@kenhkl/agent-moss 0.12.6 → 0.12.8

package/dist/engine/coordinator.js

@@ -126,6 +126,7 @@ __export(config_exports, {
   getProviderHeaders: () => getProviderHeaders,
   getRetryConfig: () => getRetryConfig,
   getTimeoutConfig: () => getTimeoutConfig,
+  isBrainEnabled: () => isBrainEnabled,
   isHeuristicEnabled: () => isHeuristicEnabled,
   isLLMAvailable: () => isLLMAvailable,
   isLogicRulesEnabled: () => isLogicRulesEnabled,
@@ -245,11 +246,11 @@ function isLLMAvailable() {
 }
 async function probeLLMConnection(timeoutMs = 8e3) {
   if (!isLLMAvailable()) return false;
-  const OpenAI2 = (await import("openai")).default;
+  const OpenAI3 = (await import("openai")).default;
   const config = getLLMConfig();
   const provider = detectProvider(config.baseUrl, config.provider);
   const extraHeaders = getProviderHeaders(provider);
-  const client = new OpenAI2({
+  const client = new OpenAI3({
     baseURL: config.baseUrl,
     apiKey: config.apiKey,
     timeout: timeoutMs,
@@ -307,6 +308,9 @@ function getProviderHeaders(provider) {
 function isHeuristicEnabled() {
   return process.env.AGENT_MOSS_DISABLE_HEURISTIC !== "1";
 }
+function isBrainEnabled() {
+  return process.env.AGENT_MOSS_BRAIN_ENABLED === "1";
+}
 function isLogicRulesEnabled() {
   return process.env.AGENT_MOSS_DISABLE_LOGIC_RULES !== "1";
 }
@@ -756,6 +760,53 @@ function runLogicCheck(input) {
   if (pwdResult) return pwdResult;
   const userDelResult = checkUserDeletionConsent(actionType, actionDetail, actionHistory);
   if (userDelResult) return userDelResult;
+  const comboResult = checkComboChain(actionHistory, aNext.actionDetail);
+  if (comboResult) return comboResult;
+  return null;
+}
+function checkComboChain(actionHistory, actionDetailRaw) {
+  INLINE_SCRIPT_RE.lastIndex = 0;
+  if (INLINE_SCRIPT_RE.test(actionDetailRaw)) return null;
+  const details = [];
+  for (const h of actionHistory) {
+    if (h.actionDetail) details.push(h.actionDetail.toLowerCase());
+  }
+  details.push(actionDetailRaw.toLowerCase());
+  const seq = details.map((d) => {
+    const hits = /* @__PURE__ */ new Set();
+    for (const [stage, pats] of Object.entries(COMBO_STAGES)) {
+      if (pats.some((p) => {
+        p.lastIndex = 0;
+        return p.test(d);
+      })) hits.add(stage);
+    }
+    return hits;
+  });
+  for (const chain of COMBO_CHAINS) {
+    const chainStages = chain.stages;
+    if (!chainStages.length || chain.min_stages <= 0) continue;
+    let matched = 0;
+    let stageIdx = 0;
+    for (const hits of seq) {
+      if (stageIdx < chainStages.length && hits.has(chainStages[stageIdx])) {
+        matched += 1;
+        stageIdx += 1;
+        if (matched >= chain.min_stages) break;
+      }
+    }
+    if (matched >= chain.min_stages) {
+      const riskLevel = chain.risk_level === "critical" || chain.risk_level === "high" || chain.risk_level === "medium" || chain.risk_level === "low" ? chain.risk_level : "high";
+      return {
+        allowed: false,
+        reason: chain.reason,
+        riskLevel,
+        riskType: "combo_chain",
+        confidence: 85,
+        source: "logic_rule",
+        violatedLayers: ["2"]
+      };
+    }
+  }
   return null;
 }
 function extractFilePaths(text) {
@@ -855,17 +906,17 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
     }
   }
   const unreadPaths = [];
-  for (const path3 of uniqueTargetPaths) {
+  for (const path5 of uniqueTargetPaths) {
     const hasRead = [...historyReadPaths].some(
-      (rp) => path3 === rp || path3.startsWith(rp) || rp.startsWith(path3)
+      (rp) => path5 === rp || path5.startsWith(rp) || rp.startsWith(path5)
     );
     if (!hasRead) {
-      let isCreate = !fs2.existsSync(path3);
+      let isCreate = !fs2.existsSync(path5);
       if (!isCreate) {
         isCreate = CREATE_KEYWORDS.some((kw) => reason.toLowerCase().includes(kw) || actionDetail.includes(kw));
       }
       if (!isCreate) {
-        unreadPaths.push(path3);
+        unreadPaths.push(path5);
       }
     }
   }
@@ -1008,7 +1059,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
     violatedLayers: ["2"]
   };
 }
-var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, WRITE_KEYWORDS, WRITE_COMMAND_RES, READ_ONLY_COMMANDS, DEVNULL_REDIRECT_RE, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
+var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, WRITE_KEYWORDS, WRITE_COMMAND_RES, READ_ONLY_COMMANDS, DEVNULL_REDIRECT_RE, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
 var init_logic_rules = __esm({
   "src/engine/logic-rules.ts"() {
     "use strict";
@@ -1017,7 +1068,7 @@ var init_logic_rules = __esm({
     init_rules_loader();
     ROOT_SENSITIVE_PATHS = _loadSensitivePathScope("root");
     HOME_SENSITIVE_PATHS = _loadSensitivePathScope("home");
-    CREDENTIAL_PATHS = _loadSensitivePathScope("credential").map(({ path: path3, riskLevel, desc }) => ({ path: path3, riskLevel, desc, credential: true }));
+    CREDENTIAL_PATHS = _loadSensitivePathScope("credential").map(({ path: path5, riskLevel, desc }) => ({ path: path5, riskLevel, desc, credential: true }));
     NON_WRITE_TOOLS = /* @__PURE__ */ new Set([
       "ask_user_question",
       "glob",
@@ -1161,6 +1212,24 @@ var init_logic_rules = __esm({
         reason: p.reason
       }));
     })();
+    COMBO_STAGES = (() => {
+      const combo = loadL2().combo_chains || {};
+      const stages = {};
+      for (const [name, pats] of Object.entries(combo.stages || {})) {
+        stages[name] = pats.map((p) => new RegExp(p, "i"));
+      }
+      return stages;
+    })();
+    COMBO_CHAINS = (() => {
+      const combo = loadL2().combo_chains || {};
+      return (combo.chains || []).map((c) => ({
+        id: String(c.id || "combo_chain"),
+        stages: c.stages || [],
+        min_stages: Number(c.min_stages) || (c.stages || []).length,
+        risk_level: String(c.risk_level || "high"),
+        reason: String(c.reason || "\u68C0\u6D4B\u5230\u7EC4\u5408\u653B\u51FB\u94FE")
+      }));
+    })();
     INLINE_SCRIPT_RE = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
     DIR_TRAVERSAL_KW = [
       "os.listdir",
@@ -1278,9 +1347,11 @@ __export(runtime_config_exports, {
   addAgentRule: () => addAgentRule,
   addCustomRule: () => addCustomRule,
   addCustomSkill: () => addCustomSkill,
+  addScenarioRule: () => addScenarioRule,
   deleteAgentRule: () => deleteAgentRule,
   deleteCustomRule: () => deleteCustomRule,
   deleteCustomSkill: () => deleteCustomSkill,
+  deleteScenarioRule: () => deleteScenarioRule,
   filterEnabledRules: () => filterEnabledRules,
   generateSourceDefaults: () => generateSourceDefaults,
   getAgentRules: () => getAgentRules,
@@ -1299,9 +1370,11 @@ __export(runtime_config_exports, {
   getEnabledL2SensitivePathsOrDefault: () => getEnabledL2SensitivePathsOrDefault,
   getEnabledL2UserDeletionPatterns: () => getEnabledL2UserDeletionPatterns,
   getEnabledL2UserDeletionPatternsOrDefault: () => getEnabledL2UserDeletionPatternsOrDefault,
+  getEnabledScenarioExtensions: () => getEnabledScenarioExtensions,
   getEnvOverrides: () => getEnvOverrides,
   getProfileOrDetect: () => getProfileOrDetect,
   getRuntimeConfigPath: () => getRuntimeConfigPath,
+  getScenarioRules: () => getScenarioRules,
   hasRuntimeConfig: () => hasRuntimeConfig,
   isL2CategoryEnabled: () => isL2CategoryEnabled,
   isLayerEnabled: () => isLayerEnabled,
@@ -1315,6 +1388,8 @@ __export(runtime_config_exports, {
   updateRuleDenyMode: () => updateRuleDenyMode,
   updateRuleEnabled: () => updateRuleEnabled,
   updateRuleSkipL3: () => updateRuleSkipL3,
+  updateScenarioCategoryEnabled: () => updateScenarioCategoryEnabled,
+  updateScenarioRuleEnabled: () => updateScenarioRuleEnabled,
   updateSkillCategoryEnabled: () => updateSkillCategoryEnabled,
   updateSkillEnabled: () => updateSkillEnabled
 });
@@ -1343,7 +1418,8 @@ function emptyRuntimeConfig() {
     L1_rules: {},
     L2_rules: {},
     L3_skills: {},
-    agent_rules: {}
+    agent_rules: {},
+    scenario_rules: {}
   };
 }
 function loadRuntimeConfig() {
@@ -1369,7 +1445,8 @@ function loadRuntimeConfig() {
       L1_rules: merged.L1_rules || {},
       L2_rules: merged.L2_rules || {},
       L3_skills: merged.L3_skills || {},
-      agent_rules: merged.agent_rules || {}
+      agent_rules: merged.agent_rules || {},
+      scenario_rules: merged.scenario_rules || {}
     };
   } catch {
     return emptyRuntimeConfig();
@@ -1604,6 +1681,55 @@ function _l3SkillsToRules() {
   out.user_custom = { category_enabled: true, category_desc: "", skills: [] };
   return out;
 }
+function _scenarioRulesToDefaults() {
+  const out = {};
+  const scenDir = existsSync4(_SCENARIOS_DIR_PROD) ? _SCENARIOS_DIR_PROD : existsSync4(_SCENARIOS_DIR_DEV) ? _SCENARIOS_DIR_DEV : _SCENARIOS_DIR_PROD;
+  if (!existsSync4(scenDir)) return out;
+  let entries;
+  try {
+    entries = readdirSync3(scenDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+  } catch {
+    return out;
+  }
+  for (const scenarioId of entries) {
+    const rulesFile = join2(scenDir, scenarioId, "rules.json");
+    if (!existsSync4(rulesFile)) continue;
+    let data;
+    try {
+      data = JSON.parse(readFileSync4(rulesFile, "utf-8"));
+    } catch {
+      continue;
+    }
+    out[scenarioId] = {
+      builtin_safe_action_types: {
+        category_enabled: true,
+        category_desc: "\u573A\u666F\u5B8C\u5168\u5B89\u5168\u64CD\u4F5C\u767D\u540D\u5355\uFF08\u573A\u666F\u901A\u5E38\u4E0D\u4F7F\u7528\uFF09",
+        rules: []
+      },
+      builtin_safe_skills: {
+        category_enabled: true,
+        category_desc: "\u573A\u666F\u4FE1\u4EFB\u7684\u5185\u7F6E Skill\uFF08\u573A\u666F\u901A\u5E38\u4E0D\u4F7F\u7528\uFF09",
+        rules: []
+      },
+      extra_command_patterns: {
+        category_enabled: true,
+        category_desc: "\u573A\u666F\u4E13\u5C5E\u5371\u9669\u547D\u4EE4\u6B63\u5219\uFF08L1 \u672B\u5C3E\u8FFD\u52A0\uFF09",
+        rules: (data.extra_command_patterns || []).map((p) => ({ ...p, enabled: true, builtin: true }))
+      },
+      extra_injection_keywords: {
+        category_enabled: true,
+        category_desc: "\u573A\u666F\u4E13\u5C5E\u6CE8\u5165\u5173\u952E\u8BCD\uFF08L1 \u672B\u5C3E\u8FFD\u52A0\uFF09",
+        rules: (data.extra_injection_keywords || []).map((k) => ({ ...k, enabled: true, builtin: true }))
+      },
+      extra_sensitive_paths: {
+        category_enabled: true,
+        category_desc: "\u573A\u666F\u4E13\u5C5E\u654F\u611F\u8DEF\u5F84\uFF08L1 \u672B\u5C3E\u8FFD\u52A0\uFF09",
+        rules: (data.extra_sensitive_paths || []).map((sp) => ({ ...sp, enabled: true, builtin: true }))
+      }
+    };
+  }
+  return out;
+}
 function _agentRulesToDefaults() {
   const out = {};
   const agentsDir = existsSync4(_AGENTS_DIR_PROD) ? _AGENTS_DIR_PROD : existsSync4(_AGENTS_DIR_DEV) ? _AGENTS_DIR_DEV : _AGENTS_DIR_PROD;
@@ -1695,7 +1821,8 @@ function generateSourceDefaults() {
       user_custom: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49 L2 \u903B\u8F91\u89C4\u5219", rules: [] }
     },
     L3_skills: _l3SkillsToRules(),
-    agent_rules: _agentRulesToDefaults()
+    agent_rules: _agentRulesToDefaults(),
+    scenario_rules: _scenarioRulesToDefaults()
   };
 }
 function normalizePatternForFingerprint(pattern) {
@@ -1788,9 +1915,9 @@ function _mergeSkillCategories(userCfg, srcDefaults, layerKey) {
     }
   }
 }
-function _mergeAgentRules(userCfg, srcDefaults) {
-  const userAgent = userCfg.agent_rules || (userCfg.agent_rules = {});
-  const srcAgent = srcDefaults.agent_rules || {};
+function _mergeAgentRules(userCfg, srcDefaults, partition = "agent_rules") {
+  const userAgent = userCfg[partition] || (userCfg[partition] = {});
+  const srcAgent = srcDefaults[partition] || {};
   for (const [agentId, srcCats] of Object.entries(srcAgent)) {
     if (!(agentId in userAgent)) {
       userAgent[agentId] = JSON.parse(JSON.stringify(srcCats));
@@ -1849,6 +1976,7 @@ function mergeConfig(userCfg, srcDefaults) {
   _mergeRuleCategories(cfg, srcDefaults, "L2_rules");
   _mergeSkillCategories(cfg, srcDefaults, "L3_skills");
   _mergeAgentRules(cfg, srcDefaults);
+  _mergeAgentRules(cfg, srcDefaults, "scenario_rules");
   return cfg;
 }
 function _migrateCategoriesAcrossLayers(cfg, srcLayer, dstLayer, catNames) {
@@ -2174,7 +2302,85 @@ function updateAgentCategoryEnabled(agentId, category, enabled) {
   saveRuntimeConfig(runtime);
   return runtime;
 }
-var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DENY_MODE_LABELS, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, SKILL_ID_RE;
+function getScenarioRules(runtime) {
+  return runtime.scenario_rules || {};
+}
+function getEnabledScenarioExtensions(runtime, scenarioId) {
+  const scenData = runtime.scenario_rules?.[scenarioId];
+  if (!scenData) return null;
+  const cmdPatterns = _agentCategoryEnabledRules(scenData.extra_command_patterns).filter((r) => r.pattern).map((r) => ({
+    pattern: r.pattern,
+    risk_level: r.risk_level || "",
+    risk_type: r.risk_type || "",
+    reason: r.reason || ""
+  }));
+  const injKeywords = _agentCategoryEnabledRules(scenData.extra_injection_keywords).filter((r) => r.keyword).map((r) => ({
+    keyword: r.keyword,
+    risk_level: r.risk_level || "",
+    lang: r.lang || "en"
+  }));
+  const sensitivePaths = _agentCategoryEnabledRules(scenData.extra_sensitive_paths).filter((r) => r.path).map((r) => ({
+    path: r.path,
+    risk_level: r.risk_level || "",
+    desc: r.desc || "",
+    credential: r.credential,
+    read_only: r.read_only,
+    deny_mode: r.deny_mode
+  }));
+  return {
+    agent_id: scenarioId,
+    description: "",
+    extra_command_patterns: cmdPatterns,
+    extra_injection_keywords: injKeywords,
+    extra_sensitive_paths: sensitivePaths,
+    builtin_safe_skills: [],
+    builtin_safe_action_types: [],
+    extra_skills: []
+  };
+}
+function updateScenarioRuleEnabled(scenarioId, category, ruleFp, enabled) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.scenario_rules?.[scenarioId]?.[category];
+  if (cat) {
+    const targetFp = _ruleFingerprint(ruleFp);
+    for (const r of cat.rules || []) {
+      if (_ruleFingerprint(r) === targetFp) {
+        r.enabled = enabled;
+        break;
+      }
+    }
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function addScenarioRule(scenarioId, category, rule) {
+  const runtime = loadRuntimeConfig();
+  if (!runtime.scenario_rules) runtime.scenario_rules = {};
+  if (!runtime.scenario_rules[scenarioId]) runtime.scenario_rules[scenarioId] = {};
+  const cats = runtime.scenario_rules[scenarioId];
+  if (!cats[category]) cats[category] = { category_enabled: true, category_desc: "", rules: [] };
+  (cats[category].rules || (cats[category].rules = [])).push({ ...rule, enabled: true, builtin: false });
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function deleteScenarioRule(scenarioId, category, ruleFp) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.scenario_rules?.[scenarioId]?.[category];
+  if (cat) {
+    const targetFp = _ruleFingerprint(ruleFp);
+    cat.rules = (cat.rules || []).filter((r) => _ruleFingerprint(r) !== targetFp);
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function updateScenarioCategoryEnabled(scenarioId, category, enabled) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.scenario_rules?.[scenarioId]?.[category];
+  if (cat) cat.category_enabled = enabled;
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DENY_MODE_LABELS, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, SKILL_ID_RE;
 var init_runtime_config = __esm({
   "src/infra/runtime-config.ts"() {
     "use strict";
@@ -2199,6 +2405,8 @@ var init_runtime_config = __esm({
     };
     _AGENTS_DIR_PROD = join2(__dirname4, "agents");
     _AGENTS_DIR_DEV = join2(__dirname4, "..", "..", "..", "agent_moss", "agents");
+    _SCENARIOS_DIR_PROD = join2(__dirname4, "scenarios");
+    _SCENARIOS_DIR_DEV = join2(__dirname4, "..", "..", "..", "agent_moss", "scenarios");
     SKILL_ID_RE = /^[A-Za-z0-9_-]+$/;
   }
 });
@@ -2250,6 +2458,21 @@ function getAgentExtensions(agentId) {
   );
   return ext;
 }
+function mergeAgentExtensions(...exts) {
+  const nonNull = exts.filter((e) => !!e);
+  if (nonNull.length === 0) return null;
+  const base = nonNull[0];
+  return {
+    agent_id: base.agent_id,
+    description: base.description,
+    extra_command_patterns: nonNull.flatMap((e) => e.extra_command_patterns || []),
+    extra_injection_keywords: nonNull.flatMap((e) => e.extra_injection_keywords || []),
+    extra_sensitive_paths: nonNull.flatMap((e) => e.extra_sensitive_paths || []),
+    builtin_safe_skills: nonNull.flatMap((e) => e.builtin_safe_skills || []),
+    builtin_safe_action_types: nonNull.flatMap((e) => e.builtin_safe_action_types || []),
+    extra_skills: nonNull.flatMap((e) => e.extra_skills || [])
+  };
+}
 var __filename4, __dirname5, AGENTS_DIR_PROD, AGENTS_DIR_DEV_FALLBACK, cache;
 var init_agents = __esm({
   "src/agents/index.ts"() {
@@ -2263,6 +2486,77 @@ var init_agents = __esm({
   }
 });
 
+// src/scenarios/index.ts
+import { readFileSync as readFileSync6, existsSync as existsSync6 } from "fs";
+import { resolve as resolve4, dirname as dirname5 } from "path";
+import { fileURLToPath as fileURLToPath7 } from "url";
+function resolveScenariosDir() {
+  if (existsSync6(SCENARIOS_DIR_PROD)) return SCENARIOS_DIR_PROD;
+  if (existsSync6(SCENARIOS_DIR_DEV_FALLBACK)) return SCENARIOS_DIR_DEV_FALLBACK;
+  return SCENARIOS_DIR_PROD;
+}
+function getScenarioExtensions(scenarioId) {
+  if (!scenarioId) return null;
+  if (cache2.has(scenarioId)) return cache2.get(scenarioId) ?? null;
+  let ext = null;
+  try {
+    const { hasRuntimeConfig: hasRuntimeConfig2, loadRuntimeConfig: loadRuntimeConfig2, getEnabledScenarioExtensions: getEnabledScenarioExtensions2 } = (init_runtime_config(), __toCommonJS(runtime_config_exports));
+    if (hasRuntimeConfig2()) {
+      ext = getEnabledScenarioExtensions2(loadRuntimeConfig2(), scenarioId);
+    }
+  } catch {
+  }
+  if (ext === null) {
+    const scenariosDir = resolveScenariosDir();
+    const rulesFile = resolve4(scenariosDir, scenarioId, "rules.json");
+    if (!existsSync6(rulesFile)) {
+      cache2.set(scenarioId, null);
+      return null;
+    }
+    try {
+      const raw = readFileSync6(rulesFile, "utf-8");
+      const data = JSON.parse(raw);
+      const id = data.scenario_id || data.agent_id || "";
+      if (!id) {
+        console.warn(`[AgentMoss scenarios] rules.json \u7F3A\u5C11 scenario_id \u5B57\u6BB5: ${rulesFile}`);
+        cache2.set(scenarioId, null);
+        return null;
+      }
+      ext = {
+        agent_id: id,
+        description: data.description || "",
+        extra_command_patterns: data.extra_command_patterns || [],
+        extra_injection_keywords: data.extra_injection_keywords || [],
+        extra_sensitive_paths: data.extra_sensitive_paths || [],
+        builtin_safe_skills: data.builtin_safe_skills || [],
+        builtin_safe_action_types: data.builtin_safe_action_types || [],
+        extra_skills: data.extra_skills || []
+      };
+    } catch (e) {
+      console.error(`[AgentMoss scenarios] \u52A0\u8F7D\u573A\u666F ${scenarioId} rules.json \u5931\u8D25:`, e.message);
+      cache2.set(scenarioId, null);
+      return null;
+    }
+  }
+  cache2.set(scenarioId, ext);
+  console.log(
+    `[AgentMoss scenarios] \u52A0\u8F7D\u573A\u666F ${scenarioId} \u5B9A\u5236\u89C4\u5219: ${ext.extra_command_patterns?.length ?? 0} cmd patterns, ${ext.extra_injection_keywords?.length ?? 0} injection keywords, ${ext.extra_sensitive_paths?.length ?? 0} sensitive paths`
+  );
+  return ext;
+}
+var __filename5, __dirname6, SCENARIOS_DIR_PROD, SCENARIOS_DIR_DEV_FALLBACK, cache2;
+var init_scenarios = __esm({
+  "src/scenarios/index.ts"() {
+    "use strict";
+    init_esm_shims();
+    __filename5 = fileURLToPath7(import.meta.url);
+    __dirname6 = dirname5(__filename5);
+    SCENARIOS_DIR_PROD = resolve4(__dirname6, "scenarios");
+    SCENARIOS_DIR_DEV_FALLBACK = resolve4(__dirname6, "../../../agent_moss/scenarios");
+    cache2 = /* @__PURE__ */ new Map();
+  }
+});
+
 // src/engine/heuristic.ts
 function runHeuristicCheck(input) {
   const command = `${input.aNext.actionType}: ${input.aNext.actionDetail}`;
@@ -2302,7 +2596,10 @@ function runHeuristicCheck(input) {
     }
   }
   highestRiskType = topRiskType || highestRiskType;
-  const agentExt = getAgentExtensions(input.agentId);
+  const agentExt = mergeAgentExtensions(
+    getAgentExtensions(input.agentId),
+    getScenarioExtensions(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "")
+  );
   if (agentExt?.extra_command_patterns) {
     for (const rule of agentExt.extra_command_patterns) {
       try {
@@ -2475,13 +2772,13 @@ function checkSensitivePath(command, cwd, agentExt) {
   const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
   const isWriteOpFlag = isWriteOperation("", command);
   const pathScanText = normalizePathSegments(stripLiteralTextSegments(command));
-  const pathMatches = (text, path3) => {
-    const parts = path3.split(/(\(\?!.*?\))/);
+  const pathMatches = (text, path5) => {
+    const parts = path5.split(/(\(\?!.*?\))/);
     const escaped = parts.map((part) => {
       if (part.startsWith("(?!")) return part;
       return part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     }).join("");
-    const re = path3.startsWith(".") || path3.startsWith("/") ? new RegExp(`(?:^|[\\s/\\\\'"])${escaped}\\b`, "i") : new RegExp(`\\b${escaped}\\b`, "i");
+    const re = path5.startsWith(".") || path5.startsWith("/") ? new RegExp(`(?:^|[\\s/\\\\'"])${escaped}\\b`, "i") : new RegExp(`\\b${escaped}\\b`, "i");
     return re.test(text);
   };
   for (const sp of ROOT_SENSITIVE_PATHS) {
@@ -2745,6 +3042,7 @@ var init_heuristic = __esm({
     init_esm_shims();
     init_config();
     init_agents();
+    init_scenarios();
     init_rules_loader();
     init_logic_rules();
     INJECTION_KEYWORDS = (() => {
@@ -2779,16 +3077,16 @@ __export(token_stats_exports, {
   recordTokenUsage: () => recordTokenUsage,
   resetTokenStats: () => resetTokenStats
 });
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync2, existsSync as existsSync8, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2 } from "fs";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync2, existsSync as existsSync10, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2 } from "fs";
 function getStatsPath() {
   const envPath = process.env[ENV_STATS_PATH];
   if (envPath) return envPath;
   return getTokenStatsPath();
 }
 function loadAllRecords(statsPath) {
-  if (!existsSync8(statsPath)) return [];
+  if (!existsSync10(statsPath)) return [];
   try {
-    const data = JSON.parse(readFileSync9(statsPath, "utf-8"));
+    const data = JSON.parse(readFileSync11(statsPath, "utf-8"));
     if (Array.isArray(data)) return data;
     if (data && Array.isArray(data.records)) return data.records;
     return [];
@@ -2799,7 +3097,7 @@ function loadAllRecords(statsPath) {
 function saveRecords(statsPath, records) {
   try {
     const dir = statsPath.substring(0, statsPath.lastIndexOf("/"));
-    if (dir && !existsSync8(dir)) mkdirSync2(dir, { recursive: true });
+    if (dir && !existsSync10(dir)) mkdirSync2(dir, { recursive: true });
     writeFileSync2(statsPath, JSON.stringify(records, null, 2), "utf-8");
   } catch (e) {
   }
@@ -2926,7 +3224,7 @@ function getTokenTrend(days = 0, startDate, endDate) {
 }
 function resetTokenStats() {
   const statsPath = getStatsPath();
-  if (existsSync8(statsPath)) {
+  if (existsSync10(statsPath)) {
     try {
       unlinkSync2(statsPath);
     } catch {
@@ -2957,28 +3255,28 @@ init_skill_loader();
 
 // src/engine/template-loader.ts
 init_esm_shims();
-import { readFileSync as readFileSync6, existsSync as existsSync6 } from "fs";
-import { resolve as resolve4, dirname as dirname5 } from "path";
-import { fileURLToPath as fileURLToPath7 } from "url";
-var __filename5 = fileURLToPath7(import.meta.url);
-var __dirname6 = dirname5(__filename5);
-var TEMPLATES_DIR = resolve4(__dirname6, "../templates");
-var TEMPLATES_DIR_FALLBACK = resolve4(__dirname6, "../../../agent_moss/templates");
+import { readFileSync as readFileSync7, existsSync as existsSync7 } from "fs";
+import { resolve as resolve5, dirname as dirname6 } from "path";
+import { fileURLToPath as fileURLToPath8 } from "url";
+var __filename6 = fileURLToPath8(import.meta.url);
+var __dirname7 = dirname6(__filename6);
+var TEMPLATES_DIR = resolve5(__dirname7, "../templates");
+var TEMPLATES_DIR_FALLBACK = resolve5(__dirname7, "../../../agent_moss/templates");
 var TEMPLATE_FILES = ["prompt1_template.txt", "prompt2_template.txt", "security_judge_template.txt"];
 var cachedTemplates = null;
 function loadTemplates() {
   if (cachedTemplates) return cachedTemplates;
   cachedTemplates = {};
-  const dir = existsSync6(TEMPLATES_DIR) ? TEMPLATES_DIR : TEMPLATES_DIR_FALLBACK;
-  if (!existsSync6(dir)) {
+  const dir = existsSync7(TEMPLATES_DIR) ? TEMPLATES_DIR : TEMPLATES_DIR_FALLBACK;
+  if (!existsSync7(dir)) {
     console.warn("[AgentMoss] Templates directory not found:", TEMPLATES_DIR, "and fallback:", TEMPLATES_DIR_FALLBACK);
     return cachedTemplates;
   }
   for (const file of TEMPLATE_FILES) {
-    const filePath = resolve4(dir, file);
-    if (existsSync6(filePath)) {
+    const filePath = resolve5(dir, file);
+    if (existsSync7(filePath)) {
       const key = file.replace(".txt", "").replace("_template", "");
-      cachedTemplates[key] = readFileSync6(filePath, "utf-8");
+      cachedTemplates[key] = readFileSync7(filePath, "utf-8");
     }
   }
   console.log(`[AgentMoss] Loaded ${Object.keys(cachedTemplates).length} templates from ${dir}`);
@@ -2987,8 +3285,8 @@ function loadTemplates() {
 
 // src/engine/script-analyzer.ts
 init_esm_shims();
-import { readFileSync as readFileSync7 } from "fs";
-import { resolve as resolve5, join as join3 } from "path";
+import { readFileSync as readFileSync8 } from "fs";
+import { resolve as resolve6, join as join3 } from "path";
 var SUSPICIOUS_PATTERNS = [
   // Network exfiltration (curl/wget POST in scripts is almost never legitimate)
   { name: "curl POST", pattern: /curl\s+(.*\s)?-X\s+POST/i },
@@ -3121,8 +3419,8 @@ function assessKeywordCombinationRisk(matchedKeywords, scriptContent) {
 }
 function readScriptContent(scriptPath, maxLines = 500) {
   try {
-    const expandedPath = scriptPath.startsWith("~") ? join3(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve5(scriptPath);
-    const raw = readFileSync7(expandedPath, "utf-8");
+    const expandedPath = scriptPath.startsWith("~") ? join3(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve6(scriptPath);
+    const raw = readFileSync8(expandedPath, "utf-8");
     const lines = raw.split("\n").slice(0, maxLines);
     return { content: lines.join("\n"), lineCount: lines.length, error: "" };
   } catch (e) {
@@ -3176,760 +3474,3036 @@ ${result.scriptContent}
 init_esm_shims();
 init_heuristic();
 init_logic_rules();
-import { readFileSync as readFileSync8, statSync, existsSync as existsSync7 } from "fs";
-import { resolve as resolve6, join as join4, isAbsolute, dirname as dirname6 } from "path";
-import { homedir as homedir2 } from "os";
-function emptyChain() {
-  return {
-    nodes: [],
-    entryPath: "",
-    maxDepthReached: false,
-    maxSizeReached: false,
-    totalSize: 0,
-    totalLines: 0,
-    hasCritical: false,
-    hasHigh: false,
-    firstHitNode: null,
-    error: ""
-  };
+import { statSync as statSync2, existsSync as existsSync9 } from "fs";
+import { resolve as resolve8, join as join5, isAbsolute as isAbsolute2 } from "path";
+import { homedir as homedir3 } from "os";
+
+// src/engine/script-engine/tracker.ts
+init_esm_shims();
+import * as fs3 from "fs";
+import * as path3 from "path";
+import * as os from "os";
+
+// src/engine/script-engine/backends/python-backend.ts
+init_esm_shims();
+import { parser } from "@lezer/python";
+var MAX_LINES = 500;
+var PURE_BUILTINS = /* @__PURE__ */ new Set([
+  "len",
+  "print",
+  "str",
+  "int",
+  "float",
+  "bool",
+  "list",
+  "dict",
+  "set",
+  "tuple",
+  "range",
+  "sorted",
+  "enumerate",
+  "zip",
+  "map",
+  "filter",
+  "sum",
+  "min",
+  "max",
+  "abs",
+  "round",
+  "isinstance",
+  "type",
+  "open",
+  "input",
+  "repr",
+  "ord",
+  "chr",
+  "hex",
+  "oct",
+  "bin",
+  "format",
+  "id",
+  "hash",
+  "any",
+  "all",
+  "next",
+  "iter",
+  "reversed",
+  "pow",
+  "divmod"
+]);
+var CHILD_CALL_RE = /(?:^|\s|&&|\|\|)\s*((?:\/bin\/)?bash|sh|zsh|(?:python|python3|node|ruby|perl|php|lua))\s+(\S+(?:\.(?:sh|shrc|py|js|rb|pl|php|lua))?)([^\n;|&]*?)$/gim;
+var SUBPROCESS_FUNCS = /* @__PURE__ */ new Set(["run", "call", "Popen", "check_call", "check_output"]);
+var OS_FUNCS = /* @__PURE__ */ new Set(["system", "popen", "popen2", "popen3", "popen4"]);
+function buildLineStarts(content) {
+  const starts = [0];
+  for (let i = 0; i < content.length; i++) {
+    if (content[i] === "\n") starts.push(i + 1);
+  }
+  return starts;
+}
+function lineAt(lineStarts, pos) {
+  let lo = 0;
+  let hi = lineStarts.length - 1;
+  while (lo < hi) {
+    const mid = lo + hi + 1 >> 1;
+    if (lineStarts[mid] <= pos) lo = mid;
+    else hi = mid - 1;
+  }
+  return lo + 1;
+}
+function markNodeLines(node, lines, lineStarts) {
+  const start = lineAt(lineStarts, node.from);
+  const end = node.to > node.from ? lineAt(lineStarts, node.to - 1) : start;
+  for (let i = start; i <= end; i++) lines.add(i);
+}
+function reconstruct(sourceLines, lines) {
+  const out = [];
+  for (const i of [...lines].sort((a, b) => a - b)) {
+    if (i >= 1 && i <= sourceLines.length) out.push(sourceLines[i - 1]);
+  }
+  return out.join("\n");
+}
+function makeEnv(argv) {
+  return { argv, vars: {} };
+}
+var SOURCE = "";
+function srcSlice(node) {
+  return SOURCE.slice(node.from, node.to);
+}
+function stringValue(tokenText) {
+  let s = tokenText;
+  if (s.length >= 2) {
+    const q = s[0];
+    if ((q === '"' || q === "'") && s.endsWith(q)) s = s.slice(1, -1);
+  }
+  s = s.replace(/\\n/g, "\n").replace(/\\t/g, "	").replace(/\\r/g, "\r").replace(/\\\\/g, "\\").replace(/\\"/g, '"').replace(/\\'/g, "'");
+  return s;
+}
+function isSysArgv(node) {
+  if (!node || node.name !== "MemberExpression") return false;
+  const first = node.firstChild;
+  if (!first || first.name !== "VariableName" || srcSlice(first) !== "sys") return false;
+  const prop = node.getChild("PropertyName");
+  return prop !== null && srcSlice(prop) === "argv";
+}
+function evalExpr(node, env) {
+  if (!node) return null;
+  const name = node.name;
+  if (name === "String") return stringValue(srcSlice(node));
+  if (name === "Number") return srcSlice(node);
+  if (name === "VariableName") {
+    const id = srcSlice(node);
+    return id in env.vars ? env.vars[id] : null;
+  }
+  if (name === "MemberExpression") {
+    const bracket = node.getChild("[");
+    if (bracket) {
+      const inner = node.firstChild;
+      if (inner && isSysArgv(inner)) {
+        const idxNode = bracket.nextSibling;
+        if (idxNode && idxNode.name === "Number") {
+          const idx = parseInt(srcSlice(idxNode), 10);
+          if (idx >= 1 && idx <= env.argv.length) return env.argv[idx - 1];
+          return null;
+        }
+      }
+      return null;
+    }
+    if (isSysArgv(node)) return env.argv[0] ?? null;
+    return null;
+  }
+  if (name === "CallExpression") {
+    const func = node.firstChild;
+    if (func && func.name === "VariableName" && srcSlice(func) === "len") {
+      const argList = node.getChild("ArgList");
+      const inner = argList ? firstNamedChild(argList) : null;
+      if (inner && isSysArgv(inner)) return String(env.argv.length + 1);
+    }
+    return null;
+  }
+  if (name === "ConditionalExpression") {
+    const ifKw = node.getChild("if");
+    const elseKw = node.getChild("else");
+    if (!ifKw || !elseKw) return null;
+    const thenNode = node.firstChild;
+    const condNode = ifKw.nextSibling;
+    const orelseNode = elseKw.nextSibling;
+    if (!thenNode || !condNode || !orelseNode) return null;
+    const cond = evalCondition(condNode, env);
+    if (cond === true) return evalExpr(thenNode, env);
+    if (cond === false) return evalExpr(orelseNode, env);
+    return null;
+  }
+  if (name === "BinaryExpression") {
+    const op = findOp(node);
+    if (op === "+") {
+      const left = evalExpr(node.firstChild, env);
+      const right = evalExpr(lastNamedChild(node), env);
+      if (left !== null && right !== null) return left + right;
+    }
+    return null;
+  }
+  return null;
 }
-function newNode(path3, depth) {
-  return {
-    scriptPath: path3,
-    rawContent: "",
-    preprocessedContent: "",
-    lineCount: 0,
-    fileSize: 0,
-    depth,
-    childPaths: [],
-    error: "",
-    l1Hit: false,
-    l1RiskLevel: "",
-    l1RiskType: "",
-    l1Reason: "",
-    l1MatchedPatterns: [],
-    l2Hit: false,
-    l2ViolatedRule: "",
-    l2RiskLevel: "",
-    l2RiskType: "",
-    l2Reason: "",
-    matchedKeywords: [],
-    isSuspicious: false,
-    keywordRiskLevel: "",
-    keywordRiskReason: ""
-  };
+function firstNamedChild(node) {
+  let c = node.firstChild;
+  while (c) {
+    if (c.name !== "(" && c.name !== ")" && c.name !== "," && c.name !== ":") return c;
+    c = c.nextSibling;
+  }
+  return null;
 }
-function stripComments(content) {
-  return content.split("\n").filter((line) => !line.trimStart().startsWith("#")).join("\n");
+function lastNamedChild(node) {
+  let c = node.lastChild;
+  while (c) {
+    if (c.name !== "(" && c.name !== ")" && c.name !== "," && c.name !== ":") return c;
+    c = c.prevSibling;
+  }
+  return null;
 }
-function stripOutputText(content) {
-  let result = content.replace(/echo\s+".*?"/gs, 'echo ""');
-  result = result.replace(/echo\s+'.*?'/gs, "echo ''");
-  result = result.replace(/printf\s+".*?"[^\n]*/gs, 'printf ""');
-  result = result.replace(/printf\s+'.*?'[^\n]*/gs, "printf ''");
-  return result;
+function findOp(node) {
+  let c = node.firstChild;
+  while (c) {
+    if (c.name === "CompareOp" || c.name === "and" || c.name === "or" || c.name === "UpdateOp") {
+      return srcSlice(c).trim();
+    }
+    c = c.nextSibling;
+  }
+  return null;
 }
-function expandSimpleVariables(content) {
-  const varMap = {};
-  const assignmentRe = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.+)$/;
-  const collectAssignments = (text) => {
-    for (const line of text.split("\n")) {
-      const m = line.match(assignmentRe);
-      if (m) {
-        const varName = m[1];
-        let varVal = m[2].trim();
-        if (varVal && !varVal.includes("$") && !varVal.includes("`")) {
-          if (varVal.startsWith('"') && varVal.endsWith('"') || varVal.startsWith("'") && varVal.endsWith("'")) {
-            varVal = varVal.slice(1, -1);
-          }
-          varMap[varName] = varVal;
-        }
+function evalCondition(node, env) {
+  if (!node) return null;
+  const name = node.name;
+  if (name === "Boolean") {
+    const t = srcSlice(node).trim();
+    return t === "True" ? true : t === "False" ? false : null;
+  }
+  if (name === "BinaryExpression") {
+    const op = findOp(node);
+    if (op === "and" || op === "or") {
+      const parts2 = namedChildren(node);
+      const vals = parts2.map((p) => evalCondition(p, env));
+      if (op === "and") {
+        if (vals.some((v) => v === false)) return false;
+        if (vals.every((v) => v === true)) return true;
+        return null;
       }
+      if (vals.some((v) => v === true)) return true;
+      if (vals.every((v) => v === false)) return false;
+      return null;
     }
-  };
-  collectAssignments(content);
-  let expanded = content;
-  for (let round = 0; round < 3; round++) {
-    const sortedVars = Object.keys(varMap).sort((a, b) => b.length - a.length);
-    let newExpanded = expanded;
-    for (const v of sortedVars) {
-      const val = varMap[v];
-      newExpanded = newExpanded.split("${" + v + "}").join(val);
-      newExpanded = newExpanded.split("$" + v).join(val);
-    }
-    if (newExpanded === expanded) break;
-    expanded = newExpanded;
-    collectAssignments(expanded);
-  }
-  return expanded;
-}
-function preprocessScriptContent(content) {
-  let result = stripComments(content);
-  result = stripOutputText(result);
-  result = expandSimpleVariables(result);
-  return result;
+    const parts = namedChildren(node);
+    if (parts.length !== 3) return null;
+    const [left, opNode, right] = parts;
+    const opText = srcSlice(opNode).trim();
+    return evalCompare(left, opText, right, env);
+  }
+  if (name === "UnaryExpression") {
+    const kw = node.getChild("not");
+    if (kw) {
+      const operand = kw.nextSibling;
+      const v = evalCondition(operand, env);
+      return v === null ? null : !v;
+    }
+    return null;
+  }
+  if (name === "CallExpression") {
+    return null;
+  }
+  return null;
 }
-var SUSPICIOUS_PATTERNS2 = [
-  { name: "curl POST", pattern: /curl\s+(.*\s)?-X\s+POST/i },
-  { name: "curl --data", pattern: /curl\s+(.*\s)?--data/i },
-  { name: "curl -d", pattern: /curl\s+(.*\s)?-d\s/i },
-  { name: "wget --post-data", pattern: /wget\s+(.*\s)?--post-data/i },
-  { name: "wget --post-file", pattern: /wget\s+(.*\s)?--post-file/i },
-  { name: "nc -e", pattern: /\bnc\s+.*-e\b/ },
-  { name: "ncat -e", pattern: /\bncat\s+.*-e\b/ },
-  { name: "/dev/tcp", pattern: /\/dev\/tcp\// },
-  { name: "/dev/udp", pattern: /\/dev\/udp\// },
-  { name: "$(base64", pattern: /\$\(\s*base64/ },
-  { name: "`base64", pattern: /`\s*base64/ },
-  { name: "base64 decode pipe", pattern: /base64\s+(-d|--decode)\s*\|/ },
-  { name: "/etc/shadow", pattern: /\/etc\/shadow/ },
-  { name: "id_rsa", pattern: /\bid_rsa\b/ },
-  { name: "id_ed25519", pattern: /\bid_ed25519\b/ },
-  { name: "crontab install", pattern: /crontab\s+-/ },
-  { name: "authorized_keys", pattern: /authorized_keys/ },
-  { name: "ssh no host key check", pattern: /ssh\s+.*StrictHostKeyChecking\s*=\s*no/ }
-];
-var SCRIPT_EXEC_PATTERNS2 = [
-  /(?:^|\s|&&|\|\|)\s*bash\s+(\S+)/i,
-  /(?:^|\s|&&|\|\|)\s*\/bin\/bash\s+(\S+)/i,
-  /(?:^|\s|&&|\|\|)\s*sh\s+(\S+)/i,
-  /(?:^|\s|&&|\|\|)\s*zsh\s+(\S+)/i,
-  /\.\/(\S+)/,
-  /(?:^|\s|&&|\|\|)\s*source\s+(\S+)/i,
-  /(?:^|\s|&&|\|\|)\s*\.\s+(\S+)/,
-  /(?:^|\s|&&|\|\|)\s*python3?\s+(\S+\.py)/i,
-  /(?:^|\s|&&|\|\|)\s*node\s+(\S+\.js)/i,
-  /(?:^|\s|&&|\|\|)\s*ruby\s+(\S+\.rb)/i,
-  /(?:^|\s|&&|\|\|)\s*perl\s+(\S+\.pl)/i,
-  /(?:^|\s|&&|\|\|)\s*php\s+(\S+\.php)/i,
-  /(?:^|\s|&&|\|\|)\s*lua\s+(\S+\.lua)/i
-];
-var KEYWORD_COMBINATION_RISKS2 = [
-  {
-    group1: /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]),
-    group2: /* @__PURE__ */ new Set(["$(base64", "`base64", "base64 decode pipe"]),
-    level: "critical",
-    reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + Base64\u7F16\u7801\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u6570\u636E\u5916\u4F20\u98CE\u9669\u3002\u653B\u51FB\u8005\u53EF\u80FD\u5C06\u654F\u611F\u6570\u636E\u7F16\u7801\u540E\u5916\u4F20\u3002"
-  },
-  {
-    group1: /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]),
-    group2: /* @__PURE__ */ new Set(["/etc/shadow", "id_rsa", "id_ed25519"]),
-    level: "critical",
-    reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + \u654F\u611F\u6587\u4EF6\u8BBF\u95EE\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u51ED\u8BC1\u5916\u4F20\u98CE\u9669\u3002"
-  },
-  {
-    group1: /* @__PURE__ */ new Set(["nc -e", "ncat -e", "/dev/tcp", "/dev/udp"]),
-    group2: /* @__PURE__ */ new Set(),
-    level: "high",
-    reason: "\u68C0\u6D4B\u5230\u53CD\u5F39 Shell \u7279\u5F81\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5EFA\u7ACB\u8FDC\u7A0B\u63A7\u5236\u901A\u9053\u3002"
-  },
-  {
-    group1: /* @__PURE__ */ new Set(["crontab install", "authorized_keys", "ssh no host key check"]),
-    group2: /* @__PURE__ */ new Set(),
-    level: "high",
-    reason: "\u68C0\u6D4B\u5230\u6301\u4E45\u5316\u540E\u95E8\u7279\u5F81\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5728\u7CFB\u7EDF\u4E2D\u690D\u5165\u540E\u95E8\u3002"
-  }
-];
-var SINGLE_KEYWORD_RISKS2 = {
-  "curl POST": { level: "high", reason: "\u68C0\u6D4B\u5230 curl POST \u8BF7\u6C42\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
-  "curl --data": { level: "high", reason: "\u68C0\u6D4B\u5230 curl --data \u53C2\u6570\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
-  "curl -d": { level: "high", reason: "\u68C0\u6D4B\u5230 curl -d \u53C2\u6570\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
-  "wget --post-data": { level: "high", reason: "\u68C0\u6D4B\u5230 wget POST \u8BF7\u6C42\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
-  "wget --post-file": { level: "high", reason: "\u68C0\u6D4B\u5230 wget \u6587\u4EF6\u4E0A\u4F20\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6587\u4EF6\u3002" },
-  "nc -e": { level: "critical", reason: "\u68C0\u6D4B\u5230 nc -e \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
-  "ncat -e": { level: "critical", reason: "\u68C0\u6D4B\u5230 ncat -e \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
-  "/dev/tcp": { level: "critical", reason: "\u68C0\u6D4B\u5230 /dev/tcp \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
-  "/dev/udp": { level: "critical", reason: "\u68C0\u6D4B\u5230 /dev/udp \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
-  "$(base64": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u7F16\u7801\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
-  "`base64": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u7F16\u7801\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
-  "base64 decode pipe": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u89E3\u7801\u540E\u7BA1\u9053\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
-  "/etc/shadow": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6\u3002" },
-  "id_rsa": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE SSH \u79C1\u94A5\u3002" },
-  "id_ed25519": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE SSH \u79C1\u94A5\u3002" },
-  "crontab install": { level: "high", reason: "\u68C0\u6D4B\u5230\u4FEE\u6539\u5B9A\u65F6\u4EFB\u52A1\uFF0C\u53EF\u80FD\u662F\u6301\u4E45\u5316\u540E\u95E8\u3002" },
-  "authorized_keys": { level: "high", reason: "\u68C0\u6D4B\u5230\u4FEE\u6539 SSH \u6388\u6743\u5BC6\u94A5\uFF0C\u53EF\u80FD\u662F\u6301\u4E45\u5316\u540E\u95E8\u3002" },
-  "ssh no host key check": { level: "high", reason: "\u68C0\u6D4B\u5230 SSH \u8DF3\u8FC7\u4E3B\u673A\u5BC6\u94A5\u9A8C\u8BC1\uFF0C\u53EF\u80FD\u662F\u6A2A\u5411\u79FB\u52A8\u3002" }
-};
-var LEVEL_ORDER2 = { low: 1, medium: 2, high: 3, critical: 4 };
-function scanScriptForKeywords2(content) {
-  const matched = [];
-  for (const { name, pattern } of SUSPICIOUS_PATTERNS2) {
-    if (pattern.test(content)) matched.push(name);
+function namedChildren(node) {
+  const out = [];
+  let c = node.firstChild;
+  while (c) {
+    if (c.name !== "(" && c.name !== ")" && c.name !== "," && c.name !== ":" && c.name !== "[" && c.name !== "]") {
+      out.push(c);
+    }
+    c = c.nextSibling;
   }
-  return matched;
+  return out;
 }
-function assessKeywordCombinationRisk2(matchedKeywords, scriptContent) {
-  if (matchedKeywords.length === 0) return { level: "", reason: "" };
-  const keywordSet = new Set(matchedKeywords);
-  for (const rule of KEYWORD_COMBINATION_RISKS2) {
-    const hitGroup1 = [...rule.group1].some((k) => keywordSet.has(k));
-    const hitGroup2 = rule.group2.size === 0 ? true : [...rule.group2].some((k) => keywordSet.has(k));
-    if (hitGroup1 && hitGroup2) return { level: rule.level, reason: rule.reason };
+function evalCompare(left, opText, right, env) {
+  if (opText === "==" && left.name === "VariableName" && srcSlice(left) === "__name__") {
+    const rv = evalExpr(right, env);
+    if (rv !== null) return rv === "__main__";
+    return null;
   }
-  const networkPostKeywords = /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]);
-  const hasNetworkPost = [...networkPostKeywords].some((k) => keywordSet.has(k));
-  if (hasNetworkPost) {
-    const envPatterns = ["$env", "$(env)", "$USER", "$(hostname)", "$(pwd)", "$HOME"];
-    const contentLower = scriptContent.toLowerCase();
-    for (const p of envPatterns) {
-      if (contentLower.includes(p.toLowerCase())) {
-        return {
-          level: "critical",
-          reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + \u7CFB\u7EDF\u73AF\u5883\u53D8\u91CF\u6536\u96C6\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u6570\u636E\u5916\u4F20\u98CE\u9669\u3002\u811A\u672C\u53EF\u80FD\u5C06\u7528\u6237\u73AF\u5883\u53D8\u91CF\uFF08\u53EF\u80FD\u5305\u542B API Key\u3001\u5BC6\u94A5\u7B49\u654F\u611F\u4FE1\u606F\uFF09\u53D1\u9001\u5230\u8FDC\u7A0B\u670D\u52A1\u5668\u3002"
-        };
-      }
+  if (opText === "==" || opText === "!=") {
+    const lv = evalExpr(left, env);
+    const rv = evalExpr(right, env);
+    if (lv !== null && rv !== null) {
+      return opText === "==" ? lv === rv : lv !== rv;
     }
+    return null;
   }
-  let bestLevel = "";
-  let bestReason = "";
-  for (const kw of matchedKeywords) {
-    const risk = SINGLE_KEYWORD_RISKS2[kw];
-    if (risk && (LEVEL_ORDER2[risk.level] || 0) > (LEVEL_ORDER2[bestLevel] || 0)) {
-      bestLevel = risk.level;
-      bestReason = risk.reason;
+  if (opText === "in") {
+    const lv = evalExpr(left, env);
+    if (lv === null) return null;
+    const rightName = right.name;
+    if (rightName === "TupleExpression" || rightName === "ArrayExpression" || rightName === "SetExpression" || rightName === "ParenthesizedExpression") {
+      const container = rightName === "ParenthesizedExpression" && right.firstChild && right.firstChild.name === "TupleExpression" ? right.firstChild : right;
+      for (const elt of namedChildren(container)) {
+        const ev = evalExpr(elt, env);
+        if (ev !== null && ev === lv) return true;
+      }
+      return false;
     }
+    const rv = evalExpr(right, env);
+    if (rv !== null) return rv.includes(lv);
+    return null;
   }
-  return { level: bestLevel, reason: bestReason };
-}
-function extractScriptPath2(command) {
-  for (const pattern of SCRIPT_EXEC_PATTERNS2) {
-    const m = command.match(pattern);
-    if (m) return m[1];
+  if (opText === ">" || opText === ">=" || opText === "<" || opText === "<=") {
+    const lv = evalExpr(left, env);
+    const rv = evalExpr(right, env);
+    if (lv === null || rv === null) return null;
+    const ln = parseInt(lv, 10);
+    const rn = parseInt(rv, 10);
+    if (Number.isNaN(ln) || Number.isNaN(rn)) return null;
+    if (opText === ">") return ln > rn;
+    if (opText === ">=") return ln >= rn;
+    if (opText === "<") return ln < rn;
+    return ln <= rn;
   }
   return null;
 }
-function extractInlineScriptPath(actionDetail) {
-  const re = /open\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
-  let m;
-  while ((m = re.exec(actionDetail)) !== null) {
-    const p = m[1];
-    let resolved;
-    try {
-      resolved = resolvePath(p);
-      if (existsSync7(resolved)) {
-        const stat = statSync(resolved);
-        if (stat.isFile()) return resolved;
-      }
-    } catch {
+function processStmts(stmts, env, lineStarts, lines, branches) {
+  for (const s of stmts) processStmt(s, env, lineStarts, lines, branches);
+}
+function invalidateEnvOnCalls(node, env) {
+  const cursor = node.cursor();
+  cursor.iterate((n) => {
+    const nd = n.node;
+    if (nd.name !== "CallExpression") return true;
+    const func = nd.firstChild;
+    if (func && func.name === "VariableName" && !PURE_BUILTINS.has(srcSlice(func))) {
+      for (const k of Object.keys(env.vars)) env.vars[k] = null;
+      return false;
     }
-  }
-  return null;
+    return true;
+  });
 }
-function resolvePath(p) {
-  let expanded = p;
-  if (expanded.startsWith("~/") || expanded === "~") {
-    expanded = join4(homedir2(), expanded.slice(1));
+function processStmt(stmt, env, lineStarts, lines, branches) {
+  const name = stmt.name;
+  if (name === "AssignStatement") {
+    const target = stmt.firstChild;
+    if (target && target.name === "VariableName") {
+      const valNode = target.nextSibling ? target.nextSibling.nextSibling : null;
+      invalidateEnvOnCalls(stmt, env);
+      const val = evalExpr(valNode, env);
+      env.vars[srcSlice(target)] = val;
+    }
+    markNodeLines(stmt, lines, lineStarts);
+    return;
   }
-  return resolve6(expanded);
-}
-function readScriptContent2(scriptPath, maxFileSize = 2 * 1024 * 1024) {
-  try {
-    const path3 = resolvePath(scriptPath);
-    if (!existsSync7(path3)) return { content: "", lineCount: 0, fileSize: 0, error: `\u811A\u672C\u4E0D\u5B58\u5728: ${scriptPath}` };
-    const stat = statSync(path3);
-    if (!stat.isFile()) return { content: "", lineCount: 0, fileSize: 0, error: `\u4E0D\u662F\u6587\u4EF6: ${scriptPath}` };
-    if (stat.size > maxFileSize) {
-      return { content: "", lineCount: 0, fileSize: stat.size, error: `\u811A\u672C\u6587\u4EF6\u8FC7\u5927 (${stat.size} bytes)\uFF0C\u8DF3\u8FC7\u8BFB\u53D6` };
+  if (name === "UpdateStatement") {
+    const target = stmt.firstChild;
+    if (target && target.name === "VariableName") env.vars[srcSlice(target)] = null;
+    invalidateEnvOnCalls(stmt, env);
+    markNodeLines(stmt, lines, lineStarts);
+    return;
+  }
+  if (name === "IfStatement") {
+    processIf(stmt, env, lineStarts, lines, branches);
+    return;
+  }
+  if (name === "ForStatement" || name === "WhileStatement") {
+    markNodeLines(stmt, lines, lineStarts);
+    for (const body of stmt.getChildren("Body")) {
+      processStmts(bodyStmts(body), { argv: env.argv, vars: { ...env.vars } }, lineStarts, lines, branches);
     }
-    const content = readFileSync8(path3, "utf-8");
-    const lineCount = content ? content.split("\n").length : 0;
-    return { content, lineCount, fileSize: stat.size, error: "" };
-  } catch (e) {
-    const msg = e instanceof Error ? e.message : String(e);
-    return { content: "", lineCount: 0, fileSize: 0, error: `\u8BFB\u53D6\u811A\u672C\u5931\u8D25: ${msg}` };
+    return;
   }
-}
-function extractChildScriptPaths(content, baseDir) {
-  const paths = [];
-  for (const pattern of CHILD_SCRIPT_PATTERNS) {
-    pattern.lastIndex = 0;
-    let m;
-    while ((m = pattern.exec(content)) !== null) {
-      const pathStr = m[1];
-      if (pathStr.startsWith("-") || pathStr.startsWith("$")) continue;
-      if (pathStr.includes("/dev/") || pathStr.startsWith("|") || pathStr.startsWith(";")) continue;
-      const full = isAbsolute(pathStr) ? pathStr : join4(baseDir, pathStr);
-      const resolved = resolvePath(full);
-      if (existsSync7(resolved)) {
-        try {
-          if (statSync(resolved).isFile() && !paths.includes(resolved)) paths.push(resolved);
-        } catch {
-        }
-      }
+  if (name === "TryStatement") {
+    markNodeLines(stmt, lines, lineStarts);
+    for (const body of stmt.getChildren("Body")) {
+      processStmts(bodyStmts(body), { argv: env.argv, vars: { ...env.vars } }, lineStarts, lines, branches);
     }
+    return;
   }
-  return paths;
-}
-function resolveScriptChain(entryPath, input, maxDepth = 3, maxFileSize = 2 * 1024 * 1024, maxTotalSize = 6 * 1024 * 1024) {
-  const visited = /* @__PURE__ */ new Set();
-  const result = emptyChain();
-  result.entryPath = entryPath;
-  const entry = resolvePath(entryPath);
-  const baseDir = existsSync7(entry) ? dirname6(entry) : input.cwd || process.cwd();
-  resolveRecursive({
-    path: entry,
-    depth: 0,
-    maxDepth,
-    maxFileSize,
-    maxTotalSize,
-    visited,
-    result,
-    baseDir,
-    input
-  });
-  result.hasCritical = result.nodes.some((n) => n.l1RiskLevel === "critical" || n.l2RiskLevel === "critical" || n.keywordRiskLevel === "critical");
-  result.hasHigh = result.nodes.some((n) => ["high", "critical"].includes(n.l1RiskLevel) || ["high", "critical"].includes(n.l2RiskLevel) || ["high", "critical"].includes(n.keywordRiskLevel));
-  result.firstHitNode = result.nodes.find((n) => n.l1Hit || n.l2Hit || n.isSuspicious) || null;
-  return result;
-}
-function resolveRecursive(ctx) {
-  const { path: path3, depth, maxDepth, maxFileSize, maxTotalSize, visited, result, baseDir, input } = ctx;
-  if (visited.has(path3)) return;
-  if (depth > maxDepth) {
-    result.maxDepthReached = true;
+  if (name === "WithStatement") {
+    markNodeLines(stmt, lines, lineStarts);
+    const body = stmt.getChild("Body");
+    if (body) processStmts(bodyStmts(body), { argv: env.argv, vars: { ...env.vars } }, lineStarts, lines, branches);
     return;
   }
-  if (result.totalSize >= maxTotalSize) {
-    result.maxSizeReached = true;
+  if (name === "MatchStatement") {
+    markNodeLines(stmt, lines, lineStarts);
+    for (const clause of stmt.getChildren("MatchClause")) {
+      const body = clause.getChild("Body");
+      if (body) processStmts(bodyStmts(body), { argv: env.argv, vars: { ...env.vars } }, lineStarts, lines, branches);
+    }
     return;
   }
-  visited.add(path3);
-  const { content, lineCount, fileSize, error } = readScriptContent2(path3, maxFileSize);
-  if (error) {
-    const node2 = newNode(path3, depth);
-    node2.error = error;
-    node2.fileSize = fileSize;
-    node2.lineCount = lineCount;
-    result.nodes.push(node2);
+  if (name === "FunctionDefinition" || name === "ClassDefinition") {
+    markDefTree(stmt, lines, lineStarts);
     return;
   }
-  result.totalSize += fileSize;
-  result.totalLines += lineCount;
-  const preprocessed = preprocessScriptContent(content);
-  const node = newNode(path3, depth);
-  node.rawContent = content;
-  node.preprocessedContent = preprocessed;
-  node.lineCount = lineCount;
-  node.fileSize = fileSize;
-  result.nodes.push(node);
-  const virtualInput = {
-    ...input,
-    aNext: { actionType: "bash", actionDetail: preprocessed }
-  };
-  const l1 = runHeuristicCheck(virtualInput);
-  if (l1 && !l1.allowed) {
-    node.l1Hit = true;
-    node.l1RiskLevel = l1.riskLevel;
-    node.l1RiskType = l1.riskType;
-    node.l1Reason = l1.reason;
-    node.l1MatchedPatterns = [];
-    if (l1.riskLevel === "critical") {
-      result.hasCritical = true;
-      result.firstHitNode = node;
-      return;
-    }
+  if (name === "ExpressionStatement") {
+    invalidateEnvOnCalls(stmt, env);
   }
-  const childPaths = extractChildScriptPaths(preprocessed, baseDir);
-  node.childPaths = childPaths;
-  for (const childPath of childPaths) {
-    resolveRecursive({
-      path: resolvePath(childPath),
-      depth: depth + 1,
-      maxDepth,
-      maxFileSize,
-      maxTotalSize,
-      visited,
-      result,
-      baseDir: dirname6(resolvePath(childPath)),
-      input
-    });
-    if (result.hasCritical) return;
+  markNodeLines(stmt, lines, lineStarts);
+}
+function markDefTree(stmt, lines, lineStarts) {
+  const cursor = stmt.cursor();
+  cursor.iterate((n) => {
+    markNodeLines(n.node, lines, lineStarts);
+    return true;
+  });
+}
+function bodyStmts(body) {
+  const out = [];
+  let c = body.firstChild;
+  while (c) {
+    if (c.name !== ":" && c.name !== ";") out.push(c);
+    c = c.nextSibling;
   }
+  return out;
 }
-function scanScriptChainWithL1(chain, input) {
-  for (const node of chain.nodes) {
-    if (node.error || !node.preprocessedContent || node.l1Hit) continue;
-    const virtualInput = {
-      ...input,
-      aNext: { actionType: "bash", actionDetail: node.preprocessedContent }
-    };
-    const l1 = runHeuristicCheck(virtualInput);
-    if (l1 && !l1.allowed) {
-      node.l1Hit = true;
-      node.l1RiskLevel = l1.riskLevel;
-      node.l1RiskType = l1.riskType;
-      node.l1Reason = l1.reason;
-      if (l1.riskLevel === "critical") {
-        chain.hasCritical = true;
-        chain.firstHitNode = node;
-        break;
+function processIf(stmt, env, lineStarts, lines, branches) {
+  const sections = [];
+  let c = stmt.firstChild;
+  while (c) {
+    if (c.name === "if" || c.name === "elif") {
+      sections.push({ cond: c.nextSibling ?? null, body: null, isElse: false });
+    } else if (c.name === "else") {
+      sections.push({ cond: null, body: null, isElse: true });
+    } else if (c.name === "Body") {
+      if (sections.length > 0 && sections[sections.length - 1].body === null) {
+        sections[sections.length - 1].body = c;
       }
     }
+    c = c.nextSibling;
   }
-  return chain;
+  processIfSections(stmt, sections, 0, env, lineStarts, lines, branches);
 }
-function scanScriptChainWithL2(chain, input) {
-  for (const node of chain.nodes) {
-    if (node.error || !node.preprocessedContent) continue;
-    if (node.l1RiskLevel === "critical") break;
-    const virtualInput = {
-      ...input,
-      aNext: { actionType: "bash", actionDetail: node.preprocessedContent }
-    };
-    const l2 = runLogicCheck(virtualInput);
-    if (l2 && !l2.allowed) {
-      node.l2Hit = true;
-      node.l2ViolatedRule = `script_logic:${node.scriptPath}`;
-      node.l2RiskLevel = l2.riskLevel;
-      node.l2RiskType = l2.riskType;
-      node.l2Reason = `\u811A\u672C ${node.scriptPath} (\u6DF1\u5EA6 ${node.depth}) \u4E2D: ${l2.reason}`;
-      if (l2.riskLevel === "critical") {
-        chain.hasCritical = true;
-        chain.firstHitNode = node;
-        break;
-      }
-    }
+function processIfSections(_stmt, sections, idx, env, lineStarts, lines, branches) {
+  if (idx >= sections.length) return;
+  const s = sections[idx];
+  if (s.cond) markNodeLines(s.cond, lines, lineStarts);
+  if (s.isElse) {
+    if (s.body) processStmts(bodyStmts(s.body), env, lineStarts, lines, branches);
+    return;
   }
-  if (!chain.hasHigh) {
-    chain.hasHigh = chain.nodes.some((n) => ["high", "critical"].includes(n.l2RiskLevel));
+  const cond = s.cond ? evalCondition(s.cond, env) : null;
+  branches.push({
+    kind: "if",
+    label: s.cond ? srcSlice(s.cond) : "",
+    body: "",
+    reachable: cond !== false
+  });
+  if (cond === true) {
+    if (s.body) processStmts(bodyStmts(s.body), env, lineStarts, lines, branches);
+    return;
   }
-  return chain;
-}
-function scanScriptChainKeywords(chain) {
-  for (const node of chain.nodes) {
-    if (node.error || !node.preprocessedContent) continue;
-    if (node.l1Hit || node.l2Hit) continue;
-    const matched = scanScriptForKeywords2(node.preprocessedContent);
-    node.matchedKeywords = matched;
-    node.isSuspicious = matched.length > 0;
-    if (matched.length > 0) {
-      const risk = assessKeywordCombinationRisk2(matched, node.preprocessedContent);
-      node.keywordRiskLevel = risk.level;
-      node.keywordRiskReason = risk.reason;
-    }
+  if (cond === false) {
+    processIfSections(_stmt, sections, idx + 1, env, lineStarts, lines, branches);
+    return;
   }
-  return chain;
-}
-function analyzeScriptContent2(input) {
-  const actionType = input.aNext.actionType.toLowerCase();
-  if (actionType !== "bash") return emptyChain();
-  const scriptPath = extractScriptPath2(input.aNext.actionDetail);
-  let resolvedPath = scriptPath;
-  if (!resolvedPath) {
-    const inline = extractInlineScriptPath(input.aNext.actionDetail);
-    if (!inline) return emptyChain();
-    resolvedPath = inline;
+  if (s.body) processStmts(bodyStmts(s.body), env, lineStarts, lines, branches);
+  for (let j = idx + 1; j < sections.length; j++) {
+    const sj = sections[j];
+    if (sj.cond) markNodeLines(sj.cond, lines, lineStarts);
+    if (sj.body) processStmts(bodyStmts(sj.body), env, lineStarts, lines, branches);
   }
-  const chain = resolveScriptChain(resolvedPath, input);
-  if (chain.nodes.length === 0) return chain;
-  scanScriptChainWithL1(chain, input);
-  scanScriptChainWithL2(chain, input);
-  scanScriptChainKeywords(chain);
-  return chain;
 }
-function formatScriptChainForPrompt(chain) {
-  if (chain.nodes.length === 0) return "";
-  const errorNodes = chain.nodes.filter((n) => n.error);
-  if (errorNodes.length > 0 && chain.nodes.length === 1) {
-    return `\u26A0\uFE0F \u811A\u672C\u5185\u5BB9\u5206\u6790\u5931\u8D25: ${errorNodes[0].error}`;
-  }
-  const suspiciousNodes = chain.nodes.filter((n) => n.isSuspicious && !n.l1Hit && !n.l2Hit);
-  if (suspiciousNodes.length === 0) {
-    const safeNodes = chain.nodes.filter((n) => !n.error);
-    if (safeNodes.length === 0) return "";
-    const parts2 = ["\u2713 \u811A\u672C\u5185\u5BB9\u5DF2\u5206\u6790\uFF0C\u672A\u53D1\u73B0\u5371\u9669/\u53EF\u7591\u64CD\u4F5C\uFF08L1/L2/\u5173\u952E\u8BCD\u626B\u63CF\u5747\u672A\u547D\u4E2D\uFF09\uFF1A"];
-    for (const node of safeNodes) {
-      const pre = node.preprocessedContent || "";
-      let preview = pre.slice(0, 600);
-      if (pre.length > 600) preview += `
-... (\u622A\u65AD\uFF0C\u5B8C\u6574\u5185\u5BB9 ${pre.length} \u5B57\u7B26)`;
-      parts2.push(
-        `   \u811A\u672C\u8DEF\u5F84: ${node.scriptPath}\uFF08\u9012\u5F52\u6DF1\u5EA6 ${node.depth}\uFF0C${node.lineCount} \u884C\uFF09
-   \u5185\u5BB9\uFF08\u9884\u5904\u7406\u540E\uFF09:
-\`\`\`
-${preview}
-\`\`\``
-      );
+function parseShellString(s) {
+  CHILD_CALL_RE.lastIndex = 0;
+  let m;
+  while ((m = CHILD_CALL_RE.exec(s)) !== null) {
+    const interp = m[1];
+    const path5 = m[2].trim();
+    let rest = m[3].trim();
+    if (path5.startsWith("-") || path5.startsWith("$") || path5.includes("/dev/")) continue;
+    rest = rest.split(/[;|&<>]/)[0].trim();
+    const args = [];
+    for (const tm of rest.matchAll(/(["'])(.*?)\1|(\S+)/g)) {
+      args.push(tm[1] ? tm[2] : tm[3]);
     }
-    return parts2.join("\n");
+    return { path: path5, args, interpreter: interp };
   }
-  const parts = [];
-  for (const node of suspiciousNodes) {
-    const keywordsStr = node.matchedKeywords.join(", ");
-    let riskHint = "";
-    if (node.keywordRiskLevel && node.keywordRiskReason) {
-      riskHint = `
-
-\u{1F534} **\u98CE\u9669\u8BC4\u4F30**: ${node.keywordRiskLevel.toUpperCase()} \u7EA7\u522B
-**\u98CE\u9669\u539F\u56E0**: ${node.keywordRiskReason}
-**\u5EFA\u8BAE**: \u6B64\u811A\u672C\u5E94\u88AB\u62D2\u7EDD\uFF08Deny\uFF09\uFF0C\u9664\u975E\u6709\u660E\u786E\u7684\u4E1A\u52A1\u9700\u6C42\u4E14\u5DF2\u786E\u8BA4\u76EE\u6807\u670D\u52A1\u5668\u53EF\u4FE1\u3002`;
+  return null;
+}
+function extractCallsFromTree(tree, reachableLines) {
+  const calls = [];
+  const seen = /* @__PURE__ */ new Set();
+  const add = (c) => {
+    const key = `${c.path}\0${c.args.join("\0")}\0${c.interpreter}`;
+    if (!seen.has(key)) {
+      seen.add(key);
+      calls.push(c);
     }
-    const pre = node.preprocessedContent;
-    let contentPreview = pre.slice(0, 2e3);
-    if (pre.length > 2e3) contentPreview += `
-... (\u622A\u65AD\uFF0C\u5B8C\u6574\u5185\u5BB9 ${pre.length} \u5B57\u7B26)`;
-    parts.push(
-      `\u26A0\uFE0F \u811A\u672C\u5185\u5BB9\u5305\u542B\u53EF\u7591\u5173\u952E\u8BCD:
-   \u811A\u672C\u8DEF\u5F84: ${node.scriptPath}
-   \u9012\u5F52\u6DF1\u5EA6: ${node.depth}
-   \u53EF\u7591\u5173\u952E\u8BCD: ${keywordsStr}
-   \u811A\u672C\u884C\u6570: ${node.lineCount}${riskHint}
+  };
+  const lineReachable = (node) => {
+    if (reachableLines === null) return true;
+    return reachableLines.has(lineAt(buildLineStarts(SOURCE), node.from));
+  };
+  const cursor = tree.cursor();
+  cursor.iterate((n) => {
+    const node = n.node;
+    if (node.name !== "CallExpression") return true;
+    if (!lineReachable(node)) return true;
+    const func = node.firstChild;
+    if (!func || func.name !== "MemberExpression") return true;
+    const modName = func.firstChild;
+    if (!modName || modName.name !== "VariableName") return true;
+    const funcNameNode = func.getChild("PropertyName");
+    if (!funcNameNode) return true;
+    const mod = srcSlice(modName);
+    const funcName = srcSlice(funcNameNode);
+    const argList = node.getChild("ArgList");
+    const firstArg = argList ? firstNamedChild(argList) : null;
+    if (mod === "subprocess" && SUBPROCESS_FUNCS.has(funcName)) {
+      if (firstArg && (firstArg.name === "ArrayExpression" || firstArg.name === "TupleExpression")) {
+        const elts = [];
+        let allStr = true;
+        for (const elt of namedChildren(firstArg)) {
+          if (elt.name === "String") elts.push(stringValue(srcSlice(elt)));
+          else {
+            allStr = false;
+            break;
+          }
+        }
+        if (allStr && elts.length >= 2) {
+          const interp = elts[0];
+          const path5 = elts[1];
+          if (!path5.startsWith("-") && !path5.startsWith("$") && !path5.includes("/dev/")) {
+            add({ path: path5, args: elts.slice(2), interpreter: interp });
+            return true;
+          }
+        }
+      }
+      if (firstArg && firstArg.name === "String") {
+        const sc = parseShellString(stringValue(srcSlice(firstArg)));
+        if (sc) add(sc);
+      }
+    } else if (mod === "os" && OS_FUNCS.has(funcName)) {
+      if (firstArg && firstArg.name === "String") {
+        const sc = parseShellString(stringValue(srcSlice(firstArg)));
+        if (sc) add(sc);
+      }
+    }
+    return true;
+  });
+  const cursor2 = tree.cursor();
+  cursor2.iterate((n) => {
+    const node = n.node;
+    if (node.name !== "ImportStatement") return true;
+    const txt = srcSlice(node);
+    if (!/^from\s+\./m.test(txt)) return true;
+    const m = txt.match(/\bimport\s+(.+)$/m);
+    if (m) {
+      for (const part of m[1].split(",")) {
+        const name = part.trim().replace(/\s+as\s+\w+$/, "");
+        if (name && name !== "*") add({ path: name.replace(/\./g, "/") + ".py", args: [], interpreter: "python3" });
+      }
+    }
+    return true;
+  });
+  return calls;
+}
+function extractCallsRegex(content) {
+  const calls = [];
+  CHILD_CALL_RE.lastIndex = 0;
+  let m;
+  while ((m = CHILD_CALL_RE.exec(content)) !== null) {
+    const interp = m[1];
+    const path5 = m[2].trim();
+    let rest = m[3].trim();
+    if (path5.startsWith("-") || path5.startsWith("$") || path5.includes("/dev/")) continue;
+    rest = rest.split(/[;|&<>]/)[0].trim();
+    const args = [];
+    for (const tm of rest.matchAll(/(["'])(.*?)\1|(\S+)/g)) {
+      args.push(tm[1] ? tm[2] : tm[3]);
+    }
+    calls.push({ path: path5, args, interpreter: interp });
+  }
+  return calls;
+}
+var PythonBackend = class {
+  language = "python";
+  parse(content, entryArgs) {
+    const c = content || "";
+    SOURCE = c;
+    const sourceLines = c.split("\n");
+    const lineStarts = buildLineStarts(c);
+    const env = makeEnv(entryArgs || []);
+    const lines = /* @__PURE__ */ new Set();
+    const branches = [];
+    if (sourceLines.length > MAX_LINES) {
+      return {
+        reachableContent: c,
+        controlFlowResolved: false,
+        calls: extractCallsRegex(c),
+        branches: [],
+        unresolvedSnippets: [],
+        language: this.language
+      };
+    }
+    let tree;
+    try {
+      tree = parser.parse(c).topNode;
+    } catch {
+      return {
+        reachableContent: c,
+        controlFlowResolved: false,
+        calls: extractCallsRegex(c),
+        branches: [],
+        unresolvedSnippets: [],
+        language: this.language
+      };
+    }
+    const stmts = bodyStmts(tree);
+    processStmts(stmts, env, lineStarts, lines, branches);
+    const reachable = reconstruct(sourceLines, lines);
+    let calls = extractCallsFromTree(tree, lines);
+    if (calls.length === 0) calls = extractCallsRegex(c);
+    const srcNonblank = sourceLines.filter((l) => l.trim().length > 0);
+    const rcNonblank = reachable.split("\n").filter((l) => l.trim().length > 0);
+    const resolved = rcNonblank.length !== srcNonblank.length || rcNonblank.some((l, i) => l !== srcNonblank[i]);
+    return {
+      reachableContent: reachable,
+      controlFlowResolved: resolved,
+      calls,
+      branches,
+      unresolvedSnippets: [],
+      language: this.language
+    };
+  }
+};
 
-### \u811A\u672C\u5185\u5BB9\uFF08\u9884\u5904\u7406\u540E\uFF09###
-\`\`\`
-${contentPreview}
-\`\`\`
-`
-    );
+// src/engine/script-engine/backends/index.ts
+init_esm_shims();
+
+// src/engine/script-engine/backends/shell-backend.ts
+init_esm_shims();
+
+// src/engine/script-engine/symbolic.ts
+init_esm_shims();
+function reescape(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var RE_DOTALL = "s";
+var MAX_LINES2 = 500;
+var MAX_BRANCHES = 50;
+var MAX_VARS = 200;
+function svalConc(v) {
+  return { kind: "concrete", value: v, children: [], op: "" };
+}
+function svalSym(name) {
+  return { kind: "symbol", value: name, children: [], op: "" };
+}
+function svalExpr(children) {
+  return { kind: "expr", value: null, children, op: "+" };
+}
+function fold(val) {
+  if (val.kind !== "expr") return val;
+  const parts = [];
+  for (const c of val.children) {
+    const cc = fold(c);
+    if (cc.kind === "concrete") {
+      parts.push(cc.value || "");
+    } else {
+      return cc;
+    }
   }
-  let header = `\u26A0\uFE0F \u68C0\u6D4B\u5230\u811A\u672C\u6267\u884C\u94FE\uFF08\u5171 ${chain.nodes.length} \u4E2A\u811A\u672C\uFF09\uFF0C\u5176\u4E2D ${suspiciousNodes.length} \u4E2A\u5305\u542B\u53EF\u7591\u5173\u952E\u8BCD:
-`;
-  if (chain.maxDepthReached) header += "\u26A0\uFE0F \u6CE8\u610F\uFF1A\u9012\u5F52\u8FFD\u8E2A\u89E6\u8FBE\u6DF1\u5EA6\u4E0A\u9650\uFF0C\u53EF\u80FD\u5B58\u5728\u66F4\u6DF1\u5C42\u7684\u811A\u672C\u8C03\u7528\u672A\u88AB\u626B\u63CF\u3002\n";
-  if (chain.maxSizeReached) header += "\u26A0\uFE0F \u6CE8\u610F\uFF1A\u7D2F\u8BA1\u6587\u4EF6\u5927\u5C0F\u89E6\u8FBE\u4E0A\u9650\uFF0C\u90E8\u5206\u811A\u672C\u53EF\u80FD\u672A\u88AB\u5B8C\u6574\u8BFB\u53D6\u3002\n";
-  return header + parts.join("\n---\n\n");
+  return svalConc(parts.join(""));
+}
+var ASGN_RE = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/;
+var CASE_START_RE = /^\s*case\s+/;
+var IF_START_RE = /^\s*if\s+/;
+var NOT_MODELED_RE = /\$\(|`[^`]*`/;
+var CASE_OPEN_RE = /\bcase\b/;
+var CASE_CLOSE_RE = /\besac\b/;
+var IF_OPEN_RE = /\bif\b/;
+var IF_CLOSE_RE = /\bfi\b/;
+function countMatches(re, s) {
+  const m = s.match(re);
+  return m ? m.length : 0;
+}
+function findBlockEnd(lines, startLine, openRe, closeRe) {
+  let depth = 0;
+  for (let idx = startLine; idx < lines.length; idx++) {
+    depth += countMatches(openRe, lines[idx]) - countMatches(closeRe, lines[idx]);
+    if (depth <= 0 && idx > startLine) return idx;
+  }
+  return -1;
+}
+function findCaseEnd(lines, start) {
+  return findBlockEnd(lines, start, CASE_OPEN_RE, CASE_CLOSE_RE);
+}
+function findIfEnd(lines, start) {
+  return findBlockEnd(lines, start, IF_OPEN_RE, IF_CLOSE_RE);
+}
+var LOOP_DO_RE = /\bdo\b/g;
+var LOOP_DONE_RE = /\bdone\b/g;
+function findLoopEnd(lines, start) {
+  let depth = 0;
+  for (let idx = start; idx < lines.length; idx++) {
+    depth += countMatches(LOOP_DO_RE, lines[idx]) - countMatches(LOOP_DONE_RE, lines[idx]);
+    if (depth <= 0 && idx > start) return idx;
+  }
+  return -1;
+}
+var FN_DEF_RE = /^\s*(?:function\s+)?[A-Za-z_][A-Za-z0-9_]*\s*\(\s*\)\s*\{/;
+var FN_DEF_KW_RE = /^\s*function\s+[A-Za-z_][A-Za-z0-9_]*\s*\{?/;
+function findFnEnd(lines, start) {
+  let depth = 0;
+  for (let idx = start; idx < lines.length; idx++) {
+    depth += (lines[idx].match(/\{/g) || []).length - (lines[idx].match(/\}/g) || []).length;
+    if (depth <= 0 && idx > start) return idx;
+  }
+  return -1;
+}
+function stripComments(content) {
+  return content.split("\n").filter((l) => !l.trimStart().startsWith("#")).join("\n");
+}
+function parseCaseStmt(block) {
+  const header = block.match(/\s*case\s+(\S[^;]*?)\s*\bin\b[\s\S]*/);
+  if (!header) return null;
+  const sel = header[1].trim();
+  const lines = block.split("\n");
+  let headerLine = 0;
+  for (let i = 0; i < lines.length; i++) {
+    if (/\bin\b/.test(lines[i]) && /\bcase\b/.test(lines[i])) {
+      headerLine = i;
+      break;
+    }
+  }
+  const bodyStartLine = headerLine + 1;
+  const endLine = findCaseEnd(lines, 0);
+  if (endLine === -1) return null;
+  const branches = splitCaseBranchesDepthAware(lines.slice(bodyStartLine, endLine));
+  if (!branches.length) return null;
+  return { kind: "case", line: block, modelable: true, selector: sel, branches };
+}
+function splitCaseBranchesDepthAware(bodyLines) {
+  let depth = 0;
+  let curPat = null;
+  let curBody = [];
+  const branches = [];
+  const flush = () => {
+    if (curPat !== null) {
+      branches.push({ pat: curPat, body: curBody.join("\n") });
+    }
+    curPat = null;
+    curBody = [];
+  };
+  for (const ln of bodyLines) {
+    const stripped = ln.trim();
+    if (depth === 0) {
+      const bm = stripped.match(/^([^()]+?)\s*\)\s*(.*)$/);
+      if (bm) {
+        if (curPat !== null) flush();
+        curPat = bm[1].trim().replace(/^["']|["']$/g, "");
+        curBody = bm[2].trim() ? [bm[2].trim()] : [];
+        continue;
+      }
+    }
+    if (/\bcase\b/.test(stripped)) depth += 1;
+    else if (/\besac\b/.test(stripped)) depth = Math.max(0, depth - 1);
+    else if (curPat !== null) {
+      curBody.push(ln);
+      if (depth === 0 && stripped.endsWith(";;")) flush();
+    }
+  }
+  if (curPat !== null && curBody.length) flush();
+  return branches;
+}
+function parseIfStmt(block) {
+  const m = block.match(/\s*if\s+([^\n;]+?)\s*;\s*then/);
+  if (!m) return null;
+  const cond = m[1].trim();
+  const lines = block.split("\n");
+  const fiLine = findIfEnd(lines, 0);
+  if (fiLine === -1) return null;
+  const body = lines.slice(1, fiLine).join("\n");
+  const elseM = /\belse\b/.exec(body);
+  let thenBody;
+  let elseBody;
+  if (elseM) {
+    thenBody = body.slice(0, elseM.index);
+    elseBody = body.slice(elseM.index + 4);
+  } else {
+    thenBody = body;
+    elseBody = null;
+  }
+  return { kind: "if", line: block, modelable: true, cond, thenBody, elseBody };
+}
+function tokenize(content) {
+  const lines = stripComments(content).split("\n");
+  const stmts = [];
+  let i = 0;
+  while (i < lines.length) {
+    const ln = lines[i];
+    const stripped = ln.trim();
+    if (!stripped) {
+      i++;
+      continue;
+    }
+    if (/\b(?:while|for|until)\b/.test(stripped) && !CASE_START_RE.test(stripped) && !IF_START_RE.test(stripped)) {
+      const endLine = findLoopEnd(lines, i);
+      if (endLine !== -1) {
+        for (let k = i; k <= endLine; k++) stmts.push({ kind: "plain", line: lines[k], modelable: false });
+        i = endLine + 1;
+        continue;
+      }
+      stmts.push({ kind: "plain", line: ln, modelable: false });
+      i++;
+      continue;
+    }
+    if (FN_DEF_RE.test(stripped) || FN_DEF_KW_RE.test(stripped)) {
+      const endLine = findFnEnd(lines, i);
+      if (endLine !== -1) {
+        for (let k = i; k <= endLine; k++) stmts.push({ kind: "plain", line: lines[k], modelable: false });
+        i = endLine + 1;
+        continue;
+      }
+      stmts.push({ kind: "plain", line: ln, modelable: false });
+      i++;
+      continue;
+    }
+    if (CASE_START_RE.test(stripped)) {
+      const endLine = findCaseEnd(lines, i);
+      if (endLine === -1) {
+        stmts.push({ kind: "plain", line: ln, modelable: false });
+        i++;
+        continue;
+      }
+      const parsed = parseCaseStmt(lines.slice(i, endLine + 1).join("\n"));
+      stmts.push(parsed || { kind: "plain", line: ln, modelable: false });
+      i = endLine + 1;
+      continue;
+    }
+    if (IF_START_RE.test(stripped)) {
+      const endLine = findIfEnd(lines, i);
+      if (endLine === -1) {
+        stmts.push({ kind: "plain", line: ln, modelable: false });
+        i++;
+        continue;
+      }
+      const parsed = parseIfStmt(lines.slice(i, endLine + 1).join("\n"));
+      stmts.push(parsed || { kind: "plain", line: ln, modelable: false });
+      i = endLine + 1;
+      continue;
+    }
+    if (/\bshift\b|\bset\s+--(?:\s|$)|[\s;|&]read\b|^\s*read\b/.test(stripped)) {
+      stmts.push({ kind: "plain", line: ln, modelable: false });
+      i++;
+      continue;
+    }
+    const am = stripped.match(ASGN_RE);
+    if (am && !NOT_MODELED_RE.test(stripped)) {
+      stmts.push({ kind: "assign", line: stripped, modelable: true, name: am[1], rhs: am[2].trim() });
+      i++;
+      continue;
+    }
+    stmts.push(NOT_MODELED_RE.test(stripped) ? { kind: "plain", line: ln, modelable: false } : { kind: "plain", line: ln, modelable: true });
+    i++;
+  }
+  return stmts;
+}
+var EXPR_SPLIT_RE = /(\$\{?\d+\}?|\$\{?[A-Za-z_][A-Za-z0-9_]*\}?)/;
+function evalExpr2(text, env) {
+  const isSingleQuoted = text.length >= 2 && text[0] === "'" && text[text.length - 1] === "'";
+  if (text.length >= 2 && (text[0] === '"' || text[0] === "'") && text[text.length - 1] === text[0]) {
+    text = text.slice(1, -1);
+  }
+  if (isSingleQuoted) return svalConc(text);
+  const parts = text.split(EXPR_SPLIT_RE);
+  const result = [];
+  for (const p of parts) {
+    if (!p) continue;
+    const brace = p.match(/^\$\{([^}]+)\}$/);
+    if (brace) {
+      const inner = brace[1];
+      if (/^\d+$/.test(inner)) {
+        const v = env.get(`$${inner}`);
+        result.push(v || svalSym(`$${inner}`));
+      } else {
+        const v = env.get(inner);
+        result.push(v || svalSym(inner));
+      }
+      continue;
+    }
+    const bare = p.match(/^\$([A-Za-z_][A-Za-z0-9_]*|\d+)$/);
+    if (bare) {
+      const varName = bare[1];
+      const key = /^\d+$/.test(varName) ? `$${varName}` : varName;
+      const v = env.get(key);
+      result.push(v || svalSym(p));
+      continue;
+    }
+    result.push(svalConc(p));
+  }
+  if (result.length === 1) return fold(result[0]);
+  return fold(svalExpr(result));
+}
+function initEnv(entryArgs) {
+  const env = /* @__PURE__ */ new Map();
+  if (entryArgs && entryArgs.length) {
+    entryArgs.forEach((a, idx) => env.set(`$${idx + 1}`, svalConc(a)));
+    env.set("$@", svalConc(entryArgs.join(" ")));
+    env.set("$*", svalConc(entryArgs.join(" ")));
+  }
+  return env;
+}
+var HAS_GLOB = /[*?[]/;
+function globToRegex(pattern) {
+  let out = "^";
+  let i = 0;
+  while (i < pattern.length) {
+    const c = pattern[i];
+    if (c === "*") out += ".*";
+    else if (c === "?") out += ".";
+    else if (c === "[") {
+      let j = i + 1;
+      let neg = false;
+      if (j < pattern.length && (pattern[j] === "!" || pattern[j] === "^")) {
+        neg = true;
+        j++;
+      }
+      let cls = "";
+      while (j < pattern.length && pattern[j] !== "]") {
+        cls += pattern[j];
+        j++;
+      }
+      if (j >= pattern.length) {
+        out += reescape(pattern.slice(i));
+        break;
+      }
+      out += "[" + (neg ? "^" : "") + reescape(cls) + "]";
+      i = j;
+    } else {
+      out += reescape(c);
+    }
+    i++;
+  }
+  out += "$";
+  return new RegExp(out, RE_DOTALL);
+}
+function matchGlob(pattern, value) {
+  if (!HAS_GLOB.test(pattern)) return pattern === value;
+  return globToRegex(pattern).test(value);
+}
+function evalNumericCompare(op, left, right) {
+  const li = parseInt(left, 10);
+  const ri = parseInt(right, 10);
+  if (isNaN(li) || isNaN(ri)) return null;
+  switch (op) {
+    case "-gt":
+      return li > ri;
+    case "-lt":
+      return li < ri;
+    case "-eq":
+      return li === ri;
+    case "-ge":
+      return li >= ri;
+    case "-le":
+      return li <= ri;
+    default:
+      return null;
+  }
+}
+function resolveVarSide(tok, env) {
+  if (!tok.startsWith("$")) return tok;
+  const ev = evalExpr2(tok, env);
+  return ev.kind === "concrete" ? ev.value : null;
+}
+function evalCondition2(cond, env) {
+  let inner = cond.trim().replace(/^\[\[?|\]\]?$/g, "").trim();
+  if (/^-[A-Za-z]\s/.test(inner) || inner.startsWith("-d") || inner.startsWith("-f")) return null;
+  const innerQ = inner.replace(/"/g, "").replace(/'/g, "");
+  for (const op2 of ["-gt", "-lt", "-eq", "-ge", "-le"]) {
+    const re = new RegExp(`\\s${op2}\\s`);
+    const opm = re.exec(innerQ);
+    if (!opm) continue;
+    const left2 = innerQ.slice(0, opm.index).trim();
+    const right2 = innerQ.slice(opm.index + opm[0].length).trim();
+    const lv2 = resolveVarSide(left2, env);
+    const rv2 = resolveVarSide(right2, env);
+    if (lv2 === null || rv2 === null) return null;
+    return evalNumericCompare(op2, lv2, rv2);
+  }
+  const sm = innerQ.match(/(.*?)\s*(==|=|!=|=~)\s*(.*)/);
+  if (!sm) return null;
+  const op = sm[2];
+  let left = sm[1].trim();
+  let right = sm[3].trim();
+  if (op === "=~") {
+    if (right.startsWith("/") && right.endsWith("/")) right = right.slice(1, -1);
+    const lv2 = resolveVarSide(left, env);
+    if (lv2 === null) return null;
+    try {
+      return new RegExp(right).test(lv2);
+    } catch {
+      return null;
+    }
+  }
+  const lv = resolveVarSide(left, env);
+  const rv = resolveVarSide(right, env);
+  if (lv === null || rv === null) return null;
+  if (op === "!=") return lv !== rv;
+  return lv === rv;
+}
+function symbolicProcess(content, entryArgs) {
+  if (!content) return null;
+  const stmts = tokenize(content);
+  if (!stmts.some((s) => s.kind === "case" || s.kind === "if" || s.kind === "assign")) return null;
+  if (stmts.some((s) => !s.modelable)) return null;
+  const env = initEnv(entryArgs);
+  let linesBudget = 0;
+  let branchesBudget = 0;
+  let modelable = false;
+  const out = [];
+  for (const s of stmts) {
+    linesBudget++;
+    if (linesBudget > MAX_LINES2) return null;
+    if (s.kind === "assign") {
+      modelable = true;
+      if (env.size >= MAX_VARS) return null;
+      const v = evalExpr2(s.rhs, env);
+      env.set(s.name, fold(v));
+      out.push(s.line);
+      continue;
+    }
+    if (s.kind === "case") {
+      modelable = true;
+      branchesBudget += s.branches.length;
+      if (branchesBudget > MAX_BRANCHES) return null;
+      const selVal = fold(evalExpr2(s.selector, env));
+      if (selVal.kind !== "concrete") return null;
+      const concrete = selVal.value || "";
+      let selected = null;
+      let fallback = "";
+      for (const b of s.branches) {
+        const patStripped = b.pat.trim();
+        if (patStripped === "*") {
+          fallback = b.body;
+          continue;
+        }
+        if (matchGlob(patStripped, concrete)) {
+          selected = b.body;
+          break;
+        }
+      }
+      const final = selected !== null ? selected : fallback || null;
+      if (final === null) return null;
+      out.push(`case ${s.selector} in
+${final}
+esac`);
+      continue;
+    }
+    if (s.kind === "if") {
+      modelable = true;
+      branchesBudget++;
+      if (branchesBudget > MAX_BRANCHES) return null;
+      const truth = evalCondition2(s.cond, env);
+      if (truth === null) return null;
+      const chosen = truth ? s.thenBody : s.elseBody;
+      if (chosen === null) return null;
+      out.push(`if ${s.cond}; then
+${chosen}
+fi`);
+      continue;
+    }
+    out.push(s.line);
+  }
+  if (!modelable) return null;
+  return out.join("\n");
 }
-var CHILD_SCRIPT_PATTERNS = [
-  /(?:^|\s|&&|\|\|)\s*bash\s+(\S+)/i,
-  /(?:^|\s|&&|\|\|)\s*sh\s+(\S+)/i,
-  /(?:^|\s|&&|\|\|)\s*source\s+(\S+)/i,
-  /(?:^|\s|&&|\|\|)\s*\.\s+(\S+)/,
-  /(?:^|\s|&&|\|\|)\s*python3?\s+(\S+\.py)/i,
-  /(?:^|\s|&&|\|\|)\s*node\s+(\S+\.js)/i,
-  /(?:^|\s|&&|\|\|)\s*ruby\s+(\S+\.rb)/i,
-  /(?:^|\s|&&|\|\|)\s*perl\s+(\S+\.pl)/i,
-  /(?:^|\s|&&|\|\|)\s*php\s+(\S+\.php)/i,
-  /(?:^|\s|&&|\|\|)\s*lua\s+(\S+\.lua)/i
-];
 
-// src/engine/llm-analyzer.ts
-import { appendFileSync } from "fs";
-import OpenAI from "openai";
-var llmCache = /* @__PURE__ */ new Map();
-var LLM_CACHE_MAX = 200;
-async function runLLMAnalysis(input, previous) {
-  if (!isLLMAvailable()) {
-    console.log("[AgentMoss] LLM not configured, skipping deep analysis");
-    return {
-      allowed: true,
-      reason: "LLM \u672A\u914D\u7F6E\uFF0C\u8DF3\u8FC7\u6DF1\u5C42\u5206\u6790",
-      riskLevel: "low",
-      riskType: "",
-      confidence: 50,
-      source: "llm",
-      violatedLayers: []
-    };
+// src/engine/script-engine/backends/shell-backend.ts
+function bindPositionalArgs(content, args) {
+  if (!args.length) return content;
+  const allArgs = args.join(" ");
+  content = content.replace(/\$\{(\d+|@|\*)(?::?[-]?([^}]*))?\}/g, (full, kind, defv) => {
+    if (kind === "@" || kind === "*") return allArgs;
+    if (!/^\d+$/.test(kind)) return full;
+    const idx = parseInt(kind, 10);
+    if (1 <= idx && idx <= args.length) return args[idx - 1];
+    return defv !== void 0 ? defv : "";
+  });
+  content = content.replace(/\$\{(\d+)\}/g, (full, kind) => {
+    const idx = parseInt(kind, 10);
+    if (1 <= idx && idx <= args.length) return args[idx - 1];
+    return "";
+  });
+  content = content.replace(/\$(\d+)/g, (full, kind) => {
+    const idx = parseInt(kind, 10);
+    if (1 <= idx && idx <= args.length) return args[idx - 1];
+    return "";
+  });
+  content = content.replace(/\$[@*]/g, allArgs);
+  return content;
+}
+function findSelectorValue(selector, args) {
+  if (!args || !args.length) return null;
+  const m = selector.match(/^\$\{?(\d+)\}?$/);
+  if (m) {
+    const idx = parseInt(m[1], 10);
+    if (1 <= idx && idx <= args.length) return args[idx - 1];
+    return null;
   }
-  const globalConfig = getLLMConfig();
-  const config = input.llmConfig?.apiKey ? { ...globalConfig, ...input.llmConfig } : globalConfig;
-  const rawDetail = input.aNext.actionDetail.replace(/^terminal-\w+:\s*command=([^,]+).*/, "$1").trim();
-  const cacheKey = `${input.aNext.actionType}:${rawDetail || input.aNext.actionDetail}`;
-  const cached = llmCache.get(cacheKey);
-  if (cached) {
-    console.log("[AgentMoss] LLM cache hit");
-    return cached;
+  return null;
+}
+function splitCaseBody(body) {
+  const lines = body.split("\n");
+  const branches = [];
+  let cur = null;
+  for (const ln of lines) {
+    const stripped = ln.trim();
+    if (/^[\w:-]+\s*\(\)\s*\{/.test(stripped)) continue;
+    const m = stripped.match(/^([^()]+?)\s*\)\s*(.*)$/);
+    if (m) {
+      const pat = m[1].trim().replace(/^["']|["']$/g, "");
+      const inline = m[2].trim();
+      if (pat) {
+        if (cur) branches.push(cur);
+        cur = { label: pat, body: inline };
+      }
+      continue;
+    }
+    if (cur) {
+      cur.body += cur.body ? "\n" + ln : ln;
+      if (stripped.endsWith(";;")) {
+        branches.push(cur);
+        cur = null;
+      }
+    }
   }
-  const matchedSkills = matchSkills(input.aNext.actionType, input.aNext.actionDetail, input.reason);
-  const templates = loadTemplates();
-  let scriptAnalysis;
-  let scriptChainText = "";
-  if (previous.scriptChain) {
-    scriptChainText = formatScriptChainForPrompt(previous.scriptChain);
+  if (cur && cur.body.trim()) {
+    if (!branches.includes(cur)) branches.push(cur);
+  }
+  return branches;
+}
+function parseCase(content, args) {
+  const m = content.match(/\bcase\s+(\$\{?\d+\}?|[A-Za-z_]\w*|\$[A-Za-z_]\w*)\s+in/i);
+  if (!m) return null;
+  const selector = m[1].trim();
+  const val = findSelectorValue(selector, args);
+  if (val === null) return null;
+  const lines = content.split("\n");
+  const endMatch = findCaseEndInLines(lines, 0);
+  if (endMatch === -1) return null;
+  const bodyLines = lines.slice(1, endMatch);
+  const body = bodyLines.join("\n");
+  const hasNested = /\bcase\s+/.test(body) || /\bif\s+/.test(body);
+  let final;
+  if (hasNested) {
+    final = splitNestedCaseBranches(bodyLines, val);
+    if (final === null) return null;
   } else {
-    scriptAnalysis = analyzeScriptContent(input.aNext.actionType, input.aNext.actionDetail);
+    const branches = splitCaseBody(body);
+    let selected = null;
+    let fallback = "";
+    for (const b of branches) {
+      const values = b.label.split("|").map((v) => v.trim()).filter(Boolean);
+      if (values.includes("*")) fallback = b.body;
+      else if (values.includes(val)) selected = b.body;
+    }
+    final = selected !== null ? selected : fallback || null;
+    if (final === null) return null;
+  }
+  const prefix = content.slice(0, m.index ?? 0);
+  const suffix = lines.slice(endMatch + 1).join("\n");
+  return `${prefix}
+${final}
+${suffix}`;
+}
+function findCaseEndInLines(lines, headerLine) {
+  let depth = 0;
+  for (let idx = headerLine; idx < lines.length; idx++) {
+    const ln = lines[idx];
+    const opens = (ln.match(/\bcase\b/g) || []).length;
+    const closes = (ln.match(/\besac\b/g) || []).length;
+    depth += opens - closes;
+    if (depth <= 0 && idx > headerLine) return idx;
+  }
+  return -1;
+}
+function splitNestedCaseBranches(bodyLines, selectorVal) {
+  let depth = 0;
+  let curPat = null;
+  let curBody = [];
+  let selected = null;
+  let fallback = null;
+  const flush = () => {
+    if (curPat === null) return;
+    const values = curPat.split("|").map((v) => v.trim()).filter(Boolean);
+    const body = curBody.join("\n");
+    if (values.includes("*")) {
+      if (fallback === null) fallback = body;
+    } else if (values.includes(selectorVal)) {
+      selected = body;
+    }
+    curPat = null;
+    curBody = [];
+  };
+  for (const ln of bodyLines) {
+    const stripped = ln.trim();
+    if (depth === 0) {
+      const bm = stripped.match(/^([^()]+?)\s*\)\s*(.*)$/);
+      if (bm) {
+        if (curPat !== null) flush();
+        curPat = bm[1].trim().replace(/^["']|["']$/g, "");
+        curBody = bm[2].trim() ? [bm[2].trim()] : [];
+        continue;
+      }
+    }
+    if (/\bcase\b/.test(stripped)) depth += 1;
+    else if (/\besac\b/.test(stripped)) depth = Math.max(0, depth - 1);
+    else if (curPat !== null) {
+      curBody.push(ln);
+      if (depth === 0 && stripped.endsWith(";;")) flush();
+    }
   }
-  const prompt = buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis, previous.skipL3Hints ?? "", scriptChainText);
-  logPrompt(prompt, input.aNext, previous.llmLogPath);
-  const result = await analyzeWithLLM(prompt, config);
-  if (llmCache.size >= LLM_CACHE_MAX) {
-    const firstKey = llmCache.keys().next().value;
-    if (firstKey) llmCache.delete(firstKey);
+  if (curPat !== null && curBody.length) flush();
+  return selected !== null ? selected : fallback;
+}
+function evalIfCondition(cond, args) {
+  if (!args || !args.length) return null;
+  let inner = cond.replace(/^\[\[?|\]\]?$/g, "").replace(/"/g, "").replace(/'/g, "").trim();
+  const m = inner.match(/(.*?)\s*(==|=)\s*(.*)/);
+  if (!m) return null;
+  let left = m[1].trim();
+  let right = m[3].trim();
+  const lm = left.match(/^\$(\d+)$/);
+  if (lm) {
+    const idx = parseInt(lm[1], 10);
+    if (1 <= idx && idx <= args.length) left = args[idx - 1];
+    else return null;
+  } else if (left.startsWith("$")) return null;
+  const rm = right.match(/^\$(\d+)$/);
+  if (rm) {
+    const idx = parseInt(rm[1], 10);
+    if (1 <= idx && idx <= args.length) right = args[idx - 1];
+    else return null;
+  } else if (right.startsWith("$")) return null;
+  return left === right;
+}
+function parseIf(content, args) {
+  const m = content.match(/\bif\s+([^\n;]+?)\s*;\s*then/i);
+  if (!m) return null;
+  const truth = evalIfCondition(m[1].trim(), args);
+  if (truth === null) return null;
+  const start = m.index ?? 0;
+  const thenBodyStart = start + m[0].length;
+  const fiPos = content.indexOf("fi", thenBodyStart);
+  if (fiPos === -1) return null;
+  const segment = content.slice(thenBodyStart, fiPos);
+  const elseM = segment.match(/\belse\b/);
+  let chosen;
+  if (truth) chosen = elseM ? segment.slice(0, elseM.index) : segment;
+  else {
+    if (!elseM) return null;
+    chosen = segment.slice((elseM.index ?? 0) + 4);
+  }
+  return `${content.slice(0, start)}
+${chosen}
+${content.slice(fiPos + 2)}`;
+}
+function markLoopsReachable(content) {
+  return content;
+}
+var CHILD_CALL_RE2 = /(?:^|\s|&&|\|\|)\s*((?:\/bin\/)?bash|sh|zsh|(?:python|python3|node|ruby|perl|php|lua))\s+(\S+(?:\.(?:sh|shrc|py|js|rb|pl|php|lua))?)([^\n;|&]*?)$/gmi;
+function extractCallsFromContent(content) {
+  const calls = [];
+  let m;
+  CHILD_CALL_RE2.lastIndex = 0;
+  while ((m = CHILD_CALL_RE2.exec(content)) !== null) {
+    const interp = m[1];
+    const path5 = m[2].trim();
+    let rest = m[3].trim();
+    if (path5.startsWith("-") || path5.startsWith("$") || path5.includes("/dev/")) continue;
+    rest = rest.split(/[;|&<>]/)[0].trim();
+    const args = [];
+    for (const tm of rest.matchAll(/(["'])(.*?)\1|(\S+)/g)) {
+      args.push(tm[1] ? tm[2] : tm[3]);
+    }
+    calls.push({ path: path5, args, interpreter: interp });
+  }
+  return calls;
+}
+var ShellBackend = class {
+  language = "shell";
+  parse(content, entryArgs) {
+    const c = content || "";
+    const orig = c;
+    let candidate = c;
+    let resolved = false;
+    const p1Safe = !/(?:\bshift\b|\bset\s+--(?:\s|$)|[\s;|&]read\b|^\s*read\b|\(\)\s*\{|function\s+\w+)/.test(c);
+    if (p1Safe) {
+      const caseOut = parseCase(candidate, entryArgs);
+      if (caseOut !== null && caseOut !== candidate) {
+        resolved = true;
+        candidate = caseOut;
+      }
+      const ifOut = parseIf(candidate, entryArgs);
+      if (ifOut !== null && ifOut !== candidate) {
+        resolved = true;
+        candidate = ifOut;
+      }
+    }
+    let bound = p1Safe ? bindPositionalArgs(candidate, entryArgs || []) : candidate;
+    if (!resolved) {
+      const symOut = symbolicProcess(c, entryArgs);
+      if (symOut !== null && symOut !== c) {
+        resolved = true;
+        bound = symOut;
+      }
+    }
+    const loopMarked = markLoopsReachable(bound);
+    const calls = extractCallsFromContent(loopMarked);
+    return {
+      reachableContent: loopMarked,
+      controlFlowResolved: resolved,
+      calls,
+      branches: [],
+      unresolvedSnippets: [],
+      language: this.language
+    };
   }
-  llmCache.set(cacheKey, result);
-  return result;
+};
+
+// src/engine/script-engine/tracker.ts
+var DEFAULT_MAX_DEPTH = 14;
+var DEFAULT_MAX_NODES = 64;
+var DEFAULT_MAX_FILE_SIZE = 2 * 1024 * 1024;
+var DEFAULT_MAX_TOTAL_SIZE = 8 * 1024 * 1024;
+var BACKENDS = {
+  ".py": new PythonBackend()
+};
+var DEFAULT_BACKEND = new ShellBackend();
+function pickBackend(pathStr) {
+  const lower = pathStr.toLowerCase();
+  for (const ext of Object.keys(BACKENDS)) {
+    if (lower.endsWith(ext)) return BACKENDS[ext];
+  }
+  return DEFAULT_BACKEND;
 }
-function logPrompt(prompt, aNext, logPath) {
-  if (!logPath) return;
+function resolvePath(p, baseDir) {
+  let expanded = p;
+  if (expanded.startsWith("~/") || expanded === "~") {
+    expanded = path3.join(os.homedir(), expanded.slice(1));
+  } else if (!path3.isAbsolute(expanded) && baseDir) {
+    expanded = path3.join(baseDir, expanded);
+  }
+  return path3.resolve(expanded);
+}
+function readScript(pathStr, maxFileSize) {
   try {
-    const actionType = aNext.actionType || "unknown";
-    const actionDetail = (aNext.actionDetail || "").slice(0, 100);
-    const line = `[${(/* @__PURE__ */ new Date()).toISOString()}] [LLM_PROMPT] action_type=${actionType}, action_detail=${actionDetail}... prompt_length=${prompt.length}
-${prompt}
---- END PROMPT ---
-`;
-    appendFileSync(logPath, line, "utf-8");
+    const p = resolvePath(pathStr);
+    if (!fs3.existsSync(p)) return { content: "", lineCount: 0, fileSize: 0, error: `\u811A\u672C\u4E0D\u5B58\u5728: ${pathStr}` };
+    const stat = fs3.statSync(p);
+    if (!stat.isFile()) return { content: "", lineCount: 0, fileSize: 0, error: `\u4E0D\u662F\u6587\u4EF6: ${pathStr}` };
+    if (stat.size > maxFileSize) {
+      return { content: "", lineCount: 0, fileSize: stat.size, error: `\u811A\u672C\u6587\u4EF6\u8FC7\u5927 (${stat.size} bytes)\uFF0C\u8DF3\u8FC7\u8BFB\u53D6` };
+    }
+    const content = fs3.readFileSync(p, "utf-8");
+    return { content, lineCount: content ? content.split("\n").length : 0, fileSize: stat.size, error: "" };
   } catch (e) {
-    console.warn("[AgentMoss] Failed to write LLM prompt to log:", e);
+    const msg = e instanceof Error ? e.message : String(e);
+    return { content: "", lineCount: 0, fileSize: 0, error: `\u8BFB\u53D6\u811A\u672C\u5931\u8D25: ${msg}` };
   }
 }
-function buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis, skipL3Hints = "", scriptChainText = "") {
-  const skillsText = formatSkillsForPrompt(matchedSkills);
-  const historyStr = input.actionHistory.map((h, i) => `${i + 1}. ${h.actionType}: ${h.actionDetail}`).join("\n") || "(\u65E0\u5386\u53F2\u64CD\u4F5C)";
-  const promptHistoryText = formatPromptHistory(input.promptHistory);
-  const scriptAnalysisText = scriptChainText ? scriptChainText : scriptAnalysis ? formatScriptAnalysisForPrompt(scriptAnalysis) : "";
-  const hintsText = formatHints(previous);
-  const securityJudgeTemplate = templates["security_judge"];
-  if (securityJudgeTemplate) {
-    return securityJudgeTemplate.replaceAll("{prompt_session}", input.promptSession || "\uFF08\u672A\u63D0\u4F9B\uFF09").replaceAll("{prompt_history_text}", promptHistoryText).replaceAll("{action_history}", historyStr).replaceAll("{action_type}", input.aNext.actionType).replaceAll("{action_detail}", input.aNext.actionDetail).replaceAll("{reason}", input.reason || "\u672A\u8BF4\u660E").replaceAll("{skills_text}", skillsText).replaceAll("{hints_text}", hintsText).replaceAll("{script_analysis_text}", scriptAnalysisText).replaceAll("{skip_l3_hints}", skipL3Hints).replaceAll("{{", "{").replaceAll("}}", "}");
+function emptyNode(pathStr, depth) {
+  return {
+    scriptPath: pathStr,
+    rawContent: "",
+    preprocessedContent: "",
+    lineCount: 0,
+    fileSize: 0,
+    depth,
+    childPaths: [],
+    error: "",
+    l1Hit: false,
+    l1RiskLevel: "",
+    l1RiskType: "",
+    l1Reason: "",
+    l1MatchedPatterns: [],
+    l2Hit: false,
+    l2ViolatedRule: "",
+    l2RiskLevel: "",
+    l2RiskType: "",
+    l2Reason: "",
+    matchedKeywords: [],
+    isSuspicious: false,
+    keywordRiskLevel: "",
+    keywordRiskReason: ""
+  };
+}
+var RecursiveTracker = class {
+  constructor(commandScanner, maxDepth = DEFAULT_MAX_DEPTH, maxNodes = DEFAULT_MAX_NODES, maxFileSize = DEFAULT_MAX_FILE_SIZE, maxTotalSize = DEFAULT_MAX_TOTAL_SIZE) {
+    this.maxDepth = maxDepth;
+    this.maxNodes = maxNodes;
+    this.maxFileSize = maxFileSize;
+    this.maxTotalSize = maxTotalSize;
+    this._scanner = commandScanner;
+    this.result = {
+      nodes: [],
+      entryPath: "",
+      maxDepthReached: false,
+      maxSizeReached: false,
+      maxNodesReached: false,
+      totalSize: 0,
+      totalLines: 0,
+      totalNodes: 0,
+      hasCritical: false,
+      hasHigh: false,
+      firstHitNode: null,
+      error: ""
+    };
+  }
+  maxDepth;
+  maxNodes;
+  maxFileSize;
+  maxTotalSize;
+  result;
+  visiting = /* @__PURE__ */ new Set();
+  visitedPaths = /* @__PURE__ */ new Set();
+  _scanner;
+  track(entryPath, entryArgs, cwd = "") {
+    const baseDir = cwd || process.cwd();
+    const resolved = resolvePath(entryPath);
+    this.result.entryPath = resolved;
+    this.visitScript(resolved, 0, path3.dirname(resolved), entryArgs);
+    const nodes = this.result.nodes;
+    this.result.hasCritical = nodes.some((n) => n.l1RiskLevel === "critical" || n.l2RiskLevel === "critical" || n.keywordRiskLevel === "critical") || this.result.hasCritical;
+    this.result.hasHigh = nodes.some((n) => ["high", "critical"].includes(n.l1RiskLevel) || ["high", "critical"].includes(n.l2RiskLevel) || ["high", "critical"].includes(n.keywordRiskLevel));
+    this.result.firstHitNode = nodes.find((n) => n.l1Hit || n.l2Hit || n.isSuspicious) || null;
+    return this.result;
+  }
+  visitScript(pathStr, depth, baseDir, args) {
+    pathStr = resolvePath(pathStr);
+    if (this.visiting.has(pathStr)) return;
+    if (this.visitedPaths.has(pathStr)) return;
+    if (depth > this.maxDepth) {
+      this.result.maxDepthReached = true;
+      return;
+    }
+    if (this.result.nodes.length >= this.maxNodes) {
+      this.result.maxNodesReached = true;
+      return;
+    }
+    if (this.result.totalSize >= this.maxTotalSize) {
+      this.result.maxSizeReached = true;
+      return;
+    }
+    this.visiting.add(pathStr);
+    this.visitedPaths.add(pathStr);
+    const { content, lineCount, fileSize, error } = readScript(pathStr, this.maxFileSize);
+    if (error) {
+      const node2 = emptyNode(pathStr, depth);
+      node2.error = error;
+      node2.fileSize = fileSize;
+      node2.lineCount = lineCount;
+      this.result.nodes.push(node2);
+      this.visiting.delete(pathStr);
+      return;
+    }
+    this.result.totalSize += fileSize;
+    this.result.totalLines += lineCount;
+    const ir = pickBackend(pathStr).parse(content, args);
+    const node = emptyNode(pathStr, depth);
+    node.rawContent = content;
+    node.preprocessedContent = ir.reachableContent;
+    node.lineCount = lineCount;
+    node.fileSize = fileSize;
+    this.result.nodes.push(node);
+    this.result.totalNodes = this.result.nodes.length;
+    if (this._scanner && ir.reachableContent) {
+      const l1 = this._scanner(ir.reachableContent);
+      if (l1.hit) {
+        node.l1Hit = true;
+        node.l1RiskLevel = l1.riskLevel;
+        node.l1RiskType = l1.riskType;
+        node.l1Reason = l1.reason;
+        node.l1MatchedPatterns = l1.matchedPatterns || [];
+        if (l1.riskLevel === "critical") {
+          this.result.hasCritical = true;
+          this.result.firstHitNode = node;
+          this.visiting.delete(pathStr);
+          return;
+        }
+      }
+    }
+    const parentDir = path3.dirname(pathStr);
+    const childPaths = [];
+    for (const call of ir.calls) {
+      const child = resolvePath(call.path, parentDir);
+      childPaths.push(child);
+      this.visitScript(child, depth + 1, path3.dirname(child), call.args);
+      if (this.result.hasCritical) break;
+    }
+    node.childPaths = childPaths;
+    this.visiting.delete(pathStr);
+  }
+};
+
+// src/engine/script-content-analyzer.ts
+function emptyChain() {
+  return {
+    nodes: [],
+    entryPath: "",
+    maxDepthReached: false,
+    maxSizeReached: false,
+    maxNodesReached: false,
+    totalSize: 0,
+    totalLines: 0,
+    totalNodes: 0,
+    hasCritical: false,
+    hasHigh: false,
+    firstHitNode: null,
+    error: ""
+  };
+}
+var SUSPICIOUS_PATTERNS2 = [
+  { name: "curl POST", pattern: /curl\s+(.*\s)?-X\s+POST/i },
+  { name: "curl --data", pattern: /curl\s+(.*\s)?--data/i },
+  { name: "curl -d", pattern: /curl\s+(.*\s)?-d\s/i },
+  { name: "wget --post-data", pattern: /wget\s+(.*\s)?--post-data/i },
+  { name: "wget --post-file", pattern: /wget\s+(.*\s)?--post-file/i },
+  { name: "nc -e", pattern: /\bnc\s+.*-e\b/ },
+  { name: "ncat -e", pattern: /\bncat\s+.*-e\b/ },
+  { name: "/dev/tcp", pattern: /\/dev\/tcp\// },
+  { name: "/dev/udp", pattern: /\/dev\/udp\// },
+  { name: "$(base64", pattern: /\$\(\s*base64/ },
+  { name: "`base64", pattern: /`\s*base64/ },
+  { name: "base64 decode pipe", pattern: /base64\s+(-d|--decode)\s*\|/ },
+  { name: "/etc/shadow", pattern: /\/etc\/shadow/ },
+  { name: "id_rsa", pattern: /\bid_rsa\b/ },
+  { name: "id_ed25519", pattern: /\bid_ed25519\b/ },
+  { name: "crontab install", pattern: /crontab\s+-/ },
+  { name: "authorized_keys", pattern: /authorized_keys/ },
+  { name: "ssh no host key check", pattern: /ssh\s+.*StrictHostKeyChecking\s*=\s*no/ }
+];
+var SCRIPT_EXEC_PATTERNS2 = [
+  /(?:^|\s|&&|\|\|)\s*bash\s+(\S+)/i,
+  /(?:^|\s|&&|\|\|)\s*\/bin\/bash\s+(\S+)/i,
+  /(?:^|\s|&&|\|\|)\s*sh\s+(\S+)/i,
+  /(?:^|\s|&&|\|\|)\s*zsh\s+(\S+)/i,
+  /\.\/(\S+)/,
+  /(?:^|\s|&&|\|\|)\s*source\s+(\S+)/i,
+  /(?:^|\s|&&|\|\|)\s*\.\s+(\S+)/,
+  /(?:^|\s|&&|\|\|)\s*python3?\s+(\S+\.py)/i,
+  /(?:^|\s|&&|\|\|)\s*node\s+(\S+\.js)/i,
+  /(?:^|\s|&&|\|\|)\s*ruby\s+(\S+\.rb)/i,
+  /(?:^|\s|&&|\|\|)\s*perl\s+(\S+\.pl)/i,
+  /(?:^|\s|&&|\|\|)\s*php\s+(\S+\.php)/i,
+  /(?:^|\s|&&|\|\|)\s*lua\s+(\S+\.lua)/i
+];
+var KEYWORD_COMBINATION_RISKS2 = [
+  {
+    group1: /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]),
+    group2: /* @__PURE__ */ new Set(["$(base64", "`base64", "base64 decode pipe"]),
+    level: "critical",
+    reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + Base64\u7F16\u7801\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u6570\u636E\u5916\u4F20\u98CE\u9669\u3002\u653B\u51FB\u8005\u53EF\u80FD\u5C06\u654F\u611F\u6570\u636E\u7F16\u7801\u540E\u5916\u4F20\u3002"
+  },
+  {
+    group1: /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]),
+    group2: /* @__PURE__ */ new Set(["/etc/shadow", "id_rsa", "id_ed25519"]),
+    level: "critical",
+    reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + \u654F\u611F\u6587\u4EF6\u8BBF\u95EE\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u51ED\u8BC1\u5916\u4F20\u98CE\u9669\u3002"
+  },
+  {
+    group1: /* @__PURE__ */ new Set(["nc -e", "ncat -e", "/dev/tcp", "/dev/udp"]),
+    group2: /* @__PURE__ */ new Set(),
+    level: "high",
+    reason: "\u68C0\u6D4B\u5230\u53CD\u5F39 Shell \u7279\u5F81\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5EFA\u7ACB\u8FDC\u7A0B\u63A7\u5236\u901A\u9053\u3002"
+  },
+  {
+    group1: /* @__PURE__ */ new Set(["crontab install", "authorized_keys", "ssh no host key check"]),
+    group2: /* @__PURE__ */ new Set(),
+    level: "high",
+    reason: "\u68C0\u6D4B\u5230\u6301\u4E45\u5316\u540E\u95E8\u7279\u5F81\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5728\u7CFB\u7EDF\u4E2D\u690D\u5165\u540E\u95E8\u3002"
+  }
+];
+var SINGLE_KEYWORD_RISKS2 = {
+  "curl POST": { level: "high", reason: "\u68C0\u6D4B\u5230 curl POST \u8BF7\u6C42\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+  "curl --data": { level: "high", reason: "\u68C0\u6D4B\u5230 curl --data \u53C2\u6570\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+  "curl -d": { level: "high", reason: "\u68C0\u6D4B\u5230 curl -d \u53C2\u6570\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+  "wget --post-data": { level: "high", reason: "\u68C0\u6D4B\u5230 wget POST \u8BF7\u6C42\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+  "wget --post-file": { level: "high", reason: "\u68C0\u6D4B\u5230 wget \u6587\u4EF6\u4E0A\u4F20\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6587\u4EF6\u3002" },
+  "nc -e": { level: "critical", reason: "\u68C0\u6D4B\u5230 nc -e \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+  "ncat -e": { level: "critical", reason: "\u68C0\u6D4B\u5230 ncat -e \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+  "/dev/tcp": { level: "critical", reason: "\u68C0\u6D4B\u5230 /dev/tcp \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+  "/dev/udp": { level: "critical", reason: "\u68C0\u6D4B\u5230 /dev/udp \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+  "$(base64": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u7F16\u7801\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
+  "`base64": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u7F16\u7801\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
+  "base64 decode pipe": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u89E3\u7801\u540E\u7BA1\u9053\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
+  "/etc/shadow": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6\u3002" },
+  "id_rsa": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE SSH \u79C1\u94A5\u3002" },
+  "id_ed25519": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE SSH \u79C1\u94A5\u3002" },
+  "crontab install": { level: "high", reason: "\u68C0\u6D4B\u5230\u4FEE\u6539\u5B9A\u65F6\u4EFB\u52A1\uFF0C\u53EF\u80FD\u662F\u6301\u4E45\u5316\u540E\u95E8\u3002" },
+  "authorized_keys": { level: "high", reason: "\u68C0\u6D4B\u5230\u4FEE\u6539 SSH \u6388\u6743\u5BC6\u94A5\uFF0C\u53EF\u80FD\u662F\u6301\u4E45\u5316\u540E\u95E8\u3002" },
+  "ssh no host key check": { level: "high", reason: "\u68C0\u6D4B\u5230 SSH \u8DF3\u8FC7\u4E3B\u673A\u5BC6\u94A5\u9A8C\u8BC1\uFF0C\u53EF\u80FD\u662F\u6A2A\u5411\u79FB\u52A8\u3002" }
+};
+var LEVEL_ORDER2 = { low: 1, medium: 2, high: 3, critical: 4 };
+function scanScriptForKeywords2(content) {
+  const matched = [];
+  for (const { name, pattern } of SUSPICIOUS_PATTERNS2) {
+    if (pattern.test(content)) matched.push(name);
+  }
+  return matched;
+}
+function assessKeywordCombinationRisk2(matchedKeywords, scriptContent) {
+  if (matchedKeywords.length === 0) return { level: "", reason: "" };
+  const keywordSet = new Set(matchedKeywords);
+  for (const rule of KEYWORD_COMBINATION_RISKS2) {
+    const hitGroup1 = [...rule.group1].some((k) => keywordSet.has(k));
+    const hitGroup2 = rule.group2.size === 0 ? true : [...rule.group2].some((k) => keywordSet.has(k));
+    if (hitGroup1 && hitGroup2) return { level: rule.level, reason: rule.reason };
+  }
+  const networkPostKeywords = /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]);
+  const hasNetworkPost = [...networkPostKeywords].some((k) => keywordSet.has(k));
+  if (hasNetworkPost) {
+    const envPatterns = ["$env", "$(env)", "$USER", "$(hostname)", "$(pwd)", "$HOME"];
+    const contentLower = scriptContent.toLowerCase();
+    for (const p of envPatterns) {
+      if (contentLower.includes(p.toLowerCase())) {
+        return {
+          level: "critical",
+          reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + \u7CFB\u7EDF\u73AF\u5883\u53D8\u91CF\u6536\u96C6\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u6570\u636E\u5916\u4F20\u98CE\u9669\u3002\u811A\u672C\u53EF\u80FD\u5C06\u7528\u6237\u73AF\u5883\u53D8\u91CF\uFF08\u53EF\u80FD\u5305\u542B API Key\u3001\u5BC6\u94A5\u7B49\u654F\u611F\u4FE1\u606F\uFF09\u53D1\u9001\u5230\u8FDC\u7A0B\u670D\u52A1\u5668\u3002"
+        };
+      }
+    }
+  }
+  let bestLevel = "";
+  let bestReason = "";
+  for (const kw of matchedKeywords) {
+    const risk = SINGLE_KEYWORD_RISKS2[kw];
+    if (risk && (LEVEL_ORDER2[risk.level] || 0) > (LEVEL_ORDER2[bestLevel] || 0)) {
+      bestLevel = risk.level;
+      bestReason = risk.reason;
+    }
+  }
+  return { level: bestLevel, reason: bestReason };
+}
+function extractScriptPath2(command) {
+  for (const pattern of SCRIPT_EXEC_PATTERNS2) {
+    const m = command.match(pattern);
+    if (m) return m[1];
+  }
+  return null;
+}
+function extractScriptPathWithArgs(command) {
+  const scriptPath = extractScriptPath2(command);
+  if (!scriptPath) return { path: null, args: [] };
+  const idx = command.indexOf(scriptPath);
+  if (idx < 0) return { path: scriptPath, args: [] };
+  let rest = command.slice(idx + scriptPath.length);
+  rest = rest.split(/[;|&<>]/)[0].trim();
+  const tokens = [...rest.matchAll(/(["'])(.*?)\1|(\S+)/g)];
+  const args = [];
+  for (const m of tokens) {
+    args.push(m[1] ? m[2] : m[3]);
+  }
+  return { path: scriptPath, args };
+}
+function extractInlineScriptPath(actionDetail) {
+  const re = /open\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+  let m;
+  while ((m = re.exec(actionDetail)) !== null) {
+    const p = m[1];
+    let resolved;
+    try {
+      resolved = resolvePath2(p);
+      if (existsSync9(resolved)) {
+        const stat = statSync2(resolved);
+        if (stat.isFile()) return resolved;
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function resolvePath2(p) {
+  let expanded = p;
+  if (expanded.startsWith("~/") || expanded === "~") {
+    expanded = join5(homedir3(), expanded.slice(1));
+  }
+  return resolve8(expanded);
+}
+function scanScriptChainWithL1(chain, input) {
+  for (const node of chain.nodes) {
+    if (node.error || !node.preprocessedContent || node.l1Hit) continue;
+    const virtualInput = {
+      ...input,
+      aNext: { actionType: "bash", actionDetail: node.preprocessedContent }
+    };
+    const l1 = runHeuristicCheck(virtualInput);
+    if (l1 && !l1.allowed) {
+      node.l1Hit = true;
+      node.l1RiskLevel = l1.riskLevel;
+      node.l1RiskType = l1.riskType;
+      node.l1Reason = l1.reason;
+      if (l1.riskLevel === "critical") {
+        chain.hasCritical = true;
+        chain.firstHitNode = node;
+        break;
+      }
+    }
+  }
+  return chain;
+}
+function scanScriptChainWithL2(chain, input) {
+  for (const node of chain.nodes) {
+    if (node.error || !node.preprocessedContent) continue;
+    if (node.l1RiskLevel === "critical") break;
+    const virtualInput = {
+      ...input,
+      aNext: { actionType: "bash", actionDetail: node.preprocessedContent }
+    };
+    const l2 = runLogicCheck(virtualInput);
+    if (l2 && !l2.allowed) {
+      node.l2Hit = true;
+      node.l2ViolatedRule = `script_logic:${node.scriptPath}`;
+      node.l2RiskLevel = l2.riskLevel;
+      node.l2RiskType = l2.riskType;
+      node.l2Reason = `\u811A\u672C ${node.scriptPath} (\u6DF1\u5EA6 ${node.depth}) \u4E2D: ${l2.reason}`;
+      if (l2.riskLevel === "critical") {
+        chain.hasCritical = true;
+        chain.firstHitNode = node;
+        break;
+      }
+    }
+  }
+  if (!chain.hasHigh) {
+    chain.hasHigh = chain.nodes.some((n) => ["high", "critical"].includes(n.l2RiskLevel));
+  }
+  return chain;
+}
+function scanScriptChainKeywords(chain) {
+  for (const node of chain.nodes) {
+    if (node.error || !node.preprocessedContent) continue;
+    if (node.l1Hit || node.l2Hit) continue;
+    const matched = scanScriptForKeywords2(node.preprocessedContent);
+    node.matchedKeywords = matched;
+    node.isSuspicious = matched.length > 0;
+    if (matched.length > 0) {
+      const risk = assessKeywordCombinationRisk2(matched, node.preprocessedContent);
+      node.keywordRiskLevel = risk.level;
+      node.keywordRiskReason = risk.reason;
+    }
+  }
+  return chain;
+}
+function analyzeScriptContent2(input) {
+  const actionType = input.aNext.actionType.toLowerCase();
+  if (actionType !== "bash") return emptyChain();
+  const { path: scriptPath, args: scriptArgs } = extractScriptPathWithArgs(input.aNext.actionDetail);
+  let resolvedPath = scriptPath;
+  let isInline = false;
+  if (!resolvedPath) {
+    const inline = extractInlineScriptPath(input.aNext.actionDetail);
+    if (!inline) return emptyChain();
+    resolvedPath = inline;
+    isInline = true;
+  }
+  if (resolvedPath && !isAbsolute2(resolvedPath) && !resolvedPath.startsWith("~/")) {
+    resolvedPath = join5(input.cwd || process.cwd(), resolvedPath);
+  }
+  const l1Adapter = (content) => {
+    const virtualInput = {
+      ...input,
+      aNext: { actionType: "bash", actionDetail: content }
+    };
+    const j = runHeuristicCheck(virtualInput);
+    if (j && !j.allowed) {
+      return { hit: true, riskLevel: j.riskLevel, riskType: j.riskType, reason: j.reason, matchedPatterns: [] };
+    }
+    return { hit: false, riskLevel: "", riskType: "", reason: "", matchedPatterns: [] };
+  };
+  const tracker = new RecursiveTracker(l1Adapter);
+  const chain = tracker.track(resolvedPath, isInline ? null : scriptArgs, input.cwd || process.cwd());
+  if (chain.nodes.length === 0) return chain;
+  scanScriptChainWithL1(chain, input);
+  scanScriptChainWithL2(chain, input);
+  scanScriptChainKeywords(chain);
+  return chain;
+}
+function formatScriptChainForPrompt(chain) {
+  if (chain.nodes.length === 0) return "";
+  const errorNodes = chain.nodes.filter((n) => n.error);
+  if (errorNodes.length > 0 && chain.nodes.length === 1) {
+    return `\u26A0\uFE0F \u811A\u672C\u5185\u5BB9\u5206\u6790\u5931\u8D25: ${errorNodes[0].error}`;
+  }
+  const suspiciousNodes = chain.nodes.filter((n) => n.isSuspicious && !n.l1Hit && !n.l2Hit);
+  if (suspiciousNodes.length === 0) {
+    const safeNodes = chain.nodes.filter((n) => !n.error);
+    if (safeNodes.length === 0) return "";
+    const parts2 = ["\u2713 \u811A\u672C\u5185\u5BB9\u5DF2\u5206\u6790\uFF0C\u672A\u53D1\u73B0\u5371\u9669/\u53EF\u7591\u64CD\u4F5C\uFF08L1/L2/\u5173\u952E\u8BCD\u626B\u63CF\u5747\u672A\u547D\u4E2D\uFF09\uFF1A"];
+    for (const node of safeNodes) {
+      const pre = node.preprocessedContent || "";
+      let preview = pre.slice(0, 600);
+      if (pre.length > 600) preview += `
+... (\u622A\u65AD\uFF0C\u5B8C\u6574\u5185\u5BB9 ${pre.length} \u5B57\u7B26)`;
+      parts2.push(
+        `   \u811A\u672C\u8DEF\u5F84: ${node.scriptPath}\uFF08\u9012\u5F52\u6DF1\u5EA6 ${node.depth}\uFF0C${node.lineCount} \u884C\uFF09
+   \u5185\u5BB9\uFF08\u9884\u5904\u7406\u540E\uFF09:
+\`\`\`
+${preview}
+\`\`\``
+      );
+    }
+    return parts2.join("\n");
+  }
+  const parts = [];
+  for (const node of suspiciousNodes) {
+    const keywordsStr = node.matchedKeywords.join(", ");
+    let riskHint = "";
+    if (node.keywordRiskLevel && node.keywordRiskReason) {
+      riskHint = `
+
+\u{1F534} **\u98CE\u9669\u8BC4\u4F30**: ${node.keywordRiskLevel.toUpperCase()} \u7EA7\u522B
+**\u98CE\u9669\u539F\u56E0**: ${node.keywordRiskReason}
+**\u5EFA\u8BAE**: \u6B64\u811A\u672C\u5E94\u88AB\u62D2\u7EDD\uFF08Deny\uFF09\uFF0C\u9664\u975E\u6709\u660E\u786E\u7684\u4E1A\u52A1\u9700\u6C42\u4E14\u5DF2\u786E\u8BA4\u76EE\u6807\u670D\u52A1\u5668\u53EF\u4FE1\u3002`;
+    }
+    const pre = node.preprocessedContent;
+    let contentPreview = pre.slice(0, 2e3);
+    if (pre.length > 2e3) contentPreview += `
+... (\u622A\u65AD\uFF0C\u5B8C\u6574\u5185\u5BB9 ${pre.length} \u5B57\u7B26)`;
+    parts.push(
+      `\u26A0\uFE0F \u811A\u672C\u5185\u5BB9\u5305\u542B\u53EF\u7591\u5173\u952E\u8BCD:
+   \u811A\u672C\u8DEF\u5F84: ${node.scriptPath}
+   \u9012\u5F52\u6DF1\u5EA6: ${node.depth}
+   \u53EF\u7591\u5173\u952E\u8BCD: ${keywordsStr}
+   \u811A\u672C\u884C\u6570: ${node.lineCount}${riskHint}
+
+### \u811A\u672C\u5185\u5BB9\uFF08\u9884\u5904\u7406\u540E\uFF09###
+\`\`\`
+${contentPreview}
+\`\`\`
+`
+    );
+  }
+  let header = `\u26A0\uFE0F \u68C0\u6D4B\u5230\u811A\u672C\u6267\u884C\u94FE\uFF08\u5171 ${chain.nodes.length} \u4E2A\u811A\u672C\uFF09\uFF0C\u5176\u4E2D ${suspiciousNodes.length} \u4E2A\u5305\u542B\u53EF\u7591\u5173\u952E\u8BCD:
+`;
+  if (chain.maxDepthReached) header += "\u26A0\uFE0F \u6CE8\u610F\uFF1A\u9012\u5F52\u8FFD\u8E2A\u89E6\u8FBE\u6DF1\u5EA6\u4E0A\u9650\uFF0C\u53EF\u80FD\u5B58\u5728\u66F4\u6DF1\u5C42\u7684\u811A\u672C\u8C03\u7528\u672A\u88AB\u626B\u63CF\u3002\n";
+  if (chain.maxSizeReached) header += "\u26A0\uFE0F \u6CE8\u610F\uFF1A\u7D2F\u8BA1\u6587\u4EF6\u5927\u5C0F\u89E6\u8FBE\u4E0A\u9650\uFF0C\u90E8\u5206\u811A\u672C\u53EF\u80FD\u672A\u88AB\u5B8C\u6574\u8BFB\u53D6\u3002\n";
+  return header + parts.join("\n---\n\n");
+}
+
+// src/engine/llm-analyzer.ts
+import { appendFileSync } from "fs";
+import OpenAI from "openai";
+var llmCache = /* @__PURE__ */ new Map();
+var LLM_CACHE_MAX = 200;
+async function runLLMAnalysis(input, previous) {
+  if (!isLLMAvailable()) {
+    console.log("[AgentMoss] LLM not configured, skipping deep analysis");
+    return {
+      allowed: true,
+      reason: "LLM \u672A\u914D\u7F6E\uFF0C\u8DF3\u8FC7\u6DF1\u5C42\u5206\u6790",
+      riskLevel: "low",
+      riskType: "",
+      confidence: 50,
+      source: "llm",
+      violatedLayers: []
+    };
+  }
+  const globalConfig = getLLMConfig();
+  const config = input.llmConfig?.apiKey ? { ...globalConfig, ...input.llmConfig } : globalConfig;
+  const rawDetail = input.aNext.actionDetail.replace(/^terminal-\w+:\s*command=([^,]+).*/, "$1").trim();
+  const cacheKey = `${input.aNext.actionType}:${rawDetail || input.aNext.actionDetail}`;
+  const cached = llmCache.get(cacheKey);
+  if (cached) {
+    console.log("[AgentMoss] LLM cache hit");
+    return cached;
+  }
+  const matchedSkills = matchSkills(input.aNext.actionType, input.aNext.actionDetail, input.reason);
+  const templates = loadTemplates();
+  let scriptAnalysis;
+  let scriptChainText = "";
+  if (previous.scriptChain) {
+    scriptChainText = formatScriptChainForPrompt(previous.scriptChain);
+  } else {
+    scriptAnalysis = analyzeScriptContent(input.aNext.actionType, input.aNext.actionDetail);
+  }
+  const prompt = buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis, previous.skipL3Hints ?? "", scriptChainText);
+  logPrompt(prompt, input.aNext, previous.llmLogPath);
+  const result = await analyzeWithLLM(prompt, config);
+  if (llmCache.size >= LLM_CACHE_MAX) {
+    const firstKey = llmCache.keys().next().value;
+    if (firstKey) llmCache.delete(firstKey);
+  }
+  llmCache.set(cacheKey, result);
+  return result;
+}
+function logPrompt(prompt, aNext, logPath) {
+  if (!logPath) return;
+  try {
+    const actionType = aNext.actionType || "unknown";
+    const actionDetail = (aNext.actionDetail || "").slice(0, 100);
+    const line = `[${(/* @__PURE__ */ new Date()).toISOString()}] [LLM_PROMPT] action_type=${actionType}, action_detail=${actionDetail}... prompt_length=${prompt.length}
+${prompt}
+--- END PROMPT ---
+`;
+    appendFileSync(logPath, line, "utf-8");
+  } catch (e) {
+    console.warn("[AgentMoss] Failed to write LLM prompt to log:", e);
+  }
+}
+function buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis, skipL3Hints = "", scriptChainText = "") {
+  const skillsText = formatSkillsForPrompt(matchedSkills);
+  const historyStr = input.actionHistory.map((h, i) => `${i + 1}. ${h.actionType}: ${h.actionDetail}`).join("\n") || "(\u65E0\u5386\u53F2\u64CD\u4F5C)";
+  const promptHistoryText = formatPromptHistory(input.promptHistory);
+  const scriptAnalysisText = scriptChainText ? scriptChainText : scriptAnalysis ? formatScriptAnalysisForPrompt(scriptAnalysis) : "";
+  const hintsText = formatHints(previous);
+  const securityJudgeTemplate = templates["security_judge"];
+  if (securityJudgeTemplate) {
+    return securityJudgeTemplate.replaceAll("{prompt_session}", input.promptSession || "\uFF08\u672A\u63D0\u4F9B\uFF09").replaceAll("{prompt_history_text}", promptHistoryText).replaceAll("{action_history}", historyStr).replaceAll("{action_type}", input.aNext.actionType).replaceAll("{action_detail}", input.aNext.actionDetail).replaceAll("{reason}", input.reason || "\u672A\u8BF4\u660E").replaceAll("{skills_text}", skillsText).replaceAll("{hints_text}", hintsText).replaceAll("{script_analysis_text}", scriptAnalysisText).replaceAll("{skip_l3_hints}", skipL3Hints).replaceAll("{{", "{").replaceAll("}}", "}");
+  }
+  console.warn("[AgentMoss] security_judge template missing, using sparse fallback prompt");
+  return `## \u5F53\u524D\u64CD\u4F5C\u4E0A\u4E0B\u6587
+- \u4F1A\u8BDD ID: ${input.sessionId}
+- \u7528\u6237\u4EFB\u52A1: ${input.promptSession || "\u672A\u6307\u5B9A"}
+- \u64CD\u4F5C\u7CFB\u7EDF: ${input.osType}
+- \u5DE5\u4F5C\u76EE\u5F55: ${input.cwd || "/"}
+- \u64CD\u4F5C\u539F\u56E0: ${input.reason || "\u672A\u8BF4\u660E"}
+- \u5386\u53F2\u64CD\u4F5C\u5E8F\u5217:
+${historyStr}
+
+- \u5373\u5C06\u6267\u884C\u7684\u64CD\u4F5C:
+  \u7C7B\u578B: ${input.aNext.actionType}
+  \u8BE6\u60C5: ${input.aNext.actionDetail}
+
+## \u53EF\u7528\u5B89\u5168 Skill
+${skillsText}
+
+## \u524D\u7F6E\u68C0\u6D4B\u7ED3\u679C
+${hintsText}
+${scriptAnalysisText ? `
+## \u811A\u672C\u5185\u5BB9\u5206\u6790
+${scriptAnalysisText}` : ""}
+
+\u8BF7\u6839\u636E\u4EE5\u4E0A\u4FE1\u606F\uFF0C\u5BF9\u5373\u5C06\u6267\u884C\u7684\u64CD\u4F5C\u8FDB\u884C\u5B89\u5168\u5224\u65AD\u3002\u524D\u7F6E\u68C0\u6D4B\u4E3A low/medium \u4E14\u6709\u5408\u7406\u6267\u884C\u7406\u7531\u65F6\u5E94\u5F53\u5141\u8BB8\u3002\u4F60\u5FC5\u987B\u8F93\u51FA\u4E25\u683C\u7684 JSON \u683C\u5F0F\uFF0C\u4E0D\u8981\u5305\u542B\u4EFB\u4F55\u5176\u4ED6\u6587\u5B57\u3001\u6CE8\u91CA\u6216 markdown \u6807\u8BB0\u3002
+
+\u8F93\u51FA\u683C\u5F0F:
+{"allowed": true/false, "reason": "\u5224\u65AD\u7406\u7531", "riskLevel": "low|medium|high|critical", "riskType": "\u98CE\u9669\u7C7B\u578B", "confidence": 0-100}`;
+}
+function formatPromptHistory(promptHistory, maxTextChars = 500) {
+  if (!promptHistory || promptHistory.length === 0) {
+    return "\uFF08\u672A\u63D0\u4F9B\u5386\u53F2\u610F\u56FE\uFF09";
+  }
+  const lines = [];
+  for (let i = 0; i < promptHistory.length; i++) {
+    const turn = promptHistory[i];
+    const text = (typeof turn === "string" ? turn : turn?.text || "").trim();
+    if (!text) continue;
+    let line = `  \u7B2C${i + 1}\u8F6E\u7528\u6237\u610F\u56FE: ${text.slice(0, maxTextChars)}`;
+    const actions = typeof turn === "string" ? void 0 : turn?.actions;
+    if (actions && actions.length > 0) {
+      const types = actions.map((a) => a?.actionType).filter((t) => typeof t === "string" && t.length > 0);
+      if (types.length > 0) {
+        line += `  \u2192 \u52A8\u4F5C: ${types.join(", ")}`;
+      }
+    }
+    lines.push(line);
+  }
+  return lines.length > 0 ? lines.join("\n") : "\uFF08\u672A\u63D0\u4F9B\u5386\u53F2\u610F\u56FE\uFF09";
+}
+function formatHints(previous) {
+  const hints = [];
+  if (previous.heuristic) {
+    hints.push(
+      `\u7279\u5F81\u5339\u914D\u68C0\u6D4B\u53D1\u73B0\u98CE\u9669 [\u98CE\u9669\u7B49\u7EA7: ${previous.heuristic.riskLevel}]:
+   \u7C7B\u578B: ${previous.heuristic.riskType}
+   \u539F\u56E0: ${previous.heuristic.reason}`
+    );
+  }
+  if (previous.logic) {
+    hints.push(
+      `\u903B\u8F91\u89C4\u5219\u68C0\u6D4B\u53D1\u73B0\u98CE\u9669 [\u98CE\u9669\u7B49\u7EA7: ${previous.logic.riskLevel}]:
+   \u7C7B\u578B: ${previous.logic.riskType}
+   \u539F\u56E0: ${previous.logic.reason}`
+    );
+  }
+  return hints.length > 0 ? hints.join("\n\n") : "\u7279\u5F81\u5339\u914D\u68C0\u6D4B\u548C\u903B\u8F91\u89C4\u5219\u68C0\u6D4B\u5747\u672A\u53D1\u73B0\u98CE\u9669\u3002";
+}
+async function analyzeWithLLM(prompt, config) {
+  console.log(`[AgentMoss] LLM analyzing with model: ${config.model}, url: ${config.baseUrl}`);
+  const provider = detectProvider(config.baseUrl, config.provider);
+  const extraHeaders = getProviderHeaders(provider);
+  if (Object.keys(extraHeaders).length > 0) {
+    console.log(`[AgentMoss] Provider detected: ${provider}, injecting headers: ${Object.keys(extraHeaders).join(", ")}`);
+  }
+  const timeoutCfg = getTimeoutConfig();
+  const retryCfg = getRetryConfig();
+  const client = new OpenAI({
+    baseURL: config.baseUrl,
+    apiKey: config.apiKey,
+    // 单次 LLM 调用超时用 prompt1Timeout（对齐 py）；env 覆盖的 config.timeout 仍向后兼容
+    timeout: (config.timeout || timeoutCfg.prompt1Timeout) * 1e3,
+    defaultHeaders: Object.keys(extraHeaders).length > 0 ? extraHeaders : void 0
+  });
+  const maxRetries = parseInt(process.env.AGENT_MOSS_LLM_RETRIES || String(retryCfg.maxRetries), 10);
+  const totalTimeoutMs = timeoutCfg.totalTimeout * 1e3;
+  const abortController = new AbortController();
+  const totalTimeoutTimer = setTimeout(() => {
+    console.error(`[AgentMoss] totalTimeout (${timeoutCfg.totalTimeout}s) exceeded, aborting all LLM calls`);
+    abortController.abort();
+  }, totalTimeoutMs);
+  for (let attempt = 0; attempt <= maxRetries; attempt++) {
+    if (abortController.signal.aborted) {
+      break;
+    }
+    try {
+      const response = await client.chat.completions.create({
+        model: config.model,
+        temperature: config.temperature || 0.1,
+        max_tokens: config.maxTokens || 1024,
+        messages: [
+          { role: "system", content: "\u53EA\u8F93\u51FA\u7EAF JSON\uFF0C\u4E0D\u8981\u5305\u542B markdown \u6807\u8BB0\u3001\u4EE3\u7801\u5757\u6216\u4EFB\u4F55\u5176\u4ED6\u6587\u5B57\u3002" },
+          { role: "user", content: prompt }
+        ],
+        signal: abortController.signal
+      });
+      const content = response.choices[0]?.message?.content || "{}";
+      console.log(`[AgentMoss] LLM raw response (attempt ${attempt + 1}/${maxRetries + 1}): ${content.substring(0, 300)}`);
+      let jsonStr = content.trim();
+      if (jsonStr.startsWith("```")) {
+        jsonStr = jsonStr.replace(/^```[\w]*\n?/, "").replace(/\n?```$/, "");
+      }
+      const parsed = JSON.parse(jsonStr);
+      try {
+        const usage = response.usage;
+        const { recordTokenUsage: recordTokenUsage2 } = await Promise.resolve().then(() => (init_token_stats(), token_stats_exports));
+        recordTokenUsage2({
+          sessionId: "audit",
+          step: "L3_security_judge",
+          model: response.model || config.model,
+          promptTokens: usage?.prompt_tokens || 0,
+          completionTokens: usage?.completion_tokens || 0,
+          totalTokens: usage?.total_tokens || 0
+        });
+      } catch {
+      }
+      clearTimeout(totalTimeoutTimer);
+      const riskLevel = parsed.riskLevel ?? parsed.risk_level;
+      const riskType = parsed.riskType ?? parsed.risk_type;
+      return {
+        allowed: parsed.allowed !== false,
+        reason: parsed.reason || "LLM \u5206\u6790\u5B8C\u6210",
+        riskLevel: ["low", "medium", "high", "critical"].includes(riskLevel) ? riskLevel : "low",
+        riskType: riskType || "",
+        confidence: typeof parsed.confidence === "number" ? Math.min(100, Math.max(0, parsed.confidence)) : 70,
+        source: "llm",
+        violatedLayers: ["3"]
+      };
+    } catch (err) {
+      if (abortController.signal.aborted) {
+        console.error(`[AgentMoss] LLM analysis aborted by totalTimeout (${timeoutCfg.totalTimeout}s)`);
+        break;
+      }
+      if (attempt < maxRetries) {
+        console.error(`[AgentMoss] LLM call failed (attempt ${attempt + 1}/${maxRetries + 1}), retrying in ${retryCfg.retryInterval}s:`, err.message);
+        await new Promise((resolve9) => setTimeout(resolve9, retryCfg.retryInterval * 1e3));
+      } else {
+        clearTimeout(totalTimeoutTimer);
+        console.error("[AgentMoss] LLM call failed after all retries:", err.message);
+        throw new Error(`LLM \u5206\u6790\u5931\u8D25 (${maxRetries + 1} \u6B21\u5C1D\u8BD5): ${err.message}`);
+      }
+    }
+  }
+  clearTimeout(totalTimeoutTimer);
+  throw new Error(`LLM \u5206\u6790\u8D85\u65F6\uFF08totalTimeout ${timeoutCfg.totalTimeout}s\uFF09`);
+}
+
+// src/engine/coordinator.ts
+init_config();
+init_agents();
+init_scenarios();
+
+// src/brain/index.ts
+init_esm_shims();
+
+// src/brain/rule-store.ts
+init_esm_shims();
+import { existsSync as existsSync11, readFileSync as readFileSync12, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
+import { join as join6 } from "path";
+import { homedir as homedir4 } from "os";
+var DEFAULT_RULES_PATH = join6(homedir4(), ".agentmoss", "brain", "rules.json");
+var ENV_RULES_PATH = "AGENT_MOSS_BRAIN_RULES_PATH";
+var STATUS_DRAFT = "draft";
+var STATUS_APPROVED = "approved";
+var STATUS_ACTIVE = "active";
+var STATUS_DISPUTED = "disputed";
+var STATUS_STALE = "stale";
+var STATUS_ARCHIVED = "archived";
+var STATUS_REJECTED = "rejected";
+function getRulesPath() {
+  const envPath = process.env[ENV_RULES_PATH];
+  if (envPath) return envPath;
+  return DEFAULT_RULES_PATH;
+}
+function uuid() {
+  try {
+    return crypto.randomUUID();
+  } catch {
+    return `rule_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
+  }
+}
+var BrainRuleStore = class {
+  path;
+  data;
+  constructor(path5) {
+    this.path = path5 || getRulesPath();
+    this.data = this.load();
+  }
+  load() {
+    if (!existsSync11(this.path)) {
+      return { version: 1, rules: [], pattern_candidates: [] };
+    }
+    try {
+      const raw = JSON.parse(readFileSync12(this.path, "utf-8"));
+      return {
+        version: raw.version || 1,
+        rules: raw.rules || [],
+        pattern_candidates: raw.pattern_candidates || []
+      };
+    } catch {
+      return { version: 1, rules: [], pattern_candidates: [] };
+    }
+  }
+  save() {
+    const dir = this.path.substring(0, this.path.lastIndexOf("/"));
+    if (dir) mkdirSync3(dir, { recursive: true });
+    writeFileSync3(this.path, JSON.stringify(this.data, null, 2), "utf-8");
+  }
+  addRule(rule) {
+    const now = Date.now();
+    const full = {
+      id: rule.id || uuid(),
+      layer: rule.layer,
+      ruleType: rule.ruleType || "deny_pattern",
+      pattern: rule.pattern,
+      scope: rule.scope || "all",
+      source: rule.source || "llm_extracted",
+      sourceEventIds: rule.sourceEventIds || [],
+      confidence: rule.confidence || 0,
+      status: rule.status || STATUS_DRAFT,
+      createdAt: rule.createdAt || now,
+      lastTriggeredAt: rule.lastTriggeredAt || 0,
+      triggerCount: rule.triggerCount || 0,
+      disputedCount: rule.disputedCount || 0,
+      explanation: rule.explanation || "",
+      originNode: rule.originNode || "local"
+    };
+    this.data.rules.push(full);
+    this.save();
+    return full.id;
+  }
+  approveRule(ruleId) {
+    const rule = this.getRule(ruleId);
+    if (!rule) throw new Error(`\u89C4\u5219\u4E0D\u5B58\u5728: ${ruleId}`);
+    if (rule.status !== STATUS_DRAFT) throw new Error(`\u53EA\u6709 draft \u72B6\u6001\u53EF\u5BA1\u6838\uFF0C\u5F53\u524D: ${rule.status}`);
+    rule.status = STATUS_ACTIVE;
+    this.save();
+  }
+  rejectRule(ruleId) {
+    const rule = this.getRule(ruleId);
+    if (!rule) throw new Error(`\u89C4\u5219\u4E0D\u5B58\u5728: ${ruleId}`);
+    if (rule.status !== STATUS_DRAFT) throw new Error(`\u53EA\u6709 draft \u72B6\u6001\u53EF\u62D2\u7EDD\uFF0C\u5F53\u524D: ${rule.status}`);
+    rule.status = STATUS_REJECTED;
+    this.save();
+  }
+  getRule(ruleId) {
+    return this.data.rules.find((r) => r.id === ruleId);
+  }
+  getActiveRules(layer) {
+    return this.data.rules.filter((r) => r.status === STATUS_ACTIVE && (layer === void 0 || r.layer === layer));
+  }
+  getDraftRules() {
+    return this.data.rules.filter((r) => r.status === STATUS_DRAFT).sort((a, b) => b.createdAt - a.createdAt);
+  }
+  recordTrigger(ruleId) {
+    const rule = this.getRule(ruleId);
+    if (!rule) return;
+    rule.triggerCount += 1;
+    rule.lastTriggeredAt = Date.now();
+    this.save();
+  }
+  // --- pattern_candidates ---
+  addPatternCandidate(pattern, layer, scope, sourceEventId, confidence) {
+    const now = Date.now();
+    const existing = this.data.pattern_candidates.find(
+      (c) => c.pattern === pattern && c.layer === layer && c.scope === scope
+    );
+    if (existing) {
+      if (existing.reviewStatus === "rejected") return 0;
+      existing.occurrenceCount += 1;
+      existing.lastSeenAt = now;
+      existing.sourceEventIds.unshift(sourceEventId);
+      this.save();
+      return existing.occurrenceCount;
+    }
+    this.data.pattern_candidates.push({
+      pattern,
+      layer,
+      scope,
+      sourceEventIds: [sourceEventId],
+      confidence,
+      occurrenceCount: 1,
+      firstSeenAt: now,
+      lastSeenAt: now,
+      reviewStatus: "pending",
+      reviewReason: "",
+      reviewedAt: 0
+    });
+    this.save();
+    return 1;
+  }
+  getPatternCandidates(minOccurrences = 3) {
+    return this.data.pattern_candidates.filter((c) => c.occurrenceCount >= minOccurrences && c.reviewStatus !== "rejected").sort((a, b) => b.occurrenceCount - a.occurrenceCount);
+  }
+  getPendingReviewCandidates(minOccurrences = 3) {
+    return this.data.pattern_candidates.filter((c) => c.occurrenceCount >= minOccurrences && c.reviewStatus === "pending").sort((a, b) => b.occurrenceCount - a.occurrenceCount);
+  }
+  isExcludedPattern(pattern, layer, scope) {
+    const c = this.data.pattern_candidates.find(
+      (c2) => c2.pattern === pattern && c2.layer === layer && c2.scope === scope
+    );
+    return !!c && c.reviewStatus === "rejected";
+  }
+  setPatternReviewStatus(pattern, layer, scope, status, reason = "") {
+    const c = this.data.pattern_candidates.find(
+      (c2) => c2.pattern === pattern && c2.layer === layer && c2.scope === scope
+    );
+    if (c) {
+      c.reviewStatus = status;
+      c.reviewReason = reason;
+      c.reviewedAt = Date.now();
+      this.save();
+    }
+  }
+  removePatternCandidate(pattern, layer, scope) {
+    this.data.pattern_candidates = this.data.pattern_candidates.filter(
+      (c) => !(c.pattern === pattern && c.layer === layer && c.scope === scope)
+    );
+    this.save();
+  }
+  getStats() {
+    const count = (status) => this.data.rules.filter((r) => r.status === status).length;
+    return {
+      draft: count(STATUS_DRAFT),
+      approved: count(STATUS_APPROVED),
+      active: count(STATUS_ACTIVE),
+      disputed: count(STATUS_DISPUTED),
+      stale: count(STATUS_STALE),
+      archived: count(STATUS_ARCHIVED),
+      rejected: count(STATUS_REJECTED),
+      total: this.data.rules.length,
+      by_layer: {
+        1: this.data.rules.filter((r) => r.layer === 1 && r.status === STATUS_ACTIVE).length,
+        2: this.data.rules.filter((r) => r.layer === 2 && r.status === STATUS_ACTIVE).length
+      },
+      pattern_candidates: this.data.pattern_candidates.length
+    };
+  }
+};
+
+// src/brain/pattern-extractor.ts
+init_esm_shims();
+var PatternExtractor = class {
+  ruleStore;
+  minConfidence;
+  minOccurrences;
+  builtinPatterns;
+  reviewFn;
+  constructor(ruleStore, opts) {
+    this.ruleStore = ruleStore;
+    this.minConfidence = opts?.minConfidence ?? 0.9;
+    this.minOccurrences = opts?.minOccurrences ?? 3;
+    this.builtinPatterns = opts?.builtinPatterns ?? [];
+    this.reviewFn = opts?.review ?? null;
+  }
+  async extract(event, llmResult) {
+    const result = { rulesCreated: 0, patternsRecorded: 0, skippedReason: "", deduped: [] };
+    const confidence = llmResult.confidence ?? 0;
+    const reason = llmResult.reason ?? "";
+    const riskType = llmResult.riskType ?? "";
+    const actionDetail = llmResult.actionDetail ?? event.actionDetail ?? "";
+    const eventId = event.eventId ?? "";
+    if (confidence < this.minConfidence) {
+      result.skippedReason = `confidence ${confidence} < ${this.minConfidence}`;
+      return result;
+    }
+    const patterns = this.extractPatterns(actionDetail, reason, riskType);
+    if (patterns.length === 0) {
+      result.skippedReason = "no extractable pattern";
+      return result;
+    }
+    for (const p of patterns) {
+      if (this.isCoveredByBuiltin(actionDetail)) {
+        result.deduped.push(p.pattern);
+        continue;
+      }
+      const count = this.ruleStore.addPatternCandidate(
+        p.pattern,
+        p.layer,
+        p.scope,
+        eventId,
+        confidence
+      );
+      if (count === 0) {
+        result.deduped.push(p.pattern);
+        continue;
+      }
+      result.patternsRecorded += 1;
+      if (count >= this.minOccurrences) {
+        const candidates = this.ruleStore.getPatternCandidates(this.minOccurrences);
+        const matched = candidates.find((c) => c.pattern === p.pattern && c.layer === p.layer);
+        if (!matched) continue;
+        if (this.reviewFn) {
+          let review;
+          try {
+            review = await this.reviewFn({
+              pattern: p.pattern,
+              layer: p.layer,
+              ruleType: p.ruleType,
+              actionDetail,
+              reason
+            });
+          } catch {
+            review = null;
+          }
+          if (review === null) {
+            continue;
+          }
+          if (!review.shouldKeep) {
+            this.ruleStore.setPatternReviewStatus(
+              p.pattern,
+              p.layer,
+              p.scope,
+              "rejected",
+              review.reason || "LLM \u5BA1\u6838\u62D2\u7EDD"
+            );
+            result.deduped.push(p.pattern);
+            continue;
+          }
+          this.ruleStore.setPatternReviewStatus(
+            p.pattern,
+            p.layer,
+            p.scope,
+            "approved",
+            review.reason || "LLM \u5BA1\u6838\u901A\u8FC7"
+          );
+        }
+        this.ruleStore.addRule({
+          layer: p.layer,
+          ruleType: p.ruleType,
+          pattern: p.pattern,
+          scope: p.scope,
+          source: "llm_extracted",
+          sourceEventIds: eventId ? [eventId] : [],
+          confidence: matched.confidence,
+          status: STATUS_DRAFT,
+          explanation: `\u4ECE ${count} \u6B21 LLM Deny \u4E2D\u63D0\u53D6(\u7ECF\u5BA1\u6838): ${reason.slice(0, 200)}`
+        });
+        this.ruleStore.removePatternCandidate(p.pattern, p.layer, p.scope);
+        result.rulesCreated += 1;
+      }
+    }
+    return result;
+  }
+  extractPatterns(actionDetail, reason, riskType) {
+    const patterns = [];
+    const detailLower = actionDetail.toLowerCase();
+    const seen = /* @__PURE__ */ new Set();
+    const sensitivePathRe = /(\/(?:etc|root)(?:\/[^\s;|&"'<>`$]*)?|(?:[^\s;|&"'<>`$]*)?\/\.ssh\/[^\s;|&"'<>`$]*|(?:[^\s;|&"'<>`$]*)?\/\.aws\/[^\s;|&"'<>`$]*|\S+\.(?:pem|key|p12|pfx|id_rsa|authorized_keys)\b)/;
+    const m = detailLower.match(sensitivePathRe);
+    if (m) {
+      const gen = this.generalizePath(m[1]);
+      if (!seen.has(gen)) {
+        seen.add(gen);
+        patterns.push({ pattern: gen, layer: 1, scope: "openat", ruleType: "deny_path" });
+      }
+    }
+    const dangerousCmdRe = /\b(rm\s+-[a-zA-Z]*r[a-zA-Z]*f|rm\s+--recursive|chmod\s+777|curl\s+[^|]*\|\s*(?:ba)?sh|wget\s+[^|]*\|\s*(?:ba)?sh|mkfs\.|dd\s+if=|>\s*\/dev\/sd)\b/;
+    const cmdM = detailLower.match(dangerousCmdRe);
+    if (cmdM) {
+      const gen = this.generalizeCommand(cmdM[1]);
+      const seenKey = `cmd:${gen}`;
+      if (!seen.has(seenKey)) {
+        seen.add(seenKey);
+        patterns.push({ pattern: gen, layer: 1, scope: "execve", ruleType: "deny_command" });
+      }
+    }
+    const reasonLower = (reason || "").toLowerCase();
+    if (reasonLower.includes("inject") || reasonLower.includes("\u6570\u636E\u6CE8\u5165")) {
+      patterns.push({
+        pattern: "BEHAVIOR_CHAIN:external_read\u2192sensitive_write",
+        layer: 2,
+        scope: "all",
+        ruleType: "deny_pattern"
+      });
+    }
+    if (reasonLower.includes("reconnaissance") || reasonLower.includes("\u4FA6\u5BDF") || reasonLower.includes("\u63D0\u6743")) {
+      patterns.push({
+        pattern: "BEHAVIOR_CHAIN:multi_config_read\u2192privilege_action",
+        layer: 2,
+        scope: "all",
+        ruleType: "deny_pattern"
+      });
+    }
+    const pathPrefix = `(?:^|[\\s"'(=])`;
+    const pathBody = "(\\/(?:[a-zA-Z0-9_.-]+\\/)+[a-zA-Z0-9_.-]+)";
+    const pathSuffix = `(?=[\\s"')\uFF0C\u3002\uFF09\uFF1B;]|$)`;
+    for (const src of [detailLower, reasonLower]) {
+      const pathRe = new RegExp(pathPrefix + pathBody + pathSuffix, "g");
+      let mm;
+      while ((mm = pathRe.exec(src)) !== null) {
+        const path5 = mm[1];
+        if (path5.split("/").length < 3) continue;
+        if (["/dev/null", "/dev/zero", "/dev/random", "/dev/urandom"].includes(path5)) continue;
+        const gen = this.generalizePath(path5);
+        if (seen.has(gen)) continue;
+        seen.add(gen);
+        patterns.push({ pattern: gen, layer: 1, scope: "openat", ruleType: "deny_path" });
+      }
+    }
+    return patterns;
+  }
+  isCoveredByBuiltin(actionDetail) {
+    if (this.builtinPatterns.length === 0 || !actionDetail) return false;
+    for (const pat of this.builtinPatterns) {
+      try {
+        if (new RegExp(pat, "i").test(actionDetail)) return true;
+      } catch {
+        continue;
+      }
+    }
+    return false;
+  }
+  generalizePath(path5) {
+    const p = path5.toLowerCase();
+    if (/\/etc\/(shadow|passwd|sudoers|security|ssh)/.test(p)) {
+      return "(?:^|[^a-z0-9_-])etc/(?:shadow|passwd|sudoers|security/|ssh/)";
+    }
+    if (p.includes("/etc/")) {
+      return "(?:^|[^a-z0-9_-])etc/";
+    }
+    if (p.includes("/root/")) {
+      return "(?:^|[^a-z0-9_-])root/\\.(?:ssh|gnupg|aws|config)/";
+    }
+    if (p.includes(".ssh/")) {
+      return "(?:^|[^a-z0-9_-])[\\w./-]*/\\.ssh/";
+    }
+    if (p.includes(".aws/")) {
+      return "(?:^|[^a-z0-9_-])[\\w./-]*/\\.aws/";
+    }
+    if (/\.(pem|key|p12|pfx|id_rsa|authorized_keys)\b/.test(p)) {
+      return "[\\w./-]*\\.(?:pem|key|p12|pfx|id_rsa|authorized_keys)(?:$|[^a-z0-9])";
+    }
+    const escaped = p.replace(/^\//, "").replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    return `(?:^|[^a-z0-9_-])${escaped}(?:/|\\b)`;
+  }
+  generalizeCommand(cmd) {
+    if (cmd.includes("rm") && cmd.includes("r") && cmd.includes("f")) {
+      return "rm\\s+(?:-[a-zA-Z]*r[a-zA-Z]*f|--recursive)\\s+/";
+    }
+    if (cmd.includes("chmod")) return "chmod\\s+777";
+    if (cmd.includes("curl") || cmd.includes("wget")) {
+      return "(?:curl|wget)\\s+[^|]*\\|\\s*(?:ba)?sh";
+    }
+    if (cmd.includes("mkfs")) return "mkfs\\.";
+    if (cmd.includes("dd")) return "dd\\s+if=";
+    return cmd.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  }
+};
+
+// src/brain/reviewer.ts
+init_esm_shims();
+init_config();
+import OpenAI2 from "openai";
+var REVIEW_PROMPT = `\u4F60\u662F AgentMoss \u5B89\u5168\u89C4\u5219\u5BA1\u6838\u5668\u3002\u5224\u65AD\u4E0B\u5217"\u4ECE LLM \u62D2\u7EDD\u7ED3\u679C\u4E2D\u63D0\u53D6\u7684\u5B89\u5168\u6A21\u5F0F"\u662F\u5426\u503C\u5F97\u6C89\u6DC0\u4E3A\u672C\u5730\u89C4\u5219\u3002
+
+## \u63D0\u53D6\u7684\u6A21\u5F0F\uFF08\u5019\u9009\uFF09
+- \u6A21\u5F0F: {pattern}
+- \u6240\u5C5E\u5C42: Layer {layer}\uFF081=\u7279\u5F81\u5339\u914D\uFF0C2=\u884C\u4E3A\u94FE\uFF09
+- \u7C7B\u578B: {ruleType}
+
+## \u539F\u59CB\u88AB\u62D2\u7EDD\u7684\u64CD\u4F5C
+{actionDetail}
+
+## LLM \u5F53\u65F6\u7684\u62D2\u7EDD\u7406\u7531
+{reason}
+
+## \u5224\u65AD\u51C6\u5219
+1. **\u662F\u5426\u8FC7\u9AD8\u6CDB\u5316**\uFF1A\u8FD9\u6761\u6A21\u5F0F\u662F\u5426\u4F1A\u8BEF\u62E6\u6B63\u5E38\u7684\u5408\u6CD5\u64CD\u4F5C\uFF1F
+2. **\u662F\u5426\u7B26\u5408\u654F\u611F\u7279\u5F81**\uFF1A\u6307\u5411\u7684\u8DEF\u5F84/\u547D\u4EE4\u662F\u5426\u786E\u5B9E\u654F\u611F\uFF08\u51ED\u636E/\u7CFB\u7EDF\u6587\u4EF6/\u6076\u610F\u547D\u4EE4/\u5916\u4F20\uFF09\uFF1F
+3. **\u4E0E\u4E09\u5C42\u89C4\u5219\u91CD\u590D**\uFF1A\u662F\u5426\u5DF2\u88AB\u73B0\u6709 L1/L2 \u89C4\u5219\u8986\u76D6\uFF1F
+4. **\u662F\u4E0D\u662F\u771F\u5B9E\u653B\u51FB\u6A21\u5F0F**\uFF1A\u662F\u5426\u4EE3\u8868\u4E00\u79CD\u8FDE\u7EED\u7684\u653B\u51FB\u884C\u4E3A\u6A21\u5F0F\uFF1F
+
+## \u8F93\u51FA JSON\uFF08\u53EA\u8F93\u51FA JSON\uFF0C\u65E0\u5176\u4ED6\u6587\u5B57\uFF09
+{"should_keep": true/false, "confidence": 0-100, "reason": "\u7B80\u77ED\u7406\u7531\uFF08\u4E2D\u6587\uFF09", "suggested_rule": "\u82E5\u4FDD\u7559\u5219\u8F93\u51FA\u5EFA\u8BAE\u6B63\u5219\uFF0C\u5426\u5219\u7A7A\u4E32", "duplicate_of": "\u82E5\u91CD\u590D\u5219\u8BF4\u660E\u662F\u54EA\u4E2A\uFF0C\u5426\u5219\u7A7A\u4E32"}`;
+function createBrainReviewer(timeoutMs = 1e4) {
+  return async (opts) => {
+    if (process.env.AGENT_MOSS_BRAIN_REVIEW === "0") return null;
+    if (!isLLMAvailable()) return null;
+    const config = getLLMConfig();
+    const provider = detectProvider(config.baseUrl, config.provider);
+    const extraHeaders = getProviderHeaders(provider);
+    const client = new OpenAI2({
+      baseURL: config.baseUrl,
+      apiKey: config.apiKey,
+      timeout: timeoutMs,
+      maxRetries: 1,
+      defaultHeaders: Object.keys(extraHeaders).length > 0 ? extraHeaders : void 0
+    });
+    const prompt = REVIEW_PROMPT.replace("{pattern}", opts.pattern).replace("{layer}", String(opts.layer)).replace("{ruleType}", opts.ruleType).replace("{actionDetail}", (opts.actionDetail || "").slice(0, 400)).replace("{reason}", (opts.reason || "").slice(0, 400));
+    try {
+      const response = await client.chat.completions.create({
+        model: config.model,
+        temperature: config.temperature || 0.1,
+        max_tokens: 256,
+        messages: [
+          { role: "system", content: "\u53EA\u8F93\u51FA\u7EAF JSON\uFF0C\u4E0D\u8981\u5305\u542B markdown \u6807\u8BB0\u3001\u4EE3\u7801\u5757\u6216\u4EFB\u4F55\u5176\u4ED6\u6587\u5B57\u3002" },
+          { role: "user", content: prompt }
+        ]
+      });
+      const content = response.choices[0]?.message?.content || "";
+      const parsed = parseReview(content);
+      return { shouldKeep: parsed.shouldKeep, reason: parsed.reason };
+    } catch (e) {
+      console.warn(`[AgentMoss] Brain \u5BA1\u6838 LLM \u8C03\u7528\u5931\u8D25\uFF08\u964D\u7EA7\u4FDD\u6301\u5019\u9009\uFF09: ${e.message}`);
+      return null;
+    }
+  };
+}
+function parseReview(content) {
+  let text = content.trim();
+  if (text.startsWith("```")) {
+    text = text.replace(/^```[a-zA-Z]*\n?/, "").replace(/\n?```$/, "");
+  }
+  const match = text.match(/\{[\s\S]*\}/);
+  if (!match) throw new Error(`\u5BA1\u6838\u54CD\u5E94\u65E0 JSON \u5BF9\u8C61: ${text.slice(0, 200)}`);
+  const data = JSON.parse(match[0]);
+  if (!("should_keep" in data) && !("shouldKeep" in data)) {
+    throw new Error(`\u5BA1\u6838\u54CD\u5E94\u7F3A should_keep: ${text.slice(0, 200)}`);
+  }
+  let shouldKeep = data.shouldKeep ?? data.should_keep;
+  if (typeof shouldKeep === "string") {
+    shouldKeep = ["true", "1", "\u662F", "yes"].includes(shouldKeep.trim().toLowerCase());
+  }
+  return {
+    shouldKeep: !!shouldKeep,
+    confidence: Number(data.confidence ?? 0) || 0,
+    reason: String(data.reason ?? data.suggested_rule ?? "") || ""
+  };
+}
+
+// src/brain/index.ts
+function checkBrainRules(store, opts) {
+  if (!store) return null;
+  const rules = store.getActiveRules(opts.layer);
+  if (rules.length === 0) return null;
+  const combined = `${opts.actionType} ${opts.actionDetail}`;
+  for (const rule of rules) {
+    try {
+      if (new RegExp(rule.pattern, "i").test(combined)) {
+        if (opts.layer === 2 && opts.actionHistory) {
+          if (!checkLayer2Context(rule.pattern, opts.actionHistory, opts.actionDetail)) {
+            continue;
+          }
+        }
+        store.recordTrigger(rule.id);
+        return {
+          ruleId: rule.id,
+          pattern: rule.pattern,
+          explanation: rule.explanation,
+          confidence: rule.confidence
+        };
+      }
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+function checkLayer2Context(pattern, actionHistory, actionDetail) {
+  if (pattern.startsWith("BEHAVIOR_CHAIN:")) {
+    const chainType = pattern.replace("BEHAVIOR_CHAIN:", "");
+    if (chainType === "external_read\u2192sensitive_write") {
+      const hasExternalRead = actionHistory.slice(-5).some((h) => /curl|wget|http/i.test(h.actionDetail ?? ""));
+      const isSensitiveWrite = /\.ssh|\.gnupg|authorized_keys|bashrc|profile/i.test(actionDetail);
+      return hasExternalRead && isSensitiveWrite;
+    }
+    if (chainType === "multi_config_read\u2192privilege_action") {
+      const configReads = actionHistory.slice(-5).filter((h) => /\/etc\/|config|\.conf|\.yaml|\.json/i.test(h.actionDetail ?? "")).length;
+      const isPrivilege = /sudo|su |chmod|chown/i.test(actionDetail);
+      return configReads >= 2 && isPrivilege;
+    }
+    return false;
   }
-  console.warn("[AgentMoss] security_judge template missing, using sparse fallback prompt");
-  return `## \u5F53\u524D\u64CD\u4F5C\u4E0A\u4E0B\u6587
-- \u4F1A\u8BDD ID: ${input.sessionId}
-- \u7528\u6237\u4EFB\u52A1: ${input.promptSession || "\u672A\u6307\u5B9A"}
-- \u64CD\u4F5C\u7CFB\u7EDF: ${input.osType}
-- \u5DE5\u4F5C\u76EE\u5F55: ${input.cwd || "/"}
-- \u64CD\u4F5C\u539F\u56E0: ${input.reason || "\u672A\u8BF4\u660E"}
-- \u5386\u53F2\u64CD\u4F5C\u5E8F\u5217:
-${historyStr}
-
-- \u5373\u5C06\u6267\u884C\u7684\u64CD\u4F5C:
-  \u7C7B\u578B: ${input.aNext.actionType}
-  \u8BE6\u60C5: ${input.aNext.actionDetail}
+  return true;
+}
 
-## \u53EF\u7528\u5B89\u5168 Skill
-${skillsText}
+// src/engine/formal-engine/index.ts
+init_esm_shims();
 
-## \u524D\u7F6E\u68C0\u6D4B\u7ED3\u679C
-${hintsText}
-${scriptAnalysisText ? `
-## \u811A\u672C\u5185\u5BB9\u5206\u6790
-${scriptAnalysisText}` : ""}
+// src/engine/formal-engine/engine.ts
+init_esm_shims();
 
-\u8BF7\u6839\u636E\u4EE5\u4E0A\u4FE1\u606F\uFF0C\u5BF9\u5373\u5C06\u6267\u884C\u7684\u64CD\u4F5C\u8FDB\u884C\u5B89\u5168\u5224\u65AD\u3002\u524D\u7F6E\u68C0\u6D4B\u4E3A low/medium \u4E14\u6709\u5408\u7406\u6267\u884C\u7406\u7531\u65F6\u5E94\u5F53\u5141\u8BB8\u3002\u4F60\u5FC5\u987B\u8F93\u51FA\u4E25\u683C\u7684 JSON \u683C\u5F0F\uFF0C\u4E0D\u8981\u5305\u542B\u4EFB\u4F55\u5176\u4ED6\u6587\u5B57\u3001\u6CE8\u91CA\u6216 markdown \u6807\u8BB0\u3002
+// src/engine/formal-engine/builder.ts
+init_esm_shims();
+init_rules_loader();
 
-\u8F93\u51FA\u683C\u5F0F:
-{"allowed": true/false, "reason": "\u5224\u65AD\u7406\u7531", "riskLevel": "low|medium|high|critical", "riskType": "\u98CE\u9669\u7C7B\u578B", "confidence": 0-100}`;
+// src/engine/formal-engine/decode.ts
+init_esm_shims();
+var B64_TOKEN_RE = /[A-Za-z0-9+/]+={0,2}/g;
+function isValidBase64Token(tok) {
+  if (tok.length < 8) return false;
+  if (!(tok.length % 4 === 0 || tok.endsWith("==") || tok.endsWith("="))) return false;
+  return true;
 }
-function formatPromptHistory(promptHistory, maxTextChars = 500) {
-  if (!promptHistory || promptHistory.length === 0) {
-    return "\uFF08\u672A\u63D0\u4F9B\u5386\u53F2\u610F\u56FE\uFF09";
+function isPrintable(s) {
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c < 32 || c > 126) return false;
   }
-  const lines = [];
-  for (let i = 0; i < promptHistory.length; i++) {
-    const turn = promptHistory[i];
-    const text = (typeof turn === "string" ? turn : turn?.text || "").trim();
-    if (!text) continue;
-    let line = `  \u7B2C${i + 1}\u8F6E\u7528\u6237\u610F\u56FE: ${text.slice(0, maxTextChars)}`;
-    const actions = typeof turn === "string" ? void 0 : turn?.actions;
-    if (actions && actions.length > 0) {
-      const types = actions.map((a) => a?.actionType).filter((t) => typeof t === "string" && t.length > 0);
-      if (types.length > 0) {
-        line += `  \u2192 \u52A8\u4F5C: ${types.join(", ")}`;
+  return true;
+}
+function decodeBase64Literals(text) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const m of text.matchAll(B64_TOKEN_RE)) {
+    const tok = m[0];
+    if (!isValidBase64Token(tok)) continue;
+    if (!/[A-Z]/.test(tok) || !/[a-z]/.test(tok)) continue;
+    try {
+      const padded = tok + "=".repeat((4 - tok.length % 4) % 4);
+      const bin = Buffer.from(padded, "base64");
+      const s = bin.toString("utf8");
+      if (s && isPrintable(s) && !seen.has(s)) {
+        seen.add(s);
+        out.push(s);
       }
+    } catch {
     }
-    lines.push(line);
   }
-  return lines.length > 0 ? lines.join("\n") : "\uFF08\u672A\u63D0\u4F9B\u5386\u53F2\u610F\u56FE\uFF09";
+  return out;
 }
-function formatHints(previous) {
-  const hints = [];
-  if (previous.heuristic) {
-    hints.push(
-      `\u7279\u5F81\u5339\u914D\u68C0\u6D4B\u53D1\u73B0\u98CE\u9669 [\u98CE\u9669\u7B49\u7EA7: ${previous.heuristic.riskLevel}]:
-   \u7C7B\u578B: ${previous.heuristic.riskType}
-   \u539F\u56E0: ${previous.heuristic.reason}`
-    );
+function decodeUrlAndNumeric(text) {
+  const out = [];
+  let s = text;
+  for (let i = 0; i < 3; i++) {
+    let nxt = s;
+    try {
+      nxt = decodeURIComponent(s);
+    } catch {
+      break;
+    }
+    if (nxt === s) break;
+    s = nxt;
   }
-  if (previous.logic) {
-    hints.push(
-      `\u903B\u8F91\u89C4\u5219\u68C0\u6D4B\u53D1\u73B0\u98CE\u9669 [\u98CE\u9669\u7B49\u7EA7: ${previous.logic.riskLevel}]:
-   \u7C7B\u578B: ${previous.logic.riskType}
-   \u539F\u56E0: ${previous.logic.reason}`
-    );
+  if (s !== text) out.push(s);
+  if (/\\[0-7]{3}/.test(text)) {
+    let expanded = "";
+    try {
+      expanded = text.replace(/\\[0-7]{3}/g, (m) => String.fromCharCode(parseInt(m.slice(1), 8)));
+    } catch {
+    }
+    if (expanded && expanded !== text) out.push(expanded);
   }
-  return hints.length > 0 ? hints.join("\n\n") : "\u7279\u5F81\u5339\u914D\u68C0\u6D4B\u548C\u903B\u8F91\u89C4\u5219\u68C0\u6D4B\u5747\u672A\u53D1\u73B0\u98CE\u9669\u3002";
+  if (/\\x[0-9a-fA-F]{2}/.test(text)) {
+    let expanded = "";
+    try {
+      expanded = text.replace(/\\x[0-9a-fA-F]{2}/g, (m) => String.fromCharCode(parseInt(m.slice(2), 16)));
+    } catch {
+    }
+    if (expanded && expanded !== text) out.push(expanded);
+  }
+  return out;
 }
-async function analyzeWithLLM(prompt, config) {
-  console.log(`[AgentMoss] LLM analyzing with model: ${config.model}, url: ${config.baseUrl}`);
-  const provider = detectProvider(config.baseUrl, config.provider);
-  const extraHeaders = getProviderHeaders(provider);
-  if (Object.keys(extraHeaders).length > 0) {
-    console.log(`[AgentMoss] Provider detected: ${provider}, injecting headers: ${Object.keys(extraHeaders).join(", ")}`);
+function allCandidates(detail, max = 8) {
+  const cands = [detail];
+  cands.push(...decodeBase64Literals(detail));
+  cands.push(...decodeUrlAndNumeric(detail));
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const c of cands) {
+    if (seen.has(c) || c.length > 4096) continue;
+    seen.add(c);
+    out.push(c);
+    if (out.length >= max) break;
   }
-  const timeoutCfg = getTimeoutConfig();
-  const retryCfg = getRetryConfig();
-  const client = new OpenAI({
-    baseURL: config.baseUrl,
-    apiKey: config.apiKey,
-    // 单次 LLM 调用超时用 prompt1Timeout（对齐 py）；env 覆盖的 config.timeout 仍向后兼容
-    timeout: (config.timeout || timeoutCfg.prompt1Timeout) * 1e3,
-    defaultHeaders: Object.keys(extraHeaders).length > 0 ? extraHeaders : void 0
+  return out;
+}
+function matchStageAny(detail, stages) {
+  for (const cand of allCandidates(detail)) {
+    for (const [name, pats] of Object.entries(stages)) {
+      for (const p of pats) {
+        p.lastIndex = 0;
+        if (p.test(cand)) return name;
+      }
+    }
+  }
+  return "";
+}
+
+// src/engine/formal-engine/builder.ts
+var COMBO_STAGES2 = null;
+function loadStages() {
+  if (COMBO_STAGES2) return COMBO_STAGES2;
+  const combo = loadL2().combo_chains || {};
+  const stages = {};
+  for (const [name, pats] of Object.entries(combo.stages || {})) {
+    stages[name] = pats.map((p) => new RegExp(p, "i"));
+  }
+  COMBO_STAGES2 = stages;
+  return stages;
+}
+var PATH_RE = /(?:^|\s|[@=])((?:\/|~\/)[\w./~-]+)/g;
+function extractResources(actionDetail) {
+  const resources = /* @__PURE__ */ new Set();
+  const text = actionDetail.replace(/'[^']*'|"[^"]*"/g, "");
+  PATH_RE.lastIndex = 0;
+  let m;
+  while ((m = PATH_RE.exec(text)) !== null) {
+    const p = m[1];
+    if (p.startsWith("/dev/") || p.includes("://")) continue;
+    resources.add(p);
+  }
+  return resources;
+}
+function markStage(actionDetail) {
+  return matchStageAny(actionDetail, loadStages());
+}
+function buildSessionGraph(actionHistory, aNext, sessionId = "current") {
+  const nodes = [];
+  const edges = [];
+  const stageFlags = /* @__PURE__ */ new Set();
+  const details = [];
+  for (const a of actionHistory) {
+    const ad = String(a.actionDetail || "");
+    if (ad) details.push({ actionType: String(a.actionType || ""), actionDetail: ad });
+  }
+  if (aNext) {
+    details.push({ actionType: String(aNext.actionType || ""), actionDetail: String(aNext.actionDetail || "") });
+  }
+  details.forEach((d, seq) => {
+    const stage = markStage(d.actionDetail);
+    const node = {
+      sessionId,
+      seq,
+      actionType: d.actionType,
+      actionDetail: d.actionDetail,
+      stage,
+      resources: extractResources(d.actionDetail)
+    };
+    nodes.push(node);
+    if (stage) stageFlags.add(stage);
   });
-  const maxRetries = parseInt(process.env.AGENT_MOSS_LLM_RETRIES || String(retryCfg.maxRetries), 10);
-  const totalTimeoutMs = timeoutCfg.totalTimeout * 1e3;
-  const abortController = new AbortController();
-  const totalTimeoutTimer = setTimeout(() => {
-    console.error(`[AgentMoss] totalTimeout (${timeoutCfg.totalTimeout}s) exceeded, aborting all LLM calls`);
-    abortController.abort();
-  }, totalTimeoutMs);
-  for (let attempt = 0; attempt <= maxRetries; attempt++) {
-    if (abortController.signal.aborted) {
-      break;
+  for (let i = 0; i < nodes.length - 1; i++) {
+    edges.push({ src: i, dst: i + 1, kind: "next" });
+  }
+  return { sessionId, nodes, edges, stageFlags };
+}
+function buildMultiSessionGraph(sessions, aNext) {
+  const mg = { sessions: [], crossEdges: [] };
+  if (!sessions || sessions.length === 0) {
+    mg.sessions.push(buildSessionGraph([], aNext, "current"));
+    return mg;
+  }
+  for (const s of sessions) {
+    const sid = String(s.sessionId || "s");
+    mg.sessions.push(buildSessionGraph(s.actionHistory || [], void 0, sid));
+  }
+  if (aNext) {
+    const last = mg.sessions[mg.sessions.length - 1];
+    if (last.sessionId === "current") {
+      const stage = markStage(String(aNext.actionDetail || ""));
+      last.nodes.push({
+        sessionId: last.sessionId,
+        seq: last.nodes.length,
+        actionType: String(aNext.actionType || ""),
+        actionDetail: String(aNext.actionDetail || ""),
+        stage,
+        resources: extractResources(String(aNext.actionDetail || ""))
+      });
+      if (last.nodes.length > 1) {
+        last.edges.push({ src: last.nodes.length - 2, dst: last.nodes.length - 1, kind: "next" });
+      }
+    } else {
+      mg.sessions.push(buildSessionGraph([], aNext, "current"));
     }
-    try {
-      const response = await client.chat.completions.create({
-        model: config.model,
-        temperature: config.temperature || 0.1,
-        max_tokens: config.maxTokens || 1024,
-        messages: [
-          { role: "system", content: "\u53EA\u8F93\u51FA\u7EAF JSON\uFF0C\u4E0D\u8981\u5305\u542B markdown \u6807\u8BB0\u3001\u4EE3\u7801\u5757\u6216\u4EFB\u4F55\u5176\u4ED6\u6587\u5B57\u3002" },
-          { role: "user", content: prompt }
-        ],
-        signal: abortController.signal
+  }
+  addCrossDataEdges(mg);
+  return mg;
+}
+function addCrossDataEdges(mg) {
+  const nodes = allNodesFlat(mg);
+  if (nodes.length < 2) return;
+  for (let i = 0; i < nodes.length; i++) {
+    for (let j = i + 1; j < nodes.length; j++) {
+      if (nodes[i].sessionId === nodes[j].sessionId) continue;
+      const shared = intersect(nodes[i].resources, nodes[j].resources);
+      if (shared.size > 0) {
+        mg.crossEdges.push({ src: i, dst: j, kind: "data" });
+      }
+    }
+  }
+}
+function allNodesFlat(mg) {
+  const out = [];
+  for (const s of mg.sessions) out.push(...s.nodes);
+  return out;
+}
+function intersect(a, b) {
+  const out = /* @__PURE__ */ new Set();
+  for (const v of a) if (b.has(v)) out.add(v);
+  return out;
+}
+
+// src/engine/formal-engine/ir.ts
+init_esm_shims();
+function allNodes(mg) {
+  const out = [];
+  for (const s of mg.sessions) out.push(...s.nodes);
+  return out;
+}
+function allEdges(mg) {
+  const out = [];
+  for (const s of mg.sessions) out.push(...s.edges);
+  out.push(...mg.crossEdges);
+  return out;
+}
+function emptyVerificationResult() {
+  return { verified: true, violations: [] };
+}
+
+// src/engine/formal-engine/properties.ts
+init_esm_shims();
+init_rules_loader();
+var CROSS_SESSION_CHAINS = null;
+function loadCrossSessionChains() {
+  if (CROSS_SESSION_CHAINS) return CROSS_SESSION_CHAINS;
+  const combo = loadL2().combo_chains || {};
+  CROSS_SESSION_CHAINS = (combo.chains || []).map((c) => ({
+    id: String(c.id || "combo_chain"),
+    stages: c.stages || [],
+    riskLevel: String(c.riskLevel || c.risk_level || "high"),
+    reason: "\u8DE8\u4F1A\u8BDD" + String(c.reason || "\u7EC4\u5408\u653B\u51FB\u94FE")
+  }));
+  return CROSS_SESSION_CHAINS;
+}
+var CRED_FILE_RE = /(known_hosts|\.ssh|id_rsa|\/etc\/shadow|\/etc\/passwd|credentials)/i;
+var EXFIL_RE = /https?:\/\/|scp\s+.*@|rsync\s+.*@/i;
+function checkCrossSessionChain(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length === 0) return violations;
+  for (const chain of loadCrossSessionChains()) {
+    const stages = chain.stages;
+    if (!stages.length) continue;
+    let matched = 0;
+    let stageIdx = 0;
+    const path5 = [];
+    for (const n of nodes) {
+      if (stageIdx < stages.length && n.stage === stages[stageIdx]) {
+        matched += 1;
+        path5.push({ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) });
+        stageIdx += 1;
+        if (matched >= stages.length) break;
+      }
+    }
+    if (matched >= stages.length) {
+      violations.push({
+        propertyId: "cross-" + chain.id,
+        reason: chain.reason,
+        riskLevel: chain.riskLevel,
+        path: path5
       });
-      const content = response.choices[0]?.message?.content || "{}";
-      console.log(`[AgentMoss] LLM raw response (attempt ${attempt + 1}/${maxRetries + 1}): ${content.substring(0, 300)}`);
-      let jsonStr = content.trim();
-      if (jsonStr.startsWith("```")) {
-        jsonStr = jsonStr.replace(/^```[\w]*\n?/, "").replace(/\n?```$/, "");
+    }
+  }
+  return violations;
+}
+function checkSensitiveDataFlow(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length === 0) return violations;
+  const tainted = /* @__PURE__ */ new Map();
+  for (let i = 0; i < nodes.length; i++) {
+    const n = nodes[i];
+    if (n.stage === "CRED" && [...n.resources].some((r) => CRED_FILE_RE.test(r))) {
+      tainted.set(i, `${n.sessionId}#${n.seq} \u8BBF\u95EE ${[...n.resources][0]}`);
+    }
+  }
+  if (tainted.size === 0) return violations;
+  const edges = allEdges(graph);
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const e of edges) {
+      if (tainted.has(e.src) && !tainted.has(e.dst)) {
+        const srcRes = nodes[e.src].resources;
+        const dstRes = nodes[e.dst].resources;
+        for (const r of srcRes) {
+          if (dstRes.has(r)) {
+            tainted.set(e.dst, tainted.get(e.src));
+            changed = true;
+            break;
+          }
+        }
       }
-      const parsed = JSON.parse(jsonStr);
+    }
+  }
+  for (const [i, n] of nodes.entries()) {
+    if (tainted.has(i) && EXFIL_RE.test(n.actionDetail)) {
+      violations.push({
+        propertyId: "sensitive-data-exfil",
+        reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${tainted.get(i)} \u2192 ${n.sessionId}#${n.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
+        riskLevel: "critical",
+        path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
+      });
+    }
+  }
+  return violations;
+}
+var EBPF_NET_RE = /connect|sendto|network_connect/i;
+var REMOTE_RE = /to\s+\d+\.\d+\.\d+\.\d+|remote_addr/i;
+var PRIVESC_RE = /\bsudo\b|\bsu\b|chmod\s+u\s*\+\s*s|pkexec|setuid/i;
+var EXFIL_ACTION_RE = /\bcurl\b|\bwget\b|\bscp\b|\brsync\b|\brclone\b|\bftp\b|connect\s+.*\d+\.\d+\.\d+\.\d+|open\s+.*tcp|base64\s+.*\-o/i;
+var CRED_STRICT_RE = /(known_hosts|\.ssh|id_rsa|\.pem|\b\.key\b|\/etc\/shadow|\/etc\/passwd|\.aws\/credentials|credentials\.json|netrc|password|secrets?\.ya?ml|credentials?\s*(file|path)?\s*(=|\:)|\bconfig.*(password|token))/i;
+function isExfilNode(n) {
+  if (n.stage === "EXFIL") return true;
+  if (EXFIL_RE.test(n.actionDetail) && EXFIL_ACTION_RE.test(n.actionDetail)) return true;
+  if (EBPF_NET_RE.test(n.actionDetail) && REMOTE_RE.test(n.actionDetail)) return true;
+  return false;
+}
+function isCredNode(n) {
+  if (n.stage !== "CRED") return false;
+  for (const r of n.resources) {
+    if (CRED_STRICT_RE.test(r)) return true;
+  }
+  return CRED_STRICT_RE.test(n.actionDetail);
+}
+function isPrivescNode(n) {
+  if (n.stage === "PRIVESC") return true;
+  return PRIVESC_RE.test(n.actionDetail);
+}
+function checkNeverExfilAfterPrivesc(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length < 2) return violations;
+  for (let i = 0; i < nodes.length; i++) {
+    if (!isPrivescNode(nodes[i])) continue;
+    for (let j = i + 1; j < nodes.length; j++) {
+      if (isExfilNode(nodes[j])) {
+        violations.push({
+          propertyId: "no-privesc-then-exfil",
+          reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\xAC\u25C7EXFIL)",
+          riskLevel: "critical",
+          path: [
+            { sessionId: nodes[i].sessionId, seq: nodes[i].seq, detail: nodes[i].actionDetail.slice(0, 60) },
+            { sessionId: nodes[j].sessionId, seq: nodes[j].seq, detail: nodes[j].actionDetail.slice(0, 60) }
+          ]
+        });
+        return violations;
+      }
+    }
+  }
+  return violations;
+}
+function checkNeverExfilAfterCred(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length < 2) return violations;
+  for (let i = 0; i < nodes.length; i++) {
+    if (!isCredNode(nodes[i])) continue;
+    for (let j = i + 1; j < nodes.length; j++) {
+      if (isExfilNode(nodes[j])) {
+        violations.push({
+          propertyId: "no-cred-then-exfil",
+          reason: "\u8BFB\u53D6\u51ED\u636E\u540E\u51FA\u73B0\u5916\u4F20\uFF0C\u8FDD\u53CD \u25A1(CRED\u2192\xAC\u25C7EXFIL)",
+          riskLevel: "critical",
+          path: [
+            { sessionId: nodes[i].sessionId, seq: nodes[i].seq, detail: nodes[i].actionDetail.slice(0, 60) },
+            { sessionId: nodes[j].sessionId, seq: nodes[j].seq, detail: nodes[j].actionDetail.slice(0, 60) }
+          ]
+        });
+        return violations;
+      }
+    }
+  }
+  return violations;
+}
+var ALL_PROPERTIES = [
+  { id: "cross-session-chain", check: checkCrossSessionChain },
+  { id: "sensitive-data-flow", check: checkSensitiveDataFlow },
+  { id: "no-privesc-then-exfil", check: checkNeverExfilAfterPrivesc },
+  { id: "no-cred-then-exfil", check: checkNeverExfilAfterCred }
+];
+
+// src/engine/formal-engine/engine.ts
+function ebpfEventToDetail(e) {
+  const parts = [];
+  const syscall = String(e.syscall || e.op || "");
+  const argv = String(e.argv || e.pathname || "");
+  const remote = String(e.remote_addr || "");
+  const port = e.remote_port;
+  if (syscall) parts.push(syscall);
+  if (argv && argv !== "" && argv !== "None") parts.push(argv);
+  if (remote) parts.push("to " + remote + (port ? ":" + String(port) : ""));
+  return parts.join(" ");
+}
+var FormalEngine = class {
+  properties;
+  constructor(properties) {
+    this.properties = properties && properties.length > 0 ? properties : ALL_PROPERTIES;
+  }
+  verify(sessions, aNext, ebpfEvents) {
+    const all = sessions ? [...sessions] : [];
+    if (ebpfEvents && ebpfEvents.length > 0) {
+      all.push({
+        sessionId: "ebpf-evidence",
+        actionHistory: ebpfEvents.map((e) => ({
+          actionType: "syscall",
+          actionDetail: ebpfEventToDetail(e)
+        }))
+      });
+    }
+    const graph = buildMultiSessionGraph(all, aNext);
+    const result = emptyVerificationResult();
+    for (const prop of this.properties) {
+      let violations;
       try {
-        const usage = response.usage;
-        const { recordTokenUsage: recordTokenUsage2 } = await Promise.resolve().then(() => (init_token_stats(), token_stats_exports));
-        recordTokenUsage2({
-          sessionId: "audit",
-          step: "L3_security_judge",
-          model: response.model || config.model,
-          promptTokens: usage?.prompt_tokens || 0,
-          completionTokens: usage?.completion_tokens || 0,
-          totalTokens: usage?.total_tokens || 0
+        violations = prop.check(graph);
+      } catch (e) {
+        result.verified = false;
+        result.violations.push({
+          propertyId: prop.id,
+          reason: `\u5F62\u5F0F\u5316\u6027\u8D28\u9A8C\u8BC1\u5F02\u5E38\uFF0C\u4FDD\u5B88\u62E6\u622A: ${e}`,
+          riskLevel: "medium",
+          path: []
         });
-      } catch {
+        return result;
       }
-      clearTimeout(totalTimeoutTimer);
-      const riskLevel = parsed.riskLevel ?? parsed.risk_level;
-      const riskType = parsed.riskType ?? parsed.risk_type;
-      return {
-        allowed: parsed.allowed !== false,
-        reason: parsed.reason || "LLM \u5206\u6790\u5B8C\u6210",
-        riskLevel: ["low", "medium", "high", "critical"].includes(riskLevel) ? riskLevel : "low",
-        riskType: riskType || "",
-        confidence: typeof parsed.confidence === "number" ? Math.min(100, Math.max(0, parsed.confidence)) : 70,
-        source: "llm",
-        violatedLayers: ["3"]
-      };
-    } catch (err) {
-      if (abortController.signal.aborted) {
-        console.error(`[AgentMoss] LLM analysis aborted by totalTimeout (${timeoutCfg.totalTimeout}s)`);
+      if (violations.length > 0) {
+        result.verified = false;
+        result.violations.push(...violations);
         break;
       }
-      if (attempt < maxRetries) {
-        console.error(`[AgentMoss] LLM call failed (attempt ${attempt + 1}/${maxRetries + 1}), retrying in ${retryCfg.retryInterval}s:`, err.message);
-        await new Promise((resolve7) => setTimeout(resolve7, retryCfg.retryInterval * 1e3));
-      } else {
-        clearTimeout(totalTimeoutTimer);
-        console.error("[AgentMoss] LLM call failed after all retries:", err.message);
-        throw new Error(`LLM \u5206\u6790\u5931\u8D25 (${maxRetries + 1} \u6B21\u5C1D\u8BD5): ${err.message}`);
-      }
     }
+    return result;
   }
-  clearTimeout(totalTimeoutTimer);
-  throw new Error(`LLM \u5206\u6790\u8D85\u65F6\uFF08totalTimeout ${timeoutCfg.totalTimeout}s\uFF09`);
-}
+};
+
+// src/engine/formal-engine/stateful.ts
+init_esm_shims();
+init_rules_loader();
+
+// src/engine/formal-engine/chain_state.ts
+init_esm_shims();
+import * as fs4 from "fs";
+import * as os2 from "os";
+import * as path4 from "path";
+import { createHash } from "crypto";
 
 // src/engine/coordinator.ts
-init_config();
-init_agents();
 var FULLY_SAFE_TOOLS = /* @__PURE__ */ new Set([
   "ask_user_question",
   "glob",
@@ -4014,6 +6588,24 @@ function extractRawCommand(detail) {
 function matchesAny(cmd, patterns) {
   return patterns.some((p) => p.test(cmd));
 }
+var _brainStore = null;
+var _brainExtractor = null;
+var _brainInitialized = false;
+function getBrainStore() {
+  if (!isBrainEnabled()) return null;
+  if (!_brainInitialized) {
+    _brainStore = new BrainRuleStore();
+    _brainExtractor = new PatternExtractor(_brainStore, { review: createBrainReviewer() });
+    _brainInitialized = true;
+  }
+  return _brainStore;
+}
+function _resetBrainForTest() {
+  _brainStore = null;
+  _brainExtractor = null;
+  _brainInitialized = false;
+}
+var formalEngine = new FormalEngine();
 async function runAnalysis(input) {
   const heuristicResult = isHeuristicEnabled() ? runHeuristicCheck(input) : null;
   const isInlineScriptCmd = isInlineScriptCommand(input.aNext.actionDetail.toLowerCase());
@@ -4046,10 +6638,32 @@ async function runAnalysis(input) {
       }
     }
   }
+  const brainStore = getBrainStore();
+  if (brainStore) {
+    const brainL1 = checkBrainRules(brainStore, {
+      layer: 1,
+      actionType: input.aNext.actionType,
+      actionDetail: input.aNext.actionDetail
+    });
+    if (brainL1) {
+      return {
+        allowed: false,
+        reason: `[Brain L1] ${brainL1.explanation}`,
+        riskLevel: "high",
+        riskType: "brain_rule",
+        confidence: Math.round(brainL1.confidence * 100),
+        source: "brain_rule",
+        violatedLayers: ["brain_L1"]
+      };
+    }
+  }
   const actionType = input.aNext.actionType.toLowerCase();
   const rawDetail = extractRawCommand(input.aNext.actionDetail);
   const lowerDetail = rawDetail.toLowerCase();
-  const agentExt = getAgentExtensions(input.agentId);
+  const agentExt = mergeAgentExtensions(
+    getAgentExtensions(input.agentId),
+    getScenarioExtensions(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "")
+  );
   if (FULLY_SAFE_TOOLS.has(actionType)) {
     return {
       allowed: true,
@@ -4154,6 +6768,28 @@ async function runAnalysis(input) {
       return effectiveResult;
     }
   }
+  if (isLogicRulesEnabled()) {
+    const formalSessions = [];
+    if (input.sessionHistory) {
+      for (const s of input.sessionHistory) {
+        formalSessions.push({ sessionId: s.sessionId || "s", actionHistory: s.actionHistory || [] });
+      }
+    }
+    formalSessions.push({ sessionId: "current", actionHistory: input.actionHistory });
+    const formalResult = formalEngine.verify(formalSessions, input.aNext);
+    if (!formalResult.verified) {
+      const v = formalResult.violations[0];
+      return {
+        allowed: false,
+        reason: v ? v.reason : "\u5F62\u5F0F\u5316\u9A8C\u8BC1\u672A\u901A\u8FC7\uFF08\u884C\u4E3A\u6027\u8D28\u8FDD\u53CD\uFF09",
+        riskLevel: v ? v.riskLevel : "high",
+        riskType: "formal_verification",
+        confidence: 90,
+        source: "formal_engine",
+        violatedLayers: ["2.4"]
+      };
+    }
+  }
   if (scriptChain && scriptChain.nodes.length > 0 && isLogicRulesEnabled()) {
     for (const node of scriptChain.nodes) {
       if (node.error || !node.preprocessedContent) continue;
@@ -4171,6 +6807,25 @@ async function runAnalysis(input) {
       }
     }
   }
+  if (brainStore) {
+    const brainL2 = checkBrainRules(brainStore, {
+      layer: 2,
+      actionType: input.aNext.actionType,
+      actionDetail: input.aNext.actionDetail,
+      actionHistory: input.actionHistory
+    });
+    if (brainL2) {
+      return {
+        allowed: false,
+        reason: `[Brain L2] ${brainL2.explanation}`,
+        riskLevel: "high",
+        riskType: "brain_rule",
+        confidence: Math.round(brainL2.confidence * 100),
+        source: "brain_rule",
+        violatedLayers: ["brain_L2"]
+      };
+    }
+  }
   if (skipLLM || !isLLMAvailable()) {
     return {
       allowed: true,
@@ -4237,10 +6892,25 @@ async function runAnalysis(input) {
       violatedLayers: ["3"]
     };
   }
+  if (!llmResult.allowed && llmResult.confidence && llmResult.confidence >= 90 && _brainExtractor) {
+    try {
+      await _brainExtractor.extract(
+        { actionDetail: input.aNext.actionDetail, eventId: "" },
+        {
+          confidence: llmResult.confidence / 100,
+          reason: llmResult.reason || "",
+          riskType: llmResult.riskType || "",
+          actionDetail: input.aNext.actionDetail
+        }
+      );
+    } catch {
+    }
+  }
   return llmResult;
 }
 export {
   TRUSTED_SKILLS_BASE,
+  _resetBrainForTest,
   runAnalysis
 };
 //# sourceMappingURL=coordinator.js.map