@kenhkl/agent-moss 0.13.0 → 0.15.0

package/dist/engine/coordinator.js

@@ -628,10 +628,15 @@ function loadMC() {
   try {
     const rt = (init_runtime_config(), __toCommonJS(runtime_config_exports));
     if (rules.length > 0 && typeof rt.hasRuntimeConfig === "function" && rt.hasRuntimeConfig()) {
-      const rtRules = rt.loadRuntimeConfig()?.L2_4?.ltl_rules?.rules || [];
+      const ltl = rt.loadRuntimeConfig()?.L2_2?.ltl_rules || {};
+      const rtRules = ltl.rules || [];
       const enabledById = {};
       for (const r of rtRules) if (r?.id) enabledById[r.id] = r.enabled !== false;
-      for (const r of rules) if (r?.id && r.id in enabledById) r.enabled = enabledById[r.id];
+      const catEnabled = ltl.category_enabled !== false;
+      for (const r of rules) {
+        if (r?.id && r.id in enabledById) r.enabled = enabledById[r.id];
+        if (!catEnabled) r.enabled = false;
+      }
     }
   } catch {
   }
@@ -676,7 +681,8 @@ function _loadSensitivePathScope(scope) {
     path: sp.path,
     riskLevel: sp.risk_level,
     desc: sp.desc,
-    credential: sp.deny_mode === "deny_both" ? true : void 0
+    credential: sp.deny_mode === "deny_both" ? true : void 0,
+    dirDelOnly: sp.dir_del_only === true ? true : void 0
   }));
 }
 function isWriteOperation(actionType, actionDetail, writeKeywords = WRITE_KEYWORDS) {
@@ -774,7 +780,7 @@ function runLogicCheck(input) {
             riskType: "intent_deviation",
             confidence: 85,
             source: "logic_rule",
-            violatedLayers: ["2"]
+            violatedLayers: ["L2.1"]
           };
         }
       }
@@ -798,7 +804,7 @@ function runLogicCheck(input) {
           riskType: "privilege_escalation",
           confidence: 85,
           source: "logic_rule",
-          violatedLayers: ["2"]
+          violatedLayers: ["L2.1"]
         };
       }
     }
@@ -850,7 +856,7 @@ function checkComboChain(actionHistory, actionDetailRaw) {
         riskType: "combo_chain",
         confidence: 85,
         source: "logic_rule",
-        violatedLayers: ["2"]
+        violatedLayers: ["L2.1"]
       };
     }
   }
@@ -975,7 +981,7 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
       riskType: "read_before_write",
       confidence: 85,
       source: "logic_rule",
-      violatedLayers: ["2"]
+      violatedLayers: ["L2.1"]
     };
   }
   return null;
@@ -995,7 +1001,7 @@ function checkPasswordConsent(actionType, actionDetail, actionHistory) {
     riskType: "consent_missing",
     confidence: 85,
     source: "logic_rule",
-    violatedLayers: ["2"]
+    violatedLayers: ["L2.1"]
   };
 }
 function checkUserDeletionConsent(actionType, actionDetail, actionHistory) {
@@ -1013,7 +1019,7 @@ function checkUserDeletionConsent(actionType, actionDetail, actionHistory) {
     riskType: "consent_missing",
     confidence: 85,
     source: "logic_rule",
-    violatedLayers: ["2"]
+    violatedLayers: ["L2.1"]
   };
 }
 function containsPrivilegeEscalation(actionDetail) {
@@ -1073,7 +1079,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
           riskType: "file_access",
           confidence: 95,
           source: "logic_rule",
-          violatedLayers: ["2"],
+          violatedLayers: ["L2.1"],
           isCredential: true
         };
       }
@@ -1089,7 +1095,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
             riskType: "file_access",
             confidence: 95,
             source: "logic_rule",
-            violatedLayers: ["2"]
+            violatedLayers: ["L2.1"]
           };
         }
       }
@@ -1103,7 +1109,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
     riskType: "file_access",
     confidence: 70,
     source: "logic_rule",
-    violatedLayers: ["2"]
+    violatedLayers: ["L2.1"]
   };
 }
 var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, WRITE_KEYWORDS, WRITE_COMMAND_RES, READ_ONLY_COMMANDS, DEVNULL_REDIRECT_RE, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
@@ -1115,7 +1121,7 @@ var init_logic_rules = __esm({
     init_rules_loader();
     ROOT_SENSITIVE_PATHS = _loadSensitivePathScope("root");
     HOME_SENSITIVE_PATHS = _loadSensitivePathScope("home");
-    CREDENTIAL_PATHS = _loadSensitivePathScope("credential").map(({ path: path5, riskLevel, desc }) => ({ path: path5, riskLevel, desc, credential: true }));
+    CREDENTIAL_PATHS = _loadSensitivePathScope("credential").map(({ path: path5, riskLevel, desc, dirDelOnly }) => ({ path: path5, riskLevel, desc, credential: true, dirDelOnly }));
     NON_WRITE_TOOLS = /* @__PURE__ */ new Set([
       "ask_user_question",
       "glob",
@@ -1428,6 +1434,7 @@ __export(runtime_config_exports, {
   isLayerEnabled: () => isLayerEnabled,
   loadRuntimeConfig: () => loadRuntimeConfig,
   mergeConfig: () => mergeConfig,
+  pickDeletableRule: () => pickDeletableRule,
   saveRuntimeConfig: () => saveRuntimeConfig,
   updateAgentCategoryEnabled: () => updateAgentCategoryEnabled,
   updateAgentRuleEnabled: () => updateAgentRuleEnabled,
@@ -1466,7 +1473,7 @@ function emptyRuntimeConfig() {
     L1_rules: {},
     L2_rules: {},
     L3_skills: {},
-    L2_4: {},
+    L2_2: {},
     agent_rules: {},
     scenario_rules: {}
   };
@@ -1494,7 +1501,7 @@ function loadRuntimeConfig() {
       L1_rules: merged.L1_rules || {},
       L2_rules: merged.L2_rules || {},
       L3_skills: merged.L3_skills || {},
-      L2_4: merged.L2_4 || {},
+      L2_2: merged.L2_2 || {},
       agent_rules: merged.agent_rules || {},
       scenario_rules: merged.scenario_rules || {}
     };
@@ -1547,6 +1554,7 @@ function getEnabledL2SensitivePaths(runtime) {
     const out = { path: r.path || "", risk_level: r.risk_level || "", desc: r.desc || "", deny_mode: r.deny_mode || "deny_write" };
     if (r.credential) out.credential = true;
     if (r.read_only) out.read_only = true;
+    if (r.dir_del_only) out.dir_del_only = true;
     return out;
   });
 }
@@ -1592,8 +1600,16 @@ function getDisabledL2RulesWithSkipL3() {
 function _slugify(text) {
   return text.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_|_$/g, "") || "x";
 }
+function _fnv1a32(text) {
+  let h = 2166136261;
+  for (const b of Buffer.from(text, "utf-8")) {
+    h ^= b;
+    h = h * 16777619 >>> 0;
+  }
+  return h.toString(16).padStart(8, "0");
+}
 function _generatePatternId(pattern) {
-  return `pat_${_slugify(pattern)}`;
+  return `pat_${_slugify(pattern)}_${_fnv1a32(pattern)}`;
 }
 function _deriveDenyMode(rule) {
   if (rule.deny_mode) return rule.deny_mode;
@@ -1655,6 +1671,7 @@ function _l2SensitivePathsToRules() {
       builtin: true
     };
     _syncDenyModeFields(rule);
+    if (sp.dirDelOnly) rule.dir_del_only = true;
     return rule;
   });
 }
@@ -1871,17 +1888,20 @@ function generateSourceDefaults() {
       user_custom: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49 L2 \u903B\u8F91\u89C4\u5219", rules: [] }
     },
     L3_skills: _l3SkillsToRules(),
-    L2_4: _ltlRulesToRuntime(),
+    L2_2: _ltlRulesToRuntime(),
     agent_rules: _agentRulesToDefaults(),
     scenario_rules: _scenarioRulesToDefaults()
   };
 }
 function _ltlRulesToRuntime() {
   const cands = [
-    join3(__dirname4, "..", "rules"),
-    join3(__dirname4, "..", "..", "..", "agent_moss", "rules"),
-    join3(process.cwd(), "agent_moss", "rules")
-  ];
+    getRuntimeConfigDir() && join3(getRuntimeConfigDir(), "rules"),
+    join3(__dirname4, "../rules"),
+    join3(__dirname4, "rules"),
+    join3(__dirname4, "../../../agent_moss/rules"),
+    join3(__dirname4, "../../../../agent_moss/rules"),
+    join3(process.cwd(), "agent_moss/rules")
+  ].filter(Boolean);
   let mc = {};
   for (const dir of cands) {
     const p = join3(dir, "mc_rules.json");
@@ -2059,7 +2079,11 @@ function mergeConfig(userCfg, srcDefaults) {
   );
   _mergeRuleCategories(cfg, srcDefaults, "L1_rules");
   _mergeRuleCategories(cfg, srcDefaults, "L2_rules");
-  _mergeRuleCategories(cfg, srcDefaults, "L2_4");
+  if (!cfg.L2_2 && cfg.L2_4) {
+    cfg.L2_2 = cfg.L2_4;
+    delete cfg.L2_4;
+  }
+  _mergeRuleCategories(cfg, srcDefaults, "L2_2");
   _mergeSkillCategories(cfg, srcDefaults, "L3_skills");
   _mergeAgentRules(cfg, srcDefaults);
   _mergeAgentRules(cfg, srcDefaults, "scenario_rules");
@@ -2237,16 +2261,20 @@ function addCustomRule(layer, category, rule) {
   saveRuntimeConfig(runtime);
   return runtime;
 }
-function deleteCustomRule(layer, category, ruleId) {
-  const runtime = loadRuntimeConfig();
-  const rules = runtime[layer]?.[category]?.rules || [];
-  const idx = rules.findIndex((r) => r.id === ruleId);
+function pickDeletableRule(rules, ruleId) {
+  const idx = rules.findIndex((r) => r.id === ruleId && (!r.builtin || r.source_removed));
   if (idx >= 0) {
-    const r = rules[idx];
-    if (r.builtin && !r.source_removed) return null;
     rules.splice(idx, 1);
-    saveRuntimeConfig(runtime);
+    return rules;
   }
+  if (rules.some((r) => r.id === ruleId)) return null;
+  return rules;
+}
+function deleteCustomRule(layer, category, ruleId) {
+  const runtime = loadRuntimeConfig();
+  const rules = runtime[layer]?.[category]?.rules || [];
+  if (pickDeletableRule(rules, ruleId) === null) return null;
+  saveRuntimeConfig(runtime);
   return runtime;
 }
 function addCustomSkill(skillId, category, keywords, content) {
@@ -2679,7 +2707,7 @@ function runHeuristicCheck(input) {
             riskType: "sensitive_action",
             confidence: 90,
             source: "heuristic",
-            violatedLayers: ["1.1"]
+            violatedLayers: ["L1.1"]
           };
         }
       }
@@ -2689,8 +2717,10 @@ function runHeuristicCheck(input) {
   const scanDetail = normalizePathSegments(stripLiteralTextSegments(input.aNext.actionDetail));
   const scanCommand = `${input.aNext.actionType}: ${scanDetail}`;
   let topRiskType = "";
+  const exemptKeygen = isSshKeygenGenerate(input.aNext.actionDetail);
   for (const rule of DANGEROUS_PATTERNS) {
     if (rule.pattern.test(scanCommand)) {
+      if (exemptKeygen && rule.riskType === "file_access") continue;
       matched.push(rule.description);
       if (severityRank(rule.severity) > severityRank(highestSeverity)) {
         highestSeverity = rule.severity;
@@ -2732,10 +2762,26 @@ function runHeuristicCheck(input) {
   const detailL = input.aNext.actionDetail.toLowerCase();
   const isExcludedType = SENSITIVE_EXCLUDED_PREFIXES.some((p) => actionTypeL.startsWith(p));
   const dangerousResult = checkDangerousPatterns(actionTypeL, detailL);
-  if (dangerousResult) return dangerousResult;
-  if (!isExcludedType) {
-    const pathResult = checkSensitivePath(detailL, input.cwd || "/", agentExt);
-    if (pathResult) return pathResult;
+  const pathResult = isExcludedType ? null : checkSensitivePath(detailL, input.cwd || "/", agentExt);
+  const homeResult = checkHomeDeletion(actionTypeL, detailL);
+  const mergeResults = [dangerousResult, pathResult, homeResult].filter(Boolean);
+  if (mergeResults.length > 0) {
+    let best = mergeResults[0];
+    for (const r of mergeResults) {
+      if (severityRank(r.riskLevel) > severityRank(best.riskLevel)) best = r;
+    }
+    if (severityRank(highestSeverity) > severityRank(best.riskLevel)) {
+      return {
+        allowed: false,
+        reason: `\u68C0\u6D4B\u5230\u9AD8\u5371\u64CD\u4F5C: ${matched.join(", ")}`,
+        riskLevel: highestSeverity,
+        riskType: highestRiskType,
+        confidence: 95,
+        source: "heuristic",
+        violatedLayers: ["L1.1"]
+      };
+    }
+    return best;
   }
   if (matched.length > 0) {
     return {
@@ -2745,8 +2791,7 @@ function runHeuristicCheck(input) {
       riskType: highestRiskType,
       confidence: 95,
       source: "heuristic",
-      violatedLayers: ["1.1"]
-      // 对齐 py coordinator.py:165（L1.1 = 命中高危命令模式/注入关键词）
+      violatedLayers: ["L1.1"]
     };
   }
   const lateralResult = checkLateralMovement(detailL);
@@ -2874,6 +2919,7 @@ function isSearchActionType(actionType) {
 function checkSensitivePath(command, cwd, agentExt) {
   const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
   const isWriteOpFlag = isWriteOperation("", command);
+  const keygenGenerate = isSshKeygenGenerate(command);
   const pathScanText = normalizePathSegments(stripLiteralTextSegments(command));
   const pathMatches = (text, path5) => {
     const parts = path5.split(/(\(\?!.*?\))/);
@@ -2886,6 +2932,7 @@ function checkSensitivePath(command, cwd, agentExt) {
   };
   for (const sp of ROOT_SENSITIVE_PATHS) {
     if (pathMatches(pathScanText, sp.path.toLowerCase())) {
+      if (keygenGenerate) continue;
       if (sp.path === "/dev/random") {
         if (isWriteOpFlag) {
           continue;
@@ -2897,7 +2944,7 @@ function checkSensitivePath(command, cwd, agentExt) {
           riskType: "file_access",
           confidence: 90,
           source: "heuristic",
-          violatedLayers: ["1.1"]
+          violatedLayers: ["L1.1"]
         };
       }
       if (!isWriteOpFlag && !sp.credential) {
@@ -2910,16 +2957,51 @@ function checkSensitivePath(command, cwd, agentExt) {
         riskType: "file_access",
         confidence: 90,
         source: "heuristic",
-        violatedLayers: ["1.1"],
+        violatedLayers: ["L1.1"],
         isCredential: !!sp.credential
       };
     }
   }
   for (const sp of HOME_SENSITIVE_PATHS) {
     const expanded = `${expandedCwd}/${sp.path}`;
-    const pathRe = sp.path.endsWith(".pub") ? new RegExp(sp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i") : new RegExp(sp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "(?!\\.pub)", "i");
-    const expandedRe = sp.path.endsWith(".pub") ? new RegExp(expanded.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i") : new RegExp(expanded.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "(?!\\.pub)", "i");
-    if (pathRe.test(pathScanText) || expandedRe.test(pathScanText)) {
+    let pPath = sp.path;
+    if (!sp.path.endsWith(".pub")) pPath = `${sp.path}(?!\\.pub)`;
+    let dirPrefixMatch = null;
+    if (sp.dirDelOnly) {
+      const dirRe = (t) => new RegExp(`(?:^|[\\s/\\\\'"])${t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:/|[\\s'"\\\\]|$)`, "i");
+      dirPrefixMatch = dirRe(sp.path).test(pathScanText) || dirRe(expanded.toLowerCase()).test(pathScanText);
+    }
+    const pathReMatch = sp.dirDelOnly ? !!dirPrefixMatch : pathMatches(pathScanText, pPath);
+    const expandedReMatch = sp.dirDelOnly ? false : pathMatches(pathScanText, expanded + (sp.path.endsWith(".pub") ? "" : "(?!\\.pub)"));
+    if (pathReMatch || expandedReMatch) {
+      if (keygenGenerate) continue;
+      if (sp.dirDelOnly) {
+        if (isDeleteActionForDir(command, sp.path)) {
+          return {
+            allowed: false,
+            reason: `\u5220\u9664\u654F\u611F\u76EE\u5F55: ${sp.desc} (${sp.path})`,
+            riskLevel: sp.riskLevel,
+            riskType: "file_access",
+            confidence: 90,
+            source: "heuristic",
+            violatedLayers: ["L1.1"],
+            isCredential: !!sp.credential
+          };
+        }
+        if (isArchiveReadOfDir(command, sp.path)) {
+          return {
+            allowed: false,
+            reason: `\u5F52\u6863/\u590D\u5236\u8BFB\u53D6\u654F\u611F\u76EE\u5F55: ${sp.desc} (${sp.path})`,
+            riskLevel: sp.riskLevel,
+            riskType: "file_access",
+            confidence: 90,
+            source: "heuristic",
+            violatedLayers: ["L1.1"],
+            isCredential: !!sp.credential
+          };
+        }
+        continue;
+      }
       if (!isWriteOpFlag && !sp.credential) {
         continue;
       }
@@ -2930,7 +3012,7 @@ function checkSensitivePath(command, cwd, agentExt) {
         riskType: "file_access",
         confidence: 90,
         source: "heuristic",
-        violatedLayers: ["1.1"],
+        violatedLayers: ["L1.1"],
         isCredential: !!sp.credential
       };
     }
@@ -2953,7 +3035,7 @@ function checkSensitivePath(command, cwd, agentExt) {
           riskType: "file_access",
           confidence: 90,
           source: "heuristic",
-          violatedLayers: ["1.1"],
+          violatedLayers: ["L1.1"],
           isCredential: !!sp.credential
         };
       }
@@ -2970,7 +3052,7 @@ function checkSensitivePath(command, cwd, agentExt) {
         riskType: "file_access",
         confidence: 90,
         source: "heuristic",
-        violatedLayers: ["1.1"],
+        violatedLayers: ["L1.1"],
         isCredential: true
       };
     }
@@ -2983,18 +3065,142 @@ function checkSensitivePath(command, cwd, agentExt) {
       riskType: "file_access",
       confidence: 90,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
   return null;
 }
+function isHomeValue(path5) {
+  let p = path5.trim().toLowerCase();
+  if (p.startsWith("$(") && p.endsWith(")")) {
+    const inner = p.slice(2, -1).trim();
+    return HOME_TARGET_RE.test(" " + inner);
+  }
+  if (/^\/home\/[^/\s]+\/?$/.test(p)) return true;
+  return HOME_TARGET_RE.test(" " + p);
+}
+function isDeleteCommand(seg) {
+  const s = seg.trimStart();
+  if (/^(?:rm|rmdir|unlink)\b/i.test(s)) return true;
+  return /删除|移除/.test(s);
+}
+function homeEscapeTarget(seg) {
+  const low = seg.toLowerCase();
+  const re = /(?:~|(?:\$home|\$\{home\})|\/home\/[a-z0-9_.-]+)/g;
+  let m;
+  while ((m = re.exec(low)) !== null) {
+    const endIdx = m.index + m[0].length;
+    const tail = low.slice(endIdx);
+    if (!tail) continue;
+    let token = tail.trimStart().split(/\s+/)[0] || "";
+    token = token.split("&&")[0].split("||")[0].split(";")[0].replace(/\/+$/, "");
+    token = token.replace(/^['"]|['"]$/g, "");
+    const segments = token.split("/").filter((s) => s && s !== ".");
+    if (!segments.some((s) => s === "..")) continue;
+    let depth = 0;
+    let minDepth = 0;
+    for (const s of segments) {
+      depth += s === ".." ? -1 : 1;
+      minDepth = Math.min(minDepth, depth);
+    }
+    if (minDepth < 0) return true;
+    if (depth <= 0) return true;
+  }
+  return false;
+}
+function checkHomeDeletion(actionType, actionDetail) {
+  if (actionType !== "bash" && actionType !== "executebash" && actionType !== "terminal-executebash") return null;
+  const segs = actionDetail.split(/&&|\|\||;|\n/).map((s) => s.trim()).filter(Boolean);
+  for (const seg of segs) {
+    if (!isDeleteCommand(seg)) continue;
+    if (HOME_TARGET_RE.test(seg) || homeEscapeTarget(seg)) {
+      return {
+        allowed: false,
+        reason: "\u68C0\u6D4B\u5230\u5220\u9664\u4E3B\u76EE\u5F55 (~/$HOME) \u64CD\u4F5C",
+        riskLevel: "high",
+        riskType: "script_execution",
+        confidence: 90,
+        source: "heuristic",
+        violatedLayers: ["L1.1"]
+      };
+    }
+  }
+  const assigned = {};
+  for (const m of actionDetail.matchAll(HOME_ASSIGN_RE)) assigned[m[1]] = m[2];
+  for (const [varName, path5] of Object.entries(assigned)) {
+    if (!isHomeValue(path5)) continue;
+    const varRefRe = new RegExp(`(?:${escapeRegExp(varName)}|\\$\\{${escapeRegExp(varName)}\\})`);
+    for (const seg of segs) {
+      if (!isDeleteCommand(seg)) continue;
+      if (varRefRe.test(seg)) {
+        return {
+          allowed: false,
+          reason: `\u68C0\u6D4B\u5230\u901A\u8FC7\u53D8\u91CF ${varName}\uFF08=${path5}\uFF0C\u4E3B\u76EE\u5F55\uFF09\u6267\u884C\u5220\u9664`,
+          riskLevel: "high",
+          riskType: "script_execution",
+          confidence: 90,
+          source: "heuristic",
+          violatedLayers: ["L1.1"]
+        };
+      }
+    }
+  }
+  return null;
+}
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function isDeleteActionForDir(command, dirPath) {
+  const low = command.toLowerCase();
+  const dpath = dirPath.toLowerCase();
+  if (new RegExp(`\\b(?:rm|unlink|rmdir)\\b[^&|;]*?${escapeRegExp(dpath)}`, "i").test(low)) {
+    return true;
+  }
+  if (new RegExp(`(?:\u5220\u9664|\u79FB\u9664)[^\\n;|&]*?${escapeRegExp(dpath)}`).test(low)) {
+    return true;
+  }
+  for (const seg of low.split(/&&|\|\||;|\n/)) {
+    const fw = (seg.trim().split(/\s+/)[0] || "").toLowerCase();
+    if ((fw === "rm" || fw === "unlink" || fw === "rmdir") && low.includes(dpath)) {
+      return true;
+    }
+  }
+  return false;
+}
+function isArchiveReadOfDir(command, dirPath) {
+  const low = command.toLowerCase();
+  const dpath = dirPath.toLowerCase();
+  for (const seg of low.split(/&&|\|\||;|\n/)) {
+    const s = seg.trim();
+    if (!s || !s.includes(dpath)) continue;
+    const parts = s.split(/\s+/);
+    const fw = parts[0] || "";
+    if (fw === "zip") return true;
+    if (fw === "tar") {
+      if (/(?:^|\s)-[a-zA-Z]*x|--extract/.test(s)) continue;
+      return true;
+    }
+    if (fw === "cp" || fw === "rsync") {
+      const segPaths = s.match(/[/~][^\s;|&><'"]*/g) || [];
+      if (segPaths.length && segPaths[0].includes(dpath)) return true;
+    }
+  }
+  return false;
+}
+function isSshKeygenGenerate(command) {
+  const low = command.toLowerCase();
+  if (!low.includes("ssh-keygen")) return false;
+  if (!/(?:^|\s)-t\s+\S+/.test(low)) return false;
+  if (/(?:^|\s)-\S*[ylpB]\S*/.test(low)) return false;
+  return true;
+}
 function checkDangerousPatterns(actionType, actionDetail) {
   if (actionType === "file_write" || actionType === "file_edit") return null;
   const scan = stripHeredocContent(actionDetail);
   const TEMP_DIRS = ["/tmp", "/var/tmp", "/run", "/dev/shm"];
   const isTempPath = TEMP_DIRS.some(
     (td) => new RegExp(`(?:^|[\\s/])${td.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[\\s/]|$)`).test(actionDetail)
-  );
+  ) || /(?:^|[\s;]|&&\s*|\|\|\s*)var\/tmp(?:[/\s;]|$)/.test(actionDetail);
   const wildcardDeleteRe = /(?:\brm\b|\b(r?mdir|del|delete|remove|rmdir|unlink)\b|\b删除\b|\b移除\b)[\s\S]{0,40}?[*?]|[*?][\s\S]{0,40}?\b(?:rm|del|delete|remove|rmdir|unlink)\b|rm\s+-[a-zA-Z]*[rf][a-zA-Z]*\s+\S*[*?]/i;
   if (!isTempPath && wildcardDeleteRe.test(scan)) {
     return {
@@ -3004,7 +3210,7 @@ function checkDangerousPatterns(actionType, actionDetail) {
       riskType: "script_execution",
       confidence: 90,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
   const findWriteMatch = actionDetail.match(
@@ -3019,10 +3225,10 @@ function checkDangerousPatterns(actionType, actionDetail) {
       riskType: "script_execution",
       confidence: 90,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
-  if (/>\s*\/etc\//.test(actionDetail) || />\s*\/boot\//.test(actionDetail)) {
+  if (/>\s*['"]?\/etc\//.test(actionDetail) || />\s*['"]?\/boot\//.test(actionDetail) || />\s*['"]?\/proc\//.test(actionDetail)) {
     return {
       allowed: false,
       reason: "\u68C0\u6D4B\u5230\u91CD\u5B9A\u5411\u8986\u76D6\u5199\u5165\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55",
@@ -3030,7 +3236,7 @@ function checkDangerousPatterns(actionType, actionDetail) {
       riskType: "file_access",
       confidence: 95,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
   if (/>\s*\/dev\/(sd|hd|nvme|vd|loop|mem|kmsg|port|zero|random|urandom|full|core)/i.test(actionDetail)) {
@@ -3041,7 +3247,7 @@ function checkDangerousPatterns(actionType, actionDetail) {
       riskType: "file_access",
       confidence: 90,
       source: "heuristic",
-      violatedLayers: ["1.1"]
+      violatedLayers: ["L1.1"]
     };
   }
   return null;
@@ -3132,13 +3338,13 @@ function checkLateralMovement(actionDetail) {
         riskType: "lateral_movement",
         confidence: 80,
         source: "heuristic",
-        violatedLayers: ["1.1"]
+        violatedLayers: ["L1.1"]
       };
     }
   }
   return null;
 }
-var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES;
+var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES, HOME_TARGET_RE, HOME_ASSIGN_RE;
 var init_heuristic = __esm({
   "src/engine/heuristic.ts"() {
     "use strict";
@@ -3168,6 +3374,8 @@ var init_heuristic = __esm({
     })();
     SENSITIVE_EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
     SEARCH_ACTION_PREFIXES = ["search-", "web-", "browser-", "query-", "websearch", "web_search"];
+    HOME_TARGET_RE = /(?:^|[\s="'($])(?:~|(?:\$home|\$\{home\}))(?:\/(?:\.\*|\*|\.)?)?(?=[\s"';}|&)]|$)/i;
+    HOME_ASSIGN_RE = /([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(~[A-Za-z0-9_./-]*|\$HOME[A-Za-z0-9_./-]*|\$\{HOME\}[A-Za-z0-9_./-]*|\/home\/[^\s;|&]+|\$\((?:[^()]|\([^()]*\))*\))(?=\s|;|$|\||&)/gi;
   }
 });
 
@@ -3346,112 +3554,6 @@ var init_token_stats = __esm({
   }
 });
 
-// src/engine/formal-engine/decode.ts
-var decode_exports = {};
-__export(decode_exports, {
-  allCandidates: () => allCandidates,
-  decodeBase64Literals: () => decodeBase64Literals,
-  decodeUrlAndNumeric: () => decodeUrlAndNumeric,
-  matchStageAny: () => matchStageAny
-});
-function isValidBase64Token(tok) {
-  if (tok.length < 8) return false;
-  if (!(tok.length % 4 === 0 || tok.endsWith("==") || tok.endsWith("="))) return false;
-  return true;
-}
-function isPrintable(s) {
-  for (let i = 0; i < s.length; i++) {
-    const c = s.charCodeAt(i);
-    if (c < 32 || c > 126) return false;
-  }
-  return true;
-}
-function decodeBase64Literals(text) {
-  const out = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const m of text.matchAll(B64_TOKEN_RE)) {
-    const tok = m[0];
-    if (!isValidBase64Token(tok)) continue;
-    if (!/[A-Z]/.test(tok) || !/[a-z]/.test(tok)) continue;
-    try {
-      const padded = tok + "=".repeat((4 - tok.length % 4) % 4);
-      const bin = Buffer.from(padded, "base64");
-      const s = bin.toString("utf8");
-      if (s && isPrintable(s) && !seen.has(s)) {
-        seen.add(s);
-        out.push(s);
-      }
-    } catch {
-    }
-  }
-  return out;
-}
-function decodeUrlAndNumeric(text) {
-  const out = [];
-  let s = text;
-  for (let i = 0; i < 3; i++) {
-    let nxt = s;
-    try {
-      nxt = decodeURIComponent(s);
-    } catch {
-      break;
-    }
-    if (nxt === s) break;
-    s = nxt;
-  }
-  if (s !== text) out.push(s);
-  if (/\\[0-7]{3}/.test(text)) {
-    let expanded = "";
-    try {
-      expanded = text.replace(/\\[0-7]{3}/g, (m) => String.fromCharCode(parseInt(m.slice(1), 8)));
-    } catch {
-    }
-    if (expanded && expanded !== text) out.push(expanded);
-  }
-  if (/\\x[0-9a-fA-F]{2}/.test(text)) {
-    let expanded = "";
-    try {
-      expanded = text.replace(/\\x[0-9a-fA-F]{2}/g, (m) => String.fromCharCode(parseInt(m.slice(2), 16)));
-    } catch {
-    }
-    if (expanded && expanded !== text) out.push(expanded);
-  }
-  return out;
-}
-function allCandidates(detail, max = 8) {
-  const cands = [detail];
-  cands.push(...decodeBase64Literals(detail));
-  cands.push(...decodeUrlAndNumeric(detail));
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const c of cands) {
-    if (seen.has(c) || c.length > 4096) continue;
-    seen.add(c);
-    out.push(c);
-    if (out.length >= max) break;
-  }
-  return out;
-}
-function matchStageAny(detail, stages) {
-  for (const cand of allCandidates(detail)) {
-    for (const [name, pats] of Object.entries(stages)) {
-      for (const p of pats) {
-        p.lastIndex = 0;
-        if (p.test(cand)) return name;
-      }
-    }
-  }
-  return "";
-}
-var B64_TOKEN_RE;
-var init_decode = __esm({
-  "src/engine/formal-engine/decode.ts"() {
-    "use strict";
-    init_esm_shims();
-    B64_TOKEN_RE = /[A-Za-z0-9+/]+={0,2}/g;
-  }
-});
-
 // src/engine/coordinator.ts
 init_esm_shims();
 init_heuristic();
@@ -3684,6 +3786,7 @@ ${result.scriptContent}
 init_esm_shims();
 init_heuristic();
 init_logic_rules();
+init_inline_analyzer();
 import { statSync as statSync2, existsSync as existsSync9 } from "fs";
 import { resolve as resolve8, join as join6, isAbsolute as isAbsolute2 } from "path";
 import { homedir as homedir4 } from "os";
@@ -5298,6 +5401,13 @@ function extractScriptPath2(command) {
   return null;
 }
 function extractScriptPathWithArgs(command) {
+  const inline = command.match(/(?:^|\s|&&|\|\|)\s*(?:bash|\/bin\/bash|sh|zsh)\s+-c\s*(['"])([\s\S]*?)\1/i);
+  if (inline) {
+    const inner = inline[2];
+    const realPath = extractScriptPath2(inner);
+    if (realPath) return { path: realPath, args: [] };
+    return { path: null, args: [] };
+  }
   const scriptPath = extractScriptPath2(command);
   if (!scriptPath) return { path: null, args: [] };
   const idx = command.indexOf(scriptPath);
@@ -5311,11 +5421,59 @@ function extractScriptPathWithArgs(command) {
   }
   return { path: scriptPath, args };
 }
+function looksLikeScriptPath(tok) {
+  const t = tok.trim().replace(/^['"]|['"]$/g, "");
+  if (!t) return false;
+  const low = t.toLowerCase();
+  if (["bash", "sh", "zsh", "dash", "python", "python3", "perl", "ruby", "node", "php", "lua"].includes(low)) return false;
+  if (/\.(sh|bash|py|pl|rb|js|php|lua)$/.test(low)) return true;
+  if (t.includes("/") && !t.startsWith("-")) return true;
+  return false;
+}
 function extractInlineScriptPath(actionDetail) {
+  const code = extractInlineCode(actionDetail);
+  if (code) {
+    const candidates = [];
+    const osRe = /os\.(?:system|popen)\s*\(\s*(['"])(.*?)\1\s*\)/gi;
+    let m;
+    while ((m = osRe.exec(code)) !== null) candidates.push(m[2]);
+    const subListRe = /subprocess\.(?:run|call|Popen|check_output|check_call)\s*\(\s*\[(.*?)\]/gi;
+    while ((m = subListRe.exec(code)) !== null) candidates.push(m[1]);
+    const subShellRe = /subprocess\.(?:run|call|Popen|check_output|check_call)\s*\(\s*(['"])(.*?)\1[^)]*?shell\s*=\s*true/gi;
+    while ((m = subShellRe.exec(code)) !== null) candidates.push(m[2]);
+    for (const cand of candidates) {
+      const tokens = cand.includes(",") ? cand.split(/\s*,\s*/).map((t) => t.trim().replace(/^['"]|['"]$/g, "")) : cand.split(/\s+/);
+      for (const tok of tokens) {
+        if (looksLikeScriptPath(tok)) {
+          try {
+            const resolved = resolvePath2(tok.replace(/^['"]|['"]$/g, ""));
+            if (existsSync9(resolved)) {
+              const stat = statSync2(resolved);
+              if (stat.isFile()) return resolved;
+            }
+          } catch {
+          }
+        }
+      }
+    }
+    const openRe = /open\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+    while ((m = openRe.exec(code)) !== null) {
+      const p = m[1];
+      try {
+        const resolved = resolvePath2(p);
+        if (existsSync9(resolved)) {
+          const stat = statSync2(resolved);
+          if (stat.isFile()) return resolved;
+        }
+      } catch {
+      }
+    }
+    return null;
+  }
   const re = /open\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
-  let m;
-  while ((m = re.exec(actionDetail)) !== null) {
-    const p = m[1];
+  let m2;
+  while ((m2 = re.exec(actionDetail)) !== null) {
+    const p = m2[1];
     let resolved;
     try {
       resolved = resolvePath2(p);
@@ -5700,7 +5858,7 @@ async function analyzeWithLLM(prompt, config) {
         riskType: riskType || "",
         confidence: typeof parsed.confidence === "number" ? Math.min(100, Math.max(0, parsed.confidence)) : 70,
         source: "llm",
-        violatedLayers: ["3"]
+        violatedLayers: ["L3.1"]
       };
     } catch (err) {
       if (abortController.signal.aborted) {
@@ -6261,7 +6419,139 @@ init_esm_shims();
 // src/engine/formal-engine/builder.ts
 init_esm_shims();
 init_rules_loader();
-init_decode();
+
+// src/engine/formal-engine/decode.ts
+init_esm_shims();
+var B64_TOKEN_RE = /[A-Za-z0-9+/]+={0,2}/g;
+function isValidBase64Token(tok) {
+  if (tok.length < 8) return false;
+  if (!(tok.length % 4 === 0 || tok.endsWith("==") || tok.endsWith("="))) return false;
+  return true;
+}
+function isPrintable(s) {
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c < 32 || c > 126) return false;
+  }
+  return true;
+}
+function decodeBase64Literals(text) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const m of text.matchAll(B64_TOKEN_RE)) {
+    const tok = m[0];
+    if (!isValidBase64Token(tok)) continue;
+    if (!/[A-Z]/.test(tok) || !/[a-z]/.test(tok)) continue;
+    try {
+      const padded = tok + "=".repeat((4 - tok.length % 4) % 4);
+      const bin = Buffer.from(padded, "base64");
+      const s = bin.toString("utf8");
+      if (s && isPrintable(s) && !seen.has(s)) {
+        seen.add(s);
+        out.push(s);
+      }
+    } catch {
+    }
+  }
+  return out;
+}
+var QUOTED_STR_RE = /('(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"|`(?:[^`\\]|\\.)*`)/g;
+var OUTPUT_CMDS = /* @__PURE__ */ new Set(["echo", "printf", "print"]);
+function stripStringLiterals(text) {
+  const m = text.match(/\s*([A-Za-z_][\w-]*|\/?[\w./-]+)\b/);
+  if (!m) return text;
+  const cmd = m[1].split("/").pop().toLowerCase();
+  if (!OUTPUT_CMDS.has(cmd)) return text;
+  return text.replace(QUOTED_STR_RE, "");
+}
+function decodeUrlAndNumeric(text) {
+  const out = [];
+  let s = text;
+  for (let i = 0; i < 3; i++) {
+    let nxt = s;
+    try {
+      nxt = decodeURIComponent(s);
+    } catch {
+      break;
+    }
+    if (nxt === s) break;
+    s = nxt;
+  }
+  if (s !== text) out.push(s);
+  if (/\\[0-7]{3}/.test(text)) {
+    let expanded = "";
+    try {
+      expanded = text.replace(/\\[0-7]{3}/g, (m) => String.fromCharCode(parseInt(m.slice(1), 8)));
+    } catch {
+    }
+    if (expanded && expanded !== text) out.push(expanded);
+  }
+  if (/\\x[0-9a-fA-F]{2}/.test(text)) {
+    let expanded = "";
+    try {
+      expanded = text.replace(/\\x[0-9a-fA-F]{2}/g, (m) => String.fromCharCode(parseInt(m.slice(2), 16)));
+    } catch {
+    }
+    if (expanded && expanded !== text) out.push(expanded);
+  }
+  return out;
+}
+function allCandidates(detail, max = 8) {
+  const shell = stripStringLiterals(detail);
+  const cands = [shell];
+  cands.push(...decodeBase64Literals(shell));
+  cands.push(...decodeUrlAndNumeric(shell));
+  cands.push(...decodeBase64Literals(detail));
+  cands.push(...decodeUrlAndNumeric(detail));
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const c of cands) {
+    if (seen.has(c) || c.length > 4096) continue;
+    seen.add(c);
+    out.push(c);
+    if (out.length >= max) break;
+  }
+  return out;
+}
+var STAGE_PRIORITY = ["EXFIL", "PRIVESC", "PERSIST", "SCAN", "LISTEN"];
+var PURPOSE_EXEC_RE = /subprocess\.\w+\s*\(|os\.system\s*\(|shell\s*=\s*True|\beval\s*\(|\bexec\s*\(|os\.popen\s*\(|\/exec\b/i;
+var LISTEN_LEAD_RE = /http\.server|flask\s+run|nohup\b|nc\s+-l|socat\s+TCP-LISTEN/i;
+var LISTEN_NOISE_RE = /shell\s*=\s*True|os\.system|subprocess\.(?:run|call|Popen)|\beval\s*\(|\bexec\s*\(/i;
+function matchStageAny(detail, stages) {
+  const cands = allCandidates(detail);
+  if (cands.length === 0) return "";
+  const shell = cands[0];
+  const hits = [];
+  for (const [name, pats] of Object.entries(stages)) {
+    for (const p of pats) {
+      p.lastIndex = 0;
+      if (p.test(shell)) {
+        hits.push(name);
+        break;
+      }
+    }
+  }
+  if (hits.length > 0) {
+    if (hits.length === 1) return hits[0];
+    if (hits.includes("EXEC") && PURPOSE_EXEC_RE.test(shell)) return "EXEC";
+    if (hits.includes("LISTEN") && LISTEN_LEAD_RE.test(shell) && !LISTEN_NOISE_RE.test(shell)) {
+      return "LISTEN";
+    }
+    for (const s of STAGE_PRIORITY) {
+      if (hits.includes(s)) return s;
+    }
+    if (hits.includes("EXEC")) return "EXEC";
+  }
+  for (const cand of cands.slice(1)) {
+    for (const [name, pats] of Object.entries(stages)) {
+      for (const p of pats) {
+        p.lastIndex = 0;
+        if (p.test(cand)) return name;
+      }
+    }
+  }
+  return "";
+}
 
 // src/engine/formal-engine/ltl.ts
 init_esm_shims();
@@ -6295,11 +6585,7 @@ function compileAps(apPatterns) {
 }
 function labelEvent(actionDetail) {
   if (!AP_RE) compileAps(loadMC().ap_patterns || {});
-  let candidates = [actionDetail];
-  try {
-    candidates = (init_decode(), __toCommonJS(decode_exports)).allCandidates(actionDetail);
-  } catch {
-  }
+  const candidates = allCandidates(actionDetail);
   const hits = /* @__PURE__ */ new Set();
   for (const [name, pats] of Object.entries(AP_RE || {})) {
     for (const c of candidates) {
@@ -6537,7 +6823,7 @@ function loadCrossSessionChains() {
   return CROSS_SESSION_CHAINS;
 }
 var CRED_FILE_RE = /(known_hosts|\.ssh|id_rsa|\/etc\/shadow|\/etc\/passwd|credentials)/i;
-var EXFIL_RE = /https?:\/\/|scp\s+.*@|rsync\s+.*@/i;
+var EXFIL_RE = /https?:\/\/(?!127\.\d+\.\d+\.\d+|0\.0\.0\.0|localhost|\[?::1\]?)[^\s]+|\bscp\s+.*@|\brsync\s+.*@/i;
 function checkCrossSessionChain(graph) {
   const violations = [];
   const nodes = allNodes(graph);
@@ -6626,7 +6912,7 @@ function checkSensitiveDataFlow(graph) {
     const n = nodes[i];
     if (tainted.has(i) && EXFIL_RE.test(n.actionDetail)) {
       violations.push({
-        propertyId: "sensitive-data-exfil",
+        propertyId: "sensitive-data-flow",
         reason: `\u654F\u611F\u6570\u636E\u4F20\u64AD\u5916\u4F20\uFF1A${tainted.get(i)} \u2192 ${n.sessionId}#${n.seq} \u7ECF\u5171\u4EAB\u8F7D\u4F53\u5916\u53D1`,
         riskLevel: "critical",
         path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
@@ -6638,9 +6924,67 @@ function checkSensitiveDataFlow(graph) {
 }
 var EBPF_NET_RE = /connect|sendto|network_connect/i;
 var REMOTE_RE = /to\s+\d+\.\d+\.\d+\.\d+|remote_addr/i;
-var PRIVESC_RE = /\bsudo\b|\bsu\b|chmod\s+u\s*\+\s*s|pkexec|setuid/i;
 var EXFIL_ACTION_RE = /\bcurl\b|\bwget\b|\bscp\b|\brsync\b|\brclone\b|\bftp\b|connect\s+.*\d+\.\d+\.\d+\.\d+|open\s+.*tcp|base64\s+.*\-o/i;
 var CRED_STRICT_RE = /(known_hosts|\.ssh|id_rsa|\.pem|\b\.key\b|\/etc\/shadow|\/etc\/passwd|\.aws\/credentials|credentials\.json|netrc|password|secrets?\.ya?ml|credentials?\s*(file|path)?\s*(=|\:)|\bconfig.*(password|token))/i;
+var INLINE_SHELL_RE = /(?:os\.system|os\.popen)\s*\(\s*['"]([^'"]+)['"]|subprocess\.[a-z_]+\(\s*\[([^\]]+)\]|subprocess\.[a-z_]+\(\s*['"]([^'"]+)['"]|(?:bash|sh|zsh)\s+-c\s*['"]([^'"]+)['"]/gi;
+function extractInlineShell(s) {
+  const out = [];
+  let m;
+  INLINE_SHELL_RE.lastIndex = 0;
+  while ((m = INLINE_SHELL_RE.exec(s)) !== null) {
+    let g = m[1] ?? m[2] ?? m[3] ?? m[4] ?? "";
+    if (/^["']/.test(g) && (/"\s*,/.test(g) || /'\s*,/.test(g))) {
+      g = g.replace(/['"\[\],]+/g, " ");
+    }
+    g = g.trim();
+    if (g) out.push(g);
+  }
+  return out;
+}
+var PKG_MGR = /* @__PURE__ */ new Set(["apt", "apt-get", "aptitude", "yum", "dnf", "pacman", "zypper", "apk", "brew"]);
+var SHELLS = /* @__PURE__ */ new Set(["bash", "sh", "zsh", "dash", "fish", "ksh", "csh", "tcsh", "nologin"]);
+function containsPrivesc(shell) {
+  if (!shell) return false;
+  for (const seg of shell.split(/\&\&|\|\||;|\n/)) {
+    const s = seg.trim();
+    if (!s) continue;
+    const toks = s.split(/\s+/);
+    const head = (toks[0] || "").toLowerCase();
+    const rest = toks.slice(1).join(" ");
+    if (head === "chmod" && /(?:u\+s|g\+s|[2-7][0-7]{3})/.test(rest)) return true;
+    if (head === "setcap" && /cap_/.test(rest)) return true;
+    if (head === "pkexec" || head === "doas") return true;
+    if (head === "sudo") {
+      if (/^-u\s+/.test(rest)) {
+        if (/^-u\s+root\b/.test(rest)) return true;
+        continue;
+      }
+      const m = /^(\S+)(.*)$/.exec(rest);
+      if (m) {
+        const nxt = m[1].toLowerCase();
+        const tail = m[2];
+        if (PKG_MGR.has(nxt)) continue;
+        if (SHELLS.has(nxt)) return true;
+        if (nxt === "-i" || nxt === "-s") return true;
+        if (nxt.startsWith("su")) return true;
+        if (nxt.startsWith("/") && /bin\/(?:bash|sh|zsh|dash|fish)$/.test(nxt)) return true;
+      }
+      if (/\/(?:usr\/(?:local\/)?bin|bin)\/(?:bash|sh|zsh|dash|fish)\b/.test(rest)) return true;
+      if (/\bchmod\s+(?:u\+s|g\+s|[2-7][0-7]{3})\b/.test(rest)) return true;
+      if (/\bsetcap\s+cap_\w+/.test(rest)) return true;
+      if (/\bvisudo\b/.test(rest)) return true;
+      if (/\bpasswd\s+root\b/.test(rest)) return true;
+      if (/\buseradd\b/.test(rest)) return true;
+    }
+    if (head === "su") {
+      if (!rest) return true;
+      if (/^-l?\s*$/.test(rest)) return true;
+      if (/^root\b/.test(rest) || /^-l?\s+root\b/.test(rest)) return true;
+    }
+  }
+  if (/\bset(?:uid|euid|gid|egid|reuid|regid|resuid|resgid)\s*\(/i.test(shell)) return true;
+  return false;
+}
 function isExfilNode(n) {
   if (n.stage === "EXFIL") return true;
   if (EXFIL_RE.test(n.actionDetail) && EXFIL_ACTION_RE.test(n.actionDetail)) return true;
@@ -6655,8 +6999,12 @@ function isCredNode(n) {
   return CRED_STRICT_RE.test(n.actionDetail);
 }
 function isPrivescNode(n) {
-  if (n.stage === "PRIVESC") return true;
-  return PRIVESC_RE.test(n.actionDetail);
+  const shell = stripStringLiterals(n.actionDetail);
+  if (containsPrivesc(shell)) return true;
+  for (const cmd of extractInlineShell(shell)) {
+    if (containsPrivesc(cmd)) return true;
+  }
+  return false;
 }
 function checkNeverExfilAfterPrivesc(graph) {
   const violations = [];
@@ -6677,7 +7025,7 @@ function checkNeverExfilAfterPrivesc(graph) {
     if (pre) {
       const post = nodes[firstEv];
       return [{
-        propertyId: "no-privesc-then-exfil",
+        propertyId: "no-exfil-after-privesc",
         reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\xAC\u25C7EXFIL)",
         riskLevel: "critical",
         path: [
@@ -6693,7 +7041,7 @@ function checkNeverExfilAfterPrivesc(graph) {
     for (let j = i + 1; j < nodes.length; j++) {
       if (isExfilNode(nodes[j])) {
         violations.push({
-          propertyId: "no-privesc-then-exfil",
+          propertyId: "no-exfil-after-privesc",
           reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\xAC\u25C7EXFIL)",
           riskLevel: "critical",
           path: [
@@ -6726,7 +7074,7 @@ function checkNeverExfilAfterCred(graph) {
     if (pre) {
       const post = nodes[firstEv];
       return [{
-        propertyId: "no-cred-then-exfil",
+        propertyId: "no-exfil-after-credential",
         reason: "\u8BFB\u53D6\u51ED\u636E\u540E\u51FA\u73B0\u5916\u4F20\uFF0C\u8FDD\u53CD \u25A1(CRED\u2192\xAC\u25C7EXFIL)",
         riskLevel: "critical",
         path: [
@@ -6742,7 +7090,7 @@ function checkNeverExfilAfterCred(graph) {
     for (let j = i + 1; j < nodes.length; j++) {
       if (isExfilNode(nodes[j])) {
         violations.push({
-          propertyId: "no-cred-then-exfil",
+          propertyId: "no-exfil-after-credential",
           reason: "\u8BFB\u53D6\u51ED\u636E\u540E\u51FA\u73B0\u5916\u4F20\uFF0C\u8FDD\u53CD \u25A1(CRED\u2192\xAC\u25C7EXFIL)",
           riskLevel: "critical",
           path: [
@@ -6812,7 +7160,7 @@ function checkLowIntegrityCommandExec(graph) {
     const n = nodes[i];
     if (lowAt.has(i) && isComputeNode(n)) {
       violations.push({
-        propertyId: "low-integrity-controls-command-exec",
+        propertyId: "low-integrity-command-exec",
         reason: `\u4F4E\u5B8C\u6574\u6027\u6570\u636E\u63A7\u5236\u547D\u4EE4\u6267\u884C\uFF1A${lowAt.get(i)} \u2192 ${n.sessionId}#${n.seq} \u6267\u884C\u4E0D\u53EF\u4FE1\u5185\u5BB9`,
         riskLevel: "critical",
         path: [{ sessionId: n.sessionId, seq: n.seq, detail: n.actionDetail.slice(0, 60) }]
@@ -6859,7 +7207,7 @@ function checkCrossSessionReachability(graph) {
       const srcIdx = Math.min(...sources);
       const srcDesc = nodes[srcIdx].actionDetail.slice(0, 40);
       violations.push({
-        propertyId: "cross-session-reachability",
+        propertyId: "low-integrity-reachability",
         reason: `\u4F4E\u5B8C\u6574\u6027\u6E90\u7ECF\u8DE8 session \u6570\u636E\u94FE\u591A\u8DF3\u5230\u8FBE\u5F53\u524D\u6267\u884C\uFF08\u6E90: ${srcDesc} \u2192 ${n.sessionId}#${n.seq}\uFF09`,
         riskLevel: "high",
         path: nodes.slice(-3).map((m) => ({ sessionId: m.sessionId, seq: m.seq, detail: m.actionDetail.slice(0, 60) }))
@@ -6911,17 +7259,17 @@ function checkSensitiveDataAggregation(graph) {
   return violations;
 }
 var ALL_PROPERTIES = [
-  { id: "cross-session-chain", check: checkCrossSessionChain },
-  { id: "sensitive-data-flow", check: checkSensitiveDataFlow },
-  { id: "cross-session-reachability", check: checkCrossSessionReachability },
-  { id: "no-privesc-then-exfil", check: checkNeverExfilAfterPrivesc },
-  { id: "no-cred-then-exfil", check: checkNeverExfilAfterCred },
+  { id: "cross-session-chain", check: checkCrossSessionChain, shortName: "P1" },
+  { id: "sensitive-data-flow", check: checkSensitiveDataFlow, shortName: "P2" },
+  { id: "low-integrity-reachability", check: checkCrossSessionReachability, shortName: "P3" },
+  { id: "no-exfil-after-privesc", check: checkNeverExfilAfterPrivesc, shortName: "P4" },
+  { id: "no-exfil-after-credential", check: checkNeverExfilAfterCred, shortName: "P5" },
   // L2.2 模型检测（通用 LTL 求值器，mc_rules.json 单一事实源；witness 语义见 ltl.ts）
-  { id: "mc-ltl-rules", check: checkMCRules },
-  // Rule 5 低完整性控制命令执行（integrity 维度，站点 L2.1 最有区分度的检测之一）
-  { id: "low-integrity-command-exec", check: checkLowIntegrityCommandExec },
-  // Rule 12 敏感数据聚合外传（egress 聚合 ≥2 事件源）
-  { id: "sensitive-data-aggregation", check: checkSensitiveDataAggregation }
+  { id: "mc-ltl-rules", check: checkMCRules, shortName: "P6" },
+  // P7 低完整性控制命令执行（integrity 维度，站点 L2.1 最有区分度的检测之一）
+  { id: "low-integrity-command-exec", check: checkLowIntegrityCommandExec, shortName: "P7" },
+  // P8 敏感数据聚合外传（egress 聚合 ≥2 事件源）
+  { id: "sensitive-data-aggregation", check: checkSensitiveDataAggregation, shortName: "P8" }
 ];
 
 // src/engine/formal-engine/engine.ts
@@ -6984,7 +7332,6 @@ var FormalEngine = class {
 // src/engine/formal-engine/stateful.ts
 init_esm_shims();
 init_rules_loader();
-init_decode();
 
 // src/engine/formal-engine/chain_state.ts
 init_esm_shims();
@@ -7123,7 +7470,7 @@ async function runAnalysis(input) {
             riskType: node.l1RiskType,
             confidence: 90,
             source: "heuristic_script_scan",
-            violatedLayers: ["1.1-script"]
+            violatedLayers: ["L1.2"]
           };
         }
       }
@@ -7241,7 +7588,7 @@ async function runAnalysis(input) {
             riskType: inlineJudgment.riskType,
             confidence: 90,
             source: "logic_rule",
-            violatedLayers: ["1.2"]
+            violatedLayers: ["L2.1"]
           };
         }
         return {
@@ -7274,7 +7621,7 @@ async function runAnalysis(input) {
         console.warn(
           `[AgentMoss] \u5F62\u5F0F\u5316\u9A8C\u8BC1 observe\uFF08\u53EA\u8BB0\u5F55\u4E0D\u62E6\u622A\uFF09: property=${v?.propertyId ?? "?"} risk=${v?.riskLevel ?? "?"} path_len=${v?.path?.length ?? 0} reason=${(v?.reason ?? "?").slice(0, 200)}`
         );
-        observedFormalLayers.push("2.4");
+        observedFormalLayers.push("L2.2");
       } else {
         return {
           allowed: false,
@@ -7283,7 +7630,7 @@ async function runAnalysis(input) {
           riskType: "formal_verification",
           confidence: 90,
           source: "formal_engine",
-          violatedLayers: ["2.4"]
+          violatedLayers: ["L2.2"]
         };
       }
     }
@@ -7300,7 +7647,7 @@ async function runAnalysis(input) {
           riskType: node.l2RiskType,
           confidence: 85,
           source: "logic_rule_script_scan",
-          violatedLayers: ["1.2-script"]
+          violatedLayers: ["L2.3"]
         };
       }
     }
@@ -7387,7 +7734,7 @@ async function runAnalysis(input) {
       riskType: "",
       confidence: 60,
       source: "llm_failure_fallback",
-      violatedLayers: ["3"]
+      violatedLayers: ["L3.1"]
     };
   }
   if (!llmResult.allowed && llmResult.confidence && llmResult.confidence >= 90 && _brainExtractor) {
@@ -7417,4 +7764,14 @@ export {
 //! 顺序即 fail-closed 短路优先级：verify 逐个执行，首个返回违规的性质成为
 //! first_violation，后续不再评估。调整顺序影响判定归属，须与 Python
 //! properties.py ALL_PROPERTIES 保持一致并双端测试确认。
+//!
+//! shortName（P1~P8 连续短名）与 id（语义化英文）对照（与 Python 一致）：
+//!   P1 cross-session-chain          跨会话组合链
+//!   P2 sensitive-data-flow          敏感数据传播
+//!   P3 low-integrity-reachability   低完整性数据流可达
+//!   P4 no-exfil-after-privesc       提权后禁外传
+//!   P5 no-exfil-after-credential    凭据后禁外传
+//!   P6 mc-ltl-rules                 LTL 模型检测
+//!   P7 low-integrity-command-exec   低完整性命令执行
+//!   P8 sensitive-data-aggregation   敏感数据聚合外传
 //# sourceMappingURL=coordinator.js.map