Add files via upload

config.yaml

@@ -142,10 +142,10 @@ multi_agent:
     plan_execute_max_step_result_runes: 4000 # plan_execute 每步结果最大字符数（超出截断）
     plan_execute_keep_last_steps: 8 # plan_execute 仅保留最近 N 步正文，早期步骤折叠为标题
     checkpoint_dir: data/eino-checkpoints # P0：进程崩溃/OOM 后同会话自动 ADK Resume；正常结束会删 .ckpt；与「中断并继续」(last_react_*) 是两套机制
-    run_retry_max_attempts: 0 # 429/5xx/网络抖动时整轮 Run 指数退避续跑；0=默认 10（与 deep_model_retry 互补，建议保持默认）
+    run_retry_max_attempts: 0 # 429/5xx/网络抖动时可退避重试次数（run loop + summarization 共用 isEinoTransientRunError）；0=默认 10
     run_retry_max_backoff_sec: 0 # 单次退避上限秒数；0=默认 30
     deep_output_key: final_answer # P0：Eino session 写入最终助手结论（框架内部；Deep/Supervisor 主/eino_single）
-    deep_model_retry_max_retries: 3 # P0：单次 ChatModel API 失败时框架自动重试（超时/502 等）；子代理模型不受此项影响
+    deep_model_retry_max_retries: 0 # 已废弃，请用 run_retry_max_attempts；保留字段仅为兼容旧配置
     task_tool_description_prefix: "" # 非空：仅 Deep 的 task 工具使用自定义描述前缀，运行时会拼接子代理名称；空则走 Eino 默认生成逻辑
   # Eino callbacks + OpenTelemetry：框架级 span（与 Zap 对齐）；默认不向终端用户 UI 推 eino_trace_*（见 sse_trace_to_client）
   eino_callbacks:

internal/handler/agent.go

@@ -1309,7 +1309,10 @@ func (h *AgentHandler) createProgressCallback(runCtx context.Context, cancelRun
 
 		// 保存过程详情到数据库（排除 response/done；response 正文已在 messages 表）
 		// response_start/response_delta 已聚合为 planning，不落逐条。
+		// [Eino] agent 心跳 progress 仅用于实时进度标题，不落库以免时间线刷屏。
+		skipEinoAgentHeartbeat := eventType == "progress" && strings.HasPrefix(strings.TrimSpace(message), "[Eino] ")
 		if assistantMessageID != "" &&
+			!skipEinoAgentHeartbeat &&
 			eventType != "response" &&
 			eventType != "done" &&
 			eventType != "response_start" &&

internal/multiagent/eino_adk_run_loop.go

@@ -630,13 +630,16 @@ func runEinoADKAgentLoop(ctx context.Context, args *einoADKRunLoopArgs, baseMsgs
 					}
 				}
 			}
+			// 仅在代理切换时更新进度标题；同一代理的每个 ADK 事件不再重复刷 progress。
+			if einoLastAgent != ev.AgentName {
+				progress("progress", fmt.Sprintf("[Eino] %s", ev.AgentName), map[string]interface{}{
+					"conversationId": conversationID,
+					"einoAgent":      ev.AgentName,
+					"einoRole":       einoRoleTag(ev.AgentName),
+					"orchestration":  orchMode,
+				})
+			}
 			einoLastAgent = ev.AgentName
-			progress("progress", fmt.Sprintf("[Eino] %s", ev.AgentName), map[string]interface{}{
-				"conversationId": conversationID,
-				"einoAgent":      ev.AgentName,
-				"einoRole":       einoRoleTag(ev.AgentName),
-				"orchestration":  orchMode,
-			})
 		}
 		if ev.Output == nil || ev.Output.MessageOutput == nil {
 			continue

internal/multiagent/eino_execute_streaming_wrap.go

@@ -34,6 +34,15 @@ func einoExecuteTimeoutUserHint() string {
 	return "已超时终止 · Timed out"
 }
 
+// einoExecuteRecvErrIsToolTimeout 判断 Recv 错误是否由 agent.tool_timeout_minutes 触发。
+// WithTimeout 到期后 local 侧常报 canceled / exit -1，但 execCtx.Err() 仍为 DeadlineExceeded。
+func einoExecuteRecvErrIsToolTimeout(rerr error, tctx context.Context) bool {
+	if tctx != nil && errors.Is(tctx.Err(), context.DeadlineExceeded) {
+		return true
+	}
+	return errors.Is(rerr, context.DeadlineExceeded)
+}
+
 // einoStreamingShellWrap 包装 Eino filesystem 使用的 StreamingShell（cloudwego eino-ext local.Local）。
 // 官方 execute 工具默认走 ExecuteStreaming 且不设 RunInBackendGround；末尾带 & 时子进程仍与管道相连，
 // streamStdout 按行读取会在无换行输出时长时间阻塞（与 MCP 工具 exec 的独立实现不同）。
@@ -83,6 +92,16 @@ func (w *einoStreamingShellWrap) ExecuteStreaming(ctx context.Context, input *fi
 		if execCancel != nil {
 			execCancel()
 		}
+		if einoExecuteRecvErrIsToolTimeout(err, execCtx) {
+			hint := "\n\n" + einoExecuteTimeoutUserHint() + "\n"
+			if w.recordMonitor != nil {
+				w.recordMonitor(tid, userCmd, hint, false, context.DeadlineExceeded)
+			}
+			if w.invokeNotify != nil && tid != "" {
+				w.invokeNotify.Fire(tid, "execute", agentTag, false, hint, context.DeadlineExceeded)
+			}
+			return schema.StreamReaderFromArray([]*filesystem.ExecuteResponse{{Output: hint}}), nil
+		}
 		if w.recordMonitor != nil {
 			w.recordMonitor(tid, userCmd, "", false, err)
 		}
@@ -91,7 +110,7 @@ func (w *einoStreamingShellWrap) ExecuteStreaming(ctx context.Context, input *fi
 		}
 		return nil, err
 	}
-	if sr == nil || w.invokeNotify == nil || tid == "" {
+	if sr == nil || w.invokeNotify == nil {
 		if execCancel != nil {
 			execCancel()
 		}
@@ -120,6 +139,11 @@ func (w *einoStreamingShellWrap) ExecuteStreaming(ctx context.Context, input *fi
 			if rerr != nil {
 				success = false
 				invokeErr = rerr
+				// 单次 execute 超时须与 MCP 工具一致：写入工具结果尾标、继续迭代，不得向 ADK 流注入硬错误。
+				if einoExecuteRecvErrIsToolTimeout(rerr, tctx) {
+					invokeErr = context.DeadlineExceeded
+					break
+				}
 				_ = outW.Send(nil, rerr)
 				break
 			}

internal/multiagent/eino_execute_streaming_wrap_test.go

@@ -0,0 +1,138 @@
+package multiagent
+
+import (
+	"context"
+	"errors"
+	"io"
+	"strings"
+	"testing"
+	"time"
+
+	"cyberstrike-ai/internal/einomcp"
+
+	"github.com/cloudwego/eino/adk/filesystem"
+	"github.com/cloudwego/eino/schema"
+)
+
+type mockStreamingShell struct {
+	immediateErr error
+	recvErr      error
+	output       string
+}
+
+func (m *mockStreamingShell) ExecuteStreaming(ctx context.Context, input *filesystem.ExecuteRequest) (*schema.StreamReader[*filesystem.ExecuteResponse], error) {
+	if m.immediateErr != nil {
+		return nil, m.immediateErr
+	}
+	outR, outW := schema.Pipe[*filesystem.ExecuteResponse](4)
+	go func() {
+		defer outW.Close()
+		if strings.TrimSpace(m.output) != "" {
+			_ = outW.Send(&filesystem.ExecuteResponse{Output: m.output}, nil)
+		}
+		if m.recvErr != nil {
+			_ = outW.Send(nil, m.recvErr)
+		}
+	}()
+	return outR, nil
+}
+
+func TestEinoExecuteRecvErrIsToolTimeout(t *testing.T) {
+	tctx, cancel := context.WithTimeout(context.Background(), time.Millisecond)
+	defer cancel()
+	time.Sleep(2 * time.Millisecond)
+	<-tctx.Done()
+
+	if !einoExecuteRecvErrIsToolTimeout(context.Canceled, tctx) {
+		t.Fatal("expected canceled recv with deadline exec ctx to count as tool timeout")
+	}
+	if !einoExecuteRecvErrIsToolTimeout(context.DeadlineExceeded, nil) {
+		t.Fatal("expected DeadlineExceeded recv without tctx")
+	}
+	if einoExecuteRecvErrIsToolTimeout(errors.New("exit status 1"), context.Background()) {
+		t.Fatal("unexpected timeout for generic error")
+	}
+}
+
+func TestEinoStreamingShellWrap_ToolTimeoutImmediateErrIsSoft(t *testing.T) {
+	inner := &mockStreamingShell{immediateErr: context.DeadlineExceeded}
+	wrap := &einoStreamingShellWrap{
+		inner:              inner,
+		toolTimeoutMinutes: 60,
+	}
+	sr, err := wrap.ExecuteStreaming(context.Background(), &filesystem.ExecuteRequest{Command: "true"})
+	if err != nil {
+		t.Fatalf("immediate tool timeout must return soft stream, got err: %v", err)
+	}
+	defer sr.Close()
+
+	var got strings.Builder
+	for {
+		resp, rerr := sr.Recv()
+		if errors.Is(rerr, io.EOF) {
+			break
+		}
+		if rerr != nil {
+			t.Fatalf("outer stream must not hard-fail, got: %v", rerr)
+		}
+		if resp != nil && resp.Output != "" {
+			got.WriteString(resp.Output)
+		}
+	}
+	if !strings.Contains(got.String(), einoExecuteTimeoutUserHint()) {
+		t.Fatalf("expected timeout hint, got: %q", got.String())
+	}
+}
+
+func TestEinoStreamingShellWrap_ToolTimeoutRecvErrIsSoft(t *testing.T) {
+	inner := &mockStreamingShell{recvErr: context.DeadlineExceeded}
+	notify := einomcp.NewToolInvokeNotifyHolder()
+	wrap := &einoStreamingShellWrap{
+		inner:              inner,
+		invokeNotify:       notify,
+		toolTimeoutMinutes: 60,
+	}
+	// 生产路径由 Eino compose 注入 toolCallID；单测通过已过期 execCtx 识别 tool_timeout 软错误。
+	tctx, cancel := context.WithTimeout(context.Background(), time.Millisecond)
+	defer cancel()
+	time.Sleep(2 * time.Millisecond)
+	<-tctx.Done()
+
+	sr, err := wrap.ExecuteStreaming(tctx, &filesystem.ExecuteRequest{Command: "sleep 999"})
+	if err != nil {
+		t.Fatalf("ExecuteStreaming: %v", err)
+	}
+	defer sr.Close()
+
+	var got strings.Builder
+	for {
+		resp, rerr := sr.Recv()
+		if errors.Is(rerr, io.EOF) {
+			break
+		}
+		if rerr != nil {
+			t.Fatalf("outer stream must not hard-fail on tool timeout, got: %v", rerr)
+		}
+		if resp != nil && resp.Output != "" {
+			got.WriteString(resp.Output)
+		}
+	}
+	if !strings.Contains(got.String(), einoExecuteTimeoutUserHint()) {
+		t.Fatalf("expected timeout hint in stream, got: %q", got.String())
+	}
+}
+
+func TestEinoStreamingShellWrap_NonTimeoutRecvErrStillHard(t *testing.T) {
+	inner := &mockStreamingShell{recvErr: errors.New("broken pipe")}
+	wrap := &einoStreamingShellWrap{inner: inner}
+	sr, err := wrap.ExecuteStreaming(context.Background(), &filesystem.ExecuteRequest{Command: "true"})
+	if err != nil {
+		t.Fatalf("ExecuteStreaming: %v", err)
+	}
+	defer sr.Close()
+
+	_, rerr := sr.Recv()
+	if rerr == nil || errors.Is(rerr, io.EOF) {
+		t.Fatal("expected hard stream error for non-timeout failure")
+	}
+}

internal/project/fact_edges.go

@@ -19,8 +19,39 @@ var PathGraphCategories = map[string]struct{}{
 }
 
 // GraphNodeType 将 fact category 映射为图节点类型（供前端样式与 ELK 分层）。
+// 优先使用 category；仅 synthetic 节点（vuln:）或无 category 时才回退到 fact_key 前缀。
 func GraphNodeType(category, factKey string) string {
 	key := strings.ToLower(strings.TrimSpace(factKey))
+	if strings.HasPrefix(key, "vuln:") {
+		return "vulnerability"
+	}
+	c := strings.ToLower(strings.TrimSpace(category))
+	if c != "" {
+		switch c {
+		case FactCategoryTarget:
+			return "target"
+		case FactCategoryExploit:
+			return "exploit"
+		case FactCategoryPOC:
+			return "poc"
+		case FactCategoryChain:
+			return "chain"
+		case FactCategoryFinding:
+			return "finding"
+		case "vuln":
+			return "vulnerability"
+		case FactCategoryAuth:
+			return "auth"
+		case FactCategoryInfra, FactCategoryBusiness:
+			return "infra"
+		case FactCategoryNote:
+			return "note"
+		case "missing":
+			return "missing"
+		default:
+			return c
+		}
+	}
 	switch {
 	case strings.HasPrefix(key, "target/"):
 		return "target"
@@ -36,25 +67,6 @@ func GraphNodeType(category, factKey string) string {
 		return "auth"
 	case strings.HasPrefix(key, "infra/"), strings.HasPrefix(key, "business/"):
 		return "infra"
-	case strings.HasPrefix(key, "vuln:"):
-		return "vulnerability"
-	}
-	c := strings.ToLower(strings.TrimSpace(category))
-	switch c {
-	case FactCategoryTarget:
-		return "target"
-	case FactCategoryExploit:
-		return "exploit"
-	case FactCategoryPOC:
-		return "poc"
-	case FactCategoryChain:
-		return "chain"
-	case FactCategoryFinding, "vuln":
-		return "finding"
-	case "auth":
-		return "auth"
-	case "infra", "business":
-		return "infra"
 	default:
 		return "note"
 	}
@@ -258,6 +270,9 @@ func isPathGraphFact(category, factKey string) bool {
 	if _, ok := PathGraphCategories[c]; ok {
 		return true
 	}
+	if c != "" {
+		return false
+	}
 	key := strings.ToLower(strings.TrimSpace(factKey))
 	for _, p := range []string{"target/", "finding/", "chain/", "exploit/", "poc/", "evidence/"} {
 		if strings.HasPrefix(key, p) {
@@ -269,9 +284,12 @@ func isPathGraphFact(category, factKey string) bool {
 
 func isDependencyGraphFact(category, factKey string) bool {
 	c := strings.ToLower(strings.TrimSpace(category))
-	if c == "auth" || c == "infra" || c == "business" {
+	if c == FactCategoryAuth || c == FactCategoryInfra || c == FactCategoryBusiness {
 		return true
 	}
+	if c != "" {
+		return false
+	}
 	key := strings.ToLower(strings.TrimSpace(factKey))
 	return strings.HasPrefix(key, "auth/") || strings.HasPrefix(key, "infra/") || strings.HasPrefix(key, "business/")
 }

internal/project/fact_edges_test.go

@@ -102,11 +102,17 @@ func TestGraphNodeType(t *testing.T) {
 	if GraphNodeType("exploit", "exploit/x") != "exploit" {
 		t.Fatal("exploit category")
 	}
-	if GraphNodeType("finding", "evidence/x") != "exploit" {
-		t.Fatal("evidence prefix")
+	if GraphNodeType("finding", "evidence/x") != "finding" {
+		t.Fatal("category should override evidence key prefix")
 	}
-	if GraphNodeType("note", "target/x") != "target" {
-		t.Fatal("target prefix")
+	if GraphNodeType("note", "target/x") != "note" {
+		t.Fatal("category should override target key prefix")
+	}
+	if GraphNodeType("vuln", "finding/x") != "vulnerability" {
+		t.Fatal("vuln category maps to vulnerability node type")
+	}
+	if GraphNodeType("", "target/x") != "target" {
+		t.Fatal("empty category falls back to target key prefix")
 	}
 }
 

tools/gau.yaml

@@ -27,13 +27,13 @@ parameters:
     type: "string"
     description: "数据源（wayback,commoncrawl,otx,urlscan）"
     required: false
-    flag: "-providers"
+    flag: "--providers"
     format: "flag"
   - name: "include_subs"
     type: "bool"
     description: "包含子域名"
     required: false
-    flag: "-subs"
+    flag: "--subs"
     format: "flag"
     default: true
   - name: "additional_args"
@@ -42,9 +42,9 @@ parameters:
       额外的Gau参数。用于传递未在参数列表中定义的Gau选项。
 
       **示例值：**
-      - "-o output.txt": 输出到文件
-      - "-t": 线程数
-      - "-b": 黑名单扩展
+      - "--o output.txt": 输出到文件
+      - "--threads 4": 线程数
+      - "--blacklist ttf,woff,svg,png": 黑名单扩展
 
       **注意事项：**
       - 多个参数用空格分隔

web/static/css/style.css

@@ -3964,9 +3964,10 @@ header {
     background: var(--bg-tertiary);
 }
 
+/* 迭代轮次：暖琥珀色条 + 极浅底，与紫（推理）/蓝（工具）区分但不抢视觉 */
 .timeline-item-iteration {
-    border-left-color: var(--accent-color);
-    background: rgba(0, 102, 255, 0.06);
+    border-left-color: #c4a574;
+    background: rgba(180, 140, 90, 0.045);
 }
 
 /*
@@ -3974,13 +3975,18 @@ header {
  * 但不再在此处整卡铺色 + !important，否则会盖住工具调用/结果/思考的类型色。
  * 主编排 vs 子代理的区分由「迭代轮次」上的 timeline-eino-scope-* 负责。
  */
-.timeline-item-iteration.timeline-eino-scope-main {
-    border-left-color: #3949ab !important;
-    background: rgba(57, 73, 171, 0.1) !important;
+.timeline-item.timeline-item-iteration.timeline-eino-scope-main {
+    border-left-color: #b8956a;
+    background: rgba(184, 149, 106, 0.05);
 }
-.timeline-item-iteration.timeline-eino-scope-sub {
-    border-left-color: #00695c !important;
-    background: rgba(0, 105, 92, 0.09) !important;
+.timeline-item.timeline-item-iteration.timeline-eino-scope-sub {
+    border-left-color: #a6896c;
+    background: rgba(166, 137, 108, 0.045);
+}
+
+.timeline-item-iteration .timeline-item-title {
+    color: var(--text-secondary);
+    font-weight: 500;
 }
 
 /* 模型内部思考：弱化灰紫，避免与「助手输出」抢视觉 */
@@ -15846,7 +15852,12 @@ tr.mcp-stats-tool-row[data-tool-name]:focus-visible {
     overflow-y: visible;
 }
 .webshell-ai-process-block .webshell-ai-timeline-iteration {
-    border-left-color: var(--accent-color);
+    border-left-color: #c4a574;
+    background: rgba(180, 140, 90, 0.04);
+}
+.webshell-ai-process-block .webshell-ai-timeline-iteration .webshell-ai-timeline-title {
+    color: var(--text-secondary);
+    font-weight: 500;
 }
 .webshell-ai-process-block .webshell-ai-timeline-thinking {
     border-left-color: #9c27b0;
@@ -24536,17 +24547,30 @@ button.chat-files-dropdown-item:hover:not(:disabled) {
     flex-direction: column;
     overflow: hidden;
     min-height: 0;
-    padding-bottom: 16px;
+    padding-bottom: 0;
 }
 #project-panel-graph .projects-graph-toolbar {
     flex: 0 0 auto;
 }
 #project-panel-graph .project-fact-graph-layout {
-    flex: 1 1 auto;
+    flex: 1 1 0;
     min-height: 0;
+    max-height: 100%;
+    overflow: hidden;
+}
+#project-panel-graph .project-fact-graph-container {
+    min-height: 0;
+    height: 100%;
 }
 #project-panel-graph .project-fact-graph-footer {
     flex: 0 0 auto;
+    flex-shrink: 0;
+    position: relative;
+    z-index: 20;
+    margin: 0;
+    padding: 10px 0 12px;
+    background: #fff;
+    border-top: 1px solid #eef2f7;
 }
 .projects-graph-toolbar-row {
     align-items: flex-end;
@@ -24607,7 +24631,27 @@ button.chat-files-dropdown-item:hover:not(:disabled) {
     flex-wrap: wrap;
     align-items: center;
     justify-content: flex-end;
-    gap: 6px 12px;
+    gap: 8px 14px;
+}
+.projects-graph-legend-group {
+    display: inline-flex;
+    flex-wrap: wrap;
+    align-items: center;
+    gap: 6px 10px;
+}
+.projects-graph-legend-heading {
+    font-size: 0.6875rem;
+    font-weight: 600;
+    letter-spacing: 0.04em;
+    text-transform: uppercase;
+    color: #94a3b8;
+}
+.projects-graph-legend-divider {
+    display: inline-block;
+    width: 1px;
+    height: 18px;
+    background: #e2e8f0;
+    flex: 0 0 auto;
 }
 .projects-graph-legend-item {
     display: inline-flex;
@@ -24616,27 +24660,40 @@ button.chat-files-dropdown-item:hover:not(:disabled) {
     font-size: 0.75rem;
     color: #64748b;
 }
-.projects-graph-legend-item i {
+.projects-graph-legend-item--edge i {
     display: inline-block;
     width: 22px;
     height: 0;
     border-top: 2.5px solid var(--legend-color, #cbd5e1);
     border-radius: 2px;
 }
-.projects-graph-legend-item--dashed i {
+.projects-graph-legend-item--edge.projects-graph-legend-item--dashed i {
     border-top-style: dashed;
     opacity: 0.7;
 }
+.projects-graph-legend-item--node i {
+    display: inline-block;
+    width: 14px;
+    height: 14px;
+    border: 1.5px solid var(--legend-color, #cbd5e1);
+    border-radius: 4px;
+    background: linear-gradient(135deg, #ffffff 0%, var(--legend-bg, #f8fafc) 100%);
+    box-shadow: inset 0 1px 0 rgba(255, 255, 255, 0.9);
+}
+.projects-graph-legend-item--node-dashed i {
+    border-style: dashed;
+    opacity: 0.85;
+}
 .project-fact-graph-layout {
     position: relative;
     display: flex;
-    min-height: 480px;
+    min-height: 0;
     align-items: stretch;
 }
 .project-fact-graph-container {
     flex: 1 1 auto;
     width: 100%;
-    min-height: 480px;
+    min-height: 240px;
     border: 1px solid var(--border-color, #e2e8f0);
     border-radius: 14px;
     background-color: #f8fafc;
@@ -24781,8 +24838,8 @@ button.chat-files-dropdown-item:hover:not(:disabled) {
     border: 1px solid #e2e8f0;
 }
 .project-fact-graph-node-category--target { color: #4338ca; background: #eef2ff; border-color: #c7d2fe; }
-.project-fact-graph-node-category--finding,
-.project-fact-graph-node-category--vulnerability { color: #be123c; background: #fff1f2; border-color: #fecdd3; }
+.project-fact-graph-node-category--finding { color: #be123c; background: #fff1f2; border-color: #fecdd3; }
+.project-fact-graph-node-category--vulnerability { color: #7e22ce; background: #f5f3ff; border-color: #ddd6fe; }
 .project-fact-graph-node-category--exploit,
 .project-fact-graph-node-category--poc { color: #c2410c; background: #ffedd5; border-color: #fdba74; }
 .project-fact-graph-node-category--chain { color: #6d28d9; background: #f5f3ff; border-color: #ddd6fe; }
@@ -24831,6 +24888,13 @@ button.chat-files-dropdown-item:hover:not(:disabled) {
     min-width: 0;
     color: #475569;
 }
+.project-fact-graph-node-vuln-hint {
+    display: block;
+    width: 100%;
+    font-size: 0.75rem;
+    line-height: 1.45;
+    color: #64748b;
+}
 .project-fact-graph-edges-wrap {
     flex: 1 1 auto;
     min-height: 0;
@@ -24991,6 +25055,7 @@ button.chat-files-dropdown-item:hover:not(:disabled) {
     gap: 8px 12px;
     margin: 10px 0 0;
     flex: 0 0 auto;
+    flex-shrink: 0;
 }
 .project-fact-graph-stats {
     display: flex;

web/static/i18n/en-US.json

@@ -280,6 +280,14 @@
     "graphStats": "Nodes: {{nodes}} | Edges: {{edges}}",
     "graphStatsNodes": "Nodes",
     "graphStatsEdges": "Edges",
+    "graphLegendNodes": "Nodes",
+    "graphLegendEdges": "Edges",
+    "graphLegendNodeTarget": "TARGET",
+    "graphLegendNodeInfra": "INFRA",
+    "graphLegendNodeFinding": "FINDING",
+    "graphLegendNodeVuln": "VULN",
+    "graphLegendNodeExploit": "EXPLOIT",
+    "graphLegendNodeMissing": "MISSING",
     "graphLegendDiscovered": "discovered_on",
     "graphLegendLeads": "leads_to",
     "graphLegendExploits": "exploits",
@@ -310,6 +318,8 @@
     "graphEdgeDeleteFailed": "Failed to delete edge",
     "graphEdgeDeleteSuccess": "Edge deleted",
     "graphDeleteEdge": "Delete",
+    "viewVulnerability": "View vulnerability",
+    "graphVulnSidebarHint": "Linked vulnerability node. Use the button below to open it in Vulnerability Management.",
     "promoteAttackChain": "Promote chain",
     "promoteAttackChainTitle": "Promote conversation attack chain to project facts",
     "confirmPromoteAttackChain": "Promote this conversation's attack chain into the project? Facts and edges will be created or updated.",

web/static/i18n/zh-CN.json

@@ -268,6 +268,14 @@
     "graphStats": "节点: {{nodes}} | 边: {{edges}}",
     "graphStatsNodes": "节点",
     "graphStatsEdges": "边",
+    "graphLegendNodes": "节点",
+    "graphLegendEdges": "连线",
+    "graphLegendNodeTarget": "TARGET · 目标",
+    "graphLegendNodeInfra": "INFRA · 基础设施",
+    "graphLegendNodeFinding": "FINDING · 发现",
+    "graphLegendNodeVuln": "VULN · 漏洞",
+    "graphLegendNodeExploit": "EXPLOIT · 利用",
+    "graphLegendNodeMissing": "MISSING · 缺失",
     "graphLegendDiscovered": "discovered_on",
     "graphLegendLeads": "leads_to",
     "graphLegendExploits": "exploits",
@@ -298,6 +306,8 @@
     "graphEdgeDeleteFailed": "删除边失败",
     "graphEdgeDeleteSuccess": "边已删除",
     "graphDeleteEdge": "删边",
+    "viewVulnerability": "查看漏洞",
+    "graphVulnSidebarHint": "关联漏洞节点，点击下方按钮在漏洞管理中查看详情。",
     "promoteAttackChain": "沉淀攻击链",
     "promoteAttackChainTitle": "将对话攻击链沉淀为项目事实与边",
     "confirmPromoteAttackChain": "将该对话的攻击链沉淀到本项目？会创建/更新事实与关系边。",

web/static/js/chat.js

@@ -2252,10 +2252,22 @@ async function syncAssistantReasoningContentFromServer(backendMessageId, domAssi
 window.normalizeReasoningContentForDisplay = normalizeReasoningContentForDisplay;
 window.setMessageReasoningContent = setMessageReasoningContent;
 window.getMessageReasoningContent = getMessageReasoningContent;
+window.filterNoiseProcessDetails = filterNoiseProcessDetails;
 window.mergeMessageReasoningContentIntoProcessDetails = mergeMessageReasoningContentIntoProcessDetails;
 window.syncAssistantReasoningContentFromServer = syncAssistantReasoningContentFromServer;
 
 /** 相邻且类型/正文/data 完全一致的过程详情只保留一条（与后端去重一致，避免时间线叠多条相同块） */
+function isEinoAgentHeartbeatProgress(detail) {
+    if (!detail || detail.eventType !== 'progress') return false;
+    const msg = String(detail.message != null ? detail.message : '').trim();
+    return /^\[Eino\]\s+\S/.test(msg);
+}
+
+function filterNoiseProcessDetails(details) {
+    if (!Array.isArray(details)) return details;
+    return details.filter(function (d) { return !isEinoAgentHeartbeatProgress(d); });
+}
+
 function dedupeConsecutiveProcessDetailRows(details) {
     if (!Array.isArray(details) || details.length < 2) {
         return details;
@@ -2394,6 +2406,7 @@ function renderProcessDetails(messageId, processDetails) {
         detailsContainer.dataset.loaded = '1';
     }
     processDetails = mergeMessageReasoningContentIntoProcessDetails(processDetails, reasoningFromMessage);
+    processDetails = filterNoiseProcessDetails(processDetails);
     processDetails = dedupeConsecutiveProcessDetailRows(processDetails);
     if (typeof window.coalesceProcessDetailsToolPairs === 'function') {
         processDetails = window.coalesceProcessDetailsToolPairs(processDetails);

web/static/js/fact-graph.js

@@ -9,6 +9,7 @@
     let _graphData = null;
     let _onNodeSelect = null;
     let _onEdgeSelect = null;
+    let _resizeObs = null;
 
     const EDGE_COLORS = {
         discovered_on: '#4F46E5',
@@ -30,25 +31,29 @@
     const CARD_MIN_W = 300;
     const CARD_TARGET_W = 360;
     const CARD_MIN_H = 88;
-    const CARD_MAX_H = 152;
+    const CARD_MAX_H = 176;
     const CARD_HEADER_FS = 11;
     const CARD_HEADER_LH = 16;
+    const CARD_KEY_FS = 10;
+    const CARD_KEY_LH = 14;
     const CARD_SUMMARY_FS = 13;
     const CARD_SUMMARY_LH = 18;
     const CARD_SECTION_GAP = 6;
     const CARD_FONT =
         '-apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", "PingFang SC", "Microsoft YaHei", sans-serif';
+    const CARD_KEY_FONT =
+        'ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", monospace';
 
     function nodeTheme(type) {
         switch (type) {
             case 'target':
                 return { typeLabel: '目标', typeEn: 'TARGET', accent: '#4F46E5', bgEnd: '#F5F3FF', icon: 'target' };
             case 'finding':
-                return { typeLabel: '发现', typeEn: 'FINDING', accent: '#E11D48', bgEnd: '#FFF1F2', icon: 'vulnerability' };
+                return { typeLabel: '发现', typeEn: 'FINDING', accent: '#E11D48', bgEnd: '#FFF1F2', icon: 'finding', cardStyle: 'default' };
             case 'exploit':
-                return { typeLabel: '利用', typeEn: 'EXPLOIT', accent: '#B45309', bgEnd: '#FFFBEB', icon: 'vulnerability' };
+                return { typeLabel: '利用', typeEn: 'EXPLOIT', accent: '#B45309', bgEnd: '#FFFBEB', icon: 'vulnerability', cardStyle: 'default' };
             case 'vulnerability':
-                return { typeLabel: '漏洞', typeEn: 'VULN', accent: '#BE123C', bgEnd: '#FFF1F2', icon: 'vulnerability' };
+                return { typeLabel: '漏洞', typeEn: 'VULN', accent: '#9333EA', bgEnd: '#F5F3FF', icon: 'vuln', cardStyle: 'default' };
             case 'auth':
                 return { typeLabel: '认证', typeEn: 'AUTH', accent: '#0D9488', bgEnd: '#F0FDFA', icon: 'default' };
             case 'infra':
@@ -148,19 +153,24 @@
         return nodeWidth - CARD_TEXT_X - CARD_PAD - CARD_TEXT_PAD_RIGHT;
     }
 
-    function computeNodeLayout(type, summary, statusBadge, theme) {
+    function computeNodeLayout(type, summary, statusBadge, theme, factKey) {
         const width = type === 'target' ? CARD_TARGET_W : CARD_MIN_W;
         const textW = cardTextWidth(width);
         const t = theme || nodeTheme(type);
         const headerLines = wrapTextLines(buildHeaderText(t, statusBadge), textW, CARD_HEADER_FS, 2, true);
-        const summaryLines = wrapTextLines(summary, textW, CARD_SUMMARY_FS, 4, true);
+        const keyText = String(factKey || '').trim();
+        const keyLines = keyText ? wrapTextLines(keyText, textW, CARD_KEY_FS, 2, false) : [];
+        const summaryLines = wrapTextLines(summary, textW, CARD_SUMMARY_FS, keyLines.length ? 3 : 4, true);
+        const keyBlockHeight = keyLines.length
+            ? CARD_SECTION_GAP + keyLines.length * CARD_KEY_LH + CARD_SECTION_GAP
+            : CARD_SECTION_GAP;
         const height = Math.min(
             CARD_MAX_H,
             Math.max(
                 CARD_MIN_H,
                 CARD_PAD +
                     headerLines.length * CARD_HEADER_LH +
-                    CARD_SECTION_GAP +
+                    keyBlockHeight +
                     summaryLines.length * CARD_SUMMARY_LH +
                     CARD_PAD,
             ),
@@ -169,8 +179,11 @@
             width,
             height,
             headerLines,
+            keyLines,
             summaryLines,
-            searchLabel: headerLines.join(' ') + '\n' + summaryLines.join(' '),
+            searchLabel: [headerLines.join(' '), keyLines.join(' '), summaryLines.join(' ')]
+                .filter(Boolean)
+                .join('\n'),
         };
     }
 
@@ -183,6 +196,21 @@
                 `<circle cx="12" cy="12" r="2.5" fill="${color}"/></g>`
             );
         }
+        if (kind === 'finding') {
+            return (
+                `<g transform="translate(${x}, ${y}) scale(${scale})">` +
+                `<circle cx="10" cy="10" r="6" fill="none" stroke="${color}" stroke-width="2"/>` +
+                `<line x1="14.5" y1="14.5" x2="19" y2="19" stroke="${color}" stroke-width="2" stroke-linecap="round"/></g>`
+            );
+        }
+        if (kind === 'vuln') {
+            return (
+                `<g transform="translate(${x}, ${y}) scale(${scale})">` +
+                `<path d="M12 2.5l7.5 3v6.2c0 4.6-3.1 8.1-7.5 9.3-4.4-1.2-7.5-4.7-7.5-9.3V5.5z" fill="${color}" fill-opacity="0.12" stroke="${color}" stroke-width="2"/>` +
+                `<line x1="12" y1="8.5" x2="12" y2="12.5" stroke="${color}" stroke-width="2" stroke-linecap="round"/>` +
+                `<circle cx="12" cy="15.5" r="1.1" fill="${color}"/></g>`
+            );
+        }
         if (kind === 'vulnerability') {
             return (
                 `<g transform="translate(${x}, ${y}) scale(${scale})">` +
@@ -198,7 +226,7 @@
     }
 
     function buildNodeCardSvgUrl(theme, layout, confidence) {
-        const { width, height, headerLines, summaryLines } = layout;
+        const { width, height, headerLines, keyLines, summaryLines } = layout;
         const accent = theme.accent;
         const bgEnd = theme.bgEnd;
         const conf = (confidence || '').toLowerCase();
@@ -207,7 +235,14 @@
         const iconX = CARD_PAD;
         const iconY = (height - CARD_ICON) / 2;
         const headerY = CARD_PAD + CARD_HEADER_FS;
-        const summaryY = CARD_PAD + headerLines.length * CARD_HEADER_LH + CARD_SECTION_GAP + CARD_SUMMARY_FS;
+        const keyY = CARD_PAD + headerLines.length * CARD_HEADER_LH + CARD_SECTION_GAP + CARD_KEY_FS;
+        const summaryY =
+            CARD_PAD +
+            headerLines.length * CARD_HEADER_LH +
+            (keyLines.length
+                ? CARD_SECTION_GAP + keyLines.length * CARD_KEY_LH + CARD_SECTION_GAP
+                : CARD_SECTION_GAP) +
+            CARD_SUMMARY_FS;
 
         const stroke = isTentative
             ? `stroke="${accent}" stroke-width="1.5" stroke-dasharray="8 5" stroke-opacity="0.9"`
@@ -220,6 +255,13 @@
             )
             .join('');
 
+        const keySvg = keyLines
+            .map(
+                (line, i) =>
+                    `<text x="${CARD_TEXT_X}" y="${keyY + i * CARD_KEY_LH}" font-size="${CARD_KEY_FS}" font-weight="500" fill="#64748b" font-family='${CARD_KEY_FONT}'>${escapeXml(line)}</text>`,
+            )
+            .join('');
+
         const summarySvg = summaryLines
             .map(
                 (line, i) =>
@@ -238,7 +280,7 @@
             `<g${isDeprecated ? ' opacity="0.55"' : ''}>` +
             `<rect x="0.75" y="0.75" width="${width - 1.5}" height="${height - 1.5}" rx="12" fill="url(#bg)" ${stroke}/>` +
             svgIconGroup(theme.icon, accent, iconX, iconY) +
-            `<g clip-path="url(#textClip)">${headerSvg}${summarySvg}</g>` +
+            `<g clip-path="url(#textClip)">${headerSvg}${keySvg}${summarySvg}</g>` +
             `</g></svg>`;
 
         try {
@@ -249,6 +291,10 @@
     }
 
     function destroy() {
+        if (_resizeObs) {
+            _resizeObs.disconnect();
+            _resizeObs = null;
+        }
         if (_cy) {
             _cy.destroy();
             _cy = null;
@@ -256,9 +302,28 @@
         _graphData = null;
     }
 
+    function observeContainerResize(container) {
+        if (_resizeObs) {
+            _resizeObs.disconnect();
+            _resizeObs = null;
+        }
+        if (!container || typeof ResizeObserver === 'undefined') return;
+        _resizeObs = new ResizeObserver(() => {
+            if (_cy) {
+                try {
+                    _cy.resize();
+                } catch (e) {
+                    console.warn('graph resize', e);
+                }
+            }
+        });
+        _resizeObs.observe(container);
+    }
+
     function centerGraph() {
         if (!_cy) return;
         try {
+            _cy.resize();
             _cy.fit(undefined, 56);
             if (_cy.zoom() < 0.65) {
                 _cy.zoom(0.65);
@@ -273,17 +338,13 @@
     function pathGraphNodeLayer(type, factKey) {
         const key = (factKey || '').toLowerCase();
         if (key.startsWith('vuln:')) return '4';
-        if (key.startsWith('target/')) return '0';
-        if (key.startsWith('infra/') || key.startsWith('auth/') || key.startsWith('business/')) return '1';
-        if (key.startsWith('exploit/') || key.startsWith('evidence/')) return '3';
-        if (key.startsWith('poc/')) return '3';
-        if (key.startsWith('chain/')) return '2';
-        if (key.startsWith('finding/')) return '2';
         const t = (type || '').toLowerCase();
         if (t === 'target') return '0';
-        if (t === 'infra' || t === 'auth') return '1';
+        if (t === 'infra' || t === 'auth' || t === 'business') return '1';
         if (t === 'exploit' || t === 'poc') return '3';
-        if (t === 'chain' || t === 'finding' || t === 'vulnerability') return '2';
+        if (t === 'vulnerability' || t === 'vuln') return '3';
+        if (t === 'chain' || t === 'finding') return '2';
+        if (t === 'note') return '2';
         return '2';
     }
 
@@ -408,16 +469,19 @@
 
         nodes.forEach((node) => {
             nodeIds.add(node.id);
-            const theme = nodeTheme(node.type || node.category || 'note');
-            const label = node.label || node.fact_key || node.id;
+            const visualType = resolveGraphNodeType(node);
+            const theme = nodeTheme(visualType);
+            const factKey = node.fact_key || node.id;
+            const summary = (node.summary || node.label || '').trim() || '—';
             const statusBadge = buildStatusBadge(node.confidence);
-            const layout = computeNodeLayout(node.type || node.category || 'note', label, statusBadge, theme);
+            const layout = computeNodeLayout(visualType, summary, statusBadge, theme, factKey);
             elements.push({
                 data: {
                     id: node.id,
                     label: layout.searchLabel,
                     factKey: node.fact_key || node.id,
-                    type: node.type || 'note',
+                    category: node.category || '',
+                    type: visualType,
                     typeLabel: theme.typeLabel,
                     typeEn: theme.typeEn,
                     accentColor: theme.accent,
@@ -529,6 +593,7 @@
         });
 
         applyElkLayout(validEdges, isComplex);
+        observeContainerResize(container);
         return _cy;
     }
 
@@ -577,21 +642,28 @@
         }
     }
 
-    /** 与后端 GraphNodeType 一致：优先 fact_key 前缀，再 category/type。 */
+    /** 与后端 GraphNodeType 一致：优先 category，vuln: 合成节点例外；无 category 时回退 type/key。 */
     function resolveGraphNodeType(node) {
         if (!node) return 'note';
         const key = String(node.fact_key || node.id || '').toLowerCase();
+        if (key.startsWith('vuln:')) return 'vulnerability';
+        const cat = String(node.category || '').toLowerCase();
+        if (cat) {
+            if (cat === 'vuln') return 'vulnerability';
+            if (cat === 'missing') return 'missing';
+            return cat;
+        }
+        const t = String(node.type || '').toLowerCase();
+        if (t === 'vuln') return 'vulnerability';
+        if (t) return t;
         if (key.startsWith('target/')) return 'target';
-        if (key.startsWith('exploit/') || key.startsWith('poc/') || key.startsWith('evidence/')) return 'exploit';
+        if (key.startsWith('exploit/') || key.startsWith('evidence/')) return 'exploit';
+        if (key.startsWith('poc/')) return 'poc';
         if (key.startsWith('chain/')) return 'chain';
         if (key.startsWith('finding/')) return 'finding';
         if (key.startsWith('auth/')) return 'auth';
-        if (key.startsWith('infra/')) return 'infra';
-        if (key.startsWith('business/')) return 'business';
-        if (key.startsWith('vuln:')) return 'vulnerability';
-        const t = String(node.type || node.category || 'note').toLowerCase();
-        if (t === 'vuln') return 'vulnerability';
-        return t || 'note';
+        if (key.startsWith('infra/') || key.startsWith('business/')) return 'infra';
+        return 'note';
     }
 
     global.ProjectFactGraph = {

web/static/js/projects.js

@@ -920,20 +920,31 @@ function renderProjectFactGraphEdges(factKey, graphData, selectedEdgeId) {
     if (!edges.length) wrap.hidden = false;
 }
 
+function graphVulnIdFromKey(factKey) {
+    const key = String(factKey || '');
+    if (!key.startsWith('vuln:')) return null;
+    return key.slice(5);
+}
+
 function showProjectFactGraphNode(factKey, graphData, selectedEdgeId) {
-    if (!factKey || String(factKey).startsWith('vuln:')) {
+    if (!factKey) {
         closeProjectFactGraphSidebar();
         return;
     }
     _selectedGraphFactKey = factKey;
     _selectedGraphEdgeId = selectedEdgeId || null;
     const node = (graphData?.nodes || []).find((n) => n.fact_key === factKey || n.id === factKey);
+    const vulnId = graphVulnIdFromKey(factKey);
+    const isVulnNode = !!vulnId;
     const sidebar = document.getElementById('project-fact-graph-sidebar');
     const titleEl = document.getElementById('project-fact-graph-node-title');
     const metaEl = document.getElementById('project-fact-graph-node-meta');
     const categoryEl = document.getElementById('project-fact-graph-node-category');
+    const detailBtn = document.getElementById('project-fact-graph-detail-btn');
+    const editBtn = document.getElementById('project-fact-graph-edit-btn');
     if (!sidebar || !titleEl || !metaEl) return;
-    titleEl.textContent = factKey;
+    titleEl.textContent = isVulnNode ? vulnId : factKey;
+    titleEl.title = isVulnNode ? vulnId : factKey;
     if (categoryEl) {
         const visualType =
             typeof ProjectFactGraph !== 'undefined' && ProjectFactGraph.resolveGraphNodeType
@@ -950,11 +961,16 @@ function showProjectFactGraphNode(factKey, graphData, selectedEdgeId) {
     }
     const conf = node?.confidence || '';
     const summary = (node?.summary || node?.label || '').trim();
-    if (summary || conf) {
+    if (summary || conf || isVulnNode) {
         const parts = [];
         if (summary) {
             parts.push(`<span class="project-fact-graph-node-summary">${escapeHtml(summary)}</span>`);
         }
+        if (isVulnNode) {
+            parts.push(
+                `<span class="project-fact-graph-node-vuln-hint">${escapeHtml(tp('projects.graphVulnSidebarHint'))}</span>`,
+            );
+        }
         if (conf) {
             parts.push(formatConfidenceBadge(conf));
         }
@@ -962,6 +978,12 @@ function showProjectFactGraphNode(factKey, graphData, selectedEdgeId) {
     } else {
         metaEl.textContent = '';
     }
+    if (detailBtn) {
+        detailBtn.textContent = isVulnNode ? tp('projects.viewVulnerability') : tp('projects.details');
+    }
+    if (editBtn) {
+        editBtn.hidden = isVulnNode;
+    }
     renderProjectFactGraphEdges(factKey, graphData, _selectedGraphEdgeId);
     if (_selectedGraphEdgeId && typeof ProjectFactGraph !== 'undefined') {
         ProjectFactGraph.selectEdge(_selectedGraphEdgeId);
@@ -1003,7 +1025,13 @@ async function deleteProjectFactEdge(edgeId) {
 }
 
 function openSelectedGraphFactDetail() {
-    if (_selectedGraphFactKey) viewProjectFactBody(_selectedGraphFactKey);
+    if (!_selectedGraphFactKey) return;
+    const vulnId = graphVulnIdFromKey(_selectedGraphFactKey);
+    if (vulnId) {
+        openVulnerabilityDetail(vulnId);
+        return;
+    }
+    viewProjectFactBody(_selectedGraphFactKey);
 }
 
 function editSelectedGraphFact() {

web/static/js/webshell.js

@@ -1989,6 +1989,10 @@ function buildWebshellTimelineItemFromDetail(detail) {
 // 渲染「执行过程及调用工具」折叠块（默认折叠，刷新后加载历史时保留并可展开）
 function renderWebshellProcessDetailsBlock(processDetails, defaultCollapsed) {
     if (!processDetails || processDetails.length === 0) return null;
+    if (typeof window.filterNoiseProcessDetails === 'function') {
+        processDetails = window.filterNoiseProcessDetails(processDetails);
+    }
+    if (!processDetails.length) return null;
     if (typeof window.coalesceProcessDetailsToolPairs === 'function') {
         processDetails = window.coalesceProcessDetailsToolPairs(processDetails);
     }

web/templates/index.html

@@ -1664,11 +1664,24 @@
                                     </div>
                                     <div class="project-fact-graph-footer">
                                         <div id="project-fact-graph-stats" class="project-fact-graph-stats"></div>
-                                        <div class="projects-graph-legend" aria-hidden="true">
-                                            <span class="projects-graph-legend-item"><i style="--legend-color:#4F46E5"></i><span data-i18n="projects.graphLegendDiscovered">discovered_on</span></span>
-                                            <span class="projects-graph-legend-item"><i style="--legend-color:#64748B"></i><span data-i18n="projects.graphLegendLeads">leads_to</span></span>
-                                            <span class="projects-graph-legend-item"><i style="--legend-color:#DC2626"></i><span data-i18n="projects.graphLegendExploits">exploits</span></span>
-                                            <span class="projects-graph-legend-item projects-graph-legend-item--dashed"><i style="--legend-color:#94A3B8"></i><span data-i18n="projects.graphLegendTentative">待确认</span></span>
+                                        <div class="projects-graph-legend" role="group" aria-label="Graph legend">
+                                            <div class="projects-graph-legend-group">
+                                                <span class="projects-graph-legend-heading" data-i18n="projects.graphLegendNodes">节点</span>
+                                                <span class="projects-graph-legend-item projects-graph-legend-item--node"><i style="--legend-color:#4F46E5;--legend-bg:#F5F3FF"></i><span data-i18n="projects.graphLegendNodeTarget">TARGET · 目标</span></span>
+                                                <span class="projects-graph-legend-item projects-graph-legend-item--node"><i style="--legend-color:#64748B;--legend-bg:#F8FAFC"></i><span data-i18n="projects.graphLegendNodeInfra">INFRA · 基础设施</span></span>
+                                                <span class="projects-graph-legend-item projects-graph-legend-item--node"><i style="--legend-color:#E11D48;--legend-bg:#FFF1F2"></i><span data-i18n="projects.graphLegendNodeFinding">FINDING · 发现</span></span>
+                                                <span class="projects-graph-legend-item projects-graph-legend-item--node"><i style="--legend-color:#9333EA;--legend-bg:#F5F3FF"></i><span data-i18n="projects.graphLegendNodeVuln">VULN · 漏洞</span></span>
+                                                <span class="projects-graph-legend-item projects-graph-legend-item--node"><i style="--legend-color:#B45309;--legend-bg:#FFFBEB"></i><span data-i18n="projects.graphLegendNodeExploit">EXPLOIT · 利用</span></span>
+                                                <span class="projects-graph-legend-item projects-graph-legend-item--node projects-graph-legend-item--node-dashed"><i style="--legend-color:#CBD5E1;--legend-bg:#F1F5F9"></i><span data-i18n="projects.graphLegendNodeMissing">MISSING · 缺失</span></span>
+                                            </div>
+                                            <span class="projects-graph-legend-divider" aria-hidden="true"></span>
+                                            <div class="projects-graph-legend-group">
+                                                <span class="projects-graph-legend-heading" data-i18n="projects.graphLegendEdges">连线</span>
+                                                <span class="projects-graph-legend-item projects-graph-legend-item--edge"><i style="--legend-color:#4F46E5"></i><span data-i18n="projects.graphLegendDiscovered">discovered_on</span></span>
+                                                <span class="projects-graph-legend-item projects-graph-legend-item--edge"><i style="--legend-color:#64748B"></i><span data-i18n="projects.graphLegendLeads">leads_to</span></span>
+                                                <span class="projects-graph-legend-item projects-graph-legend-item--edge"><i style="--legend-color:#DC2626"></i><span data-i18n="projects.graphLegendExploits">exploits</span></span>
+                                                <span class="projects-graph-legend-item projects-graph-legend-item--edge projects-graph-legend-item--dashed"><i style="--legend-color:#94A3B8"></i><span data-i18n="projects.graphLegendTentative">待确认（虚线）</span></span>
+                                            </div>
                                         </div>
                                     </div>
                                 </div>