Add explainable AWS exposure rules

app/src/db.rs

@@ -2,8 +2,10 @@
 //! blocks on the engine; UI code reaches it through `smol::unblock`.
 
 use std::path::{Path, PathBuf};
+use std::sync::atomic::AtomicBool;
 use std::sync::{LazyLock, Mutex, PoisonError};
 
+use khonsu_core::explore::{Exploration, ExploreRequest};
 use khonsu_core::{AccessMode, Graph, GraphData, GraphSchema, Language, OpenError, QueryError, QueryOptions, QueryResult};
 use serde_json::Map;
 
@@ -91,6 +93,12 @@ pub fn neighbors(id: i64) -> Result<GraphData, QueryError> {
     with_graph(|g| g.neighbors(id, 200))
 }
 
+/// Holds the graph for the whole walk, as any call here does; `cancel` stops
+/// it between queries.
+pub fn explore(request: &ExploreRequest, cancel: &AtomicBool) -> Result<Exploration, QueryError> {
+    with_graph(|g| g.explore(request, cancel))
+}
+
 pub fn nodes_by_id(ids: &[i64]) -> Result<GraphData, QueryError> {
     with_graph(|g| g.nodes_by_id(ids))
 }

app/src/i18n.rs

@@ -332,6 +332,47 @@ static STRINGS: &[(&str, &str, &str)] = &[
     ("canvas.compact_hint", "滚轮缩放，悬停查看名称", "Scroll to zoom; hover to see names"),
     ("canvas.truncated", "显示 {} / {} 个节点", "Showing {} of {} nodes"),
     ("canvas.limit", "画布最多显示 {} 个节点，没有展开", "The canvas holds at most {} nodes; not expanded"),
+    ("evidence.title", "证据", "Evidence"),
+    ("evidence.id", "证据 ID", "Evidence ID"),
+    ("evidence.source", "数据源", "Source"),
+    ("evidence.plugin", "插件", "Plugin"),
+    ("evidence.written", "记录最后写入", "Record last written"),
+    ("evidence.last_sync", "数据源最后成功同步", "Source last synced"),
+    ("evidence.snapshot", "数据源快照", "Source snapshot"),
+    ("evidence.assertion", "断言", "Assertion"),
+    ("evidence.explicit", "数据源报告", "Reported by the source"),
+    ("evidence.derived", "由其他记录推导", "Derived from other records"),
+    ("evidence.unknown", "未提供", "Not supplied"),
+    ("evidence.not_stable", "内部 ID，重建图后可能改变", "An internal ID, which a rebuild can change"),
+    ("evidence.redacted", "已遮盖疑似机密：{}", "Masked as possible secrets: {}"),
+    ("evidence.copy", "复制证据 JSON", "Copy evidence as JSON"),
+    ("evidence.copy_path", "复制路径证据 JSON", "Copy path evidence as JSON"),
+    ("explore.title", "路径探索", "Path Explorer"),
+    ("explore.out", "沿箭头", "Outbound"),
+    ("explore.in", "逆箭头", "Inbound"),
+    ("explore.both", "双向", "Both"),
+    ("explore.hops", "最多 {} 跳", "Up to {} hops"),
+    ("explore.fewer_hops", "减少跳数", "Fewer hops"),
+    ("explore.more_hops", "增加跳数", "More hops"),
+    ("explore.types_all", "全部关系类型", "All relationship types"),
+    ("explore.types_some", "关系类型：{} 种", "Relationship types: {}"),
+    ("explore.add_start", "加为起点", "Add as a start"),
+    ("explore.remove_start", "移出起点", "Remove from starts"),
+    ("explore.starts", "起点：{} 个", "Starts: {}"),
+    ("explore.run", "探索", "Explore"),
+    ("explore.cancel", "取消", "Cancel"),
+    ("explore.back", "返回上一步", "Back"),
+    ("explore.show_path", "只看这条路径", "Show only this path"),
+    ("explore.path", "到此节点的路径", "Path to this node"),
+    ("explore.found", "节点：{}，关系：{}，深度：{}", "Nodes: {}, relationships: {}, depth: {}"),
+    ("explore.none", "没有符合筛选条件的关系", "No relationships match these filters"),
+    ("explore.limit.hops", "已到跳数上限，可能还有更远的节点", "Stopped at the hop limit; there is more beyond it"),
+    ("explore.limit.nodes", "已到节点上限，结果不完整", "Stopped at the node limit; this result is incomplete"),
+    ("explore.limit.edges", "已到关系上限，结果不完整", "Stopped at the relationship limit; this result is incomplete"),
+    ("explore.cancelled", "已取消，结果不完整", "Cancelled; this result is incomplete"),
+    ("explore.missing_start", "有起点已不在图中", "A start is no longer in the graph"),
+    ("explore.failed", "探索失败：{}", "Exploring failed: {}"),
+    ("explore.candidate", "路径来自配置数据，不代表实际可达", "A path in the data, not proof that it can be reached"),
 
     // ── status bar ──────────────────────────────────────────────────────
     ("status_bar.opening", "正在打开…", "Opening…"),

app/src/setup.rs

@@ -312,6 +312,8 @@ pub fn agent_prompt() -> String {
          `{command} schema --db <graph>`.\n\
          - HawDB's Cypher has no labels(), and path variables only with shortestPath; \
          return whole nodes and relationships to get a graph back.\n\
+         - To follow a suspected chain within caps: `{command} explore --db <graph> --from <node> --to <node>`; \
+         check `complete` before treating a missing path as an answer.\n\
          - Validate a dashboard with `{command} check <file.dash> --db <graph>`; \
          answer my comments on it with `{command} comments <file.dash>`.\n\
          - Reads are the default. Answer from the values it returns, check `truncated`, \