@kenhkl/agent-moss 0.13.0 → 0.15.0

package/dist/cli.js

@@ -633,10 +633,15 @@ function loadMC() {
   try {
     const rt = (init_runtime_config(), __toCommonJS(runtime_config_exports));
     if (rules.length > 0 && typeof rt.hasRuntimeConfig === "function" && rt.hasRuntimeConfig()) {
-      const rtRules = rt.loadRuntimeConfig()?.L2_4?.ltl_rules?.rules || [];
+      const ltl = rt.loadRuntimeConfig()?.L2_2?.ltl_rules || {};
+      const rtRules = ltl.rules || [];
       const enabledById = {};
       for (const r of rtRules) if (r?.id) enabledById[r.id] = r.enabled !== false;
-      for (const r of rules) if (r?.id && r.id in enabledById) r.enabled = enabledById[r.id];
+      const catEnabled = ltl.category_enabled !== false;
+      for (const r of rules) {
+        if (r?.id && r.id in enabledById) r.enabled = enabledById[r.id];
+        if (!catEnabled) r.enabled = false;
+      }
     }
   } catch {
   }
@@ -681,7 +686,8 @@ function _loadSensitivePathScope(scope) {
     path: sp.path,
     riskLevel: sp.risk_level,
     desc: sp.desc,
-    credential: sp.deny_mode === "deny_both" ? true : void 0
+    credential: sp.deny_mode === "deny_both" ? true : void 0,
+    dirDelOnly: sp.dir_del_only === true ? true : void 0
   }));
 }
 function isWriteOperation(actionType, actionDetail, writeKeywords = WRITE_KEYWORDS) {
@@ -779,7 +785,7 @@ function runLogicCheck(input) {
             riskType: "intent_deviation",
             confidence: 85,
             source: "logic_rule",
-            violatedLayers: ["2"]
+            violatedLayers: ["L2.1"]
           };
         }
       }
@@ -803,7 +809,7 @@ function runLogicCheck(input) {
           riskType: "privilege_escalation",
           confidence: 85,
           source: "logic_rule",
-          violatedLayers: ["2"]
+          violatedLayers: ["L2.1"]
         };
       }
     }
@@ -855,7 +861,7 @@ function checkComboChain(actionHistory, actionDetailRaw) {
         riskType: "combo_chain",
         confidence: 85,
         source: "logic_rule",
-        violatedLayers: ["2"]
+        violatedLayers: ["L2.1"]
       };
     }
   }
@@ -980,7 +986,7 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
       riskType: "read_before_write",
       confidence: 85,
       source: "logic_rule",
-      violatedLayers: ["2"]
+      violatedLayers: ["L2.1"]
     };
   }
   return null;
@@ -1000,7 +1006,7 @@ function checkPasswordConsent(actionType, actionDetail, actionHistory) {
     riskType: "consent_missing",
     confidence: 85,
     source: "logic_rule",
-    violatedLayers: ["2"]
+    violatedLayers: ["L2.1"]
   };
 }
 function checkUserDeletionConsent(actionType, actionDetail, actionHistory) {
@@ -1018,7 +1024,7 @@ function checkUserDeletionConsent(actionType, actionDetail, actionHistory) {
     riskType: "consent_missing",
     confidence: 85,
     source: "logic_rule",
-    violatedLayers: ["2"]
+    violatedLayers: ["L2.1"]
   };
 }
 function containsPrivilegeEscalation(actionDetail) {
@@ -1078,7 +1084,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
           riskType: "file_access",
           confidence: 95,
           source: "logic_rule",
-          violatedLayers: ["2"],
+          violatedLayers: ["L2.1"],
           isCredential: true
         };
       }
@@ -1094,7 +1100,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
             riskType: "file_access",
             confidence: 95,
             source: "logic_rule",
-            violatedLayers: ["2"]
+            violatedLayers: ["L2.1"]
           };
         }
       }
@@ -1108,7 +1114,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
     riskType: "file_access",
     confidence: 70,
     source: "logic_rule",
-    violatedLayers: ["2"]
+    violatedLayers: ["L2.1"]
   };
 }
 var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, WRITE_KEYWORDS, WRITE_COMMAND_RES, READ_ONLY_COMMANDS, DEVNULL_REDIRECT_RE, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
@@ -1120,7 +1126,7 @@ var init_logic_rules = __esm({
     init_rules_loader();
     ROOT_SENSITIVE_PATHS = _loadSensitivePathScope("root");
     HOME_SENSITIVE_PATHS = _loadSensitivePathScope("home");
-    CREDENTIAL_PATHS = _loadSensitivePathScope("credential").map(({ path: path6, riskLevel, desc }) => ({ path: path6, riskLevel, desc, credential: true }));
+    CREDENTIAL_PATHS = _loadSensitivePathScope("credential").map(({ path: path6, riskLevel, desc, dirDelOnly }) => ({ path: path6, riskLevel, desc, credential: true, dirDelOnly }));
     NON_WRITE_TOOLS = /* @__PURE__ */ new Set([
       "ask_user_question",
       "glob",
@@ -1433,6 +1439,7 @@ __export(runtime_config_exports, {
   isLayerEnabled: () => isLayerEnabled,
   loadRuntimeConfig: () => loadRuntimeConfig,
   mergeConfig: () => mergeConfig,
+  pickDeletableRule: () => pickDeletableRule,
   saveRuntimeConfig: () => saveRuntimeConfig,
   updateAgentCategoryEnabled: () => updateAgentCategoryEnabled,
   updateAgentRuleEnabled: () => updateAgentRuleEnabled,
@@ -1471,7 +1478,7 @@ function emptyRuntimeConfig() {
     L1_rules: {},
     L2_rules: {},
     L3_skills: {},
-    L2_4: {},
+    L2_2: {},
     agent_rules: {},
     scenario_rules: {}
   };
@@ -1499,7 +1506,7 @@ function loadRuntimeConfig() {
       L1_rules: merged.L1_rules || {},
       L2_rules: merged.L2_rules || {},
       L3_skills: merged.L3_skills || {},
-      L2_4: merged.L2_4 || {},
+      L2_2: merged.L2_2 || {},
       agent_rules: merged.agent_rules || {},
       scenario_rules: merged.scenario_rules || {}
     };
@@ -1552,6 +1559,7 @@ function getEnabledL2SensitivePaths(runtime) {
     const out = { path: r.path || "", risk_level: r.risk_level || "", desc: r.desc || "", deny_mode: r.deny_mode || "deny_write" };
     if (r.credential) out.credential = true;
     if (r.read_only) out.read_only = true;
+    if (r.dir_del_only) out.dir_del_only = true;
     return out;
   });
 }
@@ -1597,8 +1605,16 @@ function getDisabledL2RulesWithSkipL3() {
 function _slugify(text) {
   return text.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_|_$/g, "") || "x";
 }
+function _fnv1a32(text) {
+  let h = 2166136261;
+  for (const b of Buffer.from(text, "utf-8")) {
+    h ^= b;
+    h = h * 16777619 >>> 0;
+  }
+  return h.toString(16).padStart(8, "0");
+}
 function _generatePatternId(pattern) {
-  return `pat_${_slugify(pattern)}`;
+  return `pat_${_slugify(pattern)}_${_fnv1a32(pattern)}`;
 }
 function _deriveDenyMode(rule) {
   if (rule.deny_mode) return rule.deny_mode;
@@ -1660,6 +1676,7 @@ function _l2SensitivePathsToRules() {
       builtin: true
     };
     _syncDenyModeFields(rule);
+    if (sp.dirDelOnly) rule.dir_del_only = true;
     return rule;
   });
 }
@@ -1876,17 +1893,20 @@ function generateSourceDefaults() {
       user_custom: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49 L2 \u903B\u8F91\u89C4\u5219", rules: [] }
     },
     L3_skills: _l3SkillsToRules(),
-    L2_4: _ltlRulesToRuntime(),
+    L2_2: _ltlRulesToRuntime(),
     agent_rules: _agentRulesToDefaults(),
     scenario_rules: _scenarioRulesToDefaults()
   };
 }
 function _ltlRulesToRuntime() {
   const cands = [
-    join3(__dirname4, "..", "rules"),
-    join3(__dirname4, "..", "..", "..", "agent_moss", "rules"),
-    join3(process.cwd(), "agent_moss", "rules")
-  ];
+    getRuntimeConfigDir() && join3(getRuntimeConfigDir(), "rules"),
+    join3(__dirname4, "../rules"),
+    join3(__dirname4, "rules"),
+    join3(__dirname4, "../../../agent_moss/rules"),
+    join3(__dirname4, "../../../../agent_moss/rules"),
+    join3(process.cwd(), "agent_moss/rules")
+  ].filter(Boolean);
   let mc = {};
   for (const dir of cands) {
     const p = join3(dir, "mc_rules.json");
@@ -2064,7 +2084,11 @@ function mergeConfig(userCfg, srcDefaults) {
   );
   _mergeRuleCategories(cfg, srcDefaults, "L1_rules");
   _mergeRuleCategories(cfg, srcDefaults, "L2_rules");
-  _mergeRuleCategories(cfg, srcDefaults, "L2_4");
+  if (!cfg.L2_2 && cfg.L2_4) {
+    cfg.L2_2 = cfg.L2_4;
+    delete cfg.L2_4;
+  }
+  _mergeRuleCategories(cfg, srcDefaults, "L2_2");
   _mergeSkillCategories(cfg, srcDefaults, "L3_skills");
   _mergeAgentRules(cfg, srcDefaults);
   _mergeAgentRules(cfg, srcDefaults, "scenario_rules");
@@ -2242,16 +2266,20 @@ function addCustomRule(layer, category, rule) {
   saveRuntimeConfig(runtime);
   return runtime;
 }
-function deleteCustomRule(layer, category, ruleId) {
-  const runtime = loadRuntimeConfig();
-  const rules = runtime[layer]?.[category]?.rules || [];
-  const idx = rules.findIndex((r) => r.id === ruleId);
+function pickDeletableRule(rules, ruleId) {
+  const idx = rules.findIndex((r) => r.id === ruleId && (!r.builtin || r.source_removed));
   if (idx >= 0) {
-    const r = rules[idx];
-    if (r.builtin && !r.source_removed) return null;
     rules.splice(idx, 1);
-    saveRuntimeConfig(runtime);
+    return rules;
   }
+  if (rules.some((r) => r.id === ruleId)) return null;
+  return rules;
+}
+function deleteCustomRule(layer, category, ruleId) {
+  const runtime = loadRuntimeConfig();
+  const rules = runtime[layer]?.[category]?.rules || [];
+  if (pickDeletableRule(rules, ruleId) === null) return null;
+  saveRuntimeConfig(runtime);
   return runtime;
 }
 function addCustomSkill(skillId, category, keywords, content) {
@@ -2684,7 +2712,7 @@ function runHeuristicCheck(input) {
             riskType: "sensitive_action",
             confidence: 90,
             source: "heuristic",
-            violatedLayers: ["1.1"]
+            violatedLayers: ["L1.1"]
           };
         }
       }
@@ -2694,8 +2722,10 @@ function runHeuristicCheck(input) {
   const scanDetail = normalizePathSegments(stripLiteralTextSegments(input.aNext.actionDetail));
   const scanCommand = `${input.aNext.actionType}: ${scanDetail}`;
   let topRiskType = "";
+  const exemptKeygen = isSshKeygenGenerate(input.aNext.actionDetail);
   for (const rule of DANGEROUS_PATTERNS) {
     if (rule.pattern.test(scanCommand)) {
+      if (exemptKeygen && rule.riskType === "file_access") continue;
       matched.push(rule.description);
       if (severityRank(rule.severity) > severityRank(highestSeverity)) {
         highestSeverity = rule.severity;
@@ -2737,10 +2767,26 @@ function runHeuristicCheck(input) {
   const detailL = input.aNext.actionDetail.toLowerCase();
   const isExcludedType = SENSITIVE_EXCLUDED_PREFIXES.some((p) => actionTypeL.startsWith(p));
   const dangerousResult = checkDangerousPatterns(actionTypeL, detailL);
-  if (dangerousResult) return dangerousResult;
-  if (!isExcludedType) {
-    const pathResult = checkSensitivePath(detailL, input.cwd || "/", agentExt);
-    if (pathResult) return pathResult;
+  const pathResult = isExcludedType ? null : checkSensitivePath(detailL, input.cwd || "/", agentExt);
+  const homeResult = checkHomeDeletion(actionTypeL, detailL);
+  const mergeResults = [dangerousResult, pathResult, homeResult].filter(Boolean);
+  if (mergeResults.length > 0) {
+    let best = mergeResults[0];
+    for (const r of mergeResults) {
+      if (severityRank(r.riskLevel) > severityRank(best.riskLevel)) best = r;
+    }
+    if (severityRank(highestSeverity) > severityRank(best.riskLevel)) {
+      return {
+        allowed: false,
+        reason: `\u68C0\u6D4B\u5230\u9AD8\u5371\u64CD\u4F5C: ${matched.join(", ")}`,
+        riskLevel: highestSeverity,
+        riskType: highestRiskType,
+        confidence: 95,
+        source: "heuristic",
+        violatedLayers: ["L1.1"]
+      };
+    }
+    return best;
   }
   if (matched.length > 0) {
     return {
@@ -2750,8 +2796,7 @@ function runHeuristicCheck(input) {
       riskType: highestRiskType,
       confidence: 95,
       source: "heuristic",
-      violatedLayers: ["1.1"]
-      // 对齐 py coordinator.py:165（L1.1 = 命中高危命令模式/注入关键词）
+      violatedLayers: ["L1.1"]
     };
   }
   const lateralResult = checkLateralMovement(detailL);
@@ -2879,6 +2924,7 @@ function isSearchActionType(actionType) {
 function checkSensitivePath(command, cwd, agentExt) {
   const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
   const isWriteOpFlag = isWriteOperation("", command);
+  const keygenGenerate = isSshKeygenGenerate(command);
   const pathScanText = normalizePathSegments(stripLiteralTextSegments(command));
   const pathMatches = (text, path6) => {
     const parts = path6.split(/(\(\?!.*?\))/);
@@ -2891,6 +2937,7 @@ function checkSensitivePath(command, cwd, agentExt) {
   };
   for (const sp of ROOT_SENSITIVE_PATHS) {
     if (pathMatches(pathScanText, sp.path.toLowerCase())) {
+      if (keygenGenerate) continue;
       if (sp.path === "/dev/random") {
         if (isWriteOpFlag) {
           continue;
@@ -2902,7 +2949,7 @@ function checkSensitivePath(command, cwd, agentExt) {
           riskType: "file_access",
           confidence: 90,
           source: "heuristic",
-          violatedLayers: ["1.1"]
+          violatedLayers: ["L1.1"]
         };
       }
       if (!isWriteOpFlag && !sp.credential) {
@@ -2915,16 +2962,51 @@ function checkSensitivePath(command, cwd, agentExt) {
         riskType: "file_access",
         confidence: 90,
         source: "heuristic",
-        violatedLayers: ["1.1"],
+        violatedLayers: ["L1.1"],
         isCredential: !!sp.credential
       };
     }
   }
   for (const sp of HOME_SENSITIVE_PATHS) {
     const expanded = `${expandedCwd}/${sp.path}`;
-    const pathRe = sp.path.endsWith(".pub") ? new RegExp(sp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i") : new RegExp(sp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "(?!\\.pub)", "i");
-    const expandedRe = sp.path.endsWith(".pub") ? new RegExp(expanded.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i") : new RegExp(expanded.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "(?!\\.pub)", "i");
-    if (pathRe.test(pathScanText) || expandedRe.test(pathScanText)) {
+    let pPath = sp.path;
+    if (!sp.path.endsWith(".pub")) pPath = `${sp.path}(?!\\.pub)`;
+    let dirPrefixMatch = null;
+    if (sp.dirDelOnly) {
+      const dirRe = (t) => new RegExp(`(?:^|[\\s/\\\\'"])${t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:/|[\\s'"\\\\]|$)`, "i");
+      dirPrefixMatch = dirRe(sp.path).test(pathScanText) || dirRe(expanded.toLowerCase()).test(pathScanText);
+    }
+    const pathReMatch = sp.dirDelOnly ? !!dirPrefixMatch : pathMatches(pathScanText, pPath);
+    const expandedReMatch = sp.dirDelOnly ? false : pathMatches(pathScanText, expanded + (sp.path.endsWith(".pub") ? "" : "(?!\\.pub)"));
+    if (pathReMatch || expandedReMatch) {
+      if (keygenGenerate) continue;
+      if (sp.dirDelOnly) {
+        if (isDeleteActionForDir(command, sp.path)) {
+          return {
+            allowed: false,
+            reason: `\u5220\u9664\u654F\u611F\u76EE\u5F55: ${sp.desc} (${sp.path})`,
+            riskLevel: sp.riskLevel,
+            riskType: "file_access",
+            confidence: 90,
+            source: "heuristic",
+            violatedLayers: ["L1.1"],
+            isCredential: !!sp.credential
+          };
+        }
+        if (isArchiveReadOfDir(command, sp.path)) {
+          return {
+            allowed: false,
+            reason: `\u5F52\u6863/\u590D\u5236\u8BFB\u53D6\u654F\u611F\u76EE\u5F55: ${sp.desc} (${sp.path})`,
+            riskLevel: sp.riskLevel,
+            riskType: "file_access",
+            confidence: 90,
+            source: "heuristic",
+            violatedLayers: ["L1.1"],
+            isCredential: !!sp.credential
+          };
+        }
+        continue;
+      }
       if (!isWriteOpFlag && !sp.credential) {
         continue;
       }
@@ -2935,7 +3017,7 @@ function checkSensitivePath(command, cwd, agentExt) {
         riskType: "file_access",
         confidence: 90,
         source: "heuristic",
-        violatedLayers: ["1.1"],
+        violatedLayers: ["L1.1"],
         isCredential: !!sp.credential
       };
     }
@@ -2958,7 +3040,7 @@ function checkSensitivePath(command, cwd, agentExt) {
           riskType: "file_access",
           confidence: 90,
           source: "heuristic",
-          violatedLayers: ["1.1"],
+          violatedLayers: ["L1.1"],
           isCredential: !!sp.credential
         };
       }
@@ -2975,7 +3057,7 @@ function checkSensitivePath(command, cwd, agentExt) {
         riskType: "file_access",
         confidence: 90,
         source: "heuristic",
-        violatedLayers: ["1.1"],
+        violatedLayers: ["L1.1"],
         isCredential: true
       };
     }
@@ -2988,18 +3070,142 @@ function checkSensitivePath(command, cwd, agentExt) {
       riskType: "file_access",
       confidence: 90,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
   return null;
 }
+function isHomeValue(path6) {
+  let p = path6.trim().toLowerCase();
+  if (p.startsWith("$(") && p.endsWith(")")) {
+    const inner = p.slice(2, -1).trim();
+    return HOME_TARGET_RE.test(" " + inner);
+  }
+  if (/^\/home\/[^/\s]+\/?$/.test(p)) return true;
+  return HOME_TARGET_RE.test(" " + p);
+}
+function isDeleteCommand(seg) {
+  const s = seg.trimStart();
+  if (/^(?:rm|rmdir|unlink)\b/i.test(s)) return true;
+  return /删除|移除/.test(s);
+}
+function homeEscapeTarget(seg) {
+  const low = seg.toLowerCase();
+  const re = /(?:~|(?:\$home|\$\{home\})|\/home\/[a-z0-9_.-]+)/g;
+  let m;
+  while ((m = re.exec(low)) !== null) {
+    const endIdx = m.index + m[0].length;
+    const tail = low.slice(endIdx);
+    if (!tail) continue;
+    let token = tail.trimStart().split(/\s+/)[0] || "";
+    token = token.split("&&")[0].split("||")[0].split(";")[0].replace(/\/+$/, "");
+    token = token.replace(/^['"]|['"]$/g, "");
+    const segments = token.split("/").filter((s) => s && s !== ".");
+    if (!segments.some((s) => s === "..")) continue;
+    let depth = 0;
+    let minDepth = 0;
+    for (const s of segments) {
+      depth += s === ".." ? -1 : 1;
+      minDepth = Math.min(minDepth, depth);
+    }
+    if (minDepth < 0) return true;
+    if (depth <= 0) return true;
+  }
+  return false;
+}
+function checkHomeDeletion(actionType, actionDetail) {
+  if (actionType !== "bash" && actionType !== "executebash" && actionType !== "terminal-executebash") return null;
+  const segs = actionDetail.split(/&&|\|\||;|\n/).map((s) => s.trim()).filter(Boolean);
+  for (const seg of segs) {
+    if (!isDeleteCommand(seg)) continue;
+    if (HOME_TARGET_RE.test(seg) || homeEscapeTarget(seg)) {
+      return {
+        allowed: false,
+        reason: "\u68C0\u6D4B\u5230\u5220\u9664\u4E3B\u76EE\u5F55 (~/$HOME) \u64CD\u4F5C",
+        riskLevel: "high",
+        riskType: "script_execution",
+        confidence: 90,
+        source: "heuristic",
+        violatedLayers: ["L1.1"]
+      };
+    }
+  }
+  const assigned = {};
+  for (const m of actionDetail.matchAll(HOME_ASSIGN_RE)) assigned[m[1]] = m[2];
+  for (const [varName, path6] of Object.entries(assigned)) {
+    if (!isHomeValue(path6)) continue;
+    const varRefRe = new RegExp(`(?:${escapeRegExp(varName)}|\\$\\{${escapeRegExp(varName)}\\})`);
+    for (const seg of segs) {
+      if (!isDeleteCommand(seg)) continue;
+      if (varRefRe.test(seg)) {
+        return {
+          allowed: false,
+          reason: `\u68C0\u6D4B\u5230\u901A\u8FC7\u53D8\u91CF ${varName}\uFF08=${path6}\uFF0C\u4E3B\u76EE\u5F55\uFF09\u6267\u884C\u5220\u9664`,
+          riskLevel: "high",
+          riskType: "script_execution",
+          confidence: 90,
+          source: "heuristic",
+          violatedLayers: ["L1.1"]
+        };
+      }
+    }
+  }
+  return null;
+}
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function isDeleteActionForDir(command, dirPath) {
+  const low = command.toLowerCase();
+  const dpath = dirPath.toLowerCase();
+  if (new RegExp(`\\b(?:rm|unlink|rmdir)\\b[^&|;]*?${escapeRegExp(dpath)}`, "i").test(low)) {
+    return true;
+  }
+  if (new RegExp(`(?:\u5220\u9664|\u79FB\u9664)[^\\n;|&]*?${escapeRegExp(dpath)}`).test(low)) {
+    return true;
+  }
+  for (const seg of low.split(/&&|\|\||;|\n/)) {
+    const fw = (seg.trim().split(/\s+/)[0] || "").toLowerCase();
+    if ((fw === "rm" || fw === "unlink" || fw === "rmdir") && low.includes(dpath)) {
+      return true;
+    }
+  }
+  return false;
+}
+function isArchiveReadOfDir(command, dirPath) {
+  const low = command.toLowerCase();
+  const dpath = dirPath.toLowerCase();
+  for (const seg of low.split(/&&|\|\||;|\n/)) {
+    const s = seg.trim();
+    if (!s || !s.includes(dpath)) continue;
+    const parts = s.split(/\s+/);
+    const fw = parts[0] || "";
+    if (fw === "zip") return true;
+    if (fw === "tar") {
+      if (/(?:^|\s)-[a-zA-Z]*x|--extract/.test(s)) continue;
+      return true;
+    }
+    if (fw === "cp" || fw === "rsync") {
+      const segPaths = s.match(/[/~][^\s;|&><'"]*/g) || [];
+      if (segPaths.length && segPaths[0].includes(dpath)) return true;
+    }
+  }
+  return false;
+}
+function isSshKeygenGenerate(command) {
+  const low = command.toLowerCase();
+  if (!low.includes("ssh-keygen")) return false;
+  if (!/(?:^|\s)-t\s+\S+/.test(low)) return false;
+  if (/(?:^|\s)-\S*[ylpB]\S*/.test(low)) return false;
+  return true;
+}
 function checkDangerousPatterns(actionType, actionDetail) {
   if (actionType === "file_write" || actionType === "file_edit") return null;
   const scan = stripHeredocContent(actionDetail);
   const TEMP_DIRS = ["/tmp", "/var/tmp", "/run", "/dev/shm"];
   const isTempPath = TEMP_DIRS.some(
     (td) => new RegExp(`(?:^|[\\s/])${td.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[\\s/]|$)`).test(actionDetail)
-  );
+  ) || /(?:^|[\s;]|&&\s*|\|\|\s*)var\/tmp(?:[/\s;]|$)/.test(actionDetail);
   const wildcardDeleteRe = /(?:\brm\b|\b(r?mdir|del|delete|remove|rmdir|unlink)\b|\b删除\b|\b移除\b)[\s\S]{0,40}?[*?]|[*?][\s\S]{0,40}?\b(?:rm|del|delete|remove|rmdir|unlink)\b|rm\s+-[a-zA-Z]*[rf][a-zA-Z]*\s+\S*[*?]/i;
   if (!isTempPath && wildcardDeleteRe.test(scan)) {
     return {
@@ -3009,7 +3215,7 @@ function checkDangerousPatterns(actionType, actionDetail) {
       riskType: "script_execution",
       confidence: 90,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
   const findWriteMatch = actionDetail.match(
@@ -3024,10 +3230,10 @@ function checkDangerousPatterns(actionType, actionDetail) {
       riskType: "script_execution",
       confidence: 90,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
-  if (/>\s*\/etc\//.test(actionDetail) || />\s*\/boot\//.test(actionDetail)) {
+  if (/>\s*['"]?\/etc\//.test(actionDetail) || />\s*['"]?\/boot\//.test(actionDetail) || />\s*['"]?\/proc\//.test(actionDetail)) {
     return {
       allowed: false,
       reason: "\u68C0\u6D4B\u5230\u91CD\u5B9A\u5411\u8986\u76D6\u5199\u5165\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55",
@@ -3035,7 +3241,7 @@ function checkDangerousPatterns(actionType, actionDetail) {
       riskType: "file_access",
       confidence: 95,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
   if (/>\s*\/dev\/(sd|hd|nvme|vd|loop|mem|kmsg|port|zero|random|urandom|full|core)/i.test(actionDetail)) {
@@ -3046,7 +3252,7 @@ function checkDangerousPatterns(actionType, actionDetail) {
       riskType: "file_access",
       confidence: 90,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
   return null;
@@ -3137,13 +3343,13 @@ function checkLateralMovement(actionDetail) {
         riskType: "lateral_movement",
         confidence: 80,
         source: "heuristic",
-        violatedLayers: ["1.1"]
+        violatedLayers: ["L1.1"]
       };
     }
   }
   return null;
 }
-var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES;
+var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES, HOME_TARGET_RE, HOME_ASSIGN_RE;
 var init_heuristic = __esm({
   "src/engine/heuristic.ts"() {
     "use strict";
@@ -3173,6 +3379,8 @@ var init_heuristic = __esm({
     })();
     SENSITIVE_EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
     SEARCH_ACTION_PREFIXES = ["search-", "web-", "browser-", "query-", "websearch", "web_search"];
+    HOME_TARGET_RE = /(?:^|[\s="'($])(?:~|(?:\$home|\$\{home\}))(?:\/(?:\.\*|\*|\.)?)?(?=[\s"';}|&)]|$)/i;
+    HOME_ASSIGN_RE = /([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(~[A-Za-z0-9_./-]*|\$HOME[A-Za-z0-9_./-]*|\$\{HOME\}[A-Za-z0-9_./-]*|\/home\/[^\s;|&]+|\$\((?:[^()]|\([^()]*\))*\))(?=\s|;|$|\||&)/gi;
   }
 });
 
@@ -4967,6 +5175,13 @@ function extractScriptPath2(command) {
   return null;
 }
 function extractScriptPathWithArgs(command) {
+  const inline = command.match(/(?:^|\s|&&|\|\|)\s*(?:bash|\/bin\/bash|sh|zsh)\s+-c\s*(['"])([\s\S]*?)\1/i);
+  if (inline) {
+    const inner = inline[2];
+    const realPath = extractScriptPath2(inner);
+    if (realPath) return { path: realPath, args: [] };
+    return { path: null, args: [] };
+  }
   const scriptPath = extractScriptPath2(command);
   if (!scriptPath) return { path: null, args: [] };
   const idx = command.indexOf(scriptPath);
@@ -4980,11 +5195,59 @@ function extractScriptPathWithArgs(command) {
   }
   return { path: scriptPath, args };
 }
+function looksLikeScriptPath(tok) {
+  const t = tok.trim().replace(/^['"]|['"]$/g, "");
+  if (!t) return false;
+  const low = t.toLowerCase();
+  if (["bash", "sh", "zsh", "dash", "python", "python3", "perl", "ruby", "node", "php", "lua"].includes(low)) return false;
+  if (/\.(sh|bash|py|pl|rb|js|php|lua)$/.test(low)) return true;
+  if (t.includes("/") && !t.startsWith("-")) return true;
+  return false;
+}
 function extractInlineScriptPath(actionDetail) {
+  const code = extractInlineCode(actionDetail);
+  if (code) {
+    const candidates = [];
+    const osRe = /os\.(?:system|popen)\s*\(\s*(['"])(.*?)\1\s*\)/gi;
+    let m;
+    while ((m = osRe.exec(code)) !== null) candidates.push(m[2]);
+    const subListRe = /subprocess\.(?:run|call|Popen|check_output|check_call)\s*\(\s*\[(.*?)\]/gi;
+    while ((m = subListRe.exec(code)) !== null) candidates.push(m[1]);
+    const subShellRe = /subprocess\.(?:run|call|Popen|check_output|check_call)\s*\(\s*(['"])(.*?)\1[^)]*?shell\s*=\s*true/gi;
+    while ((m = subShellRe.exec(code)) !== null) candidates.push(m[2]);
+    for (const cand of candidates) {
+      const tokens = cand.includes(",") ? cand.split(/\s*,\s*/).map((t) => t.trim().replace(/^['"]|['"]$/g, "")) : cand.split(/\s+/);
+      for (const tok of tokens) {
+        if (looksLikeScriptPath(tok)) {
+          try {
+            const resolved = resolvePath2(tok.replace(/^['"]|['"]$/g, ""));
+            if (existsSync9(resolved)) {
+              const stat = statSync2(resolved);
+              if (stat.isFile()) return resolved;
+            }
+          } catch {
+          }
+        }
+      }
+    }
+    const openRe = /open\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+    while ((m = openRe.exec(code)) !== null) {
+      const p = m[1];
+      try {
+        const resolved = resolvePath2(p);
+        if (existsSync9(resolved)) {
+          const stat = statSync2(resolved);
+          if (stat.isFile()) return resolved;
+        }
+      } catch {
+      }
+    }
+    return null;
+  }
   const re = /open\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
-  let m;
-  while ((m = re.exec(actionDetail)) !== null) {
-    const p = m[1];
+  let m2;
+  while ((m2 = re.exec(actionDetail)) !== null) {
+    const p = m2[1];
     let resolved;
     try {
       resolved = resolvePath2(p);
@@ -5170,6 +5433,7 @@ var init_script_content_analyzer = __esm({
     init_esm_shims();
     init_heuristic();
     init_logic_rules();
+    init_inline_analyzer();
     init_tracker();
     SUSPICIOUS_PATTERNS2 = [
       { name: "curl POST", pattern: /curl\s+(.*\s)?-X\s+POST/i },
@@ -5634,7 +5898,7 @@ async function analyzeWithLLM(prompt, config) {
         riskType: riskType || "",
         confidence: typeof parsed.confidence === "number" ? Math.min(100, Math.max(0, parsed.confidence)) : 70,
         source: "llm",
-        violatedLayers: ["3"]
+        violatedLayers: ["L3.1"]
       };
     } catch (err) {
       if (abortController.signal.aborted) {
@@ -6220,13 +6484,6 @@ var init_brain = __esm({
 });
 
 // src/engine/formal-engine/decode.ts
-var decode_exports = {};
-__export(decode_exports, {
-  allCandidates: () => allCandidates,
-  decodeBase64Literals: () => decodeBase64Literals,
-  decodeUrlAndNumeric: () => decodeUrlAndNumeric,
-  matchStageAny: () => matchStageAny
-});
 function isValidBase64Token(tok) {
   if (tok.length < 8) return false;
   if (!(tok.length % 4 === 0 || tok.endsWith("==") || tok.endsWith("="))) return false;
@@ -6259,6 +6516,13 @@ function decodeBase64Literals(text) {
   }
   return out;
 }
+function stripStringLiterals(text) {
+  const m = text.match(/\s*([A-Za-z_][\w-]*|\/?[\w./-]+)\b/);
+  if (!m) return text;
+  const cmd = m[1].split("/").pop().toLowerCase();
+  if (!OUTPUT_CMDS.has(cmd)) return text;
+  return text.replace(QUOTED_STR_RE, "");
+}
 function decodeUrlAndNumeric(text) {
   const out = [];
   let s = text;
@@ -6292,7 +6556,10 @@ function decodeUrlAndNumeric(text) {
   return out;
 }
 function allCandidates(detail, max = 8) {
-  const cands = [detail];
+  const shell = stripStringLiterals(detail);
+  const cands = [shell];
+  cands.push(...decodeBase64Literals(shell));
+  cands.push(...decodeUrlAndNumeric(shell));
   cands.push(...decodeBase64Literals(detail));
   cands.push(...decodeUrlAndNumeric(detail));
   const seen = /* @__PURE__ */ new Set();
@@ -6306,7 +6573,31 @@ function allCandidates(detail, max = 8) {
   return out;
 }
 function matchStageAny(detail, stages) {
-  for (const cand of allCandidates(detail)) {
+  const cands = allCandidates(detail);
+  if (cands.length === 0) return "";
+  const shell = cands[0];
+  const hits = [];
+  for (const [name, pats] of Object.entries(stages)) {
+    for (const p of pats) {
+      p.lastIndex = 0;
+      if (p.test(shell)) {
+        hits.push(name);
+        break;
+      }
+    }
+  }
+  if (hits.length > 0) {
+    if (hits.length === 1) return hits[0];
+    if (hits.includes("EXEC") && PURPOSE_EXEC_RE.test(shell)) return "EXEC";
+    if (hits.includes("LISTEN") && LISTEN_LEAD_RE.test(shell) && !LISTEN_NOISE_RE.test(shell)) {
+      return "LISTEN";
+    }
+    for (const s of STAGE_PRIORITY) {
+      if (hits.includes(s)) return s;
+    }
+    if (hits.includes("EXEC")) return "EXEC";
+  }
+  for (const cand of cands.slice(1)) {
     for (const [name, pats] of Object.entries(stages)) {
       for (const p of pats) {
         p.lastIndex = 0;
@@ -6316,12 +6607,18 @@ function matchStageAny(detail, stages) {
   }
   return "";
 }
-var B64_TOKEN_RE;
+var B64_TOKEN_RE, QUOTED_STR_RE, OUTPUT_CMDS, STAGE_PRIORITY, PURPOSE_EXEC_RE, LISTEN_LEAD_RE, LISTEN_NOISE_RE;
 var init_decode = __esm({
   "src/engine/formal-engine/decode.ts"() {
     "use strict";
     init_esm_shims();
     B64_TOKEN_RE = /[A-Za-z0-9+/]+={0,2}/g;
+    QUOTED_STR_RE = /('(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"|`(?:[^`\\]|\\.)*`)/g;
+    OUTPUT_CMDS = /* @__PURE__ */ new Set(["echo", "printf", "print"]);
+    STAGE_PRIORITY = ["EXFIL", "PRIVESC", "PERSIST", "SCAN", "LISTEN"];
+    PURPOSE_EXEC_RE = /subprocess\.\w+\s*\(|os\.system\s*\(|shell\s*=\s*True|\beval\s*\(|\bexec\s*\(|os\.popen\s*\(|\/exec\b/i;
+    LISTEN_LEAD_RE = /http\.server|flask\s+run|nohup\b|nc\s+-l|socat\s+TCP-LISTEN/i;
+    LISTEN_NOISE_RE = /shell\s*=\s*True|os\.system|subprocess\.(?:run|call|Popen)|\beval\s*\(|\bexec\s*\(/i;
   }
 });
 
@@ -6357,11 +6654,7 @@ function compileAps(apPatterns) {
 }
 function labelEvent(actionDetail) {
   if (!AP_RE) compileAps(loadMC().ap_patterns || {});
-  let candidates = [actionDetail];
-  try {
-    candidates = (init_decode(), __toCommonJS(decode_exports)).allCandidates(actionDetail);
-  } catch {
-  }
+  const candidates = allCandidates(actionDetail);
   const hits = /* @__PURE__ */ new Set();
   for (const [name, pats] of Object.entries(AP_RE || {})) {
     for (const c of candidates) {
@@ -6457,6 +6750,7 @@ var init_ltl = __esm({
     init_esm_shims();
     init_rules_loader();
     init_ir();
+    init_decode();
     AP_RE = null;
   }
 });
@@ -6703,7 +6997,7 @@ function checkSensitiveDataFlow(graph) {
     const n = nodes[i];
     if (tainted.has(i) && EXFIL_RE.test(n.actionDetail)) {
       violations.push({
-        propertyId: "sensitive-data-exfil",
+        propertyId: "sensitive-data-flow",
         reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${tainted.get(i)} \u2192 ${n.sessionId}#${n.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
         riskLevel: "critical",
         path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
@@ -6713,6 +7007,62 @@ function checkSensitiveDataFlow(graph) {
   }
   return violations;
 }
+function extractInlineShell(s) {
+  const out = [];
+  let m;
+  INLINE_SHELL_RE.lastIndex = 0;
+  while ((m = INLINE_SHELL_RE.exec(s)) !== null) {
+    let g = m[1] ?? m[2] ?? m[3] ?? m[4] ?? "";
+    if (/^["']/.test(g) && (/"\s*,/.test(g) || /'\s*,/.test(g))) {
+      g = g.replace(/['"\[\],]+/g, " ");
+    }
+    g = g.trim();
+    if (g) out.push(g);
+  }
+  return out;
+}
+function containsPrivesc(shell) {
+  if (!shell) return false;
+  for (const seg of shell.split(/\&\&|\|\||;|\n/)) {
+    const s = seg.trim();
+    if (!s) continue;
+    const toks = s.split(/\s+/);
+    const head = (toks[0] || "").toLowerCase();
+    const rest = toks.slice(1).join(" ");
+    if (head === "chmod" && /(?:u\+s|g\+s|[2-7][0-7]{3})/.test(rest)) return true;
+    if (head === "setcap" && /cap_/.test(rest)) return true;
+    if (head === "pkexec" || head === "doas") return true;
+    if (head === "sudo") {
+      if (/^-u\s+/.test(rest)) {
+        if (/^-u\s+root\b/.test(rest)) return true;
+        continue;
+      }
+      const m = /^(\S+)(.*)$/.exec(rest);
+      if (m) {
+        const nxt = m[1].toLowerCase();
+        const tail = m[2];
+        if (PKG_MGR.has(nxt)) continue;
+        if (SHELLS.has(nxt)) return true;
+        if (nxt === "-i" || nxt === "-s") return true;
+        if (nxt.startsWith("su")) return true;
+        if (nxt.startsWith("/") && /bin\/(?:bash|sh|zsh|dash|fish)$/.test(nxt)) return true;
+      }
+      if (/\/(?:usr\/(?:local\/)?bin|bin)\/(?:bash|sh|zsh|dash|fish)\b/.test(rest)) return true;
+      if (/\bchmod\s+(?:u\+s|g\+s|[2-7][0-7]{3})\b/.test(rest)) return true;
+      if (/\bsetcap\s+cap_\w+/.test(rest)) return true;
+      if (/\bvisudo\b/.test(rest)) return true;
+      if (/\bpasswd\s+root\b/.test(rest)) return true;
+      if (/\buseradd\b/.test(rest)) return true;
+    }
+    if (head === "su") {
+      if (!rest) return true;
+      if (/^-l?\s*$/.test(rest)) return true;
+      if (/^root\b/.test(rest) || /^-l?\s+root\b/.test(rest)) return true;
+    }
+  }
+  if (/\bset(?:uid|euid|gid|egid|reuid|regid|resuid|resgid)\s*\(/i.test(shell)) return true;
+  return false;
+}
 function isExfilNode(n) {
   if (n.stage === "EXFIL") return true;
   if (EXFIL_RE.test(n.actionDetail) && EXFIL_ACTION_RE.test(n.actionDetail)) return true;
@@ -6727,8 +7077,12 @@ function isCredNode(n) {
   return CRED_STRICT_RE.test(n.actionDetail);
 }
 function isPrivescNode(n) {
-  if (n.stage === "PRIVESC") return true;
-  return PRIVESC_RE.test(n.actionDetail);
+  const shell = stripStringLiterals(n.actionDetail);
+  if (containsPrivesc(shell)) return true;
+  for (const cmd of extractInlineShell(shell)) {
+    if (containsPrivesc(cmd)) return true;
+  }
+  return false;
 }
 function checkNeverExfilAfterPrivesc(graph) {
   const violations = [];
@@ -6749,7 +7103,7 @@ function checkNeverExfilAfterPrivesc(graph) {
     if (pre) {
       const post = nodes[firstEv];
       return [{
-        propertyId: "no-privesc-then-exfil",
+        propertyId: "no-exfil-after-privesc",
         reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\xAC\u25C7EXFIL)",
         riskLevel: "critical",
         path: [
@@ -6765,7 +7119,7 @@ function checkNeverExfilAfterPrivesc(graph) {
     for (let j = i + 1; j < nodes.length; j++) {
       if (isExfilNode(nodes[j])) {
         violations.push({
-          propertyId: "no-privesc-then-exfil",
+          propertyId: "no-exfil-after-privesc",
           reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\xAC\u25C7EXFIL)",
           riskLevel: "critical",
           path: [
@@ -6798,7 +7152,7 @@ function checkNeverExfilAfterCred(graph) {
     if (pre) {
       const post = nodes[firstEv];
       return [{
-        propertyId: "no-cred-then-exfil",
+        propertyId: "no-exfil-after-credential",
         reason: "\u8BFB\u53D6\u51ED\u636E\u540E\u51FA\u73B0\u5916\u4F20\uFF0C\u8FDD\u53CD \u25A1(CRED\u2192\xAC\u25C7EXFIL)",
         riskLevel: "critical",
         path: [
@@ -6814,7 +7168,7 @@ function checkNeverExfilAfterCred(graph) {
     for (let j = i + 1; j < nodes.length; j++) {
       if (isExfilNode(nodes[j])) {
         violations.push({
-          propertyId: "no-cred-then-exfil",
+          propertyId: "no-exfil-after-credential",
           reason: "\u8BFB\u53D6\u51ED\u636E\u540E\u51FA\u73B0\u5916\u4F20\uFF0C\u8FDD\u53CD \u25A1(CRED\u2192\xAC\u25C7EXFIL)",
           riskLevel: "critical",
           path: [
@@ -6881,7 +7235,7 @@ function checkLowIntegrityCommandExec(graph) {
     const n = nodes[i];
     if (lowAt.has(i) && isComputeNode(n)) {
       violations.push({
-        propertyId: "low-integrity-controls-command-exec",
+        propertyId: "low-integrity-command-exec",
         reason: `\u4F4E\u5B8C\u6574\u6027\u6570\u636E\u63A7\u5236\u547D\u4EE4\u6267\u884C\uFF1A${lowAt.get(i)} \u2192 ${n.sessionId}#${n.seq} \u6267\u884C\u4E0D\u53EF\u4FE1\u5185\u5BB9`,
         riskLevel: "critical",
         path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
@@ -6927,7 +7281,7 @@ function checkCrossSessionReachability(graph) {
       const srcIdx = Math.min(...sources);
       const srcDesc = nodes[srcIdx].actionDetail.slice(0, 40);
       violations.push({
-        propertyId: "cross-session-reachability",
+        propertyId: "low-integrity-reachability",
         reason: `\u4F4E\u5B8C\u6574\u6027\u6E90\u7ECF\u8DE8 session \u6570\u636E\u94FE\u591A\u8DF3\u5230\u8FBE\u5F53\u524D\u6267\u884C\uFF08\u6E90: ${srcDesc} \u2192 ${n.sessionId}#${n.seq}\uFF09`,
         riskLevel: "high",
         path: nodes.slice(-3).map((m) => ({ sessionId: m.sessionId, seq: m.seq, detail: m.actionDetail.slice(0, 60) }))
@@ -6978,7 +7332,7 @@ function checkSensitiveDataAggregation(graph) {
   }
   return violations;
 }
-var CROSS_SESSION_CHAINS, CRED_FILE_RE, EXFIL_RE, EBPF_NET_RE, REMOTE_RE, PRIVESC_RE, EXFIL_ACTION_RE, CRED_STRICT_RE, TOOL_REGISTRY, COMPUTE_RE, STRONG_COMPUTE_TYPES, DL_OR_LOW_RE, ALL_PROPERTIES;
+var CROSS_SESSION_CHAINS, CRED_FILE_RE, EXFIL_RE, EBPF_NET_RE, REMOTE_RE, EXFIL_ACTION_RE, CRED_STRICT_RE, INLINE_SHELL_RE, PKG_MGR, SHELLS, TOOL_REGISTRY, COMPUTE_RE, STRONG_COMPUTE_TYPES, DL_OR_LOW_RE, ALL_PROPERTIES;
 var init_properties = __esm({
   "src/engine/formal-engine/properties.ts"() {
     "use strict";
@@ -6986,30 +7340,33 @@ var init_properties = __esm({
     init_rules_loader();
     init_ir();
     init_ltl();
+    init_decode();
     CROSS_SESSION_CHAINS = null;
     CRED_FILE_RE = /(known_hosts|\.ssh|id_rsa|\/etc\/shadow|\/etc\/passwd|credentials)/i;
-    EXFIL_RE = /https?:\/\/|scp\s+.*@|rsync\s+.*@/i;
+    EXFIL_RE = /https?:\/\/(?!127\.\d+\.\d+\.\d+|0\.0\.0\.0|localhost|\[?::1\]?)[^\s]+|\bscp\s+.*@|\brsync\s+.*@/i;
     EBPF_NET_RE = /connect|sendto|network_connect/i;
     REMOTE_RE = /to\s+\d+\.\d+\.\d+\.\d+|remote_addr/i;
-    PRIVESC_RE = /\bsudo\b|\bsu\b|chmod\s+u\s*\+\s*s|pkexec|setuid/i;
     EXFIL_ACTION_RE = /\bcurl\b|\bwget\b|\bscp\b|\brsync\b|\brclone\b|\bftp\b|connect\s+.*\d+\.\d+\.\d+\.\d+|open\s+.*tcp|base64\s+.*\-o/i;
     CRED_STRICT_RE = /(known_hosts|\.ssh|id_rsa|\.pem|\b\.key\b|\/etc\/shadow|\/etc\/passwd|\.aws\/credentials|credentials\.json|netrc|password|secrets?\.ya?ml|credentials?\s*(file|path)?\s*(=|\:)|\bconfig.*(password|token))/i;
+    INLINE_SHELL_RE = /(?:os\.system|os\.popen)\s*\(\s*['"]([^'"]+)['"]|subprocess\.[a-z_]+\(\s*\[([^\]]+)\]|subprocess\.[a-z_]+\(\s*['"]([^'"]+)['"]|(?:bash|sh|zsh)\s+-c\s*['"]([^'"]+)['"]/gi;
+    PKG_MGR = /* @__PURE__ */ new Set(["apt", "apt-get", "aptitude", "yum", "dnf", "pacman", "zypper", "apk", "brew"]);
+    SHELLS = /* @__PURE__ */ new Set(["bash", "sh", "zsh", "dash", "fish", "ksh", "csh", "tcsh", "nologin"]);
     TOOL_REGISTRY = null;
     COMPUTE_RE = /subprocess|os\.system|shell\s*=\s*True|\beval\(|\bexec\(|bash\s+[^\s]|sh\s+-c|python3?\s+|node\s+|\btimeout\s+|nohup\s+|\b\.\/[\w./-]+/i;
     STRONG_COMPUTE_TYPES = /* @__PURE__ */ new Set(["python", "node", "exec", "terminal", "cmd"]);
     DL_OR_LOW_RE = /curl\s+.*-o\b|wget\s+.*\s+-O\b|curl\s+.*\|\s*(bash|sh|python)|wget\s+.*\|\s*(bash|sh|python)|git\s+clone|docker\s+pull|pip\s+install|npm\s+install|base64\s+-d/i;
     ALL_PROPERTIES = [
-      { id: "cross-session-chain", check: checkCrossSessionChain },
-      { id: "sensitive-data-flow", check: checkSensitiveDataFlow },
-      { id: "cross-session-reachability", check: checkCrossSessionReachability },
-      { id: "no-privesc-then-exfil", check: checkNeverExfilAfterPrivesc },
-      { id: "no-cred-then-exfil", check: checkNeverExfilAfterCred },
+      { id: "cross-session-chain", check: checkCrossSessionChain, shortName: "P1" },
+      { id: "sensitive-data-flow", check: checkSensitiveDataFlow, shortName: "P2" },
+      { id: "low-integrity-reachability", check: checkCrossSessionReachability, shortName: "P3" },
+      { id: "no-exfil-after-privesc", check: checkNeverExfilAfterPrivesc, shortName: "P4" },
+      { id: "no-exfil-after-credential", check: checkNeverExfilAfterCred, shortName: "P5" },
       // L2.2 模型检测（通用 LTL 求值器，mc_rules.json 单一事实源；witness 语义见 ltl.ts）
-      { id: "mc-ltl-rules", check: checkMCRules },
-      // Rule 5 低完整性控制命令执行（integrity 维度，站点 L2.1 最有区分度的检测之一）
-      { id: "low-integrity-command-exec", check: checkLowIntegrityCommandExec },
-      // Rule 12 敏感数据聚合外传（egress 聚合 ≥2 事件源）
-      { id: "sensitive-data-aggregation", check: checkSensitiveDataAggregation }
+      { id: "mc-ltl-rules", check: checkMCRules, shortName: "P6" },
+      // P7 低完整性控制命令执行（integrity 维度，站点 L2.1 最有区分度的检测之一）
+      { id: "low-integrity-command-exec", check: checkLowIntegrityCommandExec, shortName: "P7" },
+      // P8 敏感数据聚合外传（egress 聚合 ≥2 事件源）
+      { id: "sensitive-data-aggregation", check: checkSensitiveDataAggregation, shortName: "P8" }
     ];
   }
 });
@@ -7082,6 +7439,32 @@ var init_engine = __esm({
 });
 
 // src/engine/formal-engine/stateful.ts
+function extractInstances(actionDetail, stage) {
+  const out = [];
+  if (PORT_STAGE_RE.test(stage)) {
+    const d = actionDetail;
+    let m;
+    const re = new RegExp(PORT_RE.source, "gi");
+    while ((m = re.exec(d)) !== null) {
+      const p = m[1] || m[2] || m[3];
+      if (p && Number(p) > 0 && Number(p) <= 65535) out.push(`port:${p}`);
+    }
+    if (/SCAN/.test(stage)) {
+      const bareRe = new RegExp(BARE_PORT_RE.source, "g");
+      while ((m = bareRe.exec(d)) !== null) {
+        if (m[1] && Number(m[1]) > 0 && Number(m[1]) <= 65535) out.push(`port:${m[1]}`);
+      }
+    }
+    m = SOCK_RE.exec(d);
+    if (m && m[1]) out.push(`sock:${m[1]}`);
+    m = UNIT_RE.exec(d);
+    if (m && m[1]) out.push(`unit:${m[1]}`);
+  }
+  return out;
+}
+function buckKey(chainId, inst) {
+  return inst ? `${chainId}@@${inst}` : chainId;
+}
 function loadRules() {
   if (STAGES_PATTERNS !== null && CHAINS !== null) {
     return { stages: STAGES_PATTERNS, chains: CHAINS };
@@ -7121,7 +7504,7 @@ function lifecycleFor(detail, stage, isError) {
   if (detail.includes(">>") || detail.includes(">")) return "alive";
   return "";
 }
-var DESTROY_RE, NEVER_ACTIVATED_RE, CRED_FILE_RE2, EXFIL_RE2, STAGES_PATTERNS, CHAINS, MAX_NODES, StatefulChainTracker;
+var DESTROY_RE, NEVER_ACTIVATED_RE, CRED_FILE_RE2, EXFIL_RE2, PORT_RE, BARE_PORT_RE, SOCK_RE, UNIT_RE, PORT_STAGE_RE, STAGES_PATTERNS, CHAINS, MAX_NODES, StatefulChainTracker;
 var init_stateful = __esm({
   "src/engine/formal-engine/stateful.ts"() {
     "use strict";
@@ -7131,11 +7514,20 @@ var init_stateful = __esm({
     DESTROY_RE = /\b(?:pkill|kill)\b|systemctl\s+stop|service\s+stop|crontab\s+-r|rm\s+-[rf]?\s+/i;
     NEVER_ACTIVATED_RE = /\b(?:not\s+found|no\s+such\s+file|command\s+not\s+found|refused|failed\s+to\s+(?:start|bind|listen)|address\s+already\s+in\s+use)\b/i;
     CRED_FILE_RE2 = /(known_hosts|\.ssh|id_rsa|\/etc\/shadow|\/etc\/passwd|credentials)/i;
-    EXFIL_RE2 = /https?:\/\/|scp\s+.*@|rsync\s+.*@/i;
+    EXFIL_RE2 = /https?:\/\/(?!127\.\d+\.\d+\.\d+|0\.0\.0\.0|localhost|\[?::1\]?)|scp\s+.*@|rsync\s+.*@/i;
+    PORT_RE = /(?:-p\s+(\d{1,5})|-p(\d{1,5})|:(\d{1,5})\b)/i;
+    BARE_PORT_RE = /(?<=^|\s)(\d{1,5})(?=\s|$)/g;
+    SOCK_RE = /([\w./-]*(?:\/tmp\/|\/var\/run\/|\.sock\b)[\w./-]*)/;
+    UNIT_RE = /systemctl\s+(?:start|enable|restart)\s+([\w.-]+)/i;
+    PORT_STAGE_RE = /LISTEN|PERSIST|SCAN/;
     STAGES_PATTERNS = null;
     CHAINS = null;
     MAX_NODES = 1e5;
-    StatefulChainTracker = class {
+    StatefulChainTracker = class _StatefulChainTracker {
+      /** 本地接收时刻（实时路径无 called_at 时的兜底时间戳，ISO）。 */
+      static now() {
+        return (/* @__PURE__ */ new Date()).toISOString();
+      }
       agentId;
       nodes_ = [];
       ptr = {};
@@ -7157,10 +7549,14 @@ var init_stateful = __esm({
         for (const chain of chains) {
           const stages = chain.stages || [];
           if (stages.length === 0) continue;
-          const matched = this.ptr[String(chain.id || "")] || 0;
+          const cid = String(chain.id || "");
+          let matched = this.ptr[cid] || 0;
+          for (const [k, v] of Object.entries(this.ptr)) {
+            if (k.startsWith(`${cid}@@`) && v > matched && v < stages.length) matched = v;
+          }
           if (matched > 0 && matched < stages.length) {
             const pf = {
-              chainId: String(chain.id || ""),
+              chainId: cid,
               stages,
               matched,
               riskLevel: String(chain.riskLevel || chain.risk_level || "high"),
@@ -7236,8 +7632,10 @@ var init_stateful = __esm({
           actionDetail: ad,
           stage,
           resources: extractResources2(ad),
+          instances: extractInstances(ad, stage),
           isError,
-          lifecycle: lifecycleFor(ad, stage, isError)
+          lifecycle: lifecycleFor(ad, stage, isError),
+          timestamp: typeof action.calledAt === "string" ? action.calledAt : _StatefulChainTracker.now()
         };
         this.nodes_.push(node);
         this.seqNext += 1;
@@ -7245,11 +7643,19 @@ var init_stateful = __esm({
       }
       recordLifecycle(node) {
         if (node.lifecycle === "dead") {
-          let hit = false;
+          const clearedInsts = [];
+          for (const inst of node.instances) {
+            const key = `inst:${inst}`;
+            if (key in this.aliveResources) {
+              delete this.aliveResources[key];
+              clearedInsts.push(inst);
+            }
+          }
+          let pathHit = false;
           for (const r of node.resources) {
             if (r in this.aliveResources) {
               delete this.aliveResources[r];
-              hit = true;
+              pathHit = true;
             }
           }
           const detail = node.actionDetail;
@@ -7257,16 +7663,30 @@ var init_stateful = __esm({
             const base = r.split("/").pop() || "";
             if (base && detail.includes(base)) {
               delete this.aliveResources[r];
-              hit = true;
+              pathHit = true;
             }
           }
-          if (hit) this.resetChainsOnDestroy();
+          if (clearedInsts.length > 0 && !pathHit) {
+            for (const inst of clearedInsts) this.resetChainsForInstance(inst);
+          } else {
+            this.resetChainsOnDestroy();
+          }
           return;
         }
         if (node.lifecycle === "alive") {
           for (const r of node.resources) {
             this.aliveResources[r] = node.seq;
           }
+          for (const inst of node.instances) {
+            this.aliveResources[`inst:${inst}`] = node.seq;
+          }
+        }
+      }
+      /** 只重置指定实例在全部链上的进度（不影响其他端口/资源）。 */
+      resetChainsForInstance(inst) {
+        const key = buckKey("", inst).slice(2);
+        for (const k of Object.keys(this.ptr)) {
+          if (k.endsWith(`@@${inst}`)) this.ptr[k] = 0;
         }
       }
       resetChainsOnDestroy() {
@@ -7274,6 +7694,29 @@ var init_stateful = __esm({
           this.ptr[cid] = 0;
         }
       }
+      /**
+       * 当前节点应推进的链桶集合。
+       * - 有实例节点（LISTEN/PERSIST 带端口/socket/unit）→ 只推自己的实例桶；
+       *   同时为所有链的该实例建立桶（若首次出现）。
+       * - 无实例节点（EXEC/SCAN 等中间段）→ 推全局桶 + 所有当前活跃实例桶
+       *   （信息不足时保守推进一切可能，避免漏判）。
+       */
+      targetsForNode(node, chainId) {
+        const insts = node.instances;
+        if (insts.length > 0) {
+          const active = insts.filter((i) => this.aliveResources[`inst:${i}`] !== void 0);
+          if (active.length > 0) return active.map((i) => buckKey(chainId, i));
+          return [chainId];
+        }
+        const targets = [chainId];
+        for (const k of Object.keys(this.aliveResources)) {
+          if (k.startsWith("inst:")) {
+            const inst = k.slice("inst:".length);
+            targets.push(`${chainId}@@${inst}`);
+          }
+        }
+        return targets;
+      }
       advanceChains(node) {
         if (node.lifecycle === "dead") return null;
         if (node.lifecycle === "never_activated") {
@@ -7287,23 +7730,32 @@ var init_stateful = __esm({
           const stages = chain.stages || [];
           if (stages.length === 0) continue;
           const cid = String(chain.id || "");
-          const cur = this.ptr[cid] || 0;
-          if (cur < stages.length && stages[cur] === stage) {
-            this.ptr[cid] = cur + 1;
-            if (cur + 1 >= stages.length) {
-              return {
-                chainId: cid,
-                stages,
-                riskLevel: String(chain.riskLevel || chain.risk_level || "high"),
-                reason: String(chain.reason || "\u68C0\u6D4B\u5230\u7EC4\u5408\u653B\u51FB\u94FE"),
-                path: this.chainPath(stages)
-              };
+          const targets = this.targetsForNode(node, cid);
+          for (const key of targets) {
+            const cur = this.ptr[key] || 0;
+            if (cur < stages.length && stages[cur] === stage) {
+              this.ptr[key] = cur + 1;
+              if (cur + 1 >= stages.length) {
+                return {
+                  chainId: cid,
+                  stages,
+                  riskLevel: String(chain.riskLevel || chain.risk_level || "high"),
+                  reason: String(chain.reason || "\u68C0\u6D4B\u5230\u7EC4\u5408\u653B\u51FB\u94FE"),
+                  path: this.chainPath(stages)
+                };
+              }
             }
           }
         }
         return null;
       }
       invalidateChainOnFailure(node) {
+        if (node.instances.length > 0) {
+          for (const inst of node.instances) {
+            this.resetChainsForInstance(inst);
+          }
+          return;
+        }
         const failed = new Set(node.resources);
         if (failed.size === 0) return;
         const { chains } = loadRules();
@@ -7319,7 +7771,7 @@ var init_stateful = __esm({
         let want = stages[0];
         for (const n of this.nodes_) {
           if (n.stage === want) {
-            path6.push({ sessionId: n.sessionId, seq: n.seq, stage: n.stage });
+            path6.push({ sessionId: n.sessionId, seq: n.seq, stage: n.stage, timestamp: n.timestamp });
             const idx = stages.indexOf(n.stage);
             if (idx + 1 < stages.length) {
               want = stages[idx + 1];
@@ -7355,7 +7807,7 @@ var init_stateful = __esm({
         if (!this.tainted.has(node.seq)) return [];
         if (EXFIL_RE2.test(node.actionDetail)) {
           return [{
-            property_id: "sensitive-data-exfil",
+            property_id: "sensitive-data-flow",
             reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${this.taintSource(node)} \u2192 ${node.sessionId}#${node.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
             risk_level: "critical",
             path: [[node.sessionId, node.seq, node.actionDetail.slice(0, 60)]]
@@ -7397,8 +7849,12 @@ var init_stateful = __esm({
             actionDetail: String(raw.actionDetail || ""),
             stage: String(raw.stage || ""),
             resources: [...raw.resources || []],
+            instances: [...raw.instances || []],
+            // 旧快照无此字段 → 空
             isError: Boolean(raw.isError),
-            lifecycle: String(raw.lifecycle || "")
+            lifecycle: String(raw.lifecycle || ""),
+            timestamp: typeof raw.timestamp === "string" ? raw.timestamp : null
+            // 旧快照无此字段 → null
           });
         }
         this.seqNext = Number(snapshot.seq_next || this.nodes_.length);
@@ -7591,7 +8047,7 @@ async function runAnalysis(input) {
             riskType: node.l1RiskType,
             confidence: 90,
             source: "heuristic_script_scan",
-            violatedLayers: ["1.1-script"]
+            violatedLayers: ["L1.2"]
           };
         }
       }
@@ -7709,7 +8165,7 @@ async function runAnalysis(input) {
             riskType: inlineJudgment.riskType,
             confidence: 90,
             source: "logic_rule",
-            violatedLayers: ["1.2"]
+            violatedLayers: ["L2.1"]
           };
         }
         return {
@@ -7742,7 +8198,7 @@ async function runAnalysis(input) {
         console.warn(
           `[AgentMoss] \u5F62\u5F0F\u5316\u9A8C\u8BC1 observe\uFF08\u53EA\u8BB0\u5F55\u4E0D\u62E6\u622A\uFF09: property=${v?.propertyId ?? "?"} risk=${v?.riskLevel ?? "?"} path_len=${v?.path?.length ?? 0} reason=${(v?.reason ?? "?").slice(0, 200)}`
         );
-        observedFormalLayers.push("2.4");
+        observedFormalLayers.push("L2.2");
       } else {
         return {
           allowed: false,
@@ -7751,7 +8207,7 @@ async function runAnalysis(input) {
           riskType: "formal_verification",
           confidence: 90,
           source: "formal_engine",
-          violatedLayers: ["2.4"]
+          violatedLayers: ["L2.2"]
         };
       }
     }
@@ -7768,7 +8224,7 @@ async function runAnalysis(input) {
           riskType: node.l2RiskType,
           confidence: 85,
           source: "logic_rule_script_scan",
-          violatedLayers: ["1.2-script"]
+          violatedLayers: ["L2.3"]
         };
       }
     }
@@ -7855,7 +8311,7 @@ async function runAnalysis(input) {
       riskType: "",
       confidence: 60,
       source: "llm_failure_fallback",
-      violatedLayers: ["3"]
+      violatedLayers: ["L3.1"]
     };
   }
   if (!llmResult.allowed && llmResult.confidence && llmResult.confidence >= 90 && _brainExtractor) {
@@ -8797,7 +9253,7 @@ var AnalyzeRequestSchema = z.object({
   session_history: z.array(z.object({
     session_id: z.string(),
     action_history: z.array(ActionItemSchema).default([])
-  })).default([]).describe("Multi-session historical actions (optional): for L2.4 formal engine cross-session combo-chain / sensitive-data-flow verification. Provided by caller (incl. future agentgate)."),
+  })).default([]).describe("Multi-session historical actions (optional): for L2.2 formal engine cross-session combo-chain / sensitive-data-flow verification. Provided by caller (incl. future agentgate)."),
   a_next: ActionItemSchema.describe("Next action to be executed"),
   reason: z.string().default("").describe("Reason for executing this action"),
   os_type: z.string().default("").describe("OS type: 'linux', 'windows', or empty for auto-detect"),
@@ -8814,7 +9270,9 @@ var AnalyzeResponseSchema = z.object({
   policy: z.string().default(""),
   violated_policy: z.string().default(""),
   confidence: z.number().int().min(0).max(100).default(100),
-  analysis_duration_ms: z.number().default(0)
+  analysis_duration_ms: z.number().default(0),
+  // 组合攻击链反例路径：每步 [session_id, seq, stage, timestamp]，含真实发生时间
+  violation_chain: z.array(z.array(z.union([z.string(), z.number()]).nullable())).default([])
 });
 var HealthResponseSchema = z.object({
   status: z.string().default("healthy"),
@@ -9198,7 +9656,7 @@ async function analyzeRoute(c) {
         const judgment = incMatchedToDeny(inc);
         if (judgment) {
           const layers = [...result.violatedLayers];
-          if (!layers.includes("2.4-stateful")) layers.push("2.4-stateful");
+          if (!layers.includes("L2.2-stateful")) layers.push("L2.2-stateful");
           console.error(
             `[AgentMoss] stateful \u589E\u91CF\u62E6\u622A: agent=${agentId || "-"} property=${judgment.property_id} risk=${judgment.risk_level}`
           );
@@ -9212,7 +9670,8 @@ async function analyzeRoute(c) {
               policy: "",
               violated_policy: "",
               confidence: 90,
-              analysis_duration_ms: Math.round((performance.now() - t0) * 10) / 10
+              analysis_duration_ms: Math.round((performance.now() - t0) * 10) / 10,
+              violation_chain: judgment.violation_chain
             })
           );
         }
@@ -9251,17 +9710,20 @@ function getChainStateStoreFor(_agentId) {
 }
 function incMatchedToDeny(inc) {
   if (inc.matched) {
+    const chain = (inc.matched.path || []).map((p) => [p.sessionId, p.seq, p.stage, p.timestamp]);
     return {
       property_id: "cross-" + inc.matched.chainId,
       reason: inc.matched.reason,
-      risk_level: inc.matched.riskLevel
+      risk_level: inc.matched.riskLevel,
+      violation_chain: chain
     };
   }
   if (inc.exfil && inc.exfil.length > 0) {
     return {
-      property_id: "sensitive-data-exfil",
+      property_id: "sensitive-data-flow",
       reason: inc.exfil[0].reason,
-      risk_level: inc.exfil[0].risk_level
+      risk_level: inc.exfil[0].risk_level,
+      violation_chain: []
     };
   }
   return null;
@@ -9387,7 +9849,7 @@ function createConsoleRouter() {
     const rc = updateLayerEnabled(body.layer_key, body.enabled);
     return c.json({ layers: rc.layers, env_overrides: getEnvOverrides() });
   });
-  function getL24View() {
+  function getL22View() {
     const ltlHuman = {
       "mc-ltl-001": "\u5148\u8BFB\u53D6\u4E86\u51ED\u636E/\u5BC6\u94A5\uFF0C\u4E4B\u540E\u51FA\u73B0\u7F51\u7EDC\u5916\u4F20",
       "mc-ltl-002": "\u5148\u4E0B\u8F7D/\u83B7\u53D6\u4E86\u6587\u4EF6\uFF0C\u4E4B\u540E\u6267\u884C\u4E86\u6587\u4EF6",
@@ -9403,9 +9865,16 @@ function createConsoleRouter() {
     };
     const mc = loadMC();
     const rules = mc.rules || [];
+    let catEnabled = true;
+    try {
+      const rt = loadRuntimeConfig();
+      catEnabled = rt.L2_2?.ltl_rules?.category_enabled !== false;
+    } catch {
+    }
     return {
       enabled_via: "L2_logic_rules",
       description: "\u65F6\u5E8F\u4E0E\u6570\u636E\u6D41\u653B\u51FB\u68C0\u6D4B\uFF08L2.2 \u6A21\u578B\u68C0\u6D4B\uFF09",
+      category_enabled: catEnabled,
       ltl_rules: rules.map((r) => ({
         id: r.id,
         type: r.type,
@@ -9418,10 +9887,10 @@ function createConsoleRouter() {
       }))
     };
   }
-  function withL24View(rc) {
-    if (rc && rc.L2_4 && typeof rc.L2_4 === "object" && !Array.isArray(rc.L2_4)) {
-      const cat = rc.L2_4.ltl_rules;
-      const rls = cat && cat.rules || [];
+  function withL22View(rc) {
+    const l22 = rc && rc.L2_2;
+    if (l22 && typeof l22 === "object" && !Array.isArray(l22) && l22.ltl_rules && typeof l22.ltl_rules === "object" && !Array.isArray(l22.ltl_rules)) {
+      const rls = l22.ltl_rules.rules || [];
       const ltlHumanLocal = {
         "mc-ltl-001": "\u5148\u8BFB\u53D6\u4E86\u51ED\u636E/\u5BC6\u94A5\uFF0C\u4E4B\u540E\u51FA\u73B0\u7F51\u7EDC\u5916\u4F20",
         "mc-ltl-002": "\u5148\u4E0B\u8F7D/\u83B7\u53D6\u4E86\u6587\u4EF6\uFF0C\u4E4B\u540E\u6267\u884C\u4E86\u6587\u4EF6",
@@ -9435,9 +9904,10 @@ function createConsoleRouter() {
         "mc-ltl-010": "\u5B89\u88C5\u4E86\u6301\u4E45\u5316\u673A\u5236\uFF08crontab/systemd/.bashrc \u7B49\uFF09\uFF0C\u9700\u5BA1\u6279",
         "mc-ctl-001": "\u4EFB\u4F55\u60C5\u51B5\u4E0B\u4E0D\u5141\u8BB8\u6E05\u9664\u65E5\u5FD7\uFF08\u5B89\u5168\u5E95\u7EBF\uFF09"
       };
-      rc.L2_4 = {
+      rc.L2_2 = {
         enabled_via: "L2_logic_rules",
         description: "\u65F6\u5E8F\u4E0E\u6570\u636E\u6D41\u653B\u51FB\u68C0\u6D4B\uFF08L2.2 \u6A21\u578B\u68C0\u6D4B\uFF09",
+        category_enabled: l22.ltl_rules.category_enabled !== false,
         ltl_rules: rls.map((r) => ({
           id: r.id,
           type: "ltl",
@@ -9454,27 +9924,27 @@ function createConsoleRouter() {
   }
   console2.get("/api/rules", (c) => {
     const rc = loadRuntimeConfig();
-    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules, L2_4: getL24View() });
+    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules, L2_2: getL22View() });
   });
   console2.put("/api/rules/enabled", async (c) => {
     const b = await c.req.json();
     const rc = updateRuleEnabled(b.layer, b.category, b.rule_id, b.enabled);
-    return c.json(withL24View(rc));
+    return c.json(withL22View(rc));
   });
   console2.put("/api/rules/deny_mode", async (c) => {
     const b = await c.req.json();
     const rc = updateRuleDenyMode(b.layer, b.category, b.rule_id, b.deny_mode);
-    return c.json(withL24View(rc));
+    return c.json(withL22View(rc));
   });
   console2.put("/api/rules/skip_l3", async (c) => {
     const b = await c.req.json();
     const rc = updateRuleSkipL3(b.layer, b.category, b.rule_id, b.skip_l3_on_disabled);
-    return c.json(withL24View(rc));
+    return c.json(withL22View(rc));
   });
   console2.put("/api/categories/enabled", async (c) => {
     const b = await c.req.json();
     const rc = updateCategoryEnabled(b.layer, b.category, b.enabled);
-    return c.json(rc);
+    return c.json(withL22View(rc));
   });
   console2.post("/api/rules", async (c) => {
     const b = await c.req.json();
@@ -9490,13 +9960,13 @@ function createConsoleRouter() {
       credential: b.credential,
       deny_mode: b.deny_mode
     });
-    return c.json(rc);
+    return c.json(withL22View(rc));
   });
   console2.delete("/api/rules", async (c) => {
     const b = await c.req.json();
     deleteCustomRule(b.layer, b.category, b.rule_id);
     const rc = loadRuntimeConfig();
-    return c.json(rc);
+    return c.json(withL22View(rc));
   });
   console2.get("/api/skills", (c) => {
     const rc = loadRuntimeConfig();
@@ -9505,23 +9975,23 @@ function createConsoleRouter() {
   console2.put("/api/skills/enabled", async (c) => {
     const b = await c.req.json();
     const rc = updateSkillEnabled(b.skill_id, b.enabled);
-    return c.json(rc);
+    return c.json(withL22View(rc));
   });
   console2.put("/api/skill-categories/enabled", async (c) => {
     const b = await c.req.json();
     const rc = updateSkillCategoryEnabled(b.category, b.enabled);
-    return c.json(rc);
+    return c.json(withL22View(rc));
   });
   console2.post("/api/skills", async (c) => {
     const b = await c.req.json();
     const rc = addCustomSkill(b.skill_id, b.category || "user_custom", b.keywords || [], b.content);
-    return c.json(rc);
+    return c.json(withL22View(rc));
   });
   console2.delete("/api/skills", async (c) => {
     const b = await c.req.json();
     deleteCustomSkill(b.skill_id, b.category);
     const rc = loadRuntimeConfig();
-    return c.json(rc);
+    return c.json(withL22View(rc));
   });
   console2.get("/api/skills/:skill_id/content", async (c) => {
     const skillId = c.req.param("skill_id");
@@ -9619,7 +10089,7 @@ function createConsoleRouter() {
   });
   console2.get("/api/config", (c) => {
     const rc = loadRuntimeConfig();
-    return c.json({ ...rc, L2_4: getL24View() });
+    return c.json({ ...rc, L2_2: getL22View() });
   });
   console2.get("/api/env-overrides", (c) => {
     return c.json({ overrides: getEnvOverrides() });
@@ -9627,7 +10097,7 @@ function createConsoleRouter() {
   console2.post("/api/reset", (c) => {
     const defaults = generateSourceDefaults();
     saveRuntimeConfig(defaults);
-    return c.json(defaults);
+    return c.json(withL22View(defaults));
   });
   console2.get("/api/token-stats", (c) => {
     const days = parseInt(c.req.query("days") || "7", 10);
@@ -9959,4 +10429,14 @@ if (isMain) {
 //! 顺序即 fail-closed 短路优先级：verify 逐个执行，首个返回违规的性质成为
 //! first_violation，后续不再评估。调整顺序影响判定归属，须与 Python
 //! properties.py ALL_PROPERTIES 保持一致并双端测试确认。
+//!
+//! shortName（P1~P8 连续短名）与 id（语义化英文）对照（与 Python 一致）：
+//!   P1 cross-session-chain          跨会话组合链
+//!   P2 sensitive-data-flow          敏感数据传播
+//!   P3 low-integrity-reachability   低完整性数据流可达
+//!   P4 no-exfil-after-privesc       提权后禁外传
+//!   P5 no-exfil-after-credential    凭据后禁外传
+//!   P6 mc-ltl-rules                 LTL 模型检测
+//!   P7 low-integrity-command-exec   低完整性命令执行
+//!   P8 sensitive-data-aggregation   敏感数据聚合外传
 //# sourceMappingURL=cli.js.map