@kenhkl/agent-moss 0.12.7 → 0.12.8

package/dist/cli.js

@@ -771,6 +771,53 @@ function runLogicCheck(input) {
   if (pwdResult) return pwdResult;
   const userDelResult = checkUserDeletionConsent(actionType, actionDetail, actionHistory);
   if (userDelResult) return userDelResult;
+  const comboResult = checkComboChain(actionHistory, aNext.actionDetail);
+  if (comboResult) return comboResult;
+  return null;
+}
+function checkComboChain(actionHistory, actionDetailRaw) {
+  INLINE_SCRIPT_RE.lastIndex = 0;
+  if (INLINE_SCRIPT_RE.test(actionDetailRaw)) return null;
+  const details = [];
+  for (const h of actionHistory) {
+    if (h.actionDetail) details.push(h.actionDetail.toLowerCase());
+  }
+  details.push(actionDetailRaw.toLowerCase());
+  const seq = details.map((d) => {
+    const hits = /* @__PURE__ */ new Set();
+    for (const [stage, pats] of Object.entries(COMBO_STAGES)) {
+      if (pats.some((p) => {
+        p.lastIndex = 0;
+        return p.test(d);
+      })) hits.add(stage);
+    }
+    return hits;
+  });
+  for (const chain of COMBO_CHAINS) {
+    const chainStages = chain.stages;
+    if (!chainStages.length || chain.min_stages <= 0) continue;
+    let matched = 0;
+    let stageIdx = 0;
+    for (const hits of seq) {
+      if (stageIdx < chainStages.length && hits.has(chainStages[stageIdx])) {
+        matched += 1;
+        stageIdx += 1;
+        if (matched >= chain.min_stages) break;
+      }
+    }
+    if (matched >= chain.min_stages) {
+      const riskLevel = chain.risk_level === "critical" || chain.risk_level === "high" || chain.risk_level === "medium" || chain.risk_level === "low" ? chain.risk_level : "high";
+      return {
+        allowed: false,
+        reason: chain.reason,
+        riskLevel,
+        riskType: "combo_chain",
+        confidence: 85,
+        source: "logic_rule",
+        violatedLayers: ["2"]
+      };
+    }
+  }
   return null;
 }
 function extractFilePaths(text) {
@@ -870,17 +917,17 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
     }
   }
   const unreadPaths = [];
-  for (const path3 of uniqueTargetPaths) {
+  for (const path6 of uniqueTargetPaths) {
     const hasRead = [...historyReadPaths].some(
-      (rp) => path3 === rp || path3.startsWith(rp) || rp.startsWith(path3)
+      (rp) => path6 === rp || path6.startsWith(rp) || rp.startsWith(path6)
     );
     if (!hasRead) {
-      let isCreate = !fs2.existsSync(path3);
+      let isCreate = !fs2.existsSync(path6);
       if (!isCreate) {
         isCreate = CREATE_KEYWORDS.some((kw) => reason.toLowerCase().includes(kw) || actionDetail.includes(kw));
       }
       if (!isCreate) {
-        unreadPaths.push(path3);
+        unreadPaths.push(path6);
       }
     }
   }
@@ -1023,7 +1070,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
     violatedLayers: ["2"]
   };
 }
-var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, WRITE_KEYWORDS, WRITE_COMMAND_RES, READ_ONLY_COMMANDS, DEVNULL_REDIRECT_RE, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
+var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, WRITE_KEYWORDS, WRITE_COMMAND_RES, READ_ONLY_COMMANDS, DEVNULL_REDIRECT_RE, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
 var init_logic_rules = __esm({
   "src/engine/logic-rules.ts"() {
     "use strict";
@@ -1032,7 +1079,7 @@ var init_logic_rules = __esm({
     init_rules_loader();
     ROOT_SENSITIVE_PATHS = _loadSensitivePathScope("root");
     HOME_SENSITIVE_PATHS = _loadSensitivePathScope("home");
-    CREDENTIAL_PATHS = _loadSensitivePathScope("credential").map(({ path: path3, riskLevel, desc }) => ({ path: path3, riskLevel, desc, credential: true }));
+    CREDENTIAL_PATHS = _loadSensitivePathScope("credential").map(({ path: path6, riskLevel, desc }) => ({ path: path6, riskLevel, desc, credential: true }));
     NON_WRITE_TOOLS = /* @__PURE__ */ new Set([
       "ask_user_question",
       "glob",
@@ -1176,6 +1223,24 @@ var init_logic_rules = __esm({
         reason: p.reason
       }));
     })();
+    COMBO_STAGES = (() => {
+      const combo = loadL2().combo_chains || {};
+      const stages = {};
+      for (const [name, pats] of Object.entries(combo.stages || {})) {
+        stages[name] = pats.map((p) => new RegExp(p, "i"));
+      }
+      return stages;
+    })();
+    COMBO_CHAINS = (() => {
+      const combo = loadL2().combo_chains || {};
+      return (combo.chains || []).map((c) => ({
+        id: String(c.id || "combo_chain"),
+        stages: c.stages || [],
+        min_stages: Number(c.min_stages) || (c.stages || []).length,
+        risk_level: String(c.risk_level || "high"),
+        reason: String(c.reason || "\u68C0\u6D4B\u5230\u7EC4\u5408\u653B\u51FB\u94FE")
+      }));
+    })();
     INLINE_SCRIPT_RE = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
     DIR_TRAVERSAL_KW = [
       "os.listdir",
@@ -1293,9 +1358,11 @@ __export(runtime_config_exports, {
   addAgentRule: () => addAgentRule,
   addCustomRule: () => addCustomRule,
   addCustomSkill: () => addCustomSkill,
+  addScenarioRule: () => addScenarioRule,
   deleteAgentRule: () => deleteAgentRule,
   deleteCustomRule: () => deleteCustomRule,
   deleteCustomSkill: () => deleteCustomSkill,
+  deleteScenarioRule: () => deleteScenarioRule,
   filterEnabledRules: () => filterEnabledRules,
   generateSourceDefaults: () => generateSourceDefaults,
   getAgentRules: () => getAgentRules,
@@ -1314,9 +1381,11 @@ __export(runtime_config_exports, {
   getEnabledL2SensitivePathsOrDefault: () => getEnabledL2SensitivePathsOrDefault,
   getEnabledL2UserDeletionPatterns: () => getEnabledL2UserDeletionPatterns,
   getEnabledL2UserDeletionPatternsOrDefault: () => getEnabledL2UserDeletionPatternsOrDefault,
+  getEnabledScenarioExtensions: () => getEnabledScenarioExtensions,
   getEnvOverrides: () => getEnvOverrides,
   getProfileOrDetect: () => getProfileOrDetect,
   getRuntimeConfigPath: () => getRuntimeConfigPath,
+  getScenarioRules: () => getScenarioRules,
   hasRuntimeConfig: () => hasRuntimeConfig,
   isL2CategoryEnabled: () => isL2CategoryEnabled,
   isLayerEnabled: () => isLayerEnabled,
@@ -1330,6 +1399,8 @@ __export(runtime_config_exports, {
   updateRuleDenyMode: () => updateRuleDenyMode,
   updateRuleEnabled: () => updateRuleEnabled,
   updateRuleSkipL3: () => updateRuleSkipL3,
+  updateScenarioCategoryEnabled: () => updateScenarioCategoryEnabled,
+  updateScenarioRuleEnabled: () => updateScenarioRuleEnabled,
   updateSkillCategoryEnabled: () => updateSkillCategoryEnabled,
   updateSkillEnabled: () => updateSkillEnabled
 });
@@ -1358,7 +1429,8 @@ function emptyRuntimeConfig() {
     L1_rules: {},
     L2_rules: {},
     L3_skills: {},
-    agent_rules: {}
+    agent_rules: {},
+    scenario_rules: {}
   };
 }
 function loadRuntimeConfig() {
@@ -1384,7 +1456,8 @@ function loadRuntimeConfig() {
       L1_rules: merged.L1_rules || {},
       L2_rules: merged.L2_rules || {},
       L3_skills: merged.L3_skills || {},
-      agent_rules: merged.agent_rules || {}
+      agent_rules: merged.agent_rules || {},
+      scenario_rules: merged.scenario_rules || {}
     };
   } catch {
     return emptyRuntimeConfig();
@@ -1619,6 +1692,55 @@ function _l3SkillsToRules() {
   out.user_custom = { category_enabled: true, category_desc: "", skills: [] };
   return out;
 }
+function _scenarioRulesToDefaults() {
+  const out = {};
+  const scenDir = existsSync4(_SCENARIOS_DIR_PROD) ? _SCENARIOS_DIR_PROD : existsSync4(_SCENARIOS_DIR_DEV) ? _SCENARIOS_DIR_DEV : _SCENARIOS_DIR_PROD;
+  if (!existsSync4(scenDir)) return out;
+  let entries;
+  try {
+    entries = readdirSync3(scenDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+  } catch {
+    return out;
+  }
+  for (const scenarioId of entries) {
+    const rulesFile = join2(scenDir, scenarioId, "rules.json");
+    if (!existsSync4(rulesFile)) continue;
+    let data;
+    try {
+      data = JSON.parse(readFileSync4(rulesFile, "utf-8"));
+    } catch {
+      continue;
+    }
+    out[scenarioId] = {
+      builtin_safe_action_types: {
+        category_enabled: true,
+        category_desc: "\u573A\u666F\u5B8C\u5168\u5B89\u5168\u64CD\u4F5C\u767D\u540D\u5355\uFF08\u573A\u666F\u901A\u5E38\u4E0D\u4F7F\u7528\uFF09",
+        rules: []
+      },
+      builtin_safe_skills: {
+        category_enabled: true,
+        category_desc: "\u573A\u666F\u4FE1\u4EFB\u7684\u5185\u7F6E Skill\uFF08\u573A\u666F\u901A\u5E38\u4E0D\u4F7F\u7528\uFF09",
+        rules: []
+      },
+      extra_command_patterns: {
+        category_enabled: true,
+        category_desc: "\u573A\u666F\u4E13\u5C5E\u5371\u9669\u547D\u4EE4\u6B63\u5219\uFF08L1 \u672B\u5C3E\u8FFD\u52A0\uFF09",
+        rules: (data.extra_command_patterns || []).map((p) => ({ ...p, enabled: true, builtin: true }))
+      },
+      extra_injection_keywords: {
+        category_enabled: true,
+        category_desc: "\u573A\u666F\u4E13\u5C5E\u6CE8\u5165\u5173\u952E\u8BCD\uFF08L1 \u672B\u5C3E\u8FFD\u52A0\uFF09",
+        rules: (data.extra_injection_keywords || []).map((k) => ({ ...k, enabled: true, builtin: true }))
+      },
+      extra_sensitive_paths: {
+        category_enabled: true,
+        category_desc: "\u573A\u666F\u4E13\u5C5E\u654F\u611F\u8DEF\u5F84\uFF08L1 \u672B\u5C3E\u8FFD\u52A0\uFF09",
+        rules: (data.extra_sensitive_paths || []).map((sp) => ({ ...sp, enabled: true, builtin: true }))
+      }
+    };
+  }
+  return out;
+}
 function _agentRulesToDefaults() {
   const out = {};
   const agentsDir = existsSync4(_AGENTS_DIR_PROD) ? _AGENTS_DIR_PROD : existsSync4(_AGENTS_DIR_DEV) ? _AGENTS_DIR_DEV : _AGENTS_DIR_PROD;
@@ -1710,7 +1832,8 @@ function generateSourceDefaults() {
       user_custom: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49 L2 \u903B\u8F91\u89C4\u5219", rules: [] }
     },
     L3_skills: _l3SkillsToRules(),
-    agent_rules: _agentRulesToDefaults()
+    agent_rules: _agentRulesToDefaults(),
+    scenario_rules: _scenarioRulesToDefaults()
   };
 }
 function normalizePatternForFingerprint(pattern) {
@@ -1803,9 +1926,9 @@ function _mergeSkillCategories(userCfg, srcDefaults, layerKey) {
     }
   }
 }
-function _mergeAgentRules(userCfg, srcDefaults) {
-  const userAgent = userCfg.agent_rules || (userCfg.agent_rules = {});
-  const srcAgent = srcDefaults.agent_rules || {};
+function _mergeAgentRules(userCfg, srcDefaults, partition = "agent_rules") {
+  const userAgent = userCfg[partition] || (userCfg[partition] = {});
+  const srcAgent = srcDefaults[partition] || {};
   for (const [agentId, srcCats] of Object.entries(srcAgent)) {
     if (!(agentId in userAgent)) {
       userAgent[agentId] = JSON.parse(JSON.stringify(srcCats));
@@ -1864,6 +1987,7 @@ function mergeConfig(userCfg, srcDefaults) {
   _mergeRuleCategories(cfg, srcDefaults, "L2_rules");
   _mergeSkillCategories(cfg, srcDefaults, "L3_skills");
   _mergeAgentRules(cfg, srcDefaults);
+  _mergeAgentRules(cfg, srcDefaults, "scenario_rules");
   return cfg;
 }
 function _migrateCategoriesAcrossLayers(cfg, srcLayer, dstLayer, catNames) {
@@ -2189,7 +2313,85 @@ function updateAgentCategoryEnabled(agentId, category, enabled) {
   saveRuntimeConfig(runtime);
   return runtime;
 }
-var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DENY_MODE_LABELS, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, SKILL_ID_RE;
+function getScenarioRules(runtime) {
+  return runtime.scenario_rules || {};
+}
+function getEnabledScenarioExtensions(runtime, scenarioId) {
+  const scenData = runtime.scenario_rules?.[scenarioId];
+  if (!scenData) return null;
+  const cmdPatterns = _agentCategoryEnabledRules(scenData.extra_command_patterns).filter((r) => r.pattern).map((r) => ({
+    pattern: r.pattern,
+    risk_level: r.risk_level || "",
+    risk_type: r.risk_type || "",
+    reason: r.reason || ""
+  }));
+  const injKeywords = _agentCategoryEnabledRules(scenData.extra_injection_keywords).filter((r) => r.keyword).map((r) => ({
+    keyword: r.keyword,
+    risk_level: r.risk_level || "",
+    lang: r.lang || "en"
+  }));
+  const sensitivePaths = _agentCategoryEnabledRules(scenData.extra_sensitive_paths).filter((r) => r.path).map((r) => ({
+    path: r.path,
+    risk_level: r.risk_level || "",
+    desc: r.desc || "",
+    credential: r.credential,
+    read_only: r.read_only,
+    deny_mode: r.deny_mode
+  }));
+  return {
+    agent_id: scenarioId,
+    description: "",
+    extra_command_patterns: cmdPatterns,
+    extra_injection_keywords: injKeywords,
+    extra_sensitive_paths: sensitivePaths,
+    builtin_safe_skills: [],
+    builtin_safe_action_types: [],
+    extra_skills: []
+  };
+}
+function updateScenarioRuleEnabled(scenarioId, category, ruleFp, enabled) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.scenario_rules?.[scenarioId]?.[category];
+  if (cat) {
+    const targetFp = _ruleFingerprint(ruleFp);
+    for (const r of cat.rules || []) {
+      if (_ruleFingerprint(r) === targetFp) {
+        r.enabled = enabled;
+        break;
+      }
+    }
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function addScenarioRule(scenarioId, category, rule) {
+  const runtime = loadRuntimeConfig();
+  if (!runtime.scenario_rules) runtime.scenario_rules = {};
+  if (!runtime.scenario_rules[scenarioId]) runtime.scenario_rules[scenarioId] = {};
+  const cats = runtime.scenario_rules[scenarioId];
+  if (!cats[category]) cats[category] = { category_enabled: true, category_desc: "", rules: [] };
+  (cats[category].rules || (cats[category].rules = [])).push({ ...rule, enabled: true, builtin: false });
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function deleteScenarioRule(scenarioId, category, ruleFp) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.scenario_rules?.[scenarioId]?.[category];
+  if (cat) {
+    const targetFp = _ruleFingerprint(ruleFp);
+    cat.rules = (cat.rules || []).filter((r) => _ruleFingerprint(r) !== targetFp);
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function updateScenarioCategoryEnabled(scenarioId, category, enabled) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.scenario_rules?.[scenarioId]?.[category];
+  if (cat) cat.category_enabled = enabled;
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DENY_MODE_LABELS, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, SKILL_ID_RE;
 var init_runtime_config = __esm({
   "src/infra/runtime-config.ts"() {
     "use strict";
@@ -2214,6 +2416,8 @@ var init_runtime_config = __esm({
     };
     _AGENTS_DIR_PROD = join2(__dirname4, "agents");
     _AGENTS_DIR_DEV = join2(__dirname4, "..", "..", "..", "agent_moss", "agents");
+    _SCENARIOS_DIR_PROD = join2(__dirname4, "scenarios");
+    _SCENARIOS_DIR_DEV = join2(__dirname4, "..", "..", "..", "agent_moss", "scenarios");
     SKILL_ID_RE = /^[A-Za-z0-9_-]+$/;
   }
 });
@@ -2265,6 +2469,21 @@ function getAgentExtensions(agentId) {
   );
   return ext;
 }
+function mergeAgentExtensions(...exts) {
+  const nonNull = exts.filter((e) => !!e);
+  if (nonNull.length === 0) return null;
+  const base = nonNull[0];
+  return {
+    agent_id: base.agent_id,
+    description: base.description,
+    extra_command_patterns: nonNull.flatMap((e) => e.extra_command_patterns || []),
+    extra_injection_keywords: nonNull.flatMap((e) => e.extra_injection_keywords || []),
+    extra_sensitive_paths: nonNull.flatMap((e) => e.extra_sensitive_paths || []),
+    builtin_safe_skills: nonNull.flatMap((e) => e.builtin_safe_skills || []),
+    builtin_safe_action_types: nonNull.flatMap((e) => e.builtin_safe_action_types || []),
+    extra_skills: nonNull.flatMap((e) => e.extra_skills || [])
+  };
+}
 var __filename4, __dirname5, AGENTS_DIR_PROD, AGENTS_DIR_DEV_FALLBACK, cache;
 var init_agents = __esm({
   "src/agents/index.ts"() {
@@ -2278,6 +2497,77 @@ var init_agents = __esm({
   }
 });
 
+// src/scenarios/index.ts
+import { readFileSync as readFileSync6, existsSync as existsSync6 } from "fs";
+import { resolve as resolve4, dirname as dirname5 } from "path";
+import { fileURLToPath as fileURLToPath7 } from "url";
+function resolveScenariosDir() {
+  if (existsSync6(SCENARIOS_DIR_PROD)) return SCENARIOS_DIR_PROD;
+  if (existsSync6(SCENARIOS_DIR_DEV_FALLBACK)) return SCENARIOS_DIR_DEV_FALLBACK;
+  return SCENARIOS_DIR_PROD;
+}
+function getScenarioExtensions(scenarioId) {
+  if (!scenarioId) return null;
+  if (cache2.has(scenarioId)) return cache2.get(scenarioId) ?? null;
+  let ext = null;
+  try {
+    const { hasRuntimeConfig: hasRuntimeConfig2, loadRuntimeConfig: loadRuntimeConfig2, getEnabledScenarioExtensions: getEnabledScenarioExtensions2 } = (init_runtime_config(), __toCommonJS(runtime_config_exports));
+    if (hasRuntimeConfig2()) {
+      ext = getEnabledScenarioExtensions2(loadRuntimeConfig2(), scenarioId);
+    }
+  } catch {
+  }
+  if (ext === null) {
+    const scenariosDir = resolveScenariosDir();
+    const rulesFile = resolve4(scenariosDir, scenarioId, "rules.json");
+    if (!existsSync6(rulesFile)) {
+      cache2.set(scenarioId, null);
+      return null;
+    }
+    try {
+      const raw = readFileSync6(rulesFile, "utf-8");
+      const data = JSON.parse(raw);
+      const id = data.scenario_id || data.agent_id || "";
+      if (!id) {
+        console.warn(`[AgentMoss scenarios] rules.json \u7F3A\u5C11 scenario_id \u5B57\u6BB5: ${rulesFile}`);
+        cache2.set(scenarioId, null);
+        return null;
+      }
+      ext = {
+        agent_id: id,
+        description: data.description || "",
+        extra_command_patterns: data.extra_command_patterns || [],
+        extra_injection_keywords: data.extra_injection_keywords || [],
+        extra_sensitive_paths: data.extra_sensitive_paths || [],
+        builtin_safe_skills: data.builtin_safe_skills || [],
+        builtin_safe_action_types: data.builtin_safe_action_types || [],
+        extra_skills: data.extra_skills || []
+      };
+    } catch (e) {
+      console.error(`[AgentMoss scenarios] \u52A0\u8F7D\u573A\u666F ${scenarioId} rules.json \u5931\u8D25:`, e.message);
+      cache2.set(scenarioId, null);
+      return null;
+    }
+  }
+  cache2.set(scenarioId, ext);
+  console.log(
+    `[AgentMoss scenarios] \u52A0\u8F7D\u573A\u666F ${scenarioId} \u5B9A\u5236\u89C4\u5219: ${ext.extra_command_patterns?.length ?? 0} cmd patterns, ${ext.extra_injection_keywords?.length ?? 0} injection keywords, ${ext.extra_sensitive_paths?.length ?? 0} sensitive paths`
+  );
+  return ext;
+}
+var __filename5, __dirname6, SCENARIOS_DIR_PROD, SCENARIOS_DIR_DEV_FALLBACK, cache2;
+var init_scenarios = __esm({
+  "src/scenarios/index.ts"() {
+    "use strict";
+    init_esm_shims();
+    __filename5 = fileURLToPath7(import.meta.url);
+    __dirname6 = dirname5(__filename5);
+    SCENARIOS_DIR_PROD = resolve4(__dirname6, "scenarios");
+    SCENARIOS_DIR_DEV_FALLBACK = resolve4(__dirname6, "../../../agent_moss/scenarios");
+    cache2 = /* @__PURE__ */ new Map();
+  }
+});
+
 // src/engine/heuristic.ts
 function runHeuristicCheck(input) {
   const command = `${input.aNext.actionType}: ${input.aNext.actionDetail}`;
@@ -2317,7 +2607,10 @@ function runHeuristicCheck(input) {
     }
   }
   highestRiskType = topRiskType || highestRiskType;
-  const agentExt = getAgentExtensions(input.agentId);
+  const agentExt = mergeAgentExtensions(
+    getAgentExtensions(input.agentId),
+    getScenarioExtensions(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "")
+  );
   if (agentExt?.extra_command_patterns) {
     for (const rule of agentExt.extra_command_patterns) {
       try {
@@ -2490,13 +2783,13 @@ function checkSensitivePath(command, cwd, agentExt) {
   const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
   const isWriteOpFlag = isWriteOperation("", command);
   const pathScanText = normalizePathSegments(stripLiteralTextSegments(command));
-  const pathMatches = (text, path3) => {
-    const parts = path3.split(/(\(\?!.*?\))/);
+  const pathMatches = (text, path6) => {
+    const parts = path6.split(/(\(\?!.*?\))/);
     const escaped = parts.map((part) => {
       if (part.startsWith("(?!")) return part;
       return part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     }).join("");
-    const re = path3.startsWith(".") || path3.startsWith("/") ? new RegExp(`(?:^|[\\s/\\\\'"])${escaped}\\b`, "i") : new RegExp(`\\b${escaped}\\b`, "i");
+    const re = path6.startsWith(".") || path6.startsWith("/") ? new RegExp(`(?:^|[\\s/\\\\'"])${escaped}\\b`, "i") : new RegExp(`\\b${escaped}\\b`, "i");
     return re.test(text);
   };
   for (const sp of ROOT_SENSITIVE_PATHS) {
@@ -2760,6 +3053,7 @@ var init_heuristic = __esm({
     init_esm_shims();
     init_config();
     init_agents();
+    init_scenarios();
     init_rules_loader();
     init_logic_rules();
     INJECTION_KEYWORDS = (() => {
@@ -2785,44 +3079,44 @@ var init_heuristic = __esm({
 });
 
 // src/engine/template-loader.ts
-import { readFileSync as readFileSync6, existsSync as existsSync6 } from "fs";
-import { resolve as resolve4, dirname as dirname5 } from "path";
-import { fileURLToPath as fileURLToPath7 } from "url";
+import { readFileSync as readFileSync7, existsSync as existsSync7 } from "fs";
+import { resolve as resolve5, dirname as dirname6 } from "path";
+import { fileURLToPath as fileURLToPath8 } from "url";
 function loadTemplates() {
   if (cachedTemplates) return cachedTemplates;
   cachedTemplates = {};
-  const dir = existsSync6(TEMPLATES_DIR) ? TEMPLATES_DIR : TEMPLATES_DIR_FALLBACK;
-  if (!existsSync6(dir)) {
+  const dir = existsSync7(TEMPLATES_DIR) ? TEMPLATES_DIR : TEMPLATES_DIR_FALLBACK;
+  if (!existsSync7(dir)) {
     console.warn("[AgentMoss] Templates directory not found:", TEMPLATES_DIR, "and fallback:", TEMPLATES_DIR_FALLBACK);
     return cachedTemplates;
   }
   for (const file of TEMPLATE_FILES) {
-    const filePath = resolve4(dir, file);
-    if (existsSync6(filePath)) {
+    const filePath = resolve5(dir, file);
+    if (existsSync7(filePath)) {
       const key = file.replace(".txt", "").replace("_template", "");
-      cachedTemplates[key] = readFileSync6(filePath, "utf-8");
+      cachedTemplates[key] = readFileSync7(filePath, "utf-8");
     }
   }
   console.log(`[AgentMoss] Loaded ${Object.keys(cachedTemplates).length} templates from ${dir}`);
   return cachedTemplates;
 }
-var __filename5, __dirname6, TEMPLATES_DIR, TEMPLATES_DIR_FALLBACK, TEMPLATE_FILES, cachedTemplates;
+var __filename6, __dirname7, TEMPLATES_DIR, TEMPLATES_DIR_FALLBACK, TEMPLATE_FILES, cachedTemplates;
 var init_template_loader = __esm({
   "src/engine/template-loader.ts"() {
     "use strict";
     init_esm_shims();
-    __filename5 = fileURLToPath7(import.meta.url);
-    __dirname6 = dirname5(__filename5);
-    TEMPLATES_DIR = resolve4(__dirname6, "../templates");
-    TEMPLATES_DIR_FALLBACK = resolve4(__dirname6, "../../../agent_moss/templates");
+    __filename6 = fileURLToPath8(import.meta.url);
+    __dirname7 = dirname6(__filename6);
+    TEMPLATES_DIR = resolve5(__dirname7, "../templates");
+    TEMPLATES_DIR_FALLBACK = resolve5(__dirname7, "../../../agent_moss/templates");
     TEMPLATE_FILES = ["prompt1_template.txt", "prompt2_template.txt", "security_judge_template.txt"];
     cachedTemplates = null;
   }
 });
 
 // src/engine/script-analyzer.ts
-import { readFileSync as readFileSync7 } from "fs";
-import { resolve as resolve5, join as join3 } from "path";
+import { readFileSync as readFileSync8 } from "fs";
+import { resolve as resolve6, join as join3 } from "path";
 function emptyResult() {
   return { scriptPath: "", scriptContent: "", matchedKeywords: [], lineCount: 0, isSuspicious: false, error: "", riskLevel: "", riskReason: "" };
 }
@@ -2875,8 +3169,8 @@ function assessKeywordCombinationRisk(matchedKeywords, scriptContent) {
 }
 function readScriptContent(scriptPath, maxLines = 500) {
   try {
-    const expandedPath = scriptPath.startsWith("~") ? join3(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve5(scriptPath);
-    const raw = readFileSync7(expandedPath, "utf-8");
+    const expandedPath = scriptPath.startsWith("~") ? join3(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve6(scriptPath);
+    const raw = readFileSync8(expandedPath, "utf-8");
     const lines = raw.split("\n").slice(0, maxLines);
     return { content: lines.join("\n"), lineCount: lines.length, error: "" };
   } catch (e) {
@@ -3013,294 +3307,1604 @@ var init_script_analyzer = __esm({
   }
 });
 
-// src/engine/script-content-analyzer.ts
-import { readFileSync as readFileSync8, statSync, existsSync as existsSync7 } from "fs";
-import { resolve as resolve6, join as join4, isAbsolute, dirname as dirname6 } from "path";
-import { homedir as homedir2 } from "os";
-function emptyChain() {
-  return {
-    nodes: [],
-    entryPath: "",
-    maxDepthReached: false,
-    maxSizeReached: false,
-    totalSize: 0,
-    totalLines: 0,
-    hasCritical: false,
-    hasHigh: false,
-    firstHitNode: null,
-    error: ""
-  };
-}
-function newNode(path3, depth) {
-  return {
-    scriptPath: path3,
-    rawContent: "",
-    preprocessedContent: "",
-    lineCount: 0,
-    fileSize: 0,
-    depth,
-    childPaths: [],
-    error: "",
-    l1Hit: false,
-    l1RiskLevel: "",
-    l1RiskType: "",
-    l1Reason: "",
-    l1MatchedPatterns: [],
-    l2Hit: false,
-    l2ViolatedRule: "",
-    l2RiskLevel: "",
-    l2RiskType: "",
-    l2Reason: "",
-    matchedKeywords: [],
-    isSuspicious: false,
-    keywordRiskLevel: "",
-    keywordRiskReason: ""
-  };
-}
-function stripComments(content) {
-  return content.split("\n").filter((line) => !line.trimStart().startsWith("#")).join("\n");
-}
-function stripOutputText(content) {
-  let result = content.replace(/echo\s+".*?"/gs, 'echo ""');
-  result = result.replace(/echo\s+'.*?'/gs, "echo ''");
-  result = result.replace(/printf\s+".*?"[^\n]*/gs, 'printf ""');
-  result = result.replace(/printf\s+'.*?'[^\n]*/gs, "printf ''");
-  return result;
-}
-function expandSimpleVariables(content) {
-  const varMap = {};
-  const assignmentRe = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.+)$/;
-  const collectAssignments = (text) => {
-    for (const line of text.split("\n")) {
-      const m = line.match(assignmentRe);
-      if (m) {
-        const varName = m[1];
-        let varVal = m[2].trim();
-        if (varVal && !varVal.includes("$") && !varVal.includes("`")) {
-          if (varVal.startsWith('"') && varVal.endsWith('"') || varVal.startsWith("'") && varVal.endsWith("'")) {
-            varVal = varVal.slice(1, -1);
-          }
-          varMap[varName] = varVal;
+// src/engine/script-engine/backends/python-backend.ts
+import { parser } from "@lezer/python";
+function buildLineStarts(content) {
+  const starts = [0];
+  for (let i = 0; i < content.length; i++) {
+    if (content[i] === "\n") starts.push(i + 1);
+  }
+  return starts;
+}
+function lineAt(lineStarts, pos) {
+  let lo = 0;
+  let hi = lineStarts.length - 1;
+  while (lo < hi) {
+    const mid = lo + hi + 1 >> 1;
+    if (lineStarts[mid] <= pos) lo = mid;
+    else hi = mid - 1;
+  }
+  return lo + 1;
+}
+function markNodeLines(node, lines, lineStarts) {
+  const start = lineAt(lineStarts, node.from);
+  const end = node.to > node.from ? lineAt(lineStarts, node.to - 1) : start;
+  for (let i = start; i <= end; i++) lines.add(i);
+}
+function reconstruct(sourceLines, lines) {
+  const out = [];
+  for (const i of [...lines].sort((a, b) => a - b)) {
+    if (i >= 1 && i <= sourceLines.length) out.push(sourceLines[i - 1]);
+  }
+  return out.join("\n");
+}
+function makeEnv(argv) {
+  return { argv, vars: {} };
+}
+function srcSlice(node) {
+  return SOURCE.slice(node.from, node.to);
+}
+function stringValue(tokenText) {
+  let s = tokenText;
+  if (s.length >= 2) {
+    const q = s[0];
+    if ((q === '"' || q === "'") && s.endsWith(q)) s = s.slice(1, -1);
+  }
+  s = s.replace(/\\n/g, "\n").replace(/\\t/g, "	").replace(/\\r/g, "\r").replace(/\\\\/g, "\\").replace(/\\"/g, '"').replace(/\\'/g, "'");
+  return s;
+}
+function isSysArgv(node) {
+  if (!node || node.name !== "MemberExpression") return false;
+  const first = node.firstChild;
+  if (!first || first.name !== "VariableName" || srcSlice(first) !== "sys") return false;
+  const prop = node.getChild("PropertyName");
+  return prop !== null && srcSlice(prop) === "argv";
+}
+function evalExpr(node, env) {
+  if (!node) return null;
+  const name = node.name;
+  if (name === "String") return stringValue(srcSlice(node));
+  if (name === "Number") return srcSlice(node);
+  if (name === "VariableName") {
+    const id = srcSlice(node);
+    return id in env.vars ? env.vars[id] : null;
+  }
+  if (name === "MemberExpression") {
+    const bracket = node.getChild("[");
+    if (bracket) {
+      const inner = node.firstChild;
+      if (inner && isSysArgv(inner)) {
+        const idxNode = bracket.nextSibling;
+        if (idxNode && idxNode.name === "Number") {
+          const idx = parseInt(srcSlice(idxNode), 10);
+          if (idx >= 1 && idx <= env.argv.length) return env.argv[idx - 1];
+          return null;
         }
       }
+      return null;
     }
-  };
-  collectAssignments(content);
-  let expanded = content;
-  for (let round = 0; round < 3; round++) {
-    const sortedVars = Object.keys(varMap).sort((a, b) => b.length - a.length);
-    let newExpanded = expanded;
-    for (const v of sortedVars) {
-      const val = varMap[v];
-      newExpanded = newExpanded.split("${" + v + "}").join(val);
-      newExpanded = newExpanded.split("$" + v).join(val);
-    }
-    if (newExpanded === expanded) break;
-    expanded = newExpanded;
-    collectAssignments(expanded);
-  }
-  return expanded;
-}
-function preprocessScriptContent(content) {
-  let result = stripComments(content);
-  result = stripOutputText(result);
-  result = expandSimpleVariables(result);
-  return result;
-}
-function scanScriptForKeywords2(content) {
-  const matched = [];
-  for (const { name, pattern } of SUSPICIOUS_PATTERNS2) {
-    if (pattern.test(content)) matched.push(name);
-  }
-  return matched;
-}
-function assessKeywordCombinationRisk2(matchedKeywords, scriptContent) {
-  if (matchedKeywords.length === 0) return { level: "", reason: "" };
-  const keywordSet = new Set(matchedKeywords);
-  for (const rule of KEYWORD_COMBINATION_RISKS2) {
-    const hitGroup1 = [...rule.group1].some((k) => keywordSet.has(k));
-    const hitGroup2 = rule.group2.size === 0 ? true : [...rule.group2].some((k) => keywordSet.has(k));
-    if (hitGroup1 && hitGroup2) return { level: rule.level, reason: rule.reason };
+    if (isSysArgv(node)) return env.argv[0] ?? null;
+    return null;
   }
-  const networkPostKeywords = /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]);
-  const hasNetworkPost = [...networkPostKeywords].some((k) => keywordSet.has(k));
-  if (hasNetworkPost) {
-    const envPatterns = ["$env", "$(env)", "$USER", "$(hostname)", "$(pwd)", "$HOME"];
-    const contentLower = scriptContent.toLowerCase();
-    for (const p of envPatterns) {
-      if (contentLower.includes(p.toLowerCase())) {
-        return {
-          level: "critical",
-          reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + \u7CFB\u7EDF\u73AF\u5883\u53D8\u91CF\u6536\u96C6\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u6570\u636E\u5916\u4F20\u98CE\u9669\u3002\u811A\u672C\u53EF\u80FD\u5C06\u7528\u6237\u73AF\u5883\u53D8\u91CF\uFF08\u53EF\u80FD\u5305\u542B API Key\u3001\u5BC6\u94A5\u7B49\u654F\u611F\u4FE1\u606F\uFF09\u53D1\u9001\u5230\u8FDC\u7A0B\u670D\u52A1\u5668\u3002"
-        };
-      }
+  if (name === "CallExpression") {
+    const func = node.firstChild;
+    if (func && func.name === "VariableName" && srcSlice(func) === "len") {
+      const argList = node.getChild("ArgList");
+      const inner = argList ? firstNamedChild(argList) : null;
+      if (inner && isSysArgv(inner)) return String(env.argv.length + 1);
     }
+    return null;
   }
-  let bestLevel = "";
-  let bestReason = "";
-  for (const kw of matchedKeywords) {
-    const risk = SINGLE_KEYWORD_RISKS2[kw];
-    if (risk && (LEVEL_ORDER2[risk.level] || 0) > (LEVEL_ORDER2[bestLevel] || 0)) {
-      bestLevel = risk.level;
-      bestReason = risk.reason;
+  if (name === "ConditionalExpression") {
+    const ifKw = node.getChild("if");
+    const elseKw = node.getChild("else");
+    if (!ifKw || !elseKw) return null;
+    const thenNode = node.firstChild;
+    const condNode = ifKw.nextSibling;
+    const orelseNode = elseKw.nextSibling;
+    if (!thenNode || !condNode || !orelseNode) return null;
+    const cond = evalCondition(condNode, env);
+    if (cond === true) return evalExpr(thenNode, env);
+    if (cond === false) return evalExpr(orelseNode, env);
+    return null;
+  }
+  if (name === "BinaryExpression") {
+    const op = findOp(node);
+    if (op === "+") {
+      const left = evalExpr(node.firstChild, env);
+      const right = evalExpr(lastNamedChild(node), env);
+      if (left !== null && right !== null) return left + right;
     }
+    return null;
   }
-  return { level: bestLevel, reason: bestReason };
+  return null;
 }
-function extractScriptPath2(command) {
-  for (const pattern of SCRIPT_EXEC_PATTERNS2) {
-    const m = command.match(pattern);
-    if (m) return m[1];
+function firstNamedChild(node) {
+  let c = node.firstChild;
+  while (c) {
+    if (c.name !== "(" && c.name !== ")" && c.name !== "," && c.name !== ":") return c;
+    c = c.nextSibling;
   }
   return null;
 }
-function extractInlineScriptPath(actionDetail) {
-  const re = /open\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
-  let m;
-  while ((m = re.exec(actionDetail)) !== null) {
-    const p = m[1];
-    let resolved;
-    try {
-      resolved = resolvePath(p);
-      if (existsSync7(resolved)) {
-        const stat = statSync(resolved);
-        if (stat.isFile()) return resolved;
-      }
-    } catch {
-    }
+function lastNamedChild(node) {
+  let c = node.lastChild;
+  while (c) {
+    if (c.name !== "(" && c.name !== ")" && c.name !== "," && c.name !== ":") return c;
+    c = c.prevSibling;
   }
   return null;
 }
-function resolvePath(p) {
-  let expanded = p;
-  if (expanded.startsWith("~/") || expanded === "~") {
-    expanded = join4(homedir2(), expanded.slice(1));
+function findOp(node) {
+  let c = node.firstChild;
+  while (c) {
+    if (c.name === "CompareOp" || c.name === "and" || c.name === "or" || c.name === "UpdateOp") {
+      return srcSlice(c).trim();
+    }
+    c = c.nextSibling;
   }
-  return resolve6(expanded);
+  return null;
 }
-function readScriptContent2(scriptPath, maxFileSize = 2 * 1024 * 1024) {
-  try {
-    const path3 = resolvePath(scriptPath);
-    if (!existsSync7(path3)) return { content: "", lineCount: 0, fileSize: 0, error: `\u811A\u672C\u4E0D\u5B58\u5728: ${scriptPath}` };
-    const stat = statSync(path3);
-    if (!stat.isFile()) return { content: "", lineCount: 0, fileSize: 0, error: `\u4E0D\u662F\u6587\u4EF6: ${scriptPath}` };
-    if (stat.size > maxFileSize) {
-      return { content: "", lineCount: 0, fileSize: stat.size, error: `\u811A\u672C\u6587\u4EF6\u8FC7\u5927 (${stat.size} bytes)\uFF0C\u8DF3\u8FC7\u8BFB\u53D6` };
+function evalCondition(node, env) {
+  if (!node) return null;
+  const name = node.name;
+  if (name === "Boolean") {
+    const t = srcSlice(node).trim();
+    return t === "True" ? true : t === "False" ? false : null;
+  }
+  if (name === "BinaryExpression") {
+    const op = findOp(node);
+    if (op === "and" || op === "or") {
+      const parts2 = namedChildren(node);
+      const vals = parts2.map((p) => evalCondition(p, env));
+      if (op === "and") {
+        if (vals.some((v) => v === false)) return false;
+        if (vals.every((v) => v === true)) return true;
+        return null;
+      }
+      if (vals.some((v) => v === true)) return true;
+      if (vals.every((v) => v === false)) return false;
+      return null;
+    }
+    const parts = namedChildren(node);
+    if (parts.length !== 3) return null;
+    const [left, opNode, right] = parts;
+    const opText = srcSlice(opNode).trim();
+    return evalCompare(left, opText, right, env);
+  }
+  if (name === "UnaryExpression") {
+    const kw = node.getChild("not");
+    if (kw) {
+      const operand = kw.nextSibling;
+      const v = evalCondition(operand, env);
+      return v === null ? null : !v;
+    }
+    return null;
+  }
+  if (name === "CallExpression") {
+    return null;
+  }
+  return null;
+}
+function namedChildren(node) {
+  const out = [];
+  let c = node.firstChild;
+  while (c) {
+    if (c.name !== "(" && c.name !== ")" && c.name !== "," && c.name !== ":" && c.name !== "[" && c.name !== "]") {
+      out.push(c);
+    }
+    c = c.nextSibling;
+  }
+  return out;
+}
+function evalCompare(left, opText, right, env) {
+  if (opText === "==" && left.name === "VariableName" && srcSlice(left) === "__name__") {
+    const rv = evalExpr(right, env);
+    if (rv !== null) return rv === "__main__";
+    return null;
+  }
+  if (opText === "==" || opText === "!=") {
+    const lv = evalExpr(left, env);
+    const rv = evalExpr(right, env);
+    if (lv !== null && rv !== null) {
+      return opText === "==" ? lv === rv : lv !== rv;
+    }
+    return null;
+  }
+  if (opText === "in") {
+    const lv = evalExpr(left, env);
+    if (lv === null) return null;
+    const rightName = right.name;
+    if (rightName === "TupleExpression" || rightName === "ArrayExpression" || rightName === "SetExpression" || rightName === "ParenthesizedExpression") {
+      const container = rightName === "ParenthesizedExpression" && right.firstChild && right.firstChild.name === "TupleExpression" ? right.firstChild : right;
+      for (const elt of namedChildren(container)) {
+        const ev = evalExpr(elt, env);
+        if (ev !== null && ev === lv) return true;
+      }
+      return false;
+    }
+    const rv = evalExpr(right, env);
+    if (rv !== null) return rv.includes(lv);
+    return null;
+  }
+  if (opText === ">" || opText === ">=" || opText === "<" || opText === "<=") {
+    const lv = evalExpr(left, env);
+    const rv = evalExpr(right, env);
+    if (lv === null || rv === null) return null;
+    const ln = parseInt(lv, 10);
+    const rn = parseInt(rv, 10);
+    if (Number.isNaN(ln) || Number.isNaN(rn)) return null;
+    if (opText === ">") return ln > rn;
+    if (opText === ">=") return ln >= rn;
+    if (opText === "<") return ln < rn;
+    return ln <= rn;
+  }
+  return null;
+}
+function processStmts(stmts, env, lineStarts, lines, branches) {
+  for (const s of stmts) processStmt(s, env, lineStarts, lines, branches);
+}
+function invalidateEnvOnCalls(node, env) {
+  const cursor = node.cursor();
+  cursor.iterate((n) => {
+    const nd = n.node;
+    if (nd.name !== "CallExpression") return true;
+    const func = nd.firstChild;
+    if (func && func.name === "VariableName" && !PURE_BUILTINS.has(srcSlice(func))) {
+      for (const k of Object.keys(env.vars)) env.vars[k] = null;
+      return false;
+    }
+    return true;
+  });
+}
+function processStmt(stmt, env, lineStarts, lines, branches) {
+  const name = stmt.name;
+  if (name === "AssignStatement") {
+    const target = stmt.firstChild;
+    if (target && target.name === "VariableName") {
+      const valNode = target.nextSibling ? target.nextSibling.nextSibling : null;
+      invalidateEnvOnCalls(stmt, env);
+      const val = evalExpr(valNode, env);
+      env.vars[srcSlice(target)] = val;
+    }
+    markNodeLines(stmt, lines, lineStarts);
+    return;
+  }
+  if (name === "UpdateStatement") {
+    const target = stmt.firstChild;
+    if (target && target.name === "VariableName") env.vars[srcSlice(target)] = null;
+    invalidateEnvOnCalls(stmt, env);
+    markNodeLines(stmt, lines, lineStarts);
+    return;
+  }
+  if (name === "IfStatement") {
+    processIf(stmt, env, lineStarts, lines, branches);
+    return;
+  }
+  if (name === "ForStatement" || name === "WhileStatement") {
+    markNodeLines(stmt, lines, lineStarts);
+    for (const body of stmt.getChildren("Body")) {
+      processStmts(bodyStmts(body), { argv: env.argv, vars: { ...env.vars } }, lineStarts, lines, branches);
+    }
+    return;
+  }
+  if (name === "TryStatement") {
+    markNodeLines(stmt, lines, lineStarts);
+    for (const body of stmt.getChildren("Body")) {
+      processStmts(bodyStmts(body), { argv: env.argv, vars: { ...env.vars } }, lineStarts, lines, branches);
+    }
+    return;
+  }
+  if (name === "WithStatement") {
+    markNodeLines(stmt, lines, lineStarts);
+    const body = stmt.getChild("Body");
+    if (body) processStmts(bodyStmts(body), { argv: env.argv, vars: { ...env.vars } }, lineStarts, lines, branches);
+    return;
+  }
+  if (name === "MatchStatement") {
+    markNodeLines(stmt, lines, lineStarts);
+    for (const clause of stmt.getChildren("MatchClause")) {
+      const body = clause.getChild("Body");
+      if (body) processStmts(bodyStmts(body), { argv: env.argv, vars: { ...env.vars } }, lineStarts, lines, branches);
     }
-    const content = readFileSync8(path3, "utf-8");
-    const lineCount = content ? content.split("\n").length : 0;
-    return { content, lineCount, fileSize: stat.size, error: "" };
+    return;
+  }
+  if (name === "FunctionDefinition" || name === "ClassDefinition") {
+    markDefTree(stmt, lines, lineStarts);
+    return;
+  }
+  if (name === "ExpressionStatement") {
+    invalidateEnvOnCalls(stmt, env);
+  }
+  markNodeLines(stmt, lines, lineStarts);
+}
+function markDefTree(stmt, lines, lineStarts) {
+  const cursor = stmt.cursor();
+  cursor.iterate((n) => {
+    markNodeLines(n.node, lines, lineStarts);
+    return true;
+  });
+}
+function bodyStmts(body) {
+  const out = [];
+  let c = body.firstChild;
+  while (c) {
+    if (c.name !== ":" && c.name !== ";") out.push(c);
+    c = c.nextSibling;
+  }
+  return out;
+}
+function processIf(stmt, env, lineStarts, lines, branches) {
+  const sections = [];
+  let c = stmt.firstChild;
+  while (c) {
+    if (c.name === "if" || c.name === "elif") {
+      sections.push({ cond: c.nextSibling ?? null, body: null, isElse: false });
+    } else if (c.name === "else") {
+      sections.push({ cond: null, body: null, isElse: true });
+    } else if (c.name === "Body") {
+      if (sections.length > 0 && sections[sections.length - 1].body === null) {
+        sections[sections.length - 1].body = c;
+      }
+    }
+    c = c.nextSibling;
+  }
+  processIfSections(stmt, sections, 0, env, lineStarts, lines, branches);
+}
+function processIfSections(_stmt, sections, idx, env, lineStarts, lines, branches) {
+  if (idx >= sections.length) return;
+  const s = sections[idx];
+  if (s.cond) markNodeLines(s.cond, lines, lineStarts);
+  if (s.isElse) {
+    if (s.body) processStmts(bodyStmts(s.body), env, lineStarts, lines, branches);
+    return;
+  }
+  const cond = s.cond ? evalCondition(s.cond, env) : null;
+  branches.push({
+    kind: "if",
+    label: s.cond ? srcSlice(s.cond) : "",
+    body: "",
+    reachable: cond !== false
+  });
+  if (cond === true) {
+    if (s.body) processStmts(bodyStmts(s.body), env, lineStarts, lines, branches);
+    return;
+  }
+  if (cond === false) {
+    processIfSections(_stmt, sections, idx + 1, env, lineStarts, lines, branches);
+    return;
+  }
+  if (s.body) processStmts(bodyStmts(s.body), env, lineStarts, lines, branches);
+  for (let j = idx + 1; j < sections.length; j++) {
+    const sj = sections[j];
+    if (sj.cond) markNodeLines(sj.cond, lines, lineStarts);
+    if (sj.body) processStmts(bodyStmts(sj.body), env, lineStarts, lines, branches);
+  }
+}
+function parseShellString(s) {
+  CHILD_CALL_RE.lastIndex = 0;
+  let m;
+  while ((m = CHILD_CALL_RE.exec(s)) !== null) {
+    const interp = m[1];
+    const path6 = m[2].trim();
+    let rest = m[3].trim();
+    if (path6.startsWith("-") || path6.startsWith("$") || path6.includes("/dev/")) continue;
+    rest = rest.split(/[;|&<>]/)[0].trim();
+    const args = [];
+    for (const tm of rest.matchAll(/(["'])(.*?)\1|(\S+)/g)) {
+      args.push(tm[1] ? tm[2] : tm[3]);
+    }
+    return { path: path6, args, interpreter: interp };
+  }
+  return null;
+}
+function extractCallsFromTree(tree, reachableLines) {
+  const calls = [];
+  const seen = /* @__PURE__ */ new Set();
+  const add = (c) => {
+    const key = `${c.path}\0${c.args.join("\0")}\0${c.interpreter}`;
+    if (!seen.has(key)) {
+      seen.add(key);
+      calls.push(c);
+    }
+  };
+  const lineReachable = (node) => {
+    if (reachableLines === null) return true;
+    return reachableLines.has(lineAt(buildLineStarts(SOURCE), node.from));
+  };
+  const cursor = tree.cursor();
+  cursor.iterate((n) => {
+    const node = n.node;
+    if (node.name !== "CallExpression") return true;
+    if (!lineReachable(node)) return true;
+    const func = node.firstChild;
+    if (!func || func.name !== "MemberExpression") return true;
+    const modName = func.firstChild;
+    if (!modName || modName.name !== "VariableName") return true;
+    const funcNameNode = func.getChild("PropertyName");
+    if (!funcNameNode) return true;
+    const mod = srcSlice(modName);
+    const funcName = srcSlice(funcNameNode);
+    const argList = node.getChild("ArgList");
+    const firstArg = argList ? firstNamedChild(argList) : null;
+    if (mod === "subprocess" && SUBPROCESS_FUNCS.has(funcName)) {
+      if (firstArg && (firstArg.name === "ArrayExpression" || firstArg.name === "TupleExpression")) {
+        const elts = [];
+        let allStr = true;
+        for (const elt of namedChildren(firstArg)) {
+          if (elt.name === "String") elts.push(stringValue(srcSlice(elt)));
+          else {
+            allStr = false;
+            break;
+          }
+        }
+        if (allStr && elts.length >= 2) {
+          const interp = elts[0];
+          const path6 = elts[1];
+          if (!path6.startsWith("-") && !path6.startsWith("$") && !path6.includes("/dev/")) {
+            add({ path: path6, args: elts.slice(2), interpreter: interp });
+            return true;
+          }
+        }
+      }
+      if (firstArg && firstArg.name === "String") {
+        const sc = parseShellString(stringValue(srcSlice(firstArg)));
+        if (sc) add(sc);
+      }
+    } else if (mod === "os" && OS_FUNCS.has(funcName)) {
+      if (firstArg && firstArg.name === "String") {
+        const sc = parseShellString(stringValue(srcSlice(firstArg)));
+        if (sc) add(sc);
+      }
+    }
+    return true;
+  });
+  const cursor2 = tree.cursor();
+  cursor2.iterate((n) => {
+    const node = n.node;
+    if (node.name !== "ImportStatement") return true;
+    const txt = srcSlice(node);
+    if (!/^from\s+\./m.test(txt)) return true;
+    const m = txt.match(/\bimport\s+(.+)$/m);
+    if (m) {
+      for (const part of m[1].split(",")) {
+        const name = part.trim().replace(/\s+as\s+\w+$/, "");
+        if (name && name !== "*") add({ path: name.replace(/\./g, "/") + ".py", args: [], interpreter: "python3" });
+      }
+    }
+    return true;
+  });
+  return calls;
+}
+function extractCallsRegex(content) {
+  const calls = [];
+  CHILD_CALL_RE.lastIndex = 0;
+  let m;
+  while ((m = CHILD_CALL_RE.exec(content)) !== null) {
+    const interp = m[1];
+    const path6 = m[2].trim();
+    let rest = m[3].trim();
+    if (path6.startsWith("-") || path6.startsWith("$") || path6.includes("/dev/")) continue;
+    rest = rest.split(/[;|&<>]/)[0].trim();
+    const args = [];
+    for (const tm of rest.matchAll(/(["'])(.*?)\1|(\S+)/g)) {
+      args.push(tm[1] ? tm[2] : tm[3]);
+    }
+    calls.push({ path: path6, args, interpreter: interp });
+  }
+  return calls;
+}
+var MAX_LINES, PURE_BUILTINS, CHILD_CALL_RE, SUBPROCESS_FUNCS, OS_FUNCS, SOURCE, PythonBackend;
+var init_python_backend = __esm({
+  "src/engine/script-engine/backends/python-backend.ts"() {
+    "use strict";
+    init_esm_shims();
+    MAX_LINES = 500;
+    PURE_BUILTINS = /* @__PURE__ */ new Set([
+      "len",
+      "print",
+      "str",
+      "int",
+      "float",
+      "bool",
+      "list",
+      "dict",
+      "set",
+      "tuple",
+      "range",
+      "sorted",
+      "enumerate",
+      "zip",
+      "map",
+      "filter",
+      "sum",
+      "min",
+      "max",
+      "abs",
+      "round",
+      "isinstance",
+      "type",
+      "open",
+      "input",
+      "repr",
+      "ord",
+      "chr",
+      "hex",
+      "oct",
+      "bin",
+      "format",
+      "id",
+      "hash",
+      "any",
+      "all",
+      "next",
+      "iter",
+      "reversed",
+      "pow",
+      "divmod"
+    ]);
+    CHILD_CALL_RE = /(?:^|\s|&&|\|\|)\s*((?:\/bin\/)?bash|sh|zsh|(?:python|python3|node|ruby|perl|php|lua))\s+(\S+(?:\.(?:sh|shrc|py|js|rb|pl|php|lua))?)([^\n;|&]*?)$/gim;
+    SUBPROCESS_FUNCS = /* @__PURE__ */ new Set(["run", "call", "Popen", "check_call", "check_output"]);
+    OS_FUNCS = /* @__PURE__ */ new Set(["system", "popen", "popen2", "popen3", "popen4"]);
+    SOURCE = "";
+    PythonBackend = class {
+      language = "python";
+      parse(content, entryArgs) {
+        const c = content || "";
+        SOURCE = c;
+        const sourceLines = c.split("\n");
+        const lineStarts = buildLineStarts(c);
+        const env = makeEnv(entryArgs || []);
+        const lines = /* @__PURE__ */ new Set();
+        const branches = [];
+        if (sourceLines.length > MAX_LINES) {
+          return {
+            reachableContent: c,
+            controlFlowResolved: false,
+            calls: extractCallsRegex(c),
+            branches: [],
+            unresolvedSnippets: [],
+            language: this.language
+          };
+        }
+        let tree;
+        try {
+          tree = parser.parse(c).topNode;
+        } catch {
+          return {
+            reachableContent: c,
+            controlFlowResolved: false,
+            calls: extractCallsRegex(c),
+            branches: [],
+            unresolvedSnippets: [],
+            language: this.language
+          };
+        }
+        const stmts = bodyStmts(tree);
+        processStmts(stmts, env, lineStarts, lines, branches);
+        const reachable = reconstruct(sourceLines, lines);
+        let calls = extractCallsFromTree(tree, lines);
+        if (calls.length === 0) calls = extractCallsRegex(c);
+        const srcNonblank = sourceLines.filter((l) => l.trim().length > 0);
+        const rcNonblank = reachable.split("\n").filter((l) => l.trim().length > 0);
+        const resolved = rcNonblank.length !== srcNonblank.length || rcNonblank.some((l, i) => l !== srcNonblank[i]);
+        return {
+          reachableContent: reachable,
+          controlFlowResolved: resolved,
+          calls,
+          branches,
+          unresolvedSnippets: [],
+          language: this.language
+        };
+      }
+    };
+  }
+});
+
+// src/engine/script-engine/symbolic.ts
+function reescape(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function svalConc(v) {
+  return { kind: "concrete", value: v, children: [], op: "" };
+}
+function svalSym(name) {
+  return { kind: "symbol", value: name, children: [], op: "" };
+}
+function svalExpr(children) {
+  return { kind: "expr", value: null, children, op: "+" };
+}
+function fold(val) {
+  if (val.kind !== "expr") return val;
+  const parts = [];
+  for (const c of val.children) {
+    const cc = fold(c);
+    if (cc.kind === "concrete") {
+      parts.push(cc.value || "");
+    } else {
+      return cc;
+    }
+  }
+  return svalConc(parts.join(""));
+}
+function countMatches(re, s) {
+  const m = s.match(re);
+  return m ? m.length : 0;
+}
+function findBlockEnd(lines, startLine, openRe, closeRe) {
+  let depth = 0;
+  for (let idx = startLine; idx < lines.length; idx++) {
+    depth += countMatches(openRe, lines[idx]) - countMatches(closeRe, lines[idx]);
+    if (depth <= 0 && idx > startLine) return idx;
+  }
+  return -1;
+}
+function findCaseEnd(lines, start) {
+  return findBlockEnd(lines, start, CASE_OPEN_RE, CASE_CLOSE_RE);
+}
+function findIfEnd(lines, start) {
+  return findBlockEnd(lines, start, IF_OPEN_RE, IF_CLOSE_RE);
+}
+function findLoopEnd(lines, start) {
+  let depth = 0;
+  for (let idx = start; idx < lines.length; idx++) {
+    depth += countMatches(LOOP_DO_RE, lines[idx]) - countMatches(LOOP_DONE_RE, lines[idx]);
+    if (depth <= 0 && idx > start) return idx;
+  }
+  return -1;
+}
+function findFnEnd(lines, start) {
+  let depth = 0;
+  for (let idx = start; idx < lines.length; idx++) {
+    depth += (lines[idx].match(/\{/g) || []).length - (lines[idx].match(/\}/g) || []).length;
+    if (depth <= 0 && idx > start) return idx;
+  }
+  return -1;
+}
+function stripComments(content) {
+  return content.split("\n").filter((l) => !l.trimStart().startsWith("#")).join("\n");
+}
+function parseCaseStmt(block) {
+  const header = block.match(/\s*case\s+(\S[^;]*?)\s*\bin\b[\s\S]*/);
+  if (!header) return null;
+  const sel = header[1].trim();
+  const lines = block.split("\n");
+  let headerLine = 0;
+  for (let i = 0; i < lines.length; i++) {
+    if (/\bin\b/.test(lines[i]) && /\bcase\b/.test(lines[i])) {
+      headerLine = i;
+      break;
+    }
+  }
+  const bodyStartLine = headerLine + 1;
+  const endLine = findCaseEnd(lines, 0);
+  if (endLine === -1) return null;
+  const branches = splitCaseBranchesDepthAware(lines.slice(bodyStartLine, endLine));
+  if (!branches.length) return null;
+  return { kind: "case", line: block, modelable: true, selector: sel, branches };
+}
+function splitCaseBranchesDepthAware(bodyLines) {
+  let depth = 0;
+  let curPat = null;
+  let curBody = [];
+  const branches = [];
+  const flush = () => {
+    if (curPat !== null) {
+      branches.push({ pat: curPat, body: curBody.join("\n") });
+    }
+    curPat = null;
+    curBody = [];
+  };
+  for (const ln of bodyLines) {
+    const stripped = ln.trim();
+    if (depth === 0) {
+      const bm = stripped.match(/^([^()]+?)\s*\)\s*(.*)$/);
+      if (bm) {
+        if (curPat !== null) flush();
+        curPat = bm[1].trim().replace(/^["']|["']$/g, "");
+        curBody = bm[2].trim() ? [bm[2].trim()] : [];
+        continue;
+      }
+    }
+    if (/\bcase\b/.test(stripped)) depth += 1;
+    else if (/\besac\b/.test(stripped)) depth = Math.max(0, depth - 1);
+    else if (curPat !== null) {
+      curBody.push(ln);
+      if (depth === 0 && stripped.endsWith(";;")) flush();
+    }
+  }
+  if (curPat !== null && curBody.length) flush();
+  return branches;
+}
+function parseIfStmt(block) {
+  const m = block.match(/\s*if\s+([^\n;]+?)\s*;\s*then/);
+  if (!m) return null;
+  const cond = m[1].trim();
+  const lines = block.split("\n");
+  const fiLine = findIfEnd(lines, 0);
+  if (fiLine === -1) return null;
+  const body = lines.slice(1, fiLine).join("\n");
+  const elseM = /\belse\b/.exec(body);
+  let thenBody;
+  let elseBody;
+  if (elseM) {
+    thenBody = body.slice(0, elseM.index);
+    elseBody = body.slice(elseM.index + 4);
+  } else {
+    thenBody = body;
+    elseBody = null;
+  }
+  return { kind: "if", line: block, modelable: true, cond, thenBody, elseBody };
+}
+function tokenize(content) {
+  const lines = stripComments(content).split("\n");
+  const stmts = [];
+  let i = 0;
+  while (i < lines.length) {
+    const ln = lines[i];
+    const stripped = ln.trim();
+    if (!stripped) {
+      i++;
+      continue;
+    }
+    if (/\b(?:while|for|until)\b/.test(stripped) && !CASE_START_RE.test(stripped) && !IF_START_RE.test(stripped)) {
+      const endLine = findLoopEnd(lines, i);
+      if (endLine !== -1) {
+        for (let k = i; k <= endLine; k++) stmts.push({ kind: "plain", line: lines[k], modelable: false });
+        i = endLine + 1;
+        continue;
+      }
+      stmts.push({ kind: "plain", line: ln, modelable: false });
+      i++;
+      continue;
+    }
+    if (FN_DEF_RE.test(stripped) || FN_DEF_KW_RE.test(stripped)) {
+      const endLine = findFnEnd(lines, i);
+      if (endLine !== -1) {
+        for (let k = i; k <= endLine; k++) stmts.push({ kind: "plain", line: lines[k], modelable: false });
+        i = endLine + 1;
+        continue;
+      }
+      stmts.push({ kind: "plain", line: ln, modelable: false });
+      i++;
+      continue;
+    }
+    if (CASE_START_RE.test(stripped)) {
+      const endLine = findCaseEnd(lines, i);
+      if (endLine === -1) {
+        stmts.push({ kind: "plain", line: ln, modelable: false });
+        i++;
+        continue;
+      }
+      const parsed = parseCaseStmt(lines.slice(i, endLine + 1).join("\n"));
+      stmts.push(parsed || { kind: "plain", line: ln, modelable: false });
+      i = endLine + 1;
+      continue;
+    }
+    if (IF_START_RE.test(stripped)) {
+      const endLine = findIfEnd(lines, i);
+      if (endLine === -1) {
+        stmts.push({ kind: "plain", line: ln, modelable: false });
+        i++;
+        continue;
+      }
+      const parsed = parseIfStmt(lines.slice(i, endLine + 1).join("\n"));
+      stmts.push(parsed || { kind: "plain", line: ln, modelable: false });
+      i = endLine + 1;
+      continue;
+    }
+    if (/\bshift\b|\bset\s+--(?:\s|$)|[\s;|&]read\b|^\s*read\b/.test(stripped)) {
+      stmts.push({ kind: "plain", line: ln, modelable: false });
+      i++;
+      continue;
+    }
+    const am = stripped.match(ASGN_RE);
+    if (am && !NOT_MODELED_RE.test(stripped)) {
+      stmts.push({ kind: "assign", line: stripped, modelable: true, name: am[1], rhs: am[2].trim() });
+      i++;
+      continue;
+    }
+    stmts.push(NOT_MODELED_RE.test(stripped) ? { kind: "plain", line: ln, modelable: false } : { kind: "plain", line: ln, modelable: true });
+    i++;
+  }
+  return stmts;
+}
+function evalExpr2(text, env) {
+  const isSingleQuoted = text.length >= 2 && text[0] === "'" && text[text.length - 1] === "'";
+  if (text.length >= 2 && (text[0] === '"' || text[0] === "'") && text[text.length - 1] === text[0]) {
+    text = text.slice(1, -1);
+  }
+  if (isSingleQuoted) return svalConc(text);
+  const parts = text.split(EXPR_SPLIT_RE);
+  const result = [];
+  for (const p of parts) {
+    if (!p) continue;
+    const brace = p.match(/^\$\{([^}]+)\}$/);
+    if (brace) {
+      const inner = brace[1];
+      if (/^\d+$/.test(inner)) {
+        const v = env.get(`$${inner}`);
+        result.push(v || svalSym(`$${inner}`));
+      } else {
+        const v = env.get(inner);
+        result.push(v || svalSym(inner));
+      }
+      continue;
+    }
+    const bare = p.match(/^\$([A-Za-z_][A-Za-z0-9_]*|\d+)$/);
+    if (bare) {
+      const varName = bare[1];
+      const key = /^\d+$/.test(varName) ? `$${varName}` : varName;
+      const v = env.get(key);
+      result.push(v || svalSym(p));
+      continue;
+    }
+    result.push(svalConc(p));
+  }
+  if (result.length === 1) return fold(result[0]);
+  return fold(svalExpr(result));
+}
+function initEnv(entryArgs) {
+  const env = /* @__PURE__ */ new Map();
+  if (entryArgs && entryArgs.length) {
+    entryArgs.forEach((a, idx) => env.set(`$${idx + 1}`, svalConc(a)));
+    env.set("$@", svalConc(entryArgs.join(" ")));
+    env.set("$*", svalConc(entryArgs.join(" ")));
+  }
+  return env;
+}
+function globToRegex(pattern) {
+  let out = "^";
+  let i = 0;
+  while (i < pattern.length) {
+    const c = pattern[i];
+    if (c === "*") out += ".*";
+    else if (c === "?") out += ".";
+    else if (c === "[") {
+      let j = i + 1;
+      let neg = false;
+      if (j < pattern.length && (pattern[j] === "!" || pattern[j] === "^")) {
+        neg = true;
+        j++;
+      }
+      let cls = "";
+      while (j < pattern.length && pattern[j] !== "]") {
+        cls += pattern[j];
+        j++;
+      }
+      if (j >= pattern.length) {
+        out += reescape(pattern.slice(i));
+        break;
+      }
+      out += "[" + (neg ? "^" : "") + reescape(cls) + "]";
+      i = j;
+    } else {
+      out += reescape(c);
+    }
+    i++;
+  }
+  out += "$";
+  return new RegExp(out, RE_DOTALL);
+}
+function matchGlob(pattern, value) {
+  if (!HAS_GLOB.test(pattern)) return pattern === value;
+  return globToRegex(pattern).test(value);
+}
+function evalNumericCompare(op, left, right) {
+  const li = parseInt(left, 10);
+  const ri = parseInt(right, 10);
+  if (isNaN(li) || isNaN(ri)) return null;
+  switch (op) {
+    case "-gt":
+      return li > ri;
+    case "-lt":
+      return li < ri;
+    case "-eq":
+      return li === ri;
+    case "-ge":
+      return li >= ri;
+    case "-le":
+      return li <= ri;
+    default:
+      return null;
+  }
+}
+function resolveVarSide(tok, env) {
+  if (!tok.startsWith("$")) return tok;
+  const ev = evalExpr2(tok, env);
+  return ev.kind === "concrete" ? ev.value : null;
+}
+function evalCondition2(cond, env) {
+  let inner = cond.trim().replace(/^\[\[?|\]\]?$/g, "").trim();
+  if (/^-[A-Za-z]\s/.test(inner) || inner.startsWith("-d") || inner.startsWith("-f")) return null;
+  const innerQ = inner.replace(/"/g, "").replace(/'/g, "");
+  for (const op2 of ["-gt", "-lt", "-eq", "-ge", "-le"]) {
+    const re = new RegExp(`\\s${op2}\\s`);
+    const opm = re.exec(innerQ);
+    if (!opm) continue;
+    const left2 = innerQ.slice(0, opm.index).trim();
+    const right2 = innerQ.slice(opm.index + opm[0].length).trim();
+    const lv2 = resolveVarSide(left2, env);
+    const rv2 = resolveVarSide(right2, env);
+    if (lv2 === null || rv2 === null) return null;
+    return evalNumericCompare(op2, lv2, rv2);
+  }
+  const sm = innerQ.match(/(.*?)\s*(==|=|!=|=~)\s*(.*)/);
+  if (!sm) return null;
+  const op = sm[2];
+  let left = sm[1].trim();
+  let right = sm[3].trim();
+  if (op === "=~") {
+    if (right.startsWith("/") && right.endsWith("/")) right = right.slice(1, -1);
+    const lv2 = resolveVarSide(left, env);
+    if (lv2 === null) return null;
+    try {
+      return new RegExp(right).test(lv2);
+    } catch {
+      return null;
+    }
+  }
+  const lv = resolveVarSide(left, env);
+  const rv = resolveVarSide(right, env);
+  if (lv === null || rv === null) return null;
+  if (op === "!=") return lv !== rv;
+  return lv === rv;
+}
+function symbolicProcess(content, entryArgs) {
+  if (!content) return null;
+  const stmts = tokenize(content);
+  if (!stmts.some((s) => s.kind === "case" || s.kind === "if" || s.kind === "assign")) return null;
+  if (stmts.some((s) => !s.modelable)) return null;
+  const env = initEnv(entryArgs);
+  let linesBudget = 0;
+  let branchesBudget = 0;
+  let modelable = false;
+  const out = [];
+  for (const s of stmts) {
+    linesBudget++;
+    if (linesBudget > MAX_LINES2) return null;
+    if (s.kind === "assign") {
+      modelable = true;
+      if (env.size >= MAX_VARS) return null;
+      const v = evalExpr2(s.rhs, env);
+      env.set(s.name, fold(v));
+      out.push(s.line);
+      continue;
+    }
+    if (s.kind === "case") {
+      modelable = true;
+      branchesBudget += s.branches.length;
+      if (branchesBudget > MAX_BRANCHES) return null;
+      const selVal = fold(evalExpr2(s.selector, env));
+      if (selVal.kind !== "concrete") return null;
+      const concrete = selVal.value || "";
+      let selected = null;
+      let fallback = "";
+      for (const b of s.branches) {
+        const patStripped = b.pat.trim();
+        if (patStripped === "*") {
+          fallback = b.body;
+          continue;
+        }
+        if (matchGlob(patStripped, concrete)) {
+          selected = b.body;
+          break;
+        }
+      }
+      const final = selected !== null ? selected : fallback || null;
+      if (final === null) return null;
+      out.push(`case ${s.selector} in
+${final}
+esac`);
+      continue;
+    }
+    if (s.kind === "if") {
+      modelable = true;
+      branchesBudget++;
+      if (branchesBudget > MAX_BRANCHES) return null;
+      const truth = evalCondition2(s.cond, env);
+      if (truth === null) return null;
+      const chosen = truth ? s.thenBody : s.elseBody;
+      if (chosen === null) return null;
+      out.push(`if ${s.cond}; then
+${chosen}
+fi`);
+      continue;
+    }
+    out.push(s.line);
+  }
+  if (!modelable) return null;
+  return out.join("\n");
+}
+var RE_DOTALL, MAX_LINES2, MAX_BRANCHES, MAX_VARS, ASGN_RE, CASE_START_RE, IF_START_RE, NOT_MODELED_RE, CASE_OPEN_RE, CASE_CLOSE_RE, IF_OPEN_RE, IF_CLOSE_RE, LOOP_DO_RE, LOOP_DONE_RE, FN_DEF_RE, FN_DEF_KW_RE, EXPR_SPLIT_RE, HAS_GLOB;
+var init_symbolic = __esm({
+  "src/engine/script-engine/symbolic.ts"() {
+    "use strict";
+    init_esm_shims();
+    RE_DOTALL = "s";
+    MAX_LINES2 = 500;
+    MAX_BRANCHES = 50;
+    MAX_VARS = 200;
+    ASGN_RE = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/;
+    CASE_START_RE = /^\s*case\s+/;
+    IF_START_RE = /^\s*if\s+/;
+    NOT_MODELED_RE = /\$\(|`[^`]*`/;
+    CASE_OPEN_RE = /\bcase\b/;
+    CASE_CLOSE_RE = /\besac\b/;
+    IF_OPEN_RE = /\bif\b/;
+    IF_CLOSE_RE = /\bfi\b/;
+    LOOP_DO_RE = /\bdo\b/g;
+    LOOP_DONE_RE = /\bdone\b/g;
+    FN_DEF_RE = /^\s*(?:function\s+)?[A-Za-z_][A-Za-z0-9_]*\s*\(\s*\)\s*\{/;
+    FN_DEF_KW_RE = /^\s*function\s+[A-Za-z_][A-Za-z0-9_]*\s*\{?/;
+    EXPR_SPLIT_RE = /(\$\{?\d+\}?|\$\{?[A-Za-z_][A-Za-z0-9_]*\}?)/;
+    HAS_GLOB = /[*?[]/;
+  }
+});
+
+// src/engine/script-engine/backends/shell-backend.ts
+function bindPositionalArgs(content, args) {
+  if (!args.length) return content;
+  const allArgs = args.join(" ");
+  content = content.replace(/\$\{(\d+|@|\*)(?::?[-]?([^}]*))?\}/g, (full, kind, defv) => {
+    if (kind === "@" || kind === "*") return allArgs;
+    if (!/^\d+$/.test(kind)) return full;
+    const idx = parseInt(kind, 10);
+    if (1 <= idx && idx <= args.length) return args[idx - 1];
+    return defv !== void 0 ? defv : "";
+  });
+  content = content.replace(/\$\{(\d+)\}/g, (full, kind) => {
+    const idx = parseInt(kind, 10);
+    if (1 <= idx && idx <= args.length) return args[idx - 1];
+    return "";
+  });
+  content = content.replace(/\$(\d+)/g, (full, kind) => {
+    const idx = parseInt(kind, 10);
+    if (1 <= idx && idx <= args.length) return args[idx - 1];
+    return "";
+  });
+  content = content.replace(/\$[@*]/g, allArgs);
+  return content;
+}
+function findSelectorValue(selector, args) {
+  if (!args || !args.length) return null;
+  const m = selector.match(/^\$\{?(\d+)\}?$/);
+  if (m) {
+    const idx = parseInt(m[1], 10);
+    if (1 <= idx && idx <= args.length) return args[idx - 1];
+    return null;
+  }
+  return null;
+}
+function splitCaseBody(body) {
+  const lines = body.split("\n");
+  const branches = [];
+  let cur = null;
+  for (const ln of lines) {
+    const stripped = ln.trim();
+    if (/^[\w:-]+\s*\(\)\s*\{/.test(stripped)) continue;
+    const m = stripped.match(/^([^()]+?)\s*\)\s*(.*)$/);
+    if (m) {
+      const pat = m[1].trim().replace(/^["']|["']$/g, "");
+      const inline = m[2].trim();
+      if (pat) {
+        if (cur) branches.push(cur);
+        cur = { label: pat, body: inline };
+      }
+      continue;
+    }
+    if (cur) {
+      cur.body += cur.body ? "\n" + ln : ln;
+      if (stripped.endsWith(";;")) {
+        branches.push(cur);
+        cur = null;
+      }
+    }
+  }
+  if (cur && cur.body.trim()) {
+    if (!branches.includes(cur)) branches.push(cur);
+  }
+  return branches;
+}
+function parseCase(content, args) {
+  const m = content.match(/\bcase\s+(\$\{?\d+\}?|[A-Za-z_]\w*|\$[A-Za-z_]\w*)\s+in/i);
+  if (!m) return null;
+  const selector = m[1].trim();
+  const val = findSelectorValue(selector, args);
+  if (val === null) return null;
+  const lines = content.split("\n");
+  const endMatch = findCaseEndInLines(lines, 0);
+  if (endMatch === -1) return null;
+  const bodyLines = lines.slice(1, endMatch);
+  const body = bodyLines.join("\n");
+  const hasNested = /\bcase\s+/.test(body) || /\bif\s+/.test(body);
+  let final;
+  if (hasNested) {
+    final = splitNestedCaseBranches(bodyLines, val);
+    if (final === null) return null;
+  } else {
+    const branches = splitCaseBody(body);
+    let selected = null;
+    let fallback = "";
+    for (const b of branches) {
+      const values = b.label.split("|").map((v) => v.trim()).filter(Boolean);
+      if (values.includes("*")) fallback = b.body;
+      else if (values.includes(val)) selected = b.body;
+    }
+    final = selected !== null ? selected : fallback || null;
+    if (final === null) return null;
+  }
+  const prefix = content.slice(0, m.index ?? 0);
+  const suffix = lines.slice(endMatch + 1).join("\n");
+  return `${prefix}
+${final}
+${suffix}`;
+}
+function findCaseEndInLines(lines, headerLine) {
+  let depth = 0;
+  for (let idx = headerLine; idx < lines.length; idx++) {
+    const ln = lines[idx];
+    const opens = (ln.match(/\bcase\b/g) || []).length;
+    const closes = (ln.match(/\besac\b/g) || []).length;
+    depth += opens - closes;
+    if (depth <= 0 && idx > headerLine) return idx;
+  }
+  return -1;
+}
+function splitNestedCaseBranches(bodyLines, selectorVal) {
+  let depth = 0;
+  let curPat = null;
+  let curBody = [];
+  let selected = null;
+  let fallback = null;
+  const flush = () => {
+    if (curPat === null) return;
+    const values = curPat.split("|").map((v) => v.trim()).filter(Boolean);
+    const body = curBody.join("\n");
+    if (values.includes("*")) {
+      if (fallback === null) fallback = body;
+    } else if (values.includes(selectorVal)) {
+      selected = body;
+    }
+    curPat = null;
+    curBody = [];
+  };
+  for (const ln of bodyLines) {
+    const stripped = ln.trim();
+    if (depth === 0) {
+      const bm = stripped.match(/^([^()]+?)\s*\)\s*(.*)$/);
+      if (bm) {
+        if (curPat !== null) flush();
+        curPat = bm[1].trim().replace(/^["']|["']$/g, "");
+        curBody = bm[2].trim() ? [bm[2].trim()] : [];
+        continue;
+      }
+    }
+    if (/\bcase\b/.test(stripped)) depth += 1;
+    else if (/\besac\b/.test(stripped)) depth = Math.max(0, depth - 1);
+    else if (curPat !== null) {
+      curBody.push(ln);
+      if (depth === 0 && stripped.endsWith(";;")) flush();
+    }
+  }
+  if (curPat !== null && curBody.length) flush();
+  return selected !== null ? selected : fallback;
+}
+function evalIfCondition(cond, args) {
+  if (!args || !args.length) return null;
+  let inner = cond.replace(/^\[\[?|\]\]?$/g, "").replace(/"/g, "").replace(/'/g, "").trim();
+  const m = inner.match(/(.*?)\s*(==|=)\s*(.*)/);
+  if (!m) return null;
+  let left = m[1].trim();
+  let right = m[3].trim();
+  const lm = left.match(/^\$(\d+)$/);
+  if (lm) {
+    const idx = parseInt(lm[1], 10);
+    if (1 <= idx && idx <= args.length) left = args[idx - 1];
+    else return null;
+  } else if (left.startsWith("$")) return null;
+  const rm = right.match(/^\$(\d+)$/);
+  if (rm) {
+    const idx = parseInt(rm[1], 10);
+    if (1 <= idx && idx <= args.length) right = args[idx - 1];
+    else return null;
+  } else if (right.startsWith("$")) return null;
+  return left === right;
+}
+function parseIf(content, args) {
+  const m = content.match(/\bif\s+([^\n;]+?)\s*;\s*then/i);
+  if (!m) return null;
+  const truth = evalIfCondition(m[1].trim(), args);
+  if (truth === null) return null;
+  const start = m.index ?? 0;
+  const thenBodyStart = start + m[0].length;
+  const fiPos = content.indexOf("fi", thenBodyStart);
+  if (fiPos === -1) return null;
+  const segment = content.slice(thenBodyStart, fiPos);
+  const elseM = segment.match(/\belse\b/);
+  let chosen;
+  if (truth) chosen = elseM ? segment.slice(0, elseM.index) : segment;
+  else {
+    if (!elseM) return null;
+    chosen = segment.slice((elseM.index ?? 0) + 4);
+  }
+  return `${content.slice(0, start)}
+${chosen}
+${content.slice(fiPos + 2)}`;
+}
+function markLoopsReachable(content) {
+  return content;
+}
+function extractCallsFromContent(content) {
+  const calls = [];
+  let m;
+  CHILD_CALL_RE2.lastIndex = 0;
+  while ((m = CHILD_CALL_RE2.exec(content)) !== null) {
+    const interp = m[1];
+    const path6 = m[2].trim();
+    let rest = m[3].trim();
+    if (path6.startsWith("-") || path6.startsWith("$") || path6.includes("/dev/")) continue;
+    rest = rest.split(/[;|&<>]/)[0].trim();
+    const args = [];
+    for (const tm of rest.matchAll(/(["'])(.*?)\1|(\S+)/g)) {
+      args.push(tm[1] ? tm[2] : tm[3]);
+    }
+    calls.push({ path: path6, args, interpreter: interp });
+  }
+  return calls;
+}
+var CHILD_CALL_RE2, ShellBackend;
+var init_shell_backend = __esm({
+  "src/engine/script-engine/backends/shell-backend.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_symbolic();
+    CHILD_CALL_RE2 = /(?:^|\s|&&|\|\|)\s*((?:\/bin\/)?bash|sh|zsh|(?:python|python3|node|ruby|perl|php|lua))\s+(\S+(?:\.(?:sh|shrc|py|js|rb|pl|php|lua))?)([^\n;|&]*?)$/gmi;
+    ShellBackend = class {
+      language = "shell";
+      parse(content, entryArgs) {
+        const c = content || "";
+        const orig = c;
+        let candidate = c;
+        let resolved = false;
+        const p1Safe = !/(?:\bshift\b|\bset\s+--(?:\s|$)|[\s;|&]read\b|^\s*read\b|\(\)\s*\{|function\s+\w+)/.test(c);
+        if (p1Safe) {
+          const caseOut = parseCase(candidate, entryArgs);
+          if (caseOut !== null && caseOut !== candidate) {
+            resolved = true;
+            candidate = caseOut;
+          }
+          const ifOut = parseIf(candidate, entryArgs);
+          if (ifOut !== null && ifOut !== candidate) {
+            resolved = true;
+            candidate = ifOut;
+          }
+        }
+        let bound = p1Safe ? bindPositionalArgs(candidate, entryArgs || []) : candidate;
+        if (!resolved) {
+          const symOut = symbolicProcess(c, entryArgs);
+          if (symOut !== null && symOut !== c) {
+            resolved = true;
+            bound = symOut;
+          }
+        }
+        const loopMarked = markLoopsReachable(bound);
+        const calls = extractCallsFromContent(loopMarked);
+        return {
+          reachableContent: loopMarked,
+          controlFlowResolved: resolved,
+          calls,
+          branches: [],
+          unresolvedSnippets: [],
+          language: this.language
+        };
+      }
+    };
+  }
+});
+
+// src/engine/script-engine/backends/index.ts
+var init_backends = __esm({
+  "src/engine/script-engine/backends/index.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_shell_backend();
+    init_shell_backend();
+    init_python_backend();
+  }
+});
+
+// src/engine/script-engine/tracker.ts
+import * as fs3 from "fs";
+import * as path3 from "path";
+import * as os from "os";
+function pickBackend(pathStr) {
+  const lower = pathStr.toLowerCase();
+  for (const ext of Object.keys(BACKENDS)) {
+    if (lower.endsWith(ext)) return BACKENDS[ext];
+  }
+  return DEFAULT_BACKEND;
+}
+function resolvePath(p, baseDir) {
+  let expanded = p;
+  if (expanded.startsWith("~/") || expanded === "~") {
+    expanded = path3.join(os.homedir(), expanded.slice(1));
+  } else if (!path3.isAbsolute(expanded) && baseDir) {
+    expanded = path3.join(baseDir, expanded);
+  }
+  return path3.resolve(expanded);
+}
+function readScript(pathStr, maxFileSize) {
+  try {
+    const p = resolvePath(pathStr);
+    if (!fs3.existsSync(p)) return { content: "", lineCount: 0, fileSize: 0, error: `\u811A\u672C\u4E0D\u5B58\u5728: ${pathStr}` };
+    const stat = fs3.statSync(p);
+    if (!stat.isFile()) return { content: "", lineCount: 0, fileSize: 0, error: `\u4E0D\u662F\u6587\u4EF6: ${pathStr}` };
+    if (stat.size > maxFileSize) {
+      return { content: "", lineCount: 0, fileSize: stat.size, error: `\u811A\u672C\u6587\u4EF6\u8FC7\u5927 (${stat.size} bytes)\uFF0C\u8DF3\u8FC7\u8BFB\u53D6` };
+    }
+    const content = fs3.readFileSync(p, "utf-8");
+    return { content, lineCount: content ? content.split("\n").length : 0, fileSize: stat.size, error: "" };
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
     return { content: "", lineCount: 0, fileSize: 0, error: `\u8BFB\u53D6\u811A\u672C\u5931\u8D25: ${msg}` };
   }
 }
-function extractChildScriptPaths(content, baseDir) {
-  const paths = [];
-  for (const pattern of CHILD_SCRIPT_PATTERNS) {
-    pattern.lastIndex = 0;
-    let m;
-    while ((m = pattern.exec(content)) !== null) {
-      const pathStr = m[1];
-      if (pathStr.startsWith("-") || pathStr.startsWith("$")) continue;
-      if (pathStr.includes("/dev/") || pathStr.startsWith("|") || pathStr.startsWith(";")) continue;
-      const full = isAbsolute(pathStr) ? pathStr : join4(baseDir, pathStr);
-      const resolved = resolvePath(full);
-      if (existsSync7(resolved)) {
-        try {
-          if (statSync(resolved).isFile() && !paths.includes(resolved)) paths.push(resolved);
-        } catch {
-        }
+function emptyNode(pathStr, depth) {
+  return {
+    scriptPath: pathStr,
+    rawContent: "",
+    preprocessedContent: "",
+    lineCount: 0,
+    fileSize: 0,
+    depth,
+    childPaths: [],
+    error: "",
+    l1Hit: false,
+    l1RiskLevel: "",
+    l1RiskType: "",
+    l1Reason: "",
+    l1MatchedPatterns: [],
+    l2Hit: false,
+    l2ViolatedRule: "",
+    l2RiskLevel: "",
+    l2RiskType: "",
+    l2Reason: "",
+    matchedKeywords: [],
+    isSuspicious: false,
+    keywordRiskLevel: "",
+    keywordRiskReason: ""
+  };
+}
+var DEFAULT_MAX_DEPTH, DEFAULT_MAX_NODES, DEFAULT_MAX_FILE_SIZE, DEFAULT_MAX_TOTAL_SIZE, BACKENDS, DEFAULT_BACKEND, RecursiveTracker;
+var init_tracker = __esm({
+  "src/engine/script-engine/tracker.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_python_backend();
+    init_backends();
+    DEFAULT_MAX_DEPTH = 14;
+    DEFAULT_MAX_NODES = 64;
+    DEFAULT_MAX_FILE_SIZE = 2 * 1024 * 1024;
+    DEFAULT_MAX_TOTAL_SIZE = 8 * 1024 * 1024;
+    BACKENDS = {
+      ".py": new PythonBackend()
+    };
+    DEFAULT_BACKEND = new ShellBackend();
+    RecursiveTracker = class {
+      constructor(commandScanner, maxDepth = DEFAULT_MAX_DEPTH, maxNodes = DEFAULT_MAX_NODES, maxFileSize = DEFAULT_MAX_FILE_SIZE, maxTotalSize = DEFAULT_MAX_TOTAL_SIZE) {
+        this.maxDepth = maxDepth;
+        this.maxNodes = maxNodes;
+        this.maxFileSize = maxFileSize;
+        this.maxTotalSize = maxTotalSize;
+        this._scanner = commandScanner;
+        this.result = {
+          nodes: [],
+          entryPath: "",
+          maxDepthReached: false,
+          maxSizeReached: false,
+          maxNodesReached: false,
+          totalSize: 0,
+          totalLines: 0,
+          totalNodes: 0,
+          hasCritical: false,
+          hasHigh: false,
+          firstHitNode: null,
+          error: ""
+        };
+      }
+      maxDepth;
+      maxNodes;
+      maxFileSize;
+      maxTotalSize;
+      result;
+      visiting = /* @__PURE__ */ new Set();
+      visitedPaths = /* @__PURE__ */ new Set();
+      _scanner;
+      track(entryPath, entryArgs, cwd = "") {
+        const baseDir = cwd || process.cwd();
+        const resolved = resolvePath(entryPath);
+        this.result.entryPath = resolved;
+        this.visitScript(resolved, 0, path3.dirname(resolved), entryArgs);
+        const nodes = this.result.nodes;
+        this.result.hasCritical = nodes.some((n) => n.l1RiskLevel === "critical" || n.l2RiskLevel === "critical" || n.keywordRiskLevel === "critical") || this.result.hasCritical;
+        this.result.hasHigh = nodes.some((n) => ["high", "critical"].includes(n.l1RiskLevel) || ["high", "critical"].includes(n.l2RiskLevel) || ["high", "critical"].includes(n.keywordRiskLevel));
+        this.result.firstHitNode = nodes.find((n) => n.l1Hit || n.l2Hit || n.isSuspicious) || null;
+        return this.result;
+      }
+      visitScript(pathStr, depth, baseDir, args) {
+        pathStr = resolvePath(pathStr);
+        if (this.visiting.has(pathStr)) return;
+        if (this.visitedPaths.has(pathStr)) return;
+        if (depth > this.maxDepth) {
+          this.result.maxDepthReached = true;
+          return;
+        }
+        if (this.result.nodes.length >= this.maxNodes) {
+          this.result.maxNodesReached = true;
+          return;
+        }
+        if (this.result.totalSize >= this.maxTotalSize) {
+          this.result.maxSizeReached = true;
+          return;
+        }
+        this.visiting.add(pathStr);
+        this.visitedPaths.add(pathStr);
+        const { content, lineCount, fileSize, error } = readScript(pathStr, this.maxFileSize);
+        if (error) {
+          const node2 = emptyNode(pathStr, depth);
+          node2.error = error;
+          node2.fileSize = fileSize;
+          node2.lineCount = lineCount;
+          this.result.nodes.push(node2);
+          this.visiting.delete(pathStr);
+          return;
+        }
+        this.result.totalSize += fileSize;
+        this.result.totalLines += lineCount;
+        const ir = pickBackend(pathStr).parse(content, args);
+        const node = emptyNode(pathStr, depth);
+        node.rawContent = content;
+        node.preprocessedContent = ir.reachableContent;
+        node.lineCount = lineCount;
+        node.fileSize = fileSize;
+        this.result.nodes.push(node);
+        this.result.totalNodes = this.result.nodes.length;
+        if (this._scanner && ir.reachableContent) {
+          const l1 = this._scanner(ir.reachableContent);
+          if (l1.hit) {
+            node.l1Hit = true;
+            node.l1RiskLevel = l1.riskLevel;
+            node.l1RiskType = l1.riskType;
+            node.l1Reason = l1.reason;
+            node.l1MatchedPatterns = l1.matchedPatterns || [];
+            if (l1.riskLevel === "critical") {
+              this.result.hasCritical = true;
+              this.result.firstHitNode = node;
+              this.visiting.delete(pathStr);
+              return;
+            }
+          }
+        }
+        const parentDir = path3.dirname(pathStr);
+        const childPaths = [];
+        for (const call of ir.calls) {
+          const child = resolvePath(call.path, parentDir);
+          childPaths.push(child);
+          this.visitScript(child, depth + 1, path3.dirname(child), call.args);
+          if (this.result.hasCritical) break;
+        }
+        node.childPaths = childPaths;
+        this.visiting.delete(pathStr);
+      }
+    };
+  }
+});
+
+// src/engine/script-content-analyzer.ts
+import { statSync as statSync2, existsSync as existsSync9 } from "fs";
+import { resolve as resolve8, join as join5, isAbsolute as isAbsolute2 } from "path";
+import { homedir as homedir3 } from "os";
+function emptyChain() {
+  return {
+    nodes: [],
+    entryPath: "",
+    maxDepthReached: false,
+    maxSizeReached: false,
+    maxNodesReached: false,
+    totalSize: 0,
+    totalLines: 0,
+    totalNodes: 0,
+    hasCritical: false,
+    hasHigh: false,
+    firstHitNode: null,
+    error: ""
+  };
+}
+function scanScriptForKeywords2(content) {
+  const matched = [];
+  for (const { name, pattern } of SUSPICIOUS_PATTERNS2) {
+    if (pattern.test(content)) matched.push(name);
+  }
+  return matched;
+}
+function assessKeywordCombinationRisk2(matchedKeywords, scriptContent) {
+  if (matchedKeywords.length === 0) return { level: "", reason: "" };
+  const keywordSet = new Set(matchedKeywords);
+  for (const rule of KEYWORD_COMBINATION_RISKS2) {
+    const hitGroup1 = [...rule.group1].some((k) => keywordSet.has(k));
+    const hitGroup2 = rule.group2.size === 0 ? true : [...rule.group2].some((k) => keywordSet.has(k));
+    if (hitGroup1 && hitGroup2) return { level: rule.level, reason: rule.reason };
+  }
+  const networkPostKeywords = /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]);
+  const hasNetworkPost = [...networkPostKeywords].some((k) => keywordSet.has(k));
+  if (hasNetworkPost) {
+    const envPatterns = ["$env", "$(env)", "$USER", "$(hostname)", "$(pwd)", "$HOME"];
+    const contentLower = scriptContent.toLowerCase();
+    for (const p of envPatterns) {
+      if (contentLower.includes(p.toLowerCase())) {
+        return {
+          level: "critical",
+          reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + \u7CFB\u7EDF\u73AF\u5883\u53D8\u91CF\u6536\u96C6\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u6570\u636E\u5916\u4F20\u98CE\u9669\u3002\u811A\u672C\u53EF\u80FD\u5C06\u7528\u6237\u73AF\u5883\u53D8\u91CF\uFF08\u53EF\u80FD\u5305\u542B API Key\u3001\u5BC6\u94A5\u7B49\u654F\u611F\u4FE1\u606F\uFF09\u53D1\u9001\u5230\u8FDC\u7A0B\u670D\u52A1\u5668\u3002"
+        };
       }
     }
   }
-  return paths;
-}
-function resolveScriptChain(entryPath, input, maxDepth = 3, maxFileSize = 2 * 1024 * 1024, maxTotalSize = 6 * 1024 * 1024) {
-  const visited = /* @__PURE__ */ new Set();
-  const result = emptyChain();
-  result.entryPath = entryPath;
-  const entry = resolvePath(entryPath);
-  const baseDir = existsSync7(entry) ? dirname6(entry) : input.cwd || process.cwd();
-  resolveRecursive({
-    path: entry,
-    depth: 0,
-    maxDepth,
-    maxFileSize,
-    maxTotalSize,
-    visited,
-    result,
-    baseDir,
-    input
-  });
-  result.hasCritical = result.nodes.some((n) => n.l1RiskLevel === "critical" || n.l2RiskLevel === "critical" || n.keywordRiskLevel === "critical");
-  result.hasHigh = result.nodes.some((n) => ["high", "critical"].includes(n.l1RiskLevel) || ["high", "critical"].includes(n.l2RiskLevel) || ["high", "critical"].includes(n.keywordRiskLevel));
-  result.firstHitNode = result.nodes.find((n) => n.l1Hit || n.l2Hit || n.isSuspicious) || null;
-  return result;
+  let bestLevel = "";
+  let bestReason = "";
+  for (const kw of matchedKeywords) {
+    const risk = SINGLE_KEYWORD_RISKS2[kw];
+    if (risk && (LEVEL_ORDER2[risk.level] || 0) > (LEVEL_ORDER2[bestLevel] || 0)) {
+      bestLevel = risk.level;
+      bestReason = risk.reason;
+    }
+  }
+  return { level: bestLevel, reason: bestReason };
 }
-function resolveRecursive(ctx) {
-  const { path: path3, depth, maxDepth, maxFileSize, maxTotalSize, visited, result, baseDir, input } = ctx;
-  if (visited.has(path3)) return;
-  if (depth > maxDepth) {
-    result.maxDepthReached = true;
-    return;
+function extractScriptPath2(command) {
+  for (const pattern of SCRIPT_EXEC_PATTERNS2) {
+    const m = command.match(pattern);
+    if (m) return m[1];
   }
-  if (result.totalSize >= maxTotalSize) {
-    result.maxSizeReached = true;
-    return;
+  return null;
+}
+function extractScriptPathWithArgs(command) {
+  const scriptPath = extractScriptPath2(command);
+  if (!scriptPath) return { path: null, args: [] };
+  const idx = command.indexOf(scriptPath);
+  if (idx < 0) return { path: scriptPath, args: [] };
+  let rest = command.slice(idx + scriptPath.length);
+  rest = rest.split(/[;|&<>]/)[0].trim();
+  const tokens = [...rest.matchAll(/(["'])(.*?)\1|(\S+)/g)];
+  const args = [];
+  for (const m of tokens) {
+    args.push(m[1] ? m[2] : m[3]);
   }
-  visited.add(path3);
-  const { content, lineCount, fileSize, error } = readScriptContent2(path3, maxFileSize);
-  if (error) {
-    const node2 = newNode(path3, depth);
-    node2.error = error;
-    node2.fileSize = fileSize;
-    node2.lineCount = lineCount;
-    result.nodes.push(node2);
-    return;
+  return { path: scriptPath, args };
+}
+function extractInlineScriptPath(actionDetail) {
+  const re = /open\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+  let m;
+  while ((m = re.exec(actionDetail)) !== null) {
+    const p = m[1];
+    let resolved;
+    try {
+      resolved = resolvePath2(p);
+      if (existsSync9(resolved)) {
+        const stat = statSync2(resolved);
+        if (stat.isFile()) return resolved;
+      }
+    } catch {
+    }
   }
-  result.totalSize += fileSize;
-  result.totalLines += lineCount;
-  const preprocessed = preprocessScriptContent(content);
-  const node = newNode(path3, depth);
-  node.rawContent = content;
-  node.preprocessedContent = preprocessed;
-  node.lineCount = lineCount;
-  node.fileSize = fileSize;
-  result.nodes.push(node);
-  const virtualInput = {
-    ...input,
-    aNext: { actionType: "bash", actionDetail: preprocessed }
-  };
-  const l1 = runHeuristicCheck(virtualInput);
-  if (l1 && !l1.allowed) {
-    node.l1Hit = true;
-    node.l1RiskLevel = l1.riskLevel;
-    node.l1RiskType = l1.riskType;
-    node.l1Reason = l1.reason;
-    node.l1MatchedPatterns = [];
-    if (l1.riskLevel === "critical") {
-      result.hasCritical = true;
-      result.firstHitNode = node;
-      return;
-    }
-  }
-  const childPaths = extractChildScriptPaths(preprocessed, baseDir);
-  node.childPaths = childPaths;
-  for (const childPath of childPaths) {
-    resolveRecursive({
-      path: resolvePath(childPath),
-      depth: depth + 1,
-      maxDepth,
-      maxFileSize,
-      maxTotalSize,
-      visited,
-      result,
-      baseDir: dirname6(resolvePath(childPath)),
-      input
-    });
-    if (result.hasCritical) return;
+  return null;
+}
+function resolvePath2(p) {
+  let expanded = p;
+  if (expanded.startsWith("~/") || expanded === "~") {
+    expanded = join5(homedir3(), expanded.slice(1));
   }
+  return resolve8(expanded);
 }
 function scanScriptChainWithL1(chain, input) {
   for (const node of chain.nodes) {
@@ -3369,14 +4973,31 @@ function scanScriptChainKeywords(chain) {
 function analyzeScriptContent2(input) {
   const actionType = input.aNext.actionType.toLowerCase();
   if (actionType !== "bash") return emptyChain();
-  const scriptPath = extractScriptPath2(input.aNext.actionDetail);
+  const { path: scriptPath, args: scriptArgs } = extractScriptPathWithArgs(input.aNext.actionDetail);
   let resolvedPath = scriptPath;
+  let isInline = false;
   if (!resolvedPath) {
     const inline = extractInlineScriptPath(input.aNext.actionDetail);
     if (!inline) return emptyChain();
     resolvedPath = inline;
+    isInline = true;
   }
-  const chain = resolveScriptChain(resolvedPath, input);
+  if (resolvedPath && !isAbsolute2(resolvedPath) && !resolvedPath.startsWith("~/")) {
+    resolvedPath = join5(input.cwd || process.cwd(), resolvedPath);
+  }
+  const l1Adapter = (content) => {
+    const virtualInput = {
+      ...input,
+      aNext: { actionType: "bash", actionDetail: content }
+    };
+    const j = runHeuristicCheck(virtualInput);
+    if (j && !j.allowed) {
+      return { hit: true, riskLevel: j.riskLevel, riskType: j.riskType, reason: j.reason, matchedPatterns: [] };
+    }
+    return { hit: false, riskLevel: "", riskType: "", reason: "", matchedPatterns: [] };
+  };
+  const tracker = new RecursiveTracker(l1Adapter);
+  const chain = tracker.track(resolvedPath, isInline ? null : scriptArgs, input.cwd || process.cwd());
   if (chain.nodes.length === 0) return chain;
   scanScriptChainWithL1(chain, input);
   scanScriptChainWithL2(chain, input);
@@ -3444,13 +5065,14 @@ ${contentPreview}
   if (chain.maxSizeReached) header += "\u26A0\uFE0F \u6CE8\u610F\uFF1A\u7D2F\u8BA1\u6587\u4EF6\u5927\u5C0F\u89E6\u8FBE\u4E0A\u9650\uFF0C\u90E8\u5206\u811A\u672C\u53EF\u80FD\u672A\u88AB\u5B8C\u6574\u8BFB\u53D6\u3002\n";
   return header + parts.join("\n---\n\n");
 }
-var SUSPICIOUS_PATTERNS2, SCRIPT_EXEC_PATTERNS2, KEYWORD_COMBINATION_RISKS2, SINGLE_KEYWORD_RISKS2, LEVEL_ORDER2, CHILD_SCRIPT_PATTERNS;
+var SUSPICIOUS_PATTERNS2, SCRIPT_EXEC_PATTERNS2, KEYWORD_COMBINATION_RISKS2, SINGLE_KEYWORD_RISKS2, LEVEL_ORDER2;
 var init_script_content_analyzer = __esm({
   "src/engine/script-content-analyzer.ts"() {
     "use strict";
     init_esm_shims();
     init_heuristic();
     init_logic_rules();
+    init_tracker();
     SUSPICIOUS_PATTERNS2 = [
       { name: "curl POST", pattern: /curl\s+(.*\s)?-X\s+POST/i },
       { name: "curl --data", pattern: /curl\s+(.*\s)?--data/i },
@@ -3533,18 +5155,6 @@ var init_script_content_analyzer = __esm({
       "ssh no host key check": { level: "high", reason: "\u68C0\u6D4B\u5230 SSH \u8DF3\u8FC7\u4E3B\u673A\u5BC6\u94A5\u9A8C\u8BC1\uFF0C\u53EF\u80FD\u662F\u6A2A\u5411\u79FB\u52A8\u3002" }
     };
     LEVEL_ORDER2 = { low: 1, medium: 2, high: 3, critical: 4 };
-    CHILD_SCRIPT_PATTERNS = [
-      /(?:^|\s|&&|\|\|)\s*bash\s+(\S+)/i,
-      /(?:^|\s|&&|\|\|)\s*sh\s+(\S+)/i,
-      /(?:^|\s|&&|\|\|)\s*source\s+(\S+)/i,
-      /(?:^|\s|&&|\|\|)\s*\.\s+(\S+)/,
-      /(?:^|\s|&&|\|\|)\s*python3?\s+(\S+\.py)/i,
-      /(?:^|\s|&&|\|\|)\s*node\s+(\S+\.js)/i,
-      /(?:^|\s|&&|\|\|)\s*ruby\s+(\S+\.rb)/i,
-      /(?:^|\s|&&|\|\|)\s*perl\s+(\S+\.pl)/i,
-      /(?:^|\s|&&|\|\|)\s*php\s+(\S+\.php)/i,
-      /(?:^|\s|&&|\|\|)\s*lua\s+(\S+\.lua)/i
-    ];
   }
 });
 
@@ -3558,16 +5168,16 @@ __export(token_stats_exports, {
   recordTokenUsage: () => recordTokenUsage,
   resetTokenStats: () => resetTokenStats
 });
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync2, existsSync as existsSync8, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2 } from "fs";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync2, existsSync as existsSync10, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2 } from "fs";
 function getStatsPath() {
   const envPath = process.env[ENV_STATS_PATH];
   if (envPath) return envPath;
   return getTokenStatsPath();
 }
 function loadAllRecords(statsPath) {
-  if (!existsSync8(statsPath)) return [];
+  if (!existsSync10(statsPath)) return [];
   try {
-    const data = JSON.parse(readFileSync9(statsPath, "utf-8"));
+    const data = JSON.parse(readFileSync11(statsPath, "utf-8"));
     if (Array.isArray(data)) return data;
     if (data && Array.isArray(data.records)) return data.records;
     return [];
@@ -3578,7 +5188,7 @@ function loadAllRecords(statsPath) {
 function saveRecords(statsPath, records) {
   try {
     const dir = statsPath.substring(0, statsPath.lastIndexOf("/"));
-    if (dir && !existsSync8(dir)) mkdirSync2(dir, { recursive: true });
+    if (dir && !existsSync10(dir)) mkdirSync2(dir, { recursive: true });
     writeFileSync2(statsPath, JSON.stringify(records, null, 2), "utf-8");
   } catch (e) {
   }
@@ -3705,7 +5315,7 @@ function getTokenTrend(days = 0, startDate, endDate) {
 }
 function resetTokenStats() {
   const statsPath = getStatsPath();
-  if (existsSync8(statsPath)) {
+  if (existsSync10(statsPath)) {
     try {
       unlinkSync2(statsPath);
     } catch {
@@ -3935,7 +5545,7 @@ async function analyzeWithLLM(prompt, config) {
       }
       if (attempt < maxRetries) {
         console.error(`[AgentMoss] LLM call failed (attempt ${attempt + 1}/${maxRetries + 1}), retrying in ${retryCfg.retryInterval}s:`, err.message);
-        await new Promise((resolve7) => setTimeout(resolve7, retryCfg.retryInterval * 1e3));
+        await new Promise((resolve9) => setTimeout(resolve9, retryCfg.retryInterval * 1e3));
       } else {
         clearTimeout(totalTimeoutTimer);
         console.error("[AgentMoss] LLM call failed after all retries:", err.message);
@@ -3962,9 +5572,9 @@ var init_llm_analyzer = __esm({
 });
 
 // src/brain/rule-store.ts
-import { existsSync as existsSync9, readFileSync as readFileSync10, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
-import { join as join5 } from "path";
-import { homedir as homedir3 } from "os";
+import { existsSync as existsSync11, readFileSync as readFileSync12, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
+import { join as join6 } from "path";
+import { homedir as homedir4 } from "os";
 function getRulesPath() {
   const envPath = process.env[ENV_RULES_PATH];
   if (envPath) return envPath;
@@ -3982,7 +5592,7 @@ var init_rule_store = __esm({
   "src/brain/rule-store.ts"() {
     "use strict";
     init_esm_shims();
-    DEFAULT_RULES_PATH = join5(homedir3(), ".agentmoss", "brain", "rules.json");
+    DEFAULT_RULES_PATH = join6(homedir4(), ".agentmoss", "brain", "rules.json");
     ENV_RULES_PATH = "AGENT_MOSS_BRAIN_RULES_PATH";
     STATUS_DRAFT = "draft";
     STATUS_APPROVED = "approved";
@@ -3994,16 +5604,16 @@ var init_rule_store = __esm({
     BrainRuleStore = class {
       path;
       data;
-      constructor(path3) {
-        this.path = path3 || getRulesPath();
+      constructor(path6) {
+        this.path = path6 || getRulesPath();
         this.data = this.load();
       }
       load() {
-        if (!existsSync9(this.path)) {
+        if (!existsSync11(this.path)) {
           return { version: 1, rules: [], pattern_candidates: [] };
         }
         try {
-          const raw = JSON.parse(readFileSync10(this.path, "utf-8"));
+          const raw = JSON.parse(readFileSync12(this.path, "utf-8"));
           return {
             version: raw.version || 1,
             rules: raw.rules || [],
@@ -4308,10 +5918,10 @@ var init_pattern_extractor = __esm({
           const pathRe = new RegExp(pathPrefix + pathBody + pathSuffix, "g");
           let mm;
           while ((mm = pathRe.exec(src)) !== null) {
-            const path3 = mm[1];
-            if (path3.split("/").length < 3) continue;
-            if (["/dev/null", "/dev/zero", "/dev/random", "/dev/urandom"].includes(path3)) continue;
-            const gen = this.generalizePath(path3);
+            const path6 = mm[1];
+            if (path6.split("/").length < 3) continue;
+            if (["/dev/null", "/dev/zero", "/dev/random", "/dev/urandom"].includes(path6)) continue;
+            const gen = this.generalizePath(path6);
             if (seen.has(gen)) continue;
             seen.add(gen);
             patterns.push({ pattern: gen, layer: 1, scope: "openat", ruleType: "deny_path" });
@@ -4330,8 +5940,8 @@ var init_pattern_extractor = __esm({
         }
         return false;
       }
-      generalizePath(path3) {
-        const p = path3.toLowerCase();
+      generalizePath(path6) {
+        const p = path6.toLowerCase();
         if (/\/etc\/(shadow|passwd|sudoers|security|ssh)/.test(p)) {
           return "(?:^|[^a-z0-9_-])etc/(?:shadow|passwd|sudoers|security/|ssh/)";
         }
@@ -4456,58 +6066,980 @@ var init_reviewer = __esm({
   }
 });
 
-// src/brain/index.ts
-function checkBrainRules(store, opts) {
-  if (!store) return null;
-  const rules = store.getActiveRules(opts.layer);
-  if (rules.length === 0) return null;
-  const combined = `${opts.actionType} ${opts.actionDetail}`;
-  for (const rule of rules) {
-    try {
-      if (new RegExp(rule.pattern, "i").test(combined)) {
-        if (opts.layer === 2 && opts.actionHistory) {
-          if (!checkLayer2Context(rule.pattern, opts.actionHistory, opts.actionDetail)) {
-            continue;
+// src/brain/index.ts
+function checkBrainRules(store, opts) {
+  if (!store) return null;
+  const rules = store.getActiveRules(opts.layer);
+  if (rules.length === 0) return null;
+  const combined = `${opts.actionType} ${opts.actionDetail}`;
+  for (const rule of rules) {
+    try {
+      if (new RegExp(rule.pattern, "i").test(combined)) {
+        if (opts.layer === 2 && opts.actionHistory) {
+          if (!checkLayer2Context(rule.pattern, opts.actionHistory, opts.actionDetail)) {
+            continue;
+          }
+        }
+        store.recordTrigger(rule.id);
+        return {
+          ruleId: rule.id,
+          pattern: rule.pattern,
+          explanation: rule.explanation,
+          confidence: rule.confidence
+        };
+      }
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+function checkLayer2Context(pattern, actionHistory, actionDetail) {
+  if (pattern.startsWith("BEHAVIOR_CHAIN:")) {
+    const chainType = pattern.replace("BEHAVIOR_CHAIN:", "");
+    if (chainType === "external_read\u2192sensitive_write") {
+      const hasExternalRead = actionHistory.slice(-5).some((h) => /curl|wget|http/i.test(h.actionDetail ?? ""));
+      const isSensitiveWrite = /\.ssh|\.gnupg|authorized_keys|bashrc|profile/i.test(actionDetail);
+      return hasExternalRead && isSensitiveWrite;
+    }
+    if (chainType === "multi_config_read\u2192privilege_action") {
+      const configReads = actionHistory.slice(-5).filter((h) => /\/etc\/|config|\.conf|\.yaml|\.json/i.test(h.actionDetail ?? "")).length;
+      const isPrivilege = /sudo|su |chmod|chown/i.test(actionDetail);
+      return configReads >= 2 && isPrivilege;
+    }
+    return false;
+  }
+  return true;
+}
+var init_brain = __esm({
+  "src/brain/index.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_rule_store();
+    init_pattern_extractor();
+    init_reviewer();
+  }
+});
+
+// src/engine/formal-engine/decode.ts
+function isValidBase64Token(tok) {
+  if (tok.length < 8) return false;
+  if (!(tok.length % 4 === 0 || tok.endsWith("==") || tok.endsWith("="))) return false;
+  return true;
+}
+function isPrintable(s) {
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c < 32 || c > 126) return false;
+  }
+  return true;
+}
+function decodeBase64Literals(text) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const m of text.matchAll(B64_TOKEN_RE)) {
+    const tok = m[0];
+    if (!isValidBase64Token(tok)) continue;
+    if (!/[A-Z]/.test(tok) || !/[a-z]/.test(tok)) continue;
+    try {
+      const padded = tok + "=".repeat((4 - tok.length % 4) % 4);
+      const bin = Buffer.from(padded, "base64");
+      const s = bin.toString("utf8");
+      if (s && isPrintable(s) && !seen.has(s)) {
+        seen.add(s);
+        out.push(s);
+      }
+    } catch {
+    }
+  }
+  return out;
+}
+function decodeUrlAndNumeric(text) {
+  const out = [];
+  let s = text;
+  for (let i = 0; i < 3; i++) {
+    let nxt = s;
+    try {
+      nxt = decodeURIComponent(s);
+    } catch {
+      break;
+    }
+    if (nxt === s) break;
+    s = nxt;
+  }
+  if (s !== text) out.push(s);
+  if (/\\[0-7]{3}/.test(text)) {
+    let expanded = "";
+    try {
+      expanded = text.replace(/\\[0-7]{3}/g, (m) => String.fromCharCode(parseInt(m.slice(1), 8)));
+    } catch {
+    }
+    if (expanded && expanded !== text) out.push(expanded);
+  }
+  if (/\\x[0-9a-fA-F]{2}/.test(text)) {
+    let expanded = "";
+    try {
+      expanded = text.replace(/\\x[0-9a-fA-F]{2}/g, (m) => String.fromCharCode(parseInt(m.slice(2), 16)));
+    } catch {
+    }
+    if (expanded && expanded !== text) out.push(expanded);
+  }
+  return out;
+}
+function allCandidates(detail, max = 8) {
+  const cands = [detail];
+  cands.push(...decodeBase64Literals(detail));
+  cands.push(...decodeUrlAndNumeric(detail));
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const c of cands) {
+    if (seen.has(c) || c.length > 4096) continue;
+    seen.add(c);
+    out.push(c);
+    if (out.length >= max) break;
+  }
+  return out;
+}
+function matchStageAny(detail, stages) {
+  for (const cand of allCandidates(detail)) {
+    for (const [name, pats] of Object.entries(stages)) {
+      for (const p of pats) {
+        p.lastIndex = 0;
+        if (p.test(cand)) return name;
+      }
+    }
+  }
+  return "";
+}
+var B64_TOKEN_RE;
+var init_decode = __esm({
+  "src/engine/formal-engine/decode.ts"() {
+    "use strict";
+    init_esm_shims();
+    B64_TOKEN_RE = /[A-Za-z0-9+/]+={0,2}/g;
+  }
+});
+
+// src/engine/formal-engine/builder.ts
+function loadStages() {
+  if (COMBO_STAGES2) return COMBO_STAGES2;
+  const combo = loadL2().combo_chains || {};
+  const stages = {};
+  for (const [name, pats] of Object.entries(combo.stages || {})) {
+    stages[name] = pats.map((p) => new RegExp(p, "i"));
+  }
+  COMBO_STAGES2 = stages;
+  return stages;
+}
+function extractResources(actionDetail) {
+  const resources = /* @__PURE__ */ new Set();
+  const text = actionDetail.replace(/'[^']*'|"[^"]*"/g, "");
+  PATH_RE.lastIndex = 0;
+  let m;
+  while ((m = PATH_RE.exec(text)) !== null) {
+    const p = m[1];
+    if (p.startsWith("/dev/") || p.includes("://")) continue;
+    resources.add(p);
+  }
+  return resources;
+}
+function markStage(actionDetail) {
+  return matchStageAny(actionDetail, loadStages());
+}
+function buildSessionGraph(actionHistory, aNext, sessionId = "current") {
+  const nodes = [];
+  const edges = [];
+  const stageFlags = /* @__PURE__ */ new Set();
+  const details = [];
+  for (const a of actionHistory) {
+    const ad = String(a.actionDetail || "");
+    if (ad) details.push({ actionType: String(a.actionType || ""), actionDetail: ad });
+  }
+  if (aNext) {
+    details.push({ actionType: String(aNext.actionType || ""), actionDetail: String(aNext.actionDetail || "") });
+  }
+  details.forEach((d, seq) => {
+    const stage = markStage(d.actionDetail);
+    const node = {
+      sessionId,
+      seq,
+      actionType: d.actionType,
+      actionDetail: d.actionDetail,
+      stage,
+      resources: extractResources(d.actionDetail)
+    };
+    nodes.push(node);
+    if (stage) stageFlags.add(stage);
+  });
+  for (let i = 0; i < nodes.length - 1; i++) {
+    edges.push({ src: i, dst: i + 1, kind: "next" });
+  }
+  return { sessionId, nodes, edges, stageFlags };
+}
+function buildMultiSessionGraph(sessions, aNext) {
+  const mg = { sessions: [], crossEdges: [] };
+  if (!sessions || sessions.length === 0) {
+    mg.sessions.push(buildSessionGraph([], aNext, "current"));
+    return mg;
+  }
+  for (const s of sessions) {
+    const sid = String(s.sessionId || "s");
+    mg.sessions.push(buildSessionGraph(s.actionHistory || [], void 0, sid));
+  }
+  if (aNext) {
+    const last = mg.sessions[mg.sessions.length - 1];
+    if (last.sessionId === "current") {
+      const stage = markStage(String(aNext.actionDetail || ""));
+      last.nodes.push({
+        sessionId: last.sessionId,
+        seq: last.nodes.length,
+        actionType: String(aNext.actionType || ""),
+        actionDetail: String(aNext.actionDetail || ""),
+        stage,
+        resources: extractResources(String(aNext.actionDetail || ""))
+      });
+      if (last.nodes.length > 1) {
+        last.edges.push({ src: last.nodes.length - 2, dst: last.nodes.length - 1, kind: "next" });
+      }
+    } else {
+      mg.sessions.push(buildSessionGraph([], aNext, "current"));
+    }
+  }
+  addCrossDataEdges(mg);
+  return mg;
+}
+function addCrossDataEdges(mg) {
+  const nodes = allNodesFlat(mg);
+  if (nodes.length < 2) return;
+  for (let i = 0; i < nodes.length; i++) {
+    for (let j = i + 1; j < nodes.length; j++) {
+      if (nodes[i].sessionId === nodes[j].sessionId) continue;
+      const shared = intersect(nodes[i].resources, nodes[j].resources);
+      if (shared.size > 0) {
+        mg.crossEdges.push({ src: i, dst: j, kind: "data" });
+      }
+    }
+  }
+}
+function allNodesFlat(mg) {
+  const out = [];
+  for (const s of mg.sessions) out.push(...s.nodes);
+  return out;
+}
+function intersect(a, b) {
+  const out = /* @__PURE__ */ new Set();
+  for (const v of a) if (b.has(v)) out.add(v);
+  return out;
+}
+var COMBO_STAGES2, PATH_RE;
+var init_builder = __esm({
+  "src/engine/formal-engine/builder.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_rules_loader();
+    init_decode();
+    COMBO_STAGES2 = null;
+    PATH_RE = /(?:^|\s|[@=])((?:\/|~\/)[\w./~-]+)/g;
+  }
+});
+
+// src/engine/formal-engine/ir.ts
+function allNodes(mg) {
+  const out = [];
+  for (const s of mg.sessions) out.push(...s.nodes);
+  return out;
+}
+function allEdges(mg) {
+  const out = [];
+  for (const s of mg.sessions) out.push(...s.edges);
+  out.push(...mg.crossEdges);
+  return out;
+}
+function emptyVerificationResult() {
+  return { verified: true, violations: [] };
+}
+var init_ir = __esm({
+  "src/engine/formal-engine/ir.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
+// src/engine/formal-engine/properties.ts
+function loadCrossSessionChains() {
+  if (CROSS_SESSION_CHAINS) return CROSS_SESSION_CHAINS;
+  const combo = loadL2().combo_chains || {};
+  CROSS_SESSION_CHAINS = (combo.chains || []).map((c) => ({
+    id: String(c.id || "combo_chain"),
+    stages: c.stages || [],
+    riskLevel: String(c.riskLevel || c.risk_level || "high"),
+    reason: "\u8DE8\u4F1A\u8BDD" + String(c.reason || "\u7EC4\u5408\u653B\u51FB\u94FE")
+  }));
+  return CROSS_SESSION_CHAINS;
+}
+function checkCrossSessionChain(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length === 0) return violations;
+  for (const chain of loadCrossSessionChains()) {
+    const stages = chain.stages;
+    if (!stages.length) continue;
+    let matched = 0;
+    let stageIdx = 0;
+    const path6 = [];
+    for (const n of nodes) {
+      if (stageIdx < stages.length && n.stage === stages[stageIdx]) {
+        matched += 1;
+        path6.push({ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) });
+        stageIdx += 1;
+        if (matched >= stages.length) break;
+      }
+    }
+    if (matched >= stages.length) {
+      violations.push({
+        propertyId: "cross-" + chain.id,
+        reason: chain.reason,
+        riskLevel: chain.riskLevel,
+        path: path6
+      });
+    }
+  }
+  return violations;
+}
+function checkSensitiveDataFlow(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length === 0) return violations;
+  const tainted = /* @__PURE__ */ new Map();
+  for (let i = 0; i < nodes.length; i++) {
+    const n = nodes[i];
+    if (n.stage === "CRED" && [...n.resources].some((r) => CRED_FILE_RE.test(r))) {
+      tainted.set(i, `${n.sessionId}#${n.seq} \u8BBF\u95EE ${[...n.resources][0]}`);
+    }
+  }
+  if (tainted.size === 0) return violations;
+  const edges = allEdges(graph);
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const e of edges) {
+      if (tainted.has(e.src) && !tainted.has(e.dst)) {
+        const srcRes = nodes[e.src].resources;
+        const dstRes = nodes[e.dst].resources;
+        for (const r of srcRes) {
+          if (dstRes.has(r)) {
+            tainted.set(e.dst, tainted.get(e.src));
+            changed = true;
+            break;
+          }
+        }
+      }
+    }
+  }
+  for (const [i, n] of nodes.entries()) {
+    if (tainted.has(i) && EXFIL_RE.test(n.actionDetail)) {
+      violations.push({
+        propertyId: "sensitive-data-exfil",
+        reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${tainted.get(i)} \u2192 ${n.sessionId}#${n.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
+        riskLevel: "critical",
+        path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
+      });
+    }
+  }
+  return violations;
+}
+function isExfilNode(n) {
+  if (n.stage === "EXFIL") return true;
+  if (EXFIL_RE.test(n.actionDetail) && EXFIL_ACTION_RE.test(n.actionDetail)) return true;
+  if (EBPF_NET_RE.test(n.actionDetail) && REMOTE_RE.test(n.actionDetail)) return true;
+  return false;
+}
+function isCredNode(n) {
+  if (n.stage !== "CRED") return false;
+  for (const r of n.resources) {
+    if (CRED_STRICT_RE.test(r)) return true;
+  }
+  return CRED_STRICT_RE.test(n.actionDetail);
+}
+function isPrivescNode(n) {
+  if (n.stage === "PRIVESC") return true;
+  return PRIVESC_RE.test(n.actionDetail);
+}
+function checkNeverExfilAfterPrivesc(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length < 2) return violations;
+  for (let i = 0; i < nodes.length; i++) {
+    if (!isPrivescNode(nodes[i])) continue;
+    for (let j = i + 1; j < nodes.length; j++) {
+      if (isExfilNode(nodes[j])) {
+        violations.push({
+          propertyId: "no-privesc-then-exfil",
+          reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\xAC\u25C7EXFIL)",
+          riskLevel: "critical",
+          path: [
+            { sessionId: nodes[i].sessionId, seq: nodes[i].seq, detail: nodes[i].actionDetail.slice(0, 60) },
+            { sessionId: nodes[j].sessionId, seq: nodes[j].seq, detail: nodes[j].actionDetail.slice(0, 60) }
+          ]
+        });
+        return violations;
+      }
+    }
+  }
+  return violations;
+}
+function checkNeverExfilAfterCred(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length < 2) return violations;
+  for (let i = 0; i < nodes.length; i++) {
+    if (!isCredNode(nodes[i])) continue;
+    for (let j = i + 1; j < nodes.length; j++) {
+      if (isExfilNode(nodes[j])) {
+        violations.push({
+          propertyId: "no-cred-then-exfil",
+          reason: "\u8BFB\u53D6\u51ED\u636E\u540E\u51FA\u73B0\u5916\u4F20\uFF0C\u8FDD\u53CD \u25A1(CRED\u2192\xAC\u25C7EXFIL)",
+          riskLevel: "critical",
+          path: [
+            { sessionId: nodes[i].sessionId, seq: nodes[i].seq, detail: nodes[i].actionDetail.slice(0, 60) },
+            { sessionId: nodes[j].sessionId, seq: nodes[j].seq, detail: nodes[j].actionDetail.slice(0, 60) }
+          ]
+        });
+        return violations;
+      }
+    }
+  }
+  return violations;
+}
+var CROSS_SESSION_CHAINS, CRED_FILE_RE, EXFIL_RE, EBPF_NET_RE, REMOTE_RE, PRIVESC_RE, EXFIL_ACTION_RE, CRED_STRICT_RE, ALL_PROPERTIES;
+var init_properties = __esm({
+  "src/engine/formal-engine/properties.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_rules_loader();
+    init_ir();
+    CROSS_SESSION_CHAINS = null;
+    CRED_FILE_RE = /(known_hosts|\.ssh|id_rsa|\/etc\/shadow|\/etc\/passwd|credentials)/i;
+    EXFIL_RE = /https?:\/\/|scp\s+.*@|rsync\s+.*@/i;
+    EBPF_NET_RE = /connect|sendto|network_connect/i;
+    REMOTE_RE = /to\s+\d+\.\d+\.\d+\.\d+|remote_addr/i;
+    PRIVESC_RE = /\bsudo\b|\bsu\b|chmod\s+u\s*\+\s*s|pkexec|setuid/i;
+    EXFIL_ACTION_RE = /\bcurl\b|\bwget\b|\bscp\b|\brsync\b|\brclone\b|\bftp\b|connect\s+.*\d+\.\d+\.\d+\.\d+|open\s+.*tcp|base64\s+.*\-o/i;
+    CRED_STRICT_RE = /(known_hosts|\.ssh|id_rsa|\.pem|\b\.key\b|\/etc\/shadow|\/etc\/passwd|\.aws\/credentials|credentials\.json|netrc|password|secrets?\.ya?ml|credentials?\s*(file|path)?\s*(=|\:)|\bconfig.*(password|token))/i;
+    ALL_PROPERTIES = [
+      { id: "cross-session-chain", check: checkCrossSessionChain },
+      { id: "sensitive-data-flow", check: checkSensitiveDataFlow },
+      { id: "no-privesc-then-exfil", check: checkNeverExfilAfterPrivesc },
+      { id: "no-cred-then-exfil", check: checkNeverExfilAfterCred }
+    ];
+  }
+});
+
+// src/engine/formal-engine/engine.ts
+function ebpfEventToDetail(e) {
+  const parts = [];
+  const syscall = String(e.syscall || e.op || "");
+  const argv = String(e.argv || e.pathname || "");
+  const remote = String(e.remote_addr || "");
+  const port = e.remote_port;
+  if (syscall) parts.push(syscall);
+  if (argv && argv !== "" && argv !== "None") parts.push(argv);
+  if (remote) parts.push("to " + remote + (port ? ":" + String(port) : ""));
+  return parts.join(" ");
+}
+var FormalEngine;
+var init_engine = __esm({
+  "src/engine/formal-engine/engine.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_builder();
+    init_ir();
+    init_properties();
+    FormalEngine = class {
+      properties;
+      constructor(properties) {
+        this.properties = properties && properties.length > 0 ? properties : ALL_PROPERTIES;
+      }
+      verify(sessions, aNext, ebpfEvents) {
+        const all = sessions ? [...sessions] : [];
+        if (ebpfEvents && ebpfEvents.length > 0) {
+          all.push({
+            sessionId: "ebpf-evidence",
+            actionHistory: ebpfEvents.map((e) => ({
+              actionType: "syscall",
+              actionDetail: ebpfEventToDetail(e)
+            }))
+          });
+        }
+        const graph = buildMultiSessionGraph(all, aNext);
+        const result = emptyVerificationResult();
+        for (const prop of this.properties) {
+          let violations;
+          try {
+            violations = prop.check(graph);
+          } catch (e) {
+            result.verified = false;
+            result.violations.push({
+              propertyId: prop.id,
+              reason: `\u5F62\u5F0F\u5316\u6027\u8D28\u9A8C\u8BC1\u5F02\u5E38\uFF0C\u4FDD\u5B88\u62E6\u622A: ${e}`,
+              riskLevel: "medium",
+              path: []
+            });
+            return result;
+          }
+          if (violations.length > 0) {
+            result.verified = false;
+            result.violations.push(...violations);
+            break;
+          }
+        }
+        return result;
+      }
+    };
+  }
+});
+
+// src/engine/formal-engine/stateful.ts
+function loadRules() {
+  if (STAGES_PATTERNS !== null && CHAINS !== null) {
+    return { stages: STAGES_PATTERNS, chains: CHAINS };
+  }
+  const combo = loadL2().combo_chains || {};
+  const stages = {};
+  for (const [name, pats] of Object.entries(combo.stages || {})) {
+    stages[name] = pats.map((p) => new RegExp(p, "i"));
+  }
+  const chains = combo.chains || [];
+  STAGES_PATTERNS = stages;
+  CHAINS = chains;
+  return { stages, chains };
+}
+function markStage2(actionDetail) {
+  const { stages } = loadRules();
+  return matchStageAny(actionDetail, stages);
+}
+function extractResources2(actionDetail) {
+  const text = actionDetail.replace(/'[^']*'|"[^"]*"/g, "");
+  const out = [];
+  const re = /(?:^|\s|[@=])((?:\/|~\/)[\w./~-]+)/g;
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    const p = m[1];
+    if (p.startsWith("/dev/") || p.includes("://")) continue;
+    if (!out.includes(p)) out.push(p);
+  }
+  return out;
+}
+function lifecycleFor(detail, stage, isError) {
+  if (isError) {
+    if (stage === "LISTEN" || stage === "PERSIST" || NEVER_ACTIVATED_RE.test(detail)) return "never_activated";
+  }
+  if (DESTROY_RE.test(detail)) return "dead";
+  if (stage === "LISTEN" || stage === "PERSIST") return "alive";
+  if (detail.includes(">>") || detail.includes(">")) return "alive";
+  return "";
+}
+var DESTROY_RE, NEVER_ACTIVATED_RE, CRED_FILE_RE2, EXFIL_RE2, STAGES_PATTERNS, CHAINS, MAX_NODES, StatefulChainTracker;
+var init_stateful = __esm({
+  "src/engine/formal-engine/stateful.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_rules_loader();
+    init_decode();
+    DESTROY_RE = /\b(?:pkill|kill)\b|systemctl\s+stop|service\s+stop|crontab\s+-r|rm\s+-[rf]?\s+/i;
+    NEVER_ACTIVATED_RE = /\b(?:not\s+found|no\s+such\s+file|command\s+not\s+found|refused|failed\s+to\s+(?:start|bind|listen)|address\s+already\s+in\s+use)\b/i;
+    CRED_FILE_RE2 = /(known_hosts|\.ssh|id_rsa|\/etc\/shadow|\/etc\/passwd|credentials)/i;
+    EXFIL_RE2 = /https?:\/\/|scp\s+.*@|rsync\s+.*@/i;
+    STAGES_PATTERNS = null;
+    CHAINS = null;
+    MAX_NODES = 1e5;
+    StatefulChainTracker = class {
+      agentId;
+      nodes_ = [];
+      ptr = {};
+      tainted = /* @__PURE__ */ new Set();
+      /** taint 反索引：资源路径 → 已染毒（O(1) 命中）。 */
+      taintedResources = /* @__PURE__ */ new Set();
+      aliveResources = {};
+      seqNext = 0;
+      constructor(agentId = "") {
+        this.agentId = agentId;
+        loadRules();
+      }
+      get nodes() {
+        return this.nodes_;
+      }
+      get pendingPrefixes() {
+        const { chains } = loadRules();
+        const out = [];
+        for (const chain of chains) {
+          const stages = chain.stages || [];
+          if (stages.length === 0) continue;
+          const matched = this.ptr[String(chain.id || "")] || 0;
+          if (matched > 0 && matched < stages.length) {
+            const pf = {
+              chainId: String(chain.id || ""),
+              stages,
+              matched,
+              riskLevel: String(chain.riskLevel || chain.risk_level || "high"),
+              get nextStage() {
+                return this.matched < this.stages.length ? this.stages[this.matched] : "";
+              }
+            };
+            out.push(pf);
           }
         }
-        store.recordTrigger(rule.id);
+        return out;
+      }
+      get aliveResourcesSnapshot() {
+        return { ...this.aliveResources };
+      }
+      /**
+       * 全量/定期灌入历史 session（多 session 各动作追加到时间线）。
+       * 历史节点同样推进链指针 / 生命周期 / taint，否则后续 advance 无法在历史基础上
+       * 补全链。历史阶段推进若补全链，属于历史事实，不阻断当前动作。
+       */
+      seed(sessions) {
+        let added = 0;
+        for (const s of sessions || []) {
+          const sid = String(s.sessionId || "s");
+          for (const a of s.actionHistory || []) {
+            const node = this.appendNode(a, sid);
+            if (!node) {
+              continue;
+            }
+            added += 1;
+            this.recordLifecycle(node);
+            this.advanceTaint(node);
+            this.advanceChains(node);
+          }
+        }
+        return added;
+      }
+      /** 增量推进：把当前动作追加到时间线 → 链指针推进 → 判定。 */
+      advance(args) {
+        const { aNext, sessionId = "current", isError = false } = args;
+        const node = this.appendNode(aNext, sessionId, isError);
+        if (!node) {
+          return { seq: this.seqNext, node: null, matched: null, pendingPrefixes: this.pendingPrefixes, exfil: [], shouldBlock: false };
+        }
+        const seq = this.seqNext;
+        this.recordLifecycle(node);
+        const matched = this.advanceChains(node);
+        this.advanceTaint(node);
+        const exfil = this.checkExfilAfterTaint(node);
         return {
-          ruleId: rule.id,
-          pattern: rule.pattern,
-          explanation: rule.explanation,
-          confidence: rule.confidence
+          seq,
+          node,
+          matched,
+          pendingPrefixes: this.pendingPrefixes,
+          exfil,
+          get shouldBlock() {
+            return this.matched !== null || this.exfil.length > 0;
+          }
         };
       }
-    } catch {
-      continue;
-    }
+      appendNode(action, sessionId, isError = false) {
+        const ad = String(action.actionDetail || "");
+        const at = String(action.actionType || "");
+        if (!ad) return null;
+        if (this.nodes_.length >= MAX_NODES) {
+          return null;
+        }
+        const stage = markStage2(ad);
+        const node = {
+          seq: this.seqNext,
+          sessionId,
+          actionType: at,
+          actionDetail: ad,
+          stage,
+          resources: extractResources2(ad),
+          isError,
+          lifecycle: lifecycleFor(ad, stage, isError)
+        };
+        this.nodes_.push(node);
+        this.seqNext += 1;
+        return node;
+      }
+      recordLifecycle(node) {
+        if (node.lifecycle === "dead") {
+          let hit = false;
+          for (const r of node.resources) {
+            if (r in this.aliveResources) {
+              delete this.aliveResources[r];
+              hit = true;
+            }
+          }
+          const detail = node.actionDetail;
+          for (const r of Object.keys(this.aliveResources)) {
+            const base = r.split("/").pop() || "";
+            if (base && detail.includes(base)) {
+              delete this.aliveResources[r];
+              hit = true;
+            }
+          }
+          if (hit) this.resetChainsOnDestroy();
+          return;
+        }
+        if (node.lifecycle === "alive") {
+          for (const r of node.resources) {
+            this.aliveResources[r] = node.seq;
+          }
+        }
+      }
+      resetChainsOnDestroy() {
+        for (const cid of Object.keys(this.ptr)) {
+          this.ptr[cid] = 0;
+        }
+      }
+      advanceChains(node) {
+        if (node.lifecycle === "dead") return null;
+        if (node.lifecycle === "never_activated") {
+          this.invalidateChainOnFailure(node);
+          return null;
+        }
+        const stage = node.stage;
+        if (!stage) return null;
+        const { chains } = loadRules();
+        for (const chain of chains) {
+          const stages = chain.stages || [];
+          if (stages.length === 0) continue;
+          const cid = String(chain.id || "");
+          const cur = this.ptr[cid] || 0;
+          if (cur < stages.length && stages[cur] === stage) {
+            this.ptr[cid] = cur + 1;
+            if (cur + 1 >= stages.length) {
+              return {
+                chainId: cid,
+                stages,
+                riskLevel: String(chain.riskLevel || chain.risk_level || "high"),
+                reason: String(chain.reason || "\u68C0\u6D4B\u5230\u7EC4\u5408\u653B\u51FB\u94FE"),
+                path: this.chainPath(stages)
+              };
+            }
+          }
+        }
+        return null;
+      }
+      invalidateChainOnFailure(node) {
+        const failed = new Set(node.resources);
+        if (failed.size === 0) return;
+        const { chains } = loadRules();
+        for (const chain of chains) {
+          const cid = String(chain.id || "");
+          if ((this.ptr[cid] || 0) > 0) {
+            this.ptr[cid] = 0;
+          }
+        }
+      }
+      chainPath(stages) {
+        const path6 = [];
+        let want = stages[0];
+        for (const n of this.nodes_) {
+          if (n.stage === want) {
+            path6.push({ sessionId: n.sessionId, seq: n.seq, stage: n.stage });
+            const idx = stages.indexOf(n.stage);
+            if (idx + 1 < stages.length) {
+              want = stages[idx + 1];
+            } else {
+              break;
+            }
+          }
+        }
+        return path6;
+      }
+      // ---------------- 敏感数据 taint（P2） ----------------
+      advanceTaint(node) {
+        if (node.lifecycle === "dead") return;
+        const idx = node.seq;
+        const taintedRes = /* @__PURE__ */ new Set();
+        for (const r of node.resources) {
+          if (this.resourceTainted(r)) taintedRes.add(r);
+        }
+        if (node.stage === "CRED" && node.resources.some((r) => CRED_FILE_RE2.test(r))) {
+          this.tainted.add(idx);
+          for (const r of node.resources) taintedRes.add(r);
+        }
+        if (taintedRes.size > 0) {
+          this.tainted.add(idx);
+          for (const r of taintedRes) this.taintedResources.add(r);
+        }
+      }
+      resourceTainted(resource) {
+        return this.taintedResources.has(resource);
+        return false;
+      }
+      checkExfilAfterTaint(node) {
+        if (!this.tainted.has(node.seq)) return [];
+        if (EXFIL_RE2.test(node.actionDetail)) {
+          return [{
+            property_id: "sensitive-data-exfil",
+            reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${this.taintSource(node)} \u2192 ${node.sessionId}#${node.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
+            risk_level: "critical",
+            path: [[node.sessionId, node.seq, node.actionDetail.slice(0, 60)]]
+          }];
+        }
+        return [];
+      }
+      taintSource(node) {
+        const sorted = [...this.tainted].sort((a, b) => a - b);
+        for (const i of sorted) {
+          if (i === node.seq) continue;
+          const n = this.nodes_[i];
+          if (!n) continue;
+          for (const r of node.resources) {
+            if (n.resources.includes(r)) return `${n.sessionId}#${n.seq} \u8BBF\u95EE ${r}`;
+          }
+        }
+        return "\u672A\u77E5\u51ED\u636E\u6E90";
+      }
+      // ---------------- 序列化/状态 ----------------
+      toSnapshot() {
+        return {
+          agent_id: this.agentId,
+          nodes: this.nodes_.map((n) => ({ ...n, resources: [...n.resources] })),
+          ptrs: { ...this.ptr },
+          tainted: [...this.tainted].sort((a, b) => a - b),
+          alive: { ...this.aliveResources },
+          seq_next: this.seqNext
+        };
+      }
+      restore(snapshot) {
+        if (!snapshot) return;
+        this.agentId = String(snapshot.agent_id || this.agentId);
+        for (const raw of snapshot.nodes || []) {
+          this.nodes_.push({
+            seq: Number(raw.seq || 0),
+            sessionId: String(raw.sessionId || ""),
+            actionType: String(raw.actionType || ""),
+            actionDetail: String(raw.actionDetail || ""),
+            stage: String(raw.stage || ""),
+            resources: [...raw.resources || []],
+            isError: Boolean(raw.isError),
+            lifecycle: String(raw.lifecycle || "")
+          });
+        }
+        this.seqNext = Number(snapshot.seq_next || this.nodes_.length);
+        this.ptr = Object.fromEntries(Object.entries(snapshot.ptrs || {}).map(([k, v]) => [k, Number(v)]));
+        this.tainted = new Set((snapshot.tainted || []).map(Number));
+        this.taintedResources = /* @__PURE__ */ new Set();
+        for (const i of this.tainted) {
+          const n = this.nodes_[i];
+          if (n) for (const r of n.resources) this.taintedResources.add(r);
+        }
+        this.aliveResources = Object.fromEntries(
+          Object.entries(snapshot.alive || {}).map(([k, v]) => [k, Number(v)])
+        );
+      }
+    };
   }
-  return null;
-}
-function checkLayer2Context(pattern, actionHistory, actionDetail) {
-  if (pattern.startsWith("BEHAVIOR_CHAIN:")) {
-    const chainType = pattern.replace("BEHAVIOR_CHAIN:", "");
-    if (chainType === "external_read\u2192sensitive_write") {
-      const hasExternalRead = actionHistory.slice(-5).some((h) => /curl|wget|http/i.test(h.actionDetail ?? ""));
-      const isSensitiveWrite = /\.ssh|\.gnupg|authorized_keys|bashrc|profile/i.test(actionDetail);
-      return hasExternalRead && isSensitiveWrite;
-    }
-    if (chainType === "multi_config_read\u2192privilege_action") {
-      const configReads = actionHistory.slice(-5).filter((h) => /\/etc\/|config|\.conf|\.yaml|\.json/i.test(h.actionDetail ?? "")).length;
-      const isPrivilege = /sudo|su |chmod|chown/i.test(actionDetail);
-      return configReads >= 2 && isPrivilege;
-    }
-    return false;
+});
+
+// src/engine/formal-engine/chain_state.ts
+import * as fs4 from "fs";
+import * as os2 from "os";
+import * as path4 from "path";
+import { createHash } from "crypto";
+function defaultStateDbPath() {
+  const dir = process.env.AGENT_MOSS_STATE_DIR || path4.join(os2.homedir(), ".agentmoss");
+  const tag = createHash("sha1").update("agentmoss-stateful").digest("hex").slice(0, 8);
+  return path4.join(dir, `stateful_chains_${tag}.json`);
+}
+var ChainStateStore;
+var init_chain_state = __esm({
+  "src/engine/formal-engine/chain_state.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_stateful();
+    ChainStateStore = class {
+      filePath;
+      data;
+      _timer = null;
+      _flushDelayMs = 50;
+      constructor(filePath = "") {
+        this.filePath = filePath || defaultStateDbPath();
+        this.data = this._read();
+      }
+      _read() {
+        try {
+          if (fs4.existsSync(this.filePath)) {
+            const raw = fs4.readFileSync(this.filePath, "utf-8");
+            return JSON.parse(raw);
+          }
+        } catch {
+        }
+        return {};
+      }
+      /** 防抖写入：save() 只改内存，后台批量落盘（避免每次 tool call 全量 writeFileSync）。 */
+      _scheduleWrite() {
+        if (this._timer !== null) return;
+        this._timer = setTimeout(() => {
+          this._timer = null;
+          try {
+            fs4.mkdirSync(path4.dirname(this.filePath), { recursive: true });
+            fs4.writeFileSync(this.filePath, JSON.stringify(this.data, null, 2), "utf-8");
+          } catch {
+          }
+        }, this._flushDelayMs);
+      }
+      /** 立即落盘（测试/关停前调用，保证状态不丢）。 */
+      flush() {
+        if (this._timer !== null) {
+          clearTimeout(this._timer);
+          this._timer = null;
+        }
+        try {
+          fs4.mkdirSync(path4.dirname(this.filePath), { recursive: true });
+          fs4.writeFileSync(this.filePath, JSON.stringify(this.data, null, 2), "utf-8");
+        } catch {
+        }
+      }
+      load(agentId) {
+        const entry = this.data[agentId];
+        if (!entry) return null;
+        const t = new StatefulChainTracker(agentId);
+        t.restore(entry.state);
+        return t;
+      }
+      save(tracker) {
+        this.data[tracker.agentId] = {
+          state: tracker.toSnapshot(),
+          updated_at: (/* @__PURE__ */ new Date()).toISOString()
+        };
+        this._scheduleWrite();
+      }
+      delete(agentId) {
+        delete this.data[agentId];
+        this._scheduleWrite();
+      }
+      applyAction(agentId, aNext, sessionId, isError = false) {
+        const t = this.load(agentId) || new StatefulChainTracker(agentId);
+        const r = t.advance({ aNext, sessionId, isError });
+        this.save(t);
+        return r;
+      }
+      seedAndApply(agentId, sessions, aNext, sessionId = "current", isError = false) {
+        const t = this.load(agentId) || new StatefulChainTracker(agentId);
+        t.seed(sessions);
+        const r = t.advance({ aNext, sessionId, isError });
+        this.save(t);
+        return r;
+      }
+    };
   }
-  return true;
-}
-var init_brain = __esm({
-  "src/brain/index.ts"() {
+});
+
+// src/engine/formal-engine/index.ts
+var init_formal_engine = __esm({
+  "src/engine/formal-engine/index.ts"() {
     "use strict";
     init_esm_shims();
-    init_rule_store();
-    init_pattern_extractor();
-    init_reviewer();
+    init_engine();
+    init_ir();
+    init_builder();
+    init_properties();
+    init_stateful();
+    init_chain_state();
   }
 });
 
@@ -4604,7 +7136,10 @@ async function runAnalysis(input) {
   const actionType = input.aNext.actionType.toLowerCase();
   const rawDetail = extractRawCommand(input.aNext.actionDetail);
   const lowerDetail = rawDetail.toLowerCase();
-  const agentExt = getAgentExtensions(input.agentId);
+  const agentExt = mergeAgentExtensions(
+    getAgentExtensions(input.agentId),
+    getScenarioExtensions(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "")
+  );
   if (FULLY_SAFE_TOOLS.has(actionType)) {
     return {
       allowed: true,
@@ -4709,6 +7244,28 @@ async function runAnalysis(input) {
       return effectiveResult;
     }
   }
+  if (isLogicRulesEnabled()) {
+    const formalSessions = [];
+    if (input.sessionHistory) {
+      for (const s of input.sessionHistory) {
+        formalSessions.push({ sessionId: s.sessionId || "s", actionHistory: s.actionHistory || [] });
+      }
+    }
+    formalSessions.push({ sessionId: "current", actionHistory: input.actionHistory });
+    const formalResult = formalEngine.verify(formalSessions, input.aNext);
+    if (!formalResult.verified) {
+      const v = formalResult.violations[0];
+      return {
+        allowed: false,
+        reason: v ? v.reason : "\u5F62\u5F0F\u5316\u9A8C\u8BC1\u672A\u901A\u8FC7\uFF08\u884C\u4E3A\u6027\u8D28\u8FDD\u53CD\uFF09",
+        riskLevel: v ? v.riskLevel : "high",
+        riskType: "formal_verification",
+        confidence: 90,
+        source: "formal_engine",
+        violatedLayers: ["2.4"]
+      };
+    }
+  }
   if (scriptChain && scriptChain.nodes.length > 0 && isLogicRulesEnabled()) {
     for (const node of scriptChain.nodes) {
       if (node.error || !node.preprocessedContent) continue;
@@ -4827,7 +7384,7 @@ async function runAnalysis(input) {
   }
   return llmResult;
 }
-var FULLY_SAFE_TOOLS, TRUSTED_SKILLS_BASE, READONLY_SENSITIVE_TOOLS, FULLY_SAFE_BASH_PATTERNS, READONLY_SENSITIVE_BASH_PATTERNS, _brainStore, _brainExtractor, _brainInitialized;
+var FULLY_SAFE_TOOLS, TRUSTED_SKILLS_BASE, READONLY_SENSITIVE_TOOLS, FULLY_SAFE_BASH_PATTERNS, READONLY_SENSITIVE_BASH_PATTERNS, _brainStore, _brainExtractor, _brainInitialized, formalEngine;
 var init_coordinator = __esm({
   "src/engine/coordinator.ts"() {
     "use strict";
@@ -4839,8 +7396,10 @@ var init_coordinator = __esm({
     init_script_content_analyzer();
     init_config();
     init_agents();
+    init_scenarios();
     init_brain();
     init_reviewer();
+    init_formal_engine();
     FULLY_SAFE_TOOLS = /* @__PURE__ */ new Set([
       "ask_user_question",
       "glob",
@@ -4910,6 +7469,7 @@ var init_coordinator = __esm({
     _brainStore = null;
     _brainExtractor = null;
     _brainInitialized = false;
+    formalEngine = new FormalEngine();
   }
 });
 
@@ -4970,20 +7530,20 @@ var require_file_uri_to_path = __commonJS({
       var rest = decodeURI(uri.substring(7));
       var firstSlash = rest.indexOf("/");
       var host = rest.substring(0, firstSlash);
-      var path3 = rest.substring(firstSlash + 1);
+      var path6 = rest.substring(firstSlash + 1);
       if ("localhost" == host) host = "";
       if (host) {
         host = sep + sep + host;
       }
-      path3 = path3.replace(/^(.+)\|/, "$1:");
+      path6 = path6.replace(/^(.+)\|/, "$1:");
       if (sep == "\\") {
-        path3 = path3.replace(/\//g, "\\");
+        path6 = path6.replace(/\//g, "\\");
       }
-      if (/^.+\:/.test(path3)) {
+      if (/^.+\:/.test(path6)) {
       } else {
-        path3 = sep + path3;
+        path6 = sep + path6;
       }
-      return host + path3;
+      return host + path6;
     }
   }
 });
@@ -4993,19 +7553,19 @@ var require_bindings = __commonJS({
   "node_modules/bindings/bindings.js"(exports, module) {
     "use strict";
     init_esm_shims();
-    var fs4 = __require("fs");
-    var path3 = __require("path");
-    var fileURLToPath10 = require_file_uri_to_path();
-    var join7 = path3.join;
-    var dirname8 = path3.dirname;
-    var exists = fs4.accessSync && function(path4) {
+    var fs7 = __require("fs");
+    var path6 = __require("path");
+    var fileURLToPath11 = require_file_uri_to_path();
+    var join10 = path6.join;
+    var dirname11 = path6.dirname;
+    var exists = fs7.accessSync && function(path7) {
       try {
-        fs4.accessSync(path4);
+        fs7.accessSync(path7);
       } catch (e) {
         return false;
       }
       return true;
-    } || fs4.existsSync || path3.existsSync;
+    } || fs7.existsSync || path6.existsSync;
     var defaults = {
       arrow: process.env.NODE_BINDINGS_ARROW || " \u2192 ",
       compiled: process.env.NODE_BINDINGS_COMPILED_DIR || "compiled",
@@ -5050,13 +7610,13 @@ var require_bindings = __commonJS({
       if (!opts.module_root) {
         opts.module_root = exports.getRoot(exports.getFileName());
       }
-      if (path3.extname(opts.bindings) != ".node") {
+      if (path6.extname(opts.bindings) != ".node") {
         opts.bindings += ".node";
       }
       var requireFunc = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
       var tries = [], i = 0, l = opts.try.length, n, b, err;
       for (; i < l; i++) {
-        n = join7.apply(
+        n = join10.apply(
           null,
           opts.try[i].map(function(p) {
             return opts[p] || p;
@@ -5107,17 +7667,17 @@ var require_bindings = __commonJS({
       Error.stackTraceLimit = origSTL;
       var fileSchema = "file://";
       if (fileName.indexOf(fileSchema) === 0) {
-        fileName = fileURLToPath10(fileName);
+        fileName = fileURLToPath11(fileName);
       }
       return fileName;
     };
     exports.getRoot = function getRoot(file) {
-      var dir = dirname8(file), prev;
+      var dir = dirname11(file), prev;
       while (true) {
         if (dir === ".") {
           dir = process.cwd();
         }
-        if (exists(join7(dir, "package.json")) || exists(join7(dir, "node_modules"))) {
+        if (exists(join10(dir, "package.json")) || exists(join10(dir, "node_modules"))) {
           return dir;
         }
         if (prev === dir) {
@@ -5126,7 +7686,7 @@ var require_bindings = __commonJS({
           );
         }
         prev = dir;
-        dir = join7(dir, "..");
+        dir = join10(dir, "..");
       }
     };
   }
@@ -5292,11 +7852,11 @@ var require_backup = __commonJS({
   "node_modules/better-sqlite3/lib/methods/backup.js"(exports, module) {
     "use strict";
     init_esm_shims();
-    var fs4 = __require("fs");
-    var path3 = __require("path");
+    var fs7 = __require("fs");
+    var path6 = __require("path");
     var { promisify } = __require("util");
     var { cppdb } = require_util();
-    var fsAccess = promisify(fs4.access);
+    var fsAccess = promisify(fs7.access);
     module.exports = async function backup(filename, options) {
       if (options == null) options = {};
       if (typeof filename !== "string") throw new TypeError("Expected first argument to be a string");
@@ -5309,7 +7869,7 @@ var require_backup = __commonJS({
       if (typeof attachedName !== "string") throw new TypeError('Expected the "attached" option to be a string');
       if (!attachedName) throw new TypeError('The "attached" option cannot be an empty string');
       if (handler != null && typeof handler !== "function") throw new TypeError('Expected the "progress" option to be a function');
-      await fsAccess(path3.dirname(filename)).catch(() => {
+      await fsAccess(path6.dirname(filename)).catch(() => {
         throw new TypeError("Cannot save backup because the directory does not exist");
       });
       const isNewFile = await fsAccess(filename).then(() => false, () => true);
@@ -5318,13 +7878,13 @@ var require_backup = __commonJS({
     var runBackup = (backup, handler) => {
       let rate = 0;
       let useDefault = true;
-      return new Promise((resolve7, reject) => {
+      return new Promise((resolve9, reject) => {
         setImmediate(function step() {
           try {
             const progress = backup.transfer(rate);
             if (!progress.remainingPages) {
               backup.close();
-              resolve7(progress);
+              resolve9(progress);
               return;
             }
             if (useDefault) {
@@ -5620,8 +8180,8 @@ var require_database = __commonJS({
   "node_modules/better-sqlite3/lib/database.js"(exports, module) {
     "use strict";
     init_esm_shims();
-    var fs4 = __require("fs");
-    var path3 = __require("path");
+    var fs7 = __require("fs");
+    var path6 = __require("path");
     var util = require_util();
     var SqliteError = require_sqlite_error();
     var DEFAULT_ADDON;
@@ -5657,7 +8217,7 @@ var require_database = __commonJS({
         addon = DEFAULT_ADDON || (DEFAULT_ADDON = require_bindings()("better_sqlite3.node"));
       } else if (typeof nativeBinding === "string") {
         const requireFunc = typeof __non_webpack_require__ === "function" ? __non_webpack_require__ : __require;
-        addon = requireFunc(path3.resolve(nativeBinding).replace(/(\.node)?$/, ".node"));
+        addon = requireFunc(path6.resolve(nativeBinding).replace(/(\.node)?$/, ".node"));
       } else {
         addon = nativeBinding;
       }
@@ -5665,7 +8225,7 @@ var require_database = __commonJS({
         addon.setErrorConstructor(SqliteError);
         addon.isInitialized = true;
       }
-      if (!anonymous && !fs4.existsSync(path3.dirname(filename))) {
+      if (!anonymous && !fs7.existsSync(path6.dirname(filename))) {
         throw new TypeError("Cannot open database because the directory does not exist");
       }
       Object.defineProperties(this, {
@@ -5740,6 +8300,10 @@ var AnalyzeRequestSchema = z.object({
   prompt_session: z.string().default("").describe("User original prompt (most recent user message; backward compat)"),
   prompt_history: z.array(PromptTurnSchema).default([]).describe("Full interleaved prompt history (ordered turns, each with its triggered actions). Optional; empty = fall back to prompt_session only."),
   action_history: z.array(ActionItemSchema).default([]).describe("Historical action sequence"),
+  session_history: z.array(z.object({
+    session_id: z.string(),
+    action_history: z.array(ActionItemSchema).default([])
+  })).default([]).describe("Multi-session historical actions (optional): for L2.4 formal engine cross-session combo-chain / sensitive-data-flow verification. Provided by caller (incl. future agentgate)."),
   a_next: ActionItemSchema.describe("Next action to be executed"),
   reason: z.string().default("").describe("Reason for executing this action"),
   os_type: z.string().default("").describe("OS type: 'linux', 'windows', or empty for auto-detect"),
@@ -5766,13 +8330,33 @@ var HealthResponseSchema = z.object({
   // 空=未配置（独立部署或旧版），调用方可选择兼容或严格过滤。
   instance: z.string().default("")
 });
+var ReviewRequestSchema = z.object({
+  agent_id: z.string().default("").describe("\u76EE\u6807 agent \u6807\u8BC6\uFF08\u51B3\u5B9A\u72B6\u6001\u5E93\u5206\u6876\uFF09"),
+  db_path: z.string().default("").describe("AgentGate \u672C\u5730\u5B58\u50A8\u8DEF\u5F84\uFF08SQLite \u6587\u4EF6 \u6216 tool_calls JSON \u76EE\u5F55\uFF09\uFF1B\u4E3A\u7A7A\u5219\u7528 sessions"),
+  sessions: z.array(z.object({
+    session_id: z.string(),
+    action_history: z.array(ActionItemSchema).default([])
+  })).default([]).describe("\u591A session \u5386\u53F2\u52A8\u4F5C\uFF08\u66FF\u4EE3/\u515C\u5E95 db_path\uFF09"),
+  a_next: ActionItemSchema.optional().describe("\u53EF\u9009\uFF1Aseed \u540E\u8FDE\u540C\u5F53\u524D\u52A8\u4F5C\u4E00\u8D77\u5224\u5B9A"),
+  is_error: z.boolean().default(false).describe("\u5F53\u524D\u52A8\u4F5C\u6267\u884C\u662F\u5426\u5931\u8D25"),
+  output_pending: z.boolean().default(false).describe("\u8FD4\u56DE\u524D\u5E8F\u94FE\u6E05\u5355 pending_prefixes")
+});
+var ReviewResponseSchema = z.object({
+  agent_id: z.string().default(""),
+  seeded_nodes: z.number().default(0),
+  verified: z.boolean().default(true),
+  violations: z.array(z.record(z.unknown())).default([]),
+  pending_prefixes: z.array(z.record(z.unknown())).default([]),
+  state_nodes: z.number().default(0),
+  discovered_patterns: z.array(z.record(z.unknown())).default([]).describe("\u6570\u636E\u9A71\u52A8\u53D1\u73B0\uFF1A\u8DE8 session \u9891\u7E41\u5371\u9669\u7EC4\u5408\uFF08\u9884\u7F6E\u94FE\u76F2\u533A\uFF0CPatternMiner\uFF09")
+});
 
 // src/routes.ts
 init_coordinator();
 
 // src/actrail.ts
 init_esm_shims();
-import * as fs3 from "fs";
+import * as fs5 from "fs";
 function escape(value) {
   return value.replace(/\\/g, "\\\\").replace(/\n/g, "\\n").replace(/=/g, "\\e");
 }
@@ -5793,7 +8377,7 @@ function getStoragePath() {
 function reportEnforcementEvent(opts) {
   if (!isEnabled()) return false;
   const storagePath = getStoragePath();
-  if (!fs3.existsSync(storagePath)) return false;
+  if (!fs5.existsSync(storagePath)) return false;
   try {
     let Database;
     try {
@@ -5871,6 +8455,182 @@ function reportEnforcementEvent(opts) {
   }
 }
 
+// src/routes.ts
+init_formal_engine();
+
+// src/engine/formal-engine/pattern_miner.ts
+init_esm_shims();
+init_builder();
+var DANGER_STAGES = /* @__PURE__ */ new Set(["PRIVESC", "EXFIL", "LISTEN"]);
+var SENSITIVE_PAIRS = /* @__PURE__ */ new Set(["CRED|LISTEN", "LISTEN|CRED"]);
+function projectStages(actionHistory) {
+  const stages = [];
+  let prev = null;
+  for (const act of actionHistory) {
+    const s = markStage(String(act.actionDetail || ""));
+    if (s && s !== prev) {
+      stages.push(s);
+      prev = s;
+    }
+  }
+  return stages;
+}
+function isDangerous(pat) {
+  if (pat.some((s) => DANGER_STAGES.has(s))) return true;
+  for (let i = 0; i < pat.length - 1; i++) {
+    if (SENSITIVE_PAIRS.has(pat[i] + "|" + pat[i + 1])) return true;
+  }
+  return false;
+}
+function mineDangerousPatterns(sessions, minSup = 2, maxLen = 4) {
+  const seqs = [];
+  for (const s of sessions) {
+    const sid = String(s.sessionId || "");
+    const stages = projectStages(s.actionHistory || []);
+    if (stages.length > 0) seqs.push([sid, stages]);
+  }
+  if (seqs.length === 0) return [];
+  const results = /* @__PURE__ */ new Map();
+  const mine = (prefix, projected) => {
+    if (prefix.length > 0) {
+      results.set(prefix.join("\u2192"), projected.length);
+    }
+    if (prefix.length >= maxLen) return;
+    const itemSids = /* @__PURE__ */ new Map();
+    for (const [sid, suffix] of projected) {
+      const seen = /* @__PURE__ */ new Set();
+      for (const it of suffix) {
+        if (!seen.has(it)) {
+          seen.add(it);
+          if (!itemSids.has(it)) itemSids.set(it, /* @__PURE__ */ new Set());
+          itemSids.get(it).add(sid);
+        }
+      }
+    }
+    for (const [it, sids] of [...itemSids.entries()].sort()) {
+      if (sids.size >= minSup) {
+        const next = [];
+        for (const [sid, suffix] of projected) {
+          const idx = suffix.indexOf(it);
+          if (idx >= 0) next.push([sid, suffix.slice(idx + 1)]);
+        }
+        mine([...prefix, it], next);
+      }
+    }
+  };
+  mine([], seqs);
+  const out = [];
+  for (const [key, support] of results) {
+    const pat = key.split("\u2192");
+    if (pat.length < 2 || !isDangerous(pat)) continue;
+    const risk = pat.some((s) => s === "PRIVESC" || s === "EXFIL") ? "high" : "medium";
+    out.push({
+      pattern: pat,
+      support,
+      risk,
+      reason: `\u8DE8 session \u9891\u7E41\u51FA\u73B0\u7EC4\u5408 ${pat.join("\u2192")}\uFF08${support} \u4E2A session\uFF09\uFF0C\u9884\u7F6E\u94FE\u672A\u76F4\u63A5\u8986\u76D6\uFF0C\u7591\u4F3C\u653B\u51FB\u524D\u5E8F`
+    });
+  }
+  out.sort((a, b) => b.support - a.support || b.pattern.length - a.pattern.length);
+  return out;
+}
+
+// src/agent-gate-reader.ts
+init_esm_shims();
+import * as fs6 from "fs";
+import * as os3 from "os";
+import * as path5 from "path";
+var DEFAULT_AGENTGATE_SQLITE = path5.join(
+  os3.homedir(),
+  ".local",
+  "share",
+  "agent_gate",
+  "agent_gate_ts.db"
+);
+function normalizeAction(row) {
+  return {
+    actionType: String(row.action_type || row.tool_name || row.name || ""),
+    actionDetail: String(row.action_detail || row.command || row.input || "")
+  };
+}
+function readJsonDir(dirPath, limit = 1e5) {
+  const sessions = /* @__PURE__ */ new Map();
+  try {
+    const files = fs6.readdirSync(dirPath).filter((f) => f.endsWith(".json")).sort();
+    for (const f of files.slice(-200)) {
+      const sid = f.replace(/\.json$/, "");
+      const raw = fs6.readFileSync(path5.join(dirPath, f), "utf-8");
+      const arr = JSON.parse(raw);
+      if (!Array.isArray(arr)) continue;
+      for (const item of arr) {
+        if (!item || typeof item !== "object") continue;
+        const act = normalizeAction(item);
+        if (act.actionDetail) {
+          const list = sessions.get(sid) || [];
+          list.push(act);
+          sessions.set(sid, list);
+        }
+      }
+      let total = 0;
+      for (const v of sessions.values()) total += v.length;
+      if (total > limit) break;
+    }
+  } catch {
+  }
+  return [...sessions.entries()].map(([sessionId, actionHistory]) => ({ sessionId, actionHistory }));
+}
+function readSqlite(dbPath, limit = 1e5) {
+  let Database;
+  try {
+    Database = require_lib();
+  } catch {
+    return [];
+  }
+  let db;
+  try {
+    db = new Database(dbPath, { readonly: true });
+    const rows = db.prepare(
+      `SELECT session_id, action_type, tool_name, action_detail, command, called_at
+         FROM tool_calls ORDER BY called_at, id LIMIT ?`
+    ).all(limit);
+    const sessions = /* @__PURE__ */ new Map();
+    for (const r of rows) {
+      const sid = String(r.session_id || "");
+      if (!sid) continue;
+      const act = normalizeAction(r);
+      if (!act.actionDetail) continue;
+      const list = sessions.get(sid) || [];
+      list.push(act);
+      sessions.set(sid, list);
+    }
+    return [...sessions.entries()].map(([sessionId, actionHistory]) => ({ sessionId, actionHistory }));
+  } catch {
+    return [];
+  } finally {
+    try {
+      db?.close();
+    } catch {
+    }
+  }
+}
+function loadAgentGateSessions(dbPath = "") {
+  if (dbPath) {
+    try {
+      if (fs6.statSync(dbPath).isDirectory()) {
+        return readJsonDir(dbPath);
+      }
+    } catch {
+    }
+    const sql2 = readSqlite(dbPath);
+    if (sql2.length > 0) return sql2;
+    return readJsonDir(dbPath);
+  }
+  const sql = readSqlite(DEFAULT_AGENTGATE_SQLITE);
+  if (sql.length > 0) return sql;
+  const jsonDefault = path5.join(os3.homedir(), ".local", "share", "agent_gate", "tool_calls");
+  return readJsonDir(jsonDefault);
+}
+
 // src/routes.ts
 async function healthRoute(c) {
   return c.json(HealthResponseSchema.parse({
@@ -5886,6 +8646,7 @@ async function analyzeRoute(c) {
     if (!osType) {
       osType = process.platform === "win32" ? "windows" : "linux";
     }
+    const agentId = req.agent_id || req.metadata?.agent_type || "";
     const result = await runAnalysis({
       sessionId: req.session_id,
       promptSession: req.prompt_session,
@@ -5893,6 +8654,13 @@ async function analyzeRoute(c) {
         actionType: h.action_type,
         actionDetail: h.action_detail
       })),
+      sessionHistory: (req.session_history || []).map((s) => ({
+        sessionId: s.session_id,
+        actionHistory: (s.action_history || []).map((h) => ({
+          actionType: h.action_type,
+          actionDetail: h.action_detail
+        }))
+      })),
       aNext: {
         actionType: req.a_next.action_type,
         actionDetail: req.a_next.action_detail
@@ -5900,10 +8668,9 @@ async function analyzeRoute(c) {
       reason: req.reason,
       osType,
       cwd: req.cwd,
-      // agent_id 透传：优先顶层；为空兜底 metadata.agent_type（AgentGate V1
-      // normalizer 历史上只把 agent_type 塞进 metadata，顶层 agent_id 为空 →
-      // 定制规则不生效。AgentGate 已修，此处兜底防御其他只传 metadata 的调用方）。
-      agentId: req.agent_id || req.metadata?.agent_type || "",
+      // agent_id：AgentGate V1 normalizer 历史上把 agent_type 塞 metadata，
+      // 顶层为空时兜底（OpenDesk 的 agent-moss 需 agent_id 加载专属规则）。
+      agentId,
       llmConfig: req.metadata?.llm_config,
       llmLogPath: req.metadata?.llm_log_path
     });
@@ -5925,6 +8692,40 @@ async function analyzeRoute(c) {
       });
     } catch {
     }
+    const meta = req.metadata || {};
+    const incEnabled = String(meta.stateful_incremental || "").toLowerCase();
+    if (incEnabled === "1" || incEnabled === "true" || incEnabled === "yes" || incEnabled === "on") {
+      try {
+        const store = getChainStateStoreFor(agentId);
+        const inc = store.applyAction(agentId, {
+          actionType: req.a_next.action_type,
+          actionDetail: req.a_next.action_detail
+        }, req.session_id, Boolean(meta.is_error));
+        const judgment = incMatchedToDeny(inc);
+        if (judgment) {
+          const layers = [...result.violatedLayers];
+          if (!layers.includes("2.4-stateful")) layers.push("2.4-stateful");
+          console.error(
+            `[AgentMoss] stateful \u589E\u91CF\u62E6\u622A: agent=${agentId || "-"} property=${judgment.property_id} risk=${judgment.risk_level}`
+          );
+          return c.json(
+            AnalyzeResponseSchema.parse({
+              decision: "Deny",
+              reason: judgment.reason,
+              risk_level: judgment.risk_level,
+              risk_type: "formal_verification",
+              violated_layers: layers,
+              policy: "",
+              violated_policy: "",
+              confidence: 90,
+              analysis_duration_ms: Math.round((performance.now() - t0) * 10) / 10
+            })
+          );
+        }
+      } catch (err) {
+        console.error("[AgentMoss] stateful incremental error (non-fatal):", err);
+      }
+    }
     return c.json(
       AnalyzeResponseSchema.parse({
         decision: result.allowed ? "Allow" : "Deny",
@@ -5949,6 +8750,94 @@ async function analyzeRoute(c) {
     return c.json({ error: "Internal error", detail: String(err) }, 500);
   }
 }
+var reviewStore = null;
+function getChainStateStoreFor(_agentId) {
+  if (!reviewStore) reviewStore = new ChainStateStore();
+  return reviewStore;
+}
+function incMatchedToDeny(inc) {
+  if (inc.matched) {
+    return {
+      property_id: "cross-" + inc.matched.chainId,
+      reason: inc.matched.reason,
+      risk_level: inc.matched.riskLevel
+    };
+  }
+  if (inc.exfil && inc.exfil.length > 0) {
+    return {
+      property_id: "sensitive-data-exfil",
+      reason: inc.exfil[0].reason,
+      risk_level: inc.exfil[0].risk_level
+    };
+  }
+  return null;
+}
+async function reviewRoute(c) {
+  const t0 = performance.now();
+  try {
+    const body = await c.req.json();
+    const req = ReviewRequestSchema.parse(body);
+    const agentId = req.agent_id || "default";
+    const store = getChainStateStoreFor(agentId);
+    let tracker = store.load(agentId);
+    if (!tracker) {
+      tracker = new StatefulChainTracker(agentId);
+    }
+    let sessions = [];
+    if (req.db_path) {
+      sessions = loadAgentGateSessions(req.db_path);
+      if (sessions.length === 0) sessions = (req.sessions || []).map((s) => ({
+        sessionId: s.session_id,
+        actionHistory: s.action_history.map((a) => ({ actionType: a.action_type, actionDetail: a.action_detail }))
+      }));
+    } else {
+      sessions = (req.sessions || []).map((s) => ({
+        sessionId: s.session_id,
+        actionHistory: s.action_history.map((a) => ({ actionType: a.action_type, actionDetail: a.action_detail }))
+      }));
+    }
+    const added = sessions.length > 0 ? tracker.seed(sessions) : 0;
+    store.save(tracker);
+    let verified = true;
+    const violations = [];
+    if (sessions.length > 0 || tracker.nodes.length > 0) {
+      const eng = new FormalEngine();
+      const full = eng.verify(
+        sessions.map((s) => ({ sessionId: s.sessionId, actionHistory: s.actionHistory })),
+        req.a_next ? { actionType: req.a_next.action_type, actionDetail: req.a_next.action_detail } : void 0
+      );
+      verified = full.verified;
+      for (const v of full.violations) {
+        violations.push({ property_id: v.propertyId, reason: v.reason, risk_level: v.riskLevel });
+      }
+    }
+    const pending = tracker.pendingPrefixes.map((p) => ({
+      chain_id: p.chainId,
+      matched: p.matched,
+      next_stage: p.nextStage,
+      risk_level: p.riskLevel
+    }));
+    let discovered = [];
+    if (sessions.length > 0) {
+      try {
+        discovered = mineDangerousPatterns(sessions, 2);
+      } catch {
+      }
+    }
+    return c.json(ReviewResponseSchema.parse({
+      agent_id: agentId,
+      seeded_nodes: added,
+      verified,
+      violations,
+      pending_prefixes: pending,
+      state_nodes: tracker.nodes.length,
+      discovered_patterns: discovered
+    }));
+  } catch (err) {
+    console.error("[AgentMoss] Review error:", err);
+    return c.json({ error: "Internal error", detail: String(err) }, 500);
+  }
+}
 
 // src/console/index.ts
 init_esm_shims();
@@ -5958,11 +8847,11 @@ init_esm_shims();
 init_runtime_config();
 init_token_stats();
 import { Hono } from "hono";
-import { readFileSync as readFileSync11, existsSync as existsSync11 } from "fs";
-import { join as join6, dirname as dirname7 } from "path";
-import { fileURLToPath as fileURLToPath8 } from "url";
-var __dirname7 = dirname7(fileURLToPath8(import.meta.url));
-var STATIC_DIR = join6(__dirname7, "static");
+import { readFileSync as readFileSync15, existsSync as existsSync14 } from "fs";
+import { join as join9, dirname as dirname10 } from "path";
+import { fileURLToPath as fileURLToPath9 } from "url";
+var __dirname8 = dirname10(fileURLToPath9(import.meta.url));
+var STATIC_DIR = join9(__dirname8, "static");
 var CONSOLE_TOKEN_ENV = "AGENT_MOSS_CONSOLE_TOKEN";
 function getConsoleToken() {
   return process.env[CONSOLE_TOKEN_ENV] || "";
@@ -5986,9 +8875,9 @@ function createConsoleRouter() {
   const console2 = new Hono();
   console2.use("/api/*", authMiddleware());
   const serveIndex = (c) => {
-    const indexFile = join6(STATIC_DIR, "index.html");
-    if (existsSync11(indexFile)) {
-      return c.html(readFileSync11(indexFile, "utf-8"));
+    const indexFile = join9(STATIC_DIR, "index.html");
+    if (existsSync14(indexFile)) {
+      return c.html(readFileSync15(indexFile, "utf-8"));
     }
     return c.html("<h1>AgentMoss Policy Console</h1><p>Frontend not built. Use /console/api/* endpoints.</p>");
   };
@@ -6079,13 +8968,13 @@ function createConsoleRouter() {
     if (!/^[A-Za-z0-9_-]+$/.test(skillId)) {
       return c.json({ error: "invalid skill_id" }, 400);
     }
-    const skillPath = join6(dirname7(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
-    if (!existsSync11(skillPath)) {
-      const builtinPath = join6(__dirname7, "..", "..", "agent_moss", "skills", `${skillId}.md`);
-      if (existsSync11(builtinPath)) return c.text(readFileSync11(builtinPath, "utf-8"));
+    const skillPath = join9(dirname10(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
+    if (!existsSync14(skillPath)) {
+      const builtinPath = join9(__dirname8, "..", "..", "agent_moss", "skills", `${skillId}.md`);
+      if (existsSync14(builtinPath)) return c.text(readFileSync15(builtinPath, "utf-8"));
       return c.json({ error: "skill not found" }, 404);
     }
-    return c.text(readFileSync11(skillPath, "utf-8"));
+    return c.text(readFileSync15(skillPath, "utf-8"));
   });
   console2.get("/api/agents", (c) => {
     const rc = loadRuntimeConfig();
@@ -6125,6 +9014,49 @@ function createConsoleRouter() {
     const rc = updateAgentCategoryEnabled(b.agent_id, b.category, b.enabled);
     return c.json({ agents: getAgentRules(rc) });
   });
+  const enabledScenarioIds = () => (process.env.AGENT_MOSS_SCENARIO || "").split(",").map((s) => s.trim()).filter(Boolean);
+  console2.get("/api/scenarios", (c) => {
+    const all = getScenarioRules(loadRuntimeConfig());
+    const enabled = enabledScenarioIds();
+    if (!enabled.length) return c.json({ scenarios: {}, enabled: [] });
+    const shown = {};
+    for (const sid of enabled) if (all[sid]) shown[sid] = all[sid];
+    return c.json({ scenarios: shown, enabled });
+  });
+  console2.put("/api/scenarios/rules/enabled", async (c) => {
+    const b = await c.req.json();
+    const fp = {};
+    if (b.value) fp.value = b.value;
+    if (b.pattern) fp.pattern = b.pattern;
+    if (b.keyword) fp.keyword = b.keyword;
+    if (b.path) fp.path = b.path;
+    const rc = updateScenarioRuleEnabled(b.scenario_id, b.category, fp, b.enabled);
+    return c.json({ scenarios: getScenarioRules(rc), enabled: enabledScenarioIds() });
+  });
+  console2.post("/api/scenarios/rules", async (c) => {
+    const b = await c.req.json();
+    const rule = {};
+    for (const [k, v] of Object.entries(b)) {
+      if (!["scenario_id", "category"].includes(k) && v !== void 0 && v !== null) rule[k] = v;
+    }
+    const rc = addScenarioRule(b.scenario_id, b.category, rule);
+    return c.json({ scenarios: getScenarioRules(rc), enabled: enabledScenarioIds() });
+  });
+  console2.delete("/api/scenarios/rules", async (c) => {
+    const b = await c.req.json();
+    const fp = {};
+    if (b.value) fp.value = b.value;
+    if (b.pattern) fp.pattern = b.pattern;
+    if (b.keyword) fp.keyword = b.keyword;
+    if (b.path) fp.path = b.path;
+    const rc = deleteScenarioRule(b.scenario_id, b.category, fp);
+    return c.json({ scenarios: getScenarioRules(rc), enabled: enabledScenarioIds() });
+  });
+  console2.put("/api/scenarios/categories/enabled", async (c) => {
+    const b = await c.req.json();
+    const rc = updateScenarioCategoryEnabled(b.scenario_id, b.category, b.enabled);
+    return c.json({ scenarios: getScenarioRules(rc), enabled: enabledScenarioIds() });
+  });
   console2.get("/api/config", (c) => {
     const rc = loadRuntimeConfig();
     return c.json(rc);
@@ -6164,18 +9096,19 @@ function createApp() {
   app.use("*", logger());
   app.get("/api/v1/health", healthRoute);
   app.post("/api/v1/analyze", analyzeRoute);
+  app.post("/api/v1/review", reviewRoute);
   app.route("/console", createConsoleRouter());
   app.get("/console/", (c) => c.redirect("/console"));
   return app;
 }
 async function findFreePort(startPort, host = "127.0.0.1", scan = 100) {
   for (let port = startPort; port < startPort + scan; port++) {
-    const free = await new Promise((resolve7) => {
+    const free = await new Promise((resolve9) => {
       const server = net.createServer();
       server.listen(port, host, () => {
-        server.close(() => resolve7(true));
+        server.close(() => resolve9(true));
       });
-      server.on("error", () => resolve7(false));
+      server.on("error", () => resolve9(false));
     });
     if (free) {
       if (port !== startPort) {
@@ -6200,7 +9133,7 @@ async function startServer(host = "127.0.0.1", port = 9090) {
 }
 
 // src/cli.ts
-import { fileURLToPath as fileURLToPath9 } from "url";
+import { fileURLToPath as fileURLToPath10 } from "url";
 import { realpathSync } from "fs";
 function printHelp() {
   console.log(`AgentMoss security analysis engine (TypeScript v${version})
@@ -6229,7 +9162,7 @@ async function main() {
   switch (command) {
     case "init": {
       const output = args[2] || "input.json";
-      const fs4 = await import("fs");
+      const fs7 = await import("fs");
       const template = {
         session_id: "my-session-001",
         prompt_session: "Read /var/log/app.log and analyze errors",
@@ -6239,7 +9172,7 @@ async function main() {
         os_type: "",
         cwd: "/home/user/project"
       };
-      fs4.writeFileSync(output, JSON.stringify(template, null, 2), "utf-8");
+      fs7.writeFileSync(output, JSON.stringify(template, null, 2), "utf-8");
       console.log(`Template written to ${output}`);
       break;
     }
@@ -6248,11 +9181,11 @@ async function main() {
         console.error("Usage: agent-moss analyze <input.json>");
         process.exit(1);
       }
-      const fs4 = await import("fs");
-      const path3 = await import("path");
+      const fs7 = await import("fs");
+      const path6 = await import("path");
       const { runAnalysis: runAnalysis2 } = await Promise.resolve().then(() => (init_coordinator(), coordinator_exports));
-      const filePath = path3.resolve(args[1]);
-      const data = JSON.parse(fs4.readFileSync(filePath, "utf-8"));
+      const filePath = path6.resolve(args[1]);
+      const data = JSON.parse(fs7.readFileSync(filePath, "utf-8"));
       const result = await runAnalysis2({
         sessionId: data.session_id || "unknown",
         promptSession: data.prompt_session || "",
@@ -6289,9 +9222,9 @@ async function main() {
     case "install": {
       const enable = args.includes("--enable");
       const { execSync } = await import("child_process");
-      const fs4 = await import("fs");
-      const path3 = await import("path");
-      const { fileURLToPath: fileURLToPath10 } = await import("url");
+      const fs7 = await import("fs");
+      const path6 = await import("path");
+      const { fileURLToPath: fileURLToPath11 } = await import("url");
       if (process.getuid?.() !== 0) {
         try {
           execSync("sudo -n true", { stdio: "ignore", timeout: 5e3 });
@@ -6306,23 +9239,23 @@ async function main() {
         execSync(sudoArgs.join(" "), { stdio: "inherit" });
         process.exit(0);
       }
-      const __filename6 = fileURLToPath10(import.meta.url);
-      const __dirname8 = path3.dirname(__filename6);
-      let srcPath = path3.join(__dirname8, "data", "agent_moss.service");
-      if (!fs4.existsSync(srcPath)) {
-        srcPath = path3.join(__dirname8, "..", "src", "data", "agent_moss.service");
+      const __filename7 = fileURLToPath11(import.meta.url);
+      const __dirname9 = path6.dirname(__filename7);
+      let srcPath = path6.join(__dirname9, "data", "agent_moss.service");
+      if (!fs7.existsSync(srcPath)) {
+        srcPath = path6.join(__dirname9, "..", "src", "data", "agent_moss.service");
       }
-      if (!fs4.existsSync(srcPath)) {
+      if (!fs7.existsSync(srcPath)) {
         console.error("\u9519\u8BEF\uFF1A\u627E\u4E0D\u5230 agent_moss.service \u6A21\u677F\u6587\u4EF6");
         process.exit(1);
       }
       const which = execSync("which agent-moss 2>/dev/null || true", { encoding: "utf-8" }).trim();
-      const binPath = which || `${process.execPath} ${path3.join(__dirname8, "cli.js")}`;
-      let content = fs4.readFileSync(srcPath, "utf-8");
+      const binPath = which || `${process.execPath} ${path6.join(__dirname9, "cli.js")}`;
+      let content = fs7.readFileSync(srcPath, "utf-8");
       content = content.replace("__AGENT_MOSS_BIN__", binPath);
       const dst = "/etc/systemd/system/agent-moss.service";
-      fs4.writeFileSync(dst, content, "utf-8");
-      fs4.chmodSync(dst, 420);
+      fs7.writeFileSync(dst, content, "utf-8");
+      fs7.chmodSync(dst, 420);
       console.log(`\u2705 \u5DF2\u5B89\u88C5 systemd service: ${dst}`);
       execSync("systemctl daemon-reload", { stdio: "inherit" });
       console.log("\u2705 systemctl daemon-reload \u5B8C\u6210");
@@ -6361,13 +9294,13 @@ async function main() {
       let version2 = "";
       for (let port = 9090; port <= 9095; port++) {
         try {
-          const data = await new Promise((resolve7, reject) => {
+          const data = await new Promise((resolve9, reject) => {
             const req = http.get(`http://127.0.0.1:${port}/api/v1/health`, { timeout: 2e3 }, (res) => {
               let body = "";
               res.on("data", (chunk) => body += chunk);
               res.on("end", () => {
                 try {
-                  resolve7(JSON.parse(body));
+                  resolve9(JSON.parse(body));
                 } catch {
                   reject();
                 }
@@ -6395,13 +9328,13 @@ async function main() {
           console.log(`   Systemd:  \u672A\u6CE8\u518C\uFF08\u8FD0\u884C agent-moss install --enable \u5B89\u88C5\uFF09`);
         }
         try {
-          const data = await new Promise((resolve7, reject) => {
+          const data = await new Promise((resolve9, reject) => {
             const req = http.get(`http://127.0.0.1:${foundPort}/console/api/config`, { timeout: 3e3 }, (res) => {
               let body = "";
               res.on("data", (chunk) => body += chunk);
               res.on("end", () => {
                 try {
-                  resolve7(JSON.parse(body));
+                  resolve9(JSON.parse(body));
                 } catch {
                   reject();
                 }
@@ -6448,9 +9381,9 @@ async function main() {
 var isMain = (() => {
   try {
     if (!process.argv[1]) return false;
-    const thisFile = realpathSync(fileURLToPath9(import.meta.url));
+    const thisFile = realpathSync(fileURLToPath10(import.meta.url));
     const argv1 = realpathSync(
-      process.argv[1].startsWith("file://") ? fileURLToPath9(process.argv[1]) : process.argv[1]
+      process.argv[1].startsWith("file://") ? fileURLToPath10(process.argv[1]) : process.argv[1]
     );
     return thisFile === argv1;
   } catch {