@kenhkl/agent-moss 0.12.9 → 0.13.0

package/dist/server.js

@@ -137,6 +137,7 @@ __export(config_exports, {
   getRetryConfig: () => getRetryConfig,
   getTimeoutConfig: () => getTimeoutConfig,
   isBrainEnabled: () => isBrainEnabled,
+  isFormalObserveMode: () => isFormalObserveMode,
   isHeuristicEnabled: () => isHeuristicEnabled,
   isLLMAvailable: () => isLLMAvailable,
   isLogicRulesEnabled: () => isLogicRulesEnabled,
@@ -252,6 +253,7 @@ function getCustomRules() {
 }
 function isLLMAvailable() {
   if (process.env.AGENT_MOSS_DISABLE_LLM === "1") return false;
+  if (!layerEnabledOrDefault("L3_llm_analysis")) return false;
   return llmConfig.apiKey.length > 0;
 }
 async function probeLLMConnection(timeoutMs = 8e3) {
@@ -316,13 +318,26 @@ function getProviderHeaders(provider) {
   return PROVIDER_HEADERS[provider] || {};
 }
 function isHeuristicEnabled() {
-  return process.env.AGENT_MOSS_DISABLE_HEURISTIC !== "1";
+  if (process.env.AGENT_MOSS_DISABLE_HEURISTIC === "1") return false;
+  return layerEnabledOrDefault("L1_heuristic");
+}
+function layerEnabledOrDefault(key) {
+  try {
+    const { isLayerEnabled: isLayerEnabled2 } = __require("../infra/runtime-config");
+    return isLayerEnabled2(key);
+  } catch {
+    return true;
+  }
 }
 function isBrainEnabled() {
   return process.env.AGENT_MOSS_BRAIN_ENABLED === "1";
 }
 function isLogicRulesEnabled() {
-  return process.env.AGENT_MOSS_DISABLE_LOGIC_RULES !== "1";
+  if (process.env.AGENT_MOSS_DISABLE_LOGIC_RULES === "1") return false;
+  return layerEnabledOrDefault("L2_logic_rules");
+}
+function isFormalObserveMode() {
+  return process.env.AGENT_MOSS_FORMAL_OBSERVE === "1";
 }
 var timeoutConfig, retryConfig, llmConfig, __configModuleDir, USER_RULES_PATHS, customRules, PROVIDER_HEADERS;
 var init_config = __esm({
@@ -580,8 +595,12 @@ var init_inline_analyzer = __esm({
 
 // src/infra/rules-loader.ts
 import { readFileSync as readFileSync2, existsSync } from "fs";
-import { resolve, dirname } from "path";
+import { resolve, dirname, join as join2 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
+import { homedir as homedir2 } from "os";
+function dataRootDir() {
+  return process.env.AGENT_MOSS_DATA_DIR || join2(homedir2(), ".config", "agentmoss");
+}
 function findRulesFile(name) {
   for (const dir of RULES_DIR_CANDS) {
     const p = resolve(dir, name);
@@ -607,6 +626,24 @@ function loadL2() {
 function loadL3() {
   return loadJson("l3_rules.json");
 }
+function loadMC() {
+  const mc = loadJson("mc_rules.json");
+  const rules = mc.rules || [];
+  try {
+    const rt = (init_runtime_config(), __toCommonJS(runtime_config_exports));
+    if (rules.length > 0 && typeof rt.hasRuntimeConfig === "function" && rt.hasRuntimeConfig()) {
+      const rtRules = rt.loadRuntimeConfig()?.L2_4?.ltl_rules?.rules || [];
+      const enabledById = {};
+      for (const r of rtRules) if (r?.id) enabledById[r.id] = r.enabled !== false;
+      for (const r of rules) if (r?.id && r.id in enabledById) r.enabled = enabledById[r.id];
+    }
+  } catch {
+  }
+  return mc;
+}
+function loadToolRegistry() {
+  return loadJson("tool_registry.json");
+}
 var __filename2, __dirname2, RULES_DIR_CANDS;
 var init_rules_loader = __esm({
   "src/infra/rules-loader.ts"() {
@@ -616,6 +653,10 @@ var init_rules_loader = __esm({
     __dirname2 = dirname(__filename2);
     RULES_DIR_CANDS = (() => {
       const cands = [
+        // 用户数据目录覆盖优先（与 Python rules_loader._load_json 的
+        // <data_root>/rules/<name> 优先逻辑对齐）。用户安装 pip/npm 包后把自定义
+        // mc_rules.json 放到 <data_root>/rules/ 即可覆盖内置默认，无需改源码。
+        resolve(dataRootDir(), "rules"),
         // dist: __dirname=dist/ → dist/rules；__dirname=dist/engine/ → dist/engine/../rules=dist/rules
         resolve(__dirname2, "../rules"),
         resolve(__dirname2, "rules"),
@@ -1353,6 +1394,7 @@ var init_skill_loader = __esm({
 // src/infra/runtime-config.ts
 var runtime_config_exports = {};
 __export(runtime_config_exports, {
+  DEFAULT_LAYERS: () => DEFAULT_LAYERS,
   DENY_MODE_LABELS: () => DENY_MODE_LABELS,
   addAgentRule: () => addAgentRule,
   addCustomRule: () => addCustomRule,
@@ -1404,7 +1446,7 @@ __export(runtime_config_exports, {
   updateSkillEnabled: () => updateSkillEnabled
 });
 import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync4, mkdirSync, unlinkSync, readdirSync as readdirSync3 } from "fs";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import { dirname as dirname3 } from "path";
 function runtimeDir() {
@@ -1428,6 +1470,7 @@ function emptyRuntimeConfig() {
     L1_rules: {},
     L2_rules: {},
     L3_skills: {},
+    L2_4: {},
     agent_rules: {},
     scenario_rules: {}
   };
@@ -1455,6 +1498,7 @@ function loadRuntimeConfig() {
       L1_rules: merged.L1_rules || {},
       L2_rules: merged.L2_rules || {},
       L3_skills: merged.L3_skills || {},
+      L2_4: merged.L2_4 || {},
       agent_rules: merged.agent_rules || {},
       scenario_rules: merged.scenario_rules || {}
     };
@@ -1702,7 +1746,7 @@ function _scenarioRulesToDefaults() {
     return out;
   }
   for (const scenarioId of entries) {
-    const rulesFile = join2(scenDir, scenarioId, "rules.json");
+    const rulesFile = join3(scenDir, scenarioId, "rules.json");
     if (!existsSync4(rulesFile)) continue;
     let data;
     try {
@@ -1751,7 +1795,7 @@ function _agentRulesToDefaults() {
     return out;
   }
   for (const agentId of entries) {
-    const rulesFile = join2(agentsDir, agentId, "rules.json");
+    const rulesFile = join3(agentsDir, agentId, "rules.json");
     if (!existsSync4(rulesFile)) continue;
     let data;
     try {
@@ -1792,7 +1836,7 @@ function _agentRulesToDefaults() {
 function generateSourceDefaults() {
   return {
     version: 1,
-    layers: { L1_heuristic: true, L2_logic_rules: true, L3_llm_analysis: true },
+    layers: { ...DEFAULT_LAYERS },
     L1_rules: {
       dangerous_commands: {
         category_enabled: true,
@@ -1831,10 +1875,45 @@ function generateSourceDefaults() {
       user_custom: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49 L2 \u903B\u8F91\u89C4\u5219", rules: [] }
     },
     L3_skills: _l3SkillsToRules(),
+    L2_4: _ltlRulesToRuntime(),
     agent_rules: _agentRulesToDefaults(),
     scenario_rules: _scenarioRulesToDefaults()
   };
 }
+function _ltlRulesToRuntime() {
+  const cands = [
+    join3(__dirname4, "..", "rules"),
+    join3(__dirname4, "..", "..", "..", "agent_moss", "rules"),
+    join3(process.cwd(), "agent_moss", "rules")
+  ];
+  let mc = {};
+  for (const dir of cands) {
+    const p = join3(dir, "mc_rules.json");
+    if (existsSync4(p)) {
+      try {
+        mc = JSON.parse(readFileSync4(p, "utf-8")) || {};
+      } catch {
+        mc = {};
+      }
+      break;
+    }
+  }
+  const rules = mc.rules || [];
+  return {
+    ltl_rules: {
+      category_enabled: true,
+      category_desc: "LTL \u653B\u51FB\u6A21\u5F0F\u89C4\u5219\uFF08\u65F6\u5E8F\u653B\u51FB\u68C0\u6D4B\uFF0C\u5148 A \u540E B\uFF09",
+      rules: rules.map((r) => ({
+        id: r.id,
+        reason: r.reason || "",
+        risk_level: r.risk_level || "high",
+        action: r.action || "block",
+        enabled: true,
+        builtin: true
+      }))
+    }
+  };
+}
 function normalizePatternForFingerprint(pattern) {
   return pattern.replace(/\\\//g, "/");
 }
@@ -1984,6 +2063,7 @@ function mergeConfig(userCfg, srcDefaults) {
   );
   _mergeRuleCategories(cfg, srcDefaults, "L1_rules");
   _mergeRuleCategories(cfg, srcDefaults, "L2_rules");
+  _mergeRuleCategories(cfg, srcDefaults, "L2_4");
   _mergeSkillCategories(cfg, srcDefaults, "L3_skills");
   _mergeAgentRules(cfg, srcDefaults);
   _mergeAgentRules(cfg, srcDefaults, "scenario_rules");
@@ -2176,12 +2256,12 @@ function deleteCustomRule(layer, category, ruleId) {
 function addCustomSkill(skillId, category, keywords, content) {
   _validateSkillId(skillId);
   const runtime = loadRuntimeConfig();
-  const skillsDir = join2(RUNTIME_CONFIG_DIR, "agent_moss_skills");
+  const skillsDir = join3(RUNTIME_CONFIG_DIR, "agent_moss_skills");
   try {
     mkdirSync(skillsDir, { recursive: true });
   } catch {
   }
-  writeFileSync(join2(skillsDir, `${skillId}.md`), content, "utf-8");
+  writeFileSync(join3(skillsDir, `${skillId}.md`), content, "utf-8");
   const l3 = runtime.L3_skills || (runtime.L3_skills = {});
   const cat = l3[category] || (l3[category] = { category_enabled: true, category_desc: "", skills: [] });
   (cat.skills || (cat.skills = [])).push({ id: skillId, keywords, enabled: true, builtin: false });
@@ -2196,7 +2276,7 @@ function deleteCustomSkill(skillId, category) {
   if (idx >= 0) {
     if (skills[idx].builtin) return null;
     skills.splice(idx, 1);
-    const skillPath = join2(RUNTIME_CONFIG_DIR, "agent_moss_skills", `${skillId}.md`);
+    const skillPath = join3(RUNTIME_CONFIG_DIR, "agent_moss_skills", `${skillId}.md`);
     try {
       if (existsSync4(skillPath)) unlinkSync(skillPath);
     } catch {
@@ -2390,7 +2470,7 @@ function updateScenarioCategoryEnabled(scenarioId, category, enabled) {
   saveRuntimeConfig(runtime);
   return runtime;
 }
-var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DENY_MODE_LABELS, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, SKILL_ID_RE;
+var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DEFAULT_LAYERS, DENY_MODE_LABELS, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, SKILL_ID_RE;
 var init_runtime_config = __esm({
   "src/infra/runtime-config.ts"() {
     "use strict";
@@ -2402,21 +2482,28 @@ var init_runtime_config = __esm({
     __dirname4 = dirname3(fileURLToPath5(import.meta.url));
     ENV_RUNTIME_CONFIG_PATH = "AGENT_MOSS_RUNTIME_CONFIG_PATH";
     RUNTIME_CONFIG_DIR = runtimeDir();
-    RUNTIME_CONFIG_PATH = join2(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
+    RUNTIME_CONFIG_PATH = join3(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
     LAYER_DISABLE_ENV = {
       L1_heuristic: "AGENT_MOSS_DISABLE_HEURISTIC",
       L2_logic_rules: "AGENT_MOSS_DISABLE_LOGIC_RULES",
       L3_llm_analysis: "AGENT_MOSS_DISABLE_LLM"
     };
+    DEFAULT_LAYERS = {
+      L1_heuristic: true,
+      L2_logic_rules: true,
+      L3_llm_analysis: true,
+      agent_rules_enabled: true,
+      scenario_rules_enabled: true
+    };
     DENY_MODE_LABELS = {
       deny_write: "\u4EC5\u62E6\u622A\u5199\u5165",
       deny_read: "\u4EC5\u62E6\u622A\u8BFB\u53D6",
       deny_both: "\u8BFB\u5199\u5747\u62E6\u622A"
     };
-    _AGENTS_DIR_PROD = join2(__dirname4, "agents");
-    _AGENTS_DIR_DEV = join2(__dirname4, "..", "..", "..", "agent_moss", "agents");
-    _SCENARIOS_DIR_PROD = join2(__dirname4, "scenarios");
-    _SCENARIOS_DIR_DEV = join2(__dirname4, "..", "..", "..", "agent_moss", "scenarios");
+    _AGENTS_DIR_PROD = join3(__dirname4, "agents");
+    _AGENTS_DIR_DEV = join3(__dirname4, "..", "..", "..", "agent_moss", "agents");
+    _SCENARIOS_DIR_PROD = join3(__dirname4, "scenarios");
+    _SCENARIOS_DIR_DEV = join3(__dirname4, "..", "..", "..", "agent_moss", "scenarios");
     SKILL_ID_RE = /^[A-Za-z0-9_-]+$/;
   }
 });
@@ -2554,11 +2641,21 @@ function getScenarioExtensions(scenarioId) {
   );
   return ext;
 }
+function getScenarioExtensionsMulti(scenarioSpec) {
+  if (!scenarioSpec) return null;
+  const ids = scenarioSpec.split(",").map((s) => s.trim()).filter(Boolean);
+  if (ids.length === 0) return null;
+  const exts = ids.map((id) => getScenarioExtensions(id));
+  const nonNull = exts.filter((e) => e !== null);
+  if (nonNull.length === 0) return null;
+  return mergeAgentExtensions(...nonNull);
+}
 var __filename5, __dirname6, SCENARIOS_DIR_PROD, SCENARIOS_DIR_DEV_FALLBACK, cache2;
 var init_scenarios = __esm({
   "src/scenarios/index.ts"() {
     "use strict";
     init_esm_shims();
+    init_agents();
     __filename5 = fileURLToPath7(import.meta.url);
     __dirname6 = dirname5(__filename5);
     SCENARIOS_DIR_PROD = resolve4(__dirname6, "scenarios");
@@ -2607,8 +2704,8 @@ function runHeuristicCheck(input) {
   }
   highestRiskType = topRiskType || highestRiskType;
   const agentExt = mergeAgentExtensions(
-    getAgentExtensions(input.agentId),
-    getScenarioExtensions(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "")
+    isLayerEnabled("agent_rules_enabled") ? getAgentExtensions(input.agentId) : null,
+    isLayerEnabled("scenario_rules_enabled") ? getScenarioExtensionsMulti(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "") : null
   );
   if (agentExt?.extra_command_patterns) {
     for (const rule of agentExt.extra_command_patterns) {
@@ -3053,6 +3150,7 @@ var init_heuristic = __esm({
     init_config();
     init_agents();
     init_scenarios();
+    init_runtime_config();
     init_rules_loader();
     init_logic_rules();
     INJECTION_KEYWORDS = (() => {
@@ -3252,6 +3350,112 @@ var init_token_stats = __esm({
   }
 });
 
+// src/engine/formal-engine/decode.ts
+var decode_exports = {};
+__export(decode_exports, {
+  allCandidates: () => allCandidates,
+  decodeBase64Literals: () => decodeBase64Literals,
+  decodeUrlAndNumeric: () => decodeUrlAndNumeric,
+  matchStageAny: () => matchStageAny
+});
+function isValidBase64Token(tok) {
+  if (tok.length < 8) return false;
+  if (!(tok.length % 4 === 0 || tok.endsWith("==") || tok.endsWith("="))) return false;
+  return true;
+}
+function isPrintable(s) {
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c < 32 || c > 126) return false;
+  }
+  return true;
+}
+function decodeBase64Literals(text) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const m of text.matchAll(B64_TOKEN_RE)) {
+    const tok = m[0];
+    if (!isValidBase64Token(tok)) continue;
+    if (!/[A-Z]/.test(tok) || !/[a-z]/.test(tok)) continue;
+    try {
+      const padded = tok + "=".repeat((4 - tok.length % 4) % 4);
+      const bin = Buffer.from(padded, "base64");
+      const s = bin.toString("utf8");
+      if (s && isPrintable(s) && !seen.has(s)) {
+        seen.add(s);
+        out.push(s);
+      }
+    } catch {
+    }
+  }
+  return out;
+}
+function decodeUrlAndNumeric(text) {
+  const out = [];
+  let s = text;
+  for (let i = 0; i < 3; i++) {
+    let nxt = s;
+    try {
+      nxt = decodeURIComponent(s);
+    } catch {
+      break;
+    }
+    if (nxt === s) break;
+    s = nxt;
+  }
+  if (s !== text) out.push(s);
+  if (/\\[0-7]{3}/.test(text)) {
+    let expanded = "";
+    try {
+      expanded = text.replace(/\\[0-7]{3}/g, (m) => String.fromCharCode(parseInt(m.slice(1), 8)));
+    } catch {
+    }
+    if (expanded && expanded !== text) out.push(expanded);
+  }
+  if (/\\x[0-9a-fA-F]{2}/.test(text)) {
+    let expanded = "";
+    try {
+      expanded = text.replace(/\\x[0-9a-fA-F]{2}/g, (m) => String.fromCharCode(parseInt(m.slice(2), 16)));
+    } catch {
+    }
+    if (expanded && expanded !== text) out.push(expanded);
+  }
+  return out;
+}
+function allCandidates(detail, max = 8) {
+  const cands = [detail];
+  cands.push(...decodeBase64Literals(detail));
+  cands.push(...decodeUrlAndNumeric(detail));
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const c of cands) {
+    if (seen.has(c) || c.length > 4096) continue;
+    seen.add(c);
+    out.push(c);
+    if (out.length >= max) break;
+  }
+  return out;
+}
+function matchStageAny(detail, stages) {
+  for (const cand of allCandidates(detail)) {
+    for (const [name, pats] of Object.entries(stages)) {
+      for (const p of pats) {
+        p.lastIndex = 0;
+        if (p.test(cand)) return name;
+      }
+    }
+  }
+  return "";
+}
+var B64_TOKEN_RE;
+var init_decode = __esm({
+  "src/engine/formal-engine/decode.ts"() {
+    "use strict";
+    init_esm_shims();
+    B64_TOKEN_RE = /[A-Za-z0-9+/]+={0,2}/g;
+  }
+});
+
 // node_modules/better-sqlite3/lib/util.js
 var require_util = __commonJS({
   "node_modules/better-sqlite3/lib/util.js"(exports) {
@@ -3335,7 +3539,7 @@ var require_bindings = __commonJS({
     var fs7 = __require("fs");
     var path6 = __require("path");
     var fileURLToPath10 = require_file_uri_to_path();
-    var join10 = path6.join;
+    var join11 = path6.join;
     var dirname11 = path6.dirname;
     var exists = fs7.accessSync && function(path7) {
       try {
@@ -3395,7 +3599,7 @@ var require_bindings = __commonJS({
       var requireFunc = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
       var tries = [], i = 0, l = opts.try.length, n, b, err;
       for (; i < l; i++) {
-        n = join10.apply(
+        n = join11.apply(
           null,
           opts.try[i].map(function(p) {
             return opts[p] || p;
@@ -3456,7 +3660,7 @@ var require_bindings = __commonJS({
         if (dir === ".") {
           dir = process.cwd();
         }
-        if (exists(join10(dir, "package.json")) || exists(join10(dir, "node_modules"))) {
+        if (exists(join11(dir, "package.json")) || exists(join11(dir, "node_modules"))) {
           return dir;
         }
         if (prev === dir) {
@@ -3465,7 +3669,7 @@ var require_bindings = __commonJS({
           );
         }
         prev = dir;
-        dir = join10(dir, "..");
+        dir = join11(dir, "..");
       }
     };
   }
@@ -4171,7 +4375,7 @@ function loadTemplates() {
 // src/engine/script-analyzer.ts
 init_esm_shims();
 import { readFileSync as readFileSync8 } from "fs";
-import { resolve as resolve6, join as join3 } from "path";
+import { resolve as resolve6, join as join4 } from "path";
 var SUSPICIOUS_PATTERNS = [
   // Network exfiltration (curl/wget POST in scripts is almost never legitimate)
   { name: "curl POST", pattern: /curl\s+(.*\s)?-X\s+POST/i },
@@ -4304,7 +4508,7 @@ function assessKeywordCombinationRisk(matchedKeywords, scriptContent) {
 }
 function readScriptContent(scriptPath, maxLines = 500) {
   try {
-    const expandedPath = scriptPath.startsWith("~") ? join3(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve6(scriptPath);
+    const expandedPath = scriptPath.startsWith("~") ? join4(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve6(scriptPath);
     const raw = readFileSync8(expandedPath, "utf-8");
     const lines = raw.split("\n").slice(0, maxLines);
     return { content: lines.join("\n"), lineCount: lines.length, error: "" };
@@ -4360,8 +4564,8 @@ init_esm_shims();
 init_heuristic();
 init_logic_rules();
 import { statSync as statSync2, existsSync as existsSync9 } from "fs";
-import { resolve as resolve8, join as join5, isAbsolute as isAbsolute2 } from "path";
-import { homedir as homedir3 } from "os";
+import { resolve as resolve8, join as join6, isAbsolute as isAbsolute2 } from "path";
+import { homedir as homedir4 } from "os";
 
 // src/engine/script-engine/tracker.ts
 init_esm_shims();
@@ -6006,7 +6210,7 @@ function extractInlineScriptPath(actionDetail) {
 function resolvePath2(p) {
   let expanded = p;
   if (expanded.startsWith("~/") || expanded === "~") {
-    expanded = join5(homedir3(), expanded.slice(1));
+    expanded = join6(homedir4(), expanded.slice(1));
   }
   return resolve8(expanded);
 }
@@ -6087,7 +6291,7 @@ function analyzeScriptContent2(input) {
     isInline = true;
   }
   if (resolvedPath && !isAbsolute2(resolvedPath) && !resolvedPath.startsWith("~/")) {
-    resolvedPath = join5(input.cwd || process.cwd(), resolvedPath);
+    resolvedPath = join6(input.cwd || process.cwd(), resolvedPath);
   }
   const l1Adapter = (content) => {
     const virtualInput = {
@@ -6398,6 +6602,7 @@ async function analyzeWithLLM(prompt, config) {
 
 // src/engine/coordinator.ts
 init_config();
+init_runtime_config();
 init_agents();
 init_scenarios();
 
@@ -6407,9 +6612,9 @@ init_esm_shims();
 // src/brain/rule-store.ts
 init_esm_shims();
 import { existsSync as existsSync11, readFileSync as readFileSync12, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
-import { join as join6 } from "path";
-import { homedir as homedir4 } from "os";
-var DEFAULT_RULES_PATH = join6(homedir4(), ".agentmoss", "brain", "rules.json");
+import { join as join7 } from "path";
+import { homedir as homedir5 } from "os";
+var DEFAULT_RULES_PATH = join7(homedir5(), ".agentmoss", "brain", "rules.json");
 var ENV_RULES_PATH = "AGENT_MOSS_BRAIN_RULES_PATH";
 var STATUS_DRAFT = "draft";
 var STATUS_APPROVED = "approved";
@@ -6935,98 +7140,132 @@ init_esm_shims();
 // src/engine/formal-engine/builder.ts
 init_esm_shims();
 init_rules_loader();
+init_decode();
 
-// src/engine/formal-engine/decode.ts
+// src/engine/formal-engine/ltl.ts
 init_esm_shims();
-var B64_TOKEN_RE = /[A-Za-z0-9+/]+={0,2}/g;
-function isValidBase64Token(tok) {
-  if (tok.length < 8) return false;
-  if (!(tok.length % 4 === 0 || tok.endsWith("==") || tok.endsWith("="))) return false;
-  return true;
-}
-function isPrintable(s) {
-  for (let i = 0; i < s.length; i++) {
-    const c = s.charCodeAt(i);
-    if (c < 32 || c > 126) return false;
-  }
-  return true;
+init_rules_loader();
+
+// src/engine/formal-engine/ir.ts
+init_esm_shims();
+function allNodes(mg) {
+  const out = [];
+  for (const s of mg.sessions) out.push(...s.nodes);
+  return out;
 }
-function decodeBase64Literals(text) {
+function allEdges(mg) {
   const out = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const m of text.matchAll(B64_TOKEN_RE)) {
-    const tok = m[0];
-    if (!isValidBase64Token(tok)) continue;
-    if (!/[A-Z]/.test(tok) || !/[a-z]/.test(tok)) continue;
-    try {
-      const padded = tok + "=".repeat((4 - tok.length % 4) % 4);
-      const bin = Buffer.from(padded, "base64");
-      const s = bin.toString("utf8");
-      if (s && isPrintable(s) && !seen.has(s)) {
-        seen.add(s);
-        out.push(s);
+  for (const s of mg.sessions) out.push(...s.edges);
+  out.push(...mg.crossEdges);
+  return out;
+}
+function emptyVerificationResult() {
+  return { verified: true, violations: [] };
+}
+
+// src/engine/formal-engine/ltl.ts
+var AP_RE = null;
+function compileAps(apPatterns) {
+  if (AP_RE) return;
+  AP_RE = {};
+  for (const [name, pats] of Object.entries(apPatterns || {})) {
+    AP_RE[name] = pats.map((p) => new RegExp(p, "i"));
+  }
+}
+function labelEvent(actionDetail) {
+  if (!AP_RE) compileAps(loadMC().ap_patterns || {});
+  let candidates = [actionDetail];
+  try {
+    candidates = (init_decode(), __toCommonJS(decode_exports)).allCandidates(actionDetail);
+  } catch {
+  }
+  const hits = /* @__PURE__ */ new Set();
+  for (const [name, pats] of Object.entries(AP_RE || {})) {
+    for (const c of candidates) {
+      const m = pats.some((p) => p.test(c));
+      if (m) {
+        hits.add(name);
+        break;
       }
-    } catch {
     }
   }
-  return out;
+  return hits;
 }
-function decodeUrlAndNumeric(text) {
-  const out = [];
-  let s = text;
-  for (let i = 0; i < 3; i++) {
-    let nxt = s;
-    try {
-      nxt = decodeURIComponent(s);
-    } catch {
-      break;
+function evaluateLTL(formula, trace, pos) {
+  const op = formula[0];
+  switch (op) {
+    case "ap":
+      return trace[pos].has(formula[1]);
+    case "!":
+      return !evaluateLTL(formula[1], trace, pos);
+    case "&":
+      return evaluateLTL(formula[1], trace, pos) && evaluateLTL(formula[2], trace, pos);
+    case "|":
+      return evaluateLTL(formula[1], trace, pos) || evaluateLTL(formula[2], trace, pos);
+    case "->":
+      return !evaluateLTL(formula[1], trace, pos) || evaluateLTL(formula[2], trace, pos);
+    case "X":
+      return pos + 1 < trace.length && evaluateLTL(formula[1], trace, pos + 1);
+    case "G": {
+      for (let j = pos; j < trace.length; j++) {
+        if (!evaluateLTL(formula[1], trace, j)) return false;
+      }
+      return true;
     }
-    if (nxt === s) break;
-    s = nxt;
-  }
-  if (s !== text) out.push(s);
-  if (/\\[0-7]{3}/.test(text)) {
-    let expanded = "";
-    try {
-      expanded = text.replace(/\\[0-7]{3}/g, (m) => String.fromCharCode(parseInt(m.slice(1), 8)));
-    } catch {
+    case "F": {
+      for (let j = pos; j < trace.length; j++) {
+        if (evaluateLTL(formula[1], trace, j)) return true;
+      }
+      return false;
     }
-    if (expanded && expanded !== text) out.push(expanded);
-  }
-  if (/\\x[0-9a-fA-F]{2}/.test(text)) {
-    let expanded = "";
-    try {
-      expanded = text.replace(/\\x[0-9a-fA-F]{2}/g, (m) => String.fromCharCode(parseInt(m.slice(2), 16)));
-    } catch {
+    case "U": {
+      for (let j = pos; j < trace.length; j++) {
+        if (evaluateLTL(formula[2], trace, j)) {
+          for (let k = pos; k < j; k++) {
+            if (!evaluateLTL(formula[1], trace, k)) return false;
+          }
+          return true;
+        }
+      }
+      return false;
     }
-    if (expanded && expanded !== text) out.push(expanded);
+    default:
+      return false;
   }
-  return out;
 }
-function allCandidates(detail, max = 8) {
-  const cands = [detail];
-  cands.push(...decodeBase64Literals(detail));
-  cands.push(...decodeUrlAndNumeric(detail));
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const c of cands) {
-    if (seen.has(c) || c.length > 4096) continue;
-    seen.add(c);
-    out.push(c);
-    if (out.length >= max) break;
+function ruleViolates(rule, traceWith, witnessMode) {
+  const formula = rule?.formula;
+  if (!Array.isArray(formula) || formula.length === 0) return false;
+  const satWith = evaluateLTL(formula, traceWith, 0);
+  if (!satWith) return false;
+  if (witnessMode && traceWith.length > 1) {
+    const traceWithout = traceWith.slice(0, -1);
+    if (evaluateLTL(formula, traceWithout, 0)) return false;
   }
-  return out;
+  return true;
 }
-function matchStageAny(detail, stages) {
-  for (const cand of allCandidates(detail)) {
-    for (const [name, pats] of Object.entries(stages)) {
-      for (const p of pats) {
-        p.lastIndex = 0;
-        if (p.test(cand)) return name;
-      }
+function checkMCRules(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length === 0) return violations;
+  const mc = loadMC();
+  const rules = mc.rules || [];
+  if (rules.length === 0) return violations;
+  const trace = nodes.map((n) => labelEvent(n.actionDetail));
+  const witnessMode = graph.witnessIdx !== void 0;
+  for (const rule of rules) {
+    if (rule?.type !== "ltl" || !(rule.enabled !== false)) continue;
+    if (ruleViolates(rule, trace, witnessMode)) {
+      violations.push({
+        propertyId: String(rule.id || "mc-ltl"),
+        reason: String(rule.reason || "L2.2 \u6A21\u578B\u68C0\u6D4B\u89C4\u5219\u547D\u4E2D"),
+        riskLevel: String(rule.risk_level || "high"),
+        path: nodes.filter((n) => labelEvent(n.actionDetail).size > 0).slice(-3).map((n) => ({ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }))
+      });
+      if (witnessMode) return violations;
     }
   }
-  return "";
+  return violations;
 }
 
 // src/engine/formal-engine/builder.ts
@@ -7057,6 +7296,26 @@ function extractResources(actionDetail) {
 function markStage(actionDetail) {
   return matchStageAny(actionDetail, loadStages());
 }
+function markIntegrity(actionDetail) {
+  const aps = labelEvent(actionDetail);
+  if (aps.has("download_file") || aps.has("prompt_injection")) {
+    return { integrity: "low", isLowSource: true };
+  }
+  return { integrity: "medium", isLowSource: false };
+}
+function initNode(sessionId, seq, actionType, actionDetail) {
+  const { integrity, isLowSource } = markIntegrity(actionDetail);
+  return {
+    sessionId,
+    seq,
+    actionType,
+    actionDetail,
+    stage: markStage(actionDetail),
+    resources: extractResources(actionDetail),
+    integrity,
+    isLowSource
+  };
+}
 function buildSessionGraph(actionHistory, aNext, sessionId = "current") {
   const nodes = [];
   const edges = [];
@@ -7070,17 +7329,9 @@ function buildSessionGraph(actionHistory, aNext, sessionId = "current") {
     details.push({ actionType: String(aNext.actionType || ""), actionDetail: String(aNext.actionDetail || "") });
   }
   details.forEach((d, seq) => {
-    const stage = markStage(d.actionDetail);
-    const node = {
-      sessionId,
-      seq,
-      actionType: d.actionType,
-      actionDetail: d.actionDetail,
-      stage,
-      resources: extractResources(d.actionDetail)
-    };
+    const node = initNode(sessionId, seq, d.actionType, d.actionDetail);
     nodes.push(node);
-    if (stage) stageFlags.add(stage);
+    if (node.stage) stageFlags.add(node.stage);
   });
   for (let i = 0; i < nodes.length - 1; i++) {
     edges.push({ src: i, dst: i + 1, kind: "next" });
@@ -7100,15 +7351,12 @@ function buildMultiSessionGraph(sessions, aNext) {
   if (aNext) {
     const last = mg.sessions[mg.sessions.length - 1];
     if (last.sessionId === "current") {
-      const stage = markStage(String(aNext.actionDetail || ""));
-      last.nodes.push({
-        sessionId: last.sessionId,
-        seq: last.nodes.length,
-        actionType: String(aNext.actionType || ""),
-        actionDetail: String(aNext.actionDetail || ""),
-        stage,
-        resources: extractResources(String(aNext.actionDetail || ""))
-      });
+      last.nodes.push(initNode(
+        last.sessionId,
+        last.nodes.length,
+        String(aNext.actionType || ""),
+        String(aNext.actionDetail || "")
+      ));
       if (last.nodes.length > 1) {
         last.edges.push({ src: last.nodes.length - 2, dst: last.nodes.length - 1, kind: "next" });
       }
@@ -7122,11 +7370,25 @@ function buildMultiSessionGraph(sessions, aNext) {
 function addCrossDataEdges(mg) {
   const nodes = allNodesFlat(mg);
   if (nodes.length < 2) return;
-  for (let i = 0; i < nodes.length; i++) {
-    for (let j = i + 1; j < nodes.length; j++) {
-      if (nodes[i].sessionId === nodes[j].sessionId) continue;
-      const shared = intersect(nodes[i].resources, nodes[j].resources);
-      if (shared.size > 0) {
+  const resIndex = /* @__PURE__ */ new Map();
+  nodes.forEach((n, i) => {
+    for (const r of n.resources) {
+      const list = resIndex.get(r);
+      if (list) list.push(i);
+      else resIndex.set(r, [i]);
+    }
+  });
+  const seen = /* @__PURE__ */ new Set();
+  for (const idxs of resIndex.values()) {
+    if (idxs.length < 2) continue;
+    for (let a = 0; a < idxs.length; a++) {
+      const i = idxs[a];
+      for (let b = a + 1; b < idxs.length; b++) {
+        const j = idxs[b];
+        if (nodes[i].sessionId === nodes[j].sessionId) continue;
+        const key = `${i}:${j}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
         mg.crossEdges.push({ src: i, dst: j, kind: "data" });
       }
     }
@@ -7137,28 +7399,6 @@ function allNodesFlat(mg) {
   for (const s of mg.sessions) out.push(...s.nodes);
   return out;
 }
-function intersect(a, b) {
-  const out = /* @__PURE__ */ new Set();
-  for (const v of a) if (b.has(v)) out.add(v);
-  return out;
-}
-
-// src/engine/formal-engine/ir.ts
-init_esm_shims();
-function allNodes(mg) {
-  const out = [];
-  for (const s of mg.sessions) out.push(...s.nodes);
-  return out;
-}
-function allEdges(mg) {
-  const out = [];
-  for (const s of mg.sessions) out.push(...s.edges);
-  out.push(...mg.crossEdges);
-  return out;
-}
-function emptyVerificationResult() {
-  return { verified: true, violations: [] };
-}
 
 // src/engine/formal-engine/properties.ts
 init_esm_shims();
@@ -7181,27 +7421,50 @@ function checkCrossSessionChain(graph) {
   const violations = [];
   const nodes = allNodes(graph);
   if (nodes.length === 0) return violations;
+  const witness = graph.witnessIdx;
   for (const chain of loadCrossSessionChains()) {
     const stages = chain.stages;
     if (!stages.length) continue;
-    let matched = 0;
-    let stageIdx = 0;
-    const path6 = [];
-    for (const n of nodes) {
-      if (stageIdx < stages.length && n.stage === stages[stageIdx]) {
-        matched += 1;
-        path6.push({ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) });
-        stageIdx += 1;
-        if (matched >= stages.length) break;
+    if (witness !== void 0) {
+      if (nodes[witness].stage !== stages[stages.length - 1]) continue;
+      let matched = 0;
+      const path6 = [];
+      for (let k = 0; k < witness; k++) {
+        const n = nodes[k];
+        if (matched < stages.length - 1 && n.stage === stages[matched]) {
+          matched += 1;
+          path6.push({ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) });
+        }
       }
-    }
-    if (matched >= stages.length) {
+      if (matched < stages.length - 1) continue;
+      path6.push({ sessionId: nodes[witness].sessionId, seq: nodes[witness].seq, detail: nodes[witness].actionDetail.slice(0, 60) });
       violations.push({
         propertyId: "cross-" + chain.id,
         reason: chain.reason,
         riskLevel: chain.riskLevel,
         path: path6
       });
+      return violations;
+    } else {
+      let matched = 0;
+      let stageIdx = 0;
+      const path6 = [];
+      for (const n of nodes) {
+        if (stageIdx < stages.length && n.stage === stages[stageIdx]) {
+          matched += 1;
+          path6.push({ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) });
+          stageIdx += 1;
+          if (matched >= stages.length) break;
+        }
+      }
+      if (matched >= stages.length) {
+        violations.push({
+          propertyId: "cross-" + chain.id,
+          reason: chain.reason,
+          riskLevel: chain.riskLevel,
+          path: path6
+        });
+      }
     }
   }
   return violations;
@@ -7236,7 +7499,10 @@ function checkSensitiveDataFlow(graph) {
       }
     }
   }
-  for (const [i, n] of nodes.entries()) {
+  const witness = graph.witnessIdx;
+  const candidates = witness !== void 0 ? [witness] : nodes.map((_, i) => i);
+  for (const i of candidates) {
+    const n = nodes[i];
     if (tainted.has(i) && EXFIL_RE.test(n.actionDetail)) {
       violations.push({
         propertyId: "sensitive-data-exfil",
@@ -7244,6 +7510,7 @@ function checkSensitiveDataFlow(graph) {
         riskLevel: "critical",
         path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
       });
+      if (witness !== void 0) return violations;
     }
   }
   return violations;
@@ -7274,6 +7541,32 @@ function checkNeverExfilAfterPrivesc(graph) {
   const violations = [];
   const nodes = allNodes(graph);
   if (nodes.length < 2) return violations;
+  const witness = graph.witnessIdx;
+  if (witness !== void 0) {
+    const evIdx = [];
+    nodes.forEach((n, i) => {
+      if ((i === witness || n.sessionId === "ebpf-evidence") && isExfilNode(n)) evIdx.push(i);
+    });
+    if (evIdx.length === 0) return violations;
+    const firstEv = Math.min(...evIdx);
+    let pre = null;
+    for (let i = 0; i < firstEv; i++) {
+      if (isPrivescNode(nodes[i])) pre = nodes[i];
+    }
+    if (pre) {
+      const post = nodes[firstEv];
+      return [{
+        propertyId: "no-privesc-then-exfil",
+        reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\xAC\u25C7EXFIL)",
+        riskLevel: "critical",
+        path: [
+          { sessionId: pre.sessionId, seq: pre.seq, detail: pre.actionDetail.slice(0, 60) },
+          { sessionId: post.sessionId, seq: post.seq, detail: post.actionDetail.slice(0, 60) }
+        ]
+      }];
+    }
+    return violations;
+  }
   for (let i = 0; i < nodes.length; i++) {
     if (!isPrivescNode(nodes[i])) continue;
     for (let j = i + 1; j < nodes.length; j++) {
@@ -7297,6 +7590,32 @@ function checkNeverExfilAfterCred(graph) {
   const violations = [];
   const nodes = allNodes(graph);
   if (nodes.length < 2) return violations;
+  const witness = graph.witnessIdx;
+  if (witness !== void 0) {
+    const evIdx = [];
+    nodes.forEach((n, i) => {
+      if ((i === witness || n.sessionId === "ebpf-evidence") && isExfilNode(n)) evIdx.push(i);
+    });
+    if (evIdx.length === 0) return violations;
+    const firstEv = Math.min(...evIdx);
+    let pre = null;
+    for (let i = 0; i < firstEv; i++) {
+      if (isCredNode(nodes[i])) pre = nodes[i];
+    }
+    if (pre) {
+      const post = nodes[firstEv];
+      return [{
+        propertyId: "no-cred-then-exfil",
+        reason: "\u8BFB\u53D6\u51ED\u636E\u540E\u51FA\u73B0\u5916\u4F20\uFF0C\u8FDD\u53CD \u25A1(CRED\u2192\xAC\u25C7EXFIL)",
+        riskLevel: "critical",
+        path: [
+          { sessionId: pre.sessionId, seq: pre.seq, detail: pre.actionDetail.slice(0, 60) },
+          { sessionId: post.sessionId, seq: post.seq, detail: post.actionDetail.slice(0, 60) }
+        ]
+      }];
+    }
+    return violations;
+  }
   for (let i = 0; i < nodes.length; i++) {
     if (!isCredNode(nodes[i])) continue;
     for (let j = i + 1; j < nodes.length; j++) {
@@ -7316,11 +7635,172 @@ function checkNeverExfilAfterCred(graph) {
   }
   return violations;
 }
+var TOOL_REGISTRY = null;
+function getToolRegistry() {
+  if (TOOL_REGISTRY) return TOOL_REGISTRY;
+  TOOL_REGISTRY = loadToolRegistry().tools || {};
+  return TOOL_REGISTRY;
+}
+function lookupToolClass(actionType) {
+  const entry = getToolRegistry()[actionType] || {};
+  return entry.actionClass;
+}
+var COMPUTE_RE = /subprocess|os\.system|shell\s*=\s*True|\beval\(|\bexec\(|bash\s+[^\s]|sh\s+-c|python3?\s+|node\s+|\btimeout\s+|nohup\s+|\b\.\/[\w./-]+/i;
+var STRONG_COMPUTE_TYPES = /* @__PURE__ */ new Set(["python", "node", "exec", "terminal", "cmd"]);
+function isComputeNode(n) {
+  if (STRONG_COMPUTE_TYPES.has(n.actionType.toLowerCase())) return true;
+  const cls = lookupToolClass(n.actionType);
+  if (cls === "read" || cls === "write" || cls === "network_egress" || cls === "message_egress") return false;
+  return COMPUTE_RE.test(n.actionDetail);
+}
+function checkLowIntegrityCommandExec(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length === 0) return violations;
+  const witness = graph.witnessIdx;
+  const lowResources = /* @__PURE__ */ new Set();
+  const lowAt = /* @__PURE__ */ new Map();
+  nodes.forEach((n, i) => {
+    if (n.isLowSource) {
+      lowAt.set(i, n.actionDetail.slice(0, 60));
+      for (const r of n.resources) lowResources.add(r);
+    }
+  });
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (let i = 0; i < nodes.length; i++) {
+      if (lowAt.has(i)) continue;
+      let shared = "";
+      for (const r of nodes[i].resources) {
+        if (lowResources.has(r)) {
+          shared = r;
+          break;
+        }
+      }
+      if (shared) {
+        lowAt.set(i, `\u7EE7\u627F\u81EA ${shared}`);
+        for (const r of nodes[i].resources) lowResources.add(r);
+        changed = true;
+      }
+    }
+  }
+  if (lowAt.size === 0) return violations;
+  const candidates = witness !== void 0 ? [witness] : nodes.map((_, i) => i);
+  for (const i of candidates) {
+    const n = nodes[i];
+    if (lowAt.has(i) && isComputeNode(n)) {
+      violations.push({
+        propertyId: "low-integrity-controls-command-exec",
+        reason: `\u4F4E\u5B8C\u6574\u6027\u6570\u636E\u63A7\u5236\u547D\u4EE4\u6267\u884C\uFF1A${lowAt.get(i)} \u2192 ${n.sessionId}#${n.seq} \u6267\u884C\u4E0D\u53EF\u4FE1\u5185\u5BB9`,
+        riskLevel: "critical",
+        path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
+      });
+      if (witness !== void 0) return violations;
+    }
+  }
+  return violations;
+}
+var DL_OR_LOW_RE = /curl\s+.*-o\b|wget\s+.*\s+-O\b|curl\s+.*\|\s*(bash|sh|python)|wget\s+.*\|\s*(bash|sh|python)|git\s+clone|docker\s+pull|pip\s+install|npm\s+install|base64\s+-d/i;
+function checkCrossSessionReachability(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length === 0) return violations;
+  const witness = graph.witnessIdx;
+  const sources = /* @__PURE__ */ new Set();
+  nodes.forEach((n, i) => {
+    if (n.isLowSource || DL_OR_LOW_RE.test(n.actionDetail)) sources.add(i);
+  });
+  if (sources.size === 0) return violations;
+  const reached = new Set(sources);
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const e of allEdges(graph)) {
+      if (reached.has(e.src) && !reached.has(e.dst)) {
+        const srcRes = nodes[e.src].resources;
+        const dstRes = nodes[e.dst].resources;
+        for (const r of srcRes) {
+          if (dstRes.has(r)) {
+            reached.add(e.dst);
+            changed = true;
+            break;
+          }
+        }
+      }
+    }
+  }
+  const candidates = witness !== void 0 ? [witness] : nodes.map((_, i) => i);
+  for (const i of candidates) {
+    const n = nodes[i];
+    if (sources.has(i)) continue;
+    if (reached.has(i)) {
+      const srcIdx = Math.min(...sources);
+      const srcDesc = nodes[srcIdx].actionDetail.slice(0, 40);
+      violations.push({
+        propertyId: "cross-session-reachability",
+        reason: `\u4F4E\u5B8C\u6574\u6027\u6E90\u7ECF\u8DE8 session \u6570\u636E\u94FE\u591A\u8DF3\u5230\u8FBE\u5F53\u524D\u6267\u884C\uFF08\u6E90: ${srcDesc} \u2192 ${n.sessionId}#${n.seq}\uFF09`,
+        riskLevel: "high",
+        path: nodes.slice(-3).map((m) => ({ sessionId: m.sessionId, seq: m.seq, detail: m.actionDetail.slice(0, 60) }))
+      });
+      if (witness !== void 0) return violations;
+    }
+  }
+  return violations;
+}
+function checkSensitiveDataAggregation(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length < 2) return violations;
+  const witness = graph.witnessIdx;
+  const resIndex = /* @__PURE__ */ new Map();
+  nodes.forEach((n, i) => {
+    for (const r of n.resources) {
+      const list = resIndex.get(r);
+      if (list) list.push(i);
+      else resIndex.set(r, [i]);
+    }
+  });
+  const sourcesFor = (exfilIdx) => {
+    const srcs = /* @__PURE__ */ new Set();
+    const n = nodes[exfilIdx];
+    for (const r of n.resources) {
+      for (const j of resIndex.get(r) || []) {
+        if (j === exfilIdx) continue;
+        srcs.add(`${nodes[j].sessionId}#${nodes[j].seq}`);
+      }
+    }
+    return srcs;
+  };
+  const candidates = witness !== void 0 ? [witness] : nodes.map((_, i) => i);
+  for (const i of candidates) {
+    const n = nodes[i];
+    if (!isExfilNode(n)) continue;
+    const srcs = sourcesFor(i);
+    if (srcs.size >= 2) {
+      violations.push({
+        propertyId: "sensitive-data-aggregation",
+        reason: `\u654F\u611F\u6570\u636E\u805A\u5408\u5916\u4F20\uFF1Aegress \u805A\u5408 ${srcs.size} \u4E2A\u4E8B\u4EF6\u6E90\u6570\u636E\uFF08Rule 12\uFF09`,
+        riskLevel: "critical",
+        path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
+      });
+      if (witness !== void 0) return violations;
+    }
+  }
+  return violations;
+}
 var ALL_PROPERTIES = [
   { id: "cross-session-chain", check: checkCrossSessionChain },
   { id: "sensitive-data-flow", check: checkSensitiveDataFlow },
+  { id: "cross-session-reachability", check: checkCrossSessionReachability },
   { id: "no-privesc-then-exfil", check: checkNeverExfilAfterPrivesc },
-  { id: "no-cred-then-exfil", check: checkNeverExfilAfterCred }
+  { id: "no-cred-then-exfil", check: checkNeverExfilAfterCred },
+  // L2.2 模型检测（通用 LTL 求值器，mc_rules.json 单一事实源；witness 语义见 ltl.ts）
+  { id: "mc-ltl-rules", check: checkMCRules },
+  // Rule 5 低完整性控制命令执行（integrity 维度，站点 L2.1 最有区分度的检测之一）
+  { id: "low-integrity-command-exec", check: checkLowIntegrityCommandExec },
+  // Rule 12 敏感数据聚合外传（egress 聚合 ≥2 事件源）
+  { id: "sensitive-data-aggregation", check: checkSensitiveDataAggregation }
 ];
 
 // src/engine/formal-engine/engine.ts
@@ -7352,6 +7832,9 @@ var FormalEngine = class {
       });
     }
     const graph = buildMultiSessionGraph(all, aNext);
+    if (aNext) {
+      graph.witnessIdx = allNodes(graph).length - 1;
+    }
     const result = emptyVerificationResult();
     for (const prop of this.properties) {
       let violations;
@@ -7380,6 +7863,7 @@ var FormalEngine = class {
 // src/engine/formal-engine/stateful.ts
 init_esm_shims();
 init_rules_loader();
+init_decode();
 var DESTROY_RE = /\b(?:pkill|kill)\b|systemctl\s+stop|service\s+stop|crontab\s+-r|rm\s+-[rf]?\s+/i;
 var NEVER_ACTIVATED_RE = /\b(?:not\s+found|no\s+such\s+file|command\s+not\s+found|refused|failed\s+to\s+(?:start|bind|listen)|address\s+already\s+in\s+use)\b/i;
 var CRED_FILE_RE2 = /(known_hosts|\.ssh|id_rsa|\/etc\/shadow|\/etc\/passwd|credentials)/i;
@@ -7892,6 +8376,7 @@ function getBrainStore() {
 }
 var formalEngine = new FormalEngine();
 async function runAnalysis(input) {
+  const observedFormalLayers = [];
   const heuristicResult = isHeuristicEnabled() ? runHeuristicCheck(input) : null;
   const isInlineScriptCmd = isInlineScriptCommand(input.aNext.actionDetail.toLowerCase());
   const isLiteralTextCmd = isLiteralTextCommand(input.aNext.actionDetail.toLowerCase());
@@ -7946,8 +8431,8 @@ async function runAnalysis(input) {
   const rawDetail = extractRawCommand(input.aNext.actionDetail);
   const lowerDetail = rawDetail.toLowerCase();
   const agentExt = mergeAgentExtensions(
-    getAgentExtensions(input.agentId),
-    getScenarioExtensions(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "")
+    isLayerEnabled("agent_rules_enabled") ? getAgentExtensions(input.agentId) : null,
+    isLayerEnabled("scenario_rules_enabled") ? getScenarioExtensionsMulti(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "") : null
   );
   if (FULLY_SAFE_TOOLS.has(actionType)) {
     return {
@@ -8064,15 +8549,22 @@ async function runAnalysis(input) {
     const formalResult = formalEngine.verify(formalSessions, input.aNext);
     if (!formalResult.verified) {
       const v = formalResult.violations[0];
-      return {
-        allowed: false,
-        reason: v ? v.reason : "\u5F62\u5F0F\u5316\u9A8C\u8BC1\u672A\u901A\u8FC7\uFF08\u884C\u4E3A\u6027\u8D28\u8FDD\u53CD\uFF09",
-        riskLevel: v ? v.riskLevel : "high",
-        riskType: "formal_verification",
-        confidence: 90,
-        source: "formal_engine",
-        violatedLayers: ["2.4"]
-      };
+      if (isFormalObserveMode()) {
+        console.warn(
+          `[AgentMoss] \u5F62\u5F0F\u5316\u9A8C\u8BC1 observe\uFF08\u53EA\u8BB0\u5F55\u4E0D\u62E6\u622A\uFF09: property=${v?.propertyId ?? "?"} risk=${v?.riskLevel ?? "?"} path_len=${v?.path?.length ?? 0} reason=${(v?.reason ?? "?").slice(0, 200)}`
+        );
+        observedFormalLayers.push("2.4");
+      } else {
+        return {
+          allowed: false,
+          reason: v ? v.reason : "\u5F62\u5F0F\u5316\u9A8C\u8BC1\u672A\u901A\u8FC7\uFF08\u884C\u4E3A\u6027\u8D28\u8FDD\u53CD\uFF09",
+          riskLevel: v ? v.riskLevel : "high",
+          riskType: "formal_verification",
+          confidence: 90,
+          source: "formal_engine",
+          violatedLayers: ["2.4"]
+        };
+      }
     }
   }
   if (scriptChain && scriptChain.nodes.length > 0 && isLogicRulesEnabled()) {
@@ -8119,7 +8611,7 @@ async function runAnalysis(input) {
       riskType: "",
       confidence: 85,
       source: "heuristic_and_logic_only",
-      violatedLayers: []
+      violatedLayers: observedFormalLayers.length > 0 ? [...observedFormalLayers] : []
     };
   }
   let skipL3Hints = "\u65E0\uFF08\u5F53\u524D\u65E0\u7981\u7528\u89C4\u5219\u547D\u4E2D\uFF09";
@@ -8164,7 +8656,7 @@ async function runAnalysis(input) {
         riskType: "",
         confidence: 50,
         source: "llm_failure_fallback",
-        violatedLayers: []
+        violatedLayers: observedFormalLayers.length > 0 ? [...observedFormalLayers] : []
       };
     }
     return {
@@ -8191,6 +8683,9 @@ async function runAnalysis(input) {
     } catch {
     }
   }
+  if (observedFormalLayers.length > 0 && llmResult.allowed) {
+    llmResult.violatedLayers = Array.from(/* @__PURE__ */ new Set([...observedFormalLayers, ...llmResult.violatedLayers || []]));
+  }
   return llmResult;
 }
 
@@ -8682,12 +9177,13 @@ init_esm_shims();
 init_esm_shims();
 init_runtime_config();
 init_token_stats();
+init_rules_loader();
 import { Hono } from "hono";
 import { readFileSync as readFileSync15, existsSync as existsSync14 } from "fs";
-import { join as join9, dirname as dirname10 } from "path";
+import { join as join10, dirname as dirname10 } from "path";
 import { fileURLToPath as fileURLToPath9 } from "url";
 var __dirname8 = dirname10(fileURLToPath9(import.meta.url));
-var STATIC_DIR = join9(__dirname8, "static");
+var STATIC_DIR = join10(__dirname8, "static");
 var CONSOLE_TOKEN_ENV = "AGENT_MOSS_CONSOLE_TOKEN";
 function getConsoleToken() {
   return process.env[CONSOLE_TOKEN_ENV] || "";
@@ -8711,7 +9207,7 @@ function createConsoleRouter() {
   const console2 = new Hono();
   console2.use("/api/*", authMiddleware());
   const serveIndex = (c) => {
-    const indexFile = join9(STATIC_DIR, "index.html");
+    const indexFile = join10(STATIC_DIR, "index.html");
     if (existsSync14(indexFile)) {
       return c.html(readFileSync15(indexFile, "utf-8"));
     }
@@ -8728,24 +9224,89 @@ function createConsoleRouter() {
     const rc = updateLayerEnabled(body.layer_key, body.enabled);
     return c.json({ layers: rc.layers, env_overrides: getEnvOverrides() });
   });
+  function getL24View() {
+    const ltlHuman = {
+      "mc-ltl-001": "\u5148\u8BFB\u53D6\u4E86\u51ED\u636E/\u5BC6\u94A5\uFF0C\u4E4B\u540E\u51FA\u73B0\u7F51\u7EDC\u5916\u4F20",
+      "mc-ltl-002": "\u5148\u4E0B\u8F7D/\u83B7\u53D6\u4E86\u6587\u4EF6\uFF0C\u4E4B\u540E\u6267\u884C\u4E86\u6587\u4EF6",
+      "mc-ltl-003": "\u5148\u7981\u7528\u4E86\u5B89\u5168\u9632\u62A4\uFF0C\u4E4B\u540E\u51FA\u73B0\u7834\u574F\u6027\u64CD\u4F5C\uFF08\u6267\u884C/\u5220\u9664/\u63D0\u6743\uFF09",
+      "mc-ltl-004": "\u5148\u51FA\u73B0\u63D0\u793A\u8BCD\u6CE8\u5165\uFF0C\u4E4B\u540E\u51FA\u73B0\u654F\u611F\u64CD\u4F5C\uFF08\u5916\u4F20/\u5199\u6587\u4EF6/\u6267\u884C\uFF09",
+      "mc-ltl-005": "\u5148\u8BFB\u53D6\u51ED\u636E\uFF0C\u4E4B\u540E\u51FA\u73B0\u6A2A\u5411\u79FB\u52A8\uFF08ssh/scp \u5230\u8FDC\u7A0B\uFF09",
+      "mc-ltl-006": "\u5148\u63A5\u89E6\u654F\u611F\u6570\u636E\uFF0C\u4E4B\u540E\u6E05\u9664\u65E5\u5FD7",
+      "mc-ltl-007": "\u5148\u63D0\u6743\uFF0C\u4E4B\u540E\u5B89\u88C5\u6301\u4E45\u5316\u540E\u95E8",
+      "mc-ltl-008": "\u5148\u4E0B\u8F7D\u6587\u4EF6\uFF0C\u4E4B\u540E\u5B89\u88C5\u6301\u4E45\u5316\u540E\u95E8",
+      "mc-ltl-009": "\u5148\u63A5\u89E6\u654F\u611F\u6570\u636E \u2192 \u6253\u5305\u538B\u7F29 \u2192 \u7F51\u7EDC\u5916\u4F20",
+      "mc-ltl-010": "\u5B89\u88C5\u4E86\u6301\u4E45\u5316\u673A\u5236\uFF08crontab/systemd/.bashrc \u7B49\uFF09\uFF0C\u9700\u5BA1\u6279",
+      "mc-ctl-001": "\u4EFB\u4F55\u60C5\u51B5\u4E0B\u4E0D\u5141\u8BB8\u6E05\u9664\u65E5\u5FD7\uFF08\u5B89\u5168\u5E95\u7EBF\uFF09"
+    };
+    const mc = loadMC();
+    const rules = mc.rules || [];
+    return {
+      enabled_via: "L2_logic_rules",
+      description: "\u65F6\u5E8F\u4E0E\u6570\u636E\u6D41\u653B\u51FB\u68C0\u6D4B\uFF08L2.2 \u6A21\u578B\u68C0\u6D4B\uFF09",
+      ltl_rules: rules.map((r) => ({
+        id: r.id,
+        type: r.type,
+        formula: Array.isArray(r.formula) ? "<\u516C\u5F0F>" : r.formula,
+        reason: r.reason,
+        risk_level: r.risk_level,
+        action: r.action,
+        enabled: r.enabled !== false,
+        human: ltlHuman[r.id] || r.reason || ""
+      }))
+    };
+  }
+  function withL24View(rc) {
+    if (rc && rc.L2_4 && typeof rc.L2_4 === "object" && !Array.isArray(rc.L2_4)) {
+      const cat = rc.L2_4.ltl_rules;
+      const rls = cat && cat.rules || [];
+      const ltlHumanLocal = {
+        "mc-ltl-001": "\u5148\u8BFB\u53D6\u4E86\u51ED\u636E/\u5BC6\u94A5\uFF0C\u4E4B\u540E\u51FA\u73B0\u7F51\u7EDC\u5916\u4F20",
+        "mc-ltl-002": "\u5148\u4E0B\u8F7D/\u83B7\u53D6\u4E86\u6587\u4EF6\uFF0C\u4E4B\u540E\u6267\u884C\u4E86\u6587\u4EF6",
+        "mc-ltl-003": "\u5148\u7981\u7528\u4E86\u5B89\u5168\u9632\u62A4\uFF0C\u4E4B\u540E\u51FA\u73B0\u7834\u574F\u6027\u64CD\u4F5C\uFF08\u6267\u884C/\u5220\u9664/\u63D0\u6743\uFF09",
+        "mc-ltl-004": "\u5148\u51FA\u73B0\u63D0\u793A\u8BCD\u6CE8\u5165\uFF0C\u4E4B\u540E\u51FA\u73B0\u654F\u611F\u64CD\u4F5C\uFF08\u5916\u4F20/\u5199\u6587\u4EF6/\u6267\u884C\uFF09",
+        "mc-ltl-005": "\u5148\u8BFB\u53D6\u51ED\u636E\uFF0C\u4E4B\u540E\u51FA\u73B0\u6A2A\u5411\u79FB\u52A8\uFF08ssh/scp \u5230\u8FDC\u7A0B\uFF09",
+        "mc-ltl-006": "\u5148\u63A5\u89E6\u654F\u611F\u6570\u636E\uFF0C\u4E4B\u540E\u6E05\u9664\u65E5\u5FD7",
+        "mc-ltl-007": "\u5148\u63D0\u6743\uFF0C\u4E4B\u540E\u5B89\u88C5\u6301\u4E45\u5316\u540E\u95E8",
+        "mc-ltl-008": "\u5148\u4E0B\u8F7D\u6587\u4EF6\uFF0C\u4E4B\u540E\u5B89\u88C5\u6301\u4E45\u5316\u540E\u95E8",
+        "mc-ltl-009": "\u5148\u63A5\u89E6\u654F\u611F\u6570\u636E \u2192 \u6253\u5305\u538B\u7F29 \u2192 \u7F51\u7EDC\u5916\u4F20",
+        "mc-ltl-010": "\u5B89\u88C5\u4E86\u6301\u4E45\u5316\u673A\u5236\uFF08crontab/systemd/.bashrc \u7B49\uFF09\uFF0C\u9700\u5BA1\u6279",
+        "mc-ctl-001": "\u4EFB\u4F55\u60C5\u51B5\u4E0B\u4E0D\u5141\u8BB8\u6E05\u9664\u65E5\u5FD7\uFF08\u5B89\u5168\u5E95\u7EBF\uFF09"
+      };
+      rc.L2_4 = {
+        enabled_via: "L2_logic_rules",
+        description: "\u65F6\u5E8F\u4E0E\u6570\u636E\u6D41\u653B\u51FB\u68C0\u6D4B\uFF08L2.2 \u6A21\u578B\u68C0\u6D4B\uFF09",
+        ltl_rules: rls.map((r) => ({
+          id: r.id,
+          type: "ltl",
+          formula: "<\u516C\u5F0F>",
+          reason: r.reason || "",
+          risk_level: r.risk_level || "high",
+          action: r.action || "block",
+          enabled: r.enabled !== false,
+          human: ltlHumanLocal[r.id] || r.reason || ""
+        }))
+      };
+    }
+    return rc;
+  }
   console2.get("/api/rules", (c) => {
     const rc = loadRuntimeConfig();
-    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules });
+    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules, L2_4: getL24View() });
   });
   console2.put("/api/rules/enabled", async (c) => {
     const b = await c.req.json();
     const rc = updateRuleEnabled(b.layer, b.category, b.rule_id, b.enabled);
-    return c.json(rc);
+    return c.json(withL24View(rc));
   });
   console2.put("/api/rules/deny_mode", async (c) => {
     const b = await c.req.json();
     const rc = updateRuleDenyMode(b.layer, b.category, b.rule_id, b.deny_mode);
-    return c.json(rc);
+    return c.json(withL24View(rc));
   });
   console2.put("/api/rules/skip_l3", async (c) => {
     const b = await c.req.json();
     const rc = updateRuleSkipL3(b.layer, b.category, b.rule_id, b.skip_l3_on_disabled);
-    return c.json(rc);
+    return c.json(withL24View(rc));
   });
   console2.put("/api/categories/enabled", async (c) => {
     const b = await c.req.json();
@@ -8804,9 +9365,9 @@ function createConsoleRouter() {
     if (!/^[A-Za-z0-9_-]+$/.test(skillId)) {
       return c.json({ error: "invalid skill_id" }, 400);
     }
-    const skillPath = join9(dirname10(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
+    const skillPath = join10(dirname10(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
     if (!existsSync14(skillPath)) {
-      const builtinPath = join9(__dirname8, "..", "..", "agent_moss", "skills", `${skillId}.md`);
+      const builtinPath = join10(__dirname8, "..", "..", "agent_moss", "skills", `${skillId}.md`);
       if (existsSync14(builtinPath)) return c.text(readFileSync15(builtinPath, "utf-8"));
       return c.json({ error: "skill not found" }, 404);
     }
@@ -8895,7 +9456,7 @@ function createConsoleRouter() {
   });
   console2.get("/api/config", (c) => {
     const rc = loadRuntimeConfig();
-    return c.json(rc);
+    return c.json({ ...rc, L2_4: getL24View() });
   });
   console2.get("/api/env-overrides", (c) => {
     return c.json({ overrides: getEnvOverrides() });
@@ -8972,4 +9533,7 @@ export {
   findFreePort,
   startServer
 };
+//! 顺序即 fail-closed 短路优先级：verify 逐个执行，首个返回违规的性质成为
+//! first_violation，后续不再评估。调整顺序影响判定归属，须与 Python
+//! properties.py ALL_PROPERTIES 保持一致并双端测试确认。
 //# sourceMappingURL=server.js.map