@kenhkl/agent-moss 0.17.8 → 0.17.11

package/dist/cli.js

@@ -1246,31 +1246,42 @@ function hardenExistingPaths() {
 function chainDetailMode() {
   return (env("AGENT_MOSS_CHAIN_DETAIL", "redacted") || "redacted").toLowerCase();
 }
-function redactChain(chain, currentSessionId) {
+function redactChain(chain, currentInstanceId = "", currentSessionId = "") {
   if (!chain || chain.length === 0) return [];
   if (chainDetailMode() === "full") return [...chain];
   return chain.map((step) => {
     if (Array.isArray(step) && step.length >= 3) {
       const [sid, seq, , ts] = step;
-      if (String(sid) === String(currentSessionId)) return [...step];
+      const inst = step.length > 5 ? String(step[5] ?? "") : "";
+      const sameInstance = !!(inst && currentInstanceId && inst === String(currentInstanceId));
+      const sameSessionFallback = !inst && !!currentSessionId && String(sid) === String(currentSessionId);
+      if (sameInstance || sameSessionFallback) return [...step];
       return ["<other-session>", seq, "<\u5DF2\u9690\u85CF>", ts ?? ""];
     }
     return step;
   });
 }
-function redactGraph(graph, currentSessionId) {
+function redactGraph(graph, currentInstanceId = "", currentSessionId = "") {
   if (!graph) return null;
   if (chainDetailMode() === "full") return graph;
   const nodes = (graph.nodes || []).map((n) => {
     const m = { ...n };
-    if (String(m.session_id ?? "") !== String(currentSessionId)) {
+    const inst = String(m.instance_id ?? "") || "";
+    const sid = String(m.session_id ?? "") || "";
+    const sameInstance = !!(inst && currentInstanceId && inst === String(currentInstanceId));
+    const sameSessionFallback = !inst && !!currentSessionId && sid === String(currentSessionId);
+    if (!(sameInstance || sameSessionFallback)) {
       m.session_id = "<other-session>";
       m.action_detail = "<\u5DF2\u9690\u85CF>";
       m.resources = [];
     }
     return m;
   });
-  return { nodes, edges: graph.edges || [] };
+  const out = { nodes, edges: graph.edges || [] };
+  for (const key of ["property_id", "property_short", "property_name", "property_expression"]) {
+    if (graph[key] !== void 0) out[key] = graph[key];
+  }
+  return out;
 }
 function sessionSweepThreshold() {
   return envInt("AGENT_MOSS_SESSION_SWEEP_THRESHOLD", 50);
@@ -1433,6 +1444,8 @@ var init_models = __esm({
         session_id: z.string(),
         /** 来源 agent（AgentGate 逐会话带上）：记录在链路径里供告警/取证，不参与链匹配。 */
         agent_id: z.string().optional(),
+        /** 来源实例：仅用于展示层脱敏（同实例不隐藏），不参与链匹配。 */
+        instance_id: z.string().optional(),
         action_history: z.array(ActionItemSchema).default([])
       })).default([]).describe("Multi-session historical actions (optional): for L2.2 formal engine cross-session combo-chain / sensitive-data-flow verification. Provided by caller (incl. future agentgate)."),
       a_next: ActionItemSchema.describe("Next action to be executed"),
@@ -1440,6 +1453,7 @@ var init_models = __esm({
       os_type: z.string().default("").describe("OS type: 'linux', 'windows', or empty for auto-detect"),
       cwd: z.string().default("").describe("Current working directory"),
       agent_id: z.string().default("").describe("Caller agent identifier, e.g. 'xiaoo' / 'opencode' / 'opendesk'. Empty = generic mode (no agent-specific rules)."),
+      instance_id: z.string().default("").describe("Agent installation/instance identifier. Used only for display-layer redaction: nodes from the same instance are returned unredacted. Does not affect detection."),
       metadata: z.record(z.unknown()).optional().describe("Extended metadata")
     });
     AnalyzeResponseSchema = z.object({
@@ -1477,7 +1491,9 @@ var init_models = __esm({
             // 节点在性质中的角色：source/carrier/sink（P2）或阶段名（P1）
             role: z.string().optional(),
             // 是否为违例见证节点（当前动作补全链 / 触发外传）
-            witness: z.boolean().optional()
+            witness: z.boolean().optional(),
+            // 来源实例（仅展示层脱敏：同实例不隐藏）
+            instance_id: z.string().optional()
           })
         ),
         edges: z.array(
@@ -9436,7 +9452,7 @@ function markIntegrity(actionDetail) {
   }
   return { integrity: "medium", isLowSource: false };
 }
-function initNode(sessionId, seq, actionType, actionDetail, timestamp, agentId = "") {
+function initNode(sessionId, seq, actionType, actionDetail, timestamp, agentId = "", instanceId = "") {
   const { integrity, isLowSource } = markIntegrity(actionDetail);
   return {
     sessionId,
@@ -9445,13 +9461,14 @@ function initNode(sessionId, seq, actionType, actionDetail, timestamp, agentId =
     actionDetail,
     stage: markStage(actionDetail),
     agentId: agentId || void 0,
+    instanceId: instanceId || void 0,
     resources: extractResources(actionDetail),
     integrity,
     isLowSource,
     timestamp: timestamp || void 0
   };
 }
-function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId = "") {
+function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId = "", instanceId = "") {
   const nodes = [];
   const edges = [];
   const stageFlags = /* @__PURE__ */ new Set();
@@ -9462,7 +9479,8 @@ function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId
       actionType: String(a.actionType || ""),
       actionDetail: ad,
       calledAt: a.calledAt || void 0,
-      agentId: a.agentId || agentId || void 0
+      agentId: a.agentId || agentId || void 0,
+      instanceId: a.instanceId || instanceId || void 0
     });
   }
   if (aNext) {
@@ -9470,11 +9488,12 @@ function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId
       actionType: String(aNext.actionType || ""),
       actionDetail: String(aNext.actionDetail || ""),
       calledAt: aNext.calledAt || void 0,
-      agentId: aNext.agentId || agentId || void 0
+      agentId: aNext.agentId || agentId || void 0,
+      instanceId: aNext.instanceId || instanceId || void 0
     });
   }
   details.forEach((d, seq) => {
-    const node = initNode(sessionId, seq, d.actionType, d.actionDetail, d.calledAt, d.agentId || "");
+    const node = initNode(sessionId, seq, d.actionType, d.actionDetail, d.calledAt, d.agentId || "", d.instanceId || "");
     nodes.push(node);
     if (node.stage) stageFlags.add(node.stage);
   });
@@ -9486,12 +9505,18 @@ function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId
 function buildMultiSessionGraph(sessions, aNext) {
   const mg = { sessions: [], crossEdges: [] };
   if (!sessions || sessions.length === 0) {
-    mg.sessions.push(buildSessionGraph([], aNext, "current"));
+    mg.sessions.push(buildSessionGraph([], aNext, "current", "", aNext?.instanceId || ""));
     return mg;
   }
   for (const s of sessions) {
     const sid = String(s.sessionId || "s");
-    mg.sessions.push(buildSessionGraph(s.actionHistory || [], void 0, sid, s.agentId || ""));
+    mg.sessions.push(buildSessionGraph(
+      s.actionHistory || [],
+      void 0,
+      sid,
+      s.agentId || "",
+      s.instanceId || ""
+    ));
   }
   if (aNext) {
     const last = mg.sessions[mg.sessions.length - 1];
@@ -9502,13 +9527,14 @@ function buildMultiSessionGraph(sessions, aNext) {
         String(aNext.actionType || ""),
         String(aNext.actionDetail || ""),
         aNext.calledAt || void 0,
-        aNext.agentId || ""
+        aNext.agentId || "",
+        aNext.instanceId || ""
       ));
       if (last.nodes.length > 1) {
         last.edges.push({ src: last.nodes.length - 2, dst: last.nodes.length - 1, kind: "next" });
       }
     } else {
-      mg.sessions.push(buildSessionGraph([], aNext, "current"));
+      mg.sessions.push(buildSessionGraph([], aNext, "current", "", aNext.instanceId || ""));
     }
   }
   addCrossDataEdges(mg);
@@ -9572,7 +9598,8 @@ function graphFromPath(nodes, path6, edgeType = "next", propertyMeta, roles, wit
       seq: item.seq,
       stage: n ? n.stage : "",
       action_detail: n ? n.actionDetail : item.detail,
-      resources: n ? [...n.resources].sort() : []
+      resources: n ? [...n.resources].sort() : [],
+      instance_id: n ? n.instanceId || "" : ""
     });
     if (gNodes.length > 1) {
       gEdges.push({ from: gNodes.length - 2, to: gNodes.length - 1, type: edgeType });
@@ -9740,7 +9767,8 @@ function checkSensitiveDataFlow(graph) {
         stage: n.stage,
         action_detail: n.actionDetail,
         resources: [...n.resources].sort(),
-        role
+        role,
+        instance_id: n.instanceId || ""
       });
       if (k > 0) {
         const prev = chain[k - 1];
@@ -9890,14 +9918,23 @@ function checkNeverExfilAfterPrivesc(graph) {
     if (candidates.length > 0) {
       const pre = nodes[candidates[candidates.length - 1]];
       const post = nodes[firstEv];
+      const path6 = [
+        { sessionId: pre.sessionId, seq: pre.seq, detail: pre.actionDetail.slice(0, 60) },
+        { sessionId: post.sessionId, seq: post.seq, detail: post.actionDetail.slice(0, 60) }
+      ];
       return [{
         propertyId: "no-exfil-after-privesc",
         reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\u25C7EXFIL) \u7A97\u53E3\u7EA6\u675F",
         riskLevel: "critical",
-        path: [
-          { sessionId: pre.sessionId, seq: pre.seq, detail: pre.actionDetail.slice(0, 60) },
-          { sessionId: post.sessionId, seq: post.seq, detail: post.actionDetail.slice(0, 60) }
-        ]
+        path: path6,
+        graph: graphFromPath(nodes, path6, "next", {
+          property_id: "no-exfil-after-privesc",
+          property_short: "P4",
+          property_name: "\u63D0\u6743\u540E\u7981\u6B62\u5916\u4F20"
+        }, ["privesc", "sink"], true, [
+          { token: "PRIVESC", node_index: 0 },
+          { token: "EXFIL", node_index: 1 }
+        ])
       }];
     }
     return violations;
@@ -9907,14 +9944,23 @@ function checkNeverExfilAfterPrivesc(graph) {
     for (let j = i + 1; j < nodes.length; j++) {
       if (!isExfilNode(nodes[j])) continue;
       if (privescInWindow(nodes, [i], j, windowSec).length === 0) continue;
+      const path6 = [
+        { sessionId: nodes[i].sessionId, seq: nodes[i].seq, detail: nodes[i].actionDetail.slice(0, 60) },
+        { sessionId: nodes[j].sessionId, seq: nodes[j].seq, detail: nodes[j].actionDetail.slice(0, 60) }
+      ];
       violations.push({
         propertyId: "no-exfil-after-privesc",
         reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\u25C7EXFIL) \u7A97\u53E3\u7EA6\u675F",
         riskLevel: "critical",
-        path: [
-          { sessionId: nodes[i].sessionId, seq: nodes[i].seq, detail: nodes[i].actionDetail.slice(0, 60) },
-          { sessionId: nodes[j].sessionId, seq: nodes[j].seq, detail: nodes[j].actionDetail.slice(0, 60) }
-        ]
+        path: path6,
+        graph: graphFromPath(nodes, path6, "next", {
+          property_id: "no-exfil-after-privesc",
+          property_short: "P4",
+          property_name: "\u63D0\u6743\u540E\u7981\u6B62\u5916\u4F20"
+        }, ["privesc", "sink"], true, [
+          { token: "PRIVESC", node_index: 0 },
+          { token: "EXFIL", node_index: 1 }
+        ])
       });
       return violations;
     }
@@ -9939,14 +9985,23 @@ function checkNeverExfilAfterCred(graph) {
     }
     if (pre) {
       const post = nodes[firstEv];
+      const path6 = [
+        { sessionId: pre.sessionId, seq: pre.seq, detail: pre.actionDetail.slice(0, 60) },
+        { sessionId: post.sessionId, seq: post.seq, detail: post.actionDetail.slice(0, 60) }
+      ];
       return [{
         propertyId: "no-exfil-after-credential",
         reason: "\u8BFB\u53D6\u51ED\u636E\u540E\u51FA\u73B0\u5916\u4F20\uFF0C\u8FDD\u53CD \u25A1(CRED\u2192\xAC\u25C7EXFIL)",
         riskLevel: "critical",
-        path: [
-          { sessionId: pre.sessionId, seq: pre.seq, detail: pre.actionDetail.slice(0, 60) },
-          { sessionId: post.sessionId, seq: post.seq, detail: post.actionDetail.slice(0, 60) }
-        ]
+        path: path6,
+        graph: graphFromPath(nodes, path6, "data", {
+          property_id: "no-exfil-after-credential",
+          property_short: "P5",
+          property_name: "\u8BFB\u53D6\u51ED\u636E\u540E\u7981\u6B62\u5916\u4F20"
+        }, ["source", "sink"], true, [
+          { token: "CRED", node_index: 0 },
+          { token: "EXFIL", node_index: 1 }
+        ])
       }];
     }
     return violations;
@@ -9955,14 +10010,23 @@ function checkNeverExfilAfterCred(graph) {
     if (!isCredNode(nodes[i])) continue;
     for (let j = i + 1; j < nodes.length; j++) {
       if (isExfilNode(nodes[j])) {
+        const path6 = [
+          { sessionId: nodes[i].sessionId, seq: nodes[i].seq, detail: nodes[i].actionDetail.slice(0, 60) },
+          { sessionId: nodes[j].sessionId, seq: nodes[j].seq, detail: nodes[j].actionDetail.slice(0, 60) }
+        ];
         violations.push({
           propertyId: "no-exfil-after-credential",
           reason: "\u8BFB\u53D6\u51ED\u636E\u540E\u51FA\u73B0\u5916\u4F20\uFF0C\u8FDD\u53CD \u25A1(CRED\u2192\xAC\u25C7EXFIL)",
           riskLevel: "critical",
-          path: [
-            { sessionId: nodes[i].sessionId, seq: nodes[i].seq, detail: nodes[i].actionDetail.slice(0, 60) },
-            { sessionId: nodes[j].sessionId, seq: nodes[j].seq, detail: nodes[j].actionDetail.slice(0, 60) }
-          ]
+          path: path6,
+          graph: graphFromPath(nodes, path6, "data", {
+            property_id: "no-exfil-after-credential",
+            property_short: "P5",
+            property_name: "\u8BFB\u53D6\u51ED\u636E\u540E\u7981\u6B62\u5916\u4F20"
+          }, ["source", "sink"], true, [
+            { token: "CRED", node_index: 0 },
+            { token: "EXFIL", node_index: 1 }
+          ])
         });
         return violations;
       }
@@ -10114,11 +10178,19 @@ function checkSensitiveDataAggregation(graph) {
     if (!isExfilNode(n)) continue;
     const srcs = sourcesFor(i);
     if (srcs.size >= 2) {
+      const path6 = [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }];
       violations.push({
         propertyId: "sensitive-data-aggregation",
         reason: `\u654F\u611F\u6570\u636E\u805A\u5408\u5916\u4F20\uFF1Aegress \u805A\u5408 ${srcs.size} \u4E2A\u4E8B\u4EF6\u6E90\u6570\u636E\uFF08Rule 12\uFF09`,
         riskLevel: "critical",
-        path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
+        path: path6,
+        graph: graphFromPath(nodes, path6, "next", {
+          property_id: "sensitive-data-aggregation",
+          property_short: "P8",
+          property_name: "\u654F\u611F\u6570\u636E\u805A\u5408\u5916\u4F20"
+        }, ["sink"], true, [
+          { token: "EXFIL", node_index: 0 }
+        ])
       });
       if (witness !== void 0) return violations;
     }
@@ -10383,7 +10455,7 @@ var init_stateful = __esm({
         for (const s of sessions || []) {
           const sid = String(s.sessionId || "s");
           for (const a of s.actionHistory || []) {
-            const node = this.appendNode(a, sid);
+            const node = this.appendNode(a, sid, false, s.agentId || "", s.instanceId || "");
             if (!node) {
               continue;
             }
@@ -10397,8 +10469,8 @@ var init_stateful = __esm({
       }
       /** 增量推进：把当前动作追加到时间线 → 链指针推进 → 判定。 */
       advance(args) {
-        const { aNext, sessionId = "current", isError = false, agentId = "" } = args;
-        const node = this.appendNode(aNext, sessionId, isError, agentId);
+        const { aNext, sessionId = "current", isError = false, agentId = "", instanceId = "" } = args;
+        const node = this.appendNode(aNext, sessionId, isError, agentId, instanceId);
         if (!node) {
           return { seq: this.seqNext, node: null, matched: null, pendingPrefixes: this.pendingPrefixes, exfil: [], shouldBlock: false };
         }
@@ -10418,7 +10490,7 @@ var init_stateful = __esm({
           }
         };
       }
-      appendNode(action, sessionId, isError = false, agentId = "") {
+      appendNode(action, sessionId, isError = false, agentId = "", instanceId = "") {
         const ad = String(action.actionDetail || "");
         const at = String(action.actionType || "");
         if (!ad) return null;
@@ -10436,6 +10508,7 @@ var init_stateful = __esm({
           instances: extractInstances(ad, stage),
           isError,
           agentId: String(action.agentId || agentId || ""),
+          instanceId: String(action.instanceId || instanceId || ""),
           lifecycle: lifecycleFor(ad, stage, isError),
           timestamp: typeof action.calledAt === "string" ? action.calledAt : _StatefulChainTracker.now()
         };
@@ -10579,7 +10652,8 @@ var init_stateful = __esm({
               seq: n.seq,
               stage: n.stage,
               timestamp: n.timestamp,
-              agentId: n.agentId
+              agentId: n.agentId,
+              instanceId: n.instanceId
             });
             const idx = stages.indexOf(n.stage);
             if (idx + 1 < stages.length) {
@@ -10602,7 +10676,8 @@ var init_stateful = __esm({
             stage: p.stage,
             action_detail: n ? n.actionDetail : "",
             resources: n ? [...n.resources].sort() : [],
-            role: stages[i] || ""
+            role: stages[i] || "",
+            instance_id: p.instanceId || ""
           };
         });
         const gEdges = [];
@@ -10670,7 +10745,7 @@ var init_stateful = __esm({
             risk_level: "critical",
             path: chain.map((j) => {
               const n = this.nodes_[j];
-              return [n.sessionId, n.seq, n.actionDetail.slice(0, 60), n.timestamp];
+              return [n.sessionId, n.seq, n.actionDetail.slice(0, 60), n.timestamp, null, n.instanceId];
             }),
             graph: this.taintGraph(chain)
           }];
@@ -10702,7 +10777,8 @@ var init_stateful = __esm({
             stage: n.stage,
             action_detail: n.actionDetail,
             resources: [...n.resources].sort(),
-            role
+            role,
+            instance_id: n.instanceId
           });
           if (k > 0) {
             const prev = chain[k - 1];
@@ -10774,6 +10850,8 @@ var init_stateful = __esm({
             seq: Number(raw.seq || 0),
             sessionId: String(raw.sessionId || ""),
             agentId: String(raw.agentId || ""),
+            instanceId: String(raw.instanceId || ""),
+            // 旧快照无此字段 → 空
             actionType: String(raw.actionType || ""),
             actionDetail: String(raw.actionDetail || ""),
             stage: String(raw.stage || ""),
@@ -10918,9 +10996,9 @@ var init_chain_state = __esm({
         delete this.data[agentId];
         this._scheduleWrite();
       }
-      applyAction(agentId, aNext, sessionId, isError = false, sourceAgent = "") {
+      applyAction(agentId, aNext, sessionId, isError = false, sourceAgent = "", instanceId = "") {
         const t = this.load(agentId) || new StatefulChainTracker(agentId);
-        const r = t.advance({ aNext, sessionId, isError, agentId: sourceAgent });
+        const r = t.advance({ aNext, sessionId, isError, agentId: sourceAgent, instanceId });
         this.save(t);
         return r;
       }
@@ -11238,12 +11316,21 @@ async function runAnalysis(input) {
         formalSessions.push({
           sessionId: s.sessionId || "s",
           ...s.agentId ? { agentId: s.agentId } : {},
+          ...s.instanceId ? { instanceId: s.instanceId } : {},
           actionHistory: s.actionHistory || []
         });
       }
     }
-    formalSessions.push({ sessionId: "current", agentId: input.agentId, actionHistory: input.actionHistory });
-    const formalResult = formalEngine.verify(formalSessions, input.aNext);
+    formalSessions.push({
+      sessionId: "current",
+      agentId: input.agentId,
+      instanceId: input.instanceId || "",
+      actionHistory: input.actionHistory
+    });
+    const formalResult = formalEngine.verify(formalSessions, {
+      ...input.aNext,
+      instanceId: input.instanceId || ""
+    });
     if (!formalResult.verified) {
       const v = formalResult.violations[0];
       if (isFormalObserveMode()) {
@@ -12327,6 +12414,9 @@ async function analyzeRoute(c) {
         `[AgentMoss] \u26A0\uFE0F \u8DE8\u4F1A\u8BDD\u6279\u91CF\u8BBF\u95EE: key=${_sweepKey} \u7A97\u53E3\u5185 ${_sweepN} \u4E2A\u4E0D\u540C session\uFF08\u9608\u503C ${sessionSweepThreshold()}\uFF09`
       );
     }
+    const instanceId = String(
+      req.instance_id || req.metadata?.instance_id || ""
+    );
     const result = await analyze({
       sessionId: req.session_id,
       promptSession: req.prompt_session,
@@ -12342,8 +12432,9 @@ async function analyzeRoute(c) {
       })),
       sessionHistory: (req.session_history || []).map((s) => ({
         sessionId: s.session_id,
-        // 来源 agent（AgentGate 逐会话带上，用于链路径取证展示；不参与链匹配）
+        // 来源 agent/实例（AgentGate 逐会话带上，用于链路径取证/展示脱敏；不参与链匹配）
         ...s.agent_id ? { agentId: s.agent_id } : {},
+        ...s.instance_id ? { instanceId: s.instance_id } : {},
         actionHistory: (s.action_history || []).map((h) => ({
           actionType: h.action_type,
           actionDetail: h.action_detail,
@@ -12367,11 +12458,13 @@ async function analyzeRoute(c) {
       })),
       aNext: {
         actionType: req.a_next.action_type,
-        actionDetail: req.a_next.action_detail
+        actionDetail: req.a_next.action_detail,
+        instanceId
       },
       reason: req.reason,
       osType,
       cwd: req.cwd,
+      instanceId,
       // agent_id：AgentGate V1 normalizer 历史上把 agent_type 塞 metadata，
       // 顶层为空时兜底（OpenDesk 的 agent-moss 需 agent_id 加载专属规则）。
       agentId,
@@ -12407,8 +12500,9 @@ async function analyzeRoute(c) {
           { actionType: req.a_next.action_type, actionDetail: req.a_next.action_detail },
           req.session_id,
           Boolean(meta.is_error),
-          agentId
+          agentId,
           // 来源：真实 agent（桶 key 可能是 __system__）
+          instanceId
         );
         const judgment = incMatchedToDeny(inc);
         if (judgment) {
@@ -12429,8 +12523,8 @@ async function analyzeRoute(c) {
               confidence: 90,
               analysis_duration_ms: Math.round((performance.now() - t0) * 10) / 10,
               // 跨会话节点脱敏（时间线按 agent_id 共享，原样返回等于泄露别人的命令原文）
-              violation_chain: redactChain(judgment.violation_chain, req.session_id),
-              violation_graph: redactGraph(judgment.violation_graph, req.session_id)
+              violation_chain: redactChain(judgment.violation_chain, instanceId, req.session_id),
+              violation_graph: redactGraph(judgment.violation_graph, instanceId, req.session_id)
             })
           );
         }
@@ -12452,7 +12546,7 @@ async function analyzeRoute(c) {
         confidence: result.confidence,
         analysis_duration_ms: Math.round(durationMs * 10) / 10,
         violation_chain: result.violation_chain ?? [],
-        violation_graph: redactGraph(result.violation_graph, req.session_id)
+        violation_graph: redactGraph(result.violation_graph, instanceId, req.session_id)
       })
     );
   } catch (err) {

package/dist/engine/coordinator.d.ts

@@ -81,6 +81,7 @@ interface AnalysisInput {
      *  由调用方（含未来 agentgate 非侵入式采集）提供。 */
     sessionHistory?: {
         sessionId?: string;
+        instanceId?: string;
         actionHistory: {
             actionType: string;
             actionDetail: string;
@@ -90,12 +91,15 @@ interface AnalysisInput {
     aNext: {
         actionType: string;
         actionDetail: string;
+        instanceId?: string;
     };
     reason: string;
     osType: string;
     cwd: string;
     /** 调用方 agent 标识（如 'xiaoo' / 'opencode' / 'opendesk'）。空 = 通用模式。 */
     agentId: string;
+    /** 调用方实例标识（安装级）。仅用于展示层脱敏：同实例节点不隐藏。 */
+    instanceId?: string;
     /** 调用方场景标识（如 'bank'），用于加载场景定制规则（客户沙箱的目录访问边界/禁 ssh 等）。
      *  空时兜底环境变量 AGENT_MOSS_SCENARIO（部署级，客户沙箱设一次，所有请求生效）。 */
     scenarioId?: string;

package/dist/engine/coordinator.js

@@ -8369,7 +8369,7 @@ function markIntegrity(actionDetail) {
   }
   return { integrity: "medium", isLowSource: false };
 }
-function initNode(sessionId, seq, actionType, actionDetail, timestamp, agentId = "") {
+function initNode(sessionId, seq, actionType, actionDetail, timestamp, agentId = "", instanceId = "") {
   const { integrity, isLowSource } = markIntegrity(actionDetail);
   return {
     sessionId,
@@ -8378,13 +8378,14 @@ function initNode(sessionId, seq, actionType, actionDetail, timestamp, agentId =
     actionDetail,
     stage: markStage(actionDetail),
     agentId: agentId || void 0,
+    instanceId: instanceId || void 0,
     resources: extractResources(actionDetail),
     integrity,
     isLowSource,
     timestamp: timestamp || void 0
   };
 }
-function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId = "") {
+function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId = "", instanceId = "") {
   const nodes = [];
   const edges = [];
   const stageFlags = /* @__PURE__ */ new Set();
@@ -8395,7 +8396,8 @@ function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId
       actionType: String(a.actionType || ""),
       actionDetail: ad,
       calledAt: a.calledAt || void 0,
-      agentId: a.agentId || agentId || void 0
+      agentId: a.agentId || agentId || void 0,
+      instanceId: a.instanceId || instanceId || void 0
     });
   }
   if (aNext) {
@@ -8403,11 +8405,12 @@ function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId
       actionType: String(aNext.actionType || ""),
       actionDetail: String(aNext.actionDetail || ""),
       calledAt: aNext.calledAt || void 0,
-      agentId: aNext.agentId || agentId || void 0
+      agentId: aNext.agentId || agentId || void 0,
+      instanceId: aNext.instanceId || instanceId || void 0
     });
   }
   details.forEach((d, seq) => {
-    const node = initNode(sessionId, seq, d.actionType, d.actionDetail, d.calledAt, d.agentId || "");
+    const node = initNode(sessionId, seq, d.actionType, d.actionDetail, d.calledAt, d.agentId || "", d.instanceId || "");
     nodes.push(node);
     if (node.stage) stageFlags.add(node.stage);
   });
@@ -8419,12 +8422,18 @@ function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId
 function buildMultiSessionGraph(sessions, aNext) {
   const mg = { sessions: [], crossEdges: [] };
   if (!sessions || sessions.length === 0) {
-    mg.sessions.push(buildSessionGraph([], aNext, "current"));
+    mg.sessions.push(buildSessionGraph([], aNext, "current", "", aNext?.instanceId || ""));
     return mg;
   }
   for (const s of sessions) {
     const sid = String(s.sessionId || "s");
-    mg.sessions.push(buildSessionGraph(s.actionHistory || [], void 0, sid, s.agentId || ""));
+    mg.sessions.push(buildSessionGraph(
+      s.actionHistory || [],
+      void 0,
+      sid,
+      s.agentId || "",
+      s.instanceId || ""
+    ));
   }
   if (aNext) {
     const last = mg.sessions[mg.sessions.length - 1];
@@ -8435,13 +8444,14 @@ function buildMultiSessionGraph(sessions, aNext) {
         String(aNext.actionType || ""),
         String(aNext.actionDetail || ""),
         aNext.calledAt || void 0,
-        aNext.agentId || ""
+        aNext.agentId || "",
+        aNext.instanceId || ""
       ));
       if (last.nodes.length > 1) {
         last.edges.push({ src: last.nodes.length - 2, dst: last.nodes.length - 1, kind: "next" });
       }
     } else {
-      mg.sessions.push(buildSessionGraph([], aNext, "current"));
+      mg.sessions.push(buildSessionGraph([], aNext, "current", "", aNext.instanceId || ""));
     }
   }
   addCrossDataEdges(mg);
@@ -8495,7 +8505,8 @@ function graphFromPath(nodes, path5, edgeType = "next", propertyMeta, roles, wit
       seq: item.seq,
       stage: n ? n.stage : "",
       action_detail: n ? n.actionDetail : item.detail,
-      resources: n ? [...n.resources].sort() : []
+      resources: n ? [...n.resources].sort() : [],
+      instance_id: n ? n.instanceId || "" : ""
     });
     if (gNodes.length > 1) {
       gEdges.push({ from: gNodes.length - 2, to: gNodes.length - 1, type: edgeType });
@@ -8666,7 +8677,8 @@ function checkSensitiveDataFlow(graph) {
         stage: n.stage,
         action_detail: n.actionDetail,
         resources: [...n.resources].sort(),
-        role
+        role,
+        instance_id: n.instanceId || ""
       });
       if (k > 0) {
         const prev = chain[k - 1];
@@ -8824,14 +8836,23 @@ function checkNeverExfilAfterPrivesc(graph) {
     if (candidates.length > 0) {
       const pre = nodes[candidates[candidates.length - 1]];
       const post = nodes[firstEv];
+      const path5 = [
+        { sessionId: pre.sessionId, seq: pre.seq, detail: pre.actionDetail.slice(0, 60) },
+        { sessionId: post.sessionId, seq: post.seq, detail: post.actionDetail.slice(0, 60) }
+      ];
       return [{
         propertyId: "no-exfil-after-privesc",
         reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\u25C7EXFIL) \u7A97\u53E3\u7EA6\u675F",
         riskLevel: "critical",
-        path: [
-          { sessionId: pre.sessionId, seq: pre.seq, detail: pre.actionDetail.slice(0, 60) },
-          { sessionId: post.sessionId, seq: post.seq, detail: post.actionDetail.slice(0, 60) }
-        ]
+        path: path5,
+        graph: graphFromPath(nodes, path5, "next", {
+          property_id: "no-exfil-after-privesc",
+          property_short: "P4",
+          property_name: "\u63D0\u6743\u540E\u7981\u6B62\u5916\u4F20"
+        }, ["privesc", "sink"], true, [
+          { token: "PRIVESC", node_index: 0 },
+          { token: "EXFIL", node_index: 1 }
+        ])
       }];
     }
     return violations;
@@ -8841,14 +8862,23 @@ function checkNeverExfilAfterPrivesc(graph) {
     for (let j = i + 1; j < nodes.length; j++) {
       if (!isExfilNode(nodes[j])) continue;
       if (privescInWindow(nodes, [i], j, windowSec).length === 0) continue;
+      const path5 = [
+        { sessionId: nodes[i].sessionId, seq: nodes[i].seq, detail: nodes[i].actionDetail.slice(0, 60) },
+        { sessionId: nodes[j].sessionId, seq: nodes[j].seq, detail: nodes[j].actionDetail.slice(0, 60) }
+      ];
       violations.push({
         propertyId: "no-exfil-after-privesc",
         reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\u25C7EXFIL) \u7A97\u53E3\u7EA6\u675F",
         riskLevel: "critical",
-        path: [
-          { sessionId: nodes[i].sessionId, seq: nodes[i].seq, detail: nodes[i].actionDetail.slice(0, 60) },
-          { sessionId: nodes[j].sessionId, seq: nodes[j].seq, detail: nodes[j].actionDetail.slice(0, 60) }
-        ]
+        path: path5,
+        graph: graphFromPath(nodes, path5, "next", {
+          property_id: "no-exfil-after-privesc",
+          property_short: "P4",
+          property_name: "\u63D0\u6743\u540E\u7981\u6B62\u5916\u4F20"
+        }, ["privesc", "sink"], true, [
+          { token: "PRIVESC", node_index: 0 },
+          { token: "EXFIL", node_index: 1 }
+        ])
       });
       return violations;
     }
@@ -8873,14 +8903,23 @@ function checkNeverExfilAfterCred(graph) {
     }
     if (pre) {
       const post = nodes[firstEv];
+      const path5 = [
+        { sessionId: pre.sessionId, seq: pre.seq, detail: pre.actionDetail.slice(0, 60) },
+        { sessionId: post.sessionId, seq: post.seq, detail: post.actionDetail.slice(0, 60) }
+      ];
       return [{
         propertyId: "no-exfil-after-credential",
         reason: "\u8BFB\u53D6\u51ED\u636E\u540E\u51FA\u73B0\u5916\u4F20\uFF0C\u8FDD\u53CD \u25A1(CRED\u2192\xAC\u25C7EXFIL)",
         riskLevel: "critical",
-        path: [
-          { sessionId: pre.sessionId, seq: pre.seq, detail: pre.actionDetail.slice(0, 60) },
-          { sessionId: post.sessionId, seq: post.seq, detail: post.actionDetail.slice(0, 60) }
-        ]
+        path: path5,
+        graph: graphFromPath(nodes, path5, "data", {
+          property_id: "no-exfil-after-credential",
+          property_short: "P5",
+          property_name: "\u8BFB\u53D6\u51ED\u636E\u540E\u7981\u6B62\u5916\u4F20"
+        }, ["source", "sink"], true, [
+          { token: "CRED", node_index: 0 },
+          { token: "EXFIL", node_index: 1 }
+        ])
       }];
     }
     return violations;
@@ -8889,14 +8928,23 @@ function checkNeverExfilAfterCred(graph) {
     if (!isCredNode(nodes[i])) continue;
     for (let j = i + 1; j < nodes.length; j++) {
       if (isExfilNode(nodes[j])) {
+        const path5 = [
+          { sessionId: nodes[i].sessionId, seq: nodes[i].seq, detail: nodes[i].actionDetail.slice(0, 60) },
+          { sessionId: nodes[j].sessionId, seq: nodes[j].seq, detail: nodes[j].actionDetail.slice(0, 60) }
+        ];
         violations.push({
           propertyId: "no-exfil-after-credential",
           reason: "\u8BFB\u53D6\u51ED\u636E\u540E\u51FA\u73B0\u5916\u4F20\uFF0C\u8FDD\u53CD \u25A1(CRED\u2192\xAC\u25C7EXFIL)",
           riskLevel: "critical",
-          path: [
-            { sessionId: nodes[i].sessionId, seq: nodes[i].seq, detail: nodes[i].actionDetail.slice(0, 60) },
-            { sessionId: nodes[j].sessionId, seq: nodes[j].seq, detail: nodes[j].actionDetail.slice(0, 60) }
-          ]
+          path: path5,
+          graph: graphFromPath(nodes, path5, "data", {
+            property_id: "no-exfil-after-credential",
+            property_short: "P5",
+            property_name: "\u8BFB\u53D6\u51ED\u636E\u540E\u7981\u6B62\u5916\u4F20"
+          }, ["source", "sink"], true, [
+            { token: "CRED", node_index: 0 },
+            { token: "EXFIL", node_index: 1 }
+          ])
         });
         return violations;
       }
@@ -9053,11 +9101,19 @@ function checkSensitiveDataAggregation(graph) {
     if (!isExfilNode(n)) continue;
     const srcs = sourcesFor(i);
     if (srcs.size >= 2) {
+      const path5 = [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }];
       violations.push({
         propertyId: "sensitive-data-aggregation",
         reason: `\u654F\u611F\u6570\u636E\u805A\u5408\u5916\u4F20\uFF1Aegress \u805A\u5408 ${srcs.size} \u4E2A\u4E8B\u4EF6\u6E90\u6570\u636E\uFF08Rule 12\uFF09`,
         riskLevel: "critical",
-        path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
+        path: path5,
+        graph: graphFromPath(nodes, path5, "next", {
+          property_id: "sensitive-data-aggregation",
+          property_short: "P8",
+          property_name: "\u654F\u611F\u6570\u636E\u805A\u5408\u5916\u4F20"
+        }, ["sink"], true, [
+          { token: "EXFIL", node_index: 0 }
+        ])
       });
       if (witness !== void 0) return violations;
     }
@@ -9434,12 +9490,21 @@ async function runAnalysis(input) {
         formalSessions.push({
           sessionId: s.sessionId || "s",
           ...s.agentId ? { agentId: s.agentId } : {},
+          ...s.instanceId ? { instanceId: s.instanceId } : {},
           actionHistory: s.actionHistory || []
         });
       }
     }
-    formalSessions.push({ sessionId: "current", agentId: input.agentId, actionHistory: input.actionHistory });
-    const formalResult = formalEngine.verify(formalSessions, input.aNext);
+    formalSessions.push({
+      sessionId: "current",
+      agentId: input.agentId,
+      instanceId: input.instanceId || "",
+      actionHistory: input.actionHistory
+    });
+    const formalResult = formalEngine.verify(formalSessions, {
+      ...input.aNext,
+      instanceId: input.instanceId || ""
+    });
     if (!formalResult.verified) {
       const v = formalResult.violations[0];
       if (isFormalObserveMode()) {

package/dist/server.js

@@ -1092,31 +1092,42 @@ function hardenExistingPaths() {
 function chainDetailMode() {
   return (env("AGENT_MOSS_CHAIN_DETAIL", "redacted") || "redacted").toLowerCase();
 }
-function redactChain(chain, currentSessionId) {
+function redactChain(chain, currentInstanceId = "", currentSessionId = "") {
   if (!chain || chain.length === 0) return [];
   if (chainDetailMode() === "full") return [...chain];
   return chain.map((step) => {
     if (Array.isArray(step) && step.length >= 3) {
       const [sid, seq, , ts] = step;
-      if (String(sid) === String(currentSessionId)) return [...step];
+      const inst = step.length > 5 ? String(step[5] ?? "") : "";
+      const sameInstance = !!(inst && currentInstanceId && inst === String(currentInstanceId));
+      const sameSessionFallback = !inst && !!currentSessionId && String(sid) === String(currentSessionId);
+      if (sameInstance || sameSessionFallback) return [...step];
       return ["<other-session>", seq, "<\u5DF2\u9690\u85CF>", ts ?? ""];
     }
     return step;
   });
 }
-function redactGraph(graph, currentSessionId) {
+function redactGraph(graph, currentInstanceId = "", currentSessionId = "") {
   if (!graph) return null;
   if (chainDetailMode() === "full") return graph;
   const nodes = (graph.nodes || []).map((n) => {
     const m = { ...n };
-    if (String(m.session_id ?? "") !== String(currentSessionId)) {
+    const inst = String(m.instance_id ?? "") || "";
+    const sid = String(m.session_id ?? "") || "";
+    const sameInstance = !!(inst && currentInstanceId && inst === String(currentInstanceId));
+    const sameSessionFallback = !inst && !!currentSessionId && sid === String(currentSessionId);
+    if (!(sameInstance || sameSessionFallback)) {
       m.session_id = "<other-session>";
       m.action_detail = "<\u5DF2\u9690\u85CF>";
       m.resources = [];
     }
     return m;
   });
-  return { nodes, edges: graph.edges || [] };
+  const out = { nodes, edges: graph.edges || [] };
+  for (const key of ["property_id", "property_short", "property_name", "property_expression"]) {
+    if (graph[key] !== void 0) out[key] = graph[key];
+  }
+  return out;
 }
 function sessionSweepThreshold() {
   return envInt("AGENT_MOSS_SESSION_SWEEP_THRESHOLD", 50);
@@ -8884,7 +8895,7 @@ function markIntegrity(actionDetail) {
   }
   return { integrity: "medium", isLowSource: false };
 }
-function initNode(sessionId, seq, actionType, actionDetail, timestamp, agentId = "") {
+function initNode(sessionId, seq, actionType, actionDetail, timestamp, agentId = "", instanceId = "") {
   const { integrity, isLowSource } = markIntegrity(actionDetail);
   return {
     sessionId,
@@ -8893,13 +8904,14 @@ function initNode(sessionId, seq, actionType, actionDetail, timestamp, agentId =
     actionDetail,
     stage: markStage(actionDetail),
     agentId: agentId || void 0,
+    instanceId: instanceId || void 0,
     resources: extractResources(actionDetail),
     integrity,
     isLowSource,
     timestamp: timestamp || void 0
   };
 }
-function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId = "") {
+function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId = "", instanceId = "") {
   const nodes = [];
   const edges = [];
   const stageFlags = /* @__PURE__ */ new Set();
@@ -8910,7 +8922,8 @@ function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId
       actionType: String(a.actionType || ""),
       actionDetail: ad,
       calledAt: a.calledAt || void 0,
-      agentId: a.agentId || agentId || void 0
+      agentId: a.agentId || agentId || void 0,
+      instanceId: a.instanceId || instanceId || void 0
     });
   }
   if (aNext) {
@@ -8918,11 +8931,12 @@ function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId
       actionType: String(aNext.actionType || ""),
       actionDetail: String(aNext.actionDetail || ""),
       calledAt: aNext.calledAt || void 0,
-      agentId: aNext.agentId || agentId || void 0
+      agentId: aNext.agentId || agentId || void 0,
+      instanceId: aNext.instanceId || instanceId || void 0
     });
   }
   details.forEach((d, seq) => {
-    const node = initNode(sessionId, seq, d.actionType, d.actionDetail, d.calledAt, d.agentId || "");
+    const node = initNode(sessionId, seq, d.actionType, d.actionDetail, d.calledAt, d.agentId || "", d.instanceId || "");
     nodes.push(node);
     if (node.stage) stageFlags.add(node.stage);
   });
@@ -8934,12 +8948,18 @@ function buildSessionGraph(actionHistory, aNext, sessionId = "current", agentId
 function buildMultiSessionGraph(sessions, aNext) {
   const mg = { sessions: [], crossEdges: [] };
   if (!sessions || sessions.length === 0) {
-    mg.sessions.push(buildSessionGraph([], aNext, "current"));
+    mg.sessions.push(buildSessionGraph([], aNext, "current", "", aNext?.instanceId || ""));
     return mg;
   }
   for (const s of sessions) {
     const sid = String(s.sessionId || "s");
-    mg.sessions.push(buildSessionGraph(s.actionHistory || [], void 0, sid, s.agentId || ""));
+    mg.sessions.push(buildSessionGraph(
+      s.actionHistory || [],
+      void 0,
+      sid,
+      s.agentId || "",
+      s.instanceId || ""
+    ));
   }
   if (aNext) {
     const last = mg.sessions[mg.sessions.length - 1];
@@ -8950,13 +8970,14 @@ function buildMultiSessionGraph(sessions, aNext) {
         String(aNext.actionType || ""),
         String(aNext.actionDetail || ""),
         aNext.calledAt || void 0,
-        aNext.agentId || ""
+        aNext.agentId || "",
+        aNext.instanceId || ""
       ));
       if (last.nodes.length > 1) {
         last.edges.push({ src: last.nodes.length - 2, dst: last.nodes.length - 1, kind: "next" });
       }
     } else {
-      mg.sessions.push(buildSessionGraph([], aNext, "current"));
+      mg.sessions.push(buildSessionGraph([], aNext, "current", "", aNext.instanceId || ""));
     }
   }
   addCrossDataEdges(mg);
@@ -9020,7 +9041,8 @@ function graphFromPath(nodes, path6, edgeType = "next", propertyMeta, roles, wit
       seq: item.seq,
       stage: n ? n.stage : "",
       action_detail: n ? n.actionDetail : item.detail,
-      resources: n ? [...n.resources].sort() : []
+      resources: n ? [...n.resources].sort() : [],
+      instance_id: n ? n.instanceId || "" : ""
     });
     if (gNodes.length > 1) {
       gEdges.push({ from: gNodes.length - 2, to: gNodes.length - 1, type: edgeType });
@@ -9188,7 +9210,8 @@ function checkSensitiveDataFlow(graph) {
         stage: n.stage,
         action_detail: n.actionDetail,
         resources: [...n.resources].sort(),
-        role
+        role,
+        instance_id: n.instanceId || ""
       });
       if (k > 0) {
         const prev = chain[k - 1];
@@ -9338,14 +9361,23 @@ function checkNeverExfilAfterPrivesc(graph) {
     if (candidates.length > 0) {
       const pre = nodes[candidates[candidates.length - 1]];
       const post = nodes[firstEv];
+      const path6 = [
+        { sessionId: pre.sessionId, seq: pre.seq, detail: pre.actionDetail.slice(0, 60) },
+        { sessionId: post.sessionId, seq: post.seq, detail: post.actionDetail.slice(0, 60) }
+      ];
       return [{
         propertyId: "no-exfil-after-privesc",
         reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\u25C7EXFIL) \u7A97\u53E3\u7EA6\u675F",
         riskLevel: "critical",
-        path: [
-          { sessionId: pre.sessionId, seq: pre.seq, detail: pre.actionDetail.slice(0, 60) },
-          { sessionId: post.sessionId, seq: post.seq, detail: post.actionDetail.slice(0, 60) }
-        ]
+        path: path6,
+        graph: graphFromPath(nodes, path6, "next", {
+          property_id: "no-exfil-after-privesc",
+          property_short: "P4",
+          property_name: "\u63D0\u6743\u540E\u7981\u6B62\u5916\u4F20"
+        }, ["privesc", "sink"], true, [
+          { token: "PRIVESC", node_index: 0 },
+          { token: "EXFIL", node_index: 1 }
+        ])
       }];
     }
     return violations;
@@ -9355,14 +9387,23 @@ function checkNeverExfilAfterPrivesc(graph) {
     for (let j = i + 1; j < nodes.length; j++) {
       if (!isExfilNode(nodes[j])) continue;
       if (privescInWindow(nodes, [i], j, windowSec).length === 0) continue;
+      const path6 = [
+        { sessionId: nodes[i].sessionId, seq: nodes[i].seq, detail: nodes[i].actionDetail.slice(0, 60) },
+        { sessionId: nodes[j].sessionId, seq: nodes[j].seq, detail: nodes[j].actionDetail.slice(0, 60) }
+      ];
       violations.push({
         propertyId: "no-exfil-after-privesc",
         reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\u25C7EXFIL) \u7A97\u53E3\u7EA6\u675F",
         riskLevel: "critical",
-        path: [
-          { sessionId: nodes[i].sessionId, seq: nodes[i].seq, detail: nodes[i].actionDetail.slice(0, 60) },
-          { sessionId: nodes[j].sessionId, seq: nodes[j].seq, detail: nodes[j].actionDetail.slice(0, 60) }
-        ]
+        path: path6,
+        graph: graphFromPath(nodes, path6, "next", {
+          property_id: "no-exfil-after-privesc",
+          property_short: "P4",
+          property_name: "\u63D0\u6743\u540E\u7981\u6B62\u5916\u4F20"
+        }, ["privesc", "sink"], true, [
+          { token: "PRIVESC", node_index: 0 },
+          { token: "EXFIL", node_index: 1 }
+        ])
       });
       return violations;
     }
@@ -9387,14 +9428,23 @@ function checkNeverExfilAfterCred(graph) {
     }
     if (pre) {
       const post = nodes[firstEv];
+      const path6 = [
+        { sessionId: pre.sessionId, seq: pre.seq, detail: pre.actionDetail.slice(0, 60) },
+        { sessionId: post.sessionId, seq: post.seq, detail: post.actionDetail.slice(0, 60) }
+      ];
       return [{
         propertyId: "no-exfil-after-credential",
         reason: "\u8BFB\u53D6\u51ED\u636E\u540E\u51FA\u73B0\u5916\u4F20\uFF0C\u8FDD\u53CD \u25A1(CRED\u2192\xAC\u25C7EXFIL)",
         riskLevel: "critical",
-        path: [
-          { sessionId: pre.sessionId, seq: pre.seq, detail: pre.actionDetail.slice(0, 60) },
-          { sessionId: post.sessionId, seq: post.seq, detail: post.actionDetail.slice(0, 60) }
-        ]
+        path: path6,
+        graph: graphFromPath(nodes, path6, "data", {
+          property_id: "no-exfil-after-credential",
+          property_short: "P5",
+          property_name: "\u8BFB\u53D6\u51ED\u636E\u540E\u7981\u6B62\u5916\u4F20"
+        }, ["source", "sink"], true, [
+          { token: "CRED", node_index: 0 },
+          { token: "EXFIL", node_index: 1 }
+        ])
       }];
     }
     return violations;
@@ -9403,14 +9453,23 @@ function checkNeverExfilAfterCred(graph) {
     if (!isCredNode(nodes[i])) continue;
     for (let j = i + 1; j < nodes.length; j++) {
       if (isExfilNode(nodes[j])) {
+        const path6 = [
+          { sessionId: nodes[i].sessionId, seq: nodes[i].seq, detail: nodes[i].actionDetail.slice(0, 60) },
+          { sessionId: nodes[j].sessionId, seq: nodes[j].seq, detail: nodes[j].actionDetail.slice(0, 60) }
+        ];
         violations.push({
           propertyId: "no-exfil-after-credential",
           reason: "\u8BFB\u53D6\u51ED\u636E\u540E\u51FA\u73B0\u5916\u4F20\uFF0C\u8FDD\u53CD \u25A1(CRED\u2192\xAC\u25C7EXFIL)",
           riskLevel: "critical",
-          path: [
-            { sessionId: nodes[i].sessionId, seq: nodes[i].seq, detail: nodes[i].actionDetail.slice(0, 60) },
-            { sessionId: nodes[j].sessionId, seq: nodes[j].seq, detail: nodes[j].actionDetail.slice(0, 60) }
-          ]
+          path: path6,
+          graph: graphFromPath(nodes, path6, "data", {
+            property_id: "no-exfil-after-credential",
+            property_short: "P5",
+            property_name: "\u8BFB\u53D6\u51ED\u636E\u540E\u7981\u6B62\u5916\u4F20"
+          }, ["source", "sink"], true, [
+            { token: "CRED", node_index: 0 },
+            { token: "EXFIL", node_index: 1 }
+          ])
         });
         return violations;
       }
@@ -9562,11 +9621,19 @@ function checkSensitiveDataAggregation(graph) {
     if (!isExfilNode(n)) continue;
     const srcs = sourcesFor(i);
     if (srcs.size >= 2) {
+      const path6 = [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }];
       violations.push({
         propertyId: "sensitive-data-aggregation",
         reason: `\u654F\u611F\u6570\u636E\u805A\u5408\u5916\u4F20\uFF1Aegress \u805A\u5408 ${srcs.size} \u4E2A\u4E8B\u4EF6\u6E90\u6570\u636E\uFF08Rule 12\uFF09`,
         riskLevel: "critical",
-        path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
+        path: path6,
+        graph: graphFromPath(nodes, path6, "next", {
+          property_id: "sensitive-data-aggregation",
+          property_short: "P8",
+          property_name: "\u654F\u611F\u6570\u636E\u805A\u5408\u5916\u4F20"
+        }, ["sink"], true, [
+          { token: "EXFIL", node_index: 0 }
+        ])
       });
       if (witness !== void 0) return violations;
     }
@@ -9831,7 +9898,7 @@ var init_stateful = __esm({
         for (const s of sessions || []) {
           const sid = String(s.sessionId || "s");
           for (const a of s.actionHistory || []) {
-            const node = this.appendNode(a, sid);
+            const node = this.appendNode(a, sid, false, s.agentId || "", s.instanceId || "");
             if (!node) {
               continue;
             }
@@ -9845,8 +9912,8 @@ var init_stateful = __esm({
       }
       /** 增量推进：把当前动作追加到时间线 → 链指针推进 → 判定。 */
       advance(args) {
-        const { aNext, sessionId = "current", isError = false, agentId = "" } = args;
-        const node = this.appendNode(aNext, sessionId, isError, agentId);
+        const { aNext, sessionId = "current", isError = false, agentId = "", instanceId = "" } = args;
+        const node = this.appendNode(aNext, sessionId, isError, agentId, instanceId);
         if (!node) {
           return { seq: this.seqNext, node: null, matched: null, pendingPrefixes: this.pendingPrefixes, exfil: [], shouldBlock: false };
         }
@@ -9866,7 +9933,7 @@ var init_stateful = __esm({
           }
         };
       }
-      appendNode(action, sessionId, isError = false, agentId = "") {
+      appendNode(action, sessionId, isError = false, agentId = "", instanceId = "") {
         const ad = String(action.actionDetail || "");
         const at = String(action.actionType || "");
         if (!ad) return null;
@@ -9884,6 +9951,7 @@ var init_stateful = __esm({
           instances: extractInstances(ad, stage),
           isError,
           agentId: String(action.agentId || agentId || ""),
+          instanceId: String(action.instanceId || instanceId || ""),
           lifecycle: lifecycleFor(ad, stage, isError),
           timestamp: typeof action.calledAt === "string" ? action.calledAt : _StatefulChainTracker.now()
         };
@@ -10027,7 +10095,8 @@ var init_stateful = __esm({
               seq: n.seq,
               stage: n.stage,
               timestamp: n.timestamp,
-              agentId: n.agentId
+              agentId: n.agentId,
+              instanceId: n.instanceId
             });
             const idx = stages.indexOf(n.stage);
             if (idx + 1 < stages.length) {
@@ -10050,7 +10119,8 @@ var init_stateful = __esm({
             stage: p.stage,
             action_detail: n ? n.actionDetail : "",
             resources: n ? [...n.resources].sort() : [],
-            role: stages[i] || ""
+            role: stages[i] || "",
+            instance_id: p.instanceId || ""
           };
         });
         const gEdges = [];
@@ -10118,7 +10188,7 @@ var init_stateful = __esm({
             risk_level: "critical",
             path: chain.map((j) => {
               const n = this.nodes_[j];
-              return [n.sessionId, n.seq, n.actionDetail.slice(0, 60), n.timestamp];
+              return [n.sessionId, n.seq, n.actionDetail.slice(0, 60), n.timestamp, null, n.instanceId];
             }),
             graph: this.taintGraph(chain)
           }];
@@ -10150,7 +10220,8 @@ var init_stateful = __esm({
             stage: n.stage,
             action_detail: n.actionDetail,
             resources: [...n.resources].sort(),
-            role
+            role,
+            instance_id: n.instanceId
           });
           if (k > 0) {
             const prev = chain[k - 1];
@@ -10222,6 +10293,8 @@ var init_stateful = __esm({
             seq: Number(raw.seq || 0),
             sessionId: String(raw.sessionId || ""),
             agentId: String(raw.agentId || ""),
+            instanceId: String(raw.instanceId || ""),
+            // 旧快照无此字段 → 空
             actionType: String(raw.actionType || ""),
             actionDetail: String(raw.actionDetail || ""),
             stage: String(raw.stage || ""),
@@ -10366,9 +10439,9 @@ var init_chain_state = __esm({
         delete this.data[agentId];
         this._scheduleWrite();
       }
-      applyAction(agentId, aNext, sessionId, isError = false, sourceAgent = "") {
+      applyAction(agentId, aNext, sessionId, isError = false, sourceAgent = "", instanceId = "") {
         const t = this.load(agentId) || new StatefulChainTracker(agentId);
-        const r = t.advance({ aNext, sessionId, isError, agentId: sourceAgent });
+        const r = t.advance({ aNext, sessionId, isError, agentId: sourceAgent, instanceId });
         this.save(t);
         return r;
       }
@@ -10686,12 +10759,21 @@ async function runAnalysis(input) {
         formalSessions.push({
           sessionId: s.sessionId || "s",
           ...s.agentId ? { agentId: s.agentId } : {},
+          ...s.instanceId ? { instanceId: s.instanceId } : {},
           actionHistory: s.actionHistory || []
         });
       }
     }
-    formalSessions.push({ sessionId: "current", agentId: input.agentId, actionHistory: input.actionHistory });
-    const formalResult = formalEngine.verify(formalSessions, input.aNext);
+    formalSessions.push({
+      sessionId: "current",
+      agentId: input.agentId,
+      instanceId: input.instanceId || "",
+      actionHistory: input.actionHistory
+    });
+    const formalResult = formalEngine.verify(formalSessions, {
+      ...input.aNext,
+      instanceId: input.instanceId || ""
+    });
     if (!formalResult.verified) {
       const v = formalResult.violations[0];
       if (isFormalObserveMode()) {
@@ -11062,6 +11144,8 @@ var AnalyzeRequestSchema = z.object({
     session_id: z.string(),
     /** 来源 agent（AgentGate 逐会话带上）：记录在链路径里供告警/取证，不参与链匹配。 */
     agent_id: z.string().optional(),
+    /** 来源实例：仅用于展示层脱敏（同实例不隐藏），不参与链匹配。 */
+    instance_id: z.string().optional(),
     action_history: z.array(ActionItemSchema).default([])
   })).default([]).describe("Multi-session historical actions (optional): for L2.2 formal engine cross-session combo-chain / sensitive-data-flow verification. Provided by caller (incl. future agentgate)."),
   a_next: ActionItemSchema.describe("Next action to be executed"),
@@ -11069,6 +11153,7 @@ var AnalyzeRequestSchema = z.object({
   os_type: z.string().default("").describe("OS type: 'linux', 'windows', or empty for auto-detect"),
   cwd: z.string().default("").describe("Current working directory"),
   agent_id: z.string().default("").describe("Caller agent identifier, e.g. 'xiaoo' / 'opencode' / 'opendesk'. Empty = generic mode (no agent-specific rules)."),
+  instance_id: z.string().default("").describe("Agent installation/instance identifier. Used only for display-layer redaction: nodes from the same instance are returned unredacted. Does not affect detection."),
   metadata: z.record(z.unknown()).optional().describe("Extended metadata")
 });
 var AnalyzeResponseSchema = z.object({
@@ -11106,7 +11191,9 @@ var AnalyzeResponseSchema = z.object({
         // 节点在性质中的角色：source/carrier/sink（P2）或阶段名（P1）
         role: z.string().optional(),
         // 是否为违例见证节点（当前动作补全链 / 触发外传）
-        witness: z.boolean().optional()
+        witness: z.boolean().optional(),
+        // 来源实例（仅展示层脱敏：同实例不隐藏）
+        instance_id: z.string().optional()
       })
     ),
     edges: z.array(
@@ -11998,6 +12085,9 @@ async function analyzeRoute(c) {
         `[AgentMoss] \u26A0\uFE0F \u8DE8\u4F1A\u8BDD\u6279\u91CF\u8BBF\u95EE: key=${_sweepKey} \u7A97\u53E3\u5185 ${_sweepN} \u4E2A\u4E0D\u540C session\uFF08\u9608\u503C ${sessionSweepThreshold()}\uFF09`
       );
     }
+    const instanceId = String(
+      req.instance_id || req.metadata?.instance_id || ""
+    );
     const result = await analyze({
       sessionId: req.session_id,
       promptSession: req.prompt_session,
@@ -12013,8 +12103,9 @@ async function analyzeRoute(c) {
       })),
       sessionHistory: (req.session_history || []).map((s) => ({
         sessionId: s.session_id,
-        // 来源 agent（AgentGate 逐会话带上，用于链路径取证展示；不参与链匹配）
+        // 来源 agent/实例（AgentGate 逐会话带上，用于链路径取证/展示脱敏；不参与链匹配）
         ...s.agent_id ? { agentId: s.agent_id } : {},
+        ...s.instance_id ? { instanceId: s.instance_id } : {},
         actionHistory: (s.action_history || []).map((h) => ({
           actionType: h.action_type,
           actionDetail: h.action_detail,
@@ -12038,11 +12129,13 @@ async function analyzeRoute(c) {
       })),
       aNext: {
         actionType: req.a_next.action_type,
-        actionDetail: req.a_next.action_detail
+        actionDetail: req.a_next.action_detail,
+        instanceId
       },
       reason: req.reason,
       osType,
       cwd: req.cwd,
+      instanceId,
       // agent_id：AgentGate V1 normalizer 历史上把 agent_type 塞 metadata，
       // 顶层为空时兜底（OpenDesk 的 agent-moss 需 agent_id 加载专属规则）。
       agentId,
@@ -12078,8 +12171,9 @@ async function analyzeRoute(c) {
           { actionType: req.a_next.action_type, actionDetail: req.a_next.action_detail },
           req.session_id,
           Boolean(meta.is_error),
-          agentId
+          agentId,
           // 来源：真实 agent（桶 key 可能是 __system__）
+          instanceId
         );
         const judgment = incMatchedToDeny(inc);
         if (judgment) {
@@ -12100,8 +12194,8 @@ async function analyzeRoute(c) {
               confidence: 90,
               analysis_duration_ms: Math.round((performance.now() - t0) * 10) / 10,
               // 跨会话节点脱敏（时间线按 agent_id 共享，原样返回等于泄露别人的命令原文）
-              violation_chain: redactChain(judgment.violation_chain, req.session_id),
-              violation_graph: redactGraph(judgment.violation_graph, req.session_id)
+              violation_chain: redactChain(judgment.violation_chain, instanceId, req.session_id),
+              violation_graph: redactGraph(judgment.violation_graph, instanceId, req.session_id)
             })
           );
         }
@@ -12123,7 +12217,7 @@ async function analyzeRoute(c) {
         confidence: result.confidence,
         analysis_duration_ms: Math.round(durationMs * 10) / 10,
         violation_chain: result.violation_chain ?? [],
-        violation_graph: redactGraph(result.violation_graph, req.session_id)
+        violation_graph: redactGraph(result.violation_graph, instanceId, req.session_id)
       })
     );
   } catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kenhkl/agent-moss",
-  "version": "0.17.8",
+  "version": "0.17.11",
   "description": "Multi-layer security analysis engine for AI agents (TypeScript)",
   "type": "module",
   "main": "dist/server.js",