@kenhkl/agent-moss 0.12.7 → 0.12.9

package/dist/engine/coordinator.js

@@ -760,6 +760,53 @@ function runLogicCheck(input) {
   if (pwdResult) return pwdResult;
   const userDelResult = checkUserDeletionConsent(actionType, actionDetail, actionHistory);
   if (userDelResult) return userDelResult;
+  const comboResult = checkComboChain(actionHistory, aNext.actionDetail);
+  if (comboResult) return comboResult;
+  return null;
+}
+function checkComboChain(actionHistory, actionDetailRaw) {
+  INLINE_SCRIPT_RE.lastIndex = 0;
+  if (INLINE_SCRIPT_RE.test(actionDetailRaw)) return null;
+  const details = [];
+  for (const h of actionHistory) {
+    if (h.actionDetail) details.push(h.actionDetail.toLowerCase());
+  }
+  details.push(actionDetailRaw.toLowerCase());
+  const seq = details.map((d) => {
+    const hits = /* @__PURE__ */ new Set();
+    for (const [stage, pats] of Object.entries(COMBO_STAGES)) {
+      if (pats.some((p) => {
+        p.lastIndex = 0;
+        return p.test(d);
+      })) hits.add(stage);
+    }
+    return hits;
+  });
+  for (const chain of COMBO_CHAINS) {
+    const chainStages = chain.stages;
+    if (!chainStages.length || chain.min_stages <= 0) continue;
+    let matched = 0;
+    let stageIdx = 0;
+    for (const hits of seq) {
+      if (stageIdx < chainStages.length && hits.has(chainStages[stageIdx])) {
+        matched += 1;
+        stageIdx += 1;
+        if (matched >= chain.min_stages) break;
+      }
+    }
+    if (matched >= chain.min_stages) {
+      const riskLevel = chain.risk_level === "critical" || chain.risk_level === "high" || chain.risk_level === "medium" || chain.risk_level === "low" ? chain.risk_level : "high";
+      return {
+        allowed: false,
+        reason: chain.reason,
+        riskLevel,
+        riskType: "combo_chain",
+        confidence: 85,
+        source: "logic_rule",
+        violatedLayers: ["2"]
+      };
+    }
+  }
   return null;
 }
 function extractFilePaths(text) {
@@ -859,17 +906,17 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
     }
   }
   const unreadPaths = [];
-  for (const path3 of uniqueTargetPaths) {
+  for (const path5 of uniqueTargetPaths) {
     const hasRead = [...historyReadPaths].some(
-      (rp) => path3 === rp || path3.startsWith(rp) || rp.startsWith(path3)
+      (rp) => path5 === rp || path5.startsWith(rp) || rp.startsWith(path5)
     );
     if (!hasRead) {
-      let isCreate = !fs2.existsSync(path3);
+      let isCreate = !fs2.existsSync(path5);
       if (!isCreate) {
         isCreate = CREATE_KEYWORDS.some((kw) => reason.toLowerCase().includes(kw) || actionDetail.includes(kw));
       }
       if (!isCreate) {
-        unreadPaths.push(path3);
+        unreadPaths.push(path5);
       }
     }
   }
@@ -1012,7 +1059,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
     violatedLayers: ["2"]
   };
 }
-var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, WRITE_KEYWORDS, WRITE_COMMAND_RES, READ_ONLY_COMMANDS, DEVNULL_REDIRECT_RE, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
+var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, WRITE_KEYWORDS, WRITE_COMMAND_RES, READ_ONLY_COMMANDS, DEVNULL_REDIRECT_RE, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
 var init_logic_rules = __esm({
   "src/engine/logic-rules.ts"() {
     "use strict";
@@ -1021,7 +1068,7 @@ var init_logic_rules = __esm({
     init_rules_loader();
     ROOT_SENSITIVE_PATHS = _loadSensitivePathScope("root");
     HOME_SENSITIVE_PATHS = _loadSensitivePathScope("home");
-    CREDENTIAL_PATHS = _loadSensitivePathScope("credential").map(({ path: path3, riskLevel, desc }) => ({ path: path3, riskLevel, desc, credential: true }));
+    CREDENTIAL_PATHS = _loadSensitivePathScope("credential").map(({ path: path5, riskLevel, desc }) => ({ path: path5, riskLevel, desc, credential: true }));
     NON_WRITE_TOOLS = /* @__PURE__ */ new Set([
       "ask_user_question",
       "glob",
@@ -1165,6 +1212,24 @@ var init_logic_rules = __esm({
         reason: p.reason
       }));
     })();
+    COMBO_STAGES = (() => {
+      const combo = loadL2().combo_chains || {};
+      const stages = {};
+      for (const [name, pats] of Object.entries(combo.stages || {})) {
+        stages[name] = pats.map((p) => new RegExp(p, "i"));
+      }
+      return stages;
+    })();
+    COMBO_CHAINS = (() => {
+      const combo = loadL2().combo_chains || {};
+      return (combo.chains || []).map((c) => ({
+        id: String(c.id || "combo_chain"),
+        stages: c.stages || [],
+        min_stages: Number(c.min_stages) || (c.stages || []).length,
+        risk_level: String(c.risk_level || "high"),
+        reason: String(c.reason || "\u68C0\u6D4B\u5230\u7EC4\u5408\u653B\u51FB\u94FE")
+      }));
+    })();
     INLINE_SCRIPT_RE = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
     DIR_TRAVERSAL_KW = [
       "os.listdir",
@@ -1282,9 +1347,11 @@ __export(runtime_config_exports, {
   addAgentRule: () => addAgentRule,
   addCustomRule: () => addCustomRule,
   addCustomSkill: () => addCustomSkill,
+  addScenarioRule: () => addScenarioRule,
   deleteAgentRule: () => deleteAgentRule,
   deleteCustomRule: () => deleteCustomRule,
   deleteCustomSkill: () => deleteCustomSkill,
+  deleteScenarioRule: () => deleteScenarioRule,
   filterEnabledRules: () => filterEnabledRules,
   generateSourceDefaults: () => generateSourceDefaults,
   getAgentRules: () => getAgentRules,
@@ -1303,9 +1370,11 @@ __export(runtime_config_exports, {
   getEnabledL2SensitivePathsOrDefault: () => getEnabledL2SensitivePathsOrDefault,
   getEnabledL2UserDeletionPatterns: () => getEnabledL2UserDeletionPatterns,
   getEnabledL2UserDeletionPatternsOrDefault: () => getEnabledL2UserDeletionPatternsOrDefault,
+  getEnabledScenarioExtensions: () => getEnabledScenarioExtensions,
   getEnvOverrides: () => getEnvOverrides,
   getProfileOrDetect: () => getProfileOrDetect,
   getRuntimeConfigPath: () => getRuntimeConfigPath,
+  getScenarioRules: () => getScenarioRules,
   hasRuntimeConfig: () => hasRuntimeConfig,
   isL2CategoryEnabled: () => isL2CategoryEnabled,
   isLayerEnabled: () => isLayerEnabled,
@@ -1319,6 +1388,8 @@ __export(runtime_config_exports, {
   updateRuleDenyMode: () => updateRuleDenyMode,
   updateRuleEnabled: () => updateRuleEnabled,
   updateRuleSkipL3: () => updateRuleSkipL3,
+  updateScenarioCategoryEnabled: () => updateScenarioCategoryEnabled,
+  updateScenarioRuleEnabled: () => updateScenarioRuleEnabled,
   updateSkillCategoryEnabled: () => updateSkillCategoryEnabled,
   updateSkillEnabled: () => updateSkillEnabled
 });
@@ -1347,7 +1418,8 @@ function emptyRuntimeConfig() {
     L1_rules: {},
     L2_rules: {},
     L3_skills: {},
-    agent_rules: {}
+    agent_rules: {},
+    scenario_rules: {}
   };
 }
 function loadRuntimeConfig() {
@@ -1373,7 +1445,8 @@ function loadRuntimeConfig() {
       L1_rules: merged.L1_rules || {},
       L2_rules: merged.L2_rules || {},
       L3_skills: merged.L3_skills || {},
-      agent_rules: merged.agent_rules || {}
+      agent_rules: merged.agent_rules || {},
+      scenario_rules: merged.scenario_rules || {}
     };
   } catch {
     return emptyRuntimeConfig();
@@ -1608,6 +1681,55 @@ function _l3SkillsToRules() {
   out.user_custom = { category_enabled: true, category_desc: "", skills: [] };
   return out;
 }
+function _scenarioRulesToDefaults() {
+  const out = {};
+  const scenDir = existsSync4(_SCENARIOS_DIR_PROD) ? _SCENARIOS_DIR_PROD : existsSync4(_SCENARIOS_DIR_DEV) ? _SCENARIOS_DIR_DEV : _SCENARIOS_DIR_PROD;
+  if (!existsSync4(scenDir)) return out;
+  let entries;
+  try {
+    entries = readdirSync3(scenDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+  } catch {
+    return out;
+  }
+  for (const scenarioId of entries) {
+    const rulesFile = join2(scenDir, scenarioId, "rules.json");
+    if (!existsSync4(rulesFile)) continue;
+    let data;
+    try {
+      data = JSON.parse(readFileSync4(rulesFile, "utf-8"));
+    } catch {
+      continue;
+    }
+    out[scenarioId] = {
+      builtin_safe_action_types: {
+        category_enabled: true,
+        category_desc: "\u573A\u666F\u5B8C\u5168\u5B89\u5168\u64CD\u4F5C\u767D\u540D\u5355\uFF08\u573A\u666F\u901A\u5E38\u4E0D\u4F7F\u7528\uFF09",
+        rules: []
+      },
+      builtin_safe_skills: {
+        category_enabled: true,
+        category_desc: "\u573A\u666F\u4FE1\u4EFB\u7684\u5185\u7F6E Skill\uFF08\u573A\u666F\u901A\u5E38\u4E0D\u4F7F\u7528\uFF09",
+        rules: []
+      },
+      extra_command_patterns: {
+        category_enabled: true,
+        category_desc: "\u573A\u666F\u4E13\u5C5E\u5371\u9669\u547D\u4EE4\u6B63\u5219\uFF08L1 \u672B\u5C3E\u8FFD\u52A0\uFF09",
+        rules: (data.extra_command_patterns || []).map((p) => ({ ...p, enabled: true, builtin: true }))
+      },
+      extra_injection_keywords: {
+        category_enabled: true,
+        category_desc: "\u573A\u666F\u4E13\u5C5E\u6CE8\u5165\u5173\u952E\u8BCD\uFF08L1 \u672B\u5C3E\u8FFD\u52A0\uFF09",
+        rules: (data.extra_injection_keywords || []).map((k) => ({ ...k, enabled: true, builtin: true }))
+      },
+      extra_sensitive_paths: {
+        category_enabled: true,
+        category_desc: "\u573A\u666F\u4E13\u5C5E\u654F\u611F\u8DEF\u5F84\uFF08L1 \u672B\u5C3E\u8FFD\u52A0\uFF09",
+        rules: (data.extra_sensitive_paths || []).map((sp) => ({ ...sp, enabled: true, builtin: true }))
+      }
+    };
+  }
+  return out;
+}
 function _agentRulesToDefaults() {
   const out = {};
   const agentsDir = existsSync4(_AGENTS_DIR_PROD) ? _AGENTS_DIR_PROD : existsSync4(_AGENTS_DIR_DEV) ? _AGENTS_DIR_DEV : _AGENTS_DIR_PROD;
@@ -1699,7 +1821,8 @@ function generateSourceDefaults() {
       user_custom: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49 L2 \u903B\u8F91\u89C4\u5219", rules: [] }
     },
     L3_skills: _l3SkillsToRules(),
-    agent_rules: _agentRulesToDefaults()
+    agent_rules: _agentRulesToDefaults(),
+    scenario_rules: _scenarioRulesToDefaults()
   };
 }
 function normalizePatternForFingerprint(pattern) {
@@ -1792,9 +1915,9 @@ function _mergeSkillCategories(userCfg, srcDefaults, layerKey) {
     }
   }
 }
-function _mergeAgentRules(userCfg, srcDefaults) {
-  const userAgent = userCfg.agent_rules || (userCfg.agent_rules = {});
-  const srcAgent = srcDefaults.agent_rules || {};
+function _mergeAgentRules(userCfg, srcDefaults, partition = "agent_rules") {
+  const userAgent = userCfg[partition] || (userCfg[partition] = {});
+  const srcAgent = srcDefaults[partition] || {};
   for (const [agentId, srcCats] of Object.entries(srcAgent)) {
     if (!(agentId in userAgent)) {
       userAgent[agentId] = JSON.parse(JSON.stringify(srcCats));
@@ -1853,6 +1976,7 @@ function mergeConfig(userCfg, srcDefaults) {
   _mergeRuleCategories(cfg, srcDefaults, "L2_rules");
   _mergeSkillCategories(cfg, srcDefaults, "L3_skills");
   _mergeAgentRules(cfg, srcDefaults);
+  _mergeAgentRules(cfg, srcDefaults, "scenario_rules");
   return cfg;
 }
 function _migrateCategoriesAcrossLayers(cfg, srcLayer, dstLayer, catNames) {
@@ -2178,7 +2302,85 @@ function updateAgentCategoryEnabled(agentId, category, enabled) {
   saveRuntimeConfig(runtime);
   return runtime;
 }
-var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DENY_MODE_LABELS, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, SKILL_ID_RE;
+function getScenarioRules(runtime) {
+  return runtime.scenario_rules || {};
+}
+function getEnabledScenarioExtensions(runtime, scenarioId) {
+  const scenData = runtime.scenario_rules?.[scenarioId];
+  if (!scenData) return null;
+  const cmdPatterns = _agentCategoryEnabledRules(scenData.extra_command_patterns).filter((r) => r.pattern).map((r) => ({
+    pattern: r.pattern,
+    risk_level: r.risk_level || "",
+    risk_type: r.risk_type || "",
+    reason: r.reason || ""
+  }));
+  const injKeywords = _agentCategoryEnabledRules(scenData.extra_injection_keywords).filter((r) => r.keyword).map((r) => ({
+    keyword: r.keyword,
+    risk_level: r.risk_level || "",
+    lang: r.lang || "en"
+  }));
+  const sensitivePaths = _agentCategoryEnabledRules(scenData.extra_sensitive_paths).filter((r) => r.path).map((r) => ({
+    path: r.path,
+    risk_level: r.risk_level || "",
+    desc: r.desc || "",
+    credential: r.credential,
+    read_only: r.read_only,
+    deny_mode: r.deny_mode
+  }));
+  return {
+    agent_id: scenarioId,
+    description: "",
+    extra_command_patterns: cmdPatterns,
+    extra_injection_keywords: injKeywords,
+    extra_sensitive_paths: sensitivePaths,
+    builtin_safe_skills: [],
+    builtin_safe_action_types: [],
+    extra_skills: []
+  };
+}
+function updateScenarioRuleEnabled(scenarioId, category, ruleFp, enabled) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.scenario_rules?.[scenarioId]?.[category];
+  if (cat) {
+    const targetFp = _ruleFingerprint(ruleFp);
+    for (const r of cat.rules || []) {
+      if (_ruleFingerprint(r) === targetFp) {
+        r.enabled = enabled;
+        break;
+      }
+    }
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function addScenarioRule(scenarioId, category, rule) {
+  const runtime = loadRuntimeConfig();
+  if (!runtime.scenario_rules) runtime.scenario_rules = {};
+  if (!runtime.scenario_rules[scenarioId]) runtime.scenario_rules[scenarioId] = {};
+  const cats = runtime.scenario_rules[scenarioId];
+  if (!cats[category]) cats[category] = { category_enabled: true, category_desc: "", rules: [] };
+  (cats[category].rules || (cats[category].rules = [])).push({ ...rule, enabled: true, builtin: false });
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function deleteScenarioRule(scenarioId, category, ruleFp) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.scenario_rules?.[scenarioId]?.[category];
+  if (cat) {
+    const targetFp = _ruleFingerprint(ruleFp);
+    cat.rules = (cat.rules || []).filter((r) => _ruleFingerprint(r) !== targetFp);
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function updateScenarioCategoryEnabled(scenarioId, category, enabled) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.scenario_rules?.[scenarioId]?.[category];
+  if (cat) cat.category_enabled = enabled;
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DENY_MODE_LABELS, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, SKILL_ID_RE;
 var init_runtime_config = __esm({
   "src/infra/runtime-config.ts"() {
     "use strict";
@@ -2203,6 +2405,8 @@ var init_runtime_config = __esm({
     };
     _AGENTS_DIR_PROD = join2(__dirname4, "agents");
     _AGENTS_DIR_DEV = join2(__dirname4, "..", "..", "..", "agent_moss", "agents");
+    _SCENARIOS_DIR_PROD = join2(__dirname4, "scenarios");
+    _SCENARIOS_DIR_DEV = join2(__dirname4, "..", "..", "..", "agent_moss", "scenarios");
     SKILL_ID_RE = /^[A-Za-z0-9_-]+$/;
   }
 });
@@ -2254,6 +2458,21 @@ function getAgentExtensions(agentId) {
   );
   return ext;
 }
+function mergeAgentExtensions(...exts) {
+  const nonNull = exts.filter((e) => !!e);
+  if (nonNull.length === 0) return null;
+  const base = nonNull[0];
+  return {
+    agent_id: base.agent_id,
+    description: base.description,
+    extra_command_patterns: nonNull.flatMap((e) => e.extra_command_patterns || []),
+    extra_injection_keywords: nonNull.flatMap((e) => e.extra_injection_keywords || []),
+    extra_sensitive_paths: nonNull.flatMap((e) => e.extra_sensitive_paths || []),
+    builtin_safe_skills: nonNull.flatMap((e) => e.builtin_safe_skills || []),
+    builtin_safe_action_types: nonNull.flatMap((e) => e.builtin_safe_action_types || []),
+    extra_skills: nonNull.flatMap((e) => e.extra_skills || [])
+  };
+}
 var __filename4, __dirname5, AGENTS_DIR_PROD, AGENTS_DIR_DEV_FALLBACK, cache;
 var init_agents = __esm({
   "src/agents/index.ts"() {
@@ -2267,6 +2486,77 @@ var init_agents = __esm({
   }
 });
 
+// src/scenarios/index.ts
+import { readFileSync as readFileSync6, existsSync as existsSync6 } from "fs";
+import { resolve as resolve4, dirname as dirname5 } from "path";
+import { fileURLToPath as fileURLToPath7 } from "url";
+function resolveScenariosDir() {
+  if (existsSync6(SCENARIOS_DIR_PROD)) return SCENARIOS_DIR_PROD;
+  if (existsSync6(SCENARIOS_DIR_DEV_FALLBACK)) return SCENARIOS_DIR_DEV_FALLBACK;
+  return SCENARIOS_DIR_PROD;
+}
+function getScenarioExtensions(scenarioId) {
+  if (!scenarioId) return null;
+  if (cache2.has(scenarioId)) return cache2.get(scenarioId) ?? null;
+  let ext = null;
+  try {
+    const { hasRuntimeConfig: hasRuntimeConfig2, loadRuntimeConfig: loadRuntimeConfig2, getEnabledScenarioExtensions: getEnabledScenarioExtensions2 } = (init_runtime_config(), __toCommonJS(runtime_config_exports));
+    if (hasRuntimeConfig2()) {
+      ext = getEnabledScenarioExtensions2(loadRuntimeConfig2(), scenarioId);
+    }
+  } catch {
+  }
+  if (ext === null) {
+    const scenariosDir = resolveScenariosDir();
+    const rulesFile = resolve4(scenariosDir, scenarioId, "rules.json");
+    if (!existsSync6(rulesFile)) {
+      cache2.set(scenarioId, null);
+      return null;
+    }
+    try {
+      const raw = readFileSync6(rulesFile, "utf-8");
+      const data = JSON.parse(raw);
+      const id = data.scenario_id || data.agent_id || "";
+      if (!id) {
+        console.warn(`[AgentMoss scenarios] rules.json \u7F3A\u5C11 scenario_id \u5B57\u6BB5: ${rulesFile}`);
+        cache2.set(scenarioId, null);
+        return null;
+      }
+      ext = {
+        agent_id: id,
+        description: data.description || "",
+        extra_command_patterns: data.extra_command_patterns || [],
+        extra_injection_keywords: data.extra_injection_keywords || [],
+        extra_sensitive_paths: data.extra_sensitive_paths || [],
+        builtin_safe_skills: data.builtin_safe_skills || [],
+        builtin_safe_action_types: data.builtin_safe_action_types || [],
+        extra_skills: data.extra_skills || []
+      };
+    } catch (e) {
+      console.error(`[AgentMoss scenarios] \u52A0\u8F7D\u573A\u666F ${scenarioId} rules.json \u5931\u8D25:`, e.message);
+      cache2.set(scenarioId, null);
+      return null;
+    }
+  }
+  cache2.set(scenarioId, ext);
+  console.log(
+    `[AgentMoss scenarios] \u52A0\u8F7D\u573A\u666F ${scenarioId} \u5B9A\u5236\u89C4\u5219: ${ext.extra_command_patterns?.length ?? 0} cmd patterns, ${ext.extra_injection_keywords?.length ?? 0} injection keywords, ${ext.extra_sensitive_paths?.length ?? 0} sensitive paths`
+  );
+  return ext;
+}
+var __filename5, __dirname6, SCENARIOS_DIR_PROD, SCENARIOS_DIR_DEV_FALLBACK, cache2;
+var init_scenarios = __esm({
+  "src/scenarios/index.ts"() {
+    "use strict";
+    init_esm_shims();
+    __filename5 = fileURLToPath7(import.meta.url);
+    __dirname6 = dirname5(__filename5);
+    SCENARIOS_DIR_PROD = resolve4(__dirname6, "scenarios");
+    SCENARIOS_DIR_DEV_FALLBACK = resolve4(__dirname6, "../../../agent_moss/scenarios");
+    cache2 = /* @__PURE__ */ new Map();
+  }
+});
+
 // src/engine/heuristic.ts
 function runHeuristicCheck(input) {
   const command = `${input.aNext.actionType}: ${input.aNext.actionDetail}`;
@@ -2306,7 +2596,10 @@ function runHeuristicCheck(input) {
     }
   }
   highestRiskType = topRiskType || highestRiskType;
-  const agentExt = getAgentExtensions(input.agentId);
+  const agentExt = mergeAgentExtensions(
+    getAgentExtensions(input.agentId),
+    getScenarioExtensions(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "")
+  );
   if (agentExt?.extra_command_patterns) {
     for (const rule of agentExt.extra_command_patterns) {
       try {
@@ -2479,13 +2772,13 @@ function checkSensitivePath(command, cwd, agentExt) {
   const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
   const isWriteOpFlag = isWriteOperation("", command);
   const pathScanText = normalizePathSegments(stripLiteralTextSegments(command));
-  const pathMatches = (text, path3) => {
-    const parts = path3.split(/(\(\?!.*?\))/);
+  const pathMatches = (text, path5) => {
+    const parts = path5.split(/(\(\?!.*?\))/);
     const escaped = parts.map((part) => {
       if (part.startsWith("(?!")) return part;
       return part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     }).join("");
-    const re = path3.startsWith(".") || path3.startsWith("/") ? new RegExp(`(?:^|[\\s/\\\\'"])${escaped}\\b`, "i") : new RegExp(`\\b${escaped}\\b`, "i");
+    const re = path5.startsWith(".") || path5.startsWith("/") ? new RegExp(`(?:^|[\\s/\\\\'"])${escaped}\\b`, "i") : new RegExp(`\\b${escaped}\\b`, "i");
     return re.test(text);
   };
   for (const sp of ROOT_SENSITIVE_PATHS) {
@@ -2749,6 +3042,7 @@ var init_heuristic = __esm({
     init_esm_shims();
     init_config();
     init_agents();
+    init_scenarios();
     init_rules_loader();
     init_logic_rules();
     INJECTION_KEYWORDS = (() => {
@@ -2783,16 +3077,16 @@ __export(token_stats_exports, {
   recordTokenUsage: () => recordTokenUsage,
   resetTokenStats: () => resetTokenStats
 });
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync2, existsSync as existsSync8, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2 } from "fs";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync2, existsSync as existsSync10, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2 } from "fs";
 function getStatsPath() {
   const envPath = process.env[ENV_STATS_PATH];
   if (envPath) return envPath;
   return getTokenStatsPath();
 }
 function loadAllRecords(statsPath) {
-  if (!existsSync8(statsPath)) return [];
+  if (!existsSync10(statsPath)) return [];
   try {
-    const data = JSON.parse(readFileSync9(statsPath, "utf-8"));
+    const data = JSON.parse(readFileSync11(statsPath, "utf-8"));
     if (Array.isArray(data)) return data;
     if (data && Array.isArray(data.records)) return data.records;
     return [];
@@ -2803,7 +3097,7 @@ function loadAllRecords(statsPath) {
 function saveRecords(statsPath, records) {
   try {
     const dir = statsPath.substring(0, statsPath.lastIndexOf("/"));
-    if (dir && !existsSync8(dir)) mkdirSync2(dir, { recursive: true });
+    if (dir && !existsSync10(dir)) mkdirSync2(dir, { recursive: true });
     writeFileSync2(statsPath, JSON.stringify(records, null, 2), "utf-8");
   } catch (e) {
   }
@@ -2930,7 +3224,7 @@ function getTokenTrend(days = 0, startDate, endDate) {
 }
 function resetTokenStats() {
   const statsPath = getStatsPath();
-  if (existsSync8(statsPath)) {
+  if (existsSync10(statsPath)) {
     try {
       unlinkSync2(statsPath);
     } catch {
@@ -2961,28 +3255,28 @@ init_skill_loader();
 
 // src/engine/template-loader.ts
 init_esm_shims();
-import { readFileSync as readFileSync6, existsSync as existsSync6 } from "fs";
-import { resolve as resolve4, dirname as dirname5 } from "path";
-import { fileURLToPath as fileURLToPath7 } from "url";
-var __filename5 = fileURLToPath7(import.meta.url);
-var __dirname6 = dirname5(__filename5);
-var TEMPLATES_DIR = resolve4(__dirname6, "../templates");
-var TEMPLATES_DIR_FALLBACK = resolve4(__dirname6, "../../../agent_moss/templates");
+import { readFileSync as readFileSync7, existsSync as existsSync7 } from "fs";
+import { resolve as resolve5, dirname as dirname6 } from "path";
+import { fileURLToPath as fileURLToPath8 } from "url";
+var __filename6 = fileURLToPath8(import.meta.url);
+var __dirname7 = dirname6(__filename6);
+var TEMPLATES_DIR = resolve5(__dirname7, "../templates");
+var TEMPLATES_DIR_FALLBACK = resolve5(__dirname7, "../../../agent_moss/templates");
 var TEMPLATE_FILES = ["prompt1_template.txt", "prompt2_template.txt", "security_judge_template.txt"];
 var cachedTemplates = null;
 function loadTemplates() {
   if (cachedTemplates) return cachedTemplates;
   cachedTemplates = {};
-  const dir = existsSync6(TEMPLATES_DIR) ? TEMPLATES_DIR : TEMPLATES_DIR_FALLBACK;
-  if (!existsSync6(dir)) {
+  const dir = existsSync7(TEMPLATES_DIR) ? TEMPLATES_DIR : TEMPLATES_DIR_FALLBACK;
+  if (!existsSync7(dir)) {
     console.warn("[AgentMoss] Templates directory not found:", TEMPLATES_DIR, "and fallback:", TEMPLATES_DIR_FALLBACK);
     return cachedTemplates;
   }
   for (const file of TEMPLATE_FILES) {
-    const filePath = resolve4(dir, file);
-    if (existsSync6(filePath)) {
+    const filePath = resolve5(dir, file);
+    if (existsSync7(filePath)) {
       const key = file.replace(".txt", "").replace("_template", "");
-      cachedTemplates[key] = readFileSync6(filePath, "utf-8");
+      cachedTemplates[key] = readFileSync7(filePath, "utf-8");
     }
   }
   console.log(`[AgentMoss] Loaded ${Object.keys(cachedTemplates).length} templates from ${dir}`);
@@ -2991,8 +3285,8 @@ function loadTemplates() {
 
 // src/engine/script-analyzer.ts
 init_esm_shims();
-import { readFileSync as readFileSync7 } from "fs";
-import { resolve as resolve5, join as join3 } from "path";
+import { readFileSync as readFileSync8 } from "fs";
+import { resolve as resolve6, join as join3 } from "path";
 var SUSPICIOUS_PATTERNS = [
   // Network exfiltration (curl/wget POST in scripts is almost never legitimate)
   { name: "curl POST", pattern: /curl\s+(.*\s)?-X\s+POST/i },
@@ -3125,8 +3419,8 @@ function assessKeywordCombinationRisk(matchedKeywords, scriptContent) {
 }
 function readScriptContent(scriptPath, maxLines = 500) {
   try {
-    const expandedPath = scriptPath.startsWith("~") ? join3(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve5(scriptPath);
-    const raw = readFileSync7(expandedPath, "utf-8");
+    const expandedPath = scriptPath.startsWith("~") ? join3(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve6(scriptPath);
+    const raw = readFileSync8(expandedPath, "utf-8");
     const lines = raw.split("\n").slice(0, maxLines);
     return { content: lines.join("\n"), lineCount: lines.length, error: "" };
   } catch (e) {
@@ -3180,133 +3474,1524 @@ ${result.scriptContent}
 init_esm_shims();
 init_heuristic();
 init_logic_rules();
-import { readFileSync as readFileSync8, statSync, existsSync as existsSync7 } from "fs";
-import { resolve as resolve6, join as join4, isAbsolute, dirname as dirname6 } from "path";
-import { homedir as homedir2 } from "os";
-function emptyChain() {
-  return {
-    nodes: [],
-    entryPath: "",
-    maxDepthReached: false,
-    maxSizeReached: false,
-    totalSize: 0,
-    totalLines: 0,
-    hasCritical: false,
-    hasHigh: false,
-    firstHitNode: null,
-    error: ""
-  };
+import { statSync as statSync2, existsSync as existsSync9 } from "fs";
+import { resolve as resolve8, join as join5, isAbsolute as isAbsolute2 } from "path";
+import { homedir as homedir3 } from "os";
+
+// src/engine/script-engine/tracker.ts
+init_esm_shims();
+import * as fs3 from "fs";
+import * as path3 from "path";
+import * as os from "os";
+
+// src/engine/script-engine/backends/python-backend.ts
+init_esm_shims();
+import { parser } from "@lezer/python";
+var MAX_LINES = 500;
+var PURE_BUILTINS = /* @__PURE__ */ new Set([
+  "len",
+  "print",
+  "str",
+  "int",
+  "float",
+  "bool",
+  "list",
+  "dict",
+  "set",
+  "tuple",
+  "range",
+  "sorted",
+  "enumerate",
+  "zip",
+  "map",
+  "filter",
+  "sum",
+  "min",
+  "max",
+  "abs",
+  "round",
+  "isinstance",
+  "type",
+  "open",
+  "input",
+  "repr",
+  "ord",
+  "chr",
+  "hex",
+  "oct",
+  "bin",
+  "format",
+  "id",
+  "hash",
+  "any",
+  "all",
+  "next",
+  "iter",
+  "reversed",
+  "pow",
+  "divmod"
+]);
+var CHILD_CALL_RE = /(?:^|\s|&&|\|\|)\s*((?:\/bin\/)?bash|sh|zsh|(?:python|python3|node|ruby|perl|php|lua))\s+(\S+(?:\.(?:sh|shrc|py|js|rb|pl|php|lua))?)([^\n;|&]*?)$/gim;
+var SUBPROCESS_FUNCS = /* @__PURE__ */ new Set(["run", "call", "Popen", "check_call", "check_output"]);
+var OS_FUNCS = /* @__PURE__ */ new Set(["system", "popen", "popen2", "popen3", "popen4"]);
+function buildLineStarts(content) {
+  const starts = [0];
+  for (let i = 0; i < content.length; i++) {
+    if (content[i] === "\n") starts.push(i + 1);
+  }
+  return starts;
+}
+function lineAt(lineStarts, pos) {
+  let lo = 0;
+  let hi = lineStarts.length - 1;
+  while (lo < hi) {
+    const mid = lo + hi + 1 >> 1;
+    if (lineStarts[mid] <= pos) lo = mid;
+    else hi = mid - 1;
+  }
+  return lo + 1;
+}
+function markNodeLines(node, lines, lineStarts) {
+  const start = lineAt(lineStarts, node.from);
+  const end = node.to > node.from ? lineAt(lineStarts, node.to - 1) : start;
+  for (let i = start; i <= end; i++) lines.add(i);
+}
+function reconstruct(sourceLines, lines) {
+  const out = [];
+  for (const i of [...lines].sort((a, b) => a - b)) {
+    if (i >= 1 && i <= sourceLines.length) out.push(sourceLines[i - 1]);
+  }
+  return out.join("\n");
+}
+function makeEnv(argv) {
+  return { argv, vars: {} };
+}
+var SOURCE = "";
+function srcSlice(node) {
+  return SOURCE.slice(node.from, node.to);
+}
+function stringValue(tokenText) {
+  let s = tokenText;
+  if (s.length >= 2) {
+    const q = s[0];
+    if ((q === '"' || q === "'") && s.endsWith(q)) s = s.slice(1, -1);
+  }
+  s = s.replace(/\\n/g, "\n").replace(/\\t/g, "	").replace(/\\r/g, "\r").replace(/\\\\/g, "\\").replace(/\\"/g, '"').replace(/\\'/g, "'");
+  return s;
+}
+function isSysArgv(node) {
+  if (!node || node.name !== "MemberExpression") return false;
+  const first = node.firstChild;
+  if (!first || first.name !== "VariableName" || srcSlice(first) !== "sys") return false;
+  const prop = node.getChild("PropertyName");
+  return prop !== null && srcSlice(prop) === "argv";
+}
+function evalExpr(node, env) {
+  if (!node) return null;
+  const name = node.name;
+  if (name === "String") return stringValue(srcSlice(node));
+  if (name === "Number") return srcSlice(node);
+  if (name === "VariableName") {
+    const id = srcSlice(node);
+    return id in env.vars ? env.vars[id] : null;
+  }
+  if (name === "MemberExpression") {
+    const bracket = node.getChild("[");
+    if (bracket) {
+      const inner = node.firstChild;
+      if (inner && isSysArgv(inner)) {
+        const idxNode = bracket.nextSibling;
+        if (idxNode && idxNode.name === "Number") {
+          const idx = parseInt(srcSlice(idxNode), 10);
+          if (idx >= 1 && idx <= env.argv.length) return env.argv[idx - 1];
+          return null;
+        }
+      }
+      return null;
+    }
+    if (isSysArgv(node)) return env.argv[0] ?? null;
+    return null;
+  }
+  if (name === "CallExpression") {
+    const func = node.firstChild;
+    if (func && func.name === "VariableName" && srcSlice(func) === "len") {
+      const argList = node.getChild("ArgList");
+      const inner = argList ? firstNamedChild(argList) : null;
+      if (inner && isSysArgv(inner)) return String(env.argv.length + 1);
+    }
+    return null;
+  }
+  if (name === "ConditionalExpression") {
+    const ifKw = node.getChild("if");
+    const elseKw = node.getChild("else");
+    if (!ifKw || !elseKw) return null;
+    const thenNode = node.firstChild;
+    const condNode = ifKw.nextSibling;
+    const orelseNode = elseKw.nextSibling;
+    if (!thenNode || !condNode || !orelseNode) return null;
+    const cond = evalCondition(condNode, env);
+    if (cond === true) return evalExpr(thenNode, env);
+    if (cond === false) return evalExpr(orelseNode, env);
+    return null;
+  }
+  if (name === "BinaryExpression") {
+    const op = findOp(node);
+    if (op === "+") {
+      const left = evalExpr(node.firstChild, env);
+      const right = evalExpr(lastNamedChild(node), env);
+      if (left !== null && right !== null) return left + right;
+    }
+    return null;
+  }
+  return null;
 }
-function newNode(path3, depth) {
-  return {
-    scriptPath: path3,
-    rawContent: "",
-    preprocessedContent: "",
-    lineCount: 0,
-    fileSize: 0,
-    depth,
-    childPaths: [],
-    error: "",
-    l1Hit: false,
-    l1RiskLevel: "",
-    l1RiskType: "",
-    l1Reason: "",
-    l1MatchedPatterns: [],
-    l2Hit: false,
-    l2ViolatedRule: "",
-    l2RiskLevel: "",
-    l2RiskType: "",
-    l2Reason: "",
-    matchedKeywords: [],
-    isSuspicious: false,
-    keywordRiskLevel: "",
-    keywordRiskReason: ""
-  };
+function firstNamedChild(node) {
+  let c = node.firstChild;
+  while (c) {
+    if (c.name !== "(" && c.name !== ")" && c.name !== "," && c.name !== ":") return c;
+    c = c.nextSibling;
+  }
+  return null;
 }
-function stripComments(content) {
-  return content.split("\n").filter((line) => !line.trimStart().startsWith("#")).join("\n");
+function lastNamedChild(node) {
+  let c = node.lastChild;
+  while (c) {
+    if (c.name !== "(" && c.name !== ")" && c.name !== "," && c.name !== ":") return c;
+    c = c.prevSibling;
+  }
+  return null;
 }
-function stripOutputText(content) {
-  let result = content.replace(/echo\s+".*?"/gs, 'echo ""');
-  result = result.replace(/echo\s+'.*?'/gs, "echo ''");
-  result = result.replace(/printf\s+".*?"[^\n]*/gs, 'printf ""');
-  result = result.replace(/printf\s+'.*?'[^\n]*/gs, "printf ''");
-  return result;
+function findOp(node) {
+  let c = node.firstChild;
+  while (c) {
+    if (c.name === "CompareOp" || c.name === "and" || c.name === "or" || c.name === "UpdateOp") {
+      return srcSlice(c).trim();
+    }
+    c = c.nextSibling;
+  }
+  return null;
 }
-function expandSimpleVariables(content) {
-  const varMap = {};
-  const assignmentRe = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.+)$/;
-  const collectAssignments = (text) => {
-    for (const line of text.split("\n")) {
-      const m = line.match(assignmentRe);
-      if (m) {
-        const varName = m[1];
-        let varVal = m[2].trim();
-        if (varVal && !varVal.includes("$") && !varVal.includes("`")) {
-          if (varVal.startsWith('"') && varVal.endsWith('"') || varVal.startsWith("'") && varVal.endsWith("'")) {
-            varVal = varVal.slice(1, -1);
-          }
-          varMap[varName] = varVal;
-        }
+function evalCondition(node, env) {
+  if (!node) return null;
+  const name = node.name;
+  if (name === "Boolean") {
+    const t = srcSlice(node).trim();
+    return t === "True" ? true : t === "False" ? false : null;
+  }
+  if (name === "BinaryExpression") {
+    const op = findOp(node);
+    if (op === "and" || op === "or") {
+      const parts2 = namedChildren(node);
+      const vals = parts2.map((p) => evalCondition(p, env));
+      if (op === "and") {
+        if (vals.some((v) => v === false)) return false;
+        if (vals.every((v) => v === true)) return true;
+        return null;
       }
+      if (vals.some((v) => v === true)) return true;
+      if (vals.every((v) => v === false)) return false;
+      return null;
     }
-  };
-  collectAssignments(content);
-  let expanded = content;
-  for (let round = 0; round < 3; round++) {
-    const sortedVars = Object.keys(varMap).sort((a, b) => b.length - a.length);
-    let newExpanded = expanded;
-    for (const v of sortedVars) {
-      const val = varMap[v];
-      newExpanded = newExpanded.split("${" + v + "}").join(val);
-      newExpanded = newExpanded.split("$" + v).join(val);
-    }
-    if (newExpanded === expanded) break;
-    expanded = newExpanded;
-    collectAssignments(expanded);
-  }
-  return expanded;
-}
-function preprocessScriptContent(content) {
-  let result = stripComments(content);
-  result = stripOutputText(result);
-  result = expandSimpleVariables(result);
-  return result;
+    const parts = namedChildren(node);
+    if (parts.length !== 3) return null;
+    const [left, opNode, right] = parts;
+    const opText = srcSlice(opNode).trim();
+    return evalCompare(left, opText, right, env);
+  }
+  if (name === "UnaryExpression") {
+    const kw = node.getChild("not");
+    if (kw) {
+      const operand = kw.nextSibling;
+      const v = evalCondition(operand, env);
+      return v === null ? null : !v;
+    }
+    return null;
+  }
+  if (name === "CallExpression") {
+    return null;
+  }
+  return null;
 }
-var SUSPICIOUS_PATTERNS2 = [
-  { name: "curl POST", pattern: /curl\s+(.*\s)?-X\s+POST/i },
-  { name: "curl --data", pattern: /curl\s+(.*\s)?--data/i },
-  { name: "curl -d", pattern: /curl\s+(.*\s)?-d\s/i },
-  { name: "wget --post-data", pattern: /wget\s+(.*\s)?--post-data/i },
-  { name: "wget --post-file", pattern: /wget\s+(.*\s)?--post-file/i },
-  { name: "nc -e", pattern: /\bnc\s+.*-e\b/ },
-  { name: "ncat -e", pattern: /\bncat\s+.*-e\b/ },
-  { name: "/dev/tcp", pattern: /\/dev\/tcp\// },
-  { name: "/dev/udp", pattern: /\/dev\/udp\// },
-  { name: "$(base64", pattern: /\$\(\s*base64/ },
-  { name: "`base64", pattern: /`\s*base64/ },
-  { name: "base64 decode pipe", pattern: /base64\s+(-d|--decode)\s*\|/ },
-  { name: "/etc/shadow", pattern: /\/etc\/shadow/ },
-  { name: "id_rsa", pattern: /\bid_rsa\b/ },
-  { name: "id_ed25519", pattern: /\bid_ed25519\b/ },
-  { name: "crontab install", pattern: /crontab\s+-/ },
-  { name: "authorized_keys", pattern: /authorized_keys/ },
-  { name: "ssh no host key check", pattern: /ssh\s+.*StrictHostKeyChecking\s*=\s*no/ }
-];
-var SCRIPT_EXEC_PATTERNS2 = [
-  /(?:^|\s|&&|\|\|)\s*bash\s+(\S+)/i,
-  /(?:^|\s|&&|\|\|)\s*\/bin\/bash\s+(\S+)/i,
-  /(?:^|\s|&&|\|\|)\s*sh\s+(\S+)/i,
-  /(?:^|\s|&&|\|\|)\s*zsh\s+(\S+)/i,
-  /\.\/(\S+)/,
-  /(?:^|\s|&&|\|\|)\s*source\s+(\S+)/i,
-  /(?:^|\s|&&|\|\|)\s*\.\s+(\S+)/,
-  /(?:^|\s|&&|\|\|)\s*python3?\s+(\S+\.py)/i,
-  /(?:^|\s|&&|\|\|)\s*node\s+(\S+\.js)/i,
-  /(?:^|\s|&&|\|\|)\s*ruby\s+(\S+\.rb)/i,
-  /(?:^|\s|&&|\|\|)\s*perl\s+(\S+\.pl)/i,
-  /(?:^|\s|&&|\|\|)\s*php\s+(\S+\.php)/i,
-  /(?:^|\s|&&|\|\|)\s*lua\s+(\S+\.lua)/i
+function namedChildren(node) {
+  const out = [];
+  let c = node.firstChild;
+  while (c) {
+    if (c.name !== "(" && c.name !== ")" && c.name !== "," && c.name !== ":" && c.name !== "[" && c.name !== "]") {
+      out.push(c);
+    }
+    c = c.nextSibling;
+  }
+  return out;
+}
+function evalCompare(left, opText, right, env) {
+  if (opText === "==" && left.name === "VariableName" && srcSlice(left) === "__name__") {
+    const rv = evalExpr(right, env);
+    if (rv !== null) return rv === "__main__";
+    return null;
+  }
+  if (opText === "==" || opText === "!=") {
+    const lv = evalExpr(left, env);
+    const rv = evalExpr(right, env);
+    if (lv !== null && rv !== null) {
+      return opText === "==" ? lv === rv : lv !== rv;
+    }
+    return null;
+  }
+  if (opText === "in") {
+    const lv = evalExpr(left, env);
+    if (lv === null) return null;
+    const rightName = right.name;
+    if (rightName === "TupleExpression" || rightName === "ArrayExpression" || rightName === "SetExpression" || rightName === "ParenthesizedExpression") {
+      const container = rightName === "ParenthesizedExpression" && right.firstChild && right.firstChild.name === "TupleExpression" ? right.firstChild : right;
+      for (const elt of namedChildren(container)) {
+        const ev = evalExpr(elt, env);
+        if (ev !== null && ev === lv) return true;
+      }
+      return false;
+    }
+    const rv = evalExpr(right, env);
+    if (rv !== null) return rv.includes(lv);
+    return null;
+  }
+  if (opText === ">" || opText === ">=" || opText === "<" || opText === "<=") {
+    const lv = evalExpr(left, env);
+    const rv = evalExpr(right, env);
+    if (lv === null || rv === null) return null;
+    const ln = parseInt(lv, 10);
+    const rn = parseInt(rv, 10);
+    if (Number.isNaN(ln) || Number.isNaN(rn)) return null;
+    if (opText === ">") return ln > rn;
+    if (opText === ">=") return ln >= rn;
+    if (opText === "<") return ln < rn;
+    return ln <= rn;
+  }
+  return null;
+}
+function processStmts(stmts, env, lineStarts, lines, branches) {
+  for (const s of stmts) processStmt(s, env, lineStarts, lines, branches);
+}
+function invalidateEnvOnCalls(node, env) {
+  const cursor = node.cursor();
+  cursor.iterate((n) => {
+    const nd = n.node;
+    if (nd.name !== "CallExpression") return true;
+    const func = nd.firstChild;
+    if (func && func.name === "VariableName" && !PURE_BUILTINS.has(srcSlice(func))) {
+      for (const k of Object.keys(env.vars)) env.vars[k] = null;
+      return false;
+    }
+    return true;
+  });
+}
+function processStmt(stmt, env, lineStarts, lines, branches) {
+  const name = stmt.name;
+  if (name === "AssignStatement") {
+    const target = stmt.firstChild;
+    if (target && target.name === "VariableName") {
+      const valNode = target.nextSibling ? target.nextSibling.nextSibling : null;
+      invalidateEnvOnCalls(stmt, env);
+      const val = evalExpr(valNode, env);
+      env.vars[srcSlice(target)] = val;
+    }
+    markNodeLines(stmt, lines, lineStarts);
+    return;
+  }
+  if (name === "UpdateStatement") {
+    const target = stmt.firstChild;
+    if (target && target.name === "VariableName") env.vars[srcSlice(target)] = null;
+    invalidateEnvOnCalls(stmt, env);
+    markNodeLines(stmt, lines, lineStarts);
+    return;
+  }
+  if (name === "IfStatement") {
+    processIf(stmt, env, lineStarts, lines, branches);
+    return;
+  }
+  if (name === "ForStatement" || name === "WhileStatement") {
+    markNodeLines(stmt, lines, lineStarts);
+    for (const body of stmt.getChildren("Body")) {
+      processStmts(bodyStmts(body), { argv: env.argv, vars: { ...env.vars } }, lineStarts, lines, branches);
+    }
+    return;
+  }
+  if (name === "TryStatement") {
+    markNodeLines(stmt, lines, lineStarts);
+    for (const body of stmt.getChildren("Body")) {
+      processStmts(bodyStmts(body), { argv: env.argv, vars: { ...env.vars } }, lineStarts, lines, branches);
+    }
+    return;
+  }
+  if (name === "WithStatement") {
+    markNodeLines(stmt, lines, lineStarts);
+    const body = stmt.getChild("Body");
+    if (body) processStmts(bodyStmts(body), { argv: env.argv, vars: { ...env.vars } }, lineStarts, lines, branches);
+    return;
+  }
+  if (name === "MatchStatement") {
+    markNodeLines(stmt, lines, lineStarts);
+    for (const clause of stmt.getChildren("MatchClause")) {
+      const body = clause.getChild("Body");
+      if (body) processStmts(bodyStmts(body), { argv: env.argv, vars: { ...env.vars } }, lineStarts, lines, branches);
+    }
+    return;
+  }
+  if (name === "FunctionDefinition" || name === "ClassDefinition") {
+    markDefTree(stmt, lines, lineStarts);
+    return;
+  }
+  if (name === "ExpressionStatement") {
+    invalidateEnvOnCalls(stmt, env);
+  }
+  markNodeLines(stmt, lines, lineStarts);
+}
+function markDefTree(stmt, lines, lineStarts) {
+  const cursor = stmt.cursor();
+  cursor.iterate((n) => {
+    markNodeLines(n.node, lines, lineStarts);
+    return true;
+  });
+}
+function bodyStmts(body) {
+  const out = [];
+  let c = body.firstChild;
+  while (c) {
+    if (c.name !== ":" && c.name !== ";") out.push(c);
+    c = c.nextSibling;
+  }
+  return out;
+}
+function processIf(stmt, env, lineStarts, lines, branches) {
+  const sections = [];
+  let c = stmt.firstChild;
+  while (c) {
+    if (c.name === "if" || c.name === "elif") {
+      sections.push({ cond: c.nextSibling ?? null, body: null, isElse: false });
+    } else if (c.name === "else") {
+      sections.push({ cond: null, body: null, isElse: true });
+    } else if (c.name === "Body") {
+      if (sections.length > 0 && sections[sections.length - 1].body === null) {
+        sections[sections.length - 1].body = c;
+      }
+    }
+    c = c.nextSibling;
+  }
+  processIfSections(stmt, sections, 0, env, lineStarts, lines, branches);
+}
+function processIfSections(_stmt, sections, idx, env, lineStarts, lines, branches) {
+  if (idx >= sections.length) return;
+  const s = sections[idx];
+  if (s.cond) markNodeLines(s.cond, lines, lineStarts);
+  if (s.isElse) {
+    if (s.body) processStmts(bodyStmts(s.body), env, lineStarts, lines, branches);
+    return;
+  }
+  const cond = s.cond ? evalCondition(s.cond, env) : null;
+  branches.push({
+    kind: "if",
+    label: s.cond ? srcSlice(s.cond) : "",
+    body: "",
+    reachable: cond !== false
+  });
+  if (cond === true) {
+    if (s.body) processStmts(bodyStmts(s.body), env, lineStarts, lines, branches);
+    return;
+  }
+  if (cond === false) {
+    processIfSections(_stmt, sections, idx + 1, env, lineStarts, lines, branches);
+    return;
+  }
+  if (s.body) processStmts(bodyStmts(s.body), env, lineStarts, lines, branches);
+  for (let j = idx + 1; j < sections.length; j++) {
+    const sj = sections[j];
+    if (sj.cond) markNodeLines(sj.cond, lines, lineStarts);
+    if (sj.body) processStmts(bodyStmts(sj.body), env, lineStarts, lines, branches);
+  }
+}
+function parseShellString(s) {
+  CHILD_CALL_RE.lastIndex = 0;
+  let m;
+  while ((m = CHILD_CALL_RE.exec(s)) !== null) {
+    const interp = m[1];
+    const path5 = m[2].trim();
+    let rest = m[3].trim();
+    if (path5.startsWith("-") || path5.startsWith("$") || path5.includes("/dev/")) continue;
+    rest = rest.split(/[;|&<>]/)[0].trim();
+    const args = [];
+    for (const tm of rest.matchAll(/(["'])(.*?)\1|(\S+)/g)) {
+      args.push(tm[1] ? tm[2] : tm[3]);
+    }
+    return { path: path5, args, interpreter: interp };
+  }
+  return null;
+}
+function extractCallsFromTree(tree, reachableLines) {
+  const calls = [];
+  const seen = /* @__PURE__ */ new Set();
+  const add = (c) => {
+    const key = `${c.path}\0${c.args.join("\0")}\0${c.interpreter}`;
+    if (!seen.has(key)) {
+      seen.add(key);
+      calls.push(c);
+    }
+  };
+  const lineReachable = (node) => {
+    if (reachableLines === null) return true;
+    return reachableLines.has(lineAt(buildLineStarts(SOURCE), node.from));
+  };
+  const cursor = tree.cursor();
+  cursor.iterate((n) => {
+    const node = n.node;
+    if (node.name !== "CallExpression") return true;
+    if (!lineReachable(node)) return true;
+    const func = node.firstChild;
+    if (!func || func.name !== "MemberExpression") return true;
+    const modName = func.firstChild;
+    if (!modName || modName.name !== "VariableName") return true;
+    const funcNameNode = func.getChild("PropertyName");
+    if (!funcNameNode) return true;
+    const mod = srcSlice(modName);
+    const funcName = srcSlice(funcNameNode);
+    const argList = node.getChild("ArgList");
+    const firstArg = argList ? firstNamedChild(argList) : null;
+    if (mod === "subprocess" && SUBPROCESS_FUNCS.has(funcName)) {
+      if (firstArg && (firstArg.name === "ArrayExpression" || firstArg.name === "TupleExpression")) {
+        const elts = [];
+        let allStr = true;
+        for (const elt of namedChildren(firstArg)) {
+          if (elt.name === "String") elts.push(stringValue(srcSlice(elt)));
+          else {
+            allStr = false;
+            break;
+          }
+        }
+        if (allStr && elts.length >= 2) {
+          const interp = elts[0];
+          const path5 = elts[1];
+          if (!path5.startsWith("-") && !path5.startsWith("$") && !path5.includes("/dev/")) {
+            add({ path: path5, args: elts.slice(2), interpreter: interp });
+            return true;
+          }
+        }
+      }
+      if (firstArg && firstArg.name === "String") {
+        const sc = parseShellString(stringValue(srcSlice(firstArg)));
+        if (sc) add(sc);
+      }
+    } else if (mod === "os" && OS_FUNCS.has(funcName)) {
+      if (firstArg && firstArg.name === "String") {
+        const sc = parseShellString(stringValue(srcSlice(firstArg)));
+        if (sc) add(sc);
+      }
+    }
+    return true;
+  });
+  const cursor2 = tree.cursor();
+  cursor2.iterate((n) => {
+    const node = n.node;
+    if (node.name !== "ImportStatement") return true;
+    const txt = srcSlice(node);
+    if (!/^from\s+\./m.test(txt)) return true;
+    const m = txt.match(/\bimport\s+(.+)$/m);
+    if (m) {
+      for (const part of m[1].split(",")) {
+        const name = part.trim().replace(/\s+as\s+\w+$/, "");
+        if (name && name !== "*") add({ path: name.replace(/\./g, "/") + ".py", args: [], interpreter: "python3" });
+      }
+    }
+    return true;
+  });
+  return calls;
+}
+function extractCallsRegex(content) {
+  const calls = [];
+  CHILD_CALL_RE.lastIndex = 0;
+  let m;
+  while ((m = CHILD_CALL_RE.exec(content)) !== null) {
+    const interp = m[1];
+    const path5 = m[2].trim();
+    let rest = m[3].trim();
+    if (path5.startsWith("-") || path5.startsWith("$") || path5.includes("/dev/")) continue;
+    rest = rest.split(/[;|&<>]/)[0].trim();
+    const args = [];
+    for (const tm of rest.matchAll(/(["'])(.*?)\1|(\S+)/g)) {
+      args.push(tm[1] ? tm[2] : tm[3]);
+    }
+    calls.push({ path: path5, args, interpreter: interp });
+  }
+  return calls;
+}
+var PythonBackend = class {
+  language = "python";
+  parse(content, entryArgs) {
+    const c = content || "";
+    SOURCE = c;
+    const sourceLines = c.split("\n");
+    const lineStarts = buildLineStarts(c);
+    const env = makeEnv(entryArgs || []);
+    const lines = /* @__PURE__ */ new Set();
+    const branches = [];
+    if (sourceLines.length > MAX_LINES) {
+      return {
+        reachableContent: c,
+        controlFlowResolved: false,
+        calls: extractCallsRegex(c),
+        branches: [],
+        unresolvedSnippets: [],
+        language: this.language
+      };
+    }
+    let tree;
+    try {
+      tree = parser.parse(c).topNode;
+    } catch {
+      return {
+        reachableContent: c,
+        controlFlowResolved: false,
+        calls: extractCallsRegex(c),
+        branches: [],
+        unresolvedSnippets: [],
+        language: this.language
+      };
+    }
+    const stmts = bodyStmts(tree);
+    processStmts(stmts, env, lineStarts, lines, branches);
+    const reachable = reconstruct(sourceLines, lines);
+    let calls = extractCallsFromTree(tree, lines);
+    if (calls.length === 0) calls = extractCallsRegex(c);
+    const srcNonblank = sourceLines.filter((l) => l.trim().length > 0);
+    const rcNonblank = reachable.split("\n").filter((l) => l.trim().length > 0);
+    const resolved = rcNonblank.length !== srcNonblank.length || rcNonblank.some((l, i) => l !== srcNonblank[i]);
+    return {
+      reachableContent: reachable,
+      controlFlowResolved: resolved,
+      calls,
+      branches,
+      unresolvedSnippets: [],
+      language: this.language
+    };
+  }
+};
+
+// src/engine/script-engine/backends/index.ts
+init_esm_shims();
+
+// src/engine/script-engine/backends/shell-backend.ts
+init_esm_shims();
+
+// src/engine/script-engine/symbolic.ts
+init_esm_shims();
+function reescape(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var RE_DOTALL = "s";
+var MAX_LINES2 = 500;
+var MAX_BRANCHES = 50;
+var MAX_VARS = 200;
+function svalConc(v) {
+  return { kind: "concrete", value: v, children: [], op: "" };
+}
+function svalSym(name) {
+  return { kind: "symbol", value: name, children: [], op: "" };
+}
+function svalExpr(children) {
+  return { kind: "expr", value: null, children, op: "+" };
+}
+function fold(val) {
+  if (val.kind !== "expr") return val;
+  const parts = [];
+  for (const c of val.children) {
+    const cc = fold(c);
+    if (cc.kind === "concrete") {
+      parts.push(cc.value || "");
+    } else {
+      return cc;
+    }
+  }
+  return svalConc(parts.join(""));
+}
+var ASGN_RE = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/;
+var CASE_START_RE = /^\s*case\s+/;
+var IF_START_RE = /^\s*if\s+/;
+var NOT_MODELED_RE = /\$\(|`[^`]*`/;
+var CASE_OPEN_RE = /\bcase\b/;
+var CASE_CLOSE_RE = /\besac\b/;
+var IF_OPEN_RE = /\bif\b/;
+var IF_CLOSE_RE = /\bfi\b/;
+function countMatches(re, s) {
+  const m = s.match(re);
+  return m ? m.length : 0;
+}
+function findBlockEnd(lines, startLine, openRe, closeRe) {
+  let depth = 0;
+  for (let idx = startLine; idx < lines.length; idx++) {
+    depth += countMatches(openRe, lines[idx]) - countMatches(closeRe, lines[idx]);
+    if (depth <= 0 && idx > startLine) return idx;
+  }
+  return -1;
+}
+function findCaseEnd(lines, start) {
+  return findBlockEnd(lines, start, CASE_OPEN_RE, CASE_CLOSE_RE);
+}
+function findIfEnd(lines, start) {
+  return findBlockEnd(lines, start, IF_OPEN_RE, IF_CLOSE_RE);
+}
+var LOOP_DO_RE = /\bdo\b/g;
+var LOOP_DONE_RE = /\bdone\b/g;
+function findLoopEnd(lines, start) {
+  let depth = 0;
+  for (let idx = start; idx < lines.length; idx++) {
+    depth += countMatches(LOOP_DO_RE, lines[idx]) - countMatches(LOOP_DONE_RE, lines[idx]);
+    if (depth <= 0 && idx > start) return idx;
+  }
+  return -1;
+}
+var FN_DEF_RE = /^\s*(?:function\s+)?[A-Za-z_][A-Za-z0-9_]*\s*\(\s*\)\s*\{/;
+var FN_DEF_KW_RE = /^\s*function\s+[A-Za-z_][A-Za-z0-9_]*\s*\{?/;
+function findFnEnd(lines, start) {
+  let depth = 0;
+  for (let idx = start; idx < lines.length; idx++) {
+    depth += (lines[idx].match(/\{/g) || []).length - (lines[idx].match(/\}/g) || []).length;
+    if (depth <= 0 && idx > start) return idx;
+  }
+  return -1;
+}
+function stripComments(content) {
+  return content.split("\n").filter((l) => !l.trimStart().startsWith("#")).join("\n");
+}
+function parseCaseStmt(block) {
+  const header = block.match(/\s*case\s+(\S[^;]*?)\s*\bin\b[\s\S]*/);
+  if (!header) return null;
+  const sel = header[1].trim();
+  const lines = block.split("\n");
+  let headerLine = 0;
+  for (let i = 0; i < lines.length; i++) {
+    if (/\bin\b/.test(lines[i]) && /\bcase\b/.test(lines[i])) {
+      headerLine = i;
+      break;
+    }
+  }
+  const bodyStartLine = headerLine + 1;
+  const endLine = findCaseEnd(lines, 0);
+  if (endLine === -1) return null;
+  const branches = splitCaseBranchesDepthAware(lines.slice(bodyStartLine, endLine));
+  if (!branches.length) return null;
+  return { kind: "case", line: block, modelable: true, selector: sel, branches };
+}
+function splitCaseBranchesDepthAware(bodyLines) {
+  let depth = 0;
+  let curPat = null;
+  let curBody = [];
+  const branches = [];
+  const flush = () => {
+    if (curPat !== null) {
+      branches.push({ pat: curPat, body: curBody.join("\n") });
+    }
+    curPat = null;
+    curBody = [];
+  };
+  for (const ln of bodyLines) {
+    const stripped = ln.trim();
+    if (depth === 0) {
+      const bm = stripped.match(/^([^()]+?)\s*\)\s*(.*)$/);
+      if (bm) {
+        if (curPat !== null) flush();
+        curPat = bm[1].trim().replace(/^["']|["']$/g, "");
+        curBody = bm[2].trim() ? [bm[2].trim()] : [];
+        continue;
+      }
+    }
+    if (/\bcase\b/.test(stripped)) depth += 1;
+    else if (/\besac\b/.test(stripped)) depth = Math.max(0, depth - 1);
+    else if (curPat !== null) {
+      curBody.push(ln);
+      if (depth === 0 && stripped.endsWith(";;")) flush();
+    }
+  }
+  if (curPat !== null && curBody.length) flush();
+  return branches;
+}
+function parseIfStmt(block) {
+  const m = block.match(/\s*if\s+([^\n;]+?)\s*;\s*then/);
+  if (!m) return null;
+  const cond = m[1].trim();
+  const lines = block.split("\n");
+  const fiLine = findIfEnd(lines, 0);
+  if (fiLine === -1) return null;
+  const body = lines.slice(1, fiLine).join("\n");
+  const elseM = /\belse\b/.exec(body);
+  let thenBody;
+  let elseBody;
+  if (elseM) {
+    thenBody = body.slice(0, elseM.index);
+    elseBody = body.slice(elseM.index + 4);
+  } else {
+    thenBody = body;
+    elseBody = null;
+  }
+  return { kind: "if", line: block, modelable: true, cond, thenBody, elseBody };
+}
+function tokenize(content) {
+  const lines = stripComments(content).split("\n");
+  const stmts = [];
+  let i = 0;
+  while (i < lines.length) {
+    const ln = lines[i];
+    const stripped = ln.trim();
+    if (!stripped) {
+      i++;
+      continue;
+    }
+    if (/\b(?:while|for|until)\b/.test(stripped) && !CASE_START_RE.test(stripped) && !IF_START_RE.test(stripped)) {
+      const endLine = findLoopEnd(lines, i);
+      if (endLine !== -1) {
+        for (let k = i; k <= endLine; k++) stmts.push({ kind: "plain", line: lines[k], modelable: false });
+        i = endLine + 1;
+        continue;
+      }
+      stmts.push({ kind: "plain", line: ln, modelable: false });
+      i++;
+      continue;
+    }
+    if (FN_DEF_RE.test(stripped) || FN_DEF_KW_RE.test(stripped)) {
+      const endLine = findFnEnd(lines, i);
+      if (endLine !== -1) {
+        for (let k = i; k <= endLine; k++) stmts.push({ kind: "plain", line: lines[k], modelable: false });
+        i = endLine + 1;
+        continue;
+      }
+      stmts.push({ kind: "plain", line: ln, modelable: false });
+      i++;
+      continue;
+    }
+    if (CASE_START_RE.test(stripped)) {
+      const endLine = findCaseEnd(lines, i);
+      if (endLine === -1) {
+        stmts.push({ kind: "plain", line: ln, modelable: false });
+        i++;
+        continue;
+      }
+      const parsed = parseCaseStmt(lines.slice(i, endLine + 1).join("\n"));
+      stmts.push(parsed || { kind: "plain", line: ln, modelable: false });
+      i = endLine + 1;
+      continue;
+    }
+    if (IF_START_RE.test(stripped)) {
+      const endLine = findIfEnd(lines, i);
+      if (endLine === -1) {
+        stmts.push({ kind: "plain", line: ln, modelable: false });
+        i++;
+        continue;
+      }
+      const parsed = parseIfStmt(lines.slice(i, endLine + 1).join("\n"));
+      stmts.push(parsed || { kind: "plain", line: ln, modelable: false });
+      i = endLine + 1;
+      continue;
+    }
+    if (/\bshift\b|\bset\s+--(?:\s|$)|[\s;|&]read\b|^\s*read\b/.test(stripped)) {
+      stmts.push({ kind: "plain", line: ln, modelable: false });
+      i++;
+      continue;
+    }
+    const am = stripped.match(ASGN_RE);
+    if (am && !NOT_MODELED_RE.test(stripped)) {
+      stmts.push({ kind: "assign", line: stripped, modelable: true, name: am[1], rhs: am[2].trim() });
+      i++;
+      continue;
+    }
+    stmts.push(NOT_MODELED_RE.test(stripped) ? { kind: "plain", line: ln, modelable: false } : { kind: "plain", line: ln, modelable: true });
+    i++;
+  }
+  return stmts;
+}
+var EXPR_SPLIT_RE = /(\$\{?\d+\}?|\$\{?[A-Za-z_][A-Za-z0-9_]*\}?)/;
+function evalExpr2(text, env) {
+  const isSingleQuoted = text.length >= 2 && text[0] === "'" && text[text.length - 1] === "'";
+  if (text.length >= 2 && (text[0] === '"' || text[0] === "'") && text[text.length - 1] === text[0]) {
+    text = text.slice(1, -1);
+  }
+  if (isSingleQuoted) return svalConc(text);
+  const parts = text.split(EXPR_SPLIT_RE);
+  const result = [];
+  for (const p of parts) {
+    if (!p) continue;
+    const brace = p.match(/^\$\{([^}]+)\}$/);
+    if (brace) {
+      const inner = brace[1];
+      if (/^\d+$/.test(inner)) {
+        const v = env.get(`$${inner}`);
+        result.push(v || svalSym(`$${inner}`));
+      } else {
+        const v = env.get(inner);
+        result.push(v || svalSym(inner));
+      }
+      continue;
+    }
+    const bare = p.match(/^\$([A-Za-z_][A-Za-z0-9_]*|\d+)$/);
+    if (bare) {
+      const varName = bare[1];
+      const key = /^\d+$/.test(varName) ? `$${varName}` : varName;
+      const v = env.get(key);
+      result.push(v || svalSym(p));
+      continue;
+    }
+    result.push(svalConc(p));
+  }
+  if (result.length === 1) return fold(result[0]);
+  return fold(svalExpr(result));
+}
+function initEnv(entryArgs) {
+  const env = /* @__PURE__ */ new Map();
+  if (entryArgs && entryArgs.length) {
+    entryArgs.forEach((a, idx) => env.set(`$${idx + 1}`, svalConc(a)));
+    env.set("$@", svalConc(entryArgs.join(" ")));
+    env.set("$*", svalConc(entryArgs.join(" ")));
+  }
+  return env;
+}
+var HAS_GLOB = /[*?[]/;
+function globToRegex(pattern) {
+  let out = "^";
+  let i = 0;
+  while (i < pattern.length) {
+    const c = pattern[i];
+    if (c === "*") out += ".*";
+    else if (c === "?") out += ".";
+    else if (c === "[") {
+      let j = i + 1;
+      let neg = false;
+      if (j < pattern.length && (pattern[j] === "!" || pattern[j] === "^")) {
+        neg = true;
+        j++;
+      }
+      let cls = "";
+      while (j < pattern.length && pattern[j] !== "]") {
+        cls += pattern[j];
+        j++;
+      }
+      if (j >= pattern.length) {
+        out += reescape(pattern.slice(i));
+        break;
+      }
+      out += "[" + (neg ? "^" : "") + reescape(cls) + "]";
+      i = j;
+    } else {
+      out += reescape(c);
+    }
+    i++;
+  }
+  out += "$";
+  return new RegExp(out, RE_DOTALL);
+}
+function matchGlob(pattern, value) {
+  if (!HAS_GLOB.test(pattern)) return pattern === value;
+  return globToRegex(pattern).test(value);
+}
+function evalNumericCompare(op, left, right) {
+  const li = parseInt(left, 10);
+  const ri = parseInt(right, 10);
+  if (isNaN(li) || isNaN(ri)) return null;
+  switch (op) {
+    case "-gt":
+      return li > ri;
+    case "-lt":
+      return li < ri;
+    case "-eq":
+      return li === ri;
+    case "-ge":
+      return li >= ri;
+    case "-le":
+      return li <= ri;
+    default:
+      return null;
+  }
+}
+function resolveVarSide(tok, env) {
+  if (!tok.startsWith("$")) return tok;
+  const ev = evalExpr2(tok, env);
+  return ev.kind === "concrete" ? ev.value : null;
+}
+function evalCondition2(cond, env) {
+  let inner = cond.trim().replace(/^\[\[?|\]\]?$/g, "").trim();
+  if (/^-[A-Za-z]\s/.test(inner) || inner.startsWith("-d") || inner.startsWith("-f")) return null;
+  const innerQ = inner.replace(/"/g, "").replace(/'/g, "");
+  for (const op2 of ["-gt", "-lt", "-eq", "-ge", "-le"]) {
+    const re = new RegExp(`\\s${op2}\\s`);
+    const opm = re.exec(innerQ);
+    if (!opm) continue;
+    const left2 = innerQ.slice(0, opm.index).trim();
+    const right2 = innerQ.slice(opm.index + opm[0].length).trim();
+    const lv2 = resolveVarSide(left2, env);
+    const rv2 = resolveVarSide(right2, env);
+    if (lv2 === null || rv2 === null) return null;
+    return evalNumericCompare(op2, lv2, rv2);
+  }
+  const sm = innerQ.match(/(.*?)\s*(==|=|!=|=~)\s*(.*)/);
+  if (!sm) return null;
+  const op = sm[2];
+  let left = sm[1].trim();
+  let right = sm[3].trim();
+  if (op === "=~") {
+    if (right.startsWith("/") && right.endsWith("/")) right = right.slice(1, -1);
+    const lv2 = resolveVarSide(left, env);
+    if (lv2 === null) return null;
+    try {
+      return new RegExp(right).test(lv2);
+    } catch {
+      return null;
+    }
+  }
+  const lv = resolveVarSide(left, env);
+  const rv = resolveVarSide(right, env);
+  if (lv === null || rv === null) return null;
+  if (op === "!=") return lv !== rv;
+  return lv === rv;
+}
+function symbolicProcess(content, entryArgs) {
+  if (!content) return null;
+  const stmts = tokenize(content);
+  if (!stmts.some((s) => s.kind === "case" || s.kind === "if" || s.kind === "assign")) return null;
+  if (stmts.some((s) => !s.modelable)) return null;
+  const env = initEnv(entryArgs);
+  let linesBudget = 0;
+  let branchesBudget = 0;
+  let modelable = false;
+  const out = [];
+  for (const s of stmts) {
+    linesBudget++;
+    if (linesBudget > MAX_LINES2) return null;
+    if (s.kind === "assign") {
+      modelable = true;
+      if (env.size >= MAX_VARS) return null;
+      const v = evalExpr2(s.rhs, env);
+      env.set(s.name, fold(v));
+      out.push(s.line);
+      continue;
+    }
+    if (s.kind === "case") {
+      modelable = true;
+      branchesBudget += s.branches.length;
+      if (branchesBudget > MAX_BRANCHES) return null;
+      const selVal = fold(evalExpr2(s.selector, env));
+      if (selVal.kind !== "concrete") return null;
+      const concrete = selVal.value || "";
+      let selected = null;
+      let fallback = "";
+      for (const b of s.branches) {
+        const patStripped = b.pat.trim();
+        if (patStripped === "*") {
+          fallback = b.body;
+          continue;
+        }
+        if (matchGlob(patStripped, concrete)) {
+          selected = b.body;
+          break;
+        }
+      }
+      const final = selected !== null ? selected : fallback || null;
+      if (final === null) return null;
+      out.push(`case ${s.selector} in
+${final}
+esac`);
+      continue;
+    }
+    if (s.kind === "if") {
+      modelable = true;
+      branchesBudget++;
+      if (branchesBudget > MAX_BRANCHES) return null;
+      const truth = evalCondition2(s.cond, env);
+      if (truth === null) return null;
+      const chosen = truth ? s.thenBody : s.elseBody;
+      if (chosen === null) return null;
+      out.push(`if ${s.cond}; then
+${chosen}
+fi`);
+      continue;
+    }
+    out.push(s.line);
+  }
+  if (!modelable) return null;
+  return out.join("\n");
+}
+
+// src/engine/script-engine/backends/shell-backend.ts
+function bindPositionalArgs(content, args) {
+  if (!args.length) return content;
+  const allArgs = args.join(" ");
+  content = content.replace(/\$\{(\d+|@|\*)(?::?[-]?([^}]*))?\}/g, (full, kind, defv) => {
+    if (kind === "@" || kind === "*") return allArgs;
+    if (!/^\d+$/.test(kind)) return full;
+    const idx = parseInt(kind, 10);
+    if (1 <= idx && idx <= args.length) return args[idx - 1];
+    return defv !== void 0 ? defv : "";
+  });
+  content = content.replace(/\$\{(\d+)\}/g, (full, kind) => {
+    const idx = parseInt(kind, 10);
+    if (1 <= idx && idx <= args.length) return args[idx - 1];
+    return "";
+  });
+  content = content.replace(/\$(\d+)/g, (full, kind) => {
+    const idx = parseInt(kind, 10);
+    if (1 <= idx && idx <= args.length) return args[idx - 1];
+    return "";
+  });
+  content = content.replace(/\$[@*]/g, allArgs);
+  return content;
+}
+function findSelectorValue(selector, args) {
+  if (!args || !args.length) return null;
+  const m = selector.match(/^\$\{?(\d+)\}?$/);
+  if (m) {
+    const idx = parseInt(m[1], 10);
+    if (1 <= idx && idx <= args.length) return args[idx - 1];
+    return null;
+  }
+  return null;
+}
+function splitCaseBody(body) {
+  const lines = body.split("\n");
+  const branches = [];
+  let cur = null;
+  for (const ln of lines) {
+    const stripped = ln.trim();
+    if (/^[\w:-]+\s*\(\)\s*\{/.test(stripped)) continue;
+    const m = stripped.match(/^([^()]+?)\s*\)\s*(.*)$/);
+    if (m) {
+      const pat = m[1].trim().replace(/^["']|["']$/g, "");
+      const inline = m[2].trim();
+      if (pat) {
+        if (cur) branches.push(cur);
+        cur = { label: pat, body: inline };
+      }
+      continue;
+    }
+    if (cur) {
+      cur.body += cur.body ? "\n" + ln : ln;
+      if (stripped.endsWith(";;")) {
+        branches.push(cur);
+        cur = null;
+      }
+    }
+  }
+  if (cur && cur.body.trim()) {
+    if (!branches.includes(cur)) branches.push(cur);
+  }
+  return branches;
+}
+function parseCase(content, args) {
+  const m = content.match(/\bcase\s+(\$\{?\d+\}?|[A-Za-z_]\w*|\$[A-Za-z_]\w*)\s+in/i);
+  if (!m) return null;
+  const selector = m[1].trim();
+  const val = findSelectorValue(selector, args);
+  if (val === null) return null;
+  const lines = content.split("\n");
+  const endMatch = findCaseEndInLines(lines, 0);
+  if (endMatch === -1) return null;
+  const bodyLines = lines.slice(1, endMatch);
+  const body = bodyLines.join("\n");
+  const hasNested = /\bcase\s+/.test(body) || /\bif\s+/.test(body);
+  let final;
+  if (hasNested) {
+    final = splitNestedCaseBranches(bodyLines, val);
+    if (final === null) return null;
+  } else {
+    const branches = splitCaseBody(body);
+    let selected = null;
+    let fallback = "";
+    for (const b of branches) {
+      const values = b.label.split("|").map((v) => v.trim()).filter(Boolean);
+      if (values.includes("*")) fallback = b.body;
+      else if (values.includes(val)) selected = b.body;
+    }
+    final = selected !== null ? selected : fallback || null;
+    if (final === null) return null;
+  }
+  const prefix = content.slice(0, m.index ?? 0);
+  const suffix = lines.slice(endMatch + 1).join("\n");
+  return `${prefix}
+${final}
+${suffix}`;
+}
+function findCaseEndInLines(lines, headerLine) {
+  let depth = 0;
+  for (let idx = headerLine; idx < lines.length; idx++) {
+    const ln = lines[idx];
+    const opens = (ln.match(/\bcase\b/g) || []).length;
+    const closes = (ln.match(/\besac\b/g) || []).length;
+    depth += opens - closes;
+    if (depth <= 0 && idx > headerLine) return idx;
+  }
+  return -1;
+}
+function splitNestedCaseBranches(bodyLines, selectorVal) {
+  let depth = 0;
+  let curPat = null;
+  let curBody = [];
+  let selected = null;
+  let fallback = null;
+  const flush = () => {
+    if (curPat === null) return;
+    const values = curPat.split("|").map((v) => v.trim()).filter(Boolean);
+    const body = curBody.join("\n");
+    if (values.includes("*")) {
+      if (fallback === null) fallback = body;
+    } else if (values.includes(selectorVal)) {
+      selected = body;
+    }
+    curPat = null;
+    curBody = [];
+  };
+  for (const ln of bodyLines) {
+    const stripped = ln.trim();
+    if (depth === 0) {
+      const bm = stripped.match(/^([^()]+?)\s*\)\s*(.*)$/);
+      if (bm) {
+        if (curPat !== null) flush();
+        curPat = bm[1].trim().replace(/^["']|["']$/g, "");
+        curBody = bm[2].trim() ? [bm[2].trim()] : [];
+        continue;
+      }
+    }
+    if (/\bcase\b/.test(stripped)) depth += 1;
+    else if (/\besac\b/.test(stripped)) depth = Math.max(0, depth - 1);
+    else if (curPat !== null) {
+      curBody.push(ln);
+      if (depth === 0 && stripped.endsWith(";;")) flush();
+    }
+  }
+  if (curPat !== null && curBody.length) flush();
+  return selected !== null ? selected : fallback;
+}
+function evalIfCondition(cond, args) {
+  if (!args || !args.length) return null;
+  let inner = cond.replace(/^\[\[?|\]\]?$/g, "").replace(/"/g, "").replace(/'/g, "").trim();
+  const m = inner.match(/(.*?)\s*(==|=)\s*(.*)/);
+  if (!m) return null;
+  let left = m[1].trim();
+  let right = m[3].trim();
+  const lm = left.match(/^\$(\d+)$/);
+  if (lm) {
+    const idx = parseInt(lm[1], 10);
+    if (1 <= idx && idx <= args.length) left = args[idx - 1];
+    else return null;
+  } else if (left.startsWith("$")) return null;
+  const rm = right.match(/^\$(\d+)$/);
+  if (rm) {
+    const idx = parseInt(rm[1], 10);
+    if (1 <= idx && idx <= args.length) right = args[idx - 1];
+    else return null;
+  } else if (right.startsWith("$")) return null;
+  return left === right;
+}
+function parseIf(content, args) {
+  const m = content.match(/\bif\s+([^\n;]+?)\s*;\s*then/i);
+  if (!m) return null;
+  const truth = evalIfCondition(m[1].trim(), args);
+  if (truth === null) return null;
+  const start = m.index ?? 0;
+  const thenBodyStart = start + m[0].length;
+  const fiPos = content.indexOf("fi", thenBodyStart);
+  if (fiPos === -1) return null;
+  const segment = content.slice(thenBodyStart, fiPos);
+  const elseM = segment.match(/\belse\b/);
+  let chosen;
+  if (truth) chosen = elseM ? segment.slice(0, elseM.index) : segment;
+  else {
+    if (!elseM) return null;
+    chosen = segment.slice((elseM.index ?? 0) + 4);
+  }
+  return `${content.slice(0, start)}
+${chosen}
+${content.slice(fiPos + 2)}`;
+}
+function markLoopsReachable(content) {
+  return content;
+}
+var CHILD_CALL_RE2 = /(?:^|\s|&&|\|\|)\s*((?:\/bin\/)?bash|sh|zsh|(?:python|python3|node|ruby|perl|php|lua))\s+(\S+(?:\.(?:sh|shrc|py|js|rb|pl|php|lua))?)([^\n;|&]*?)$/gmi;
+function extractCallsFromContent(content) {
+  const calls = [];
+  let m;
+  CHILD_CALL_RE2.lastIndex = 0;
+  while ((m = CHILD_CALL_RE2.exec(content)) !== null) {
+    const interp = m[1];
+    const path5 = m[2].trim();
+    let rest = m[3].trim();
+    if (path5.startsWith("-") || path5.startsWith("$") || path5.includes("/dev/")) continue;
+    rest = rest.split(/[;|&<>]/)[0].trim();
+    const args = [];
+    for (const tm of rest.matchAll(/(["'])(.*?)\1|(\S+)/g)) {
+      args.push(tm[1] ? tm[2] : tm[3]);
+    }
+    calls.push({ path: path5, args, interpreter: interp });
+  }
+  return calls;
+}
+var ShellBackend = class {
+  language = "shell";
+  parse(content, entryArgs) {
+    const c = content || "";
+    const orig = c;
+    let candidate = c;
+    let resolved = false;
+    const p1Safe = !/(?:\bshift\b|\bset\s+--(?:\s|$)|[\s;|&]read\b|^\s*read\b|\(\)\s*\{|function\s+\w+)/.test(c);
+    if (p1Safe) {
+      const caseOut = parseCase(candidate, entryArgs);
+      if (caseOut !== null && caseOut !== candidate) {
+        resolved = true;
+        candidate = caseOut;
+      }
+      const ifOut = parseIf(candidate, entryArgs);
+      if (ifOut !== null && ifOut !== candidate) {
+        resolved = true;
+        candidate = ifOut;
+      }
+    }
+    let bound = p1Safe ? bindPositionalArgs(candidate, entryArgs || []) : candidate;
+    if (!resolved) {
+      const symOut = symbolicProcess(c, entryArgs);
+      if (symOut !== null && symOut !== c) {
+        resolved = true;
+        bound = symOut;
+      }
+    }
+    const loopMarked = markLoopsReachable(bound);
+    const calls = extractCallsFromContent(loopMarked);
+    return {
+      reachableContent: loopMarked,
+      controlFlowResolved: resolved,
+      calls,
+      branches: [],
+      unresolvedSnippets: [],
+      language: this.language
+    };
+  }
+};
+
+// src/engine/script-engine/tracker.ts
+var DEFAULT_MAX_DEPTH = 14;
+var DEFAULT_MAX_NODES = 64;
+var DEFAULT_MAX_FILE_SIZE = 2 * 1024 * 1024;
+var DEFAULT_MAX_TOTAL_SIZE = 8 * 1024 * 1024;
+var BACKENDS = {
+  ".py": new PythonBackend()
+};
+var DEFAULT_BACKEND = new ShellBackend();
+function pickBackend(pathStr) {
+  const lower = pathStr.toLowerCase();
+  for (const ext of Object.keys(BACKENDS)) {
+    if (lower.endsWith(ext)) return BACKENDS[ext];
+  }
+  return DEFAULT_BACKEND;
+}
+function resolvePath(p, baseDir) {
+  let expanded = p;
+  if (expanded.startsWith("~/") || expanded === "~") {
+    expanded = path3.join(os.homedir(), expanded.slice(1));
+  } else if (!path3.isAbsolute(expanded) && baseDir) {
+    expanded = path3.join(baseDir, expanded);
+  }
+  return path3.resolve(expanded);
+}
+function readScript(pathStr, maxFileSize) {
+  try {
+    const p = resolvePath(pathStr);
+    if (!fs3.existsSync(p)) return { content: "", lineCount: 0, fileSize: 0, error: `\u811A\u672C\u4E0D\u5B58\u5728: ${pathStr}` };
+    const stat = fs3.statSync(p);
+    if (!stat.isFile()) return { content: "", lineCount: 0, fileSize: 0, error: `\u4E0D\u662F\u6587\u4EF6: ${pathStr}` };
+    if (stat.size > maxFileSize) {
+      return { content: "", lineCount: 0, fileSize: stat.size, error: `\u811A\u672C\u6587\u4EF6\u8FC7\u5927 (${stat.size} bytes)\uFF0C\u8DF3\u8FC7\u8BFB\u53D6` };
+    }
+    const content = fs3.readFileSync(p, "utf-8");
+    return { content, lineCount: content ? content.split("\n").length : 0, fileSize: stat.size, error: "" };
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    return { content: "", lineCount: 0, fileSize: 0, error: `\u8BFB\u53D6\u811A\u672C\u5931\u8D25: ${msg}` };
+  }
+}
+function emptyNode(pathStr, depth) {
+  return {
+    scriptPath: pathStr,
+    rawContent: "",
+    preprocessedContent: "",
+    lineCount: 0,
+    fileSize: 0,
+    depth,
+    childPaths: [],
+    error: "",
+    l1Hit: false,
+    l1RiskLevel: "",
+    l1RiskType: "",
+    l1Reason: "",
+    l1MatchedPatterns: [],
+    l2Hit: false,
+    l2ViolatedRule: "",
+    l2RiskLevel: "",
+    l2RiskType: "",
+    l2Reason: "",
+    matchedKeywords: [],
+    isSuspicious: false,
+    keywordRiskLevel: "",
+    keywordRiskReason: ""
+  };
+}
+var RecursiveTracker = class {
+  constructor(commandScanner, maxDepth = DEFAULT_MAX_DEPTH, maxNodes = DEFAULT_MAX_NODES, maxFileSize = DEFAULT_MAX_FILE_SIZE, maxTotalSize = DEFAULT_MAX_TOTAL_SIZE) {
+    this.maxDepth = maxDepth;
+    this.maxNodes = maxNodes;
+    this.maxFileSize = maxFileSize;
+    this.maxTotalSize = maxTotalSize;
+    this._scanner = commandScanner;
+    this.result = {
+      nodes: [],
+      entryPath: "",
+      maxDepthReached: false,
+      maxSizeReached: false,
+      maxNodesReached: false,
+      totalSize: 0,
+      totalLines: 0,
+      totalNodes: 0,
+      hasCritical: false,
+      hasHigh: false,
+      firstHitNode: null,
+      error: ""
+    };
+  }
+  maxDepth;
+  maxNodes;
+  maxFileSize;
+  maxTotalSize;
+  result;
+  visiting = /* @__PURE__ */ new Set();
+  visitedPaths = /* @__PURE__ */ new Set();
+  _scanner;
+  track(entryPath, entryArgs, cwd = "") {
+    const baseDir = cwd || process.cwd();
+    const resolved = resolvePath(entryPath);
+    this.result.entryPath = resolved;
+    this.visitScript(resolved, 0, path3.dirname(resolved), entryArgs);
+    const nodes = this.result.nodes;
+    this.result.hasCritical = nodes.some((n) => n.l1RiskLevel === "critical" || n.l2RiskLevel === "critical" || n.keywordRiskLevel === "critical") || this.result.hasCritical;
+    this.result.hasHigh = nodes.some((n) => ["high", "critical"].includes(n.l1RiskLevel) || ["high", "critical"].includes(n.l2RiskLevel) || ["high", "critical"].includes(n.keywordRiskLevel));
+    this.result.firstHitNode = nodes.find((n) => n.l1Hit || n.l2Hit || n.isSuspicious) || null;
+    return this.result;
+  }
+  visitScript(pathStr, depth, baseDir, args) {
+    pathStr = resolvePath(pathStr);
+    if (this.visiting.has(pathStr)) return;
+    if (this.visitedPaths.has(pathStr)) return;
+    if (depth > this.maxDepth) {
+      this.result.maxDepthReached = true;
+      return;
+    }
+    if (this.result.nodes.length >= this.maxNodes) {
+      this.result.maxNodesReached = true;
+      return;
+    }
+    if (this.result.totalSize >= this.maxTotalSize) {
+      this.result.maxSizeReached = true;
+      return;
+    }
+    this.visiting.add(pathStr);
+    this.visitedPaths.add(pathStr);
+    const { content, lineCount, fileSize, error } = readScript(pathStr, this.maxFileSize);
+    if (error) {
+      const node2 = emptyNode(pathStr, depth);
+      node2.error = error;
+      node2.fileSize = fileSize;
+      node2.lineCount = lineCount;
+      this.result.nodes.push(node2);
+      this.visiting.delete(pathStr);
+      return;
+    }
+    this.result.totalSize += fileSize;
+    this.result.totalLines += lineCount;
+    const ir = pickBackend(pathStr).parse(content, args);
+    const node = emptyNode(pathStr, depth);
+    node.rawContent = content;
+    node.preprocessedContent = ir.reachableContent;
+    node.lineCount = lineCount;
+    node.fileSize = fileSize;
+    this.result.nodes.push(node);
+    this.result.totalNodes = this.result.nodes.length;
+    if (this._scanner && ir.reachableContent) {
+      const l1 = this._scanner(ir.reachableContent);
+      if (l1.hit) {
+        node.l1Hit = true;
+        node.l1RiskLevel = l1.riskLevel;
+        node.l1RiskType = l1.riskType;
+        node.l1Reason = l1.reason;
+        node.l1MatchedPatterns = l1.matchedPatterns || [];
+        if (l1.riskLevel === "critical") {
+          this.result.hasCritical = true;
+          this.result.firstHitNode = node;
+          this.visiting.delete(pathStr);
+          return;
+        }
+      }
+    }
+    const parentDir = path3.dirname(pathStr);
+    const childPaths = [];
+    for (const call of ir.calls) {
+      const child = resolvePath(call.path, parentDir);
+      childPaths.push(child);
+      this.visitScript(child, depth + 1, path3.dirname(child), call.args);
+      if (this.result.hasCritical) break;
+    }
+    node.childPaths = childPaths;
+    this.visiting.delete(pathStr);
+  }
+};
+
+// src/engine/script-content-analyzer.ts
+function emptyChain() {
+  return {
+    nodes: [],
+    entryPath: "",
+    maxDepthReached: false,
+    maxSizeReached: false,
+    maxNodesReached: false,
+    totalSize: 0,
+    totalLines: 0,
+    totalNodes: 0,
+    hasCritical: false,
+    hasHigh: false,
+    firstHitNode: null,
+    error: ""
+  };
+}
+var SUSPICIOUS_PATTERNS2 = [
+  { name: "curl POST", pattern: /curl\s+(.*\s)?-X\s+POST/i },
+  { name: "curl --data", pattern: /curl\s+(.*\s)?--data/i },
+  { name: "curl -d", pattern: /curl\s+(.*\s)?-d\s/i },
+  { name: "wget --post-data", pattern: /wget\s+(.*\s)?--post-data/i },
+  { name: "wget --post-file", pattern: /wget\s+(.*\s)?--post-file/i },
+  { name: "nc -e", pattern: /\bnc\s+.*-e\b/ },
+  { name: "ncat -e", pattern: /\bncat\s+.*-e\b/ },
+  { name: "/dev/tcp", pattern: /\/dev\/tcp\// },
+  { name: "/dev/udp", pattern: /\/dev\/udp\// },
+  { name: "$(base64", pattern: /\$\(\s*base64/ },
+  { name: "`base64", pattern: /`\s*base64/ },
+  { name: "base64 decode pipe", pattern: /base64\s+(-d|--decode)\s*\|/ },
+  { name: "/etc/shadow", pattern: /\/etc\/shadow/ },
+  { name: "id_rsa", pattern: /\bid_rsa\b/ },
+  { name: "id_ed25519", pattern: /\bid_ed25519\b/ },
+  { name: "crontab install", pattern: /crontab\s+-/ },
+  { name: "authorized_keys", pattern: /authorized_keys/ },
+  { name: "ssh no host key check", pattern: /ssh\s+.*StrictHostKeyChecking\s*=\s*no/ }
+];
+var SCRIPT_EXEC_PATTERNS2 = [
+  /(?:^|\s|&&|\|\|)\s*bash\s+(\S+)/i,
+  /(?:^|\s|&&|\|\|)\s*\/bin\/bash\s+(\S+)/i,
+  /(?:^|\s|&&|\|\|)\s*sh\s+(\S+)/i,
+  /(?:^|\s|&&|\|\|)\s*zsh\s+(\S+)/i,
+  /\.\/(\S+)/,
+  /(?:^|\s|&&|\|\|)\s*source\s+(\S+)/i,
+  /(?:^|\s|&&|\|\|)\s*\.\s+(\S+)/,
+  /(?:^|\s|&&|\|\|)\s*python3?\s+(\S+\.py)/i,
+  /(?:^|\s|&&|\|\|)\s*node\s+(\S+\.js)/i,
+  /(?:^|\s|&&|\|\|)\s*ruby\s+(\S+\.rb)/i,
+  /(?:^|\s|&&|\|\|)\s*perl\s+(\S+\.pl)/i,
+  /(?:^|\s|&&|\|\|)\s*php\s+(\S+\.php)/i,
+  /(?:^|\s|&&|\|\|)\s*lua\s+(\S+\.lua)/i
 ];
 var KEYWORD_COMBINATION_RISKS2 = [
   {
@@ -3402,6 +5087,20 @@ function extractScriptPath2(command) {
   }
   return null;
 }
+function extractScriptPathWithArgs(command) {
+  const scriptPath = extractScriptPath2(command);
+  if (!scriptPath) return { path: null, args: [] };
+  const idx = command.indexOf(scriptPath);
+  if (idx < 0) return { path: scriptPath, args: [] };
+  let rest = command.slice(idx + scriptPath.length);
+  rest = rest.split(/[;|&<>]/)[0].trim();
+  const tokens = [...rest.matchAll(/(["'])(.*?)\1|(\S+)/g)];
+  const args = [];
+  for (const m of tokens) {
+    args.push(m[1] ? m[2] : m[3]);
+  }
+  return { path: scriptPath, args };
+}
 function extractInlineScriptPath(actionDetail) {
   const re = /open\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
   let m;
@@ -3409,9 +5108,9 @@ function extractInlineScriptPath(actionDetail) {
     const p = m[1];
     let resolved;
     try {
-      resolved = resolvePath(p);
-      if (existsSync7(resolved)) {
-        const stat = statSync(resolved);
+      resolved = resolvePath2(p);
+      if (existsSync9(resolved)) {
+        const stat = statSync2(resolved);
         if (stat.isFile()) return resolved;
       }
     } catch {
@@ -3419,136 +5118,12 @@ function extractInlineScriptPath(actionDetail) {
   }
   return null;
 }
-function resolvePath(p) {
+function resolvePath2(p) {
   let expanded = p;
   if (expanded.startsWith("~/") || expanded === "~") {
-    expanded = join4(homedir2(), expanded.slice(1));
-  }
-  return resolve6(expanded);
-}
-function readScriptContent2(scriptPath, maxFileSize = 2 * 1024 * 1024) {
-  try {
-    const path3 = resolvePath(scriptPath);
-    if (!existsSync7(path3)) return { content: "", lineCount: 0, fileSize: 0, error: `\u811A\u672C\u4E0D\u5B58\u5728: ${scriptPath}` };
-    const stat = statSync(path3);
-    if (!stat.isFile()) return { content: "", lineCount: 0, fileSize: 0, error: `\u4E0D\u662F\u6587\u4EF6: ${scriptPath}` };
-    if (stat.size > maxFileSize) {
-      return { content: "", lineCount: 0, fileSize: stat.size, error: `\u811A\u672C\u6587\u4EF6\u8FC7\u5927 (${stat.size} bytes)\uFF0C\u8DF3\u8FC7\u8BFB\u53D6` };
-    }
-    const content = readFileSync8(path3, "utf-8");
-    const lineCount = content ? content.split("\n").length : 0;
-    return { content, lineCount, fileSize: stat.size, error: "" };
-  } catch (e) {
-    const msg = e instanceof Error ? e.message : String(e);
-    return { content: "", lineCount: 0, fileSize: 0, error: `\u8BFB\u53D6\u811A\u672C\u5931\u8D25: ${msg}` };
-  }
-}
-function extractChildScriptPaths(content, baseDir) {
-  const paths = [];
-  for (const pattern of CHILD_SCRIPT_PATTERNS) {
-    pattern.lastIndex = 0;
-    let m;
-    while ((m = pattern.exec(content)) !== null) {
-      const pathStr = m[1];
-      if (pathStr.startsWith("-") || pathStr.startsWith("$")) continue;
-      if (pathStr.includes("/dev/") || pathStr.startsWith("|") || pathStr.startsWith(";")) continue;
-      const full = isAbsolute(pathStr) ? pathStr : join4(baseDir, pathStr);
-      const resolved = resolvePath(full);
-      if (existsSync7(resolved)) {
-        try {
-          if (statSync(resolved).isFile() && !paths.includes(resolved)) paths.push(resolved);
-        } catch {
-        }
-      }
-    }
-  }
-  return paths;
-}
-function resolveScriptChain(entryPath, input, maxDepth = 3, maxFileSize = 2 * 1024 * 1024, maxTotalSize = 6 * 1024 * 1024) {
-  const visited = /* @__PURE__ */ new Set();
-  const result = emptyChain();
-  result.entryPath = entryPath;
-  const entry = resolvePath(entryPath);
-  const baseDir = existsSync7(entry) ? dirname6(entry) : input.cwd || process.cwd();
-  resolveRecursive({
-    path: entry,
-    depth: 0,
-    maxDepth,
-    maxFileSize,
-    maxTotalSize,
-    visited,
-    result,
-    baseDir,
-    input
-  });
-  result.hasCritical = result.nodes.some((n) => n.l1RiskLevel === "critical" || n.l2RiskLevel === "critical" || n.keywordRiskLevel === "critical");
-  result.hasHigh = result.nodes.some((n) => ["high", "critical"].includes(n.l1RiskLevel) || ["high", "critical"].includes(n.l2RiskLevel) || ["high", "critical"].includes(n.keywordRiskLevel));
-  result.firstHitNode = result.nodes.find((n) => n.l1Hit || n.l2Hit || n.isSuspicious) || null;
-  return result;
-}
-function resolveRecursive(ctx) {
-  const { path: path3, depth, maxDepth, maxFileSize, maxTotalSize, visited, result, baseDir, input } = ctx;
-  if (visited.has(path3)) return;
-  if (depth > maxDepth) {
-    result.maxDepthReached = true;
-    return;
-  }
-  if (result.totalSize >= maxTotalSize) {
-    result.maxSizeReached = true;
-    return;
-  }
-  visited.add(path3);
-  const { content, lineCount, fileSize, error } = readScriptContent2(path3, maxFileSize);
-  if (error) {
-    const node2 = newNode(path3, depth);
-    node2.error = error;
-    node2.fileSize = fileSize;
-    node2.lineCount = lineCount;
-    result.nodes.push(node2);
-    return;
-  }
-  result.totalSize += fileSize;
-  result.totalLines += lineCount;
-  const preprocessed = preprocessScriptContent(content);
-  const node = newNode(path3, depth);
-  node.rawContent = content;
-  node.preprocessedContent = preprocessed;
-  node.lineCount = lineCount;
-  node.fileSize = fileSize;
-  result.nodes.push(node);
-  const virtualInput = {
-    ...input,
-    aNext: { actionType: "bash", actionDetail: preprocessed }
-  };
-  const l1 = runHeuristicCheck(virtualInput);
-  if (l1 && !l1.allowed) {
-    node.l1Hit = true;
-    node.l1RiskLevel = l1.riskLevel;
-    node.l1RiskType = l1.riskType;
-    node.l1Reason = l1.reason;
-    node.l1MatchedPatterns = [];
-    if (l1.riskLevel === "critical") {
-      result.hasCritical = true;
-      result.firstHitNode = node;
-      return;
-    }
-  }
-  const childPaths = extractChildScriptPaths(preprocessed, baseDir);
-  node.childPaths = childPaths;
-  for (const childPath of childPaths) {
-    resolveRecursive({
-      path: resolvePath(childPath),
-      depth: depth + 1,
-      maxDepth,
-      maxFileSize,
-      maxTotalSize,
-      visited,
-      result,
-      baseDir: dirname6(resolvePath(childPath)),
-      input
-    });
-    if (result.hasCritical) return;
+    expanded = join5(homedir3(), expanded.slice(1));
   }
+  return resolve8(expanded);
 }
 function scanScriptChainWithL1(chain, input) {
   for (const node of chain.nodes) {
@@ -3617,14 +5192,31 @@ function scanScriptChainKeywords(chain) {
 function analyzeScriptContent2(input) {
   const actionType = input.aNext.actionType.toLowerCase();
   if (actionType !== "bash") return emptyChain();
-  const scriptPath = extractScriptPath2(input.aNext.actionDetail);
+  const { path: scriptPath, args: scriptArgs } = extractScriptPathWithArgs(input.aNext.actionDetail);
   let resolvedPath = scriptPath;
+  let isInline = false;
   if (!resolvedPath) {
     const inline = extractInlineScriptPath(input.aNext.actionDetail);
     if (!inline) return emptyChain();
     resolvedPath = inline;
+    isInline = true;
   }
-  const chain = resolveScriptChain(resolvedPath, input);
+  if (resolvedPath && !isAbsolute2(resolvedPath) && !resolvedPath.startsWith("~/")) {
+    resolvedPath = join5(input.cwd || process.cwd(), resolvedPath);
+  }
+  const l1Adapter = (content) => {
+    const virtualInput = {
+      ...input,
+      aNext: { actionType: "bash", actionDetail: content }
+    };
+    const j = runHeuristicCheck(virtualInput);
+    if (j && !j.allowed) {
+      return { hit: true, riskLevel: j.riskLevel, riskType: j.riskType, reason: j.reason, matchedPatterns: [] };
+    }
+    return { hit: false, riskLevel: "", riskType: "", reason: "", matchedPatterns: [] };
+  };
+  const tracker = new RecursiveTracker(l1Adapter);
+  const chain = tracker.track(resolvedPath, isInline ? null : scriptArgs, input.cwd || process.cwd());
   if (chain.nodes.length === 0) return chain;
   scanScriptChainWithL1(chain, input);
   scanScriptChainWithL2(chain, input);
@@ -3692,18 +5284,6 @@ ${contentPreview}
   if (chain.maxSizeReached) header += "\u26A0\uFE0F \u6CE8\u610F\uFF1A\u7D2F\u8BA1\u6587\u4EF6\u5927\u5C0F\u89E6\u8FBE\u4E0A\u9650\uFF0C\u90E8\u5206\u811A\u672C\u53EF\u80FD\u672A\u88AB\u5B8C\u6574\u8BFB\u53D6\u3002\n";
   return header + parts.join("\n---\n\n");
 }
-var CHILD_SCRIPT_PATTERNS = [
-  /(?:^|\s|&&|\|\|)\s*bash\s+(\S+)/i,
-  /(?:^|\s|&&|\|\|)\s*sh\s+(\S+)/i,
-  /(?:^|\s|&&|\|\|)\s*source\s+(\S+)/i,
-  /(?:^|\s|&&|\|\|)\s*\.\s+(\S+)/,
-  /(?:^|\s|&&|\|\|)\s*python3?\s+(\S+\.py)/i,
-  /(?:^|\s|&&|\|\|)\s*node\s+(\S+\.js)/i,
-  /(?:^|\s|&&|\|\|)\s*ruby\s+(\S+\.rb)/i,
-  /(?:^|\s|&&|\|\|)\s*perl\s+(\S+\.pl)/i,
-  /(?:^|\s|&&|\|\|)\s*php\s+(\S+\.php)/i,
-  /(?:^|\s|&&|\|\|)\s*lua\s+(\S+\.lua)/i
-];
 
 // src/engine/llm-analyzer.ts
 import { appendFileSync } from "fs";
@@ -3919,7 +5499,7 @@ async function analyzeWithLLM(prompt, config) {
       }
       if (attempt < maxRetries) {
         console.error(`[AgentMoss] LLM call failed (attempt ${attempt + 1}/${maxRetries + 1}), retrying in ${retryCfg.retryInterval}s:`, err.message);
-        await new Promise((resolve7) => setTimeout(resolve7, retryCfg.retryInterval * 1e3));
+        await new Promise((resolve9) => setTimeout(resolve9, retryCfg.retryInterval * 1e3));
       } else {
         clearTimeout(totalTimeoutTimer);
         console.error("[AgentMoss] LLM call failed after all retries:", err.message);
@@ -3934,16 +5514,17 @@ async function analyzeWithLLM(prompt, config) {
 // src/engine/coordinator.ts
 init_config();
 init_agents();
+init_scenarios();
 
 // src/brain/index.ts
 init_esm_shims();
 
 // src/brain/rule-store.ts
 init_esm_shims();
-import { existsSync as existsSync9, readFileSync as readFileSync10, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
-import { join as join5 } from "path";
-import { homedir as homedir3 } from "os";
-var DEFAULT_RULES_PATH = join5(homedir3(), ".agentmoss", "brain", "rules.json");
+import { existsSync as existsSync11, readFileSync as readFileSync12, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
+import { join as join6 } from "path";
+import { homedir as homedir4 } from "os";
+var DEFAULT_RULES_PATH = join6(homedir4(), ".agentmoss", "brain", "rules.json");
 var ENV_RULES_PATH = "AGENT_MOSS_BRAIN_RULES_PATH";
 var STATUS_DRAFT = "draft";
 var STATUS_APPROVED = "approved";
@@ -3967,16 +5548,16 @@ function uuid() {
 var BrainRuleStore = class {
   path;
   data;
-  constructor(path3) {
-    this.path = path3 || getRulesPath();
+  constructor(path5) {
+    this.path = path5 || getRulesPath();
     this.data = this.load();
   }
   load() {
-    if (!existsSync9(this.path)) {
+    if (!existsSync11(this.path)) {
       return { version: 1, rules: [], pattern_candidates: [] };
     }
     try {
-      const raw = JSON.parse(readFileSync10(this.path, "utf-8"));
+      const raw = JSON.parse(readFileSync12(this.path, "utf-8"));
       return {
         version: raw.version || 1,
         rules: raw.rules || [],
@@ -4274,10 +5855,10 @@ var PatternExtractor = class {
       const pathRe = new RegExp(pathPrefix + pathBody + pathSuffix, "g");
       let mm;
       while ((mm = pathRe.exec(src)) !== null) {
-        const path3 = mm[1];
-        if (path3.split("/").length < 3) continue;
-        if (["/dev/null", "/dev/zero", "/dev/random", "/dev/urandom"].includes(path3)) continue;
-        const gen = this.generalizePath(path3);
+        const path5 = mm[1];
+        if (path5.split("/").length < 3) continue;
+        if (["/dev/null", "/dev/zero", "/dev/random", "/dev/urandom"].includes(path5)) continue;
+        const gen = this.generalizePath(path5);
         if (seen.has(gen)) continue;
         seen.add(gen);
         patterns.push({ pattern: gen, layer: 1, scope: "openat", ruleType: "deny_path" });
@@ -4296,8 +5877,8 @@ var PatternExtractor = class {
     }
     return false;
   }
-  generalizePath(path3) {
-    const p = path3.toLowerCase();
+  generalizePath(path5) {
+    const p = path5.toLowerCase();
     if (/\/etc\/(shadow|passwd|sudoers|security|ssh)/.test(p)) {
       return "(?:^|[^a-z0-9_-])etc/(?:shadow|passwd|sudoers|security/|ssh/)";
     }
@@ -4460,6 +6041,468 @@ function checkLayer2Context(pattern, actionHistory, actionDetail) {
   return true;
 }
 
+// src/engine/formal-engine/index.ts
+init_esm_shims();
+
+// src/engine/formal-engine/engine.ts
+init_esm_shims();
+
+// src/engine/formal-engine/builder.ts
+init_esm_shims();
+init_rules_loader();
+
+// src/engine/formal-engine/decode.ts
+init_esm_shims();
+var B64_TOKEN_RE = /[A-Za-z0-9+/]+={0,2}/g;
+function isValidBase64Token(tok) {
+  if (tok.length < 8) return false;
+  if (!(tok.length % 4 === 0 || tok.endsWith("==") || tok.endsWith("="))) return false;
+  return true;
+}
+function isPrintable(s) {
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c < 32 || c > 126) return false;
+  }
+  return true;
+}
+function decodeBase64Literals(text) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const m of text.matchAll(B64_TOKEN_RE)) {
+    const tok = m[0];
+    if (!isValidBase64Token(tok)) continue;
+    if (!/[A-Z]/.test(tok) || !/[a-z]/.test(tok)) continue;
+    try {
+      const padded = tok + "=".repeat((4 - tok.length % 4) % 4);
+      const bin = Buffer.from(padded, "base64");
+      const s = bin.toString("utf8");
+      if (s && isPrintable(s) && !seen.has(s)) {
+        seen.add(s);
+        out.push(s);
+      }
+    } catch {
+    }
+  }
+  return out;
+}
+function decodeUrlAndNumeric(text) {
+  const out = [];
+  let s = text;
+  for (let i = 0; i < 3; i++) {
+    let nxt = s;
+    try {
+      nxt = decodeURIComponent(s);
+    } catch {
+      break;
+    }
+    if (nxt === s) break;
+    s = nxt;
+  }
+  if (s !== text) out.push(s);
+  if (/\\[0-7]{3}/.test(text)) {
+    let expanded = "";
+    try {
+      expanded = text.replace(/\\[0-7]{3}/g, (m) => String.fromCharCode(parseInt(m.slice(1), 8)));
+    } catch {
+    }
+    if (expanded && expanded !== text) out.push(expanded);
+  }
+  if (/\\x[0-9a-fA-F]{2}/.test(text)) {
+    let expanded = "";
+    try {
+      expanded = text.replace(/\\x[0-9a-fA-F]{2}/g, (m) => String.fromCharCode(parseInt(m.slice(2), 16)));
+    } catch {
+    }
+    if (expanded && expanded !== text) out.push(expanded);
+  }
+  return out;
+}
+function allCandidates(detail, max = 8) {
+  const cands = [detail];
+  cands.push(...decodeBase64Literals(detail));
+  cands.push(...decodeUrlAndNumeric(detail));
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const c of cands) {
+    if (seen.has(c) || c.length > 4096) continue;
+    seen.add(c);
+    out.push(c);
+    if (out.length >= max) break;
+  }
+  return out;
+}
+function matchStageAny(detail, stages) {
+  for (const cand of allCandidates(detail)) {
+    for (const [name, pats] of Object.entries(stages)) {
+      for (const p of pats) {
+        p.lastIndex = 0;
+        if (p.test(cand)) return name;
+      }
+    }
+  }
+  return "";
+}
+
+// src/engine/formal-engine/builder.ts
+var COMBO_STAGES2 = null;
+function loadStages() {
+  if (COMBO_STAGES2) return COMBO_STAGES2;
+  const combo = loadL2().combo_chains || {};
+  const stages = {};
+  for (const [name, pats] of Object.entries(combo.stages || {})) {
+    stages[name] = pats.map((p) => new RegExp(p, "i"));
+  }
+  COMBO_STAGES2 = stages;
+  return stages;
+}
+var PATH_RE = /(?:^|\s|[@=])((?:\/|~\/)[\w./~-]+)/g;
+function extractResources(actionDetail) {
+  const resources = /* @__PURE__ */ new Set();
+  const text = actionDetail.replace(/'[^']*'|"[^"]*"/g, "");
+  PATH_RE.lastIndex = 0;
+  let m;
+  while ((m = PATH_RE.exec(text)) !== null) {
+    const p = m[1];
+    if (p.startsWith("/dev/") || p.includes("://")) continue;
+    resources.add(p);
+  }
+  return resources;
+}
+function markStage(actionDetail) {
+  return matchStageAny(actionDetail, loadStages());
+}
+function buildSessionGraph(actionHistory, aNext, sessionId = "current") {
+  const nodes = [];
+  const edges = [];
+  const stageFlags = /* @__PURE__ */ new Set();
+  const details = [];
+  for (const a of actionHistory) {
+    const ad = String(a.actionDetail || "");
+    if (ad) details.push({ actionType: String(a.actionType || ""), actionDetail: ad });
+  }
+  if (aNext) {
+    details.push({ actionType: String(aNext.actionType || ""), actionDetail: String(aNext.actionDetail || "") });
+  }
+  details.forEach((d, seq) => {
+    const stage = markStage(d.actionDetail);
+    const node = {
+      sessionId,
+      seq,
+      actionType: d.actionType,
+      actionDetail: d.actionDetail,
+      stage,
+      resources: extractResources(d.actionDetail)
+    };
+    nodes.push(node);
+    if (stage) stageFlags.add(stage);
+  });
+  for (let i = 0; i < nodes.length - 1; i++) {
+    edges.push({ src: i, dst: i + 1, kind: "next" });
+  }
+  return { sessionId, nodes, edges, stageFlags };
+}
+function buildMultiSessionGraph(sessions, aNext) {
+  const mg = { sessions: [], crossEdges: [] };
+  if (!sessions || sessions.length === 0) {
+    mg.sessions.push(buildSessionGraph([], aNext, "current"));
+    return mg;
+  }
+  for (const s of sessions) {
+    const sid = String(s.sessionId || "s");
+    mg.sessions.push(buildSessionGraph(s.actionHistory || [], void 0, sid));
+  }
+  if (aNext) {
+    const last = mg.sessions[mg.sessions.length - 1];
+    if (last.sessionId === "current") {
+      const stage = markStage(String(aNext.actionDetail || ""));
+      last.nodes.push({
+        sessionId: last.sessionId,
+        seq: last.nodes.length,
+        actionType: String(aNext.actionType || ""),
+        actionDetail: String(aNext.actionDetail || ""),
+        stage,
+        resources: extractResources(String(aNext.actionDetail || ""))
+      });
+      if (last.nodes.length > 1) {
+        last.edges.push({ src: last.nodes.length - 2, dst: last.nodes.length - 1, kind: "next" });
+      }
+    } else {
+      mg.sessions.push(buildSessionGraph([], aNext, "current"));
+    }
+  }
+  addCrossDataEdges(mg);
+  return mg;
+}
+function addCrossDataEdges(mg) {
+  const nodes = allNodesFlat(mg);
+  if (nodes.length < 2) return;
+  for (let i = 0; i < nodes.length; i++) {
+    for (let j = i + 1; j < nodes.length; j++) {
+      if (nodes[i].sessionId === nodes[j].sessionId) continue;
+      const shared = intersect(nodes[i].resources, nodes[j].resources);
+      if (shared.size > 0) {
+        mg.crossEdges.push({ src: i, dst: j, kind: "data" });
+      }
+    }
+  }
+}
+function allNodesFlat(mg) {
+  const out = [];
+  for (const s of mg.sessions) out.push(...s.nodes);
+  return out;
+}
+function intersect(a, b) {
+  const out = /* @__PURE__ */ new Set();
+  for (const v of a) if (b.has(v)) out.add(v);
+  return out;
+}
+
+// src/engine/formal-engine/ir.ts
+init_esm_shims();
+function allNodes(mg) {
+  const out = [];
+  for (const s of mg.sessions) out.push(...s.nodes);
+  return out;
+}
+function allEdges(mg) {
+  const out = [];
+  for (const s of mg.sessions) out.push(...s.edges);
+  out.push(...mg.crossEdges);
+  return out;
+}
+function emptyVerificationResult() {
+  return { verified: true, violations: [] };
+}
+
+// src/engine/formal-engine/properties.ts
+init_esm_shims();
+init_rules_loader();
+var CROSS_SESSION_CHAINS = null;
+function loadCrossSessionChains() {
+  if (CROSS_SESSION_CHAINS) return CROSS_SESSION_CHAINS;
+  const combo = loadL2().combo_chains || {};
+  CROSS_SESSION_CHAINS = (combo.chains || []).map((c) => ({
+    id: String(c.id || "combo_chain"),
+    stages: c.stages || [],
+    riskLevel: String(c.riskLevel || c.risk_level || "high"),
+    reason: "\u8DE8\u4F1A\u8BDD" + String(c.reason || "\u7EC4\u5408\u653B\u51FB\u94FE")
+  }));
+  return CROSS_SESSION_CHAINS;
+}
+var CRED_FILE_RE = /(known_hosts|\.ssh|id_rsa|\/etc\/shadow|\/etc\/passwd|credentials)/i;
+var EXFIL_RE = /https?:\/\/|scp\s+.*@|rsync\s+.*@/i;
+function checkCrossSessionChain(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length === 0) return violations;
+  for (const chain of loadCrossSessionChains()) {
+    const stages = chain.stages;
+    if (!stages.length) continue;
+    let matched = 0;
+    let stageIdx = 0;
+    const path5 = [];
+    for (const n of nodes) {
+      if (stageIdx < stages.length && n.stage === stages[stageIdx]) {
+        matched += 1;
+        path5.push({ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) });
+        stageIdx += 1;
+        if (matched >= stages.length) break;
+      }
+    }
+    if (matched >= stages.length) {
+      violations.push({
+        propertyId: "cross-" + chain.id,
+        reason: chain.reason,
+        riskLevel: chain.riskLevel,
+        path: path5
+      });
+    }
+  }
+  return violations;
+}
+function checkSensitiveDataFlow(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length === 0) return violations;
+  const tainted = /* @__PURE__ */ new Map();
+  for (let i = 0; i < nodes.length; i++) {
+    const n = nodes[i];
+    if (n.stage === "CRED" && [...n.resources].some((r) => CRED_FILE_RE.test(r))) {
+      tainted.set(i, `${n.sessionId}#${n.seq} \u8BBF\u95EE ${[...n.resources][0]}`);
+    }
+  }
+  if (tainted.size === 0) return violations;
+  const edges = allEdges(graph);
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const e of edges) {
+      if (tainted.has(e.src) && !tainted.has(e.dst)) {
+        const srcRes = nodes[e.src].resources;
+        const dstRes = nodes[e.dst].resources;
+        for (const r of srcRes) {
+          if (dstRes.has(r)) {
+            tainted.set(e.dst, tainted.get(e.src));
+            changed = true;
+            break;
+          }
+        }
+      }
+    }
+  }
+  for (const [i, n] of nodes.entries()) {
+    if (tainted.has(i) && EXFIL_RE.test(n.actionDetail)) {
+      violations.push({
+        propertyId: "sensitive-data-exfil",
+        reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${tainted.get(i)} \u2192 ${n.sessionId}#${n.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
+        riskLevel: "critical",
+        path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
+      });
+    }
+  }
+  return violations;
+}
+var EBPF_NET_RE = /connect|sendto|network_connect/i;
+var REMOTE_RE = /to\s+\d+\.\d+\.\d+\.\d+|remote_addr/i;
+var PRIVESC_RE = /\bsudo\b|\bsu\b|chmod\s+u\s*\+\s*s|pkexec|setuid/i;
+var EXFIL_ACTION_RE = /\bcurl\b|\bwget\b|\bscp\b|\brsync\b|\brclone\b|\bftp\b|connect\s+.*\d+\.\d+\.\d+\.\d+|open\s+.*tcp|base64\s+.*\-o/i;
+var CRED_STRICT_RE = /(known_hosts|\.ssh|id_rsa|\.pem|\b\.key\b|\/etc\/shadow|\/etc\/passwd|\.aws\/credentials|credentials\.json|netrc|password|secrets?\.ya?ml|credentials?\s*(file|path)?\s*(=|\:)|\bconfig.*(password|token))/i;
+function isExfilNode(n) {
+  if (n.stage === "EXFIL") return true;
+  if (EXFIL_RE.test(n.actionDetail) && EXFIL_ACTION_RE.test(n.actionDetail)) return true;
+  if (EBPF_NET_RE.test(n.actionDetail) && REMOTE_RE.test(n.actionDetail)) return true;
+  return false;
+}
+function isCredNode(n) {
+  if (n.stage !== "CRED") return false;
+  for (const r of n.resources) {
+    if (CRED_STRICT_RE.test(r)) return true;
+  }
+  return CRED_STRICT_RE.test(n.actionDetail);
+}
+function isPrivescNode(n) {
+  if (n.stage === "PRIVESC") return true;
+  return PRIVESC_RE.test(n.actionDetail);
+}
+function checkNeverExfilAfterPrivesc(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length < 2) return violations;
+  for (let i = 0; i < nodes.length; i++) {
+    if (!isPrivescNode(nodes[i])) continue;
+    for (let j = i + 1; j < nodes.length; j++) {
+      if (isExfilNode(nodes[j])) {
+        violations.push({
+          propertyId: "no-privesc-then-exfil",
+          reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\xAC\u25C7EXFIL)",
+          riskLevel: "critical",
+          path: [
+            { sessionId: nodes[i].sessionId, seq: nodes[i].seq, detail: nodes[i].actionDetail.slice(0, 60) },
+            { sessionId: nodes[j].sessionId, seq: nodes[j].seq, detail: nodes[j].actionDetail.slice(0, 60) }
+          ]
+        });
+        return violations;
+      }
+    }
+  }
+  return violations;
+}
+function checkNeverExfilAfterCred(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length < 2) return violations;
+  for (let i = 0; i < nodes.length; i++) {
+    if (!isCredNode(nodes[i])) continue;
+    for (let j = i + 1; j < nodes.length; j++) {
+      if (isExfilNode(nodes[j])) {
+        violations.push({
+          propertyId: "no-cred-then-exfil",
+          reason: "\u8BFB\u53D6\u51ED\u636E\u540E\u51FA\u73B0\u5916\u4F20\uFF0C\u8FDD\u53CD \u25A1(CRED\u2192\xAC\u25C7EXFIL)",
+          riskLevel: "critical",
+          path: [
+            { sessionId: nodes[i].sessionId, seq: nodes[i].seq, detail: nodes[i].actionDetail.slice(0, 60) },
+            { sessionId: nodes[j].sessionId, seq: nodes[j].seq, detail: nodes[j].actionDetail.slice(0, 60) }
+          ]
+        });
+        return violations;
+      }
+    }
+  }
+  return violations;
+}
+var ALL_PROPERTIES = [
+  { id: "cross-session-chain", check: checkCrossSessionChain },
+  { id: "sensitive-data-flow", check: checkSensitiveDataFlow },
+  { id: "no-privesc-then-exfil", check: checkNeverExfilAfterPrivesc },
+  { id: "no-cred-then-exfil", check: checkNeverExfilAfterCred }
+];
+
+// src/engine/formal-engine/engine.ts
+function ebpfEventToDetail(e) {
+  const parts = [];
+  const syscall = String(e.syscall || e.op || "");
+  const argv = String(e.argv || e.pathname || "");
+  const remote = String(e.remote_addr || "");
+  const port = e.remote_port;
+  if (syscall) parts.push(syscall);
+  if (argv && argv !== "" && argv !== "None") parts.push(argv);
+  if (remote) parts.push("to " + remote + (port ? ":" + String(port) : ""));
+  return parts.join(" ");
+}
+var FormalEngine = class {
+  properties;
+  constructor(properties) {
+    this.properties = properties && properties.length > 0 ? properties : ALL_PROPERTIES;
+  }
+  verify(sessions, aNext, ebpfEvents) {
+    const all = sessions ? [...sessions] : [];
+    if (ebpfEvents && ebpfEvents.length > 0) {
+      all.push({
+        sessionId: "ebpf-evidence",
+        actionHistory: ebpfEvents.map((e) => ({
+          actionType: "syscall",
+          actionDetail: ebpfEventToDetail(e)
+        }))
+      });
+    }
+    const graph = buildMultiSessionGraph(all, aNext);
+    const result = emptyVerificationResult();
+    for (const prop of this.properties) {
+      let violations;
+      try {
+        violations = prop.check(graph);
+      } catch (e) {
+        result.verified = false;
+        result.violations.push({
+          propertyId: prop.id,
+          reason: `\u5F62\u5F0F\u5316\u6027\u8D28\u9A8C\u8BC1\u5F02\u5E38\uFF0C\u4FDD\u5B88\u62E6\u622A: ${e}`,
+          riskLevel: "medium",
+          path: []
+        });
+        return result;
+      }
+      if (violations.length > 0) {
+        result.verified = false;
+        result.violations.push(...violations);
+        break;
+      }
+    }
+    return result;
+  }
+};
+
+// src/engine/formal-engine/stateful.ts
+init_esm_shims();
+init_rules_loader();
+
+// src/engine/formal-engine/chain_state.ts
+init_esm_shims();
+import * as fs4 from "fs";
+import * as os2 from "os";
+import * as path4 from "path";
+import { createHash } from "crypto";
+
 // src/engine/coordinator.ts
 var FULLY_SAFE_TOOLS = /* @__PURE__ */ new Set([
   "ask_user_question",
@@ -4562,6 +6605,7 @@ function _resetBrainForTest() {
   _brainExtractor = null;
   _brainInitialized = false;
 }
+var formalEngine = new FormalEngine();
 async function runAnalysis(input) {
   const heuristicResult = isHeuristicEnabled() ? runHeuristicCheck(input) : null;
   const isInlineScriptCmd = isInlineScriptCommand(input.aNext.actionDetail.toLowerCase());
@@ -4616,7 +6660,10 @@ async function runAnalysis(input) {
   const actionType = input.aNext.actionType.toLowerCase();
   const rawDetail = extractRawCommand(input.aNext.actionDetail);
   const lowerDetail = rawDetail.toLowerCase();
-  const agentExt = getAgentExtensions(input.agentId);
+  const agentExt = mergeAgentExtensions(
+    getAgentExtensions(input.agentId),
+    getScenarioExtensions(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "")
+  );
   if (FULLY_SAFE_TOOLS.has(actionType)) {
     return {
       allowed: true,
@@ -4721,6 +6768,28 @@ async function runAnalysis(input) {
       return effectiveResult;
     }
   }
+  if (isLogicRulesEnabled()) {
+    const formalSessions = [];
+    if (input.sessionHistory) {
+      for (const s of input.sessionHistory) {
+        formalSessions.push({ sessionId: s.sessionId || "s", actionHistory: s.actionHistory || [] });
+      }
+    }
+    formalSessions.push({ sessionId: "current", actionHistory: input.actionHistory });
+    const formalResult = formalEngine.verify(formalSessions, input.aNext);
+    if (!formalResult.verified) {
+      const v = formalResult.violations[0];
+      return {
+        allowed: false,
+        reason: v ? v.reason : "\u5F62\u5F0F\u5316\u9A8C\u8BC1\u672A\u901A\u8FC7\uFF08\u884C\u4E3A\u6027\u8D28\u8FDD\u53CD\uFF09",
+        riskLevel: v ? v.riskLevel : "high",
+        riskType: "formal_verification",
+        confidence: 90,
+        source: "formal_engine",
+        violatedLayers: ["2.4"]
+      };
+    }
+  }
   if (scriptChain && scriptChain.nodes.length > 0 && isLogicRulesEnabled()) {
     for (const node of scriptChain.nodes) {
       if (node.error || !node.preprocessedContent) continue;