@kenhkl/agent-moss 0.12.8 → 0.13.0

package/dist/engine/coordinator.js

@@ -2,6 +2,12 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
@@ -127,6 +133,7 @@ __export(config_exports, {
   getRetryConfig: () => getRetryConfig,
   getTimeoutConfig: () => getTimeoutConfig,
   isBrainEnabled: () => isBrainEnabled,
+  isFormalObserveMode: () => isFormalObserveMode,
   isHeuristicEnabled: () => isHeuristicEnabled,
   isLLMAvailable: () => isLLMAvailable,
   isLogicRulesEnabled: () => isLogicRulesEnabled,
@@ -242,6 +249,7 @@ function getCustomRules() {
 }
 function isLLMAvailable() {
   if (process.env.AGENT_MOSS_DISABLE_LLM === "1") return false;
+  if (!layerEnabledOrDefault("L3_llm_analysis")) return false;
   return llmConfig.apiKey.length > 0;
 }
 async function probeLLMConnection(timeoutMs = 8e3) {
@@ -306,13 +314,26 @@ function getProviderHeaders(provider) {
   return PROVIDER_HEADERS[provider] || {};
 }
 function isHeuristicEnabled() {
-  return process.env.AGENT_MOSS_DISABLE_HEURISTIC !== "1";
+  if (process.env.AGENT_MOSS_DISABLE_HEURISTIC === "1") return false;
+  return layerEnabledOrDefault("L1_heuristic");
+}
+function layerEnabledOrDefault(key) {
+  try {
+    const { isLayerEnabled: isLayerEnabled2 } = __require("../infra/runtime-config");
+    return isLayerEnabled2(key);
+  } catch {
+    return true;
+  }
 }
 function isBrainEnabled() {
   return process.env.AGENT_MOSS_BRAIN_ENABLED === "1";
 }
 function isLogicRulesEnabled() {
-  return process.env.AGENT_MOSS_DISABLE_LOGIC_RULES !== "1";
+  if (process.env.AGENT_MOSS_DISABLE_LOGIC_RULES === "1") return false;
+  return layerEnabledOrDefault("L2_logic_rules");
+}
+function isFormalObserveMode() {
+  return process.env.AGENT_MOSS_FORMAL_OBSERVE === "1";
 }
 var timeoutConfig, retryConfig, llmConfig, __configModuleDir, USER_RULES_PATHS, customRules, PROVIDER_HEADERS;
 var init_config = __esm({
@@ -570,8 +591,12 @@ var init_inline_analyzer = __esm({
 
 // src/infra/rules-loader.ts
 import { readFileSync as readFileSync2, existsSync } from "fs";
-import { resolve, dirname } from "path";
+import { resolve, dirname, join as join2 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
+import { homedir as homedir2 } from "os";
+function dataRootDir() {
+  return process.env.AGENT_MOSS_DATA_DIR || join2(homedir2(), ".config", "agentmoss");
+}
 function findRulesFile(name) {
   for (const dir of RULES_DIR_CANDS) {
     const p = resolve(dir, name);
@@ -597,6 +622,24 @@ function loadL2() {
 function loadL3() {
   return loadJson("l3_rules.json");
 }
+function loadMC() {
+  const mc = loadJson("mc_rules.json");
+  const rules = mc.rules || [];
+  try {
+    const rt = (init_runtime_config(), __toCommonJS(runtime_config_exports));
+    if (rules.length > 0 && typeof rt.hasRuntimeConfig === "function" && rt.hasRuntimeConfig()) {
+      const rtRules = rt.loadRuntimeConfig()?.L2_4?.ltl_rules?.rules || [];
+      const enabledById = {};
+      for (const r of rtRules) if (r?.id) enabledById[r.id] = r.enabled !== false;
+      for (const r of rules) if (r?.id && r.id in enabledById) r.enabled = enabledById[r.id];
+    }
+  } catch {
+  }
+  return mc;
+}
+function loadToolRegistry() {
+  return loadJson("tool_registry.json");
+}
 var __filename2, __dirname2, RULES_DIR_CANDS;
 var init_rules_loader = __esm({
   "src/infra/rules-loader.ts"() {
@@ -606,6 +649,10 @@ var init_rules_loader = __esm({
     __dirname2 = dirname(__filename2);
     RULES_DIR_CANDS = (() => {
       const cands = [
+        // 用户数据目录覆盖优先（与 Python rules_loader._load_json 的
+        // <data_root>/rules/<name> 优先逻辑对齐）。用户安装 pip/npm 包后把自定义
+        // mc_rules.json 放到 <data_root>/rules/ 即可覆盖内置默认，无需改源码。
+        resolve(dataRootDir(), "rules"),
         // dist: __dirname=dist/ → dist/rules；__dirname=dist/engine/ → dist/engine/../rules=dist/rules
         resolve(__dirname2, "../rules"),
         resolve(__dirname2, "rules"),
@@ -1343,6 +1390,7 @@ var init_skill_loader = __esm({
 // src/infra/runtime-config.ts
 var runtime_config_exports = {};
 __export(runtime_config_exports, {
+  DEFAULT_LAYERS: () => DEFAULT_LAYERS,
   DENY_MODE_LABELS: () => DENY_MODE_LABELS,
   addAgentRule: () => addAgentRule,
   addCustomRule: () => addCustomRule,
@@ -1394,7 +1442,7 @@ __export(runtime_config_exports, {
   updateSkillEnabled: () => updateSkillEnabled
 });
 import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync4, mkdirSync, unlinkSync, readdirSync as readdirSync3 } from "fs";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import { dirname as dirname3 } from "path";
 function runtimeDir() {
@@ -1418,6 +1466,7 @@ function emptyRuntimeConfig() {
     L1_rules: {},
     L2_rules: {},
     L3_skills: {},
+    L2_4: {},
     agent_rules: {},
     scenario_rules: {}
   };
@@ -1445,6 +1494,7 @@ function loadRuntimeConfig() {
       L1_rules: merged.L1_rules || {},
       L2_rules: merged.L2_rules || {},
       L3_skills: merged.L3_skills || {},
+      L2_4: merged.L2_4 || {},
       agent_rules: merged.agent_rules || {},
       scenario_rules: merged.scenario_rules || {}
     };
@@ -1692,7 +1742,7 @@ function _scenarioRulesToDefaults() {
     return out;
   }
   for (const scenarioId of entries) {
-    const rulesFile = join2(scenDir, scenarioId, "rules.json");
+    const rulesFile = join3(scenDir, scenarioId, "rules.json");
     if (!existsSync4(rulesFile)) continue;
     let data;
     try {
@@ -1741,7 +1791,7 @@ function _agentRulesToDefaults() {
     return out;
   }
   for (const agentId of entries) {
-    const rulesFile = join2(agentsDir, agentId, "rules.json");
+    const rulesFile = join3(agentsDir, agentId, "rules.json");
     if (!existsSync4(rulesFile)) continue;
     let data;
     try {
@@ -1782,7 +1832,7 @@ function _agentRulesToDefaults() {
 function generateSourceDefaults() {
   return {
     version: 1,
-    layers: { L1_heuristic: true, L2_logic_rules: true, L3_llm_analysis: true },
+    layers: { ...DEFAULT_LAYERS },
     L1_rules: {
       dangerous_commands: {
         category_enabled: true,
@@ -1821,10 +1871,45 @@ function generateSourceDefaults() {
       user_custom: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49 L2 \u903B\u8F91\u89C4\u5219", rules: [] }
     },
     L3_skills: _l3SkillsToRules(),
+    L2_4: _ltlRulesToRuntime(),
     agent_rules: _agentRulesToDefaults(),
     scenario_rules: _scenarioRulesToDefaults()
   };
 }
+function _ltlRulesToRuntime() {
+  const cands = [
+    join3(__dirname4, "..", "rules"),
+    join3(__dirname4, "..", "..", "..", "agent_moss", "rules"),
+    join3(process.cwd(), "agent_moss", "rules")
+  ];
+  let mc = {};
+  for (const dir of cands) {
+    const p = join3(dir, "mc_rules.json");
+    if (existsSync4(p)) {
+      try {
+        mc = JSON.parse(readFileSync4(p, "utf-8")) || {};
+      } catch {
+        mc = {};
+      }
+      break;
+    }
+  }
+  const rules = mc.rules || [];
+  return {
+    ltl_rules: {
+      category_enabled: true,
+      category_desc: "LTL \u653B\u51FB\u6A21\u5F0F\u89C4\u5219\uFF08\u65F6\u5E8F\u653B\u51FB\u68C0\u6D4B\uFF0C\u5148 A \u540E B\uFF09",
+      rules: rules.map((r) => ({
+        id: r.id,
+        reason: r.reason || "",
+        risk_level: r.risk_level || "high",
+        action: r.action || "block",
+        enabled: true,
+        builtin: true
+      }))
+    }
+  };
+}
 function normalizePatternForFingerprint(pattern) {
   return pattern.replace(/\\\//g, "/");
 }
@@ -1974,6 +2059,7 @@ function mergeConfig(userCfg, srcDefaults) {
   );
   _mergeRuleCategories(cfg, srcDefaults, "L1_rules");
   _mergeRuleCategories(cfg, srcDefaults, "L2_rules");
+  _mergeRuleCategories(cfg, srcDefaults, "L2_4");
   _mergeSkillCategories(cfg, srcDefaults, "L3_skills");
   _mergeAgentRules(cfg, srcDefaults);
   _mergeAgentRules(cfg, srcDefaults, "scenario_rules");
@@ -2166,12 +2252,12 @@ function deleteCustomRule(layer, category, ruleId) {
 function addCustomSkill(skillId, category, keywords, content) {
   _validateSkillId(skillId);
   const runtime = loadRuntimeConfig();
-  const skillsDir = join2(RUNTIME_CONFIG_DIR, "agent_moss_skills");
+  const skillsDir = join3(RUNTIME_CONFIG_DIR, "agent_moss_skills");
   try {
     mkdirSync(skillsDir, { recursive: true });
   } catch {
   }
-  writeFileSync(join2(skillsDir, `${skillId}.md`), content, "utf-8");
+  writeFileSync(join3(skillsDir, `${skillId}.md`), content, "utf-8");
   const l3 = runtime.L3_skills || (runtime.L3_skills = {});
   const cat = l3[category] || (l3[category] = { category_enabled: true, category_desc: "", skills: [] });
   (cat.skills || (cat.skills = [])).push({ id: skillId, keywords, enabled: true, builtin: false });
@@ -2186,7 +2272,7 @@ function deleteCustomSkill(skillId, category) {
   if (idx >= 0) {
     if (skills[idx].builtin) return null;
     skills.splice(idx, 1);
-    const skillPath = join2(RUNTIME_CONFIG_DIR, "agent_moss_skills", `${skillId}.md`);
+    const skillPath = join3(RUNTIME_CONFIG_DIR, "agent_moss_skills", `${skillId}.md`);
     try {
       if (existsSync4(skillPath)) unlinkSync(skillPath);
     } catch {
@@ -2380,7 +2466,7 @@ function updateScenarioCategoryEnabled(scenarioId, category, enabled) {
   saveRuntimeConfig(runtime);
   return runtime;
 }
-var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DENY_MODE_LABELS, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, SKILL_ID_RE;
+var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DEFAULT_LAYERS, DENY_MODE_LABELS, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, SKILL_ID_RE;
 var init_runtime_config = __esm({
   "src/infra/runtime-config.ts"() {
     "use strict";
@@ -2392,21 +2478,28 @@ var init_runtime_config = __esm({
     __dirname4 = dirname3(fileURLToPath5(import.meta.url));
     ENV_RUNTIME_CONFIG_PATH = "AGENT_MOSS_RUNTIME_CONFIG_PATH";
     RUNTIME_CONFIG_DIR = runtimeDir();
-    RUNTIME_CONFIG_PATH = join2(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
+    RUNTIME_CONFIG_PATH = join3(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
     LAYER_DISABLE_ENV = {
       L1_heuristic: "AGENT_MOSS_DISABLE_HEURISTIC",
       L2_logic_rules: "AGENT_MOSS_DISABLE_LOGIC_RULES",
       L3_llm_analysis: "AGENT_MOSS_DISABLE_LLM"
     };
+    DEFAULT_LAYERS = {
+      L1_heuristic: true,
+      L2_logic_rules: true,
+      L3_llm_analysis: true,
+      agent_rules_enabled: true,
+      scenario_rules_enabled: true
+    };
     DENY_MODE_LABELS = {
       deny_write: "\u4EC5\u62E6\u622A\u5199\u5165",
       deny_read: "\u4EC5\u62E6\u622A\u8BFB\u53D6",
       deny_both: "\u8BFB\u5199\u5747\u62E6\u622A"
     };
-    _AGENTS_DIR_PROD = join2(__dirname4, "agents");
-    _AGENTS_DIR_DEV = join2(__dirname4, "..", "..", "..", "agent_moss", "agents");
-    _SCENARIOS_DIR_PROD = join2(__dirname4, "scenarios");
-    _SCENARIOS_DIR_DEV = join2(__dirname4, "..", "..", "..", "agent_moss", "scenarios");
+    _AGENTS_DIR_PROD = join3(__dirname4, "agents");
+    _AGENTS_DIR_DEV = join3(__dirname4, "..", "..", "..", "agent_moss", "agents");
+    _SCENARIOS_DIR_PROD = join3(__dirname4, "scenarios");
+    _SCENARIOS_DIR_DEV = join3(__dirname4, "..", "..", "..", "agent_moss", "scenarios");
     SKILL_ID_RE = /^[A-Za-z0-9_-]+$/;
   }
 });
@@ -2544,11 +2637,21 @@ function getScenarioExtensions(scenarioId) {
   );
   return ext;
 }
+function getScenarioExtensionsMulti(scenarioSpec) {
+  if (!scenarioSpec) return null;
+  const ids = scenarioSpec.split(",").map((s) => s.trim()).filter(Boolean);
+  if (ids.length === 0) return null;
+  const exts = ids.map((id) => getScenarioExtensions(id));
+  const nonNull = exts.filter((e) => e !== null);
+  if (nonNull.length === 0) return null;
+  return mergeAgentExtensions(...nonNull);
+}
 var __filename5, __dirname6, SCENARIOS_DIR_PROD, SCENARIOS_DIR_DEV_FALLBACK, cache2;
 var init_scenarios = __esm({
   "src/scenarios/index.ts"() {
     "use strict";
     init_esm_shims();
+    init_agents();
     __filename5 = fileURLToPath7(import.meta.url);
     __dirname6 = dirname5(__filename5);
     SCENARIOS_DIR_PROD = resolve4(__dirname6, "scenarios");
@@ -2597,8 +2700,8 @@ function runHeuristicCheck(input) {
   }
   highestRiskType = topRiskType || highestRiskType;
   const agentExt = mergeAgentExtensions(
-    getAgentExtensions(input.agentId),
-    getScenarioExtensions(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "")
+    isLayerEnabled("agent_rules_enabled") ? getAgentExtensions(input.agentId) : null,
+    isLayerEnabled("scenario_rules_enabled") ? getScenarioExtensionsMulti(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "") : null
   );
   if (agentExt?.extra_command_patterns) {
     for (const rule of agentExt.extra_command_patterns) {
@@ -3043,6 +3146,7 @@ var init_heuristic = __esm({
     init_config();
     init_agents();
     init_scenarios();
+    init_runtime_config();
     init_rules_loader();
     init_logic_rules();
     INJECTION_KEYWORDS = (() => {
@@ -3242,6 +3346,112 @@ var init_token_stats = __esm({
   }
 });
 
+// src/engine/formal-engine/decode.ts
+var decode_exports = {};
+__export(decode_exports, {
+  allCandidates: () => allCandidates,
+  decodeBase64Literals: () => decodeBase64Literals,
+  decodeUrlAndNumeric: () => decodeUrlAndNumeric,
+  matchStageAny: () => matchStageAny
+});
+function isValidBase64Token(tok) {
+  if (tok.length < 8) return false;
+  if (!(tok.length % 4 === 0 || tok.endsWith("==") || tok.endsWith("="))) return false;
+  return true;
+}
+function isPrintable(s) {
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c < 32 || c > 126) return false;
+  }
+  return true;
+}
+function decodeBase64Literals(text) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const m of text.matchAll(B64_TOKEN_RE)) {
+    const tok = m[0];
+    if (!isValidBase64Token(tok)) continue;
+    if (!/[A-Z]/.test(tok) || !/[a-z]/.test(tok)) continue;
+    try {
+      const padded = tok + "=".repeat((4 - tok.length % 4) % 4);
+      const bin = Buffer.from(padded, "base64");
+      const s = bin.toString("utf8");
+      if (s && isPrintable(s) && !seen.has(s)) {
+        seen.add(s);
+        out.push(s);
+      }
+    } catch {
+    }
+  }
+  return out;
+}
+function decodeUrlAndNumeric(text) {
+  const out = [];
+  let s = text;
+  for (let i = 0; i < 3; i++) {
+    let nxt = s;
+    try {
+      nxt = decodeURIComponent(s);
+    } catch {
+      break;
+    }
+    if (nxt === s) break;
+    s = nxt;
+  }
+  if (s !== text) out.push(s);
+  if (/\\[0-7]{3}/.test(text)) {
+    let expanded = "";
+    try {
+      expanded = text.replace(/\\[0-7]{3}/g, (m) => String.fromCharCode(parseInt(m.slice(1), 8)));
+    } catch {
+    }
+    if (expanded && expanded !== text) out.push(expanded);
+  }
+  if (/\\x[0-9a-fA-F]{2}/.test(text)) {
+    let expanded = "";
+    try {
+      expanded = text.replace(/\\x[0-9a-fA-F]{2}/g, (m) => String.fromCharCode(parseInt(m.slice(2), 16)));
+    } catch {
+    }
+    if (expanded && expanded !== text) out.push(expanded);
+  }
+  return out;
+}
+function allCandidates(detail, max = 8) {
+  const cands = [detail];
+  cands.push(...decodeBase64Literals(detail));
+  cands.push(...decodeUrlAndNumeric(detail));
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const c of cands) {
+    if (seen.has(c) || c.length > 4096) continue;
+    seen.add(c);
+    out.push(c);
+    if (out.length >= max) break;
+  }
+  return out;
+}
+function matchStageAny(detail, stages) {
+  for (const cand of allCandidates(detail)) {
+    for (const [name, pats] of Object.entries(stages)) {
+      for (const p of pats) {
+        p.lastIndex = 0;
+        if (p.test(cand)) return name;
+      }
+    }
+  }
+  return "";
+}
+var B64_TOKEN_RE;
+var init_decode = __esm({
+  "src/engine/formal-engine/decode.ts"() {
+    "use strict";
+    init_esm_shims();
+    B64_TOKEN_RE = /[A-Za-z0-9+/]+={0,2}/g;
+  }
+});
+
 // src/engine/coordinator.ts
 init_esm_shims();
 init_heuristic();
@@ -3286,7 +3496,7 @@ function loadTemplates() {
 // src/engine/script-analyzer.ts
 init_esm_shims();
 import { readFileSync as readFileSync8 } from "fs";
-import { resolve as resolve6, join as join3 } from "path";
+import { resolve as resolve6, join as join4 } from "path";
 var SUSPICIOUS_PATTERNS = [
   // Network exfiltration (curl/wget POST in scripts is almost never legitimate)
   { name: "curl POST", pattern: /curl\s+(.*\s)?-X\s+POST/i },
@@ -3419,7 +3629,7 @@ function assessKeywordCombinationRisk(matchedKeywords, scriptContent) {
 }
 function readScriptContent(scriptPath, maxLines = 500) {
   try {
-    const expandedPath = scriptPath.startsWith("~") ? join3(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve6(scriptPath);
+    const expandedPath = scriptPath.startsWith("~") ? join4(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve6(scriptPath);
     const raw = readFileSync8(expandedPath, "utf-8");
     const lines = raw.split("\n").slice(0, maxLines);
     return { content: lines.join("\n"), lineCount: lines.length, error: "" };
@@ -3475,8 +3685,8 @@ init_esm_shims();
 init_heuristic();
 init_logic_rules();
 import { statSync as statSync2, existsSync as existsSync9 } from "fs";
-import { resolve as resolve8, join as join5, isAbsolute as isAbsolute2 } from "path";
-import { homedir as homedir3 } from "os";
+import { resolve as resolve8, join as join6, isAbsolute as isAbsolute2 } from "path";
+import { homedir as homedir4 } from "os";
 
 // src/engine/script-engine/tracker.ts
 init_esm_shims();
@@ -5121,7 +5331,7 @@ function extractInlineScriptPath(actionDetail) {
 function resolvePath2(p) {
   let expanded = p;
   if (expanded.startsWith("~/") || expanded === "~") {
-    expanded = join5(homedir3(), expanded.slice(1));
+    expanded = join6(homedir4(), expanded.slice(1));
   }
   return resolve8(expanded);
 }
@@ -5202,7 +5412,7 @@ function analyzeScriptContent2(input) {
     isInline = true;
   }
   if (resolvedPath && !isAbsolute2(resolvedPath) && !resolvedPath.startsWith("~/")) {
-    resolvedPath = join5(input.cwd || process.cwd(), resolvedPath);
+    resolvedPath = join6(input.cwd || process.cwd(), resolvedPath);
   }
   const l1Adapter = (content) => {
     const virtualInput = {
@@ -5513,6 +5723,7 @@ async function analyzeWithLLM(prompt, config) {
 
 // src/engine/coordinator.ts
 init_config();
+init_runtime_config();
 init_agents();
 init_scenarios();
 
@@ -5522,9 +5733,9 @@ init_esm_shims();
 // src/brain/rule-store.ts
 init_esm_shims();
 import { existsSync as existsSync11, readFileSync as readFileSync12, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
-import { join as join6 } from "path";
-import { homedir as homedir4 } from "os";
-var DEFAULT_RULES_PATH = join6(homedir4(), ".agentmoss", "brain", "rules.json");
+import { join as join7 } from "path";
+import { homedir as homedir5 } from "os";
+var DEFAULT_RULES_PATH = join7(homedir5(), ".agentmoss", "brain", "rules.json");
 var ENV_RULES_PATH = "AGENT_MOSS_BRAIN_RULES_PATH";
 var STATUS_DRAFT = "draft";
 var STATUS_APPROVED = "approved";
@@ -6050,98 +6261,132 @@ init_esm_shims();
 // src/engine/formal-engine/builder.ts
 init_esm_shims();
 init_rules_loader();
+init_decode();
 
-// src/engine/formal-engine/decode.ts
+// src/engine/formal-engine/ltl.ts
 init_esm_shims();
-var B64_TOKEN_RE = /[A-Za-z0-9+/]+={0,2}/g;
-function isValidBase64Token(tok) {
-  if (tok.length < 8) return false;
-  if (!(tok.length % 4 === 0 || tok.endsWith("==") || tok.endsWith("="))) return false;
-  return true;
-}
-function isPrintable(s) {
-  for (let i = 0; i < s.length; i++) {
-    const c = s.charCodeAt(i);
-    if (c < 32 || c > 126) return false;
-  }
-  return true;
+init_rules_loader();
+
+// src/engine/formal-engine/ir.ts
+init_esm_shims();
+function allNodes(mg) {
+  const out = [];
+  for (const s of mg.sessions) out.push(...s.nodes);
+  return out;
 }
-function decodeBase64Literals(text) {
+function allEdges(mg) {
   const out = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const m of text.matchAll(B64_TOKEN_RE)) {
-    const tok = m[0];
-    if (!isValidBase64Token(tok)) continue;
-    if (!/[A-Z]/.test(tok) || !/[a-z]/.test(tok)) continue;
-    try {
-      const padded = tok + "=".repeat((4 - tok.length % 4) % 4);
-      const bin = Buffer.from(padded, "base64");
-      const s = bin.toString("utf8");
-      if (s && isPrintable(s) && !seen.has(s)) {
-        seen.add(s);
-        out.push(s);
+  for (const s of mg.sessions) out.push(...s.edges);
+  out.push(...mg.crossEdges);
+  return out;
+}
+function emptyVerificationResult() {
+  return { verified: true, violations: [] };
+}
+
+// src/engine/formal-engine/ltl.ts
+var AP_RE = null;
+function compileAps(apPatterns) {
+  if (AP_RE) return;
+  AP_RE = {};
+  for (const [name, pats] of Object.entries(apPatterns || {})) {
+    AP_RE[name] = pats.map((p) => new RegExp(p, "i"));
+  }
+}
+function labelEvent(actionDetail) {
+  if (!AP_RE) compileAps(loadMC().ap_patterns || {});
+  let candidates = [actionDetail];
+  try {
+    candidates = (init_decode(), __toCommonJS(decode_exports)).allCandidates(actionDetail);
+  } catch {
+  }
+  const hits = /* @__PURE__ */ new Set();
+  for (const [name, pats] of Object.entries(AP_RE || {})) {
+    for (const c of candidates) {
+      const m = pats.some((p) => p.test(c));
+      if (m) {
+        hits.add(name);
+        break;
       }
-    } catch {
     }
   }
-  return out;
+  return hits;
 }
-function decodeUrlAndNumeric(text) {
-  const out = [];
-  let s = text;
-  for (let i = 0; i < 3; i++) {
-    let nxt = s;
-    try {
-      nxt = decodeURIComponent(s);
-    } catch {
-      break;
+function evaluateLTL(formula, trace, pos) {
+  const op = formula[0];
+  switch (op) {
+    case "ap":
+      return trace[pos].has(formula[1]);
+    case "!":
+      return !evaluateLTL(formula[1], trace, pos);
+    case "&":
+      return evaluateLTL(formula[1], trace, pos) && evaluateLTL(formula[2], trace, pos);
+    case "|":
+      return evaluateLTL(formula[1], trace, pos) || evaluateLTL(formula[2], trace, pos);
+    case "->":
+      return !evaluateLTL(formula[1], trace, pos) || evaluateLTL(formula[2], trace, pos);
+    case "X":
+      return pos + 1 < trace.length && evaluateLTL(formula[1], trace, pos + 1);
+    case "G": {
+      for (let j = pos; j < trace.length; j++) {
+        if (!evaluateLTL(formula[1], trace, j)) return false;
+      }
+      return true;
     }
-    if (nxt === s) break;
-    s = nxt;
-  }
-  if (s !== text) out.push(s);
-  if (/\\[0-7]{3}/.test(text)) {
-    let expanded = "";
-    try {
-      expanded = text.replace(/\\[0-7]{3}/g, (m) => String.fromCharCode(parseInt(m.slice(1), 8)));
-    } catch {
+    case "F": {
+      for (let j = pos; j < trace.length; j++) {
+        if (evaluateLTL(formula[1], trace, j)) return true;
+      }
+      return false;
     }
-    if (expanded && expanded !== text) out.push(expanded);
-  }
-  if (/\\x[0-9a-fA-F]{2}/.test(text)) {
-    let expanded = "";
-    try {
-      expanded = text.replace(/\\x[0-9a-fA-F]{2}/g, (m) => String.fromCharCode(parseInt(m.slice(2), 16)));
-    } catch {
+    case "U": {
+      for (let j = pos; j < trace.length; j++) {
+        if (evaluateLTL(formula[2], trace, j)) {
+          for (let k = pos; k < j; k++) {
+            if (!evaluateLTL(formula[1], trace, k)) return false;
+          }
+          return true;
+        }
+      }
+      return false;
     }
-    if (expanded && expanded !== text) out.push(expanded);
+    default:
+      return false;
   }
-  return out;
 }
-function allCandidates(detail, max = 8) {
-  const cands = [detail];
-  cands.push(...decodeBase64Literals(detail));
-  cands.push(...decodeUrlAndNumeric(detail));
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const c of cands) {
-    if (seen.has(c) || c.length > 4096) continue;
-    seen.add(c);
-    out.push(c);
-    if (out.length >= max) break;
+function ruleViolates(rule, traceWith, witnessMode) {
+  const formula = rule?.formula;
+  if (!Array.isArray(formula) || formula.length === 0) return false;
+  const satWith = evaluateLTL(formula, traceWith, 0);
+  if (!satWith) return false;
+  if (witnessMode && traceWith.length > 1) {
+    const traceWithout = traceWith.slice(0, -1);
+    if (evaluateLTL(formula, traceWithout, 0)) return false;
   }
-  return out;
+  return true;
 }
-function matchStageAny(detail, stages) {
-  for (const cand of allCandidates(detail)) {
-    for (const [name, pats] of Object.entries(stages)) {
-      for (const p of pats) {
-        p.lastIndex = 0;
-        if (p.test(cand)) return name;
-      }
+function checkMCRules(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length === 0) return violations;
+  const mc = loadMC();
+  const rules = mc.rules || [];
+  if (rules.length === 0) return violations;
+  const trace = nodes.map((n) => labelEvent(n.actionDetail));
+  const witnessMode = graph.witnessIdx !== void 0;
+  for (const rule of rules) {
+    if (rule?.type !== "ltl" || !(rule.enabled !== false)) continue;
+    if (ruleViolates(rule, trace, witnessMode)) {
+      violations.push({
+        propertyId: String(rule.id || "mc-ltl"),
+        reason: String(rule.reason || "L2.2 \u6A21\u578B\u68C0\u6D4B\u89C4\u5219\u547D\u4E2D"),
+        riskLevel: String(rule.risk_level || "high"),
+        path: nodes.filter((n) => labelEvent(n.actionDetail).size > 0).slice(-3).map((n) => ({ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }))
+      });
+      if (witnessMode) return violations;
     }
   }
-  return "";
+  return violations;
 }
 
 // src/engine/formal-engine/builder.ts
@@ -6172,6 +6417,26 @@ function extractResources(actionDetail) {
 function markStage(actionDetail) {
   return matchStageAny(actionDetail, loadStages());
 }
+function markIntegrity(actionDetail) {
+  const aps = labelEvent(actionDetail);
+  if (aps.has("download_file") || aps.has("prompt_injection")) {
+    return { integrity: "low", isLowSource: true };
+  }
+  return { integrity: "medium", isLowSource: false };
+}
+function initNode(sessionId, seq, actionType, actionDetail) {
+  const { integrity, isLowSource } = markIntegrity(actionDetail);
+  return {
+    sessionId,
+    seq,
+    actionType,
+    actionDetail,
+    stage: markStage(actionDetail),
+    resources: extractResources(actionDetail),
+    integrity,
+    isLowSource
+  };
+}
 function buildSessionGraph(actionHistory, aNext, sessionId = "current") {
   const nodes = [];
   const edges = [];
@@ -6185,17 +6450,9 @@ function buildSessionGraph(actionHistory, aNext, sessionId = "current") {
     details.push({ actionType: String(aNext.actionType || ""), actionDetail: String(aNext.actionDetail || "") });
   }
   details.forEach((d, seq) => {
-    const stage = markStage(d.actionDetail);
-    const node = {
-      sessionId,
-      seq,
-      actionType: d.actionType,
-      actionDetail: d.actionDetail,
-      stage,
-      resources: extractResources(d.actionDetail)
-    };
+    const node = initNode(sessionId, seq, d.actionType, d.actionDetail);
     nodes.push(node);
-    if (stage) stageFlags.add(stage);
+    if (node.stage) stageFlags.add(node.stage);
   });
   for (let i = 0; i < nodes.length - 1; i++) {
     edges.push({ src: i, dst: i + 1, kind: "next" });
@@ -6215,15 +6472,12 @@ function buildMultiSessionGraph(sessions, aNext) {
   if (aNext) {
     const last = mg.sessions[mg.sessions.length - 1];
     if (last.sessionId === "current") {
-      const stage = markStage(String(aNext.actionDetail || ""));
-      last.nodes.push({
-        sessionId: last.sessionId,
-        seq: last.nodes.length,
-        actionType: String(aNext.actionType || ""),
-        actionDetail: String(aNext.actionDetail || ""),
-        stage,
-        resources: extractResources(String(aNext.actionDetail || ""))
-      });
+      last.nodes.push(initNode(
+        last.sessionId,
+        last.nodes.length,
+        String(aNext.actionType || ""),
+        String(aNext.actionDetail || "")
+      ));
       if (last.nodes.length > 1) {
         last.edges.push({ src: last.nodes.length - 2, dst: last.nodes.length - 1, kind: "next" });
       }
@@ -6237,11 +6491,25 @@ function buildMultiSessionGraph(sessions, aNext) {
 function addCrossDataEdges(mg) {
   const nodes = allNodesFlat(mg);
   if (nodes.length < 2) return;
-  for (let i = 0; i < nodes.length; i++) {
-    for (let j = i + 1; j < nodes.length; j++) {
-      if (nodes[i].sessionId === nodes[j].sessionId) continue;
-      const shared = intersect(nodes[i].resources, nodes[j].resources);
-      if (shared.size > 0) {
+  const resIndex = /* @__PURE__ */ new Map();
+  nodes.forEach((n, i) => {
+    for (const r of n.resources) {
+      const list = resIndex.get(r);
+      if (list) list.push(i);
+      else resIndex.set(r, [i]);
+    }
+  });
+  const seen = /* @__PURE__ */ new Set();
+  for (const idxs of resIndex.values()) {
+    if (idxs.length < 2) continue;
+    for (let a = 0; a < idxs.length; a++) {
+      const i = idxs[a];
+      for (let b = a + 1; b < idxs.length; b++) {
+        const j = idxs[b];
+        if (nodes[i].sessionId === nodes[j].sessionId) continue;
+        const key = `${i}:${j}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
         mg.crossEdges.push({ src: i, dst: j, kind: "data" });
       }
     }
@@ -6252,28 +6520,6 @@ function allNodesFlat(mg) {
   for (const s of mg.sessions) out.push(...s.nodes);
   return out;
 }
-function intersect(a, b) {
-  const out = /* @__PURE__ */ new Set();
-  for (const v of a) if (b.has(v)) out.add(v);
-  return out;
-}
-
-// src/engine/formal-engine/ir.ts
-init_esm_shims();
-function allNodes(mg) {
-  const out = [];
-  for (const s of mg.sessions) out.push(...s.nodes);
-  return out;
-}
-function allEdges(mg) {
-  const out = [];
-  for (const s of mg.sessions) out.push(...s.edges);
-  out.push(...mg.crossEdges);
-  return out;
-}
-function emptyVerificationResult() {
-  return { verified: true, violations: [] };
-}
 
 // src/engine/formal-engine/properties.ts
 init_esm_shims();
@@ -6296,27 +6542,50 @@ function checkCrossSessionChain(graph) {
   const violations = [];
   const nodes = allNodes(graph);
   if (nodes.length === 0) return violations;
+  const witness = graph.witnessIdx;
   for (const chain of loadCrossSessionChains()) {
     const stages = chain.stages;
     if (!stages.length) continue;
-    let matched = 0;
-    let stageIdx = 0;
-    const path5 = [];
-    for (const n of nodes) {
-      if (stageIdx < stages.length && n.stage === stages[stageIdx]) {
-        matched += 1;
-        path5.push({ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) });
-        stageIdx += 1;
-        if (matched >= stages.length) break;
+    if (witness !== void 0) {
+      if (nodes[witness].stage !== stages[stages.length - 1]) continue;
+      let matched = 0;
+      const path5 = [];
+      for (let k = 0; k < witness; k++) {
+        const n = nodes[k];
+        if (matched < stages.length - 1 && n.stage === stages[matched]) {
+          matched += 1;
+          path5.push({ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) });
+        }
       }
-    }
-    if (matched >= stages.length) {
+      if (matched < stages.length - 1) continue;
+      path5.push({ sessionId: nodes[witness].sessionId, seq: nodes[witness].seq, detail: nodes[witness].actionDetail.slice(0, 60) });
       violations.push({
         propertyId: "cross-" + chain.id,
         reason: chain.reason,
         riskLevel: chain.riskLevel,
         path: path5
       });
+      return violations;
+    } else {
+      let matched = 0;
+      let stageIdx = 0;
+      const path5 = [];
+      for (const n of nodes) {
+        if (stageIdx < stages.length && n.stage === stages[stageIdx]) {
+          matched += 1;
+          path5.push({ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) });
+          stageIdx += 1;
+          if (matched >= stages.length) break;
+        }
+      }
+      if (matched >= stages.length) {
+        violations.push({
+          propertyId: "cross-" + chain.id,
+          reason: chain.reason,
+          riskLevel: chain.riskLevel,
+          path: path5
+        });
+      }
     }
   }
   return violations;
@@ -6351,7 +6620,10 @@ function checkSensitiveDataFlow(graph) {
       }
     }
   }
-  for (const [i, n] of nodes.entries()) {
+  const witness = graph.witnessIdx;
+  const candidates = witness !== void 0 ? [witness] : nodes.map((_, i) => i);
+  for (const i of candidates) {
+    const n = nodes[i];
     if (tainted.has(i) && EXFIL_RE.test(n.actionDetail)) {
       violations.push({
         propertyId: "sensitive-data-exfil",
@@ -6359,6 +6631,7 @@ function checkSensitiveDataFlow(graph) {
         riskLevel: "critical",
         path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
       });
+      if (witness !== void 0) return violations;
     }
   }
   return violations;
@@ -6389,6 +6662,32 @@ function checkNeverExfilAfterPrivesc(graph) {
   const violations = [];
   const nodes = allNodes(graph);
   if (nodes.length < 2) return violations;
+  const witness = graph.witnessIdx;
+  if (witness !== void 0) {
+    const evIdx = [];
+    nodes.forEach((n, i) => {
+      if ((i === witness || n.sessionId === "ebpf-evidence") && isExfilNode(n)) evIdx.push(i);
+    });
+    if (evIdx.length === 0) return violations;
+    const firstEv = Math.min(...evIdx);
+    let pre = null;
+    for (let i = 0; i < firstEv; i++) {
+      if (isPrivescNode(nodes[i])) pre = nodes[i];
+    }
+    if (pre) {
+      const post = nodes[firstEv];
+      return [{
+        propertyId: "no-privesc-then-exfil",
+        reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\xAC\u25C7EXFIL)",
+        riskLevel: "critical",
+        path: [
+          { sessionId: pre.sessionId, seq: pre.seq, detail: pre.actionDetail.slice(0, 60) },
+          { sessionId: post.sessionId, seq: post.seq, detail: post.actionDetail.slice(0, 60) }
+        ]
+      }];
+    }
+    return violations;
+  }
   for (let i = 0; i < nodes.length; i++) {
     if (!isPrivescNode(nodes[i])) continue;
     for (let j = i + 1; j < nodes.length; j++) {
@@ -6412,6 +6711,32 @@ function checkNeverExfilAfterCred(graph) {
   const violations = [];
   const nodes = allNodes(graph);
   if (nodes.length < 2) return violations;
+  const witness = graph.witnessIdx;
+  if (witness !== void 0) {
+    const evIdx = [];
+    nodes.forEach((n, i) => {
+      if ((i === witness || n.sessionId === "ebpf-evidence") && isExfilNode(n)) evIdx.push(i);
+    });
+    if (evIdx.length === 0) return violations;
+    const firstEv = Math.min(...evIdx);
+    let pre = null;
+    for (let i = 0; i < firstEv; i++) {
+      if (isCredNode(nodes[i])) pre = nodes[i];
+    }
+    if (pre) {
+      const post = nodes[firstEv];
+      return [{
+        propertyId: "no-cred-then-exfil",
+        reason: "\u8BFB\u53D6\u51ED\u636E\u540E\u51FA\u73B0\u5916\u4F20\uFF0C\u8FDD\u53CD \u25A1(CRED\u2192\xAC\u25C7EXFIL)",
+        riskLevel: "critical",
+        path: [
+          { sessionId: pre.sessionId, seq: pre.seq, detail: pre.actionDetail.slice(0, 60) },
+          { sessionId: post.sessionId, seq: post.seq, detail: post.actionDetail.slice(0, 60) }
+        ]
+      }];
+    }
+    return violations;
+  }
   for (let i = 0; i < nodes.length; i++) {
     if (!isCredNode(nodes[i])) continue;
     for (let j = i + 1; j < nodes.length; j++) {
@@ -6431,11 +6756,172 @@ function checkNeverExfilAfterCred(graph) {
   }
   return violations;
 }
+var TOOL_REGISTRY = null;
+function getToolRegistry() {
+  if (TOOL_REGISTRY) return TOOL_REGISTRY;
+  TOOL_REGISTRY = loadToolRegistry().tools || {};
+  return TOOL_REGISTRY;
+}
+function lookupToolClass(actionType) {
+  const entry = getToolRegistry()[actionType] || {};
+  return entry.actionClass;
+}
+var COMPUTE_RE = /subprocess|os\.system|shell\s*=\s*True|\beval\(|\bexec\(|bash\s+[^\s]|sh\s+-c|python3?\s+|node\s+|\btimeout\s+|nohup\s+|\b\.\/[\w./-]+/i;
+var STRONG_COMPUTE_TYPES = /* @__PURE__ */ new Set(["python", "node", "exec", "terminal", "cmd"]);
+function isComputeNode(n) {
+  if (STRONG_COMPUTE_TYPES.has(n.actionType.toLowerCase())) return true;
+  const cls = lookupToolClass(n.actionType);
+  if (cls === "read" || cls === "write" || cls === "network_egress" || cls === "message_egress") return false;
+  return COMPUTE_RE.test(n.actionDetail);
+}
+function checkLowIntegrityCommandExec(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length === 0) return violations;
+  const witness = graph.witnessIdx;
+  const lowResources = /* @__PURE__ */ new Set();
+  const lowAt = /* @__PURE__ */ new Map();
+  nodes.forEach((n, i) => {
+    if (n.isLowSource) {
+      lowAt.set(i, n.actionDetail.slice(0, 60));
+      for (const r of n.resources) lowResources.add(r);
+    }
+  });
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (let i = 0; i < nodes.length; i++) {
+      if (lowAt.has(i)) continue;
+      let shared = "";
+      for (const r of nodes[i].resources) {
+        if (lowResources.has(r)) {
+          shared = r;
+          break;
+        }
+      }
+      if (shared) {
+        lowAt.set(i, `\u7EE7\u627F\u81EA ${shared}`);
+        for (const r of nodes[i].resources) lowResources.add(r);
+        changed = true;
+      }
+    }
+  }
+  if (lowAt.size === 0) return violations;
+  const candidates = witness !== void 0 ? [witness] : nodes.map((_, i) => i);
+  for (const i of candidates) {
+    const n = nodes[i];
+    if (lowAt.has(i) && isComputeNode(n)) {
+      violations.push({
+        propertyId: "low-integrity-controls-command-exec",
+        reason: `\u4F4E\u5B8C\u6574\u6027\u6570\u636E\u63A7\u5236\u547D\u4EE4\u6267\u884C\uFF1A${lowAt.get(i)} \u2192 ${n.sessionId}#${n.seq} \u6267\u884C\u4E0D\u53EF\u4FE1\u5185\u5BB9`,
+        riskLevel: "critical",
+        path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
+      });
+      if (witness !== void 0) return violations;
+    }
+  }
+  return violations;
+}
+var DL_OR_LOW_RE = /curl\s+.*-o\b|wget\s+.*\s+-O\b|curl\s+.*\|\s*(bash|sh|python)|wget\s+.*\|\s*(bash|sh|python)|git\s+clone|docker\s+pull|pip\s+install|npm\s+install|base64\s+-d/i;
+function checkCrossSessionReachability(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length === 0) return violations;
+  const witness = graph.witnessIdx;
+  const sources = /* @__PURE__ */ new Set();
+  nodes.forEach((n, i) => {
+    if (n.isLowSource || DL_OR_LOW_RE.test(n.actionDetail)) sources.add(i);
+  });
+  if (sources.size === 0) return violations;
+  const reached = new Set(sources);
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const e of allEdges(graph)) {
+      if (reached.has(e.src) && !reached.has(e.dst)) {
+        const srcRes = nodes[e.src].resources;
+        const dstRes = nodes[e.dst].resources;
+        for (const r of srcRes) {
+          if (dstRes.has(r)) {
+            reached.add(e.dst);
+            changed = true;
+            break;
+          }
+        }
+      }
+    }
+  }
+  const candidates = witness !== void 0 ? [witness] : nodes.map((_, i) => i);
+  for (const i of candidates) {
+    const n = nodes[i];
+    if (sources.has(i)) continue;
+    if (reached.has(i)) {
+      const srcIdx = Math.min(...sources);
+      const srcDesc = nodes[srcIdx].actionDetail.slice(0, 40);
+      violations.push({
+        propertyId: "cross-session-reachability",
+        reason: `\u4F4E\u5B8C\u6574\u6027\u6E90\u7ECF\u8DE8 session \u6570\u636E\u94FE\u591A\u8DF3\u5230\u8FBE\u5F53\u524D\u6267\u884C\uFF08\u6E90: ${srcDesc} \u2192 ${n.sessionId}#${n.seq}\uFF09`,
+        riskLevel: "high",
+        path: nodes.slice(-3).map((m) => ({ sessionId: m.sessionId, seq: m.seq, detail: m.actionDetail.slice(0, 60) }))
+      });
+      if (witness !== void 0) return violations;
+    }
+  }
+  return violations;
+}
+function checkSensitiveDataAggregation(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length < 2) return violations;
+  const witness = graph.witnessIdx;
+  const resIndex = /* @__PURE__ */ new Map();
+  nodes.forEach((n, i) => {
+    for (const r of n.resources) {
+      const list = resIndex.get(r);
+      if (list) list.push(i);
+      else resIndex.set(r, [i]);
+    }
+  });
+  const sourcesFor = (exfilIdx) => {
+    const srcs = /* @__PURE__ */ new Set();
+    const n = nodes[exfilIdx];
+    for (const r of n.resources) {
+      for (const j of resIndex.get(r) || []) {
+        if (j === exfilIdx) continue;
+        srcs.add(`${nodes[j].sessionId}#${nodes[j].seq}`);
+      }
+    }
+    return srcs;
+  };
+  const candidates = witness !== void 0 ? [witness] : nodes.map((_, i) => i);
+  for (const i of candidates) {
+    const n = nodes[i];
+    if (!isExfilNode(n)) continue;
+    const srcs = sourcesFor(i);
+    if (srcs.size >= 2) {
+      violations.push({
+        propertyId: "sensitive-data-aggregation",
+        reason: `\u654F\u611F\u6570\u636E\u805A\u5408\u5916\u4F20\uFF1Aegress \u805A\u5408 ${srcs.size} \u4E2A\u4E8B\u4EF6\u6E90\u6570\u636E\uFF08Rule 12\uFF09`,
+        riskLevel: "critical",
+        path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
+      });
+      if (witness !== void 0) return violations;
+    }
+  }
+  return violations;
+}
 var ALL_PROPERTIES = [
   { id: "cross-session-chain", check: checkCrossSessionChain },
   { id: "sensitive-data-flow", check: checkSensitiveDataFlow },
+  { id: "cross-session-reachability", check: checkCrossSessionReachability },
   { id: "no-privesc-then-exfil", check: checkNeverExfilAfterPrivesc },
-  { id: "no-cred-then-exfil", check: checkNeverExfilAfterCred }
+  { id: "no-cred-then-exfil", check: checkNeverExfilAfterCred },
+  // L2.2 模型检测（通用 LTL 求值器，mc_rules.json 单一事实源；witness 语义见 ltl.ts）
+  { id: "mc-ltl-rules", check: checkMCRules },
+  // Rule 5 低完整性控制命令执行（integrity 维度，站点 L2.1 最有区分度的检测之一）
+  { id: "low-integrity-command-exec", check: checkLowIntegrityCommandExec },
+  // Rule 12 敏感数据聚合外传（egress 聚合 ≥2 事件源）
+  { id: "sensitive-data-aggregation", check: checkSensitiveDataAggregation }
 ];
 
 // src/engine/formal-engine/engine.ts
@@ -6467,6 +6953,9 @@ var FormalEngine = class {
       });
     }
     const graph = buildMultiSessionGraph(all, aNext);
+    if (aNext) {
+      graph.witnessIdx = allNodes(graph).length - 1;
+    }
     const result = emptyVerificationResult();
     for (const prop of this.properties) {
       let violations;
@@ -6495,6 +6984,7 @@ var FormalEngine = class {
 // src/engine/formal-engine/stateful.ts
 init_esm_shims();
 init_rules_loader();
+init_decode();
 
 // src/engine/formal-engine/chain_state.ts
 init_esm_shims();
@@ -6607,6 +7097,7 @@ function _resetBrainForTest() {
 }
 var formalEngine = new FormalEngine();
 async function runAnalysis(input) {
+  const observedFormalLayers = [];
   const heuristicResult = isHeuristicEnabled() ? runHeuristicCheck(input) : null;
   const isInlineScriptCmd = isInlineScriptCommand(input.aNext.actionDetail.toLowerCase());
   const isLiteralTextCmd = isLiteralTextCommand(input.aNext.actionDetail.toLowerCase());
@@ -6661,8 +7152,8 @@ async function runAnalysis(input) {
   const rawDetail = extractRawCommand(input.aNext.actionDetail);
   const lowerDetail = rawDetail.toLowerCase();
   const agentExt = mergeAgentExtensions(
-    getAgentExtensions(input.agentId),
-    getScenarioExtensions(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "")
+    isLayerEnabled("agent_rules_enabled") ? getAgentExtensions(input.agentId) : null,
+    isLayerEnabled("scenario_rules_enabled") ? getScenarioExtensionsMulti(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "") : null
   );
   if (FULLY_SAFE_TOOLS.has(actionType)) {
     return {
@@ -6779,15 +7270,22 @@ async function runAnalysis(input) {
     const formalResult = formalEngine.verify(formalSessions, input.aNext);
     if (!formalResult.verified) {
       const v = formalResult.violations[0];
-      return {
-        allowed: false,
-        reason: v ? v.reason : "\u5F62\u5F0F\u5316\u9A8C\u8BC1\u672A\u901A\u8FC7\uFF08\u884C\u4E3A\u6027\u8D28\u8FDD\u53CD\uFF09",
-        riskLevel: v ? v.riskLevel : "high",
-        riskType: "formal_verification",
-        confidence: 90,
-        source: "formal_engine",
-        violatedLayers: ["2.4"]
-      };
+      if (isFormalObserveMode()) {
+        console.warn(
+          `[AgentMoss] \u5F62\u5F0F\u5316\u9A8C\u8BC1 observe\uFF08\u53EA\u8BB0\u5F55\u4E0D\u62E6\u622A\uFF09: property=${v?.propertyId ?? "?"} risk=${v?.riskLevel ?? "?"} path_len=${v?.path?.length ?? 0} reason=${(v?.reason ?? "?").slice(0, 200)}`
+        );
+        observedFormalLayers.push("2.4");
+      } else {
+        return {
+          allowed: false,
+          reason: v ? v.reason : "\u5F62\u5F0F\u5316\u9A8C\u8BC1\u672A\u901A\u8FC7\uFF08\u884C\u4E3A\u6027\u8D28\u8FDD\u53CD\uFF09",
+          riskLevel: v ? v.riskLevel : "high",
+          riskType: "formal_verification",
+          confidence: 90,
+          source: "formal_engine",
+          violatedLayers: ["2.4"]
+        };
+      }
     }
   }
   if (scriptChain && scriptChain.nodes.length > 0 && isLogicRulesEnabled()) {
@@ -6834,7 +7332,7 @@ async function runAnalysis(input) {
       riskType: "",
       confidence: 85,
       source: "heuristic_and_logic_only",
-      violatedLayers: []
+      violatedLayers: observedFormalLayers.length > 0 ? [...observedFormalLayers] : []
     };
   }
   let skipL3Hints = "\u65E0\uFF08\u5F53\u524D\u65E0\u7981\u7528\u89C4\u5219\u547D\u4E2D\uFF09";
@@ -6879,7 +7377,7 @@ async function runAnalysis(input) {
         riskType: "",
         confidence: 50,
         source: "llm_failure_fallback",
-        violatedLayers: []
+        violatedLayers: observedFormalLayers.length > 0 ? [...observedFormalLayers] : []
       };
     }
     return {
@@ -6906,6 +7404,9 @@ async function runAnalysis(input) {
     } catch {
     }
   }
+  if (observedFormalLayers.length > 0 && llmResult.allowed) {
+    llmResult.violatedLayers = Array.from(/* @__PURE__ */ new Set([...observedFormalLayers, ...llmResult.violatedLayers || []]));
+  }
   return llmResult;
 }
 export {
@@ -6913,4 +7414,7 @@ export {
   _resetBrainForTest,
   runAnalysis
 };
+//! 顺序即 fail-closed 短路优先级：verify 逐个执行，首个返回违规的性质成为
+//! first_violation，后续不再评估。调整顺序影响判定归属，须与 Python
+//! properties.py ALL_PROPERTIES 保持一致并双端测试确认。
 //# sourceMappingURL=coordinator.js.map