@kenhkl/agent-moss 0.15.7 → 0.16.3

package/dist/cli.js

@@ -1,45 +1,24 @@
 #!/usr/bin/env node
 var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
-var __commonJS = (cb, mod) => function __require2() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // node_modules/tsup/assets/esm_shims.js
 import path from "path";
 import { fileURLToPath } from "url";
-var getFilename, getDirname, __dirname, __filename;
+var getFilename, getDirname, __dirname;
 var init_esm_shims = __esm({
   "node_modules/tsup/assets/esm_shims.js"() {
     "use strict";
     getFilename = () => fileURLToPath(import.meta.url);
     getDirname = () => path.dirname(getFilename());
     __dirname = /* @__PURE__ */ getDirname();
-    __filename = /* @__PURE__ */ getFilename();
   }
 });
 
@@ -127,278 +106,31 @@ var init_paths = __esm({
   }
 });
 
-// src/config.ts
-var config_exports = {};
-__export(config_exports, {
-  detectProvider: () => detectProvider,
-  getCustomRules: () => getCustomRules,
-  getLLMConfig: () => getLLMConfig,
-  getLLMFailMode: () => getLLMFailMode,
-  getProviderHeaders: () => getProviderHeaders,
-  getRetryConfig: () => getRetryConfig,
-  getTimeoutConfig: () => getTimeoutConfig,
-  isBrainEnabled: () => isBrainEnabled,
-  isFormalObserveMode: () => isFormalObserveMode,
-  isHeuristicEnabled: () => isHeuristicEnabled,
-  isLLMAvailable: () => isLLMAvailable,
-  isLogicRulesEnabled: () => isLogicRulesEnabled,
-  probeLLMConnection: () => probeLLMConnection,
-  updateLLMConfig: () => updateLLMConfig
-});
-import fs from "fs";
-import path2 from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-function loadConfigFile(filePath) {
-  try {
-    const raw = fs.readFileSync(filePath, "utf-8");
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-function resolveConfigPath() {
-  const envPath = process.env.AGENT_MOSS_CONFIG_PATH;
-  if (envPath) return envPath;
-  const userConfig = path2.join(getConfigDir(), "config.json");
-  if (fs.existsSync(userConfig)) return userConfig;
-  const defaultCandidates = [
-    path2.join(__dirname, "config.json.example"),
-    path2.join(__dirname, "..", "..", "agent_moss", "infra", "config.json.example")
-  ];
-  const defaultConfig = defaultCandidates.find((p) => fs.existsSync(p));
-  if (defaultConfig) {
-    const configDir = path2.dirname(userConfig);
-    fs.mkdirSync(configDir, { recursive: true });
-    const pkgConfig = loadConfigFile(defaultConfig);
-    const safeConfig = pkgConfig ? { ...pkgConfig, llm: { ...pkgConfig.llm, api_key: "" } } : {};
-    fs.writeFileSync(userConfig, JSON.stringify(safeConfig, null, 4), "utf-8");
-    console.log(`[AgentMoss] \u5DF2\u521B\u5EFA\u7528\u6237\u914D\u7F6E\u6587\u4EF6: ${userConfig}`);
-    console.log(`[AgentMoss] \u8BF7\u7F16\u8F91\u8BE5\u6587\u4EF6\u914D\u7F6E\u4F60\u7684 LLM API Key`);
-  }
-  return userConfig;
-}
-function loadLLMConfigFromFile(configPath) {
-  const data = loadConfigFile(configPath);
-  if (!data?.llm) return {};
-  const llm = data.llm;
-  return {
-    provider: llm.provider || "",
-    baseUrl: llm.base_url || "",
-    apiKey: llm.api_key || "",
-    model: llm.model || "",
-    temperature: llm.temperature ?? 0.1,
-    maxTokens: llm.max_tokens ?? 4096,
-    timeout: llm.timeout ?? 40
-  };
-}
-function loadTimeoutRetryFromFile(configPath) {
-  const data = loadConfigFile(configPath);
-  const t = data?.timeout ?? {};
-  const r = data?.retry ?? {};
-  return {
-    timeout: {
-      totalTimeout: Number(t.total_timeout ?? 90),
-      prompt1Timeout: Number(t.prompt1_timeout ?? 40),
-      prompt2Timeout: Number(t.prompt2_timeout ?? 20),
-      stepInterval: Number(t.step_interval ?? 0)
-    },
-    retry: {
-      maxRetries: Number(r.max_retries ?? 2),
-      retryInterval: Number(r.retry_interval ?? 2)
-    }
-  };
-}
-function getTimeoutConfig() {
-  return timeoutConfig;
-}
-function getRetryConfig() {
-  return retryConfig;
-}
-function wildcardToRegExp(pattern) {
-  return pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/\\\*/g, ".*");
-}
-function loadCustomRules() {
-  const rules = [];
-  try {
-    const raw = process.env.AGENT_MOSS_CUSTOM_RULES;
-    if (raw) {
-      const parsed = JSON.parse(raw);
-      if (Array.isArray(parsed)) {
-        for (const r of parsed) {
-          if (r && r.pattern && r.action) rules.push({ pattern: r.pattern, action: r.action, severity: r.severity || "high" });
-        }
-      }
-    }
-  } catch {
-  }
-  for (const rulesPath of USER_RULES_PATHS) {
-    try {
-      if (!fs.existsSync(rulesPath)) continue;
-      const data = JSON.parse(fs.readFileSync(rulesPath, "utf-8"));
-      const actions = Array.isArray(data?.sensitive_actions) ? data.sensitive_actions : [];
-      for (const r of actions) {
-        const p = r?.pattern;
-        if (!p) continue;
-        rules.push({ pattern: wildcardToRegExp(p), action: "Deny", severity: "high" });
-      }
-      break;
-    } catch {
-    }
-  }
-  return rules;
-}
-function getLLMConfig() {
-  return llmConfig;
-}
-function updateLLMConfig(partial) {
-  llmConfig = { ...llmConfig, ...partial };
-}
-function getCustomRules() {
-  return customRules;
-}
-function isLLMAvailable() {
-  if (process.env.AGENT_MOSS_DISABLE_LLM === "1") return false;
-  if (!layerEnabledOrDefault("L3_llm_analysis")) return false;
-  return llmConfig.apiKey.length > 0;
-}
-async function probeLLMConnection(timeoutMs = 8e3) {
-  if (!isLLMAvailable()) return false;
-  const OpenAI3 = (await import("openai")).default;
-  const config = getLLMConfig();
-  const provider = detectProvider(config.baseUrl, config.provider);
-  const extraHeaders = getProviderHeaders(provider);
-  const client = new OpenAI3({
-    baseURL: config.baseUrl,
-    apiKey: config.apiKey,
-    timeout: timeoutMs,
-    maxRetries: 0,
-    defaultHeaders: Object.keys(extraHeaders).length > 0 ? extraHeaders : void 0
-  });
-  try {
-    const resp = await client.chat.completions.create({
-      model: config.model,
-      messages: [{ role: "user", content: "ping" }],
-      max_tokens: 1
-    });
-    return !!(resp && resp.choices && resp.choices[0]);
-  } catch {
-    return false;
-  }
-}
-function getLLMFailMode() {
-  const val = (process.env.AGENT_MOSS_LLM_FAIL_MODE || "fail_open").toLowerCase();
-  return val === "fail_closed" ? "fail_closed" : "fail_open";
-}
-function detectProvider(baseUrl, providerHint = "") {
-  if (providerHint) {
-    const hint = providerHint.toLowerCase();
-    if (["claude", "anthropic"].includes(hint)) return "anthropic";
-    if (["google", "gemini"].includes(hint)) return "gemini";
-    if (["zai-coding-plan", "zhipu-coding-plan", "zhipuai-coding-plan"].includes(hint)) return "zai-coding-plan";
-    if (["zai", "z-ai", "z.ai", "zai-cn", "zai-china", "zhipu", "glm-cn", "bigmodel"].includes(hint)) return "zhipu";
-    if (["xai", "xai-grok"].includes(hint)) return "xai";
-    if (["minimax", "minimax-openai"].includes(hint)) return "minimax";
-    if (["minimax-anthropic"].includes(hint)) return "minimax-anthropic";
-    if (["other", "custom", "local"].includes(hint)) return "openai-compatible";
-    return hint;
-  }
-  const url = baseUrl.toLowerCase();
-  if (url.includes("openrouter.ai")) return "openrouter";
-  if (url.includes("api.openai.com")) return "openai";
-  if (url.includes("anthropic.com") || url.includes("api.anthropic.com")) return "anthropic";
-  if (url.includes("generativelanguage.googleapis.com") || url.includes("gemini")) return "gemini";
-  if (url.includes("api.deepseek.com")) return "deepseek";
-  if (url.includes("api.groq.com")) return "groq";
-  if (url.includes("api.mistral.ai")) return "mistral";
-  if (url.includes("api.together.xyz")) return "together";
-  if (url.includes("api.x.ai")) return "xai";
-  if (url.includes("api.minimaxi.com")) return "minimax";
-  if (url.includes("api-ai.gitcode.com")) return "gitcode";
-  if (url.includes("api.z.ai")) return "zai-coding-plan";
-  if (url.includes("open.bigmodel.cn") || url.includes("bigmodel")) return "zhipu";
-  if (url.includes(":11434")) return "ollama";
-  return "openai-compatible";
-}
-function getProviderHeaders(provider) {
-  return PROVIDER_HEADERS[provider] || {};
-}
-function isHeuristicEnabled() {
-  if (process.env.AGENT_MOSS_DISABLE_HEURISTIC === "1") return false;
-  return layerEnabledOrDefault("L1_heuristic");
-}
-function layerEnabledOrDefault(key) {
-  try {
-    const { isLayerEnabled: isLayerEnabled2 } = __require("../infra/runtime-config");
-    return isLayerEnabled2(key);
-  } catch {
-    return true;
-  }
-}
-function isBrainEnabled() {
-  return process.env.AGENT_MOSS_BRAIN_ENABLED === "1";
+// src/engine/shell-split.ts
+function hasCommandSubstitution(text) {
+  return CMD_SUBSTITUTION.test(text);
 }
-function isLogicRulesEnabled() {
-  if (process.env.AGENT_MOSS_DISABLE_LOGIC_RULES === "1") return false;
-  return layerEnabledOrDefault("L2_logic_rules");
+function splitCommandSegments(command) {
+  return command.split(CMD_SEPARATORS).map((s) => s.trim()).filter((s) => s.length > 0);
 }
-function isFormalObserveMode() {
-  return process.env.AGENT_MOSS_FORMAL_OBSERVE === "1";
+function extractFirstCommand(command) {
+  const segments = splitCommandSegments(command);
+  return segments.length ? segments[0] : "";
 }
-var timeoutConfig, retryConfig, llmConfig, __configModuleDir, USER_RULES_PATHS, customRules, PROVIDER_HEADERS;
-var init_config = __esm({
-  "src/config.ts"() {
+var CMD_SEPARATORS, CMD_SUBSTITUTION;
+var init_shell_split = __esm({
+  "src/engine/shell-split.ts"() {
     "use strict";
     init_esm_shims();
-    init_paths();
-    llmConfig = (() => {
-      const configPath = resolveConfigPath();
-      const fileConfig = fs.existsSync(configPath) ? loadLLMConfigFromFile(configPath) : {};
-      const tr = loadTimeoutRetryFromFile(configPath);
-      timeoutConfig = tr.timeout;
-      retryConfig = tr.retry;
-      return {
-        provider: process.env.AGENT_MOSS_LLM_PROVIDER || fileConfig.provider || "openai",
-        baseUrl: process.env.AGENT_MOSS_LLM_BASE_URL || fileConfig.baseUrl || "https://api.openai.com/v1",
-        apiKey: process.env.AGENT_MOSS_LLM_API_KEY || process.env.OPENAI_API_KEY || fileConfig.apiKey || "",
-        model: process.env.AGENT_MOSS_LLM_MODEL || fileConfig.model || "gpt-4o",
-        temperature: parseFloat(process.env.AGENT_MOSS_LLM_TEMPERATURE || String(fileConfig.temperature ?? "0.1")),
-        maxTokens: parseInt(process.env.AGENT_MOSS_LLM_MAX_TOKENS || String(fileConfig.maxTokens ?? "4096"), 10),
-        // 优先用 env，否则用 timeout 块的 prompt1Timeout（对齐 py）
-        timeout: parseInt(process.env.AGENT_MOSS_LLM_TIMEOUT || String(fileConfig.timeout ?? String(tr.timeout.prompt1Timeout)), 10)
-      };
-    })();
-    __configModuleDir = (() => {
-      try {
-        return path2.dirname(fileURLToPath2(import.meta.url));
-      } catch {
-        return typeof __dirname !== "undefined" ? __dirname : process.cwd();
-      }
-    })();
-    USER_RULES_PATHS = [
-      path2.join(__configModuleDir, "rules", "user_rules.json"),
-      // 源在 ts/src/rules（一般不存在）
-      path2.join(__configModuleDir, "..", "rules", "user_rules.json"),
-      // dist: dist/engine/../rules = dist/rules ✅
-      path2.join(__configModuleDir, "..", "..", "agent_moss", "rules", "user_rules.json")
-      // dev src: ts/src/../../agent_moss
-    ];
-    customRules = loadCustomRules();
-    PROVIDER_HEADERS = {
-      "openrouter": {
-        "HTTP-Referer": "shturl.cc/LlVD5pyWViHjM",
-        "X-OpenRouter-Title": "AgentMoss"
-      },
-      "xai": {
-        "HTTP-Referer": "shturl.cc/LlVD5pyWViHjM"
-      }
-    };
+    CMD_SEPARATORS = /\|\||&&|[|;&\n]/;
+    CMD_SUBSTITUTION = /\$\(|`|</;
   }
 });
 
 // src/engine/inline-analyzer.ts
 function isLiteralTextCommand(command) {
-  ECHO_CMD_RE.lastIndex = 0;
-  if (!ECHO_CMD_RE.test(command)) return false;
+  const segments = splitCommandSegments(command);
+  if (segments.length === 0 || segments.some((s) => !ECHO_SEG_RE.test(s))) return false;
   if (command.includes(">")) {
     let d = command.replace(/<=>|>=|<=|<>|=>/g, " ");
     d = d.replace(/(?:2|&|1)?\s*>\s*\/dev\/null\b/g, "");
@@ -488,14 +220,15 @@ function analyzeInlineScript(command) {
     riskType: "file_access"
   };
 }
-var INLINE_CODE_RE, ECHO_STRING_RE, ECHO_CMD_RE, READ_WRITE_KEYWORDS, WRITE_EXEC_CHAIN_PATTERNS, SHELL_RC_FRAGMENTS, SENSITIVE_PATH_FRAGMENTS, REDIRECT_TO_SENSITIVE_RE, DIR_TRAVERSAL_KEYWORDS;
+var INLINE_CODE_RE, ECHO_STRING_RE, ECHO_SEG_RE, READ_WRITE_KEYWORDS, WRITE_EXEC_CHAIN_PATTERNS, SHELL_RC_FRAGMENTS, SENSITIVE_PATH_FRAGMENTS, REDIRECT_TO_SENSITIVE_RE, DIR_TRAVERSAL_KEYWORDS;
 var init_inline_analyzer = __esm({
   "src/engine/inline-analyzer.ts"() {
     "use strict";
     init_esm_shims();
+    init_shell_split();
     INLINE_CODE_RE = /(?:python|python3|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cera][a-zA-Z]*\s+)"([^"\\]*(?:\\.[^"\\]*)*)"|'([^'\\]*(?:\\.[^'\\]*)*)'/gi;
     ECHO_STRING_RE = /\b(?:echo|printf)\s+"([^"\\]*(?:\\.[^"\\]*)*)"|\b(?:echo|printf)\s+'([^'\\]*(?:\\.[^'\\]*)*)'/gi;
-    ECHO_CMD_RE = /(?:^|\s|;|&&|\|\|)(?:echo|printf)\s/gi;
+    ECHO_SEG_RE = /^\s*(?:echo|printf)(?:\s|$)/i;
     READ_WRITE_KEYWORDS = [
       // 函数调用形态（关键词后跟 '('）
       "open(",
@@ -544,9 +277,34 @@ var init_inline_analyzer = __esm({
       "passthru",
       "shell_exec",
       "proc_open",
-      // Perl-Ruby
+      // Perl/Ruby
       "<stdin>",
-      "open my"
+      "open my",
+      // Node/JS（2026-09 补，与 Python _READ_WRITE_KEYWORDS 同步）：历史缺口 ——
+      // 识别表里一条 Node API 都没有，于是 node -e "require('fs').readFileSync('/etc/shadow')"
+      // 判为纯文本字面量 → 放行（真漏报）。
+      "readfilesync(",
+      "writefilesync(",
+      "appendfilesync(",
+      "unlinksync(",
+      "rmsync(",
+      "mkdirsync(",
+      "execsync(",
+      "spawnsync(",
+      "execfile",
+      "createreadstream",
+      "createwritestream",
+      "fs.read",
+      "fs.write",
+      "fs.promises",
+      "require('fs')",
+      'require("fs")',
+      "require('node:fs')",
+      'require("node:fs")',
+      "require('child_process')",
+      'require("child_process")',
+      "require('https')",
+      'require("https")'
     ];
     WRITE_EXEC_CHAIN_PATTERNS = [
       // echo/cat/printf "..." > file && bash/sh/python file
@@ -601,15 +359,53 @@ var init_inline_analyzer = __esm({
   }
 });
 
-// src/infra/rules-loader.ts
-import { readFileSync as readFileSync2, existsSync } from "fs";
-import { resolve, dirname, join as join2 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
-import { homedir as homedir2 } from "os";
-function dataRootDir() {
-  return process.env.AGENT_MOSS_DATA_DIR || join2(homedir2(), ".config", "agentmoss");
+// src/infra/runtime-config-bridge.ts
+function registerRuntimeConfigBridge(bridge) {
+  runtimeConfigBridge.current = bridge;
+}
+var runtimeConfigBridge;
+var init_runtime_config_bridge = __esm({
+  "src/infra/runtime-config-bridge.ts"() {
+    "use strict";
+    init_esm_shims();
+    runtimeConfigBridge = { current: null };
+  }
+});
+
+// src/infra/rules-loader.ts
+import { readFileSync as readFileSync2, existsSync } from "fs";
+import { resolve, dirname } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+function dataRootDir() {
+  return getDataRoot();
+}
+function overrideRulesDir() {
+  return resolve(dataRootDir(), "rules");
+}
+function warnOverride(name, path6, data) {
+  if (warnedOverride.has(path6)) return;
+  warnedOverride.add(path6);
+  console.warn(
+    `[AgentMoss] \u89C4\u5219\u6587\u4EF6\u88AB\u7528\u6237\u6570\u636E\u76EE\u5F55\u8986\u76D6: ${path6}\uFF08\u5185\u7F6E\u9ED8\u8BA4\u88AB\u5FFD\u7565\uFF09\u3002\u8BE5\u6587\u4EF6\u7531\u90E8\u7F72\u4FA7\u81EA\u884C\u7EF4\u62A4 \u2014\u2014 **\u5185\u7F6E\u89C4\u5219\u66F4\u65B0\u4E0D\u4F1A\u53CD\u6620\u5230\u5B83\u4E0A\u9762**\uFF1B\u5220\u9664\u8BE5\u6587\u4EF6\u5373\u6062\u590D\u5185\u7F6E\u89C4\u5219\u3002\u82E5\u53EA\u60F3\u9010\u6761\u542F\u505C/\u589E\u5220\uFF0C\u8BF7\u6539\u7528 runtime config\uFF08Console\uFF09\u3002`
+  );
+  const missing = (EXPECTED_KEYS[name] || []).filter((k) => !(k in data));
+  if (missing.length > 0) {
+    console.warn(
+      `\u26A0\uFE0F  [AgentMoss] \u8986\u76D6\u6587\u4EF6 ${path6} \u7F3A\u5C11\u9876\u5C42\u952E [${missing.join(", ")}] \u2014\u2014 \u5BF9\u5E94\u7C7B\u522B\u4F1A**\u4E00\u6761\u89C4\u5219\u90FD\u4E0D\u8DD1**\uFF08\u9759\u9ED8\u5931\u6548\uFF09\u3002\u82E5\u53EA\u60F3\u6539\u5176\u4E2D\u4E00\u7C7B\uFF0C\u8BF7\u5148\u62F7\u8D1D\u5B8C\u6574\u7684\u5185\u7F6E\u6587\u4EF6\u518D\u6539\u3002`
+    );
+  }
+}
+function overriddenRuleFiles() {
+  const out = [];
+  for (const name of Object.keys(EXPECTED_KEYS)) {
+    const p = resolve(overrideRulesDir(), name);
+    if (existsSync(p)) out.push(p);
+  }
+  return out;
 }
 function findRulesFile(name) {
+  const override = resolve(overrideRulesDir(), name);
+  if (existsSync(override)) return override;
   for (const dir of RULES_DIR_CANDS) {
     const p = resolve(dir, name);
     if (existsSync(p)) return p;
@@ -619,11 +415,16 @@ function findRulesFile(name) {
 function loadJson(name) {
   const p = findRulesFile(name);
   if (!p) return {};
+  const isOverride = p === resolve(overrideRulesDir(), name);
+  let data;
   try {
-    return JSON.parse(readFileSync2(p, "utf-8")) || {};
+    data = JSON.parse(readFileSync2(p, "utf-8")) || {};
   } catch {
+    if (isOverride) warnOverride(name, p, {});
     return {};
   }
+  if (isOverride) warnOverride(name, p, data);
+  return data;
 }
 function loadL1() {
   return loadJson("l1_rules.json");
@@ -638,8 +439,8 @@ function loadMC() {
   const mc = loadJson("mc_rules.json");
   const rules = mc.rules || [];
   try {
-    const rt = (init_runtime_config(), __toCommonJS(runtime_config_exports));
-    if (rules.length > 0 && typeof rt.hasRuntimeConfig === "function" && rt.hasRuntimeConfig()) {
+    const rt = runtimeConfigBridge.current;
+    if (rules.length > 0 && rt?.hasRuntimeConfig()) {
       const ltl = rt.loadRuntimeConfig()?.L2_2?.ltl_rules || {};
       const rtRules = ltl.rules || [];
       const enabledById = {};
@@ -657,16 +458,26 @@ function loadMC() {
 function loadToolRegistry() {
   return loadJson("tool_registry.json");
 }
-var __filename2, __dirname2, RULES_DIR_CANDS;
+var __filename2, __dirname2, EXPECTED_KEYS, warnedOverride, RULES_DIR_CANDS;
 var init_rules_loader = __esm({
   "src/infra/rules-loader.ts"() {
     "use strict";
     init_esm_shims();
-    __filename2 = fileURLToPath3(import.meta.url);
+    init_paths();
+    init_runtime_config_bridge();
+    __filename2 = fileURLToPath2(import.meta.url);
     __dirname2 = dirname(__filename2);
+    EXPECTED_KEYS = {
+      "l1_rules.json": ["dangerous_commands", "injection_detection", "sensitive_path_access"],
+      "l2_rules.json": ["intent_consistency", "password_modify_consent", "user_deletion_consent"],
+      "l3_rules.json": [],
+      "mc_rules.json": ["rules"],
+      "tool_registry.json": ["tools"]
+    };
+    warnedOverride = /* @__PURE__ */ new Set();
     RULES_DIR_CANDS = (() => {
       const cands = [
-        // 用户数据目录覆盖优先（与 Python rules_loader._load_json 的
+        // 用户数据目录覆盖优先（与 Python rules_loader.resolve_rules_file 的
         // <data_root>/rules/<name> 优先逻辑对齐）。用户安装 pip/npm 包后把自定义
         // mc_rules.json 放到 <data_root>/rules/ 即可覆盖内置默认，无需改源码。
         resolve(dataRootDir(), "rules"),
@@ -685,21 +496,455 @@ var init_rules_loader = __esm({
   }
 });
 
+// src/engine/platform-traits.ts
+function getPlatformTraits(osType) {
+  const accepted = acceptedOsValues(osType);
+  if (accepted.includes("windows")) return WINDOWS_TRAITS;
+  if (accepted.includes("macos")) return MACOS_TRAITS;
+  if (accepted.includes("harmony")) return HARMONY_TRAITS;
+  return LINUX_TRAITS;
+}
+var LINUX_TRAITS, WINDOWS_TRAITS, MACOS_TRAITS, HARMONY_TRAITS;
+var init_platform_traits = __esm({
+  "src/engine/platform-traits.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_logic_rules();
+    LINUX_TRAITS = {
+      writeKeywords: [
+        "write",
+        "\u5199\u5165",
+        "save",
+        "\u4FDD\u5B58",
+        "modify",
+        "\u4FEE\u6539",
+        "update",
+        "\u66F4\u65B0",
+        "delete",
+        "\u5220\u9664",
+        "remove",
+        "\u79FB\u9664",
+        "create",
+        "\u521B\u5EFA",
+        "append",
+        "\u8FFD\u52A0",
+        "truncate",
+        "\u622A\u65AD",
+        "overwrite",
+        "\u8986\u76D6",
+        "replace",
+        "\u66FF\u6362",
+        "edit"
+      ],
+      readKeywords: [
+        "read",
+        "\u8BFB\u53D6",
+        "cat",
+        "head",
+        "tail",
+        "less",
+        "more",
+        "view",
+        "\u67E5\u770B",
+        "open",
+        "\u6253\u5F00",
+        "load",
+        "\u52A0\u8F7D",
+        "grep",
+        "search",
+        "\u641C\u7D22",
+        "find",
+        "\u67E5\u627E"
+      ],
+      writeCommandRes: [
+        /\brm\b/,
+        /\bunlink\b/,
+        /\brmdir\b/,
+        /\bshred\b/,
+        /\bcp\b/,
+        /\bmv\b/,
+        /\binstall\b/,
+        /\btee\b/,
+        /\bdd\b/,
+        /\bmkfs\b/,
+        /\b(fdisk|parted|cfdisk|sfdisk)\b/,
+        /\bchmod\b/,
+        /\bchown\b/,
+        /\btruncate\b/
+      ],
+      readOnlyCommands: /* @__PURE__ */ new Set([
+        "cat",
+        "head",
+        "tail",
+        "less",
+        "more",
+        "grep",
+        "find",
+        "awk",
+        "sed",
+        "sort",
+        "uniq",
+        "wc",
+        "cut",
+        "strings",
+        "od",
+        "xxd",
+        "hexdump",
+        "tr",
+        "file",
+        "stat",
+        "du",
+        "df",
+        "ls",
+        "dir",
+        "tree",
+        "nl",
+        "tac",
+        "rev",
+        "echo",
+        "printf",
+        "lsblk",
+        "blockdev",
+        "smartctl",
+        "udevadm",
+        "dmidecode",
+        "lscpu",
+        "lspci",
+        "lsusb",
+        "lsmem",
+        "lsns",
+        "lsof",
+        "hwinfo",
+        "inxi",
+        "fdisk",
+        "parted",
+        "dmesg",
+        "journalctl",
+        "systemctl",
+        "hostnamectl",
+        "localectl",
+        "timedatectl",
+        "ps",
+        "top",
+        "free",
+        "vmstat",
+        "iostat",
+        "mpstat",
+        "pidof",
+        "pgrep",
+        "ip",
+        "ifconfig",
+        "route",
+        "ss",
+        "netstat",
+        "arp",
+        "ethtool",
+        "nmcli",
+        "uname",
+        "arch",
+        "nproc",
+        "getconf",
+        "getent",
+        "id",
+        "whoami",
+        "who",
+        "w",
+        "last",
+        "uptime",
+        "lsmod",
+        "modinfo",
+        "sysctl"
+      ]),
+      fullySafeCommands: [
+        /^ls(?:\s|$)/i,
+        /^dir(?:\s|$)/i,
+        /^pwd(?:\s|$)/i,
+        /^which\s+/i,
+        /^whereis\s+/i,
+        /^realpath\s+/i,
+        /^basename\s+/i,
+        /^dirname\s+/i,
+        /^file\s+/i,
+        /^stat\s+/i,
+        /^du(?:\s|$)/i,
+        /^echo\s+/i,
+        /^printf\s+/i,
+        /^type\s+/i,
+        /^command\s+/i,
+        // 系统信息查询（只读，不涉及文件/网络/权限）
+        /^whoami(?:\s|$)/i,
+        /^id(?:\s|$)/i,
+        /^hostname(?:\s|$)/i,
+        /^uname(?:\s|$)/i,
+        /^date(?:\s|$)/i,
+        /^env(?:\s|$)/i,
+        /^printenv(?:\s|$)/i,
+        /^tty(?:\s|$)/i,
+        /^arch(?:\s|$)/i,
+        /^uptime(?:\s|$)/i,
+        /^groups(?:\s|$)/i,
+        /^logname(?:\s|$)/i,
+        // 系统资源/硬件信息（只读，不读文件内容、无状态变更选项）
+        // 与上面 uptime/uname/id 同性质；缺了它们时开 L3 的部署每查一次磁盘/内存
+        // 都要走 LLM（实测 df -h 从 5ms 变成十几秒）。
+        /^df(?:\s|$)/i,
+        /^free(?:\s|$)/i,
+        /^vmstat(?:\s|$)/i,
+        /^nproc(?:\s|$)/i,
+        /^lscpu(?:\s|$)/i,
+        /^lsblk(?:\s|$)/i,
+        /^lspci(?:\s|$)/i,
+        /^lsusb(?:\s|$)/i,
+        /^lsmod(?:\s|$)/i
+      ],
+      readonlySensitiveCommands: [
+        /^cat\s+/i,
+        /^head(?:\s|$)/i,
+        /^tail(?:\s|$)/i,
+        /^less(?:\s|$)/i,
+        /^more(?:\s|$)/i,
+        /^wc(?:\s|$)/i,
+        /^grep(?:\s|$)/i,
+        /^find\s+/i,
+        /^ag(?:\s|$)/i,
+        /^rg(?:\s|$)/i,
+        /^awk\s+/i,
+        /^sed\s+/i,
+        /^cut\s+/i,
+        /^sort(?:\s|$)/i,
+        /^uniq(?:\s|$)/i,
+        // 进程/网络/打开文件信息：只读，但会暴露进程命令行、连接对端、打开的文件
+        // 路径，故只跳 L3、保留 L2（L1 敏感路径检测照常生效）。
+        /^ps(?:\s|$)/i,
+        /^ss(?:\s|$)/i,
+        /^netstat(?:\s|$)/i,
+        /^lsof(?:\s|$)/i,
+        // 只读子命令级白名单：匹配的是「第一段命令」而非首词（extractFirstCommand
+        // 按 | && || 切分），所以能精确到子命令。systemctl stop/disable 等不在此列。
+        /^systemctl\s+(?:status|is-active|is-enabled|is-failed|list-units|list-unit-files|list-dependencies|show|cat)\b/i,
+        /^service\s+\S+\s+status\b/i,
+        // journalctl 整族是只读的，但 --vacuum-*/--rotate/--flush/--sync 会删改日志，
+        // 用否定前瞻挡掉后再放行。注意前瞻里必须用 .* 扫描**整段**：只写 (?!\s+--...)
+        // 的话只看紧跟 journalctl 的第一个参数，
+        // `journalctl -u sshd --vacuum-size=100M` 就漏过去了。
+        /^journalctl\b(?!.*--(?:vacuum-size|vacuum-time|vacuum-files|rotate|flush|sync)\b)/i
+      ]
+    };
+    WINDOWS_TRAITS = {
+      writeKeywords: [
+        "write",
+        "\u5199\u5165",
+        "save",
+        "\u4FDD\u5B58",
+        "modify",
+        "\u4FEE\u6539",
+        "update",
+        "\u66F4\u65B0",
+        "delete",
+        "\u5220\u9664",
+        "remove",
+        "\u79FB\u9664",
+        "create",
+        "\u521B\u5EFA",
+        "append",
+        "\u8FFD\u52A0",
+        "overwrite",
+        "\u8986\u76D6",
+        "replace",
+        "\u66FF\u6362",
+        "set",
+        "\u8BBE\u7F6E"
+        // 注意：这里**不能放 `reg` / `注册表`**。关键词是子串包含匹配，放进去等于
+        // 「只要命令里出现 reg 字样就算写操作」——`reg query`（读）会被判成写，
+        // 进而误拦对 deny_write 路径的只读查询。注册表的写判定交给下面的
+        // writeCommandRes（只认写子命令）。两端语义必须一致。
+      ],
+      readKeywords: [
+        "read",
+        "\u8BFB\u53D6",
+        "type",
+        "findstr",
+        "dir",
+        "view",
+        "\u67E5\u770B",
+        "open",
+        "\u6253\u5F00",
+        "load",
+        "\u52A0\u8F7D",
+        "search",
+        "\u641C\u7D22",
+        "find",
+        "\u67E5\u627E",
+        "get",
+        "\u83B7\u53D6"
+      ],
+      // Windows 写/删命令：del/copy/move/xcopy/replace/rmdir/icacls/reg delete 等
+      writeCommandRes: [
+        /\b(del|erase)\b/,
+        /\brmdir\b/,
+        /\b(rd)\b/,
+        /\bcopy\b/,
+        /\b(xcopy|robocopy)\b/,
+        /\b(move|movefile)\b/,
+        /\breplace\b/,
+        /\bicacls\b/,
+        /\battrib\b/,
+        // 注册表：**只认写子命令**（对齐 Python WindowsProfile.write_command_res）。
+        // 此前是 /\breg\b/，把 reg query（读）也判成写 → 误拦对 deny_write 路径的只读查询。
+        // 写子命令 add/delete/copy/save/restore/import/load/unload；
+        // 读子命令 query/compare/export/flags/help 不在此列。
+        /\breg(?:\.exe)?\s+(?:add|delete|copy|save|restore|import|load|unload)\b/,
+        /\bformat\b/,
+        /\bdiskpart\b/,
+        /\bmkdir\b/,
+        /\bmd\b/,
+        /\bsetx\b/,
+        /\bwmic\b/
+      ],
+      // Windows 只读命令（重定向写判定用）：type/findstr/more/tree/dir 等
+      readOnlyCommands: /* @__PURE__ */ new Set([
+        "type",
+        "findstr",
+        "more",
+        "tree",
+        "dir",
+        "where",
+        "ver",
+        "cls",
+        "echo",
+        "help",
+        "fc",
+        "comp",
+        "find",
+        "sort",
+        "powershell",
+        "cmd",
+        "netstat",
+        "ipconfig",
+        "tasklist",
+        "systeminfo",
+        "driverquery",
+        "reg",
+        "wmic",
+        "whoami",
+        "hostname",
+        "getmac",
+        "query",
+        "w32tm",
+        "diskpart"
+      ]),
+      // Windows 完全安全命令（对齐 WindowsProfile.fully_safe_commands）
+      fullySafeCommands: [
+        /^dir(?:\s|$)/,
+        /^where\s+/,
+        /^echo\s+/,
+        /^cd(?:\s|$)/,
+        /^tree(?:\s|$)/,
+        /^help(?:\s|$)/,
+        /^cls(?:\s|$)/,
+        /^ver(?:\s|$)/,
+        // 系统信息查询（只读，不读文件内容、无状态变更选项），与 Linux 侧 df/free 对齐
+        /^whoami(?:\s|$)/,
+        /^hostname(?:\s|$)/,
+        /^systeminfo(?:\s|$)/,
+        /^tasklist(?:\s|$)/,
+        /^getmac(?:\s|$)/,
+        /^driverquery(?:\s|$)/,
+        /^netstat(?:\s|$)/
+      ],
+      // Windows 安全但可能访问敏感路径的命令（对齐 WindowsProfile.readonly_sensitive_commands）
+      readonlySensitiveCommands: [
+        /^type\s+/,
+        /^findstr\s+/,
+        // 只读子命令级白名单（匹配「第一段命令」而非首词）；
+        // sc create/delete/start/stop、reg add/delete/set 均不在此列。
+        /^sc\s+query\b/,
+        /^reg\s+query\b/
+      ]
+    };
+    MACOS_TRAITS = LINUX_TRAITS;
+    HARMONY_TRAITS = LINUX_TRAITS;
+  }
+});
+
 // src/engine/logic-rules.ts
-import * as fs2 from "fs";
-function _loadSensitivePathScope(scope) {
+import * as fs from "fs";
+function acceptedOsValues(osType) {
+  const t = String(osType || "").toLowerCase();
+  if (t === "windows") return ["windows"];
+  if (t === "macos" || t === "darwin" || t === "osx" || t === "mac") return ["linux", "macos"];
+  if (t === "harmony" || t === "hmos" || t === "openharmony" || t === "hongmeng") return ["linux", "harmony"];
+  return ["linux"];
+}
+function _loadSensitivePathScope(scope, osType = "linux") {
+  const accepted = acceptedOsValues(osType);
   const sps = loadL1().sensitive_path_access || [];
-  return sps.filter((sp) => sp.scope === scope).map((sp) => ({
+  return sps.filter((sp) => sp.scope === scope).filter((sp) => accepted.includes(String(sp.os || "linux").toLowerCase())).map((sp) => ({
     path: sp.path,
     riskLevel: sp.risk_level,
     desc: sp.desc,
     credential: sp.deny_mode === "deny_both" ? true : void 0,
-    dirDelOnly: sp.dir_del_only === true ? true : void 0
+    readOnly: sp.read_only === true || sp.deny_mode === "deny_read" ? true : void 0,
+    denyMode: sp.deny_mode || void 0,
+    dirDelOnly: sp.dir_del_only === true ? true : void 0,
+    // 保留条目的原始平台归属（非查询用的 osType）—— seed 分组去重用
+    os: String(sp.os || "linux").toLowerCase()
   }));
 }
-function isWriteOperation(actionType, actionDetail, writeKeywords = WRITE_KEYWORDS) {
+function _scopeOf(os4, path6) {
+  if (!_scopeIndex) {
+    _scopeIndex = /* @__PURE__ */ new Map();
+    for (const sp of loadL1().sensitive_path_access || []) {
+      const key = `${String(sp.os || "linux").toLowerCase()}|${sp.path}`;
+      if (!_scopeIndex.has(key)) _scopeIndex.set(key, sp.scope);
+    }
+  }
+  return _scopeIndex.get(`${String(os4 || "linux").toLowerCase()}|${path6}`) || "root";
+}
+function getSensitivePathsForOs(osType) {
+  const effective = runtimeConfigBridge.current?.effectiveSensitivePaths(osType);
+  if (effective) {
+    const root = [];
+    const home = [];
+    const credential = [];
+    for (const r of effective) {
+      const entry = {
+        path: r.path,
+        riskLevel: r.riskLevel,
+        desc: r.desc,
+        // ⚠️ 不要强制 credential：用户在 Console 把某条从 deny_both 改成 deny_write
+        // 之后，强制 credential 会让读操作仍被拦（改了不生效）。一律以 runtime 为准。
+        credential: r.credential === true ? true : void 0,
+        readOnly: r.readOnly === true ? true : void 0,
+        denyMode: r.denyMode || void 0,
+        dirDelOnly: r.dirDelOnly === true ? true : void 0
+      };
+      const scope = _scopeOf(r.os, r.path);
+      if (scope === "home") home.push(entry);
+      else if (scope === "credential") credential.push(entry);
+      else root.push(entry);
+    }
+    return { root, home, credential };
+  }
+  return getSensitivePathsForOsBuiltin(osType);
+}
+function getSensitivePathsForOsBuiltin(osType) {
+  const t = String(osType || "").toLowerCase();
+  if (t === "windows") {
+    return { root: ROOT_SENSITIVE_PATHS_WINDOWS, home: HOME_SENSITIVE_PATHS_WINDOWS, credential: CREDENTIAL_PATHS_WINDOWS };
+  }
+  if (t === "macos" || t === "darwin" || t === "osx" || t === "mac") {
+    return { root: ROOT_SENSITIVE_PATHS_MACOS, home: HOME_SENSITIVE_PATHS_MACOS, credential: CREDENTIAL_PATHS_MACOS };
+  }
+  if (t === "harmony" || t === "hmos" || t === "openharmony" || t === "hongmeng") {
+    return { root: ROOT_SENSITIVE_PATHS_HARMONY, home: HOME_SENSITIVE_PATHS_HARMONY, credential: CREDENTIAL_PATHS_HARMONY };
+  }
+  return { root: ROOT_SENSITIVE_PATHS, home: HOME_SENSITIVE_PATHS, credential: CREDENTIAL_PATHS };
+}
+function isWriteOperation(actionType, actionDetail, writeKeywords = WRITE_KEYWORDS, osType) {
   if (writeKeywords.some((kw) => actionType.includes(kw) || actionDetail.includes(kw))) return true;
-  if (WRITE_COMMAND_RES.some((rx) => rx.test(actionDetail))) return true;
+  const { writeCommandRes } = getPlatformTraits(osType);
+  if (writeCommandRes.some((rx) => rx.test(actionDetail))) return true;
   if (/\bsed\s+-[a-zA-Z]*i/i.test(actionDetail)) return true;
   for (const seg of actionDetail.split(/&&|\|\||;|\n/)) {
     const trimmed = seg.trim();
@@ -733,6 +978,12 @@ function isWriteOperation(actionType, actionDetail, writeKeywords = WRITE_KEYWOR
   }
   return false;
 }
+function getIntentPatternsForOs(osType) {
+  const effective = runtimeConfigBridge.current?.effectiveIntentPatterns(osType);
+  if (effective) return effective;
+  const accepted = acceptedOsValues(osType);
+  return INTENT_DEVIATION_PATTERNS.filter((p) => accepted.includes(p.os));
+}
 function matchDangerousAction(actionDetail, action) {
   if (/[^\x00-\x7f]/.test(action)) {
     return actionDetail.includes(action);
@@ -767,38 +1018,47 @@ function collectIntentTexts(promptSession, promptHistory) {
   }
   return deduped;
 }
-function runLogicCheck(input) {
+function checkIntentConsistency(input) {
+  const { aNext, promptSession, promptHistory } = input;
+  const actionDetail = aNext.actionDetail.toLowerCase();
+  const actionType = aNext.actionType.toLowerCase();
+  const EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
+  if (EXCLUDED_PREFIXES.some((p) => actionType.startsWith(p))) return null;
+  if (INLINE_SCRIPT_RE.test(actionDetail)) return null;
+  const intentTexts = collectIntentTexts(promptSession, promptHistory);
+  for (const pattern of getIntentPatternsForOs(input.osType)) {
+    const intentMatched = intentTexts.some(
+      (text) => pattern.intentKeywords.some((kw) => text.includes(kw))
+    );
+    const dangerousMatched = pattern.dangerousActions.some((kw) => matchDangerousAction(actionDetail, kw));
+    if (intentMatched && dangerousMatched) {
+      return {
+        allowed: false,
+        reason: pattern.reason,
+        riskLevel: "high",
+        riskType: "intent_deviation",
+        confidence: 85,
+        source: "logic_rule",
+        violatedLayers: ["L2.1"]
+      };
+    }
+  }
+  return null;
+}
+function runLogicCheck(input, opts) {
   const { actionHistory, aNext, cwd } = input;
   const actionDetail = aNext.actionDetail.toLowerCase();
   const actionType = aNext.actionType.toLowerCase();
   const resolvedCwd = cwd || "/";
   const EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
   const isExcludedType = EXCLUDED_PREFIXES.some((p) => actionType.startsWith(p));
-  const rbwResult = checkReadBeforeWrite(actionType, actionDetail, actionHistory, input.reason, resolvedCwd);
-  if (rbwResult) return rbwResult;
-  if (!isExcludedType) {
-    if (!INLINE_SCRIPT_RE.test(actionDetail)) {
-      const intentTexts = collectIntentTexts(input.promptSession, input.promptHistory);
-      for (const pattern of INTENT_DEVIATION_PATTERNS) {
-        const intentMatched = intentTexts.some(
-          (text) => pattern.intentKeywords.some((kw) => text.includes(kw))
-        );
-        const dangerousMatched = pattern.dangerousActions.some((kw) => matchDangerousAction(actionDetail, kw));
-        if (intentMatched && dangerousMatched) {
-          return {
-            allowed: false,
-            reason: pattern.reason,
-            riskLevel: "high",
-            riskType: "intent_deviation",
-            confidence: 85,
-            source: "logic_rule",
-            violatedLayers: ["L2.1"]
-          };
-        }
-      }
-    }
+  if (!opts?.skipReadBeforeWrite) {
+    const rbwResult = checkReadBeforeWrite(actionType, actionDetail, actionHistory, input.reason, resolvedCwd, input.osType);
+    if (rbwResult) return rbwResult;
   }
-  const indirectResult = checkIndirectFileAccess(actionType, actionDetail, resolvedCwd);
+  const intentResult = checkIntentConsistency(input);
+  if (intentResult) return intentResult;
+  const indirectResult = checkIndirectFileAccess(actionType, actionDetail, resolvedCwd, input.osType);
   if (indirectResult) return indirectResult;
   if (INLINE_SCRIPT_RE.test(actionDetail)) {
   } else if (containsPrivilegeEscalation(actionDetail)) {
@@ -821,9 +1081,9 @@ function runLogicCheck(input) {
       }
     }
   }
-  const pwdResult = checkPasswordConsent(actionType, actionDetail, actionHistory);
+  const pwdResult = checkPasswordConsent(actionType, actionDetail, actionHistory, input.osType);
   if (pwdResult) return pwdResult;
-  const userDelResult = checkUserDeletionConsent(actionType, actionDetail, actionHistory);
+  const userDelResult = checkUserDeletionConsent(actionType, actionDetail, actionHistory, input.osType);
   if (userDelResult) return userDelResult;
   const comboResult = checkComboChain(actionHistory, aNext.actionDetail);
   if (comboResult) return comboResult;
@@ -874,22 +1134,33 @@ function checkComboChain(actionHistory, actionDetailRaw) {
   }
   return null;
 }
-function extractFilePaths(text) {
+function extractFilePaths(text, osType) {
   const paths = [];
   const unixPaths = text.match(/(?:^|\s)(\/[^\s;|&><'"]+)/g);
   if (unixPaths) paths.push(...unixPaths.map((p) => p.trim()));
+  const isWindows = String(osType || "").toLowerCase() === "windows";
+  if (isWindows) {
+    const winPaths = text.match(/(?:^|\s)([A-Za-z]:[\\\/][^\s;|&><'"]+)/g);
+    if (winPaths) paths.push(...winPaths.map((p) => p.trim()));
+    const uncPaths = text.match(/(?:^|\s)(\\{2}[^\\\s]+(?:\\[^\s;|&><'"]*))/g);
+    if (uncPaths) paths.push(...uncPaths.map((p) => p.trim()));
+  }
   const textNoQuotes = text.replace(/'[^']*'|"[^"]*"/g, "");
   const kvPaths = textNoQuotes.match(/(?:=)(\/[^\s;|&><'"]+)/g);
   if (kvPaths) paths.push(...kvPaths.map((p) => p.replace(/^=/, "")));
   const quotedPaths = text.match(/["']\/([^"']+)["']/g);
   if (quotedPaths) paths.push(...quotedPaths.map((p) => p.replace(/["']/g, "")));
+  if (isWindows) {
+    const quotedWinPaths = text.match(/["']([A-Za-z]:[\\\/][^"']+)["']/g);
+    if (quotedWinPaths) paths.push(...quotedWinPaths.map((p) => p.replace(/["']/g, "")));
+  }
   return [...new Set(paths)];
 }
-function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, cwd) {
+function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, cwd, osType) {
   if (NON_WRITE_TOOL_PREFIXES.some((p) => actionType.startsWith(p))) return null;
   if (NON_WRITE_TOOLS.has(actionType)) return null;
   const isBashLike = actionType === "bash" || actionType === "executebash" || actionType === "terminal-executebash";
-  const isWrite = isBashLike ? isWriteOperation(actionType, actionDetail) : WRITE_KEYWORDS.some((kw) => actionType.includes(kw));
+  const isWrite = isBashLike ? isWriteOperation(actionType, actionDetail, void 0, osType) : getPlatformTraits(osType).writeKeywords.some((kw) => actionType.includes(kw));
   if (!isWrite) return null;
   const WRITE_CMDS = /* @__PURE__ */ new Set(["cp", "mv", "install", "tee", "dd", "truncate", "mkfs", "fdisk", "parted"]);
   if (isBashLike) {
@@ -933,7 +1204,7 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
     if (firstWord === "cd") {
       continue;
     }
-    if (READ_ONLY_COMMANDS.has(firstWord)) {
+    if (getPlatformTraits(osType).readOnlyCommands.has(firstWord)) {
       const segUnquoted = trimmed.replace(new RegExp(`>{1,2}\\s*(['"])([~./][^'"]+)\\1`, "g"), (_m, _q, p) => ">" + p);
       const segNoDevnull = segUnquoted.replace(DEVNULL_REDIRECT_RE, "");
       const segNoQuotes = segNoDevnull.replace(/'[^']*'|"[^"]*"/g, "");
@@ -941,7 +1212,7 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
       if (m) targetPaths.push(m[1] || m[2] || m[3]);
       continue;
     }
-    const segPaths = extractFilePaths(trimmed);
+    const segPaths = extractFilePaths(trimmed, osType);
     const segPathsFiltered = firstWord === "wget" || firstWord === "curl" ? segPaths.filter((p) => p !== "/dev/null") : segPaths;
     if (SOURCE_ARG_CMDS.has(firstWord)) {
       if (segPathsFiltered.length > 1) targetPaths.push(...segPathsFiltered.slice(1));
@@ -963,20 +1234,30 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
   for (const action of actionHistory) {
     const histDetail = action.actionDetail.toLowerCase();
     const histType = action.actionType.toLowerCase();
-    const isRead = READ_KEYWORDS.some((kw) => histType.includes(kw) || histDetail.includes(kw));
+    const isRead = getPlatformTraits(osType).readKeywords.some((kw) => histType.includes(kw) || histDetail.includes(kw));
     if (isRead) {
-      for (const p of extractFilePaths(histDetail)) {
+      for (const p of extractFilePaths(histDetail, osType)) {
         historyReadPaths.add(p);
       }
     }
   }
+  const TEMP_DIRS = ["/tmp/", "/var/tmp/", "/dev/shm/", "/run/"];
+  let filteredPaths = uniqueTargetPaths;
+  if (/\bdd\b/i.test(actionDetail) && /\bif=\/dev\/zero\b/i.test(actionDetail)) {
+    filteredPaths = uniqueTargetPaths.filter(
+      (p) => !TEMP_DIRS.some((td) => p.startsWith(td))
+    );
+  }
+  if (filteredPaths.length === 0) {
+    return null;
+  }
   const unreadPaths = [];
-  for (const path6 of uniqueTargetPaths) {
+  for (const path6 of filteredPaths) {
     const hasRead = [...historyReadPaths].some(
       (rp) => path6 === rp || path6.startsWith(rp) || rp.startsWith(path6)
     );
     if (!hasRead) {
-      let isCreate = !fs2.existsSync(path6);
+      let isCreate = !fs.existsSync(path6);
       if (!isCreate) {
         isCreate = CREATE_KEYWORDS.some((kw) => reason.toLowerCase().includes(kw) || actionDetail.includes(kw));
       }
@@ -998,14 +1279,18 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
   }
   return null;
 }
-function checkPasswordConsent(actionType, actionDetail, actionHistory) {
+function hasUserConsent(actionHistory) {
+  return actionHistory.some((h) => {
+    const t = String(h.actionType || "").toLowerCase();
+    return t === "ask_user_question" && String(h.output || "").trim().length > 0;
+  });
+}
+function checkPasswordConsent(actionType, actionDetail, actionHistory, osType) {
   if (actionType !== "bash") return null;
-  const isPasswordModify = PASSWORD_MODIFY_PATTERNS.some((p) => p.test(actionDetail));
+  const pwdPatterns = runtimeConfigBridge.current?.effectivePasswordPatterns(osType) ?? PASSWORD_MODIFY_PATTERNS;
+  const isPasswordModify = pwdPatterns.some((p) => p.test(actionDetail));
   if (!isPasswordModify) return null;
-  const hasConsent = actionHistory.some(
-    (h) => h.actionType.toLowerCase() === "ask_user_question" && h.actionDetail.trim().length > 0
-  );
-  if (hasConsent) return null;
+  if (hasUserConsent(actionHistory)) return null;
   return {
     allowed: false,
     reason: "\u6267\u884C\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u5BC6\u7801\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u5BC6\u7801\u4FEE\u6539\u98CE\u9669",
@@ -1016,14 +1301,12 @@ function checkPasswordConsent(actionType, actionDetail, actionHistory) {
     violatedLayers: ["L2.1"]
   };
 }
-function checkUserDeletionConsent(actionType, actionDetail, actionHistory) {
+function checkUserDeletionConsent(actionType, actionDetail, actionHistory, osType) {
   if (actionType !== "bash") return null;
-  const isUserDeletion = USER_DELETION_PATTERNS.some((p) => p.test(actionDetail));
+  const udPatterns = runtimeConfigBridge.current?.effectiveUserDeletionPatterns(osType) ?? USER_DELETION_PATTERNS;
+  const isUserDeletion = udPatterns.some((p) => p.test(actionDetail));
   if (!isUserDeletion) return null;
-  const hasConsent = actionHistory.some(
-    (h) => h.actionType.toLowerCase() === "ask_user_question" && h.actionDetail.trim().length > 0
-  );
-  if (hasConsent) return null;
+  if (hasUserConsent(actionHistory)) return null;
   return {
     allowed: false,
     reason: "\u6267\u884C\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u7528\u6237\u5220\u9664\u98CE\u9669",
@@ -1046,7 +1329,7 @@ function containsPrivilegeEscalation(actionDetail) {
   }
   return false;
 }
-function checkIndirectFileAccess(actionType, actionDetail, cwd) {
+function checkIndirectFileAccess(actionType, actionDetail, cwd, osType) {
   if (actionType !== "bash" && actionType !== "executebash" && actionType !== "terminal-executebash") {
     return null;
   }
@@ -1059,14 +1342,14 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
   if (!hasTraversal) {
     return null;
   }
-  const READ_KEYWORDS2 = ["read(", "readline", "readlines", "fread", "fgets", "load(", "getpass", "file_get_contents"];
+  const READ_KEYWORDS = ["read(", "readline", "readlines", "fread", "fgets", "load(", "getpass", "file_get_contents"];
   const WRITE_KEYWORDS2 = ["write(", "writelines", "fwrite", "file_put_contents"];
   const EXEC_KEYWORDS = ["system(", "exec(", "eval(", "popen(", "os.system", "os.popen", "subprocess", "os.exec", "os.spawn", "shell=true", "check_output", "check_call", "run(", "passthru", "shell_exec", "proc_open"];
   const OPEN_KEYWORDS = ["open(", "fopen("];
   const code = extractInlineCode(actionDetail);
   if (!code) return null;
   const codeLower = code.toLowerCase();
-  const hasAnyOp = READ_KEYWORDS2.some((kw) => codeLower.includes(kw)) || WRITE_KEYWORDS2.some((kw) => codeLower.includes(kw)) || EXEC_KEYWORDS.some((kw) => codeLower.includes(kw)) || OPEN_KEYWORDS.some((kw) => codeLower.includes(kw));
+  const hasAnyOp = READ_KEYWORDS.some((kw) => codeLower.includes(kw)) || WRITE_KEYWORDS2.some((kw) => codeLower.includes(kw)) || EXEC_KEYWORDS.some((kw) => codeLower.includes(kw)) || OPEN_KEYWORDS.some((kw) => codeLower.includes(kw));
   if (!hasAnyOp) {
     return null;
   }
@@ -1074,15 +1357,16 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
   const hasExec = EXEC_KEYWORDS.some((kw) => codeLower.includes(kw));
   const blockAllSensitive = hasWrite || hasExec;
   let actualFiles = [];
-  if (cwd && cwd !== "/") {
+  if (cwd) {
     try {
-      actualFiles = fs2.readdirSync(cwd);
+      actualFiles = fs.readdirSync(cwd);
     } catch {
     }
   }
   if (actualFiles.length > 0) {
-    for (const cp of CREDENTIAL_PATHS) {
-      const fname = cp.path.split("/").pop() || cp.path;
+    const { root: rootPaths, home: homePaths, credential: credentialPaths } = getSensitivePathsForOs(osType);
+    for (const cp of credentialPaths) {
+      const fname = cp.path.split(/[/\\]/).pop() || cp.path;
       if (actualFiles.some((f) => f === fname || f.toLowerCase() === fname.toLowerCase())) {
         return {
           allowed: false,
@@ -1097,8 +1381,8 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
       }
     }
     if (blockAllSensitive) {
-      for (const sp of [...ROOT_SENSITIVE_PATHS, ...HOME_SENSITIVE_PATHS]) {
-        const fname = sp.path.split("/").pop() || sp.path;
+      for (const sp of [...rootPaths, ...homePaths]) {
+        const fname = sp.path.split(/[/\\]/).pop() || sp.path;
         if (actualFiles.some((f) => f === fname || f.toLowerCase() === fname.toLowerCase())) {
           return {
             allowed: false,
@@ -1124,16 +1408,28 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
     violatedLayers: ["L2.1"]
   };
 }
-var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, WRITE_KEYWORDS, WRITE_COMMAND_RES, READ_ONLY_COMMANDS, DEVNULL_REDIRECT_RE, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
+var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, WRITE_KEYWORDS, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
 var init_logic_rules = __esm({
   "src/engine/logic-rules.ts"() {
     "use strict";
     init_esm_shims();
     init_inline_analyzer();
+    init_runtime_config_bridge();
     init_rules_loader();
+    init_platform_traits();
     ROOT_SENSITIVE_PATHS = _loadSensitivePathScope("root");
     HOME_SENSITIVE_PATHS = _loadSensitivePathScope("home");
     CREDENTIAL_PATHS = _loadSensitivePathScope("credential").map(({ path: path6, riskLevel, desc, dirDelOnly }) => ({ path: path6, riskLevel, desc, credential: true, dirDelOnly }));
+    ROOT_SENSITIVE_PATHS_WINDOWS = _loadSensitivePathScope("root", "windows");
+    HOME_SENSITIVE_PATHS_WINDOWS = _loadSensitivePathScope("home", "windows");
+    CREDENTIAL_PATHS_WINDOWS = _loadSensitivePathScope("credential", "windows").map(({ path: path6, riskLevel, desc, dirDelOnly }) => ({ path: path6, riskLevel, desc, credential: true, dirDelOnly }));
+    ROOT_SENSITIVE_PATHS_MACOS = _loadSensitivePathScope("root", "macos");
+    HOME_SENSITIVE_PATHS_MACOS = _loadSensitivePathScope("home", "macos");
+    CREDENTIAL_PATHS_MACOS = _loadSensitivePathScope("credential", "macos").map(({ path: path6, riskLevel, desc, dirDelOnly }) => ({ path: path6, riskLevel, desc, credential: true, dirDelOnly }));
+    ROOT_SENSITIVE_PATHS_HARMONY = _loadSensitivePathScope("root", "harmony");
+    HOME_SENSITIVE_PATHS_HARMONY = _loadSensitivePathScope("home", "harmony");
+    CREDENTIAL_PATHS_HARMONY = _loadSensitivePathScope("credential", "harmony").map(({ path: path6, riskLevel, desc, dirDelOnly }) => ({ path: path6, riskLevel, desc, credential: true, dirDelOnly }));
+    _scopeIndex = null;
     NON_WRITE_TOOLS = /* @__PURE__ */ new Set([
       "ask_user_question",
       "glob",
@@ -1155,111 +1451,7 @@ var init_logic_rules = __esm({
     ]);
     NON_WRITE_TOOL_PREFIXES = ["memory-", "skill-manager-", "mailbox-", "app-"];
     WRITE_KEYWORDS = ["write", "\u5199\u5165", "save", "\u4FDD\u5B58", "modify", "\u4FEE\u6539", "update", "\u66F4\u65B0", "delete", "\u5220\u9664", "remove", "\u79FB\u9664", "create", "\u521B\u5EFA", "append", "\u8FFD\u52A0", "truncate", "\u622A\u65AD", "overwrite", "\u8986\u76D6", "replace", "\u66FF\u6362", "edit"];
-    WRITE_COMMAND_RES = [
-      /\brm\b/,
-      /\bunlink\b/,
-      /\brmdir\b/,
-      /\bshred\b/,
-      /\bcp\b/,
-      /\bmv\b/,
-      /\binstall\b/,
-      /\btee\b/,
-      /\bdd\b/,
-      /\bmkfs\b/,
-      /\b(fdisk|parted|cfdisk|sfdisk)\b/,
-      /\bchmod\b/,
-      /\bchown\b/,
-      /\btruncate\b/
-    ];
-    READ_ONLY_COMMANDS = /* @__PURE__ */ new Set([
-      "cat",
-      "head",
-      "tail",
-      "less",
-      "more",
-      "grep",
-      "find",
-      "awk",
-      "sed",
-      "sort",
-      "uniq",
-      "wc",
-      "cut",
-      "strings",
-      "od",
-      "xxd",
-      "hexdump",
-      "tr",
-      "file",
-      "stat",
-      "du",
-      "df",
-      "ls",
-      "dir",
-      "tree",
-      "nl",
-      "tac",
-      "rev",
-      // NEW-FP-I: echo/printf 是文本输出命令，参数是字面量非写目标。加入此集让
-      // read_before_write 的 echo 段走只读命令分支（只提取重定向目标，不提取参数路径），
-      // 避免 echo "cat /etc/shadow" > /tmp/x.sh 的引号内 /etc/shadow 被当写目标误报。
-      // echo "x" > /tmp/x.sh 的重定向目标 /tmp/x.sh 仍被提取（真实写不漏报）。
-      "echo",
-      "printf",
-      "lsblk",
-      "blockdev",
-      "smartctl",
-      "udevadm",
-      "dmidecode",
-      "lscpu",
-      "lspci",
-      "lsusb",
-      "lsmem",
-      "lsns",
-      "lsof",
-      "hwinfo",
-      "inxi",
-      "fdisk",
-      "parted",
-      "dmesg",
-      "journalctl",
-      "systemctl",
-      "hostnamectl",
-      "localectl",
-      "timedatectl",
-      "ps",
-      "top",
-      "free",
-      "vmstat",
-      "iostat",
-      "mpstat",
-      "pidof",
-      "pgrep",
-      "ip",
-      "ifconfig",
-      "route",
-      "ss",
-      "netstat",
-      "arp",
-      "ethtool",
-      "nmcli",
-      "uname",
-      "arch",
-      "nproc",
-      "getconf",
-      "getent",
-      "id",
-      "whoami",
-      "who",
-      "w",
-      "last",
-      "uptime",
-      "lsmod",
-      "modinfo",
-      "sysctl"
-    ]);
     DEVNULL_REDIRECT_RE = /(?:2|&|1)?\s*>\s*\/dev\/null\b/g;
-    READ_KEYWORDS = ["read", "\u8BFB\u53D6", "cat", "head", "tail", "less", "more", "view", "\u67E5\u770B", "open", "\u6253\u5F00", "load", "\u52A0\u8F7D", "grep", "search", "\u641C\u7D22", "find", "\u67E5\u627E"];
     CREATE_KEYWORDS = ["\u521B\u5EFA", "\u65B0\u5EFA", "create", "new file", "touch"];
     PASSWORD_MODIFY_PATTERNS = (() => {
       const pats = loadL2().password_modify_consent || [];
@@ -1274,7 +1466,8 @@ var init_logic_rules = __esm({
       return pats.map((p) => ({
         intentKeywords: p.intent_keywords,
         dangerousActions: p.dangerous_actions,
-        reason: p.reason
+        reason: p.reason,
+        os: String(p.os || "linux").toLowerCase()
       }));
     })();
     COMBO_STAGES = (() => {
@@ -1334,9 +1527,9 @@ var init_asset_dir = __esm({
 });
 
 // src/engine/skill-loader.ts
-import { readFileSync as readFileSync3, readdirSync as readdirSync2 } from "fs";
+import { readFileSync as readFileSync3, readdirSync as readdirSync2, existsSync as existsSync4 } from "fs";
 import { resolve as resolve3, dirname as dirname2 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
+import { fileURLToPath as fileURLToPath3 } from "url";
 function loadAllSkills() {
   if (cachedSkills) return cachedSkills;
   cachedSkills = {};
@@ -1354,14 +1547,47 @@ function loadAllSkills() {
   console.log(`[AgentMoss] Loaded ${Object.keys(cachedSkills).length} skills from ${dir}`);
   return cachedSkills;
 }
+function userSkillsDir() {
+  return resolve3(getDataRoot(), "agent_moss_skills");
+}
+function runtimeCustomSkillKeywords() {
+  try {
+    const rt = runtimeConfigBridge.current?.loadRuntimeConfig?.();
+    if (!rt) return {};
+    const out = {};
+    for (const cat of Object.values(rt.L3_skills || {})) {
+      if (!cat || typeof cat !== "object" || cat.category_enabled === false) continue;
+      for (const sk of cat.skills || []) {
+        if (!sk || sk.builtin !== false || sk.enabled === false || !sk.id) continue;
+        out[sk.id] = sk.keywords || [];
+      }
+    }
+    return out;
+  } catch {
+    return {};
+  }
+}
+function loadUserSkill(name) {
+  if (userSkillCache[name] !== void 0) return userSkillCache[name];
+  try {
+    const p = resolve3(userSkillsDir(), `${name}.md`);
+    userSkillCache[name] = existsSync4(p) ? readFileSync3(p, "utf-8") : "";
+  } catch {
+    userSkillCache[name] = "";
+  }
+  return userSkillCache[name];
+}
 function matchSkills(actionType, actionDetail, reason, maxSkills = 3) {
   const skills = loadAllSkills();
   const combined = `${actionType} ${actionDetail} ${reason}`.toLowerCase();
   const actionDetailLower = actionDetail.toLowerCase();
   const actionTypeLower = actionType.toLowerCase();
   const reasonLower = reason.toLowerCase();
+  const disabledSkillIds = runtimeConfigBridge.current?.disabledSkillIds() ?? /* @__PURE__ */ new Set();
+  const skillMap = { ...SKILL_KEYWORD_MAP, ...runtimeCustomSkillKeywords() };
   const scores = {};
-  for (const [skillName, keywords] of Object.entries(SKILL_KEYWORD_MAP)) {
+  for (const [skillName, keywords] of Object.entries(skillMap)) {
+    if (disabledSkillIds.has(skillName)) continue;
     let score = 0;
     for (const kw of keywords) {
       if (combined.includes(kw)) {
@@ -1378,7 +1604,7 @@ function matchSkills(actionType, actionDetail, reason, maxSkills = 3) {
   const maxScore = top[0]?.[1] || 1;
   const results = [];
   for (const [name, score] of top) {
-    const content = skills[name];
+    const content = skills[name] || loadUserSkill(name);
     if (content) {
       results.push({
         skillName: name,
@@ -1403,14 +1629,16 @@ function formatSkillsForPrompt(skills) {
 ${s.skillContent}`
   ).join("\n\n---\n\n");
 }
-var __filename3, __dirname3, SKILL_KEYWORD_MAP, cachedSkills;
+var __filename3, __dirname3, SKILL_KEYWORD_MAP, cachedSkills, userSkillCache;
 var init_skill_loader = __esm({
   "src/engine/skill-loader.ts"() {
     "use strict";
     init_esm_shims();
     init_rules_loader();
+    init_paths();
     init_asset_dir();
-    __filename3 = fileURLToPath4(import.meta.url);
+    init_runtime_config_bridge();
+    __filename3 = fileURLToPath3(import.meta.url);
     __dirname3 = dirname2(__filename3);
     SKILL_KEYWORD_MAP = (() => {
       const map = {};
@@ -1424,6 +1652,7 @@ var init_skill_loader = __esm({
       return map;
     })();
     cachedSkills = null;
+    userSkillCache = {};
   }
 });
 
@@ -1440,6 +1669,12 @@ __export(runtime_config_exports, {
   deleteCustomRule: () => deleteCustomRule,
   deleteCustomSkill: () => deleteCustomSkill,
   deleteScenarioRule: () => deleteScenarioRule,
+  effectiveDangerousPatterns: () => effectiveDangerousPatterns,
+  effectiveInjectionKeywords: () => effectiveInjectionKeywords,
+  effectiveIntentPatterns: () => effectiveIntentPatterns,
+  effectivePasswordPatterns: () => effectivePasswordPatterns,
+  effectiveSensitivePaths: () => effectiveSensitivePaths,
+  effectiveUserDeletionPatterns: () => effectiveUserDeletionPatterns,
   filterEnabledRules: () => filterEnabledRules,
   generateSourceDefaults: () => generateSourceDefaults,
   getAgentRules: () => getAgentRules,
@@ -1483,9 +1718,9 @@ __export(runtime_config_exports, {
   updateSkillCategoryEnabled: () => updateSkillCategoryEnabled,
   updateSkillEnabled: () => updateSkillEnabled
 });
-import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync4, mkdirSync, unlinkSync, readdirSync as readdirSync3, statSync } from "fs";
+import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync5, mkdirSync, unlinkSync, readdirSync as readdirSync3, statSync } from "fs";
 import { join as join3 } from "path";
-import { fileURLToPath as fileURLToPath5 } from "url";
+import { fileURLToPath as fileURLToPath4 } from "url";
 import { dirname as dirname3 } from "path";
 function runtimeDir() {
   return getRuntimeConfigDir();
@@ -1498,7 +1733,7 @@ function getRuntimeConfigPath() {
 function saveRuntimeConfig(config) {
   const p = getRuntimeConfigPath();
   const dir = p.substring(0, p.lastIndexOf("/"));
-  if (dir && !existsSync4(dir)) mkdirSync(dir, { recursive: true });
+  if (dir && !existsSync5(dir)) mkdirSync(dir, { recursive: true });
   writeFileSync(p, JSON.stringify(config, null, 2), "utf-8");
   invalidateRuntimeConfigCache();
 }
@@ -1516,10 +1751,11 @@ function emptyRuntimeConfig() {
 }
 function invalidateRuntimeConfigCache() {
   runtimeConfigCache = null;
+  hasRuntimeConfigCache.clear();
 }
 function loadRuntimeConfig() {
   const p = getRuntimeConfigPath();
-  if (!existsSync4(p)) {
+  if (!existsSync5(p)) {
     const seeded = mergeConfig({}, generateSourceDefaults());
     try {
       saveRuntimeConfig(seeded);
@@ -1540,7 +1776,13 @@ function loadRuntimeConfig() {
       layers: {
         L1_heuristic: data.layers?.L1_heuristic ?? true,
         L2_logic_rules: data.layers?.L2_logic_rules ?? true,
-        L3_llm_analysis: data.layers?.L3_llm_analysis ?? true
+        L3_llm_analysis: data.layers?.L3_llm_analysis ?? true,
+        // ⚠️ agent_rules_enabled / scenario_rules_enabled 必须一并带上：
+        // isLayerEnabled 的判据是 `layerKey in layers`，键丢了就恒真，
+        // 于是控制台的「agent 规则 / 场景规则」总开关**永远是开**（点了没反应）。
+        // 这两个键本来就写在 seed 里（DEFAULT_LAYERS），只是这里没透传。
+        agent_rules_enabled: data.layers?.agent_rules_enabled ?? true,
+        scenario_rules_enabled: data.layers?.scenario_rules_enabled ?? true
       },
       L1_rules: merged.L1_rules || {},
       L2_rules: merged.L2_rules || {},
@@ -1582,21 +1824,48 @@ function filterEnabledRules(rules, categoryEnabled = true) {
   if (!categoryEnabled) return [];
   return rules.filter((r) => r.enabled !== false);
 }
-function getEnabledL1CommandPatterns(runtime) {
+function _filterRulesByOs(rules, osType) {
+  const accepted = acceptedOsValues(osType);
+  return rules.filter((r) => accepted.includes(String(r.os || "linux").toLowerCase()));
+}
+function _userCustomRules(runtime, layers, requiredKey) {
+  const list = Array.isArray(layers) ? layers : [layers];
+  const out = [];
+  for (const layer of list) {
+    const cat = runtime?.[layer]?.user_custom;
+    const rules = filterEnabledRules(cat?.rules || [], cat?.category_enabled);
+    for (const r of rules) {
+      if (!r[requiredKey]) continue;
+      out.push(r.risk_level ? r : { ...r, risk_level: "high" });
+    }
+  }
+  return out;
+}
+function _mergeUserCustom(primary, runtime, layers, key) {
+  const extra = _userCustomRules(runtime, layers, key);
+  return extra.length > 0 ? [...primary, ...extra] : [...primary];
+}
+function getEnabledL1CommandPatterns(runtime, osType) {
   const cat = runtime.L1_rules?.dangerous_commands || { category_enabled: true, rules: [] };
-  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => ({
+  let rules = filterEnabledRules(cat.rules || [], cat.category_enabled);
+  rules = _mergeUserCustom(rules, runtime, "L1_rules", "pattern");
+  if (osType) rules = _filterRulesByOs(rules, osType);
+  return rules.map((r) => ({
     pattern: r.pattern || "",
     risk_level: r.risk_level || "",
     risk_type: r.risk_type || "",
     reason: r.reason || ""
   }));
 }
-function getEnabledL2SensitivePaths(runtime) {
+function getEnabledL2SensitivePaths(runtime, osType) {
   let cat = runtime.L1_rules?.sensitive_path_access;
   if (!cat || !cat.rules || cat.rules.length === 0) {
     cat = runtime.L2_rules?.sensitive_path_access || { category_enabled: true, rules: [] };
   }
-  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => {
+  let rules = filterEnabledRules(cat.rules || [], cat.category_enabled);
+  rules = _mergeUserCustom(rules, runtime, ["L1_rules", "L2_rules"], "path");
+  if (osType) rules = _filterRulesByOs(rules, osType);
+  return rules.map((r) => {
     const out = { path: r.path || "", risk_level: r.risk_level || "", desc: r.desc || "", deny_mode: r.deny_mode || "deny_write" };
     if (r.credential) out.credential = true;
     if (r.read_only) out.read_only = true;
@@ -1606,13 +1875,24 @@ function getEnabledL2SensitivePaths(runtime) {
 }
 function hasRuntimeConfig() {
   const p = getRuntimeConfigPath();
-  if (!existsSync4(p)) return false;
+  let key;
   try {
-    JSON.parse(readFileSync4(p, "utf-8"));
-    return true;
+    const st = statSync(p);
+    key = `${p}|${st.mtimeMs}|${st.size}`;
   } catch {
     return false;
   }
+  const cached = hasRuntimeConfigCache.get(key);
+  if (cached !== void 0) return cached;
+  let ok = false;
+  try {
+    JSON.parse(readFileSync4(p, "utf-8"));
+    ok = true;
+  } catch {
+    ok = false;
+  }
+  hasRuntimeConfigCache.set(key, ok);
+  return ok;
 }
 function getDisabledL2RulesWithSkipL3() {
   let runtime;
@@ -1677,15 +1957,28 @@ function _syncDenyModeFields(rule) {
   }
 }
 function _l1CommandPatternsToRules() {
-  return DANGEROUS_PATTERNS.map((p) => ({
-    id: _generatePatternId(p.pattern instanceof RegExp ? p.pattern.source : p.pattern),
-    pattern: p.pattern instanceof RegExp ? p.pattern.source : p.pattern,
-    risk_level: p.severity,
-    risk_type: p.riskType,
-    reason: p.description,
-    enabled: true,
-    builtin: true
-  }));
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const osName of ["linux", "windows", "macos", "harmony"]) {
+    for (const p of getDangerousPatternsForOs(osName)) {
+      const src = p.pattern instanceof RegExp ? p.pattern.source : String(p.pattern);
+      const rule = {
+        id: _generatePatternId(src),
+        pattern: src,
+        risk_level: p.severity,
+        risk_type: p.riskType,
+        reason: p.description,
+        enabled: true,
+        builtin: true,
+        os: p.os || "linux"
+      };
+      const fp = _ruleFingerprint(rule);
+      if (seen.has(fp)) continue;
+      seen.add(fp);
+      out.push(rule);
+    }
+  }
+  return out;
 }
 function _l1InjectionKeywordsToRules() {
   return INJECTION_KEYWORDS.map((kw) => ({
@@ -1698,28 +1991,42 @@ function _l1InjectionKeywordsToRules() {
   }));
 }
 function _l2SensitivePathsToRules() {
-  const all = [...ROOT_SENSITIVE_PATHS, ...HOME_SENSITIVE_PATHS, ...CREDENTIAL_PATHS];
-  return all.map((sp) => {
-    const denyMode = _deriveDenyMode({
-      deny_mode: sp.deny_mode,
-      credential: sp.credential,
-      read_only: sp.read_only
-    });
-    const rule = {
-      id: `path_${_slugify(sp.path)}`,
-      path: sp.path,
-      risk_level: sp.riskLevel,
-      desc: sp.desc,
-      deny_mode: denyMode,
-      source_deny_mode: denyMode,
-      skip_l3_on_disabled: true,
-      enabled: true,
-      builtin: true
-    };
-    _syncDenyModeFields(rule);
-    if (sp.dirDelOnly) rule.dir_del_only = true;
-    return rule;
-  });
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const osName of ["linux", "windows", "macos", "harmony"]) {
+    const { root, home, credential } = getSensitivePathsForOsBuiltin(osName);
+    const all = [...root, ...home, ...credential];
+    for (const sp of all) {
+      const os4 = String(sp.os || "linux").toLowerCase();
+      const denyMode = _deriveDenyMode({
+        deny_mode: sp.deny_mode,
+        credential: sp.credential,
+        read_only: sp.read_only
+      });
+      const rule = {
+        // id = path_<平台>_<slug>_<hash8>：平台段消除跨平台同名（.ssh/.aws 各一条），
+        // hash 段消除同平台 slug 撞车（macOS 的 /Library/LaunchAgents 与
+        // Library/LaunchAgents）—— Console 按 id 操作，撞 id 会误改别的规则。
+        id: `path_${os4}_${_slugify(sp.path)}_${_fnv1a32(sp.path)}`,
+        path: sp.path,
+        risk_level: sp.riskLevel,
+        desc: sp.desc,
+        deny_mode: denyMode,
+        source_deny_mode: denyMode,
+        skip_l3_on_disabled: true,
+        enabled: true,
+        builtin: true,
+        os: os4
+      };
+      _syncDenyModeFields(rule);
+      if (sp.dirDelOnly) rule.dir_del_only = true;
+      const fp = _ruleFingerprint(rule);
+      if (seen.has(fp)) continue;
+      seen.add(fp);
+      out.push(rule);
+    }
+  }
+  return out;
 }
 function _l2IntentPatternsToRules() {
   return INTENT_DEVIATION_PATTERNS.map((pat, i) => ({
@@ -1796,8 +2103,8 @@ function _l3SkillsToRules() {
 }
 function _scenarioRulesToDefaults() {
   const out = {};
-  const scenDir = existsSync4(_SCENARIOS_DIR_PROD) ? _SCENARIOS_DIR_PROD : existsSync4(_SCENARIOS_DIR_DEV) ? _SCENARIOS_DIR_DEV : _SCENARIOS_DIR_PROD;
-  if (!existsSync4(scenDir)) return out;
+  const scenDir = existsSync5(_SCENARIOS_DIR_PROD) ? _SCENARIOS_DIR_PROD : existsSync5(_SCENARIOS_DIR_DEV) ? _SCENARIOS_DIR_DEV : _SCENARIOS_DIR_PROD;
+  if (!existsSync5(scenDir)) return out;
   let entries;
   try {
     entries = readdirSync3(scenDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
@@ -1806,7 +2113,7 @@ function _scenarioRulesToDefaults() {
   }
   for (const scenarioId of entries) {
     const rulesFile = join3(scenDir, scenarioId, "rules.json");
-    if (!existsSync4(rulesFile)) continue;
+    if (!existsSync5(rulesFile)) continue;
     let data;
     try {
       data = JSON.parse(readFileSync4(rulesFile, "utf-8"));
@@ -1845,8 +2152,8 @@ function _scenarioRulesToDefaults() {
 }
 function _agentRulesToDefaults() {
   const out = {};
-  const agentsDir = existsSync4(_AGENTS_DIR_PROD) ? _AGENTS_DIR_PROD : existsSync4(_AGENTS_DIR_DEV) ? _AGENTS_DIR_DEV : _AGENTS_DIR_PROD;
-  if (!existsSync4(agentsDir)) return out;
+  const agentsDir = existsSync5(_AGENTS_DIR_PROD) ? _AGENTS_DIR_PROD : existsSync5(_AGENTS_DIR_DEV) ? _AGENTS_DIR_DEV : _AGENTS_DIR_PROD;
+  if (!existsSync5(agentsDir)) return out;
   let entries;
   try {
     entries = readdirSync3(agentsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
@@ -1855,7 +2162,7 @@ function _agentRulesToDefaults() {
   }
   for (const agentId of entries) {
     const rulesFile = join3(agentsDir, agentId, "rules.json");
-    if (!existsSync4(rulesFile)) continue;
+    if (!existsSync5(rulesFile)) continue;
     let data;
     try {
       data = JSON.parse(readFileSync4(rulesFile, "utf-8"));
@@ -1951,7 +2258,7 @@ function _ltlRulesToRuntime() {
   let mc = {};
   for (const dir of cands) {
     const p = join3(dir, "mc_rules.json");
-    if (existsSync4(p)) {
+    if (existsSync5(p)) {
       try {
         mc = JSON.parse(readFileSync4(p, "utf-8")) || {};
       } catch {
@@ -1980,17 +2287,27 @@ function normalizePatternForFingerprint(pattern) {
   return pattern.replace(/\\\//g, "/");
 }
 function _ruleFingerprint(rule) {
+  const osTag = String(rule.os || "linux").toLowerCase();
   if (rule.intent_keywords && rule.intent_keywords.length || rule.dangerous_actions && rule.dangerous_actions.length) {
     return JSON.stringify([
+      osTag,
       [...rule.intent_keywords || []].sort(),
       [...rule.dangerous_actions || []].sort()
     ]);
   }
-  if (rule.path) return JSON.stringify([normalizePatternForFingerprint(rule.path)]);
-  if (rule.pattern) return JSON.stringify([normalizePatternForFingerprint(rule.pattern)]);
-  if (rule.keyword) return JSON.stringify([rule.keyword, rule.lang || ""]);
-  if (rule.value) return JSON.stringify([rule.value]);
-  return JSON.stringify([rule.id || ""]);
+  if (rule.path) return JSON.stringify([osTag, normalizePatternForFingerprint(rule.path)]);
+  if (rule.pattern) return JSON.stringify([osTag, normalizePatternForFingerprint(rule.pattern)]);
+  if (rule.keyword) return JSON.stringify([osTag, rule.keyword, rule.lang || ""]);
+  if (rule.value) return JSON.stringify([osTag, rule.value]);
+  return JSON.stringify([osTag, rule.id || ""]);
+}
+function _applyRuleEnabled(rule, enabled) {
+  rule.enabled = enabled;
+  if (enabled) {
+    delete rule.user_disabled;
+  } else {
+    rule.user_disabled = true;
+  }
 }
 function _mergeRuleCategories(userCfg, srcDefaults, layerKey) {
   const userLayer = userCfg[layerKey] || (userCfg[layerKey] = {});
@@ -2013,13 +2330,14 @@ function _mergeRuleCategories(userCfg, srcDefaults, layerKey) {
       srcFps.add(fp);
       if (userByFp.has(fp)) {
         const existing = userByFp.get(fp);
-        const userEnabled = existing.enabled;
+        const userDisabled = existing.user_disabled === true;
         const userSkipL3 = existing.skip_l3_on_disabled;
         const userDenyMode = existing.deny_mode;
         const userSourceDeny = existing.source_deny_mode;
         Object.keys(existing).forEach((k) => delete existing[k]);
         Object.assign(existing, srcR);
-        existing.enabled = userEnabled;
+        existing.enabled = !userDisabled;
+        if (userDisabled) existing.user_disabled = true;
         if (userSkipL3 !== void 0) existing.skip_l3_on_disabled = userSkipL3;
         if (userDenyMode && userSourceDeny && userDenyMode !== userSourceDeny) {
           existing.deny_mode = userDenyMode;
@@ -2045,7 +2363,19 @@ function _mergeRuleCategories(userCfg, srcDefaults, layerKey) {
   }
   for (const catName of Object.keys(userLayer)) {
     if (catName === "user_custom") continue;
-    if (!(catName in srcLayer)) delete userLayer[catName];
+    if (!(catName in srcLayer)) {
+      const kept = (userLayer[catName].rules || []).filter((r) => r.builtin !== true);
+      if (kept.length) {
+        const uc = userLayer.user_custom || (userLayer.user_custom = {
+          category_enabled: true,
+          category_desc: "",
+          rules: []
+        });
+        const existing = new Set((uc.rules || []).map((r) => r.id));
+        uc.rules = [...uc.rules || [], ...kept.filter((r) => !existing.has(r.id))];
+      }
+      delete userLayer[catName];
+    }
   }
 }
 function _mergeSkillCategories(userCfg, srcDefaults, layerKey) {
@@ -2093,10 +2423,11 @@ function _mergeAgentRules(userCfg, srcDefaults, partition = "agent_rules") {
         srcFps.add(fp);
         if (userByFp.has(fp)) {
           const existing = userByFp.get(fp);
-          const userEnabled = existing.enabled;
+          const userDisabled = existing.user_disabled === true;
           Object.keys(existing).forEach((k) => delete existing[k]);
           Object.assign(existing, srcR);
-          existing.enabled = userEnabled;
+          existing.enabled = !userDisabled;
+          if (userDisabled) existing.user_disabled = true;
         } else {
           userRules.push({ ...srcR, enabled: true });
         }
@@ -2160,17 +2491,23 @@ function _migrateCategoriesAcrossLayers(cfg, srcLayer, dstLayer, catNames) {
     delete src[catName];
   }
 }
-function getEnabledL1InjectionKeywords(runtime) {
+function getEnabledL1InjectionKeywords(runtime, osType) {
   const cat = runtime.L1_rules?.injection_detection || { category_enabled: true, rules: [] };
-  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => ({
+  let rules = filterEnabledRules(cat.rules || [], cat.category_enabled);
+  rules = _mergeUserCustom(rules, runtime, "L1_rules", "keyword");
+  if (osType) rules = _filterRulesByOs(rules, osType);
+  return rules.map((r) => ({
     keyword: r.keyword || "",
     risk_level: r.risk_level || "",
     lang: r.lang || "en"
   }));
 }
-function getEnabledL2IntentPatterns(runtime) {
+function getEnabledL2IntentPatterns(runtime, osType) {
   const cat = runtime.L2_rules?.intent_consistency || { category_enabled: true, rules: [] };
-  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => ({
+  let rules = filterEnabledRules(cat.rules || [], cat.category_enabled);
+  rules = _mergeUserCustom(rules, runtime, "L2_rules", "intent_keywords");
+  if (osType) rules = _filterRulesByOs(rules, osType);
+  return rules.map((r) => ({
     intent_keywords: r.intent_keywords || [],
     dangerous_actions: r.dangerous_actions || [],
     reason: r.reason || ""
@@ -2178,11 +2515,13 @@ function getEnabledL2IntentPatterns(runtime) {
 }
 function getEnabledL2PasswordPatterns(runtime) {
   const cat = runtime.L2_rules?.password_modify_consent || { category_enabled: true, rules: [] };
-  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => r.pattern || "");
+  const rules = _mergeUserCustom(filterEnabledRules(cat.rules || [], cat.category_enabled), runtime, "L2_rules", "pattern");
+  return rules.map((r) => r.pattern || "");
 }
 function getEnabledL2UserDeletionPatterns(runtime) {
   const cat = runtime.L2_rules?.user_deletion_consent || { category_enabled: true, rules: [] };
-  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => r.pattern || "");
+  const rules = _mergeUserCustom(filterEnabledRules(cat.rules || [], cat.category_enabled), runtime, "L2_rules", "pattern");
+  return rules.map((r) => r.pattern || "");
 }
 function isL2CategoryEnabled(runtime, categoryKey) {
   const cat = runtime.L2_rules?.[categoryKey];
@@ -2201,45 +2540,126 @@ function getDisabledSkillIds(runtime) {
   }
   return disabled;
 }
-function getEnabledL1CommandPatternsOrDefault(runtime) {
-  const enabled = getEnabledL1CommandPatterns(runtime);
-  if (enabled.length) return enabled;
-  if (!hasRuntimeConfig()) return _l1CommandPatternsToRules();
-  return [];
-}
-function getEnabledL1InjectionKeywordsOrDefault(runtime) {
-  const enabled = getEnabledL1InjectionKeywords(runtime);
-  if (enabled.length) return enabled;
-  if (!hasRuntimeConfig()) return _l1InjectionKeywordsToRules();
-  return [];
-}
-function getEnabledL2SensitivePathsOrDefault(runtime) {
-  const enabled = getEnabledL2SensitivePaths(runtime);
-  if (enabled.length) return enabled;
-  if (!hasRuntimeConfig()) return _l2SensitivePathsToRules();
-  return [];
-}
-function getEnabledL2IntentPatternsOrDefault(runtime) {
-  const enabled = getEnabledL2IntentPatterns(runtime);
-  if (enabled.length) return enabled;
-  if (!hasRuntimeConfig()) return _l2IntentPatternsToRules();
-  return [];
-}
-function getEnabledL2PasswordPatternsOrDefault(runtime) {
-  const enabled = getEnabledL2PasswordPatterns(runtime);
-  if (enabled.length) return enabled;
-  if (!hasRuntimeConfig()) {
-    return PASSWORD_MODIFY_PATTERNS.map((p) => p.source);
-  }
-  return [];
-}
-function getEnabledL2UserDeletionPatternsOrDefault(runtime) {
-  const enabled = getEnabledL2UserDeletionPatterns(runtime);
-  if (enabled.length) return enabled;
-  if (!hasRuntimeConfig()) {
-    return USER_DELETION_PATTERNS.map((p) => p.source);
-  }
-  return [];
+function _filterDefaultsByOs(rules, osType) {
+  const accepted = acceptedOsValues(osType);
+  return rules.filter((r) => !r.os || accepted.includes(String(r.os).toLowerCase()));
+}
+function _hasRulesForOs(rules, osType) {
+  return _filterRulesByOs(rules || [], osType || "linux").length > 0;
+}
+function getEnabledL1CommandPatternsOrDefault(runtime, osType) {
+  const cat = runtime.L1_rules?.dangerous_commands;
+  if (_hasRulesForOs(cat?.rules, osType)) {
+    return getEnabledL1CommandPatterns(runtime, osType);
+  }
+  return _mergeUserCustom(_filterDefaultsByOs(_l1CommandPatternsToRules(), osType), runtime, "L1_rules", "pattern");
+}
+function getEnabledL1InjectionKeywordsOrDefault(runtime, osType) {
+  const cat = runtime.L1_rules?.injection_detection;
+  if (_hasRulesForOs(cat?.rules, osType)) {
+    return getEnabledL1InjectionKeywords(runtime, osType);
+  }
+  return _mergeUserCustom(_l1InjectionKeywordsToRules(), runtime, "L1_rules", "keyword");
+}
+function getEnabledL2SensitivePathsOrDefault(runtime, osType) {
+  const spCat = _sensitivePathCategoryOf(runtime);
+  if (_hasRulesForOs(spCat?.rules, osType)) {
+    return getEnabledL2SensitivePaths(runtime, osType);
+  }
+  return _mergeUserCustom(_filterDefaultsByOs(_l2SensitivePathsToRules(), osType), runtime, ["L1_rules", "L2_rules"], "path");
+}
+function getEnabledL2IntentPatternsOrDefault(runtime, osType) {
+  const cat = runtime.L2_rules?.intent_consistency;
+  if (_hasRulesForOs(cat?.rules, osType)) {
+    return getEnabledL2IntentPatterns(runtime, osType);
+  }
+  return _mergeUserCustom(_filterDefaultsByOs(_l2IntentPatternsToRules(), osType), runtime, "L2_rules", "intent_keywords");
+}
+function getEnabledL2PasswordPatternsOrDefault(runtime, osType) {
+  const cat = runtime.L2_rules?.password_modify_consent;
+  if (_hasRulesForOs(cat?.rules, osType)) {
+    return getEnabledL2PasswordPatterns(runtime);
+  }
+  return PASSWORD_MODIFY_PATTERNS.map((p) => p.source);
+}
+function getEnabledL2UserDeletionPatternsOrDefault(runtime, osType) {
+  const cat = runtime.L2_rules?.user_deletion_consent;
+  if (_hasRulesForOs(cat?.rules, osType)) {
+    return getEnabledL2UserDeletionPatterns(runtime);
+  }
+  return USER_DELETION_PATTERNS.map((p) => p.source);
+}
+function _effective(osType, key, compute) {
+  const runtime = loadRuntimeConfig();
+  let bucket = _effectiveCache.get(runtime);
+  if (!bucket) {
+    bucket = /* @__PURE__ */ new Map();
+    _effectiveCache.set(runtime, bucket);
+  }
+  const k = `${key}|${osType || ""}`;
+  if (bucket.has(k)) return bucket.get(k);
+  const value = compute(runtime);
+  bucket.set(k, value);
+  return value;
+}
+function effectiveDangerousPatterns(osType) {
+  return _effective(osType, "danger", (rt) => {
+    const rules = getEnabledL1CommandPatternsOrDefault(rt, osType);
+    return rules.filter((r) => r.pattern).map((r) => ({
+      pattern: new RegExp(String(r.pattern), "i"),
+      severity: String(r.risk_level || "medium"),
+      riskType: String(r.risk_type || ""),
+      description: String(r.reason || ""),
+      os: String(r.os || "linux").toLowerCase()
+    }));
+  });
+}
+function effectiveInjectionKeywords(osType) {
+  return _effective(osType, "injection", (rt) => {
+    const rules = getEnabledL1InjectionKeywordsOrDefault(rt, osType);
+    return rules.map((r) => ({
+      keyword: String(r.keyword || ""),
+      riskLevel: String(r.risk_level || ""),
+      lang: String(r.lang || "en")
+    })).filter((r) => r.keyword);
+  });
+}
+function effectiveSensitivePaths(osType) {
+  return _effective(osType, "sensitive", (rt) => {
+    const rules = getEnabledL2SensitivePathsOrDefault(rt, osType);
+    return rules.filter((r) => r.path).map((r) => ({
+      path: String(r.path),
+      riskLevel: String(r.risk_level || "high"),
+      desc: String(r.desc || ""),
+      credential: r.credential === true ? true : void 0,
+      readOnly: r.read_only === true ? true : void 0,
+      dirDelOnly: r.dir_del_only === true ? true : void 0,
+      denyMode: String(r.deny_mode || ""),
+      os: String(r.os || "linux").toLowerCase()
+    }));
+  });
+}
+function effectiveIntentPatterns(osType) {
+  return _effective(osType, "intent", (rt) => {
+    const rules = getEnabledL2IntentPatternsOrDefault(rt, osType);
+    return rules.map((r) => ({
+      intentKeywords: r.intent_keywords || [],
+      dangerousActions: r.dangerous_actions || [],
+      reason: String(r.reason || ""),
+      os: String(r.os || "linux").toLowerCase()
+    }));
+  });
+}
+function effectivePasswordPatterns(osType) {
+  return _effective(osType, "password", (rt) => getEnabledL2PasswordPatternsOrDefault(rt, osType).map((p) => new RegExp(p, "i")));
+}
+function effectiveUserDeletionPatterns(osType) {
+  return _effective(osType, "userdel", (rt) => getEnabledL2UserDeletionPatternsOrDefault(rt, osType).map((p) => new RegExp(p, "i")));
+}
+function _sensitivePathCategoryOf(runtime) {
+  const l1 = runtime.L1_rules?.sensitive_path_access;
+  if (l1 && (l1.rules || []).length > 0) return l1;
+  return runtime.L2_rules?.sensitive_path_access;
 }
 function _validateSkillId(skillId) {
   if (!skillId || !SKILL_ID_RE.test(skillId)) {
@@ -2256,7 +2676,7 @@ function updateRuleEnabled(layer, category, ruleId, enabled) {
   const runtime = loadRuntimeConfig();
   for (const r of runtime[layer]?.[category]?.rules || []) {
     if (r.id === ruleId) {
-      r.enabled = enabled;
+      _applyRuleEnabled(r, enabled);
       break;
     }
   }
@@ -2326,7 +2746,7 @@ function deleteCustomRule(layer, category, ruleId) {
 function addCustomSkill(skillId, category, keywords, content) {
   _validateSkillId(skillId);
   const runtime = loadRuntimeConfig();
-  const skillsDir = join3(RUNTIME_CONFIG_DIR, "agent_moss_skills");
+  const skillsDir = join3(getRuntimeConfigDir(), "agent_moss_skills");
   try {
     mkdirSync(skillsDir, { recursive: true });
   } catch {
@@ -2346,9 +2766,9 @@ function deleteCustomSkill(skillId, category) {
   if (idx >= 0) {
     if (skills[idx].builtin) return null;
     skills.splice(idx, 1);
-    const skillPath = join3(RUNTIME_CONFIG_DIR, "agent_moss_skills", `${skillId}.md`);
+    const skillPath = join3(getRuntimeConfigDir(), "agent_moss_skills", `${skillId}.md`);
     try {
-      if (existsSync4(skillPath)) unlinkSync(skillPath);
+      if (existsSync5(skillPath)) unlinkSync(skillPath);
     } catch {
     }
     saveRuntimeConfig(runtime);
@@ -2427,7 +2847,7 @@ function updateAgentRuleEnabled(agentId, category, ruleFp, enabled) {
     const targetFp = _ruleFingerprint(ruleFp);
     for (const r of cat.rules || []) {
       if (_ruleFingerprint(r) === targetFp) {
-        r.enabled = enabled;
+        _applyRuleEnabled(r, enabled);
         break;
       }
     }
@@ -2455,137 +2875,419 @@ function deleteAgentRule(agentId, category, ruleFp) {
   saveRuntimeConfig(runtime);
   return runtime;
 }
-function updateAgentCategoryEnabled(agentId, category, enabled) {
-  const runtime = loadRuntimeConfig();
-  const cat = runtime.agent_rules?.[agentId]?.[category];
-  if (cat) cat.category_enabled = enabled;
-  saveRuntimeConfig(runtime);
-  return runtime;
+function updateAgentCategoryEnabled(agentId, category, enabled) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.agent_rules?.[agentId]?.[category];
+  if (cat) cat.category_enabled = enabled;
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function getScenarioRules(runtime) {
+  return runtime.scenario_rules || {};
+}
+function getEnabledScenarioExtensions(runtime, scenarioId) {
+  const scenData = runtime.scenario_rules?.[scenarioId];
+  if (!scenData) return null;
+  const cmdPatterns = _agentCategoryEnabledRules(scenData.extra_command_patterns).filter((r) => r.pattern).map((r) => ({
+    pattern: r.pattern,
+    risk_level: r.risk_level || "",
+    risk_type: r.risk_type || "",
+    reason: r.reason || ""
+  }));
+  const injKeywords = _agentCategoryEnabledRules(scenData.extra_injection_keywords).filter((r) => r.keyword).map((r) => ({
+    keyword: r.keyword,
+    risk_level: r.risk_level || "",
+    lang: r.lang || "en"
+  }));
+  const sensitivePaths = _agentCategoryEnabledRules(scenData.extra_sensitive_paths).filter((r) => r.path).map((r) => ({
+    path: r.path,
+    risk_level: r.risk_level || "",
+    desc: r.desc || "",
+    credential: r.credential,
+    read_only: r.read_only,
+    deny_mode: r.deny_mode
+  }));
+  return {
+    agent_id: scenarioId,
+    description: "",
+    extra_command_patterns: cmdPatterns,
+    extra_injection_keywords: injKeywords,
+    extra_sensitive_paths: sensitivePaths,
+    builtin_safe_skills: [],
+    builtin_safe_action_types: [],
+    extra_skills: []
+  };
+}
+function updateScenarioRuleEnabled(scenarioId, category, ruleFp, enabled) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.scenario_rules?.[scenarioId]?.[category];
+  if (cat) {
+    const targetFp = _ruleFingerprint(ruleFp);
+    for (const r of cat.rules || []) {
+      if (_ruleFingerprint(r) === targetFp) {
+        _applyRuleEnabled(r, enabled);
+        break;
+      }
+    }
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function addScenarioRule(scenarioId, category, rule) {
+  const runtime = loadRuntimeConfig();
+  if (!runtime.scenario_rules) runtime.scenario_rules = {};
+  if (!runtime.scenario_rules[scenarioId]) runtime.scenario_rules[scenarioId] = {};
+  const cats = runtime.scenario_rules[scenarioId];
+  if (!cats[category]) cats[category] = { category_enabled: true, category_desc: "", rules: [] };
+  (cats[category].rules || (cats[category].rules = [])).push({ ...rule, enabled: true, builtin: false });
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function deleteScenarioRule(scenarioId, category, ruleFp) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.scenario_rules?.[scenarioId]?.[category];
+  if (cat) {
+    const targetFp = _ruleFingerprint(ruleFp);
+    cat.rules = (cat.rules || []).filter((r) => _ruleFingerprint(r) !== targetFp);
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function updateScenarioCategoryEnabled(scenarioId, category, enabled) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.scenario_rules?.[scenarioId]?.[category];
+  if (cat) cat.category_enabled = enabled;
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DEFAULT_LAYERS, DENY_MODE_LABELS, runtimeConfigCache, hasRuntimeConfigCache, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, _effectiveCache, SKILL_ID_RE;
+var init_runtime_config = __esm({
+  "src/infra/runtime-config.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_paths();
+    init_heuristic();
+    init_logic_rules();
+    init_skill_loader();
+    init_runtime_config_bridge();
+    __dirname4 = dirname3(fileURLToPath4(import.meta.url));
+    ENV_RUNTIME_CONFIG_PATH = "AGENT_MOSS_RUNTIME_CONFIG_PATH";
+    RUNTIME_CONFIG_DIR = runtimeDir();
+    RUNTIME_CONFIG_PATH = join3(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
+    LAYER_DISABLE_ENV = {
+      L1_heuristic: "AGENT_MOSS_DISABLE_HEURISTIC",
+      L2_logic_rules: "AGENT_MOSS_DISABLE_LOGIC_RULES",
+      L3_llm_analysis: "AGENT_MOSS_DISABLE_LLM"
+    };
+    DEFAULT_LAYERS = {
+      L1_heuristic: true,
+      L2_logic_rules: true,
+      L3_llm_analysis: true,
+      agent_rules_enabled: true,
+      scenario_rules_enabled: true
+    };
+    DENY_MODE_LABELS = {
+      deny_write: "\u4EC5\u62E6\u622A\u5199\u5165",
+      deny_read: "\u4EC5\u62E6\u622A\u8BFB\u53D6",
+      deny_both: "\u8BFB\u5199\u5747\u62E6\u622A"
+    };
+    runtimeConfigCache = null;
+    hasRuntimeConfigCache = /* @__PURE__ */ new Map();
+    _AGENTS_DIR_PROD = join3(__dirname4, "agents");
+    _AGENTS_DIR_DEV = join3(__dirname4, "..", "..", "..", "agent_moss", "agents");
+    _SCENARIOS_DIR_PROD = join3(__dirname4, "scenarios");
+    _SCENARIOS_DIR_DEV = join3(__dirname4, "..", "..", "..", "agent_moss", "scenarios");
+    _effectiveCache = /* @__PURE__ */ new WeakMap();
+    SKILL_ID_RE = /^[A-Za-z0-9_-]+$/;
+    registerRuntimeConfigBridge({
+      hasRuntimeConfig,
+      loadRuntimeConfig,
+      effectiveDangerousPatterns,
+      effectiveInjectionKeywords,
+      effectiveSensitivePaths,
+      effectiveIntentPatterns,
+      effectivePasswordPatterns,
+      effectiveUserDeletionPatterns,
+      disabledSkillIds: () => getDisabledSkillIds(loadRuntimeConfig())
+    });
+  }
+});
+
+// src/config.ts
+var config_exports = {};
+__export(config_exports, {
+  detectProvider: () => detectProvider,
+  getCustomRules: () => getCustomRules,
+  getLLMConfig: () => getLLMConfig,
+  getLLMFailMode: () => getLLMFailMode,
+  getProviderHeaders: () => getProviderHeaders,
+  getRetryConfig: () => getRetryConfig,
+  getTimeoutConfig: () => getTimeoutConfig,
+  isBrainEnabled: () => isBrainEnabled,
+  isFormalObserveMode: () => isFormalObserveMode,
+  isHeuristicEnabled: () => isHeuristicEnabled,
+  isLLMAvailable: () => isLLMAvailable,
+  isLogicRulesEnabled: () => isLogicRulesEnabled,
+  probeLLMConnection: () => probeLLMConnection,
+  updateLLMConfig: () => updateLLMConfig
+});
+import fs2 from "fs";
+import path2 from "path";
+import { fileURLToPath as fileURLToPath5 } from "url";
+function loadConfigFile(filePath) {
+  try {
+    const raw = fs2.readFileSync(filePath, "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function resolveConfigPath() {
+  const envPath = process.env.AGENT_MOSS_CONFIG_PATH;
+  if (envPath) return envPath;
+  const userConfig = path2.join(getConfigDir(), "config.json");
+  if (fs2.existsSync(userConfig)) return userConfig;
+  const defaultCandidates = [
+    path2.join(__dirname, "config.json.example"),
+    path2.join(__dirname, "..", "..", "agent_moss", "infra", "config.json.example")
+  ];
+  const defaultConfig = defaultCandidates.find((p) => fs2.existsSync(p));
+  if (defaultConfig) {
+    const configDir = path2.dirname(userConfig);
+    fs2.mkdirSync(configDir, { recursive: true });
+    const pkgConfig = loadConfigFile(defaultConfig);
+    const safeConfig = pkgConfig ? { ...pkgConfig, llm: { ...pkgConfig.llm, api_key: "" } } : {};
+    fs2.writeFileSync(userConfig, JSON.stringify(safeConfig, null, 4), "utf-8");
+    console.log(`[AgentMoss] \u5DF2\u521B\u5EFA\u7528\u6237\u914D\u7F6E\u6587\u4EF6: ${userConfig}`);
+    console.log(`[AgentMoss] \u8BF7\u7F16\u8F91\u8BE5\u6587\u4EF6\u914D\u7F6E\u4F60\u7684 LLM API Key`);
+  }
+  return userConfig;
+}
+function loadLLMConfigFromFile(configPath) {
+  const data = loadConfigFile(configPath);
+  if (!data?.llm) return {};
+  const llm = data.llm;
+  return {
+    provider: llm.provider || "",
+    baseUrl: llm.base_url || "",
+    apiKey: llm.api_key || "",
+    model: llm.model || "",
+    temperature: llm.temperature ?? 0.1,
+    maxTokens: llm.max_tokens ?? 4096,
+    timeout: llm.timeout ?? 40
+  };
+}
+function loadTimeoutRetryFromFile(configPath) {
+  const data = loadConfigFile(configPath);
+  const t = data?.timeout ?? {};
+  const r = data?.retry ?? {};
+  return {
+    timeout: {
+      totalTimeout: Number(t.total_timeout ?? 90),
+      prompt1Timeout: Number(t.prompt1_timeout ?? 40),
+      prompt2Timeout: Number(t.prompt2_timeout ?? 20),
+      stepInterval: Number(t.step_interval ?? 0)
+    },
+    retry: {
+      maxRetries: Number(r.max_retries ?? 2),
+      retryInterval: Number(r.retry_interval ?? 2)
+    }
+  };
+}
+function getTimeoutConfig() {
+  return timeoutConfig;
+}
+function getRetryConfig() {
+  return retryConfig;
+}
+function wildcardToRegExp(pattern) {
+  return pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/\\\*/g, ".*");
+}
+function loadCustomRules() {
+  const rules = [];
+  try {
+    const raw = process.env.AGENT_MOSS_CUSTOM_RULES;
+    if (raw) {
+      const parsed = JSON.parse(raw);
+      if (Array.isArray(parsed)) {
+        for (const r of parsed) {
+          if (r && r.pattern && r.action) rules.push({ pattern: r.pattern, action: r.action, severity: r.severity || "high" });
+        }
+      }
+    }
+  } catch {
+  }
+  for (const rulesPath of USER_RULES_PATHS) {
+    try {
+      if (!fs2.existsSync(rulesPath)) continue;
+      const data = JSON.parse(fs2.readFileSync(rulesPath, "utf-8"));
+      const actions = Array.isArray(data?.sensitive_actions) ? data.sensitive_actions : [];
+      for (const r of actions) {
+        const p = r?.pattern;
+        if (!p) continue;
+        rules.push({ pattern: wildcardToRegExp(p), action: "Deny", severity: "high" });
+      }
+      break;
+    } catch {
+    }
+  }
+  return rules;
+}
+function getLLMConfig() {
+  return llmConfig;
+}
+function updateLLMConfig(partial) {
+  llmConfig = { ...llmConfig, ...partial };
+}
+function getCustomRules() {
+  return customRules;
+}
+function isLLMAvailable() {
+  if (process.env.AGENT_MOSS_DISABLE_LLM === "1") return false;
+  if (!layerEnabledOrDefault("L3_llm_analysis")) return false;
+  return llmConfig.apiKey.length > 0;
+}
+async function probeLLMConnection(timeoutMs = 3e4) {
+  if (!isLLMAvailable()) return false;
+  const OpenAI3 = (await import("openai")).default;
+  const config = getLLMConfig();
+  const provider = detectProvider(config.baseUrl, config.provider);
+  const extraHeaders = getProviderHeaders(provider);
+  const client = new OpenAI3({
+    baseURL: config.baseUrl,
+    apiKey: config.apiKey,
+    timeout: timeoutMs,
+    maxRetries: 0,
+    defaultHeaders: Object.keys(extraHeaders).length > 0 ? extraHeaders : void 0
+  });
+  try {
+    const resp = await client.chat.completions.create({
+      model: config.model,
+      messages: [{ role: "user", content: "ping" }],
+      max_tokens: 1
+    });
+    return !!(resp && resp.choices && resp.choices[0]);
+  } catch {
+    return false;
+  }
+}
+function getLLMFailMode() {
+  const val = (process.env.AGENT_MOSS_LLM_FAIL_MODE || "fail_open").toLowerCase();
+  return val === "fail_closed" ? "fail_closed" : "fail_open";
+}
+function detectProvider(baseUrl, providerHint = "") {
+  if (providerHint) {
+    const hint = providerHint.toLowerCase();
+    if (["claude", "anthropic"].includes(hint)) return "anthropic";
+    if (["google", "gemini"].includes(hint)) return "gemini";
+    if (["zai-coding-plan", "zhipu-coding-plan", "zhipuai-coding-plan"].includes(hint)) return "zai-coding-plan";
+    if (["zai", "z-ai", "z.ai", "zai-cn", "zai-china", "zhipu", "glm-cn", "bigmodel"].includes(hint)) return "zhipu";
+    if (["xai", "xai-grok"].includes(hint)) return "xai";
+    if (["minimax", "minimax-openai"].includes(hint)) return "minimax";
+    if (["minimax-anthropic"].includes(hint)) return "minimax-anthropic";
+    if (["other", "custom", "local"].includes(hint)) return "openai-compatible";
+    return hint;
+  }
+  const url = baseUrl.toLowerCase();
+  if (url.includes("openrouter.ai")) return "openrouter";
+  if (url.includes("api.openai.com")) return "openai";
+  if (url.includes("anthropic.com") || url.includes("api.anthropic.com")) return "anthropic";
+  if (url.includes("generativelanguage.googleapis.com") || url.includes("gemini")) return "gemini";
+  if (url.includes("api.deepseek.com")) return "deepseek";
+  if (url.includes("api.groq.com")) return "groq";
+  if (url.includes("api.mistral.ai")) return "mistral";
+  if (url.includes("api.together.xyz")) return "together";
+  if (url.includes("api.x.ai")) return "xai";
+  if (url.includes("api.minimaxi.com")) return "minimax";
+  if (url.includes("api-ai.gitcode.com")) return "gitcode";
+  if (url.includes("api.z.ai")) return "zai-coding-plan";
+  if (url.includes("open.bigmodel.cn") || url.includes("bigmodel")) return "zhipu";
+  if (url.includes(":11434")) return "ollama";
+  return "openai-compatible";
 }
-function getScenarioRules(runtime) {
-  return runtime.scenario_rules || {};
+function getProviderHeaders(provider) {
+  return PROVIDER_HEADERS[provider] || {};
 }
-function getEnabledScenarioExtensions(runtime, scenarioId) {
-  const scenData = runtime.scenario_rules?.[scenarioId];
-  if (!scenData) return null;
-  const cmdPatterns = _agentCategoryEnabledRules(scenData.extra_command_patterns).filter((r) => r.pattern).map((r) => ({
-    pattern: r.pattern,
-    risk_level: r.risk_level || "",
-    risk_type: r.risk_type || "",
-    reason: r.reason || ""
-  }));
-  const injKeywords = _agentCategoryEnabledRules(scenData.extra_injection_keywords).filter((r) => r.keyword).map((r) => ({
-    keyword: r.keyword,
-    risk_level: r.risk_level || "",
-    lang: r.lang || "en"
-  }));
-  const sensitivePaths = _agentCategoryEnabledRules(scenData.extra_sensitive_paths).filter((r) => r.path).map((r) => ({
-    path: r.path,
-    risk_level: r.risk_level || "",
-    desc: r.desc || "",
-    credential: r.credential,
-    read_only: r.read_only,
-    deny_mode: r.deny_mode
-  }));
-  return {
-    agent_id: scenarioId,
-    description: "",
-    extra_command_patterns: cmdPatterns,
-    extra_injection_keywords: injKeywords,
-    extra_sensitive_paths: sensitivePaths,
-    builtin_safe_skills: [],
-    builtin_safe_action_types: [],
-    extra_skills: []
-  };
+function isHeuristicEnabled() {
+  if (process.env.AGENT_MOSS_DISABLE_HEURISTIC === "1") return false;
+  return layerEnabledOrDefault("L1_heuristic");
 }
-function updateScenarioRuleEnabled(scenarioId, category, ruleFp, enabled) {
-  const runtime = loadRuntimeConfig();
-  const cat = runtime.scenario_rules?.[scenarioId]?.[category];
-  if (cat) {
-    const targetFp = _ruleFingerprint(ruleFp);
-    for (const r of cat.rules || []) {
-      if (_ruleFingerprint(r) === targetFp) {
-        r.enabled = enabled;
-        break;
-      }
-    }
+function layerEnabledOrDefault(key) {
+  try {
+    return isLayerEnabled(key);
+  } catch {
+    return true;
   }
-  saveRuntimeConfig(runtime);
-  return runtime;
 }
-function addScenarioRule(scenarioId, category, rule) {
-  const runtime = loadRuntimeConfig();
-  if (!runtime.scenario_rules) runtime.scenario_rules = {};
-  if (!runtime.scenario_rules[scenarioId]) runtime.scenario_rules[scenarioId] = {};
-  const cats = runtime.scenario_rules[scenarioId];
-  if (!cats[category]) cats[category] = { category_enabled: true, category_desc: "", rules: [] };
-  (cats[category].rules || (cats[category].rules = [])).push({ ...rule, enabled: true, builtin: false });
-  saveRuntimeConfig(runtime);
-  return runtime;
+function isBrainEnabled() {
+  return process.env.AGENT_MOSS_BRAIN_ENABLED === "1";
 }
-function deleteScenarioRule(scenarioId, category, ruleFp) {
-  const runtime = loadRuntimeConfig();
-  const cat = runtime.scenario_rules?.[scenarioId]?.[category];
-  if (cat) {
-    const targetFp = _ruleFingerprint(ruleFp);
-    cat.rules = (cat.rules || []).filter((r) => _ruleFingerprint(r) !== targetFp);
-  }
-  saveRuntimeConfig(runtime);
-  return runtime;
+function isLogicRulesEnabled() {
+  if (process.env.AGENT_MOSS_DISABLE_LOGIC_RULES === "1") return false;
+  return layerEnabledOrDefault("L2_logic_rules");
 }
-function updateScenarioCategoryEnabled(scenarioId, category, enabled) {
-  const runtime = loadRuntimeConfig();
-  const cat = runtime.scenario_rules?.[scenarioId]?.[category];
-  if (cat) cat.category_enabled = enabled;
-  saveRuntimeConfig(runtime);
-  return runtime;
+function isFormalObserveMode() {
+  return process.env.AGENT_MOSS_FORMAL_OBSERVE === "1";
 }
-var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DEFAULT_LAYERS, DENY_MODE_LABELS, runtimeConfigCache, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, SKILL_ID_RE;
-var init_runtime_config = __esm({
-  "src/infra/runtime-config.ts"() {
+var timeoutConfig, retryConfig, llmConfig, __configModuleDir, USER_RULES_PATHS, customRules, PROVIDER_HEADERS;
+var init_config = __esm({
+  "src/config.ts"() {
     "use strict";
     init_esm_shims();
     init_paths();
-    init_heuristic();
-    init_logic_rules();
-    init_skill_loader();
-    __dirname4 = dirname3(fileURLToPath5(import.meta.url));
-    ENV_RUNTIME_CONFIG_PATH = "AGENT_MOSS_RUNTIME_CONFIG_PATH";
-    RUNTIME_CONFIG_DIR = runtimeDir();
-    RUNTIME_CONFIG_PATH = join3(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
-    LAYER_DISABLE_ENV = {
-      L1_heuristic: "AGENT_MOSS_DISABLE_HEURISTIC",
-      L2_logic_rules: "AGENT_MOSS_DISABLE_LOGIC_RULES",
-      L3_llm_analysis: "AGENT_MOSS_DISABLE_LLM"
-    };
-    DEFAULT_LAYERS = {
-      L1_heuristic: true,
-      L2_logic_rules: true,
-      L3_llm_analysis: true,
-      agent_rules_enabled: true,
-      scenario_rules_enabled: true
-    };
-    DENY_MODE_LABELS = {
-      deny_write: "\u4EC5\u62E6\u622A\u5199\u5165",
-      deny_read: "\u4EC5\u62E6\u622A\u8BFB\u53D6",
-      deny_both: "\u8BFB\u5199\u5747\u62E6\u622A"
+    init_runtime_config();
+    llmConfig = (() => {
+      const configPath = resolveConfigPath();
+      const fileConfig = fs2.existsSync(configPath) ? loadLLMConfigFromFile(configPath) : {};
+      const tr = loadTimeoutRetryFromFile(configPath);
+      timeoutConfig = tr.timeout;
+      retryConfig = tr.retry;
+      return {
+        provider: process.env.AGENT_MOSS_LLM_PROVIDER || fileConfig.provider || "openai",
+        baseUrl: process.env.AGENT_MOSS_LLM_BASE_URL || fileConfig.baseUrl || "https://api.openai.com/v1",
+        apiKey: process.env.AGENT_MOSS_LLM_API_KEY || process.env.OPENAI_API_KEY || fileConfig.apiKey || "",
+        model: process.env.AGENT_MOSS_LLM_MODEL || fileConfig.model || "gpt-4o",
+        temperature: parseFloat(process.env.AGENT_MOSS_LLM_TEMPERATURE || String(fileConfig.temperature ?? "0.1")),
+        maxTokens: parseInt(process.env.AGENT_MOSS_LLM_MAX_TOKENS || String(fileConfig.maxTokens ?? "4096"), 10),
+        // 优先用 env，否则用 timeout 块的 prompt1Timeout（对齐 py）
+        timeout: parseInt(process.env.AGENT_MOSS_LLM_TIMEOUT || String(fileConfig.timeout ?? String(tr.timeout.prompt1Timeout)), 10)
+      };
+    })();
+    __configModuleDir = (() => {
+      try {
+        return path2.dirname(fileURLToPath5(import.meta.url));
+      } catch {
+        return typeof __dirname !== "undefined" ? __dirname : process.cwd();
+      }
+    })();
+    USER_RULES_PATHS = [
+      path2.join(__configModuleDir, "rules", "user_rules.json"),
+      // 源在 ts/src/rules（一般不存在）
+      path2.join(__configModuleDir, "..", "rules", "user_rules.json"),
+      // dist: dist/engine/../rules = dist/rules ✅
+      path2.join(__configModuleDir, "..", "..", "agent_moss", "rules", "user_rules.json")
+      // dev src: ts/src/../../agent_moss
+    ];
+    customRules = loadCustomRules();
+    PROVIDER_HEADERS = {
+      "openrouter": {
+        "HTTP-Referer": "shturl.cc/LlVD5pyWViHjM",
+        "X-OpenRouter-Title": "AgentMoss"
+      },
+      "xai": {
+        "HTTP-Referer": "shturl.cc/LlVD5pyWViHjM"
+      }
     };
-    runtimeConfigCache = null;
-    _AGENTS_DIR_PROD = join3(__dirname4, "agents");
-    _AGENTS_DIR_DEV = join3(__dirname4, "..", "..", "..", "agent_moss", "agents");
-    _SCENARIOS_DIR_PROD = join3(__dirname4, "scenarios");
-    _SCENARIOS_DIR_DEV = join3(__dirname4, "..", "..", "..", "agent_moss", "scenarios");
-    SKILL_ID_RE = /^[A-Za-z0-9_-]+$/;
   }
 });
 
 // src/agents/index.ts
-import { readFileSync as readFileSync5, existsSync as existsSync5 } from "fs";
+import { readFileSync as readFileSync5, existsSync as existsSync6 } from "fs";
 import { resolve as resolve4, dirname as dirname4 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 function resolveAgentsDir() {
-  if (existsSync5(AGENTS_DIR_PROD)) return AGENTS_DIR_PROD;
-  if (existsSync5(AGENTS_DIR_DEV_FALLBACK)) return AGENTS_DIR_DEV_FALLBACK;
+  if (existsSync6(AGENTS_DIR_PROD)) return AGENTS_DIR_PROD;
+  if (existsSync6(AGENTS_DIR_DEV_FALLBACK)) return AGENTS_DIR_DEV_FALLBACK;
   return AGENTS_DIR_PROD;
 }
 function getAgentExtensions(agentId) {
@@ -2593,16 +3295,15 @@ function getAgentExtensions(agentId) {
   if (cache.has(agentId)) return cache.get(agentId) ?? null;
   let ext = null;
   try {
-    const { hasRuntimeConfig: hasRuntimeConfig2, loadRuntimeConfig: loadRuntimeConfig2, getEnabledAgentExtensions: getEnabledAgentExtensions2 } = (init_runtime_config(), __toCommonJS(runtime_config_exports));
-    if (hasRuntimeConfig2()) {
-      ext = getEnabledAgentExtensions2(loadRuntimeConfig2(), agentId);
+    if (hasRuntimeConfig()) {
+      ext = getEnabledAgentExtensions(loadRuntimeConfig(), agentId);
     }
   } catch {
   }
   if (ext === null) {
     const agentsDir = resolveAgentsDir();
     const rulesFile = resolve4(agentsDir, agentId, "rules.json");
-    if (!existsSync5(rulesFile)) {
+    if (!existsSync6(rulesFile)) {
       cache.set(agentId, null);
       return null;
     }
@@ -2621,7 +3322,7 @@ function getAgentExtensions(agentId) {
     }
   }
   cache.set(agentId, ext);
-  console.log(
+  console.error(
     `[AgentMoss agents] \u52A0\u8F7D agent ${agentId} \u5B9A\u5236\u89C4\u5219: ${ext.extra_command_patterns?.length ?? 0} cmd patterns, ${ext.extra_injection_keywords?.length ?? 0} injection keywords, ${ext.extra_sensitive_paths?.length ?? 0} sensitive paths, ${ext.builtin_safe_skills?.length ?? 0} builtin safe skills, ${ext.builtin_safe_action_types?.length ?? 0} builtin safe action types`
   );
   return ext;
@@ -2646,6 +3347,7 @@ var init_agents = __esm({
   "src/agents/index.ts"() {
     "use strict";
     init_esm_shims();
+    init_runtime_config();
     __filename4 = fileURLToPath6(import.meta.url);
     __dirname5 = dirname4(__filename4);
     AGENTS_DIR_PROD = resolve4(__dirname5, "agents");
@@ -2655,12 +3357,12 @@ var init_agents = __esm({
 });
 
 // src/scenarios/index.ts
-import { readFileSync as readFileSync6, existsSync as existsSync6 } from "fs";
+import { readFileSync as readFileSync6, existsSync as existsSync7 } from "fs";
 import { resolve as resolve5, dirname as dirname5 } from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 function resolveScenariosDir() {
-  if (existsSync6(SCENARIOS_DIR_PROD)) return SCENARIOS_DIR_PROD;
-  if (existsSync6(SCENARIOS_DIR_DEV_FALLBACK)) return SCENARIOS_DIR_DEV_FALLBACK;
+  if (existsSync7(SCENARIOS_DIR_PROD)) return SCENARIOS_DIR_PROD;
+  if (existsSync7(SCENARIOS_DIR_DEV_FALLBACK)) return SCENARIOS_DIR_DEV_FALLBACK;
   return SCENARIOS_DIR_PROD;
 }
 function getScenarioExtensions(scenarioId) {
@@ -2668,16 +3370,15 @@ function getScenarioExtensions(scenarioId) {
   if (cache2.has(scenarioId)) return cache2.get(scenarioId) ?? null;
   let ext = null;
   try {
-    const { hasRuntimeConfig: hasRuntimeConfig2, loadRuntimeConfig: loadRuntimeConfig2, getEnabledScenarioExtensions: getEnabledScenarioExtensions2 } = (init_runtime_config(), __toCommonJS(runtime_config_exports));
-    if (hasRuntimeConfig2()) {
-      ext = getEnabledScenarioExtensions2(loadRuntimeConfig2(), scenarioId);
+    if (hasRuntimeConfig()) {
+      ext = getEnabledScenarioExtensions(loadRuntimeConfig(), scenarioId);
     }
   } catch {
   }
   if (ext === null) {
     const scenariosDir = resolveScenariosDir();
     const rulesFile = resolve5(scenariosDir, scenarioId, "rules.json");
-    if (!existsSync6(rulesFile)) {
+    if (!existsSync7(rulesFile)) {
       cache2.set(scenarioId, null);
       return null;
     }
@@ -2707,7 +3408,7 @@ function getScenarioExtensions(scenarioId) {
     }
   }
   cache2.set(scenarioId, ext);
-  console.log(
+  console.error(
     `[AgentMoss scenarios] \u52A0\u8F7D\u573A\u666F ${scenarioId} \u5B9A\u5236\u89C4\u5219: ${ext.extra_command_patterns?.length ?? 0} cmd patterns, ${ext.extra_injection_keywords?.length ?? 0} injection keywords, ${ext.extra_sensitive_paths?.length ?? 0} sensitive paths`
   );
   return ext;
@@ -2727,6 +3428,7 @@ var init_scenarios = __esm({
     "use strict";
     init_esm_shims();
     init_agents();
+    init_runtime_config();
     __filename5 = fileURLToPath7(import.meta.url);
     __dirname6 = dirname5(__filename5);
     SCENARIOS_DIR_PROD = resolve5(__dirname6, "scenarios");
@@ -2736,6 +3438,62 @@ var init_scenarios = __esm({
 });
 
 // src/engine/heuristic.ts
+function _effectiveDangerousPatterns(osType) {
+  return runtimeConfigBridge.current?.effectiveDangerousPatterns(osType) ?? getDangerousPatternsForOs(osType);
+}
+function _loadDangerousPatterns(osType) {
+  const accepted = acceptedOsValues(osType);
+  const cmds = loadL1().dangerous_commands || [];
+  return cmds.filter((c) => accepted.includes(String(c.os || "linux").toLowerCase())).map((c) => ({
+    pattern: new RegExp(c.pattern, "i"),
+    severity: c.risk_level,
+    riskType: c.risk_type,
+    description: c.reason,
+    // 保留条目的原始平台归属（非查询用的 osType）—— seed 生成据此分组去重
+    os: String(c.os || "linux").toLowerCase()
+  }));
+}
+function getDangerousPatternsForOs(osType) {
+  const t = String(osType || "").toLowerCase();
+  if (t === "windows") return DANGEROUS_PATTERNS_WINDOWS;
+  if (t === "macos") return DANGEROUS_PATTERNS_MACOS;
+  if (t === "harmony" || t === "hmos" || t === "openharmony" || t === "hongmeng") return DANGEROUS_PATTERNS_HARMONY;
+  return DANGEROUS_PATTERNS2;
+}
+function normalizeShellObfuscation(text) {
+  let t = text.replace(/(?<=\w)(?:''|"")(?=\w)/g, "");
+  t = t.replace(/\$\{IFS\}|\$IFS/gi, " ");
+  return t;
+}
+function scanDangerousCommandPatterns(actionType, actionDetail, osType) {
+  const scanDetail = normalizePathSegments(stripLiteralTextSegments(actionDetail));
+  const scanCommands = String(osType || "").toLowerCase() === "windows" ? [
+    `${actionType}: ${scanDetail}`,
+    scanDetail,
+    `${actionType}: ${scanDetail.replace(/\//g, "\\")}`,
+    scanDetail.replace(/\//g, "\\")
+  ] : [`${actionType}: ${scanDetail}`, scanDetail];
+  const deob = normalizeShellObfuscation(scanDetail);
+  if (deob !== scanDetail) scanCommands.push(`${actionType}: ${deob}`, deob);
+  let top = null;
+  for (const rule of _effectiveDangerousPatterns(osType)) {
+    if (scanCommands.some((c) => rule.pattern.test(c))) {
+      if (!top || severityRank(rule.severity) > severityRank(top.sev)) {
+        top = { sev: rule.severity, type: rule.riskType, desc: rule.description };
+      }
+    }
+  }
+  if (!top) return null;
+  return {
+    allowed: false,
+    reason: `\u68C0\u6D4B\u5230\u9AD8\u5371\u64CD\u4F5C: ${top.desc}`,
+    riskLevel: top.sev,
+    riskType: top.type,
+    confidence: 95,
+    source: "heuristic",
+    violatedLayers: ["L1.1"]
+  };
+}
 function runHeuristicCheck(input) {
   const command = `${input.aNext.actionType}: ${input.aNext.actionDetail}`;
   const matched = [];
@@ -2762,11 +3520,23 @@ function runHeuristicCheck(input) {
     }
   }
   const scanDetail = normalizePathSegments(stripLiteralTextSegments(input.aNext.actionDetail));
-  const scanCommand = `${input.aNext.actionType}: ${scanDetail}`;
+  const scanCommands = String(input.osType || "").toLowerCase() === "windows" ? [
+    `${input.aNext.actionType}: ${scanDetail}`,
+    scanDetail,
+    `${input.aNext.actionType}: ${scanDetail.replace(/\//g, "\\")}`,
+    scanDetail.replace(/\//g, "\\")
+  ] : [`${input.aNext.actionType}: ${scanDetail}`, scanDetail];
+  const deobfuscated = normalizeShellObfuscation(scanDetail);
+  if (deobfuscated !== scanDetail) {
+    scanCommands.push(
+      `${input.aNext.actionType}: ${deobfuscated}`,
+      deobfuscated
+    );
+  }
   let topRiskType = "";
   const exemptKeygen = isSshKeygenGenerate(input.aNext.actionDetail);
-  for (const rule of DANGEROUS_PATTERNS) {
-    if (rule.pattern.test(scanCommand)) {
+  for (const rule of _effectiveDangerousPatterns(input.osType)) {
+    if (scanCommands.some((c) => rule.pattern.test(c))) {
       if (exemptKeygen && rule.riskType === "file_access") continue;
       matched.push(rule.description);
       if (severityRank(rule.severity) > severityRank(highestSeverity)) {
@@ -2784,7 +3554,7 @@ function runHeuristicCheck(input) {
     for (const rule of agentExt.extra_command_patterns) {
       try {
         const re = new RegExp(rule.pattern, "i");
-        if (re.test(scanCommand)) {
+        if (scanCommands.some((c) => re.test(c))) {
           matched.push(`agent \u4E13\u5C5E\u89C4\u5219: ${rule.reason}`);
           if (severityRank(rule.risk_level) > severityRank(highestSeverity)) {
             highestSeverity = rule.risk_level;
@@ -2796,7 +3566,7 @@ function runHeuristicCheck(input) {
     }
   }
   const injectionText = isSearchActionType(input.aNext.actionType) ? `${input.aNext.actionType} ${input.reason || ""} ${input.promptSession || ""}`.toLowerCase() : `${input.aNext.actionType} ${input.aNext.actionDetail} ${input.reason || ""} ${input.promptSession || ""}`.toLowerCase();
-  const injectionHits = checkInjectionKeywords(injectionText, agentExt?.extra_injection_keywords);
+  const injectionHits = checkInjectionKeywords(injectionText, agentExt?.extra_injection_keywords, input.osType);
   if (injectionHits.length > 0) {
     const topHit = injectionHits.reduce((a, b) => severityRank(a.riskLevel) >= severityRank(b.riskLevel) ? a : b);
     matched.push(...injectionHits.map((h) => `\u6CE8\u5165\u5173\u952E\u8BCD [${h.lang}]: ${h.keyword}`));
@@ -2809,7 +3579,7 @@ function runHeuristicCheck(input) {
   const detailL = input.aNext.actionDetail.toLowerCase();
   const isExcludedType = SENSITIVE_EXCLUDED_PREFIXES.some((p) => actionTypeL.startsWith(p));
   const dangerousResult = checkDangerousPatterns(actionTypeL, detailL);
-  const pathResult = isExcludedType ? null : checkSensitivePath(detailL, input.cwd || "/", agentExt);
+  const pathResult = isExcludedType ? null : checkSensitivePath(detailL, input.cwd || "/", agentExt, input.osType);
   const homeResult = checkHomeDeletion(actionTypeL, detailL);
   const mergeResults = [dangerousResult, pathResult, homeResult].filter(Boolean);
   if (mergeResults.length > 0) {
@@ -2845,9 +3615,10 @@ function runHeuristicCheck(input) {
   if (lateralResult) return lateralResult;
   return null;
 }
-function checkInjectionKeywords(text, extraKeywords) {
+function checkInjectionKeywords(text, extraKeywords, osType) {
   const hits = [];
-  for (const entry of INJECTION_KEYWORDS) {
+  const baseKeywords = runtimeConfigBridge.current?.effectiveInjectionKeywords(osType) ?? INJECTION_KEYWORDS;
+  for (const entry of baseKeywords) {
     if (text.includes(entry.keyword.toLowerCase())) {
       hits.push(entry);
     }
@@ -2907,7 +3678,7 @@ function buildPathContext(actionDetail) {
   if (!PATH_CONTEXT_TRIGGER_RE.test(actionDetail)) return "";
   const stripped = stripLiteralTextSegments(actionDetail);
   const lines = [];
-  for (const seg of splitCommandSegments(stripped)) {
+  for (const seg of splitCommandSegments2(stripped)) {
     for (const [raw, lex] of resolvePathTokens(seg)) {
       lines.push(`- \u547D\u4EE4\u6BB5 \`${seg.trim().slice(0, 60)}\`\uFF1A\`${raw}\` \u8BCD\u6CD5\u89E3\u6790\u4E3A \`${lex}\``);
     }
@@ -2922,7 +3693,7 @@ function stripLiteralTextSegments(actionDetail) {
     return actionDetail;
   }
   const resultParts = [];
-  for (const seg of splitCommandSegments(actionDetail)) {
+  for (const seg of splitCommandSegments2(actionDetail)) {
     const fw = (seg.trim().split(/\s+/)[0] || "").toLowerCase();
     if (fw === "echo" || fw === "printf") {
       const segUnquotedRedirect = seg.replace(
@@ -2942,7 +3713,7 @@ function stripHeredocContent(actionDetail) {
     "<<heredoc>>\n"
   );
 }
-function normalizePathSegments(text) {
+function normalizePathSegments(text, foldQuotes = false) {
   const protTokens = [];
   let t = text.replace(/\b(https?|ftp|file):\/\//gi, (m) => {
     const scheme = m.slice(0, m.indexOf(":"));
@@ -2950,10 +3721,12 @@ function normalizePathSegments(text) {
     return `${scheme}__PROT${protTokens.length - 1}__`;
   });
   const quoteTokens = [];
-  t = t.replace(/'[^']*'|"[^"]*"/g, (m) => {
-    quoteTokens.push(m);
-    return `__Q${quoteTokens.length - 1}__`;
-  });
+  if (!foldQuotes) {
+    t = t.replace(/'[^']*'|"[^"]*"/g, (m) => {
+      quoteTokens.push(m);
+      return `__Q${quoteTokens.length - 1}__`;
+    });
+  }
   t = t.replace(/\/{2,}/g, "/");
   t = t.replace(/\/\.\//g, "/");
   for (let i = 0; i < quoteTokens.length; i++) {
@@ -2964,7 +3737,12 @@ function normalizePathSegments(text) {
   }
   return t;
 }
-function splitCommandSegments(actionDetail) {
+function pathScanVariants(actionDetailLower) {
+  const base = stripLiteralTextSegments(actionDetailLower);
+  const deep = normalizePathSegments(base, true);
+  return deep === base ? [base] : [base, deep];
+}
+function splitCommandSegments2(actionDetail) {
   const segments = [];
   let cur = "";
   let quote = null;
@@ -3013,11 +3791,15 @@ function isSearchActionType(actionType) {
   const at = actionType.toLowerCase();
   return SEARCH_ACTION_PREFIXES.some((p) => at.startsWith(p)) || ["websearch", "web_search", "search", "query"].includes(at);
 }
-function checkSensitivePath(command, cwd, agentExt) {
+function checkSensitivePath(command, cwd, agentExt, osType) {
   const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
-  const isWriteOpFlag = isWriteOperation("", command);
+  const { root: rootPaths, home: homePaths, credential: credentialPaths } = getSensitivePathsForOs(osType);
+  const isWriteOpFlag = isWriteOperation("", command, void 0, osType);
   const keygenGenerate = isSshKeygenGenerate(command);
-  const pathScanText = normalizePathSegments(stripLiteralTextSegments(command));
+  const pathScanTexts = pathScanVariants(command);
+  if (String(osType || "").toLowerCase() === "windows") {
+    pathScanTexts.push(...pathScanTexts.map((t) => t.replace(/\//g, "\\")));
+  }
   const pathMatches = (text, path6) => {
     const parts = path6.split(/(\(\?!.*?\))/);
     const escaped = parts.map((part) => {
@@ -3027,8 +3809,9 @@ function checkSensitivePath(command, cwd, agentExt) {
     const re = path6.startsWith(".") || path6.startsWith("/") ? new RegExp(`(?:^|[\\s/\\\\'"])${escaped}\\b`, "i") : new RegExp(`\\b${escaped}\\b`, "i");
     return re.test(text);
   };
-  for (const sp of ROOT_SENSITIVE_PATHS) {
-    if (pathMatches(pathScanText, sp.path.toLowerCase())) {
+  const pathMatchesAny = (path6) => pathScanTexts.some((t) => pathMatches(t, path6));
+  for (const sp of rootPaths) {
+    if (pathMatchesAny(sp.path.toLowerCase())) {
       if (keygenGenerate) continue;
       if (sp.path === "/dev/random") {
         if (isWriteOpFlag) {
@@ -3044,9 +3827,9 @@ function checkSensitivePath(command, cwd, agentExt) {
           violatedLayers: ["L1.1"]
         };
       }
-      if (!isWriteOpFlag && !sp.credential) {
-        continue;
-      }
+      const denyMode = sp.denyMode || (sp.credential ? "deny_both" : sp.readOnly ? "deny_read" : "deny_write");
+      if (denyMode === "deny_write" && !isWriteOpFlag) continue;
+      if (denyMode === "deny_read" && isWriteOpFlag) continue;
       return {
         allowed: false,
         reason: `\u5C1D\u8BD5\u8BBF\u95EE\u7CFB\u7EDF\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
@@ -3059,17 +3842,19 @@ function checkSensitivePath(command, cwd, agentExt) {
       };
     }
   }
-  for (const sp of HOME_SENSITIVE_PATHS) {
+  for (const sp of homePaths) {
     const expanded = `${expandedCwd}/${sp.path}`;
     let pPath = sp.path;
     if (!sp.path.endsWith(".pub")) pPath = `${sp.path}(?!\\.pub)`;
     let dirPrefixMatch = null;
     if (sp.dirDelOnly) {
       const dirRe = (t) => new RegExp(`(?:^|[\\s/\\\\'"])${t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:/|[\\s'"\\\\]|$)`, "i");
-      dirPrefixMatch = dirRe(sp.path).test(pathScanText) || dirRe(expanded.toLowerCase()).test(pathScanText);
+      dirPrefixMatch = pathScanTexts.some(
+        (t) => dirRe(sp.path).test(t) || dirRe(expanded.toLowerCase()).test(t)
+      );
     }
-    const pathReMatch = sp.dirDelOnly ? !!dirPrefixMatch : pathMatches(pathScanText, pPath);
-    const expandedReMatch = sp.dirDelOnly ? false : pathMatches(pathScanText, expanded + (sp.path.endsWith(".pub") ? "" : "(?!\\.pub)"));
+    const pathReMatch = sp.dirDelOnly ? !!dirPrefixMatch : pathMatchesAny(pPath);
+    const expandedReMatch = sp.dirDelOnly ? false : pathMatchesAny(expanded + (sp.path.endsWith(".pub") ? "" : "(?!\\.pub)"));
     if (pathReMatch || expandedReMatch) {
       if (keygenGenerate) continue;
       if (sp.dirDelOnly) {
@@ -3099,9 +3884,9 @@ function checkSensitivePath(command, cwd, agentExt) {
         }
         continue;
       }
-      if (!isWriteOpFlag && !sp.credential) {
-        continue;
-      }
+      const denyMode = sp.denyMode || (sp.credential ? "deny_both" : sp.readOnly ? "deny_read" : "deny_write");
+      if (denyMode === "deny_write" && !isWriteOpFlag) continue;
+      if (denyMode === "deny_read" && isWriteOpFlag) continue;
       return {
         allowed: false,
         reason: `\u5C1D\u8BD5\u8BBF\u95EE\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
@@ -3138,7 +3923,7 @@ function checkSensitivePath(command, cwd, agentExt) {
       }
     }
   }
-  for (const cp of CREDENTIAL_PATHS) {
+  for (const cp of credentialPaths) {
     const escaped = cp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     const re = cp.path.startsWith(".") ? new RegExp(`(?:^|[\\s/\\\\'"])${escaped}\\b`) : new RegExp(`\\b${escaped}\\b`);
     if (re.test(command)) {
@@ -3258,7 +4043,7 @@ function isDeleteActionForDir(command, dirPath) {
   }
   for (const seg of low.split(/&&|\|\||;|\n/)) {
     const fw = (seg.trim().split(/\s+/)[0] || "").toLowerCase();
-    if ((fw === "rm" || fw === "unlink" || fw === "rmdir") && low.includes(dpath)) {
+    if ((fw === "rm" || fw === "unlink" || fw === "rmdir") && seg.includes(dpath)) {
       return true;
     }
   }
@@ -3441,7 +4226,7 @@ function checkLateralMovement(actionDetail) {
   }
   return null;
 }
-var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, PATH_CONTEXT_TRIGGER_RE, HOME_PREFIX_RE, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES, HOME_TARGET_RE, HOME_ASSIGN_RE;
+var INJECTION_KEYWORDS, DANGEROUS_PATTERNS2, DANGEROUS_PATTERNS_WINDOWS, DANGEROUS_PATTERNS_MACOS, DANGEROUS_PATTERNS_HARMONY, PATH_CONTEXT_TRIGGER_RE, HOME_PREFIX_RE, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES, HOME_TARGET_RE, HOME_ASSIGN_RE;
 var init_heuristic = __esm({
   "src/engine/heuristic.ts"() {
     "use strict";
@@ -3450,6 +4235,7 @@ var init_heuristic = __esm({
     init_agents();
     init_scenarios();
     init_runtime_config();
+    init_runtime_config_bridge();
     init_rules_loader();
     init_logic_rules();
     INJECTION_KEYWORDS = (() => {
@@ -3460,15 +4246,10 @@ var init_heuristic = __esm({
         lang: k.lang || "en"
       }));
     })();
-    DANGEROUS_PATTERNS = (() => {
-      const cmds = loadL1().dangerous_commands || [];
-      return cmds.map((c) => ({
-        pattern: new RegExp(c.pattern, "i"),
-        severity: c.risk_level,
-        riskType: c.risk_type,
-        description: c.reason
-      }));
-    })();
+    DANGEROUS_PATTERNS2 = _loadDangerousPatterns("linux");
+    DANGEROUS_PATTERNS_WINDOWS = _loadDangerousPatterns("windows");
+    DANGEROUS_PATTERNS_MACOS = _loadDangerousPatterns("macos");
+    DANGEROUS_PATTERNS_HARMONY = _loadDangerousPatterns("harmony");
     PATH_CONTEXT_TRIGGER_RE = /(?:^|[;&|]\s*)(?:rm|rmdir|unlink|ln|mv|cp|dd|truncate|shred|chmod|chown)\b/i;
     HOME_PREFIX_RE = /(?:~|~(?=\/)|\$HOME\b|\$\{HOME\}|\/home\/[a-z0-9_.-]+)/gi;
     SENSITIVE_EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
@@ -3479,7 +4260,7 @@ var init_heuristic = __esm({
 });
 
 // src/engine/template-loader.ts
-import { readFileSync as readFileSync7, existsSync as existsSync7 } from "fs";
+import { readFileSync as readFileSync7, existsSync as existsSync8 } from "fs";
 import { resolve as resolve6, dirname as dirname6 } from "path";
 import { fileURLToPath as fileURLToPath8 } from "url";
 function loadTemplates() {
@@ -3493,7 +4274,7 @@ function loadTemplates() {
   }
   for (const file of TEMPLATE_FILES) {
     const filePath = resolve6(dir, file);
-    if (existsSync7(filePath)) {
+    if (existsSync8(filePath)) {
       const key = file.replace(".txt", "").replace("_template", "");
       cachedTemplates[key] = readFileSync7(filePath, "utf-8");
     }
@@ -3569,7 +4350,7 @@ function assessKeywordCombinationRisk(matchedKeywords, scriptContent) {
 }
 function readScriptContent(scriptPath, maxLines = 500) {
   try {
-    const expandedPath = scriptPath.startsWith("~") ? join4(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve7(scriptPath);
+    const expandedPath = scriptPath === "~" || scriptPath.startsWith("~/") ? join4(process.env.HOME || "/home/user", scriptPath.slice(1)) : resolve7(scriptPath);
     const raw = readFileSync8(expandedPath, "utf-8");
     const lines = raw.split("\n").slice(0, maxLines);
     return { content: lines.join("\n"), lineCount: lines.length, error: "" };
@@ -4519,9 +5300,20 @@ function evalExpr2(text, env) {
   const result = [];
   for (const p of parts) {
     if (!p) continue;
-    const brace = p.match(/^\$\{([^}]+)\}$/);
+    const brace = p.match(/^\$\{([^}]*)\}$/);
     if (brace) {
       const inner = brace[1];
+      const dm = inner.match(/^([A-Za-z_][A-Za-z0-9_]*|\d+):?-(.*)$/s);
+      if (dm) {
+        const key = /^\d+$/.test(dm[1]) ? `$${dm[1]}` : dm[1];
+        const bound = env.get(key);
+        if (bound && !(bound.kind === "concrete" && !bound.value)) {
+          result.push(bound);
+        } else {
+          result.push(evalExpr2(dm[2], env));
+        }
+        continue;
+      }
       if (/^\d+$/.test(inner)) {
         const v = env.get(`$${inner}`);
         result.push(v || svalSym(`$${inner}`));
@@ -4737,7 +5529,7 @@ var init_symbolic = __esm({
     LOOP_DONE_RE = /\bdone\b/g;
     FN_DEF_RE = /^\s*(?:function\s+)?[A-Za-z_][A-Za-z0-9_]*\s*\(\s*\)\s*\{/;
     FN_DEF_KW_RE = /^\s*function\s+[A-Za-z_][A-Za-z0-9_]*\s*\{?/;
-    EXPR_SPLIT_RE = /(\$\{?\d+\}?|\$\{?[A-Za-z_][A-Za-z0-9_]*\}?)/;
+    EXPR_SPLIT_RE = /(\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*|\$\d+)/;
     HAS_GLOB = /[*?[]/;
   }
 });
@@ -5018,6 +5810,14 @@ var init_backends = __esm({
 import * as fs3 from "fs";
 import * as path3 from "path";
 import * as os from "os";
+function maxFileSizeFromEnv() {
+  const raw = (process.env.AGENT_MOSS_SCRIPT_MAX_FILE_SIZE || "").trim();
+  if (raw) {
+    const v = Number(raw);
+    if (Number.isFinite(v) && v > 0) return v;
+  }
+  return 2 * 1024 * 1024;
+}
 function pickBackend(pathStr) {
   const lower = pathStr.toLowerCase();
   for (const ext of Object.keys(BACKENDS)) {
@@ -5060,6 +5860,7 @@ function emptyNode(pathStr, depth) {
     depth,
     childPaths: [],
     error: "",
+    unanalyzable: false,
     l1Hit: false,
     l1RiskLevel: "",
     l1RiskType: "",
@@ -5085,7 +5886,7 @@ var init_tracker = __esm({
     init_backends();
     DEFAULT_MAX_DEPTH = 14;
     DEFAULT_MAX_NODES = 64;
-    DEFAULT_MAX_FILE_SIZE = 2 * 1024 * 1024;
+    DEFAULT_MAX_FILE_SIZE = maxFileSizeFromEnv();
     DEFAULT_MAX_TOTAL_SIZE = 8 * 1024 * 1024;
     BACKENDS = {
       ".py": new PythonBackend()
@@ -5156,6 +5957,7 @@ var init_tracker = __esm({
           node2.error = error;
           node2.fileSize = fileSize;
           node2.lineCount = lineCount;
+          node2.unanalyzable = error.startsWith("\u811A\u672C\u6587\u4EF6\u8FC7\u5927");
           this.result.nodes.push(node2);
           this.visiting.delete(pathStr);
           return;
@@ -5202,9 +6004,9 @@ var init_tracker = __esm({
 });
 
 // src/engine/script-content-analyzer.ts
-import { statSync as statSync3, existsSync as existsSync9 } from "fs";
+import { statSync as statSync3, existsSync as existsSync10 } from "fs";
 import { resolve as resolve9, join as join6, isAbsolute as isAbsolute2 } from "path";
-import { homedir as homedir4 } from "os";
+import { homedir as homedir3 } from "os";
 function emptyChain() {
   return {
     nodes: [],
@@ -5310,12 +6112,12 @@ function extractInlineScriptPath(actionDetail) {
     const subShellRe = /subprocess\.(?:run|call|Popen|check_output|check_call)\s*\(\s*(['"])(.*?)\1[^)]*?shell\s*=\s*true/gi;
     while ((m = subShellRe.exec(code)) !== null) candidates.push(m[2]);
     for (const cand of candidates) {
-      const tokens = cand.includes(",") ? cand.split(/\s*,\s*/).map((t) => t.trim().replace(/^['"]|['"]$/g, "")) : cand.split(/\s+/);
+      const tokens = cand.includes(",") ? cand.split(/\s*,\s*/).map((t) => t.trim().replace(/^['"]|['"]$/g, "")) : shlexSplit(cand);
       for (const tok of tokens) {
         if (looksLikeScriptPath(tok)) {
           try {
             const resolved = resolvePath2(tok.replace(/^['"]|['"]$/g, ""));
-            if (existsSync9(resolved)) {
+            if (existsSync10(resolved)) {
               const stat = statSync3(resolved);
               if (stat.isFile()) return resolved;
             }
@@ -5329,7 +6131,7 @@ function extractInlineScriptPath(actionDetail) {
       const p = m[1];
       try {
         const resolved = resolvePath2(p);
-        if (existsSync9(resolved)) {
+        if (existsSync10(resolved)) {
           const stat = statSync3(resolved);
           if (stat.isFile()) return resolved;
         }
@@ -5345,7 +6147,7 @@ function extractInlineScriptPath(actionDetail) {
     let resolved;
     try {
       resolved = resolvePath2(p);
-      if (existsSync9(resolved)) {
+      if (existsSync10(resolved)) {
         const stat = statSync3(resolved);
         if (stat.isFile()) return resolved;
       }
@@ -5354,10 +6156,39 @@ function extractInlineScriptPath(actionDetail) {
   }
   return null;
 }
+function shlexSplit(s) {
+  const out = [];
+  let cur = "";
+  let quote = null;
+  let quoted = false;
+  for (let i = 0; i < s.length; i++) {
+    const ch = s[i];
+    if (quote) {
+      if (ch === quote) quote = null;
+      else if (ch === "\\" && quote === '"' && i + 1 < s.length) cur += s[++i];
+      else cur += ch;
+    } else if (ch === '"' || ch === "'") {
+      quote = ch;
+      quoted = true;
+    } else if (ch === "\\" && i + 1 < s.length) {
+      cur += s[++i];
+    } else if (/\s/.test(ch)) {
+      if (cur || quoted) {
+        out.push(cur);
+        cur = "";
+        quoted = false;
+      }
+    } else {
+      cur += ch;
+    }
+  }
+  if (cur || quoted) out.push(cur);
+  return out;
+}
 function resolvePath2(p) {
   let expanded = p;
   if (expanded.startsWith("~/") || expanded === "~") {
-    expanded = join6(homedir4(), expanded.slice(1));
+    expanded = join6(homedir3(), expanded.slice(1));
   }
   return resolve9(expanded);
 }
@@ -5368,7 +6199,7 @@ function scanScriptChainWithL1(chain, input) {
       ...input,
       aNext: { actionType: "bash", actionDetail: node.preprocessedContent }
     };
-    const l1 = runHeuristicCheck(virtualInput);
+    const l1 = scanDangerousCommandPatterns("bash", node.preprocessedContent, input.osType);
     if (l1 && !l1.allowed) {
       node.l1Hit = true;
       node.l1RiskLevel = l1.riskLevel;
@@ -5391,18 +6222,25 @@ function scanScriptChainWithL2(chain, input) {
       ...input,
       aNext: { actionType: "bash", actionDetail: node.preprocessedContent }
     };
-    const l2 = runLogicCheck(virtualInput);
-    if (l2 && !l2.allowed) {
-      node.l2Hit = true;
-      node.l2ViolatedRule = `script_logic:${node.scriptPath}`;
-      node.l2RiskLevel = l2.riskLevel;
-      node.l2RiskType = l2.riskType;
-      node.l2Reason = `\u811A\u672C ${node.scriptPath} (\u6DF1\u5EA6 ${node.depth}) \u4E2D: ${l2.reason}`;
-      if (l2.riskLevel === "critical") {
-        chain.hasCritical = true;
-        chain.firstHitNode = node;
-        break;
-      }
+    let l2 = null;
+    if (isLogicRulesEnabled()) {
+      l2 = checkSensitivePath(
+        node.preprocessedContent.toLowerCase(),
+        input.cwd || "/",
+        null,
+        input.osType
+      ) || checkIntentConsistency(virtualInput);
+    }
+    if (!l2 || l2.allowed) continue;
+    node.l2Hit = true;
+    node.l2ViolatedRule = `script_logic:${node.scriptPath}`;
+    node.l2RiskLevel = l2.riskLevel;
+    node.l2RiskType = l2.riskType;
+    node.l2Reason = `\u811A\u672C ${node.scriptPath} (\u6DF1\u5EA6 ${node.depth}) \u4E2D: ${l2.reason}`;
+    if (l2.riskLevel === "critical") {
+      chain.hasCritical = true;
+      chain.firstHitNode = node;
+      break;
     }
   }
   if (!chain.hasHigh) {
@@ -5441,13 +6279,16 @@ function analyzeScriptContent2(input) {
     resolvedPath = join6(input.cwd || process.cwd(), resolvedPath);
   }
   const l1Adapter = (content) => {
-    const virtualInput = {
-      ...input,
-      aNext: { actionType: "bash", actionDetail: content }
-    };
-    const j = runHeuristicCheck(virtualInput);
+    const j = scanDangerousCommandPatterns("bash", content, input.osType);
     if (j && !j.allowed) {
-      return { hit: true, riskLevel: j.riskLevel, riskType: j.riskType, reason: j.reason, matchedPatterns: [] };
+      return {
+        hit: true,
+        riskLevel: j.riskLevel,
+        riskType: j.riskType,
+        reason: j.reason,
+        matchedPatterns: []
+        // SecurityJudgment 不带模式列表（见 types.ts）；留空即可
+      };
     }
     return { hit: false, riskLevel: "", riskType: "", reason: "", matchedPatterns: [] };
   };
@@ -5526,6 +6367,7 @@ var init_script_content_analyzer = __esm({
     "use strict";
     init_esm_shims();
     init_heuristic();
+    init_config();
     init_logic_rules();
     init_inline_analyzer();
     init_tracker();
@@ -5624,14 +6466,14 @@ __export(token_stats_exports, {
   recordTokenUsage: () => recordTokenUsage,
   resetTokenStats: () => resetTokenStats
 });
-import { readFileSync as readFileSync11, writeFileSync as writeFileSync2, existsSync as existsSync10, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2 } from "fs";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync2, existsSync as existsSync11, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2 } from "fs";
 function getStatsPath() {
   const envPath = process.env[ENV_STATS_PATH];
   if (envPath) return envPath;
   return getTokenStatsPath();
 }
 function loadAllRecords(statsPath) {
-  if (!existsSync10(statsPath)) return [];
+  if (!existsSync11(statsPath)) return [];
   try {
     const data = JSON.parse(readFileSync11(statsPath, "utf-8"));
     if (Array.isArray(data)) return data;
@@ -5644,7 +6486,7 @@ function loadAllRecords(statsPath) {
 function saveRecords(statsPath, records) {
   try {
     const dir = statsPath.substring(0, statsPath.lastIndexOf("/"));
-    if (dir && !existsSync10(dir)) mkdirSync2(dir, { recursive: true });
+    if (dir && !existsSync11(dir)) mkdirSync2(dir, { recursive: true });
     writeFileSync2(statsPath, JSON.stringify(records, null, 2), "utf-8");
   } catch (e) {
   }
@@ -5771,7 +6613,7 @@ function getTokenTrend(days = 0, startDate, endDate) {
 }
 function resetTokenStats() {
   const statsPath = getStatsPath();
-  if (existsSync10(statsPath)) {
+  if (existsSync11(statsPath)) {
     try {
       unlinkSync2(statsPath);
     } catch {
@@ -6028,9 +6870,9 @@ var init_llm_analyzer = __esm({
 });
 
 // src/brain/rule-store.ts
-import { existsSync as existsSync11, readFileSync as readFileSync12, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync12, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
 import { join as join7 } from "path";
-import { homedir as homedir5 } from "os";
+import { homedir as homedir4 } from "os";
 function getRulesPath() {
   const envPath = process.env[ENV_RULES_PATH];
   if (envPath) return envPath;
@@ -6048,7 +6890,7 @@ var init_rule_store = __esm({
   "src/brain/rule-store.ts"() {
     "use strict";
     init_esm_shims();
-    DEFAULT_RULES_PATH = join7(homedir5(), ".agentmoss", "brain", "rules.json");
+    DEFAULT_RULES_PATH = join7(homedir4(), ".agentmoss", "brain", "rules.json");
     ENV_RULES_PATH = "AGENT_MOSS_BRAIN_RULES_PATH";
     STATUS_DRAFT = "draft";
     STATUS_APPROVED = "approved";
@@ -6065,7 +6907,7 @@ var init_rule_store = __esm({
         this.data = this.load();
       }
       load() {
-        if (!existsSync11(this.path)) {
+        if (!existsSync12(this.path)) {
           return { version: 1, rules: [], pattern_candidates: [] };
         }
         try {
@@ -8080,18 +8922,21 @@ var coordinator_exports = {};
 __export(coordinator_exports, {
   TRUSTED_SKILLS_BASE: () => TRUSTED_SKILLS_BASE,
   _resetBrainForTest: () => _resetBrainForTest,
-  runAnalysis: () => runAnalysis
+  extractFirstCommand: () => extractFirstCommand,
+  matchesAny: () => matchesAny,
+  runAnalysis: () => runAnalysis,
+  splitCommandSegments: () => splitCommandSegments,
+  whitelistTier: () => whitelistTier
 });
-function extractFirstCommand(command) {
-  let main2 = command.split("|")[0].trim();
-  for (const sep of ["&&", "||"]) {
-    const idx = main2.indexOf(sep);
-    if (idx !== -1) {
-      main2 = main2.substring(0, idx).trim();
-      break;
-    }
-  }
-  return main2;
+function whitelistTier(command, fullySafe, readonlySensitive) {
+  const segments = splitCommandSegments(command);
+  if (segments.length === 0) return "";
+  if (segments.some((seg) => hasCommandSubstitution(seg))) return "";
+  const hitFull = (seg) => matchesAny(seg, fullySafe);
+  const hitAny = (seg) => hitFull(seg) || matchesAny(seg, readonlySensitive);
+  if (segments.every(hitFull)) return "full";
+  if (segments.every(hitAny)) return "readonly";
+  return "";
 }
 function extractRawCommand(detail) {
   const m = detail.match(/command=([^,]+)/);
@@ -8122,7 +8967,7 @@ async function runAnalysis(input) {
   if (heuristicResult && !heuristicResult.allowed) {
     const skipInlineFileAccess = (isInlineScriptCmd || isLiteralTextCmd) && heuristicResult.riskType === "file_access";
     if (!skipInlineFileAccess) {
-      const shouldDenyL1 = heuristicResult.riskLevel === "high" || heuristicResult.riskLevel === "critical" || heuristicResult.riskLevel === "medium" && heuristicResult.riskType === "file_access";
+      const shouldDenyL1 = heuristicResult.riskLevel === "high" || heuristicResult.riskLevel === "critical" || heuristicResult.riskLevel === "medium" && heuristicResult.riskType === "file_access" || heuristicResult.riskLevel === "medium" && heuristicResult.riskType === "resource_exhaustion";
       if (shouldDenyL1) {
         return heuristicResult;
       }
@@ -8132,6 +8977,19 @@ async function runAnalysis(input) {
   if (input.aNext.actionType.toLowerCase() === "bash") {
     scriptChain = analyzeScriptContent2(input);
     if (scriptChain.nodes.length > 0) {
+      for (const node of scriptChain.nodes) {
+        if (node.unanalyzable) {
+          return {
+            allowed: false,
+            reason: `\u811A\u672C\u5B58\u5728\u4F46\u5185\u5BB9\u65E0\u6CD5\u9759\u6001\u5206\u6790\uFF08${node.error}\uFF09\u2014\u2014 \u65E0\u6CD5\u786E\u8BA4\u5176\u5B89\u5168\u6027\uFF0C\u6309\u4E0D\u53EF\u4FE1\u5904\u7406\u3002\u6587\u4EF6: ${node.scriptPath}\u3002\u5982\u786E\u5C5E\u6B63\u5E38\u5927\u811A\u672C\uFF0C\u53EF\u8BBE AGENT_MOSS_SCRIPT_MAX_FILE_SIZE \u653E\u5BBD\u4E0A\u9650\u3002`,
+            riskLevel: "high",
+            riskType: "script_execution",
+            confidence: 80,
+            source: "heuristic_script_scan",
+            violatedLayers: ["L1.2"]
+          };
+        }
+      }
       for (const node of scriptChain.nodes) {
         if (node.l1Hit && (node.l1RiskLevel === "high" || node.l1RiskLevel === "critical")) {
           return {
@@ -8219,11 +9077,15 @@ async function runAnalysis(input) {
   let skipLLM = READONLY_SENSITIVE_TOOLS.has(actionType);
   if (actionType === "bash" || actionType === "executebash" || actionType === "terminal-executebash") {
     const firstCmd = extractFirstCommand(lowerDetail);
-    if (matchesAny(firstCmd, FULLY_SAFE_BASH_PATTERNS)) {
-      const fullCmdHit = DANGEROUS_PATTERNS.some(
+    const { fullySafeCommands, readonlySensitiveCommands } = getPlatformTraits(input.osType);
+    const tier = whitelistTier(lowerDetail, fullySafeCommands, readonlySensitiveCommands);
+    if (tier === "full") {
+      const fastPassScanText = normalizePathSegments(stripLiteralTextSegments(lowerDetail));
+      const osPatterns = getDangerousPatternsForOs(input.osType);
+      const fullCmdHit = osPatterns.some(
         (p) => p.severity === "critical" || p.severity === "high"
-      ) && DANGEROUS_PATTERNS.some(
-        (p) => (p.severity === "critical" || p.severity === "high") && p.pattern.test(lowerDetail)
+      ) && osPatterns.some(
+        (p) => (p.severity === "critical" || p.severity === "high") && p.pattern.test(fastPassScanText)
       );
       const hasRedirectWrite = isWriteOperation(firstCmd, lowerDetail);
       if (!fullCmdHit && !hasRedirectWrite) {
@@ -8238,7 +9100,7 @@ async function runAnalysis(input) {
         };
       }
     }
-    if (matchesAny(firstCmd, READONLY_SENSITIVE_BASH_PATTERNS)) {
+    if (tier !== "") {
       skipLLM = true;
     }
   }
@@ -8247,8 +9109,8 @@ async function runAnalysis(input) {
   const effectiveResult = logicResult && !logicResult.allowed ? logicResult : l1FileAccessHit ? heuristicResult : null;
   if (effectiveResult) {
     const isCredentialPath = !!effectiveResult.isCredential;
-    const skipInlineFileAccess = (isInlineScriptCmd || isLiteralTextCmd) && effectiveResult.riskType === "file_access";
-    if (skipInlineFileAccess) {
+    const skipInlineFileAccess = (isInlineScriptCmd || isLiteralTextCmd) && l1FileAccessHit;
+    if (isInlineScriptCmd || isLiteralTextCmd) {
       const inlineJudgment = analyzeInlineScript(input.aNext.actionDetail);
       if (inlineJudgment.actionable) {
         if (!inlineJudgment.allowed) {
@@ -8444,13 +9306,15 @@ async function runAnalysis(input) {
   }
   return llmResult;
 }
-var FULLY_SAFE_TOOLS, TRUSTED_SKILLS_BASE, READONLY_SENSITIVE_TOOLS, FULLY_SAFE_BASH_PATTERNS, READONLY_SENSITIVE_BASH_PATTERNS, _brainStore, _brainExtractor, _brainInitialized, formalEngine;
+var FULLY_SAFE_TOOLS, TRUSTED_SKILLS_BASE, READONLY_SENSITIVE_TOOLS, _brainStore, _brainExtractor, _brainInitialized, formalEngine;
 var init_coordinator = __esm({
   "src/engine/coordinator.ts"() {
     "use strict";
     init_esm_shims();
     init_heuristic();
     init_logic_rules();
+    init_platform_traits();
+    init_shell_split();
     init_inline_analyzer();
     init_llm_analyzer();
     init_script_content_analyzer();
@@ -8480,53 +9344,6 @@ var init_coordinator = __esm({
       "filemgr-readfile",
       "filemgr-grepfiles"
     ]);
-    FULLY_SAFE_BASH_PATTERNS = [
-      /^ls(?:\s|$)/i,
-      /^dir(?:\s|$)/i,
-      /^pwd(?:\s|$)/i,
-      /^which\s+/i,
-      /^whereis\s+/i,
-      /^realpath\s+/i,
-      /^basename\s+/i,
-      /^dirname\s+/i,
-      /^file\s+/i,
-      /^stat\s+/i,
-      /^du(?:\s|$)/i,
-      /^echo\s+/i,
-      /^printf\s+/i,
-      /^type\s+/i,
-      /^command\s+/i,
-      // 系统信息查询（只读，不涉及文件/网络/权限）
-      /^whoami(?:\s|$)/i,
-      /^id(?:\s|$)/i,
-      /^hostname(?:\s|$)/i,
-      /^uname(?:\s|$)/i,
-      /^date(?:\s|$)/i,
-      /^env(?:\s|$)/i,
-      /^printenv(?:\s|$)/i,
-      /^tty(?:\s|$)/i,
-      /^arch(?:\s|$)/i,
-      /^uptime(?:\s|$)/i,
-      /^groups(?:\s|$)/i,
-      /^logname(?:\s|$)/i
-    ];
-    READONLY_SENSITIVE_BASH_PATTERNS = [
-      /^cat\s+/i,
-      /^head(?:\s|$)/i,
-      /^tail(?:\s|$)/i,
-      /^less(?:\s|$)/i,
-      /^more(?:\s|$)/i,
-      /^wc(?:\s|$)/i,
-      /^grep(?:\s|$)/i,
-      /^find\s+/i,
-      /^ag(?:\s|$)/i,
-      /^rg(?:\s|$)/i,
-      /^awk\s+/i,
-      /^sed\s+/i,
-      /^cut\s+/i,
-      /^sort(?:\s|$)/i,
-      /^uniq(?:\s|$)/i
-    ];
     _brainStore = null;
     _brainExtractor = null;
     _brainInitialized = false;
@@ -8534,795 +9351,6 @@ var init_coordinator = __esm({
   }
 });
 
-// node_modules/better-sqlite3/lib/util.js
-var require_util = __commonJS({
-  "node_modules/better-sqlite3/lib/util.js"(exports) {
-    "use strict";
-    init_esm_shims();
-    exports.getBooleanOption = (options, key) => {
-      let value = false;
-      if (key in options && typeof (value = options[key]) !== "boolean") {
-        throw new TypeError(`Expected the "${key}" option to be a boolean`);
-      }
-      return value;
-    };
-    exports.cppdb = /* @__PURE__ */ Symbol();
-    exports.inspect = /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom");
-  }
-});
-
-// node_modules/better-sqlite3/lib/sqlite-error.js
-var require_sqlite_error = __commonJS({
-  "node_modules/better-sqlite3/lib/sqlite-error.js"(exports, module) {
-    "use strict";
-    init_esm_shims();
-    var descriptor = { value: "SqliteError", writable: true, enumerable: false, configurable: true };
-    function SqliteError(message, code) {
-      if (new.target !== SqliteError) {
-        return new SqliteError(message, code);
-      }
-      if (typeof code !== "string") {
-        throw new TypeError("Expected second argument to be a string");
-      }
-      Error.call(this, message);
-      descriptor.value = "" + message;
-      Object.defineProperty(this, "message", descriptor);
-      Error.captureStackTrace(this, SqliteError);
-      this.code = code;
-    }
-    Object.setPrototypeOf(SqliteError, Error);
-    Object.setPrototypeOf(SqliteError.prototype, Error.prototype);
-    Object.defineProperty(SqliteError.prototype, "name", descriptor);
-    module.exports = SqliteError;
-  }
-});
-
-// node_modules/file-uri-to-path/index.js
-var require_file_uri_to_path = __commonJS({
-  "node_modules/file-uri-to-path/index.js"(exports, module) {
-    "use strict";
-    init_esm_shims();
-    var sep = __require("path").sep || "/";
-    module.exports = fileUriToPath;
-    function fileUriToPath(uri) {
-      if ("string" != typeof uri || uri.length <= 7 || "file://" != uri.substring(0, 7)) {
-        throw new TypeError("must pass in a file:// URI to convert to a file path");
-      }
-      var rest = decodeURI(uri.substring(7));
-      var firstSlash = rest.indexOf("/");
-      var host = rest.substring(0, firstSlash);
-      var path6 = rest.substring(firstSlash + 1);
-      if ("localhost" == host) host = "";
-      if (host) {
-        host = sep + sep + host;
-      }
-      path6 = path6.replace(/^(.+)\|/, "$1:");
-      if (sep == "\\") {
-        path6 = path6.replace(/\//g, "\\");
-      }
-      if (/^.+\:/.test(path6)) {
-      } else {
-        path6 = sep + path6;
-      }
-      return host + path6;
-    }
-  }
-});
-
-// node_modules/bindings/bindings.js
-var require_bindings = __commonJS({
-  "node_modules/bindings/bindings.js"(exports, module) {
-    "use strict";
-    init_esm_shims();
-    var fs7 = __require("fs");
-    var path6 = __require("path");
-    var fileURLToPath11 = require_file_uri_to_path();
-    var join11 = path6.join;
-    var dirname11 = path6.dirname;
-    var exists = fs7.accessSync && function(path7) {
-      try {
-        fs7.accessSync(path7);
-      } catch (e) {
-        return false;
-      }
-      return true;
-    } || fs7.existsSync || path6.existsSync;
-    var defaults = {
-      arrow: process.env.NODE_BINDINGS_ARROW || " \u2192 ",
-      compiled: process.env.NODE_BINDINGS_COMPILED_DIR || "compiled",
-      platform: process.platform,
-      arch: process.arch,
-      nodePreGyp: "node-v" + process.versions.modules + "-" + process.platform + "-" + process.arch,
-      version: process.versions.node,
-      bindings: "bindings.node",
-      try: [
-        // node-gyp's linked version in the "build" dir
-        ["module_root", "build", "bindings"],
-        // node-waf and gyp_addon (a.k.a node-gyp)
-        ["module_root", "build", "Debug", "bindings"],
-        ["module_root", "build", "Release", "bindings"],
-        // Debug files, for development (legacy behavior, remove for node v0.9)
-        ["module_root", "out", "Debug", "bindings"],
-        ["module_root", "Debug", "bindings"],
-        // Release files, but manually compiled (legacy behavior, remove for node v0.9)
-        ["module_root", "out", "Release", "bindings"],
-        ["module_root", "Release", "bindings"],
-        // Legacy from node-waf, node <= 0.4.x
-        ["module_root", "build", "default", "bindings"],
-        // Production "Release" buildtype binary (meh...)
-        ["module_root", "compiled", "version", "platform", "arch", "bindings"],
-        // node-qbs builds
-        ["module_root", "addon-build", "release", "install-root", "bindings"],
-        ["module_root", "addon-build", "debug", "install-root", "bindings"],
-        ["module_root", "addon-build", "default", "install-root", "bindings"],
-        // node-pre-gyp path ./lib/binding/{node_abi}-{platform}-{arch}
-        ["module_root", "lib", "binding", "nodePreGyp", "bindings"]
-      ]
-    };
-    function bindings(opts) {
-      if (typeof opts == "string") {
-        opts = { bindings: opts };
-      } else if (!opts) {
-        opts = {};
-      }
-      Object.keys(defaults).map(function(i2) {
-        if (!(i2 in opts)) opts[i2] = defaults[i2];
-      });
-      if (!opts.module_root) {
-        opts.module_root = exports.getRoot(exports.getFileName());
-      }
-      if (path6.extname(opts.bindings) != ".node") {
-        opts.bindings += ".node";
-      }
-      var requireFunc = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
-      var tries = [], i = 0, l = opts.try.length, n, b, err;
-      for (; i < l; i++) {
-        n = join11.apply(
-          null,
-          opts.try[i].map(function(p) {
-            return opts[p] || p;
-          })
-        );
-        tries.push(n);
-        try {
-          b = opts.path ? requireFunc.resolve(n) : requireFunc(n);
-          if (!opts.path) {
-            b.path = n;
-          }
-          return b;
-        } catch (e) {
-          if (e.code !== "MODULE_NOT_FOUND" && e.code !== "QUALIFIED_PATH_RESOLUTION_FAILED" && !/not find/i.test(e.message)) {
-            throw e;
-          }
-        }
-      }
-      err = new Error(
-        "Could not locate the bindings file. Tried:\n" + tries.map(function(a) {
-          return opts.arrow + a;
-        }).join("\n")
-      );
-      err.tries = tries;
-      throw err;
-    }
-    module.exports = exports = bindings;
-    exports.getFileName = function getFileName(calling_file) {
-      var origPST = Error.prepareStackTrace, origSTL = Error.stackTraceLimit, dummy = {}, fileName;
-      Error.stackTraceLimit = 10;
-      Error.prepareStackTrace = function(e, st) {
-        for (var i = 0, l = st.length; i < l; i++) {
-          fileName = st[i].getFileName();
-          if (fileName !== __filename) {
-            if (calling_file) {
-              if (fileName !== calling_file) {
-                return;
-              }
-            } else {
-              return;
-            }
-          }
-        }
-      };
-      Error.captureStackTrace(dummy);
-      dummy.stack;
-      Error.prepareStackTrace = origPST;
-      Error.stackTraceLimit = origSTL;
-      var fileSchema = "file://";
-      if (fileName.indexOf(fileSchema) === 0) {
-        fileName = fileURLToPath11(fileName);
-      }
-      return fileName;
-    };
-    exports.getRoot = function getRoot(file) {
-      var dir = dirname11(file), prev;
-      while (true) {
-        if (dir === ".") {
-          dir = process.cwd();
-        }
-        if (exists(join11(dir, "package.json")) || exists(join11(dir, "node_modules"))) {
-          return dir;
-        }
-        if (prev === dir) {
-          throw new Error(
-            'Could not find module root given file: "' + file + '". Do you have a `package.json` file? '
-          );
-        }
-        prev = dir;
-        dir = join11(dir, "..");
-      }
-    };
-  }
-});
-
-// node_modules/better-sqlite3/lib/methods/wrappers.js
-var require_wrappers = __commonJS({
-  "node_modules/better-sqlite3/lib/methods/wrappers.js"(exports) {
-    "use strict";
-    init_esm_shims();
-    var { cppdb } = require_util();
-    exports.prepare = function prepare(sql) {
-      return this[cppdb].prepare(sql, this, false);
-    };
-    exports.exec = function exec(sql) {
-      this[cppdb].exec(sql);
-      return this;
-    };
-    exports.close = function close() {
-      this[cppdb].close();
-      return this;
-    };
-    exports.loadExtension = function loadExtension(...args) {
-      this[cppdb].loadExtension(...args);
-      return this;
-    };
-    exports.defaultSafeIntegers = function defaultSafeIntegers(...args) {
-      this[cppdb].defaultSafeIntegers(...args);
-      return this;
-    };
-    exports.unsafeMode = function unsafeMode(...args) {
-      this[cppdb].unsafeMode(...args);
-      return this;
-    };
-    exports.getters = {
-      name: {
-        get: function name() {
-          return this[cppdb].name;
-        },
-        enumerable: true
-      },
-      open: {
-        get: function open() {
-          return this[cppdb].open;
-        },
-        enumerable: true
-      },
-      inTransaction: {
-        get: function inTransaction() {
-          return this[cppdb].inTransaction;
-        },
-        enumerable: true
-      },
-      readonly: {
-        get: function readonly() {
-          return this[cppdb].readonly;
-        },
-        enumerable: true
-      },
-      memory: {
-        get: function memory() {
-          return this[cppdb].memory;
-        },
-        enumerable: true
-      }
-    };
-  }
-});
-
-// node_modules/better-sqlite3/lib/methods/transaction.js
-var require_transaction = __commonJS({
-  "node_modules/better-sqlite3/lib/methods/transaction.js"(exports, module) {
-    "use strict";
-    init_esm_shims();
-    var { cppdb } = require_util();
-    var controllers = /* @__PURE__ */ new WeakMap();
-    module.exports = function transaction(fn) {
-      if (typeof fn !== "function") throw new TypeError("Expected first argument to be a function");
-      const db = this[cppdb];
-      const controller = getController(db, this);
-      const { apply } = Function.prototype;
-      const properties = {
-        default: { value: wrapTransaction(apply, fn, db, controller.default) },
-        deferred: { value: wrapTransaction(apply, fn, db, controller.deferred) },
-        immediate: { value: wrapTransaction(apply, fn, db, controller.immediate) },
-        exclusive: { value: wrapTransaction(apply, fn, db, controller.exclusive) },
-        database: { value: this, enumerable: true }
-      };
-      Object.defineProperties(properties.default.value, properties);
-      Object.defineProperties(properties.deferred.value, properties);
-      Object.defineProperties(properties.immediate.value, properties);
-      Object.defineProperties(properties.exclusive.value, properties);
-      return properties.default.value;
-    };
-    var getController = (db, self) => {
-      let controller = controllers.get(db);
-      if (!controller) {
-        const shared = {
-          commit: db.prepare("COMMIT", self, false),
-          rollback: db.prepare("ROLLBACK", self, false),
-          savepoint: db.prepare("SAVEPOINT `	_bs3.	`", self, false),
-          release: db.prepare("RELEASE `	_bs3.	`", self, false),
-          rollbackTo: db.prepare("ROLLBACK TO `	_bs3.	`", self, false)
-        };
-        controllers.set(db, controller = {
-          default: Object.assign({ begin: db.prepare("BEGIN", self, false) }, shared),
-          deferred: Object.assign({ begin: db.prepare("BEGIN DEFERRED", self, false) }, shared),
-          immediate: Object.assign({ begin: db.prepare("BEGIN IMMEDIATE", self, false) }, shared),
-          exclusive: Object.assign({ begin: db.prepare("BEGIN EXCLUSIVE", self, false) }, shared)
-        });
-      }
-      return controller;
-    };
-    var wrapTransaction = (apply, fn, db, { begin, commit, rollback, savepoint, release, rollbackTo }) => function sqliteTransaction() {
-      let before, after, undo;
-      if (db.inTransaction) {
-        before = savepoint;
-        after = release;
-        undo = rollbackTo;
-      } else {
-        before = begin;
-        after = commit;
-        undo = rollback;
-      }
-      before.run();
-      try {
-        const result = apply.call(fn, this, arguments);
-        if (result && typeof result.then === "function") {
-          throw new TypeError("Transaction function cannot return a promise");
-        }
-        after.run();
-        return result;
-      } catch (ex) {
-        if (db.inTransaction) {
-          undo.run();
-          if (undo !== rollback) after.run();
-        }
-        throw ex;
-      }
-    };
-  }
-});
-
-// node_modules/better-sqlite3/lib/methods/pragma.js
-var require_pragma = __commonJS({
-  "node_modules/better-sqlite3/lib/methods/pragma.js"(exports, module) {
-    "use strict";
-    init_esm_shims();
-    var { getBooleanOption, cppdb } = require_util();
-    module.exports = function pragma(source, options) {
-      if (options == null) options = {};
-      if (typeof source !== "string") throw new TypeError("Expected first argument to be a string");
-      if (typeof options !== "object") throw new TypeError("Expected second argument to be an options object");
-      const simple = getBooleanOption(options, "simple");
-      const stmt = this[cppdb].prepare(`PRAGMA ${source}`, this, true);
-      return simple ? stmt.pluck().get() : stmt.all();
-    };
-  }
-});
-
-// node_modules/better-sqlite3/lib/methods/backup.js
-var require_backup = __commonJS({
-  "node_modules/better-sqlite3/lib/methods/backup.js"(exports, module) {
-    "use strict";
-    init_esm_shims();
-    var fs7 = __require("fs");
-    var path6 = __require("path");
-    var { promisify } = __require("util");
-    var { cppdb } = require_util();
-    var fsAccess = promisify(fs7.access);
-    module.exports = async function backup(filename, options) {
-      if (options == null) options = {};
-      if (typeof filename !== "string") throw new TypeError("Expected first argument to be a string");
-      if (typeof options !== "object") throw new TypeError("Expected second argument to be an options object");
-      filename = filename.trim();
-      const attachedName = "attached" in options ? options.attached : "main";
-      const handler = "progress" in options ? options.progress : null;
-      if (!filename) throw new TypeError("Backup filename cannot be an empty string");
-      if (filename === ":memory:") throw new TypeError('Invalid backup filename ":memory:"');
-      if (typeof attachedName !== "string") throw new TypeError('Expected the "attached" option to be a string');
-      if (!attachedName) throw new TypeError('The "attached" option cannot be an empty string');
-      if (handler != null && typeof handler !== "function") throw new TypeError('Expected the "progress" option to be a function');
-      await fsAccess(path6.dirname(filename)).catch(() => {
-        throw new TypeError("Cannot save backup because the directory does not exist");
-      });
-      const isNewFile = await fsAccess(filename).then(() => false, () => true);
-      return runBackup(this[cppdb].backup(this, attachedName, filename, isNewFile), handler || null);
-    };
-    var runBackup = (backup, handler) => {
-      let rate = 0;
-      let useDefault = true;
-      return new Promise((resolve10, reject) => {
-        setImmediate(function step() {
-          try {
-            const progress = backup.transfer(rate);
-            if (!progress.remainingPages) {
-              backup.close();
-              resolve10(progress);
-              return;
-            }
-            if (useDefault) {
-              useDefault = false;
-              rate = 100;
-            }
-            if (handler) {
-              const ret = handler(progress);
-              if (ret !== void 0) {
-                if (typeof ret === "number" && ret === ret) rate = Math.max(0, Math.min(2147483647, Math.round(ret)));
-                else throw new TypeError("Expected progress callback to return a number or undefined");
-              }
-            }
-            setImmediate(step);
-          } catch (err) {
-            backup.close();
-            reject(err);
-          }
-        });
-      });
-    };
-  }
-});
-
-// node_modules/better-sqlite3/lib/methods/serialize.js
-var require_serialize = __commonJS({
-  "node_modules/better-sqlite3/lib/methods/serialize.js"(exports, module) {
-    "use strict";
-    init_esm_shims();
-    var { cppdb } = require_util();
-    module.exports = function serialize(options) {
-      if (options == null) options = {};
-      if (typeof options !== "object") throw new TypeError("Expected first argument to be an options object");
-      const attachedName = "attached" in options ? options.attached : "main";
-      if (typeof attachedName !== "string") throw new TypeError('Expected the "attached" option to be a string');
-      if (!attachedName) throw new TypeError('The "attached" option cannot be an empty string');
-      return this[cppdb].serialize(attachedName);
-    };
-  }
-});
-
-// node_modules/better-sqlite3/lib/methods/function.js
-var require_function = __commonJS({
-  "node_modules/better-sqlite3/lib/methods/function.js"(exports, module) {
-    "use strict";
-    init_esm_shims();
-    var { getBooleanOption, cppdb } = require_util();
-    module.exports = function defineFunction(name, options, fn) {
-      if (options == null) options = {};
-      if (typeof options === "function") {
-        fn = options;
-        options = {};
-      }
-      if (typeof name !== "string") throw new TypeError("Expected first argument to be a string");
-      if (typeof fn !== "function") throw new TypeError("Expected last argument to be a function");
-      if (typeof options !== "object") throw new TypeError("Expected second argument to be an options object");
-      if (!name) throw new TypeError("User-defined function name cannot be an empty string");
-      const safeIntegers = "safeIntegers" in options ? +getBooleanOption(options, "safeIntegers") : 2;
-      const deterministic = getBooleanOption(options, "deterministic");
-      const directOnly = getBooleanOption(options, "directOnly");
-      const varargs = getBooleanOption(options, "varargs");
-      let argCount = -1;
-      if (!varargs) {
-        argCount = fn.length;
-        if (!Number.isInteger(argCount) || argCount < 0) throw new TypeError("Expected function.length to be a positive integer");
-        if (argCount > 100) throw new RangeError("User-defined functions cannot have more than 100 arguments");
-      }
-      this[cppdb].function(fn, name, argCount, safeIntegers, deterministic, directOnly);
-      return this;
-    };
-  }
-});
-
-// node_modules/better-sqlite3/lib/methods/aggregate.js
-var require_aggregate = __commonJS({
-  "node_modules/better-sqlite3/lib/methods/aggregate.js"(exports, module) {
-    "use strict";
-    init_esm_shims();
-    var { getBooleanOption, cppdb } = require_util();
-    module.exports = function defineAggregate(name, options) {
-      if (typeof name !== "string") throw new TypeError("Expected first argument to be a string");
-      if (typeof options !== "object" || options === null) throw new TypeError("Expected second argument to be an options object");
-      if (!name) throw new TypeError("User-defined function name cannot be an empty string");
-      const start = "start" in options ? options.start : null;
-      const step = getFunctionOption(options, "step", true);
-      const inverse = getFunctionOption(options, "inverse", false);
-      const result = getFunctionOption(options, "result", false);
-      const safeIntegers = "safeIntegers" in options ? +getBooleanOption(options, "safeIntegers") : 2;
-      const deterministic = getBooleanOption(options, "deterministic");
-      const directOnly = getBooleanOption(options, "directOnly");
-      const varargs = getBooleanOption(options, "varargs");
-      let argCount = -1;
-      if (!varargs) {
-        argCount = Math.max(getLength(step), inverse ? getLength(inverse) : 0);
-        if (argCount > 0) argCount -= 1;
-        if (argCount > 100) throw new RangeError("User-defined functions cannot have more than 100 arguments");
-      }
-      this[cppdb].aggregate(start, step, inverse, result, name, argCount, safeIntegers, deterministic, directOnly);
-      return this;
-    };
-    var getFunctionOption = (options, key, required) => {
-      const value = key in options ? options[key] : null;
-      if (typeof value === "function") return value;
-      if (value != null) throw new TypeError(`Expected the "${key}" option to be a function`);
-      if (required) throw new TypeError(`Missing required option "${key}"`);
-      return null;
-    };
-    var getLength = ({ length }) => {
-      if (Number.isInteger(length) && length >= 0) return length;
-      throw new TypeError("Expected function.length to be a positive integer");
-    };
-  }
-});
-
-// node_modules/better-sqlite3/lib/methods/table.js
-var require_table = __commonJS({
-  "node_modules/better-sqlite3/lib/methods/table.js"(exports, module) {
-    "use strict";
-    init_esm_shims();
-    var { cppdb } = require_util();
-    module.exports = function defineTable(name, factory) {
-      if (typeof name !== "string") throw new TypeError("Expected first argument to be a string");
-      if (!name) throw new TypeError("Virtual table module name cannot be an empty string");
-      let eponymous = false;
-      if (typeof factory === "object" && factory !== null) {
-        eponymous = true;
-        factory = defer(parseTableDefinition(factory, "used", name));
-      } else {
-        if (typeof factory !== "function") throw new TypeError("Expected second argument to be a function or a table definition object");
-        factory = wrapFactory(factory);
-      }
-      this[cppdb].table(factory, name, eponymous);
-      return this;
-    };
-    function wrapFactory(factory) {
-      return function virtualTableFactory(moduleName, databaseName, tableName, ...args) {
-        const thisObject = {
-          module: moduleName,
-          database: databaseName,
-          table: tableName
-        };
-        const def = apply.call(factory, thisObject, args);
-        if (typeof def !== "object" || def === null) {
-          throw new TypeError(`Virtual table module "${moduleName}" did not return a table definition object`);
-        }
-        return parseTableDefinition(def, "returned", moduleName);
-      };
-    }
-    function parseTableDefinition(def, verb, moduleName) {
-      if (!hasOwnProperty.call(def, "rows")) {
-        throw new TypeError(`Virtual table module "${moduleName}" ${verb} a table definition without a "rows" property`);
-      }
-      if (!hasOwnProperty.call(def, "columns")) {
-        throw new TypeError(`Virtual table module "${moduleName}" ${verb} a table definition without a "columns" property`);
-      }
-      const rows = def.rows;
-      if (typeof rows !== "function" || Object.getPrototypeOf(rows) !== GeneratorFunctionPrototype) {
-        throw new TypeError(`Virtual table module "${moduleName}" ${verb} a table definition with an invalid "rows" property (should be a generator function)`);
-      }
-      let columns = def.columns;
-      if (!Array.isArray(columns) || !(columns = [...columns]).every((x) => typeof x === "string")) {
-        throw new TypeError(`Virtual table module "${moduleName}" ${verb} a table definition with an invalid "columns" property (should be an array of strings)`);
-      }
-      if (columns.length !== new Set(columns).size) {
-        throw new TypeError(`Virtual table module "${moduleName}" ${verb} a table definition with duplicate column names`);
-      }
-      if (!columns.length) {
-        throw new RangeError(`Virtual table module "${moduleName}" ${verb} a table definition with zero columns`);
-      }
-      let parameters;
-      if (hasOwnProperty.call(def, "parameters")) {
-        parameters = def.parameters;
-        if (!Array.isArray(parameters) || !(parameters = [...parameters]).every((x) => typeof x === "string")) {
-          throw new TypeError(`Virtual table module "${moduleName}" ${verb} a table definition with an invalid "parameters" property (should be an array of strings)`);
-        }
-      } else {
-        parameters = inferParameters(rows);
-      }
-      if (parameters.length !== new Set(parameters).size) {
-        throw new TypeError(`Virtual table module "${moduleName}" ${verb} a table definition with duplicate parameter names`);
-      }
-      if (parameters.length > 32) {
-        throw new RangeError(`Virtual table module "${moduleName}" ${verb} a table definition with more than the maximum number of 32 parameters`);
-      }
-      for (const parameter of parameters) {
-        if (columns.includes(parameter)) {
-          throw new TypeError(`Virtual table module "${moduleName}" ${verb} a table definition with column "${parameter}" which was ambiguously defined as both a column and parameter`);
-        }
-      }
-      let safeIntegers = 2;
-      if (hasOwnProperty.call(def, "safeIntegers")) {
-        const bool = def.safeIntegers;
-        if (typeof bool !== "boolean") {
-          throw new TypeError(`Virtual table module "${moduleName}" ${verb} a table definition with an invalid "safeIntegers" property (should be a boolean)`);
-        }
-        safeIntegers = +bool;
-      }
-      let directOnly = false;
-      if (hasOwnProperty.call(def, "directOnly")) {
-        directOnly = def.directOnly;
-        if (typeof directOnly !== "boolean") {
-          throw new TypeError(`Virtual table module "${moduleName}" ${verb} a table definition with an invalid "directOnly" property (should be a boolean)`);
-        }
-      }
-      const columnDefinitions = [
-        ...parameters.map(identifier).map((str) => `${str} HIDDEN`),
-        ...columns.map(identifier)
-      ];
-      return [
-        `CREATE TABLE x(${columnDefinitions.join(", ")});`,
-        wrapGenerator(rows, new Map(columns.map((x, i) => [x, parameters.length + i])), moduleName),
-        parameters,
-        safeIntegers,
-        directOnly
-      ];
-    }
-    function wrapGenerator(generator, columnMap, moduleName) {
-      return function* virtualTable(...args) {
-        const output = args.map((x) => Buffer.isBuffer(x) ? Buffer.from(x) : x);
-        for (let i = 0; i < columnMap.size; ++i) {
-          output.push(null);
-        }
-        for (const row of generator(...args)) {
-          if (Array.isArray(row)) {
-            extractRowArray(row, output, columnMap.size, moduleName);
-            yield output;
-          } else if (typeof row === "object" && row !== null) {
-            extractRowObject(row, output, columnMap, moduleName);
-            yield output;
-          } else {
-            throw new TypeError(`Virtual table module "${moduleName}" yielded something that isn't a valid row object`);
-          }
-        }
-      };
-    }
-    function extractRowArray(row, output, columnCount, moduleName) {
-      if (row.length !== columnCount) {
-        throw new TypeError(`Virtual table module "${moduleName}" yielded a row with an incorrect number of columns`);
-      }
-      const offset = output.length - columnCount;
-      for (let i = 0; i < columnCount; ++i) {
-        output[i + offset] = row[i];
-      }
-    }
-    function extractRowObject(row, output, columnMap, moduleName) {
-      let count = 0;
-      for (const key of Object.keys(row)) {
-        const index = columnMap.get(key);
-        if (index === void 0) {
-          throw new TypeError(`Virtual table module "${moduleName}" yielded a row with an undeclared column "${key}"`);
-        }
-        output[index] = row[key];
-        count += 1;
-      }
-      if (count !== columnMap.size) {
-        throw new TypeError(`Virtual table module "${moduleName}" yielded a row with missing columns`);
-      }
-    }
-    function inferParameters({ length }) {
-      if (!Number.isInteger(length) || length < 0) {
-        throw new TypeError("Expected function.length to be a positive integer");
-      }
-      const params = [];
-      for (let i = 0; i < length; ++i) {
-        params.push(`$${i + 1}`);
-      }
-      return params;
-    }
-    var { hasOwnProperty } = Object.prototype;
-    var { apply } = Function.prototype;
-    var GeneratorFunctionPrototype = Object.getPrototypeOf(function* () {
-    });
-    var identifier = (str) => `"${str.replace(/"/g, '""')}"`;
-    var defer = (x) => () => x;
-  }
-});
-
-// node_modules/better-sqlite3/lib/methods/inspect.js
-var require_inspect = __commonJS({
-  "node_modules/better-sqlite3/lib/methods/inspect.js"(exports, module) {
-    "use strict";
-    init_esm_shims();
-    var DatabaseInspection = function Database() {
-    };
-    module.exports = function inspect(depth, opts) {
-      return Object.assign(new DatabaseInspection(), this);
-    };
-  }
-});
-
-// node_modules/better-sqlite3/lib/database.js
-var require_database = __commonJS({
-  "node_modules/better-sqlite3/lib/database.js"(exports, module) {
-    "use strict";
-    init_esm_shims();
-    var fs7 = __require("fs");
-    var path6 = __require("path");
-    var util = require_util();
-    var SqliteError = require_sqlite_error();
-    var DEFAULT_ADDON;
-    function Database(filenameGiven, options) {
-      if (new.target == null) {
-        return new Database(filenameGiven, options);
-      }
-      let buffer;
-      if (Buffer.isBuffer(filenameGiven)) {
-        buffer = filenameGiven;
-        filenameGiven = ":memory:";
-      }
-      if (filenameGiven == null) filenameGiven = "";
-      if (options == null) options = {};
-      if (typeof filenameGiven !== "string") throw new TypeError("Expected first argument to be a string");
-      if (typeof options !== "object") throw new TypeError("Expected second argument to be an options object");
-      if ("readOnly" in options) throw new TypeError('Misspelled option "readOnly" should be "readonly"');
-      if ("memory" in options) throw new TypeError('Option "memory" was removed in v7.0.0 (use ":memory:" filename instead)');
-      const filename = filenameGiven.trim();
-      const anonymous = filename === "" || filename === ":memory:";
-      const readonly = util.getBooleanOption(options, "readonly");
-      const fileMustExist = util.getBooleanOption(options, "fileMustExist");
-      const timeout = "timeout" in options ? options.timeout : 5e3;
-      const verbose = "verbose" in options ? options.verbose : null;
-      const nativeBinding = "nativeBinding" in options ? options.nativeBinding : null;
-      if (readonly && anonymous && !buffer) throw new TypeError("In-memory/temporary databases cannot be readonly");
-      if (!Number.isInteger(timeout) || timeout < 0) throw new TypeError('Expected the "timeout" option to be a positive integer');
-      if (timeout > 2147483647) throw new RangeError('Option "timeout" cannot be greater than 2147483647');
-      if (verbose != null && typeof verbose !== "function") throw new TypeError('Expected the "verbose" option to be a function');
-      if (nativeBinding != null && typeof nativeBinding !== "string" && typeof nativeBinding !== "object") throw new TypeError('Expected the "nativeBinding" option to be a string or addon object');
-      let addon;
-      if (nativeBinding == null) {
-        addon = DEFAULT_ADDON || (DEFAULT_ADDON = require_bindings()("better_sqlite3.node"));
-      } else if (typeof nativeBinding === "string") {
-        const requireFunc = typeof __non_webpack_require__ === "function" ? __non_webpack_require__ : __require;
-        addon = requireFunc(path6.resolve(nativeBinding).replace(/(\.node)?$/, ".node"));
-      } else {
-        addon = nativeBinding;
-      }
-      if (!addon.isInitialized) {
-        addon.setErrorConstructor(SqliteError);
-        addon.isInitialized = true;
-      }
-      if (!anonymous && !fs7.existsSync(path6.dirname(filename))) {
-        throw new TypeError("Cannot open database because the directory does not exist");
-      }
-      Object.defineProperties(this, {
-        [util.cppdb]: { value: new addon.Database(filename, filenameGiven, anonymous, readonly, fileMustExist, timeout, verbose || null, buffer || null) },
-        ...wrappers.getters
-      });
-    }
-    var wrappers = require_wrappers();
-    Database.prototype.prepare = wrappers.prepare;
-    Database.prototype.transaction = require_transaction();
-    Database.prototype.pragma = require_pragma();
-    Database.prototype.backup = require_backup();
-    Database.prototype.serialize = require_serialize();
-    Database.prototype.function = require_function();
-    Database.prototype.aggregate = require_aggregate();
-    Database.prototype.table = require_table();
-    Database.prototype.loadExtension = wrappers.loadExtension;
-    Database.prototype.exec = wrappers.exec;
-    Database.prototype.close = wrappers.close;
-    Database.prototype.defaultSafeIntegers = wrappers.defaultSafeIntegers;
-    Database.prototype.unsafeMode = wrappers.unsafeMode;
-    Database.prototype[util.inspect] = require_inspect();
-    module.exports = Database;
-  }
-});
-
-// node_modules/better-sqlite3/lib/index.js
-var require_lib = __commonJS({
-  "node_modules/better-sqlite3/lib/index.js"(exports, module) {
-    "use strict";
-    init_esm_shims();
-    module.exports = require_database();
-    module.exports.SqliteError = require_sqlite_error();
-  }
-});
-
 // src/cli.ts
 init_esm_shims();
 
@@ -9350,7 +9378,11 @@ var version = pkg.version;
 // src/models.ts
 var ActionItemSchema = z.object({
   action_type: z.string().describe("Action type, e.g. bash, file_read, file_write"),
-  action_detail: z.string().describe("Action detail / command content")
+  action_detail: z.string().describe("Action detail / command content"),
+  // 工具返回给 agent 的内容。仅 L2 的授权（consent）判定用：判断「用户是否已授权」
+  // 看的是 ask_user_question 的**回答**，不是提问正文。历史 bug：模型里没有这个字段、
+  // 路由也没透传，TS 的授权判定退化成「提问正文非空」，等于问过任何问题即已授权。
+  output: z.string().optional().describe("Tool result / user answer (needed by L2 consent checks)")
 });
 var PromptTurnSchema = z.object({
   text: z.string().default("").describe("User prompt text at this turn"),
@@ -9420,6 +9452,16 @@ init_coordinator();
 // src/actrail.ts
 init_esm_shims();
 import * as fs5 from "fs";
+
+// src/infra/esm-require.ts
+init_esm_shims();
+import { createRequire as createRequire2 } from "module";
+var requireFromHere = createRequire2(import.meta.url);
+function esmRequire(id) {
+  return requireFromHere(id);
+}
+
+// src/actrail.ts
 function escape(value) {
   return value.replace(/\\/g, "\\\\").replace(/\n/g, "\\n").replace(/=/g, "\\e");
 }
@@ -9444,7 +9486,7 @@ function reportEnforcementEvent(opts) {
   try {
     let Database;
     try {
-      Database = require_lib();
+      Database = esmRequire("better-sqlite3");
     } catch {
       console.debug("[AgentMoss] better-sqlite3 not installed, AcTrail reporting disabled");
       return false;
@@ -9645,7 +9687,7 @@ function readJsonDir(dirPath, limit = 1e5) {
 function readSqlite(dbPath, limit = 1e5) {
   let Database;
   try {
-    Database = require_lib();
+    Database = esmRequire("better-sqlite3");
   } catch {
     return [];
   }
@@ -9713,15 +9755,21 @@ async function analyzeRoute(c) {
     const result = await runAnalysis({
       sessionId: req.session_id,
       promptSession: req.prompt_session,
+      // output 必须透传：L2 的「授权（consent）」判定看的是**用户对提问的回答**，
+      // 不是提问正文。历史 bug：这里丢了 output，TS 的判定退化成 actionDetail 非空，
+      // 于是只要会话里问过任何问题（无论用户答没答、答的是什么、问的是不是改密）
+      // 都算「已授权」→ 未授权的改密/删用户被放行（fail-open）。
       actionHistory: req.action_history.map((h) => ({
         actionType: h.action_type,
-        actionDetail: h.action_detail
+        actionDetail: h.action_detail,
+        output: h.output
       })),
       sessionHistory: (req.session_history || []).map((s) => ({
         sessionId: s.session_id,
         actionHistory: (s.action_history || []).map((h) => ({
           actionType: h.action_type,
-          actionDetail: h.action_detail
+          actionDetail: h.action_detail,
+          output: h.output
         }))
       })),
       aNext: {
@@ -9915,7 +9963,7 @@ init_runtime_config();
 init_token_stats();
 init_rules_loader();
 import { Hono } from "hono";
-import { readFileSync as readFileSync15, existsSync as existsSync14 } from "fs";
+import { readFileSync as readFileSync15, existsSync as existsSync15 } from "fs";
 import { join as join10, dirname as dirname10 } from "path";
 import { fileURLToPath as fileURLToPath9 } from "url";
 var __dirname8 = dirname10(fileURLToPath9(import.meta.url));
@@ -9944,7 +9992,7 @@ function createConsoleRouter() {
   console2.use("/api/*", authMiddleware());
   const serveIndex = (c) => {
     const indexFile = join10(STATIC_DIR, "index.html");
-    if (existsSync14(indexFile)) {
+    if (existsSync15(indexFile)) {
       return c.html(readFileSync15(indexFile, "utf-8"));
     }
     return c.html("<h1>AgentMoss Policy Console</h1><p>Frontend not built. Use /console/api/* endpoints.</p>");
@@ -10110,9 +10158,9 @@ function createConsoleRouter() {
       return c.json({ error: "invalid skill_id" }, 400);
     }
     const skillPath = join10(dirname10(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
-    if (!existsSync14(skillPath)) {
+    if (!existsSync15(skillPath)) {
       const builtinPath = join10(__dirname8, "..", "..", "agent_moss", "skills", `${skillId}.md`);
-      if (existsSync14(builtinPath)) return c.text(readFileSync15(builtinPath, "utf-8"));
+      if (existsSync15(builtinPath)) return c.text(readFileSync15(builtinPath, "utf-8"));
       return c.json({ error: "skill not found" }, 404);
     }
     return c.text(readFileSync15(skillPath, "utf-8"));
@@ -10231,6 +10279,38 @@ function createConsoleRouter() {
 }
 
 // src/server.ts
+init_runtime_config();
+init_rules_loader();
+function logDeploymentSelfCheck() {
+  try {
+    console.log("================ AgentMoss \u90E8\u7F72\u81EA\u68C0 ================");
+    console.log(`runtime \u914D\u7F6E: ${getRuntimeConfigPath()}`);
+    const layerKeys = ["L1_heuristic", "L2_logic_rules", "L3_llm_analysis", "agent_rules_enabled", "scenario_rules_enabled"];
+    console.log("\u5C42\u7EA7\u5F00\u5173: " + layerKeys.map((k) => `${k}=${isLayerEnabled(k) ? "on" : "OFF"}`).join(" "));
+    try {
+      const overrides = overriddenRuleFiles();
+      if (overrides.length > 0) {
+        console.error(`\u26A0\uFE0F  \u68C0\u6D4B\u5230\u7528\u6237\u89C4\u5219\u8986\u76D6\u76EE\u5F55\u4E0B\u6709 ${overrides.length} \u4E2A\u6587\u4EF6\uFF0C**\u6574\u4EFD\u66FF\u6362**\u4E86\u5185\u7F6E\u89C4\u5219\uFF1A`);
+        for (const p of overrides) console.error(`      ${p}`);
+        console.error(
+          "    \u8FD9\u4E9B\u6587\u4EF6\u7531\u90E8\u7F72\u4FA7\u81EA\u884C\u7EF4\u62A4\uFF0C**\u5185\u7F6E\u89C4\u5219\u66F4\u65B0\u4E0D\u4F1A\u53CD\u6620\u5230\u5B83\u4EEC\u4E0A\u9762**\uFF1B\u5220\u9664\u5BF9\u5E94\u6587\u4EF6\u5373\u6062\u590D\u5185\u7F6E\u3002\u82E5\u53EA\u60F3\u9010\u6761\u542F\u505C/\u589E\u5220\uFF0C\u8BF7\u6539\u7528 runtime config\uFF08Console\uFF09\u3002"
+        );
+      }
+    } catch {
+    }
+    const scenarioRaw = (process.env.AGENT_MOSS_SCENARIO || "").trim();
+    if (scenarioRaw) {
+      console.log(`\u573A\u666F\u89C4\u5219\u5DF2\u542F\u7528: ${scenarioRaw}\uFF08\u6765\u6E90\uFF1A\u73AF\u5883\u53D8\u91CF AGENT_MOSS_SCENARIO\uFF09`);
+    } else {
+      console.error(
+        "\u26A0\uFE0F  \u573A\u666F\u89C4\u5219\u3010\u672A\u542F\u7528\u3011\u2014\u2014 \u73AF\u5883\u53D8\u91CF AGENT_MOSS_SCENARIO \u672A\u8BBE\u7F6E\u3002\n    \u573A\u666F\u5B9A\u5236\u89C4\u5219\uFF08\u5982\u94F6\u884C\u6C99\u7BB1\u7684\u76EE\u5F55\u767D\u540D\u5355 / \u7981 ssh\uFF09**\u4E0D\u4F1A\u751F\u6548**\uFF0C\u767D\u540D\u5355\u5916\u7684\u8DEF\u5F84\u4F1A\u88AB\u653E\u884C\u3002\n    \u542F\u7528\u65B9\u5F0F\uFF1A\u8BBE AGENT_MOSS_SCENARIO=<\u573A\u666Fid>\uFF08\u5982 bank\uFF1B\u591A\u573A\u666F\u9017\u53F7\u5206\u9694\uFF09\u540E**\u91CD\u542F\u672C\u670D\u52A1**\u3002\n    \uFF08HTTP \u8BF7\u6C42\u65E0\u6CD5\u6307\u5B9A\u573A\u666F id\uFF0C\u573A\u666F\u662F\u90E8\u7F72\u7EA7\u914D\u7F6E\u3002\uFF09"
+      );
+    }
+    console.log("==================================================");
+  } catch (exc) {
+    console.error(`\u90E8\u7F72\u81EA\u68C0\u5931\u8D25\uFF08\u4E0D\u5F71\u54CD\u670D\u52A1\uFF09: ${exc instanceof Error ? exc.message : String(exc)}`);
+  }
+}
 function createApp() {
   const app = new Hono2();
   app.use("*", cors({ origin: "*", allowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"], allowHeaders: ["*"] }));
@@ -10260,6 +10340,37 @@ async function findFreePort(startPort, host = "127.0.0.1", scan = 100) {
   }
   return startPort;
 }
+var WARMUP_COMMANDS = {
+  linux: "whoami",
+  macos: "whoami",
+  harmony: "whoami",
+  windows: "dir"
+};
+async function warmUpEngine() {
+  const prevSavePolicy = process.env.AGENT_MOSS_SAVE_POLICY;
+  try {
+    const { runAnalysis: runAnalysis2 } = await Promise.resolve().then(() => (init_coordinator(), coordinator_exports));
+    process.env.AGENT_MOSS_SAVE_POLICY = "0";
+    for (const [osType, command] of Object.entries(WARMUP_COMMANDS)) {
+      await runAnalysis2({
+        sessionId: "__startup_warmup__",
+        promptSession: "",
+        actionHistory: [],
+        aNext: { actionType: "bash", actionDetail: command },
+        reason: "",
+        osType,
+        cwd: "",
+        agentId: ""
+      });
+    }
+    console.log("[AgentMoss] \u5F15\u64CE\u9884\u70ED\u5B8C\u6210\uFF08\u9996\u4E2A\u8BF7\u6C42\u4E0D\u518D\u4ED8\u51B7\u542F\u52A8\u5F00\u9500\uFF09");
+  } catch (err) {
+    console.warn(`[AgentMoss] \u5F15\u64CE\u9884\u70ED\u5931\u8D25\uFF08\u4E0D\u5F71\u54CD\u670D\u52A1\uFF09: ${String(err)}`);
+  } finally {
+    if (prevSavePolicy === void 0) delete process.env.AGENT_MOSS_SAVE_POLICY;
+    else process.env.AGENT_MOSS_SAVE_POLICY = prevSavePolicy;
+  }
+}
 async function startServer(host = "127.0.0.1", port = 9090) {
   const actualPort = await findFreePort(port, host);
   const app = createApp();
@@ -10267,6 +10378,8 @@ async function startServer(host = "127.0.0.1", port = 9090) {
     port: actualPort,
     serve: async () => {
       console.log(`AgentMoss HTTP server on ${host}:${actualPort}`);
+      logDeploymentSelfCheck();
+      await warmUpEngine();
       const { serve: honoServe } = await import("@hono/node-server");
       honoServe({ fetch: app.fetch, hostname: host, port: actualPort });
     }
@@ -10354,7 +10467,7 @@ async function main() {
           console.error(`\u9519\u8BEF: \u4E0D\u662F\u6587\u4EF6: ${target}`);
           process.exit(2);
         }
-        if (/\.(json|ya?ml|toml)$/i.test(target)) {
+        if (/\.(json|ya?ml|toml)$/i.test(target) && !/\s/.test(target.trim())) {
           console.error(`\u9519\u8BEF: \u6587\u4EF6\u4E0D\u5B58\u5728: ${target}`);
           process.exit(2);
         }