@kenhkl/agent-moss 0.12.9 → 0.14.0

package/dist/server.js

@@ -137,6 +137,7 @@ __export(config_exports, {
   getRetryConfig: () => getRetryConfig,
   getTimeoutConfig: () => getTimeoutConfig,
   isBrainEnabled: () => isBrainEnabled,
+  isFormalObserveMode: () => isFormalObserveMode,
   isHeuristicEnabled: () => isHeuristicEnabled,
   isLLMAvailable: () => isLLMAvailable,
   isLogicRulesEnabled: () => isLogicRulesEnabled,
@@ -252,6 +253,7 @@ function getCustomRules() {
 }
 function isLLMAvailable() {
   if (process.env.AGENT_MOSS_DISABLE_LLM === "1") return false;
+  if (!layerEnabledOrDefault("L3_llm_analysis")) return false;
   return llmConfig.apiKey.length > 0;
 }
 async function probeLLMConnection(timeoutMs = 8e3) {
@@ -316,13 +318,26 @@ function getProviderHeaders(provider) {
   return PROVIDER_HEADERS[provider] || {};
 }
 function isHeuristicEnabled() {
-  return process.env.AGENT_MOSS_DISABLE_HEURISTIC !== "1";
+  if (process.env.AGENT_MOSS_DISABLE_HEURISTIC === "1") return false;
+  return layerEnabledOrDefault("L1_heuristic");
+}
+function layerEnabledOrDefault(key) {
+  try {
+    const { isLayerEnabled: isLayerEnabled2 } = __require("../infra/runtime-config");
+    return isLayerEnabled2(key);
+  } catch {
+    return true;
+  }
 }
 function isBrainEnabled() {
   return process.env.AGENT_MOSS_BRAIN_ENABLED === "1";
 }
 function isLogicRulesEnabled() {
-  return process.env.AGENT_MOSS_DISABLE_LOGIC_RULES !== "1";
+  if (process.env.AGENT_MOSS_DISABLE_LOGIC_RULES === "1") return false;
+  return layerEnabledOrDefault("L2_logic_rules");
+}
+function isFormalObserveMode() {
+  return process.env.AGENT_MOSS_FORMAL_OBSERVE === "1";
 }
 var timeoutConfig, retryConfig, llmConfig, __configModuleDir, USER_RULES_PATHS, customRules, PROVIDER_HEADERS;
 var init_config = __esm({
@@ -580,8 +595,12 @@ var init_inline_analyzer = __esm({
 
 // src/infra/rules-loader.ts
 import { readFileSync as readFileSync2, existsSync } from "fs";
-import { resolve, dirname } from "path";
+import { resolve, dirname, join as join2 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
+import { homedir as homedir2 } from "os";
+function dataRootDir() {
+  return process.env.AGENT_MOSS_DATA_DIR || join2(homedir2(), ".config", "agentmoss");
+}
 function findRulesFile(name) {
   for (const dir of RULES_DIR_CANDS) {
     const p = resolve(dir, name);
@@ -607,6 +626,24 @@ function loadL2() {
 function loadL3() {
   return loadJson("l3_rules.json");
 }
+function loadMC() {
+  const mc = loadJson("mc_rules.json");
+  const rules = mc.rules || [];
+  try {
+    const rt = (init_runtime_config(), __toCommonJS(runtime_config_exports));
+    if (rules.length > 0 && typeof rt.hasRuntimeConfig === "function" && rt.hasRuntimeConfig()) {
+      const rtRules = rt.loadRuntimeConfig()?.L2_2?.ltl_rules?.rules || [];
+      const enabledById = {};
+      for (const r of rtRules) if (r?.id) enabledById[r.id] = r.enabled !== false;
+      for (const r of rules) if (r?.id && r.id in enabledById) r.enabled = enabledById[r.id];
+    }
+  } catch {
+  }
+  return mc;
+}
+function loadToolRegistry() {
+  return loadJson("tool_registry.json");
+}
 var __filename2, __dirname2, RULES_DIR_CANDS;
 var init_rules_loader = __esm({
   "src/infra/rules-loader.ts"() {
@@ -616,6 +653,10 @@ var init_rules_loader = __esm({
     __dirname2 = dirname(__filename2);
     RULES_DIR_CANDS = (() => {
       const cands = [
+        // 用户数据目录覆盖优先（与 Python rules_loader._load_json 的
+        // <data_root>/rules/<name> 优先逻辑对齐）。用户安装 pip/npm 包后把自定义
+        // mc_rules.json 放到 <data_root>/rules/ 即可覆盖内置默认，无需改源码。
+        resolve(dataRootDir(), "rules"),
         // dist: __dirname=dist/ → dist/rules；__dirname=dist/engine/ → dist/engine/../rules=dist/rules
         resolve(__dirname2, "../rules"),
         resolve(__dirname2, "rules"),
@@ -639,7 +680,8 @@ function _loadSensitivePathScope(scope) {
     path: sp.path,
     riskLevel: sp.risk_level,
     desc: sp.desc,
-    credential: sp.deny_mode === "deny_both" ? true : void 0
+    credential: sp.deny_mode === "deny_both" ? true : void 0,
+    dirDelOnly: sp.dir_del_only === true ? true : void 0
   }));
 }
 function isWriteOperation(actionType, actionDetail, writeKeywords = WRITE_KEYWORDS) {
@@ -737,7 +779,7 @@ function runLogicCheck(input) {
             riskType: "intent_deviation",
             confidence: 85,
             source: "logic_rule",
-            violatedLayers: ["2"]
+            violatedLayers: ["L2.1"]
           };
         }
       }
@@ -761,7 +803,7 @@ function runLogicCheck(input) {
           riskType: "privilege_escalation",
           confidence: 85,
           source: "logic_rule",
-          violatedLayers: ["2"]
+          violatedLayers: ["L2.1"]
         };
       }
     }
@@ -813,7 +855,7 @@ function checkComboChain(actionHistory, actionDetailRaw) {
         riskType: "combo_chain",
         confidence: 85,
         source: "logic_rule",
-        violatedLayers: ["2"]
+        violatedLayers: ["L2.1"]
       };
     }
   }
@@ -938,7 +980,7 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
       riskType: "read_before_write",
       confidence: 85,
       source: "logic_rule",
-      violatedLayers: ["2"]
+      violatedLayers: ["L2.1"]
     };
   }
   return null;
@@ -958,7 +1000,7 @@ function checkPasswordConsent(actionType, actionDetail, actionHistory) {
     riskType: "consent_missing",
     confidence: 85,
     source: "logic_rule",
-    violatedLayers: ["2"]
+    violatedLayers: ["L2.1"]
   };
 }
 function checkUserDeletionConsent(actionType, actionDetail, actionHistory) {
@@ -976,7 +1018,7 @@ function checkUserDeletionConsent(actionType, actionDetail, actionHistory) {
     riskType: "consent_missing",
     confidence: 85,
     source: "logic_rule",
-    violatedLayers: ["2"]
+    violatedLayers: ["L2.1"]
   };
 }
 function containsPrivilegeEscalation(actionDetail) {
@@ -1036,7 +1078,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
           riskType: "file_access",
           confidence: 95,
           source: "logic_rule",
-          violatedLayers: ["2"],
+          violatedLayers: ["L2.1"],
           isCredential: true
         };
       }
@@ -1052,7 +1094,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
             riskType: "file_access",
             confidence: 95,
             source: "logic_rule",
-            violatedLayers: ["2"]
+            violatedLayers: ["L2.1"]
           };
         }
       }
@@ -1066,7 +1108,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
     riskType: "file_access",
     confidence: 70,
     source: "logic_rule",
-    violatedLayers: ["2"]
+    violatedLayers: ["L2.1"]
   };
 }
 var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, WRITE_KEYWORDS, WRITE_COMMAND_RES, READ_ONLY_COMMANDS, DEVNULL_REDIRECT_RE, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
@@ -1078,7 +1120,7 @@ var init_logic_rules = __esm({
     init_rules_loader();
     ROOT_SENSITIVE_PATHS = _loadSensitivePathScope("root");
     HOME_SENSITIVE_PATHS = _loadSensitivePathScope("home");
-    CREDENTIAL_PATHS = _loadSensitivePathScope("credential").map(({ path: path6, riskLevel, desc }) => ({ path: path6, riskLevel, desc, credential: true }));
+    CREDENTIAL_PATHS = _loadSensitivePathScope("credential").map(({ path: path6, riskLevel, desc, dirDelOnly }) => ({ path: path6, riskLevel, desc, credential: true, dirDelOnly }));
     NON_WRITE_TOOLS = /* @__PURE__ */ new Set([
       "ask_user_question",
       "glob",
@@ -1353,6 +1395,7 @@ var init_skill_loader = __esm({
 // src/infra/runtime-config.ts
 var runtime_config_exports = {};
 __export(runtime_config_exports, {
+  DEFAULT_LAYERS: () => DEFAULT_LAYERS,
   DENY_MODE_LABELS: () => DENY_MODE_LABELS,
   addAgentRule: () => addAgentRule,
   addCustomRule: () => addCustomRule,
@@ -1404,7 +1447,7 @@ __export(runtime_config_exports, {
   updateSkillEnabled: () => updateSkillEnabled
 });
 import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync4, mkdirSync, unlinkSync, readdirSync as readdirSync3 } from "fs";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import { dirname as dirname3 } from "path";
 function runtimeDir() {
@@ -1428,6 +1471,7 @@ function emptyRuntimeConfig() {
     L1_rules: {},
     L2_rules: {},
     L3_skills: {},
+    L2_2: {},
     agent_rules: {},
     scenario_rules: {}
   };
@@ -1455,6 +1499,7 @@ function loadRuntimeConfig() {
       L1_rules: merged.L1_rules || {},
       L2_rules: merged.L2_rules || {},
       L3_skills: merged.L3_skills || {},
+      L2_2: merged.L2_2 || {},
       agent_rules: merged.agent_rules || {},
       scenario_rules: merged.scenario_rules || {}
     };
@@ -1507,6 +1552,7 @@ function getEnabledL2SensitivePaths(runtime) {
     const out = { path: r.path || "", risk_level: r.risk_level || "", desc: r.desc || "", deny_mode: r.deny_mode || "deny_write" };
     if (r.credential) out.credential = true;
     if (r.read_only) out.read_only = true;
+    if (r.dir_del_only) out.dir_del_only = true;
     return out;
   });
 }
@@ -1615,6 +1661,7 @@ function _l2SensitivePathsToRules() {
       builtin: true
     };
     _syncDenyModeFields(rule);
+    if (sp.dirDelOnly) rule.dir_del_only = true;
     return rule;
   });
 }
@@ -1702,7 +1749,7 @@ function _scenarioRulesToDefaults() {
     return out;
   }
   for (const scenarioId of entries) {
-    const rulesFile = join2(scenDir, scenarioId, "rules.json");
+    const rulesFile = join3(scenDir, scenarioId, "rules.json");
     if (!existsSync4(rulesFile)) continue;
     let data;
     try {
@@ -1751,7 +1798,7 @@ function _agentRulesToDefaults() {
     return out;
   }
   for (const agentId of entries) {
-    const rulesFile = join2(agentsDir, agentId, "rules.json");
+    const rulesFile = join3(agentsDir, agentId, "rules.json");
     if (!existsSync4(rulesFile)) continue;
     let data;
     try {
@@ -1792,7 +1839,7 @@ function _agentRulesToDefaults() {
 function generateSourceDefaults() {
   return {
     version: 1,
-    layers: { L1_heuristic: true, L2_logic_rules: true, L3_llm_analysis: true },
+    layers: { ...DEFAULT_LAYERS },
     L1_rules: {
       dangerous_commands: {
         category_enabled: true,
@@ -1831,10 +1878,45 @@ function generateSourceDefaults() {
       user_custom: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49 L2 \u903B\u8F91\u89C4\u5219", rules: [] }
     },
     L3_skills: _l3SkillsToRules(),
+    L2_2: _ltlRulesToRuntime(),
     agent_rules: _agentRulesToDefaults(),
     scenario_rules: _scenarioRulesToDefaults()
   };
 }
+function _ltlRulesToRuntime() {
+  const cands = [
+    join3(__dirname4, "..", "rules"),
+    join3(__dirname4, "..", "..", "..", "agent_moss", "rules"),
+    join3(process.cwd(), "agent_moss", "rules")
+  ];
+  let mc = {};
+  for (const dir of cands) {
+    const p = join3(dir, "mc_rules.json");
+    if (existsSync4(p)) {
+      try {
+        mc = JSON.parse(readFileSync4(p, "utf-8")) || {};
+      } catch {
+        mc = {};
+      }
+      break;
+    }
+  }
+  const rules = mc.rules || [];
+  return {
+    ltl_rules: {
+      category_enabled: true,
+      category_desc: "LTL \u653B\u51FB\u6A21\u5F0F\u89C4\u5219\uFF08\u65F6\u5E8F\u653B\u51FB\u68C0\u6D4B\uFF0C\u5148 A \u540E B\uFF09",
+      rules: rules.map((r) => ({
+        id: r.id,
+        reason: r.reason || "",
+        risk_level: r.risk_level || "high",
+        action: r.action || "block",
+        enabled: true,
+        builtin: true
+      }))
+    }
+  };
+}
 function normalizePatternForFingerprint(pattern) {
   return pattern.replace(/\\\//g, "/");
 }
@@ -1984,6 +2066,11 @@ function mergeConfig(userCfg, srcDefaults) {
   );
   _mergeRuleCategories(cfg, srcDefaults, "L1_rules");
   _mergeRuleCategories(cfg, srcDefaults, "L2_rules");
+  if (!cfg.L2_2 && cfg.L2_4) {
+    cfg.L2_2 = cfg.L2_4;
+    delete cfg.L2_4;
+  }
+  _mergeRuleCategories(cfg, srcDefaults, "L2_2");
   _mergeSkillCategories(cfg, srcDefaults, "L3_skills");
   _mergeAgentRules(cfg, srcDefaults);
   _mergeAgentRules(cfg, srcDefaults, "scenario_rules");
@@ -2176,12 +2263,12 @@ function deleteCustomRule(layer, category, ruleId) {
 function addCustomSkill(skillId, category, keywords, content) {
   _validateSkillId(skillId);
   const runtime = loadRuntimeConfig();
-  const skillsDir = join2(RUNTIME_CONFIG_DIR, "agent_moss_skills");
+  const skillsDir = join3(RUNTIME_CONFIG_DIR, "agent_moss_skills");
   try {
     mkdirSync(skillsDir, { recursive: true });
   } catch {
   }
-  writeFileSync(join2(skillsDir, `${skillId}.md`), content, "utf-8");
+  writeFileSync(join3(skillsDir, `${skillId}.md`), content, "utf-8");
   const l3 = runtime.L3_skills || (runtime.L3_skills = {});
   const cat = l3[category] || (l3[category] = { category_enabled: true, category_desc: "", skills: [] });
   (cat.skills || (cat.skills = [])).push({ id: skillId, keywords, enabled: true, builtin: false });
@@ -2196,7 +2283,7 @@ function deleteCustomSkill(skillId, category) {
   if (idx >= 0) {
     if (skills[idx].builtin) return null;
     skills.splice(idx, 1);
-    const skillPath = join2(RUNTIME_CONFIG_DIR, "agent_moss_skills", `${skillId}.md`);
+    const skillPath = join3(RUNTIME_CONFIG_DIR, "agent_moss_skills", `${skillId}.md`);
     try {
       if (existsSync4(skillPath)) unlinkSync(skillPath);
     } catch {
@@ -2390,7 +2477,7 @@ function updateScenarioCategoryEnabled(scenarioId, category, enabled) {
   saveRuntimeConfig(runtime);
   return runtime;
 }
-var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DENY_MODE_LABELS, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, SKILL_ID_RE;
+var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DEFAULT_LAYERS, DENY_MODE_LABELS, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, SKILL_ID_RE;
 var init_runtime_config = __esm({
   "src/infra/runtime-config.ts"() {
     "use strict";
@@ -2402,21 +2489,28 @@ var init_runtime_config = __esm({
     __dirname4 = dirname3(fileURLToPath5(import.meta.url));
     ENV_RUNTIME_CONFIG_PATH = "AGENT_MOSS_RUNTIME_CONFIG_PATH";
     RUNTIME_CONFIG_DIR = runtimeDir();
-    RUNTIME_CONFIG_PATH = join2(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
+    RUNTIME_CONFIG_PATH = join3(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
     LAYER_DISABLE_ENV = {
       L1_heuristic: "AGENT_MOSS_DISABLE_HEURISTIC",
       L2_logic_rules: "AGENT_MOSS_DISABLE_LOGIC_RULES",
       L3_llm_analysis: "AGENT_MOSS_DISABLE_LLM"
     };
+    DEFAULT_LAYERS = {
+      L1_heuristic: true,
+      L2_logic_rules: true,
+      L3_llm_analysis: true,
+      agent_rules_enabled: true,
+      scenario_rules_enabled: true
+    };
     DENY_MODE_LABELS = {
       deny_write: "\u4EC5\u62E6\u622A\u5199\u5165",
       deny_read: "\u4EC5\u62E6\u622A\u8BFB\u53D6",
       deny_both: "\u8BFB\u5199\u5747\u62E6\u622A"
     };
-    _AGENTS_DIR_PROD = join2(__dirname4, "agents");
-    _AGENTS_DIR_DEV = join2(__dirname4, "..", "..", "..", "agent_moss", "agents");
-    _SCENARIOS_DIR_PROD = join2(__dirname4, "scenarios");
-    _SCENARIOS_DIR_DEV = join2(__dirname4, "..", "..", "..", "agent_moss", "scenarios");
+    _AGENTS_DIR_PROD = join3(__dirname4, "agents");
+    _AGENTS_DIR_DEV = join3(__dirname4, "..", "..", "..", "agent_moss", "agents");
+    _SCENARIOS_DIR_PROD = join3(__dirname4, "scenarios");
+    _SCENARIOS_DIR_DEV = join3(__dirname4, "..", "..", "..", "agent_moss", "scenarios");
     SKILL_ID_RE = /^[A-Za-z0-9_-]+$/;
   }
 });
@@ -2554,11 +2648,21 @@ function getScenarioExtensions(scenarioId) {
   );
   return ext;
 }
+function getScenarioExtensionsMulti(scenarioSpec) {
+  if (!scenarioSpec) return null;
+  const ids = scenarioSpec.split(",").map((s) => s.trim()).filter(Boolean);
+  if (ids.length === 0) return null;
+  const exts = ids.map((id) => getScenarioExtensions(id));
+  const nonNull = exts.filter((e) => e !== null);
+  if (nonNull.length === 0) return null;
+  return mergeAgentExtensions(...nonNull);
+}
 var __filename5, __dirname6, SCENARIOS_DIR_PROD, SCENARIOS_DIR_DEV_FALLBACK, cache2;
 var init_scenarios = __esm({
   "src/scenarios/index.ts"() {
     "use strict";
     init_esm_shims();
+    init_agents();
     __filename5 = fileURLToPath7(import.meta.url);
     __dirname6 = dirname5(__filename5);
     SCENARIOS_DIR_PROD = resolve4(__dirname6, "scenarios");
@@ -2586,7 +2690,7 @@ function runHeuristicCheck(input) {
             riskType: "sensitive_action",
             confidence: 90,
             source: "heuristic",
-            violatedLayers: ["1.1"]
+            violatedLayers: ["L1.1"]
           };
         }
       }
@@ -2596,8 +2700,10 @@ function runHeuristicCheck(input) {
   const scanDetail = normalizePathSegments(stripLiteralTextSegments(input.aNext.actionDetail));
   const scanCommand = `${input.aNext.actionType}: ${scanDetail}`;
   let topRiskType = "";
+  const exemptKeygen = isSshKeygenGenerate(input.aNext.actionDetail);
   for (const rule of DANGEROUS_PATTERNS) {
     if (rule.pattern.test(scanCommand)) {
+      if (exemptKeygen && rule.riskType === "file_access") continue;
       matched.push(rule.description);
       if (severityRank(rule.severity) > severityRank(highestSeverity)) {
         highestSeverity = rule.severity;
@@ -2607,8 +2713,8 @@ function runHeuristicCheck(input) {
   }
   highestRiskType = topRiskType || highestRiskType;
   const agentExt = mergeAgentExtensions(
-    getAgentExtensions(input.agentId),
-    getScenarioExtensions(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "")
+    isLayerEnabled("agent_rules_enabled") ? getAgentExtensions(input.agentId) : null,
+    isLayerEnabled("scenario_rules_enabled") ? getScenarioExtensionsMulti(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "") : null
   );
   if (agentExt?.extra_command_patterns) {
     for (const rule of agentExt.extra_command_patterns) {
@@ -2639,10 +2745,26 @@ function runHeuristicCheck(input) {
   const detailL = input.aNext.actionDetail.toLowerCase();
   const isExcludedType = SENSITIVE_EXCLUDED_PREFIXES.some((p) => actionTypeL.startsWith(p));
   const dangerousResult = checkDangerousPatterns(actionTypeL, detailL);
-  if (dangerousResult) return dangerousResult;
-  if (!isExcludedType) {
-    const pathResult = checkSensitivePath(detailL, input.cwd || "/", agentExt);
-    if (pathResult) return pathResult;
+  const pathResult = isExcludedType ? null : checkSensitivePath(detailL, input.cwd || "/", agentExt);
+  const homeResult = checkHomeDeletion(actionTypeL, detailL);
+  const mergeResults = [dangerousResult, pathResult, homeResult].filter(Boolean);
+  if (mergeResults.length > 0) {
+    let best = mergeResults[0];
+    for (const r of mergeResults) {
+      if (severityRank(r.riskLevel) > severityRank(best.riskLevel)) best = r;
+    }
+    if (severityRank(highestSeverity) > severityRank(best.riskLevel)) {
+      return {
+        allowed: false,
+        reason: `\u68C0\u6D4B\u5230\u9AD8\u5371\u64CD\u4F5C: ${matched.join(", ")}`,
+        riskLevel: highestSeverity,
+        riskType: highestRiskType,
+        confidence: 95,
+        source: "heuristic",
+        violatedLayers: ["L1.1"]
+      };
+    }
+    return best;
   }
   if (matched.length > 0) {
     return {
@@ -2652,8 +2774,7 @@ function runHeuristicCheck(input) {
       riskType: highestRiskType,
       confidence: 95,
       source: "heuristic",
-      violatedLayers: ["1.1"]
-      // 对齐 py coordinator.py:165（L1.1 = 命中高危命令模式/注入关键词）
+      violatedLayers: ["L1.1"]
     };
   }
   const lateralResult = checkLateralMovement(detailL);
@@ -2781,6 +2902,7 @@ function isSearchActionType(actionType) {
 function checkSensitivePath(command, cwd, agentExt) {
   const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
   const isWriteOpFlag = isWriteOperation("", command);
+  const keygenGenerate = isSshKeygenGenerate(command);
   const pathScanText = normalizePathSegments(stripLiteralTextSegments(command));
   const pathMatches = (text, path6) => {
     const parts = path6.split(/(\(\?!.*?\))/);
@@ -2793,6 +2915,7 @@ function checkSensitivePath(command, cwd, agentExt) {
   };
   for (const sp of ROOT_SENSITIVE_PATHS) {
     if (pathMatches(pathScanText, sp.path.toLowerCase())) {
+      if (keygenGenerate) continue;
       if (sp.path === "/dev/random") {
         if (isWriteOpFlag) {
           continue;
@@ -2804,7 +2927,7 @@ function checkSensitivePath(command, cwd, agentExt) {
           riskType: "file_access",
           confidence: 90,
           source: "heuristic",
-          violatedLayers: ["1.1"]
+          violatedLayers: ["L1.1"]
         };
       }
       if (!isWriteOpFlag && !sp.credential) {
@@ -2817,16 +2940,51 @@ function checkSensitivePath(command, cwd, agentExt) {
         riskType: "file_access",
         confidence: 90,
         source: "heuristic",
-        violatedLayers: ["1.1"],
+        violatedLayers: ["L1.1"],
         isCredential: !!sp.credential
       };
     }
   }
   for (const sp of HOME_SENSITIVE_PATHS) {
     const expanded = `${expandedCwd}/${sp.path}`;
-    const pathRe = sp.path.endsWith(".pub") ? new RegExp(sp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i") : new RegExp(sp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "(?!\\.pub)", "i");
-    const expandedRe = sp.path.endsWith(".pub") ? new RegExp(expanded.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i") : new RegExp(expanded.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "(?!\\.pub)", "i");
-    if (pathRe.test(pathScanText) || expandedRe.test(pathScanText)) {
+    let pPath = sp.path;
+    if (!sp.path.endsWith(".pub")) pPath = `${sp.path}(?!\\.pub)`;
+    let dirPrefixMatch = null;
+    if (sp.dirDelOnly) {
+      const dirRe = (t) => new RegExp(`(?:^|[\\s/\\\\'"])${t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:/|[\\s'"\\\\]|$)`, "i");
+      dirPrefixMatch = dirRe(sp.path).test(pathScanText) || dirRe(expanded.toLowerCase()).test(pathScanText);
+    }
+    const pathReMatch = sp.dirDelOnly ? !!dirPrefixMatch : pathMatches(pathScanText, pPath);
+    const expandedReMatch = sp.dirDelOnly ? false : pathMatches(pathScanText, expanded + (sp.path.endsWith(".pub") ? "" : "(?!\\.pub)"));
+    if (pathReMatch || expandedReMatch) {
+      if (keygenGenerate) continue;
+      if (sp.dirDelOnly) {
+        if (isDeleteActionForDir(command, sp.path)) {
+          return {
+            allowed: false,
+            reason: `\u5220\u9664\u654F\u611F\u76EE\u5F55: ${sp.desc} (${sp.path})`,
+            riskLevel: sp.riskLevel,
+            riskType: "file_access",
+            confidence: 90,
+            source: "heuristic",
+            violatedLayers: ["L1.1"],
+            isCredential: !!sp.credential
+          };
+        }
+        if (isArchiveReadOfDir(command, sp.path)) {
+          return {
+            allowed: false,
+            reason: `\u5F52\u6863/\u590D\u5236\u8BFB\u53D6\u654F\u611F\u76EE\u5F55: ${sp.desc} (${sp.path})`,
+            riskLevel: sp.riskLevel,
+            riskType: "file_access",
+            confidence: 90,
+            source: "heuristic",
+            violatedLayers: ["L1.1"],
+            isCredential: !!sp.credential
+          };
+        }
+        continue;
+      }
       if (!isWriteOpFlag && !sp.credential) {
         continue;
       }
@@ -2837,7 +2995,7 @@ function checkSensitivePath(command, cwd, agentExt) {
         riskType: "file_access",
         confidence: 90,
         source: "heuristic",
-        violatedLayers: ["1.1"],
+        violatedLayers: ["L1.1"],
         isCredential: !!sp.credential
       };
     }
@@ -2860,7 +3018,7 @@ function checkSensitivePath(command, cwd, agentExt) {
           riskType: "file_access",
           confidence: 90,
           source: "heuristic",
-          violatedLayers: ["1.1"],
+          violatedLayers: ["L1.1"],
           isCredential: !!sp.credential
         };
       }
@@ -2877,7 +3035,7 @@ function checkSensitivePath(command, cwd, agentExt) {
         riskType: "file_access",
         confidence: 90,
         source: "heuristic",
-        violatedLayers: ["1.1"],
+        violatedLayers: ["L1.1"],
         isCredential: true
       };
     }
@@ -2890,18 +3048,142 @@ function checkSensitivePath(command, cwd, agentExt) {
       riskType: "file_access",
       confidence: 90,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
   return null;
 }
+function isHomeValue(path6) {
+  let p = path6.trim().toLowerCase();
+  if (p.startsWith("$(") && p.endsWith(")")) {
+    const inner = p.slice(2, -1).trim();
+    return HOME_TARGET_RE.test(" " + inner);
+  }
+  if (/^\/home\/[^/\s]+\/?$/.test(p)) return true;
+  return HOME_TARGET_RE.test(" " + p);
+}
+function isDeleteCommand(seg) {
+  const s = seg.trimStart();
+  if (/^(?:rm|rmdir|unlink)\b/i.test(s)) return true;
+  return /删除|移除/.test(s);
+}
+function homeEscapeTarget(seg) {
+  const low = seg.toLowerCase();
+  const re = /(?:~|(?:\$home|\$\{home\})|\/home\/[a-z0-9_.-]+)/g;
+  let m;
+  while ((m = re.exec(low)) !== null) {
+    const endIdx = m.index + m[0].length;
+    const tail = low.slice(endIdx);
+    if (!tail) continue;
+    let token = tail.trimStart().split(/\s+/)[0] || "";
+    token = token.split("&&")[0].split("||")[0].split(";")[0].replace(/\/+$/, "");
+    token = token.replace(/^['"]|['"]$/g, "");
+    const segments = token.split("/").filter((s) => s && s !== ".");
+    if (!segments.some((s) => s === "..")) continue;
+    let depth = 0;
+    let minDepth = 0;
+    for (const s of segments) {
+      depth += s === ".." ? -1 : 1;
+      minDepth = Math.min(minDepth, depth);
+    }
+    if (minDepth < 0) return true;
+    if (depth <= 0) return true;
+  }
+  return false;
+}
+function checkHomeDeletion(actionType, actionDetail) {
+  if (actionType !== "bash" && actionType !== "executebash" && actionType !== "terminal-executebash") return null;
+  const segs = actionDetail.split(/&&|\|\||;|\n/).map((s) => s.trim()).filter(Boolean);
+  for (const seg of segs) {
+    if (!isDeleteCommand(seg)) continue;
+    if (HOME_TARGET_RE.test(seg) || homeEscapeTarget(seg)) {
+      return {
+        allowed: false,
+        reason: "\u68C0\u6D4B\u5230\u5220\u9664\u4E3B\u76EE\u5F55 (~/$HOME) \u64CD\u4F5C",
+        riskLevel: "high",
+        riskType: "script_execution",
+        confidence: 90,
+        source: "heuristic",
+        violatedLayers: ["L1.1"]
+      };
+    }
+  }
+  const assigned = {};
+  for (const m of actionDetail.matchAll(HOME_ASSIGN_RE)) assigned[m[1]] = m[2];
+  for (const [varName, path6] of Object.entries(assigned)) {
+    if (!isHomeValue(path6)) continue;
+    const varRefRe = new RegExp(`(?:${escapeRegExp(varName)}|\\$\\{${escapeRegExp(varName)}\\})`);
+    for (const seg of segs) {
+      if (!isDeleteCommand(seg)) continue;
+      if (varRefRe.test(seg)) {
+        return {
+          allowed: false,
+          reason: `\u68C0\u6D4B\u5230\u901A\u8FC7\u53D8\u91CF ${varName}\uFF08=${path6}\uFF0C\u4E3B\u76EE\u5F55\uFF09\u6267\u884C\u5220\u9664`,
+          riskLevel: "high",
+          riskType: "script_execution",
+          confidence: 90,
+          source: "heuristic",
+          violatedLayers: ["L1.1"]
+        };
+      }
+    }
+  }
+  return null;
+}
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function isDeleteActionForDir(command, dirPath) {
+  const low = command.toLowerCase();
+  const dpath = dirPath.toLowerCase();
+  if (new RegExp(`\\b(?:rm|unlink|rmdir)\\b[^&|;]*?${escapeRegExp(dpath)}`, "i").test(low)) {
+    return true;
+  }
+  if (new RegExp(`(?:\u5220\u9664|\u79FB\u9664)[^\\n;|&]*?${escapeRegExp(dpath)}`).test(low)) {
+    return true;
+  }
+  for (const seg of low.split(/&&|\|\||;|\n/)) {
+    const fw = (seg.trim().split(/\s+/)[0] || "").toLowerCase();
+    if ((fw === "rm" || fw === "unlink" || fw === "rmdir") && low.includes(dpath)) {
+      return true;
+    }
+  }
+  return false;
+}
+function isArchiveReadOfDir(command, dirPath) {
+  const low = command.toLowerCase();
+  const dpath = dirPath.toLowerCase();
+  for (const seg of low.split(/&&|\|\||;|\n/)) {
+    const s = seg.trim();
+    if (!s || !s.includes(dpath)) continue;
+    const parts = s.split(/\s+/);
+    const fw = parts[0] || "";
+    if (fw === "zip") return true;
+    if (fw === "tar") {
+      if (/(?:^|\s)-[a-zA-Z]*x|--extract/.test(s)) continue;
+      return true;
+    }
+    if (fw === "cp" || fw === "rsync") {
+      const segPaths = s.match(/[/~][^\s;|&><'"]*/g) || [];
+      if (segPaths.length && segPaths[0].includes(dpath)) return true;
+    }
+  }
+  return false;
+}
+function isSshKeygenGenerate(command) {
+  const low = command.toLowerCase();
+  if (!low.includes("ssh-keygen")) return false;
+  if (!/(?:^|\s)-t\s+\S+/.test(low)) return false;
+  if (/(?:^|\s)-\S*[ylpB]\S*/.test(low)) return false;
+  return true;
+}
 function checkDangerousPatterns(actionType, actionDetail) {
   if (actionType === "file_write" || actionType === "file_edit") return null;
   const scan = stripHeredocContent(actionDetail);
   const TEMP_DIRS = ["/tmp", "/var/tmp", "/run", "/dev/shm"];
   const isTempPath = TEMP_DIRS.some(
     (td) => new RegExp(`(?:^|[\\s/])${td.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[\\s/]|$)`).test(actionDetail)
-  );
+  ) || /(?:^|[\s;]|&&\s*|\|\|\s*)var\/tmp(?:[/\s;]|$)/.test(actionDetail);
   const wildcardDeleteRe = /(?:\brm\b|\b(r?mdir|del|delete|remove|rmdir|unlink)\b|\b删除\b|\b移除\b)[\s\S]{0,40}?[*?]|[*?][\s\S]{0,40}?\b(?:rm|del|delete|remove|rmdir|unlink)\b|rm\s+-[a-zA-Z]*[rf][a-zA-Z]*\s+\S*[*?]/i;
   if (!isTempPath && wildcardDeleteRe.test(scan)) {
     return {
@@ -2911,7 +3193,7 @@ function checkDangerousPatterns(actionType, actionDetail) {
       riskType: "script_execution",
       confidence: 90,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
   const findWriteMatch = actionDetail.match(
@@ -2926,10 +3208,10 @@ function checkDangerousPatterns(actionType, actionDetail) {
       riskType: "script_execution",
       confidence: 90,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
-  if (/>\s*\/etc\//.test(actionDetail) || />\s*\/boot\//.test(actionDetail)) {
+  if (/>\s*['"]?\/etc\//.test(actionDetail) || />\s*['"]?\/boot\//.test(actionDetail) || />\s*['"]?\/proc\//.test(actionDetail)) {
     return {
       allowed: false,
       reason: "\u68C0\u6D4B\u5230\u91CD\u5B9A\u5411\u8986\u76D6\u5199\u5165\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55",
@@ -2937,7 +3219,7 @@ function checkDangerousPatterns(actionType, actionDetail) {
       riskType: "file_access",
       confidence: 95,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
   if (/>\s*\/dev\/(sd|hd|nvme|vd|loop|mem|kmsg|port|zero|random|urandom|full|core)/i.test(actionDetail)) {
@@ -2948,7 +3230,7 @@ function checkDangerousPatterns(actionType, actionDetail) {
       riskType: "file_access",
       confidence: 90,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
   return null;
@@ -3039,13 +3321,13 @@ function checkLateralMovement(actionDetail) {
         riskType: "lateral_movement",
         confidence: 80,
         source: "heuristic",
-        violatedLayers: ["1.1"]
+        violatedLayers: ["L1.1"]
       };
     }
   }
   return null;
 }
-var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES;
+var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES, HOME_TARGET_RE, HOME_ASSIGN_RE;
 var init_heuristic = __esm({
   "src/engine/heuristic.ts"() {
     "use strict";
@@ -3053,6 +3335,7 @@ var init_heuristic = __esm({
     init_config();
     init_agents();
     init_scenarios();
+    init_runtime_config();
     init_rules_loader();
     init_logic_rules();
     INJECTION_KEYWORDS = (() => {
@@ -3074,6 +3357,8 @@ var init_heuristic = __esm({
     })();
     SENSITIVE_EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
     SEARCH_ACTION_PREFIXES = ["search-", "web-", "browser-", "query-", "websearch", "web_search"];
+    HOME_TARGET_RE = /(?:^|[\s="'($])(?:~|(?:\$home|\$\{home\}))(?:\/(?:\.\*|\*|\.)?)?(?=[\s"';}|&)]|$)/i;
+    HOME_ASSIGN_RE = /([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(~[A-Za-z0-9_./-]*|\$HOME[A-Za-z0-9_./-]*|\$\{HOME\}[A-Za-z0-9_./-]*|\/home\/[^\s;|&]+|\$\((?:[^()]|\([^()]*\))*\))(?=\s|;|$|\||&)/gi;
   }
 });
 
@@ -3335,7 +3620,7 @@ var require_bindings = __commonJS({
     var fs7 = __require("fs");
     var path6 = __require("path");
     var fileURLToPath10 = require_file_uri_to_path();
-    var join10 = path6.join;
+    var join11 = path6.join;
     var dirname11 = path6.dirname;
     var exists = fs7.accessSync && function(path7) {
       try {
@@ -3395,7 +3680,7 @@ var require_bindings = __commonJS({
       var requireFunc = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
       var tries = [], i = 0, l = opts.try.length, n, b, err;
       for (; i < l; i++) {
-        n = join10.apply(
+        n = join11.apply(
           null,
           opts.try[i].map(function(p) {
             return opts[p] || p;
@@ -3456,7 +3741,7 @@ var require_bindings = __commonJS({
         if (dir === ".") {
           dir = process.cwd();
         }
-        if (exists(join10(dir, "package.json")) || exists(join10(dir, "node_modules"))) {
+        if (exists(join11(dir, "package.json")) || exists(join11(dir, "node_modules"))) {
           return dir;
         }
         if (prev === dir) {
@@ -3465,7 +3750,7 @@ var require_bindings = __commonJS({
           );
         }
         prev = dir;
-        dir = join10(dir, "..");
+        dir = join11(dir, "..");
       }
     };
   }
@@ -4079,7 +4364,7 @@ var AnalyzeRequestSchema = z.object({
   session_history: z.array(z.object({
     session_id: z.string(),
     action_history: z.array(ActionItemSchema).default([])
-  })).default([]).describe("Multi-session historical actions (optional): for L2.4 formal engine cross-session combo-chain / sensitive-data-flow verification. Provided by caller (incl. future agentgate)."),
+  })).default([]).describe("Multi-session historical actions (optional): for L2.2 formal engine cross-session combo-chain / sensitive-data-flow verification. Provided by caller (incl. future agentgate)."),
   a_next: ActionItemSchema.describe("Next action to be executed"),
   reason: z.string().default("").describe("Reason for executing this action"),
   os_type: z.string().default("").describe("OS type: 'linux', 'windows', or empty for auto-detect"),
@@ -4096,7 +4381,9 @@ var AnalyzeResponseSchema = z.object({
   policy: z.string().default(""),
   violated_policy: z.string().default(""),
   confidence: z.number().int().min(0).max(100).default(100),
-  analysis_duration_ms: z.number().default(0)
+  analysis_duration_ms: z.number().default(0),
+  // 组合攻击链反例路径：每步 [session_id, seq, stage, timestamp]，含真实发生时间
+  violation_chain: z.array(z.array(z.union([z.string(), z.number()]).nullable())).default([])
 });
 var HealthResponseSchema = z.object({
   status: z.string().default("healthy"),
@@ -4171,7 +4458,7 @@ function loadTemplates() {
 // src/engine/script-analyzer.ts
 init_esm_shims();
 import { readFileSync as readFileSync8 } from "fs";
-import { resolve as resolve6, join as join3 } from "path";
+import { resolve as resolve6, join as join4 } from "path";
 var SUSPICIOUS_PATTERNS = [
   // Network exfiltration (curl/wget POST in scripts is almost never legitimate)
   { name: "curl POST", pattern: /curl\s+(.*\s)?-X\s+POST/i },
@@ -4304,7 +4591,7 @@ function assessKeywordCombinationRisk(matchedKeywords, scriptContent) {
 }
 function readScriptContent(scriptPath, maxLines = 500) {
   try {
-    const expandedPath = scriptPath.startsWith("~") ? join3(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve6(scriptPath);
+    const expandedPath = scriptPath.startsWith("~") ? join4(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve6(scriptPath);
     const raw = readFileSync8(expandedPath, "utf-8");
     const lines = raw.split("\n").slice(0, maxLines);
     return { content: lines.join("\n"), lineCount: lines.length, error: "" };
@@ -4359,9 +4646,10 @@ ${result.scriptContent}
 init_esm_shims();
 init_heuristic();
 init_logic_rules();
+init_inline_analyzer();
 import { statSync as statSync2, existsSync as existsSync9 } from "fs";
-import { resolve as resolve8, join as join5, isAbsolute as isAbsolute2 } from "path";
-import { homedir as homedir3 } from "os";
+import { resolve as resolve8, join as join6, isAbsolute as isAbsolute2 } from "path";
+import { homedir as homedir4 } from "os";
 
 // src/engine/script-engine/tracker.ts
 init_esm_shims();
@@ -5973,6 +6261,13 @@ function extractScriptPath2(command) {
   return null;
 }
 function extractScriptPathWithArgs(command) {
+  const inline = command.match(/(?:^|\s|&&|\|\|)\s*(?:bash|\/bin\/bash|sh|zsh)\s+-c\s*(['"])([\s\S]*?)\1/i);
+  if (inline) {
+    const inner = inline[2];
+    const realPath = extractScriptPath2(inner);
+    if (realPath) return { path: realPath, args: [] };
+    return { path: null, args: [] };
+  }
   const scriptPath = extractScriptPath2(command);
   if (!scriptPath) return { path: null, args: [] };
   const idx = command.indexOf(scriptPath);
@@ -5986,11 +6281,59 @@ function extractScriptPathWithArgs(command) {
   }
   return { path: scriptPath, args };
 }
+function looksLikeScriptPath(tok) {
+  const t = tok.trim().replace(/^['"]|['"]$/g, "");
+  if (!t) return false;
+  const low = t.toLowerCase();
+  if (["bash", "sh", "zsh", "dash", "python", "python3", "perl", "ruby", "node", "php", "lua"].includes(low)) return false;
+  if (/\.(sh|bash|py|pl|rb|js|php|lua)$/.test(low)) return true;
+  if (t.includes("/") && !t.startsWith("-")) return true;
+  return false;
+}
 function extractInlineScriptPath(actionDetail) {
+  const code = extractInlineCode(actionDetail);
+  if (code) {
+    const candidates = [];
+    const osRe = /os\.(?:system|popen)\s*\(\s*(['"])(.*?)\1\s*\)/gi;
+    let m;
+    while ((m = osRe.exec(code)) !== null) candidates.push(m[2]);
+    const subListRe = /subprocess\.(?:run|call|Popen|check_output|check_call)\s*\(\s*\[(.*?)\]/gi;
+    while ((m = subListRe.exec(code)) !== null) candidates.push(m[1]);
+    const subShellRe = /subprocess\.(?:run|call|Popen|check_output|check_call)\s*\(\s*(['"])(.*?)\1[^)]*?shell\s*=\s*true/gi;
+    while ((m = subShellRe.exec(code)) !== null) candidates.push(m[2]);
+    for (const cand of candidates) {
+      const tokens = cand.includes(",") ? cand.split(/\s*,\s*/).map((t) => t.trim().replace(/^['"]|['"]$/g, "")) : cand.split(/\s+/);
+      for (const tok of tokens) {
+        if (looksLikeScriptPath(tok)) {
+          try {
+            const resolved = resolvePath2(tok.replace(/^['"]|['"]$/g, ""));
+            if (existsSync9(resolved)) {
+              const stat = statSync2(resolved);
+              if (stat.isFile()) return resolved;
+            }
+          } catch {
+          }
+        }
+      }
+    }
+    const openRe = /open\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+    while ((m = openRe.exec(code)) !== null) {
+      const p = m[1];
+      try {
+        const resolved = resolvePath2(p);
+        if (existsSync9(resolved)) {
+          const stat = statSync2(resolved);
+          if (stat.isFile()) return resolved;
+        }
+      } catch {
+      }
+    }
+    return null;
+  }
   const re = /open\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
-  let m;
-  while ((m = re.exec(actionDetail)) !== null) {
-    const p = m[1];
+  let m2;
+  while ((m2 = re.exec(actionDetail)) !== null) {
+    const p = m2[1];
     let resolved;
     try {
       resolved = resolvePath2(p);
@@ -6006,7 +6349,7 @@ function extractInlineScriptPath(actionDetail) {
 function resolvePath2(p) {
   let expanded = p;
   if (expanded.startsWith("~/") || expanded === "~") {
-    expanded = join5(homedir3(), expanded.slice(1));
+    expanded = join6(homedir4(), expanded.slice(1));
   }
   return resolve8(expanded);
 }
@@ -6087,7 +6430,7 @@ function analyzeScriptContent2(input) {
     isInline = true;
   }
   if (resolvedPath && !isAbsolute2(resolvedPath) && !resolvedPath.startsWith("~/")) {
-    resolvedPath = join5(input.cwd || process.cwd(), resolvedPath);
+    resolvedPath = join6(input.cwd || process.cwd(), resolvedPath);
   }
   const l1Adapter = (content) => {
     const virtualInput = {
@@ -6375,7 +6718,7 @@ async function analyzeWithLLM(prompt, config) {
         riskType: riskType || "",
         confidence: typeof parsed.confidence === "number" ? Math.min(100, Math.max(0, parsed.confidence)) : 70,
         source: "llm",
-        violatedLayers: ["3"]
+        violatedLayers: ["L3.1"]
       };
     } catch (err) {
       if (abortController.signal.aborted) {
@@ -6398,6 +6741,7 @@ async function analyzeWithLLM(prompt, config) {
 
 // src/engine/coordinator.ts
 init_config();
+init_runtime_config();
 init_agents();
 init_scenarios();
 
@@ -6407,9 +6751,9 @@ init_esm_shims();
 // src/brain/rule-store.ts
 init_esm_shims();
 import { existsSync as existsSync11, readFileSync as readFileSync12, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
-import { join as join6 } from "path";
-import { homedir as homedir4 } from "os";
-var DEFAULT_RULES_PATH = join6(homedir4(), ".agentmoss", "brain", "rules.json");
+import { join as join7 } from "path";
+import { homedir as homedir5 } from "os";
+var DEFAULT_RULES_PATH = join7(homedir5(), ".agentmoss", "brain", "rules.json");
 var ENV_RULES_PATH = "AGENT_MOSS_BRAIN_RULES_PATH";
 var STATUS_DRAFT = "draft";
 var STATUS_APPROVED = "approved";
@@ -6971,6 +7315,15 @@ function decodeBase64Literals(text) {
   }
   return out;
 }
+var QUOTED_STR_RE = /('(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"|`(?:[^`\\]|\\.)*`)/g;
+var OUTPUT_CMDS = /* @__PURE__ */ new Set(["echo", "printf", "print"]);
+function stripStringLiterals(text) {
+  const m = text.match(/\s*([A-Za-z_][\w-]*|\/?[\w./-]+)\b/);
+  if (!m) return text;
+  const cmd = m[1].split("/").pop().toLowerCase();
+  if (!OUTPUT_CMDS.has(cmd)) return text;
+  return text.replace(QUOTED_STR_RE, "");
+}
 function decodeUrlAndNumeric(text) {
   const out = [];
   let s = text;
@@ -7004,7 +7357,10 @@ function decodeUrlAndNumeric(text) {
   return out;
 }
 function allCandidates(detail, max = 8) {
-  const cands = [detail];
+  const shell = stripStringLiterals(detail);
+  const cands = [shell];
+  cands.push(...decodeBase64Literals(shell));
+  cands.push(...decodeUrlAndNumeric(shell));
   cands.push(...decodeBase64Literals(detail));
   cands.push(...decodeUrlAndNumeric(detail));
   const seen = /* @__PURE__ */ new Set();
@@ -7029,6 +7385,128 @@ function matchStageAny(detail, stages) {
   return "";
 }
 
+// src/engine/formal-engine/ltl.ts
+init_esm_shims();
+init_rules_loader();
+
+// src/engine/formal-engine/ir.ts
+init_esm_shims();
+function allNodes(mg) {
+  const out = [];
+  for (const s of mg.sessions) out.push(...s.nodes);
+  return out;
+}
+function allEdges(mg) {
+  const out = [];
+  for (const s of mg.sessions) out.push(...s.edges);
+  out.push(...mg.crossEdges);
+  return out;
+}
+function emptyVerificationResult() {
+  return { verified: true, violations: [] };
+}
+
+// src/engine/formal-engine/ltl.ts
+var AP_RE = null;
+function compileAps(apPatterns) {
+  if (AP_RE) return;
+  AP_RE = {};
+  for (const [name, pats] of Object.entries(apPatterns || {})) {
+    AP_RE[name] = pats.map((p) => new RegExp(p, "i"));
+  }
+}
+function labelEvent(actionDetail) {
+  if (!AP_RE) compileAps(loadMC().ap_patterns || {});
+  const candidates = allCandidates(actionDetail);
+  const hits = /* @__PURE__ */ new Set();
+  for (const [name, pats] of Object.entries(AP_RE || {})) {
+    for (const c of candidates) {
+      const m = pats.some((p) => p.test(c));
+      if (m) {
+        hits.add(name);
+        break;
+      }
+    }
+  }
+  return hits;
+}
+function evaluateLTL(formula, trace, pos) {
+  const op = formula[0];
+  switch (op) {
+    case "ap":
+      return trace[pos].has(formula[1]);
+    case "!":
+      return !evaluateLTL(formula[1], trace, pos);
+    case "&":
+      return evaluateLTL(formula[1], trace, pos) && evaluateLTL(formula[2], trace, pos);
+    case "|":
+      return evaluateLTL(formula[1], trace, pos) || evaluateLTL(formula[2], trace, pos);
+    case "->":
+      return !evaluateLTL(formula[1], trace, pos) || evaluateLTL(formula[2], trace, pos);
+    case "X":
+      return pos + 1 < trace.length && evaluateLTL(formula[1], trace, pos + 1);
+    case "G": {
+      for (let j = pos; j < trace.length; j++) {
+        if (!evaluateLTL(formula[1], trace, j)) return false;
+      }
+      return true;
+    }
+    case "F": {
+      for (let j = pos; j < trace.length; j++) {
+        if (evaluateLTL(formula[1], trace, j)) return true;
+      }
+      return false;
+    }
+    case "U": {
+      for (let j = pos; j < trace.length; j++) {
+        if (evaluateLTL(formula[2], trace, j)) {
+          for (let k = pos; k < j; k++) {
+            if (!evaluateLTL(formula[1], trace, k)) return false;
+          }
+          return true;
+        }
+      }
+      return false;
+    }
+    default:
+      return false;
+  }
+}
+function ruleViolates(rule, traceWith, witnessMode) {
+  const formula = rule?.formula;
+  if (!Array.isArray(formula) || formula.length === 0) return false;
+  const satWith = evaluateLTL(formula, traceWith, 0);
+  if (!satWith) return false;
+  if (witnessMode && traceWith.length > 1) {
+    const traceWithout = traceWith.slice(0, -1);
+    if (evaluateLTL(formula, traceWithout, 0)) return false;
+  }
+  return true;
+}
+function checkMCRules(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length === 0) return violations;
+  const mc = loadMC();
+  const rules = mc.rules || [];
+  if (rules.length === 0) return violations;
+  const trace = nodes.map((n) => labelEvent(n.actionDetail));
+  const witnessMode = graph.witnessIdx !== void 0;
+  for (const rule of rules) {
+    if (rule?.type !== "ltl" || !(rule.enabled !== false)) continue;
+    if (ruleViolates(rule, trace, witnessMode)) {
+      violations.push({
+        propertyId: String(rule.id || "mc-ltl"),
+        reason: String(rule.reason || "L2.2 \u6A21\u578B\u68C0\u6D4B\u89C4\u5219\u547D\u4E2D"),
+        riskLevel: String(rule.risk_level || "high"),
+        path: nodes.filter((n) => labelEvent(n.actionDetail).size > 0).slice(-3).map((n) => ({ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }))
+      });
+      if (witnessMode) return violations;
+    }
+  }
+  return violations;
+}
+
 // src/engine/formal-engine/builder.ts
 var COMBO_STAGES2 = null;
 function loadStages() {
@@ -7057,6 +7535,26 @@ function extractResources(actionDetail) {
 function markStage(actionDetail) {
   return matchStageAny(actionDetail, loadStages());
 }
+function markIntegrity(actionDetail) {
+  const aps = labelEvent(actionDetail);
+  if (aps.has("download_file") || aps.has("prompt_injection")) {
+    return { integrity: "low", isLowSource: true };
+  }
+  return { integrity: "medium", isLowSource: false };
+}
+function initNode(sessionId, seq, actionType, actionDetail) {
+  const { integrity, isLowSource } = markIntegrity(actionDetail);
+  return {
+    sessionId,
+    seq,
+    actionType,
+    actionDetail,
+    stage: markStage(actionDetail),
+    resources: extractResources(actionDetail),
+    integrity,
+    isLowSource
+  };
+}
 function buildSessionGraph(actionHistory, aNext, sessionId = "current") {
   const nodes = [];
   const edges = [];
@@ -7070,17 +7568,9 @@ function buildSessionGraph(actionHistory, aNext, sessionId = "current") {
     details.push({ actionType: String(aNext.actionType || ""), actionDetail: String(aNext.actionDetail || "") });
   }
   details.forEach((d, seq) => {
-    const stage = markStage(d.actionDetail);
-    const node = {
-      sessionId,
-      seq,
-      actionType: d.actionType,
-      actionDetail: d.actionDetail,
-      stage,
-      resources: extractResources(d.actionDetail)
-    };
+    const node = initNode(sessionId, seq, d.actionType, d.actionDetail);
     nodes.push(node);
-    if (stage) stageFlags.add(stage);
+    if (node.stage) stageFlags.add(node.stage);
   });
   for (let i = 0; i < nodes.length - 1; i++) {
     edges.push({ src: i, dst: i + 1, kind: "next" });
@@ -7100,15 +7590,12 @@ function buildMultiSessionGraph(sessions, aNext) {
   if (aNext) {
     const last = mg.sessions[mg.sessions.length - 1];
     if (last.sessionId === "current") {
-      const stage = markStage(String(aNext.actionDetail || ""));
-      last.nodes.push({
-        sessionId: last.sessionId,
-        seq: last.nodes.length,
-        actionType: String(aNext.actionType || ""),
-        actionDetail: String(aNext.actionDetail || ""),
-        stage,
-        resources: extractResources(String(aNext.actionDetail || ""))
-      });
+      last.nodes.push(initNode(
+        last.sessionId,
+        last.nodes.length,
+        String(aNext.actionType || ""),
+        String(aNext.actionDetail || "")
+      ));
       if (last.nodes.length > 1) {
         last.edges.push({ src: last.nodes.length - 2, dst: last.nodes.length - 1, kind: "next" });
       }
@@ -7122,11 +7609,25 @@ function buildMultiSessionGraph(sessions, aNext) {
 function addCrossDataEdges(mg) {
   const nodes = allNodesFlat(mg);
   if (nodes.length < 2) return;
-  for (let i = 0; i < nodes.length; i++) {
-    for (let j = i + 1; j < nodes.length; j++) {
-      if (nodes[i].sessionId === nodes[j].sessionId) continue;
-      const shared = intersect(nodes[i].resources, nodes[j].resources);
-      if (shared.size > 0) {
+  const resIndex = /* @__PURE__ */ new Map();
+  nodes.forEach((n, i) => {
+    for (const r of n.resources) {
+      const list = resIndex.get(r);
+      if (list) list.push(i);
+      else resIndex.set(r, [i]);
+    }
+  });
+  const seen = /* @__PURE__ */ new Set();
+  for (const idxs of resIndex.values()) {
+    if (idxs.length < 2) continue;
+    for (let a = 0; a < idxs.length; a++) {
+      const i = idxs[a];
+      for (let b = a + 1; b < idxs.length; b++) {
+        const j = idxs[b];
+        if (nodes[i].sessionId === nodes[j].sessionId) continue;
+        const key = `${i}:${j}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
         mg.crossEdges.push({ src: i, dst: j, kind: "data" });
       }
     }
@@ -7137,28 +7638,6 @@ function allNodesFlat(mg) {
   for (const s of mg.sessions) out.push(...s.nodes);
   return out;
 }
-function intersect(a, b) {
-  const out = /* @__PURE__ */ new Set();
-  for (const v of a) if (b.has(v)) out.add(v);
-  return out;
-}
-
-// src/engine/formal-engine/ir.ts
-init_esm_shims();
-function allNodes(mg) {
-  const out = [];
-  for (const s of mg.sessions) out.push(...s.nodes);
-  return out;
-}
-function allEdges(mg) {
-  const out = [];
-  for (const s of mg.sessions) out.push(...s.edges);
-  out.push(...mg.crossEdges);
-  return out;
-}
-function emptyVerificationResult() {
-  return { verified: true, violations: [] };
-}
 
 // src/engine/formal-engine/properties.ts
 init_esm_shims();
@@ -7181,27 +7660,50 @@ function checkCrossSessionChain(graph) {
   const violations = [];
   const nodes = allNodes(graph);
   if (nodes.length === 0) return violations;
+  const witness = graph.witnessIdx;
   for (const chain of loadCrossSessionChains()) {
     const stages = chain.stages;
     if (!stages.length) continue;
-    let matched = 0;
-    let stageIdx = 0;
-    const path6 = [];
-    for (const n of nodes) {
-      if (stageIdx < stages.length && n.stage === stages[stageIdx]) {
-        matched += 1;
-        path6.push({ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) });
-        stageIdx += 1;
-        if (matched >= stages.length) break;
+    if (witness !== void 0) {
+      if (nodes[witness].stage !== stages[stages.length - 1]) continue;
+      let matched = 0;
+      const path6 = [];
+      for (let k = 0; k < witness; k++) {
+        const n = nodes[k];
+        if (matched < stages.length - 1 && n.stage === stages[matched]) {
+          matched += 1;
+          path6.push({ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) });
+        }
       }
-    }
-    if (matched >= stages.length) {
+      if (matched < stages.length - 1) continue;
+      path6.push({ sessionId: nodes[witness].sessionId, seq: nodes[witness].seq, detail: nodes[witness].actionDetail.slice(0, 60) });
       violations.push({
         propertyId: "cross-" + chain.id,
         reason: chain.reason,
         riskLevel: chain.riskLevel,
         path: path6
       });
+      return violations;
+    } else {
+      let matched = 0;
+      let stageIdx = 0;
+      const path6 = [];
+      for (const n of nodes) {
+        if (stageIdx < stages.length && n.stage === stages[stageIdx]) {
+          matched += 1;
+          path6.push({ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) });
+          stageIdx += 1;
+          if (matched >= stages.length) break;
+        }
+      }
+      if (matched >= stages.length) {
+        violations.push({
+          propertyId: "cross-" + chain.id,
+          reason: chain.reason,
+          riskLevel: chain.riskLevel,
+          path: path6
+        });
+      }
     }
   }
   return violations;
@@ -7236,14 +7738,18 @@ function checkSensitiveDataFlow(graph) {
       }
     }
   }
-  for (const [i, n] of nodes.entries()) {
+  const witness = graph.witnessIdx;
+  const candidates = witness !== void 0 ? [witness] : nodes.map((_, i) => i);
+  for (const i of candidates) {
+    const n = nodes[i];
     if (tainted.has(i) && EXFIL_RE.test(n.actionDetail)) {
       violations.push({
-        propertyId: "sensitive-data-exfil",
+        propertyId: "sensitive-data-flow",
         reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${tainted.get(i)} \u2192 ${n.sessionId}#${n.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
         riskLevel: "critical",
         path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
       });
+      if (witness !== void 0) return violations;
     }
   }
   return violations;
@@ -7274,12 +7780,38 @@ function checkNeverExfilAfterPrivesc(graph) {
   const violations = [];
   const nodes = allNodes(graph);
   if (nodes.length < 2) return violations;
+  const witness = graph.witnessIdx;
+  if (witness !== void 0) {
+    const evIdx = [];
+    nodes.forEach((n, i) => {
+      if ((i === witness || n.sessionId === "ebpf-evidence") && isExfilNode(n)) evIdx.push(i);
+    });
+    if (evIdx.length === 0) return violations;
+    const firstEv = Math.min(...evIdx);
+    let pre = null;
+    for (let i = 0; i < firstEv; i++) {
+      if (isPrivescNode(nodes[i])) pre = nodes[i];
+    }
+    if (pre) {
+      const post = nodes[firstEv];
+      return [{
+        propertyId: "no-exfil-after-privesc",
+        reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\xAC\u25C7EXFIL)",
+        riskLevel: "critical",
+        path: [
+          { sessionId: pre.sessionId, seq: pre.seq, detail: pre.actionDetail.slice(0, 60) },
+          { sessionId: post.sessionId, seq: post.seq, detail: post.actionDetail.slice(0, 60) }
+        ]
+      }];
+    }
+    return violations;
+  }
   for (let i = 0; i < nodes.length; i++) {
     if (!isPrivescNode(nodes[i])) continue;
     for (let j = i + 1; j < nodes.length; j++) {
       if (isExfilNode(nodes[j])) {
         violations.push({
-          propertyId: "no-privesc-then-exfil",
+          propertyId: "no-exfil-after-privesc",
           reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\xAC\u25C7EXFIL)",
           riskLevel: "critical",
           path: [
@@ -7297,12 +7829,38 @@ function checkNeverExfilAfterCred(graph) {
   const violations = [];
   const nodes = allNodes(graph);
   if (nodes.length < 2) return violations;
+  const witness = graph.witnessIdx;
+  if (witness !== void 0) {
+    const evIdx = [];
+    nodes.forEach((n, i) => {
+      if ((i === witness || n.sessionId === "ebpf-evidence") && isExfilNode(n)) evIdx.push(i);
+    });
+    if (evIdx.length === 0) return violations;
+    const firstEv = Math.min(...evIdx);
+    let pre = null;
+    for (let i = 0; i < firstEv; i++) {
+      if (isCredNode(nodes[i])) pre = nodes[i];
+    }
+    if (pre) {
+      const post = nodes[firstEv];
+      return [{
+        propertyId: "no-exfil-after-credential",
+        reason: "\u8BFB\u53D6\u51ED\u636E\u540E\u51FA\u73B0\u5916\u4F20\uFF0C\u8FDD\u53CD \u25A1(CRED\u2192\xAC\u25C7EXFIL)",
+        riskLevel: "critical",
+        path: [
+          { sessionId: pre.sessionId, seq: pre.seq, detail: pre.actionDetail.slice(0, 60) },
+          { sessionId: post.sessionId, seq: post.seq, detail: post.actionDetail.slice(0, 60) }
+        ]
+      }];
+    }
+    return violations;
+  }
   for (let i = 0; i < nodes.length; i++) {
     if (!isCredNode(nodes[i])) continue;
     for (let j = i + 1; j < nodes.length; j++) {
       if (isExfilNode(nodes[j])) {
         violations.push({
-          propertyId: "no-cred-then-exfil",
+          propertyId: "no-exfil-after-credential",
           reason: "\u8BFB\u53D6\u51ED\u636E\u540E\u51FA\u73B0\u5916\u4F20\uFF0C\u8FDD\u53CD \u25A1(CRED\u2192\xAC\u25C7EXFIL)",
           riskLevel: "critical",
           path: [
@@ -7316,11 +7874,172 @@ function checkNeverExfilAfterCred(graph) {
   }
   return violations;
 }
+var TOOL_REGISTRY = null;
+function getToolRegistry() {
+  if (TOOL_REGISTRY) return TOOL_REGISTRY;
+  TOOL_REGISTRY = loadToolRegistry().tools || {};
+  return TOOL_REGISTRY;
+}
+function lookupToolClass(actionType) {
+  const entry = getToolRegistry()[actionType] || {};
+  return entry.actionClass;
+}
+var COMPUTE_RE = /subprocess|os\.system|shell\s*=\s*True|\beval\(|\bexec\(|bash\s+[^\s]|sh\s+-c|python3?\s+|node\s+|\btimeout\s+|nohup\s+|\b\.\/[\w./-]+/i;
+var STRONG_COMPUTE_TYPES = /* @__PURE__ */ new Set(["python", "node", "exec", "terminal", "cmd"]);
+function isComputeNode(n) {
+  if (STRONG_COMPUTE_TYPES.has(n.actionType.toLowerCase())) return true;
+  const cls = lookupToolClass(n.actionType);
+  if (cls === "read" || cls === "write" || cls === "network_egress" || cls === "message_egress") return false;
+  return COMPUTE_RE.test(n.actionDetail);
+}
+function checkLowIntegrityCommandExec(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length === 0) return violations;
+  const witness = graph.witnessIdx;
+  const lowResources = /* @__PURE__ */ new Set();
+  const lowAt = /* @__PURE__ */ new Map();
+  nodes.forEach((n, i) => {
+    if (n.isLowSource) {
+      lowAt.set(i, n.actionDetail.slice(0, 60));
+      for (const r of n.resources) lowResources.add(r);
+    }
+  });
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (let i = 0; i < nodes.length; i++) {
+      if (lowAt.has(i)) continue;
+      let shared = "";
+      for (const r of nodes[i].resources) {
+        if (lowResources.has(r)) {
+          shared = r;
+          break;
+        }
+      }
+      if (shared) {
+        lowAt.set(i, `\u7EE7\u627F\u81EA ${shared}`);
+        for (const r of nodes[i].resources) lowResources.add(r);
+        changed = true;
+      }
+    }
+  }
+  if (lowAt.size === 0) return violations;
+  const candidates = witness !== void 0 ? [witness] : nodes.map((_, i) => i);
+  for (const i of candidates) {
+    const n = nodes[i];
+    if (lowAt.has(i) && isComputeNode(n)) {
+      violations.push({
+        propertyId: "low-integrity-command-exec",
+        reason: `\u4F4E\u5B8C\u6574\u6027\u6570\u636E\u63A7\u5236\u547D\u4EE4\u6267\u884C\uFF1A${lowAt.get(i)} \u2192 ${n.sessionId}#${n.seq} \u6267\u884C\u4E0D\u53EF\u4FE1\u5185\u5BB9`,
+        riskLevel: "critical",
+        path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
+      });
+      if (witness !== void 0) return violations;
+    }
+  }
+  return violations;
+}
+var DL_OR_LOW_RE = /curl\s+.*-o\b|wget\s+.*\s+-O\b|curl\s+.*\|\s*(bash|sh|python)|wget\s+.*\|\s*(bash|sh|python)|git\s+clone|docker\s+pull|pip\s+install|npm\s+install|base64\s+-d/i;
+function checkCrossSessionReachability(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length === 0) return violations;
+  const witness = graph.witnessIdx;
+  const sources = /* @__PURE__ */ new Set();
+  nodes.forEach((n, i) => {
+    if (n.isLowSource || DL_OR_LOW_RE.test(n.actionDetail)) sources.add(i);
+  });
+  if (sources.size === 0) return violations;
+  const reached = new Set(sources);
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const e of allEdges(graph)) {
+      if (reached.has(e.src) && !reached.has(e.dst)) {
+        const srcRes = nodes[e.src].resources;
+        const dstRes = nodes[e.dst].resources;
+        for (const r of srcRes) {
+          if (dstRes.has(r)) {
+            reached.add(e.dst);
+            changed = true;
+            break;
+          }
+        }
+      }
+    }
+  }
+  const candidates = witness !== void 0 ? [witness] : nodes.map((_, i) => i);
+  for (const i of candidates) {
+    const n = nodes[i];
+    if (sources.has(i)) continue;
+    if (reached.has(i)) {
+      const srcIdx = Math.min(...sources);
+      const srcDesc = nodes[srcIdx].actionDetail.slice(0, 40);
+      violations.push({
+        propertyId: "low-integrity-reachability",
+        reason: `\u4F4E\u5B8C\u6574\u6027\u6E90\u7ECF\u8DE8 session \u6570\u636E\u94FE\u591A\u8DF3\u5230\u8FBE\u5F53\u524D\u6267\u884C\uFF08\u6E90: ${srcDesc} \u2192 ${n.sessionId}#${n.seq}\uFF09`,
+        riskLevel: "high",
+        path: nodes.slice(-3).map((m) => ({ sessionId: m.sessionId, seq: m.seq, detail: m.actionDetail.slice(0, 60) }))
+      });
+      if (witness !== void 0) return violations;
+    }
+  }
+  return violations;
+}
+function checkSensitiveDataAggregation(graph) {
+  const violations = [];
+  const nodes = allNodes(graph);
+  if (nodes.length < 2) return violations;
+  const witness = graph.witnessIdx;
+  const resIndex = /* @__PURE__ */ new Map();
+  nodes.forEach((n, i) => {
+    for (const r of n.resources) {
+      const list = resIndex.get(r);
+      if (list) list.push(i);
+      else resIndex.set(r, [i]);
+    }
+  });
+  const sourcesFor = (exfilIdx) => {
+    const srcs = /* @__PURE__ */ new Set();
+    const n = nodes[exfilIdx];
+    for (const r of n.resources) {
+      for (const j of resIndex.get(r) || []) {
+        if (j === exfilIdx) continue;
+        srcs.add(`${nodes[j].sessionId}#${nodes[j].seq}`);
+      }
+    }
+    return srcs;
+  };
+  const candidates = witness !== void 0 ? [witness] : nodes.map((_, i) => i);
+  for (const i of candidates) {
+    const n = nodes[i];
+    if (!isExfilNode(n)) continue;
+    const srcs = sourcesFor(i);
+    if (srcs.size >= 2) {
+      violations.push({
+        propertyId: "sensitive-data-aggregation",
+        reason: `\u654F\u611F\u6570\u636E\u805A\u5408\u5916\u4F20\uFF1Aegress \u805A\u5408 ${srcs.size} \u4E2A\u4E8B\u4EF6\u6E90\u6570\u636E\uFF08Rule 12\uFF09`,
+        riskLevel: "critical",
+        path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
+      });
+      if (witness !== void 0) return violations;
+    }
+  }
+  return violations;
+}
 var ALL_PROPERTIES = [
-  { id: "cross-session-chain", check: checkCrossSessionChain },
-  { id: "sensitive-data-flow", check: checkSensitiveDataFlow },
-  { id: "no-privesc-then-exfil", check: checkNeverExfilAfterPrivesc },
-  { id: "no-cred-then-exfil", check: checkNeverExfilAfterCred }
+  { id: "cross-session-chain", check: checkCrossSessionChain, shortName: "P1" },
+  { id: "sensitive-data-flow", check: checkSensitiveDataFlow, shortName: "P2" },
+  { id: "low-integrity-reachability", check: checkCrossSessionReachability, shortName: "P3" },
+  { id: "no-exfil-after-privesc", check: checkNeverExfilAfterPrivesc, shortName: "P4" },
+  { id: "no-exfil-after-credential", check: checkNeverExfilAfterCred, shortName: "P5" },
+  // L2.2 模型检测（通用 LTL 求值器，mc_rules.json 单一事实源；witness 语义见 ltl.ts）
+  { id: "mc-ltl-rules", check: checkMCRules, shortName: "P6" },
+  // P7 低完整性控制命令执行（integrity 维度，站点 L2.1 最有区分度的检测之一）
+  { id: "low-integrity-command-exec", check: checkLowIntegrityCommandExec, shortName: "P7" },
+  // P8 敏感数据聚合外传（egress 聚合 ≥2 事件源）
+  { id: "sensitive-data-aggregation", check: checkSensitiveDataAggregation, shortName: "P8" }
 ];
 
 // src/engine/formal-engine/engine.ts
@@ -7352,6 +8071,9 @@ var FormalEngine = class {
       });
     }
     const graph = buildMultiSessionGraph(all, aNext);
+    if (aNext) {
+      graph.witnessIdx = allNodes(graph).length - 1;
+    }
     const result = emptyVerificationResult();
     for (const prop of this.properties) {
       let violations;
@@ -7383,7 +8105,38 @@ init_rules_loader();
 var DESTROY_RE = /\b(?:pkill|kill)\b|systemctl\s+stop|service\s+stop|crontab\s+-r|rm\s+-[rf]?\s+/i;
 var NEVER_ACTIVATED_RE = /\b(?:not\s+found|no\s+such\s+file|command\s+not\s+found|refused|failed\s+to\s+(?:start|bind|listen)|address\s+already\s+in\s+use)\b/i;
 var CRED_FILE_RE2 = /(known_hosts|\.ssh|id_rsa|\/etc\/shadow|\/etc\/passwd|credentials)/i;
-var EXFIL_RE2 = /https?:\/\/|scp\s+.*@|rsync\s+.*@/i;
+var EXFIL_RE2 = /https?:\/\/(?!127\.\d+\.\d+\.\d+|0\.0\.0\.0|localhost|\[?::1\]?)|scp\s+.*@|rsync\s+.*@/i;
+var PORT_RE = /(?:-p\s+(\d{1,5})|-p(\d{1,5})|:(\d{1,5})\b)/i;
+var BARE_PORT_RE = /(?<=^|\s)(\d{1,5})(?=\s|$)/g;
+var SOCK_RE = /([\w./-]*(?:\/tmp\/|\/var\/run\/|\.sock\b)[\w./-]*)/;
+var UNIT_RE = /systemctl\s+(?:start|enable|restart)\s+([\w.-]+)/i;
+var PORT_STAGE_RE = /LISTEN|PERSIST|SCAN/;
+function extractInstances(actionDetail, stage) {
+  const out = [];
+  if (PORT_STAGE_RE.test(stage)) {
+    const d = actionDetail;
+    let m;
+    const re = new RegExp(PORT_RE.source, "gi");
+    while ((m = re.exec(d)) !== null) {
+      const p = m[1] || m[2] || m[3];
+      if (p && Number(p) > 0 && Number(p) <= 65535) out.push(`port:${p}`);
+    }
+    if (/SCAN/.test(stage)) {
+      const bareRe = new RegExp(BARE_PORT_RE.source, "g");
+      while ((m = bareRe.exec(d)) !== null) {
+        if (m[1] && Number(m[1]) > 0 && Number(m[1]) <= 65535) out.push(`port:${m[1]}`);
+      }
+    }
+    m = SOCK_RE.exec(d);
+    if (m && m[1]) out.push(`sock:${m[1]}`);
+    m = UNIT_RE.exec(d);
+    if (m && m[1]) out.push(`unit:${m[1]}`);
+  }
+  return out;
+}
+function buckKey(chainId, inst) {
+  return inst ? `${chainId}@@${inst}` : chainId;
+}
 var STAGES_PATTERNS = null;
 var CHAINS = null;
 function loadRules() {
@@ -7426,7 +8179,11 @@ function lifecycleFor(detail, stage, isError) {
   return "";
 }
 var MAX_NODES = 1e5;
-var StatefulChainTracker = class {
+var StatefulChainTracker = class _StatefulChainTracker {
+  /** 本地接收时刻（实时路径无 called_at 时的兜底时间戳，ISO）。 */
+  static now() {
+    return (/* @__PURE__ */ new Date()).toISOString();
+  }
   agentId;
   nodes_ = [];
   ptr = {};
@@ -7448,10 +8205,14 @@ var StatefulChainTracker = class {
     for (const chain of chains) {
       const stages = chain.stages || [];
       if (stages.length === 0) continue;
-      const matched = this.ptr[String(chain.id || "")] || 0;
+      const cid = String(chain.id || "");
+      let matched = this.ptr[cid] || 0;
+      for (const [k, v] of Object.entries(this.ptr)) {
+        if (k.startsWith(`${cid}@@`) && v > matched && v < stages.length) matched = v;
+      }
       if (matched > 0 && matched < stages.length) {
         const pf = {
-          chainId: String(chain.id || ""),
+          chainId: cid,
           stages,
           matched,
           riskLevel: String(chain.riskLevel || chain.risk_level || "high"),
@@ -7527,8 +8288,10 @@ var StatefulChainTracker = class {
       actionDetail: ad,
       stage,
       resources: extractResources2(ad),
+      instances: extractInstances(ad, stage),
       isError,
-      lifecycle: lifecycleFor(ad, stage, isError)
+      lifecycle: lifecycleFor(ad, stage, isError),
+      timestamp: typeof action.calledAt === "string" ? action.calledAt : _StatefulChainTracker.now()
     };
     this.nodes_.push(node);
     this.seqNext += 1;
@@ -7536,11 +8299,19 @@ var StatefulChainTracker = class {
   }
   recordLifecycle(node) {
     if (node.lifecycle === "dead") {
-      let hit = false;
+      const clearedInsts = [];
+      for (const inst of node.instances) {
+        const key = `inst:${inst}`;
+        if (key in this.aliveResources) {
+          delete this.aliveResources[key];
+          clearedInsts.push(inst);
+        }
+      }
+      let pathHit = false;
       for (const r of node.resources) {
         if (r in this.aliveResources) {
           delete this.aliveResources[r];
-          hit = true;
+          pathHit = true;
         }
       }
       const detail = node.actionDetail;
@@ -7548,16 +8319,30 @@ var StatefulChainTracker = class {
         const base = r.split("/").pop() || "";
         if (base && detail.includes(base)) {
           delete this.aliveResources[r];
-          hit = true;
+          pathHit = true;
         }
       }
-      if (hit) this.resetChainsOnDestroy();
+      if (clearedInsts.length > 0 && !pathHit) {
+        for (const inst of clearedInsts) this.resetChainsForInstance(inst);
+      } else {
+        this.resetChainsOnDestroy();
+      }
       return;
     }
     if (node.lifecycle === "alive") {
       for (const r of node.resources) {
         this.aliveResources[r] = node.seq;
       }
+      for (const inst of node.instances) {
+        this.aliveResources[`inst:${inst}`] = node.seq;
+      }
+    }
+  }
+  /** 只重置指定实例在全部链上的进度（不影响其他端口/资源）。 */
+  resetChainsForInstance(inst) {
+    const key = buckKey("", inst).slice(2);
+    for (const k of Object.keys(this.ptr)) {
+      if (k.endsWith(`@@${inst}`)) this.ptr[k] = 0;
     }
   }
   resetChainsOnDestroy() {
@@ -7565,6 +8350,29 @@ var StatefulChainTracker = class {
       this.ptr[cid] = 0;
     }
   }
+  /**
+   * 当前节点应推进的链桶集合。
+   * - 有实例节点（LISTEN/PERSIST 带端口/socket/unit）→ 只推自己的实例桶；
+   *   同时为所有链的该实例建立桶（若首次出现）。
+   * - 无实例节点（EXEC/SCAN 等中间段）→ 推全局桶 + 所有当前活跃实例桶
+   *   （信息不足时保守推进一切可能，避免漏判）。
+   */
+  targetsForNode(node, chainId) {
+    const insts = node.instances;
+    if (insts.length > 0) {
+      const active = insts.filter((i) => this.aliveResources[`inst:${i}`] !== void 0);
+      if (active.length > 0) return active.map((i) => buckKey(chainId, i));
+      return [chainId];
+    }
+    const targets = [chainId];
+    for (const k of Object.keys(this.aliveResources)) {
+      if (k.startsWith("inst:")) {
+        const inst = k.slice("inst:".length);
+        targets.push(`${chainId}@@${inst}`);
+      }
+    }
+    return targets;
+  }
   advanceChains(node) {
     if (node.lifecycle === "dead") return null;
     if (node.lifecycle === "never_activated") {
@@ -7578,23 +8386,32 @@ var StatefulChainTracker = class {
       const stages = chain.stages || [];
       if (stages.length === 0) continue;
       const cid = String(chain.id || "");
-      const cur = this.ptr[cid] || 0;
-      if (cur < stages.length && stages[cur] === stage) {
-        this.ptr[cid] = cur + 1;
-        if (cur + 1 >= stages.length) {
-          return {
-            chainId: cid,
-            stages,
-            riskLevel: String(chain.riskLevel || chain.risk_level || "high"),
-            reason: String(chain.reason || "\u68C0\u6D4B\u5230\u7EC4\u5408\u653B\u51FB\u94FE"),
-            path: this.chainPath(stages)
-          };
+      const targets = this.targetsForNode(node, cid);
+      for (const key of targets) {
+        const cur = this.ptr[key] || 0;
+        if (cur < stages.length && stages[cur] === stage) {
+          this.ptr[key] = cur + 1;
+          if (cur + 1 >= stages.length) {
+            return {
+              chainId: cid,
+              stages,
+              riskLevel: String(chain.riskLevel || chain.risk_level || "high"),
+              reason: String(chain.reason || "\u68C0\u6D4B\u5230\u7EC4\u5408\u653B\u51FB\u94FE"),
+              path: this.chainPath(stages)
+            };
+          }
         }
       }
     }
     return null;
   }
   invalidateChainOnFailure(node) {
+    if (node.instances.length > 0) {
+      for (const inst of node.instances) {
+        this.resetChainsForInstance(inst);
+      }
+      return;
+    }
     const failed = new Set(node.resources);
     if (failed.size === 0) return;
     const { chains } = loadRules();
@@ -7610,7 +8427,7 @@ var StatefulChainTracker = class {
     let want = stages[0];
     for (const n of this.nodes_) {
       if (n.stage === want) {
-        path6.push({ sessionId: n.sessionId, seq: n.seq, stage: n.stage });
+        path6.push({ sessionId: n.sessionId, seq: n.seq, stage: n.stage, timestamp: n.timestamp });
         const idx = stages.indexOf(n.stage);
         if (idx + 1 < stages.length) {
           want = stages[idx + 1];
@@ -7646,7 +8463,7 @@ var StatefulChainTracker = class {
     if (!this.tainted.has(node.seq)) return [];
     if (EXFIL_RE2.test(node.actionDetail)) {
       return [{
-        property_id: "sensitive-data-exfil",
+        property_id: "sensitive-data-flow",
         reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${this.taintSource(node)} \u2192 ${node.sessionId}#${node.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
         risk_level: "critical",
         path: [[node.sessionId, node.seq, node.actionDetail.slice(0, 60)]]
@@ -7688,8 +8505,12 @@ var StatefulChainTracker = class {
         actionDetail: String(raw.actionDetail || ""),
         stage: String(raw.stage || ""),
         resources: [...raw.resources || []],
+        instances: [...raw.instances || []],
+        // 旧快照无此字段 → 空
         isError: Boolean(raw.isError),
-        lifecycle: String(raw.lifecycle || "")
+        lifecycle: String(raw.lifecycle || ""),
+        timestamp: typeof raw.timestamp === "string" ? raw.timestamp : null
+        // 旧快照无此字段 → null
       });
     }
     this.seqNext = Number(snapshot.seq_next || this.nodes_.length);
@@ -7892,6 +8713,7 @@ function getBrainStore() {
 }
 var formalEngine = new FormalEngine();
 async function runAnalysis(input) {
+  const observedFormalLayers = [];
   const heuristicResult = isHeuristicEnabled() ? runHeuristicCheck(input) : null;
   const isInlineScriptCmd = isInlineScriptCommand(input.aNext.actionDetail.toLowerCase());
   const isLiteralTextCmd = isLiteralTextCommand(input.aNext.actionDetail.toLowerCase());
@@ -7917,7 +8739,7 @@ async function runAnalysis(input) {
             riskType: node.l1RiskType,
             confidence: 90,
             source: "heuristic_script_scan",
-            violatedLayers: ["1.1-script"]
+            violatedLayers: ["L1.2"]
           };
         }
       }
@@ -7946,8 +8768,8 @@ async function runAnalysis(input) {
   const rawDetail = extractRawCommand(input.aNext.actionDetail);
   const lowerDetail = rawDetail.toLowerCase();
   const agentExt = mergeAgentExtensions(
-    getAgentExtensions(input.agentId),
-    getScenarioExtensions(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "")
+    isLayerEnabled("agent_rules_enabled") ? getAgentExtensions(input.agentId) : null,
+    isLayerEnabled("scenario_rules_enabled") ? getScenarioExtensionsMulti(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "") : null
   );
   if (FULLY_SAFE_TOOLS.has(actionType)) {
     return {
@@ -8035,7 +8857,7 @@ async function runAnalysis(input) {
             riskType: inlineJudgment.riskType,
             confidence: 90,
             source: "logic_rule",
-            violatedLayers: ["1.2"]
+            violatedLayers: ["L2.1"]
           };
         }
         return {
@@ -8064,15 +8886,22 @@ async function runAnalysis(input) {
     const formalResult = formalEngine.verify(formalSessions, input.aNext);
     if (!formalResult.verified) {
       const v = formalResult.violations[0];
-      return {
-        allowed: false,
-        reason: v ? v.reason : "\u5F62\u5F0F\u5316\u9A8C\u8BC1\u672A\u901A\u8FC7\uFF08\u884C\u4E3A\u6027\u8D28\u8FDD\u53CD\uFF09",
-        riskLevel: v ? v.riskLevel : "high",
-        riskType: "formal_verification",
-        confidence: 90,
-        source: "formal_engine",
-        violatedLayers: ["2.4"]
-      };
+      if (isFormalObserveMode()) {
+        console.warn(
+          `[AgentMoss] \u5F62\u5F0F\u5316\u9A8C\u8BC1 observe\uFF08\u53EA\u8BB0\u5F55\u4E0D\u62E6\u622A\uFF09: property=${v?.propertyId ?? "?"} risk=${v?.riskLevel ?? "?"} path_len=${v?.path?.length ?? 0} reason=${(v?.reason ?? "?").slice(0, 200)}`
+        );
+        observedFormalLayers.push("L2.2");
+      } else {
+        return {
+          allowed: false,
+          reason: v ? v.reason : "\u5F62\u5F0F\u5316\u9A8C\u8BC1\u672A\u901A\u8FC7\uFF08\u884C\u4E3A\u6027\u8D28\u8FDD\u53CD\uFF09",
+          riskLevel: v ? v.riskLevel : "high",
+          riskType: "formal_verification",
+          confidence: 90,
+          source: "formal_engine",
+          violatedLayers: ["L2.2"]
+        };
+      }
     }
   }
   if (scriptChain && scriptChain.nodes.length > 0 && isLogicRulesEnabled()) {
@@ -8087,7 +8916,7 @@ async function runAnalysis(input) {
           riskType: node.l2RiskType,
           confidence: 85,
           source: "logic_rule_script_scan",
-          violatedLayers: ["1.2-script"]
+          violatedLayers: ["L2.3"]
         };
       }
     }
@@ -8119,7 +8948,7 @@ async function runAnalysis(input) {
       riskType: "",
       confidence: 85,
       source: "heuristic_and_logic_only",
-      violatedLayers: []
+      violatedLayers: observedFormalLayers.length > 0 ? [...observedFormalLayers] : []
     };
   }
   let skipL3Hints = "\u65E0\uFF08\u5F53\u524D\u65E0\u7981\u7528\u89C4\u5219\u547D\u4E2D\uFF09";
@@ -8164,7 +8993,7 @@ async function runAnalysis(input) {
         riskType: "",
         confidence: 50,
         source: "llm_failure_fallback",
-        violatedLayers: []
+        violatedLayers: observedFormalLayers.length > 0 ? [...observedFormalLayers] : []
       };
     }
     return {
@@ -8174,7 +9003,7 @@ async function runAnalysis(input) {
       riskType: "",
       confidence: 60,
       source: "llm_failure_fallback",
-      violatedLayers: ["3"]
+      violatedLayers: ["L3.1"]
     };
   }
   if (!llmResult.allowed && llmResult.confidence && llmResult.confidence >= 90 && _brainExtractor) {
@@ -8191,6 +9020,9 @@ async function runAnalysis(input) {
     } catch {
     }
   }
+  if (observedFormalLayers.length > 0 && llmResult.allowed) {
+    llmResult.violatedLayers = Array.from(/* @__PURE__ */ new Set([...observedFormalLayers, ...llmResult.violatedLayers || []]));
+  }
   return llmResult;
 }
 
@@ -8540,7 +9372,7 @@ async function analyzeRoute(c) {
         const judgment = incMatchedToDeny(inc);
         if (judgment) {
           const layers = [...result.violatedLayers];
-          if (!layers.includes("2.4-stateful")) layers.push("2.4-stateful");
+          if (!layers.includes("L2.2-stateful")) layers.push("L2.2-stateful");
           console.error(
             `[AgentMoss] stateful \u589E\u91CF\u62E6\u622A: agent=${agentId || "-"} property=${judgment.property_id} risk=${judgment.risk_level}`
           );
@@ -8554,7 +9386,8 @@ async function analyzeRoute(c) {
               policy: "",
               violated_policy: "",
               confidence: 90,
-              analysis_duration_ms: Math.round((performance.now() - t0) * 10) / 10
+              analysis_duration_ms: Math.round((performance.now() - t0) * 10) / 10,
+              violation_chain: judgment.violation_chain
             })
           );
         }
@@ -8593,17 +9426,20 @@ function getChainStateStoreFor(_agentId) {
 }
 function incMatchedToDeny(inc) {
   if (inc.matched) {
+    const chain = (inc.matched.path || []).map((p) => [p.sessionId, p.seq, p.stage, p.timestamp]);
     return {
       property_id: "cross-" + inc.matched.chainId,
       reason: inc.matched.reason,
-      risk_level: inc.matched.riskLevel
+      risk_level: inc.matched.riskLevel,
+      violation_chain: chain
     };
   }
   if (inc.exfil && inc.exfil.length > 0) {
     return {
-      property_id: "sensitive-data-exfil",
+      property_id: "sensitive-data-flow",
       reason: inc.exfil[0].reason,
-      risk_level: inc.exfil[0].risk_level
+      risk_level: inc.exfil[0].risk_level,
+      violation_chain: []
     };
   }
   return null;
@@ -8682,12 +9518,13 @@ init_esm_shims();
 init_esm_shims();
 init_runtime_config();
 init_token_stats();
+init_rules_loader();
 import { Hono } from "hono";
 import { readFileSync as readFileSync15, existsSync as existsSync14 } from "fs";
-import { join as join9, dirname as dirname10 } from "path";
+import { join as join10, dirname as dirname10 } from "path";
 import { fileURLToPath as fileURLToPath9 } from "url";
 var __dirname8 = dirname10(fileURLToPath9(import.meta.url));
-var STATIC_DIR = join9(__dirname8, "static");
+var STATIC_DIR = join10(__dirname8, "static");
 var CONSOLE_TOKEN_ENV = "AGENT_MOSS_CONSOLE_TOKEN";
 function getConsoleToken() {
   return process.env[CONSOLE_TOKEN_ENV] || "";
@@ -8711,7 +9548,7 @@ function createConsoleRouter() {
   const console2 = new Hono();
   console2.use("/api/*", authMiddleware());
   const serveIndex = (c) => {
-    const indexFile = join9(STATIC_DIR, "index.html");
+    const indexFile = join10(STATIC_DIR, "index.html");
     if (existsSync14(indexFile)) {
       return c.html(readFileSync15(indexFile, "utf-8"));
     }
@@ -8728,24 +9565,89 @@ function createConsoleRouter() {
     const rc = updateLayerEnabled(body.layer_key, body.enabled);
     return c.json({ layers: rc.layers, env_overrides: getEnvOverrides() });
   });
+  function getL22View() {
+    const ltlHuman = {
+      "mc-ltl-001": "\u5148\u8BFB\u53D6\u4E86\u51ED\u636E/\u5BC6\u94A5\uFF0C\u4E4B\u540E\u51FA\u73B0\u7F51\u7EDC\u5916\u4F20",
+      "mc-ltl-002": "\u5148\u4E0B\u8F7D/\u83B7\u53D6\u4E86\u6587\u4EF6\uFF0C\u4E4B\u540E\u6267\u884C\u4E86\u6587\u4EF6",
+      "mc-ltl-003": "\u5148\u7981\u7528\u4E86\u5B89\u5168\u9632\u62A4\uFF0C\u4E4B\u540E\u51FA\u73B0\u7834\u574F\u6027\u64CD\u4F5C\uFF08\u6267\u884C/\u5220\u9664/\u63D0\u6743\uFF09",
+      "mc-ltl-004": "\u5148\u51FA\u73B0\u63D0\u793A\u8BCD\u6CE8\u5165\uFF0C\u4E4B\u540E\u51FA\u73B0\u654F\u611F\u64CD\u4F5C\uFF08\u5916\u4F20/\u5199\u6587\u4EF6/\u6267\u884C\uFF09",
+      "mc-ltl-005": "\u5148\u8BFB\u53D6\u51ED\u636E\uFF0C\u4E4B\u540E\u51FA\u73B0\u6A2A\u5411\u79FB\u52A8\uFF08ssh/scp \u5230\u8FDC\u7A0B\uFF09",
+      "mc-ltl-006": "\u5148\u63A5\u89E6\u654F\u611F\u6570\u636E\uFF0C\u4E4B\u540E\u6E05\u9664\u65E5\u5FD7",
+      "mc-ltl-007": "\u5148\u63D0\u6743\uFF0C\u4E4B\u540E\u5B89\u88C5\u6301\u4E45\u5316\u540E\u95E8",
+      "mc-ltl-008": "\u5148\u4E0B\u8F7D\u6587\u4EF6\uFF0C\u4E4B\u540E\u5B89\u88C5\u6301\u4E45\u5316\u540E\u95E8",
+      "mc-ltl-009": "\u5148\u63A5\u89E6\u654F\u611F\u6570\u636E \u2192 \u6253\u5305\u538B\u7F29 \u2192 \u7F51\u7EDC\u5916\u4F20",
+      "mc-ltl-010": "\u5B89\u88C5\u4E86\u6301\u4E45\u5316\u673A\u5236\uFF08crontab/systemd/.bashrc \u7B49\uFF09\uFF0C\u9700\u5BA1\u6279",
+      "mc-ctl-001": "\u4EFB\u4F55\u60C5\u51B5\u4E0B\u4E0D\u5141\u8BB8\u6E05\u9664\u65E5\u5FD7\uFF08\u5B89\u5168\u5E95\u7EBF\uFF09"
+    };
+    const mc = loadMC();
+    const rules = mc.rules || [];
+    return {
+      enabled_via: "L2_logic_rules",
+      description: "\u65F6\u5E8F\u4E0E\u6570\u636E\u6D41\u653B\u51FB\u68C0\u6D4B\uFF08L2.2 \u6A21\u578B\u68C0\u6D4B\uFF09",
+      ltl_rules: rules.map((r) => ({
+        id: r.id,
+        type: r.type,
+        formula: Array.isArray(r.formula) ? "<\u516C\u5F0F>" : r.formula,
+        reason: r.reason,
+        risk_level: r.risk_level,
+        action: r.action,
+        enabled: r.enabled !== false,
+        human: ltlHuman[r.id] || r.reason || ""
+      }))
+    };
+  }
+  function withL22View(rc) {
+    if (rc && rc.L2_2 && typeof rc.L2_2 === "object" && !Array.isArray(rc.L2_2)) {
+      const cat = rc.L2_2.ltl_rules;
+      const rls = cat && cat.rules || [];
+      const ltlHumanLocal = {
+        "mc-ltl-001": "\u5148\u8BFB\u53D6\u4E86\u51ED\u636E/\u5BC6\u94A5\uFF0C\u4E4B\u540E\u51FA\u73B0\u7F51\u7EDC\u5916\u4F20",
+        "mc-ltl-002": "\u5148\u4E0B\u8F7D/\u83B7\u53D6\u4E86\u6587\u4EF6\uFF0C\u4E4B\u540E\u6267\u884C\u4E86\u6587\u4EF6",
+        "mc-ltl-003": "\u5148\u7981\u7528\u4E86\u5B89\u5168\u9632\u62A4\uFF0C\u4E4B\u540E\u51FA\u73B0\u7834\u574F\u6027\u64CD\u4F5C\uFF08\u6267\u884C/\u5220\u9664/\u63D0\u6743\uFF09",
+        "mc-ltl-004": "\u5148\u51FA\u73B0\u63D0\u793A\u8BCD\u6CE8\u5165\uFF0C\u4E4B\u540E\u51FA\u73B0\u654F\u611F\u64CD\u4F5C\uFF08\u5916\u4F20/\u5199\u6587\u4EF6/\u6267\u884C\uFF09",
+        "mc-ltl-005": "\u5148\u8BFB\u53D6\u51ED\u636E\uFF0C\u4E4B\u540E\u51FA\u73B0\u6A2A\u5411\u79FB\u52A8\uFF08ssh/scp \u5230\u8FDC\u7A0B\uFF09",
+        "mc-ltl-006": "\u5148\u63A5\u89E6\u654F\u611F\u6570\u636E\uFF0C\u4E4B\u540E\u6E05\u9664\u65E5\u5FD7",
+        "mc-ltl-007": "\u5148\u63D0\u6743\uFF0C\u4E4B\u540E\u5B89\u88C5\u6301\u4E45\u5316\u540E\u95E8",
+        "mc-ltl-008": "\u5148\u4E0B\u8F7D\u6587\u4EF6\uFF0C\u4E4B\u540E\u5B89\u88C5\u6301\u4E45\u5316\u540E\u95E8",
+        "mc-ltl-009": "\u5148\u63A5\u89E6\u654F\u611F\u6570\u636E \u2192 \u6253\u5305\u538B\u7F29 \u2192 \u7F51\u7EDC\u5916\u4F20",
+        "mc-ltl-010": "\u5B89\u88C5\u4E86\u6301\u4E45\u5316\u673A\u5236\uFF08crontab/systemd/.bashrc \u7B49\uFF09\uFF0C\u9700\u5BA1\u6279",
+        "mc-ctl-001": "\u4EFB\u4F55\u60C5\u51B5\u4E0B\u4E0D\u5141\u8BB8\u6E05\u9664\u65E5\u5FD7\uFF08\u5B89\u5168\u5E95\u7EBF\uFF09"
+      };
+      rc.L2_2 = {
+        enabled_via: "L2_logic_rules",
+        description: "\u65F6\u5E8F\u4E0E\u6570\u636E\u6D41\u653B\u51FB\u68C0\u6D4B\uFF08L2.2 \u6A21\u578B\u68C0\u6D4B\uFF09",
+        ltl_rules: rls.map((r) => ({
+          id: r.id,
+          type: "ltl",
+          formula: "<\u516C\u5F0F>",
+          reason: r.reason || "",
+          risk_level: r.risk_level || "high",
+          action: r.action || "block",
+          enabled: r.enabled !== false,
+          human: ltlHumanLocal[r.id] || r.reason || ""
+        }))
+      };
+    }
+    return rc;
+  }
   console2.get("/api/rules", (c) => {
     const rc = loadRuntimeConfig();
-    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules });
+    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules, L2_2: getL22View() });
   });
   console2.put("/api/rules/enabled", async (c) => {
     const b = await c.req.json();
     const rc = updateRuleEnabled(b.layer, b.category, b.rule_id, b.enabled);
-    return c.json(rc);
+    return c.json(withL22View(rc));
   });
   console2.put("/api/rules/deny_mode", async (c) => {
     const b = await c.req.json();
     const rc = updateRuleDenyMode(b.layer, b.category, b.rule_id, b.deny_mode);
-    return c.json(rc);
+    return c.json(withL22View(rc));
   });
   console2.put("/api/rules/skip_l3", async (c) => {
     const b = await c.req.json();
     const rc = updateRuleSkipL3(b.layer, b.category, b.rule_id, b.skip_l3_on_disabled);
-    return c.json(rc);
+    return c.json(withL22View(rc));
   });
   console2.put("/api/categories/enabled", async (c) => {
     const b = await c.req.json();
@@ -8804,9 +9706,9 @@ function createConsoleRouter() {
     if (!/^[A-Za-z0-9_-]+$/.test(skillId)) {
       return c.json({ error: "invalid skill_id" }, 400);
     }
-    const skillPath = join9(dirname10(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
+    const skillPath = join10(dirname10(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
     if (!existsSync14(skillPath)) {
-      const builtinPath = join9(__dirname8, "..", "..", "agent_moss", "skills", `${skillId}.md`);
+      const builtinPath = join10(__dirname8, "..", "..", "agent_moss", "skills", `${skillId}.md`);
       if (existsSync14(builtinPath)) return c.text(readFileSync15(builtinPath, "utf-8"));
       return c.json({ error: "skill not found" }, 404);
     }
@@ -8895,7 +9797,7 @@ function createConsoleRouter() {
   });
   console2.get("/api/config", (c) => {
     const rc = loadRuntimeConfig();
-    return c.json(rc);
+    return c.json({ ...rc, L2_2: getL22View() });
   });
   console2.get("/api/env-overrides", (c) => {
     return c.json({ overrides: getEnvOverrides() });
@@ -8972,4 +9874,17 @@ export {
   findFreePort,
   startServer
 };
+//! 顺序即 fail-closed 短路优先级：verify 逐个执行，首个返回违规的性质成为
+//! first_violation，后续不再评估。调整顺序影响判定归属，须与 Python
+//! properties.py ALL_PROPERTIES 保持一致并双端测试确认。
+//!
+//! shortName（P1~P8 连续短名）与 id（语义化英文）对照（与 Python 一致）：
+//!   P1 cross-session-chain          跨会话组合链
+//!   P2 sensitive-data-flow          敏感数据传播
+//!   P3 low-integrity-reachability   低完整性数据流可达
+//!   P4 no-exfil-after-privesc       提权后禁外传
+//!   P5 no-exfil-after-credential    凭据后禁外传
+//!   P6 mc-ltl-rules                 LTL 模型检测
+//!   P7 low-integrity-command-exec   低完整性命令执行
+//!   P8 sensitive-data-aggregation   敏感数据聚合外传
 //# sourceMappingURL=server.js.map