+  for (const item of path5) {
+    const n = byKey.get(`${item.sessionId}#${item.seq}`);
+    gNodes.push({
+      session_id: item.sessionId,
+      seq: item.seq,
+      stage: n ? n.stage : "",
+      action_detail: n ? n.actionDetail : item.detail,
+      resources: n ? [...n.resources].sort() : []
+    });
+    if (gNodes.length > 1) {
+      gEdges.push({ from: gNodes.length - 2, to: gNodes.length - 1, type: edgeType });
+    }
+  }
+  (roles || []).forEach((role, i) => {
+    if (i < gNodes.length && role) gNodes[i].role = role;
+  });
+  if (witnessLast && gNodes.length > 0) gNodes[gNodes.length - 1].witness = true;
+  const out = { nodes: gNodes, edges: gEdges };
+  if (propertyMeta) Object.assign(out, propertyMeta);
+  if (propertyExpression) out.property_expression = propertyExpression;
+  return out;
+}
 function parseTs(ts) {
   if (!ts) return null;
   const t = Date.parse(String(ts).trim());
@@ -8543,7 +8570,12 @@ function checkCrossSessionChain(graph) {
         propertyId: "cross-" + chain.id,
         reason: chain.reason,
         riskLevel: chain.riskLevel,
-        path: path5
+        path: path5,
+        graph: graphFromPath(nodes, path5, "next", {
+          property_id: "cross-" + chain.id,
+          property_short: "P1",
+          property_name: "\u8DE8\u4F1A\u8BDD\u7EC4\u5408\u94FE"
+        }, stages, true, stages.map((s, i) => ({ token: s, node_index: i })))
       });
       return violations;
     } else {
@@ -8563,7 +8595,12 @@ function checkCrossSessionChain(graph) {
           propertyId: "cross-" + chain.id,
           reason: chain.reason,
           riskLevel: chain.riskLevel,
-          path: path5
+          path: path5,
+          graph: graphFromPath(nodes, path5, "next", {
+            property_id: "cross-" + chain.id,
+            property_short: "P1",
+            property_name: "\u8DE8\u4F1A\u8BDD\u7EC4\u5408\u94FE"
+          }, stages, true, stages.map((s, i) => ({ token: s, node_index: i })))
         });
       }
     }
@@ -8578,10 +8615,15 @@ function checkSensitiveDataFlow(graph) {
   for (let i = 0; i < nodes.length; i++) {
     const n = nodes[i];
     if (n.stage === "CRED" && [...n.resources].some((r) => CRED_FILE_RE.test(r))) {
-      tainted.set(i, `${n.sessionId}#${n.seq} \u8BBF\u95EE ${[...n.resources][0]}`);
+      tainted.set(i, {
+        source: `${n.sessionId}#${n.seq} \u8BBF\u95EE ${[...n.resources][0]}`,
+        parent: null
+      });
     }
   }
   if (tainted.size === 0) return violations;
+  const taintEdges = /* @__PURE__ */ new Map();
+  const edgeKey = (p, c) => `${p}:${c}`;
   const edges = allEdges(graph);
   let changed = true;
   while (changed) {
@@ -8592,7 +8634,8 @@ function checkSensitiveDataFlow(graph) {
         const dstRes = nodes[e.dst].resources;
         for (const r of srcRes) {
           if (dstRes.has(r)) {
-            tainted.set(e.dst, tainted.get(e.src));
+            tainted.set(e.dst, { source: tainted.get(e.src).source, parent: e.src });
+            taintEdges.set(edgeKey(e.src, e.dst), r);
             changed = true;
             break;
           }
@@ -8600,16 +8643,75 @@ function checkSensitiveDataFlow(graph) {
       }
     }
   }
+  const tracePath = (idx) => {
+    const chain = [idx];
+    const seen = /* @__PURE__ */ new Set([idx]);
+    while (true) {
+      const parent = tainted.get(chain[chain.length - 1])?.parent;
+      if (parent === void 0 || parent === null || seen.has(parent)) break;
+      chain.push(parent);
+      seen.add(parent);
+    }
+    return chain.reverse();
+  };
+  const taintGraph = (chain) => {
+    const gNodes = [];
+    const gEdges = [];
+    chain.forEach((ni, k) => {
+      const n = nodes[ni];
+      const role = k === 0 ? "source" : k === chain.length - 1 ? "sink" : "carrier";
+      gNodes.push({
+        session_id: n.sessionId,
+        seq: n.seq,
+        stage: n.stage,
+        action_detail: n.actionDetail,
+        resources: [...n.resources].sort(),
+        role
+      });
+      if (k > 0) {
+        const prev = chain[k - 1];
+        gEdges.push({
+          from: k - 1,
+          to: k,
+          type: "data",
+          label: taintEdges.get(edgeKey(prev, ni)) || ""
+        });
+      }
+    });
+    if (gNodes.length > 0) gNodes[gNodes.length - 1].witness = true;
+    const expr = [{ token: "CRED", node_index: 0 }];
+    if (chain.length > 2) {
+      expr.push({
+        token: "\u5171\u4EAB\u8F7D\u4F53",
+        node_index: Array.from({ length: chain.length - 2 }, (_, i) => i + 1)
+      });
+    }
+    expr.push({ token: "EXFIL", node_index: chain.length - 1 });
+    return {
+      property_id: "sensitive-data-flow",
+      property_short: "P2",
+      property_name: "\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20",
+      property_expression: expr,
+      nodes: gNodes,
+      edges: gEdges
+    };
+  };
   const witness = graph.witnessIdx;
   const candidates = witness !== void 0 ? [witness] : nodes.map((_, i) => i);
   for (const i of candidates) {
     const n = nodes[i];
     if (tainted.has(i) && EXFIL_RE.test(n.actionDetail)) {
+      const chain = tracePath(i);
       violations.push({
         propertyId: "sensitive-data-flow",
-        reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${tainted.get(i)} \u2192 ${n.sessionId}#${n.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
+        reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${tainted.get(i).source} \u2192 ${n.sessionId}#${n.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
         riskLevel: "critical",
-        path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
+        path: chain.map((j) => ({
+          sessionId: nodes[j].sessionId,
+          seq: nodes[j].seq,
+          detail: nodes[j].actionDetail.slice(0, 60)
+        })),
+        graph: taintGraph(chain)
       });
       if (witness !== void 0) return violations;
     }
@@ -9353,7 +9455,9 @@ async function runAnalysis(input) {
           riskType: "formal_verification",
           confidence: 90,
           source: "formal_engine",
-          violatedLayers: ["L2.2"]
+          violatedLayers: ["L2.2"],
+          violationGraph: v?.graph ?? null,
+          violationChain: (v?.path ?? []).map((p) => [p.sessionId, p.seq, p.detail])
         };
       }
     }

package/dist/server.js

@@ -1104,6 +1104,20 @@ function redactChain(chain, currentSessionId) {
     return step;
   });
 }
+function redactGraph(graph, currentSessionId) {
+  if (!graph) return null;
+  if (chainDetailMode() === "full") return graph;
+  const nodes = (graph.nodes || []).map((n) => {
+    const m = { ...n };
+    if (String(m.session_id ?? "") !== String(currentSessionId)) {
+      m.session_id = "<other-session>";
+      m.action_detail = "<\u5DF2\u9690\u85CF>";
+      m.resources = [];
+    }
+    return m;
+  });
+  return { nodes, edges: graph.edges || [] };
+}
 function sessionSweepThreshold() {
   return envInt("AGENT_MOSS_SESSION_SWEEP_THRESHOLD", 50);
 }
@@ -8994,6 +9008,33 @@ var init_builder = __esm({
 });
 
 // src/engine/formal-engine/properties.ts
+function graphFromPath(nodes, path6, edgeType = "next", propertyMeta, roles, witnessLast = true, propertyExpression) {
+  const byKey = /* @__PURE__ */ new Map();
+  for (const n of nodes) byKey.set(`${n.sessionId}#${n.seq}`, n);
+  const gNodes = [];
+  const gEdges = [];
+  for (const item of path6) {
+    const n = byKey.get(`${item.sessionId}#${item.seq}`);
+    gNodes.push({
+      session_id: item.sessionId,
+      seq: item.seq,
+      stage: n ? n.stage : "",
+      action_detail: n ? n.actionDetail : item.detail,
+      resources: n ? [...n.resources].sort() : []
+    });
+    if (gNodes.length > 1) {
+      gEdges.push({ from: gNodes.length - 2, to: gNodes.length - 1, type: edgeType });
+    }
+  }
+  (roles || []).forEach((role, i) => {
+    if (i < gNodes.length && role) gNodes[i].role = role;
+  });
+  if (witnessLast && gNodes.length > 0) gNodes[gNodes.length - 1].witness = true;
+  const out = { nodes: gNodes, edges: gEdges };
+  if (propertyMeta) Object.assign(out, propertyMeta);
+  if (propertyExpression) out.property_expression = propertyExpression;
+  return out;
+}
 function parseTs(ts) {
   if (!ts) return null;
   const t = Date.parse(String(ts).trim());
@@ -9051,7 +9092,12 @@ function checkCrossSessionChain(graph) {
         propertyId: "cross-" + chain.id,
         reason: chain.reason,
         riskLevel: chain.riskLevel,
-        path: path6
+        path: path6,
+        graph: graphFromPath(nodes, path6, "next", {
+          property_id: "cross-" + chain.id,
+          property_short: "P1",
+          property_name: "\u8DE8\u4F1A\u8BDD\u7EC4\u5408\u94FE"
+        }, stages, true, stages.map((s, i) => ({ token: s, node_index: i })))
       });
       return violations;
     } else {
@@ -9071,7 +9117,12 @@ function checkCrossSessionChain(graph) {
           propertyId: "cross-" + chain.id,
           reason: chain.reason,
           riskLevel: chain.riskLevel,
-          path: path6
+          path: path6,
+          graph: graphFromPath(nodes, path6, "next", {
+            property_id: "cross-" + chain.id,
+            property_short: "P1",
+            property_name: "\u8DE8\u4F1A\u8BDD\u7EC4\u5408\u94FE"
+          }, stages, true, stages.map((s, i) => ({ token: s, node_index: i })))
         });
       }
     }
@@ -9086,10 +9137,15 @@ function checkSensitiveDataFlow(graph) {
   for (let i = 0; i < nodes.length; i++) {
     const n = nodes[i];
     if (n.stage === "CRED" && [...n.resources].some((r) => CRED_FILE_RE.test(r))) {
-      tainted.set(i, `${n.sessionId}#${n.seq} \u8BBF\u95EE ${[...n.resources][0]}`);
+      tainted.set(i, {
+        source: `${n.sessionId}#${n.seq} \u8BBF\u95EE ${[...n.resources][0]}`,
+        parent: null
+      });
     }
   }
   if (tainted.size === 0) return violations;
+  const taintEdges = /* @__PURE__ */ new Map();
+  const edgeKey = (p, c) => `${p}:${c}`;
   const edges = allEdges(graph);
   let changed = true;
   while (changed) {
@@ -9100,7 +9156,8 @@ function checkSensitiveDataFlow(graph) {
         const dstRes = nodes[e.dst].resources;
         for (const r of srcRes) {
           if (dstRes.has(r)) {
-            tainted.set(e.dst, tainted.get(e.src));
+            tainted.set(e.dst, { source: tainted.get(e.src).source, parent: e.src });
+            taintEdges.set(edgeKey(e.src, e.dst), r);
             changed = true;
             break;
           }
@@ -9108,16 +9165,75 @@ function checkSensitiveDataFlow(graph) {
       }
     }
   }
+  const tracePath = (idx) => {
+    const chain = [idx];
+    const seen = /* @__PURE__ */ new Set([idx]);
+    while (true) {
+      const parent = tainted.get(chain[chain.length - 1])?.parent;
+      if (parent === void 0 || parent === null || seen.has(parent)) break;
+      chain.push(parent);
+      seen.add(parent);
+    }
+    return chain.reverse();
+  };
+  const taintGraph = (chain) => {
+    const gNodes = [];
+    const gEdges = [];
+    chain.forEach((ni, k) => {
+      const n = nodes[ni];
+      const role = k === 0 ? "source" : k === chain.length - 1 ? "sink" : "carrier";
+      gNodes.push({
+        session_id: n.sessionId,
+        seq: n.seq,
+        stage: n.stage,
+        action_detail: n.actionDetail,
+        resources: [...n.resources].sort(),
+        role
+      });
+      if (k > 0) {
+        const prev = chain[k - 1];
+        gEdges.push({
+          from: k - 1,
+          to: k,
+          type: "data",
+          label: taintEdges.get(edgeKey(prev, ni)) || ""
+        });
+      }
+    });
+    if (gNodes.length > 0) gNodes[gNodes.length - 1].witness = true;
+    const expr = [{ token: "CRED", node_index: 0 }];
+    if (chain.length > 2) {
+      expr.push({
+        token: "\u5171\u4EAB\u8F7D\u4F53",
+        node_index: Array.from({ length: chain.length - 2 }, (_, i) => i + 1)
+      });
+    }
+    expr.push({ token: "EXFIL", node_index: chain.length - 1 });
+    return {
+      property_id: "sensitive-data-flow",
+      property_short: "P2",
+      property_name: "\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20",
+      property_expression: expr,
+      nodes: gNodes,
+      edges: gEdges
+    };
+  };
   const witness = graph.witnessIdx;
   const candidates = witness !== void 0 ? [witness] : nodes.map((_, i) => i);
   for (const i of candidates) {
     const n = nodes[i];
     if (tainted.has(i) && EXFIL_RE.test(n.actionDetail)) {
+      const chain = tracePath(i);
       violations.push({
         propertyId: "sensitive-data-flow",
-        reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${tainted.get(i)} \u2192 ${n.sessionId}#${n.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
+        reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${tainted.get(i).source} \u2192 ${n.sessionId}#${n.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
         riskLevel: "critical",
-        path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
+        path: chain.map((j) => ({
+          sessionId: nodes[j].sessionId,
+          seq: nodes[j].seq,
+          detail: nodes[j].actionDetail.slice(0, 60)
+        })),
+        graph: taintGraph(chain)
       });
       if (witness !== void 0) return violations;
     }
@@ -9659,6 +9775,12 @@ var init_stateful = __esm({
       nodes_ = [];
       ptr = {};
       tainted = /* @__PURE__ */ new Set();
+      /** taint 传播路径：nodeIdx -> 使该节点染毒的前驱 nodeIdx（CRED 源为 null） */
+      taintParent = /* @__PURE__ */ new Map();
+      /** "parent:child" -> 触发传播的共享资源（图上的 data 边标签） */
+      taintEdgeLabel = /* @__PURE__ */ new Map();
+      /** 资源 -> 首次染毒该资源的节点 seq */
+      taintOrigin = /* @__PURE__ */ new Map();
       /** taint 反索引：资源路径 → 已染毒（O(1) 命中）。 */
       taintedResources = /* @__PURE__ */ new Set();
       aliveResources = {};
@@ -9869,7 +9991,8 @@ var init_stateful = __esm({
                   stages,
                   riskLevel: String(chain.riskLevel || chain.risk_level || "high"),
                   reason: String(chain.reason || "\u68C0\u6D4B\u5230\u7EC4\u5408\u653B\u51FB\u94FE"),
-                  path: this.chainPath(stages)
+                  path: this.chainPath(stages),
+                  graph: this.buildChainGraph(stages, cid)
                 };
               }
             }
@@ -9916,21 +10039,69 @@ var init_stateful = __esm({
         }
         return path6;
       }
+      /** 把链路径转成前端可画的结构化图（相邻节点 next 边）。 */
+      buildChainGraph(stages, chainId) {
+        const path6 = this.chainPath(stages);
+        const gNodes = path6.map((p, i) => {
+          const n = this.nodes_.find((x) => x.sessionId === p.sessionId && x.seq === p.seq);
+          return {
+            session_id: p.sessionId,
+            seq: p.seq,
+            stage: p.stage,
+            action_detail: n ? n.actionDetail : "",
+            resources: n ? [...n.resources].sort() : [],
+            role: stages[i] || ""
+          };
+        });
+        const gEdges = [];
+        for (let i = 1; i < gNodes.length; i++) {
+          gEdges.push({ from: i - 1, to: i, type: "next" });
+        }
+        if (gNodes.length > 0) gNodes[gNodes.length - 1].witness = true;
+        return {
+          property_id: "cross-" + chainId,
+          property_short: "P1",
+          property_name: "\u8DE8\u4F1A\u8BDD\u7EC4\u5408\u94FE",
+          property_expression: stages.map((s, i) => ({ token: s, node_index: i })),
+          nodes: gNodes,
+          edges: gEdges
+        };
+      }
       // ---------------- 敏感数据 taint（P2） ----------------
       advanceTaint(node) {
         if (node.lifecycle === "dead") return;
         const idx = node.seq;
         const taintedRes = /* @__PURE__ */ new Set();
+        let parent = null;
+        let label = "";
+        let foundParent = false;
         for (const r of node.resources) {
-          if (this.resourceTainted(r)) taintedRes.add(r);
+          if (this.resourceTainted(r)) {
+            taintedRes.add(r);
+            if (!foundParent) {
+              const origin = this.taintOrigin.get(r);
+              if (origin !== void 0) {
+                parent = origin;
+                label = r;
+                foundParent = true;
+              }
+            }
+          }
         }
         if (node.stage === "CRED" && node.resources.some((r) => CRED_FILE_RE2.test(r))) {
           this.tainted.add(idx);
+          parent = null;
+          label = "";
           for (const r of node.resources) taintedRes.add(r);
         }
         if (taintedRes.size > 0) {
           this.tainted.add(idx);
-          for (const r of node.resources) this.taintedResources.add(r);
+          this.taintParent.set(idx, parent);
+          if (parent !== null) this.taintEdgeLabel.set(`${parent}:${idx}`, label);
+          for (const r of node.resources) {
+            this.taintedResources.add(r);
+            if (!this.taintOrigin.has(r)) this.taintOrigin.set(r, idx);
+          }
         }
       }
       resourceTainted(resource) {
@@ -9940,16 +10111,84 @@ var init_stateful = __esm({
       checkExfilAfterTaint(node) {
         if (!this.tainted.has(node.seq)) return [];
         if (EXFIL_RE2.test(node.actionDetail)) {
+          const chain = this.traceTaintChain(node.seq);
           return [{
             property_id: "sensitive-data-flow",
-            reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${this.taintSource(node)} \u2192 ${node.sessionId}#${node.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
+            reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${this.taintSource(node, chain)} \u2192 ${node.sessionId}#${node.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
             risk_level: "critical",
-            path: [[node.sessionId, node.seq, node.actionDetail.slice(0, 60)]]
+            path: chain.map((j) => {
+              const n = this.nodes_[j];
+              return [n.sessionId, n.seq, n.actionDetail.slice(0, 60), n.timestamp];
+            }),
+            graph: this.taintGraph(chain)
           }];
         }
         return [];
       }
-      taintSource(node) {
+      /** 沿 taint parent 回溯出 CRED 源 → 当前节点的完整路径。 */
+      traceTaintChain(idx) {
+        const chain = [idx];
+        const seen = /* @__PURE__ */ new Set([idx]);
+        while (true) {
+          const parent = this.taintParent.get(chain[chain.length - 1]);
+          if (parent === void 0 || parent === null || seen.has(parent)) break;
+          chain.push(parent);
+          seen.add(parent);
+        }
+        return chain.reverse();
+      }
+      /** 把 taint 路径转成前端可画的结构化图（data 边带共享资源标签）。 */
+      taintGraph(chain) {
+        const gNodes = [];
+        const gEdges = [];
+        chain.forEach((ni, k) => {
+          const n = this.nodes_[ni];
+          const role = k === 0 ? "source" : k === chain.length - 1 ? "sink" : "carrier";
+          gNodes.push({
+            session_id: n.sessionId,
+            seq: n.seq,
+            stage: n.stage,
+            action_detail: n.actionDetail,
+            resources: [...n.resources].sort(),
+            role
+          });
+          if (k > 0) {
+            const prev = chain[k - 1];
+            gEdges.push({
+              from: k - 1,
+              to: k,
+              type: "data",
+              label: this.taintEdgeLabel.get(`${prev}:${ni}`) || ""
+            });
+          }
+        });
+        if (gNodes.length > 0) gNodes[gNodes.length - 1].witness = true;
+        const expr = [{ token: "CRED", node_index: 0 }];
+        if (chain.length > 2) {
+          expr.push({
+            token: "\u5171\u4EAB\u8F7D\u4F53",
+            node_index: Array.from({ length: chain.length - 2 }, (_, i) => i + 1)
+          });
+        }
+        expr.push({ token: "EXFIL", node_index: chain.length - 1 });
+        return {
+          property_id: "sensitive-data-flow",
+          property_short: "P2",
+          property_name: "\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20",
+          property_expression: expr,
+          nodes: gNodes,
+          edges: gEdges
+        };
+      }
+      taintSource(node, chain = []) {
+        if (chain.length > 0) {
+          const src = this.nodes_[chain[0]];
+          if (src) {
+            for (const r of node.resources) {
+              if (src.resources.includes(r)) return `${src.sessionId}#${src.seq} \u8BBF\u95EE ${r}`;
+            }
+          }
+        }
         const sorted = [...this.tainted].sort((a, b) => a - b);
         for (const i of sorted) {
           if (i === node.seq) continue;
@@ -9968,6 +10207,9 @@ var init_stateful = __esm({
           nodes: this.nodes_.map((n) => ({ ...n, resources: [...n.resources] })),
           ptrs: { ...this.ptr },
           tainted: [...this.tainted].sort((a, b) => a - b),
+          // taint 传播路径（前端攻击链图）；边标签不入快照，重启后可从资源交集重建
+          taint_parent: Object.fromEntries([...this.taintParent.entries()].map(([k, v]) => [String(k), v])),
+          taint_origin: Object.fromEntries([...this.taintOrigin.entries()]),
           alive: { ...this.aliveResources },
           seq_next: this.seqNext
         };
@@ -9995,15 +10237,53 @@ var init_stateful = __esm({
         this.seqNext = Number(snapshot.seq_next || this.nodes_.length);
         this.ptr = Object.fromEntries(Object.entries(snapshot.ptrs || {}).map(([k, v]) => [k, Number(v)]));
         this.tainted = new Set((snapshot.tainted || []).map(Number));
+        this.taintParent = new Map(
+          Object.entries(snapshot.taint_parent || {}).map(
+            ([k, v]) => [Number(k), v === null || v === void 0 ? null : Number(v)]
+          )
+        );
+        this.taintOrigin = new Map(
+          Object.entries(snapshot.taint_origin || {}).map(
+            ([k, v]) => [String(k), Number(v)]
+          )
+        );
+        this.taintEdgeLabel = /* @__PURE__ */ new Map();
         this.taintedResources = /* @__PURE__ */ new Set();
         for (const i of this.tainted) {
           const n = this.nodes_[i];
           if (n) for (const r of n.resources) this.taintedResources.add(r);
         }
+        if (this.tainted.size > 0 && this.taintParent.size === 0) this.rebuildTaintParent();
+        if (this.taintOrigin.size === 0) {
+          for (const i of [...this.tainted].sort((a, b) => a - b)) {
+            const n = this.nodes_[i];
+            if (!n) continue;
+            for (const r of n.resources) {
+              if (!this.taintOrigin.has(r)) this.taintOrigin.set(r, i);
+            }
+          }
+        }
         this.aliveResources = Object.fromEntries(
           Object.entries(snapshot.alive || {}).map(([k, v]) => [k, Number(v)])
         );
       }
+      /** 旧快照无 parent 信息时，按 seq 顺序找最近的资源相交染毒前驱。 */
+      rebuildTaintParent() {
+        for (const i of [...this.tainted].sort((a, b) => a - b)) {
+          const n = this.nodes_[i];
+          if (!n) continue;
+          let parent = null;
+          for (let j = i - 1; j >= 0; j--) {
+            if (!this.tainted.has(j)) continue;
+            const m = this.nodes_[j];
+            if (m && m.resources.some((r) => n.resources.includes(r))) {
+              parent = j;
+              break;
+            }
+          }
+          this.taintParent.set(i, parent);
+        }
+      }
     };
   }
 });
@@ -10427,7 +10707,9 @@ async function runAnalysis(input) {
           riskType: "formal_verification",
           confidence: 90,
           source: "formal_engine",
-          violatedLayers: ["L2.2"]
+          violatedLayers: ["L2.2"],
+          violationGraph: v?.graph ?? null,
+          violationChain: (v?.path ?? []).map((p) => [p.sessionId, p.seq, p.detail])
         };
       }
     }
@@ -10800,7 +11082,42 @@ var AnalyzeResponseSchema = z.object({
   confidence: z.number().int().min(0).max(100).default(100),
   analysis_duration_ms: z.number().default(0),
   // 组合攻击链反例路径：每步 [session_id, seq, stage, timestamp]，含真实发生时间
-  violation_chain: z.array(z.array(z.union([z.string(), z.number()]).nullable())).default([])
+  violation_chain: z.array(z.array(z.union([z.string(), z.number()]).nullable())).default([]),
+  // 结构化攻击链图（前端可视化）：节点 + 边（next 时序 / data 数据流）
+  violation_graph: z.object({
+    // 性质元信息（前端展示"违反了哪条性质"）
+    property_id: z.string().optional(),
+    property_short: z.string().optional(),
+    property_name: z.string().optional(),
+    // 性质表达式 token → 节点位置（前端展示"表达式对应哪个节点"）
+    property_expression: z.array(
+      z.object({
+        token: z.string(),
+        node_index: z.union([z.number(), z.array(z.number())])
+      })
+    ).optional(),
+    nodes: z.array(
+      z.object({
+        session_id: z.string().default(""),
+        seq: z.number().default(0),
+        stage: z.string().default(""),
+        action_detail: z.string().default(""),
+        resources: z.array(z.string()).default([]),
+        // 节点在性质中的角色：source/carrier/sink（P2）或阶段名（P1）
+        role: z.string().optional(),
+        // 是否为违例见证节点（当前动作补全链 / 触发外传）
+        witness: z.boolean().optional()
+      })
+    ),
+    edges: z.array(
+      z.object({
+        from: z.number(),
+        to: z.number(),
+        type: z.enum(["next", "data"]).default("next"),
+        label: z.string().optional()
+      })
+    )
+  }).nullable().default(null)
 });
 var HealthResponseSchema = z.object({
   status: z.string().default("healthy"),
@@ -11224,7 +11541,9 @@ async function analyzeInner(input, mossLog) {
       violated_layers: judgment.violatedLayers || [],
       policy: "",
       violated_policy: `[${judgment.riskType}] ${judgment.reason}`,
-      confidence: judgment.confidence
+      confidence: judgment.confidence,
+      violation_graph: judgment.violationGraph ?? null,
+      violation_chain: judgment.violationChain ?? []
     };
     mossLog.logResult("Deny", denied.reason);
     return denied;
@@ -11781,7 +12100,8 @@ async function analyzeRoute(c) {
               confidence: 90,
               analysis_duration_ms: Math.round((performance.now() - t0) * 10) / 10,
               // 跨会话节点脱敏（时间线按 agent_id 共享，原样返回等于泄露别人的命令原文）
-              violation_chain: redactChain(judgment.violation_chain, req.session_id)
+              violation_chain: redactChain(judgment.violation_chain, req.session_id),
+              violation_graph: redactGraph(judgment.violation_graph, req.session_id)
             })
           );
         }
@@ -11801,7 +12121,9 @@ async function analyzeRoute(c) {
         policy: result.policy,
         violated_policy: result.violated_policy,
         confidence: result.confidence,
-        analysis_duration_ms: Math.round(durationMs * 10) / 10
+        analysis_duration_ms: Math.round(durationMs * 10) / 10,
+        violation_chain: result.violation_chain ?? [],
+        violation_graph: redactGraph(result.violation_graph, req.session_id)
       })
     );
   } catch (err) {
@@ -11832,7 +12154,8 @@ function incMatchedToDeny(inc) {
       property_id: "cross-" + inc.matched.chainId,
       reason: inc.matched.reason,
       risk_level: inc.matched.riskLevel,
-      violation_chain: chain
+      violation_chain: chain,
+      violation_graph: inc.matched.graph ?? null
     };
   }
   if (inc.exfil && inc.exfil.length > 0) {
@@ -11840,7 +12163,9 @@ function incMatchedToDeny(inc) {
       property_id: "sensitive-data-flow",
       reason: inc.exfil[0].reason,
       risk_level: inc.exfil[0].risk_level,
-      violation_chain: []
+      // P2 的 path 现在包含 CRED 源 → 中间载体 → 外传点的完整链
+      violation_chain: inc.exfil[0].path ?? [],
+      violation_graph: inc.exfil[0].graph ?? null
     };
   }
   return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kenhkl/agent-moss",
-  "version": "0.17.7",
+  "version": "0.17.8",
   "description": "Multi-layer security analysis engine for AI agents (TypeScript)",
   "type": "module",
   "main": "dist/server.js",