@kenhkl/agent-moss 0.11.5 → 0.12.1

package/dist/server.js

@@ -574,8 +574,70 @@ var init_inline_analyzer = __esm({
   }
 });
 
+// src/infra/rules-loader.ts
+import { readFileSync as readFileSync2, existsSync } from "fs";
+import { resolve, dirname } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
+function findRulesFile(name) {
+  for (const dir of RULES_DIR_CANDS) {
+    const p = resolve(dir, name);
+    if (existsSync(p)) return p;
+  }
+  return null;
+}
+function loadJson(name) {
+  const p = findRulesFile(name);
+  if (!p) return {};
+  try {
+    return JSON.parse(readFileSync2(p, "utf-8")) || {};
+  } catch {
+    return {};
+  }
+}
+function loadL1() {
+  return loadJson("l1_rules.json");
+}
+function loadL2() {
+  return loadJson("l2_rules.json");
+}
+function loadL3() {
+  return loadJson("l3_rules.json");
+}
+var __filename2, __dirname2, RULES_DIR_CANDS;
+var init_rules_loader = __esm({
+  "src/infra/rules-loader.ts"() {
+    "use strict";
+    init_esm_shims();
+    __filename2 = fileURLToPath3(import.meta.url);
+    __dirname2 = dirname(__filename2);
+    RULES_DIR_CANDS = (() => {
+      const cands = [
+        // dist: __dirname=dist/ → dist/rules；__dirname=dist/engine/ → dist/engine/../rules=dist/rules
+        resolve(__dirname2, "../rules"),
+        resolve(__dirname2, "rules"),
+        // dev src: __dirname=ts/src/infra/ → ts/src/infra/../../../agent_moss/rules = 仓库根 agent_moss/rules
+        resolve(__dirname2, "../../../agent_moss/rules"),
+        // dist 但 __dirname 指向 dist/engine 再往上两级的仓库根 agent_moss/rules
+        resolve(__dirname2, "../../../../agent_moss/rules"),
+        // 相对当前工作目录的仓库根（兜底，兼容以仓库根为 cwd 运行）
+        resolve(process.cwd(), "agent_moss/rules")
+      ];
+      return cands.filter((c) => existsSync(c));
+    })();
+  }
+});
+
 // src/engine/logic-rules.ts
 import * as fs2 from "fs";
+function _loadSensitivePathScope(scope) {
+  const sps = loadL1().sensitive_path_access || [];
+  return sps.filter((sp) => sp.scope === scope).map((sp) => ({
+    path: sp.path,
+    riskLevel: sp.risk_level,
+    desc: sp.desc,
+    credential: sp.deny_mode === "deny_both" ? true : void 0
+  }));
+}
 function isWriteOperation(actionType, actionDetail, writeKeywords = WRITE_KEYWORDS) {
   if (writeKeywords.some((kw) => actionType.includes(kw) || actionDetail.includes(kw))) return true;
   if (WRITE_COMMAND_RES.some((rx) => rx.test(actionDetail))) return true;
@@ -620,6 +682,32 @@ function matchDangerousAction(actionDetail, action) {
   const re = new RegExp(`(?<![-\\w])${escaped}\\b`, "i");
   return re.test(actionDetail);
 }
+function collectIntentTexts(promptSession, promptHistory) {
+  const texts = [];
+  if (promptHistory) {
+    for (const turn of promptHistory) {
+      if (typeof turn === "string") {
+        const t2 = turn.trim();
+        if (t2) texts.push(t2.toLowerCase());
+        continue;
+      }
+      const t = (turn?.text || "").trim();
+      if (t) texts.push(t.toLowerCase());
+    }
+  }
+  if (promptSession && promptSession.trim()) {
+    texts.push(promptSession.toLowerCase());
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const deduped = [];
+  for (const t of texts) {
+    if (!seen.has(t)) {
+      seen.add(t);
+      deduped.push(t);
+    }
+  }
+  return deduped;
+}
 function runLogicCheck(input) {
   const { actionHistory, aNext, cwd } = input;
   const actionDetail = aNext.actionDetail.toLowerCase();
@@ -629,25 +717,24 @@ function runLogicCheck(input) {
   const isExcludedType = EXCLUDED_PREFIXES.some((p) => actionType.startsWith(p));
   const rbwResult = checkReadBeforeWrite(actionType, actionDetail, actionHistory, input.reason, resolvedCwd);
   if (rbwResult) return rbwResult;
-  if (input.promptSession && input.promptSession.trim()) {
-    if (!isExcludedType) {
-      if (INLINE_SCRIPT_RE.test(actionDetail)) {
-      } else {
-        const promptLower = input.promptSession.toLowerCase();
-        for (const pattern of INTENT_DEVIATION_PATTERNS) {
-          const intentMatched = pattern.intentKeywords.some((kw) => promptLower.includes(kw));
-          const dangerousMatched = pattern.dangerousActions.some((kw) => matchDangerousAction(actionDetail, kw));
-          if (intentMatched && dangerousMatched) {
-            return {
-              allowed: false,
-              reason: pattern.reason,
-              riskLevel: "high",
-              riskType: "intent_deviation",
-              confidence: 85,
-              source: "logic_rule",
-              violatedLayers: ["2"]
-            };
-          }
+  if (!isExcludedType) {
+    if (!INLINE_SCRIPT_RE.test(actionDetail)) {
+      const intentTexts = collectIntentTexts(input.promptSession, input.promptHistory);
+      for (const pattern of INTENT_DEVIATION_PATTERNS) {
+        const intentMatched = intentTexts.some(
+          (text) => pattern.intentKeywords.some((kw) => text.includes(kw))
+        );
+        const dangerousMatched = pattern.dangerousActions.some((kw) => matchDangerousAction(actionDetail, kw));
+        if (intentMatched && dangerousMatched) {
+          return {
+            allowed: false,
+            reason: pattern.reason,
+            riskLevel: "high",
+            riskType: "intent_deviation",
+            confidence: 85,
+            source: "logic_rule",
+            violatedLayers: ["2"]
+          };
         }
       }
     }
@@ -937,57 +1024,10 @@ var init_logic_rules = __esm({
     "use strict";
     init_esm_shims();
     init_inline_analyzer();
-    ROOT_SENSITIVE_PATHS = [
-      { path: "/etc/shadow", riskLevel: "critical", desc: "\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6", credential: true },
-      { path: "/etc/gshadow", riskLevel: "critical", desc: "\u7CFB\u7EDF\u7EC4\u5BC6\u7801\u6587\u4EF6", credential: true },
-      // 注意：/etc/passwd 仅从 L1 特征匹配规则移除（公开可读），L2 敏感路径仍保留
-      { path: "/etc/passwd", riskLevel: "high", desc: "\u7CFB\u7EDF\u7528\u6237\u6587\u4EF6" },
-      { path: "/etc/sudoers", riskLevel: "critical", desc: "sudo \u914D\u7F6E", credential: true },
-      // 系统配置（仅拦截写入）
-      { path: "/etc/hosts", riskLevel: "medium", desc: "DNS \u89E3\u6790\u914D\u7F6E" },
-      { path: "/etc/crontab", riskLevel: "high", desc: "\u7CFB\u7EDF\u5B9A\u65F6\u4EFB\u52A1" },
-      { path: "/etc/cron.d/", riskLevel: "high", desc: "\u7CFB\u7EDF\u5B9A\u65F6\u4EFB\u52A1\u76EE\u5F55\uFF08\u62C6\u5206\u5F0F crontab\uFF09" },
-      { path: "/var/spool/cron/", riskLevel: "high", desc: "\u7528\u6237\u7EA7\u5B9A\u65F6\u4EFB\u52A1\u76EE\u5F55" },
-      { path: "/etc/systemd/", riskLevel: "high", desc: "systemd \u670D\u52A1\u914D\u7F6E" },
-      { path: "/etc/ssh/sshd_config", riskLevel: "high", desc: "SSH \u670D\u52A1\u914D\u7F6E" },
-      { path: "/etc/pam.d/", riskLevel: "high", desc: "PAM \u53EF\u63D2\u62D4\u8BA4\u8BC1\u6A21\u5757\u914D\u7F6E" },
-      // 危险目录（仅拦截写入）
-      { path: "/boot/", riskLevel: "critical", desc: "\u542F\u52A8\u5F15\u5BFC\u76EE\u5F55" },
-      { path: "/proc/sys/", riskLevel: "high", desc: "\u5185\u6838\u53C2\u6570" },
-      { path: "/sys/", riskLevel: "high", desc: "sysfs \u5185\u6838\u63A5\u53E3" },
-      // 设备文件（/dev/null、/dev/zero、/dev/urandom 已移除，误报率极高）
-      { path: "/dev/random", riskLevel: "high", desc: "\u963B\u585E\u5F0F\u968F\u673A\u6570\u8BBE\u5907\uFF08\u8BFB\u53D6\u8017\u5C3D\u71B5\u6C60\uFF09" },
-      { path: "/dev/mem", riskLevel: "critical", desc: "\u7269\u7406\u5185\u5B58\u8BBF\u95EE\u8BBE\u5907\uFF08\u8BFB\u5199\u5747\u5371\u9669\uFF09", credential: true },
-      { path: "/dev/kmsg", riskLevel: "high", desc: "\u5185\u6838\u6D88\u606F\u7F13\u51B2\u533A" },
-      // SSH 主机私钥
-      // SSH 主机私钥（排除 .pub 公钥变体，对齐 Python .ssh/id_rsa(?!\.pub) 范式）
-      { path: "/etc/ssh/ssh_host_rsa_key(?!\\.pub)", riskLevel: "critical", desc: "SSH \u4E3B\u673A RSA \u79C1\u94A5", credential: true },
-      { path: "/etc/ssh/ssh_host_ed25519_key(?!\\.pub)", riskLevel: "critical", desc: "SSH \u4E3B\u673A Ed25519 \u79C1\u94A5", credential: true },
-      { path: "/etc/ssh/ssh_host_ecdsa_key(?!\\.pub)", riskLevel: "critical", desc: "SSH \u4E3B\u673A ECDSA \u79C1\u94A5", credential: true },
-      // Nginx 配置（仅拦截写入，对齐 Python linux.py sensitive_paths）
-      { path: "/etc/nginx/nginx.conf", riskLevel: "high", desc: "Nginx \u4E3B\u914D\u7F6E" },
-      { path: "/etc/nginx/conf.d/", riskLevel: "high", desc: "Nginx \u5B50\u914D\u7F6E\u76EE\u5F55" },
-      { path: "/etc/nginx/sites-enabled/", riskLevel: "high", desc: "Nginx \u542F\u7528\u7AD9\u70B9\u914D\u7F6E\u76EE\u5F55" }
-    ];
-    HOME_SENSITIVE_PATHS = [
-      { path: ".ssh/id_rsa", riskLevel: "critical", desc: "SSH \u79C1\u94A5", credential: true },
-      { path: ".ssh/id_ed25519", riskLevel: "critical", desc: "SSH \u79C1\u94A5 (ed25519)", credential: true },
-      { path: ".ssh/authorized_keys", riskLevel: "high", desc: "SSH \u6388\u6743\u5BC6\u94A5" },
-      // 持久化与命令劫持（仅拦截写入）
-      { path: ".bashrc", riskLevel: "high", desc: "\u7528\u6237 Shell \u521D\u59CB\u5316\u811A\u672C" },
-      { path: ".bash_profile", riskLevel: "high", desc: "\u7528\u6237 Shell \u767B\u5F55\u811A\u672C" },
-      { path: ".profile", riskLevel: "high", desc: "\u7528\u6237\u901A\u7528\u767B\u5F55\u811A\u672C" },
-      { path: ".aws/credentials", riskLevel: "critical", desc: "AWS \u51ED\u8BC1", credential: true },
-      { path: ".gitconfig", riskLevel: "medium", desc: "Git \u914D\u7F6E" },
-      { path: ".gnupg", riskLevel: "high", desc: "GPG \u5BC6\u94A5\u76EE\u5F55" }
-    ];
-    CREDENTIAL_PATHS = [
-      { path: "credentials.yml", riskLevel: "high", desc: "\u51ED\u636E\u914D\u7F6E\u6587\u4EF6" },
-      { path: "credentials.yaml", riskLevel: "high", desc: "\u51ED\u636E\u914D\u7F6E\u6587\u4EF6" },
-      { path: "secrets.yml", riskLevel: "high", desc: "\u5BC6\u94A5\u914D\u7F6E\u6587\u4EF6" },
-      { path: "secrets.yaml", riskLevel: "high", desc: "\u5BC6\u94A5\u914D\u7F6E\u6587\u4EF6" },
-      { path: ".env", riskLevel: "high", desc: "\u73AF\u5883\u53D8\u91CF/\u51ED\u636E\u914D\u7F6E\u6587\u4EF6" }
-    ];
+    init_rules_loader();
+    ROOT_SENSITIVE_PATHS = _loadSensitivePathScope("root");
+    HOME_SENSITIVE_PATHS = _loadSensitivePathScope("home");
+    CREDENTIAL_PATHS = _loadSensitivePathScope("credential").map(({ path: path3, riskLevel, desc }) => ({ path: path3, riskLevel, desc, credential: true }));
     NON_WRITE_TOOLS = /* @__PURE__ */ new Set([
       "ask_user_question",
       "glob",
@@ -1115,34 +1155,22 @@ var init_logic_rules = __esm({
     DEVNULL_REDIRECT_RE = /(?:2|&|1)?\s*>\s*\/dev\/null\b/g;
     READ_KEYWORDS = ["read", "\u8BFB\u53D6", "cat", "head", "tail", "less", "more", "view", "\u67E5\u770B", "open", "\u6253\u5F00", "load", "\u52A0\u8F7D", "grep", "search", "\u641C\u7D22", "find", "\u67E5\u627E"];
     CREATE_KEYWORDS = ["\u521B\u5EFA", "\u65B0\u5EFA", "create", "new file", "touch"];
-    PASSWORD_MODIFY_PATTERNS = [
-      /\|\s*passwd\b/i,
-      /\bpasswd\s+--stdin\b/i,
-      /\bchpasswd\b/i,
-      /\bchgpasswd\b/i,
-      /\b(newusers|lnewusers)\b/i,
-      /\bpasswd\s+-[a-zA-Z]*d\b/i,
-      /\bpasswd\s+-[a-zA-Z]*l\b/i
-    ];
-    USER_DELETION_PATTERNS = [
-      /\buserdel\s/i,
-      /\bdeluser\s/i,
-      /\bluserdel\s/i,
-      /\bgroupdel\s/i,
-      /\blgroupdel\s/i
-    ];
-    INTENT_DEVIATION_PATTERNS = [
-      {
-        intentKeywords: ["\u8BFB\u53D6", "\u67E5\u770B", "\u5206\u6790", "read", "analyze", "view", "list", "\u5217\u51FA"],
-        dangerousActions: ["\u5220\u9664", "remove", "delete", "rm", "\u683C\u5F0F\u5316", "format"],
-        reason: "\u539F\u59CB\u610F\u56FE\u4E3A\u8BFB\u53D6/\u5206\u6790\uFF0C\u4F46\u6267\u884C\u4E86\u5220\u9664\u64CD\u4F5C"
-      },
-      {
-        intentKeywords: ["\u67E5\u8BE2", "\u641C\u7D22", "search", "query", "find"],
-        dangerousActions: ["\u4FEE\u6539", "update", "write", "\u5199\u5165", "alter"],
-        reason: "\u539F\u59CB\u610F\u56FE\u4E3A\u67E5\u8BE2/\u641C\u7D22\uFF0C\u4F46\u6267\u884C\u4E86\u4FEE\u6539\u64CD\u4F5C"
-      }
-    ];
+    PASSWORD_MODIFY_PATTERNS = (() => {
+      const pats = loadL2().password_modify_consent || [];
+      return pats.map((p) => new RegExp(p.pattern, "i"));
+    })();
+    USER_DELETION_PATTERNS = (() => {
+      const pats = loadL2().user_deletion_consent || [];
+      return pats.map((p) => new RegExp(p.pattern, "i"));
+    })();
+    INTENT_DEVIATION_PATTERNS = (() => {
+      const pats = loadL2().intent_consistency || [];
+      return pats.map((p) => ({
+        intentKeywords: p.intent_keywords,
+        dangerousActions: p.dangerous_actions,
+        reason: p.reason
+      }));
+    })();
     INLINE_SCRIPT_RE = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
     DIR_TRAVERSAL_KW = [
       "os.listdir",
@@ -1160,21 +1188,21 @@ var init_logic_rules = __esm({
 });
 
 // src/engine/skill-loader.ts
-import { readFileSync as readFileSync2, readdirSync as readdirSync2, existsSync as existsSync2 } from "fs";
-import { resolve, dirname } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { readFileSync as readFileSync3, readdirSync as readdirSync2, existsSync as existsSync3 } from "fs";
+import { resolve as resolve2, dirname as dirname2 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
 function loadAllSkills() {
   if (cachedSkills) return cachedSkills;
   cachedSkills = {};
-  const dir = existsSync2(SKILLS_DIR) ? SKILLS_DIR : SKILLS_DIR_FALLBACK;
-  if (!existsSync2(dir)) {
+  const dir = existsSync3(SKILLS_DIR) ? SKILLS_DIR : SKILLS_DIR_FALLBACK;
+  if (!existsSync3(dir)) {
     console.warn("[AgentMoss] Skills directory not found:", SKILLS_DIR, "and fallback:", SKILLS_DIR_FALLBACK);
     return cachedSkills;
   }
   const files = readdirSync2(dir).filter((f) => f.endsWith(".md"));
   for (const f of files) {
     const name = f.replace(".md", "");
-    cachedSkills[name] = readFileSync2(resolve(dir, f), "utf-8");
+    cachedSkills[name] = readFileSync3(resolve2(dir, f), "utf-8");
   }
   console.log(`[AgentMoss] Loaded ${Object.keys(cachedSkills).length} skills from ${dir}`);
   return cachedSkills;
@@ -1228,32 +1256,27 @@ function formatSkillsForPrompt(skills) {
 ${s.skillContent}`
   ).join("\n\n---\n\n");
 }
-var __filename2, __dirname2, SKILLS_DIR, SKILLS_DIR_FALLBACK, SKILL_KEYWORD_MAP, cachedSkills;
+var __filename3, __dirname3, SKILLS_DIR, SKILLS_DIR_FALLBACK, SKILL_KEYWORD_MAP, cachedSkills;
 var init_skill_loader = __esm({
   "src/engine/skill-loader.ts"() {
     "use strict";
     init_esm_shims();
-    __filename2 = fileURLToPath3(import.meta.url);
-    __dirname2 = dirname(__filename2);
-    SKILLS_DIR = resolve(__dirname2, "../skills");
-    SKILLS_DIR_FALLBACK = resolve(__dirname2, "../../../agent_moss/skills");
-    SKILL_KEYWORD_MAP = {
-      "file_access_guard": ["file", "\u6587\u4EF6", "path", "\u8DEF\u5F84", "read", "write", "cat", "open", "access", "\u8BBF\u95EE", "\u8BFB\u5199", "copy", "cp", "mv", "move"],
-      "script_execution_guard": ["command", "shell", "bash", "exec", "execute", "\u6267\u884C", "\u547D\u4EE4", "script", "\u811A\u672C", "run", "\u8FD0\u884C", "subprocess", "system", "eval", "compile", "\u5B89\u88C5", "install", "pip", "npm"],
-      "data_exfiltration_guard": ["upload", "\u4E0A\u4F20", "send", "\u53D1\u9001", "transfer", "\u4F20\u8F93", "export", "\u5BFC\u51FA", "download", "\u4E0B\u8F7D", "post", "http", "request", "fetch", "curl", "wget", "\u5916\u4F20", "\u6CC4\u9732", "exfil", "network", "\u7F51\u7EDC"],
-      "browser_web_access_guard": ["browser", "\u6D4F\u89C8\u5668", "web", "\u7F51\u9875", "url", "navigate", "\u6D4F\u89C8", "scrape", "crawl", "\u722C\u53D6", "click", "screenshot"],
-      "email_operation_guard": ["email", "\u90AE\u4EF6", "mail", "smtp", "send_email", "\u53D1\u9001\u90AE\u4EF6", "inbox", "\u6536\u4EF6\u7BB1", "\u9644\u4EF6", "attachment"],
-      "general_tool_risk_guard": ["tool", "\u5DE5\u5177", "api", "invoke", "\u8C03\u7528", "function", "\u51FD\u6570"],
-      "lateral_movement_guard": ["ssh", "scp", "ftp", "sftp", "rdp", "vnc", "telnet", "\u5185\u7F51", "\u6A2A\u5411", "tunnel", "\u4EE3\u7406", "proxy", "port", "\u7AEF\u53E3", "scan", "\u626B\u63CF", "ping", "traceroute", "nslookup"],
-      "persistence_backdoor_guard": ["cron", "crontab", "\u5B9A\u65F6", "scheduled", "startup", "\u542F\u52A8\u9879", "service", "\u670D\u52A1", "daemon", "\u5B88\u62A4", "registry", "\u6CE8\u518C\u8868", "backdoor", "\u540E\u95E8", "persist", "\u6301\u4E45\u5316", "authorized_keys", "bashrc", "zshrc", "profile", ".rc", "shell config", "shell \u914D\u7F6E"],
-      // 注意：避免裸 'memory'/'内存'/'dd'——会误命中 memory-addMemory（写记忆工具，
-      // 'dd' 是 'addMemory' 的子串）等无害操作。用组合词/命令前缀精准匹配攻击场景。
-      "resource_exhaustion_guard": ["fork", "bomb", "\u70B8\u5F39", "memory bomb", "oom", "out of memory", "\u5185\u5B58\u6EA2\u51FA", "\u5185\u5B58\u8017\u5C3D", "\u5185\u5B58\u6CC4\u6F0F", "disk", "\u78C1\u76D8", "cpu", "process", "\u8FDB\u7A0B", "dd if=", "/dev/zero", "/dev/null", "yes >", "while true", "\u65E0\u9650\u5FAA\u73AF", "\u8017\u5C3D", "exhaust", "\u8D44\u6E90"],
-      "skill_installation_guard": ["skill", "plugin", "\u63D2\u4EF6", "extension", "\u6269\u5C55", "install skill", "\u5B89\u88C5\u63D2\u4EF6", "\u5B89\u88C5\u6280\u80FD", "marketplace", "\u5546\u5E97"],
-      "supply_chain_guard": ["dependency", "\u4F9D\u8D56", "package", "\u5305", "npm install", "pip install", "requirements", "import", "library", "\u5E93", "registry", "\u4ED3\u5E93", "supply", "\u4F9B\u5E94\u94FE", "typosquatting"],
-      "intent_deviation_guard": ["rm", "del", "delete", "remove", "\u5220\u9664", "format", "\u683C\u5F0F\u5316", "drop", "truncate", "\u6E05\u7A7A", "wipe", "\u64E6\u9664", "\u91CD\u7F6E", "reset", "sudo", "root", "admin", "\u7BA1\u7406\u5458", "privilege", "\u63D0\u6743"],
-      "indirect_access_guard": ["listdir", "os.walk", "os.scandir", "glob.glob", "glob.iglob", "pathlib", "iterdir", "rglob", "scandir", "os.listdir", "\u76EE\u5F55\u904D\u5386", "traversal"]
-    };
+    init_rules_loader();
+    __filename3 = fileURLToPath4(import.meta.url);
+    __dirname3 = dirname2(__filename3);
+    SKILLS_DIR = resolve2(__dirname3, "../skills");
+    SKILLS_DIR_FALLBACK = resolve2(__dirname3, "../../../agent_moss/skills");
+    SKILL_KEYWORD_MAP = (() => {
+      const map = {};
+      const cats = loadL3();
+      for (const cat of Object.values(cats)) {
+        if (!cat || typeof cat !== "object") continue;
+        for (const [skillId, keywords] of Object.entries(cat)) {
+          map[skillId] = keywords;
+        }
+      }
+      return map;
+    })();
     cachedSkills = null;
   }
 });
@@ -1305,10 +1328,10 @@ __export(runtime_config_exports, {
   updateSkillCategoryEnabled: () => updateSkillCategoryEnabled,
   updateSkillEnabled: () => updateSkillEnabled
 });
-import { readFileSync as readFileSync3, writeFileSync, existsSync as existsSync3, mkdirSync, unlinkSync, readdirSync as readdirSync3 } from "fs";
+import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync4, mkdirSync, unlinkSync, readdirSync as readdirSync3 } from "fs";
 import { join as join2 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
-import { dirname as dirname2 } from "path";
+import { fileURLToPath as fileURLToPath5 } from "url";
+import { dirname as dirname3 } from "path";
 function runtimeDir() {
   return getRuntimeConfigDir();
 }
@@ -1320,7 +1343,7 @@ function getRuntimeConfigPath() {
 function saveRuntimeConfig(config) {
   const p = getRuntimeConfigPath();
   const dir = p.substring(0, p.lastIndexOf("/"));
-  if (dir && !existsSync3(dir)) mkdirSync(dir, { recursive: true });
+  if (dir && !existsSync4(dir)) mkdirSync(dir, { recursive: true });
   writeFileSync(p, JSON.stringify(config, null, 2), "utf-8");
 }
 function emptyRuntimeConfig() {
@@ -1335,7 +1358,7 @@ function emptyRuntimeConfig() {
 }
 function loadRuntimeConfig() {
   const p = getRuntimeConfigPath();
-  if (!existsSync3(p)) {
+  if (!existsSync4(p)) {
     const seeded = mergeConfig({}, generateSourceDefaults());
     try {
       saveRuntimeConfig(seeded);
@@ -1344,7 +1367,7 @@ function loadRuntimeConfig() {
     return seeded;
   }
   try {
-    const data = JSON.parse(readFileSync3(p, "utf-8"));
+    const data = JSON.parse(readFileSync4(p, "utf-8"));
     const merged = mergeConfig(data, generateSourceDefaults());
     return {
       version: data.version || 1,
@@ -1412,9 +1435,9 @@ function getEnabledL2SensitivePaths(runtime) {
 }
 function hasRuntimeConfig() {
   const p = getRuntimeConfigPath();
-  if (!existsSync3(p)) return false;
+  if (!existsSync4(p)) return false;
   try {
-    JSON.parse(readFileSync3(p, "utf-8"));
+    JSON.parse(readFileSync4(p, "utf-8"));
     return true;
   } catch {
     return false;
@@ -1593,8 +1616,8 @@ function _l3SkillsToRules() {
 }
 function _agentRulesToDefaults() {
   const out = {};
-  const agentsDir = existsSync3(_AGENTS_DIR_PROD) ? _AGENTS_DIR_PROD : existsSync3(_AGENTS_DIR_DEV) ? _AGENTS_DIR_DEV : _AGENTS_DIR_PROD;
-  if (!existsSync3(agentsDir)) return out;
+  const agentsDir = existsSync4(_AGENTS_DIR_PROD) ? _AGENTS_DIR_PROD : existsSync4(_AGENTS_DIR_DEV) ? _AGENTS_DIR_DEV : _AGENTS_DIR_PROD;
+  if (!existsSync4(agentsDir)) return out;
   let entries;
   try {
     entries = readdirSync3(agentsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
@@ -1603,10 +1626,10 @@ function _agentRulesToDefaults() {
   }
   for (const agentId of entries) {
     const rulesFile = join2(agentsDir, agentId, "rules.json");
-    if (!existsSync3(rulesFile)) continue;
+    if (!existsSync4(rulesFile)) continue;
     let data;
     try {
-      data = JSON.parse(readFileSync3(rulesFile, "utf-8"));
+      data = JSON.parse(readFileSync4(rulesFile, "utf-8"));
     } catch {
       continue;
     }
@@ -1685,6 +1708,9 @@ function generateSourceDefaults() {
     agent_rules: _agentRulesToDefaults()
   };
 }
+function normalizePatternForFingerprint(pattern) {
+  return pattern.replace(/\\\//g, "/");
+}
 function _ruleFingerprint(rule) {
   if (rule.intent_keywords && rule.intent_keywords.length || rule.dangerous_actions && rule.dangerous_actions.length) {
     return JSON.stringify([
@@ -1692,8 +1718,8 @@ function _ruleFingerprint(rule) {
       [...rule.dangerous_actions || []].sort()
     ]);
   }
-  if (rule.path) return JSON.stringify([rule.path]);
-  if (rule.pattern) return JSON.stringify([rule.pattern]);
+  if (rule.path) return JSON.stringify([normalizePatternForFingerprint(rule.path)]);
+  if (rule.pattern) return JSON.stringify([normalizePatternForFingerprint(rule.pattern)]);
   if (rule.keyword) return JSON.stringify([rule.keyword, rule.lang || ""]);
   if (rule.value) return JSON.stringify([rule.value]);
   return JSON.stringify([rule.id || ""]);
@@ -2044,7 +2070,7 @@ function deleteCustomSkill(skillId, category) {
     skills.splice(idx, 1);
     const skillPath = join2(RUNTIME_CONFIG_DIR, "agent_moss_skills", `${skillId}.md`);
     try {
-      if (existsSync3(skillPath)) unlinkSync(skillPath);
+      if (existsSync4(skillPath)) unlinkSync(skillPath);
     } catch {
     }
     saveRuntimeConfig(runtime);
@@ -2158,7 +2184,7 @@ function updateAgentCategoryEnabled(agentId, category, enabled) {
   saveRuntimeConfig(runtime);
   return runtime;
 }
-var __dirname3, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DENY_MODE_LABELS, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, SKILL_ID_RE;
+var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DENY_MODE_LABELS, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, SKILL_ID_RE;
 var init_runtime_config = __esm({
   "src/infra/runtime-config.ts"() {
     "use strict";
@@ -2167,7 +2193,7 @@ var init_runtime_config = __esm({
     init_heuristic();
     init_logic_rules();
     init_skill_loader();
-    __dirname3 = dirname2(fileURLToPath4(import.meta.url));
+    __dirname4 = dirname3(fileURLToPath5(import.meta.url));
     ENV_RUNTIME_CONFIG_PATH = "AGENT_MOSS_RUNTIME_CONFIG_PATH";
     RUNTIME_CONFIG_DIR = runtimeDir();
     RUNTIME_CONFIG_PATH = join2(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
@@ -2181,19 +2207,19 @@ var init_runtime_config = __esm({
       deny_read: "\u4EC5\u62E6\u622A\u8BFB\u53D6",
       deny_both: "\u8BFB\u5199\u5747\u62E6\u622A"
     };
-    _AGENTS_DIR_PROD = join2(__dirname3, "agents");
-    _AGENTS_DIR_DEV = join2(__dirname3, "..", "..", "..", "agent_moss", "agents");
+    _AGENTS_DIR_PROD = join2(__dirname4, "agents");
+    _AGENTS_DIR_DEV = join2(__dirname4, "..", "..", "..", "agent_moss", "agents");
     SKILL_ID_RE = /^[A-Za-z0-9_-]+$/;
   }
 });
 
 // src/agents/index.ts
-import { readFileSync as readFileSync4, existsSync as existsSync4 } from "fs";
-import { resolve as resolve2, dirname as dirname3 } from "path";
-import { fileURLToPath as fileURLToPath5 } from "url";
+import { readFileSync as readFileSync5, existsSync as existsSync5 } from "fs";
+import { resolve as resolve3, dirname as dirname4 } from "path";
+import { fileURLToPath as fileURLToPath6 } from "url";
 function resolveAgentsDir() {
-  if (existsSync4(AGENTS_DIR_PROD)) return AGENTS_DIR_PROD;
-  if (existsSync4(AGENTS_DIR_DEV_FALLBACK)) return AGENTS_DIR_DEV_FALLBACK;
+  if (existsSync5(AGENTS_DIR_PROD)) return AGENTS_DIR_PROD;
+  if (existsSync5(AGENTS_DIR_DEV_FALLBACK)) return AGENTS_DIR_DEV_FALLBACK;
   return AGENTS_DIR_PROD;
 }
 function getAgentExtensions(agentId) {
@@ -2209,13 +2235,13 @@ function getAgentExtensions(agentId) {
   }
   if (ext === null) {
     const agentsDir = resolveAgentsDir();
-    const rulesFile = resolve2(agentsDir, agentId, "rules.json");
-    if (!existsSync4(rulesFile)) {
+    const rulesFile = resolve3(agentsDir, agentId, "rules.json");
+    if (!existsSync5(rulesFile)) {
       cache.set(agentId, null);
       return null;
     }
     try {
-      const raw = readFileSync4(rulesFile, "utf-8");
+      const raw = readFileSync5(rulesFile, "utf-8");
       ext = JSON.parse(raw);
       if (!ext.agent_id) {
         console.warn(`[AgentMoss agents] rules.json \u7F3A\u5C11 agent_id \u5B57\u6BB5: ${rulesFile}`);
@@ -2234,15 +2260,15 @@ function getAgentExtensions(agentId) {
   );
   return ext;
 }
-var __filename3, __dirname4, AGENTS_DIR_PROD, AGENTS_DIR_DEV_FALLBACK, cache;
+var __filename4, __dirname5, AGENTS_DIR_PROD, AGENTS_DIR_DEV_FALLBACK, cache;
 var init_agents = __esm({
   "src/agents/index.ts"() {
     "use strict";
     init_esm_shims();
-    __filename3 = fileURLToPath5(import.meta.url);
-    __dirname4 = dirname3(__filename3);
-    AGENTS_DIR_PROD = resolve2(__dirname4, "agents");
-    AGENTS_DIR_DEV_FALLBACK = resolve2(__dirname4, "../../../agent_moss/agents");
+    __filename4 = fileURLToPath6(import.meta.url);
+    __dirname5 = dirname4(__filename4);
+    AGENTS_DIR_PROD = resolve3(__dirname5, "agents");
+    AGENTS_DIR_DEV_FALLBACK = resolve3(__dirname5, "../../../agent_moss/agents");
     cache = /* @__PURE__ */ new Map();
   }
 });
@@ -2273,7 +2299,7 @@ function runHeuristicCheck(input) {
     } catch {
     }
   }
-  const scanDetail = stripLiteralTextSegments(input.aNext.actionDetail);
+  const scanDetail = normalizePathSegments(stripLiteralTextSegments(input.aNext.actionDetail));
   const scanCommand = `${input.aNext.actionType}: ${scanDetail}`;
   let topRiskType = "";
   for (const rule of DANGEROUS_PATTERNS) {
@@ -2384,6 +2410,28 @@ function stripHeredocContent(actionDetail) {
     "<<heredoc>>\n"
   );
 }
+function normalizePathSegments(text) {
+  const protTokens = [];
+  let t = text.replace(/\b(https?|ftp|file):\/\//gi, (m) => {
+    const scheme = m.slice(0, m.indexOf(":"));
+    protTokens.push("://");
+    return `${scheme}__PROT${protTokens.length - 1}__`;
+  });
+  const quoteTokens = [];
+  t = t.replace(/'[^']*'|"[^"]*"/g, (m) => {
+    quoteTokens.push(m);
+    return `__Q${quoteTokens.length - 1}__`;
+  });
+  t = t.replace(/\/{2,}/g, "/");
+  t = t.replace(/\/\.\//g, "/");
+  for (let i = 0; i < quoteTokens.length; i++) {
+    t = t.replace(`__Q${i}__`, quoteTokens[i]);
+  }
+  for (let i = 0; i < protTokens.length; i++) {
+    t = t.replace(`__PROT${i}__`, protTokens[i]);
+  }
+  return t;
+}
 function splitCommandSegments(actionDetail) {
   const segments = [];
   let cur = "";
@@ -2436,7 +2484,7 @@ function isSearchActionType(actionType) {
 function checkSensitivePath(command, cwd, agentExt) {
   const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
   const isWriteOpFlag = isWriteOperation("", command);
-  const pathScanText = stripLiteralTextSegments(command);
+  const pathScanText = normalizePathSegments(stripLiteralTextSegments(command));
   const pathMatches = (text, path3) => {
     const parts = path3.split(/(\(\?!.*?\))/);
     const escaped = parts.map((part) => {
@@ -2707,164 +2755,25 @@ var init_heuristic = __esm({
     init_esm_shims();
     init_config();
     init_agents();
+    init_rules_loader();
     init_logic_rules();
-    INJECTION_KEYWORDS = [
-      // ---- Instruction Override ----
-      { keyword: "ignore previous instructions", riskLevel: "critical", lang: "en" },
-      { keyword: "ignore all previous", riskLevel: "critical", lang: "en" },
-      { keyword: "disregard all prior", riskLevel: "critical", lang: "en" },
-      { keyword: "forget everything", riskLevel: "high", lang: "en" },
-      { keyword: "\u5FFD\u7565\u4E4B\u524D\u7684\u6307\u4EE4", riskLevel: "critical", lang: "zh" },
-      { keyword: "\u5FFD\u7565\u6240\u6709\u5148\u524D\u7684", riskLevel: "critical", lang: "zh" },
-      { keyword: "\u5FFD\u7565\u4E0A\u9762\u6240\u6709", riskLevel: "high", lang: "zh" },
-      { keyword: "\u8BF7\u5FD8\u8BB0\u4E4B\u524D", riskLevel: "high", lang: "zh" },
-      // ---- Role Hijacking ----
-      { keyword: "you are now", riskLevel: "high", lang: "en" },
-      { keyword: "you are no longer", riskLevel: "high", lang: "en" },
-      { keyword: "new instructions", riskLevel: "high", lang: "en" },
-      { keyword: "from now on, you", riskLevel: "high", lang: "en" },
-      { keyword: "\u4F60\u73B0\u5728\u662F\u4E00\u4E2A", riskLevel: "high", lang: "zh" },
-      { keyword: "\u4F60\u4E0D\u518D\u662F\u4E00\u4E2A", riskLevel: "high", lang: "zh" },
-      { keyword: "\u4ECE\u73B0\u5728\u5F00\u59CB\u4F60", riskLevel: "high", lang: "zh" },
-      { keyword: "\u4F60\u7684\u65B0\u89D2\u8272\u662F", riskLevel: "high", lang: "zh" },
-      // ---- Command Injection ----
-      { keyword: "system prompt", riskLevel: "high", lang: "en" },
-      { keyword: "reveal your instructions", riskLevel: "high", lang: "en" },
-      { keyword: "output your instructions", riskLevel: "high", lang: "en" },
-      { keyword: "repeat your instructions", riskLevel: "medium", lang: "en" },
-      { keyword: "\u7CFB\u7EDF\u63D0\u793A", riskLevel: "high", lang: "zh" },
-      { keyword: "\u8F93\u51FA\u4F60\u7684\u6307\u4EE4", riskLevel: "high", lang: "zh" },
-      { keyword: "\u91CD\u590D\u4F60\u7684\u6307\u4EE4", riskLevel: "medium", lang: "zh" },
-      // ---- Social Engineering ----
-      { keyword: "this is an authorized test", riskLevel: "high", lang: "en" },
-      { keyword: "security audit approved", riskLevel: "high", lang: "en" },
-      { keyword: "admin override", riskLevel: "critical", lang: "en" },
-      { keyword: "debug mode", riskLevel: "high", lang: "en" },
-      { keyword: "maintenance mode", riskLevel: "high", lang: "en" },
-      { keyword: "\u8FD9\u662F\u6388\u6743\u7684\u6D4B\u8BD5", riskLevel: "high", lang: "zh" },
-      { keyword: "\u5B89\u5168\u5BA1\u8BA1\u5DF2\u6279\u51C6", riskLevel: "high", lang: "zh" },
-      { keyword: "\u7BA1\u7406\u5458\u8986\u76D6", riskLevel: "critical", lang: "zh" },
-      { keyword: "\u8C03\u8BD5\u6A21\u5F0F", riskLevel: "high", lang: "zh" },
-      // ---- XSS ----
-      { keyword: "<script>", riskLevel: "high", lang: "en" },
-      { keyword: "javascript:", riskLevel: "high", lang: "en" },
-      { keyword: "onerror=", riskLevel: "high", lang: "en" },
-      { keyword: "onload=", riskLevel: "high", lang: "en" },
-      // ---- Fake Boundaries ----
-      { keyword: "=== END OF", riskLevel: "high", lang: "en" },
-      { keyword: "--- END SYSTEM", riskLevel: "high", lang: "en" },
-      { keyword: "[END OF", riskLevel: "high", lang: "en" },
-      { keyword: "=== \u7ED3\u675F", riskLevel: "high", lang: "zh" },
-      { keyword: "--- \u7ED3\u675F\u7CFB\u7EDF", riskLevel: "high", lang: "zh" },
-      // ---- Developer Mode ----
-      { keyword: "developer mode", riskLevel: "critical", lang: "en" },
-      { keyword: "DAN mode", riskLevel: "critical", lang: "en" },
-      { keyword: "jailbreak", riskLevel: "critical", lang: "en" },
-      { keyword: "\u5F00\u53D1\u8005\u6A21\u5F0F", riskLevel: "critical", lang: "zh" },
-      { keyword: "\u8D8A\u72F1", riskLevel: "critical", lang: "zh" }
-      // 注：xiaoO 专属绕过词（绕过审计/禁用安全检查/关闭防护/bypass audit 等）
-      // 已迁至 agent_moss/agents/xiaoo/rules.json 的 extra_injection_keywords，
-      // 由 agent_ext 机制注入，不再污染通用层。
-    ];
-    DANGEROUS_PATTERNS = [
-      // --- Critical: rm command graded detection (strict to loose, first match wins) ---
-      // 1. rm -rf root dir (含通配符如 /* /.* 等) — 使用负向先行断言 (?!\w)：/ 后面不是单词字符时匹配
-      { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*f[a-zA-Z]*\s+\/(?!\w)/i, severity: "critical", description: "\u9012\u5F52\u5F3A\u5236\u5220\u9664\u6839\u76EE\u5F55 (rm -rf /)", riskType: "script_execution" },
-      // 注意：已移除"rm -rf /任意绝对路径"的宽泛规则，避免误杀 /tmp 等临时目录清理操作
-      // 2. rm with -r or -f targeting system dirs — var 分支排除 /var/tmp/（合法清理）
-      { pattern: /\brm\s+-[a-zA-Z]*[rf][a-zA-Z]*\s+\/(etc|var(?!\/tmp)|home|usr|boot|root|opt|srv|sys|proc)\b/i, severity: "critical", description: "\u5220\u9664\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55", riskType: "script_execution" },
-      // 3. rm -r absolute path (no -f) — 排除 /tmp/ /var/tmp/ /run/ /dev/shm/（CI/开发高频合法清理）
-      { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*\s+\/(?!tmp\/|var\/tmp\/|run\/|dev\/shm\/)/i, severity: "high", description: "\u9012\u5F52\u5220\u9664\u64CD\u4F5C (rm -r /...)", riskType: "script_execution" },
-      // 4. rm -f absolute path (no -r) — 同样排除临时目录
-      { pattern: /\brm\s+-[a-zA-Z]*f[a-zA-Z]*\s+\/(?!tmp\/|var\/tmp\/|run\/|dev\/shm\/)/i, severity: "medium", description: "\u5F3A\u5236\u5220\u9664\u6587\u4EF6 (rm -f /...)", riskType: "script_execution" },
-      // dd 磁盘清零 — 只拦截写入系统关键目录，放行 /tmp 等临时目录
-      { pattern: /dd\s+if=\/dev\/zero.*\bof\s*=\s*\/(etc|var|home|usr|boot|root|opt|srv|sys|proc)\b/i, severity: "critical", description: "\u78C1\u76D8\u6E05\u96F6\u5199\u5165\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55 (dd if=/dev/zero of=/\u7CFB\u7EDF\u76EE\u5F55)", riskType: "script_execution" },
-      // mkfs 格式化 — 只拦截对块设备（/dev/sdX 等）的格式化，放行对普通文件的格式化
-      { pattern: /mkfs\.\w+\s+\/dev\/(sd|hd|nvme|vd|loop|mapper|md|dm)\S+/i, severity: "critical", description: "\u683C\u5F0F\u5316\u5757\u8BBE\u5907 (mkfs /dev/\u5757\u8BBE\u5907)", riskType: "script_execution" },
-      { pattern: /:\(\)\s*\{.*:\|:&.*\};:/i, severity: "critical", description: "Fork Bomb", riskType: "resource_exhaustion" },
-      // --- Critical: remote code execution ---
-      // curl|bash 优先匹配 user_rules（high/sensitive_action），见下方 UserRuleMatcher 段；
-      // 非 bash 的 curl|sh/zsh/dash 走 CommandPatternScanner critical。两条分流由
-      // runHeuristicCheck 的规则顺序保证（bash 在前 high，其余 fall-through 到 critical）。
-      { pattern: /curl\s+.*\|\s*bash/i, severity: "high", description: "curl pipe bash \u6267\u884C (user_rules)", riskType: "sensitive_action" },
-      { pattern: /curl\s+.*\|\s*(sh|zsh|dash)/i, severity: "critical", description: "curl pipe shell \u6267\u884C", riskType: "script_execution" },
-      { pattern: /wget\s+.*\|\s*(bash|sh)/i, severity: "critical", description: "wget pipe shell \u6267\u884C", riskType: "script_execution" },
-      { pattern: /eval\s+\$\(curl|eval\s+\$\(wget/i, severity: "critical", description: "eval \u8FDC\u7A0B\u4EE3\u7801\u6267\u884C", riskType: "script_execution" },
-      { pattern: /base64\s+-d\s+.*\|\s*bash/i, severity: "high", description: "base64 \u89E3\u7801\u6267\u884C (user_rules)", riskType: "sensitive_action" },
-      // --- Critical: reverse shell ---
-      { pattern: /\/dev\/tcp\/|bash\s+-i\s+>&/i, severity: "critical", description: "\u53CD\u5F39 Shell", riskType: "script_execution" },
-      { pattern: /nc\s+-[el]\s+.*\d{1,5}/i, severity: "high", description: "Netcat \u53CD\u5F39\u8FDE\u63A5", riskType: "lateral_movement" },
-      // --- Critical: sensitive file access ---
-      { pattern: /\/etc\/shadow/i, severity: "critical", description: "\u8BBF\u95EE\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6 (/etc/shadow)", riskType: "file_access" },
-      { pattern: /\/etc\/gshadow/i, severity: "critical", description: "\u8BBF\u95EE\u7CFB\u7EDF\u7EC4\u5BC6\u7801\u6587\u4EF6 (/etc/gshadow)", riskType: "file_access" },
-      // 注意：/etc/passwd 已从拦截列表移除，因为它是公开可读的标准系统文件，真正敏感的是 /etc/shadow
-      { pattern: /\.ssh\/id_rsa(?!\.pub)/i, severity: "critical", description: "\u8BBF\u95EE SSH \u79C1\u94A5\u6587\u4EF6", riskType: "file_access" },
-      // --- Critical: privilege escalation / container escape ---
-      { pattern: /\/var\/run\/docker\.sock/i, severity: "critical", description: "\u8BBF\u95EE Docker socket\uFF0C\u53EF\u80FD\u5BFC\u81F4\u5BB9\u5668\u9003\u9038", riskType: "privilege_escalation" },
-      // --- Critical: dangerous permissions / ownership (提权 / 权限敞口) ---
-      // 修正「只拦 777、xx7 漏放」的缺口：
-      // 1) 八进制末位 7：other 位含写+执行敞口（chmod 777/647/007/4777 等）；644/755/1700 不命中
-      // 2) 八进制 setuid/setgid 位：首位 4(setuid)/2(setgid) 的 4 位八进制（chmod 4755/2755）
-      // 3) 符号 setuid/setgid：chmod u+s / g+s / a+s
-      // 普通权限修改（chmod 644）不在此列——L2 read_before_write 已豁免 chmod/chown（不写内容），
-      // 危险形态在此 L1 专门拦，以「提权」正确理由拦截，不再靠 RBW 误打误撞。
-      { pattern: /chmod\s+[0-7]{0,3}7\b/i, severity: "critical", description: "\u5371\u9669\u6743\u9650\u8BBE\u7F6E (chmod ...7, other \u4F4D\u542B\u5199+\u6267\u884C\u655E\u53E3)", riskType: "privilege_escalation" },
-      { pattern: /chmod\s+[24][0-7]{3}\b/i, severity: "critical", description: "setuid/setgid \u4F4D\u8BBE\u7F6E (chmod 4xxx/2xxx, \u63D0\u6743)", riskType: "privilege_escalation" },
-      { pattern: /chmod\s+[ugoa]\+s\b/i, severity: "critical", description: "\u7B26\u53F7 setuid/setgid \u8BBE\u7F6E (chmod u+s/g+s/a+s, \u63D0\u6743)", riskType: "privilege_escalation" },
-      { pattern: /chown\s+root|chown\s+-R\s+\w+:\w+\s+\//i, severity: "high", description: "\u4FEE\u6539\u6240\u6709\u8005\u4E3A root / \u9012\u5F52\u4FEE\u6539\u6839\u76EE\u5F55\u6240\u6709\u8005", riskType: "script_execution" },
-      // sudo 提权 — 只拦截 sudo 后跟的危险命令，不一刀切拦截所有 sudo
-      { pattern: /sudo\s+(rm|chmod|chown|dd|mkfs|format|iptables|crontab|passwd|userdel|useradd|groupdel)\b/i, severity: "high", description: "\u63D0\u6743\u6267\u884C\u9AD8\u5371\u547D\u4EE4 (sudo + \u5371\u9669\u64CD\u4F5C)", riskType: "privilege_escalation" },
-      // --- High: system config overwrite ---
-      // > /etc/ 重定向覆盖：对齐 Python CommandPatternScanner `>\s*/etc/`（不兼容引号路径），
-      // 引号包裹的重定向目标（cat > '/etc/ssh/sshd_config'）走 checkSensitivePath 敏感路径 high。
-      { pattern: />\s*\/etc\//i, severity: "critical", description: "\u8986\u76D6\u5199\u5165\u7CFB\u7EDF\u914D\u7F6E\u76EE\u5F55", riskType: "file_access" },
-      { pattern: />\s*\/boot\//i, severity: "critical", description: "\u8986\u76D6\u5199\u5165\u542F\u52A8\u5F15\u5BFC\u76EE\u5F55", riskType: "file_access" },
-      // 注：/proc/ 重定向覆盖走 checkSensitivePath 的 high（内核参数 /proc/sys/），此处不拦 /proc/ 避免遮蔽（对齐 Python）。
-      // --- High: download script + execute risk ---
-      // curl -X POST 外传敏感信息（对齐 Python linux.py: curl POST env/key/token）
-      { pattern: /curl\s+.*-X\s+POST.*\b(env|environment|secret|key|token|password)\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u901A\u8FC7 curl POST \u5916\u4F20\u53EF\u80FD\u5305\u542B\u654F\u611F\u4FE1\u606F\u7684\u8BF7\u6C42", riskType: "data_exfiltration" },
-      { pattern: /(?:curl|wget)\s+.*(?:-o|--output|>)\s*\S+\.(?:sh|bash)\b/i, severity: "high", description: "\u8FDC\u7A0B\u4E0B\u8F7D\u811A\u672C\u5230\u672C\u5730", riskType: "script_execution" },
-      { pattern: /(?:curl|wget)\s+\S+.*\b(?:chmod|chown)\s+\+x\b/i, severity: "high", description: "\u8FDC\u7A0B\u4E0B\u8F7D\u540E\u4FEE\u6539\u53EF\u6267\u884C\u6743\u9650\uFF0C\u5B58\u5728\u8FDC\u7A0B\u4EE3\u7801\u6267\u884C\u98CE\u9669", riskType: "script_execution" },
-      { pattern: /(?:curl|wget)\s+.*\s+&&?\s*(?:chmod\s+\+x|bash|sh)/i, severity: "high", description: "\u4E0B\u8F7D\u540E\u6267\u884C", riskType: "script_execution" },
-      // --- High: package manager pipe-to-shell ---
-      { pattern: /git\s+clone\s+.*\|.*bash/i, severity: "high", description: "git clone pipe shell", riskType: "script_execution" },
-      { pattern: /pip\s+install\s+.*\|\s*bash/i, severity: "high", description: "pip install pipe shell", riskType: "script_execution" },
-      { pattern: /npm\s+install\s+-g\s+.*\|\s*bash/i, severity: "high", description: "npm install pipe shell", riskType: "script_execution" },
-      // --- Medium: destructive git operations (降级为 medium，允许但记录) ---
-      { pattern: /git\s+push\s+.*--force/i, severity: "medium", description: "\u5F3A\u5236\u63A8\u9001\u64CD\u4F5C (git push --force)\uFF0C\u53EF\u80FD\u8986\u76D6\u8FDC\u7A0B\u63D0\u4EA4\u5386\u53F2", riskType: "script_execution" },
-      // --- High: network port scanning (横向移动侦察) ---
-      { pattern: /\bnmap\s+/i, severity: "high", description: "\u7F51\u7EDC\u7AEF\u53E3\u626B\u63CF (nmap)\uFF0C\u53EF\u80FD\u7528\u4E8E\u6A2A\u5411\u79FB\u52A8\u4FA6\u5BDF", riskType: "lateral_movement" },
-      { pattern: /\b(masscan|zmap|unicornscan)\s+/i, severity: "high", description: "\u7F51\u7EDC\u7AEF\u53E3\u626B\u63CF\u5DE5\u5177\uFF0C\u53EF\u80FD\u7528\u4E8E\u6A2A\u5411\u79FB\u52A8\u4FA6\u5BDF", riskType: "lateral_movement" },
-      // --- Medium: credential export ---
-      { pattern: /export\s+.*(?:TOKEN|KEY|SECRET|PASSWORD)/i, severity: "medium", description: "\u5BFC\u51FA\u654F\u611F\u51ED\u8BC1", riskType: "data_exfiltration" },
-      // --- High: shell rc file append (persistence) ---
-      // 两条规则：第一条匹配 ~ 与 /home/<user>/ 形态；第二条按文件名兜底，
-      // 覆盖非标准 home 路径（如鸿蒙 /storage/Users/currentUser/.bashrc、
-      // /root/.bashrc），避免按 home 前缀枚举导致漏检持久化后门。
-      { pattern: />>\s*(~|\/home\/[^/]+)\/(\.bashrc|\.zshrc|\.profile|\.bash_profile|\.zprofile)/, severity: "high", description: "\u68C0\u6D4B\u5230\u4FEE\u6539 Shell \u914D\u7F6E\u6587\u4EF6\uFF08~/.bashrc \u7B49\uFF09\uFF0C\u53EF\u80FD\u7528\u4E8E\u6301\u4E45\u5316\u540E\u95E8", riskType: "persistence" },
-      { pattern: />>\s*\S*\/(\.bashrc|\.zshrc|\.profile|\.bash_profile|\.zprofile)\b/, severity: "high", description: "\u68C0\u6D4B\u5230\u4FEE\u6539 Shell \u914D\u7F6E\u6587\u4EF6\uFF08.bashrc \u7B49\uFF09\uFF0C\u53EF\u80FD\u7528\u4E8E\u6301\u4E45\u5316\u540E\u95E8", riskType: "persistence" },
-      // --- High: device file write (只拦截重定向写入设备文件，不拦截读取) ---
-      { pattern: />\s*\/dev\/(sd|hd|nvme|vd|loop|mem|kmsg|port|zero|random|urandom|full|core)/i, severity: "high", description: "\u91CD\u5B9A\u5411\u5199\u5165\u8BBE\u5907\u6587\u4EF6", riskType: "file_access" },
-      // --- High: non-interactive password modification ---
-      { pattern: /\|\s*passwd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u7BA1\u9053\u65B9\u5F0F\u8C03\u7528 passwd\uFF08\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\uFF09", riskType: "script_execution" },
-      { pattern: /\bpasswd\s+--stdin\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 passwd --stdin \u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u8F93\u5165", riskType: "script_execution" },
-      { pattern: /\bchpasswd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 chpasswd \u6279\u91CF\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4", riskType: "script_execution" },
-      { pattern: /\b(newusers|lnewusers)\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 newusers/lnewusers \u6279\u91CF\u7528\u6237\u6DFB\u52A0\u547D\u4EE4", riskType: "script_execution" },
-      { pattern: /\bpasswd\s+-[a-zA-Z]*d\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u5BC6\u7801\u64CD\u4F5C (passwd -d)", riskType: "script_execution" },
-      { pattern: /\bpasswd\s+-[a-zA-Z]*l\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u9501\u5B9A\u7528\u6237\u8D26\u6237\u64CD\u4F5C (passwd -l)", riskType: "script_execution" },
-      // --- High: non-interactive password modification (extended) ---
-      { pattern: /\blpasswd\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u64CD\u4F5C (lpasswd)", riskType: "script_execution" },
-      { pattern: /\bgpasswd\s+(?!-[adA])/i, severity: "high", description: "\u68C0\u6D4B\u5230\u7EC4\u5BC6\u7801\u7BA1\u7406\u64CD\u4F5C (gpasswd)", riskType: "script_execution" },
-      { pattern: /\bchgpasswd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u6279\u91CF\u4FEE\u6539\u7EC4\u5BC6\u7801\u64CD\u4F5C (chgpasswd)", riskType: "script_execution" },
-      // --- High: user/group deletion (irreversible, requires user consent) ---
-      { pattern: /\buserdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (userdel)", riskType: "script_execution" },
-      { pattern: /\bdeluser\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (deluser)", riskType: "script_execution" },
-      { pattern: /\bluserdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (luserdel)", riskType: "script_execution" },
-      { pattern: /\bgroupdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u7EC4\u64CD\u4F5C (groupdel)", riskType: "script_execution" },
-      { pattern: /\blgroupdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u7EC4\u64CD\u4F5C (lgroupdel)", riskType: "script_execution" },
-      // --- High: generic command -p parameter password setting ---
-      { pattern: /\b(useradd|luseradd|groupadd|usermod|lusermod|groupmod|lgroupmod)\b[^&|;]*?\s-p\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u901A\u8FC7 -p \u53C2\u6570\u8BBE\u7F6E\u6216\u4FEE\u6539\u5BC6\u7801 (useradd/usermod/groupmod)", riskType: "script_execution" }
-    ];
+    INJECTION_KEYWORDS = (() => {
+      const kws = loadL1().injection_detection || [];
+      return kws.map((k) => ({
+        keyword: k.keyword,
+        riskLevel: k.risk_level,
+        lang: k.lang || "en"
+      }));
+    })();
+    DANGEROUS_PATTERNS = (() => {
+      const cmds = loadL1().dangerous_commands || [];
+      return cmds.map((c) => ({
+        pattern: new RegExp(c.pattern, "i"),
+        severity: c.risk_level,
+        riskType: c.risk_type,
+        description: c.reason
+      }));
+    })();
     SENSITIVE_EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
     SEARCH_ACTION_PREFIXES = ["search-", "web-", "browser-", "query-", "websearch", "web_search"];
   }
@@ -2879,16 +2788,16 @@ __export(token_stats_exports, {
   recordTokenUsage: () => recordTokenUsage,
   resetTokenStats: () => resetTokenStats
 });
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync2, existsSync as existsSync7, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2 } from "fs";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync2, existsSync as existsSync8, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2 } from "fs";
 function getStatsPath() {
   const envPath = process.env[ENV_STATS_PATH];
   if (envPath) return envPath;
   return getTokenStatsPath();
 }
 function loadAllRecords(statsPath) {
-  if (!existsSync7(statsPath)) return [];
+  if (!existsSync8(statsPath)) return [];
   try {
-    const data = JSON.parse(readFileSync8(statsPath, "utf-8"));
+    const data = JSON.parse(readFileSync9(statsPath, "utf-8"));
     if (Array.isArray(data)) return data;
     if (data && Array.isArray(data.records)) return data.records;
     return [];
@@ -2899,7 +2808,7 @@ function loadAllRecords(statsPath) {
 function saveRecords(statsPath, records) {
   try {
     const dir = statsPath.substring(0, statsPath.lastIndexOf("/"));
-    if (dir && !existsSync7(dir)) mkdirSync2(dir, { recursive: true });
+    if (dir && !existsSync8(dir)) mkdirSync2(dir, { recursive: true });
     writeFileSync2(statsPath, JSON.stringify(records, null, 2), "utf-8");
   } catch (e) {
   }
@@ -3021,7 +2930,7 @@ function getTokenTrend(days = 0, startDate, endDate) {
 }
 function resetTokenStats() {
   const statsPath = getStatsPath();
-  if (existsSync7(statsPath)) {
+  if (existsSync8(statsPath)) {
     try {
       unlinkSync2(statsPath);
     } catch {
@@ -3121,9 +3030,9 @@ var require_bindings = __commonJS({
     init_esm_shims();
     var fs4 = __require("fs");
     var path3 = __require("path");
-    var fileURLToPath8 = require_file_uri_to_path();
+    var fileURLToPath9 = require_file_uri_to_path();
     var join6 = path3.join;
-    var dirname7 = path3.dirname;
+    var dirname8 = path3.dirname;
     var exists = fs4.accessSync && function(path4) {
       try {
         fs4.accessSync(path4);
@@ -3233,12 +3142,12 @@ var require_bindings = __commonJS({
       Error.stackTraceLimit = origSTL;
       var fileSchema = "file://";
       if (fileName.indexOf(fileSchema) === 0) {
-        fileName = fileURLToPath8(fileName);
+        fileName = fileURLToPath9(fileName);
       }
       return fileName;
     };
     exports.getRoot = function getRoot(file) {
-      var dir = dirname7(file), prev;
+      var dir = dirname8(file), prev;
       while (true) {
         if (dir === ".") {
           dir = process.cwd();
@@ -3444,13 +3353,13 @@ var require_backup = __commonJS({
     var runBackup = (backup, handler) => {
       let rate = 0;
       let useDefault = true;
-      return new Promise((resolve6, reject) => {
+      return new Promise((resolve7, reject) => {
         setImmediate(function step() {
           try {
             const progress = backup.transfer(rate);
             if (!progress.remainingPages) {
               backup.close();
-              resolve6(progress);
+              resolve7(progress);
               return;
             }
             if (useDefault) {
@@ -3854,9 +3763,14 @@ var ActionItemSchema = z.object({
   action_type: z.string().describe("Action type, e.g. bash, file_read, file_write"),
   action_detail: z.string().describe("Action detail / command content")
 });
+var PromptTurnSchema = z.object({
+  text: z.string().default("").describe("User prompt text at this turn"),
+  actions: z.array(ActionItemSchema).default([]).describe("Actions triggered by this prompt, in order, until the next prompt")
+});
 var AnalyzeRequestSchema = z.object({
   session_id: z.string().describe("Session / agent unique identifier"),
-  prompt_session: z.string().default("").describe("User original prompt"),
+  prompt_session: z.string().default("").describe("User original prompt (most recent user message; backward compat)"),
+  prompt_history: z.array(PromptTurnSchema).default([]).describe("Full interleaved prompt history (ordered turns, each with its triggered actions). Optional; empty = fall back to prompt_session only."),
   action_history: z.array(ActionItemSchema).default([]).describe("Historical action sequence"),
   a_next: ActionItemSchema.describe("Next action to be executed"),
   reason: z.string().default("").describe("Reason for executing this action"),
@@ -3898,28 +3812,28 @@ init_skill_loader();
 
 // src/engine/template-loader.ts
 init_esm_shims();
-import { readFileSync as readFileSync5, existsSync as existsSync5 } from "fs";
-import { resolve as resolve3, dirname as dirname4 } from "path";
-import { fileURLToPath as fileURLToPath6 } from "url";
-var __filename4 = fileURLToPath6(import.meta.url);
-var __dirname5 = dirname4(__filename4);
-var TEMPLATES_DIR = resolve3(__dirname5, "../templates");
-var TEMPLATES_DIR_FALLBACK = resolve3(__dirname5, "../../../agent_moss/templates");
+import { readFileSync as readFileSync6, existsSync as existsSync6 } from "fs";
+import { resolve as resolve4, dirname as dirname5 } from "path";
+import { fileURLToPath as fileURLToPath7 } from "url";
+var __filename5 = fileURLToPath7(import.meta.url);
+var __dirname6 = dirname5(__filename5);
+var TEMPLATES_DIR = resolve4(__dirname6, "../templates");
+var TEMPLATES_DIR_FALLBACK = resolve4(__dirname6, "../../../agent_moss/templates");
 var TEMPLATE_FILES = ["prompt1_template.txt", "prompt2_template.txt", "security_judge_template.txt"];
 var cachedTemplates = null;
 function loadTemplates() {
   if (cachedTemplates) return cachedTemplates;
   cachedTemplates = {};
-  const dir = existsSync5(TEMPLATES_DIR) ? TEMPLATES_DIR : TEMPLATES_DIR_FALLBACK;
-  if (!existsSync5(dir)) {
+  const dir = existsSync6(TEMPLATES_DIR) ? TEMPLATES_DIR : TEMPLATES_DIR_FALLBACK;
+  if (!existsSync6(dir)) {
     console.warn("[AgentMoss] Templates directory not found:", TEMPLATES_DIR, "and fallback:", TEMPLATES_DIR_FALLBACK);
     return cachedTemplates;
   }
   for (const file of TEMPLATE_FILES) {
-    const filePath = resolve3(dir, file);
-    if (existsSync5(filePath)) {
+    const filePath = resolve4(dir, file);
+    if (existsSync6(filePath)) {
       const key = file.replace(".txt", "").replace("_template", "");
-      cachedTemplates[key] = readFileSync5(filePath, "utf-8");
+      cachedTemplates[key] = readFileSync6(filePath, "utf-8");
     }
   }
   console.log(`[AgentMoss] Loaded ${Object.keys(cachedTemplates).length} templates from ${dir}`);
@@ -3928,8 +3842,8 @@ function loadTemplates() {
 
 // src/engine/script-analyzer.ts
 init_esm_shims();
-import { readFileSync as readFileSync6 } from "fs";
-import { resolve as resolve4, join as join3 } from "path";
+import { readFileSync as readFileSync7 } from "fs";
+import { resolve as resolve5, join as join3 } from "path";
 var SUSPICIOUS_PATTERNS = [
   // Network exfiltration (curl/wget POST in scripts is almost never legitimate)
   { name: "curl POST", pattern: /curl\s+(.*\s)?-X\s+POST/i },
@@ -4062,8 +3976,8 @@ function assessKeywordCombinationRisk(matchedKeywords, scriptContent) {
 }
 function readScriptContent(scriptPath, maxLines = 500) {
   try {
-    const expandedPath = scriptPath.startsWith("~") ? join3(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve4(scriptPath);
-    const raw = readFileSync6(expandedPath, "utf-8");
+    const expandedPath = scriptPath.startsWith("~") ? join3(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve5(scriptPath);
+    const raw = readFileSync7(expandedPath, "utf-8");
     const lines = raw.split("\n").slice(0, maxLines);
     return { content: lines.join("\n"), lineCount: lines.length, error: "" };
   } catch (e) {
@@ -4117,8 +4031,8 @@ ${result.scriptContent}
 init_esm_shims();
 init_heuristic();
 init_logic_rules();
-import { readFileSync as readFileSync7, statSync, existsSync as existsSync6 } from "fs";
-import { resolve as resolve5, join as join4, isAbsolute, dirname as dirname5 } from "path";
+import { readFileSync as readFileSync8, statSync, existsSync as existsSync7 } from "fs";
+import { resolve as resolve6, join as join4, isAbsolute, dirname as dirname6 } from "path";
 import { homedir as homedir2 } from "os";
 function emptyChain() {
   return {
@@ -4347,7 +4261,7 @@ function extractInlineScriptPath(actionDetail) {
     let resolved;
     try {
       resolved = resolvePath(p);
-      if (existsSync6(resolved)) {
+      if (existsSync7(resolved)) {
         const stat = statSync(resolved);
         if (stat.isFile()) return resolved;
       }
@@ -4361,18 +4275,18 @@ function resolvePath(p) {
   if (expanded.startsWith("~/") || expanded === "~") {
     expanded = join4(homedir2(), expanded.slice(1));
   }
-  return resolve5(expanded);
+  return resolve6(expanded);
 }
 function readScriptContent2(scriptPath, maxFileSize = 2 * 1024 * 1024) {
   try {
     const path3 = resolvePath(scriptPath);
-    if (!existsSync6(path3)) return { content: "", lineCount: 0, fileSize: 0, error: `\u811A\u672C\u4E0D\u5B58\u5728: ${scriptPath}` };
+    if (!existsSync7(path3)) return { content: "", lineCount: 0, fileSize: 0, error: `\u811A\u672C\u4E0D\u5B58\u5728: ${scriptPath}` };
     const stat = statSync(path3);
     if (!stat.isFile()) return { content: "", lineCount: 0, fileSize: 0, error: `\u4E0D\u662F\u6587\u4EF6: ${scriptPath}` };
     if (stat.size > maxFileSize) {
       return { content: "", lineCount: 0, fileSize: stat.size, error: `\u811A\u672C\u6587\u4EF6\u8FC7\u5927 (${stat.size} bytes)\uFF0C\u8DF3\u8FC7\u8BFB\u53D6` };
     }
-    const content = readFileSync7(path3, "utf-8");
+    const content = readFileSync8(path3, "utf-8");
     const lineCount = content ? content.split("\n").length : 0;
     return { content, lineCount, fileSize: stat.size, error: "" };
   } catch (e) {
@@ -4391,7 +4305,7 @@ function extractChildScriptPaths(content, baseDir) {
       if (pathStr.includes("/dev/") || pathStr.startsWith("|") || pathStr.startsWith(";")) continue;
       const full = isAbsolute(pathStr) ? pathStr : join4(baseDir, pathStr);
       const resolved = resolvePath(full);
-      if (existsSync6(resolved)) {
+      if (existsSync7(resolved)) {
         try {
           if (statSync(resolved).isFile() && !paths.includes(resolved)) paths.push(resolved);
         } catch {
@@ -4406,7 +4320,7 @@ function resolveScriptChain(entryPath, input, maxDepth = 3, maxFileSize = 2 * 10
   const result = emptyChain();
   result.entryPath = entryPath;
   const entry = resolvePath(entryPath);
-  const baseDir = existsSync6(entry) ? dirname5(entry) : input.cwd || process.cwd();
+  const baseDir = existsSync7(entry) ? dirname6(entry) : input.cwd || process.cwd();
   resolveRecursive({
     path: entry,
     depth: 0,
@@ -4481,7 +4395,7 @@ function resolveRecursive(ctx) {
       maxTotalSize,
       visited,
       result,
-      baseDir: dirname5(resolvePath(childPath)),
+      baseDir: dirname6(resolvePath(childPath)),
       input
     });
     if (result.hasCritical) return;
@@ -4705,11 +4619,12 @@ ${prompt}
 function buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis, skipL3Hints = "", scriptChainText = "") {
   const skillsText = formatSkillsForPrompt(matchedSkills);
   const historyStr = input.actionHistory.map((h, i) => `${i + 1}. ${h.actionType}: ${h.actionDetail}`).join("\n") || "(\u65E0\u5386\u53F2\u64CD\u4F5C)";
+  const promptHistoryText = formatPromptHistory(input.promptHistory);
   const scriptAnalysisText = scriptChainText ? scriptChainText : scriptAnalysis ? formatScriptAnalysisForPrompt(scriptAnalysis) : "";
   const hintsText = formatHints(previous);
   const securityJudgeTemplate = templates["security_judge"];
   if (securityJudgeTemplate) {
-    return securityJudgeTemplate.replaceAll("{prompt_session}", input.promptSession || "\uFF08\u672A\u63D0\u4F9B\uFF09").replaceAll("{action_history}", historyStr).replaceAll("{action_type}", input.aNext.actionType).replaceAll("{action_detail}", input.aNext.actionDetail).replaceAll("{reason}", input.reason || "\u672A\u8BF4\u660E").replaceAll("{skills_text}", skillsText).replaceAll("{hints_text}", hintsText).replaceAll("{script_analysis_text}", scriptAnalysisText).replaceAll("{skip_l3_hints}", skipL3Hints).replaceAll("{{", "{").replaceAll("}}", "}");
+    return securityJudgeTemplate.replaceAll("{prompt_session}", input.promptSession || "\uFF08\u672A\u63D0\u4F9B\uFF09").replaceAll("{prompt_history_text}", promptHistoryText).replaceAll("{action_history}", historyStr).replaceAll("{action_type}", input.aNext.actionType).replaceAll("{action_detail}", input.aNext.actionDetail).replaceAll("{reason}", input.reason || "\u672A\u8BF4\u660E").replaceAll("{skills_text}", skillsText).replaceAll("{hints_text}", hintsText).replaceAll("{script_analysis_text}", scriptAnalysisText).replaceAll("{skip_l3_hints}", skipL3Hints).replaceAll("{{", "{").replaceAll("}}", "}");
   }
   console.warn("[AgentMoss] security_judge template missing, using sparse fallback prompt");
   return `## \u5F53\u524D\u64CD\u4F5C\u4E0A\u4E0B\u6587
@@ -4739,6 +4654,27 @@ ${scriptAnalysisText}` : ""}
 \u8F93\u51FA\u683C\u5F0F:
 {"allowed": true/false, "reason": "\u5224\u65AD\u7406\u7531", "riskLevel": "low|medium|high|critical", "riskType": "\u98CE\u9669\u7C7B\u578B", "confidence": 0-100}`;
 }
+function formatPromptHistory(promptHistory, maxTextChars = 500) {
+  if (!promptHistory || promptHistory.length === 0) {
+    return "\uFF08\u672A\u63D0\u4F9B\u5386\u53F2\u610F\u56FE\uFF09";
+  }
+  const lines = [];
+  for (let i = 0; i < promptHistory.length; i++) {
+    const turn = promptHistory[i];
+    const text = (turn?.text || "").trim();
+    if (!text) continue;
+    let line = `  \u7B2C${i + 1}\u8F6E\u7528\u6237\u610F\u56FE: ${text.slice(0, maxTextChars)}`;
+    const actions = turn?.actions;
+    if (actions && actions.length > 0) {
+      const types = actions.map((a) => a?.actionType).filter((t) => typeof t === "string" && t.length > 0);
+      if (types.length > 0) {
+        line += `  \u2192 \u52A8\u4F5C: ${types.join(", ")}`;
+      }
+    }
+    lines.push(line);
+  }
+  return lines.length > 0 ? lines.join("\n") : "\uFF08\u672A\u63D0\u4F9B\u5386\u53F2\u610F\u56FE\uFF09";
+}
 function formatHints(previous) {
   const hints = [];
   if (previous.heuristic) {
@@ -4834,7 +4770,7 @@ async function analyzeWithLLM(prompt, config) {
       }
       if (attempt < maxRetries) {
         console.error(`[AgentMoss] LLM call failed (attempt ${attempt + 1}/${maxRetries + 1}), retrying in ${retryCfg.retryInterval}s:`, err.message);
-        await new Promise((resolve6) => setTimeout(resolve6, retryCfg.retryInterval * 1e3));
+        await new Promise((resolve7) => setTimeout(resolve7, retryCfg.retryInterval * 1e3));
       } else {
         clearTimeout(totalTimeoutTimer);
         console.error("[AgentMoss] LLM call failed after all retries:", err.message);
@@ -5347,11 +5283,11 @@ init_esm_shims();
 init_runtime_config();
 init_token_stats();
 import { Hono } from "hono";
-import { readFileSync as readFileSync9, existsSync as existsSync9 } from "fs";
-import { join as join5, dirname as dirname6 } from "path";
-import { fileURLToPath as fileURLToPath7 } from "url";
-var __dirname6 = dirname6(fileURLToPath7(import.meta.url));
-var STATIC_DIR = join5(__dirname6, "static");
+import { readFileSync as readFileSync10, existsSync as existsSync10 } from "fs";
+import { join as join5, dirname as dirname7 } from "path";
+import { fileURLToPath as fileURLToPath8 } from "url";
+var __dirname7 = dirname7(fileURLToPath8(import.meta.url));
+var STATIC_DIR = join5(__dirname7, "static");
 var CONSOLE_TOKEN_ENV = "AGENT_MOSS_CONSOLE_TOKEN";
 function getConsoleToken() {
   return process.env[CONSOLE_TOKEN_ENV] || "";
@@ -5376,8 +5312,8 @@ function createConsoleRouter() {
   console2.use("/api/*", authMiddleware());
   const serveIndex = (c) => {
     const indexFile = join5(STATIC_DIR, "index.html");
-    if (existsSync9(indexFile)) {
-      return c.html(readFileSync9(indexFile, "utf-8"));
+    if (existsSync10(indexFile)) {
+      return c.html(readFileSync10(indexFile, "utf-8"));
     }
     return c.html("<h1>AgentMoss Policy Console</h1><p>Frontend not built. Use /console/api/* endpoints.</p>");
   };
@@ -5468,13 +5404,13 @@ function createConsoleRouter() {
     if (!/^[A-Za-z0-9_-]+$/.test(skillId)) {
       return c.json({ error: "invalid skill_id" }, 400);
     }
-    const skillPath = join5(dirname6(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
-    if (!existsSync9(skillPath)) {
-      const builtinPath = join5(__dirname6, "..", "..", "agent_moss", "skills", `${skillId}.md`);
-      if (existsSync9(builtinPath)) return c.text(readFileSync9(builtinPath, "utf-8"));
+    const skillPath = join5(dirname7(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
+    if (!existsSync10(skillPath)) {
+      const builtinPath = join5(__dirname7, "..", "..", "agent_moss", "skills", `${skillId}.md`);
+      if (existsSync10(builtinPath)) return c.text(readFileSync10(builtinPath, "utf-8"));
       return c.json({ error: "skill not found" }, 404);
     }
-    return c.text(readFileSync9(skillPath, "utf-8"));
+    return c.text(readFileSync10(skillPath, "utf-8"));
   });
   console2.get("/api/agents", (c) => {
     const rc = loadRuntimeConfig();
@@ -5558,12 +5494,12 @@ function createApp() {
 }
 async function findFreePort(startPort, host = "127.0.0.1", scan = 100) {
   for (let port = startPort; port < startPort + scan; port++) {
-    const free = await new Promise((resolve6) => {
+    const free = await new Promise((resolve7) => {
       const server = net.createServer();
       server.listen(port, host, () => {
-        server.close(() => resolve6(true));
+        server.close(() => resolve7(true));
       });
-      server.on("error", () => resolve6(false));
+      server.on("error", () => resolve7(false));
     });
     if (free) {
       if (port !== startPort) {