@kenhkl/agent-moss 0.15.7 → 0.16.3

package/dist/engine/coordinator.js

@@ -1,13 +1,5 @@
 var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
@@ -15,15 +7,6 @@ var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // node_modules/tsup/assets/esm_shims.js
 import path from "path";
@@ -122,278 +105,31 @@ var init_paths = __esm({
   }
 });
 
-// src/config.ts
-var config_exports = {};
-__export(config_exports, {
-  detectProvider: () => detectProvider,
-  getCustomRules: () => getCustomRules,
-  getLLMConfig: () => getLLMConfig,
-  getLLMFailMode: () => getLLMFailMode,
-  getProviderHeaders: () => getProviderHeaders,
-  getRetryConfig: () => getRetryConfig,
-  getTimeoutConfig: () => getTimeoutConfig,
-  isBrainEnabled: () => isBrainEnabled,
-  isFormalObserveMode: () => isFormalObserveMode,
-  isHeuristicEnabled: () => isHeuristicEnabled,
-  isLLMAvailable: () => isLLMAvailable,
-  isLogicRulesEnabled: () => isLogicRulesEnabled,
-  probeLLMConnection: () => probeLLMConnection,
-  updateLLMConfig: () => updateLLMConfig
-});
-import fs from "fs";
-import path2 from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-function loadConfigFile(filePath) {
-  try {
-    const raw = fs.readFileSync(filePath, "utf-8");
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-function resolveConfigPath() {
-  const envPath = process.env.AGENT_MOSS_CONFIG_PATH;
-  if (envPath) return envPath;
-  const userConfig = path2.join(getConfigDir(), "config.json");
-  if (fs.existsSync(userConfig)) return userConfig;
-  const defaultCandidates = [
-    path2.join(__dirname, "config.json.example"),
-    path2.join(__dirname, "..", "..", "agent_moss", "infra", "config.json.example")
-  ];
-  const defaultConfig = defaultCandidates.find((p) => fs.existsSync(p));
-  if (defaultConfig) {
-    const configDir = path2.dirname(userConfig);
-    fs.mkdirSync(configDir, { recursive: true });
-    const pkgConfig = loadConfigFile(defaultConfig);
-    const safeConfig = pkgConfig ? { ...pkgConfig, llm: { ...pkgConfig.llm, api_key: "" } } : {};
-    fs.writeFileSync(userConfig, JSON.stringify(safeConfig, null, 4), "utf-8");
-    console.log(`[AgentMoss] \u5DF2\u521B\u5EFA\u7528\u6237\u914D\u7F6E\u6587\u4EF6: ${userConfig}`);
-    console.log(`[AgentMoss] \u8BF7\u7F16\u8F91\u8BE5\u6587\u4EF6\u914D\u7F6E\u4F60\u7684 LLM API Key`);
-  }
-  return userConfig;
-}
-function loadLLMConfigFromFile(configPath) {
-  const data = loadConfigFile(configPath);
-  if (!data?.llm) return {};
-  const llm = data.llm;
-  return {
-    provider: llm.provider || "",
-    baseUrl: llm.base_url || "",
-    apiKey: llm.api_key || "",
-    model: llm.model || "",
-    temperature: llm.temperature ?? 0.1,
-    maxTokens: llm.max_tokens ?? 4096,
-    timeout: llm.timeout ?? 40
-  };
-}
-function loadTimeoutRetryFromFile(configPath) {
-  const data = loadConfigFile(configPath);
-  const t = data?.timeout ?? {};
-  const r = data?.retry ?? {};
-  return {
-    timeout: {
-      totalTimeout: Number(t.total_timeout ?? 90),
-      prompt1Timeout: Number(t.prompt1_timeout ?? 40),
-      prompt2Timeout: Number(t.prompt2_timeout ?? 20),
-      stepInterval: Number(t.step_interval ?? 0)
-    },
-    retry: {
-      maxRetries: Number(r.max_retries ?? 2),
-      retryInterval: Number(r.retry_interval ?? 2)
-    }
-  };
-}
-function getTimeoutConfig() {
-  return timeoutConfig;
-}
-function getRetryConfig() {
-  return retryConfig;
-}
-function wildcardToRegExp(pattern) {
-  return pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/\\\*/g, ".*");
-}
-function loadCustomRules() {
-  const rules = [];
-  try {
-    const raw = process.env.AGENT_MOSS_CUSTOM_RULES;
-    if (raw) {
-      const parsed = JSON.parse(raw);
-      if (Array.isArray(parsed)) {
-        for (const r of parsed) {
-          if (r && r.pattern && r.action) rules.push({ pattern: r.pattern, action: r.action, severity: r.severity || "high" });
-        }
-      }
-    }
-  } catch {
-  }
-  for (const rulesPath of USER_RULES_PATHS) {
-    try {
-      if (!fs.existsSync(rulesPath)) continue;
-      const data = JSON.parse(fs.readFileSync(rulesPath, "utf-8"));
-      const actions = Array.isArray(data?.sensitive_actions) ? data.sensitive_actions : [];
-      for (const r of actions) {
-        const p = r?.pattern;
-        if (!p) continue;
-        rules.push({ pattern: wildcardToRegExp(p), action: "Deny", severity: "high" });
-      }
-      break;
-    } catch {
-    }
-  }
-  return rules;
-}
-function getLLMConfig() {
-  return llmConfig;
-}
-function updateLLMConfig(partial) {
-  llmConfig = { ...llmConfig, ...partial };
-}
-function getCustomRules() {
-  return customRules;
-}
-function isLLMAvailable() {
-  if (process.env.AGENT_MOSS_DISABLE_LLM === "1") return false;
-  if (!layerEnabledOrDefault("L3_llm_analysis")) return false;
-  return llmConfig.apiKey.length > 0;
+// src/engine/shell-split.ts
+function hasCommandSubstitution(text) {
+  return CMD_SUBSTITUTION.test(text);
 }
-async function probeLLMConnection(timeoutMs = 8e3) {
-  if (!isLLMAvailable()) return false;
-  const OpenAI3 = (await import("openai")).default;
-  const config = getLLMConfig();
-  const provider = detectProvider(config.baseUrl, config.provider);
-  const extraHeaders = getProviderHeaders(provider);
-  const client = new OpenAI3({
-    baseURL: config.baseUrl,
-    apiKey: config.apiKey,
-    timeout: timeoutMs,
-    maxRetries: 0,
-    defaultHeaders: Object.keys(extraHeaders).length > 0 ? extraHeaders : void 0
-  });
-  try {
-    const resp = await client.chat.completions.create({
-      model: config.model,
-      messages: [{ role: "user", content: "ping" }],
-      max_tokens: 1
-    });
-    return !!(resp && resp.choices && resp.choices[0]);
-  } catch {
-    return false;
-  }
-}
-function getLLMFailMode() {
-  const val = (process.env.AGENT_MOSS_LLM_FAIL_MODE || "fail_open").toLowerCase();
-  return val === "fail_closed" ? "fail_closed" : "fail_open";
-}
-function detectProvider(baseUrl, providerHint = "") {
-  if (providerHint) {
-    const hint = providerHint.toLowerCase();
-    if (["claude", "anthropic"].includes(hint)) return "anthropic";
-    if (["google", "gemini"].includes(hint)) return "gemini";
-    if (["zai-coding-plan", "zhipu-coding-plan", "zhipuai-coding-plan"].includes(hint)) return "zai-coding-plan";
-    if (["zai", "z-ai", "z.ai", "zai-cn", "zai-china", "zhipu", "glm-cn", "bigmodel"].includes(hint)) return "zhipu";
-    if (["xai", "xai-grok"].includes(hint)) return "xai";
-    if (["minimax", "minimax-openai"].includes(hint)) return "minimax";
-    if (["minimax-anthropic"].includes(hint)) return "minimax-anthropic";
-    if (["other", "custom", "local"].includes(hint)) return "openai-compatible";
-    return hint;
-  }
-  const url = baseUrl.toLowerCase();
-  if (url.includes("openrouter.ai")) return "openrouter";
-  if (url.includes("api.openai.com")) return "openai";
-  if (url.includes("anthropic.com") || url.includes("api.anthropic.com")) return "anthropic";
-  if (url.includes("generativelanguage.googleapis.com") || url.includes("gemini")) return "gemini";
-  if (url.includes("api.deepseek.com")) return "deepseek";
-  if (url.includes("api.groq.com")) return "groq";
-  if (url.includes("api.mistral.ai")) return "mistral";
-  if (url.includes("api.together.xyz")) return "together";
-  if (url.includes("api.x.ai")) return "xai";
-  if (url.includes("api.minimaxi.com")) return "minimax";
-  if (url.includes("api-ai.gitcode.com")) return "gitcode";
-  if (url.includes("api.z.ai")) return "zai-coding-plan";
-  if (url.includes("open.bigmodel.cn") || url.includes("bigmodel")) return "zhipu";
-  if (url.includes(":11434")) return "ollama";
-  return "openai-compatible";
-}
-function getProviderHeaders(provider) {
-  return PROVIDER_HEADERS[provider] || {};
-}
-function isHeuristicEnabled() {
-  if (process.env.AGENT_MOSS_DISABLE_HEURISTIC === "1") return false;
-  return layerEnabledOrDefault("L1_heuristic");
-}
-function layerEnabledOrDefault(key) {
-  try {
-    const { isLayerEnabled: isLayerEnabled2 } = __require("../infra/runtime-config");
-    return isLayerEnabled2(key);
-  } catch {
-    return true;
-  }
-}
-function isBrainEnabled() {
-  return process.env.AGENT_MOSS_BRAIN_ENABLED === "1";
+function splitCommandSegments(command) {
+  return command.split(CMD_SEPARATORS).map((s) => s.trim()).filter((s) => s.length > 0);
 }
-function isLogicRulesEnabled() {
-  if (process.env.AGENT_MOSS_DISABLE_LOGIC_RULES === "1") return false;
-  return layerEnabledOrDefault("L2_logic_rules");
-}
-function isFormalObserveMode() {
-  return process.env.AGENT_MOSS_FORMAL_OBSERVE === "1";
+function extractFirstCommand(command) {
+  const segments = splitCommandSegments(command);
+  return segments.length ? segments[0] : "";
 }
-var timeoutConfig, retryConfig, llmConfig, __configModuleDir, USER_RULES_PATHS, customRules, PROVIDER_HEADERS;
-var init_config = __esm({
-  "src/config.ts"() {
+var CMD_SEPARATORS, CMD_SUBSTITUTION;
+var init_shell_split = __esm({
+  "src/engine/shell-split.ts"() {
     "use strict";
     init_esm_shims();
-    init_paths();
-    llmConfig = (() => {
-      const configPath = resolveConfigPath();
-      const fileConfig = fs.existsSync(configPath) ? loadLLMConfigFromFile(configPath) : {};
-      const tr = loadTimeoutRetryFromFile(configPath);
-      timeoutConfig = tr.timeout;
-      retryConfig = tr.retry;
-      return {
-        provider: process.env.AGENT_MOSS_LLM_PROVIDER || fileConfig.provider || "openai",
-        baseUrl: process.env.AGENT_MOSS_LLM_BASE_URL || fileConfig.baseUrl || "https://api.openai.com/v1",
-        apiKey: process.env.AGENT_MOSS_LLM_API_KEY || process.env.OPENAI_API_KEY || fileConfig.apiKey || "",
-        model: process.env.AGENT_MOSS_LLM_MODEL || fileConfig.model || "gpt-4o",
-        temperature: parseFloat(process.env.AGENT_MOSS_LLM_TEMPERATURE || String(fileConfig.temperature ?? "0.1")),
-        maxTokens: parseInt(process.env.AGENT_MOSS_LLM_MAX_TOKENS || String(fileConfig.maxTokens ?? "4096"), 10),
-        // 优先用 env，否则用 timeout 块的 prompt1Timeout（对齐 py）
-        timeout: parseInt(process.env.AGENT_MOSS_LLM_TIMEOUT || String(fileConfig.timeout ?? String(tr.timeout.prompt1Timeout)), 10)
-      };
-    })();
-    __configModuleDir = (() => {
-      try {
-        return path2.dirname(fileURLToPath2(import.meta.url));
-      } catch {
-        return typeof __dirname !== "undefined" ? __dirname : process.cwd();
-      }
-    })();
-    USER_RULES_PATHS = [
-      path2.join(__configModuleDir, "rules", "user_rules.json"),
-      // 源在 ts/src/rules（一般不存在）
-      path2.join(__configModuleDir, "..", "rules", "user_rules.json"),
-      // dist: dist/engine/../rules = dist/rules ✅
-      path2.join(__configModuleDir, "..", "..", "agent_moss", "rules", "user_rules.json")
-      // dev src: ts/src/../../agent_moss
-    ];
-    customRules = loadCustomRules();
-    PROVIDER_HEADERS = {
-      "openrouter": {
-        "HTTP-Referer": "shturl.cc/LlVD5pyWViHjM",
-        "X-OpenRouter-Title": "AgentMoss"
-      },
-      "xai": {
-        "HTTP-Referer": "shturl.cc/LlVD5pyWViHjM"
-      }
-    };
+    CMD_SEPARATORS = /\|\||&&|[|;&\n]/;
+    CMD_SUBSTITUTION = /\$\(|`|</;
   }
 });
 
 // src/engine/inline-analyzer.ts
 function isLiteralTextCommand(command) {
-  ECHO_CMD_RE.lastIndex = 0;
-  if (!ECHO_CMD_RE.test(command)) return false;
+  const segments = splitCommandSegments(command);
+  if (segments.length === 0 || segments.some((s) => !ECHO_SEG_RE.test(s))) return false;
   if (command.includes(">")) {
     let d = command.replace(/<=>|>=|<=|<>|=>/g, " ");
     d = d.replace(/(?:2|&|1)?\s*>\s*\/dev\/null\b/g, "");
@@ -483,14 +219,15 @@ function analyzeInlineScript(command) {
     riskType: "file_access"
   };
 }
-var INLINE_CODE_RE, ECHO_STRING_RE, ECHO_CMD_RE, READ_WRITE_KEYWORDS, WRITE_EXEC_CHAIN_PATTERNS, SHELL_RC_FRAGMENTS, SENSITIVE_PATH_FRAGMENTS, REDIRECT_TO_SENSITIVE_RE, DIR_TRAVERSAL_KEYWORDS;
+var INLINE_CODE_RE, ECHO_STRING_RE, ECHO_SEG_RE, READ_WRITE_KEYWORDS, WRITE_EXEC_CHAIN_PATTERNS, SHELL_RC_FRAGMENTS, SENSITIVE_PATH_FRAGMENTS, REDIRECT_TO_SENSITIVE_RE, DIR_TRAVERSAL_KEYWORDS;
 var init_inline_analyzer = __esm({
   "src/engine/inline-analyzer.ts"() {
     "use strict";
     init_esm_shims();
+    init_shell_split();
     INLINE_CODE_RE = /(?:python|python3|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cera][a-zA-Z]*\s+)"([^"\\]*(?:\\.[^"\\]*)*)"|'([^'\\]*(?:\\.[^'\\]*)*)'/gi;
     ECHO_STRING_RE = /\b(?:echo|printf)\s+"([^"\\]*(?:\\.[^"\\]*)*)"|\b(?:echo|printf)\s+'([^'\\]*(?:\\.[^'\\]*)*)'/gi;
-    ECHO_CMD_RE = /(?:^|\s|;|&&|\|\|)(?:echo|printf)\s/gi;
+    ECHO_SEG_RE = /^\s*(?:echo|printf)(?:\s|$)/i;
     READ_WRITE_KEYWORDS = [
       // 函数调用形态（关键词后跟 '('）
       "open(",
@@ -539,9 +276,34 @@ var init_inline_analyzer = __esm({
       "passthru",
       "shell_exec",
       "proc_open",
-      // Perl-Ruby
+      // Perl/Ruby
       "<stdin>",
-      "open my"
+      "open my",
+      // Node/JS（2026-09 补，与 Python _READ_WRITE_KEYWORDS 同步）：历史缺口 ——
+      // 识别表里一条 Node API 都没有，于是 node -e "require('fs').readFileSync('/etc/shadow')"
+      // 判为纯文本字面量 → 放行（真漏报）。
+      "readfilesync(",
+      "writefilesync(",
+      "appendfilesync(",
+      "unlinksync(",
+      "rmsync(",
+      "mkdirsync(",
+      "execsync(",
+      "spawnsync(",
+      "execfile",
+      "createreadstream",
+      "createwritestream",
+      "fs.read",
+      "fs.write",
+      "fs.promises",
+      "require('fs')",
+      'require("fs")',
+      "require('node:fs')",
+      'require("node:fs")',
+      "require('child_process')",
+      'require("child_process")',
+      "require('https')",
+      'require("https")'
     ];
     WRITE_EXEC_CHAIN_PATTERNS = [
       // echo/cat/printf "..." > file && bash/sh/python file
@@ -596,15 +358,45 @@ var init_inline_analyzer = __esm({
   }
 });
 
-// src/infra/rules-loader.ts
-import { readFileSync as readFileSync2, existsSync } from "fs";
-import { resolve, dirname, join as join2 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
-import { homedir as homedir2 } from "os";
-function dataRootDir() {
-  return process.env.AGENT_MOSS_DATA_DIR || join2(homedir2(), ".config", "agentmoss");
+// src/infra/runtime-config-bridge.ts
+function registerRuntimeConfigBridge(bridge) {
+  runtimeConfigBridge.current = bridge;
 }
-function findRulesFile(name) {
+var runtimeConfigBridge;
+var init_runtime_config_bridge = __esm({
+  "src/infra/runtime-config-bridge.ts"() {
+    "use strict";
+    init_esm_shims();
+    runtimeConfigBridge = { current: null };
+  }
+});
+
+// src/infra/rules-loader.ts
+import { readFileSync as readFileSync2, existsSync } from "fs";
+import { resolve, dirname } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+function dataRootDir() {
+  return getDataRoot();
+}
+function overrideRulesDir() {
+  return resolve(dataRootDir(), "rules");
+}
+function warnOverride(name, path5, data) {
+  if (warnedOverride.has(path5)) return;
+  warnedOverride.add(path5);
+  console.warn(
+    `[AgentMoss] \u89C4\u5219\u6587\u4EF6\u88AB\u7528\u6237\u6570\u636E\u76EE\u5F55\u8986\u76D6: ${path5}\uFF08\u5185\u7F6E\u9ED8\u8BA4\u88AB\u5FFD\u7565\uFF09\u3002\u8BE5\u6587\u4EF6\u7531\u90E8\u7F72\u4FA7\u81EA\u884C\u7EF4\u62A4 \u2014\u2014 **\u5185\u7F6E\u89C4\u5219\u66F4\u65B0\u4E0D\u4F1A\u53CD\u6620\u5230\u5B83\u4E0A\u9762**\uFF1B\u5220\u9664\u8BE5\u6587\u4EF6\u5373\u6062\u590D\u5185\u7F6E\u89C4\u5219\u3002\u82E5\u53EA\u60F3\u9010\u6761\u542F\u505C/\u589E\u5220\uFF0C\u8BF7\u6539\u7528 runtime config\uFF08Console\uFF09\u3002`
+  );
+  const missing = (EXPECTED_KEYS[name] || []).filter((k) => !(k in data));
+  if (missing.length > 0) {
+    console.warn(
+      `\u26A0\uFE0F  [AgentMoss] \u8986\u76D6\u6587\u4EF6 ${path5} \u7F3A\u5C11\u9876\u5C42\u952E [${missing.join(", ")}] \u2014\u2014 \u5BF9\u5E94\u7C7B\u522B\u4F1A**\u4E00\u6761\u89C4\u5219\u90FD\u4E0D\u8DD1**\uFF08\u9759\u9ED8\u5931\u6548\uFF09\u3002\u82E5\u53EA\u60F3\u6539\u5176\u4E2D\u4E00\u7C7B\uFF0C\u8BF7\u5148\u62F7\u8D1D\u5B8C\u6574\u7684\u5185\u7F6E\u6587\u4EF6\u518D\u6539\u3002`
+    );
+  }
+}
+function findRulesFile(name) {
+  const override = resolve(overrideRulesDir(), name);
+  if (existsSync(override)) return override;
   for (const dir of RULES_DIR_CANDS) {
     const p = resolve(dir, name);
     if (existsSync(p)) return p;
@@ -614,11 +406,16 @@ function findRulesFile(name) {
 function loadJson(name) {
   const p = findRulesFile(name);
   if (!p) return {};
+  const isOverride = p === resolve(overrideRulesDir(), name);
+  let data;
   try {
-    return JSON.parse(readFileSync2(p, "utf-8")) || {};
+    data = JSON.parse(readFileSync2(p, "utf-8")) || {};
   } catch {
+    if (isOverride) warnOverride(name, p, {});
     return {};
   }
+  if (isOverride) warnOverride(name, p, data);
+  return data;
 }
 function loadL1() {
   return loadJson("l1_rules.json");
@@ -633,8 +430,8 @@ function loadMC() {
   const mc = loadJson("mc_rules.json");
   const rules = mc.rules || [];
   try {
-    const rt = (init_runtime_config(), __toCommonJS(runtime_config_exports));
-    if (rules.length > 0 && typeof rt.hasRuntimeConfig === "function" && rt.hasRuntimeConfig()) {
+    const rt = runtimeConfigBridge.current;
+    if (rules.length > 0 && rt?.hasRuntimeConfig()) {
       const ltl = rt.loadRuntimeConfig()?.L2_2?.ltl_rules || {};
       const rtRules = ltl.rules || [];
       const enabledById = {};
@@ -652,16 +449,26 @@ function loadMC() {
 function loadToolRegistry() {
   return loadJson("tool_registry.json");
 }
-var __filename2, __dirname2, RULES_DIR_CANDS;
+var __filename2, __dirname2, EXPECTED_KEYS, warnedOverride, RULES_DIR_CANDS;
 var init_rules_loader = __esm({
   "src/infra/rules-loader.ts"() {
     "use strict";
     init_esm_shims();
-    __filename2 = fileURLToPath3(import.meta.url);
+    init_paths();
+    init_runtime_config_bridge();
+    __filename2 = fileURLToPath2(import.meta.url);
     __dirname2 = dirname(__filename2);
+    EXPECTED_KEYS = {
+      "l1_rules.json": ["dangerous_commands", "injection_detection", "sensitive_path_access"],
+      "l2_rules.json": ["intent_consistency", "password_modify_consent", "user_deletion_consent"],
+      "l3_rules.json": [],
+      "mc_rules.json": ["rules"],
+      "tool_registry.json": ["tools"]
+    };
+    warnedOverride = /* @__PURE__ */ new Set();
     RULES_DIR_CANDS = (() => {
       const cands = [
-        // 用户数据目录覆盖优先（与 Python rules_loader._load_json 的
+        // 用户数据目录覆盖优先（与 Python rules_loader.resolve_rules_file 的
         // <data_root>/rules/<name> 优先逻辑对齐）。用户安装 pip/npm 包后把自定义
         // mc_rules.json 放到 <data_root>/rules/ 即可覆盖内置默认，无需改源码。
         resolve(dataRootDir(), "rules"),
@@ -680,21 +487,455 @@ var init_rules_loader = __esm({
   }
 });
 
+// src/engine/platform-traits.ts
+function getPlatformTraits(osType) {
+  const accepted = acceptedOsValues(osType);
+  if (accepted.includes("windows")) return WINDOWS_TRAITS;
+  if (accepted.includes("macos")) return MACOS_TRAITS;
+  if (accepted.includes("harmony")) return HARMONY_TRAITS;
+  return LINUX_TRAITS;
+}
+var LINUX_TRAITS, WINDOWS_TRAITS, MACOS_TRAITS, HARMONY_TRAITS;
+var init_platform_traits = __esm({
+  "src/engine/platform-traits.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_logic_rules();
+    LINUX_TRAITS = {
+      writeKeywords: [
+        "write",
+        "\u5199\u5165",
+        "save",
+        "\u4FDD\u5B58",
+        "modify",
+        "\u4FEE\u6539",
+        "update",
+        "\u66F4\u65B0",
+        "delete",
+        "\u5220\u9664",
+        "remove",
+        "\u79FB\u9664",
+        "create",
+        "\u521B\u5EFA",
+        "append",
+        "\u8FFD\u52A0",
+        "truncate",
+        "\u622A\u65AD",
+        "overwrite",
+        "\u8986\u76D6",
+        "replace",
+        "\u66FF\u6362",
+        "edit"
+      ],
+      readKeywords: [
+        "read",
+        "\u8BFB\u53D6",
+        "cat",
+        "head",
+        "tail",
+        "less",
+        "more",
+        "view",
+        "\u67E5\u770B",
+        "open",
+        "\u6253\u5F00",
+        "load",
+        "\u52A0\u8F7D",
+        "grep",
+        "search",
+        "\u641C\u7D22",
+        "find",
+        "\u67E5\u627E"
+      ],
+      writeCommandRes: [
+        /\brm\b/,
+        /\bunlink\b/,
+        /\brmdir\b/,
+        /\bshred\b/,
+        /\bcp\b/,
+        /\bmv\b/,
+        /\binstall\b/,
+        /\btee\b/,
+        /\bdd\b/,
+        /\bmkfs\b/,
+        /\b(fdisk|parted|cfdisk|sfdisk)\b/,
+        /\bchmod\b/,
+        /\bchown\b/,
+        /\btruncate\b/
+      ],
+      readOnlyCommands: /* @__PURE__ */ new Set([
+        "cat",
+        "head",
+        "tail",
+        "less",
+        "more",
+        "grep",
+        "find",
+        "awk",
+        "sed",
+        "sort",
+        "uniq",
+        "wc",
+        "cut",
+        "strings",
+        "od",
+        "xxd",
+        "hexdump",
+        "tr",
+        "file",
+        "stat",
+        "du",
+        "df",
+        "ls",
+        "dir",
+        "tree",
+        "nl",
+        "tac",
+        "rev",
+        "echo",
+        "printf",
+        "lsblk",
+        "blockdev",
+        "smartctl",
+        "udevadm",
+        "dmidecode",
+        "lscpu",
+        "lspci",
+        "lsusb",
+        "lsmem",
+        "lsns",
+        "lsof",
+        "hwinfo",
+        "inxi",
+        "fdisk",
+        "parted",
+        "dmesg",
+        "journalctl",
+        "systemctl",
+        "hostnamectl",
+        "localectl",
+        "timedatectl",
+        "ps",
+        "top",
+        "free",
+        "vmstat",
+        "iostat",
+        "mpstat",
+        "pidof",
+        "pgrep",
+        "ip",
+        "ifconfig",
+        "route",
+        "ss",
+        "netstat",
+        "arp",
+        "ethtool",
+        "nmcli",
+        "uname",
+        "arch",
+        "nproc",
+        "getconf",
+        "getent",
+        "id",
+        "whoami",
+        "who",
+        "w",
+        "last",
+        "uptime",
+        "lsmod",
+        "modinfo",
+        "sysctl"
+      ]),
+      fullySafeCommands: [
+        /^ls(?:\s|$)/i,
+        /^dir(?:\s|$)/i,
+        /^pwd(?:\s|$)/i,
+        /^which\s+/i,
+        /^whereis\s+/i,
+        /^realpath\s+/i,
+        /^basename\s+/i,
+        /^dirname\s+/i,
+        /^file\s+/i,
+        /^stat\s+/i,
+        /^du(?:\s|$)/i,
+        /^echo\s+/i,
+        /^printf\s+/i,
+        /^type\s+/i,
+        /^command\s+/i,
+        // 系统信息查询（只读，不涉及文件/网络/权限）
+        /^whoami(?:\s|$)/i,
+        /^id(?:\s|$)/i,
+        /^hostname(?:\s|$)/i,
+        /^uname(?:\s|$)/i,
+        /^date(?:\s|$)/i,
+        /^env(?:\s|$)/i,
+        /^printenv(?:\s|$)/i,
+        /^tty(?:\s|$)/i,
+        /^arch(?:\s|$)/i,
+        /^uptime(?:\s|$)/i,
+        /^groups(?:\s|$)/i,
+        /^logname(?:\s|$)/i,
+        // 系统资源/硬件信息（只读，不读文件内容、无状态变更选项）
+        // 与上面 uptime/uname/id 同性质；缺了它们时开 L3 的部署每查一次磁盘/内存
+        // 都要走 LLM（实测 df -h 从 5ms 变成十几秒）。
+        /^df(?:\s|$)/i,
+        /^free(?:\s|$)/i,
+        /^vmstat(?:\s|$)/i,
+        /^nproc(?:\s|$)/i,
+        /^lscpu(?:\s|$)/i,
+        /^lsblk(?:\s|$)/i,
+        /^lspci(?:\s|$)/i,
+        /^lsusb(?:\s|$)/i,
+        /^lsmod(?:\s|$)/i
+      ],
+      readonlySensitiveCommands: [
+        /^cat\s+/i,
+        /^head(?:\s|$)/i,
+        /^tail(?:\s|$)/i,
+        /^less(?:\s|$)/i,
+        /^more(?:\s|$)/i,
+        /^wc(?:\s|$)/i,
+        /^grep(?:\s|$)/i,
+        /^find\s+/i,
+        /^ag(?:\s|$)/i,
+        /^rg(?:\s|$)/i,
+        /^awk\s+/i,
+        /^sed\s+/i,
+        /^cut\s+/i,
+        /^sort(?:\s|$)/i,
+        /^uniq(?:\s|$)/i,
+        // 进程/网络/打开文件信息：只读，但会暴露进程命令行、连接对端、打开的文件
+        // 路径，故只跳 L3、保留 L2（L1 敏感路径检测照常生效）。
+        /^ps(?:\s|$)/i,
+        /^ss(?:\s|$)/i,
+        /^netstat(?:\s|$)/i,
+        /^lsof(?:\s|$)/i,
+        // 只读子命令级白名单：匹配的是「第一段命令」而非首词（extractFirstCommand
+        // 按 | && || 切分），所以能精确到子命令。systemctl stop/disable 等不在此列。
+        /^systemctl\s+(?:status|is-active|is-enabled|is-failed|list-units|list-unit-files|list-dependencies|show|cat)\b/i,
+        /^service\s+\S+\s+status\b/i,
+        // journalctl 整族是只读的，但 --vacuum-*/--rotate/--flush/--sync 会删改日志，
+        // 用否定前瞻挡掉后再放行。注意前瞻里必须用 .* 扫描**整段**：只写 (?!\s+--...)
+        // 的话只看紧跟 journalctl 的第一个参数，
+        // `journalctl -u sshd --vacuum-size=100M` 就漏过去了。
+        /^journalctl\b(?!.*--(?:vacuum-size|vacuum-time|vacuum-files|rotate|flush|sync)\b)/i
+      ]
+    };
+    WINDOWS_TRAITS = {
+      writeKeywords: [
+        "write",
+        "\u5199\u5165",
+        "save",
+        "\u4FDD\u5B58",
+        "modify",
+        "\u4FEE\u6539",
+        "update",
+        "\u66F4\u65B0",
+        "delete",
+        "\u5220\u9664",
+        "remove",
+        "\u79FB\u9664",
+        "create",
+        "\u521B\u5EFA",
+        "append",
+        "\u8FFD\u52A0",
+        "overwrite",
+        "\u8986\u76D6",
+        "replace",
+        "\u66FF\u6362",
+        "set",
+        "\u8BBE\u7F6E"
+        // 注意：这里**不能放 `reg` / `注册表`**。关键词是子串包含匹配，放进去等于
+        // 「只要命令里出现 reg 字样就算写操作」——`reg query`（读）会被判成写，
+        // 进而误拦对 deny_write 路径的只读查询。注册表的写判定交给下面的
+        // writeCommandRes（只认写子命令）。两端语义必须一致。
+      ],
+      readKeywords: [
+        "read",
+        "\u8BFB\u53D6",
+        "type",
+        "findstr",
+        "dir",
+        "view",
+        "\u67E5\u770B",
+        "open",
+        "\u6253\u5F00",
+        "load",
+        "\u52A0\u8F7D",
+        "search",
+        "\u641C\u7D22",
+        "find",
+        "\u67E5\u627E",
+        "get",
+        "\u83B7\u53D6"
+      ],
+      // Windows 写/删命令：del/copy/move/xcopy/replace/rmdir/icacls/reg delete 等
+      writeCommandRes: [
+        /\b(del|erase)\b/,
+        /\brmdir\b/,
+        /\b(rd)\b/,
+        /\bcopy\b/,
+        /\b(xcopy|robocopy)\b/,
+        /\b(move|movefile)\b/,
+        /\breplace\b/,
+        /\bicacls\b/,
+        /\battrib\b/,
+        // 注册表：**只认写子命令**（对齐 Python WindowsProfile.write_command_res）。
+        // 此前是 /\breg\b/，把 reg query（读）也判成写 → 误拦对 deny_write 路径的只读查询。
+        // 写子命令 add/delete/copy/save/restore/import/load/unload；
+        // 读子命令 query/compare/export/flags/help 不在此列。
+        /\breg(?:\.exe)?\s+(?:add|delete|copy|save|restore|import|load|unload)\b/,
+        /\bformat\b/,
+        /\bdiskpart\b/,
+        /\bmkdir\b/,
+        /\bmd\b/,
+        /\bsetx\b/,
+        /\bwmic\b/
+      ],
+      // Windows 只读命令（重定向写判定用）：type/findstr/more/tree/dir 等
+      readOnlyCommands: /* @__PURE__ */ new Set([
+        "type",
+        "findstr",
+        "more",
+        "tree",
+        "dir",
+        "where",
+        "ver",
+        "cls",
+        "echo",
+        "help",
+        "fc",
+        "comp",
+        "find",
+        "sort",
+        "powershell",
+        "cmd",
+        "netstat",
+        "ipconfig",
+        "tasklist",
+        "systeminfo",
+        "driverquery",
+        "reg",
+        "wmic",
+        "whoami",
+        "hostname",
+        "getmac",
+        "query",
+        "w32tm",
+        "diskpart"
+      ]),
+      // Windows 完全安全命令（对齐 WindowsProfile.fully_safe_commands）
+      fullySafeCommands: [
+        /^dir(?:\s|$)/,
+        /^where\s+/,
+        /^echo\s+/,
+        /^cd(?:\s|$)/,
+        /^tree(?:\s|$)/,
+        /^help(?:\s|$)/,
+        /^cls(?:\s|$)/,
+        /^ver(?:\s|$)/,
+        // 系统信息查询（只读，不读文件内容、无状态变更选项），与 Linux 侧 df/free 对齐
+        /^whoami(?:\s|$)/,
+        /^hostname(?:\s|$)/,
+        /^systeminfo(?:\s|$)/,
+        /^tasklist(?:\s|$)/,
+        /^getmac(?:\s|$)/,
+        /^driverquery(?:\s|$)/,
+        /^netstat(?:\s|$)/
+      ],
+      // Windows 安全但可能访问敏感路径的命令（对齐 WindowsProfile.readonly_sensitive_commands）
+      readonlySensitiveCommands: [
+        /^type\s+/,
+        /^findstr\s+/,
+        // 只读子命令级白名单（匹配「第一段命令」而非首词）；
+        // sc create/delete/start/stop、reg add/delete/set 均不在此列。
+        /^sc\s+query\b/,
+        /^reg\s+query\b/
+      ]
+    };
+    MACOS_TRAITS = LINUX_TRAITS;
+    HARMONY_TRAITS = LINUX_TRAITS;
+  }
+});
+
 // src/engine/logic-rules.ts
-import * as fs2 from "fs";
-function _loadSensitivePathScope(scope) {
+import * as fs from "fs";
+function acceptedOsValues(osType) {
+  const t = String(osType || "").toLowerCase();
+  if (t === "windows") return ["windows"];
+  if (t === "macos" || t === "darwin" || t === "osx" || t === "mac") return ["linux", "macos"];
+  if (t === "harmony" || t === "hmos" || t === "openharmony" || t === "hongmeng") return ["linux", "harmony"];
+  return ["linux"];
+}
+function _loadSensitivePathScope(scope, osType = "linux") {
+  const accepted = acceptedOsValues(osType);
   const sps = loadL1().sensitive_path_access || [];
-  return sps.filter((sp) => sp.scope === scope).map((sp) => ({
+  return sps.filter((sp) => sp.scope === scope).filter((sp) => accepted.includes(String(sp.os || "linux").toLowerCase())).map((sp) => ({
     path: sp.path,
     riskLevel: sp.risk_level,
     desc: sp.desc,
     credential: sp.deny_mode === "deny_both" ? true : void 0,
-    dirDelOnly: sp.dir_del_only === true ? true : void 0
+    readOnly: sp.read_only === true || sp.deny_mode === "deny_read" ? true : void 0,
+    denyMode: sp.deny_mode || void 0,
+    dirDelOnly: sp.dir_del_only === true ? true : void 0,
+    // 保留条目的原始平台归属（非查询用的 osType）—— seed 分组去重用
+    os: String(sp.os || "linux").toLowerCase()
   }));
 }
-function isWriteOperation(actionType, actionDetail, writeKeywords = WRITE_KEYWORDS) {
+function _scopeOf(os3, path5) {
+  if (!_scopeIndex) {
+    _scopeIndex = /* @__PURE__ */ new Map();
+    for (const sp of loadL1().sensitive_path_access || []) {
+      const key = `${String(sp.os || "linux").toLowerCase()}|${sp.path}`;
+      if (!_scopeIndex.has(key)) _scopeIndex.set(key, sp.scope);
+    }
+  }
+  return _scopeIndex.get(`${String(os3 || "linux").toLowerCase()}|${path5}`) || "root";
+}
+function getSensitivePathsForOs(osType) {
+  const effective = runtimeConfigBridge.current?.effectiveSensitivePaths(osType);
+  if (effective) {
+    const root = [];
+    const home = [];
+    const credential = [];
+    for (const r of effective) {
+      const entry = {
+        path: r.path,
+        riskLevel: r.riskLevel,
+        desc: r.desc,
+        // ⚠️ 不要强制 credential：用户在 Console 把某条从 deny_both 改成 deny_write
+        // 之后，强制 credential 会让读操作仍被拦（改了不生效）。一律以 runtime 为准。
+        credential: r.credential === true ? true : void 0,
+        readOnly: r.readOnly === true ? true : void 0,
+        denyMode: r.denyMode || void 0,
+        dirDelOnly: r.dirDelOnly === true ? true : void 0
+      };
+      const scope = _scopeOf(r.os, r.path);
+      if (scope === "home") home.push(entry);
+      else if (scope === "credential") credential.push(entry);
+      else root.push(entry);
+    }
+    return { root, home, credential };
+  }
+  return getSensitivePathsForOsBuiltin(osType);
+}
+function getSensitivePathsForOsBuiltin(osType) {
+  const t = String(osType || "").toLowerCase();
+  if (t === "windows") {
+    return { root: ROOT_SENSITIVE_PATHS_WINDOWS, home: HOME_SENSITIVE_PATHS_WINDOWS, credential: CREDENTIAL_PATHS_WINDOWS };
+  }
+  if (t === "macos" || t === "darwin" || t === "osx" || t === "mac") {
+    return { root: ROOT_SENSITIVE_PATHS_MACOS, home: HOME_SENSITIVE_PATHS_MACOS, credential: CREDENTIAL_PATHS_MACOS };
+  }
+  if (t === "harmony" || t === "hmos" || t === "openharmony" || t === "hongmeng") {
+    return { root: ROOT_SENSITIVE_PATHS_HARMONY, home: HOME_SENSITIVE_PATHS_HARMONY, credential: CREDENTIAL_PATHS_HARMONY };
+  }
+  return { root: ROOT_SENSITIVE_PATHS, home: HOME_SENSITIVE_PATHS, credential: CREDENTIAL_PATHS };
+}
+function isWriteOperation(actionType, actionDetail, writeKeywords = WRITE_KEYWORDS, osType) {
   if (writeKeywords.some((kw) => actionType.includes(kw) || actionDetail.includes(kw))) return true;
-  if (WRITE_COMMAND_RES.some((rx) => rx.test(actionDetail))) return true;
+  const { writeCommandRes } = getPlatformTraits(osType);
+  if (writeCommandRes.some((rx) => rx.test(actionDetail))) return true;
   if (/\bsed\s+-[a-zA-Z]*i/i.test(actionDetail)) return true;
   for (const seg of actionDetail.split(/&&|\|\||;|\n/)) {
     const trimmed = seg.trim();
@@ -728,6 +969,12 @@ function isWriteOperation(actionType, actionDetail, writeKeywords = WRITE_KEYWOR
   }
   return false;
 }
+function getIntentPatternsForOs(osType) {
+  const effective = runtimeConfigBridge.current?.effectiveIntentPatterns(osType);
+  if (effective) return effective;
+  const accepted = acceptedOsValues(osType);
+  return INTENT_DEVIATION_PATTERNS.filter((p) => accepted.includes(p.os));
+}
 function matchDangerousAction(actionDetail, action) {
   if (/[^\x00-\x7f]/.test(action)) {
     return actionDetail.includes(action);
@@ -762,38 +1009,47 @@ function collectIntentTexts(promptSession, promptHistory) {
   }
   return deduped;
 }
-function runLogicCheck(input) {
+function checkIntentConsistency(input) {
+  const { aNext, promptSession, promptHistory } = input;
+  const actionDetail = aNext.actionDetail.toLowerCase();
+  const actionType = aNext.actionType.toLowerCase();
+  const EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
+  if (EXCLUDED_PREFIXES.some((p) => actionType.startsWith(p))) return null;
+  if (INLINE_SCRIPT_RE.test(actionDetail)) return null;
+  const intentTexts = collectIntentTexts(promptSession, promptHistory);
+  for (const pattern of getIntentPatternsForOs(input.osType)) {
+    const intentMatched = intentTexts.some(
+      (text) => pattern.intentKeywords.some((kw) => text.includes(kw))
+    );
+    const dangerousMatched = pattern.dangerousActions.some((kw) => matchDangerousAction(actionDetail, kw));
+    if (intentMatched && dangerousMatched) {
+      return {
+        allowed: false,
+        reason: pattern.reason,
+        riskLevel: "high",
+        riskType: "intent_deviation",
+        confidence: 85,
+        source: "logic_rule",
+        violatedLayers: ["L2.1"]
+      };
+    }
+  }
+  return null;
+}
+function runLogicCheck(input, opts) {
   const { actionHistory, aNext, cwd } = input;
   const actionDetail = aNext.actionDetail.toLowerCase();
   const actionType = aNext.actionType.toLowerCase();
   const resolvedCwd = cwd || "/";
   const EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
   const isExcludedType = EXCLUDED_PREFIXES.some((p) => actionType.startsWith(p));
-  const rbwResult = checkReadBeforeWrite(actionType, actionDetail, actionHistory, input.reason, resolvedCwd);
-  if (rbwResult) return rbwResult;
-  if (!isExcludedType) {
-    if (!INLINE_SCRIPT_RE.test(actionDetail)) {
-      const intentTexts = collectIntentTexts(input.promptSession, input.promptHistory);
-      for (const pattern of INTENT_DEVIATION_PATTERNS) {
-        const intentMatched = intentTexts.some(
-          (text) => pattern.intentKeywords.some((kw) => text.includes(kw))
-        );
-        const dangerousMatched = pattern.dangerousActions.some((kw) => matchDangerousAction(actionDetail, kw));
-        if (intentMatched && dangerousMatched) {
-          return {
-            allowed: false,
-            reason: pattern.reason,
-            riskLevel: "high",
-            riskType: "intent_deviation",
-            confidence: 85,
-            source: "logic_rule",
-            violatedLayers: ["L2.1"]
-          };
-        }
-      }
-    }
+  if (!opts?.skipReadBeforeWrite) {
+    const rbwResult = checkReadBeforeWrite(actionType, actionDetail, actionHistory, input.reason, resolvedCwd, input.osType);
+    if (rbwResult) return rbwResult;
   }
-  const indirectResult = checkIndirectFileAccess(actionType, actionDetail, resolvedCwd);
+  const intentResult = checkIntentConsistency(input);
+  if (intentResult) return intentResult;
+  const indirectResult = checkIndirectFileAccess(actionType, actionDetail, resolvedCwd, input.osType);
   if (indirectResult) return indirectResult;
   if (INLINE_SCRIPT_RE.test(actionDetail)) {
   } else if (containsPrivilegeEscalation(actionDetail)) {
@@ -816,9 +1072,9 @@ function runLogicCheck(input) {
       }
     }
   }
-  const pwdResult = checkPasswordConsent(actionType, actionDetail, actionHistory);
+  const pwdResult = checkPasswordConsent(actionType, actionDetail, actionHistory, input.osType);
   if (pwdResult) return pwdResult;
-  const userDelResult = checkUserDeletionConsent(actionType, actionDetail, actionHistory);
+  const userDelResult = checkUserDeletionConsent(actionType, actionDetail, actionHistory, input.osType);
   if (userDelResult) return userDelResult;
   const comboResult = checkComboChain(actionHistory, aNext.actionDetail);
   if (comboResult) return comboResult;
@@ -869,22 +1125,33 @@ function checkComboChain(actionHistory, actionDetailRaw) {
   }
   return null;
 }
-function extractFilePaths(text) {
+function extractFilePaths(text, osType) {
   const paths = [];
   const unixPaths = text.match(/(?:^|\s)(\/[^\s;|&><'"]+)/g);
   if (unixPaths) paths.push(...unixPaths.map((p) => p.trim()));
+  const isWindows = String(osType || "").toLowerCase() === "windows";
+  if (isWindows) {
+    const winPaths = text.match(/(?:^|\s)([A-Za-z]:[\\\/][^\s;|&><'"]+)/g);
+    if (winPaths) paths.push(...winPaths.map((p) => p.trim()));
+    const uncPaths = text.match(/(?:^|\s)(\\{2}[^\\\s]+(?:\\[^\s;|&><'"]*))/g);
+    if (uncPaths) paths.push(...uncPaths.map((p) => p.trim()));
+  }
   const textNoQuotes = text.replace(/'[^']*'|"[^"]*"/g, "");
   const kvPaths = textNoQuotes.match(/(?:=)(\/[^\s;|&><'"]+)/g);
   if (kvPaths) paths.push(...kvPaths.map((p) => p.replace(/^=/, "")));
   const quotedPaths = text.match(/["']\/([^"']+)["']/g);
   if (quotedPaths) paths.push(...quotedPaths.map((p) => p.replace(/["']/g, "")));
+  if (isWindows) {
+    const quotedWinPaths = text.match(/["']([A-Za-z]:[\\\/][^"']+)["']/g);
+    if (quotedWinPaths) paths.push(...quotedWinPaths.map((p) => p.replace(/["']/g, "")));
+  }
   return [...new Set(paths)];
 }
-function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, cwd) {
+function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, cwd, osType) {
   if (NON_WRITE_TOOL_PREFIXES.some((p) => actionType.startsWith(p))) return null;
   if (NON_WRITE_TOOLS.has(actionType)) return null;
   const isBashLike = actionType === "bash" || actionType === "executebash" || actionType === "terminal-executebash";
-  const isWrite = isBashLike ? isWriteOperation(actionType, actionDetail) : WRITE_KEYWORDS.some((kw) => actionType.includes(kw));
+  const isWrite = isBashLike ? isWriteOperation(actionType, actionDetail, void 0, osType) : getPlatformTraits(osType).writeKeywords.some((kw) => actionType.includes(kw));
   if (!isWrite) return null;
   const WRITE_CMDS = /* @__PURE__ */ new Set(["cp", "mv", "install", "tee", "dd", "truncate", "mkfs", "fdisk", "parted"]);
   if (isBashLike) {
@@ -928,7 +1195,7 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
     if (firstWord === "cd") {
       continue;
     }
-    if (READ_ONLY_COMMANDS.has(firstWord)) {
+    if (getPlatformTraits(osType).readOnlyCommands.has(firstWord)) {
       const segUnquoted = trimmed.replace(new RegExp(`>{1,2}\\s*(['"])([~./][^'"]+)\\1`, "g"), (_m, _q, p) => ">" + p);
       const segNoDevnull = segUnquoted.replace(DEVNULL_REDIRECT_RE, "");
       const segNoQuotes = segNoDevnull.replace(/'[^']*'|"[^"]*"/g, "");
@@ -936,7 +1203,7 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
       if (m) targetPaths.push(m[1] || m[2] || m[3]);
       continue;
     }
-    const segPaths = extractFilePaths(trimmed);
+    const segPaths = extractFilePaths(trimmed, osType);
     const segPathsFiltered = firstWord === "wget" || firstWord === "curl" ? segPaths.filter((p) => p !== "/dev/null") : segPaths;
     if (SOURCE_ARG_CMDS.has(firstWord)) {
       if (segPathsFiltered.length > 1) targetPaths.push(...segPathsFiltered.slice(1));
@@ -958,20 +1225,30 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
   for (const action of actionHistory) {
     const histDetail = action.actionDetail.toLowerCase();
     const histType = action.actionType.toLowerCase();
-    const isRead = READ_KEYWORDS.some((kw) => histType.includes(kw) || histDetail.includes(kw));
+    const isRead = getPlatformTraits(osType).readKeywords.some((kw) => histType.includes(kw) || histDetail.includes(kw));
     if (isRead) {
-      for (const p of extractFilePaths(histDetail)) {
+      for (const p of extractFilePaths(histDetail, osType)) {
         historyReadPaths.add(p);
       }
     }
   }
+  const TEMP_DIRS = ["/tmp/", "/var/tmp/", "/dev/shm/", "/run/"];
+  let filteredPaths = uniqueTargetPaths;
+  if (/\bdd\b/i.test(actionDetail) && /\bif=\/dev\/zero\b/i.test(actionDetail)) {
+    filteredPaths = uniqueTargetPaths.filter(
+      (p) => !TEMP_DIRS.some((td) => p.startsWith(td))
+    );
+  }
+  if (filteredPaths.length === 0) {
+    return null;
+  }
   const unreadPaths = [];
-  for (const path5 of uniqueTargetPaths) {
+  for (const path5 of filteredPaths) {
     const hasRead = [...historyReadPaths].some(
       (rp) => path5 === rp || path5.startsWith(rp) || rp.startsWith(path5)
     );
     if (!hasRead) {
-      let isCreate = !fs2.existsSync(path5);
+      let isCreate = !fs.existsSync(path5);
       if (!isCreate) {
         isCreate = CREATE_KEYWORDS.some((kw) => reason.toLowerCase().includes(kw) || actionDetail.includes(kw));
       }
@@ -993,14 +1270,18 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
   }
   return null;
 }
-function checkPasswordConsent(actionType, actionDetail, actionHistory) {
+function hasUserConsent(actionHistory) {
+  return actionHistory.some((h) => {
+    const t = String(h.actionType || "").toLowerCase();
+    return t === "ask_user_question" && String(h.output || "").trim().length > 0;
+  });
+}
+function checkPasswordConsent(actionType, actionDetail, actionHistory, osType) {
   if (actionType !== "bash") return null;
-  const isPasswordModify = PASSWORD_MODIFY_PATTERNS.some((p) => p.test(actionDetail));
+  const pwdPatterns = runtimeConfigBridge.current?.effectivePasswordPatterns(osType) ?? PASSWORD_MODIFY_PATTERNS;
+  const isPasswordModify = pwdPatterns.some((p) => p.test(actionDetail));
   if (!isPasswordModify) return null;
-  const hasConsent = actionHistory.some(
-    (h) => h.actionType.toLowerCase() === "ask_user_question" && h.actionDetail.trim().length > 0
-  );
-  if (hasConsent) return null;
+  if (hasUserConsent(actionHistory)) return null;
   return {
     allowed: false,
     reason: "\u6267\u884C\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u5BC6\u7801\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u5BC6\u7801\u4FEE\u6539\u98CE\u9669",
@@ -1011,14 +1292,12 @@ function checkPasswordConsent(actionType, actionDetail, actionHistory) {
     violatedLayers: ["L2.1"]
   };
 }
-function checkUserDeletionConsent(actionType, actionDetail, actionHistory) {
+function checkUserDeletionConsent(actionType, actionDetail, actionHistory, osType) {
   if (actionType !== "bash") return null;
-  const isUserDeletion = USER_DELETION_PATTERNS.some((p) => p.test(actionDetail));
+  const udPatterns = runtimeConfigBridge.current?.effectiveUserDeletionPatterns(osType) ?? USER_DELETION_PATTERNS;
+  const isUserDeletion = udPatterns.some((p) => p.test(actionDetail));
   if (!isUserDeletion) return null;
-  const hasConsent = actionHistory.some(
-    (h) => h.actionType.toLowerCase() === "ask_user_question" && h.actionDetail.trim().length > 0
-  );
-  if (hasConsent) return null;
+  if (hasUserConsent(actionHistory)) return null;
   return {
     allowed: false,
     reason: "\u6267\u884C\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u7528\u6237\u5220\u9664\u98CE\u9669",
@@ -1041,7 +1320,7 @@ function containsPrivilegeEscalation(actionDetail) {
   }
   return false;
 }
-function checkIndirectFileAccess(actionType, actionDetail, cwd) {
+function checkIndirectFileAccess(actionType, actionDetail, cwd, osType) {
   if (actionType !== "bash" && actionType !== "executebash" && actionType !== "terminal-executebash") {
     return null;
   }
@@ -1054,14 +1333,14 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
   if (!hasTraversal) {
     return null;
   }
-  const READ_KEYWORDS2 = ["read(", "readline", "readlines", "fread", "fgets", "load(", "getpass", "file_get_contents"];
+  const READ_KEYWORDS = ["read(", "readline", "readlines", "fread", "fgets", "load(", "getpass", "file_get_contents"];
   const WRITE_KEYWORDS2 = ["write(", "writelines", "fwrite", "file_put_contents"];
   const EXEC_KEYWORDS = ["system(", "exec(", "eval(", "popen(", "os.system", "os.popen", "subprocess", "os.exec", "os.spawn", "shell=true", "check_output", "check_call", "run(", "passthru", "shell_exec", "proc_open"];
   const OPEN_KEYWORDS = ["open(", "fopen("];
   const code = extractInlineCode(actionDetail);
   if (!code) return null;
   const codeLower = code.toLowerCase();
-  const hasAnyOp = READ_KEYWORDS2.some((kw) => codeLower.includes(kw)) || WRITE_KEYWORDS2.some((kw) => codeLower.includes(kw)) || EXEC_KEYWORDS.some((kw) => codeLower.includes(kw)) || OPEN_KEYWORDS.some((kw) => codeLower.includes(kw));
+  const hasAnyOp = READ_KEYWORDS.some((kw) => codeLower.includes(kw)) || WRITE_KEYWORDS2.some((kw) => codeLower.includes(kw)) || EXEC_KEYWORDS.some((kw) => codeLower.includes(kw)) || OPEN_KEYWORDS.some((kw) => codeLower.includes(kw));
   if (!hasAnyOp) {
     return null;
   }
@@ -1069,15 +1348,16 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
   const hasExec = EXEC_KEYWORDS.some((kw) => codeLower.includes(kw));
   const blockAllSensitive = hasWrite || hasExec;
   let actualFiles = [];
-  if (cwd && cwd !== "/") {
+  if (cwd) {
     try {
-      actualFiles = fs2.readdirSync(cwd);
+      actualFiles = fs.readdirSync(cwd);
     } catch {
     }
   }
   if (actualFiles.length > 0) {
-    for (const cp of CREDENTIAL_PATHS) {
-      const fname = cp.path.split("/").pop() || cp.path;
+    const { root: rootPaths, home: homePaths, credential: credentialPaths } = getSensitivePathsForOs(osType);
+    for (const cp of credentialPaths) {
+      const fname = cp.path.split(/[/\\]/).pop() || cp.path;
       if (actualFiles.some((f) => f === fname || f.toLowerCase() === fname.toLowerCase())) {
         return {
           allowed: false,
@@ -1092,8 +1372,8 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
       }
     }
     if (blockAllSensitive) {
-      for (const sp of [...ROOT_SENSITIVE_PATHS, ...HOME_SENSITIVE_PATHS]) {
-        const fname = sp.path.split("/").pop() || sp.path;
+      for (const sp of [...rootPaths, ...homePaths]) {
+        const fname = sp.path.split(/[/\\]/).pop() || sp.path;
         if (actualFiles.some((f) => f === fname || f.toLowerCase() === fname.toLowerCase())) {
           return {
             allowed: false,
@@ -1119,16 +1399,28 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
     violatedLayers: ["L2.1"]
   };
 }
-var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, WRITE_KEYWORDS, WRITE_COMMAND_RES, READ_ONLY_COMMANDS, DEVNULL_REDIRECT_RE, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
+var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, WRITE_KEYWORDS, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
 var init_logic_rules = __esm({
   "src/engine/logic-rules.ts"() {
     "use strict";
     init_esm_shims();
     init_inline_analyzer();
+    init_runtime_config_bridge();
     init_rules_loader();
+    init_platform_traits();
     ROOT_SENSITIVE_PATHS = _loadSensitivePathScope("root");
     HOME_SENSITIVE_PATHS = _loadSensitivePathScope("home");
     CREDENTIAL_PATHS = _loadSensitivePathScope("credential").map(({ path: path5, riskLevel, desc, dirDelOnly }) => ({ path: path5, riskLevel, desc, credential: true, dirDelOnly }));
+    ROOT_SENSITIVE_PATHS_WINDOWS = _loadSensitivePathScope("root", "windows");
+    HOME_SENSITIVE_PATHS_WINDOWS = _loadSensitivePathScope("home", "windows");
+    CREDENTIAL_PATHS_WINDOWS = _loadSensitivePathScope("credential", "windows").map(({ path: path5, riskLevel, desc, dirDelOnly }) => ({ path: path5, riskLevel, desc, credential: true, dirDelOnly }));
+    ROOT_SENSITIVE_PATHS_MACOS = _loadSensitivePathScope("root", "macos");
+    HOME_SENSITIVE_PATHS_MACOS = _loadSensitivePathScope("home", "macos");
+    CREDENTIAL_PATHS_MACOS = _loadSensitivePathScope("credential", "macos").map(({ path: path5, riskLevel, desc, dirDelOnly }) => ({ path: path5, riskLevel, desc, credential: true, dirDelOnly }));
+    ROOT_SENSITIVE_PATHS_HARMONY = _loadSensitivePathScope("root", "harmony");
+    HOME_SENSITIVE_PATHS_HARMONY = _loadSensitivePathScope("home", "harmony");
+    CREDENTIAL_PATHS_HARMONY = _loadSensitivePathScope("credential", "harmony").map(({ path: path5, riskLevel, desc, dirDelOnly }) => ({ path: path5, riskLevel, desc, credential: true, dirDelOnly }));
+    _scopeIndex = null;
     NON_WRITE_TOOLS = /* @__PURE__ */ new Set([
       "ask_user_question",
       "glob",
@@ -1150,111 +1442,7 @@ var init_logic_rules = __esm({
     ]);
     NON_WRITE_TOOL_PREFIXES = ["memory-", "skill-manager-", "mailbox-", "app-"];
     WRITE_KEYWORDS = ["write", "\u5199\u5165", "save", "\u4FDD\u5B58", "modify", "\u4FEE\u6539", "update", "\u66F4\u65B0", "delete", "\u5220\u9664", "remove", "\u79FB\u9664", "create", "\u521B\u5EFA", "append", "\u8FFD\u52A0", "truncate", "\u622A\u65AD", "overwrite", "\u8986\u76D6", "replace", "\u66FF\u6362", "edit"];
-    WRITE_COMMAND_RES = [
-      /\brm\b/,
-      /\bunlink\b/,
-      /\brmdir\b/,
-      /\bshred\b/,
-      /\bcp\b/,
-      /\bmv\b/,
-      /\binstall\b/,
-      /\btee\b/,
-      /\bdd\b/,
-      /\bmkfs\b/,
-      /\b(fdisk|parted|cfdisk|sfdisk)\b/,
-      /\bchmod\b/,
-      /\bchown\b/,
-      /\btruncate\b/
-    ];
-    READ_ONLY_COMMANDS = /* @__PURE__ */ new Set([
-      "cat",
-      "head",
-      "tail",
-      "less",
-      "more",
-      "grep",
-      "find",
-      "awk",
-      "sed",
-      "sort",
-      "uniq",
-      "wc",
-      "cut",
-      "strings",
-      "od",
-      "xxd",
-      "hexdump",
-      "tr",
-      "file",
-      "stat",
-      "du",
-      "df",
-      "ls",
-      "dir",
-      "tree",
-      "nl",
-      "tac",
-      "rev",
-      // NEW-FP-I: echo/printf 是文本输出命令，参数是字面量非写目标。加入此集让
-      // read_before_write 的 echo 段走只读命令分支（只提取重定向目标，不提取参数路径），
-      // 避免 echo "cat /etc/shadow" > /tmp/x.sh 的引号内 /etc/shadow 被当写目标误报。
-      // echo "x" > /tmp/x.sh 的重定向目标 /tmp/x.sh 仍被提取（真实写不漏报）。
-      "echo",
-      "printf",
-      "lsblk",
-      "blockdev",
-      "smartctl",
-      "udevadm",
-      "dmidecode",
-      "lscpu",
-      "lspci",
-      "lsusb",
-      "lsmem",
-      "lsns",
-      "lsof",
-      "hwinfo",
-      "inxi",
-      "fdisk",
-      "parted",
-      "dmesg",
-      "journalctl",
-      "systemctl",
-      "hostnamectl",
-      "localectl",
-      "timedatectl",
-      "ps",
-      "top",
-      "free",
-      "vmstat",
-      "iostat",
-      "mpstat",
-      "pidof",
-      "pgrep",
-      "ip",
-      "ifconfig",
-      "route",
-      "ss",
-      "netstat",
-      "arp",
-      "ethtool",
-      "nmcli",
-      "uname",
-      "arch",
-      "nproc",
-      "getconf",
-      "getent",
-      "id",
-      "whoami",
-      "who",
-      "w",
-      "last",
-      "uptime",
-      "lsmod",
-      "modinfo",
-      "sysctl"
-    ]);
     DEVNULL_REDIRECT_RE = /(?:2|&|1)?\s*>\s*\/dev\/null\b/g;
-    READ_KEYWORDS = ["read", "\u8BFB\u53D6", "cat", "head", "tail", "less", "more", "view", "\u67E5\u770B", "open", "\u6253\u5F00", "load", "\u52A0\u8F7D", "grep", "search", "\u641C\u7D22", "find", "\u67E5\u627E"];
     CREATE_KEYWORDS = ["\u521B\u5EFA", "\u65B0\u5EFA", "create", "new file", "touch"];
     PASSWORD_MODIFY_PATTERNS = (() => {
       const pats = loadL2().password_modify_consent || [];
@@ -1269,7 +1457,8 @@ var init_logic_rules = __esm({
       return pats.map((p) => ({
         intentKeywords: p.intent_keywords,
         dangerousActions: p.dangerous_actions,
-        reason: p.reason
+        reason: p.reason,
+        os: String(p.os || "linux").toLowerCase()
       }));
     })();
     COMBO_STAGES = (() => {
@@ -1329,9 +1518,9 @@ var init_asset_dir = __esm({
 });
 
 // src/engine/skill-loader.ts
-import { readFileSync as readFileSync3, readdirSync as readdirSync2 } from "fs";
+import { readFileSync as readFileSync3, readdirSync as readdirSync2, existsSync as existsSync4 } from "fs";
 import { resolve as resolve3, dirname as dirname2 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
+import { fileURLToPath as fileURLToPath3 } from "url";
 function loadAllSkills() {
   if (cachedSkills) return cachedSkills;
   cachedSkills = {};
@@ -1349,14 +1538,47 @@ function loadAllSkills() {
   console.log(`[AgentMoss] Loaded ${Object.keys(cachedSkills).length} skills from ${dir}`);
   return cachedSkills;
 }
+function userSkillsDir() {
+  return resolve3(getDataRoot(), "agent_moss_skills");
+}
+function runtimeCustomSkillKeywords() {
+  try {
+    const rt = runtimeConfigBridge.current?.loadRuntimeConfig?.();
+    if (!rt) return {};
+    const out = {};
+    for (const cat of Object.values(rt.L3_skills || {})) {
+      if (!cat || typeof cat !== "object" || cat.category_enabled === false) continue;
+      for (const sk of cat.skills || []) {
+        if (!sk || sk.builtin !== false || sk.enabled === false || !sk.id) continue;
+        out[sk.id] = sk.keywords || [];
+      }
+    }
+    return out;
+  } catch {
+    return {};
+  }
+}
+function loadUserSkill(name) {
+  if (userSkillCache[name] !== void 0) return userSkillCache[name];
+  try {
+    const p = resolve3(userSkillsDir(), `${name}.md`);
+    userSkillCache[name] = existsSync4(p) ? readFileSync3(p, "utf-8") : "";
+  } catch {
+    userSkillCache[name] = "";
+  }
+  return userSkillCache[name];
+}
 function matchSkills(actionType, actionDetail, reason, maxSkills = 3) {
   const skills = loadAllSkills();
   const combined = `${actionType} ${actionDetail} ${reason}`.toLowerCase();
   const actionDetailLower = actionDetail.toLowerCase();
   const actionTypeLower = actionType.toLowerCase();
   const reasonLower = reason.toLowerCase();
+  const disabledSkillIds = runtimeConfigBridge.current?.disabledSkillIds() ?? /* @__PURE__ */ new Set();
+  const skillMap = { ...SKILL_KEYWORD_MAP, ...runtimeCustomSkillKeywords() };
   const scores = {};
-  for (const [skillName, keywords] of Object.entries(SKILL_KEYWORD_MAP)) {
+  for (const [skillName, keywords] of Object.entries(skillMap)) {
+    if (disabledSkillIds.has(skillName)) continue;
     let score = 0;
     for (const kw of keywords) {
       if (combined.includes(kw)) {
@@ -1373,7 +1595,7 @@ function matchSkills(actionType, actionDetail, reason, maxSkills = 3) {
   const maxScore = top[0]?.[1] || 1;
   const results = [];
   for (const [name, score] of top) {
-    const content = skills[name];
+    const content = skills[name] || loadUserSkill(name);
     if (content) {
       results.push({
         skillName: name,
@@ -1398,14 +1620,16 @@ function formatSkillsForPrompt(skills) {
 ${s.skillContent}`
   ).join("\n\n---\n\n");
 }
-var __filename3, __dirname3, SKILL_KEYWORD_MAP, cachedSkills;
+var __filename3, __dirname3, SKILL_KEYWORD_MAP, cachedSkills, userSkillCache;
 var init_skill_loader = __esm({
   "src/engine/skill-loader.ts"() {
     "use strict";
     init_esm_shims();
     init_rules_loader();
+    init_paths();
     init_asset_dir();
-    __filename3 = fileURLToPath4(import.meta.url);
+    init_runtime_config_bridge();
+    __filename3 = fileURLToPath3(import.meta.url);
     __dirname3 = dirname2(__filename3);
     SKILL_KEYWORD_MAP = (() => {
       const map = {};
@@ -1419,6 +1643,7 @@ var init_skill_loader = __esm({
       return map;
     })();
     cachedSkills = null;
+    userSkillCache = {};
   }
 });
 
@@ -1435,6 +1660,12 @@ __export(runtime_config_exports, {
   deleteCustomRule: () => deleteCustomRule,
   deleteCustomSkill: () => deleteCustomSkill,
   deleteScenarioRule: () => deleteScenarioRule,
+  effectiveDangerousPatterns: () => effectiveDangerousPatterns,
+  effectiveInjectionKeywords: () => effectiveInjectionKeywords,
+  effectiveIntentPatterns: () => effectiveIntentPatterns,
+  effectivePasswordPatterns: () => effectivePasswordPatterns,
+  effectiveSensitivePaths: () => effectiveSensitivePaths,
+  effectiveUserDeletionPatterns: () => effectiveUserDeletionPatterns,
   filterEnabledRules: () => filterEnabledRules,
   generateSourceDefaults: () => generateSourceDefaults,
   getAgentRules: () => getAgentRules,
@@ -1478,9 +1709,9 @@ __export(runtime_config_exports, {
   updateSkillCategoryEnabled: () => updateSkillCategoryEnabled,
   updateSkillEnabled: () => updateSkillEnabled
 });
-import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync4, mkdirSync, unlinkSync, readdirSync as readdirSync3, statSync } from "fs";
+import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync5, mkdirSync, unlinkSync, readdirSync as readdirSync3, statSync } from "fs";
 import { join as join3 } from "path";
-import { fileURLToPath as fileURLToPath5 } from "url";
+import { fileURLToPath as fileURLToPath4 } from "url";
 import { dirname as dirname3 } from "path";
 function runtimeDir() {
   return getRuntimeConfigDir();
@@ -1493,7 +1724,7 @@ function getRuntimeConfigPath() {
 function saveRuntimeConfig(config) {
   const p = getRuntimeConfigPath();
   const dir = p.substring(0, p.lastIndexOf("/"));
-  if (dir && !existsSync4(dir)) mkdirSync(dir, { recursive: true });
+  if (dir && !existsSync5(dir)) mkdirSync(dir, { recursive: true });
   writeFileSync(p, JSON.stringify(config, null, 2), "utf-8");
   invalidateRuntimeConfigCache();
 }
@@ -1511,10 +1742,11 @@ function emptyRuntimeConfig() {
 }
 function invalidateRuntimeConfigCache() {
   runtimeConfigCache = null;
+  hasRuntimeConfigCache.clear();
 }
 function loadRuntimeConfig() {
   const p = getRuntimeConfigPath();
-  if (!existsSync4(p)) {
+  if (!existsSync5(p)) {
     const seeded = mergeConfig({}, generateSourceDefaults());
     try {
       saveRuntimeConfig(seeded);
@@ -1535,7 +1767,13 @@ function loadRuntimeConfig() {
       layers: {
         L1_heuristic: data.layers?.L1_heuristic ?? true,
         L2_logic_rules: data.layers?.L2_logic_rules ?? true,
-        L3_llm_analysis: data.layers?.L3_llm_analysis ?? true
+        L3_llm_analysis: data.layers?.L3_llm_analysis ?? true,
+        // ⚠️ agent_rules_enabled / scenario_rules_enabled 必须一并带上：
+        // isLayerEnabled 的判据是 `layerKey in layers`，键丢了就恒真，
+        // 于是控制台的「agent 规则 / 场景规则」总开关**永远是开**（点了没反应）。
+        // 这两个键本来就写在 seed 里（DEFAULT_LAYERS），只是这里没透传。
+        agent_rules_enabled: data.layers?.agent_rules_enabled ?? true,
+        scenario_rules_enabled: data.layers?.scenario_rules_enabled ?? true
       },
       L1_rules: merged.L1_rules || {},
       L2_rules: merged.L2_rules || {},
@@ -1577,21 +1815,48 @@ function filterEnabledRules(rules, categoryEnabled = true) {
   if (!categoryEnabled) return [];
   return rules.filter((r) => r.enabled !== false);
 }
-function getEnabledL1CommandPatterns(runtime) {
+function _filterRulesByOs(rules, osType) {
+  const accepted = acceptedOsValues(osType);
+  return rules.filter((r) => accepted.includes(String(r.os || "linux").toLowerCase()));
+}
+function _userCustomRules(runtime, layers, requiredKey) {
+  const list = Array.isArray(layers) ? layers : [layers];
+  const out = [];
+  for (const layer of list) {
+    const cat = runtime?.[layer]?.user_custom;
+    const rules = filterEnabledRules(cat?.rules || [], cat?.category_enabled);
+    for (const r of rules) {
+      if (!r[requiredKey]) continue;
+      out.push(r.risk_level ? r : { ...r, risk_level: "high" });
+    }
+  }
+  return out;
+}
+function _mergeUserCustom(primary, runtime, layers, key) {
+  const extra = _userCustomRules(runtime, layers, key);
+  return extra.length > 0 ? [...primary, ...extra] : [...primary];
+}
+function getEnabledL1CommandPatterns(runtime, osType) {
   const cat = runtime.L1_rules?.dangerous_commands || { category_enabled: true, rules: [] };
-  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => ({
+  let rules = filterEnabledRules(cat.rules || [], cat.category_enabled);
+  rules = _mergeUserCustom(rules, runtime, "L1_rules", "pattern");
+  if (osType) rules = _filterRulesByOs(rules, osType);
+  return rules.map((r) => ({
     pattern: r.pattern || "",
     risk_level: r.risk_level || "",
     risk_type: r.risk_type || "",
     reason: r.reason || ""
   }));
 }
-function getEnabledL2SensitivePaths(runtime) {
+function getEnabledL2SensitivePaths(runtime, osType) {
   let cat = runtime.L1_rules?.sensitive_path_access;
   if (!cat || !cat.rules || cat.rules.length === 0) {
     cat = runtime.L2_rules?.sensitive_path_access || { category_enabled: true, rules: [] };
   }
-  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => {
+  let rules = filterEnabledRules(cat.rules || [], cat.category_enabled);
+  rules = _mergeUserCustom(rules, runtime, ["L1_rules", "L2_rules"], "path");
+  if (osType) rules = _filterRulesByOs(rules, osType);
+  return rules.map((r) => {
     const out = { path: r.path || "", risk_level: r.risk_level || "", desc: r.desc || "", deny_mode: r.deny_mode || "deny_write" };
     if (r.credential) out.credential = true;
     if (r.read_only) out.read_only = true;
@@ -1601,13 +1866,24 @@ function getEnabledL2SensitivePaths(runtime) {
 }
 function hasRuntimeConfig() {
   const p = getRuntimeConfigPath();
-  if (!existsSync4(p)) return false;
+  let key;
   try {
-    JSON.parse(readFileSync4(p, "utf-8"));
-    return true;
+    const st = statSync(p);
+    key = `${p}|${st.mtimeMs}|${st.size}`;
   } catch {
     return false;
   }
+  const cached = hasRuntimeConfigCache.get(key);
+  if (cached !== void 0) return cached;
+  let ok = false;
+  try {
+    JSON.parse(readFileSync4(p, "utf-8"));
+    ok = true;
+  } catch {
+    ok = false;
+  }
+  hasRuntimeConfigCache.set(key, ok);
+  return ok;
 }
 function getDisabledL2RulesWithSkipL3() {
   let runtime;
@@ -1672,15 +1948,28 @@ function _syncDenyModeFields(rule) {
   }
 }
 function _l1CommandPatternsToRules() {
-  return DANGEROUS_PATTERNS.map((p) => ({
-    id: _generatePatternId(p.pattern instanceof RegExp ? p.pattern.source : p.pattern),
-    pattern: p.pattern instanceof RegExp ? p.pattern.source : p.pattern,
-    risk_level: p.severity,
-    risk_type: p.riskType,
-    reason: p.description,
-    enabled: true,
-    builtin: true
-  }));
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const osName of ["linux", "windows", "macos", "harmony"]) {
+    for (const p of getDangerousPatternsForOs(osName)) {
+      const src = p.pattern instanceof RegExp ? p.pattern.source : String(p.pattern);
+      const rule = {
+        id: _generatePatternId(src),
+        pattern: src,
+        risk_level: p.severity,
+        risk_type: p.riskType,
+        reason: p.description,
+        enabled: true,
+        builtin: true,
+        os: p.os || "linux"
+      };
+      const fp = _ruleFingerprint(rule);
+      if (seen.has(fp)) continue;
+      seen.add(fp);
+      out.push(rule);
+    }
+  }
+  return out;
 }
 function _l1InjectionKeywordsToRules() {
   return INJECTION_KEYWORDS.map((kw) => ({
@@ -1693,28 +1982,42 @@ function _l1InjectionKeywordsToRules() {
   }));
 }
 function _l2SensitivePathsToRules() {
-  const all = [...ROOT_SENSITIVE_PATHS, ...HOME_SENSITIVE_PATHS, ...CREDENTIAL_PATHS];
-  return all.map((sp) => {
-    const denyMode = _deriveDenyMode({
-      deny_mode: sp.deny_mode,
-      credential: sp.credential,
-      read_only: sp.read_only
-    });
-    const rule = {
-      id: `path_${_slugify(sp.path)}`,
-      path: sp.path,
-      risk_level: sp.riskLevel,
-      desc: sp.desc,
-      deny_mode: denyMode,
-      source_deny_mode: denyMode,
-      skip_l3_on_disabled: true,
-      enabled: true,
-      builtin: true
-    };
-    _syncDenyModeFields(rule);
-    if (sp.dirDelOnly) rule.dir_del_only = true;
-    return rule;
-  });
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const osName of ["linux", "windows", "macos", "harmony"]) {
+    const { root, home, credential } = getSensitivePathsForOsBuiltin(osName);
+    const all = [...root, ...home, ...credential];
+    for (const sp of all) {
+      const os3 = String(sp.os || "linux").toLowerCase();
+      const denyMode = _deriveDenyMode({
+        deny_mode: sp.deny_mode,
+        credential: sp.credential,
+        read_only: sp.read_only
+      });
+      const rule = {
+        // id = path_<平台>_<slug>_<hash8>：平台段消除跨平台同名（.ssh/.aws 各一条），
+        // hash 段消除同平台 slug 撞车（macOS 的 /Library/LaunchAgents 与
+        // Library/LaunchAgents）—— Console 按 id 操作，撞 id 会误改别的规则。
+        id: `path_${os3}_${_slugify(sp.path)}_${_fnv1a32(sp.path)}`,
+        path: sp.path,
+        risk_level: sp.riskLevel,
+        desc: sp.desc,
+        deny_mode: denyMode,
+        source_deny_mode: denyMode,
+        skip_l3_on_disabled: true,
+        enabled: true,
+        builtin: true,
+        os: os3
+      };
+      _syncDenyModeFields(rule);
+      if (sp.dirDelOnly) rule.dir_del_only = true;
+      const fp = _ruleFingerprint(rule);
+      if (seen.has(fp)) continue;
+      seen.add(fp);
+      out.push(rule);
+    }
+  }
+  return out;
 }
 function _l2IntentPatternsToRules() {
   return INTENT_DEVIATION_PATTERNS.map((pat, i) => ({
@@ -1791,8 +2094,8 @@ function _l3SkillsToRules() {
 }
 function _scenarioRulesToDefaults() {
   const out = {};
-  const scenDir = existsSync4(_SCENARIOS_DIR_PROD) ? _SCENARIOS_DIR_PROD : existsSync4(_SCENARIOS_DIR_DEV) ? _SCENARIOS_DIR_DEV : _SCENARIOS_DIR_PROD;
-  if (!existsSync4(scenDir)) return out;
+  const scenDir = existsSync5(_SCENARIOS_DIR_PROD) ? _SCENARIOS_DIR_PROD : existsSync5(_SCENARIOS_DIR_DEV) ? _SCENARIOS_DIR_DEV : _SCENARIOS_DIR_PROD;
+  if (!existsSync5(scenDir)) return out;
   let entries;
   try {
     entries = readdirSync3(scenDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
@@ -1801,7 +2104,7 @@ function _scenarioRulesToDefaults() {
   }
   for (const scenarioId of entries) {
     const rulesFile = join3(scenDir, scenarioId, "rules.json");
-    if (!existsSync4(rulesFile)) continue;
+    if (!existsSync5(rulesFile)) continue;
     let data;
     try {
       data = JSON.parse(readFileSync4(rulesFile, "utf-8"));
@@ -1840,8 +2143,8 @@ function _scenarioRulesToDefaults() {
 }
 function _agentRulesToDefaults() {
   const out = {};
-  const agentsDir = existsSync4(_AGENTS_DIR_PROD) ? _AGENTS_DIR_PROD : existsSync4(_AGENTS_DIR_DEV) ? _AGENTS_DIR_DEV : _AGENTS_DIR_PROD;
-  if (!existsSync4(agentsDir)) return out;
+  const agentsDir = existsSync5(_AGENTS_DIR_PROD) ? _AGENTS_DIR_PROD : existsSync5(_AGENTS_DIR_DEV) ? _AGENTS_DIR_DEV : _AGENTS_DIR_PROD;
+  if (!existsSync5(agentsDir)) return out;
   let entries;
   try {
     entries = readdirSync3(agentsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
@@ -1850,7 +2153,7 @@ function _agentRulesToDefaults() {
   }
   for (const agentId of entries) {
     const rulesFile = join3(agentsDir, agentId, "rules.json");
-    if (!existsSync4(rulesFile)) continue;
+    if (!existsSync5(rulesFile)) continue;
     let data;
     try {
       data = JSON.parse(readFileSync4(rulesFile, "utf-8"));
@@ -1946,7 +2249,7 @@ function _ltlRulesToRuntime() {
   let mc = {};
   for (const dir of cands) {
     const p = join3(dir, "mc_rules.json");
-    if (existsSync4(p)) {
+    if (existsSync5(p)) {
       try {
         mc = JSON.parse(readFileSync4(p, "utf-8")) || {};
       } catch {
@@ -1975,17 +2278,27 @@ function normalizePatternForFingerprint(pattern) {
   return pattern.replace(/\\\//g, "/");
 }
 function _ruleFingerprint(rule) {
+  const osTag = String(rule.os || "linux").toLowerCase();
   if (rule.intent_keywords && rule.intent_keywords.length || rule.dangerous_actions && rule.dangerous_actions.length) {
     return JSON.stringify([
+      osTag,
       [...rule.intent_keywords || []].sort(),
       [...rule.dangerous_actions || []].sort()
     ]);
   }
-  if (rule.path) return JSON.stringify([normalizePatternForFingerprint(rule.path)]);
-  if (rule.pattern) return JSON.stringify([normalizePatternForFingerprint(rule.pattern)]);
-  if (rule.keyword) return JSON.stringify([rule.keyword, rule.lang || ""]);
-  if (rule.value) return JSON.stringify([rule.value]);
-  return JSON.stringify([rule.id || ""]);
+  if (rule.path) return JSON.stringify([osTag, normalizePatternForFingerprint(rule.path)]);
+  if (rule.pattern) return JSON.stringify([osTag, normalizePatternForFingerprint(rule.pattern)]);
+  if (rule.keyword) return JSON.stringify([osTag, rule.keyword, rule.lang || ""]);
+  if (rule.value) return JSON.stringify([osTag, rule.value]);
+  return JSON.stringify([osTag, rule.id || ""]);
+}
+function _applyRuleEnabled(rule, enabled) {
+  rule.enabled = enabled;
+  if (enabled) {
+    delete rule.user_disabled;
+  } else {
+    rule.user_disabled = true;
+  }
 }
 function _mergeRuleCategories(userCfg, srcDefaults, layerKey) {
   const userLayer = userCfg[layerKey] || (userCfg[layerKey] = {});
@@ -2008,13 +2321,14 @@ function _mergeRuleCategories(userCfg, srcDefaults, layerKey) {
       srcFps.add(fp);
       if (userByFp.has(fp)) {
         const existing = userByFp.get(fp);
-        const userEnabled = existing.enabled;
+        const userDisabled = existing.user_disabled === true;
         const userSkipL3 = existing.skip_l3_on_disabled;
         const userDenyMode = existing.deny_mode;
         const userSourceDeny = existing.source_deny_mode;
         Object.keys(existing).forEach((k) => delete existing[k]);
         Object.assign(existing, srcR);
-        existing.enabled = userEnabled;
+        existing.enabled = !userDisabled;
+        if (userDisabled) existing.user_disabled = true;
         if (userSkipL3 !== void 0) existing.skip_l3_on_disabled = userSkipL3;
         if (userDenyMode && userSourceDeny && userDenyMode !== userSourceDeny) {
           existing.deny_mode = userDenyMode;
@@ -2040,7 +2354,19 @@ function _mergeRuleCategories(userCfg, srcDefaults, layerKey) {
   }
   for (const catName of Object.keys(userLayer)) {
     if (catName === "user_custom") continue;
-    if (!(catName in srcLayer)) delete userLayer[catName];
+    if (!(catName in srcLayer)) {
+      const kept = (userLayer[catName].rules || []).filter((r) => r.builtin !== true);
+      if (kept.length) {
+        const uc = userLayer.user_custom || (userLayer.user_custom = {
+          category_enabled: true,
+          category_desc: "",
+          rules: []
+        });
+        const existing = new Set((uc.rules || []).map((r) => r.id));
+        uc.rules = [...uc.rules || [], ...kept.filter((r) => !existing.has(r.id))];
+      }
+      delete userLayer[catName];
+    }
   }
 }
 function _mergeSkillCategories(userCfg, srcDefaults, layerKey) {
@@ -2088,10 +2414,11 @@ function _mergeAgentRules(userCfg, srcDefaults, partition = "agent_rules") {
         srcFps.add(fp);
         if (userByFp.has(fp)) {
           const existing = userByFp.get(fp);
-          const userEnabled = existing.enabled;
+          const userDisabled = existing.user_disabled === true;
           Object.keys(existing).forEach((k) => delete existing[k]);
           Object.assign(existing, srcR);
-          existing.enabled = userEnabled;
+          existing.enabled = !userDisabled;
+          if (userDisabled) existing.user_disabled = true;
         } else {
           userRules.push({ ...srcR, enabled: true });
         }
@@ -2155,17 +2482,23 @@ function _migrateCategoriesAcrossLayers(cfg, srcLayer, dstLayer, catNames) {
     delete src[catName];
   }
 }
-function getEnabledL1InjectionKeywords(runtime) {
+function getEnabledL1InjectionKeywords(runtime, osType) {
   const cat = runtime.L1_rules?.injection_detection || { category_enabled: true, rules: [] };
-  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => ({
+  let rules = filterEnabledRules(cat.rules || [], cat.category_enabled);
+  rules = _mergeUserCustom(rules, runtime, "L1_rules", "keyword");
+  if (osType) rules = _filterRulesByOs(rules, osType);
+  return rules.map((r) => ({
     keyword: r.keyword || "",
     risk_level: r.risk_level || "",
     lang: r.lang || "en"
   }));
 }
-function getEnabledL2IntentPatterns(runtime) {
+function getEnabledL2IntentPatterns(runtime, osType) {
   const cat = runtime.L2_rules?.intent_consistency || { category_enabled: true, rules: [] };
-  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => ({
+  let rules = filterEnabledRules(cat.rules || [], cat.category_enabled);
+  rules = _mergeUserCustom(rules, runtime, "L2_rules", "intent_keywords");
+  if (osType) rules = _filterRulesByOs(rules, osType);
+  return rules.map((r) => ({
     intent_keywords: r.intent_keywords || [],
     dangerous_actions: r.dangerous_actions || [],
     reason: r.reason || ""
@@ -2173,11 +2506,13 @@ function getEnabledL2IntentPatterns(runtime) {
 }
 function getEnabledL2PasswordPatterns(runtime) {
   const cat = runtime.L2_rules?.password_modify_consent || { category_enabled: true, rules: [] };
-  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => r.pattern || "");
+  const rules = _mergeUserCustom(filterEnabledRules(cat.rules || [], cat.category_enabled), runtime, "L2_rules", "pattern");
+  return rules.map((r) => r.pattern || "");
 }
 function getEnabledL2UserDeletionPatterns(runtime) {
   const cat = runtime.L2_rules?.user_deletion_consent || { category_enabled: true, rules: [] };
-  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => r.pattern || "");
+  const rules = _mergeUserCustom(filterEnabledRules(cat.rules || [], cat.category_enabled), runtime, "L2_rules", "pattern");
+  return rules.map((r) => r.pattern || "");
 }
 function isL2CategoryEnabled(runtime, categoryKey) {
   const cat = runtime.L2_rules?.[categoryKey];
@@ -2196,45 +2531,126 @@ function getDisabledSkillIds(runtime) {
   }
   return disabled;
 }
-function getEnabledL1CommandPatternsOrDefault(runtime) {
-  const enabled = getEnabledL1CommandPatterns(runtime);
-  if (enabled.length) return enabled;
-  if (!hasRuntimeConfig()) return _l1CommandPatternsToRules();
-  return [];
-}
-function getEnabledL1InjectionKeywordsOrDefault(runtime) {
-  const enabled = getEnabledL1InjectionKeywords(runtime);
-  if (enabled.length) return enabled;
-  if (!hasRuntimeConfig()) return _l1InjectionKeywordsToRules();
-  return [];
-}
-function getEnabledL2SensitivePathsOrDefault(runtime) {
-  const enabled = getEnabledL2SensitivePaths(runtime);
-  if (enabled.length) return enabled;
-  if (!hasRuntimeConfig()) return _l2SensitivePathsToRules();
-  return [];
-}
-function getEnabledL2IntentPatternsOrDefault(runtime) {
-  const enabled = getEnabledL2IntentPatterns(runtime);
-  if (enabled.length) return enabled;
-  if (!hasRuntimeConfig()) return _l2IntentPatternsToRules();
-  return [];
-}
-function getEnabledL2PasswordPatternsOrDefault(runtime) {
-  const enabled = getEnabledL2PasswordPatterns(runtime);
-  if (enabled.length) return enabled;
-  if (!hasRuntimeConfig()) {
-    return PASSWORD_MODIFY_PATTERNS.map((p) => p.source);
-  }
-  return [];
-}
-function getEnabledL2UserDeletionPatternsOrDefault(runtime) {
-  const enabled = getEnabledL2UserDeletionPatterns(runtime);
-  if (enabled.length) return enabled;
-  if (!hasRuntimeConfig()) {
-    return USER_DELETION_PATTERNS.map((p) => p.source);
-  }
-  return [];
+function _filterDefaultsByOs(rules, osType) {
+  const accepted = acceptedOsValues(osType);
+  return rules.filter((r) => !r.os || accepted.includes(String(r.os).toLowerCase()));
+}
+function _hasRulesForOs(rules, osType) {
+  return _filterRulesByOs(rules || [], osType || "linux").length > 0;
+}
+function getEnabledL1CommandPatternsOrDefault(runtime, osType) {
+  const cat = runtime.L1_rules?.dangerous_commands;
+  if (_hasRulesForOs(cat?.rules, osType)) {
+    return getEnabledL1CommandPatterns(runtime, osType);
+  }
+  return _mergeUserCustom(_filterDefaultsByOs(_l1CommandPatternsToRules(), osType), runtime, "L1_rules", "pattern");
+}
+function getEnabledL1InjectionKeywordsOrDefault(runtime, osType) {
+  const cat = runtime.L1_rules?.injection_detection;
+  if (_hasRulesForOs(cat?.rules, osType)) {
+    return getEnabledL1InjectionKeywords(runtime, osType);
+  }
+  return _mergeUserCustom(_l1InjectionKeywordsToRules(), runtime, "L1_rules", "keyword");
+}
+function getEnabledL2SensitivePathsOrDefault(runtime, osType) {
+  const spCat = _sensitivePathCategoryOf(runtime);
+  if (_hasRulesForOs(spCat?.rules, osType)) {
+    return getEnabledL2SensitivePaths(runtime, osType);
+  }
+  return _mergeUserCustom(_filterDefaultsByOs(_l2SensitivePathsToRules(), osType), runtime, ["L1_rules", "L2_rules"], "path");
+}
+function getEnabledL2IntentPatternsOrDefault(runtime, osType) {
+  const cat = runtime.L2_rules?.intent_consistency;
+  if (_hasRulesForOs(cat?.rules, osType)) {
+    return getEnabledL2IntentPatterns(runtime, osType);
+  }
+  return _mergeUserCustom(_filterDefaultsByOs(_l2IntentPatternsToRules(), osType), runtime, "L2_rules", "intent_keywords");
+}
+function getEnabledL2PasswordPatternsOrDefault(runtime, osType) {
+  const cat = runtime.L2_rules?.password_modify_consent;
+  if (_hasRulesForOs(cat?.rules, osType)) {
+    return getEnabledL2PasswordPatterns(runtime);
+  }
+  return PASSWORD_MODIFY_PATTERNS.map((p) => p.source);
+}
+function getEnabledL2UserDeletionPatternsOrDefault(runtime, osType) {
+  const cat = runtime.L2_rules?.user_deletion_consent;
+  if (_hasRulesForOs(cat?.rules, osType)) {
+    return getEnabledL2UserDeletionPatterns(runtime);
+  }
+  return USER_DELETION_PATTERNS.map((p) => p.source);
+}
+function _effective(osType, key, compute) {
+  const runtime = loadRuntimeConfig();
+  let bucket = _effectiveCache.get(runtime);
+  if (!bucket) {
+    bucket = /* @__PURE__ */ new Map();
+    _effectiveCache.set(runtime, bucket);
+  }
+  const k = `${key}|${osType || ""}`;
+  if (bucket.has(k)) return bucket.get(k);
+  const value = compute(runtime);
+  bucket.set(k, value);
+  return value;
+}
+function effectiveDangerousPatterns(osType) {
+  return _effective(osType, "danger", (rt) => {
+    const rules = getEnabledL1CommandPatternsOrDefault(rt, osType);
+    return rules.filter((r) => r.pattern).map((r) => ({
+      pattern: new RegExp(String(r.pattern), "i"),
+      severity: String(r.risk_level || "medium"),
+      riskType: String(r.risk_type || ""),
+      description: String(r.reason || ""),
+      os: String(r.os || "linux").toLowerCase()
+    }));
+  });
+}
+function effectiveInjectionKeywords(osType) {
+  return _effective(osType, "injection", (rt) => {
+    const rules = getEnabledL1InjectionKeywordsOrDefault(rt, osType);
+    return rules.map((r) => ({
+      keyword: String(r.keyword || ""),
+      riskLevel: String(r.risk_level || ""),
+      lang: String(r.lang || "en")
+    })).filter((r) => r.keyword);
+  });
+}
+function effectiveSensitivePaths(osType) {
+  return _effective(osType, "sensitive", (rt) => {
+    const rules = getEnabledL2SensitivePathsOrDefault(rt, osType);
+    return rules.filter((r) => r.path).map((r) => ({
+      path: String(r.path),
+      riskLevel: String(r.risk_level || "high"),
+      desc: String(r.desc || ""),
+      credential: r.credential === true ? true : void 0,
+      readOnly: r.read_only === true ? true : void 0,
+      dirDelOnly: r.dir_del_only === true ? true : void 0,
+      denyMode: String(r.deny_mode || ""),
+      os: String(r.os || "linux").toLowerCase()
+    }));
+  });
+}
+function effectiveIntentPatterns(osType) {
+  return _effective(osType, "intent", (rt) => {
+    const rules = getEnabledL2IntentPatternsOrDefault(rt, osType);
+    return rules.map((r) => ({
+      intentKeywords: r.intent_keywords || [],
+      dangerousActions: r.dangerous_actions || [],
+      reason: String(r.reason || ""),
+      os: String(r.os || "linux").toLowerCase()
+    }));
+  });
+}
+function effectivePasswordPatterns(osType) {
+  return _effective(osType, "password", (rt) => getEnabledL2PasswordPatternsOrDefault(rt, osType).map((p) => new RegExp(p, "i")));
+}
+function effectiveUserDeletionPatterns(osType) {
+  return _effective(osType, "userdel", (rt) => getEnabledL2UserDeletionPatternsOrDefault(rt, osType).map((p) => new RegExp(p, "i")));
+}
+function _sensitivePathCategoryOf(runtime) {
+  const l1 = runtime.L1_rules?.sensitive_path_access;
+  if (l1 && (l1.rules || []).length > 0) return l1;
+  return runtime.L2_rules?.sensitive_path_access;
 }
 function _validateSkillId(skillId) {
   if (!skillId || !SKILL_ID_RE.test(skillId)) {
@@ -2251,7 +2667,7 @@ function updateRuleEnabled(layer, category, ruleId, enabled) {
   const runtime = loadRuntimeConfig();
   for (const r of runtime[layer]?.[category]?.rules || []) {
     if (r.id === ruleId) {
-      r.enabled = enabled;
+      _applyRuleEnabled(r, enabled);
       break;
     }
   }
@@ -2321,7 +2737,7 @@ function deleteCustomRule(layer, category, ruleId) {
 function addCustomSkill(skillId, category, keywords, content) {
   _validateSkillId(skillId);
   const runtime = loadRuntimeConfig();
-  const skillsDir = join3(RUNTIME_CONFIG_DIR, "agent_moss_skills");
+  const skillsDir = join3(getRuntimeConfigDir(), "agent_moss_skills");
   try {
     mkdirSync(skillsDir, { recursive: true });
   } catch {
@@ -2341,9 +2757,9 @@ function deleteCustomSkill(skillId, category) {
   if (idx >= 0) {
     if (skills[idx].builtin) return null;
     skills.splice(idx, 1);
-    const skillPath = join3(RUNTIME_CONFIG_DIR, "agent_moss_skills", `${skillId}.md`);
+    const skillPath = join3(getRuntimeConfigDir(), "agent_moss_skills", `${skillId}.md`);
     try {
-      if (existsSync4(skillPath)) unlinkSync(skillPath);
+      if (existsSync5(skillPath)) unlinkSync(skillPath);
     } catch {
     }
     saveRuntimeConfig(runtime);
@@ -2422,7 +2838,7 @@ function updateAgentRuleEnabled(agentId, category, ruleFp, enabled) {
     const targetFp = _ruleFingerprint(ruleFp);
     for (const r of cat.rules || []) {
       if (_ruleFingerprint(r) === targetFp) {
-        r.enabled = enabled;
+        _applyRuleEnabled(r, enabled);
         break;
       }
     }
@@ -2457,130 +2873,412 @@ function updateAgentCategoryEnabled(agentId, category, enabled) {
   saveRuntimeConfig(runtime);
   return runtime;
 }
-function getScenarioRules(runtime) {
-  return runtime.scenario_rules || {};
+function getScenarioRules(runtime) {
+  return runtime.scenario_rules || {};
+}
+function getEnabledScenarioExtensions(runtime, scenarioId) {
+  const scenData = runtime.scenario_rules?.[scenarioId];
+  if (!scenData) return null;
+  const cmdPatterns = _agentCategoryEnabledRules(scenData.extra_command_patterns).filter((r) => r.pattern).map((r) => ({
+    pattern: r.pattern,
+    risk_level: r.risk_level || "",
+    risk_type: r.risk_type || "",
+    reason: r.reason || ""
+  }));
+  const injKeywords = _agentCategoryEnabledRules(scenData.extra_injection_keywords).filter((r) => r.keyword).map((r) => ({
+    keyword: r.keyword,
+    risk_level: r.risk_level || "",
+    lang: r.lang || "en"
+  }));
+  const sensitivePaths = _agentCategoryEnabledRules(scenData.extra_sensitive_paths).filter((r) => r.path).map((r) => ({
+    path: r.path,
+    risk_level: r.risk_level || "",
+    desc: r.desc || "",
+    credential: r.credential,
+    read_only: r.read_only,
+    deny_mode: r.deny_mode
+  }));
+  return {
+    agent_id: scenarioId,
+    description: "",
+    extra_command_patterns: cmdPatterns,
+    extra_injection_keywords: injKeywords,
+    extra_sensitive_paths: sensitivePaths,
+    builtin_safe_skills: [],
+    builtin_safe_action_types: [],
+    extra_skills: []
+  };
+}
+function updateScenarioRuleEnabled(scenarioId, category, ruleFp, enabled) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.scenario_rules?.[scenarioId]?.[category];
+  if (cat) {
+    const targetFp = _ruleFingerprint(ruleFp);
+    for (const r of cat.rules || []) {
+      if (_ruleFingerprint(r) === targetFp) {
+        _applyRuleEnabled(r, enabled);
+        break;
+      }
+    }
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function addScenarioRule(scenarioId, category, rule) {
+  const runtime = loadRuntimeConfig();
+  if (!runtime.scenario_rules) runtime.scenario_rules = {};
+  if (!runtime.scenario_rules[scenarioId]) runtime.scenario_rules[scenarioId] = {};
+  const cats = runtime.scenario_rules[scenarioId];
+  if (!cats[category]) cats[category] = { category_enabled: true, category_desc: "", rules: [] };
+  (cats[category].rules || (cats[category].rules = [])).push({ ...rule, enabled: true, builtin: false });
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function deleteScenarioRule(scenarioId, category, ruleFp) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.scenario_rules?.[scenarioId]?.[category];
+  if (cat) {
+    const targetFp = _ruleFingerprint(ruleFp);
+    cat.rules = (cat.rules || []).filter((r) => _ruleFingerprint(r) !== targetFp);
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function updateScenarioCategoryEnabled(scenarioId, category, enabled) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.scenario_rules?.[scenarioId]?.[category];
+  if (cat) cat.category_enabled = enabled;
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DEFAULT_LAYERS, DENY_MODE_LABELS, runtimeConfigCache, hasRuntimeConfigCache, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, _effectiveCache, SKILL_ID_RE;
+var init_runtime_config = __esm({
+  "src/infra/runtime-config.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_paths();
+    init_heuristic();
+    init_logic_rules();
+    init_skill_loader();
+    init_runtime_config_bridge();
+    __dirname4 = dirname3(fileURLToPath4(import.meta.url));
+    ENV_RUNTIME_CONFIG_PATH = "AGENT_MOSS_RUNTIME_CONFIG_PATH";
+    RUNTIME_CONFIG_DIR = runtimeDir();
+    RUNTIME_CONFIG_PATH = join3(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
+    LAYER_DISABLE_ENV = {
+      L1_heuristic: "AGENT_MOSS_DISABLE_HEURISTIC",
+      L2_logic_rules: "AGENT_MOSS_DISABLE_LOGIC_RULES",
+      L3_llm_analysis: "AGENT_MOSS_DISABLE_LLM"
+    };
+    DEFAULT_LAYERS = {
+      L1_heuristic: true,
+      L2_logic_rules: true,
+      L3_llm_analysis: true,
+      agent_rules_enabled: true,
+      scenario_rules_enabled: true
+    };
+    DENY_MODE_LABELS = {
+      deny_write: "\u4EC5\u62E6\u622A\u5199\u5165",
+      deny_read: "\u4EC5\u62E6\u622A\u8BFB\u53D6",
+      deny_both: "\u8BFB\u5199\u5747\u62E6\u622A"
+    };
+    runtimeConfigCache = null;
+    hasRuntimeConfigCache = /* @__PURE__ */ new Map();
+    _AGENTS_DIR_PROD = join3(__dirname4, "agents");
+    _AGENTS_DIR_DEV = join3(__dirname4, "..", "..", "..", "agent_moss", "agents");
+    _SCENARIOS_DIR_PROD = join3(__dirname4, "scenarios");
+    _SCENARIOS_DIR_DEV = join3(__dirname4, "..", "..", "..", "agent_moss", "scenarios");
+    _effectiveCache = /* @__PURE__ */ new WeakMap();
+    SKILL_ID_RE = /^[A-Za-z0-9_-]+$/;
+    registerRuntimeConfigBridge({
+      hasRuntimeConfig,
+      loadRuntimeConfig,
+      effectiveDangerousPatterns,
+      effectiveInjectionKeywords,
+      effectiveSensitivePaths,
+      effectiveIntentPatterns,
+      effectivePasswordPatterns,
+      effectiveUserDeletionPatterns,
+      disabledSkillIds: () => getDisabledSkillIds(loadRuntimeConfig())
+    });
+  }
+});
+
+// src/config.ts
+var config_exports = {};
+__export(config_exports, {
+  detectProvider: () => detectProvider,
+  getCustomRules: () => getCustomRules,
+  getLLMConfig: () => getLLMConfig,
+  getLLMFailMode: () => getLLMFailMode,
+  getProviderHeaders: () => getProviderHeaders,
+  getRetryConfig: () => getRetryConfig,
+  getTimeoutConfig: () => getTimeoutConfig,
+  isBrainEnabled: () => isBrainEnabled,
+  isFormalObserveMode: () => isFormalObserveMode,
+  isHeuristicEnabled: () => isHeuristicEnabled,
+  isLLMAvailable: () => isLLMAvailable,
+  isLogicRulesEnabled: () => isLogicRulesEnabled,
+  probeLLMConnection: () => probeLLMConnection,
+  updateLLMConfig: () => updateLLMConfig
+});
+import fs2 from "fs";
+import path2 from "path";
+import { fileURLToPath as fileURLToPath5 } from "url";
+function loadConfigFile(filePath) {
+  try {
+    const raw = fs2.readFileSync(filePath, "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function resolveConfigPath() {
+  const envPath = process.env.AGENT_MOSS_CONFIG_PATH;
+  if (envPath) return envPath;
+  const userConfig = path2.join(getConfigDir(), "config.json");
+  if (fs2.existsSync(userConfig)) return userConfig;
+  const defaultCandidates = [
+    path2.join(__dirname, "config.json.example"),
+    path2.join(__dirname, "..", "..", "agent_moss", "infra", "config.json.example")
+  ];
+  const defaultConfig = defaultCandidates.find((p) => fs2.existsSync(p));
+  if (defaultConfig) {
+    const configDir = path2.dirname(userConfig);
+    fs2.mkdirSync(configDir, { recursive: true });
+    const pkgConfig = loadConfigFile(defaultConfig);
+    const safeConfig = pkgConfig ? { ...pkgConfig, llm: { ...pkgConfig.llm, api_key: "" } } : {};
+    fs2.writeFileSync(userConfig, JSON.stringify(safeConfig, null, 4), "utf-8");
+    console.log(`[AgentMoss] \u5DF2\u521B\u5EFA\u7528\u6237\u914D\u7F6E\u6587\u4EF6: ${userConfig}`);
+    console.log(`[AgentMoss] \u8BF7\u7F16\u8F91\u8BE5\u6587\u4EF6\u914D\u7F6E\u4F60\u7684 LLM API Key`);
+  }
+  return userConfig;
+}
+function loadLLMConfigFromFile(configPath) {
+  const data = loadConfigFile(configPath);
+  if (!data?.llm) return {};
+  const llm = data.llm;
+  return {
+    provider: llm.provider || "",
+    baseUrl: llm.base_url || "",
+    apiKey: llm.api_key || "",
+    model: llm.model || "",
+    temperature: llm.temperature ?? 0.1,
+    maxTokens: llm.max_tokens ?? 4096,
+    timeout: llm.timeout ?? 40
+  };
+}
+function loadTimeoutRetryFromFile(configPath) {
+  const data = loadConfigFile(configPath);
+  const t = data?.timeout ?? {};
+  const r = data?.retry ?? {};
+  return {
+    timeout: {
+      totalTimeout: Number(t.total_timeout ?? 90),
+      prompt1Timeout: Number(t.prompt1_timeout ?? 40),
+      prompt2Timeout: Number(t.prompt2_timeout ?? 20),
+      stepInterval: Number(t.step_interval ?? 0)
+    },
+    retry: {
+      maxRetries: Number(r.max_retries ?? 2),
+      retryInterval: Number(r.retry_interval ?? 2)
+    }
+  };
+}
+function getTimeoutConfig() {
+  return timeoutConfig;
+}
+function getRetryConfig() {
+  return retryConfig;
+}
+function wildcardToRegExp(pattern) {
+  return pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/\\\*/g, ".*");
+}
+function loadCustomRules() {
+  const rules = [];
+  try {
+    const raw = process.env.AGENT_MOSS_CUSTOM_RULES;
+    if (raw) {
+      const parsed = JSON.parse(raw);
+      if (Array.isArray(parsed)) {
+        for (const r of parsed) {
+          if (r && r.pattern && r.action) rules.push({ pattern: r.pattern, action: r.action, severity: r.severity || "high" });
+        }
+      }
+    }
+  } catch {
+  }
+  for (const rulesPath of USER_RULES_PATHS) {
+    try {
+      if (!fs2.existsSync(rulesPath)) continue;
+      const data = JSON.parse(fs2.readFileSync(rulesPath, "utf-8"));
+      const actions = Array.isArray(data?.sensitive_actions) ? data.sensitive_actions : [];
+      for (const r of actions) {
+        const p = r?.pattern;
+        if (!p) continue;
+        rules.push({ pattern: wildcardToRegExp(p), action: "Deny", severity: "high" });
+      }
+      break;
+    } catch {
+    }
+  }
+  return rules;
+}
+function getLLMConfig() {
+  return llmConfig;
+}
+function updateLLMConfig(partial) {
+  llmConfig = { ...llmConfig, ...partial };
+}
+function getCustomRules() {
+  return customRules;
+}
+function isLLMAvailable() {
+  if (process.env.AGENT_MOSS_DISABLE_LLM === "1") return false;
+  if (!layerEnabledOrDefault("L3_llm_analysis")) return false;
+  return llmConfig.apiKey.length > 0;
+}
+async function probeLLMConnection(timeoutMs = 3e4) {
+  if (!isLLMAvailable()) return false;
+  const OpenAI3 = (await import("openai")).default;
+  const config = getLLMConfig();
+  const provider = detectProvider(config.baseUrl, config.provider);
+  const extraHeaders = getProviderHeaders(provider);
+  const client = new OpenAI3({
+    baseURL: config.baseUrl,
+    apiKey: config.apiKey,
+    timeout: timeoutMs,
+    maxRetries: 0,
+    defaultHeaders: Object.keys(extraHeaders).length > 0 ? extraHeaders : void 0
+  });
+  try {
+    const resp = await client.chat.completions.create({
+      model: config.model,
+      messages: [{ role: "user", content: "ping" }],
+      max_tokens: 1
+    });
+    return !!(resp && resp.choices && resp.choices[0]);
+  } catch {
+    return false;
+  }
+}
+function getLLMFailMode() {
+  const val = (process.env.AGENT_MOSS_LLM_FAIL_MODE || "fail_open").toLowerCase();
+  return val === "fail_closed" ? "fail_closed" : "fail_open";
+}
+function detectProvider(baseUrl, providerHint = "") {
+  if (providerHint) {
+    const hint = providerHint.toLowerCase();
+    if (["claude", "anthropic"].includes(hint)) return "anthropic";
+    if (["google", "gemini"].includes(hint)) return "gemini";
+    if (["zai-coding-plan", "zhipu-coding-plan", "zhipuai-coding-plan"].includes(hint)) return "zai-coding-plan";
+    if (["zai", "z-ai", "z.ai", "zai-cn", "zai-china", "zhipu", "glm-cn", "bigmodel"].includes(hint)) return "zhipu";
+    if (["xai", "xai-grok"].includes(hint)) return "xai";
+    if (["minimax", "minimax-openai"].includes(hint)) return "minimax";
+    if (["minimax-anthropic"].includes(hint)) return "minimax-anthropic";
+    if (["other", "custom", "local"].includes(hint)) return "openai-compatible";
+    return hint;
+  }
+  const url = baseUrl.toLowerCase();
+  if (url.includes("openrouter.ai")) return "openrouter";
+  if (url.includes("api.openai.com")) return "openai";
+  if (url.includes("anthropic.com") || url.includes("api.anthropic.com")) return "anthropic";
+  if (url.includes("generativelanguage.googleapis.com") || url.includes("gemini")) return "gemini";
+  if (url.includes("api.deepseek.com")) return "deepseek";
+  if (url.includes("api.groq.com")) return "groq";
+  if (url.includes("api.mistral.ai")) return "mistral";
+  if (url.includes("api.together.xyz")) return "together";
+  if (url.includes("api.x.ai")) return "xai";
+  if (url.includes("api.minimaxi.com")) return "minimax";
+  if (url.includes("api-ai.gitcode.com")) return "gitcode";
+  if (url.includes("api.z.ai")) return "zai-coding-plan";
+  if (url.includes("open.bigmodel.cn") || url.includes("bigmodel")) return "zhipu";
+  if (url.includes(":11434")) return "ollama";
+  return "openai-compatible";
+}
+function getProviderHeaders(provider) {
+  return PROVIDER_HEADERS[provider] || {};
 }
-function getEnabledScenarioExtensions(runtime, scenarioId) {
-  const scenData = runtime.scenario_rules?.[scenarioId];
-  if (!scenData) return null;
-  const cmdPatterns = _agentCategoryEnabledRules(scenData.extra_command_patterns).filter((r) => r.pattern).map((r) => ({
-    pattern: r.pattern,
-    risk_level: r.risk_level || "",
-    risk_type: r.risk_type || "",
-    reason: r.reason || ""
-  }));
-  const injKeywords = _agentCategoryEnabledRules(scenData.extra_injection_keywords).filter((r) => r.keyword).map((r) => ({
-    keyword: r.keyword,
-    risk_level: r.risk_level || "",
-    lang: r.lang || "en"
-  }));
-  const sensitivePaths = _agentCategoryEnabledRules(scenData.extra_sensitive_paths).filter((r) => r.path).map((r) => ({
-    path: r.path,
-    risk_level: r.risk_level || "",
-    desc: r.desc || "",
-    credential: r.credential,
-    read_only: r.read_only,
-    deny_mode: r.deny_mode
-  }));
-  return {
-    agent_id: scenarioId,
-    description: "",
-    extra_command_patterns: cmdPatterns,
-    extra_injection_keywords: injKeywords,
-    extra_sensitive_paths: sensitivePaths,
-    builtin_safe_skills: [],
-    builtin_safe_action_types: [],
-    extra_skills: []
-  };
+function isHeuristicEnabled() {
+  if (process.env.AGENT_MOSS_DISABLE_HEURISTIC === "1") return false;
+  return layerEnabledOrDefault("L1_heuristic");
 }
-function updateScenarioRuleEnabled(scenarioId, category, ruleFp, enabled) {
-  const runtime = loadRuntimeConfig();
-  const cat = runtime.scenario_rules?.[scenarioId]?.[category];
-  if (cat) {
-    const targetFp = _ruleFingerprint(ruleFp);
-    for (const r of cat.rules || []) {
-      if (_ruleFingerprint(r) === targetFp) {
-        r.enabled = enabled;
-        break;
-      }
-    }
+function layerEnabledOrDefault(key) {
+  try {
+    return isLayerEnabled(key);
+  } catch {
+    return true;
   }
-  saveRuntimeConfig(runtime);
-  return runtime;
 }
-function addScenarioRule(scenarioId, category, rule) {
-  const runtime = loadRuntimeConfig();
-  if (!runtime.scenario_rules) runtime.scenario_rules = {};
-  if (!runtime.scenario_rules[scenarioId]) runtime.scenario_rules[scenarioId] = {};
-  const cats = runtime.scenario_rules[scenarioId];
-  if (!cats[category]) cats[category] = { category_enabled: true, category_desc: "", rules: [] };
-  (cats[category].rules || (cats[category].rules = [])).push({ ...rule, enabled: true, builtin: false });
-  saveRuntimeConfig(runtime);
-  return runtime;
+function isBrainEnabled() {
+  return process.env.AGENT_MOSS_BRAIN_ENABLED === "1";
 }
-function deleteScenarioRule(scenarioId, category, ruleFp) {
-  const runtime = loadRuntimeConfig();
-  const cat = runtime.scenario_rules?.[scenarioId]?.[category];
-  if (cat) {
-    const targetFp = _ruleFingerprint(ruleFp);
-    cat.rules = (cat.rules || []).filter((r) => _ruleFingerprint(r) !== targetFp);
-  }
-  saveRuntimeConfig(runtime);
-  return runtime;
+function isLogicRulesEnabled() {
+  if (process.env.AGENT_MOSS_DISABLE_LOGIC_RULES === "1") return false;
+  return layerEnabledOrDefault("L2_logic_rules");
 }
-function updateScenarioCategoryEnabled(scenarioId, category, enabled) {
-  const runtime = loadRuntimeConfig();
-  const cat = runtime.scenario_rules?.[scenarioId]?.[category];
-  if (cat) cat.category_enabled = enabled;
-  saveRuntimeConfig(runtime);
-  return runtime;
+function isFormalObserveMode() {
+  return process.env.AGENT_MOSS_FORMAL_OBSERVE === "1";
 }
-var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DEFAULT_LAYERS, DENY_MODE_LABELS, runtimeConfigCache, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, SKILL_ID_RE;
-var init_runtime_config = __esm({
-  "src/infra/runtime-config.ts"() {
+var timeoutConfig, retryConfig, llmConfig, __configModuleDir, USER_RULES_PATHS, customRules, PROVIDER_HEADERS;
+var init_config = __esm({
+  "src/config.ts"() {
     "use strict";
     init_esm_shims();
     init_paths();
-    init_heuristic();
-    init_logic_rules();
-    init_skill_loader();
-    __dirname4 = dirname3(fileURLToPath5(import.meta.url));
-    ENV_RUNTIME_CONFIG_PATH = "AGENT_MOSS_RUNTIME_CONFIG_PATH";
-    RUNTIME_CONFIG_DIR = runtimeDir();
-    RUNTIME_CONFIG_PATH = join3(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
-    LAYER_DISABLE_ENV = {
-      L1_heuristic: "AGENT_MOSS_DISABLE_HEURISTIC",
-      L2_logic_rules: "AGENT_MOSS_DISABLE_LOGIC_RULES",
-      L3_llm_analysis: "AGENT_MOSS_DISABLE_LLM"
-    };
-    DEFAULT_LAYERS = {
-      L1_heuristic: true,
-      L2_logic_rules: true,
-      L3_llm_analysis: true,
-      agent_rules_enabled: true,
-      scenario_rules_enabled: true
-    };
-    DENY_MODE_LABELS = {
-      deny_write: "\u4EC5\u62E6\u622A\u5199\u5165",
-      deny_read: "\u4EC5\u62E6\u622A\u8BFB\u53D6",
-      deny_both: "\u8BFB\u5199\u5747\u62E6\u622A"
+    init_runtime_config();
+    llmConfig = (() => {
+      const configPath = resolveConfigPath();
+      const fileConfig = fs2.existsSync(configPath) ? loadLLMConfigFromFile(configPath) : {};
+      const tr = loadTimeoutRetryFromFile(configPath);
+      timeoutConfig = tr.timeout;
+      retryConfig = tr.retry;
+      return {
+        provider: process.env.AGENT_MOSS_LLM_PROVIDER || fileConfig.provider || "openai",
+        baseUrl: process.env.AGENT_MOSS_LLM_BASE_URL || fileConfig.baseUrl || "https://api.openai.com/v1",
+        apiKey: process.env.AGENT_MOSS_LLM_API_KEY || process.env.OPENAI_API_KEY || fileConfig.apiKey || "",
+        model: process.env.AGENT_MOSS_LLM_MODEL || fileConfig.model || "gpt-4o",
+        temperature: parseFloat(process.env.AGENT_MOSS_LLM_TEMPERATURE || String(fileConfig.temperature ?? "0.1")),
+        maxTokens: parseInt(process.env.AGENT_MOSS_LLM_MAX_TOKENS || String(fileConfig.maxTokens ?? "4096"), 10),
+        // 优先用 env，否则用 timeout 块的 prompt1Timeout（对齐 py）
+        timeout: parseInt(process.env.AGENT_MOSS_LLM_TIMEOUT || String(fileConfig.timeout ?? String(tr.timeout.prompt1Timeout)), 10)
+      };
+    })();
+    __configModuleDir = (() => {
+      try {
+        return path2.dirname(fileURLToPath5(import.meta.url));
+      } catch {
+        return typeof __dirname !== "undefined" ? __dirname : process.cwd();
+      }
+    })();
+    USER_RULES_PATHS = [
+      path2.join(__configModuleDir, "rules", "user_rules.json"),
+      // 源在 ts/src/rules（一般不存在）
+      path2.join(__configModuleDir, "..", "rules", "user_rules.json"),
+      // dist: dist/engine/../rules = dist/rules ✅
+      path2.join(__configModuleDir, "..", "..", "agent_moss", "rules", "user_rules.json")
+      // dev src: ts/src/../../agent_moss
+    ];
+    customRules = loadCustomRules();
+    PROVIDER_HEADERS = {
+      "openrouter": {
+        "HTTP-Referer": "shturl.cc/LlVD5pyWViHjM",
+        "X-OpenRouter-Title": "AgentMoss"
+      },
+      "xai": {
+        "HTTP-Referer": "shturl.cc/LlVD5pyWViHjM"
+      }
     };
-    runtimeConfigCache = null;
-    _AGENTS_DIR_PROD = join3(__dirname4, "agents");
-    _AGENTS_DIR_DEV = join3(__dirname4, "..", "..", "..", "agent_moss", "agents");
-    _SCENARIOS_DIR_PROD = join3(__dirname4, "scenarios");
-    _SCENARIOS_DIR_DEV = join3(__dirname4, "..", "..", "..", "agent_moss", "scenarios");
-    SKILL_ID_RE = /^[A-Za-z0-9_-]+$/;
   }
 });
 
 // src/agents/index.ts
-import { readFileSync as readFileSync5, existsSync as existsSync5 } from "fs";
+import { readFileSync as readFileSync5, existsSync as existsSync6 } from "fs";
 import { resolve as resolve4, dirname as dirname4 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 function resolveAgentsDir() {
-  if (existsSync5(AGENTS_DIR_PROD)) return AGENTS_DIR_PROD;
-  if (existsSync5(AGENTS_DIR_DEV_FALLBACK)) return AGENTS_DIR_DEV_FALLBACK;
+  if (existsSync6(AGENTS_DIR_PROD)) return AGENTS_DIR_PROD;
+  if (existsSync6(AGENTS_DIR_DEV_FALLBACK)) return AGENTS_DIR_DEV_FALLBACK;
   return AGENTS_DIR_PROD;
 }
 function getAgentExtensions(agentId) {
@@ -2588,16 +3286,15 @@ function getAgentExtensions(agentId) {
   if (cache.has(agentId)) return cache.get(agentId) ?? null;
   let ext = null;
   try {
-    const { hasRuntimeConfig: hasRuntimeConfig2, loadRuntimeConfig: loadRuntimeConfig2, getEnabledAgentExtensions: getEnabledAgentExtensions2 } = (init_runtime_config(), __toCommonJS(runtime_config_exports));
-    if (hasRuntimeConfig2()) {
-      ext = getEnabledAgentExtensions2(loadRuntimeConfig2(), agentId);
+    if (hasRuntimeConfig()) {
+      ext = getEnabledAgentExtensions(loadRuntimeConfig(), agentId);
     }
   } catch {
   }
   if (ext === null) {
     const agentsDir = resolveAgentsDir();
     const rulesFile = resolve4(agentsDir, agentId, "rules.json");
-    if (!existsSync5(rulesFile)) {
+    if (!existsSync6(rulesFile)) {
       cache.set(agentId, null);
       return null;
     }
@@ -2616,7 +3313,7 @@ function getAgentExtensions(agentId) {
     }
   }
   cache.set(agentId, ext);
-  console.log(
+  console.error(
     `[AgentMoss agents] \u52A0\u8F7D agent ${agentId} \u5B9A\u5236\u89C4\u5219: ${ext.extra_command_patterns?.length ?? 0} cmd patterns, ${ext.extra_injection_keywords?.length ?? 0} injection keywords, ${ext.extra_sensitive_paths?.length ?? 0} sensitive paths, ${ext.builtin_safe_skills?.length ?? 0} builtin safe skills, ${ext.builtin_safe_action_types?.length ?? 0} builtin safe action types`
   );
   return ext;
@@ -2641,6 +3338,7 @@ var init_agents = __esm({
   "src/agents/index.ts"() {
     "use strict";
     init_esm_shims();
+    init_runtime_config();
     __filename4 = fileURLToPath6(import.meta.url);
     __dirname5 = dirname4(__filename4);
     AGENTS_DIR_PROD = resolve4(__dirname5, "agents");
@@ -2650,12 +3348,12 @@ var init_agents = __esm({
 });
 
 // src/scenarios/index.ts
-import { readFileSync as readFileSync6, existsSync as existsSync6 } from "fs";
+import { readFileSync as readFileSync6, existsSync as existsSync7 } from "fs";
 import { resolve as resolve5, dirname as dirname5 } from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 function resolveScenariosDir() {
-  if (existsSync6(SCENARIOS_DIR_PROD)) return SCENARIOS_DIR_PROD;
-  if (existsSync6(SCENARIOS_DIR_DEV_FALLBACK)) return SCENARIOS_DIR_DEV_FALLBACK;
+  if (existsSync7(SCENARIOS_DIR_PROD)) return SCENARIOS_DIR_PROD;
+  if (existsSync7(SCENARIOS_DIR_DEV_FALLBACK)) return SCENARIOS_DIR_DEV_FALLBACK;
   return SCENARIOS_DIR_PROD;
 }
 function getScenarioExtensions(scenarioId) {
@@ -2663,16 +3361,15 @@ function getScenarioExtensions(scenarioId) {
   if (cache2.has(scenarioId)) return cache2.get(scenarioId) ?? null;
   let ext = null;
   try {
-    const { hasRuntimeConfig: hasRuntimeConfig2, loadRuntimeConfig: loadRuntimeConfig2, getEnabledScenarioExtensions: getEnabledScenarioExtensions2 } = (init_runtime_config(), __toCommonJS(runtime_config_exports));
-    if (hasRuntimeConfig2()) {
-      ext = getEnabledScenarioExtensions2(loadRuntimeConfig2(), scenarioId);
+    if (hasRuntimeConfig()) {
+      ext = getEnabledScenarioExtensions(loadRuntimeConfig(), scenarioId);
     }
   } catch {
   }
   if (ext === null) {
     const scenariosDir = resolveScenariosDir();
     const rulesFile = resolve5(scenariosDir, scenarioId, "rules.json");
-    if (!existsSync6(rulesFile)) {
+    if (!existsSync7(rulesFile)) {
       cache2.set(scenarioId, null);
       return null;
     }
@@ -2702,7 +3399,7 @@ function getScenarioExtensions(scenarioId) {
     }
   }
   cache2.set(scenarioId, ext);
-  console.log(
+  console.error(
     `[AgentMoss scenarios] \u52A0\u8F7D\u573A\u666F ${scenarioId} \u5B9A\u5236\u89C4\u5219: ${ext.extra_command_patterns?.length ?? 0} cmd patterns, ${ext.extra_injection_keywords?.length ?? 0} injection keywords, ${ext.extra_sensitive_paths?.length ?? 0} sensitive paths`
   );
   return ext;
@@ -2722,6 +3419,7 @@ var init_scenarios = __esm({
     "use strict";
     init_esm_shims();
     init_agents();
+    init_runtime_config();
     __filename5 = fileURLToPath7(import.meta.url);
     __dirname6 = dirname5(__filename5);
     SCENARIOS_DIR_PROD = resolve5(__dirname6, "scenarios");
@@ -2731,6 +3429,62 @@ var init_scenarios = __esm({
 });
 
 // src/engine/heuristic.ts
+function _effectiveDangerousPatterns(osType) {
+  return runtimeConfigBridge.current?.effectiveDangerousPatterns(osType) ?? getDangerousPatternsForOs(osType);
+}
+function _loadDangerousPatterns(osType) {
+  const accepted = acceptedOsValues(osType);
+  const cmds = loadL1().dangerous_commands || [];
+  return cmds.filter((c) => accepted.includes(String(c.os || "linux").toLowerCase())).map((c) => ({
+    pattern: new RegExp(c.pattern, "i"),
+    severity: c.risk_level,
+    riskType: c.risk_type,
+    description: c.reason,
+    // 保留条目的原始平台归属（非查询用的 osType）—— seed 生成据此分组去重
+    os: String(c.os || "linux").toLowerCase()
+  }));
+}
+function getDangerousPatternsForOs(osType) {
+  const t = String(osType || "").toLowerCase();
+  if (t === "windows") return DANGEROUS_PATTERNS_WINDOWS;
+  if (t === "macos") return DANGEROUS_PATTERNS_MACOS;
+  if (t === "harmony" || t === "hmos" || t === "openharmony" || t === "hongmeng") return DANGEROUS_PATTERNS_HARMONY;
+  return DANGEROUS_PATTERNS2;
+}
+function normalizeShellObfuscation(text) {
+  let t = text.replace(/(?<=\w)(?:''|"")(?=\w)/g, "");
+  t = t.replace(/\$\{IFS\}|\$IFS/gi, " ");
+  return t;
+}
+function scanDangerousCommandPatterns(actionType, actionDetail, osType) {
+  const scanDetail = normalizePathSegments(stripLiteralTextSegments(actionDetail));
+  const scanCommands = String(osType || "").toLowerCase() === "windows" ? [
+    `${actionType}: ${scanDetail}`,
+    scanDetail,
+    `${actionType}: ${scanDetail.replace(/\//g, "\\")}`,
+    scanDetail.replace(/\//g, "\\")
+  ] : [`${actionType}: ${scanDetail}`, scanDetail];
+  const deob = normalizeShellObfuscation(scanDetail);
+  if (deob !== scanDetail) scanCommands.push(`${actionType}: ${deob}`, deob);
+  let top = null;
+  for (const rule of _effectiveDangerousPatterns(osType)) {
+    if (scanCommands.some((c) => rule.pattern.test(c))) {
+      if (!top || severityRank(rule.severity) > severityRank(top.sev)) {
+        top = { sev: rule.severity, type: rule.riskType, desc: rule.description };
+      }
+    }
+  }
+  if (!top) return null;
+  return {
+    allowed: false,
+    reason: `\u68C0\u6D4B\u5230\u9AD8\u5371\u64CD\u4F5C: ${top.desc}`,
+    riskLevel: top.sev,
+    riskType: top.type,
+    confidence: 95,
+    source: "heuristic",
+    violatedLayers: ["L1.1"]
+  };
+}
 function runHeuristicCheck(input) {
   const command = `${input.aNext.actionType}: ${input.aNext.actionDetail}`;
   const matched = [];
@@ -2757,11 +3511,23 @@ function runHeuristicCheck(input) {
     }
   }
   const scanDetail = normalizePathSegments(stripLiteralTextSegments(input.aNext.actionDetail));
-  const scanCommand = `${input.aNext.actionType}: ${scanDetail}`;
+  const scanCommands = String(input.osType || "").toLowerCase() === "windows" ? [
+    `${input.aNext.actionType}: ${scanDetail}`,
+    scanDetail,
+    `${input.aNext.actionType}: ${scanDetail.replace(/\//g, "\\")}`,
+    scanDetail.replace(/\//g, "\\")
+  ] : [`${input.aNext.actionType}: ${scanDetail}`, scanDetail];
+  const deobfuscated = normalizeShellObfuscation(scanDetail);
+  if (deobfuscated !== scanDetail) {
+    scanCommands.push(
+      `${input.aNext.actionType}: ${deobfuscated}`,
+      deobfuscated
+    );
+  }
   let topRiskType = "";
   const exemptKeygen = isSshKeygenGenerate(input.aNext.actionDetail);
-  for (const rule of DANGEROUS_PATTERNS) {
-    if (rule.pattern.test(scanCommand)) {
+  for (const rule of _effectiveDangerousPatterns(input.osType)) {
+    if (scanCommands.some((c) => rule.pattern.test(c))) {
       if (exemptKeygen && rule.riskType === "file_access") continue;
       matched.push(rule.description);
       if (severityRank(rule.severity) > severityRank(highestSeverity)) {
@@ -2779,7 +3545,7 @@ function runHeuristicCheck(input) {
     for (const rule of agentExt.extra_command_patterns) {
       try {
         const re = new RegExp(rule.pattern, "i");
-        if (re.test(scanCommand)) {
+        if (scanCommands.some((c) => re.test(c))) {
           matched.push(`agent \u4E13\u5C5E\u89C4\u5219: ${rule.reason}`);
           if (severityRank(rule.risk_level) > severityRank(highestSeverity)) {
             highestSeverity = rule.risk_level;
@@ -2791,7 +3557,7 @@ function runHeuristicCheck(input) {
     }
   }
   const injectionText = isSearchActionType(input.aNext.actionType) ? `${input.aNext.actionType} ${input.reason || ""} ${input.promptSession || ""}`.toLowerCase() : `${input.aNext.actionType} ${input.aNext.actionDetail} ${input.reason || ""} ${input.promptSession || ""}`.toLowerCase();
-  const injectionHits = checkInjectionKeywords(injectionText, agentExt?.extra_injection_keywords);
+  const injectionHits = checkInjectionKeywords(injectionText, agentExt?.extra_injection_keywords, input.osType);
   if (injectionHits.length > 0) {
     const topHit = injectionHits.reduce((a, b) => severityRank(a.riskLevel) >= severityRank(b.riskLevel) ? a : b);
     matched.push(...injectionHits.map((h) => `\u6CE8\u5165\u5173\u952E\u8BCD [${h.lang}]: ${h.keyword}`));
@@ -2804,7 +3570,7 @@ function runHeuristicCheck(input) {
   const detailL = input.aNext.actionDetail.toLowerCase();
   const isExcludedType = SENSITIVE_EXCLUDED_PREFIXES.some((p) => actionTypeL.startsWith(p));
   const dangerousResult = checkDangerousPatterns(actionTypeL, detailL);
-  const pathResult = isExcludedType ? null : checkSensitivePath(detailL, input.cwd || "/", agentExt);
+  const pathResult = isExcludedType ? null : checkSensitivePath(detailL, input.cwd || "/", agentExt, input.osType);
   const homeResult = checkHomeDeletion(actionTypeL, detailL);
   const mergeResults = [dangerousResult, pathResult, homeResult].filter(Boolean);
   if (mergeResults.length > 0) {
@@ -2840,9 +3606,10 @@ function runHeuristicCheck(input) {
   if (lateralResult) return lateralResult;
   return null;
 }
-function checkInjectionKeywords(text, extraKeywords) {
+function checkInjectionKeywords(text, extraKeywords, osType) {
   const hits = [];
-  for (const entry of INJECTION_KEYWORDS) {
+  const baseKeywords = runtimeConfigBridge.current?.effectiveInjectionKeywords(osType) ?? INJECTION_KEYWORDS;
+  for (const entry of baseKeywords) {
     if (text.includes(entry.keyword.toLowerCase())) {
       hits.push(entry);
     }
@@ -2902,7 +3669,7 @@ function buildPathContext(actionDetail) {
   if (!PATH_CONTEXT_TRIGGER_RE.test(actionDetail)) return "";
   const stripped = stripLiteralTextSegments(actionDetail);
   const lines = [];
-  for (const seg of splitCommandSegments(stripped)) {
+  for (const seg of splitCommandSegments2(stripped)) {
     for (const [raw, lex] of resolvePathTokens(seg)) {
       lines.push(`- \u547D\u4EE4\u6BB5 \`${seg.trim().slice(0, 60)}\`\uFF1A\`${raw}\` \u8BCD\u6CD5\u89E3\u6790\u4E3A \`${lex}\``);
     }
@@ -2917,7 +3684,7 @@ function stripLiteralTextSegments(actionDetail) {
     return actionDetail;
   }
   const resultParts = [];
-  for (const seg of splitCommandSegments(actionDetail)) {
+  for (const seg of splitCommandSegments2(actionDetail)) {
     const fw = (seg.trim().split(/\s+/)[0] || "").toLowerCase();
     if (fw === "echo" || fw === "printf") {
       const segUnquotedRedirect = seg.replace(
@@ -2937,7 +3704,7 @@ function stripHeredocContent(actionDetail) {
     "<<heredoc>>\n"
   );
 }
-function normalizePathSegments(text) {
+function normalizePathSegments(text, foldQuotes = false) {
   const protTokens = [];
   let t = text.replace(/\b(https?|ftp|file):\/\//gi, (m) => {
     const scheme = m.slice(0, m.indexOf(":"));
@@ -2945,10 +3712,12 @@ function normalizePathSegments(text) {
     return `${scheme}__PROT${protTokens.length - 1}__`;
   });
   const quoteTokens = [];
-  t = t.replace(/'[^']*'|"[^"]*"/g, (m) => {
-    quoteTokens.push(m);
-    return `__Q${quoteTokens.length - 1}__`;
-  });
+  if (!foldQuotes) {
+    t = t.replace(/'[^']*'|"[^"]*"/g, (m) => {
+      quoteTokens.push(m);
+      return `__Q${quoteTokens.length - 1}__`;
+    });
+  }
   t = t.replace(/\/{2,}/g, "/");
   t = t.replace(/\/\.\//g, "/");
   for (let i = 0; i < quoteTokens.length; i++) {
@@ -2959,7 +3728,12 @@ function normalizePathSegments(text) {
   }
   return t;
 }
-function splitCommandSegments(actionDetail) {
+function pathScanVariants(actionDetailLower) {
+  const base = stripLiteralTextSegments(actionDetailLower);
+  const deep = normalizePathSegments(base, true);
+  return deep === base ? [base] : [base, deep];
+}
+function splitCommandSegments2(actionDetail) {
   const segments = [];
   let cur = "";
   let quote = null;
@@ -3008,11 +3782,15 @@ function isSearchActionType(actionType) {
   const at = actionType.toLowerCase();
   return SEARCH_ACTION_PREFIXES.some((p) => at.startsWith(p)) || ["websearch", "web_search", "search", "query"].includes(at);
 }
-function checkSensitivePath(command, cwd, agentExt) {
+function checkSensitivePath(command, cwd, agentExt, osType) {
   const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
-  const isWriteOpFlag = isWriteOperation("", command);
+  const { root: rootPaths, home: homePaths, credential: credentialPaths } = getSensitivePathsForOs(osType);
+  const isWriteOpFlag = isWriteOperation("", command, void 0, osType);
   const keygenGenerate = isSshKeygenGenerate(command);
-  const pathScanText = normalizePathSegments(stripLiteralTextSegments(command));
+  const pathScanTexts = pathScanVariants(command);
+  if (String(osType || "").toLowerCase() === "windows") {
+    pathScanTexts.push(...pathScanTexts.map((t) => t.replace(/\//g, "\\")));
+  }
   const pathMatches = (text, path5) => {
     const parts = path5.split(/(\(\?!.*?\))/);
     const escaped = parts.map((part) => {
@@ -3022,8 +3800,9 @@ function checkSensitivePath(command, cwd, agentExt) {
     const re = path5.startsWith(".") || path5.startsWith("/") ? new RegExp(`(?:^|[\\s/\\\\'"])${escaped}\\b`, "i") : new RegExp(`\\b${escaped}\\b`, "i");
     return re.test(text);
   };
-  for (const sp of ROOT_SENSITIVE_PATHS) {
-    if (pathMatches(pathScanText, sp.path.toLowerCase())) {
+  const pathMatchesAny = (path5) => pathScanTexts.some((t) => pathMatches(t, path5));
+  for (const sp of rootPaths) {
+    if (pathMatchesAny(sp.path.toLowerCase())) {
       if (keygenGenerate) continue;
       if (sp.path === "/dev/random") {
         if (isWriteOpFlag) {
@@ -3039,9 +3818,9 @@ function checkSensitivePath(command, cwd, agentExt) {
           violatedLayers: ["L1.1"]
         };
       }
-      if (!isWriteOpFlag && !sp.credential) {
-        continue;
-      }
+      const denyMode = sp.denyMode || (sp.credential ? "deny_both" : sp.readOnly ? "deny_read" : "deny_write");
+      if (denyMode === "deny_write" && !isWriteOpFlag) continue;
+      if (denyMode === "deny_read" && isWriteOpFlag) continue;
       return {
         allowed: false,
         reason: `\u5C1D\u8BD5\u8BBF\u95EE\u7CFB\u7EDF\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
@@ -3054,17 +3833,19 @@ function checkSensitivePath(command, cwd, agentExt) {
       };
     }
   }
-  for (const sp of HOME_SENSITIVE_PATHS) {
+  for (const sp of homePaths) {
     const expanded = `${expandedCwd}/${sp.path}`;
     let pPath = sp.path;
     if (!sp.path.endsWith(".pub")) pPath = `${sp.path}(?!\\.pub)`;
     let dirPrefixMatch = null;
     if (sp.dirDelOnly) {
       const dirRe = (t) => new RegExp(`(?:^|[\\s/\\\\'"])${t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:/|[\\s'"\\\\]|$)`, "i");
-      dirPrefixMatch = dirRe(sp.path).test(pathScanText) || dirRe(expanded.toLowerCase()).test(pathScanText);
+      dirPrefixMatch = pathScanTexts.some(
+        (t) => dirRe(sp.path).test(t) || dirRe(expanded.toLowerCase()).test(t)
+      );
     }
-    const pathReMatch = sp.dirDelOnly ? !!dirPrefixMatch : pathMatches(pathScanText, pPath);
-    const expandedReMatch = sp.dirDelOnly ? false : pathMatches(pathScanText, expanded + (sp.path.endsWith(".pub") ? "" : "(?!\\.pub)"));
+    const pathReMatch = sp.dirDelOnly ? !!dirPrefixMatch : pathMatchesAny(pPath);
+    const expandedReMatch = sp.dirDelOnly ? false : pathMatchesAny(expanded + (sp.path.endsWith(".pub") ? "" : "(?!\\.pub)"));
     if (pathReMatch || expandedReMatch) {
       if (keygenGenerate) continue;
       if (sp.dirDelOnly) {
@@ -3094,9 +3875,9 @@ function checkSensitivePath(command, cwd, agentExt) {
         }
         continue;
       }
-      if (!isWriteOpFlag && !sp.credential) {
-        continue;
-      }
+      const denyMode = sp.denyMode || (sp.credential ? "deny_both" : sp.readOnly ? "deny_read" : "deny_write");
+      if (denyMode === "deny_write" && !isWriteOpFlag) continue;
+      if (denyMode === "deny_read" && isWriteOpFlag) continue;
       return {
         allowed: false,
         reason: `\u5C1D\u8BD5\u8BBF\u95EE\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
@@ -3133,7 +3914,7 @@ function checkSensitivePath(command, cwd, agentExt) {
       }
     }
   }
-  for (const cp of CREDENTIAL_PATHS) {
+  for (const cp of credentialPaths) {
     const escaped = cp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     const re = cp.path.startsWith(".") ? new RegExp(`(?:^|[\\s/\\\\'"])${escaped}\\b`) : new RegExp(`\\b${escaped}\\b`);
     if (re.test(command)) {
@@ -3253,7 +4034,7 @@ function isDeleteActionForDir(command, dirPath) {
   }
   for (const seg of low.split(/&&|\|\||;|\n/)) {
     const fw = (seg.trim().split(/\s+/)[0] || "").toLowerCase();
-    if ((fw === "rm" || fw === "unlink" || fw === "rmdir") && low.includes(dpath)) {
+    if ((fw === "rm" || fw === "unlink" || fw === "rmdir") && seg.includes(dpath)) {
       return true;
     }
   }
@@ -3436,7 +4217,7 @@ function checkLateralMovement(actionDetail) {
   }
   return null;
 }
-var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, PATH_CONTEXT_TRIGGER_RE, HOME_PREFIX_RE, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES, HOME_TARGET_RE, HOME_ASSIGN_RE;
+var INJECTION_KEYWORDS, DANGEROUS_PATTERNS2, DANGEROUS_PATTERNS_WINDOWS, DANGEROUS_PATTERNS_MACOS, DANGEROUS_PATTERNS_HARMONY, PATH_CONTEXT_TRIGGER_RE, HOME_PREFIX_RE, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES, HOME_TARGET_RE, HOME_ASSIGN_RE;
 var init_heuristic = __esm({
   "src/engine/heuristic.ts"() {
     "use strict";
@@ -3445,6 +4226,7 @@ var init_heuristic = __esm({
     init_agents();
     init_scenarios();
     init_runtime_config();
+    init_runtime_config_bridge();
     init_rules_loader();
     init_logic_rules();
     INJECTION_KEYWORDS = (() => {
@@ -3455,15 +4237,10 @@ var init_heuristic = __esm({
         lang: k.lang || "en"
       }));
     })();
-    DANGEROUS_PATTERNS = (() => {
-      const cmds = loadL1().dangerous_commands || [];
-      return cmds.map((c) => ({
-        pattern: new RegExp(c.pattern, "i"),
-        severity: c.risk_level,
-        riskType: c.risk_type,
-        description: c.reason
-      }));
-    })();
+    DANGEROUS_PATTERNS2 = _loadDangerousPatterns("linux");
+    DANGEROUS_PATTERNS_WINDOWS = _loadDangerousPatterns("windows");
+    DANGEROUS_PATTERNS_MACOS = _loadDangerousPatterns("macos");
+    DANGEROUS_PATTERNS_HARMONY = _loadDangerousPatterns("harmony");
     PATH_CONTEXT_TRIGGER_RE = /(?:^|[;&|]\s*)(?:rm|rmdir|unlink|ln|mv|cp|dd|truncate|shred|chmod|chown)\b/i;
     HOME_PREFIX_RE = /(?:~|~(?=\/)|\$HOME\b|\$\{HOME\}|\/home\/[a-z0-9_.-]+)/gi;
     SENSITIVE_EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
@@ -3483,14 +4260,14 @@ __export(token_stats_exports, {
   recordTokenUsage: () => recordTokenUsage,
   resetTokenStats: () => resetTokenStats
 });
-import { readFileSync as readFileSync11, writeFileSync as writeFileSync2, existsSync as existsSync10, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2 } from "fs";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync2, existsSync as existsSync11, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2 } from "fs";
 function getStatsPath() {
   const envPath = process.env[ENV_STATS_PATH];
   if (envPath) return envPath;
   return getTokenStatsPath();
 }
 function loadAllRecords(statsPath) {
-  if (!existsSync10(statsPath)) return [];
+  if (!existsSync11(statsPath)) return [];
   try {
     const data = JSON.parse(readFileSync11(statsPath, "utf-8"));
     if (Array.isArray(data)) return data;
@@ -3503,7 +4280,7 @@ function loadAllRecords(statsPath) {
 function saveRecords(statsPath, records) {
   try {
     const dir = statsPath.substring(0, statsPath.lastIndexOf("/"));
-    if (dir && !existsSync10(dir)) mkdirSync2(dir, { recursive: true });
+    if (dir && !existsSync11(dir)) mkdirSync2(dir, { recursive: true });
     writeFileSync2(statsPath, JSON.stringify(records, null, 2), "utf-8");
   } catch (e) {
   }
@@ -3630,7 +4407,7 @@ function getTokenTrend(days = 0, startDate, endDate) {
 }
 function resetTokenStats() {
   const statsPath = getStatsPath();
-  if (existsSync10(statsPath)) {
+  if (existsSync11(statsPath)) {
     try {
       unlinkSync2(statsPath);
     } catch {
@@ -3652,6 +4429,8 @@ var init_token_stats = __esm({
 init_esm_shims();
 init_heuristic();
 init_logic_rules();
+init_platform_traits();
+init_shell_split();
 init_inline_analyzer();
 
 // src/engine/llm-analyzer.ts
@@ -3662,7 +4441,7 @@ init_skill_loader();
 // src/engine/template-loader.ts
 init_esm_shims();
 init_asset_dir();
-import { readFileSync as readFileSync7, existsSync as existsSync7 } from "fs";
+import { readFileSync as readFileSync7, existsSync as existsSync8 } from "fs";
 import { resolve as resolve6, dirname as dirname6 } from "path";
 import { fileURLToPath as fileURLToPath8 } from "url";
 var __filename6 = fileURLToPath8(import.meta.url);
@@ -3680,7 +4459,7 @@ function loadTemplates() {
   }
   for (const file of TEMPLATE_FILES) {
     const filePath = resolve6(dir, file);
-    if (existsSync7(filePath)) {
+    if (existsSync8(filePath)) {
       const key = file.replace(".txt", "").replace("_template", "");
       cachedTemplates[key] = readFileSync7(filePath, "utf-8");
     }
@@ -3825,7 +4604,7 @@ function assessKeywordCombinationRisk(matchedKeywords, scriptContent) {
 }
 function readScriptContent(scriptPath, maxLines = 500) {
   try {
-    const expandedPath = scriptPath.startsWith("~") ? join4(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve7(scriptPath);
+    const expandedPath = scriptPath === "~" || scriptPath.startsWith("~/") ? join4(process.env.HOME || "/home/user", scriptPath.slice(1)) : resolve7(scriptPath);
     const raw = readFileSync8(expandedPath, "utf-8");
     const lines = raw.split("\n").slice(0, maxLines);
     return { content: lines.join("\n"), lineCount: lines.length, error: "" };
@@ -3879,11 +4658,12 @@ ${result.scriptContent}
 // src/engine/script-content-analyzer.ts
 init_esm_shims();
 init_heuristic();
+init_config();
 init_logic_rules();
 init_inline_analyzer();
-import { statSync as statSync3, existsSync as existsSync9 } from "fs";
+import { statSync as statSync3, existsSync as existsSync10 } from "fs";
 import { resolve as resolve9, join as join6, isAbsolute as isAbsolute2 } from "path";
-import { homedir as homedir4 } from "os";
+import { homedir as homedir3 } from "os";
 
 // src/engine/script-engine/tracker.ts
 init_esm_shims();
@@ -4710,7 +5490,7 @@ function tokenize(content) {
   }
   return stmts;
 }
-var EXPR_SPLIT_RE = /(\$\{?\d+\}?|\$\{?[A-Za-z_][A-Za-z0-9_]*\}?)/;
+var EXPR_SPLIT_RE = /(\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*|\$\d+)/;
 function evalExpr2(text, env) {
   const isSingleQuoted = text.length >= 2 && text[0] === "'" && text[text.length - 1] === "'";
   if (text.length >= 2 && (text[0] === '"' || text[0] === "'") && text[text.length - 1] === text[0]) {
@@ -4721,9 +5501,20 @@ function evalExpr2(text, env) {
   const result = [];
   for (const p of parts) {
     if (!p) continue;
-    const brace = p.match(/^\$\{([^}]+)\}$/);
+    const brace = p.match(/^\$\{([^}]*)\}$/);
     if (brace) {
       const inner = brace[1];
+      const dm = inner.match(/^([A-Za-z_][A-Za-z0-9_]*|\d+):?-(.*)$/s);
+      if (dm) {
+        const key = /^\d+$/.test(dm[1]) ? `$${dm[1]}` : dm[1];
+        const bound = env.get(key);
+        if (bound && !(bound.kind === "concrete" && !bound.value)) {
+          result.push(bound);
+        } else {
+          result.push(evalExpr2(dm[2], env));
+        }
+        continue;
+      }
       if (/^\d+$/.test(inner)) {
         const v = env.get(`$${inner}`);
         result.push(v || svalSym(`$${inner}`));
@@ -5176,7 +5967,15 @@ var ShellBackend = class {
 // src/engine/script-engine/tracker.ts
 var DEFAULT_MAX_DEPTH = 14;
 var DEFAULT_MAX_NODES = 64;
-var DEFAULT_MAX_FILE_SIZE = 2 * 1024 * 1024;
+function maxFileSizeFromEnv() {
+  const raw = (process.env.AGENT_MOSS_SCRIPT_MAX_FILE_SIZE || "").trim();
+  if (raw) {
+    const v = Number(raw);
+    if (Number.isFinite(v) && v > 0) return v;
+  }
+  return 2 * 1024 * 1024;
+}
+var DEFAULT_MAX_FILE_SIZE = maxFileSizeFromEnv();
 var DEFAULT_MAX_TOTAL_SIZE = 8 * 1024 * 1024;
 var BACKENDS = {
   ".py": new PythonBackend()
@@ -5224,6 +6023,7 @@ function emptyNode(pathStr, depth) {
     depth,
     childPaths: [],
     error: "",
+    unanalyzable: false,
     l1Hit: false,
     l1RiskLevel: "",
     l1RiskType: "",
@@ -5305,6 +6105,7 @@ var RecursiveTracker = class {
       node2.error = error;
       node2.fileSize = fileSize;
       node2.lineCount = lineCount;
+      node2.unanalyzable = error.startsWith("\u811A\u672C\u6587\u4EF6\u8FC7\u5927");
       this.result.nodes.push(node2);
       this.visiting.delete(pathStr);
       return;
@@ -5536,12 +6337,12 @@ function extractInlineScriptPath(actionDetail) {
     const subShellRe = /subprocess\.(?:run|call|Popen|check_output|check_call)\s*\(\s*(['"])(.*?)\1[^)]*?shell\s*=\s*true/gi;
     while ((m = subShellRe.exec(code)) !== null) candidates.push(m[2]);
     for (const cand of candidates) {
-      const tokens = cand.includes(",") ? cand.split(/\s*,\s*/).map((t) => t.trim().replace(/^['"]|['"]$/g, "")) : cand.split(/\s+/);
+      const tokens = cand.includes(",") ? cand.split(/\s*,\s*/).map((t) => t.trim().replace(/^['"]|['"]$/g, "")) : shlexSplit(cand);
       for (const tok of tokens) {
         if (looksLikeScriptPath(tok)) {
           try {
             const resolved = resolvePath2(tok.replace(/^['"]|['"]$/g, ""));
-            if (existsSync9(resolved)) {
+            if (existsSync10(resolved)) {
               const stat = statSync3(resolved);
               if (stat.isFile()) return resolved;
             }
@@ -5555,7 +6356,7 @@ function extractInlineScriptPath(actionDetail) {
       const p = m[1];
       try {
         const resolved = resolvePath2(p);
-        if (existsSync9(resolved)) {
+        if (existsSync10(resolved)) {
           const stat = statSync3(resolved);
           if (stat.isFile()) return resolved;
         }
@@ -5571,7 +6372,7 @@ function extractInlineScriptPath(actionDetail) {
     let resolved;
     try {
       resolved = resolvePath2(p);
-      if (existsSync9(resolved)) {
+      if (existsSync10(resolved)) {
         const stat = statSync3(resolved);
         if (stat.isFile()) return resolved;
       }
@@ -5580,10 +6381,39 @@ function extractInlineScriptPath(actionDetail) {
   }
   return null;
 }
+function shlexSplit(s) {
+  const out = [];
+  let cur = "";
+  let quote = null;
+  let quoted = false;
+  for (let i = 0; i < s.length; i++) {
+    const ch = s[i];
+    if (quote) {
+      if (ch === quote) quote = null;
+      else if (ch === "\\" && quote === '"' && i + 1 < s.length) cur += s[++i];
+      else cur += ch;
+    } else if (ch === '"' || ch === "'") {
+      quote = ch;
+      quoted = true;
+    } else if (ch === "\\" && i + 1 < s.length) {
+      cur += s[++i];
+    } else if (/\s/.test(ch)) {
+      if (cur || quoted) {
+        out.push(cur);
+        cur = "";
+        quoted = false;
+      }
+    } else {
+      cur += ch;
+    }
+  }
+  if (cur || quoted) out.push(cur);
+  return out;
+}
 function resolvePath2(p) {
   let expanded = p;
   if (expanded.startsWith("~/") || expanded === "~") {
-    expanded = join6(homedir4(), expanded.slice(1));
+    expanded = join6(homedir3(), expanded.slice(1));
   }
   return resolve9(expanded);
 }
@@ -5594,7 +6424,7 @@ function scanScriptChainWithL1(chain, input) {
       ...input,
       aNext: { actionType: "bash", actionDetail: node.preprocessedContent }
     };
-    const l1 = runHeuristicCheck(virtualInput);
+    const l1 = scanDangerousCommandPatterns("bash", node.preprocessedContent, input.osType);
     if (l1 && !l1.allowed) {
       node.l1Hit = true;
       node.l1RiskLevel = l1.riskLevel;
@@ -5617,18 +6447,25 @@ function scanScriptChainWithL2(chain, input) {
       ...input,
       aNext: { actionType: "bash", actionDetail: node.preprocessedContent }
     };
-    const l2 = runLogicCheck(virtualInput);
-    if (l2 && !l2.allowed) {
-      node.l2Hit = true;
-      node.l2ViolatedRule = `script_logic:${node.scriptPath}`;
-      node.l2RiskLevel = l2.riskLevel;
-      node.l2RiskType = l2.riskType;
-      node.l2Reason = `\u811A\u672C ${node.scriptPath} (\u6DF1\u5EA6 ${node.depth}) \u4E2D: ${l2.reason}`;
-      if (l2.riskLevel === "critical") {
-        chain.hasCritical = true;
-        chain.firstHitNode = node;
-        break;
-      }
+    let l2 = null;
+    if (isLogicRulesEnabled()) {
+      l2 = checkSensitivePath(
+        node.preprocessedContent.toLowerCase(),
+        input.cwd || "/",
+        null,
+        input.osType
+      ) || checkIntentConsistency(virtualInput);
+    }
+    if (!l2 || l2.allowed) continue;
+    node.l2Hit = true;
+    node.l2ViolatedRule = `script_logic:${node.scriptPath}`;
+    node.l2RiskLevel = l2.riskLevel;
+    node.l2RiskType = l2.riskType;
+    node.l2Reason = `\u811A\u672C ${node.scriptPath} (\u6DF1\u5EA6 ${node.depth}) \u4E2D: ${l2.reason}`;
+    if (l2.riskLevel === "critical") {
+      chain.hasCritical = true;
+      chain.firstHitNode = node;
+      break;
     }
   }
   if (!chain.hasHigh) {
@@ -5667,13 +6504,16 @@ function analyzeScriptContent2(input) {
     resolvedPath = join6(input.cwd || process.cwd(), resolvedPath);
   }
   const l1Adapter = (content) => {
-    const virtualInput = {
-      ...input,
-      aNext: { actionType: "bash", actionDetail: content }
-    };
-    const j = runHeuristicCheck(virtualInput);
+    const j = scanDangerousCommandPatterns("bash", content, input.osType);
     if (j && !j.allowed) {
-      return { hit: true, riskLevel: j.riskLevel, riskType: j.riskType, reason: j.reason, matchedPatterns: [] };
+      return {
+        hit: true,
+        riskLevel: j.riskLevel,
+        riskType: j.riskType,
+        reason: j.reason,
+        matchedPatterns: []
+        // SecurityJudgment 不带模式列表（见 types.ts）；留空即可
+      };
     }
     return { hit: false, riskLevel: "", riskType: "", reason: "", matchedPatterns: [] };
   };
@@ -5984,10 +6824,10 @@ init_esm_shims();
 
 // src/brain/rule-store.ts
 init_esm_shims();
-import { existsSync as existsSync11, readFileSync as readFileSync12, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync12, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
 import { join as join7 } from "path";
-import { homedir as homedir5 } from "os";
-var DEFAULT_RULES_PATH = join7(homedir5(), ".agentmoss", "brain", "rules.json");
+import { homedir as homedir4 } from "os";
+var DEFAULT_RULES_PATH = join7(homedir4(), ".agentmoss", "brain", "rules.json");
 var ENV_RULES_PATH = "AGENT_MOSS_BRAIN_RULES_PATH";
 var STATUS_DRAFT = "draft";
 var STATUS_APPROVED = "approved";
@@ -6016,7 +6856,7 @@ var BrainRuleStore = class {
     this.data = this.load();
   }
   load() {
-    if (!existsSync11(this.path)) {
+    if (!existsSync12(this.path)) {
       return { version: 1, rules: [], pattern_candidates: [] };
     }
     try {
@@ -7454,63 +8294,15 @@ var READONLY_SENSITIVE_TOOLS = /* @__PURE__ */ new Set([
   "filemgr-readfile",
   "filemgr-grepfiles"
 ]);
-var FULLY_SAFE_BASH_PATTERNS = [
-  /^ls(?:\s|$)/i,
-  /^dir(?:\s|$)/i,
-  /^pwd(?:\s|$)/i,
-  /^which\s+/i,
-  /^whereis\s+/i,
-  /^realpath\s+/i,
-  /^basename\s+/i,
-  /^dirname\s+/i,
-  /^file\s+/i,
-  /^stat\s+/i,
-  /^du(?:\s|$)/i,
-  /^echo\s+/i,
-  /^printf\s+/i,
-  /^type\s+/i,
-  /^command\s+/i,
-  // 系统信息查询（只读，不涉及文件/网络/权限）
-  /^whoami(?:\s|$)/i,
-  /^id(?:\s|$)/i,
-  /^hostname(?:\s|$)/i,
-  /^uname(?:\s|$)/i,
-  /^date(?:\s|$)/i,
-  /^env(?:\s|$)/i,
-  /^printenv(?:\s|$)/i,
-  /^tty(?:\s|$)/i,
-  /^arch(?:\s|$)/i,
-  /^uptime(?:\s|$)/i,
-  /^groups(?:\s|$)/i,
-  /^logname(?:\s|$)/i
-];
-var READONLY_SENSITIVE_BASH_PATTERNS = [
-  /^cat\s+/i,
-  /^head(?:\s|$)/i,
-  /^tail(?:\s|$)/i,
-  /^less(?:\s|$)/i,
-  /^more(?:\s|$)/i,
-  /^wc(?:\s|$)/i,
-  /^grep(?:\s|$)/i,
-  /^find\s+/i,
-  /^ag(?:\s|$)/i,
-  /^rg(?:\s|$)/i,
-  /^awk\s+/i,
-  /^sed\s+/i,
-  /^cut\s+/i,
-  /^sort(?:\s|$)/i,
-  /^uniq(?:\s|$)/i
-];
-function extractFirstCommand(command) {
-  let main = command.split("|")[0].trim();
-  for (const sep of ["&&", "||"]) {
-    const idx = main.indexOf(sep);
-    if (idx !== -1) {
-      main = main.substring(0, idx).trim();
-      break;
-    }
-  }
-  return main;
+function whitelistTier(command, fullySafe, readonlySensitive) {
+  const segments = splitCommandSegments(command);
+  if (segments.length === 0) return "";
+  if (segments.some((seg) => hasCommandSubstitution(seg))) return "";
+  const hitFull = (seg) => matchesAny(seg, fullySafe);
+  const hitAny = (seg) => hitFull(seg) || matchesAny(seg, readonlySensitive);
+  if (segments.every(hitFull)) return "full";
+  if (segments.every(hitAny)) return "readonly";
+  return "";
 }
 function extractRawCommand(detail) {
   const m = detail.match(/command=([^,]+)/);
@@ -7545,7 +8337,7 @@ async function runAnalysis(input) {
   if (heuristicResult && !heuristicResult.allowed) {
     const skipInlineFileAccess = (isInlineScriptCmd || isLiteralTextCmd) && heuristicResult.riskType === "file_access";
     if (!skipInlineFileAccess) {
-      const shouldDenyL1 = heuristicResult.riskLevel === "high" || heuristicResult.riskLevel === "critical" || heuristicResult.riskLevel === "medium" && heuristicResult.riskType === "file_access";
+      const shouldDenyL1 = heuristicResult.riskLevel === "high" || heuristicResult.riskLevel === "critical" || heuristicResult.riskLevel === "medium" && heuristicResult.riskType === "file_access" || heuristicResult.riskLevel === "medium" && heuristicResult.riskType === "resource_exhaustion";
       if (shouldDenyL1) {
         return heuristicResult;
       }
@@ -7555,6 +8347,19 @@ async function runAnalysis(input) {
   if (input.aNext.actionType.toLowerCase() === "bash") {
     scriptChain = analyzeScriptContent2(input);
     if (scriptChain.nodes.length > 0) {
+      for (const node of scriptChain.nodes) {
+        if (node.unanalyzable) {
+          return {
+            allowed: false,
+            reason: `\u811A\u672C\u5B58\u5728\u4F46\u5185\u5BB9\u65E0\u6CD5\u9759\u6001\u5206\u6790\uFF08${node.error}\uFF09\u2014\u2014 \u65E0\u6CD5\u786E\u8BA4\u5176\u5B89\u5168\u6027\uFF0C\u6309\u4E0D\u53EF\u4FE1\u5904\u7406\u3002\u6587\u4EF6: ${node.scriptPath}\u3002\u5982\u786E\u5C5E\u6B63\u5E38\u5927\u811A\u672C\uFF0C\u53EF\u8BBE AGENT_MOSS_SCRIPT_MAX_FILE_SIZE \u653E\u5BBD\u4E0A\u9650\u3002`,
+            riskLevel: "high",
+            riskType: "script_execution",
+            confidence: 80,
+            source: "heuristic_script_scan",
+            violatedLayers: ["L1.2"]
+          };
+        }
+      }
       for (const node of scriptChain.nodes) {
         if (node.l1Hit && (node.l1RiskLevel === "high" || node.l1RiskLevel === "critical")) {
           return {
@@ -7642,11 +8447,15 @@ async function runAnalysis(input) {
   let skipLLM = READONLY_SENSITIVE_TOOLS.has(actionType);
   if (actionType === "bash" || actionType === "executebash" || actionType === "terminal-executebash") {
     const firstCmd = extractFirstCommand(lowerDetail);
-    if (matchesAny(firstCmd, FULLY_SAFE_BASH_PATTERNS)) {
-      const fullCmdHit = DANGEROUS_PATTERNS.some(
+    const { fullySafeCommands, readonlySensitiveCommands } = getPlatformTraits(input.osType);
+    const tier = whitelistTier(lowerDetail, fullySafeCommands, readonlySensitiveCommands);
+    if (tier === "full") {
+      const fastPassScanText = normalizePathSegments(stripLiteralTextSegments(lowerDetail));
+      const osPatterns = getDangerousPatternsForOs(input.osType);
+      const fullCmdHit = osPatterns.some(
         (p) => p.severity === "critical" || p.severity === "high"
-      ) && DANGEROUS_PATTERNS.some(
-        (p) => (p.severity === "critical" || p.severity === "high") && p.pattern.test(lowerDetail)
+      ) && osPatterns.some(
+        (p) => (p.severity === "critical" || p.severity === "high") && p.pattern.test(fastPassScanText)
       );
       const hasRedirectWrite = isWriteOperation(firstCmd, lowerDetail);
       if (!fullCmdHit && !hasRedirectWrite) {
@@ -7661,7 +8470,7 @@ async function runAnalysis(input) {
         };
       }
     }
-    if (matchesAny(firstCmd, READONLY_SENSITIVE_BASH_PATTERNS)) {
+    if (tier !== "") {
       skipLLM = true;
     }
   }
@@ -7670,8 +8479,8 @@ async function runAnalysis(input) {
   const effectiveResult = logicResult && !logicResult.allowed ? logicResult : l1FileAccessHit ? heuristicResult : null;
   if (effectiveResult) {
     const isCredentialPath = !!effectiveResult.isCredential;
-    const skipInlineFileAccess = (isInlineScriptCmd || isLiteralTextCmd) && effectiveResult.riskType === "file_access";
-    if (skipInlineFileAccess) {
+    const skipInlineFileAccess = (isInlineScriptCmd || isLiteralTextCmd) && l1FileAccessHit;
+    if (isInlineScriptCmd || isLiteralTextCmd) {
       const inlineJudgment = analyzeInlineScript(input.aNext.actionDetail);
       if (inlineJudgment.actionable) {
         if (!inlineJudgment.allowed) {
@@ -7870,7 +8679,11 @@ async function runAnalysis(input) {
 export {
   TRUSTED_SKILLS_BASE,
   _resetBrainForTest,
-  runAnalysis
+  extractFirstCommand,
+  matchesAny,
+  runAnalysis,
+  splitCommandSegments,
+  whitelistTier
 };
 //! 顺序即 fail-closed 短路优先级：verify 逐个执行，首个返回违规的性质成为
 //! first_violation，后续不再评估。调整顺序影响判定归属，须与 Python