@kenhkl/agent-moss 0.12.5 → 0.12.7

package/dist/server.js

@@ -136,6 +136,7 @@ __export(config_exports, {
   getProviderHeaders: () => getProviderHeaders,
   getRetryConfig: () => getRetryConfig,
   getTimeoutConfig: () => getTimeoutConfig,
+  isBrainEnabled: () => isBrainEnabled,
   isHeuristicEnabled: () => isHeuristicEnabled,
   isLLMAvailable: () => isLLMAvailable,
   isLogicRulesEnabled: () => isLogicRulesEnabled,
@@ -255,11 +256,11 @@ function isLLMAvailable() {
 }
 async function probeLLMConnection(timeoutMs = 8e3) {
   if (!isLLMAvailable()) return false;
-  const OpenAI2 = (await import("openai")).default;
+  const OpenAI3 = (await import("openai")).default;
   const config = getLLMConfig();
   const provider = detectProvider(config.baseUrl, config.provider);
   const extraHeaders = getProviderHeaders(provider);
-  const client = new OpenAI2({
+  const client = new OpenAI3({
     baseURL: config.baseUrl,
     apiKey: config.apiKey,
     timeout: timeoutMs,
@@ -317,6 +318,9 @@ function getProviderHeaders(provider) {
 function isHeuristicEnabled() {
   return process.env.AGENT_MOSS_DISABLE_HEURISTIC !== "1";
 }
+function isBrainEnabled() {
+  return process.env.AGENT_MOSS_BRAIN_ENABLED === "1";
+}
 function isLogicRulesEnabled() {
   return process.env.AGENT_MOSS_DISABLE_LOGIC_RULES !== "1";
 }
@@ -3037,7 +3041,7 @@ var require_bindings = __commonJS({
     var fs4 = __require("fs");
     var path3 = __require("path");
     var fileURLToPath9 = require_file_uri_to_path();
-    var join6 = path3.join;
+    var join7 = path3.join;
     var dirname8 = path3.dirname;
     var exists = fs4.accessSync && function(path4) {
       try {
@@ -3097,7 +3101,7 @@ var require_bindings = __commonJS({
       var requireFunc = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
       var tries = [], i = 0, l = opts.try.length, n, b, err;
       for (; i < l; i++) {
-        n = join6.apply(
+        n = join7.apply(
           null,
           opts.try[i].map(function(p) {
             return opts[p] || p;
@@ -3158,7 +3162,7 @@ var require_bindings = __commonJS({
         if (dir === ".") {
           dir = process.cwd();
         }
-        if (exists(join6(dir, "package.json")) || exists(join6(dir, "node_modules"))) {
+        if (exists(join7(dir, "package.json")) || exists(join7(dir, "node_modules"))) {
           return dir;
         }
         if (prev === dir) {
@@ -3167,7 +3171,7 @@ var require_bindings = __commonJS({
           );
         }
         prev = dir;
-        dir = join6(dir, "..");
+        dir = join7(dir, "..");
       }
     };
   }
@@ -4791,6 +4795,533 @@ async function analyzeWithLLM(prompt, config) {
 // src/engine/coordinator.ts
 init_config();
 init_agents();
+
+// src/brain/index.ts
+init_esm_shims();
+
+// src/brain/rule-store.ts
+init_esm_shims();
+import { existsSync as existsSync9, readFileSync as readFileSync10, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
+import { join as join5 } from "path";
+import { homedir as homedir3 } from "os";
+var DEFAULT_RULES_PATH = join5(homedir3(), ".agentmoss", "brain", "rules.json");
+var ENV_RULES_PATH = "AGENT_MOSS_BRAIN_RULES_PATH";
+var STATUS_DRAFT = "draft";
+var STATUS_APPROVED = "approved";
+var STATUS_ACTIVE = "active";
+var STATUS_DISPUTED = "disputed";
+var STATUS_STALE = "stale";
+var STATUS_ARCHIVED = "archived";
+var STATUS_REJECTED = "rejected";
+function getRulesPath() {
+  const envPath = process.env[ENV_RULES_PATH];
+  if (envPath) return envPath;
+  return DEFAULT_RULES_PATH;
+}
+function uuid() {
+  try {
+    return crypto.randomUUID();
+  } catch {
+    return `rule_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
+  }
+}
+var BrainRuleStore = class {
+  path;
+  data;
+  constructor(path3) {
+    this.path = path3 || getRulesPath();
+    this.data = this.load();
+  }
+  load() {
+    if (!existsSync9(this.path)) {
+      return { version: 1, rules: [], pattern_candidates: [] };
+    }
+    try {
+      const raw = JSON.parse(readFileSync10(this.path, "utf-8"));
+      return {
+        version: raw.version || 1,
+        rules: raw.rules || [],
+        pattern_candidates: raw.pattern_candidates || []
+      };
+    } catch {
+      return { version: 1, rules: [], pattern_candidates: [] };
+    }
+  }
+  save() {
+    const dir = this.path.substring(0, this.path.lastIndexOf("/"));
+    if (dir) mkdirSync3(dir, { recursive: true });
+    writeFileSync3(this.path, JSON.stringify(this.data, null, 2), "utf-8");
+  }
+  addRule(rule) {
+    const now = Date.now();
+    const full = {
+      id: rule.id || uuid(),
+      layer: rule.layer,
+      ruleType: rule.ruleType || "deny_pattern",
+      pattern: rule.pattern,
+      scope: rule.scope || "all",
+      source: rule.source || "llm_extracted",
+      sourceEventIds: rule.sourceEventIds || [],
+      confidence: rule.confidence || 0,
+      status: rule.status || STATUS_DRAFT,
+      createdAt: rule.createdAt || now,
+      lastTriggeredAt: rule.lastTriggeredAt || 0,
+      triggerCount: rule.triggerCount || 0,
+      disputedCount: rule.disputedCount || 0,
+      explanation: rule.explanation || "",
+      originNode: rule.originNode || "local"
+    };
+    this.data.rules.push(full);
+    this.save();
+    return full.id;
+  }
+  approveRule(ruleId) {
+    const rule = this.getRule(ruleId);
+    if (!rule) throw new Error(`\u89C4\u5219\u4E0D\u5B58\u5728: ${ruleId}`);
+    if (rule.status !== STATUS_DRAFT) throw new Error(`\u53EA\u6709 draft \u72B6\u6001\u53EF\u5BA1\u6838\uFF0C\u5F53\u524D: ${rule.status}`);
+    rule.status = STATUS_ACTIVE;
+    this.save();
+  }
+  rejectRule(ruleId) {
+    const rule = this.getRule(ruleId);
+    if (!rule) throw new Error(`\u89C4\u5219\u4E0D\u5B58\u5728: ${ruleId}`);
+    if (rule.status !== STATUS_DRAFT) throw new Error(`\u53EA\u6709 draft \u72B6\u6001\u53EF\u62D2\u7EDD\uFF0C\u5F53\u524D: ${rule.status}`);
+    rule.status = STATUS_REJECTED;
+    this.save();
+  }
+  getRule(ruleId) {
+    return this.data.rules.find((r) => r.id === ruleId);
+  }
+  getActiveRules(layer) {
+    return this.data.rules.filter((r) => r.status === STATUS_ACTIVE && (layer === void 0 || r.layer === layer));
+  }
+  getDraftRules() {
+    return this.data.rules.filter((r) => r.status === STATUS_DRAFT).sort((a, b) => b.createdAt - a.createdAt);
+  }
+  recordTrigger(ruleId) {
+    const rule = this.getRule(ruleId);
+    if (!rule) return;
+    rule.triggerCount += 1;
+    rule.lastTriggeredAt = Date.now();
+    this.save();
+  }
+  // --- pattern_candidates ---
+  addPatternCandidate(pattern, layer, scope, sourceEventId, confidence) {
+    const now = Date.now();
+    const existing = this.data.pattern_candidates.find(
+      (c) => c.pattern === pattern && c.layer === layer && c.scope === scope
+    );
+    if (existing) {
+      if (existing.reviewStatus === "rejected") return 0;
+      existing.occurrenceCount += 1;
+      existing.lastSeenAt = now;
+      existing.sourceEventIds.unshift(sourceEventId);
+      this.save();
+      return existing.occurrenceCount;
+    }
+    this.data.pattern_candidates.push({
+      pattern,
+      layer,
+      scope,
+      sourceEventIds: [sourceEventId],
+      confidence,
+      occurrenceCount: 1,
+      firstSeenAt: now,
+      lastSeenAt: now,
+      reviewStatus: "pending",
+      reviewReason: "",
+      reviewedAt: 0
+    });
+    this.save();
+    return 1;
+  }
+  getPatternCandidates(minOccurrences = 3) {
+    return this.data.pattern_candidates.filter((c) => c.occurrenceCount >= minOccurrences && c.reviewStatus !== "rejected").sort((a, b) => b.occurrenceCount - a.occurrenceCount);
+  }
+  getPendingReviewCandidates(minOccurrences = 3) {
+    return this.data.pattern_candidates.filter((c) => c.occurrenceCount >= minOccurrences && c.reviewStatus === "pending").sort((a, b) => b.occurrenceCount - a.occurrenceCount);
+  }
+  isExcludedPattern(pattern, layer, scope) {
+    const c = this.data.pattern_candidates.find(
+      (c2) => c2.pattern === pattern && c2.layer === layer && c2.scope === scope
+    );
+    return !!c && c.reviewStatus === "rejected";
+  }
+  setPatternReviewStatus(pattern, layer, scope, status, reason = "") {
+    const c = this.data.pattern_candidates.find(
+      (c2) => c2.pattern === pattern && c2.layer === layer && c2.scope === scope
+    );
+    if (c) {
+      c.reviewStatus = status;
+      c.reviewReason = reason;
+      c.reviewedAt = Date.now();
+      this.save();
+    }
+  }
+  removePatternCandidate(pattern, layer, scope) {
+    this.data.pattern_candidates = this.data.pattern_candidates.filter(
+      (c) => !(c.pattern === pattern && c.layer === layer && c.scope === scope)
+    );
+    this.save();
+  }
+  getStats() {
+    const count = (status) => this.data.rules.filter((r) => r.status === status).length;
+    return {
+      draft: count(STATUS_DRAFT),
+      approved: count(STATUS_APPROVED),
+      active: count(STATUS_ACTIVE),
+      disputed: count(STATUS_DISPUTED),
+      stale: count(STATUS_STALE),
+      archived: count(STATUS_ARCHIVED),
+      rejected: count(STATUS_REJECTED),
+      total: this.data.rules.length,
+      by_layer: {
+        1: this.data.rules.filter((r) => r.layer === 1 && r.status === STATUS_ACTIVE).length,
+        2: this.data.rules.filter((r) => r.layer === 2 && r.status === STATUS_ACTIVE).length
+      },
+      pattern_candidates: this.data.pattern_candidates.length
+    };
+  }
+};
+
+// src/brain/pattern-extractor.ts
+init_esm_shims();
+var PatternExtractor = class {
+  ruleStore;
+  minConfidence;
+  minOccurrences;
+  builtinPatterns;
+  reviewFn;
+  constructor(ruleStore, opts) {
+    this.ruleStore = ruleStore;
+    this.minConfidence = opts?.minConfidence ?? 0.9;
+    this.minOccurrences = opts?.minOccurrences ?? 3;
+    this.builtinPatterns = opts?.builtinPatterns ?? [];
+    this.reviewFn = opts?.review ?? null;
+  }
+  async extract(event, llmResult) {
+    const result = { rulesCreated: 0, patternsRecorded: 0, skippedReason: "", deduped: [] };
+    const confidence = llmResult.confidence ?? 0;
+    const reason = llmResult.reason ?? "";
+    const riskType = llmResult.riskType ?? "";
+    const actionDetail = llmResult.actionDetail ?? event.actionDetail ?? "";
+    const eventId = event.eventId ?? "";
+    if (confidence < this.minConfidence) {
+      result.skippedReason = `confidence ${confidence} < ${this.minConfidence}`;
+      return result;
+    }
+    const patterns = this.extractPatterns(actionDetail, reason, riskType);
+    if (patterns.length === 0) {
+      result.skippedReason = "no extractable pattern";
+      return result;
+    }
+    for (const p of patterns) {
+      if (this.isCoveredByBuiltin(actionDetail)) {
+        result.deduped.push(p.pattern);
+        continue;
+      }
+      const count = this.ruleStore.addPatternCandidate(
+        p.pattern,
+        p.layer,
+        p.scope,
+        eventId,
+        confidence
+      );
+      if (count === 0) {
+        result.deduped.push(p.pattern);
+        continue;
+      }
+      result.patternsRecorded += 1;
+      if (count >= this.minOccurrences) {
+        const candidates = this.ruleStore.getPatternCandidates(this.minOccurrences);
+        const matched = candidates.find((c) => c.pattern === p.pattern && c.layer === p.layer);
+        if (!matched) continue;
+        if (this.reviewFn) {
+          let review;
+          try {
+            review = await this.reviewFn({
+              pattern: p.pattern,
+              layer: p.layer,
+              ruleType: p.ruleType,
+              actionDetail,
+              reason
+            });
+          } catch {
+            review = null;
+          }
+          if (review === null) {
+            continue;
+          }
+          if (!review.shouldKeep) {
+            this.ruleStore.setPatternReviewStatus(
+              p.pattern,
+              p.layer,
+              p.scope,
+              "rejected",
+              review.reason || "LLM \u5BA1\u6838\u62D2\u7EDD"
+            );
+            result.deduped.push(p.pattern);
+            continue;
+          }
+          this.ruleStore.setPatternReviewStatus(
+            p.pattern,
+            p.layer,
+            p.scope,
+            "approved",
+            review.reason || "LLM \u5BA1\u6838\u901A\u8FC7"
+          );
+        }
+        this.ruleStore.addRule({
+          layer: p.layer,
+          ruleType: p.ruleType,
+          pattern: p.pattern,
+          scope: p.scope,
+          source: "llm_extracted",
+          sourceEventIds: eventId ? [eventId] : [],
+          confidence: matched.confidence,
+          status: STATUS_DRAFT,
+          explanation: `\u4ECE ${count} \u6B21 LLM Deny \u4E2D\u63D0\u53D6(\u7ECF\u5BA1\u6838): ${reason.slice(0, 200)}`
+        });
+        this.ruleStore.removePatternCandidate(p.pattern, p.layer, p.scope);
+        result.rulesCreated += 1;
+      }
+    }
+    return result;
+  }
+  extractPatterns(actionDetail, reason, riskType) {
+    const patterns = [];
+    const detailLower = actionDetail.toLowerCase();
+    const seen = /* @__PURE__ */ new Set();
+    const sensitivePathRe = /(\/(?:etc|root)(?:\/[^\s;|&"'<>`$]*)?|(?:[^\s;|&"'<>`$]*)?\/\.ssh\/[^\s;|&"'<>`$]*|(?:[^\s;|&"'<>`$]*)?\/\.aws\/[^\s;|&"'<>`$]*|\S+\.(?:pem|key|p12|pfx|id_rsa|authorized_keys)\b)/;
+    const m = detailLower.match(sensitivePathRe);
+    if (m) {
+      const gen = this.generalizePath(m[1]);
+      if (!seen.has(gen)) {
+        seen.add(gen);
+        patterns.push({ pattern: gen, layer: 1, scope: "openat", ruleType: "deny_path" });
+      }
+    }
+    const dangerousCmdRe = /\b(rm\s+-[a-zA-Z]*r[a-zA-Z]*f|rm\s+--recursive|chmod\s+777|curl\s+[^|]*\|\s*(?:ba)?sh|wget\s+[^|]*\|\s*(?:ba)?sh|mkfs\.|dd\s+if=|>\s*\/dev\/sd)\b/;
+    const cmdM = detailLower.match(dangerousCmdRe);
+    if (cmdM) {
+      const gen = this.generalizeCommand(cmdM[1]);
+      const seenKey = `cmd:${gen}`;
+      if (!seen.has(seenKey)) {
+        seen.add(seenKey);
+        patterns.push({ pattern: gen, layer: 1, scope: "execve", ruleType: "deny_command" });
+      }
+    }
+    const reasonLower = (reason || "").toLowerCase();
+    if (reasonLower.includes("inject") || reasonLower.includes("\u6570\u636E\u6CE8\u5165")) {
+      patterns.push({
+        pattern: "BEHAVIOR_CHAIN:external_read\u2192sensitive_write",
+        layer: 2,
+        scope: "all",
+        ruleType: "deny_pattern"
+      });
+    }
+    if (reasonLower.includes("reconnaissance") || reasonLower.includes("\u4FA6\u5BDF") || reasonLower.includes("\u63D0\u6743")) {
+      patterns.push({
+        pattern: "BEHAVIOR_CHAIN:multi_config_read\u2192privilege_action",
+        layer: 2,
+        scope: "all",
+        ruleType: "deny_pattern"
+      });
+    }
+    const pathPrefix = `(?:^|[\\s"'(=])`;
+    const pathBody = "(\\/(?:[a-zA-Z0-9_.-]+\\/)+[a-zA-Z0-9_.-]+)";
+    const pathSuffix = `(?=[\\s"')\uFF0C\u3002\uFF09\uFF1B;]|$)`;
+    for (const src of [detailLower, reasonLower]) {
+      const pathRe = new RegExp(pathPrefix + pathBody + pathSuffix, "g");
+      let mm;
+      while ((mm = pathRe.exec(src)) !== null) {
+        const path3 = mm[1];
+        if (path3.split("/").length < 3) continue;
+        if (["/dev/null", "/dev/zero", "/dev/random", "/dev/urandom"].includes(path3)) continue;
+        const gen = this.generalizePath(path3);
+        if (seen.has(gen)) continue;
+        seen.add(gen);
+        patterns.push({ pattern: gen, layer: 1, scope: "openat", ruleType: "deny_path" });
+      }
+    }
+    return patterns;
+  }
+  isCoveredByBuiltin(actionDetail) {
+    if (this.builtinPatterns.length === 0 || !actionDetail) return false;
+    for (const pat of this.builtinPatterns) {
+      try {
+        if (new RegExp(pat, "i").test(actionDetail)) return true;
+      } catch {
+        continue;
+      }
+    }
+    return false;
+  }
+  generalizePath(path3) {
+    const p = path3.toLowerCase();
+    if (/\/etc\/(shadow|passwd|sudoers|security|ssh)/.test(p)) {
+      return "(?:^|[^a-z0-9_-])etc/(?:shadow|passwd|sudoers|security/|ssh/)";
+    }
+    if (p.includes("/etc/")) {
+      return "(?:^|[^a-z0-9_-])etc/";
+    }
+    if (p.includes("/root/")) {
+      return "(?:^|[^a-z0-9_-])root/\\.(?:ssh|gnupg|aws|config)/";
+    }
+    if (p.includes(".ssh/")) {
+      return "(?:^|[^a-z0-9_-])[\\w./-]*/\\.ssh/";
+    }
+    if (p.includes(".aws/")) {
+      return "(?:^|[^a-z0-9_-])[\\w./-]*/\\.aws/";
+    }
+    if (/\.(pem|key|p12|pfx|id_rsa|authorized_keys)\b/.test(p)) {
+      return "[\\w./-]*\\.(?:pem|key|p12|pfx|id_rsa|authorized_keys)(?:$|[^a-z0-9])";
+    }
+    const escaped = p.replace(/^\//, "").replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    return `(?:^|[^a-z0-9_-])${escaped}(?:/|\\b)`;
+  }
+  generalizeCommand(cmd) {
+    if (cmd.includes("rm") && cmd.includes("r") && cmd.includes("f")) {
+      return "rm\\s+(?:-[a-zA-Z]*r[a-zA-Z]*f|--recursive)\\s+/";
+    }
+    if (cmd.includes("chmod")) return "chmod\\s+777";
+    if (cmd.includes("curl") || cmd.includes("wget")) {
+      return "(?:curl|wget)\\s+[^|]*\\|\\s*(?:ba)?sh";
+    }
+    if (cmd.includes("mkfs")) return "mkfs\\.";
+    if (cmd.includes("dd")) return "dd\\s+if=";
+    return cmd.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  }
+};
+
+// src/brain/reviewer.ts
+init_esm_shims();
+init_config();
+import OpenAI2 from "openai";
+var REVIEW_PROMPT = `\u4F60\u662F AgentMoss \u5B89\u5168\u89C4\u5219\u5BA1\u6838\u5668\u3002\u5224\u65AD\u4E0B\u5217"\u4ECE LLM \u62D2\u7EDD\u7ED3\u679C\u4E2D\u63D0\u53D6\u7684\u5B89\u5168\u6A21\u5F0F"\u662F\u5426\u503C\u5F97\u6C89\u6DC0\u4E3A\u672C\u5730\u89C4\u5219\u3002
+
+## \u63D0\u53D6\u7684\u6A21\u5F0F\uFF08\u5019\u9009\uFF09
+- \u6A21\u5F0F: {pattern}
+- \u6240\u5C5E\u5C42: Layer {layer}\uFF081=\u7279\u5F81\u5339\u914D\uFF0C2=\u884C\u4E3A\u94FE\uFF09
+- \u7C7B\u578B: {ruleType}
+
+## \u539F\u59CB\u88AB\u62D2\u7EDD\u7684\u64CD\u4F5C
+{actionDetail}
+
+## LLM \u5F53\u65F6\u7684\u62D2\u7EDD\u7406\u7531
+{reason}
+
+## \u5224\u65AD\u51C6\u5219
+1. **\u662F\u5426\u8FC7\u9AD8\u6CDB\u5316**\uFF1A\u8FD9\u6761\u6A21\u5F0F\u662F\u5426\u4F1A\u8BEF\u62E6\u6B63\u5E38\u7684\u5408\u6CD5\u64CD\u4F5C\uFF1F
+2. **\u662F\u5426\u7B26\u5408\u654F\u611F\u7279\u5F81**\uFF1A\u6307\u5411\u7684\u8DEF\u5F84/\u547D\u4EE4\u662F\u5426\u786E\u5B9E\u654F\u611F\uFF08\u51ED\u636E/\u7CFB\u7EDF\u6587\u4EF6/\u6076\u610F\u547D\u4EE4/\u5916\u4F20\uFF09\uFF1F
+3. **\u4E0E\u4E09\u5C42\u89C4\u5219\u91CD\u590D**\uFF1A\u662F\u5426\u5DF2\u88AB\u73B0\u6709 L1/L2 \u89C4\u5219\u8986\u76D6\uFF1F
+4. **\u662F\u4E0D\u662F\u771F\u5B9E\u653B\u51FB\u6A21\u5F0F**\uFF1A\u662F\u5426\u4EE3\u8868\u4E00\u79CD\u8FDE\u7EED\u7684\u653B\u51FB\u884C\u4E3A\u6A21\u5F0F\uFF1F
+
+## \u8F93\u51FA JSON\uFF08\u53EA\u8F93\u51FA JSON\uFF0C\u65E0\u5176\u4ED6\u6587\u5B57\uFF09
+{"should_keep": true/false, "confidence": 0-100, "reason": "\u7B80\u77ED\u7406\u7531\uFF08\u4E2D\u6587\uFF09", "suggested_rule": "\u82E5\u4FDD\u7559\u5219\u8F93\u51FA\u5EFA\u8BAE\u6B63\u5219\uFF0C\u5426\u5219\u7A7A\u4E32", "duplicate_of": "\u82E5\u91CD\u590D\u5219\u8BF4\u660E\u662F\u54EA\u4E2A\uFF0C\u5426\u5219\u7A7A\u4E32"}`;
+function createBrainReviewer(timeoutMs = 1e4) {
+  return async (opts) => {
+    if (process.env.AGENT_MOSS_BRAIN_REVIEW === "0") return null;
+    if (!isLLMAvailable()) return null;
+    const config = getLLMConfig();
+    const provider = detectProvider(config.baseUrl, config.provider);
+    const extraHeaders = getProviderHeaders(provider);
+    const client = new OpenAI2({
+      baseURL: config.baseUrl,
+      apiKey: config.apiKey,
+      timeout: timeoutMs,
+      maxRetries: 1,
+      defaultHeaders: Object.keys(extraHeaders).length > 0 ? extraHeaders : void 0
+    });
+    const prompt = REVIEW_PROMPT.replace("{pattern}", opts.pattern).replace("{layer}", String(opts.layer)).replace("{ruleType}", opts.ruleType).replace("{actionDetail}", (opts.actionDetail || "").slice(0, 400)).replace("{reason}", (opts.reason || "").slice(0, 400));
+    try {
+      const response = await client.chat.completions.create({
+        model: config.model,
+        temperature: config.temperature || 0.1,
+        max_tokens: 256,
+        messages: [
+          { role: "system", content: "\u53EA\u8F93\u51FA\u7EAF JSON\uFF0C\u4E0D\u8981\u5305\u542B markdown \u6807\u8BB0\u3001\u4EE3\u7801\u5757\u6216\u4EFB\u4F55\u5176\u4ED6\u6587\u5B57\u3002" },
+          { role: "user", content: prompt }
+        ]
+      });
+      const content = response.choices[0]?.message?.content || "";
+      const parsed = parseReview(content);
+      return { shouldKeep: parsed.shouldKeep, reason: parsed.reason };
+    } catch (e) {
+      console.warn(`[AgentMoss] Brain \u5BA1\u6838 LLM \u8C03\u7528\u5931\u8D25\uFF08\u964D\u7EA7\u4FDD\u6301\u5019\u9009\uFF09: ${e.message}`);
+      return null;
+    }
+  };
+}
+function parseReview(content) {
+  let text = content.trim();
+  if (text.startsWith("```")) {
+    text = text.replace(/^```[a-zA-Z]*\n?/, "").replace(/\n?```$/, "");
+  }
+  const match = text.match(/\{[\s\S]*\}/);
+  if (!match) throw new Error(`\u5BA1\u6838\u54CD\u5E94\u65E0 JSON \u5BF9\u8C61: ${text.slice(0, 200)}`);
+  const data = JSON.parse(match[0]);
+  if (!("should_keep" in data) && !("shouldKeep" in data)) {
+    throw new Error(`\u5BA1\u6838\u54CD\u5E94\u7F3A should_keep: ${text.slice(0, 200)}`);
+  }
+  let shouldKeep = data.shouldKeep ?? data.should_keep;
+  if (typeof shouldKeep === "string") {
+    shouldKeep = ["true", "1", "\u662F", "yes"].includes(shouldKeep.trim().toLowerCase());
+  }
+  return {
+    shouldKeep: !!shouldKeep,
+    confidence: Number(data.confidence ?? 0) || 0,
+    reason: String(data.reason ?? data.suggested_rule ?? "") || ""
+  };
+}
+
+// src/brain/index.ts
+function checkBrainRules(store, opts) {
+  if (!store) return null;
+  const rules = store.getActiveRules(opts.layer);
+  if (rules.length === 0) return null;
+  const combined = `${opts.actionType} ${opts.actionDetail}`;
+  for (const rule of rules) {
+    try {
+      if (new RegExp(rule.pattern, "i").test(combined)) {
+        if (opts.layer === 2 && opts.actionHistory) {
+          if (!checkLayer2Context(rule.pattern, opts.actionHistory, opts.actionDetail)) {
+            continue;
+          }
+        }
+        store.recordTrigger(rule.id);
+        return {
+          ruleId: rule.id,
+          pattern: rule.pattern,
+          explanation: rule.explanation,
+          confidence: rule.confidence
+        };
+      }
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+function checkLayer2Context(pattern, actionHistory, actionDetail) {
+  if (pattern.startsWith("BEHAVIOR_CHAIN:")) {
+    const chainType = pattern.replace("BEHAVIOR_CHAIN:", "");
+    if (chainType === "external_read\u2192sensitive_write") {
+      const hasExternalRead = actionHistory.slice(-5).some((h) => /curl|wget|http/i.test(h.actionDetail ?? ""));
+      const isSensitiveWrite = /\.ssh|\.gnupg|authorized_keys|bashrc|profile/i.test(actionDetail);
+      return hasExternalRead && isSensitiveWrite;
+    }
+    if (chainType === "multi_config_read\u2192privilege_action") {
+      const configReads = actionHistory.slice(-5).filter((h) => /\/etc\/|config|\.conf|\.yaml|\.json/i.test(h.actionDetail ?? "")).length;
+      const isPrivilege = /sudo|su |chmod|chown/i.test(actionDetail);
+      return configReads >= 2 && isPrivilege;
+    }
+    return false;
+  }
+  return true;
+}
+
+// src/engine/coordinator.ts
 var FULLY_SAFE_TOOLS = /* @__PURE__ */ new Set([
   "ask_user_question",
   "glob",
@@ -4875,6 +5406,18 @@ function extractRawCommand(detail) {
 function matchesAny(cmd, patterns) {
   return patterns.some((p) => p.test(cmd));
 }
+var _brainStore = null;
+var _brainExtractor = null;
+var _brainInitialized = false;
+function getBrainStore() {
+  if (!isBrainEnabled()) return null;
+  if (!_brainInitialized) {
+    _brainStore = new BrainRuleStore();
+    _brainExtractor = new PatternExtractor(_brainStore, { review: createBrainReviewer() });
+    _brainInitialized = true;
+  }
+  return _brainStore;
+}
 async function runAnalysis(input) {
   const heuristicResult = isHeuristicEnabled() ? runHeuristicCheck(input) : null;
   const isInlineScriptCmd = isInlineScriptCommand(input.aNext.actionDetail.toLowerCase());
@@ -4907,6 +5450,25 @@ async function runAnalysis(input) {
       }
     }
   }
+  const brainStore = getBrainStore();
+  if (brainStore) {
+    const brainL1 = checkBrainRules(brainStore, {
+      layer: 1,
+      actionType: input.aNext.actionType,
+      actionDetail: input.aNext.actionDetail
+    });
+    if (brainL1) {
+      return {
+        allowed: false,
+        reason: `[Brain L1] ${brainL1.explanation}`,
+        riskLevel: "high",
+        riskType: "brain_rule",
+        confidence: Math.round(brainL1.confidence * 100),
+        source: "brain_rule",
+        violatedLayers: ["brain_L1"]
+      };
+    }
+  }
   const actionType = input.aNext.actionType.toLowerCase();
   const rawDetail = extractRawCommand(input.aNext.actionDetail);
   const lowerDetail = rawDetail.toLowerCase();
@@ -5032,6 +5594,25 @@ async function runAnalysis(input) {
       }
     }
   }
+  if (brainStore) {
+    const brainL2 = checkBrainRules(brainStore, {
+      layer: 2,
+      actionType: input.aNext.actionType,
+      actionDetail: input.aNext.actionDetail,
+      actionHistory: input.actionHistory
+    });
+    if (brainL2) {
+      return {
+        allowed: false,
+        reason: `[Brain L2] ${brainL2.explanation}`,
+        riskLevel: "high",
+        riskType: "brain_rule",
+        confidence: Math.round(brainL2.confidence * 100),
+        source: "brain_rule",
+        violatedLayers: ["brain_L2"]
+      };
+    }
+  }
   if (skipLLM || !isLLMAvailable()) {
     return {
       allowed: true,
@@ -5098,6 +5679,20 @@ async function runAnalysis(input) {
       violatedLayers: ["3"]
     };
   }
+  if (!llmResult.allowed && llmResult.confidence && llmResult.confidence >= 90 && _brainExtractor) {
+    try {
+      await _brainExtractor.extract(
+        { actionDetail: input.aNext.actionDetail, eventId: "" },
+        {
+          confidence: llmResult.confidence / 100,
+          reason: llmResult.reason || "",
+          riskType: llmResult.riskType || "",
+          actionDetail: input.aNext.actionDetail
+        }
+      );
+    } catch {
+    }
+  }
   return llmResult;
 }
 
@@ -5289,11 +5884,11 @@ init_esm_shims();
 init_runtime_config();
 init_token_stats();
 import { Hono } from "hono";
-import { readFileSync as readFileSync10, existsSync as existsSync10 } from "fs";
-import { join as join5, dirname as dirname7 } from "path";
+import { readFileSync as readFileSync11, existsSync as existsSync11 } from "fs";
+import { join as join6, dirname as dirname7 } from "path";
 import { fileURLToPath as fileURLToPath8 } from "url";
 var __dirname7 = dirname7(fileURLToPath8(import.meta.url));
-var STATIC_DIR = join5(__dirname7, "static");
+var STATIC_DIR = join6(__dirname7, "static");
 var CONSOLE_TOKEN_ENV = "AGENT_MOSS_CONSOLE_TOKEN";
 function getConsoleToken() {
   return process.env[CONSOLE_TOKEN_ENV] || "";
@@ -5317,9 +5912,9 @@ function createConsoleRouter() {
   const console2 = new Hono();
   console2.use("/api/*", authMiddleware());
   const serveIndex = (c) => {
-    const indexFile = join5(STATIC_DIR, "index.html");
-    if (existsSync10(indexFile)) {
-      return c.html(readFileSync10(indexFile, "utf-8"));
+    const indexFile = join6(STATIC_DIR, "index.html");
+    if (existsSync11(indexFile)) {
+      return c.html(readFileSync11(indexFile, "utf-8"));
     }
     return c.html("<h1>AgentMoss Policy Console</h1><p>Frontend not built. Use /console/api/* endpoints.</p>");
   };
@@ -5410,13 +6005,13 @@ function createConsoleRouter() {
     if (!/^[A-Za-z0-9_-]+$/.test(skillId)) {
       return c.json({ error: "invalid skill_id" }, 400);
     }
-    const skillPath = join5(dirname7(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
-    if (!existsSync10(skillPath)) {
-      const builtinPath = join5(__dirname7, "..", "..", "agent_moss", "skills", `${skillId}.md`);
-      if (existsSync10(builtinPath)) return c.text(readFileSync10(builtinPath, "utf-8"));
+    const skillPath = join6(dirname7(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
+    if (!existsSync11(skillPath)) {
+      const builtinPath = join6(__dirname7, "..", "..", "agent_moss", "skills", `${skillId}.md`);
+      if (existsSync11(builtinPath)) return c.text(readFileSync11(builtinPath, "utf-8"));
       return c.json({ error: "skill not found" }, 404);
     }
-    return c.text(readFileSync10(skillPath, "utf-8"));
+    return c.text(readFileSync11(skillPath, "utf-8"));
   });
   console2.get("/api/agents", (c) => {
     const rc = loadRuntimeConfig();