@kenhkl/agent-moss 0.10.5 → 0.11.0

package/dist/server.js

@@ -55,11 +55,13 @@ __export(config_exports, {
   isHeuristicEnabled: () => isHeuristicEnabled,
   isLLMAvailable: () => isLLMAvailable,
   isLogicRulesEnabled: () => isLogicRulesEnabled,
+  probeLLMConnection: () => probeLLMConnection,
   updateLLMConfig: () => updateLLMConfig
 });
 import fs from "fs";
 import path2 from "path";
 import os from "os";
+import { fileURLToPath as fileURLToPath2 } from "url";
 function loadConfigFile(filePath) {
   try {
     const raw = fs.readFileSync(filePath, "utf-8");
@@ -122,16 +124,38 @@ function getTimeoutConfig() {
 function getRetryConfig() {
   return retryConfig;
 }
+function wildcardToRegExp(pattern) {
+  return pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/\\\*/g, ".*");
+}
 function loadCustomRules() {
+  const rules = [];
   try {
     const raw = process.env.AGENT_MOSS_CUSTOM_RULES;
-    if (!raw) return [];
-    const parsed = JSON.parse(raw);
-    if (!Array.isArray(parsed)) return [];
-    return parsed.filter((r) => r.pattern && r.action);
+    if (raw) {
+      const parsed = JSON.parse(raw);
+      if (Array.isArray(parsed)) {
+        for (const r of parsed) {
+          if (r && r.pattern && r.action) rules.push({ pattern: r.pattern, action: r.action, severity: r.severity || "high" });
+        }
+      }
+    }
   } catch {
-    return [];
   }
+  for (const rulesPath of USER_RULES_PATHS) {
+    try {
+      if (!fs.existsSync(rulesPath)) continue;
+      const data = JSON.parse(fs.readFileSync(rulesPath, "utf-8"));
+      const actions = Array.isArray(data?.sensitive_actions) ? data.sensitive_actions : [];
+      for (const r of actions) {
+        const p = r?.pattern;
+        if (!p) continue;
+        rules.push({ pattern: wildcardToRegExp(p), action: "Deny", severity: "high" });
+      }
+      break;
+    } catch {
+    }
+  }
+  return rules;
 }
 function getLLMConfig() {
   return llmConfig;
@@ -146,6 +170,30 @@ function isLLMAvailable() {
   if (process.env.AGENT_MOSS_DISABLE_LLM === "1") return false;
   return llmConfig.apiKey.length > 0;
 }
+async function probeLLMConnection(timeoutMs = 8e3) {
+  if (!isLLMAvailable()) return false;
+  const OpenAI2 = (await import("openai")).default;
+  const config = getLLMConfig();
+  const provider = detectProvider(config.baseUrl, config.provider);
+  const extraHeaders = getProviderHeaders(provider);
+  const client = new OpenAI2({
+    baseURL: config.baseUrl,
+    apiKey: config.apiKey,
+    timeout: timeoutMs,
+    maxRetries: 0,
+    defaultHeaders: Object.keys(extraHeaders).length > 0 ? extraHeaders : void 0
+  });
+  try {
+    const resp = await client.chat.completions.create({
+      model: config.model,
+      messages: [{ role: "user", content: "ping" }],
+      max_tokens: 1
+    });
+    return !!(resp && resp.choices && resp.choices[0]);
+  } catch {
+    return false;
+  }
+}
 function getLLMFailMode() {
   const val = (process.env.AGENT_MOSS_LLM_FAIL_MODE || "fail_open").toLowerCase();
   return val === "fail_closed" ? "fail_closed" : "fail_open";
@@ -189,7 +237,7 @@ function isHeuristicEnabled() {
 function isLogicRulesEnabled() {
   return process.env.AGENT_MOSS_DISABLE_LOGIC_RULES !== "1";
 }
-var timeoutConfig, retryConfig, llmConfig, customRules, PROVIDER_HEADERS;
+var timeoutConfig, retryConfig, llmConfig, __configModuleDir, USER_RULES_PATHS, customRules, PROVIDER_HEADERS;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
@@ -211,6 +259,21 @@ var init_config = __esm({
         timeout: parseInt(process.env.AGENT_MOSS_LLM_TIMEOUT || String(fileConfig.timeout ?? String(tr.timeout.prompt1Timeout)), 10)
       };
     })();
+    __configModuleDir = (() => {
+      try {
+        return path2.dirname(fileURLToPath2(import.meta.url));
+      } catch {
+        return typeof __dirname !== "undefined" ? __dirname : process.cwd();
+      }
+    })();
+    USER_RULES_PATHS = [
+      path2.join(__configModuleDir, "rules", "user_rules.json"),
+      // 源在 ts/src/rules（一般不存在）
+      path2.join(__configModuleDir, "..", "rules", "user_rules.json"),
+      // dist: dist/engine/../rules = dist/rules ✅
+      path2.join(__configModuleDir, "..", "..", "agent_moss", "rules", "user_rules.json")
+      // dev src: ts/src/../../agent_moss
+    ];
     customRules = loadCustomRules();
     PROVIDER_HEADERS = {
       "openrouter": {
@@ -227,7 +290,17 @@ var init_config = __esm({
 // src/engine/inline-analyzer.ts
 function isLiteralTextCommand(command) {
   ECHO_CMD_RE.lastIndex = 0;
-  return ECHO_CMD_RE.test(command);
+  if (!ECHO_CMD_RE.test(command)) return false;
+  if (command.includes(">")) {
+    let d = command.replace(/<=>|>=|<=|<>|=>/g, " ");
+    d = d.replace(/(?:2|&|1)?\s*>\s*\/dev\/null\b/g, "");
+    d = d.replace(new RegExp(`>{1,2}\\s*(['"])([~./][^'"]+)\\1`, "g"), (_m, _q, p) => ">" + p);
+    d = d.replace(/'[^']*'|"[^"]*"/g, "");
+    if (/>{1,2}\s*(?!&)\S/.test(d)) {
+      return false;
+    }
+  }
+  return true;
 }
 function extractInlineCode(command) {
   const parts = [];
@@ -304,7 +377,7 @@ function analyzeInlineScript(command) {
     riskType: "file_access"
   };
 }
-var INLINE_CODE_RE, ECHO_STRING_RE, ECHO_CMD_RE, READ_WRITE_KEYWORDS, WRITE_EXEC_CHAIN_PATTERNS, SENSITIVE_PATH_FRAGMENTS, REDIRECT_TO_SENSITIVE_RE, DIR_TRAVERSAL_KEYWORDS;
+var INLINE_CODE_RE, ECHO_STRING_RE, ECHO_CMD_RE, READ_WRITE_KEYWORDS, WRITE_EXEC_CHAIN_PATTERNS, SHELL_RC_FRAGMENTS, SENSITIVE_PATH_FRAGMENTS, REDIRECT_TO_SENSITIVE_RE, DIR_TRAVERSAL_KEYWORDS;
 var init_inline_analyzer = __esm({
   "src/engine/inline-analyzer.ts"() {
     "use strict";
@@ -374,6 +447,13 @@ var init_inline_analyzer = __esm({
       // xargs bash / xargs sh
       /\|\s*xargs\s+(?:bash|sh|zsh)/gi
     ];
+    SHELL_RC_FRAGMENTS = [
+      ".bashrc",
+      ".zshrc",
+      ".profile",
+      ".bash_profile",
+      ".zprofile"
+    ];
     SENSITIVE_PATH_FRAGMENTS = [
       "/etc/shadow",
       "/etc/gshadow",
@@ -390,9 +470,10 @@ var init_inline_analyzer = __esm({
       "/dev/kmsg",
       ".ssh/id_rsa",
       ".ssh/id_ed25519",
-      ".ssh/authorized_keys"
+      ".ssh/authorized_keys",
+      ...SHELL_RC_FRAGMENTS
     ];
-    REDIRECT_TO_SENSITIVE_RE = new RegExp(`>{1,2}\\s*(${SENSITIVE_PATH_FRAGMENTS.map((p) => p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})`, "i");
+    REDIRECT_TO_SENSITIVE_RE = new RegExp(`>{1,2}\\s*(?:\\S*/)?(${SENSITIVE_PATH_FRAGMENTS.map((p) => p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})(?:\\s|$)`, "i");
     DIR_TRAVERSAL_KEYWORDS = [
       // Python 目录遍历
       "os.listdir",
@@ -415,11 +496,34 @@ function isWriteOperation(actionType, actionDetail, writeKeywords = WRITE_KEYWOR
   if (writeKeywords.some((kw) => actionType.includes(kw) || actionDetail.includes(kw))) return true;
   if (WRITE_COMMAND_RES.some((rx) => rx.test(actionDetail))) return true;
   if (/\bsed\s+-[a-zA-Z]*i/i.test(actionDetail)) return true;
+  for (const seg of actionDetail.split(/&&|\|\||;|\n/)) {
+    const trimmed = seg.trim();
+    if (!trimmed) continue;
+    const parts = trimmed.split(/\s+/);
+    const fw = parts[0]?.toLowerCase() || "";
+    if (fw === "wget" || fw === "curl") {
+      const isStdout = /\s(?:-O|-o)-(?:\s|$)/.test(trimmed) || /\s--output-document=-(?:\s|$)/i.test(trimmed) || /\s--output=-(?:\s|$)/i.test(trimmed);
+      if (isStdout) continue;
+      const isDevnull = /\s(?:-O|--output-document|--output)\s*\/dev\/null(?:\s|$)/i.test(trimmed) || /\s(?:-O|--output-document|--output)=[/]?dev\/null(?:\s|$)/i.test(trimmed);
+      if (isDevnull) continue;
+      if (/\s(?:-O|--output-document|--output)(?:=|\s|$)/i.test(trimmed) || /\s-O\S/.test(trimmed)) {
+        return true;
+      }
+    }
+    if (fw === "rsync" && !/--list-only|--dry-run/i.test(trimmed) && !/(^|[^a-zA-Z])-n([^a-zA-Z]|$)/.test(trimmed)) {
+      return true;
+    }
+  }
   if (actionDetail.includes(">")) {
-    const detailWithoutDevnull = actionDetail.replace(DEVNULL_REDIRECT_RE, "");
-    if (detailWithoutDevnull.includes(">")) {
-      const firstWord = actionDetail.trim().split(/\s+/)[0]?.toLowerCase() || "";
-      if (!READ_ONLY_COMMANDS.has(firstWord)) return true;
+    const detailWithoutCompare = actionDetail.replace(/<=>|>=|<=|<>|=>/g, " ");
+    const detailWithoutDevnull = detailWithoutCompare.replace(DEVNULL_REDIRECT_RE, "");
+    const detailUnquotedRedirect = detailWithoutDevnull.replace(
+      />{1,2}\s*(['"])([~./][^'"]+)\1/g,
+      (_m, _q, p) => ">" + p
+    );
+    const detailWithoutQuotes = detailUnquotedRedirect.replace(/'[^']*'|"[^"]*"/g, "");
+    if (/>{1,2}\s*(?!&)\S/.test(detailWithoutQuotes)) {
+      return true;
     }
   }
   return false;
@@ -443,27 +547,31 @@ function runLogicCheck(input) {
   if (rbwResult) return rbwResult;
   if (input.promptSession && input.promptSession.trim()) {
     if (!isExcludedType) {
-      const promptLower = input.promptSession.toLowerCase();
-      for (const pattern of INTENT_DEVIATION_PATTERNS) {
-        const intentMatched = pattern.intentKeywords.some((kw) => promptLower.includes(kw));
-        const dangerousMatched = pattern.dangerousActions.some((kw) => matchDangerousAction(actionDetail, kw));
-        if (intentMatched && dangerousMatched) {
-          return {
-            allowed: false,
-            reason: pattern.reason,
-            riskLevel: "high",
-            riskType: "intent_deviation",
-            confidence: 85,
-            source: "logic_rule",
-            violatedLayers: ["2"]
-          };
+      if (INLINE_SCRIPT_RE.test(actionDetail)) {
+      } else {
+        const promptLower = input.promptSession.toLowerCase();
+        for (const pattern of INTENT_DEVIATION_PATTERNS) {
+          const intentMatched = pattern.intentKeywords.some((kw) => promptLower.includes(kw));
+          const dangerousMatched = pattern.dangerousActions.some((kw) => matchDangerousAction(actionDetail, kw));
+          if (intentMatched && dangerousMatched) {
+            return {
+              allowed: false,
+              reason: pattern.reason,
+              riskLevel: "high",
+              riskType: "intent_deviation",
+              confidence: 85,
+              source: "logic_rule",
+              violatedLayers: ["2"]
+            };
+          }
         }
       }
     }
   }
   const indirectResult = checkIndirectFileAccess(actionType, actionDetail, resolvedCwd);
   if (indirectResult) return indirectResult;
-  if (actionDetail.includes("sudo") || actionDetail.includes("su -") || actionDetail.includes("chmod u+s") || actionDetail.includes("setuid")) {
+  if (INLINE_SCRIPT_RE.test(actionDetail)) {
+  } else if (containsPrivilegeEscalation(actionDetail)) {
     const detailAfterSudo = actionDetail.replace(/(^|\|\||&&|\s)sudo\s+/g, " ");
     const isAdminCmd = ["apt", "systemctl", "yum", "dnf", "pacman", "zypper", "apk"].some((kw) => detailAfterSudo.includes(kw));
     if (!isAdminCmd) {
@@ -493,6 +601,9 @@ function extractFilePaths(text) {
   const paths = [];
   const unixPaths = text.match(/(?:^|\s)(\/[^\s;|&><'"]+)/g);
   if (unixPaths) paths.push(...unixPaths.map((p) => p.trim()));
+  const textNoQuotes = text.replace(/'[^']*'|"[^"]*"/g, "");
+  const kvPaths = textNoQuotes.match(/(?:=)(\/[^\s;|&><'"]+)/g);
+  if (kvPaths) paths.push(...kvPaths.map((p) => p.replace(/^=/, "")));
   const quotedPaths = text.match(/["']\/([^"']+)["']/g);
   if (quotedPaths) paths.push(...quotedPaths.map((p) => p.replace(/["']/g, "")));
   return [...new Set(paths)];
@@ -503,8 +614,74 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
   const isBashLike = actionType === "bash" || actionType === "executebash" || actionType === "terminal-executebash";
   const isWrite = isBashLike ? isWriteOperation(actionType, actionDetail) : WRITE_KEYWORDS.some((kw) => actionType.includes(kw));
   if (!isWrite) return null;
-  const targetPaths = extractFilePaths(actionDetail);
-  if (targetPaths.length === 0) return null;
+  const WRITE_CMDS = /* @__PURE__ */ new Set(["cp", "mv", "install", "tee", "dd", "truncate", "mkfs", "fdisk", "parted"]);
+  if (isBashLike) {
+    const detailNoCompare = actionDetail.replace(/<=>|>=|<=|<>|=>/g, " ");
+    const detailNoDevnull = detailNoCompare.replace(DEVNULL_REDIRECT_RE, "");
+    const detailUnquotedRedirect = detailNoDevnull.replace(
+      />{1,2}\s*(['"])([~./][^'"]+)\1/g,
+      (_m, _q, p) => ">" + p
+    );
+    const detailNoQuotes = detailUnquotedRedirect.replace(/'[^']*'|"[^"]*"/g, "");
+    const hasRedirectWrite = />{1,2}\s*(?!&)\S/.test(detailNoQuotes);
+    let hasWriteSeg = hasRedirectWrite;
+    if (!hasWriteSeg) {
+      for (const seg of actionDetail.split(/&&|\|\||;|\n/)) {
+        const trimmed = seg.trim();
+        if (!trimmed) continue;
+        const fw = trimmed.split(/\s+/)[0]?.toLowerCase() || "";
+        if (WRITE_CMDS.has(fw) || /\bsed\s+-[a-zA-Z]*i/i.test(trimmed)) {
+          hasWriteSeg = true;
+          break;
+        }
+        if ((fw === "wget" || fw === "curl") && (/\s(?:-O|--output-document|--output)(?:=|\s|$)/i.test(trimmed) || /\s-O\S/.test(trimmed))) {
+          hasWriteSeg = true;
+          break;
+        }
+        if (fw === "rsync" && !/--list-only|--dry-run/i.test(trimmed) && !/(^|[^a-zA-Z])-n([^a-zA-Z]|$)/.test(trimmed)) {
+          hasWriteSeg = true;
+          break;
+        }
+      }
+    }
+    if (!hasWriteSeg) return null;
+  }
+  const SOURCE_ARG_CMDS = /* @__PURE__ */ new Set(["cp", "mv", "install", "rsync"]);
+  const REDIRECT_TARGET_RE = new RegExp(`>{1,2}\\s*(?!&)(?:'(/[^']+)'|"(/[^\\"]+)"|(/[^\\s;|&><'\\"]+))`);
+  const targetPaths = [];
+  for (const seg of actionDetail.split(/&&|\|\||;|\n/)) {
+    const trimmed = seg.trim();
+    if (!trimmed) continue;
+    const firstWord = trimmed.split(/\s+/)[0]?.toLowerCase() || "";
+    if (firstWord === "cd") {
+      continue;
+    }
+    if (READ_ONLY_COMMANDS.has(firstWord)) {
+      const segUnquoted = trimmed.replace(new RegExp(`>{1,2}\\s*(['"])([~./][^'"]+)\\1`, "g"), (_m, _q, p) => ">" + p);
+      const segNoDevnull = segUnquoted.replace(DEVNULL_REDIRECT_RE, "");
+      const segNoQuotes = segNoDevnull.replace(/'[^']*'|"[^"]*"/g, "");
+      const m = segNoQuotes.match(REDIRECT_TARGET_RE);
+      if (m) targetPaths.push(m[1] || m[2] || m[3]);
+      continue;
+    }
+    const segPaths = extractFilePaths(trimmed);
+    const segPathsFiltered = firstWord === "wget" || firstWord === "curl" ? segPaths.filter((p) => p !== "/dev/null") : segPaths;
+    if (SOURCE_ARG_CMDS.has(firstWord)) {
+      if (segPathsFiltered.length > 1) targetPaths.push(...segPathsFiltered.slice(1));
+    } else if (firstWord === "dd") {
+      const ifSourceMatches = trimmed.match(/\bif=(\/[^\s;|&><'"]+)/g);
+      const ifSourcePaths = new Set(ifSourceMatches ? ifSourceMatches.map((m) => m.replace(/^if=/, "")) : []);
+      const devNullMatches = trimmed.match(/\bof=(\/dev\/\S+)/g);
+      const devNullTargets = new Set(devNullMatches ? devNullMatches.map((m) => m.replace(/^of=/, "")) : []);
+      for (const sp of segPaths) {
+        if (!ifSourcePaths.has(sp) && !devNullTargets.has(sp)) targetPaths.push(sp);
+      }
+    } else {
+      targetPaths.push(...segPathsFiltered);
+    }
+  }
+  const uniqueTargetPaths = [...new Set(targetPaths)];
+  if (uniqueTargetPaths.length === 0) return null;
   const historyReadPaths = /* @__PURE__ */ new Set();
   for (const action of actionHistory) {
     const histDetail = action.actionDetail.toLowerCase();
@@ -517,7 +694,7 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
     }
   }
   const unreadPaths = [];
-  for (const path3 of targetPaths) {
+  for (const path3 of uniqueTargetPaths) {
     const hasRead = [...historyReadPaths].some(
       (rp) => path3 === rp || path3.startsWith(rp) || rp.startsWith(path3)
     );
@@ -580,6 +757,18 @@ function checkUserDeletionConsent(actionType, actionDetail, actionHistory) {
     violatedLayers: ["2"]
   };
 }
+function containsPrivilegeEscalation(actionDetail) {
+  const ad = actionDetail.toLowerCase();
+  for (const seg of ad.split(/&&|\|\||;|\n/)) {
+    const trimmed = seg.trim();
+    if (!trimmed) continue;
+    const parts = trimmed.split(/\s+/);
+    const fw = parts[0]?.toLowerCase() || "";
+    if (fw === "sudo" || fw === "su" || fw === "setuid") return true;
+    if (fw === "chmod" && /\bu\s*\+\s*s\b/.test(trimmed)) return true;
+  }
+  return false;
+}
 function checkIndirectFileAccess(actionType, actionDetail, cwd) {
   if (actionType !== "bash" && actionType !== "executebash" && actionType !== "terminal-executebash") {
     return null;
@@ -684,12 +873,13 @@ var init_logic_rules = __esm({
       { path: "/sys/", riskLevel: "high", desc: "sysfs \u5185\u6838\u63A5\u53E3" },
       // 设备文件（/dev/null、/dev/zero、/dev/urandom 已移除，误报率极高）
       { path: "/dev/random", riskLevel: "high", desc: "\u963B\u585E\u5F0F\u968F\u673A\u6570\u8BBE\u5907\uFF08\u8BFB\u53D6\u8017\u5C3D\u71B5\u6C60\uFF09" },
-      { path: "/dev/mem", riskLevel: "critical", desc: "\u7269\u7406\u5185\u5B58\u8BBF\u95EE\u8BBE\u5907" },
+      { path: "/dev/mem", riskLevel: "critical", desc: "\u7269\u7406\u5185\u5B58\u8BBF\u95EE\u8BBE\u5907\uFF08\u8BFB\u5199\u5747\u5371\u9669\uFF09", credential: true },
       { path: "/dev/kmsg", riskLevel: "high", desc: "\u5185\u6838\u6D88\u606F\u7F13\u51B2\u533A" },
       // SSH 主机私钥
-      { path: "/etc/ssh/ssh_host_rsa_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A RSA \u79C1\u94A5", credential: true },
-      { path: "/etc/ssh/ssh_host_ed25519_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A Ed25519 \u79C1\u94A5", credential: true },
-      { path: "/etc/ssh/ssh_host_ecdsa_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A ECDSA \u79C1\u94A5", credential: true }
+      // SSH 主机私钥（排除 .pub 公钥变体，对齐 Python .ssh/id_rsa(?!\.pub) 范式）
+      { path: "/etc/ssh/ssh_host_rsa_key(?!\\.pub)", riskLevel: "critical", desc: "SSH \u4E3B\u673A RSA \u79C1\u94A5", credential: true },
+      { path: "/etc/ssh/ssh_host_ed25519_key(?!\\.pub)", riskLevel: "critical", desc: "SSH \u4E3B\u673A Ed25519 \u79C1\u94A5", credential: true },
+      { path: "/etc/ssh/ssh_host_ecdsa_key(?!\\.pub)", riskLevel: "critical", desc: "SSH \u4E3B\u673A ECDSA \u79C1\u94A5", credential: true }
     ];
     HOME_SENSITIVE_PATHS = [
       { path: ".ssh/id_rsa", riskLevel: "critical", desc: "SSH \u79C1\u94A5", credential: true },
@@ -730,7 +920,7 @@ var init_logic_rules = __esm({
       "cat"
     ]);
     NON_WRITE_TOOL_PREFIXES = ["memory-", "skill-manager-", "mailbox-", "app-"];
-    WRITE_KEYWORDS = ["write", "\u5199\u5165", "save", "\u4FDD\u5B58", "modify", "\u4FEE\u6539", "update", "\u66F4\u65B0", "delete", "\u5220\u9664", "remove", "\u79FB\u9664", "create", "\u521B\u5EFA", "append", "\u8FFD\u52A0", "truncate", "\u622A\u65AD", "overwrite", "\u8986\u76D6", "replace", "\u66FF\u6362"];
+    WRITE_KEYWORDS = ["write", "\u5199\u5165", "save", "\u4FDD\u5B58", "modify", "\u4FEE\u6539", "update", "\u66F4\u65B0", "delete", "\u5220\u9664", "remove", "\u79FB\u9664", "create", "\u521B\u5EFA", "append", "\u8FFD\u52A0", "truncate", "\u622A\u65AD", "overwrite", "\u8986\u76D6", "replace", "\u66FF\u6362", "edit"];
     WRITE_COMMAND_RES = [
       /\brm\b/,
       /\bunlink\b/,
@@ -776,6 +966,12 @@ var init_logic_rules = __esm({
       "nl",
       "tac",
       "rev",
+      // NEW-FP-I: echo/printf 是文本输出命令，参数是字面量非写目标。加入此集让
+      // read_before_write 的 echo 段走只读命令分支（只提取重定向目标，不提取参数路径），
+      // 避免 echo "cat /etc/shadow" > /tmp/x.sh 的引号内 /etc/shadow 被当写目标误报。
+      // echo "x" > /tmp/x.sh 的重定向目标 /tmp/x.sh 仍被提取（真实写不漏报）。
+      "echo",
+      "printf",
       "lsblk",
       "blockdev",
       "smartctl",
@@ -828,7 +1024,7 @@ var init_logic_rules = __esm({
       "modinfo",
       "sysctl"
     ]);
-    DEVNULL_REDIRECT_RE = /(?:2|&|1)?\s*>\s*\/dev\/null\b/;
+    DEVNULL_REDIRECT_RE = /(?:2|&|1)?\s*>\s*\/dev\/null\b/g;
     READ_KEYWORDS = ["read", "\u8BFB\u53D6", "cat", "head", "tail", "less", "more", "view", "\u67E5\u770B", "open", "\u6253\u5F00", "load", "\u52A0\u8F7D", "grep", "search", "\u641C\u7D22", "find", "\u67E5\u627E"];
     CREATE_KEYWORDS = ["\u521B\u5EFA", "\u65B0\u5EFA", "create", "new file", "touch"];
     PASSWORD_MODIFY_PATTERNS = [
@@ -878,7 +1074,7 @@ var init_logic_rules = __esm({
 // src/engine/skill-loader.ts
 import { readFileSync, readdirSync as readdirSync2, existsSync as existsSync2 } from "fs";
 import { resolve, dirname } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { fileURLToPath as fileURLToPath3 } from "url";
 function loadAllSkills() {
   if (cachedSkills) return cachedSkills;
   cachedSkills = {};
@@ -949,7 +1145,7 @@ var init_skill_loader = __esm({
   "src/engine/skill-loader.ts"() {
     "use strict";
     init_esm_shims();
-    __filename2 = fileURLToPath2(import.meta.url);
+    __filename2 = fileURLToPath3(import.meta.url);
     __dirname2 = dirname(__filename2);
     SKILLS_DIR = resolve(__dirname2, "../skills");
     SKILLS_DIR_FALLBACK = resolve(__dirname2, "../../../agent_moss/skills");
@@ -1024,7 +1220,7 @@ __export(runtime_config_exports, {
 import { readFileSync as readFileSync2, writeFileSync, existsSync as existsSync3, mkdirSync, unlinkSync, readdirSync as readdirSync3 } from "fs";
 import { join } from "path";
 import { homedir } from "os";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { fileURLToPath as fileURLToPath4 } from "url";
 import { dirname as dirname2 } from "path";
 function getRuntimeConfigPath() {
   const envPath = process.env[ENV_RUNTIME_CONFIG_PATH];
@@ -1880,7 +2076,7 @@ var init_runtime_config = __esm({
     init_heuristic();
     init_logic_rules();
     init_skill_loader();
-    __dirname3 = dirname2(fileURLToPath3(import.meta.url));
+    __dirname3 = dirname2(fileURLToPath4(import.meta.url));
     RUNTIME_CONFIG_DIR = join(homedir(), ".config", "agentmoss");
     RUNTIME_CONFIG_PATH = join(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
     ENV_RUNTIME_CONFIG_PATH = "AGENT_MOSS_RUNTIME_CONFIG_PATH";
@@ -1903,7 +2099,7 @@ var init_runtime_config = __esm({
 // src/agents/index.ts
 import { readFileSync as readFileSync3, existsSync as existsSync4 } from "fs";
 import { resolve as resolve2, dirname as dirname3 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
+import { fileURLToPath as fileURLToPath5 } from "url";
 function resolveAgentsDir() {
   if (existsSync4(AGENTS_DIR_PROD)) return AGENTS_DIR_PROD;
   if (existsSync4(AGENTS_DIR_DEV_FALLBACK)) return AGENTS_DIR_DEV_FALLBACK;
@@ -1952,7 +2148,7 @@ var init_agents = __esm({
   "src/agents/index.ts"() {
     "use strict";
     init_esm_shims();
-    __filename3 = fileURLToPath4(import.meta.url);
+    __filename3 = fileURLToPath5(import.meta.url);
     __dirname4 = dirname3(__filename3);
     AGENTS_DIR_PROD = resolve2(__dirname4, "agents");
     AGENTS_DIR_DEV_FALLBACK = resolve2(__dirname4, "../../../agent_moss/agents");
@@ -1972,19 +2168,25 @@ function runHeuristicCheck(input) {
       const re = new RegExp(rule.pattern);
       if (re.test(command)) {
         if (rule.action === "Deny") {
-          matched.push(`\u81EA\u5B9A\u4E49\u89C4\u5219: ${rule.pattern}`);
-          if (severityRank(rule.severity) > severityRank(highestSeverity)) {
-            highestSeverity = rule.severity;
-            highestRiskType = "custom_rule";
-          }
+          return {
+            allowed: false,
+            reason: `\u547D\u4E2D\u7528\u6237\u654F\u611F\u52A8\u4F5C\u89C4\u5219: ${rule.description || rule.pattern}`,
+            riskLevel: rule.severity,
+            riskType: "sensitive_action",
+            confidence: 90,
+            source: "heuristic",
+            violatedLayers: ["1.1"]
+          };
         }
       }
     } catch {
     }
   }
+  const scanDetail = stripLiteralTextSegments(input.aNext.actionDetail);
+  const scanCommand = `${input.aNext.actionType}: ${scanDetail}`;
   let topRiskType = "";
   for (const rule of DANGEROUS_PATTERNS) {
-    if (rule.pattern.test(command)) {
+    if (rule.pattern.test(scanCommand)) {
       matched.push(rule.description);
       if (severityRank(rule.severity) > severityRank(highestSeverity)) {
         highestSeverity = rule.severity;
@@ -1998,7 +2200,7 @@ function runHeuristicCheck(input) {
     for (const rule of agentExt.extra_command_patterns) {
       try {
         const re = new RegExp(rule.pattern, "i");
-        if (re.test(command)) {
+        if (re.test(scanCommand)) {
           matched.push(`agent \u4E13\u5C5E\u89C4\u5219: ${rule.reason}`);
           if (severityRank(rule.risk_level) > severityRank(highestSeverity)) {
             highestSeverity = rule.risk_level;
@@ -2022,14 +2224,12 @@ function runHeuristicCheck(input) {
   const actionTypeL = input.aNext.actionType.toLowerCase();
   const detailL = input.aNext.actionDetail.toLowerCase();
   const isExcludedType = SENSITIVE_EXCLUDED_PREFIXES.some((p) => actionTypeL.startsWith(p));
+  const dangerousResult = checkDangerousPatterns(actionTypeL, detailL);
+  if (dangerousResult) return dangerousResult;
   if (!isExcludedType) {
     const pathResult = checkSensitivePath(detailL, input.cwd || "/", agentExt);
     if (pathResult) return pathResult;
   }
-  const dangerousResult = checkDangerousPatterns(actionTypeL, detailL);
-  if (dangerousResult) return dangerousResult;
-  const lateralResult = checkLateralMovement(detailL);
-  if (lateralResult) return lateralResult;
   if (matched.length > 0) {
     return {
       allowed: false,
@@ -2042,6 +2242,8 @@ function runHeuristicCheck(input) {
       // 对齐 py coordinator.py:165（L1.1 = 命中高危命令模式/注入关键词）
     };
   }
+  const lateralResult = checkLateralMovement(detailL);
+  if (lateralResult) return lateralResult;
   return null;
 }
 function checkInjectionKeywords(text, extraKeywords) {
@@ -2064,6 +2266,68 @@ function isInlineScriptCommand(actionDetail) {
   const re = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
   return re.test(actionDetail);
 }
+function stripLiteralTextSegments(actionDetail) {
+  const writeScriptExec = />\s*[/~]\S*\.(sh|py|pl|rb)\b/.test(actionDetail) && /(?:&&|\|\||;|\n|\|)\s*(?:bash|sh|zsh|dash|python|perl|ruby|node)/.test(actionDetail);
+  const pipeToInterpreter = /\|\s*(?:bash|sh|zsh|dash|python|perl|ruby|node)\b/.test(actionDetail);
+  if (writeScriptExec || pipeToInterpreter) {
+    return actionDetail;
+  }
+  const resultParts = [];
+  for (const seg of splitCommandSegments(actionDetail)) {
+    const fw = (seg.trim().split(/\s+/)[0] || "").toLowerCase();
+    if (fw === "echo" || fw === "printf") {
+      const segUnquotedRedirect = seg.replace(
+        />{1,2}\s*(['"])([~./][^'"]+)\1/g,
+        (_m, _q, p) => ">" + p
+      );
+      resultParts.push(segUnquotedRedirect.replace(/'[^']*'|"[^"]*"/g, ""));
+    } else {
+      resultParts.push(seg);
+    }
+  }
+  return resultParts.join("");
+}
+function splitCommandSegments(actionDetail) {
+  const segments = [];
+  let cur = "";
+  let quote = null;
+  for (let i = 0; i < actionDetail.length; i++) {
+    const ch = actionDetail[i];
+    if (quote) {
+      cur += ch;
+      if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      cur += ch;
+      continue;
+    }
+    if (ch === ";" || ch === "\n") {
+      segments.push(cur);
+      segments.push(ch);
+      cur = "";
+      continue;
+    }
+    if (ch === "&" && actionDetail[i + 1] === "&") {
+      segments.push(cur);
+      segments.push("&&");
+      cur = "";
+      i++;
+      continue;
+    }
+    if (ch === "|" && actionDetail[i + 1] === "|") {
+      segments.push(cur);
+      segments.push("||");
+      cur = "";
+      i++;
+      continue;
+    }
+    cur += ch;
+  }
+  if (cur) segments.push(cur);
+  return segments;
+}
 function severityRank(s) {
   const ranks = { low: 1, medium: 2, high: 3, critical: 4 };
   return ranks[s] || 0;
@@ -2071,13 +2335,18 @@ function severityRank(s) {
 function checkSensitivePath(command, cwd, agentExt) {
   const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
   const isWriteOpFlag = isWriteOperation("", command);
+  const pathScanText = stripLiteralTextSegments(command);
   const pathMatches = (text, path3) => {
-    const escaped = path3.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const parts = path3.split(/(\(\?!.*?\))/);
+    const escaped = parts.map((part) => {
+      if (part.startsWith("(?!")) return part;
+      return part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    }).join("");
     const re = path3.startsWith(".") || path3.startsWith("/") ? new RegExp(`(?:^|[\\s/\\\\'"])${escaped}\\b`, "i") : new RegExp(`\\b${escaped}\\b`, "i");
     return re.test(text);
   };
   for (const sp of ROOT_SENSITIVE_PATHS) {
-    if (pathMatches(command, sp.path.toLowerCase())) {
+    if (pathMatches(pathScanText, sp.path.toLowerCase())) {
       if (sp.path === "/dev/random") {
         if (isWriteOpFlag) {
           continue;
@@ -2111,7 +2380,7 @@ function checkSensitivePath(command, cwd, agentExt) {
     const expanded = `${expandedCwd}/${sp.path}`;
     const pathRe = sp.path.endsWith(".pub") ? new RegExp(sp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i") : new RegExp(sp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "(?!\\.pub)", "i");
     const expandedRe = sp.path.endsWith(".pub") ? new RegExp(expanded.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i") : new RegExp(expanded.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "(?!\\.pub)", "i");
-    if (pathRe.test(command) || expandedRe.test(command)) {
+    if (pathRe.test(pathScanText) || expandedRe.test(pathScanText)) {
       if (!isWriteOpFlag && !sp.credential) {
         continue;
       }
@@ -2182,8 +2451,10 @@ function checkSensitivePath(command, cwd, agentExt) {
 }
 function checkDangerousPatterns(actionType, actionDetail) {
   if (actionType === "file_write" || actionType === "file_edit") return null;
-  const TEMP_DIRS = ["/tmp/", "/var/tmp/", "/run/", "/dev/shm/"];
-  const isTempPath = TEMP_DIRS.some((td) => actionDetail.includes(td));
+  const TEMP_DIRS = ["/tmp", "/var/tmp", "/run", "/dev/shm"];
+  const isTempPath = TEMP_DIRS.some(
+    (td) => new RegExp(`(?:^|[\\s/])${td.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[\\s/]|$)`).test(actionDetail)
+  );
   if (!isTempPath && (actionDetail.includes("*") || actionDetail.includes("?")) && ["rm ", "rm	", "del ", "del	", "delete", "remove ", "remove	", "\u5220\u9664", "\u79FB\u9664"].some((kw) => actionDetail.includes(kw))) {
     return {
       allowed: false,
@@ -2195,7 +2466,22 @@ function checkDangerousPatterns(actionType, actionDetail) {
       violatedLayers: ["1.1"]
     };
   }
-  if (/>\s*\/etc\//.test(actionDetail) || />\s*\/boot\//.test(actionDetail) || />\s*\/proc\//.test(actionDetail)) {
+  const findWriteMatch = actionDetail.match(
+    /\bfind\b.*?(?:(?:^|\s)-exec(?:dir)?\s+(chmod|chown|cp|mv|rm|dd|tee|truncate|mkfs|shred|rmdir|unlink)\b|(?:^|\s)\|\s*xargs\s+(?:sed\s+-[a-zA-Z]*i|chmod|chown|cp|mv|rm|dd|tee|truncate|mkfs|shred|rmdir|unlink)\b)/i
+  );
+  if (findWriteMatch) {
+    const cmdHit = findWriteMatch[1] || "xargs";
+    return {
+      allowed: false,
+      reason: `\u68C0\u6D4B\u5230 find \u6279\u91CF\u6267\u884C\u5199\u64CD\u4F5C (${cmdHit})\uFF0C\u53EF\u80FD\u6279\u91CF\u4FEE\u6539/\u5220\u9664\u6587\u4EF6`,
+      riskLevel: "high",
+      riskType: "script_execution",
+      confidence: 90,
+      source: "heuristic",
+      violatedLayers: ["1.1"]
+    };
+  }
+  if (/>\s*\/etc\//.test(actionDetail) || />\s*\/boot\//.test(actionDetail)) {
     return {
       allowed: false,
       reason: "\u68C0\u6D4B\u5230\u91CD\u5B9A\u5411\u8986\u76D6\u5199\u5165\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55",
@@ -2206,17 +2492,95 @@ function checkDangerousPatterns(actionType, actionDetail) {
       violatedLayers: ["1.1"]
     };
   }
+  if (/>\s*\/dev\/(sd|hd|nvme|vd|loop|mem|kmsg|port|zero|random|urandom|full|core)/i.test(actionDetail)) {
+    return {
+      allowed: false,
+      reason: "\u68C0\u6D4B\u5230\u91CD\u5B9A\u5411\u5199\u5165\u8BBE\u5907\u6587\u4EF6",
+      riskLevel: "high",
+      riskType: "file_access",
+      confidence: 90,
+      source: "heuristic",
+      violatedLayers: ["1.1"]
+    };
+  }
   return null;
 }
 function extractRemoteHost(command) {
-  const m = command.match(/(?:ssh|scp|rsync)\s+(?:-[\w]+\s+)*(\S+@\S+|\b(?!-)[\w.-]+\b)/);
-  return m ? m[1] : null;
+  const tokens = command.split(/\s+/).map((t) => t.replace(/^["']|["']$/g, ""));
+  for (const tok of tokens) {
+    const am = tok.match(/^([\w.-]+)@([\w.-]+)(:.*)?$/);
+    if (am && am[2] && !isLocalHost(am[2])) {
+      return `${am[1]}@${am[2]}`;
+    }
+  }
+  for (const tok of tokens) {
+    const hm = tok.match(/^([\w.-]+):\/(.*)?$/);
+    if (hm && hm[1] && !isLocalHost(hm[1])) {
+      return hm[1];
+    }
+  }
+  const skipValueOpts = /* @__PURE__ */ new Set([
+    "-p",
+    "-l",
+    "-i",
+    "-o",
+    "-b",
+    "-c",
+    "-m",
+    "-F",
+    "-e",
+    "-S",
+    "-W",
+    "-J",
+    "-I",
+    "-T",
+    "-B",
+    "-L",
+    "-R",
+    "-D",
+    "-E",
+    "-M",
+    "-O",
+    "-P",
+    "-q"
+  ]);
+  let foundCmd = false;
+  for (let i = 0; i < tokens.length; i++) {
+    const t = tokens[i];
+    if (t === "ssh" || t === "scp" || t === "rsync") {
+      foundCmd = true;
+      continue;
+    }
+    if (!foundCmd) continue;
+    if (t.startsWith("-")) {
+      if (skipValueOpts.has(t) && i + 1 < tokens.length) {
+        i++;
+      }
+      continue;
+    }
+    if (t.startsWith("/")) continue;
+    return t;
+  }
+  return null;
 }
 function isLocalHost(host) {
   const localNames = ["localhost", "127.0.0.1", "::1", process.env.HOSTNAME || "", "0.0.0.0"];
   return localNames.includes(host.replace(/.*@/, ""));
 }
 function checkLateralMovement(actionDetail) {
+  if (/\b(?:python|python3|perl|ruby|node|php|lua)\b\s+.*-[cer][a-zA-Z]*\s/.test(actionDetail)) return null;
+  const segments = actionDetail.split(/&&|\|\||;|\n/).map((s) => s.trim()).filter(Boolean);
+  let hasRealCall = false;
+  for (const seg of segments) {
+    const parts = seg.split(/\s+/);
+    const fw = (parts[0] || "").toLowerCase();
+    if (fw === "echo" || fw === "printf") continue;
+    if (/(?:ssh|scp|rsync)\s+/.test(seg)) {
+      hasRealCall = true;
+      break;
+    }
+  }
+  if (!hasRealCall) return null;
   if (/(?:ssh|scp|rsync)\s+/.test(actionDetail)) {
     const targetHost = extractRemoteHost(actionDetail);
     if (targetHost && !isLocalHost(targetHost)) {
@@ -2316,10 +2680,14 @@ var init_heuristic = __esm({
       { pattern: /mkfs\.\w+\s+\/dev\/(sd|hd|nvme|vd|loop|mapper|md|dm)\S+/i, severity: "critical", description: "\u683C\u5F0F\u5316\u5757\u8BBE\u5907 (mkfs /dev/\u5757\u8BBE\u5907)", riskType: "script_execution" },
       { pattern: /:\(\)\s*\{.*:\|:&.*\};:/i, severity: "critical", description: "Fork Bomb", riskType: "resource_exhaustion" },
       // --- Critical: remote code execution ---
-      { pattern: /curl\s+.*\|\s*(bash|sh|zsh|dash)/i, severity: "critical", description: "curl pipe shell \u6267\u884C", riskType: "script_execution" },
+      // curl|bash 优先匹配 user_rules（high/sensitive_action），见下方 UserRuleMatcher 段；
+      // 非 bash 的 curl|sh/zsh/dash 走 CommandPatternScanner critical。两条分流由
+      // runHeuristicCheck 的规则顺序保证（bash 在前 high，其余 fall-through 到 critical）。
+      { pattern: /curl\s+.*\|\s*bash/i, severity: "high", description: "curl pipe bash \u6267\u884C (user_rules)", riskType: "sensitive_action" },
+      { pattern: /curl\s+.*\|\s*(sh|zsh|dash)/i, severity: "critical", description: "curl pipe shell \u6267\u884C", riskType: "script_execution" },
       { pattern: /wget\s+.*\|\s*(bash|sh)/i, severity: "critical", description: "wget pipe shell \u6267\u884C", riskType: "script_execution" },
       { pattern: /eval\s+\$\(curl|eval\s+\$\(wget/i, severity: "critical", description: "eval \u8FDC\u7A0B\u4EE3\u7801\u6267\u884C", riskType: "script_execution" },
-      { pattern: /base64\s+-d\s+.*\|\s*bash/i, severity: "critical", description: "base64 \u89E3\u7801\u6267\u884C", riskType: "script_execution" },
+      { pattern: /base64\s+-d\s+.*\|\s*bash/i, severity: "high", description: "base64 \u89E3\u7801\u6267\u884C (user_rules)", riskType: "sensitive_action" },
       // --- Critical: reverse shell ---
       { pattern: /\/dev\/tcp\/|bash\s+-i\s+>&/i, severity: "critical", description: "\u53CD\u5F39 Shell", riskType: "script_execution" },
       { pattern: /nc\s+-[el]\s+.*\d{1,5}/i, severity: "high", description: "Netcat \u53CD\u5F39\u8FDE\u63A5", riskType: "lateral_movement" },
@@ -2330,13 +2698,25 @@ var init_heuristic = __esm({
       { pattern: /\.ssh\/id_rsa(?!\.pub)/i, severity: "critical", description: "\u8BBF\u95EE SSH \u79C1\u94A5\u6587\u4EF6", riskType: "file_access" },
       // --- Critical: privilege escalation / container escape ---
       { pattern: /\/var\/run\/docker\.sock/i, severity: "critical", description: "\u8BBF\u95EE Docker socket\uFF0C\u53EF\u80FD\u5BFC\u81F4\u5BB9\u5668\u9003\u9038", riskType: "privilege_escalation" },
-      // --- High: dangerous permissions / ownership ---
-      { pattern: /chmod\s+[0-7]*777[0-7]*/i, severity: "high", description: "\u5168\u6743\u9650\u8BBE\u7F6E (chmod 777)", riskType: "script_execution" },
+      // --- Critical: dangerous permissions / ownership (提权 / 权限敞口) ---
+      // 修正「只拦 777、xx7 漏放」的缺口：
+      // 1) 八进制末位 7：other 位含写+执行敞口（chmod 777/647/007/4777 等）；644/755/1700 不命中
+      // 2) 八进制 setuid/setgid 位：首位 4(setuid)/2(setgid) 的 4 位八进制（chmod 4755/2755）
+      // 3) 符号 setuid/setgid：chmod u+s / g+s / a+s
+      // 普通权限修改（chmod 644）不在此列——L2 read_before_write 已豁免 chmod/chown（不写内容），
+      // 危险形态在此 L1 专门拦，以「提权」正确理由拦截，不再靠 RBW 误打误撞。
+      { pattern: /chmod\s+[0-7]{0,3}7\b/i, severity: "critical", description: "\u5371\u9669\u6743\u9650\u8BBE\u7F6E (chmod ...7, other \u4F4D\u542B\u5199+\u6267\u884C\u655E\u53E3)", riskType: "privilege_escalation" },
+      { pattern: /chmod\s+[24][0-7]{3}\b/i, severity: "critical", description: "setuid/setgid \u4F4D\u8BBE\u7F6E (chmod 4xxx/2xxx, \u63D0\u6743)", riskType: "privilege_escalation" },
+      { pattern: /chmod\s+[ugoa]\+s\b/i, severity: "critical", description: "\u7B26\u53F7 setuid/setgid \u8BBE\u7F6E (chmod u+s/g+s/a+s, \u63D0\u6743)", riskType: "privilege_escalation" },
       { pattern: /chown\s+root|chown\s+-R\s+\w+:\w+\s+\//i, severity: "high", description: "\u4FEE\u6539\u6240\u6709\u8005\u4E3A root / \u9012\u5F52\u4FEE\u6539\u6839\u76EE\u5F55\u6240\u6709\u8005", riskType: "script_execution" },
       // sudo 提权 — 只拦截 sudo 后跟的危险命令，不一刀切拦截所有 sudo
       { pattern: /sudo\s+(rm|chmod|chown|dd|mkfs|format|iptables|crontab|passwd|userdel|useradd|groupdel)\b/i, severity: "high", description: "\u63D0\u6743\u6267\u884C\u9AD8\u5371\u547D\u4EE4 (sudo + \u5371\u9669\u64CD\u4F5C)", riskType: "privilege_escalation" },
       // --- High: system config overwrite ---
+      // > /etc/ 重定向覆盖：对齐 Python CommandPatternScanner `>\s*/etc/`（不兼容引号路径），
+      // 引号包裹的重定向目标（cat > '/etc/ssh/sshd_config'）走 checkSensitivePath 敏感路径 high。
       { pattern: />\s*\/etc\//i, severity: "critical", description: "\u8986\u76D6\u5199\u5165\u7CFB\u7EDF\u914D\u7F6E\u76EE\u5F55", riskType: "file_access" },
+      { pattern: />\s*\/boot\//i, severity: "critical", description: "\u8986\u76D6\u5199\u5165\u542F\u52A8\u5F15\u5BFC\u76EE\u5F55", riskType: "file_access" },
+      // 注：/proc/ 重定向覆盖走 checkSensitivePath 的 high（内核参数 /proc/sys/），此处不拦 /proc/ 避免遮蔽（对齐 Python）。
       // --- High: download script + execute risk ---
       { pattern: /(?:curl|wget)\s+.*(?:-o|--output|>)\s*\S+\.(?:sh|bash)\b/i, severity: "high", description: "\u8FDC\u7A0B\u4E0B\u8F7D\u811A\u672C\u5230\u672C\u5730", riskType: "script_execution" },
       { pattern: /(?:curl|wget)\s+.*\s+&&?\s*(?:chmod\s+\+x|bash|sh)/i, severity: "high", description: "\u4E0B\u8F7D\u540E\u6267\u884C", riskType: "script_execution" },
@@ -2352,7 +2732,11 @@ var init_heuristic = __esm({
       // --- Medium: credential export ---
       { pattern: /export\s+.*(?:TOKEN|KEY|SECRET|PASSWORD)/i, severity: "medium", description: "\u5BFC\u51FA\u654F\u611F\u51ED\u8BC1", riskType: "data_exfiltration" },
       // --- High: shell rc file append (persistence) ---
+      // 两条规则：第一条匹配 ~ 与 /home/<user>/ 形态；第二条按文件名兜底，
+      // 覆盖非标准 home 路径（如鸿蒙 /storage/Users/currentUser/.bashrc、
+      // /root/.bashrc），避免按 home 前缀枚举导致漏检持久化后门。
       { pattern: />>\s*(~|\/home\/[^/]+)\/(\.bashrc|\.zshrc|\.profile|\.bash_profile|\.zprofile)/, severity: "high", description: "\u68C0\u6D4B\u5230\u4FEE\u6539 Shell \u914D\u7F6E\u6587\u4EF6\uFF08~/.bashrc \u7B49\uFF09\uFF0C\u53EF\u80FD\u7528\u4E8E\u6301\u4E45\u5316\u540E\u95E8", riskType: "persistence" },
+      { pattern: />>\s*\S*\/(\.bashrc|\.zshrc|\.profile|\.bash_profile|\.zprofile)\b/, severity: "high", description: "\u68C0\u6D4B\u5230\u4FEE\u6539 Shell \u914D\u7F6E\u6587\u4EF6\uFF08.bashrc \u7B49\uFF09\uFF0C\u53EF\u80FD\u7528\u4E8E\u6301\u4E45\u5316\u540E\u95E8", riskType: "persistence" },
       // --- High: device file write (只拦截重定向写入设备文件，不拦截读取) ---
       { pattern: />\s*\/dev\/(sd|hd|nvme|vd|loop|mem|kmsg|port|zero|random|urandom|full|core)/i, severity: "high", description: "\u91CD\u5B9A\u5411\u5199\u5165\u8BBE\u5907\u6587\u4EF6", riskType: "file_access" },
       // --- High: non-interactive password modification ---
@@ -2632,7 +3016,7 @@ var require_bindings = __commonJS({
     init_esm_shims();
     var fs4 = __require("fs");
     var path3 = __require("path");
-    var fileURLToPath7 = require_file_uri_to_path();
+    var fileURLToPath8 = require_file_uri_to_path();
     var join6 = path3.join;
     var dirname7 = path3.dirname;
     var exists = fs4.accessSync && function(path4) {
@@ -2744,7 +3128,7 @@ var require_bindings = __commonJS({
       Error.stackTraceLimit = origSTL;
       var fileSchema = "file://";
       if (fileName.indexOf(fileSchema) === 0) {
-        fileName = fileURLToPath7(fileName);
+        fileName = fileURLToPath8(fileName);
       }
       return fileName;
     };
@@ -3411,8 +3795,8 @@ init_skill_loader();
 init_esm_shims();
 import { readFileSync as readFileSync4, existsSync as existsSync5 } from "fs";
 import { resolve as resolve3, dirname as dirname4 } from "path";
-import { fileURLToPath as fileURLToPath5 } from "url";
-var __filename4 = fileURLToPath5(import.meta.url);
+import { fileURLToPath as fileURLToPath6 } from "url";
+var __filename4 = fileURLToPath6(import.meta.url);
 var __dirname5 = dirname4(__filename4);
 var TEMPLATES_DIR = resolve3(__dirname5, "../templates");
 var TEMPLATES_DIR_FALLBACK = resolve3(__dirname5, "../../../agent_moss/templates");
@@ -4327,11 +4711,13 @@ async function analyzeWithLLM(prompt, config) {
       } catch {
       }
       clearTimeout(totalTimeoutTimer);
+      const riskLevel = parsed.riskLevel ?? parsed.risk_level;
+      const riskType = parsed.riskType ?? parsed.risk_type;
       return {
         allowed: parsed.allowed !== false,
         reason: parsed.reason || "LLM \u5206\u6790\u5B8C\u6210",
-        riskLevel: ["low", "medium", "high", "critical"].includes(parsed.riskLevel) ? parsed.riskLevel : "low",
-        riskType: parsed.riskType || "",
+        riskLevel: ["low", "medium", "high", "critical"].includes(riskLevel) ? riskLevel : "low",
+        riskType: riskType || "",
         confidence: typeof parsed.confidence === "number" ? Math.min(100, Math.max(0, parsed.confidence)) : 70,
         source: "llm",
         violatedLayers: ["3"]
@@ -4449,7 +4835,10 @@ async function runAnalysis(input) {
   if (heuristicResult && !heuristicResult.allowed) {
     const skipInlineFileAccess = (isInlineScriptCmd || isLiteralTextCmd) && heuristicResult.riskType === "file_access";
     if (!skipInlineFileAccess) {
-      return heuristicResult;
+      const shouldDenyL1 = heuristicResult.riskLevel === "high" || heuristicResult.riskLevel === "critical" || heuristicResult.riskLevel === "medium" && heuristicResult.riskType === "file_access";
+      if (shouldDenyL1) {
+        return heuristicResult;
+      }
     }
   }
   let scriptChain = null;
@@ -4527,7 +4916,8 @@ async function runAnalysis(input) {
       ) && DANGEROUS_PATTERNS.some(
         (p) => (p.severity === "critical" || p.severity === "high") && p.pattern.test(lowerDetail)
       );
-      if (!fullCmdHit) {
+      const hasRedirectWrite = isWriteOperation(firstCmd, lowerDetail);
+      if (!fullCmdHit && !hasRedirectWrite) {
         return {
           allowed: true,
           reason: `\u5B89\u5168\u7684\u53EA\u8BFB bash \u547D\u4EE4: ${firstCmd}`,
@@ -4854,8 +5244,8 @@ init_token_stats();
 import { Hono } from "hono";
 import { readFileSync as readFileSync8, existsSync as existsSync9 } from "fs";
 import { join as join5, dirname as dirname6 } from "path";
-import { fileURLToPath as fileURLToPath6 } from "url";
-var __dirname6 = dirname6(fileURLToPath6(import.meta.url));
+import { fileURLToPath as fileURLToPath7 } from "url";
+var __dirname6 = dirname6(fileURLToPath7(import.meta.url));
 var STATIC_DIR = join5(__dirname6, "static");
 var CONSOLE_TOKEN_ENV = "AGENT_MOSS_CONSOLE_TOKEN";
 function getConsoleToken() {