@kenhkl/agent-moss 0.15.2 → 0.15.5

package/dist/rules/l1_rules.json

@@ -7,7 +7,7 @@
       "reason": "检测到递归强制删除根目录 (rm -rf /)"
     },
     {
-      "pattern": "\\brm\\s+-[a-zA-Z]*[rf][a-zA-Z]*\\s+/(etc|var(?!/tmp)|home|usr|boot|root|opt|srv|sys|proc)\\b",
+      "pattern": "\\brm\\s+-[a-zA-Z]*[rf][a-zA-Z]*\\s+/(?:etc|var(?!/tmp)|usr|boot|root|opt|srv|sys|proc|home(?:/|/[A-Za-z0-9_.-]+/?)?(?=[\\s;|&\\\"']|$))",
       "risk_level": "critical",
       "risk_type": "script_execution",
       "reason": "检测到删除关键系统目录"
@@ -24,6 +24,12 @@
       "risk_type": "script_execution",
       "reason": "检测到强制删除文件 (rm -f /...)"
     },
+    {
+      "pattern": "\\bln\\s+(-[a-zA-Z]+\\s+)*(?:--\\s+)?-s[a-zA-Z]*\\s+(?:--\\s+)?(/(?![a-zA-Z0-9._~])|~/\\.\\.(?:\\s|$|\\\"|'|;|&|\\)|\\]|/)|~/(?![.a-zA-Z0-9_~-])|~/$|~(?:\\s|$|\\\"|'|;|&|\\)|\\])|\\$HOME/\\.\\.(?:\\s|$|\\\"|'|;|&|\\)|\\]|/)|\\$HOME/(?![.a-zA-Z0-9_~-])|\\$HOME/$|\\$HOME(?:\\s|$|\\\"|'|;|&|\\)|\\]))",
+      "risk_level": "high",
+      "risk_type": "file_access",
+      "reason": "检测到创建指向根目录/主目录本身的符号链接（symlink 逃逸原语：链接点进入后 ../ 可穿越到根/主目录层级，配合删除/写入实现越权）"
+    },
     {
       "pattern": "chmod\\s+(?:(?:-[a-zA-Z]*|--)\\s+)*[0-7]{0,3}7\\b",
       "risk_level": "critical",
@@ -67,16 +73,16 @@
       "reason": "检测到访问系统组密码文件 (/etc/gshadow)"
     },
     {
-      "pattern": "\\.ssh/id_rsa(?!\\.pub)",
+      "pattern": "dd\\s+if=/dev/zero.*\\bof\\s*=\\s*/(?:etc|var|usr|boot|root|opt|srv|sys|proc|home(?:/|/[A-Za-z0-9_.-]+/?)?(?=[\\s;|&\\\"']|$))",
       "risk_level": "critical",
-      "risk_type": "file_access",
-      "reason": "检测到访问 SSH 私钥文件 (.ssh/id_rsa)"
+      "risk_type": "script_execution",
+      "reason": "检测到磁盘清零写入关键系统目录 (dd if=/dev/zero of=/系统目录)"
     },
     {
-      "pattern": "dd\\s+if=/dev/zero.*\\bof\\s*=\\s*/(etc|var|home|usr|boot|root|opt|srv|sys|proc)\\b",
+      "pattern": "\\.ssh/id_rsa(?!\\.pub)",
       "risk_level": "critical",
-      "risk_type": "script_execution",
-      "reason": "检测到磁盘清零写入关键系统目录 (dd if=/dev/zero of=/系统目录)"
+      "risk_type": "file_access",
+      "reason": "检测到访问 SSH 私钥文件 (.ssh/id_rsa)"
     },
     {
       "pattern": "mkfs\\.\\w+\\s+/dev/(sd|hd|nvme|vd|loop|mapper|md|dm)\\S+",
@@ -150,6 +156,12 @@
       "risk_type": "script_execution",
       "reason": "检测到远程下载脚本到本地 (curl -o script.sh)，存在后续执行风险"
     },
+    {
+      "pattern": "base64\\s+-d\\s+.*\\|\\s*bash",
+      "risk_level": "high",
+      "risk_type": "sensitive_action",
+      "reason": "base64 解码执行（编码绕过，下载或读取内容后解码执行）"
+    },
     {
       "pattern": "(?:curl|wget)\\s+\\S+.*\\b(?:chmod|chown)\\s+\\+x\\b",
       "risk_level": "high",
@@ -256,7 +268,7 @@
       "pattern": "curl\\s+.*\\|\\s*bash",
       "risk_level": "high",
       "risk_type": "sensitive_action",
-      "reason": "curl pipe bash 执行 (user_rules)"
+      "reason": "curl pipe bash 执行（下载远程脚本直接执行）"
     },
     {
       "pattern": "curl\\s+.*\\|\\s*(sh|zsh|dash)",
@@ -276,12 +288,6 @@
       "risk_type": "script_execution",
       "reason": "eval 远程代码执行"
     },
-    {
-      "pattern": "base64\\s+-d\\s+.*\\|\\s*bash",
-      "risk_level": "high",
-      "risk_type": "sensitive_action",
-      "reason": "base64 解码执行 (user_rules)"
-    },
     {
       "pattern": "/dev/tcp/|bash\\s+-i\\s+>&",
       "risk_level": "critical",
@@ -335,6 +341,42 @@
       "risk_level": "critical",
       "risk_type": "script_execution",
       "reason": "检测到命令替换隐藏执行（$(...)/反引号载荷含写/执行命令），可能产生文件系统副作用"
+    },
+    {
+      "pattern": "\\biptables\\s+-(?:[A-Za-z]*[FPIX][A-Za-z]*|[A-Za-z]*[FPIX]\\b)",
+      "risk_level": "high",
+      "risk_type": "script_execution",
+      "reason": "检测到修改防火墙规则（iptables -F/-P/-I/-X），可能关闭安全防护或建立隧道（ATT&CK T1562.004）"
+    },
+    {
+      "pattern": "\\b(?:ssh|scp)\\b[^;\\n]{0,200}?StrictHostKeyChecking\\s*=\\s*(?:no|accept-new)",
+      "risk_level": "high",
+      "risk_type": "lateral_movement",
+      "reason": "检测到 SSH/SCP 跳过主机密钥验证（-o StrictHostKeyChecking=no），允许中间人攻击，可能用于横向移动"
+    },
+    {
+      "pattern": "\\bwget\\s+(?:-\\S+\\s+)*--post-(?:data|file)\\s*=\\s*(?:\\$\\([^)]+\\)|[^ ]+|\\\"[^\\\"]+\\\"|'[^']+')\\s+(?!https?://(?:127\\.|localhost))https?://[a-zA-Z0-9.-]+",
+      "risk_level": "high",
+      "risk_type": "data_exfiltration",
+      "reason": "检测到 wget --post-data/--post-file 向外部地址发送数据（可能为数据外传，回环地址除外）"
+    },
+    {
+      "pattern": "\\bcurl\\b(?:[^;\\n]|&(?![&\\s]))*-X\\s+POST\\b[^;\\n]*https?://(?!(?:127\\.|localhost|\\[::1\\]))[a-zA-Z0-9.-]+",
+      "risk_level": "high",
+      "risk_type": "data_exfiltration",
+      "reason": "检测到 curl -X POST 到外部地址（可能为数据外传，回环地址除外）"
+    },
+    {
+      "pattern": "\\bcurl\\b[^;&\\n]*-F\\s+\\S+[^;&\\n]*https?://(?!(?:127\\.|localhost|\\[::1\\]))[a-zA-Z0-9.-]+",
+      "risk_level": "high",
+      "risk_type": "data_exfiltration",
+      "reason": "检测到 curl -F 表单上传到外部地址（可能为数据外传，回环地址除外）"
+    },
+    {
+      "pattern": "[|]\\s*crontab\\b",
+      "risk_level": "high",
+      "risk_type": "sensitive_action",
+      "reason": "检测到通过管道安装 crontab 定时任务（cron 后门/持久化）"
     }
   ],
   "injection_detection": [
@@ -866,5 +908,6 @@
       "deny_mode": "deny_write",
       "scope": "home"
     }
-  ]
+  ],
+  "_comment": "\n2026-09-11 新增：iptables 防火墙规则修改（T1562.004）+ SSH 跳过密钥验证（横向移动），原在 user_rules.json 下沉至此——攻击形态清晰、可静态判定，user_rules 回归仅存用户自定义例外的本位。"
 }

package/dist/rules/mc_rules.json

@@ -1,5 +1,5 @@
 {
-  "_comment": "L2.2 模型检测规则单一事实源（Python + TS 共用）。原子命题正则 + LTL 公式（前缀 AST）。公式在事件迹位置 0 处评估：LTL 公式满足 = 攻击存在。对应站点 detection-l2-2.html 的 10 条 LTL + 5 条 CTL 规则（CTL 活性降级为 G(!φ) 安全不变量，见 docs/DETECTION_METHODS.md 5.4）。",
+  "_comment": "L2.2 模型检测规则单一事实源（Python + TS 共用）。原子命题正则 + LTL 公式（前缀 AST）。公式在事件迹位置 0 处评估：LTL 公式满足 = 攻击存在。对应站点 detection-l2-2.html 的 9 条 LTL + 5 条 CTL 规则（2026-09 移除 2 条单动作冗余：mc-ltl-010 F(install_persistence) 与 mc-ctl-001 F(clear_logs) —— 它们误伤正常运维，且攻击场景已由链式规则 006/007/008 覆盖）（CTL 活性降级为 G(!φ) 安全不变量，见 docs/DETECTION_METHODS.md 5.4）。",
   "ap_patterns": {
     "reads_credential": [
       "(?:cat|head|tail|less|more|sed|awk|strings|base64|dd)\\s+[^;&|\\n]*[~]?/\\.ssh(?:/[\\w.-]+)?\\b",
@@ -336,34 +336,6 @@
       "risk_level": "critical",
       "action": "block",
       "reason": "敏感数据→归档→外传（mc-ltl-009）"
-    },
-    {
-      "id": "mc-ltl-010",
-      "type": "ltl",
-      "formula": [
-        "F",
-        [
-          "ap",
-          "install_persistence"
-        ]
-      ],
-      "risk_level": "medium",
-      "action": "approval",
-      "reason": "持久化机制安装，需审批（mc-ltl-010）"
-    },
-    {
-      "id": "mc-ctl-001",
-      "type": "ltl",
-      "formula": [
-        "F",
-        [
-          "ap",
-          "clear_logs"
-        ]
-      ],
-      "risk_level": "critical",
-      "action": "block",
-      "reason": "安全不变量：任何情况不得清除日志（mc-ctl-001，AG(!clear_logs) 线性迹降级：违反 ⟺ 出现 clear_logs ⟺ F(clear_logs) 成立）"
     }
   ]
-}
+}

package/dist/rules/user_rules.json

@@ -1,77 +1,8 @@
 {
-  "sensitive_actions": [
-    {
-      "pattern": "写入系统文件",
-      "description": "写入 /etc, /usr, /boot 等系统目录下的文件"
-    },
-    {
-      "pattern": "发送外部邮件",
-      "description": "通过 email 工具发送邮件到外部地址"
-    },
-    {
-      "pattern": "危险 shell 命令",
-      "description": "执行 rm -rf, chmod 777, sudo 等危险命令"
-    },
-    {
-      "pattern": "修改全局配置",
-      "description": "修改系统级配置文件或环境变量"
-    },
-    {
-      "pattern": "支付操作",
-      "description": "涉及支付、转账等金融操作"
-    },
-    {
-      "pattern": "访问密钥文件",
-      "description": "访问 .ssh/id_rsa, .env, credentials 等密钥/凭证文件"
-    },
-    {
-      "pattern": "网络数据外传",
-      "description": "通过 HTTP/wget/curl 等方式将数据发送到外部服务器"
-    },
-    {
-      "pattern": "curl * -d *",
-      "description": "使用 curl 发送数据到外部服务器（可能为数据外传）"
-    },
-    {
-      "pattern": "curl * POST *",
-      "description": "使用 curl POST 请求发送数据到外部服务器"
-    },
-    {
-      "pattern": "wget *--post-data*",
-      "description": "使用 wget 发送 POST 数据到外部服务器"
-    },
-    {
-      "pattern": "crontab -e",
-      "description": "编辑定时任务（可能用于持久化后门）"
-    },
-    {
-      "pattern": "crontab -r",
-      "description": "删除定时任务（可能用于清除审计痕迹）"
-    },
-    {
-      "pattern": "* | crontab",
-      "description": "管道方式安装/修改定时任务（可能用于持久化后门）"
-    },
-    {
-      "pattern": "iptables -",
-      "description": "修改防火墙规则（可能用于关闭安全防护）"
-    },
-    {
-      "pattern": "ssh* -o StrictHostKeyChecking=no",
-      "description": "SSH 跳过主机密钥验证（可能用于横向移动）"
-    },
-    {
-      "pattern": "base64 -d * bash",
-      "description": "Base64 解码后执行（可能用于编码绕过）"
-    },
-    {
-      "pattern": "curl * | bash",
-      "description": "下载远程脚本并执行（远程代码执行风险）"
-    }
-  ],
+  "sensitive_actions": [],
   "sensitive_tools": [
     "eval",
     "exec",
     "system"
   ]
-}
+}

package/dist/server.js

@@ -1438,6 +1438,7 @@ __export(runtime_config_exports, {
   getRuntimeConfigPath: () => getRuntimeConfigPath,
   getScenarioRules: () => getScenarioRules,
   hasRuntimeConfig: () => hasRuntimeConfig,
+  invalidateRuntimeConfigCache: () => invalidateRuntimeConfigCache,
   isL2CategoryEnabled: () => isL2CategoryEnabled,
   isLayerEnabled: () => isLayerEnabled,
   loadRuntimeConfig: () => loadRuntimeConfig,
@@ -1456,7 +1457,7 @@ __export(runtime_config_exports, {
   updateSkillCategoryEnabled: () => updateSkillCategoryEnabled,
   updateSkillEnabled: () => updateSkillEnabled
 });
-import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync4, mkdirSync, unlinkSync, readdirSync as readdirSync3 } from "fs";
+import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync4, mkdirSync, unlinkSync, readdirSync as readdirSync3, statSync } from "fs";
 import { join as join3 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import { dirname as dirname3 } from "path";
@@ -1473,6 +1474,7 @@ function saveRuntimeConfig(config) {
   const dir = p.substring(0, p.lastIndexOf("/"));
   if (dir && !existsSync4(dir)) mkdirSync(dir, { recursive: true });
   writeFileSync(p, JSON.stringify(config, null, 2), "utf-8");
+  invalidateRuntimeConfigCache();
 }
 function emptyRuntimeConfig() {
   return {
@@ -1486,6 +1488,9 @@ function emptyRuntimeConfig() {
     scenario_rules: {}
   };
 }
+function invalidateRuntimeConfigCache() {
+  runtimeConfigCache = null;
+}
 function loadRuntimeConfig() {
   const p = getRuntimeConfigPath();
   if (!existsSync4(p)) {
@@ -1497,9 +1502,14 @@ function loadRuntimeConfig() {
     return seeded;
   }
   try {
+    const st = statSync(p);
+    const cacheKey = `${p}|${st.mtimeMs}|${st.size}`;
+    if (runtimeConfigCache && runtimeConfigCache.key === cacheKey) {
+      return runtimeConfigCache.value;
+    }
     const data = JSON.parse(readFileSync4(p, "utf-8"));
     const merged = mergeConfig(data, generateSourceDefaults());
-    return {
+    const result = {
       version: data.version || 1,
       layers: {
         L1_heuristic: data.layers?.L1_heuristic ?? true,
@@ -1513,6 +1523,8 @@ function loadRuntimeConfig() {
       agent_rules: merged.agent_rules || {},
       scenario_rules: merged.scenario_rules || {}
     };
+    runtimeConfigCache = { key: cacheKey, value: result };
+    return result;
   } catch {
     return emptyRuntimeConfig();
   }
@@ -2502,7 +2514,7 @@ function updateScenarioCategoryEnabled(scenarioId, category, enabled) {
   saveRuntimeConfig(runtime);
   return runtime;
 }
-var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DEFAULT_LAYERS, DENY_MODE_LABELS, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, SKILL_ID_RE;
+var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DEFAULT_LAYERS, DENY_MODE_LABELS, runtimeConfigCache, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, SKILL_ID_RE;
 var init_runtime_config = __esm({
   "src/infra/runtime-config.ts"() {
     "use strict";
@@ -2532,6 +2544,7 @@ var init_runtime_config = __esm({
       deny_read: "\u4EC5\u62E6\u622A\u8BFB\u53D6",
       deny_both: "\u8BFB\u5199\u5747\u62E6\u622A"
     };
+    runtimeConfigCache = null;
     _AGENTS_DIR_PROD = join3(__dirname4, "agents");
     _AGENTS_DIR_DEV = join3(__dirname4, "..", "..", "..", "agent_moss", "agents");
     _SCENARIOS_DIR_PROD = join3(__dirname4, "scenarios");
@@ -2826,6 +2839,56 @@ function isInlineScriptCommand(actionDetail) {
   const re = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
   return re.test(actionDetail);
 }
+function resolvePathTokens(segment) {
+  const out = [];
+  const low = segment.toLowerCase();
+  for (const m of low.matchAll(HOME_PREFIX_RE)) {
+    const prefix = m[0];
+    const endIdx = (m.index ?? 0) + m[0].length;
+    const tail = low.slice(endIdx);
+    if (!tail || !(tail[0] === "/" || tail[0] === " ")) {
+      out.push([prefix, prefix]);
+      continue;
+    }
+    const token = tail.trim().split(/\s+/)[0] || "";
+    if (!token.startsWith("/")) continue;
+    const cleaned = token.replace(/\/+$/, "").replace(/^['"]|['"]$/g, "");
+    const segments = cleaned.split("/").filter((s) => s && s !== ".");
+    if (!segments.some((s) => s === "..")) continue;
+    let depth = 0;
+    const kept = [];
+    let escaped = false;
+    for (const s of segments) {
+      if (s === "..") {
+        depth -= 1;
+        if (kept.length) kept.pop();
+        if (depth < 0) {
+          escaped = true;
+          depth = 0;
+        }
+      } else {
+        depth += 1;
+        kept.push(s);
+      }
+    }
+    let resolved = kept.length ? "~/" + kept.join("/") : "~";
+    if (escaped) resolved += "\uFF08\u26A0\uFE0F .. \u5F39\u6808\u8D85\u51FA\u4E3B\u76EE\u5F55\u6839\uFF0C\u5B9E\u9645\u76EE\u6807\u5728\u4E3B\u76EE\u5F55\u4E4B\u5916\uFF09";
+    out.push([prefix + token, resolved]);
+  }
+  return out;
+}
+function buildPathContext(actionDetail) {
+  if (!PATH_CONTEXT_TRIGGER_RE.test(actionDetail)) return "";
+  const stripped = stripLiteralTextSegments(actionDetail);
+  const lines = [];
+  for (const seg of splitCommandSegments(stripped)) {
+    for (const [raw, lex] of resolvePathTokens(seg)) {
+      lines.push(`- \u547D\u4EE4\u6BB5 \`${seg.trim().slice(0, 60)}\`\uFF1A\`${raw}\` \u8BCD\u6CD5\u89E3\u6790\u4E3A \`${lex}\``);
+    }
+  }
+  if (!lines.length) return "";
+  return "## \u8DEF\u5F84\u89E3\u6790\u4E8B\u5B9E\uFF08\u8BCD\u6CD5\u5206\u6790\uFF0C\u786E\u5B9A\u6027\u7ED3\u8BBA\uFF09\n" + lines.join("\n") + "\n\n## \u8FD0\u884C\u65F6\u672A\u9A8C\u8BC1\uFF08\u4F9B\u53C2\u8003\uFF0C\u975E\u4E8B\u5B9E\uFF09\n- \u5206\u6790\u5668\u4E0D\u8BFB\u6587\u4EF6\u7CFB\u7EDF\uFF1A\u65E0\u6CD5\u786E\u8BA4\u8DEF\u5F84\u4E2D\u7684\u4E2D\u95F4\u76EE\u5F55\u662F\u5426\u4E3A\u7B26\u53F7\u94FE\u63A5\uFF1B\u82E5\u4E2D\u95F4\u6BB5\u5728\u6267\u884C\u65F6\u662F\uFF08\u6216\u88AB\u66FF\u6362\u4E3A\uFF09\u6307\u5411\u4E3B\u76EE\u5F55\u5916\u7684\u8F6F\u94FE\uFF0C\u5B9E\u9645\u64CD\u4F5C\u76EE\u6807\u53EF\u80FD\u968F\u4E4B\u6539\u53D8\u3002\u8BCD\u6CD5\u89E3\u6790\u7ED3\u679C\u57FA\u4E8E\u6807\u51C6\u8DEF\u5F84\u8BED\u4E49\uFF0C\u4E0D\u5E94\u56E0\u731C\u6D4B\u300C\u89E3\u6790\u4F9D\u8D56\u67D0\u6BB5\u662F\u5426\u5B58\u5728\u300D\u800C\u5426\u5B9A\u5B83\u3002";
+}
 function stripLiteralTextSegments(actionDetail) {
   const writeScriptExec = />\s*[/~]\S*\.(sh|py|pl|rb)\b/.test(actionDetail) && /(?:&&|\|\||;|\n|\|)\s*(?:bash|sh|zsh|dash|python|perl|ruby|node)/.test(actionDetail);
   const pipeToInterpreter = /\|\s*(?:bash|sh|zsh|dash|python|perl|ruby|node)\b/.test(actionDetail);
@@ -3352,7 +3415,7 @@ function checkLateralMovement(actionDetail) {
   }
   return null;
 }
-var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES, HOME_TARGET_RE, HOME_ASSIGN_RE;
+var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, PATH_CONTEXT_TRIGGER_RE, HOME_PREFIX_RE, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES, HOME_TARGET_RE, HOME_ASSIGN_RE;
 var init_heuristic = __esm({
   "src/engine/heuristic.ts"() {
     "use strict";
@@ -3380,6 +3443,8 @@ var init_heuristic = __esm({
         description: c.reason
       }));
     })();
+    PATH_CONTEXT_TRIGGER_RE = /(?:^|[;&|]\s*)(?:rm|rmdir|unlink|ln|mv|cp|dd|truncate|shred|chmod|chown)\b/i;
+    HOME_PREFIX_RE = /(?:~|~(?=\/)|\$HOME\b|\$\{HOME\}|\/home\/[a-z0-9_.-]+)/gi;
     SENSITIVE_EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
     SEARCH_ACTION_PREFIXES = ["search-", "web-", "browser-", "query-", "websearch", "web_search"];
     HOME_TARGET_RE = /(?:^|[\s="'($])(?:~|(?:\$home|\$\{home\}))(?:\/(?:\.\*|\*|\.)?)?(?=[\s"';}|&)]|$)/i;
@@ -4672,7 +4737,7 @@ init_esm_shims();
 init_heuristic();
 init_logic_rules();
 init_inline_analyzer();
-import { statSync as statSync2, existsSync as existsSync9 } from "fs";
+import { statSync as statSync3, existsSync as existsSync9 } from "fs";
 import { resolve as resolve8, join as join6, isAbsolute as isAbsolute2 } from "path";
 import { homedir as homedir4 } from "os";
 
@@ -6333,7 +6398,7 @@ function extractInlineScriptPath(actionDetail) {
           try {
             const resolved = resolvePath2(tok.replace(/^['"]|['"]$/g, ""));
             if (existsSync9(resolved)) {
-              const stat = statSync2(resolved);
+              const stat = statSync3(resolved);
               if (stat.isFile()) return resolved;
             }
           } catch {
@@ -6347,7 +6412,7 @@ function extractInlineScriptPath(actionDetail) {
       try {
         const resolved = resolvePath2(p);
         if (existsSync9(resolved)) {
-          const stat = statSync2(resolved);
+          const stat = statSync3(resolved);
           if (stat.isFile()) return resolved;
         }
       } catch {
@@ -6363,7 +6428,7 @@ function extractInlineScriptPath(actionDetail) {
     try {
       resolved = resolvePath2(p);
       if (existsSync9(resolved)) {
-        const stat = statSync2(resolved);
+        const stat = statSync3(resolved);
         if (stat.isFile()) return resolved;
       }
     } catch {
@@ -6574,7 +6639,7 @@ async function runLLMAnalysis(input, previous) {
   } else {
     scriptAnalysis = analyzeScriptContent(input.aNext.actionType, input.aNext.actionDetail);
   }
-  const prompt = buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis, previous.skipL3Hints ?? "", scriptChainText);
+  const prompt = buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis, previous.skipL3Hints ?? "", scriptChainText, previous.pathContext ?? "");
   logPrompt(prompt, input.aNext, previous.llmLogPath);
   const result = await analyzeWithLLM(prompt, config);
   if (llmCache.size >= LLM_CACHE_MAX) {
@@ -6598,7 +6663,7 @@ ${prompt}
     console.warn("[AgentMoss] Failed to write LLM prompt to log:", e);
   }
 }
-function buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis, skipL3Hints = "", scriptChainText = "") {
+function buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis, skipL3Hints = "", scriptChainText = "", pathContext = "") {
   const skillsText = formatSkillsForPrompt(matchedSkills);
   const historyStr = input.actionHistory.map((h, i) => `${i + 1}. ${h.actionType}: ${h.actionDetail}`).join("\n") || "(\u65E0\u5386\u53F2\u64CD\u4F5C)";
   const promptHistoryText = formatPromptHistory(input.promptHistory);
@@ -6606,7 +6671,7 @@ function buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis,
   const hintsText = formatHints(previous);
   const securityJudgeTemplate = templates["security_judge"];
   if (securityJudgeTemplate) {
-    return securityJudgeTemplate.replaceAll("{prompt_session}", input.promptSession || "\uFF08\u672A\u63D0\u4F9B\uFF09").replaceAll("{prompt_history_text}", promptHistoryText).replaceAll("{action_history}", historyStr).replaceAll("{action_type}", input.aNext.actionType).replaceAll("{action_detail}", input.aNext.actionDetail).replaceAll("{reason}", input.reason || "\u672A\u8BF4\u660E").replaceAll("{skills_text}", skillsText).replaceAll("{hints_text}", hintsText).replaceAll("{script_analysis_text}", scriptAnalysisText).replaceAll("{skip_l3_hints}", skipL3Hints).replaceAll("{{", "{").replaceAll("}}", "}");
+    return securityJudgeTemplate.replaceAll("{prompt_session}", input.promptSession || "\uFF08\u672A\u63D0\u4F9B\uFF09").replaceAll("{prompt_history_text}", promptHistoryText).replaceAll("{action_history}", historyStr).replaceAll("{action_type}", input.aNext.actionType).replaceAll("{action_detail}", input.aNext.actionDetail).replaceAll("{reason}", input.reason || "\u672A\u8BF4\u660E").replaceAll("{skills_text}", skillsText).replaceAll("{hints_text}", hintsText).replaceAll("{script_analysis_text}", scriptAnalysisText).replaceAll("{skip_l3_hints}", skipL3Hints).replaceAll("{path_context}", pathContext || "\uFF08\u672C\u547D\u4EE4\u65E0\u4E3B\u76EE\u5F55\u76F8\u5173\u8DEF\u5F84\u6BB5\uFF0C\u4E0D\u9002\u7528\uFF09").replaceAll("{{", "{").replaceAll("}}", "}");
   }
   console.warn("[AgentMoss] security_judge template missing, using sparse fallback prompt");
   return `## \u5F53\u524D\u64CD\u4F5C\u4E0A\u4E0B\u6587
@@ -8989,6 +9054,21 @@ async function runAnalysis(input) {
     if ((effectiveResult.riskLevel === "high" || effectiveResult.riskLevel === "critical") && (!skipInlineFileAccess || isCredentialPath)) {
       return effectiveResult;
     }
+  } else {
+    if (isInlineScriptCmd || isLiteralTextCmd) {
+      const inlineJudgment = analyzeInlineScript(input.aNext.actionDetail);
+      if (inlineJudgment.actionable && !inlineJudgment.allowed) {
+        return {
+          allowed: false,
+          reason: inlineJudgment.reason,
+          riskLevel: inlineJudgment.riskLevel,
+          riskType: inlineJudgment.riskType,
+          confidence: 90,
+          source: "logic_rule",
+          violatedLayers: ["L2.1"]
+        };
+      }
+    }
   }
   if (isLogicRulesEnabled()) {
     const formalSessions = [];
@@ -9090,12 +9170,14 @@ async function runAnalysis(input) {
   }
   let llmResult;
   try {
+    const pathContext = buildPathContext(input.aNext.actionDetail);
     llmResult = await runLLMAnalysis(input, {
       heuristic: heuristicResult,
       logic: logicResult,
       skipL3Hints,
       scriptChain: scriptChain ?? void 0,
-      llmLogPath: input.llmLogPath
+      llmLogPath: input.llmLogPath,
+      pathContext
     });
   } catch (e) {
     const { getLLMFailMode: getLLMFailMode2 } = await Promise.resolve().then(() => (init_config(), config_exports));