@kenhkl/agent-moss 0.12.9 → 0.14.0

package/dist/engine/coordinator.js

@@ -2,6 +2,12 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
@@ -127,6 +133,7 @@ __export(config_exports, {
   getRetryConfig: () => getRetryConfig,
   getTimeoutConfig: () => getTimeoutConfig,
   isBrainEnabled: () => isBrainEnabled,
+  isFormalObserveMode: () => isFormalObserveMode,
   isHeuristicEnabled: () => isHeuristicEnabled,
   isLLMAvailable: () => isLLMAvailable,
   isLogicRulesEnabled: () => isLogicRulesEnabled,
@@ -242,6 +249,7 @@ function getCustomRules() {
 }
 function isLLMAvailable() {
   if (process.env.AGENT_MOSS_DISABLE_LLM === "1") return false;
+  if (!layerEnabledOrDefault("L3_llm_analysis")) return false;
   return llmConfig.apiKey.length > 0;
 }
 async function probeLLMConnection(timeoutMs = 8e3) {
@@ -306,13 +314,26 @@ function getProviderHeaders(provider) {
   return PROVIDER_HEADERS[provider] || {};
 }
 function isHeuristicEnabled() {
-  return process.env.AGENT_MOSS_DISABLE_HEURISTIC !== "1";
+  if (process.env.AGENT_MOSS_DISABLE_HEURISTIC === "1") return false;
+  return layerEnabledOrDefault("L1_heuristic");
+}
+function layerEnabledOrDefault(key) {
+  try {
+    const { isLayerEnabled: isLayerEnabled2 } = __require("../infra/runtime-config");
+    return isLayerEnabled2(key);
+  } catch {
+    return true;
+  }
 }
 function isBrainEnabled() {
   return process.env.AGENT_MOSS_BRAIN_ENABLED === "1";
 }
 function isLogicRulesEnabled() {
-  return process.env.AGENT_MOSS_DISABLE_LOGIC_RULES !== "1";
+  if (process.env.AGENT_MOSS_DISABLE_LOGIC_RULES === "1") return false;
+  return layerEnabledOrDefault("L2_logic_rules");
+}
+function isFormalObserveMode() {
+  return process.env.AGENT_MOSS_FORMAL_OBSERVE === "1";
 }
 var timeoutConfig, retryConfig, llmConfig, __configModuleDir, USER_RULES_PATHS, customRules, PROVIDER_HEADERS;
 var init_config = __esm({
@@ -570,8 +591,12 @@ var init_inline_analyzer = __esm({
 
 // src/infra/rules-loader.ts
 import { readFileSync as readFileSync2, existsSync } from "fs";
-import { resolve, dirname } from "path";
+import { resolve, dirname, join as join2 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
+import { homedir as homedir2 } from "os";
+function dataRootDir() {
+  return process.env.AGENT_MOSS_DATA_DIR || join2(homedir2(), ".config", "agentmoss");
+}
 function findRulesFile(name) {
   for (const dir of RULES_DIR_CANDS) {
     const p = resolve(dir, name);
@@ -597,6 +622,24 @@ function loadL2() {
 function loadL3() {
   return loadJson("l3_rules.json");
 }
+function loadMC() {
+  const mc = loadJson("mc_rules.json");
+  const rules = mc.rules || [];
+  try {
+    const rt = (init_runtime_config(), __toCommonJS(runtime_config_exports));
+    if (rules.length > 0 && typeof rt.hasRuntimeConfig === "function" && rt.hasRuntimeConfig()) {
+      const rtRules = rt.loadRuntimeConfig()?.L2_2?.ltl_rules?.rules || [];
+      const enabledById = {};
+      for (const r of rtRules) if (r?.id) enabledById[r.id] = r.enabled !== false;
+      for (const r of rules) if (r?.id && r.id in enabledById) r.enabled = enabledById[r.id];
+    }
+  } catch {
+  }
+  return mc;
+}
+function loadToolRegistry() {
+  return loadJson("tool_registry.json");
+}
 var __filename2, __dirname2, RULES_DIR_CANDS;
 var init_rules_loader = __esm({
   "src/infra/rules-loader.ts"() {
@@ -606,6 +649,10 @@ var init_rules_loader = __esm({
     __dirname2 = dirname(__filename2);
     RULES_DIR_CANDS = (() => {
       const cands = [
+        // 用户数据目录覆盖优先（与 Python rules_loader._load_json 的
+        // <data_root>/rules/<name> 优先逻辑对齐）。用户安装 pip/npm 包后把自定义
+        // mc_rules.json 放到 <data_root>/rules/ 即可覆盖内置默认，无需改源码。
+        resolve(dataRootDir(), "rules"),
         // dist: __dirname=dist/ → dist/rules；__dirname=dist/engine/ → dist/engine/../rules=dist/rules
         resolve(__dirname2, "../rules"),
         resolve(__dirname2, "rules"),
@@ -629,7 +676,8 @@ function _loadSensitivePathScope(scope) {
     path: sp.path,
     riskLevel: sp.risk_level,
     desc: sp.desc,
-    credential: sp.deny_mode === "deny_both" ? true : void 0
+    credential: sp.deny_mode === "deny_both" ? true : void 0,
+    dirDelOnly: sp.dir_del_only === true ? true : void 0
   }));
 }
 function isWriteOperation(actionType, actionDetail, writeKeywords = WRITE_KEYWORDS) {
@@ -727,7 +775,7 @@ function runLogicCheck(input) {
             riskType: "intent_deviation",
             confidence: 85,
             source: "logic_rule",
-            violatedLayers: ["2"]
+            violatedLayers: ["L2.1"]
           };
         }
       }
@@ -751,7 +799,7 @@ function runLogicCheck(input) {
           riskType: "privilege_escalation",
           confidence: 85,
           source: "logic_rule",
-          violatedLayers: ["2"]
+          violatedLayers: ["L2.1"]
         };
       }
     }
@@ -803,7 +851,7 @@ function checkComboChain(actionHistory, actionDetailRaw) {
         riskType: "combo_chain",
         confidence: 85,
         source: "logic_rule",
-        violatedLayers: ["2"]
+        violatedLayers: ["L2.1"]
       };
     }
   }
@@ -928,7 +976,7 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
       riskType: "read_before_write",
       confidence: 85,
       source: "logic_rule",
-      violatedLayers: ["2"]
+      violatedLayers: ["L2.1"]
     };
   }
   return null;
@@ -948,7 +996,7 @@ function checkPasswordConsent(actionType, actionDetail, actionHistory) {
     riskType: "consent_missing",
     confidence: 85,
     source: "logic_rule",
-    violatedLayers: ["2"]
+    violatedLayers: ["L2.1"]
   };
 }
 function checkUserDeletionConsent(actionType, actionDetail, actionHistory) {
@@ -966,7 +1014,7 @@ function checkUserDeletionConsent(actionType, actionDetail, actionHistory) {
     riskType: "consent_missing",
     confidence: 85,
     source: "logic_rule",
-    violatedLayers: ["2"]
+    violatedLayers: ["L2.1"]
   };
 }
 function containsPrivilegeEscalation(actionDetail) {
@@ -1026,7 +1074,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
           riskType: "file_access",
           confidence: 95,
           source: "logic_rule",
-          violatedLayers: ["2"],
+          violatedLayers: ["L2.1"],
           isCredential: true
         };
       }
@@ -1042,7 +1090,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
             riskType: "file_access",
             confidence: 95,
             source: "logic_rule",
-            violatedLayers: ["2"]
+            violatedLayers: ["L2.1"]
           };
         }
       }
@@ -1056,7 +1104,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
     riskType: "file_access",
     confidence: 70,
     source: "logic_rule",
-    violatedLayers: ["2"]
+    violatedLayers: ["L2.1"]
   };
 }
 var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, WRITE_KEYWORDS, WRITE_COMMAND_RES, READ_ONLY_COMMANDS, DEVNULL_REDIRECT_RE, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
@@ -1068,7 +1116,7 @@ var init_logic_rules = __esm({
     init_rules_loader();
     ROOT_SENSITIVE_PATHS = _loadSensitivePathScope("root");
     HOME_SENSITIVE_PATHS = _loadSensitivePathScope("home");
-    CREDENTIAL_PATHS = _loadSensitivePathScope("credential").map(({ path: path5, riskLevel, desc }) => ({ path: path5, riskLevel, desc, credential: true }));
+    CREDENTIAL_PATHS = _loadSensitivePathScope("credential").map(({ path: path5, riskLevel, desc, dirDelOnly }) => ({ path: path5, riskLevel, desc, credential: true, dirDelOnly }));
     NON_WRITE_TOOLS = /* @__PURE__ */ new Set([
       "ask_user_question",
       "glob",
@@ -1343,6 +1391,7 @@ var init_skill_loader = __esm({
 // src/infra/runtime-config.ts
 var runtime_config_exports = {};
 __export(runtime_config_exports, {
+  DEFAULT_LAYERS: () => DEFAULT_LAYERS,
   DENY_MODE_LABELS: () => DENY_MODE_LABELS,
   addAgentRule: () => addAgentRule,
   addCustomRule: () => addCustomRule,
@@ -1394,7 +1443,7 @@ __export(runtime_config_exports, {
   updateSkillEnabled: () => updateSkillEnabled
 });
 import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync4, mkdirSync, unlinkSync, readdirSync as readdirSync3 } from "fs";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import { dirname as dirname3 } from "path";
 function runtimeDir() {
@@ -1418,6 +1467,7 @@ function emptyRuntimeConfig() {
     L1_rules: {},
     L2_rules: {},
     L3_skills: {},
+    L2_2: {},
     agent_rules: {},
     scenario_rules: {}
   };
@@ -1445,6 +1495,7 @@ function loadRuntimeConfig() {
       L1_rules: merged.L1_rules || {},
       L2_rules: merged.L2_rules || {},
       L3_skills: merged.L3_skills || {},
+      L2_2: merged.L2_2 || {},
       agent_rules: merged.agent_rules || {},
       scenario_rules: merged.scenario_rules || {}
     };
@@ -1497,6 +1548,7 @@ function getEnabledL2SensitivePaths(runtime) {
     const out = { path: r.path || "", risk_level: r.risk_level || "", desc: r.desc || "", deny_mode: r.deny_mode || "deny_write" };
     if (r.credential) out.credential = true;
     if (r.read_only) out.read_only = true;
+    if (r.dir_del_only) out.dir_del_only = true;
     return out;
   });
 }
@@ -1605,6 +1657,7 @@ function _l2SensitivePathsToRules() {
       builtin: true
     };
     _syncDenyModeFields(rule);
+    if (sp.dirDelOnly) rule.dir_del_only = true;
     return rule;
   });
 }
@@ -1692,7 +1745,7 @@ function _scenarioRulesToDefaults() {
     return out;
   }
   for (const scenarioId of entries) {
-    const rulesFile = join2(scenDir, scenarioId, "rules.json");
+    const rulesFile = join3(scenDir, scenarioId, "rules.json");
     if (!existsSync4(rulesFile)) continue;
     let data;
     try {
@@ -1741,7 +1794,7 @@ function _agentRulesToDefaults() {
     return out;
   }
   for (const agentId of entries) {
-    const rulesFile = join2(agentsDir, agentId, "rules.json");
+    const rulesFile = join3(agentsDir, agentId, "rules.json");
     if (!existsSync4(rulesFile)) continue;
     let data;
     try {
@@ -1782,7 +1835,7 @@ function _agentRulesToDefaults() {
 function generateSourceDefaults() {
   return {
     version: 1,
-    layers: { L1_heuristic: true, L2_logic_rules: true, L3_llm_analysis: true },
+    layers: { ...DEFAULT_LAYERS },
     L1_rules: {
       dangerous_commands: {
         category_enabled: true,
@@ -1821,10 +1874,45 @@ function generateSourceDefaults() {
       user_custom: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49 L2 \u903B\u8F91\u89C4\u5219", rules: [] }
     },
     L3_skills: _l3SkillsToRules(),
+    L2_2: _ltlRulesToRuntime(),
     agent_rules: _agentRulesToDefaults(),
     scenario_rules: _scenarioRulesToDefaults()
   };
 }
+function _ltlRulesToRuntime() {
+  const cands = [
+    join3(__dirname4, "..", "rules"),
+    join3(__dirname4, "..", "..", "..", "agent_moss", "rules"),
+    join3(process.cwd(), "agent_moss", "rules")
+  ];
+  let mc = {};
+  for (const dir of cands) {
+    const p = join3(dir, "mc_rules.json");
+    if (existsSync4(p)) {
+      try {
+        mc = JSON.parse(readFileSync4(p, "utf-8")) || {};
+      } catch {
+        mc = {};
+      }
+      break;
+    }
+  }
+  const rules = mc.rules || [];
+  return {
+    ltl_rules: {
+      category_enabled: true,
+      category_desc: "LTL \u653B\u51FB\u6A21\u5F0F\u89C4\u5219\uFF08\u65F6\u5E8F\u653B\u51FB\u68C0\u6D4B\uFF0C\u5148 A \u540E B\uFF09",
+      rules: rules.map((r) => ({
+        id: r.id,
+        reason: r.reason || "",
+        risk_level: r.risk_level || "high",
+        action: r.action || "block",
+        enabled: true,
+        builtin: true
+      }))
+    }
+  };
+}
 function normalizePatternForFingerprint(pattern) {
   return pattern.replace(/\\\//g, "/");
 }
@@ -1974,6 +2062,11 @@ function mergeConfig(userCfg, srcDefaults) {
   );
   _mergeRuleCategories(cfg, srcDefaults, "L1_rules");
   _mergeRuleCategories(cfg, srcDefaults, "L2_rules");
+  if (!cfg.L2_2 && cfg.L2_4) {
+    cfg.L2_2 = cfg.L2_4;
+    delete cfg.L2_4;
+  }
+  _mergeRuleCategories(cfg, srcDefaults, "L2_2");
   _mergeSkillCategories(cfg, srcDefaults, "L3_skills");
   _mergeAgentRules(cfg, srcDefaults);
   _mergeAgentRules(cfg, srcDefaults, "scenario_rules");
@@ -2166,12 +2259,12 @@ function deleteCustomRule(layer, category, ruleId) {
 function addCustomSkill(skillId, category, keywords, content) {
   _validateSkillId(skillId);
   const runtime = loadRuntimeConfig();
-  const skillsDir = join2(RUNTIME_CONFIG_DIR, "agent_moss_skills");
+  const skillsDir = join3(RUNTIME_CONFIG_DIR, "agent_moss_skills");
   try {
     mkdirSync(skillsDir, { recursive: true });
   } catch {
   }
-  writeFileSync(join2(skillsDir, `${skillId}.md`), content, "utf-8");
+  writeFileSync(join3(skillsDir, `${skillId}.md`), content, "utf-8");
   const l3 = runtime.L3_skills || (runtime.L3_skills = {});
   const cat = l3[category] || (l3[category] = { category_enabled: true, category_desc: "", skills: [] });
   (cat.skills || (cat.skills = [])).push({ id: skillId, keywords, enabled: true, builtin: false });
@@ -2186,7 +2279,7 @@ function deleteCustomSkill(skillId, category) {
   if (idx >= 0) {
     if (skills[idx].builtin) return null;
     skills.splice(idx, 1);
-    const skillPath = join2(RUNTIME_CONFIG_DIR, "agent_moss_skills", `${skillId}.md`);
+    const skillPath = join3(RUNTIME_CONFIG_DIR, "agent_moss_skills", `${skillId}.md`);
     try {
       if (existsSync4(skillPath)) unlinkSync(skillPath);
     } catch {
@@ -2380,7 +2473,7 @@ function updateScenarioCategoryEnabled(scenarioId, category, enabled) {
   saveRuntimeConfig(runtime);
   return runtime;
 }
-var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DENY_MODE_LABELS, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, SKILL_ID_RE;
+var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DEFAULT_LAYERS, DENY_MODE_LABELS, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, SKILL_ID_RE;
 var init_runtime_config = __esm({
   "src/infra/runtime-config.ts"() {
     "use strict";
@@ -2392,21 +2485,28 @@ var init_runtime_config = __esm({
     __dirname4 = dirname3(fileURLToPath5(import.meta.url));
     ENV_RUNTIME_CONFIG_PATH = "AGENT_MOSS_RUNTIME_CONFIG_PATH";
     RUNTIME_CONFIG_DIR = runtimeDir();
-    RUNTIME_CONFIG_PATH = join2(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
+    RUNTIME_CONFIG_PATH = join3(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
     LAYER_DISABLE_ENV = {
       L1_heuristic: "AGENT_MOSS_DISABLE_HEURISTIC",
       L2_logic_rules: "AGENT_MOSS_DISABLE_LOGIC_RULES",
       L3_llm_analysis: "AGENT_MOSS_DISABLE_LLM"
     };
+    DEFAULT_LAYERS = {
+      L1_heuristic: true,
+      L2_logic_rules: true,
+      L3_llm_analysis: true,
+      agent_rules_enabled: true,
+      scenario_rules_enabled: true
+    };
     DENY_MODE_LABELS = {
       deny_write: "\u4EC5\u62E6\u622A\u5199\u5165",
       deny_read: "\u4EC5\u62E6\u622A\u8BFB\u53D6",
       deny_both: "\u8BFB\u5199\u5747\u62E6\u622A"
     };
-    _AGENTS_DIR_PROD = join2(__dirname4, "agents");
-    _AGENTS_DIR_DEV = join2(__dirname4, "..", "..", "..", "agent_moss", "agents");
-    _SCENARIOS_DIR_PROD = join2(__dirname4, "scenarios");
-    _SCENARIOS_DIR_DEV = join2(__dirname4, "..", "..", "..", "agent_moss", "scenarios");
+    _AGENTS_DIR_PROD = join3(__dirname4, "agents");
+    _AGENTS_DIR_DEV = join3(__dirname4, "..", "..", "..", "agent_moss", "agents");
+    _SCENARIOS_DIR_PROD = join3(__dirname4, "scenarios");
+    _SCENARIOS_DIR_DEV = join3(__dirname4, "..", "..", "..", "agent_moss", "scenarios");
     SKILL_ID_RE = /^[A-Za-z0-9_-]+$/;
   }
 });
@@ -2544,11 +2644,21 @@ function getScenarioExtensions(scenarioId) {
   );
   return ext;
 }
+function getScenarioExtensionsMulti(scenarioSpec) {
+  if (!scenarioSpec) return null;
+  const ids = scenarioSpec.split(",").map((s) => s.trim()).filter(Boolean);
+  if (ids.length === 0) return null;
+  const exts = ids.map((id) => getScenarioExtensions(id));
+  const nonNull = exts.filter((e) => e !== null);
+  if (nonNull.length === 0) return null;
+  return mergeAgentExtensions(...nonNull);
+}
 var __filename5, __dirname6, SCENARIOS_DIR_PROD, SCENARIOS_DIR_DEV_FALLBACK, cache2;
 var init_scenarios = __esm({
   "src/scenarios/index.ts"() {
     "use strict";
     init_esm_shims();
+    init_agents();
     __filename5 = fileURLToPath7(import.meta.url);
     __dirname6 = dirname5(__filename5);
     SCENARIOS_DIR_PROD = resolve4(__dirname6, "scenarios");
@@ -2576,7 +2686,7 @@ function runHeuristicCheck(input) {
             riskType: "sensitive_action",
             confidence: 90,
             source: "heuristic",
-            violatedLayers: ["1.1"]
+            violatedLayers: ["L1.1"]
           };
         }
       }
@@ -2586,8 +2696,10 @@ function runHeuristicCheck(input) {
   const scanDetail = normalizePathSegments(stripLiteralTextSegments(input.aNext.actionDetail));
   const scanCommand = `${input.aNext.actionType}: ${scanDetail}`;
   let topRiskType = "";
+  const exemptKeygen = isSshKeygenGenerate(input.aNext.actionDetail);
   for (const rule of DANGEROUS_PATTERNS) {
     if (rule.pattern.test(scanCommand)) {
+      if (exemptKeygen && rule.riskType === "file_access") continue;
       matched.push(rule.description);
       if (severityRank(rule.severity) > severityRank(highestSeverity)) {
         highestSeverity = rule.severity;
@@ -2597,8 +2709,8 @@ function runHeuristicCheck(input) {
   }
   highestRiskType = topRiskType || highestRiskType;
   const agentExt = mergeAgentExtensions(
-    getAgentExtensions(input.agentId),
-    getScenarioExtensions(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "")
+    isLayerEnabled("agent_rules_enabled") ? getAgentExtensions(input.agentId) : null,
+    isLayerEnabled("scenario_rules_enabled") ? getScenarioExtensionsMulti(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "") : null
   );
   if (agentExt?.extra_command_patterns) {
     for (const rule of agentExt.extra_command_patterns) {
@@ -2629,10 +2741,26 @@ function runHeuristicCheck(input) {
   const detailL = input.aNext.actionDetail.toLowerCase();
   const isExcludedType = SENSITIVE_EXCLUDED_PREFIXES.some((p) => actionTypeL.startsWith(p));
   const dangerousResult = checkDangerousPatterns(actionTypeL, detailL);
-  if (dangerousResult) return dangerousResult;
-  if (!isExcludedType) {
-    const pathResult = checkSensitivePath(detailL, input.cwd || "/", agentExt);
-    if (pathResult) return pathResult;
+  const pathResult = isExcludedType ? null : checkSensitivePath(detailL, input.cwd || "/", agentExt);
+  const homeResult = checkHomeDeletion(actionTypeL, detailL);
+  const mergeResults = [dangerousResult, pathResult, homeResult].filter(Boolean);
+  if (mergeResults.length > 0) {
+    let best = mergeResults[0];
+    for (const r of mergeResults) {
+      if (severityRank(r.riskLevel) > severityRank(best.riskLevel)) best = r;
+    }
+    if (severityRank(highestSeverity) > severityRank(best.riskLevel)) {
+      return {
+        allowed: false,
+        reason: `\u68C0\u6D4B\u5230\u9AD8\u5371\u64CD\u4F5C: ${matched.join(", ")}`,
+        riskLevel: highestSeverity,
+        riskType: highestRiskType,
+        confidence: 95,
+        source: "heuristic",
+        violatedLayers: ["L1.1"]
+      };
+    }
+    return best;
   }
   if (matched.length > 0) {
     return {
@@ -2642,8 +2770,7 @@ function runHeuristicCheck(input) {
       riskType: highestRiskType,
       confidence: 95,
       source: "heuristic",
-      violatedLayers: ["1.1"]
-      // 对齐 py coordinator.py:165（L1.1 = 命中高危命令模式/注入关键词）
+      violatedLayers: ["L1.1"]
     };
   }
   const lateralResult = checkLateralMovement(detailL);
@@ -2771,6 +2898,7 @@ function isSearchActionType(actionType) {
 function checkSensitivePath(command, cwd, agentExt) {
   const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
   const isWriteOpFlag = isWriteOperation("", command);
+  const keygenGenerate = isSshKeygenGenerate(command);
   const pathScanText = normalizePathSegments(stripLiteralTextSegments(command));
   const pathMatches = (text, path5) => {
     const parts = path5.split(/(\(\?!.*?\))/);
@@ -2783,6 +2911,7 @@ function checkSensitivePath(command, cwd, agentExt) {
   };
   for (const sp of ROOT_SENSITIVE_PATHS) {
     if (pathMatches(pathScanText, sp.path.toLowerCase())) {
+      if (keygenGenerate) continue;
       if (sp.path === "/dev/random") {
         if (isWriteOpFlag) {
           continue;
@@ -2794,7 +2923,7 @@ function checkSensitivePath(command, cwd, agentExt) {
           riskType: "file_access",
           confidence: 90,
           source: "heuristic",
-          violatedLayers: ["1.1"]
+          violatedLayers: ["L1.1"]
         };
       }
       if (!isWriteOpFlag && !sp.credential) {
@@ -2807,16 +2936,51 @@ function checkSensitivePath(command, cwd, agentExt) {
         riskType: "file_access",
         confidence: 90,
         source: "heuristic",
-        violatedLayers: ["1.1"],
+        violatedLayers: ["L1.1"],
         isCredential: !!sp.credential
       };
     }
   }
   for (const sp of HOME_SENSITIVE_PATHS) {
     const expanded = `${expandedCwd}/${sp.path}`;
-    const pathRe = sp.path.endsWith(".pub") ? new RegExp(sp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i") : new RegExp(sp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "(?!\\.pub)", "i");
-    const expandedRe = sp.path.endsWith(".pub") ? new RegExp(expanded.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i") : new RegExp(expanded.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "(?!\\.pub)", "i");
-    if (pathRe.test(pathScanText) || expandedRe.test(pathScanText)) {
+    let pPath = sp.path;
+    if (!sp.path.endsWith(".pub")) pPath = `${sp.path}(?!\\.pub)`;
+    let dirPrefixMatch = null;
+    if (sp.dirDelOnly) {
+      const dirRe = (t) => new RegExp(`(?:^|[\\s/\\\\'"])${t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:/|[\\s'"\\\\]|$)`, "i");
+      dirPrefixMatch = dirRe(sp.path).test(pathScanText) || dirRe(expanded.toLowerCase()).test(pathScanText);
+    }
+    const pathReMatch = sp.dirDelOnly ? !!dirPrefixMatch : pathMatches(pathScanText, pPath);
+    const expandedReMatch = sp.dirDelOnly ? false : pathMatches(pathScanText, expanded + (sp.path.endsWith(".pub") ? "" : "(?!\\.pub)"));
+    if (pathReMatch || expandedReMatch) {
+      if (keygenGenerate) continue;
+      if (sp.dirDelOnly) {
+        if (isDeleteActionForDir(command, sp.path)) {
+          return {
+            allowed: false,
+            reason: `\u5220\u9664\u654F\u611F\u76EE\u5F55: ${sp.desc} (${sp.path})`,
+            riskLevel: sp.riskLevel,
+            riskType: "file_access",
+            confidence: 90,
+            source: "heuristic",
+            violatedLayers: ["L1.1"],
+            isCredential: !!sp.credential
+          };
+        }
+        if (isArchiveReadOfDir(command, sp.path)) {
+          return {
+            allowed: false,
+            reason: `\u5F52\u6863/\u590D\u5236\u8BFB\u53D6\u654F\u611F\u76EE\u5F55: ${sp.desc} (${sp.path})`,
+            riskLevel: sp.riskLevel,
+            riskType: "file_access",
+            confidence: 90,
+            source: "heuristic",
+            violatedLayers: ["L1.1"],
+            isCredential: !!sp.credential
+          };
+        }
+        continue;
+      }
       if (!isWriteOpFlag && !sp.credential) {
         continue;
       }
@@ -2827,7 +2991,7 @@ function checkSensitivePath(command, cwd, agentExt) {
         riskType: "file_access",
         confidence: 90,
         source: "heuristic",
-        violatedLayers: ["1.1"],
+        violatedLayers: ["L1.1"],
         isCredential: !!sp.credential
       };
     }
@@ -2850,7 +3014,7 @@ function checkSensitivePath(command, cwd, agentExt) {
           riskType: "file_access",
           confidence: 90,
           source: "heuristic",
-          violatedLayers: ["1.1"],
+          violatedLayers: ["L1.1"],
           isCredential: !!sp.credential
         };
       }
@@ -2867,7 +3031,7 @@ function checkSensitivePath(command, cwd, agentExt) {
         riskType: "file_access",
         confidence: 90,
         source: "heuristic",
-        violatedLayers: ["1.1"],
+        violatedLayers: ["L1.1"],
         isCredential: true
       };
     }
@@ -2880,18 +3044,142 @@ function checkSensitivePath(command, cwd, agentExt) {
       riskType: "file_access",
       confidence: 90,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
   return null;
 }
+function isHomeValue(path5) {
+  let p = path5.trim().toLowerCase();
+  if (p.startsWith("$(") && p.endsWith(")")) {
+    const inner = p.slice(2, -1).trim();
+    return HOME_TARGET_RE.test(" " + inner);
+  }
+  if (/^\/home\/[^/\s]+\/?$/.test(p)) return true;
+  return HOME_TARGET_RE.test(" " + p);
+}
+function isDeleteCommand(seg) {
+  const s = seg.trimStart();
+  if (/^(?:rm|rmdir|unlink)\b/i.test(s)) return true;
+  return /删除|移除/.test(s);
+}
+function homeEscapeTarget(seg) {
+  const low = seg.toLowerCase();
+  const re = /(?:~|(?:\$home|\$\{home\})|\/home\/[a-z0-9_.-]+)/g;
+  let m;
+  while ((m = re.exec(low)) !== null) {
+    const endIdx = m.index + m[0].length;
+    const tail = low.slice(endIdx);
+    if (!tail) continue;
+    let token = tail.trimStart().split(/\s+/)[0] || "";
+    token = token.split("&&")[0].split("||")[0].split(";")[0].replace(/\/+$/, "");
+    token = token.replace(/^['"]|['"]$/g, "");
+    const segments = token.split("/").filter((s) => s && s !== ".");
+    if (!segments.some((s) => s === "..")) continue;
+    let depth = 0;
+    let minDepth = 0;
+    for (const s of segments) {
+      depth += s === ".." ? -1 : 1;
+      minDepth = Math.min(minDepth, depth);
+    }
+    if (minDepth < 0) return true;
+    if (depth <= 0) return true;
+  }
+  return false;
+}
+function checkHomeDeletion(actionType, actionDetail) {
+  if (actionType !== "bash" && actionType !== "executebash" && actionType !== "terminal-executebash") return null;
+  const segs = actionDetail.split(/&&|\|\||;|\n/).map((s) => s.trim()).filter(Boolean);
+  for (const seg of segs) {
+    if (!isDeleteCommand(seg)) continue;
+    if (HOME_TARGET_RE.test(seg) || homeEscapeTarget(seg)) {
+      return {
+        allowed: false,
+        reason: "\u68C0\u6D4B\u5230\u5220\u9664\u4E3B\u76EE\u5F55 (~/$HOME) \u64CD\u4F5C",
+        riskLevel: "high",
+        riskType: "script_execution",
+        confidence: 90,
+        source: "heuristic",
+        violatedLayers: ["L1.1"]
+      };
+    }
+  }
+  const assigned = {};
+  for (const m of actionDetail.matchAll(HOME_ASSIGN_RE)) assigned[m[1]] = m[2];
+  for (const [varName, path5] of Object.entries(assigned)) {
+    if (!isHomeValue(path5)) continue;
+    const varRefRe = new RegExp(`(?:${escapeRegExp(varName)}|\\$\\{${escapeRegExp(varName)}\\})`);
+    for (const seg of segs) {
+      if (!isDeleteCommand(seg)) continue;
+      if (varRefRe.test(seg)) {
+        return {
+          allowed: false,
+          reason: `\u68C0\u6D4B\u5230\u901A\u8FC7\u53D8\u91CF ${varName}\uFF08=${path5}\uFF0C\u4E3B\u76EE\u5F55\uFF09\u6267\u884C\u5220\u9664`,
+          riskLevel: "high",
+          riskType: "script_execution",
+          confidence: 90,
+          source: "heuristic",
+          violatedLayers: ["L1.1"]
+        };
+      }
+    }
+  }
+  return null;
+}
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function isDeleteActionForDir(command, dirPath) {
+  const low = command.toLowerCase();
+  const dpath = dirPath.toLowerCase();
+  if (new RegExp(`\\b(?:rm|unlink|rmdir)\\b[^&|;]*?${escapeRegExp(dpath)}`, "i").test(low)) {
+    return true;
+  }
+  if (new RegExp(`(?:\u5220\u9664|\u79FB\u9664)[^\\n;|&]*?${escapeRegExp(dpath)}`).test(low)) {
+    return true;
+  }
+  for (const seg of low.split(/&&|\|\||;|\n/)) {
+    const fw = (seg.trim().split(/\s+/)[0] || "").toLowerCase();
+    if ((fw === "rm" || fw === "unlink" || fw === "rmdir") && low.includes(dpath)) {
+      return true;
+    }
+  }
+  return false;
+}
+function isArchiveReadOfDir(command, dirPath) {
+  const low = command.toLowerCase();
+  const dpath = dirPath.toLowerCase();
+  for (const seg of low.split(/&&|\|\||;|\n/)) {
+    const s = seg.trim();
+    if (!s || !s.includes(dpath)) continue;
+    const parts = s.split(/\s+/);
+    const fw = parts[0] || "";
+    if (fw === "zip") return true;
+    if (fw === "tar") {
+      if (/(?:^|\s)-[a-zA-Z]*x|--extract/.test(s)) continue;
+      return true;
+    }
+    if (fw === "cp" || fw === "rsync") {
+      const segPaths = s.match(/[/~][^\s;|&><'"]*/g) || [];
+      if (segPaths.length && segPaths[0].includes(dpath)) return true;
+    }
+  }
+  return false;
+}
+function isSshKeygenGenerate(command) {
+  const low = command.toLowerCase();
+  if (!low.includes("ssh-keygen")) return false;
+  if (!/(?:^|\s)-t\s+\S+/.test(low)) return false;
+  if (/(?:^|\s)-\S*[ylpB]\S*/.test(low)) return false;
+  return true;
+}
 function checkDangerousPatterns(actionType, actionDetail) {
   if (actionType === "file_write" || actionType === "file_edit") return null;
   const scan = stripHeredocContent(actionDetail);
   const TEMP_DIRS = ["/tmp", "/var/tmp", "/run", "/dev/shm"];
   const isTempPath = TEMP_DIRS.some(
     (td) => new RegExp(`(?:^|[\\s/])${td.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[\\s/]|$)`).test(actionDetail)
-  );
+  ) || /(?:^|[\s;]|&&\s*|\|\|\s*)var\/tmp(?:[/\s;]|$)/.test(actionDetail);
   const wildcardDeleteRe = /(?:\brm\b|\b(r?mdir|del|delete|remove|rmdir|unlink)\b|\b删除\b|\b移除\b)[\s\S]{0,40}?[*?]|[*?][\s\S]{0,40}?\b(?:rm|del|delete|remove|rmdir|unlink)\b|rm\s+-[a-zA-Z]*[rf][a-zA-Z]*\s+\S*[*?]/i;
   if (!isTempPath && wildcardDeleteRe.test(scan)) {
     return {
@@ -2901,7 +3189,7 @@ function checkDangerousPatterns(actionType, actionDetail) {
       riskType: "script_execution",
       confidence: 90,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
   const findWriteMatch = actionDetail.match(
@@ -2916,10 +3204,10 @@ function checkDangerousPatterns(actionType, actionDetail) {
       riskType: "script_execution",
       confidence: 90,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
-  if (/>\s*\/etc\//.test(actionDetail) || />\s*\/boot\//.test(actionDetail)) {
+  if (/>\s*['"]?\/etc\//.test(actionDetail) || />\s*['"]?\/boot\//.test(actionDetail) || />\s*['"]?\/proc\//.test(actionDetail)) {
     return {
       allowed: false,
       reason: "\u68C0\u6D4B\u5230\u91CD\u5B9A\u5411\u8986\u76D6\u5199\u5165\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55",
@@ -2927,7 +3215,7 @@ function checkDangerousPatterns(actionType, actionDetail) {
       riskType: "file_access",
       confidence: 95,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
   if (/>\s*\/dev\/(sd|hd|nvme|vd|loop|mem|kmsg|port|zero|random|urandom|full|core)/i.test(actionDetail)) {
@@ -2938,7 +3226,7 @@ function checkDangerousPatterns(actionType, actionDetail) {
       riskType: "file_access",
       confidence: 90,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
   return null;
@@ -3029,13 +3317,13 @@ function checkLateralMovement(actionDetail) {
         riskType: "lateral_movement",
         confidence: 80,
         source: "heuristic",
-        violatedLayers: ["1.1"]
+        violatedLayers: ["L1.1"]
       };
     }
   }
   return null;
 }
-var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES;
+var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES, HOME_TARGET_RE, HOME_ASSIGN_RE;
 var init_heuristic = __esm({
   "src/engine/heuristic.ts"() {
     "use strict";
@@ -3043,6 +3331,7 @@ var init_heuristic = __esm({
     init_config();
     init_agents();
     init_scenarios();
+    init_runtime_config();
     init_rules_loader();
     init_logic_rules();
     INJECTION_KEYWORDS = (() => {
@@ -3064,6 +3353,8 @@ var init_heuristic = __esm({
     })();
     SENSITIVE_EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
     SEARCH_ACTION_PREFIXES = ["search-", "web-", "browser-", "query-", "websearch", "web_search"];
+    HOME_TARGET_RE = /(?:^|[\s="'($])(?:~|(?:\$home|\$\{home\}))(?:\/(?:\.\*|\*|\.)?)?(?=[\s"';}|&)]|$)/i;
+    HOME_ASSIGN_RE = /([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(~[A-Za-z0-9_./-]*|\$HOME[A-Za-z0-9_./-]*|\$\{HOME\}[A-Za-z0-9_./-]*|\/home\/[^\s;|&]+|\$\((?:[^()]|\([^()]*\))*\))(?=\s|;|$|\||&)/gi;
   }
 });
 
@@ -3286,7 +3577,7 @@ function loadTemplates() {
 // src/engine/script-analyzer.ts
 init_esm_shims();
 import { readFileSync as readFileSync8 } from "fs";
-import { resolve as resolve6, join as join3 } from "path";
+import { resolve as resolve6, join as join4 } from "path";
 var SUSPICIOUS_PATTERNS = [
   // Network exfiltration (curl/wget POST in scripts is almost never legitimate)
   { name: "curl POST", pattern: /curl\s+(.*\s)?-X\s+POST/i },
@@ -3419,7 +3710,7 @@ function assessKeywordCombinationRisk(matchedKeywords, scriptContent) {
 }
 function readScriptContent(scriptPath, maxLines = 500) {
   try {
-    const expandedPath = scriptPath.startsWith("~") ? join3(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve6(scriptPath);
+    const expandedPath = scriptPath.startsWith("~") ? join4(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve6(scriptPath);
     const raw = readFileSync8(expandedPath, "utf-8");
     const lines = raw.split("\n").slice(0, maxLines);
     return { content: lines.join("\n"), lineCount: lines.length, error: "" };
@@ -3474,9 +3765,10 @@ ${result.scriptContent}
 init_esm_shims();
 init_heuristic();
 init_logic_rules();
+init_inline_analyzer();
 import { statSync as statSync2, existsSync as existsSync9 } from "fs";
-import { resolve as resolve8, join as join5, isAbsolute as isAbsolute2 } from "path";
-import { homedir as homedir3 } from "os";
+import { resolve as resolve8, join as join6, isAbsolute as isAbsolute2 } from "path";
+import { homedir as homedir4 } from "os";
 
 // src/engine/script-engine/tracker.ts
 init_esm_shims();
@@ -5088,6 +5380,13 @@ function extractScriptPath2(command) {
   return null;
 }
 function extractScriptPathWithArgs(command) {
+  const inline = command.match(/(?:^|\s|&&|\|\|)\s*(?:bash|\/bin\/bash|sh|zsh)\s+-c\s*(['"])([\s\S]*?)\1/i);
+  if (inline) {
+    const inner = inline[2];
+    const realPath = extractScriptPath2(inner);
+    if (realPath) return { path: realPath, args: [] };
+    return { path: null, args: [] };
+  }
   const scriptPath = extractScriptPath2(command);
   if (!scriptPath) return { path: null, args: [] };
   const idx = command.indexOf(scriptPath);
@@ -5101,11 +5400,59 @@ function extractScriptPathWithArgs(command) {
   }
   return { path: scriptPath, args };
 }
+function looksLikeScriptPath(tok) {
+  const t = tok.trim().replace(/^['"]|['"]$/g, "");
+  if (!t) return false;
+  const low = t.toLowerCase();
+  if (["bash", "sh", "zsh", "dash", "python", "python3", "perl", "ruby", "node", "php", "lua"].includes(low)) return false;
+  if (/\.(sh|bash|py|pl|rb|js|php|lua)$/.test(low)) return true;
+  if (t.includes("/") && !t.startsWith("-")) return true;
+  return false;
+}
 function extractInlineScriptPath(actionDetail) {
+  const code = extractInlineCode(actionDetail);
+  if (code) {
+    const candidates = [];
+    const osRe = /os\.(?:system|popen)\s*\(\s*(['"])(.*?)\1\s*\)/gi;
+    let m;
+    while ((m = osRe.exec(code)) !== null) candidates.push(m[2]);
+    const subListRe = /subprocess\.(?:run|call|Popen|check_output|check_call)\s*\(\s*\[(.*?)\]/gi;
+    while ((m = subListRe.exec(code)) !== null) candidates.push(m[1]);
+    const subShellRe = /subprocess\.(?:run|call|Popen|check_output|check_call)\s*\(\s*(['"])(.*?)\1[^)]*?shell\s*=\s*true/gi;
+    while ((m = subShellRe.exec(code)) !== null) candidates.push(m[2]);
+    for (const cand of candidates) {
+      const tokens = cand.includes(",") ? cand.split(/\s*,\s*/).map((t) => t.trim().replace(/^['"]|['"]$/g, "")) : cand.split(/\s+/);
+      for (const tok of tokens) {
+        if (looksLikeScriptPath(tok)) {
+          try {
+            const resolved = resolvePath2(tok.replace(/^['"]|['"]$/g, ""));
+            if (existsSync9(resolved)) {
+              const stat = statSync2(resolved);
+              if (stat.isFile()) return resolved;
+            }
+          } catch {
+          }
+        }
+      }
+    }
+    const openRe = /open\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+    while ((m = openRe.exec(code)) !== null) {
+      const p = m[1];
+      try {
+        const resolved = resolvePath2(p);
+        if (existsSync9(resolved)) {
+          const stat = statSync2(resolved);
+          if (stat.isFile()) return resolved;
+        }
+      } catch {
+      }
+    }
+    return null;
+  }
   const re = /open\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
-  let m;
-  while ((m = re.exec(actionDetail)) !== null) {
-    const p = m[1];
+  let m2;
+  while ((m2 = re.exec(actionDetail)) !== null) {
+    const p = m2[1];
     let resolved;
     try {
       resolved = resolvePath2(p);
@@ -5121,7 +5468,7 @@ function extractInlineScriptPath(actionDetail) {
 function resolvePath2(p) {
   let expanded = p;
   if (expanded.startsWith("~/") || expanded === "~") {
-    expanded = join5(homedir3(), expanded.slice(1));
+    expanded = join6(homedir4(), expanded.slice(1));
   }
   return resolve8(expanded);
 }
@@ -5202,7 +5549,7 @@ function analyzeScriptContent2(input) {
     isInline = true;
   }
   if (resolvedPath && !isAbsolute2(resolvedPath) && !resolvedPath.startsWith("~/")) {
-    resolvedPath = join5(input.cwd || process.cwd(), resolvedPath);
+    resolvedPath = join6(input.cwd || process.cwd(), resolvedPath);
   }
   const l1Adapter = (content) => {
     const virtualInput = {
@@ -5490,7 +5837,7 @@ async function analyzeWithLLM(prompt, config) {
         riskType: riskType || "",
         confidence: typeof parsed.confidence === "number" ? Math.min(100, Math.max(0, parsed.confidence)) : 70,
         source: "llm",
-        violatedLayers: ["3"]
+        violatedLayers: ["L3.1"]
       };
     } catch (err) {
       if (abortController.signal.aborted) {
@@ -5513,6 +5860,7 @@ async function analyzeWithLLM(prompt, config) {
 
 // src/engine/coordinator.ts
 init_config();
+init_runtime_config();
 init_agents();
 init_scenarios();
 
@@ -5522,9 +5870,9 @@ init_esm_shims();
 // src/brain/rule-store.ts
 init_esm_shims();
 import { existsSync as existsSync11, readFileSync as readFileSync12, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
-import { join as join6 } from "path";
-import { homedir as homedir4 } from "os";
-var DEFAULT_RULES_PATH = join6(homedir4(), ".agentmoss", "brain", "rules.json");
+import { join as join7 } from "path";
+import { homedir as homedir5 } from "os";
+var DEFAULT_RULES_PATH = join7(homedir5(), ".agentmoss", "brain", "rules.json");
 var ENV_RULES_PATH = "AGENT_MOSS_BRAIN_RULES_PATH";
 var STATUS_DRAFT = "draft";
 var STATUS_APPROVED = "approved";
@@ -6086,6 +6434,15 @@ function decodeBase64Literals(text) {
   }
   return out;
 }
+var QUOTED_STR_RE = /('(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"|`(?:[^`\\]|\\.)*`)/g;
+var OUTPUT_CMDS = /* @__PURE__ */ new Set(["echo", "printf", "print"]);
+function stripStringLiterals(text) {
+  const m = text.match(/\s*([A-Za-z_][\w-]*|\/?[\w./-]+)\b/);
+  if (!m) return text;
+  const cmd = m[1].split("/").pop().toLowerCase();
+  if (!OUTPUT_CMDS.has(cmd)) return text;
+  return text.replace(QUOTED_STR_RE, "");
+}
 function decodeUrlAndNumeric(text) {
   const out = [];
   let s = text;
@@ -6119,7 +6476,10 @@ function decodeUrlAndNumeric(text) {
   return out;
 }
 function allCandidates(detail, max = 8) {
-  const cands = [detail];
+  const shell = stripStringLiterals(detail);
+  const cands = [shell];
+  cands.push(...decodeBase64Literals(shell));
+  cands.push(...decodeUrlAndNumeric(shell));
   cands.push(...decodeBase64Literals(detail));
   cands.push(...decodeUrlAndNumeric(detail));
   const seen = /* @__PURE__ */ new Set();
@@ -6144,6 +6504,128 @@ function matchStageAny(detail, stages) {
   return "";
 }
 
+// src/engine/formal-engine/ltl.ts
+init_esm_shims();
+init_rules_loader();
+
+// src/engine/formal-engine/ir.ts
+init_esm_shims();
+function allNodes(mg) {
+  const out = [];
+  for (const s of mg.sessions) out.push(...s.nodes);
+  return out;
+}
+function allEdges(mg) {
+  const out = [];
+  for (const s of mg.sessions) out.push(...s.edges);
+  out.push(...mg.crossEdges);
+  return out;
+}
+function emptyVerificationResult() {
+  return { verified: true, violations: [] };
+}
+
+// src/engine/formal-engine/ltl.ts
+var AP_RE = null;
+function compileAps(apPatterns) {
+  if (AP_RE) return;
+  AP_RE = {};
+  for (const [name, pats] of Object.entries(apPatterns || {})) {
+    AP_RE[name] = pats.map((p) => new RegExp(p, "i"));
+  }
+}
+function labelEvent(actionDetail) {
+  if (!AP_RE) compileAps(loadMC().ap_patterns || {});
+  const candidates = allCandidates(actionDetail);
+  const hits = /* @__PURE__ */ new Set();
+  for (const [name, pats] of Object.entries(AP_RE || {})) {
+    for (const c of candidates) {
+      const m = pats.some((p) => p.test(c));
+      if (m) {
+        hits.add(name);
+        break;
+      }
+    }
+  }
+  return hits;
+}
+function evaluateLTL(formula, trace, pos) {
+  const op = formula[0];
+  switch (op) {
+    case "ap":
+      return trace[pos].has(formula[1]);
+    case "!":
+      return !evaluateLTL(formula[1], trace, pos);
+    case "&":
+      return evaluateLTL(formula[1], trace, pos) && evaluateLTL(formula[2], trace, pos);
+    case "|":
+      return evaluateLTL(formula[1], trace, pos) || evaluateLTL(formula[2], trace, pos);
+    case "->":
+      return !evaluateLTL(formula[1], trace, pos) || evaluateLTL(formula[2], trace, pos);
+    case "X":
+      return pos + 1 < trace.length && evaluateLTL(formula[1], trace, pos + 1);
+    case "G": {
+      for (let j = pos; j < trace.length; j++) {
+        if (!evaluateLTL(formula[1], trace, j)) return false;
+      }
+      return true;
+    }
+    case "F": {
+      for (let j = pos; j < trace.length; j++) {
+        if (evaluateLTL(formula[1], trace, j)) return true;
+      }
+      return false;
+    }
+    case "U": {
+      for (let j = pos; j < trace.length; j++) {
+        if (evaluateLTL(formula[2], trace, j)) {
+          for (let k = pos; k < j; k++) {
+            if (!evaluateLTL(formula[1], trace, k)) return false;
+          }
+          return true;
+        }
+      }
+      return false;
+    }
+    default:
+      return false;
+  }
+}
+function ruleViolates(rule, traceWith, witnessMode) {
+  const formula = rule?.formula;
+  if (!Array.isArray(formula) || formula.length === 0) return false;
+  const satWith = evaluateLTL(formula, traceWith, 0);
+  if (!satWith) return false;
+  if (witnessMode && traceWith.length > 1) {
+    const traceWithout = traceWith.slice(0, -1);
+    if (evaluateLTL(formula, traceWithout, 0)) return false;
+  }
+  return true;
+}
+function checkMCRules(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length === 0) return violations;
+  const mc = loadMC();
+  const rules = mc.rules || [];
+  if (rules.length === 0) return violations;
+  const trace = nodes.map((n) => labelEvent(n.actionDetail));
+  const witnessMode = graph.witnessIdx !== void 0;
+  for (const rule of rules) {
+    if (rule?.type !== "ltl" || !(rule.enabled !== false)) continue;
+    if (ruleViolates(rule, trace, witnessMode)) {
+      violations.push({
+        propertyId: String(rule.id || "mc-ltl"),
+        reason: String(rule.reason || "L2.2 \u6A21\u578B\u68C0\u6D4B\u89C4\u5219\u547D\u4E2D"),
+        riskLevel: String(rule.risk_level || "high"),
+        path: nodes.filter((n) => labelEvent(n.actionDetail).size > 0).slice(-3).map((n) => ({ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }))
+      });
+      if (witnessMode) return violations;
+    }
+  }
+  return violations;
+}
+
 // src/engine/formal-engine/builder.ts
 var COMBO_STAGES2 = null;
 function loadStages() {
@@ -6172,6 +6654,26 @@ function extractResources(actionDetail) {
 function markStage(actionDetail) {
   return matchStageAny(actionDetail, loadStages());
 }
+function markIntegrity(actionDetail) {
+  const aps = labelEvent(actionDetail);
+  if (aps.has("download_file") || aps.has("prompt_injection")) {
+    return { integrity: "low", isLowSource: true };
+  }
+  return { integrity: "medium", isLowSource: false };
+}
+function initNode(sessionId, seq, actionType, actionDetail) {
+  const { integrity, isLowSource } = markIntegrity(actionDetail);
+  return {
+    sessionId,
+    seq,
+    actionType,
+    actionDetail,
+    stage: markStage(actionDetail),
+    resources: extractResources(actionDetail),
+    integrity,
+    isLowSource
+  };
+}
 function buildSessionGraph(actionHistory, aNext, sessionId = "current") {
   const nodes = [];
   const edges = [];
@@ -6185,17 +6687,9 @@ function buildSessionGraph(actionHistory, aNext, sessionId = "current") {
     details.push({ actionType: String(aNext.actionType || ""), actionDetail: String(aNext.actionDetail || "") });
   }
   details.forEach((d, seq) => {
-    const stage = markStage(d.actionDetail);
-    const node = {
-      sessionId,
-      seq,
-      actionType: d.actionType,
-      actionDetail: d.actionDetail,
-      stage,
-      resources: extractResources(d.actionDetail)
-    };
+    const node = initNode(sessionId, seq, d.actionType, d.actionDetail);
     nodes.push(node);
-    if (stage) stageFlags.add(stage);
+    if (node.stage) stageFlags.add(node.stage);
   });
   for (let i = 0; i < nodes.length - 1; i++) {
     edges.push({ src: i, dst: i + 1, kind: "next" });
@@ -6215,15 +6709,12 @@ function buildMultiSessionGraph(sessions, aNext) {
   if (aNext) {
     const last = mg.sessions[mg.sessions.length - 1];
     if (last.sessionId === "current") {
-      const stage = markStage(String(aNext.actionDetail || ""));
-      last.nodes.push({
-        sessionId: last.sessionId,
-        seq: last.nodes.length,
-        actionType: String(aNext.actionType || ""),
-        actionDetail: String(aNext.actionDetail || ""),
-        stage,
-        resources: extractResources(String(aNext.actionDetail || ""))
-      });
+      last.nodes.push(initNode(
+        last.sessionId,
+        last.nodes.length,
+        String(aNext.actionType || ""),
+        String(aNext.actionDetail || "")
+      ));
       if (last.nodes.length > 1) {
         last.edges.push({ src: last.nodes.length - 2, dst: last.nodes.length - 1, kind: "next" });
       }
@@ -6237,11 +6728,25 @@ function buildMultiSessionGraph(sessions, aNext) {
 function addCrossDataEdges(mg) {
   const nodes = allNodesFlat(mg);
   if (nodes.length < 2) return;
-  for (let i = 0; i < nodes.length; i++) {
-    for (let j = i + 1; j < nodes.length; j++) {
-      if (nodes[i].sessionId === nodes[j].sessionId) continue;
-      const shared = intersect(nodes[i].resources, nodes[j].resources);
-      if (shared.size > 0) {
+  const resIndex = /* @__PURE__ */ new Map();
+  nodes.forEach((n, i) => {
+    for (const r of n.resources) {
+      const list = resIndex.get(r);
+      if (list) list.push(i);
+      else resIndex.set(r, [i]);
+    }
+  });
+  const seen = /* @__PURE__ */ new Set();
+  for (const idxs of resIndex.values()) {
+    if (idxs.length < 2) continue;
+    for (let a = 0; a < idxs.length; a++) {
+      const i = idxs[a];
+      for (let b = a + 1; b < idxs.length; b++) {
+        const j = idxs[b];
+        if (nodes[i].sessionId === nodes[j].sessionId) continue;
+        const key = `${i}:${j}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
         mg.crossEdges.push({ src: i, dst: j, kind: "data" });
       }
     }
@@ -6252,28 +6757,6 @@ function allNodesFlat(mg) {
   for (const s of mg.sessions) out.push(...s.nodes);
   return out;
 }
-function intersect(a, b) {
-  const out = /* @__PURE__ */ new Set();
-  for (const v of a) if (b.has(v)) out.add(v);
-  return out;
-}
-
-// src/engine/formal-engine/ir.ts
-init_esm_shims();
-function allNodes(mg) {
-  const out = [];
-  for (const s of mg.sessions) out.push(...s.nodes);
-  return out;
-}
-function allEdges(mg) {
-  const out = [];
-  for (const s of mg.sessions) out.push(...s.edges);
-  out.push(...mg.crossEdges);
-  return out;
-}
-function emptyVerificationResult() {
-  return { verified: true, violations: [] };
-}
 
 // src/engine/formal-engine/properties.ts
 init_esm_shims();
@@ -6296,27 +6779,50 @@ function checkCrossSessionChain(graph) {
   const violations = [];
   const nodes = allNodes(graph);
   if (nodes.length === 0) return violations;
+  const witness = graph.witnessIdx;
   for (const chain of loadCrossSessionChains()) {
     const stages = chain.stages;
     if (!stages.length) continue;
-    let matched = 0;
-    let stageIdx = 0;
-    const path5 = [];
-    for (const n of nodes) {
-      if (stageIdx < stages.length && n.stage === stages[stageIdx]) {
-        matched += 1;
-        path5.push({ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) });
-        stageIdx += 1;
-        if (matched >= stages.length) break;
+    if (witness !== void 0) {
+      if (nodes[witness].stage !== stages[stages.length - 1]) continue;
+      let matched = 0;
+      const path5 = [];
+      for (let k = 0; k < witness; k++) {
+        const n = nodes[k];
+        if (matched < stages.length - 1 && n.stage === stages[matched]) {
+          matched += 1;
+          path5.push({ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) });
+        }
       }
-    }
-    if (matched >= stages.length) {
+      if (matched < stages.length - 1) continue;
+      path5.push({ sessionId: nodes[witness].sessionId, seq: nodes[witness].seq, detail: nodes[witness].actionDetail.slice(0, 60) });
       violations.push({
         propertyId: "cross-" + chain.id,
         reason: chain.reason,
         riskLevel: chain.riskLevel,
         path: path5
       });
+      return violations;
+    } else {
+      let matched = 0;
+      let stageIdx = 0;
+      const path5 = [];
+      for (const n of nodes) {
+        if (stageIdx < stages.length && n.stage === stages[stageIdx]) {
+          matched += 1;
+          path5.push({ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) });
+          stageIdx += 1;
+          if (matched >= stages.length) break;
+        }
+      }
+      if (matched >= stages.length) {
+        violations.push({
+          propertyId: "cross-" + chain.id,
+          reason: chain.reason,
+          riskLevel: chain.riskLevel,
+          path: path5
+        });
+      }
     }
   }
   return violations;
@@ -6351,14 +6857,18 @@ function checkSensitiveDataFlow(graph) {
       }
     }
   }
-  for (const [i, n] of nodes.entries()) {
+  const witness = graph.witnessIdx;
+  const candidates = witness !== void 0 ? [witness] : nodes.map((_, i) => i);
+  for (const i of candidates) {
+    const n = nodes[i];
     if (tainted.has(i) && EXFIL_RE.test(n.actionDetail)) {
       violations.push({
-        propertyId: "sensitive-data-exfil",
+        propertyId: "sensitive-data-flow",
         reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${tainted.get(i)} \u2192 ${n.sessionId}#${n.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
         riskLevel: "critical",
         path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
       });
+      if (witness !== void 0) return violations;
     }
   }
   return violations;
@@ -6389,12 +6899,38 @@ function checkNeverExfilAfterPrivesc(graph) {
   const violations = [];
   const nodes = allNodes(graph);
   if (nodes.length < 2) return violations;
+  const witness = graph.witnessIdx;
+  if (witness !== void 0) {
+    const evIdx = [];
+    nodes.forEach((n, i) => {
+      if ((i === witness || n.sessionId === "ebpf-evidence") && isExfilNode(n)) evIdx.push(i);
+    });
+    if (evIdx.length === 0) return violations;
+    const firstEv = Math.min(...evIdx);
+    let pre = null;
+    for (let i = 0; i < firstEv; i++) {
+      if (isPrivescNode(nodes[i])) pre = nodes[i];
+    }
+    if (pre) {
+      const post = nodes[firstEv];
+      return [{
+        propertyId: "no-exfil-after-privesc",
+        reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\xAC\u25C7EXFIL)",
+        riskLevel: "critical",
+        path: [
+          { sessionId: pre.sessionId, seq: pre.seq, detail: pre.actionDetail.slice(0, 60) },
+          { sessionId: post.sessionId, seq: post.seq, detail: post.actionDetail.slice(0, 60) }
+        ]
+      }];
+    }
+    return violations;
+  }
   for (let i = 0; i < nodes.length; i++) {
     if (!isPrivescNode(nodes[i])) continue;
     for (let j = i + 1; j < nodes.length; j++) {
       if (isExfilNode(nodes[j])) {
         violations.push({
-          propertyId: "no-privesc-then-exfil",
+          propertyId: "no-exfil-after-privesc",
           reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\xAC\u25C7EXFIL)",
           riskLevel: "critical",
           path: [
@@ -6412,12 +6948,38 @@ function checkNeverExfilAfterCred(graph) {
   const violations = [];
   const nodes = allNodes(graph);
   if (nodes.length < 2) return violations;
+  const witness = graph.witnessIdx;
+  if (witness !== void 0) {
+    const evIdx = [];
+    nodes.forEach((n, i) => {
+      if ((i === witness || n.sessionId === "ebpf-evidence") && isExfilNode(n)) evIdx.push(i);
+    });
+    if (evIdx.length === 0) return violations;
+    const firstEv = Math.min(...evIdx);
+    let pre = null;
+    for (let i = 0; i < firstEv; i++) {
+      if (isCredNode(nodes[i])) pre = nodes[i];
+    }
+    if (pre) {
+      const post = nodes[firstEv];
+      return [{
+        propertyId: "no-exfil-after-credential",
+        reason: "\u8BFB\u53D6\u51ED\u636E\u540E\u51FA\u73B0\u5916\u4F20\uFF0C\u8FDD\u53CD \u25A1(CRED\u2192\xAC\u25C7EXFIL)",
+        riskLevel: "critical",
+        path: [
+          { sessionId: pre.sessionId, seq: pre.seq, detail: pre.actionDetail.slice(0, 60) },
+          { sessionId: post.sessionId, seq: post.seq, detail: post.actionDetail.slice(0, 60) }
+        ]
+      }];
+    }
+    return violations;
+  }
   for (let i = 0; i < nodes.length; i++) {
     if (!isCredNode(nodes[i])) continue;
     for (let j = i + 1; j < nodes.length; j++) {
       if (isExfilNode(nodes[j])) {
         violations.push({
-          propertyId: "no-cred-then-exfil",
+          propertyId: "no-exfil-after-credential",
           reason: "\u8BFB\u53D6\u51ED\u636E\u540E\u51FA\u73B0\u5916\u4F20\uFF0C\u8FDD\u53CD \u25A1(CRED\u2192\xAC\u25C7EXFIL)",
           riskLevel: "critical",
           path: [
@@ -6431,11 +6993,172 @@ function checkNeverExfilAfterCred(graph) {
   }
   return violations;
 }
+var TOOL_REGISTRY = null;
+function getToolRegistry() {
+  if (TOOL_REGISTRY) return TOOL_REGISTRY;
+  TOOL_REGISTRY = loadToolRegistry().tools || {};
+  return TOOL_REGISTRY;
+}
+function lookupToolClass(actionType) {
+  const entry = getToolRegistry()[actionType] || {};
+  return entry.actionClass;
+}
+var COMPUTE_RE = /subprocess|os\.system|shell\s*=\s*True|\beval\(|\bexec\(|bash\s+[^\s]|sh\s+-c|python3?\s+|node\s+|\btimeout\s+|nohup\s+|\b\.\/[\w./-]+/i;
+var STRONG_COMPUTE_TYPES = /* @__PURE__ */ new Set(["python", "node", "exec", "terminal", "cmd"]);
+function isComputeNode(n) {
+  if (STRONG_COMPUTE_TYPES.has(n.actionType.toLowerCase())) return true;
+  const cls = lookupToolClass(n.actionType);
+  if (cls === "read" || cls === "write" || cls === "network_egress" || cls === "message_egress") return false;
+  return COMPUTE_RE.test(n.actionDetail);
+}
+function checkLowIntegrityCommandExec(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length === 0) return violations;
+  const witness = graph.witnessIdx;
+  const lowResources = /* @__PURE__ */ new Set();
+  const lowAt = /* @__PURE__ */ new Map();
+  nodes.forEach((n, i) => {
+    if (n.isLowSource) {
+      lowAt.set(i, n.actionDetail.slice(0, 60));
+      for (const r of n.resources) lowResources.add(r);
+    }
+  });
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (let i = 0; i < nodes.length; i++) {
+      if (lowAt.has(i)) continue;
+      let shared = "";
+      for (const r of nodes[i].resources) {
+        if (lowResources.has(r)) {
+          shared = r;
+          break;
+        }
+      }
+      if (shared) {
+        lowAt.set(i, `\u7EE7\u627F\u81EA ${shared}`);
+        for (const r of nodes[i].resources) lowResources.add(r);
+        changed = true;
+      }
+    }
+  }
+  if (lowAt.size === 0) return violations;
+  const candidates = witness !== void 0 ? [witness] : nodes.map((_, i) => i);
+  for (const i of candidates) {
+    const n = nodes[i];
+    if (lowAt.has(i) && isComputeNode(n)) {
+      violations.push({
+        propertyId: "low-integrity-command-exec",
+        reason: `\u4F4E\u5B8C\u6574\u6027\u6570\u636E\u63A7\u5236\u547D\u4EE4\u6267\u884C\uFF1A${lowAt.get(i)} \u2192 ${n.sessionId}#${n.seq} \u6267\u884C\u4E0D\u53EF\u4FE1\u5185\u5BB9`,
+        riskLevel: "critical",
+        path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
+      });
+      if (witness !== void 0) return violations;
+    }
+  }
+  return violations;
+}
+var DL_OR_LOW_RE = /curl\s+.*-o\b|wget\s+.*\s+-O\b|curl\s+.*\|\s*(bash|sh|python)|wget\s+.*\|\s*(bash|sh|python)|git\s+clone|docker\s+pull|pip\s+install|npm\s+install|base64\s+-d/i;
+function checkCrossSessionReachability(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length === 0) return violations;
+  const witness = graph.witnessIdx;
+  const sources = /* @__PURE__ */ new Set();
+  nodes.forEach((n, i) => {
+    if (n.isLowSource || DL_OR_LOW_RE.test(n.actionDetail)) sources.add(i);
+  });
+  if (sources.size === 0) return violations;
+  const reached = new Set(sources);
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const e of allEdges(graph)) {
+      if (reached.has(e.src) && !reached.has(e.dst)) {
+        const srcRes = nodes[e.src].resources;
+        const dstRes = nodes[e.dst].resources;
+        for (const r of srcRes) {
+          if (dstRes.has(r)) {
+            reached.add(e.dst);
+            changed = true;
+            break;
+          }
+        }
+      }
+    }
+  }
+  const candidates = witness !== void 0 ? [witness] : nodes.map((_, i) => i);
+  for (const i of candidates) {
+    const n = nodes[i];
+    if (sources.has(i)) continue;
+    if (reached.has(i)) {
+      const srcIdx = Math.min(...sources);
+      const srcDesc = nodes[srcIdx].actionDetail.slice(0, 40);
+      violations.push({
+        propertyId: "low-integrity-reachability",
+        reason: `\u4F4E\u5B8C\u6574\u6027\u6E90\u7ECF\u8DE8 session \u6570\u636E\u94FE\u591A\u8DF3\u5230\u8FBE\u5F53\u524D\u6267\u884C\uFF08\u6E90: ${srcDesc} \u2192 ${n.sessionId}#${n.seq}\uFF09`,
+        riskLevel: "high",
+        path: nodes.slice(-3).map((m) => ({ sessionId: m.sessionId, seq: m.seq, detail: m.actionDetail.slice(0, 60) }))
+      });
+      if (witness !== void 0) return violations;
+    }
+  }
+  return violations;
+}
+function checkSensitiveDataAggregation(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length < 2) return violations;
+  const witness = graph.witnessIdx;
+  const resIndex = /* @__PURE__ */ new Map();
+  nodes.forEach((n, i) => {
+    for (const r of n.resources) {
+      const list = resIndex.get(r);
+      if (list) list.push(i);
+      else resIndex.set(r, [i]);
+    }
+  });
+  const sourcesFor = (exfilIdx) => {
+    const srcs = /* @__PURE__ */ new Set();
+    const n = nodes[exfilIdx];
+    for (const r of n.resources) {
+      for (const j of resIndex.get(r) || []) {
+        if (j === exfilIdx) continue;
+        srcs.add(`${nodes[j].sessionId}#${nodes[j].seq}`);
+      }
+    }
+    return srcs;
+  };
+  const candidates = witness !== void 0 ? [witness] : nodes.map((_, i) => i);
+  for (const i of candidates) {
+    const n = nodes[i];
+    if (!isExfilNode(n)) continue;
+    const srcs = sourcesFor(i);
+    if (srcs.size >= 2) {
+      violations.push({
+        propertyId: "sensitive-data-aggregation",
+        reason: `\u654F\u611F\u6570\u636E\u805A\u5408\u5916\u4F20\uFF1Aegress \u805A\u5408 ${srcs.size} \u4E2A\u4E8B\u4EF6\u6E90\u6570\u636E\uFF08Rule 12\uFF09`,
+        riskLevel: "critical",
+        path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
+      });
+      if (witness !== void 0) return violations;
+    }
+  }
+  return violations;
+}
 var ALL_PROPERTIES = [
-  { id: "cross-session-chain", check: checkCrossSessionChain },
-  { id: "sensitive-data-flow", check: checkSensitiveDataFlow },
-  { id: "no-privesc-then-exfil", check: checkNeverExfilAfterPrivesc },
-  { id: "no-cred-then-exfil", check: checkNeverExfilAfterCred }
+  { id: "cross-session-chain", check: checkCrossSessionChain, shortName: "P1" },
+  { id: "sensitive-data-flow", check: checkSensitiveDataFlow, shortName: "P2" },
+  { id: "low-integrity-reachability", check: checkCrossSessionReachability, shortName: "P3" },
+  { id: "no-exfil-after-privesc", check: checkNeverExfilAfterPrivesc, shortName: "P4" },
+  { id: "no-exfil-after-credential", check: checkNeverExfilAfterCred, shortName: "P5" },
+  // L2.2 模型检测（通用 LTL 求值器，mc_rules.json 单一事实源；witness 语义见 ltl.ts）
+  { id: "mc-ltl-rules", check: checkMCRules, shortName: "P6" },
+  // P7 低完整性控制命令执行（integrity 维度，站点 L2.1 最有区分度的检测之一）
+  { id: "low-integrity-command-exec", check: checkLowIntegrityCommandExec, shortName: "P7" },
+  // P8 敏感数据聚合外传（egress 聚合 ≥2 事件源）
+  { id: "sensitive-data-aggregation", check: checkSensitiveDataAggregation, shortName: "P8" }
 ];
 
 // src/engine/formal-engine/engine.ts
@@ -6467,6 +7190,9 @@ var FormalEngine = class {
       });
     }
     const graph = buildMultiSessionGraph(all, aNext);
+    if (aNext) {
+      graph.witnessIdx = allNodes(graph).length - 1;
+    }
     const result = emptyVerificationResult();
     for (const prop of this.properties) {
       let violations;
@@ -6607,6 +7333,7 @@ function _resetBrainForTest() {
 }
 var formalEngine = new FormalEngine();
 async function runAnalysis(input) {
+  const observedFormalLayers = [];
   const heuristicResult = isHeuristicEnabled() ? runHeuristicCheck(input) : null;
   const isInlineScriptCmd = isInlineScriptCommand(input.aNext.actionDetail.toLowerCase());
   const isLiteralTextCmd = isLiteralTextCommand(input.aNext.actionDetail.toLowerCase());
@@ -6632,7 +7359,7 @@ async function runAnalysis(input) {
             riskType: node.l1RiskType,
             confidence: 90,
             source: "heuristic_script_scan",
-            violatedLayers: ["1.1-script"]
+            violatedLayers: ["L1.2"]
           };
         }
       }
@@ -6661,8 +7388,8 @@ async function runAnalysis(input) {
   const rawDetail = extractRawCommand(input.aNext.actionDetail);
   const lowerDetail = rawDetail.toLowerCase();
   const agentExt = mergeAgentExtensions(
-    getAgentExtensions(input.agentId),
-    getScenarioExtensions(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "")
+    isLayerEnabled("agent_rules_enabled") ? getAgentExtensions(input.agentId) : null,
+    isLayerEnabled("scenario_rules_enabled") ? getScenarioExtensionsMulti(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "") : null
   );
   if (FULLY_SAFE_TOOLS.has(actionType)) {
     return {
@@ -6750,7 +7477,7 @@ async function runAnalysis(input) {
             riskType: inlineJudgment.riskType,
             confidence: 90,
             source: "logic_rule",
-            violatedLayers: ["1.2"]
+            violatedLayers: ["L2.1"]
           };
         }
         return {
@@ -6779,15 +7506,22 @@ async function runAnalysis(input) {
     const formalResult = formalEngine.verify(formalSessions, input.aNext);
     if (!formalResult.verified) {
       const v = formalResult.violations[0];
-      return {
-        allowed: false,
-        reason: v ? v.reason : "\u5F62\u5F0F\u5316\u9A8C\u8BC1\u672A\u901A\u8FC7\uFF08\u884C\u4E3A\u6027\u8D28\u8FDD\u53CD\uFF09",
-        riskLevel: v ? v.riskLevel : "high",
-        riskType: "formal_verification",
-        confidence: 90,
-        source: "formal_engine",
-        violatedLayers: ["2.4"]
-      };
+      if (isFormalObserveMode()) {
+        console.warn(
+          `[AgentMoss] \u5F62\u5F0F\u5316\u9A8C\u8BC1 observe\uFF08\u53EA\u8BB0\u5F55\u4E0D\u62E6\u622A\uFF09: property=${v?.propertyId ?? "?"} risk=${v?.riskLevel ?? "?"} path_len=${v?.path?.length ?? 0} reason=${(v?.reason ?? "?").slice(0, 200)}`
+        );
+        observedFormalLayers.push("L2.2");
+      } else {
+        return {
+          allowed: false,
+          reason: v ? v.reason : "\u5F62\u5F0F\u5316\u9A8C\u8BC1\u672A\u901A\u8FC7\uFF08\u884C\u4E3A\u6027\u8D28\u8FDD\u53CD\uFF09",
+          riskLevel: v ? v.riskLevel : "high",
+          riskType: "formal_verification",
+          confidence: 90,
+          source: "formal_engine",
+          violatedLayers: ["L2.2"]
+        };
+      }
     }
   }
   if (scriptChain && scriptChain.nodes.length > 0 && isLogicRulesEnabled()) {
@@ -6802,7 +7536,7 @@ async function runAnalysis(input) {
           riskType: node.l2RiskType,
           confidence: 85,
           source: "logic_rule_script_scan",
-          violatedLayers: ["1.2-script"]
+          violatedLayers: ["L2.3"]
         };
       }
     }
@@ -6834,7 +7568,7 @@ async function runAnalysis(input) {
       riskType: "",
       confidence: 85,
       source: "heuristic_and_logic_only",
-      violatedLayers: []
+      violatedLayers: observedFormalLayers.length > 0 ? [...observedFormalLayers] : []
     };
   }
   let skipL3Hints = "\u65E0\uFF08\u5F53\u524D\u65E0\u7981\u7528\u89C4\u5219\u547D\u4E2D\uFF09";
@@ -6879,7 +7613,7 @@ async function runAnalysis(input) {
         riskType: "",
         confidence: 50,
         source: "llm_failure_fallback",
-        violatedLayers: []
+        violatedLayers: observedFormalLayers.length > 0 ? [...observedFormalLayers] : []
       };
     }
     return {
@@ -6889,7 +7623,7 @@ async function runAnalysis(input) {
       riskType: "",
       confidence: 60,
       source: "llm_failure_fallback",
-      violatedLayers: ["3"]
+      violatedLayers: ["L3.1"]
     };
   }
   if (!llmResult.allowed && llmResult.confidence && llmResult.confidence >= 90 && _brainExtractor) {
@@ -6906,6 +7640,9 @@ async function runAnalysis(input) {
     } catch {
     }
   }
+  if (observedFormalLayers.length > 0 && llmResult.allowed) {
+    llmResult.violatedLayers = Array.from(/* @__PURE__ */ new Set([...observedFormalLayers, ...llmResult.violatedLayers || []]));
+  }
   return llmResult;
 }
 export {
@@ -6913,4 +7650,17 @@ export {
   _resetBrainForTest,
   runAnalysis
 };
+//! 顺序即 fail-closed 短路优先级：verify 逐个执行，首个返回违规的性质成为
+//! first_violation，后续不再评估。调整顺序影响判定归属，须与 Python
+//! properties.py ALL_PROPERTIES 保持一致并双端测试确认。
+//!
+//! shortName（P1~P8 连续短名）与 id（语义化英文）对照（与 Python 一致）：
+//!   P1 cross-session-chain          跨会话组合链
+//!   P2 sensitive-data-flow          敏感数据传播
+//!   P3 low-integrity-reachability   低完整性数据流可达
+//!   P4 no-exfil-after-privesc       提权后禁外传
+//!   P5 no-exfil-after-credential    凭据后禁外传
+//!   P6 mc-ltl-rules                 LTL 模型检测
+//!   P7 low-integrity-command-exec   低完整性命令执行
+//!   P8 sensitive-data-aggregation   敏感数据聚合外传
 //# sourceMappingURL=coordinator.js.map