@kenhkl/agent-moss 0.12.9 → 0.13.0

package/dist/cli.js

@@ -138,6 +138,7 @@ __export(config_exports, {
   getRetryConfig: () => getRetryConfig,
   getTimeoutConfig: () => getTimeoutConfig,
   isBrainEnabled: () => isBrainEnabled,
+  isFormalObserveMode: () => isFormalObserveMode,
   isHeuristicEnabled: () => isHeuristicEnabled,
   isLLMAvailable: () => isLLMAvailable,
   isLogicRulesEnabled: () => isLogicRulesEnabled,
@@ -253,6 +254,7 @@ function getCustomRules() {
 }
 function isLLMAvailable() {
   if (process.env.AGENT_MOSS_DISABLE_LLM === "1") return false;
+  if (!layerEnabledOrDefault("L3_llm_analysis")) return false;
   return llmConfig.apiKey.length > 0;
 }
 async function probeLLMConnection(timeoutMs = 8e3) {
@@ -317,13 +319,26 @@ function getProviderHeaders(provider) {
   return PROVIDER_HEADERS[provider] || {};
 }
 function isHeuristicEnabled() {
-  return process.env.AGENT_MOSS_DISABLE_HEURISTIC !== "1";
+  if (process.env.AGENT_MOSS_DISABLE_HEURISTIC === "1") return false;
+  return layerEnabledOrDefault("L1_heuristic");
+}
+function layerEnabledOrDefault(key) {
+  try {
+    const { isLayerEnabled: isLayerEnabled2 } = __require("../infra/runtime-config");
+    return isLayerEnabled2(key);
+  } catch {
+    return true;
+  }
 }
 function isBrainEnabled() {
   return process.env.AGENT_MOSS_BRAIN_ENABLED === "1";
 }
 function isLogicRulesEnabled() {
-  return process.env.AGENT_MOSS_DISABLE_LOGIC_RULES !== "1";
+  if (process.env.AGENT_MOSS_DISABLE_LOGIC_RULES === "1") return false;
+  return layerEnabledOrDefault("L2_logic_rules");
+}
+function isFormalObserveMode() {
+  return process.env.AGENT_MOSS_FORMAL_OBSERVE === "1";
 }
 var timeoutConfig, retryConfig, llmConfig, __configModuleDir, USER_RULES_PATHS, customRules, PROVIDER_HEADERS;
 var init_config = __esm({
@@ -581,8 +596,12 @@ var init_inline_analyzer = __esm({
 
 // src/infra/rules-loader.ts
 import { readFileSync as readFileSync2, existsSync } from "fs";
-import { resolve, dirname } from "path";
+import { resolve, dirname, join as join2 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
+import { homedir as homedir2 } from "os";
+function dataRootDir() {
+  return process.env.AGENT_MOSS_DATA_DIR || join2(homedir2(), ".config", "agentmoss");
+}
 function findRulesFile(name) {
   for (const dir of RULES_DIR_CANDS) {
     const p = resolve(dir, name);
@@ -608,6 +627,24 @@ function loadL2() {
 function loadL3() {
   return loadJson("l3_rules.json");
 }
+function loadMC() {
+  const mc = loadJson("mc_rules.json");
+  const rules = mc.rules || [];
+  try {
+    const rt = (init_runtime_config(), __toCommonJS(runtime_config_exports));
+    if (rules.length > 0 && typeof rt.hasRuntimeConfig === "function" && rt.hasRuntimeConfig()) {
+      const rtRules = rt.loadRuntimeConfig()?.L2_4?.ltl_rules?.rules || [];
+      const enabledById = {};
+      for (const r of rtRules) if (r?.id) enabledById[r.id] = r.enabled !== false;
+      for (const r of rules) if (r?.id && r.id in enabledById) r.enabled = enabledById[r.id];
+    }
+  } catch {
+  }
+  return mc;
+}
+function loadToolRegistry() {
+  return loadJson("tool_registry.json");
+}
 var __filename2, __dirname2, RULES_DIR_CANDS;
 var init_rules_loader = __esm({
   "src/infra/rules-loader.ts"() {
@@ -617,6 +654,10 @@ var init_rules_loader = __esm({
     __dirname2 = dirname(__filename2);
     RULES_DIR_CANDS = (() => {
       const cands = [
+        // 用户数据目录覆盖优先（与 Python rules_loader._load_json 的
+        // <data_root>/rules/<name> 优先逻辑对齐）。用户安装 pip/npm 包后把自定义
+        // mc_rules.json 放到 <data_root>/rules/ 即可覆盖内置默认，无需改源码。
+        resolve(dataRootDir(), "rules"),
         // dist: __dirname=dist/ → dist/rules；__dirname=dist/engine/ → dist/engine/../rules=dist/rules
         resolve(__dirname2, "../rules"),
         resolve(__dirname2, "rules"),
@@ -1354,6 +1395,7 @@ var init_skill_loader = __esm({
 // src/infra/runtime-config.ts
 var runtime_config_exports = {};
 __export(runtime_config_exports, {
+  DEFAULT_LAYERS: () => DEFAULT_LAYERS,
   DENY_MODE_LABELS: () => DENY_MODE_LABELS,
   addAgentRule: () => addAgentRule,
   addCustomRule: () => addCustomRule,
@@ -1405,7 +1447,7 @@ __export(runtime_config_exports, {
   updateSkillEnabled: () => updateSkillEnabled
 });
 import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync4, mkdirSync, unlinkSync, readdirSync as readdirSync3 } from "fs";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import { dirname as dirname3 } from "path";
 function runtimeDir() {
@@ -1429,6 +1471,7 @@ function emptyRuntimeConfig() {
     L1_rules: {},
     L2_rules: {},
     L3_skills: {},
+    L2_4: {},
     agent_rules: {},
     scenario_rules: {}
   };
@@ -1456,6 +1499,7 @@ function loadRuntimeConfig() {
       L1_rules: merged.L1_rules || {},
       L2_rules: merged.L2_rules || {},
       L3_skills: merged.L3_skills || {},
+      L2_4: merged.L2_4 || {},
       agent_rules: merged.agent_rules || {},
       scenario_rules: merged.scenario_rules || {}
     };
@@ -1703,7 +1747,7 @@ function _scenarioRulesToDefaults() {
     return out;
   }
   for (const scenarioId of entries) {
-    const rulesFile = join2(scenDir, scenarioId, "rules.json");
+    const rulesFile = join3(scenDir, scenarioId, "rules.json");
     if (!existsSync4(rulesFile)) continue;
     let data;
     try {
@@ -1752,7 +1796,7 @@ function _agentRulesToDefaults() {
     return out;
   }
   for (const agentId of entries) {
-    const rulesFile = join2(agentsDir, agentId, "rules.json");
+    const rulesFile = join3(agentsDir, agentId, "rules.json");
     if (!existsSync4(rulesFile)) continue;
     let data;
     try {
@@ -1793,7 +1837,7 @@ function _agentRulesToDefaults() {
 function generateSourceDefaults() {
   return {
     version: 1,
-    layers: { L1_heuristic: true, L2_logic_rules: true, L3_llm_analysis: true },
+    layers: { ...DEFAULT_LAYERS },
     L1_rules: {
       dangerous_commands: {
         category_enabled: true,
@@ -1832,10 +1876,45 @@ function generateSourceDefaults() {
       user_custom: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49 L2 \u903B\u8F91\u89C4\u5219", rules: [] }
     },
     L3_skills: _l3SkillsToRules(),
+    L2_4: _ltlRulesToRuntime(),
     agent_rules: _agentRulesToDefaults(),
     scenario_rules: _scenarioRulesToDefaults()
   };
 }
+function _ltlRulesToRuntime() {
+  const cands = [
+    join3(__dirname4, "..", "rules"),
+    join3(__dirname4, "..", "..", "..", "agent_moss", "rules"),
+    join3(process.cwd(), "agent_moss", "rules")
+  ];
+  let mc = {};
+  for (const dir of cands) {
+    const p = join3(dir, "mc_rules.json");
+    if (existsSync4(p)) {
+      try {
+        mc = JSON.parse(readFileSync4(p, "utf-8")) || {};
+      } catch {
+        mc = {};
+      }
+      break;
+    }
+  }
+  const rules = mc.rules || [];
+  return {
+    ltl_rules: {
+      category_enabled: true,
+      category_desc: "LTL \u653B\u51FB\u6A21\u5F0F\u89C4\u5219\uFF08\u65F6\u5E8F\u653B\u51FB\u68C0\u6D4B\uFF0C\u5148 A \u540E B\uFF09",
+      rules: rules.map((r) => ({
+        id: r.id,
+        reason: r.reason || "",
+        risk_level: r.risk_level || "high",
+        action: r.action || "block",
+        enabled: true,
+        builtin: true
+      }))
+    }
+  };
+}
 function normalizePatternForFingerprint(pattern) {
   return pattern.replace(/\\\//g, "/");
 }
@@ -1985,6 +2064,7 @@ function mergeConfig(userCfg, srcDefaults) {
   );
   _mergeRuleCategories(cfg, srcDefaults, "L1_rules");
   _mergeRuleCategories(cfg, srcDefaults, "L2_rules");
+  _mergeRuleCategories(cfg, srcDefaults, "L2_4");
   _mergeSkillCategories(cfg, srcDefaults, "L3_skills");
   _mergeAgentRules(cfg, srcDefaults);
   _mergeAgentRules(cfg, srcDefaults, "scenario_rules");
@@ -2177,12 +2257,12 @@ function deleteCustomRule(layer, category, ruleId) {
 function addCustomSkill(skillId, category, keywords, content) {
   _validateSkillId(skillId);
   const runtime = loadRuntimeConfig();
-  const skillsDir = join2(RUNTIME_CONFIG_DIR, "agent_moss_skills");
+  const skillsDir = join3(RUNTIME_CONFIG_DIR, "agent_moss_skills");
   try {
     mkdirSync(skillsDir, { recursive: true });
   } catch {
   }
-  writeFileSync(join2(skillsDir, `${skillId}.md`), content, "utf-8");
+  writeFileSync(join3(skillsDir, `${skillId}.md`), content, "utf-8");
   const l3 = runtime.L3_skills || (runtime.L3_skills = {});
   const cat = l3[category] || (l3[category] = { category_enabled: true, category_desc: "", skills: [] });
   (cat.skills || (cat.skills = [])).push({ id: skillId, keywords, enabled: true, builtin: false });
@@ -2197,7 +2277,7 @@ function deleteCustomSkill(skillId, category) {
   if (idx >= 0) {
     if (skills[idx].builtin) return null;
     skills.splice(idx, 1);
-    const skillPath = join2(RUNTIME_CONFIG_DIR, "agent_moss_skills", `${skillId}.md`);
+    const skillPath = join3(RUNTIME_CONFIG_DIR, "agent_moss_skills", `${skillId}.md`);
     try {
       if (existsSync4(skillPath)) unlinkSync(skillPath);
     } catch {
@@ -2391,7 +2471,7 @@ function updateScenarioCategoryEnabled(scenarioId, category, enabled) {
   saveRuntimeConfig(runtime);
   return runtime;
 }
-var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DENY_MODE_LABELS, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, SKILL_ID_RE;
+var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DEFAULT_LAYERS, DENY_MODE_LABELS, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, SKILL_ID_RE;
 var init_runtime_config = __esm({
   "src/infra/runtime-config.ts"() {
     "use strict";
@@ -2403,21 +2483,28 @@ var init_runtime_config = __esm({
     __dirname4 = dirname3(fileURLToPath5(import.meta.url));
     ENV_RUNTIME_CONFIG_PATH = "AGENT_MOSS_RUNTIME_CONFIG_PATH";
     RUNTIME_CONFIG_DIR = runtimeDir();
-    RUNTIME_CONFIG_PATH = join2(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
+    RUNTIME_CONFIG_PATH = join3(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
     LAYER_DISABLE_ENV = {
       L1_heuristic: "AGENT_MOSS_DISABLE_HEURISTIC",
       L2_logic_rules: "AGENT_MOSS_DISABLE_LOGIC_RULES",
       L3_llm_analysis: "AGENT_MOSS_DISABLE_LLM"
     };
+    DEFAULT_LAYERS = {
+      L1_heuristic: true,
+      L2_logic_rules: true,
+      L3_llm_analysis: true,
+      agent_rules_enabled: true,
+      scenario_rules_enabled: true
+    };
     DENY_MODE_LABELS = {
       deny_write: "\u4EC5\u62E6\u622A\u5199\u5165",
       deny_read: "\u4EC5\u62E6\u622A\u8BFB\u53D6",
       deny_both: "\u8BFB\u5199\u5747\u62E6\u622A"
     };
-    _AGENTS_DIR_PROD = join2(__dirname4, "agents");
-    _AGENTS_DIR_DEV = join2(__dirname4, "..", "..", "..", "agent_moss", "agents");
-    _SCENARIOS_DIR_PROD = join2(__dirname4, "scenarios");
-    _SCENARIOS_DIR_DEV = join2(__dirname4, "..", "..", "..", "agent_moss", "scenarios");
+    _AGENTS_DIR_PROD = join3(__dirname4, "agents");
+    _AGENTS_DIR_DEV = join3(__dirname4, "..", "..", "..", "agent_moss", "agents");
+    _SCENARIOS_DIR_PROD = join3(__dirname4, "scenarios");
+    _SCENARIOS_DIR_DEV = join3(__dirname4, "..", "..", "..", "agent_moss", "scenarios");
     SKILL_ID_RE = /^[A-Za-z0-9_-]+$/;
   }
 });
@@ -2555,11 +2642,21 @@ function getScenarioExtensions(scenarioId) {
   );
   return ext;
 }
+function getScenarioExtensionsMulti(scenarioSpec) {
+  if (!scenarioSpec) return null;
+  const ids = scenarioSpec.split(",").map((s) => s.trim()).filter(Boolean);
+  if (ids.length === 0) return null;
+  const exts = ids.map((id) => getScenarioExtensions(id));
+  const nonNull = exts.filter((e) => e !== null);
+  if (nonNull.length === 0) return null;
+  return mergeAgentExtensions(...nonNull);
+}
 var __filename5, __dirname6, SCENARIOS_DIR_PROD, SCENARIOS_DIR_DEV_FALLBACK, cache2;
 var init_scenarios = __esm({
   "src/scenarios/index.ts"() {
     "use strict";
     init_esm_shims();
+    init_agents();
     __filename5 = fileURLToPath7(import.meta.url);
     __dirname6 = dirname5(__filename5);
     SCENARIOS_DIR_PROD = resolve4(__dirname6, "scenarios");
@@ -2608,8 +2705,8 @@ function runHeuristicCheck(input) {
   }
   highestRiskType = topRiskType || highestRiskType;
   const agentExt = mergeAgentExtensions(
-    getAgentExtensions(input.agentId),
-    getScenarioExtensions(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "")
+    isLayerEnabled("agent_rules_enabled") ? getAgentExtensions(input.agentId) : null,
+    isLayerEnabled("scenario_rules_enabled") ? getScenarioExtensionsMulti(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "") : null
   );
   if (agentExt?.extra_command_patterns) {
     for (const rule of agentExt.extra_command_patterns) {
@@ -3054,6 +3151,7 @@ var init_heuristic = __esm({
     init_config();
     init_agents();
     init_scenarios();
+    init_runtime_config();
     init_rules_loader();
     init_logic_rules();
     INJECTION_KEYWORDS = (() => {
@@ -3116,7 +3214,7 @@ var init_template_loader = __esm({
 
 // src/engine/script-analyzer.ts
 import { readFileSync as readFileSync8 } from "fs";
-import { resolve as resolve6, join as join3 } from "path";
+import { resolve as resolve6, join as join4 } from "path";
 function emptyResult() {
   return { scriptPath: "", scriptContent: "", matchedKeywords: [], lineCount: 0, isSuspicious: false, error: "", riskLevel: "", riskReason: "" };
 }
@@ -3169,7 +3267,7 @@ function assessKeywordCombinationRisk(matchedKeywords, scriptContent) {
 }
 function readScriptContent(scriptPath, maxLines = 500) {
   try {
-    const expandedPath = scriptPath.startsWith("~") ? join3(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve6(scriptPath);
+    const expandedPath = scriptPath.startsWith("~") ? join4(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve6(scriptPath);
     const raw = readFileSync8(expandedPath, "utf-8");
     const lines = raw.split("\n").slice(0, maxLines);
     return { content: lines.join("\n"), lineCount: lines.length, error: "" };
@@ -4803,8 +4901,8 @@ var init_tracker = __esm({
 
 // src/engine/script-content-analyzer.ts
 import { statSync as statSync2, existsSync as existsSync9 } from "fs";
-import { resolve as resolve8, join as join5, isAbsolute as isAbsolute2 } from "path";
-import { homedir as homedir3 } from "os";
+import { resolve as resolve8, join as join6, isAbsolute as isAbsolute2 } from "path";
+import { homedir as homedir4 } from "os";
 function emptyChain() {
   return {
     nodes: [],
@@ -4902,7 +5000,7 @@ function extractInlineScriptPath(actionDetail) {
 function resolvePath2(p) {
   let expanded = p;
   if (expanded.startsWith("~/") || expanded === "~") {
-    expanded = join5(homedir3(), expanded.slice(1));
+    expanded = join6(homedir4(), expanded.slice(1));
   }
   return resolve8(expanded);
 }
@@ -4983,7 +5081,7 @@ function analyzeScriptContent2(input) {
     isInline = true;
   }
   if (resolvedPath && !isAbsolute2(resolvedPath) && !resolvedPath.startsWith("~/")) {
-    resolvedPath = join5(input.cwd || process.cwd(), resolvedPath);
+    resolvedPath = join6(input.cwd || process.cwd(), resolvedPath);
   }
   const l1Adapter = (content) => {
     const virtualInput = {
@@ -5573,8 +5671,8 @@ var init_llm_analyzer = __esm({
 
 // src/brain/rule-store.ts
 import { existsSync as existsSync11, readFileSync as readFileSync12, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
-import { join as join6 } from "path";
-import { homedir as homedir4 } from "os";
+import { join as join7 } from "path";
+import { homedir as homedir5 } from "os";
 function getRulesPath() {
   const envPath = process.env[ENV_RULES_PATH];
   if (envPath) return envPath;
@@ -5592,7 +5690,7 @@ var init_rule_store = __esm({
   "src/brain/rule-store.ts"() {
     "use strict";
     init_esm_shims();
-    DEFAULT_RULES_PATH = join6(homedir4(), ".agentmoss", "brain", "rules.json");
+    DEFAULT_RULES_PATH = join7(homedir5(), ".agentmoss", "brain", "rules.json");
     ENV_RULES_PATH = "AGENT_MOSS_BRAIN_RULES_PATH";
     STATUS_DRAFT = "draft";
     STATUS_APPROVED = "approved";
@@ -6122,6 +6220,13 @@ var init_brain = __esm({
 });
 
 // src/engine/formal-engine/decode.ts
+var decode_exports = {};
+__export(decode_exports, {
+  allCandidates: () => allCandidates,
+  decodeBase64Literals: () => decodeBase64Literals,
+  decodeUrlAndNumeric: () => decodeUrlAndNumeric,
+  matchStageAny: () => matchStageAny
+});
 function isValidBase64Token(tok) {
   if (tok.length < 8) return false;
   if (!(tok.length % 4 === 0 || tok.endsWith("==") || tok.endsWith("="))) return false;
@@ -6220,6 +6325,142 @@ var init_decode = __esm({
   }
 });
 
+// src/engine/formal-engine/ir.ts
+function allNodes(mg) {
+  const out = [];
+  for (const s of mg.sessions) out.push(...s.nodes);
+  return out;
+}
+function allEdges(mg) {
+  const out = [];
+  for (const s of mg.sessions) out.push(...s.edges);
+  out.push(...mg.crossEdges);
+  return out;
+}
+function emptyVerificationResult() {
+  return { verified: true, violations: [] };
+}
+var init_ir = __esm({
+  "src/engine/formal-engine/ir.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
+// src/engine/formal-engine/ltl.ts
+function compileAps(apPatterns) {
+  if (AP_RE) return;
+  AP_RE = {};
+  for (const [name, pats] of Object.entries(apPatterns || {})) {
+    AP_RE[name] = pats.map((p) => new RegExp(p, "i"));
+  }
+}
+function labelEvent(actionDetail) {
+  if (!AP_RE) compileAps(loadMC().ap_patterns || {});
+  let candidates = [actionDetail];
+  try {
+    candidates = (init_decode(), __toCommonJS(decode_exports)).allCandidates(actionDetail);
+  } catch {
+  }
+  const hits = /* @__PURE__ */ new Set();
+  for (const [name, pats] of Object.entries(AP_RE || {})) {
+    for (const c of candidates) {
+      const m = pats.some((p) => p.test(c));
+      if (m) {
+        hits.add(name);
+        break;
+      }
+    }
+  }
+  return hits;
+}
+function evaluateLTL(formula, trace, pos) {
+  const op = formula[0];
+  switch (op) {
+    case "ap":
+      return trace[pos].has(formula[1]);
+    case "!":
+      return !evaluateLTL(formula[1], trace, pos);
+    case "&":
+      return evaluateLTL(formula[1], trace, pos) && evaluateLTL(formula[2], trace, pos);
+    case "|":
+      return evaluateLTL(formula[1], trace, pos) || evaluateLTL(formula[2], trace, pos);
+    case "->":
+      return !evaluateLTL(formula[1], trace, pos) || evaluateLTL(formula[2], trace, pos);
+    case "X":
+      return pos + 1 < trace.length && evaluateLTL(formula[1], trace, pos + 1);
+    case "G": {
+      for (let j = pos; j < trace.length; j++) {
+        if (!evaluateLTL(formula[1], trace, j)) return false;
+      }
+      return true;
+    }
+    case "F": {
+      for (let j = pos; j < trace.length; j++) {
+        if (evaluateLTL(formula[1], trace, j)) return true;
+      }
+      return false;
+    }
+    case "U": {
+      for (let j = pos; j < trace.length; j++) {
+        if (evaluateLTL(formula[2], trace, j)) {
+          for (let k = pos; k < j; k++) {
+            if (!evaluateLTL(formula[1], trace, k)) return false;
+          }
+          return true;
+        }
+      }
+      return false;
+    }
+    default:
+      return false;
+  }
+}
+function ruleViolates(rule, traceWith, witnessMode) {
+  const formula = rule?.formula;
+  if (!Array.isArray(formula) || formula.length === 0) return false;
+  const satWith = evaluateLTL(formula, traceWith, 0);
+  if (!satWith) return false;
+  if (witnessMode && traceWith.length > 1) {
+    const traceWithout = traceWith.slice(0, -1);
+    if (evaluateLTL(formula, traceWithout, 0)) return false;
+  }
+  return true;
+}
+function checkMCRules(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length === 0) return violations;
+  const mc = loadMC();
+  const rules = mc.rules || [];
+  if (rules.length === 0) return violations;
+  const trace = nodes.map((n) => labelEvent(n.actionDetail));
+  const witnessMode = graph.witnessIdx !== void 0;
+  for (const rule of rules) {
+    if (rule?.type !== "ltl" || !(rule.enabled !== false)) continue;
+    if (ruleViolates(rule, trace, witnessMode)) {
+      violations.push({
+        propertyId: String(rule.id || "mc-ltl"),
+        reason: String(rule.reason || "L2.2 \u6A21\u578B\u68C0\u6D4B\u89C4\u5219\u547D\u4E2D"),
+        riskLevel: String(rule.risk_level || "high"),
+        path: nodes.filter((n) => labelEvent(n.actionDetail).size > 0).slice(-3).map((n) => ({ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }))
+      });
+      if (witnessMode) return violations;
+    }
+  }
+  return violations;
+}
+var AP_RE;
+var init_ltl = __esm({
+  "src/engine/formal-engine/ltl.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_rules_loader();
+    init_ir();
+    AP_RE = null;
+  }
+});
+
 // src/engine/formal-engine/builder.ts
 function loadStages() {
   if (COMBO_STAGES2) return COMBO_STAGES2;
@@ -6246,6 +6487,26 @@ function extractResources(actionDetail) {
 function markStage(actionDetail) {
   return matchStageAny(actionDetail, loadStages());
 }
+function markIntegrity(actionDetail) {
+  const aps = labelEvent(actionDetail);
+  if (aps.has("download_file") || aps.has("prompt_injection")) {
+    return { integrity: "low", isLowSource: true };
+  }
+  return { integrity: "medium", isLowSource: false };
+}
+function initNode(sessionId, seq, actionType, actionDetail) {
+  const { integrity, isLowSource } = markIntegrity(actionDetail);
+  return {
+    sessionId,
+    seq,
+    actionType,
+    actionDetail,
+    stage: markStage(actionDetail),
+    resources: extractResources(actionDetail),
+    integrity,
+    isLowSource
+  };
+}
 function buildSessionGraph(actionHistory, aNext, sessionId = "current") {
   const nodes = [];
   const edges = [];
@@ -6259,17 +6520,9 @@ function buildSessionGraph(actionHistory, aNext, sessionId = "current") {
     details.push({ actionType: String(aNext.actionType || ""), actionDetail: String(aNext.actionDetail || "") });
   }
   details.forEach((d, seq) => {
-    const stage = markStage(d.actionDetail);
-    const node = {
-      sessionId,
-      seq,
-      actionType: d.actionType,
-      actionDetail: d.actionDetail,
-      stage,
-      resources: extractResources(d.actionDetail)
-    };
+    const node = initNode(sessionId, seq, d.actionType, d.actionDetail);
     nodes.push(node);
-    if (stage) stageFlags.add(stage);
+    if (node.stage) stageFlags.add(node.stage);
   });
   for (let i = 0; i < nodes.length - 1; i++) {
     edges.push({ src: i, dst: i + 1, kind: "next" });
@@ -6289,15 +6542,12 @@ function buildMultiSessionGraph(sessions, aNext) {
   if (aNext) {
     const last = mg.sessions[mg.sessions.length - 1];
     if (last.sessionId === "current") {
-      const stage = markStage(String(aNext.actionDetail || ""));
-      last.nodes.push({
-        sessionId: last.sessionId,
-        seq: last.nodes.length,
-        actionType: String(aNext.actionType || ""),
-        actionDetail: String(aNext.actionDetail || ""),
-        stage,
-        resources: extractResources(String(aNext.actionDetail || ""))
-      });
+      last.nodes.push(initNode(
+        last.sessionId,
+        last.nodes.length,
+        String(aNext.actionType || ""),
+        String(aNext.actionDetail || "")
+      ));
       if (last.nodes.length > 1) {
         last.edges.push({ src: last.nodes.length - 2, dst: last.nodes.length - 1, kind: "next" });
       }
@@ -6311,11 +6561,25 @@ function buildMultiSessionGraph(sessions, aNext) {
 function addCrossDataEdges(mg) {
   const nodes = allNodesFlat(mg);
   if (nodes.length < 2) return;
-  for (let i = 0; i < nodes.length; i++) {
-    for (let j = i + 1; j < nodes.length; j++) {
-      if (nodes[i].sessionId === nodes[j].sessionId) continue;
-      const shared = intersect(nodes[i].resources, nodes[j].resources);
-      if (shared.size > 0) {
+  const resIndex = /* @__PURE__ */ new Map();
+  nodes.forEach((n, i) => {
+    for (const r of n.resources) {
+      const list = resIndex.get(r);
+      if (list) list.push(i);
+      else resIndex.set(r, [i]);
+    }
+  });
+  const seen = /* @__PURE__ */ new Set();
+  for (const idxs of resIndex.values()) {
+    if (idxs.length < 2) continue;
+    for (let a = 0; a < idxs.length; a++) {
+      const i = idxs[a];
+      for (let b = a + 1; b < idxs.length; b++) {
+        const j = idxs[b];
+        if (nodes[i].sessionId === nodes[j].sessionId) continue;
+        const key = `${i}:${j}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
         mg.crossEdges.push({ src: i, dst: j, kind: "data" });
       }
     }
@@ -6326,11 +6590,6 @@ function allNodesFlat(mg) {
   for (const s of mg.sessions) out.push(...s.nodes);
   return out;
 }
-function intersect(a, b) {
-  const out = /* @__PURE__ */ new Set();
-  for (const v of a) if (b.has(v)) out.add(v);
-  return out;
-}
 var COMBO_STAGES2, PATH_RE;
 var init_builder = __esm({
   "src/engine/formal-engine/builder.ts"() {
@@ -6338,33 +6597,12 @@ var init_builder = __esm({
     init_esm_shims();
     init_rules_loader();
     init_decode();
+    init_ltl();
     COMBO_STAGES2 = null;
     PATH_RE = /(?:^|\s|[@=])((?:\/|~\/)[\w./~-]+)/g;
   }
 });
 
-// src/engine/formal-engine/ir.ts
-function allNodes(mg) {
-  const out = [];
-  for (const s of mg.sessions) out.push(...s.nodes);
-  return out;
-}
-function allEdges(mg) {
-  const out = [];
-  for (const s of mg.sessions) out.push(...s.edges);
-  out.push(...mg.crossEdges);
-  return out;
-}
-function emptyVerificationResult() {
-  return { verified: true, violations: [] };
-}
-var init_ir = __esm({
-  "src/engine/formal-engine/ir.ts"() {
-    "use strict";
-    init_esm_shims();
-  }
-});
-
 // src/engine/formal-engine/properties.ts
 function loadCrossSessionChains() {
   if (CROSS_SESSION_CHAINS) return CROSS_SESSION_CHAINS;
@@ -6381,27 +6619,50 @@ function checkCrossSessionChain(graph) {
   const violations = [];
   const nodes = allNodes(graph);
   if (nodes.length === 0) return violations;
+  const witness = graph.witnessIdx;
   for (const chain of loadCrossSessionChains()) {
     const stages = chain.stages;
     if (!stages.length) continue;
-    let matched = 0;
-    let stageIdx = 0;
-    const path6 = [];
-    for (const n of nodes) {
-      if (stageIdx < stages.length && n.stage === stages[stageIdx]) {
-        matched += 1;
-        path6.push({ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) });
-        stageIdx += 1;
-        if (matched >= stages.length) break;
+    if (witness !== void 0) {
+      if (nodes[witness].stage !== stages[stages.length - 1]) continue;
+      let matched = 0;
+      const path6 = [];
+      for (let k = 0; k < witness; k++) {
+        const n = nodes[k];
+        if (matched < stages.length - 1 && n.stage === stages[matched]) {
+          matched += 1;
+          path6.push({ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) });
+        }
       }
-    }
-    if (matched >= stages.length) {
+      if (matched < stages.length - 1) continue;
+      path6.push({ sessionId: nodes[witness].sessionId, seq: nodes[witness].seq, detail: nodes[witness].actionDetail.slice(0, 60) });
       violations.push({
         propertyId: "cross-" + chain.id,
         reason: chain.reason,
         riskLevel: chain.riskLevel,
         path: path6
       });
+      return violations;
+    } else {
+      let matched = 0;
+      let stageIdx = 0;
+      const path6 = [];
+      for (const n of nodes) {
+        if (stageIdx < stages.length && n.stage === stages[stageIdx]) {
+          matched += 1;
+          path6.push({ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) });
+          stageIdx += 1;
+          if (matched >= stages.length) break;
+        }
+      }
+      if (matched >= stages.length) {
+        violations.push({
+          propertyId: "cross-" + chain.id,
+          reason: chain.reason,
+          riskLevel: chain.riskLevel,
+          path: path6
+        });
+      }
     }
   }
   return violations;
@@ -6436,7 +6697,10 @@ function checkSensitiveDataFlow(graph) {
       }
     }
   }
-  for (const [i, n] of nodes.entries()) {
+  const witness = graph.witnessIdx;
+  const candidates = witness !== void 0 ? [witness] : nodes.map((_, i) => i);
+  for (const i of candidates) {
+    const n = nodes[i];
     if (tainted.has(i) && EXFIL_RE.test(n.actionDetail)) {
       violations.push({
         propertyId: "sensitive-data-exfil",
@@ -6444,6 +6708,7 @@ function checkSensitiveDataFlow(graph) {
         riskLevel: "critical",
         path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
       });
+      if (witness !== void 0) return violations;
     }
   }
   return violations;
@@ -6469,6 +6734,32 @@ function checkNeverExfilAfterPrivesc(graph) {
   const violations = [];
   const nodes = allNodes(graph);
   if (nodes.length < 2) return violations;
+  const witness = graph.witnessIdx;
+  if (witness !== void 0) {
+    const evIdx = [];
+    nodes.forEach((n, i) => {
+      if ((i === witness || n.sessionId === "ebpf-evidence") && isExfilNode(n)) evIdx.push(i);
+    });
+    if (evIdx.length === 0) return violations;
+    const firstEv = Math.min(...evIdx);
+    let pre = null;
+    for (let i = 0; i < firstEv; i++) {
+      if (isPrivescNode(nodes[i])) pre = nodes[i];
+    }
+    if (pre) {
+      const post = nodes[firstEv];
+      return [{
+        propertyId: "no-privesc-then-exfil",
+        reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\xAC\u25C7EXFIL)",
+        riskLevel: "critical",
+        path: [
+          { sessionId: pre.sessionId, seq: pre.seq, detail: pre.actionDetail.slice(0, 60) },
+          { sessionId: post.sessionId, seq: post.seq, detail: post.actionDetail.slice(0, 60) }
+        ]
+      }];
+    }
+    return violations;
+  }
   for (let i = 0; i < nodes.length; i++) {
     if (!isPrivescNode(nodes[i])) continue;
     for (let j = i + 1; j < nodes.length; j++) {
@@ -6492,6 +6783,32 @@ function checkNeverExfilAfterCred(graph) {
   const violations = [];
   const nodes = allNodes(graph);
   if (nodes.length < 2) return violations;
+  const witness = graph.witnessIdx;
+  if (witness !== void 0) {
+    const evIdx = [];
+    nodes.forEach((n, i) => {
+      if ((i === witness || n.sessionId === "ebpf-evidence") && isExfilNode(n)) evIdx.push(i);
+    });
+    if (evIdx.length === 0) return violations;
+    const firstEv = Math.min(...evIdx);
+    let pre = null;
+    for (let i = 0; i < firstEv; i++) {
+      if (isCredNode(nodes[i])) pre = nodes[i];
+    }
+    if (pre) {
+      const post = nodes[firstEv];
+      return [{
+        propertyId: "no-cred-then-exfil",
+        reason: "\u8BFB\u53D6\u51ED\u636E\u540E\u51FA\u73B0\u5916\u4F20\uFF0C\u8FDD\u53CD \u25A1(CRED\u2192\xAC\u25C7EXFIL)",
+        riskLevel: "critical",
+        path: [
+          { sessionId: pre.sessionId, seq: pre.seq, detail: pre.actionDetail.slice(0, 60) },
+          { sessionId: post.sessionId, seq: post.seq, detail: post.actionDetail.slice(0, 60) }
+        ]
+      }];
+    }
+    return violations;
+  }
   for (let i = 0; i < nodes.length; i++) {
     if (!isCredNode(nodes[i])) continue;
     for (let j = i + 1; j < nodes.length; j++) {
@@ -6511,13 +6828,164 @@ function checkNeverExfilAfterCred(graph) {
   }
   return violations;
 }
-var CROSS_SESSION_CHAINS, CRED_FILE_RE, EXFIL_RE, EBPF_NET_RE, REMOTE_RE, PRIVESC_RE, EXFIL_ACTION_RE, CRED_STRICT_RE, ALL_PROPERTIES;
+function getToolRegistry() {
+  if (TOOL_REGISTRY) return TOOL_REGISTRY;
+  TOOL_REGISTRY = loadToolRegistry().tools || {};
+  return TOOL_REGISTRY;
+}
+function lookupToolClass(actionType) {
+  const entry = getToolRegistry()[actionType] || {};
+  return entry.actionClass;
+}
+function isComputeNode(n) {
+  if (STRONG_COMPUTE_TYPES.has(n.actionType.toLowerCase())) return true;
+  const cls = lookupToolClass(n.actionType);
+  if (cls === "read" || cls === "write" || cls === "network_egress" || cls === "message_egress") return false;
+  return COMPUTE_RE.test(n.actionDetail);
+}
+function checkLowIntegrityCommandExec(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length === 0) return violations;
+  const witness = graph.witnessIdx;
+  const lowResources = /* @__PURE__ */ new Set();
+  const lowAt = /* @__PURE__ */ new Map();
+  nodes.forEach((n, i) => {
+    if (n.isLowSource) {
+      lowAt.set(i, n.actionDetail.slice(0, 60));
+      for (const r of n.resources) lowResources.add(r);
+    }
+  });
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (let i = 0; i < nodes.length; i++) {
+      if (lowAt.has(i)) continue;
+      let shared = "";
+      for (const r of nodes[i].resources) {
+        if (lowResources.has(r)) {
+          shared = r;
+          break;
+        }
+      }
+      if (shared) {
+        lowAt.set(i, `\u7EE7\u627F\u81EA ${shared}`);
+        for (const r of nodes[i].resources) lowResources.add(r);
+        changed = true;
+      }
+    }
+  }
+  if (lowAt.size === 0) return violations;
+  const candidates = witness !== void 0 ? [witness] : nodes.map((_, i) => i);
+  for (const i of candidates) {
+    const n = nodes[i];
+    if (lowAt.has(i) && isComputeNode(n)) {
+      violations.push({
+        propertyId: "low-integrity-controls-command-exec",
+        reason: `\u4F4E\u5B8C\u6574\u6027\u6570\u636E\u63A7\u5236\u547D\u4EE4\u6267\u884C\uFF1A${lowAt.get(i)} \u2192 ${n.sessionId}#${n.seq} \u6267\u884C\u4E0D\u53EF\u4FE1\u5185\u5BB9`,
+        riskLevel: "critical",
+        path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
+      });
+      if (witness !== void 0) return violations;
+    }
+  }
+  return violations;
+}
+function checkCrossSessionReachability(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length === 0) return violations;
+  const witness = graph.witnessIdx;
+  const sources = /* @__PURE__ */ new Set();
+  nodes.forEach((n, i) => {
+    if (n.isLowSource || DL_OR_LOW_RE.test(n.actionDetail)) sources.add(i);
+  });
+  if (sources.size === 0) return violations;
+  const reached = new Set(sources);
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const e of allEdges(graph)) {
+      if (reached.has(e.src) && !reached.has(e.dst)) {
+        const srcRes = nodes[e.src].resources;
+        const dstRes = nodes[e.dst].resources;
+        for (const r of srcRes) {
+          if (dstRes.has(r)) {
+            reached.add(e.dst);
+            changed = true;
+            break;
+          }
+        }
+      }
+    }
+  }
+  const candidates = witness !== void 0 ? [witness] : nodes.map((_, i) => i);
+  for (const i of candidates) {
+    const n = nodes[i];
+    if (sources.has(i)) continue;
+    if (reached.has(i)) {
+      const srcIdx = Math.min(...sources);
+      const srcDesc = nodes[srcIdx].actionDetail.slice(0, 40);
+      violations.push({
+        propertyId: "cross-session-reachability",
+        reason: `\u4F4E\u5B8C\u6574\u6027\u6E90\u7ECF\u8DE8 session \u6570\u636E\u94FE\u591A\u8DF3\u5230\u8FBE\u5F53\u524D\u6267\u884C\uFF08\u6E90: ${srcDesc} \u2192 ${n.sessionId}#${n.seq}\uFF09`,
+        riskLevel: "high",
+        path: nodes.slice(-3).map((m) => ({ sessionId: m.sessionId, seq: m.seq, detail: m.actionDetail.slice(0, 60) }))
+      });
+      if (witness !== void 0) return violations;
+    }
+  }
+  return violations;
+}
+function checkSensitiveDataAggregation(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length < 2) return violations;
+  const witness = graph.witnessIdx;
+  const resIndex = /* @__PURE__ */ new Map();
+  nodes.forEach((n, i) => {
+    for (const r of n.resources) {
+      const list = resIndex.get(r);
+      if (list) list.push(i);
+      else resIndex.set(r, [i]);
+    }
+  });
+  const sourcesFor = (exfilIdx) => {
+    const srcs = /* @__PURE__ */ new Set();
+    const n = nodes[exfilIdx];
+    for (const r of n.resources) {
+      for (const j of resIndex.get(r) || []) {
+        if (j === exfilIdx) continue;
+        srcs.add(`${nodes[j].sessionId}#${nodes[j].seq}`);
+      }
+    }
+    return srcs;
+  };
+  const candidates = witness !== void 0 ? [witness] : nodes.map((_, i) => i);
+  for (const i of candidates) {
+    const n = nodes[i];
+    if (!isExfilNode(n)) continue;
+    const srcs = sourcesFor(i);
+    if (srcs.size >= 2) {
+      violations.push({
+        propertyId: "sensitive-data-aggregation",
+        reason: `\u654F\u611F\u6570\u636E\u805A\u5408\u5916\u4F20\uFF1Aegress \u805A\u5408 ${srcs.size} \u4E2A\u4E8B\u4EF6\u6E90\u6570\u636E\uFF08Rule 12\uFF09`,
+        riskLevel: "critical",
+        path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
+      });
+      if (witness !== void 0) return violations;
+    }
+  }
+  return violations;
+}
+var CROSS_SESSION_CHAINS, CRED_FILE_RE, EXFIL_RE, EBPF_NET_RE, REMOTE_RE, PRIVESC_RE, EXFIL_ACTION_RE, CRED_STRICT_RE, TOOL_REGISTRY, COMPUTE_RE, STRONG_COMPUTE_TYPES, DL_OR_LOW_RE, ALL_PROPERTIES;
 var init_properties = __esm({
   "src/engine/formal-engine/properties.ts"() {
     "use strict";
     init_esm_shims();
     init_rules_loader();
     init_ir();
+    init_ltl();
     CROSS_SESSION_CHAINS = null;
     CRED_FILE_RE = /(known_hosts|\.ssh|id_rsa|\/etc\/shadow|\/etc\/passwd|credentials)/i;
     EXFIL_RE = /https?:\/\/|scp\s+.*@|rsync\s+.*@/i;
@@ -6526,11 +6994,22 @@ var init_properties = __esm({
     PRIVESC_RE = /\bsudo\b|\bsu\b|chmod\s+u\s*\+\s*s|pkexec|setuid/i;
     EXFIL_ACTION_RE = /\bcurl\b|\bwget\b|\bscp\b|\brsync\b|\brclone\b|\bftp\b|connect\s+.*\d+\.\d+\.\d+\.\d+|open\s+.*tcp|base64\s+.*\-o/i;
     CRED_STRICT_RE = /(known_hosts|\.ssh|id_rsa|\.pem|\b\.key\b|\/etc\/shadow|\/etc\/passwd|\.aws\/credentials|credentials\.json|netrc|password|secrets?\.ya?ml|credentials?\s*(file|path)?\s*(=|\:)|\bconfig.*(password|token))/i;
+    TOOL_REGISTRY = null;
+    COMPUTE_RE = /subprocess|os\.system|shell\s*=\s*True|\beval\(|\bexec\(|bash\s+[^\s]|sh\s+-c|python3?\s+|node\s+|\btimeout\s+|nohup\s+|\b\.\/[\w./-]+/i;
+    STRONG_COMPUTE_TYPES = /* @__PURE__ */ new Set(["python", "node", "exec", "terminal", "cmd"]);
+    DL_OR_LOW_RE = /curl\s+.*-o\b|wget\s+.*\s+-O\b|curl\s+.*\|\s*(bash|sh|python)|wget\s+.*\|\s*(bash|sh|python)|git\s+clone|docker\s+pull|pip\s+install|npm\s+install|base64\s+-d/i;
     ALL_PROPERTIES = [
       { id: "cross-session-chain", check: checkCrossSessionChain },
       { id: "sensitive-data-flow", check: checkSensitiveDataFlow },
+      { id: "cross-session-reachability", check: checkCrossSessionReachability },
       { id: "no-privesc-then-exfil", check: checkNeverExfilAfterPrivesc },
-      { id: "no-cred-then-exfil", check: checkNeverExfilAfterCred }
+      { id: "no-cred-then-exfil", check: checkNeverExfilAfterCred },
+      // L2.2 模型检测（通用 LTL 求值器，mc_rules.json 单一事实源；witness 语义见 ltl.ts）
+      { id: "mc-ltl-rules", check: checkMCRules },
+      // Rule 5 低完整性控制命令执行（integrity 维度，站点 L2.1 最有区分度的检测之一）
+      { id: "low-integrity-command-exec", check: checkLowIntegrityCommandExec },
+      // Rule 12 敏感数据聚合外传（egress 聚合 ≥2 事件源）
+      { id: "sensitive-data-aggregation", check: checkSensitiveDataAggregation }
     ];
   }
 });
@@ -6572,6 +7051,9 @@ var init_engine = __esm({
           });
         }
         const graph = buildMultiSessionGraph(all, aNext);
+        if (aNext) {
+          graph.witnessIdx = allNodes(graph).length - 1;
+        }
         const result = emptyVerificationResult();
         for (const prop of this.properties) {
           let violations;
@@ -7083,6 +7565,7 @@ function _resetBrainForTest() {
   _brainInitialized = false;
 }
 async function runAnalysis(input) {
+  const observedFormalLayers = [];
   const heuristicResult = isHeuristicEnabled() ? runHeuristicCheck(input) : null;
   const isInlineScriptCmd = isInlineScriptCommand(input.aNext.actionDetail.toLowerCase());
   const isLiteralTextCmd = isLiteralTextCommand(input.aNext.actionDetail.toLowerCase());
@@ -7137,8 +7620,8 @@ async function runAnalysis(input) {
   const rawDetail = extractRawCommand(input.aNext.actionDetail);
   const lowerDetail = rawDetail.toLowerCase();
   const agentExt = mergeAgentExtensions(
-    getAgentExtensions(input.agentId),
-    getScenarioExtensions(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "")
+    isLayerEnabled("agent_rules_enabled") ? getAgentExtensions(input.agentId) : null,
+    isLayerEnabled("scenario_rules_enabled") ? getScenarioExtensionsMulti(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "") : null
   );
   if (FULLY_SAFE_TOOLS.has(actionType)) {
     return {
@@ -7255,15 +7738,22 @@ async function runAnalysis(input) {
     const formalResult = formalEngine.verify(formalSessions, input.aNext);
     if (!formalResult.verified) {
       const v = formalResult.violations[0];
-      return {
-        allowed: false,
-        reason: v ? v.reason : "\u5F62\u5F0F\u5316\u9A8C\u8BC1\u672A\u901A\u8FC7\uFF08\u884C\u4E3A\u6027\u8D28\u8FDD\u53CD\uFF09",
-        riskLevel: v ? v.riskLevel : "high",
-        riskType: "formal_verification",
-        confidence: 90,
-        source: "formal_engine",
-        violatedLayers: ["2.4"]
-      };
+      if (isFormalObserveMode()) {
+        console.warn(
+          `[AgentMoss] \u5F62\u5F0F\u5316\u9A8C\u8BC1 observe\uFF08\u53EA\u8BB0\u5F55\u4E0D\u62E6\u622A\uFF09: property=${v?.propertyId ?? "?"} risk=${v?.riskLevel ?? "?"} path_len=${v?.path?.length ?? 0} reason=${(v?.reason ?? "?").slice(0, 200)}`
+        );
+        observedFormalLayers.push("2.4");
+      } else {
+        return {
+          allowed: false,
+          reason: v ? v.reason : "\u5F62\u5F0F\u5316\u9A8C\u8BC1\u672A\u901A\u8FC7\uFF08\u884C\u4E3A\u6027\u8D28\u8FDD\u53CD\uFF09",
+          riskLevel: v ? v.riskLevel : "high",
+          riskType: "formal_verification",
+          confidence: 90,
+          source: "formal_engine",
+          violatedLayers: ["2.4"]
+        };
+      }
     }
   }
   if (scriptChain && scriptChain.nodes.length > 0 && isLogicRulesEnabled()) {
@@ -7310,7 +7800,7 @@ async function runAnalysis(input) {
       riskType: "",
       confidence: 85,
       source: "heuristic_and_logic_only",
-      violatedLayers: []
+      violatedLayers: observedFormalLayers.length > 0 ? [...observedFormalLayers] : []
     };
   }
   let skipL3Hints = "\u65E0\uFF08\u5F53\u524D\u65E0\u7981\u7528\u89C4\u5219\u547D\u4E2D\uFF09";
@@ -7355,7 +7845,7 @@ async function runAnalysis(input) {
         riskType: "",
         confidence: 50,
         source: "llm_failure_fallback",
-        violatedLayers: []
+        violatedLayers: observedFormalLayers.length > 0 ? [...observedFormalLayers] : []
       };
     }
     return {
@@ -7382,6 +7872,9 @@ async function runAnalysis(input) {
     } catch {
     }
   }
+  if (observedFormalLayers.length > 0 && llmResult.allowed) {
+    llmResult.violatedLayers = Array.from(/* @__PURE__ */ new Set([...observedFormalLayers, ...llmResult.violatedLayers || []]));
+  }
   return llmResult;
 }
 var FULLY_SAFE_TOOLS, TRUSTED_SKILLS_BASE, READONLY_SENSITIVE_TOOLS, FULLY_SAFE_BASH_PATTERNS, READONLY_SENSITIVE_BASH_PATTERNS, _brainStore, _brainExtractor, _brainInitialized, formalEngine;
@@ -7395,6 +7888,7 @@ var init_coordinator = __esm({
     init_llm_analyzer();
     init_script_content_analyzer();
     init_config();
+    init_runtime_config();
     init_agents();
     init_scenarios();
     init_brain();
@@ -7556,7 +8050,7 @@ var require_bindings = __commonJS({
     var fs7 = __require("fs");
     var path6 = __require("path");
     var fileURLToPath11 = require_file_uri_to_path();
-    var join10 = path6.join;
+    var join11 = path6.join;
     var dirname11 = path6.dirname;
     var exists = fs7.accessSync && function(path7) {
       try {
@@ -7616,7 +8110,7 @@ var require_bindings = __commonJS({
       var requireFunc = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
       var tries = [], i = 0, l = opts.try.length, n, b, err;
       for (; i < l; i++) {
-        n = join10.apply(
+        n = join11.apply(
           null,
           opts.try[i].map(function(p) {
             return opts[p] || p;
@@ -7677,7 +8171,7 @@ var require_bindings = __commonJS({
         if (dir === ".") {
           dir = process.cwd();
         }
-        if (exists(join10(dir, "package.json")) || exists(join10(dir, "node_modules"))) {
+        if (exists(join11(dir, "package.json")) || exists(join11(dir, "node_modules"))) {
           return dir;
         }
         if (prev === dir) {
@@ -7686,7 +8180,7 @@ var require_bindings = __commonJS({
           );
         }
         prev = dir;
-        dir = join10(dir, "..");
+        dir = join11(dir, "..");
       }
     };
   }
@@ -8846,12 +9340,13 @@ init_esm_shims();
 init_esm_shims();
 init_runtime_config();
 init_token_stats();
+init_rules_loader();
 import { Hono } from "hono";
 import { readFileSync as readFileSync15, existsSync as existsSync14 } from "fs";
-import { join as join9, dirname as dirname10 } from "path";
+import { join as join10, dirname as dirname10 } from "path";
 import { fileURLToPath as fileURLToPath9 } from "url";
 var __dirname8 = dirname10(fileURLToPath9(import.meta.url));
-var STATIC_DIR = join9(__dirname8, "static");
+var STATIC_DIR = join10(__dirname8, "static");
 var CONSOLE_TOKEN_ENV = "AGENT_MOSS_CONSOLE_TOKEN";
 function getConsoleToken() {
   return process.env[CONSOLE_TOKEN_ENV] || "";
@@ -8875,7 +9370,7 @@ function createConsoleRouter() {
   const console2 = new Hono();
   console2.use("/api/*", authMiddleware());
   const serveIndex = (c) => {
-    const indexFile = join9(STATIC_DIR, "index.html");
+    const indexFile = join10(STATIC_DIR, "index.html");
     if (existsSync14(indexFile)) {
       return c.html(readFileSync15(indexFile, "utf-8"));
     }
@@ -8892,24 +9387,89 @@ function createConsoleRouter() {
     const rc = updateLayerEnabled(body.layer_key, body.enabled);
     return c.json({ layers: rc.layers, env_overrides: getEnvOverrides() });
   });
+  function getL24View() {
+    const ltlHuman = {
+      "mc-ltl-001": "\u5148\u8BFB\u53D6\u4E86\u51ED\u636E/\u5BC6\u94A5\uFF0C\u4E4B\u540E\u51FA\u73B0\u7F51\u7EDC\u5916\u4F20",
+      "mc-ltl-002": "\u5148\u4E0B\u8F7D/\u83B7\u53D6\u4E86\u6587\u4EF6\uFF0C\u4E4B\u540E\u6267\u884C\u4E86\u6587\u4EF6",
+      "mc-ltl-003": "\u5148\u7981\u7528\u4E86\u5B89\u5168\u9632\u62A4\uFF0C\u4E4B\u540E\u51FA\u73B0\u7834\u574F\u6027\u64CD\u4F5C\uFF08\u6267\u884C/\u5220\u9664/\u63D0\u6743\uFF09",
+      "mc-ltl-004": "\u5148\u51FA\u73B0\u63D0\u793A\u8BCD\u6CE8\u5165\uFF0C\u4E4B\u540E\u51FA\u73B0\u654F\u611F\u64CD\u4F5C\uFF08\u5916\u4F20/\u5199\u6587\u4EF6/\u6267\u884C\uFF09",
+      "mc-ltl-005": "\u5148\u8BFB\u53D6\u51ED\u636E\uFF0C\u4E4B\u540E\u51FA\u73B0\u6A2A\u5411\u79FB\u52A8\uFF08ssh/scp \u5230\u8FDC\u7A0B\uFF09",
+      "mc-ltl-006": "\u5148\u63A5\u89E6\u654F\u611F\u6570\u636E\uFF0C\u4E4B\u540E\u6E05\u9664\u65E5\u5FD7",
+      "mc-ltl-007": "\u5148\u63D0\u6743\uFF0C\u4E4B\u540E\u5B89\u88C5\u6301\u4E45\u5316\u540E\u95E8",
+      "mc-ltl-008": "\u5148\u4E0B\u8F7D\u6587\u4EF6\uFF0C\u4E4B\u540E\u5B89\u88C5\u6301\u4E45\u5316\u540E\u95E8",
+      "mc-ltl-009": "\u5148\u63A5\u89E6\u654F\u611F\u6570\u636E \u2192 \u6253\u5305\u538B\u7F29 \u2192 \u7F51\u7EDC\u5916\u4F20",
+      "mc-ltl-010": "\u5B89\u88C5\u4E86\u6301\u4E45\u5316\u673A\u5236\uFF08crontab/systemd/.bashrc \u7B49\uFF09\uFF0C\u9700\u5BA1\u6279",
+      "mc-ctl-001": "\u4EFB\u4F55\u60C5\u51B5\u4E0B\u4E0D\u5141\u8BB8\u6E05\u9664\u65E5\u5FD7\uFF08\u5B89\u5168\u5E95\u7EBF\uFF09"
+    };
+    const mc = loadMC();
+    const rules = mc.rules || [];
+    return {
+      enabled_via: "L2_logic_rules",
+      description: "\u65F6\u5E8F\u4E0E\u6570\u636E\u6D41\u653B\u51FB\u68C0\u6D4B\uFF08L2.2 \u6A21\u578B\u68C0\u6D4B\uFF09",
+      ltl_rules: rules.map((r) => ({
+        id: r.id,
+        type: r.type,
+        formula: Array.isArray(r.formula) ? "<\u516C\u5F0F>" : r.formula,
+        reason: r.reason,
+        risk_level: r.risk_level,
+        action: r.action,
+        enabled: r.enabled !== false,
+        human: ltlHuman[r.id] || r.reason || ""
+      }))
+    };
+  }
+  function withL24View(rc) {
+    if (rc && rc.L2_4 && typeof rc.L2_4 === "object" && !Array.isArray(rc.L2_4)) {
+      const cat = rc.L2_4.ltl_rules;
+      const rls = cat && cat.rules || [];
+      const ltlHumanLocal = {
+        "mc-ltl-001": "\u5148\u8BFB\u53D6\u4E86\u51ED\u636E/\u5BC6\u94A5\uFF0C\u4E4B\u540E\u51FA\u73B0\u7F51\u7EDC\u5916\u4F20",
+        "mc-ltl-002": "\u5148\u4E0B\u8F7D/\u83B7\u53D6\u4E86\u6587\u4EF6\uFF0C\u4E4B\u540E\u6267\u884C\u4E86\u6587\u4EF6",
+        "mc-ltl-003": "\u5148\u7981\u7528\u4E86\u5B89\u5168\u9632\u62A4\uFF0C\u4E4B\u540E\u51FA\u73B0\u7834\u574F\u6027\u64CD\u4F5C\uFF08\u6267\u884C/\u5220\u9664/\u63D0\u6743\uFF09",
+        "mc-ltl-004": "\u5148\u51FA\u73B0\u63D0\u793A\u8BCD\u6CE8\u5165\uFF0C\u4E4B\u540E\u51FA\u73B0\u654F\u611F\u64CD\u4F5C\uFF08\u5916\u4F20/\u5199\u6587\u4EF6/\u6267\u884C\uFF09",
+        "mc-ltl-005": "\u5148\u8BFB\u53D6\u51ED\u636E\uFF0C\u4E4B\u540E\u51FA\u73B0\u6A2A\u5411\u79FB\u52A8\uFF08ssh/scp \u5230\u8FDC\u7A0B\uFF09",
+        "mc-ltl-006": "\u5148\u63A5\u89E6\u654F\u611F\u6570\u636E\uFF0C\u4E4B\u540E\u6E05\u9664\u65E5\u5FD7",
+        "mc-ltl-007": "\u5148\u63D0\u6743\uFF0C\u4E4B\u540E\u5B89\u88C5\u6301\u4E45\u5316\u540E\u95E8",
+        "mc-ltl-008": "\u5148\u4E0B\u8F7D\u6587\u4EF6\uFF0C\u4E4B\u540E\u5B89\u88C5\u6301\u4E45\u5316\u540E\u95E8",
+        "mc-ltl-009": "\u5148\u63A5\u89E6\u654F\u611F\u6570\u636E \u2192 \u6253\u5305\u538B\u7F29 \u2192 \u7F51\u7EDC\u5916\u4F20",
+        "mc-ltl-010": "\u5B89\u88C5\u4E86\u6301\u4E45\u5316\u673A\u5236\uFF08crontab/systemd/.bashrc \u7B49\uFF09\uFF0C\u9700\u5BA1\u6279",
+        "mc-ctl-001": "\u4EFB\u4F55\u60C5\u51B5\u4E0B\u4E0D\u5141\u8BB8\u6E05\u9664\u65E5\u5FD7\uFF08\u5B89\u5168\u5E95\u7EBF\uFF09"
+      };
+      rc.L2_4 = {
+        enabled_via: "L2_logic_rules",
+        description: "\u65F6\u5E8F\u4E0E\u6570\u636E\u6D41\u653B\u51FB\u68C0\u6D4B\uFF08L2.2 \u6A21\u578B\u68C0\u6D4B\uFF09",
+        ltl_rules: rls.map((r) => ({
+          id: r.id,
+          type: "ltl",
+          formula: "<\u516C\u5F0F>",
+          reason: r.reason || "",
+          risk_level: r.risk_level || "high",
+          action: r.action || "block",
+          enabled: r.enabled !== false,
+          human: ltlHumanLocal[r.id] || r.reason || ""
+        }))
+      };
+    }
+    return rc;
+  }
   console2.get("/api/rules", (c) => {
     const rc = loadRuntimeConfig();
-    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules });
+    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules, L2_4: getL24View() });
   });
   console2.put("/api/rules/enabled", async (c) => {
     const b = await c.req.json();
     const rc = updateRuleEnabled(b.layer, b.category, b.rule_id, b.enabled);
-    return c.json(rc);
+    return c.json(withL24View(rc));
   });
   console2.put("/api/rules/deny_mode", async (c) => {
     const b = await c.req.json();
     const rc = updateRuleDenyMode(b.layer, b.category, b.rule_id, b.deny_mode);
-    return c.json(rc);
+    return c.json(withL24View(rc));
   });
   console2.put("/api/rules/skip_l3", async (c) => {
     const b = await c.req.json();
     const rc = updateRuleSkipL3(b.layer, b.category, b.rule_id, b.skip_l3_on_disabled);
-    return c.json(rc);
+    return c.json(withL24View(rc));
   });
   console2.put("/api/categories/enabled", async (c) => {
     const b = await c.req.json();
@@ -8968,9 +9528,9 @@ function createConsoleRouter() {
     if (!/^[A-Za-z0-9_-]+$/.test(skillId)) {
       return c.json({ error: "invalid skill_id" }, 400);
     }
-    const skillPath = join9(dirname10(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
+    const skillPath = join10(dirname10(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
     if (!existsSync14(skillPath)) {
-      const builtinPath = join9(__dirname8, "..", "..", "agent_moss", "skills", `${skillId}.md`);
+      const builtinPath = join10(__dirname8, "..", "..", "agent_moss", "skills", `${skillId}.md`);
       if (existsSync14(builtinPath)) return c.text(readFileSync15(builtinPath, "utf-8"));
       return c.json({ error: "skill not found" }, 404);
     }
@@ -9059,7 +9619,7 @@ function createConsoleRouter() {
   });
   console2.get("/api/config", (c) => {
     const rc = loadRuntimeConfig();
-    return c.json(rc);
+    return c.json({ ...rc, L2_4: getL24View() });
   });
   console2.get("/api/env-overrides", (c) => {
     return c.json({ overrides: getEnvOverrides() });
@@ -9396,4 +9956,7 @@ if (isMain) {
     process.exit(1);
   });
 }
+//! 顺序即 fail-closed 短路优先级：verify 逐个执行，首个返回违规的性质成为
+//! first_violation，后续不再评估。调整顺序影响判定归属，须与 Python
+//! properties.py ALL_PROPERTIES 保持一致并双端测试确认。
 //# sourceMappingURL=cli.js.map