@kenhkl/agent-moss 0.12.6 → 0.12.7

package/dist/cli.js

@@ -137,6 +137,7 @@ __export(config_exports, {
   getProviderHeaders: () => getProviderHeaders,
   getRetryConfig: () => getRetryConfig,
   getTimeoutConfig: () => getTimeoutConfig,
+  isBrainEnabled: () => isBrainEnabled,
   isHeuristicEnabled: () => isHeuristicEnabled,
   isLLMAvailable: () => isLLMAvailable,
   isLogicRulesEnabled: () => isLogicRulesEnabled,
@@ -256,11 +257,11 @@ function isLLMAvailable() {
 }
 async function probeLLMConnection(timeoutMs = 8e3) {
   if (!isLLMAvailable()) return false;
-  const OpenAI2 = (await import("openai")).default;
+  const OpenAI3 = (await import("openai")).default;
   const config = getLLMConfig();
   const provider = detectProvider(config.baseUrl, config.provider);
   const extraHeaders = getProviderHeaders(provider);
-  const client = new OpenAI2({
+  const client = new OpenAI3({
     baseURL: config.baseUrl,
     apiKey: config.apiKey,
     timeout: timeoutMs,
@@ -318,6 +319,9 @@ function getProviderHeaders(provider) {
 function isHeuristicEnabled() {
   return process.env.AGENT_MOSS_DISABLE_HEURISTIC !== "1";
 }
+function isBrainEnabled() {
+  return process.env.AGENT_MOSS_BRAIN_ENABLED === "1";
+}
 function isLogicRulesEnabled() {
   return process.env.AGENT_MOSS_DISABLE_LOGIC_RULES !== "1";
 }
@@ -3957,10 +3961,561 @@ var init_llm_analyzer = __esm({
   }
 });
 
+// src/brain/rule-store.ts
+import { existsSync as existsSync9, readFileSync as readFileSync10, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
+import { join as join5 } from "path";
+import { homedir as homedir3 } from "os";
+function getRulesPath() {
+  const envPath = process.env[ENV_RULES_PATH];
+  if (envPath) return envPath;
+  return DEFAULT_RULES_PATH;
+}
+function uuid() {
+  try {
+    return crypto.randomUUID();
+  } catch {
+    return `rule_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
+  }
+}
+var DEFAULT_RULES_PATH, ENV_RULES_PATH, STATUS_DRAFT, STATUS_APPROVED, STATUS_ACTIVE, STATUS_DISPUTED, STATUS_STALE, STATUS_ARCHIVED, STATUS_REJECTED, BrainRuleStore;
+var init_rule_store = __esm({
+  "src/brain/rule-store.ts"() {
+    "use strict";
+    init_esm_shims();
+    DEFAULT_RULES_PATH = join5(homedir3(), ".agentmoss", "brain", "rules.json");
+    ENV_RULES_PATH = "AGENT_MOSS_BRAIN_RULES_PATH";
+    STATUS_DRAFT = "draft";
+    STATUS_APPROVED = "approved";
+    STATUS_ACTIVE = "active";
+    STATUS_DISPUTED = "disputed";
+    STATUS_STALE = "stale";
+    STATUS_ARCHIVED = "archived";
+    STATUS_REJECTED = "rejected";
+    BrainRuleStore = class {
+      path;
+      data;
+      constructor(path3) {
+        this.path = path3 || getRulesPath();
+        this.data = this.load();
+      }
+      load() {
+        if (!existsSync9(this.path)) {
+          return { version: 1, rules: [], pattern_candidates: [] };
+        }
+        try {
+          const raw = JSON.parse(readFileSync10(this.path, "utf-8"));
+          return {
+            version: raw.version || 1,
+            rules: raw.rules || [],
+            pattern_candidates: raw.pattern_candidates || []
+          };
+        } catch {
+          return { version: 1, rules: [], pattern_candidates: [] };
+        }
+      }
+      save() {
+        const dir = this.path.substring(0, this.path.lastIndexOf("/"));
+        if (dir) mkdirSync3(dir, { recursive: true });
+        writeFileSync3(this.path, JSON.stringify(this.data, null, 2), "utf-8");
+      }
+      addRule(rule) {
+        const now = Date.now();
+        const full = {
+          id: rule.id || uuid(),
+          layer: rule.layer,
+          ruleType: rule.ruleType || "deny_pattern",
+          pattern: rule.pattern,
+          scope: rule.scope || "all",
+          source: rule.source || "llm_extracted",
+          sourceEventIds: rule.sourceEventIds || [],
+          confidence: rule.confidence || 0,
+          status: rule.status || STATUS_DRAFT,
+          createdAt: rule.createdAt || now,
+          lastTriggeredAt: rule.lastTriggeredAt || 0,
+          triggerCount: rule.triggerCount || 0,
+          disputedCount: rule.disputedCount || 0,
+          explanation: rule.explanation || "",
+          originNode: rule.originNode || "local"
+        };
+        this.data.rules.push(full);
+        this.save();
+        return full.id;
+      }
+      approveRule(ruleId) {
+        const rule = this.getRule(ruleId);
+        if (!rule) throw new Error(`\u89C4\u5219\u4E0D\u5B58\u5728: ${ruleId}`);
+        if (rule.status !== STATUS_DRAFT) throw new Error(`\u53EA\u6709 draft \u72B6\u6001\u53EF\u5BA1\u6838\uFF0C\u5F53\u524D: ${rule.status}`);
+        rule.status = STATUS_ACTIVE;
+        this.save();
+      }
+      rejectRule(ruleId) {
+        const rule = this.getRule(ruleId);
+        if (!rule) throw new Error(`\u89C4\u5219\u4E0D\u5B58\u5728: ${ruleId}`);
+        if (rule.status !== STATUS_DRAFT) throw new Error(`\u53EA\u6709 draft \u72B6\u6001\u53EF\u62D2\u7EDD\uFF0C\u5F53\u524D: ${rule.status}`);
+        rule.status = STATUS_REJECTED;
+        this.save();
+      }
+      getRule(ruleId) {
+        return this.data.rules.find((r) => r.id === ruleId);
+      }
+      getActiveRules(layer) {
+        return this.data.rules.filter((r) => r.status === STATUS_ACTIVE && (layer === void 0 || r.layer === layer));
+      }
+      getDraftRules() {
+        return this.data.rules.filter((r) => r.status === STATUS_DRAFT).sort((a, b) => b.createdAt - a.createdAt);
+      }
+      recordTrigger(ruleId) {
+        const rule = this.getRule(ruleId);
+        if (!rule) return;
+        rule.triggerCount += 1;
+        rule.lastTriggeredAt = Date.now();
+        this.save();
+      }
+      // --- pattern_candidates ---
+      addPatternCandidate(pattern, layer, scope, sourceEventId, confidence) {
+        const now = Date.now();
+        const existing = this.data.pattern_candidates.find(
+          (c) => c.pattern === pattern && c.layer === layer && c.scope === scope
+        );
+        if (existing) {
+          if (existing.reviewStatus === "rejected") return 0;
+          existing.occurrenceCount += 1;
+          existing.lastSeenAt = now;
+          existing.sourceEventIds.unshift(sourceEventId);
+          this.save();
+          return existing.occurrenceCount;
+        }
+        this.data.pattern_candidates.push({
+          pattern,
+          layer,
+          scope,
+          sourceEventIds: [sourceEventId],
+          confidence,
+          occurrenceCount: 1,
+          firstSeenAt: now,
+          lastSeenAt: now,
+          reviewStatus: "pending",
+          reviewReason: "",
+          reviewedAt: 0
+        });
+        this.save();
+        return 1;
+      }
+      getPatternCandidates(minOccurrences = 3) {
+        return this.data.pattern_candidates.filter((c) => c.occurrenceCount >= minOccurrences && c.reviewStatus !== "rejected").sort((a, b) => b.occurrenceCount - a.occurrenceCount);
+      }
+      getPendingReviewCandidates(minOccurrences = 3) {
+        return this.data.pattern_candidates.filter((c) => c.occurrenceCount >= minOccurrences && c.reviewStatus === "pending").sort((a, b) => b.occurrenceCount - a.occurrenceCount);
+      }
+      isExcludedPattern(pattern, layer, scope) {
+        const c = this.data.pattern_candidates.find(
+          (c2) => c2.pattern === pattern && c2.layer === layer && c2.scope === scope
+        );
+        return !!c && c.reviewStatus === "rejected";
+      }
+      setPatternReviewStatus(pattern, layer, scope, status, reason = "") {
+        const c = this.data.pattern_candidates.find(
+          (c2) => c2.pattern === pattern && c2.layer === layer && c2.scope === scope
+        );
+        if (c) {
+          c.reviewStatus = status;
+          c.reviewReason = reason;
+          c.reviewedAt = Date.now();
+          this.save();
+        }
+      }
+      removePatternCandidate(pattern, layer, scope) {
+        this.data.pattern_candidates = this.data.pattern_candidates.filter(
+          (c) => !(c.pattern === pattern && c.layer === layer && c.scope === scope)
+        );
+        this.save();
+      }
+      getStats() {
+        const count = (status) => this.data.rules.filter((r) => r.status === status).length;
+        return {
+          draft: count(STATUS_DRAFT),
+          approved: count(STATUS_APPROVED),
+          active: count(STATUS_ACTIVE),
+          disputed: count(STATUS_DISPUTED),
+          stale: count(STATUS_STALE),
+          archived: count(STATUS_ARCHIVED),
+          rejected: count(STATUS_REJECTED),
+          total: this.data.rules.length,
+          by_layer: {
+            1: this.data.rules.filter((r) => r.layer === 1 && r.status === STATUS_ACTIVE).length,
+            2: this.data.rules.filter((r) => r.layer === 2 && r.status === STATUS_ACTIVE).length
+          },
+          pattern_candidates: this.data.pattern_candidates.length
+        };
+      }
+    };
+  }
+});
+
+// src/brain/pattern-extractor.ts
+var PatternExtractor;
+var init_pattern_extractor = __esm({
+  "src/brain/pattern-extractor.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_rule_store();
+    PatternExtractor = class {
+      ruleStore;
+      minConfidence;
+      minOccurrences;
+      builtinPatterns;
+      reviewFn;
+      constructor(ruleStore, opts) {
+        this.ruleStore = ruleStore;
+        this.minConfidence = opts?.minConfidence ?? 0.9;
+        this.minOccurrences = opts?.minOccurrences ?? 3;
+        this.builtinPatterns = opts?.builtinPatterns ?? [];
+        this.reviewFn = opts?.review ?? null;
+      }
+      async extract(event, llmResult) {
+        const result = { rulesCreated: 0, patternsRecorded: 0, skippedReason: "", deduped: [] };
+        const confidence = llmResult.confidence ?? 0;
+        const reason = llmResult.reason ?? "";
+        const riskType = llmResult.riskType ?? "";
+        const actionDetail = llmResult.actionDetail ?? event.actionDetail ?? "";
+        const eventId = event.eventId ?? "";
+        if (confidence < this.minConfidence) {
+          result.skippedReason = `confidence ${confidence} < ${this.minConfidence}`;
+          return result;
+        }
+        const patterns = this.extractPatterns(actionDetail, reason, riskType);
+        if (patterns.length === 0) {
+          result.skippedReason = "no extractable pattern";
+          return result;
+        }
+        for (const p of patterns) {
+          if (this.isCoveredByBuiltin(actionDetail)) {
+            result.deduped.push(p.pattern);
+            continue;
+          }
+          const count = this.ruleStore.addPatternCandidate(
+            p.pattern,
+            p.layer,
+            p.scope,
+            eventId,
+            confidence
+          );
+          if (count === 0) {
+            result.deduped.push(p.pattern);
+            continue;
+          }
+          result.patternsRecorded += 1;
+          if (count >= this.minOccurrences) {
+            const candidates = this.ruleStore.getPatternCandidates(this.minOccurrences);
+            const matched = candidates.find((c) => c.pattern === p.pattern && c.layer === p.layer);
+            if (!matched) continue;
+            if (this.reviewFn) {
+              let review;
+              try {
+                review = await this.reviewFn({
+                  pattern: p.pattern,
+                  layer: p.layer,
+                  ruleType: p.ruleType,
+                  actionDetail,
+                  reason
+                });
+              } catch {
+                review = null;
+              }
+              if (review === null) {
+                continue;
+              }
+              if (!review.shouldKeep) {
+                this.ruleStore.setPatternReviewStatus(
+                  p.pattern,
+                  p.layer,
+                  p.scope,
+                  "rejected",
+                  review.reason || "LLM \u5BA1\u6838\u62D2\u7EDD"
+                );
+                result.deduped.push(p.pattern);
+                continue;
+              }
+              this.ruleStore.setPatternReviewStatus(
+                p.pattern,
+                p.layer,
+                p.scope,
+                "approved",
+                review.reason || "LLM \u5BA1\u6838\u901A\u8FC7"
+              );
+            }
+            this.ruleStore.addRule({
+              layer: p.layer,
+              ruleType: p.ruleType,
+              pattern: p.pattern,
+              scope: p.scope,
+              source: "llm_extracted",
+              sourceEventIds: eventId ? [eventId] : [],
+              confidence: matched.confidence,
+              status: STATUS_DRAFT,
+              explanation: `\u4ECE ${count} \u6B21 LLM Deny \u4E2D\u63D0\u53D6(\u7ECF\u5BA1\u6838): ${reason.slice(0, 200)}`
+            });
+            this.ruleStore.removePatternCandidate(p.pattern, p.layer, p.scope);
+            result.rulesCreated += 1;
+          }
+        }
+        return result;
+      }
+      extractPatterns(actionDetail, reason, riskType) {
+        const patterns = [];
+        const detailLower = actionDetail.toLowerCase();
+        const seen = /* @__PURE__ */ new Set();
+        const sensitivePathRe = /(\/(?:etc|root)(?:\/[^\s;|&"'<>`$]*)?|(?:[^\s;|&"'<>`$]*)?\/\.ssh\/[^\s;|&"'<>`$]*|(?:[^\s;|&"'<>`$]*)?\/\.aws\/[^\s;|&"'<>`$]*|\S+\.(?:pem|key|p12|pfx|id_rsa|authorized_keys)\b)/;
+        const m = detailLower.match(sensitivePathRe);
+        if (m) {
+          const gen = this.generalizePath(m[1]);
+          if (!seen.has(gen)) {
+            seen.add(gen);
+            patterns.push({ pattern: gen, layer: 1, scope: "openat", ruleType: "deny_path" });
+          }
+        }
+        const dangerousCmdRe = /\b(rm\s+-[a-zA-Z]*r[a-zA-Z]*f|rm\s+--recursive|chmod\s+777|curl\s+[^|]*\|\s*(?:ba)?sh|wget\s+[^|]*\|\s*(?:ba)?sh|mkfs\.|dd\s+if=|>\s*\/dev\/sd)\b/;
+        const cmdM = detailLower.match(dangerousCmdRe);
+        if (cmdM) {
+          const gen = this.generalizeCommand(cmdM[1]);
+          const seenKey = `cmd:${gen}`;
+          if (!seen.has(seenKey)) {
+            seen.add(seenKey);
+            patterns.push({ pattern: gen, layer: 1, scope: "execve", ruleType: "deny_command" });
+          }
+        }
+        const reasonLower = (reason || "").toLowerCase();
+        if (reasonLower.includes("inject") || reasonLower.includes("\u6570\u636E\u6CE8\u5165")) {
+          patterns.push({
+            pattern: "BEHAVIOR_CHAIN:external_read\u2192sensitive_write",
+            layer: 2,
+            scope: "all",
+            ruleType: "deny_pattern"
+          });
+        }
+        if (reasonLower.includes("reconnaissance") || reasonLower.includes("\u4FA6\u5BDF") || reasonLower.includes("\u63D0\u6743")) {
+          patterns.push({
+            pattern: "BEHAVIOR_CHAIN:multi_config_read\u2192privilege_action",
+            layer: 2,
+            scope: "all",
+            ruleType: "deny_pattern"
+          });
+        }
+        const pathPrefix = `(?:^|[\\s"'(=])`;
+        const pathBody = "(\\/(?:[a-zA-Z0-9_.-]+\\/)+[a-zA-Z0-9_.-]+)";
+        const pathSuffix = `(?=[\\s"')\uFF0C\u3002\uFF09\uFF1B;]|$)`;
+        for (const src of [detailLower, reasonLower]) {
+          const pathRe = new RegExp(pathPrefix + pathBody + pathSuffix, "g");
+          let mm;
+          while ((mm = pathRe.exec(src)) !== null) {
+            const path3 = mm[1];
+            if (path3.split("/").length < 3) continue;
+            if (["/dev/null", "/dev/zero", "/dev/random", "/dev/urandom"].includes(path3)) continue;
+            const gen = this.generalizePath(path3);
+            if (seen.has(gen)) continue;
+            seen.add(gen);
+            patterns.push({ pattern: gen, layer: 1, scope: "openat", ruleType: "deny_path" });
+          }
+        }
+        return patterns;
+      }
+      isCoveredByBuiltin(actionDetail) {
+        if (this.builtinPatterns.length === 0 || !actionDetail) return false;
+        for (const pat of this.builtinPatterns) {
+          try {
+            if (new RegExp(pat, "i").test(actionDetail)) return true;
+          } catch {
+            continue;
+          }
+        }
+        return false;
+      }
+      generalizePath(path3) {
+        const p = path3.toLowerCase();
+        if (/\/etc\/(shadow|passwd|sudoers|security|ssh)/.test(p)) {
+          return "(?:^|[^a-z0-9_-])etc/(?:shadow|passwd|sudoers|security/|ssh/)";
+        }
+        if (p.includes("/etc/")) {
+          return "(?:^|[^a-z0-9_-])etc/";
+        }
+        if (p.includes("/root/")) {
+          return "(?:^|[^a-z0-9_-])root/\\.(?:ssh|gnupg|aws|config)/";
+        }
+        if (p.includes(".ssh/")) {
+          return "(?:^|[^a-z0-9_-])[\\w./-]*/\\.ssh/";
+        }
+        if (p.includes(".aws/")) {
+          return "(?:^|[^a-z0-9_-])[\\w./-]*/\\.aws/";
+        }
+        if (/\.(pem|key|p12|pfx|id_rsa|authorized_keys)\b/.test(p)) {
+          return "[\\w./-]*\\.(?:pem|key|p12|pfx|id_rsa|authorized_keys)(?:$|[^a-z0-9])";
+        }
+        const escaped = p.replace(/^\//, "").replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        return `(?:^|[^a-z0-9_-])${escaped}(?:/|\\b)`;
+      }
+      generalizeCommand(cmd) {
+        if (cmd.includes("rm") && cmd.includes("r") && cmd.includes("f")) {
+          return "rm\\s+(?:-[a-zA-Z]*r[a-zA-Z]*f|--recursive)\\s+/";
+        }
+        if (cmd.includes("chmod")) return "chmod\\s+777";
+        if (cmd.includes("curl") || cmd.includes("wget")) {
+          return "(?:curl|wget)\\s+[^|]*\\|\\s*(?:ba)?sh";
+        }
+        if (cmd.includes("mkfs")) return "mkfs\\.";
+        if (cmd.includes("dd")) return "dd\\s+if=";
+        return cmd.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      }
+    };
+  }
+});
+
+// src/brain/reviewer.ts
+import OpenAI2 from "openai";
+function createBrainReviewer(timeoutMs = 1e4) {
+  return async (opts) => {
+    if (process.env.AGENT_MOSS_BRAIN_REVIEW === "0") return null;
+    if (!isLLMAvailable()) return null;
+    const config = getLLMConfig();
+    const provider = detectProvider(config.baseUrl, config.provider);
+    const extraHeaders = getProviderHeaders(provider);
+    const client = new OpenAI2({
+      baseURL: config.baseUrl,
+      apiKey: config.apiKey,
+      timeout: timeoutMs,
+      maxRetries: 1,
+      defaultHeaders: Object.keys(extraHeaders).length > 0 ? extraHeaders : void 0
+    });
+    const prompt = REVIEW_PROMPT.replace("{pattern}", opts.pattern).replace("{layer}", String(opts.layer)).replace("{ruleType}", opts.ruleType).replace("{actionDetail}", (opts.actionDetail || "").slice(0, 400)).replace("{reason}", (opts.reason || "").slice(0, 400));
+    try {
+      const response = await client.chat.completions.create({
+        model: config.model,
+        temperature: config.temperature || 0.1,
+        max_tokens: 256,
+        messages: [
+          { role: "system", content: "\u53EA\u8F93\u51FA\u7EAF JSON\uFF0C\u4E0D\u8981\u5305\u542B markdown \u6807\u8BB0\u3001\u4EE3\u7801\u5757\u6216\u4EFB\u4F55\u5176\u4ED6\u6587\u5B57\u3002" },
+          { role: "user", content: prompt }
+        ]
+      });
+      const content = response.choices[0]?.message?.content || "";
+      const parsed = parseReview(content);
+      return { shouldKeep: parsed.shouldKeep, reason: parsed.reason };
+    } catch (e) {
+      console.warn(`[AgentMoss] Brain \u5BA1\u6838 LLM \u8C03\u7528\u5931\u8D25\uFF08\u964D\u7EA7\u4FDD\u6301\u5019\u9009\uFF09: ${e.message}`);
+      return null;
+    }
+  };
+}
+function parseReview(content) {
+  let text = content.trim();
+  if (text.startsWith("```")) {
+    text = text.replace(/^```[a-zA-Z]*\n?/, "").replace(/\n?```$/, "");
+  }
+  const match = text.match(/\{[\s\S]*\}/);
+  if (!match) throw new Error(`\u5BA1\u6838\u54CD\u5E94\u65E0 JSON \u5BF9\u8C61: ${text.slice(0, 200)}`);
+  const data = JSON.parse(match[0]);
+  if (!("should_keep" in data) && !("shouldKeep" in data)) {
+    throw new Error(`\u5BA1\u6838\u54CD\u5E94\u7F3A should_keep: ${text.slice(0, 200)}`);
+  }
+  let shouldKeep = data.shouldKeep ?? data.should_keep;
+  if (typeof shouldKeep === "string") {
+    shouldKeep = ["true", "1", "\u662F", "yes"].includes(shouldKeep.trim().toLowerCase());
+  }
+  return {
+    shouldKeep: !!shouldKeep,
+    confidence: Number(data.confidence ?? 0) || 0,
+    reason: String(data.reason ?? data.suggested_rule ?? "") || ""
+  };
+}
+var REVIEW_PROMPT;
+var init_reviewer = __esm({
+  "src/brain/reviewer.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_config();
+    REVIEW_PROMPT = `\u4F60\u662F AgentMoss \u5B89\u5168\u89C4\u5219\u5BA1\u6838\u5668\u3002\u5224\u65AD\u4E0B\u5217"\u4ECE LLM \u62D2\u7EDD\u7ED3\u679C\u4E2D\u63D0\u53D6\u7684\u5B89\u5168\u6A21\u5F0F"\u662F\u5426\u503C\u5F97\u6C89\u6DC0\u4E3A\u672C\u5730\u89C4\u5219\u3002
+
+## \u63D0\u53D6\u7684\u6A21\u5F0F\uFF08\u5019\u9009\uFF09
+- \u6A21\u5F0F: {pattern}
+- \u6240\u5C5E\u5C42: Layer {layer}\uFF081=\u7279\u5F81\u5339\u914D\uFF0C2=\u884C\u4E3A\u94FE\uFF09
+- \u7C7B\u578B: {ruleType}
+
+## \u539F\u59CB\u88AB\u62D2\u7EDD\u7684\u64CD\u4F5C
+{actionDetail}
+
+## LLM \u5F53\u65F6\u7684\u62D2\u7EDD\u7406\u7531
+{reason}
+
+## \u5224\u65AD\u51C6\u5219
+1. **\u662F\u5426\u8FC7\u9AD8\u6CDB\u5316**\uFF1A\u8FD9\u6761\u6A21\u5F0F\u662F\u5426\u4F1A\u8BEF\u62E6\u6B63\u5E38\u7684\u5408\u6CD5\u64CD\u4F5C\uFF1F
+2. **\u662F\u5426\u7B26\u5408\u654F\u611F\u7279\u5F81**\uFF1A\u6307\u5411\u7684\u8DEF\u5F84/\u547D\u4EE4\u662F\u5426\u786E\u5B9E\u654F\u611F\uFF08\u51ED\u636E/\u7CFB\u7EDF\u6587\u4EF6/\u6076\u610F\u547D\u4EE4/\u5916\u4F20\uFF09\uFF1F
+3. **\u4E0E\u4E09\u5C42\u89C4\u5219\u91CD\u590D**\uFF1A\u662F\u5426\u5DF2\u88AB\u73B0\u6709 L1/L2 \u89C4\u5219\u8986\u76D6\uFF1F
+4. **\u662F\u4E0D\u662F\u771F\u5B9E\u653B\u51FB\u6A21\u5F0F**\uFF1A\u662F\u5426\u4EE3\u8868\u4E00\u79CD\u8FDE\u7EED\u7684\u653B\u51FB\u884C\u4E3A\u6A21\u5F0F\uFF1F
+
+## \u8F93\u51FA JSON\uFF08\u53EA\u8F93\u51FA JSON\uFF0C\u65E0\u5176\u4ED6\u6587\u5B57\uFF09
+{"should_keep": true/false, "confidence": 0-100, "reason": "\u7B80\u77ED\u7406\u7531\uFF08\u4E2D\u6587\uFF09", "suggested_rule": "\u82E5\u4FDD\u7559\u5219\u8F93\u51FA\u5EFA\u8BAE\u6B63\u5219\uFF0C\u5426\u5219\u7A7A\u4E32", "duplicate_of": "\u82E5\u91CD\u590D\u5219\u8BF4\u660E\u662F\u54EA\u4E2A\uFF0C\u5426\u5219\u7A7A\u4E32"}`;
+  }
+});
+
+// src/brain/index.ts
+function checkBrainRules(store, opts) {
+  if (!store) return null;
+  const rules = store.getActiveRules(opts.layer);
+  if (rules.length === 0) return null;
+  const combined = `${opts.actionType} ${opts.actionDetail}`;
+  for (const rule of rules) {
+    try {
+      if (new RegExp(rule.pattern, "i").test(combined)) {
+        if (opts.layer === 2 && opts.actionHistory) {
+          if (!checkLayer2Context(rule.pattern, opts.actionHistory, opts.actionDetail)) {
+            continue;
+          }
+        }
+        store.recordTrigger(rule.id);
+        return {
+          ruleId: rule.id,
+          pattern: rule.pattern,
+          explanation: rule.explanation,
+          confidence: rule.confidence
+        };
+      }
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+function checkLayer2Context(pattern, actionHistory, actionDetail) {
+  if (pattern.startsWith("BEHAVIOR_CHAIN:")) {
+    const chainType = pattern.replace("BEHAVIOR_CHAIN:", "");
+    if (chainType === "external_read\u2192sensitive_write") {
+      const hasExternalRead = actionHistory.slice(-5).some((h) => /curl|wget|http/i.test(h.actionDetail ?? ""));
+      const isSensitiveWrite = /\.ssh|\.gnupg|authorized_keys|bashrc|profile/i.test(actionDetail);
+      return hasExternalRead && isSensitiveWrite;
+    }
+    if (chainType === "multi_config_read\u2192privilege_action") {
+      const configReads = actionHistory.slice(-5).filter((h) => /\/etc\/|config|\.conf|\.yaml|\.json/i.test(h.actionDetail ?? "")).length;
+      const isPrivilege = /sudo|su |chmod|chown/i.test(actionDetail);
+      return configReads >= 2 && isPrivilege;
+    }
+    return false;
+  }
+  return true;
+}
+var init_brain = __esm({
+  "src/brain/index.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_rule_store();
+    init_pattern_extractor();
+    init_reviewer();
+  }
+});
+
 // src/engine/coordinator.ts
 var coordinator_exports = {};
 __export(coordinator_exports, {
   TRUSTED_SKILLS_BASE: () => TRUSTED_SKILLS_BASE,
+  _resetBrainForTest: () => _resetBrainForTest,
   runAnalysis: () => runAnalysis
 });
 function extractFirstCommand(command) {
@@ -3981,6 +4536,20 @@ function extractRawCommand(detail) {
 function matchesAny(cmd, patterns) {
   return patterns.some((p) => p.test(cmd));
 }
+function getBrainStore() {
+  if (!isBrainEnabled()) return null;
+  if (!_brainInitialized) {
+    _brainStore = new BrainRuleStore();
+    _brainExtractor = new PatternExtractor(_brainStore, { review: createBrainReviewer() });
+    _brainInitialized = true;
+  }
+  return _brainStore;
+}
+function _resetBrainForTest() {
+  _brainStore = null;
+  _brainExtractor = null;
+  _brainInitialized = false;
+}
 async function runAnalysis(input) {
   const heuristicResult = isHeuristicEnabled() ? runHeuristicCheck(input) : null;
   const isInlineScriptCmd = isInlineScriptCommand(input.aNext.actionDetail.toLowerCase());
@@ -4013,6 +4582,25 @@ async function runAnalysis(input) {
       }
     }
   }
+  const brainStore = getBrainStore();
+  if (brainStore) {
+    const brainL1 = checkBrainRules(brainStore, {
+      layer: 1,
+      actionType: input.aNext.actionType,
+      actionDetail: input.aNext.actionDetail
+    });
+    if (brainL1) {
+      return {
+        allowed: false,
+        reason: `[Brain L1] ${brainL1.explanation}`,
+        riskLevel: "high",
+        riskType: "brain_rule",
+        confidence: Math.round(brainL1.confidence * 100),
+        source: "brain_rule",
+        violatedLayers: ["brain_L1"]
+      };
+    }
+  }
   const actionType = input.aNext.actionType.toLowerCase();
   const rawDetail = extractRawCommand(input.aNext.actionDetail);
   const lowerDetail = rawDetail.toLowerCase();
@@ -4138,6 +4726,25 @@ async function runAnalysis(input) {
       }
     }
   }
+  if (brainStore) {
+    const brainL2 = checkBrainRules(brainStore, {
+      layer: 2,
+      actionType: input.aNext.actionType,
+      actionDetail: input.aNext.actionDetail,
+      actionHistory: input.actionHistory
+    });
+    if (brainL2) {
+      return {
+        allowed: false,
+        reason: `[Brain L2] ${brainL2.explanation}`,
+        riskLevel: "high",
+        riskType: "brain_rule",
+        confidence: Math.round(brainL2.confidence * 100),
+        source: "brain_rule",
+        violatedLayers: ["brain_L2"]
+      };
+    }
+  }
   if (skipLLM || !isLLMAvailable()) {
     return {
       allowed: true,
@@ -4204,9 +4811,23 @@ async function runAnalysis(input) {
       violatedLayers: ["3"]
     };
   }
+  if (!llmResult.allowed && llmResult.confidence && llmResult.confidence >= 90 && _brainExtractor) {
+    try {
+      await _brainExtractor.extract(
+        { actionDetail: input.aNext.actionDetail, eventId: "" },
+        {
+          confidence: llmResult.confidence / 100,
+          reason: llmResult.reason || "",
+          riskType: llmResult.riskType || "",
+          actionDetail: input.aNext.actionDetail
+        }
+      );
+    } catch {
+    }
+  }
   return llmResult;
 }
-var FULLY_SAFE_TOOLS, TRUSTED_SKILLS_BASE, READONLY_SENSITIVE_TOOLS, FULLY_SAFE_BASH_PATTERNS, READONLY_SENSITIVE_BASH_PATTERNS;
+var FULLY_SAFE_TOOLS, TRUSTED_SKILLS_BASE, READONLY_SENSITIVE_TOOLS, FULLY_SAFE_BASH_PATTERNS, READONLY_SENSITIVE_BASH_PATTERNS, _brainStore, _brainExtractor, _brainInitialized;
 var init_coordinator = __esm({
   "src/engine/coordinator.ts"() {
     "use strict";
@@ -4218,6 +4839,8 @@ var init_coordinator = __esm({
     init_script_content_analyzer();
     init_config();
     init_agents();
+    init_brain();
+    init_reviewer();
     FULLY_SAFE_TOOLS = /* @__PURE__ */ new Set([
       "ask_user_question",
       "glob",
@@ -4284,6 +4907,9 @@ var init_coordinator = __esm({
       /^sort(?:\s|$)/i,
       /^uniq(?:\s|$)/i
     ];
+    _brainStore = null;
+    _brainExtractor = null;
+    _brainInitialized = false;
   }
 });
 
@@ -4370,7 +4996,7 @@ var require_bindings = __commonJS({
     var fs4 = __require("fs");
     var path3 = __require("path");
     var fileURLToPath10 = require_file_uri_to_path();
-    var join6 = path3.join;
+    var join7 = path3.join;
     var dirname8 = path3.dirname;
     var exists = fs4.accessSync && function(path4) {
       try {
@@ -4430,7 +5056,7 @@ var require_bindings = __commonJS({
       var requireFunc = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
       var tries = [], i = 0, l = opts.try.length, n, b, err;
       for (; i < l; i++) {
-        n = join6.apply(
+        n = join7.apply(
           null,
           opts.try[i].map(function(p) {
             return opts[p] || p;
@@ -4491,7 +5117,7 @@ var require_bindings = __commonJS({
         if (dir === ".") {
           dir = process.cwd();
         }
-        if (exists(join6(dir, "package.json")) || exists(join6(dir, "node_modules"))) {
+        if (exists(join7(dir, "package.json")) || exists(join7(dir, "node_modules"))) {
           return dir;
         }
         if (prev === dir) {
@@ -4500,7 +5126,7 @@ var require_bindings = __commonJS({
           );
         }
         prev = dir;
-        dir = join6(dir, "..");
+        dir = join7(dir, "..");
       }
     };
   }
@@ -5332,11 +5958,11 @@ init_esm_shims();
 init_runtime_config();
 init_token_stats();
 import { Hono } from "hono";
-import { readFileSync as readFileSync10, existsSync as existsSync10 } from "fs";
-import { join as join5, dirname as dirname7 } from "path";
+import { readFileSync as readFileSync11, existsSync as existsSync11 } from "fs";
+import { join as join6, dirname as dirname7 } from "path";
 import { fileURLToPath as fileURLToPath8 } from "url";
 var __dirname7 = dirname7(fileURLToPath8(import.meta.url));
-var STATIC_DIR = join5(__dirname7, "static");
+var STATIC_DIR = join6(__dirname7, "static");
 var CONSOLE_TOKEN_ENV = "AGENT_MOSS_CONSOLE_TOKEN";
 function getConsoleToken() {
   return process.env[CONSOLE_TOKEN_ENV] || "";
@@ -5360,9 +5986,9 @@ function createConsoleRouter() {
   const console2 = new Hono();
   console2.use("/api/*", authMiddleware());
   const serveIndex = (c) => {
-    const indexFile = join5(STATIC_DIR, "index.html");
-    if (existsSync10(indexFile)) {
-      return c.html(readFileSync10(indexFile, "utf-8"));
+    const indexFile = join6(STATIC_DIR, "index.html");
+    if (existsSync11(indexFile)) {
+      return c.html(readFileSync11(indexFile, "utf-8"));
     }
     return c.html("<h1>AgentMoss Policy Console</h1><p>Frontend not built. Use /console/api/* endpoints.</p>");
   };
@@ -5453,13 +6079,13 @@ function createConsoleRouter() {
     if (!/^[A-Za-z0-9_-]+$/.test(skillId)) {
       return c.json({ error: "invalid skill_id" }, 400);
     }
-    const skillPath = join5(dirname7(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
-    if (!existsSync10(skillPath)) {
-      const builtinPath = join5(__dirname7, "..", "..", "agent_moss", "skills", `${skillId}.md`);
-      if (existsSync10(builtinPath)) return c.text(readFileSync10(builtinPath, "utf-8"));
+    const skillPath = join6(dirname7(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
+    if (!existsSync11(skillPath)) {
+      const builtinPath = join6(__dirname7, "..", "..", "agent_moss", "skills", `${skillId}.md`);
+      if (existsSync11(builtinPath)) return c.text(readFileSync11(builtinPath, "utf-8"));
       return c.json({ error: "skill not found" }, 404);
     }
-    return c.text(readFileSync10(skillPath, "utf-8"));
+    return c.text(readFileSync11(skillPath, "utf-8"));
   });
   console2.get("/api/agents", (c) => {
     const rc = loadRuntimeConfig();