feat: 支持漏洞关联多条流量证据

agent/finding_recorder.go

@@ -0,0 +1,22 @@
+package agent
+
+import (
+	"context"
+
+	"github.com/Autumn-27/artex/db"
+)
+
+// FindingRecorder is injected by the host; agents never synthesize or copy
+// evidence bodies themselves. Its implementation owns the atomic write.
+type FindingRecorder interface {
+	Record(context.Context, db.RecordFindingInput, []db.TrafficRef) (*db.RecordedFinding, error)
+}
+
+// Tool-use guidance is appended without replacing the user's editable prompt.
+// It does not require capture or claim that unavailable traffic tools exist.
+const findingTrafficGuidance = "\n\n**漏洞流量证据（可选）**：调用 report_finding 上报漏洞时，如有已查看并确认支持漏洞结论的 HTTP 请求/响应，可用 traffic_refs 按复现顺序绑定真实 ID；域名和时间只作候选筛选，不推定关联。TCP 等非 HTTP 漏洞、未采集或无确切匹配时省略或传 []，在 evidence 保留命令输出、日志等其他可验证证据，建议说明未绑定原因。不要猜测 ID，也不要仅为补包重复探测。"
+
+func (t *ToolSet) SetFindingRecorder(r FindingRecorder)   { t.findingRecorder = r }
+func (w *Worker) SetFindingRecorder(r FindingRecorder)    { w.findingRecorder = r }
+func (p *Planner) SetFindingRecorder(r FindingRecorder)   { p.findingRecorder = r }
+func (m *MainAgent) SetFindingRecorder(r FindingRecorder) { m.findingRecorder = r }

agent/finding_recorder_test.go

@@ -0,0 +1,105 @@
+package agent
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/Autumn-27/artex/db"
+	"github.com/Autumn-27/artex/evidence"
+)
+
+type failingFindingRecorder struct{}
+
+func (failingFindingRecorder) Record(context.Context, db.RecordFindingInput, []db.TrafficRef) (*db.RecordedFinding, error) {
+	return nil, errors.New("fixture persistence failed")
+}
+
+func TestReportFindingOptionalTrafficWithoutCapture(t *testing.T) {
+	d := testDB(t)
+	defer d.Close()
+	task, err := d.CreateTask("TCP evidence", "fixture", nil, 0, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer d.DeleteTask(task.ID)
+	ts := NewToolSet(nil, "")
+	ts.ts, ts.taskID = d.Exploration(task.ExplorationID), task.ID
+	ts.SetFindingRecorder(evidence.New(d, nil, t.TempDir()))
+	notices := 0
+	ts.notifyFinding = func(int64, string) { notices++ }
+	for _, refs := range []string{"", `,"traffic_refs":[]`, `,"traffic_refs":null`} {
+		res, err := ts.addFinding().Call(t.Context(), json.RawMessage(`{"vulnclass":"TCP","severity":"low","summary":"verified TCP fixture","evidence":"command output proves the finding"`+refs+`}`), nil)
+		if err != nil || !strings.HasPrefix(res.Flatten(), "finding recorded: ") {
+			t.Fatalf("optional traffic rejected: %v %s", err, res.Flatten())
+		}
+		var out db.RecordedFinding
+		if err := json.Unmarshal([]byte(strings.SplitN(res.Flatten(), "\n", 2)[1]), &out); err != nil {
+			t.Fatal(err)
+		}
+		f, err := d.GetFinding(out.FindingID)
+		if err != nil || f == nil || len(out.Traffic.Bindings) != 0 || f.Evidence != "command output proves the finding" {
+			t.Fatalf("lost non-HTTP evidence: %+v %v", f, err)
+		}
+	}
+	if notices != 3 {
+		t.Fatalf("successful reports notified %d times", notices)
+	}
+}
+
+func TestReportFindingAtomicContract(t *testing.T) {
+	d := testDB(t)
+	defer d.Close()
+	task, err := d.CreateTask("report contract", "fixture", nil, 0, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer d.DeleteTask(task.ID)
+	ts := NewToolSet(nil, "")
+	ts.ts = d.Exploration(task.ExplorationID)
+	ts.taskID = task.ID
+	ts.worker = "fixture"
+	notices := 0
+	ts.notifyFinding = func(int64, string) { notices++ }
+	call := func(body string) string {
+		t.Helper()
+		res, err := ts.addFinding().Call(t.Context(), json.RawMessage(body), nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return res.Flatten()
+	}
+	ts.SetFindingRecorder(failingFindingRecorder{})
+	if got := call(`{"vulnclass":"TEST","summary":"fail","severity":"low","traffic_refs":[{"traffic_id":"x"}]}`); !strings.Contains(got, "persistence failed") {
+		t.Fatal(got)
+	}
+	if notices != 0 || ts.writes.Findings != 0 {
+		t.Fatal("notified before commit")
+	}
+	ts.SetFindingRecorder(nil)
+	got := call(`{"vulnclass":"TEST","summary":"legacy report","severity":"low"}`)
+	lines := strings.SplitN(got, "\n", 2)
+	if len(lines) != 2 {
+		t.Fatal(got)
+	}
+	var out db.RecordedFinding
+	if err = json.Unmarshal([]byte(lines[1]), &out); err != nil {
+		t.Fatal(err)
+	}
+	if lines[0] != fmt.Sprintf("finding recorded: %d", out.NodeID) || out.FindingID <= 0 || notices != 1 {
+		t.Fatal(got)
+	}
+	f, err := d.GetFinding(out.FindingID)
+	if err != nil || f == nil || f.NodeID == nil || *f.NodeID != out.NodeID {
+		t.Fatalf("wrong finding/node mapping: %+v %v", f, err)
+	}
+	if got = call(`{"vulnclass":"TEST","summary":"no storage","severity":"low","traffic_refs":[{"traffic_id":"x"}]}`); !strings.Contains(got, "未登记") {
+		t.Fatal(got)
+	}
+	if notices != 1 {
+		t.Fatal("failed tool triggered reporter")
+	}
+}

agent/mainagent.go

@@ -17,19 +17,20 @@ import (
 // (→planner) or direct high-priority intents (→frontier). It does NOT run the
 // autonomous intent-generation loop (that is the planner's job).
 type MainAgent struct {
-	prov           llm.Provider
-	model          string
-	tx             *transcript.Store                      // raw LLM conversation persistence (nil = off)
-	window         int                                    // context window in tokens (for compaction)
-	windowFn       func() int                             // optional dynamic task-chain minimum
-	maxTurns       int                                    // max agent turns per run (0 = unlimited)
-	proxyAddr      string                                 // recording proxy for WebFetch (empty = direct)
-	proxyCACert    string                                 // recording proxy's CA cert path (HTTPS verify)
-	webSearch      WebSearchOpts                          // web_search tool backend selection (off by default)
-	workDir        string                                 // shared work dir (surfaced in prompt as artifact-output target)
-	steerWork      func(intentID int64, msg string) error // engine callback: steer a running work (nil = off)
-	nonStreamingFn func() bool                            // resolver: use non-streaming (Complete) path? (nil = streaming)
-	maxTokensFn    func() int                             // resolver: per-reply output cap (nil/0 = send no cap)
+	findingRecorder FindingRecorder
+	prov            llm.Provider
+	model           string
+	tx              *transcript.Store                      // raw LLM conversation persistence (nil = off)
+	window          int                                    // context window in tokens (for compaction)
+	windowFn        func() int                             // optional dynamic task-chain minimum
+	maxTurns        int                                    // max agent turns per run (0 = unlimited)
+	proxyAddr       string                                 // recording proxy for WebFetch (empty = direct)
+	proxyCACert     string                                 // recording proxy's CA cert path (HTTPS verify)
+	webSearch       WebSearchOpts                          // web_search tool backend selection (off by default)
+	workDir         string                                 // shared work dir (surfaced in prompt as artifact-output target)
+	steerWork       func(intentID int64, msg string) error // engine callback: steer a running work (nil = off)
+	nonStreamingFn  func() bool                            // resolver: use non-streaming (Complete) path? (nil = streaming)
+	maxTokensFn     func() int                             // resolver: per-reply output cap (nil/0 = send no cap)
 }
 
 // SetNonStreaming wires a resolver deciding whether runs use the non-streaming
@@ -103,6 +104,7 @@ func mainAgentSystem(goal, dataDir, workDir string) string {
 // worker/planner sessions — not just the final answer.
 func (m *MainAgent) Chat(ctx context.Context, taskID int64, as *db.AssetStore, ts *db.ExplorationStore, goal, message string, emit func(db.Activity), notify, resume func(), notifyGoal func([]string)) (string, error) {
 	tsx := NewToolSet(ts, "human")
+	tsx.SetFindingRecorder(m.findingRecorder)
 	if as != nil {
 		tsx.SetAssetStore(as, as.Companies())
 	}
@@ -149,7 +151,7 @@ func (m *MainAgent) Chat(ctx context.Context, taskID int64, as *db.AssetStore, t
 		// 命中预算(步数)→ SDK 跑收尾:向用户输出一句进展总结。Prompt 与收尾轮数可后台编辑(默认 10 轮)。
 		Settlement:   wrapupSettlement("mainagent", nil),
 		NonStreaming: m.nonStreaming(), // 该 profile 选非流式时走 Provider.Complete
-		MaxTokens:    m.maxTokens(),   // 0 = 不发上限,由服务端默认值决定
+		MaxTokens:    m.maxTokens(),    // 0 = 不发上限,由服务端默认值决定
 	}
 	if m.tx != nil { // persist raw human↔AI conversation; one accumulating file per task
 		opts.Transcript = m.tx

agent/planner.go

@@ -20,6 +20,7 @@ import (
 // assets, judges whether the task goal is met, and emits 0..N exploration intents
 // into the frontier. It is the sole intent generator.
 type Planner struct {
+	findingRecorder   FindingRecorder
 	prov              llm.Provider
 	model             string
 	tx                *transcript.Store                      // raw LLM conversation persistence (nil = off)
@@ -338,6 +339,7 @@ func (p *Planner) Plan(ctx context.Context, taskID int64, as *db.AssetStore, ts
 	// runs in a detached goroutine so it never adds latency to this round.
 	p.compactor.OnPlannerRound(ctx, ts)
 	tsx := NewToolSet(ts, "planner")
+	tsx.SetFindingRecorder(p.findingRecorder)
 	if as != nil {
 		tsx.SetAssetStore(as, as.Companies())
 	}

agent/prompt_test.go

@@ -57,6 +57,9 @@ func TestRenderSystemOverrideAndFallback(t *testing.T) {
 	if !strings.Contains(recording, "traffic_search") {
 		t.Fatalf("worker while recording should inject trafficTool: %q", recording)
 	}
+	if !strings.Contains(recording, "traffic_refs") || !strings.Contains(recording, "TCP") {
+		t.Fatalf("custom worker prompt lost optional finding evidence guidance: %q", recording)
+	}
 	if !strings.Contains(recording, "中间产物输出规约") {
 		t.Fatalf("worker missing artifact tail: %q", recording)
 	}

agent/promptcatalog.go

@@ -52,7 +52,9 @@ const pentestDefaultTmpl = `你是一个授权渗透测试系统的"独立渗透
 - 每得出一个结果**立刻**落地，别攒到最后（会话步数耗尽就全丢；记下来的才算数，活在脑子里的不算）。这些记录也是你抗 compaction 的长期记忆。
 - **只写增量**：写之前扫一眼已登记的资产/已记的路线，只记你**新得到**的东西，别把已有内容换措辞重记（重复只会膨胀、也误导你自己以为有新进展）。只是印证已有结论而无新增，就不必再记。
 - **发现新资产/入口** → insert_assets（资产本身：endpoint/parameter/tech 指纹/service/凭据/子域等，结构化属性写在资产 props 上）。回看已登记资产用 list_assets，避免重复登记。
-- **确认漏洞** → report_finding（含可复现 PoC）。**只有你在本次运行里真实触发过、拿到可复现证据（请求/响应或命令输出）才用它**；回看已报漏洞用 list_findings。严禁把仅凭版本/CVE 匹配、"看起来可注入"、外部漏洞库/更新日志/代码 diff 推断的东西当已确认漏洞上报。**不要用查 CVE 库或"对比补丁版本"替代实际触发**；触发不了但有嫌疑，就在 TodoWrite 里标为"存疑/待验证"，别硬记成 finding。
+- **确认漏洞** → report_finding（含可复现 PoC）。**只有你在本次运行里真实触发过、拿到可复现证据（请求/响应或命令输出）才用它**；回看已报漏洞用 list_findings。有对应录制流量时，先 traffic_search / traffic_get 核对真实记录，再用 traffic_refs 按复现顺序绑定；域名和时间只用于候选筛选，不代表任务归属。严禁把仅凭版本/CVE 匹配、"看起来可注入"、外部漏洞库/更新日志/代码 diff 推断的东西当已确认漏洞上报。**不要用查 CVE 库或"对比补丁版本"替代实际触发**；触发不了但有嫌疑，就在 TodoWrite 里标为"存疑/待验证"，别硬记成 finding。
+
+流量绑定可选：TCP 等非 HTTP 漏洞、未采集或无确切匹配记录时，省略 traffic_refs 或传 []，在 evidence 保留命令输出、日志等其他可验证证据，建议说明未绑定原因。不要猜测 ID，也不要仅为补包重复探测。
 
 ━━ 判定与收尾 ━━
 - 随时对照任务目标：已被你**验证过**的成果满足了目标，就据此判定达成并说明依据。判"达成"的前提是心法 4 的自检已通过——没独立复现过的战果不算达成依据。
@@ -77,15 +79,16 @@ const ReporterDefaultPrompt = `你是一个授权渗透测试系统里的**漏
 每当有 worker 调用 report_finding 登记了一个漏洞，系统就会用一段【由工具调用触发】的上下文唤起你，其中包含：
 - **任务 id**（task_id，见上下文"任务: #<id>"）
 - report_finding 的**入参**（vulnclass / severity / summary / evidence 等）
-- report_finding 的**返回**：形如 "finding recorded: <id>" —— 这个 **<id> 就是本漏洞的 finding_id**，是你后面保存报告的句柄。
+- report_finding 的**返回**：形如 "finding recorded: <id>" —— 这个 **<id> 是探索节点 ID**，是 get_task_node_detail 和 update_finding_report 使用的旧句柄。返回 JSON 中的 finding_id 则是独立漏洞记录 ID，get_finding_traffic 使用它。
 
-先从上下文里**准确抽取 finding_id 和 task_id**。抽取不到 finding_id 就不要瞎写，说明情况即可。
+先从上下文里**准确抽取 task_id、探索节点 node_id，以及 JSON 中的独立漏洞 finding_id（如有）**，不得混用两种 ID。抽取不到 node_id 就不要瞎写，说明情况即可。
 
 ━━ 工作步骤 ━━
-1. **取全证据**：用 get_task_node_detail(task_id, id=<finding_id>) 读该漏洞节点的**完整证据/PoC**（触发上下文里的 evidence 可能被截断）。
-2. **还原过程**：用 list_task_worker_traces(task_id) 找到相关的 work，再用 get_task_worker_trace(task_id, intent_id[, step_ids]) 或 search_task_worker_traces(task_id, q) 看这个漏洞**是怎么被发现和验证的**（用了什么请求/命令、目标怎么响应）。必要时 get_task_graph(task_id) 看整体态势、list_task_findings(task_id) 看是否有关联漏洞。
-3. **写报告**：综合以上，写一份结构化 Markdown 报告（见下方模板）。
-4. **保存**：调用 **update_finding_report(finding_id=<那个 id>, report=<Markdown 全文>)** 保存。这是你的最终产物——不写进去等于没做。
+1. **取全证据**：用 get_task_node_detail(task_id, id=<node_id>) 读该漏洞节点的**完整证据/PoC**（触发上下文里的 evidence 可能被截断）。
+2. **流量证据**：如返回 JSON 包含独立 finding_id，用 get_finding_traffic 先读有序清单及 version，有绑定时再按 binding_id 分段读取请求/响应。绑定可选，空清单不阻止撰写报告：TCP 等非 HTTP 漏洞或未采集的情况，依据节点证据、命令输出和日志说明复现与影响，建议如实说明未绑定原因，不虚构请求/响应，不仅为补包重新探测。报告引用稳定证据编号及用途；仅按真实内容描述。保存报告时传入所读 version 作为 evidence_version；如版本冲突，重新读取并生成，不得直接换版本重试。
+3. **还原过程**：用 list_task_worker_traces(task_id) 找到相关的 work，再用 get_task_worker_trace(task_id, intent_id[, step_ids]) 或 search_task_worker_traces(task_id, q) 看这个漏洞**是怎么被发现和验证的**（用了什么请求/命令、目标怎么响应）。必要时 get_task_graph(task_id) 看整体态势、list_task_findings(task_id) 看是否有关联漏洞。
+4. **写报告**：综合以上，写一份结构化 Markdown 报告（见下方模板）。
+5. **保存**：调用 **update_finding_report(finding_id=<node_id>, report=<Markdown 全文>, evidence_version=<实际读取的 version>)** 保存；未读取版本时省略 evidence_version，不得猜测。这是你的最终产物——不写进去等于没做。
 
 ━━ 报告结构（Markdown，按需裁剪，但证据/复现/修复必须有）━━
 - ` + "`## 概述`" + `：一句话说清是什么漏洞、在哪、能造成什么。

agent/tools.go

@@ -73,11 +73,12 @@ func compactIntents(ns []*db.Node, parentsOf, yieldsOf map[int64][]int64) []map[
 // ToolSet exposes the PG-backed dual graph (asset + exploration) to an LLM agent.
 // One ToolSet is created per planner/worker run; per-run signals live here.
 type ToolSet struct {
-	as     *db.AssetStore   // asset store (optional; nil = asset tools not available)
-	cs     *db.CompanyStore // company store (optional)
-	ts     *db.ExplorationStore
-	worker string
-	taskID int64 // PG tasks.id; 0 when unknown (tests / orchestrator cross-task reads)
+	findingRecorder FindingRecorder
+	as              *db.AssetStore   // asset store (optional; nil = asset tools not available)
+	cs              *db.CompanyStore // company store (optional)
+	ts              *db.ExplorationStore
+	worker          string
+	taskID          int64 // PG tasks.id; 0 when unknown (tests / orchestrator cross-task reads)
 	// coverageDisabled mirrors tasks.coverage_enabled=false. Stored inverted so the
 	// zero value (all existing ToolSet constructions) means ENABLED — matching the
 	// DB default (true). When true: graphOverviewData drops the coverage block, the
@@ -1358,67 +1359,59 @@ func (t *ToolSet) goalMet() actool.CoreTool {
 // --- worker write tools ---
 
 func (t *ToolSet) addFinding() actool.CoreTool {
-	return writeTool("report_finding", "[重要]发现漏洞时必须调用该工具进行记录!记录一个确认的漏洞发现。在任务上下文中 intent_id 必填（当前正在执行的意图 id）；在会话上下文中 intent_id 可不填。",
-		obj(map[string]any{
-			"vulnclass": str("漏洞类（分类，如 SQL Injection / IDOR / XSS）"),
-			"name":      str("漏洞名称（具体可读的标题，如『用户中心订单接口存在越权访问』；建议填写，留空时前端回退展示 vulnclass）"),
-			"severity":  str("critical|high|medium|low（严重/高/中/低）"),
-			"summary":   str("发现摘要"),
-			"intent_id": idp("产生本发现的意图 id（任务上下文必填；会话上下文可不填）"),
-			"asset_ids": map[string]any{"type": "array", "items": map[string]any{"type": "integer"}, "description": "【存在时尽量填写，否则在摘要中必须要写清楚漏洞位置】受影响资产 id（可选，0/1/多个）：参数/端点/站点等。一个漏洞影响多处可全填，纯观察可不填。"},
-			"evidence":  str("证据/PoC 文本"),
-		}, "vulnclass", "severity", "summary"),
-		func(_ context.Context, in json.RawMessage) (actool.Result, error) {
-			var a struct {
-				VulnClass, Name, Severity, Summary, Evidence string
-				IntentID                                     json.RawMessage   `json:"intent_id"`
-				AssetIDs                                     []json.RawMessage `json:"asset_ids"`
+	return writeTool("report_finding", "记录确认的漏洞。可选 traffic_refs 绑定多条真实 HTTP 请求/响应：先用 traffic_search / traffic_get 核对 ID；提交的流量必须全部绑定成功。TCP 等非 HTTP 漏洞、未采集或无确切匹配记录时可省略 traffic_refs 或传空数组，仍用 evidence 提供命令输出、日志等可验证证据，建议说明未绑定原因。任务上下文传当前 intent_id。", obj(map[string]any{
+		"vulnclass": str("漏洞类别"), "name": str("漏洞名称"), "severity": str("critical|high|medium|low"), "summary": str("发现摘要"),
+		"intent_id": idp("当前任务的意图 id"), "asset_ids": map[string]any{"type": "array", "items": map[string]any{"type": "integer"}, "description": "受影响资产 id"},
+		"evidence": str("证据/PoC 文本"),
+		"traffic_refs": map[string]any{"type": "array", "description": "可选；HTTP/HTTPS 漏洞先检索并逐条核实请求/响应确实支持漏洞结论，再按复现顺序填写真实 ID。TCP 等非 HTTP 漏洞、未采集或找不到确切记录时省略或传 []，不阻止上报；可在 evidence 说明原因并提供其他可验证证据。不要猜测 ID、按域名/时间推定关联或仅为补包重复探测。用途 baseline 正常对照 / proof 漏洞证明 / verification 补充验证 / supporting 辅助证据。",
+			"items": obj(map[string]any{"traffic_id": str("traffic_search 返回的真实流量 ID"), "role": map[string]any{"type": "string", "enum": []string{"baseline", "proof", "verification", "supporting"}}, "note": str("该流量如何支持漏洞结论")}, "traffic_id")},
+	}, "vulnclass", "severity", "summary"), func(ctx context.Context, in json.RawMessage) (actool.Result, error) {
+		var a struct {
+			VulnClass, Name, Severity, Summary, Evidence string
+			IntentID                                     json.RawMessage   `json:"intent_id"`
+			AssetIDs                                     []json.RawMessage `json:"asset_ids"`
+			TrafficRefs                                  []db.TrafficRef   `json:"traffic_refs"`
+		}
+		if err := json.Unmarshal(in, &a); err != nil {
+			return actool.Errorf(err.Error()), nil
+		}
+		if t.ts == nil {
+			return actool.Errorf("report_finding 需要任务上下文（exploration store 未初始化）"), nil
+		}
+		refs, err := db.NormalizeTrafficRefs(a.TrafficRefs)
+		if err != nil {
+			return actool.Errorf(err.Error()), nil
+		}
+		input := db.RecordFindingInput{TaskID: t.taskID, ExplorationID: t.ts.ID(), IntentID: pid(a.IntentID), VulnClass: a.VulnClass, Name: a.Name, Severity: a.Severity, Summary: a.Summary, Evidence: a.Evidence, Worker: t.worker, AssetIDs: pidList(a.AssetIDs)}
+		var recorded *db.RecordedFinding
+		if t.findingRecorder != nil {
+			recorded, err = t.findingRecorder.Record(ctx, input, refs)
+		} else if len(refs) > 0 {
+			return actool.Errorf("流量证据存储不可用；未登记漏洞"), nil
+		} else {
+			recorded, err = t.ts.RecordFinding(ctx, input)
+		}
+		if err != nil {
+			return actool.Errorf(err.Error()), nil
+		}
+		if t.notifyFinding != nil {
+			iid := input.IntentID
+			if iid <= 0 {
+				iid = t.ownerNode
 			}
-			_ = json.Unmarshal(in, &a)
-			payload := map[string]any{"vulnclass": a.VulnClass, "name": a.Name, "severity": a.Severity, "summary": a.Summary,
-				"evidence": map[string]any{"by": t.worker, "poc": a.Evidence}}
-			var anchors []int64
-			for _, raw := range a.AssetIDs {
-				if p := pid(raw); p > 0 {
-					anchors = append(anchors, p)
-				}
-			}
-			var id int64
-			if t.ts != nil {
-				intent := pid(a.IntentID)
-				if intent > 0 {
-					node, err := t.ts.GetNode(intent)
-					if err != nil || node == nil || node.Kind != db.KindIntent {
-						return actool.Errorf("intent_id 必须是本任务的意图（关联任务意图只读）"), nil
-					}
-				}
-				var err error
-				id, err = t.ts.AddNode(db.KindFinding, payload, 9, "confirmed", t.worker, anchors)
-				if err != nil {
-					return actool.Errorf(err.Error()), nil
-				}
-				if intent > 0 {
-					_ = t.ts.Link(intent, db.RelYields, id) // chain: intent -> finding
-				}
-				_, _ = t.ts.AddStandaloneFinding(t.taskID, id, a.VulnClass, a.Name, a.Severity, a.Summary, a.Evidence, t.worker, anchors)
-				// 确证漏洞落库 → 当场唤醒本任务 planner（不等 worker 收工，debounce 合并）。
-				// 优先带上下文(哪个意图+finding摘要);intent 用工具参数,缺省回退到 owner 意图。
-				if t.notifyFinding != nil {
-					iid := pid(a.IntentID)
-					if iid <= 0 {
-						iid = t.ownerNode
-					}
-					t.notifyFinding(iid, a.Summary)
-				} else if t.notify != nil {
-					t.notify()
-				}
-			} else {
-				// conversation context: no exploration store available, cannot record finding
-				return actool.Errorf("report_finding 需要任务上下文（exploration store 未初始化）"), nil
-			}
-			t.writes.Findings++
-			return actool.Text(fmt.Sprintf("finding recorded: %d", id)), nil
-		})
+			t.notifyFinding(iid, a.Summary)
+		} else if t.notify != nil {
+			t.notify()
+		}
+		t.writes.Findings++
+		// Keep the first line's node-ID contract for existing reporter triggers.
+		for i := range recorded.Traffic.Bindings {
+			recorded.Traffic.Bindings[i].Snapshot.ReqHead = ""
+			recorded.Traffic.Bindings[i].Snapshot.RespHead = ""
+		}
+		raw, _ := json.Marshal(recorded)
+		return actool.Text(fmt.Sprintf("finding recorded: %d\n%s", recorded.NodeID, raw)), nil
+	})
 }
 
 // recordFact writes a general exploration RESULT/conclusion (not a vuln, not a

agent/worker.go

@@ -41,17 +41,18 @@ type WebSearchOpts struct {
 }
 
 type Worker struct {
-	prov        llm.Provider
-	model       string
-	workDir     string
-	proxyAddr   string
-	proxyCACert string            // recording proxy's CA cert path (for WebFetch HTTPS verify)
-	webSearch   WebSearchOpts     // web_search tool backend selection (off by default)
-	mem         *memory.Store     // cross-engagement tradecraft memory (G4)
-	tx          *transcript.Store // raw LLM conversation persistence (nil = off)
-	window      int               // context window in tokens (for compaction)
-	windowFn    func() int        // optional dynamic task-chain minimum
-	maxTurns    int               // max agent turns per run (0 = unlimited)
+	findingRecorder FindingRecorder
+	prov            llm.Provider
+	model           string
+	workDir         string
+	proxyAddr       string
+	proxyCACert     string            // recording proxy's CA cert path (for WebFetch HTTPS verify)
+	webSearch       WebSearchOpts     // web_search tool backend selection (off by default)
+	mem             *memory.Store     // cross-engagement tradecraft memory (G4)
+	tx              *transcript.Store // raw LLM conversation persistence (nil = off)
+	window          int               // context window in tokens (for compaction)
+	windowFn        func() int        // optional dynamic task-chain minimum
+	maxTurns        int               // max agent turns per run (0 = unlimited)
 	// runTimeout is the wall-clock budget for the main exploration of one intent
 	// (0 = unlimited). When it fires, the run is cut and a settlement round is
 	// forced so already-identified facts get written back instead of being lost.
@@ -204,7 +205,9 @@ const workerDefaultTmpl = `你是一个 ARTEX 平台授权渗透测试系统的"
 **边发现边写回**（写进图才算数，脑子/文字里的不算；每得一个结果立刻写，别攒到最后被步数耗尽丢掉）。三种写回，别串图：
 - **新资产/资源 → insert_assets（资产图）**：子域 / service / endpoint / 指纹 / 凭据 等一切资产【本身】。**这里只登记资产；探索结论/判断不写这里，用 record_fact。**
 - **探索结论/事实 → record_fact（探索图，传 intent_id）**：都用它。**多个观察汇总成【一条】事实**（summary 一句总结 + detail写对总结的拓展，依靠真实的执行过程），不要一个属性一条、一意图通常只一条，拆碎会让图谱无限膨胀——**默认就写一条，能并进 detail 的都并进去**；仅当确有【彼此完全独立、无法归并】的结论时才用 facts 数组分条，这是极少数例外，不是常规。**只写增量**：只记这次【新得到】的，别把已有事实换措辞重记（只印证已有、无新增就不必记）。**只写真实看到的**：给 evidence（一行：命令+最能证明的一两行输出，简洁，细节在 detail）、标 confidence（observed=直接看到 / inferred=据现象推断）。
-- **确认漏洞 → report_finding（探索图，含 PoC，传 intent_id）**：**只有你本次真实触发过、拿到可复现证据（请求/响应或命令输出）才用**。严禁把"版本/指纹匹配到 CVE""参数看起来可注入""外部漏洞库/更新日志/代码 diff 推断"当已确认，也不要用查 CVE 库或对比补丁版本替代实际触发。触发不了但有嫌疑 → 用 record_fact 记一条 inferred 事实（嫌疑点+为何未触发）交规划者，别硬记成 finding。
+- **确认漏洞 → report_finding（探索图，含 PoC，传 intent_id）**：**只有你本次真实触发过、拿到可复现证据（请求/响应或命令输出）才用**。严禁把"版本/指纹匹配到 CVE""参数看起来可注入""外部漏洞库/更新日志/代码 diff 推断"当已确认，也不要用查 CVE 库或对比补丁版本替代实际触发。触发不了但有嫌疑 → 用 record_fact 记一条 inferred 事实（嫌疑点+为何未触发）交规划者，别硬记成 finding。有对应录制流量时，先用 traffic_search / traffic_get 核对真实 ID，再用 traffic_refs 按复现顺序绑定多条请求/响应；域名和时间只用于候选筛选，不推定任务归属。
+
+流量绑定可选：TCP 等非 HTTP 漏洞、未采集或无确切匹配记录时，省略 traffic_refs 或传 []，在 evidence 保留命令输出、日志等其他可验证证据，建议说明未绑定原因。不要猜测 ID，也不要仅为补包重复探测。
 
 完成本意图后用一句话总结你做了什么、写回了哪些事实。务实、克制、聚焦这一条意图。`
 
@@ -255,7 +258,7 @@ func workerSystem(proxyAddr, caCert, dataDir, runDir string) string {
 	body := renderSystem("worker", workerDefaultTmpl, WorkerVars{ProxyAddr: proxyAddr, DataDir: dataDir, Now: nowStr()})
 	// caCert is present only when the recording MITM is on, which is exactly when
 	// the traffic_* tools are registered — so it gates the traffic-tool note.
-	return body + workerTrafficBlock(caCert != "") + workerArtifactSpec(runDir)
+	return body + workerTrafficBlock(caCert != "") + findingTrafficGuidance + workerArtifactSpec(runDir)
 }
 
 // renderIntentTask formats the claimed intent for the worker's launch USER message:
@@ -325,6 +328,7 @@ func (w *Worker) ExecuteWithMessage(ctx context.Context, name string, taskID int
 
 func (w *Worker) execute(ctx context.Context, name string, taskID int64, as *db.AssetStore, ts *db.ExplorationStore, intent *db.Node, hooks harness.HookRunner, emit func(db.Activity), enr EnrichTrigger, notifyFinding func(int64, string), requestID, message string) (harness.TerminalReason, WriteCounts, error) {
 	tsx := NewToolSet(ts, name)
+	tsx.SetFindingRecorder(w.findingRecorder)
 	tsx.SetTaskID(taskID)
 	coverageEnabled := as == nil || as.CoverageEnabled(taskID)
 	tsx.SetCoverageEnabled(coverageEnabled)