@kenhkl/agent-moss 0.16.12 → 0.16.13

package/dist/server.js

@@ -394,6 +394,52 @@ var init_runtime_config_bridge = __esm({
   }
 });
 
+// src/infra/rules-mode.ts
+function truthy(name) {
+  return TRUTHY.has((process.env[name] || "").trim().toLowerCase());
+}
+function getRulesMode() {
+  if (cached !== null) return cached;
+  const raw = (process.env[ENV_RULES_MODE] || "").trim().toLowerCase();
+  if (raw) {
+    if (VALID_MODES.has(raw)) {
+      cached = raw;
+    } else {
+      console.error(
+        `[AgentMoss] ${ENV_RULES_MODE}=${JSON.stringify(raw)} \u975E\u6CD5\uFF08\u53EA\u652F\u6301 hot / cold / builtin\uFF09\uFF1B\u4E3A\u5B89\u5168\u8D77\u89C1\u6309 builtin\uFF08\u4EC5\u5185\u7F6E\u89C4\u5219\uFF09\u5904\u7406`
+      );
+      cached = "builtin";
+    }
+    return cached;
+  }
+  if (truthy(ENV_RULES_BUILTIN_ONLY)) cached = "builtin";
+  else if (truthy(ENV_DISABLE_RULE_HOT_RELOAD)) cached = "cold";
+  else cached = "hot";
+  return cached;
+}
+function isHotReloadEnabled() {
+  return getRulesMode() === "hot";
+}
+function isRuntimeConfigDisabled() {
+  return getRulesMode() !== "hot";
+}
+function isBuiltinOnly() {
+  return getRulesMode() === "builtin";
+}
+var ENV_RULES_MODE, ENV_RULES_BUILTIN_ONLY, ENV_DISABLE_RULE_HOT_RELOAD, TRUTHY, VALID_MODES, cached;
+var init_rules_mode = __esm({
+  "src/infra/rules-mode.ts"() {
+    "use strict";
+    init_esm_shims();
+    ENV_RULES_MODE = "AGENT_MOSS_RULES_MODE";
+    ENV_RULES_BUILTIN_ONLY = "AGENT_MOSS_RULES_BUILTIN_ONLY";
+    ENV_DISABLE_RULE_HOT_RELOAD = "AGENT_MOSS_DISABLE_RULE_HOT_RELOAD";
+    TRUTHY = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
+    VALID_MODES = /* @__PURE__ */ new Set(["hot", "cold", "builtin"]);
+    cached = null;
+  }
+});
+
 // src/infra/rules-loader.ts
 import { readFileSync as readFileSync2, existsSync, readdirSync, statSync } from "fs";
 import { resolve, dirname, join as join2 } from "path";
@@ -407,6 +453,7 @@ function parseDirEnv(envName) {
   return raw.split(/[,;]/).map((s) => s.trim()).filter(Boolean).map((s) => resolve(s));
 }
 function rulesDirs() {
+  if (isBuiltinOnly()) return [];
   const dirs = [];
   for (const env of RULES_DIR_ENVS) dirs.push(...parseDirEnv(env));
   dirs.push(resolve(dataRootDir(), "rules"));
@@ -420,10 +467,16 @@ function findRulesFile(name) {
   return null;
 }
 function loadJson(name) {
+  if (!isHotReloadEnabled()) {
+    const cached2 = frozenJsonCache.get(name);
+    if (cached2 !== void 0) return cached2;
+  }
   const p = findRulesFile(name);
   if (!p) return {};
   try {
-    return JSON.parse(readFileSync2(p, "utf-8")) || {};
+    const parsed = JSON.parse(readFileSync2(p, "utf-8")) || {};
+    if (!isHotReloadEnabled()) frozenJsonCache.set(name, parsed);
+    return parsed;
   } catch {
     return {};
   }
@@ -748,6 +801,7 @@ function scanRuleDirs() {
   return { override, extra, loaded, ignored };
 }
 function rulesCached() {
+  if (!isHotReloadEnabled() && _RULES_CACHE) return _RULES_CACHE;
   const dirs = rulesDirs();
   const sig = RULES_DIR_ENVS.map((e) => `${e}=${process.env[e] || ""}`).join("|") + "|" + dirs.join("|");
   const files = [];
@@ -783,9 +837,11 @@ function identicalToBuiltin(override) {
   return Object.keys(override).length > 0;
 }
 function loadOverrideRules() {
+  if (isBuiltinOnly()) return {};
   return rulesCached().override;
 }
 function loadExtraRules() {
+  if (isBuiltinOnly()) return {};
   return rulesCached().extra;
 }
 function ruleFilesLoaded() {
@@ -794,12 +850,13 @@ function ruleFilesLoaded() {
 function ignoredRuleFiles() {
   return rulesCached().ignored;
 }
-var __filename2, __dirname2, OVERRIDE_FILENAME, EXTRA_FILENAME, RULES_DIR_ENVS, RULES_DIR_CANDS, SCENARIO_LIST_KEYS, EXTRA_CATEGORIES, STRUCT_KEYS, EXTRA_FLAT_FIELD, _RULES_CACHE, warnedIgnored;
+var __filename2, __dirname2, OVERRIDE_FILENAME, EXTRA_FILENAME, RULES_DIR_ENVS, RULES_DIR_CANDS, frozenJsonCache, SCENARIO_LIST_KEYS, EXTRA_CATEGORIES, STRUCT_KEYS, EXTRA_FLAT_FIELD, _RULES_CACHE, warnedIgnored;
 var init_rules_loader = __esm({
   "src/infra/rules-loader.ts"() {
     "use strict";
     init_esm_shims();
     init_paths();
+    init_rules_mode();
     init_runtime_config_bridge();
     __filename2 = fileURLToPath2(import.meta.url);
     __dirname2 = dirname(__filename2);
@@ -822,6 +879,7 @@ var init_rules_loader = __esm({
       ];
       return cands.filter((c) => existsSync(c));
     })();
+    frozenJsonCache = /* @__PURE__ */ new Map();
     SCENARIO_LIST_KEYS = ["extra_command_patterns", "extra_injection_keywords", "extra_sensitive_paths"];
     EXTRA_CATEGORIES = {
       dangerous_commands: ["pattern"],
@@ -1904,6 +1962,7 @@ function userSkillsDir() {
   return resolve3(getDataRoot(), "agent_moss_skills");
 }
 function runtimeCustomSkillKeywords() {
+  if (isRuntimeConfigDisabled()) return {};
   try {
     const rt = runtimeConfigBridge.current?.loadRuntimeConfig?.();
     if (!rt) return {};
@@ -1921,6 +1980,7 @@ function runtimeCustomSkillKeywords() {
   }
 }
 function loadUserSkill(name) {
+  if (isRuntimeConfigDisabled()) return "";
   if (userSkillCache[name] !== void 0) return userSkillCache[name];
   try {
     const p = resolve3(userSkillsDir(), `${name}.md`);
@@ -1989,6 +2049,7 @@ var init_skill_loader = __esm({
     init_esm_shims();
     init_rules_loader();
     init_paths();
+    init_rules_mode();
     init_asset_dir();
     init_runtime_config_bridge();
     __filename3 = fileURLToPath3(import.meta.url);
@@ -2049,6 +2110,7 @@ __export(runtime_config_exports, {
   getEnabledScenarioExtensions: () => getEnabledScenarioExtensions,
   getEnvOverrides: () => getEnvOverrides,
   getProfileOrDetect: () => getProfileOrDetect,
+  getRuleSourceFingerprint: () => getRuleSourceFingerprint,
   getRuntimeConfigPath: () => getRuntimeConfigPath,
   getScenarioRules: () => getScenarioRules,
   hasRuntimeConfig: () => hasRuntimeConfig,
@@ -2083,7 +2145,22 @@ function getRuntimeConfigPath() {
   if (envPath) return envPath;
   return RUNTIME_CONFIG_PATH;
 }
+function getRuleSourceFingerprint() {
+  if (isRuntimeConfigDisabled()) return `mode:${getRulesMode()}`;
+  const p = getRuntimeConfigPath();
+  try {
+    const st = statSync2(p);
+    return `${p}|${st.mtimeMs}|${st.size}`;
+  } catch {
+    return `${p}|absent`;
+  }
+}
 function saveRuntimeConfig(config) {
+  if (isRuntimeConfigDisabled()) {
+    throw new Error(
+      `\u89C4\u5219\u6765\u6E90\u6A21\u5F0F\u4E3A ${getRulesMode()}\uFF08runtime \u914D\u7F6E\u5DF2\u7981\u7528\uFF09\uFF1A\u4FEE\u6539\u89C4\u5219\u4E0D\u4F1A\u751F\u6548\uFF0C\u8BF7\u5207\u6362\u89C4\u5219\u6765\u6E90\u6A21\u5F0F\u5E76\u91CD\u542F\u670D\u52A1\u3002`
+    );
+  }
   const p = getRuntimeConfigPath();
   const dir = p.substring(0, p.lastIndexOf("/"));
   if (dir && !existsSync5(dir)) mkdirSync(dir, { recursive: true });
@@ -2107,6 +2184,18 @@ function invalidateRuntimeConfigCache() {
   hasRuntimeConfigCache.clear();
 }
 function loadRuntimeConfig() {
+  if (isRuntimeConfigDisabled()) {
+    return {
+      version: 1,
+      layers: { ...DEFAULT_LAYERS },
+      L1_rules: {},
+      L2_rules: {},
+      L3_skills: {},
+      L2_2: {},
+      agent_rules: {},
+      scenario_rules: {}
+    };
+  }
   const p = getRuntimeConfigPath();
   if (!existsSync5(p)) {
     const seeded = mergeConfig({}, generateSourceDefaults());
@@ -2153,6 +2242,7 @@ function loadRuntimeConfig() {
 function isLayerEnabled(layerKey) {
   const disableKey = LAYER_DISABLE_ENV[layerKey];
   if (disableKey && process.env[disableKey] === "1") return false;
+  if (isRuntimeConfigDisabled()) return true;
   const runtime = loadRuntimeConfig();
   const layers = runtime.layers || {};
   if (layerKey in layers) return !!layers[layerKey];
@@ -2253,6 +2343,7 @@ function getEnabledL2SensitivePaths(runtime, osType) {
   });
 }
 function hasRuntimeConfig() {
+  if (isRuntimeConfigDisabled()) return false;
   const p = getRuntimeConfigPath();
   let key;
   try {
@@ -2261,8 +2352,8 @@ function hasRuntimeConfig() {
   } catch {
     return false;
   }
-  const cached = hasRuntimeConfigCache.get(key);
-  if (cached !== void 0) return cached;
+  const cached2 = hasRuntimeConfigCache.get(key);
+  if (cached2 !== void 0) return cached2;
   let ok = false;
   try {
     JSON.parse(readFileSync4(p, "utf-8"));
@@ -3142,6 +3233,11 @@ function deleteCustomRule(layer, category, ruleId) {
 }
 function addCustomSkill(skillId, category, keywords, content) {
   _validateSkillId(skillId);
+  if (isRuntimeConfigDisabled()) {
+    throw new Error(
+      `\u89C4\u5219\u6765\u6E90\u6A21\u5F0F\u4E3A ${getRulesMode()}\uFF08runtime \u914D\u7F6E\u5DF2\u7981\u7528\uFF09\uFF0C\u4E0D\u5141\u8BB8\u65B0\u589E\u81EA\u5B9A\u4E49 skill\u3002`
+    );
+  }
   const runtime = loadRuntimeConfig();
   const skillsDir = join3(getRuntimeConfigDir(), "agent_moss_skills");
   try {
@@ -3368,6 +3464,7 @@ var init_runtime_config = __esm({
     init_skill_loader();
     init_rules_loader();
     init_runtime_config_bridge();
+    init_rules_mode();
     __dirname4 = dirname3(fileURLToPath4(import.meta.url));
     ENV_RUNTIME_CONFIG_PATH = "AGENT_MOSS_RUNTIME_CONFIG_PATH";
     RUNTIME_CONFIG_DIR = runtimeDir();
@@ -3439,6 +3536,7 @@ __export(config_exports, {
   isPolicyGenEnabled: () => isPolicyGenEnabled,
   isPolicySaveEnabled: () => isPolicySaveEnabled,
   probeLLMConnection: () => probeLLMConnection,
+  reloadCustomRules: () => reloadCustomRules,
   updateLLMConfig: () => updateLLMConfig,
   userRuleVariantPattern: () => userRuleVariantPattern,
   wildcardToRegExp: () => wildcardToRegExp
@@ -3519,17 +3617,19 @@ function wildcardToRegExp(pattern) {
 }
 function loadCustomRules() {
   const rules = [];
-  try {
-    const raw = process.env.AGENT_MOSS_CUSTOM_RULES;
-    if (raw) {
-      const parsed = JSON.parse(raw);
-      if (Array.isArray(parsed)) {
-        for (const r of parsed) {
-          if (r && r.pattern && r.action) rules.push({ pattern: r.pattern, action: r.action, severity: r.severity || "high" });
+  if (!isBuiltinOnly()) {
+    try {
+      const raw = process.env.AGENT_MOSS_CUSTOM_RULES;
+      if (raw) {
+        const parsed = JSON.parse(raw);
+        if (Array.isArray(parsed)) {
+          for (const r of parsed) {
+            if (r && r.pattern && r.action) rules.push({ pattern: r.pattern, action: r.action, severity: r.severity || "high" });
+          }
         }
       }
+    } catch {
     }
-  } catch {
   }
   for (const rulesPath of USER_RULES_PATHS) {
     try {
@@ -3558,6 +3658,9 @@ function userRuleVariantPattern(pattern) {
   }
   return null;
 }
+function reloadCustomRules() {
+  customRules = loadCustomRules();
+}
 function getLLMConfig() {
   return llmConfig;
 }
@@ -3645,6 +3748,7 @@ function layerEnabledOrDefault(key) {
   }
 }
 function isBrainEnabled() {
+  if (isRuntimeConfigDisabled()) return false;
   return getAgentMossSetting("AGENT_MOSS_BRAIN_ENABLED", "") === "1";
 }
 function getAgentMossSetting(key, def = "") {
@@ -3686,6 +3790,7 @@ var init_config = __esm({
     init_esm_shims();
     init_paths();
     init_runtime_config();
+    init_rules_mode();
     __configModuleDir = (() => {
       try {
         return path2.dirname(fileURLToPath5(import.meta.url));
@@ -3742,7 +3847,9 @@ function resolveAgentsDir() {
 }
 function getAgentExtensions(agentId) {
   if (!agentId) return null;
-  if (cache.has(agentId)) return cache.get(agentId) ?? null;
+  const fp = getRuleSourceFingerprint();
+  const cached2 = cache.get(agentId);
+  if (cached2 && cached2.fp === fp) return cached2.ext;
   let ext = null;
   try {
     if (hasRuntimeConfig()) {
@@ -3754,7 +3861,7 @@ function getAgentExtensions(agentId) {
     const agentsDir = resolveAgentsDir();
     const rulesFile = resolve4(agentsDir, agentId, "rules.json");
     if (!existsSync6(rulesFile)) {
-      cache.set(agentId, null);
+      cache.set(agentId, { fp, ext: null });
       return null;
     }
     try {
@@ -3762,16 +3869,16 @@ function getAgentExtensions(agentId) {
       ext = JSON.parse(raw);
       if (!ext.agent_id) {
         console.warn(`[AgentMoss agents] rules.json \u7F3A\u5C11 agent_id \u5B57\u6BB5: ${rulesFile}`);
-        cache.set(agentId, null);
+        cache.set(agentId, { fp, ext: null });
         return null;
       }
     } catch (e) {
       console.error(`[AgentMoss agents] \u52A0\u8F7D agent ${agentId} rules.json \u5931\u8D25:`, e.message);
-      cache.set(agentId, null);
+      cache.set(agentId, { fp, ext: null });
       return null;
     }
   }
-  cache.set(agentId, ext);
+  cache.set(agentId, { fp, ext });
   console.error(
     `[AgentMoss agents] \u52A0\u8F7D agent ${agentId} \u5B9A\u5236\u89C4\u5219: ${ext.extra_command_patterns?.length ?? 0} cmd patterns, ${ext.extra_injection_keywords?.length ?? 0} injection keywords, ${ext.extra_sensitive_paths?.length ?? 0} sensitive paths, ${ext.builtin_safe_skills?.length ?? 0} builtin safe skills, ${ext.builtin_safe_action_types?.length ?? 0} builtin safe action types`
   );
@@ -3817,7 +3924,9 @@ function resolveScenariosDir() {
 }
 function getScenarioExtensions(scenarioId) {
   if (!scenarioId) return null;
-  if (cache2.has(scenarioId)) return cache2.get(scenarioId) ?? null;
+  const fp = getRuleSourceFingerprint();
+  const cached2 = cache2.get(scenarioId);
+  if (cached2 && cached2.fp === fp) return cached2.ext;
   let ext = null;
   let overrideHit = null;
   try {
@@ -3841,7 +3950,7 @@ function getScenarioExtensions(scenarioId) {
       );
     }
     if (!existsSync7(rulesFile)) {
-      cache2.set(scenarioId, null);
+      cache2.set(scenarioId, { fp, ext: null });
       return null;
     }
     try {
@@ -3850,7 +3959,7 @@ function getScenarioExtensions(scenarioId) {
       const id = data.scenario_id || data.agent_id || "";
       if (!id) {
         console.warn(`[AgentMoss scenarios] rules.json \u7F3A\u5C11 scenario_id \u5B57\u6BB5: ${rulesFile}`);
-        cache2.set(scenarioId, null);
+        cache2.set(scenarioId, { fp, ext: null });
         return null;
       }
       ext = {
@@ -3865,11 +3974,11 @@ function getScenarioExtensions(scenarioId) {
       };
     } catch (e) {
       console.error(`[AgentMoss scenarios] \u52A0\u8F7D\u573A\u666F ${scenarioId} rules.json \u5931\u8D25:`, e.message);
-      cache2.set(scenarioId, null);
+      cache2.set(scenarioId, { fp, ext: null });
       return null;
     }
   }
-  cache2.set(scenarioId, ext);
+  cache2.set(scenarioId, { fp, ext });
   console.error(
     `[AgentMoss scenarios] \u52A0\u8F7D\u573A\u666F ${scenarioId} \u5B9A\u5236\u89C4\u5219: ${ext.extra_command_patterns?.length ?? 0} cmd patterns, ${ext.extra_injection_keywords?.length ?? 0} injection keywords, ${ext.extra_sensitive_paths?.length ?? 0} sensitive paths`
   );
@@ -7223,10 +7332,10 @@ async function runLLMAnalysis(input, previous) {
   const config = input.llmConfig?.apiKey ? { ...globalConfig, ...input.llmConfig } : globalConfig;
   const rawDetail = input.aNext.actionDetail.replace(/^terminal-\w+:\s*command=([^,]+).*/, "$1").trim();
   const cacheKey = `${input.aNext.actionType}:${rawDetail || input.aNext.actionDetail}`;
-  const cached = llmCache.get(cacheKey);
-  if (cached) {
+  const cached2 = llmCache.get(cacheKey);
+  if (cached2) {
     console.log("[AgentMoss] LLM cache hit");
-    return cached;
+    return cached2;
   }
   const matchedSkills = matchSkills(input.aNext.actionType, input.aNext.actionDetail, input.reason);
   const templates = loadTemplates();
@@ -10814,12 +10923,12 @@ async function analyzeInner(input, mossLog) {
   }
   const cache3 = getDefaultCache();
   mossLog.startStep("step2_cache_lookup");
-  const cached = cache3.get(input.sessionId, input.promptSession);
-  if (cached !== null) {
+  const cached2 = cache3.get(input.sessionId, input.promptSession);
+  if (cached2 !== null) {
     mossLog.endStep("step2_cache_lookup", "\u7F13\u5B58\u547D\u4E2D");
-    savePolicyToFile(input.sessionId, cached);
-    const res = allowResult(cached, judgment);
-    mossLog.logResult("Allow", res.reason, cached);
+    savePolicyToFile(input.sessionId, cached2);
+    const res = allowResult(cached2, judgment);
+    mossLog.logResult("Allow", res.reason, cached2);
     return res;
   }
   if (!isPolicyGenEnabled()) {
@@ -11578,6 +11687,7 @@ init_runtime_config();
 init_token_stats();
 init_rules_loader();
 init_asset_dir();
+init_rules_mode();
 import { Hono } from "hono";
 import { readFileSync as readFileSync18, existsSync as existsSync18, unlinkSync as unlinkSync4 } from "fs";
 import { join as join14, dirname as dirname12 } from "path";
@@ -11603,9 +11713,23 @@ function authMiddleware() {
     await next();
   };
 }
+function displayRuntimeConfig() {
+  return isRuntimeConfigDisabled() ? generateSourceDefaults() : loadRuntimeConfig();
+}
+function builtinOnlyReadOnlyMiddleware() {
+  return async (c, next) => {
+    if (isRuntimeConfigDisabled() && !["GET", "HEAD", "OPTIONS"].includes(c.req.method)) {
+      return c.json({
+        detail: `\u89C4\u5219\u6765\u6E90\u6A21\u5F0F\u4E3A ${getRulesMode()}\uFF08runtime \u914D\u7F6E\u5DF2\u7981\u7528\uFF09\uFF1AConsole \u53EA\u8BFB\uFF0C\u4FEE\u6539\u4E0D\u4F1A\u4FDD\u5B58\u3002\u8BF7\u5207\u6362\u89C4\u5219\u6765\u6E90\u6A21\u5F0F\u5E76\u91CD\u542F\u670D\u52A1\u540E\u518D\u6539\u89C4\u5219\u3002`
+      }, 403);
+    }
+    await next();
+  };
+}
 function createConsoleRouter() {
   const console2 = new Hono();
   console2.use("/api/*", authMiddleware());
+  console2.use("/api/*", builtinOnlyReadOnlyMiddleware());
   const serveIndex = (c) => {
     const indexFile = join14(STATIC_DIR, "index.html");
     if (existsSync18(indexFile)) {
@@ -11616,8 +11740,8 @@ function createConsoleRouter() {
   console2.get("/", serveIndex);
   console2.get("", serveIndex);
   console2.get("/api/layers", (c) => {
-    const rc = loadRuntimeConfig();
-    return c.json({ layers: rc.layers, env_overrides: getEnvOverrides() });
+    const rc = displayRuntimeConfig();
+    return c.json({ layers: rc.layers, env_overrides: getEnvOverrides(), builtin_only: isBuiltinOnly(), rules_mode: getRulesMode() });
   });
   console2.put("/api/layers", async (c) => {
     const body = await c.req.json();
@@ -11652,7 +11776,7 @@ function createConsoleRouter() {
     const rules = mc.rules || [];
     let catEnabled = true;
     try {
-      const rt = loadRuntimeConfig();
+      const rt = displayRuntimeConfig();
       catEnabled = rt.L2_2?.ltl_rules?.category_enabled !== false;
     } catch {
     }
@@ -11708,7 +11832,7 @@ function createConsoleRouter() {
     return rc;
   }
   console2.get("/api/rules", (c) => {
-    const rc = loadRuntimeConfig();
+    const rc = displayRuntimeConfig();
     const layer = c.req.query("layer");
     const category = c.req.query("category");
     const out = {};
@@ -11773,8 +11897,8 @@ function createConsoleRouter() {
     return c.json(withL22View(rc));
   });
   console2.get("/api/skills", (c) => {
-    const rc = loadRuntimeConfig();
-    return c.json(rc.L3_skills);
+    const rc = displayRuntimeConfig();
+    return c.json(rc.L3_skills || {});
   });
   console2.put("/api/skills/enabled", async (c) => {
     const b = await c.req.json();
@@ -11806,7 +11930,10 @@ function createConsoleRouter() {
     }
     const userPath = join14(dirname12(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
     const builtinDir = resolveAssetDir(__dirname10, "skills");
-    const candidates = [userPath, builtinDir ? join14(builtinDir, `${skillId}.md`) : ""].filter(Boolean);
+    const candidates = [
+      ...isRuntimeConfigDisabled() ? [] : [userPath],
+      builtinDir ? join14(builtinDir, `${skillId}.md`) : ""
+    ].filter(Boolean);
     for (const p of candidates) {
       if (existsSync18(p)) {
         return c.json({ skill_id: skillId, path: p, content: readFileSync18(p, "utf-8") });
@@ -11815,7 +11942,7 @@ function createConsoleRouter() {
     return c.json({ detail: `skill ${skillId} \u4E0D\u5B58\u5728` }, 404);
   });
   console2.get("/api/agents", (c) => {
-    const rc = loadRuntimeConfig();
+    const rc = displayRuntimeConfig();
     return c.json({ agents: getAgentRules(rc) });
   });
   console2.put("/api/agents/rules/enabled", async (c) => {
@@ -11854,7 +11981,7 @@ function createConsoleRouter() {
   });
   const enabledScenarioIds = () => (process.env.AGENT_MOSS_SCENARIO || "").split(",").map((s) => s.trim()).filter(Boolean);
   console2.get("/api/scenarios", (c) => {
-    const all = getScenarioRules(loadRuntimeConfig());
+    const all = getScenarioRules(displayRuntimeConfig());
     const enabled = enabledScenarioIds();
     if (!enabled.length) return c.json({ scenarios: {}, enabled: [] });
     const shown = {};
@@ -11896,8 +12023,8 @@ function createConsoleRouter() {
     return c.json({ scenarios: getScenarioRules(rc), enabled: enabledScenarioIds() });
   });
   console2.get("/api/config", (c) => {
-    const rc = loadRuntimeConfig();
-    return c.json({ ...rc, L2_2: getL22View() });
+    const rc = displayRuntimeConfig();
+    return c.json({ ...rc, L2_2: getL22View(), builtin_only: isBuiltinOnly(), rules_mode: getRulesMode() });
   });
   console2.get("/api/env-overrides", (c) => {
     return c.json({ overrides: getEnvOverrides() });
@@ -11935,37 +12062,58 @@ function createConsoleRouter() {
 
 // src/server.ts
 init_runtime_config();
+init_rules_mode();
 init_rules_loader();
 function logDeploymentSelfCheck() {
   try {
+    const mode = getRulesMode();
+    const builtinOnly = isBuiltinOnly();
+    const runtimeDisabled = isRuntimeConfigDisabled();
     console.log("================ AgentMoss \u90E8\u7F72\u81EA\u68C0 ================");
-    console.log(`runtime \u914D\u7F6E: ${getRuntimeConfigPath()}`);
-    const layerKeys = ["L1_heuristic", "L2_logic_rules", "L3_llm_analysis", "agent_rules_enabled", "scenario_rules_enabled"];
-    console.log("\u5C42\u7EA7\u5F00\u5173: " + layerKeys.map((k) => `${k}=${isLayerEnabled(k) ? "on" : "OFF"}`).join(" "));
-    try {
-      const dirs = rulesDirs().filter((d) => existsSync19(d));
-      if (dirs.length > 0) {
-        console.log(`\u89C4\u5219\u76EE\u5F55: ${dirs.join(", ")}\uFF08\u53EA\u8BFB\u5176\u4E2D ${OVERRIDE_FILENAME} / ${EXTRA_FILENAME}\uFF09`);
-      }
-      const loaded = ruleFilesLoaded();
-      if (loaded.length > 0) {
-        const ov = loadOverrideRules();
-        const ex = loadExtraRules();
-        console.error(`\u26A0\uFE0F  \u5DF2\u4ECE\u89C4\u5219\u76EE\u5F55\u52A0\u8F7D ${loaded.length} \u4E2A\u6587\u4EF6\uFF08\u6574\u4EFD\u66FF\u6362 / \u8FFD\u52A0\uFF0C\u5185\u7F6E\u66F4\u65B0\u4E0D\u4F1A\u53CD\u6620\u5230\u5B83\u4EEC\u4E0A\u9762\uFF09:`);
-        for (const f of loaded) console.error(`      ${f}`);
-        const ovs = Object.entries(ov).sort().map(([k, v]) => `${k}\xD7${v.length}`).join(", ");
-        if (ovs) console.error(`      \u8986\u76D6\u7C7B\u522B: ${ovs}\uFF08**\u6574\u4EFD\u66FF\u6362**\uFF1A\u672A\u5217\u51FA\u7684\u5185\u7F6E\u89C4\u5219\u4E0D\u518D\u751F\u6548\uFF09`);
-        const exs = Object.entries(ex).sort().map(([k, v]) => `${k}\xD7${v.length}`).join(", ");
-        if (exs) console.log(`      \u8FFD\u52A0\u7C7B\u522B: ${exs}\uFF08\u5185\u7F6E\u4FDD\u7559\uFF0C\u8FFD\u52A0\u5728\u5176\u540E\u4E00\u8D77\u5224\u5B9A\uFF09`);
-      }
-      const ignored = ignoredRuleFiles();
-      if (ignored.length > 0) {
+    if (runtimeDisabled) {
+      console.log(`runtime \u914D\u7F6E: ${getRuntimeConfigPath()}\uFF08**\u5DF2\u5FFD\u7565**\uFF1A\u89C4\u5219\u6765\u6E90\u6A21\u5F0F=${mode}\uFF09`);
+      if (builtinOnly) {
         console.error(
-          `\u26A0\uFE0F  \u89C4\u5219\u76EE\u5F55\u91CC\u6709 ${ignored.length} \u4E2A json **\u4E0D\u4F1A\u88AB\u8BFB\u53D6**\uFF08\u53EA\u8BA4 ${OVERRIDE_FILENAME} / ${EXTRA_FILENAME}\uFF09:`
+          "\u89C4\u5219\u6765\u6E90: **\u4EC5\u5185\u7F6E** \u2014\u2014 \u4E0D\u8BFB runtime \u914D\u7F6E / Console \u81EA\u5B9A\u4E49 / \u89C4\u5219\u76EE\u5F55 / AGENT_MOSS_CUSTOM_RULES\uFF1B\u4E0D seed\u3001\u4E0D merge\u3001\u4E0D\u5199\u56DE\u3002"
         );
-        for (const f of ignored) console.error(`      ${f}`);
+      } else {
+        console.error(
+          "\u89C4\u5219\u6765\u6E90: **\u51B7\u542F\u52A8\uFF08cold\uFF09** \u2014\u2014 \u542F\u52A8\u65F6\u8BFB\u53D6\u5185\u7F6E\u89C4\u5219 + \u89C4\u5219\u76EE\u5F55 / AGENT_MOSS_CUSTOM_RULES / \u573A\u666F\uFF0C\u4E4B\u540E\u51BB\u7ED3\uFF1B\u4E0D\u8BFB runtime \u914D\u7F6E / Console\uFF0C\u4E0D seed\u3001\u4E0D merge\u3001\u4E0D\u5199\u56DE\u3002"
+        );
+        console.error("\u89C4\u5219\u76EE\u5F55\u5185\u5BB9\u6539\u52A8\u9700\u91CD\u542F\u670D\u52A1\u624D\u751F\u6548\u3002");
+      }
+      console.error("Console: \u53EA\u8BFB\uFF08\u89C4\u5219\u5199\u63A5\u53E3\u8FD4\u56DE 403\uFF09\uFF1B\u4FEE\u6539\u89C4\u5219\u9700\u91CD\u542F\u670D\u52A1\u5E76\u5207\u6362\u89C4\u5219\u6765\u6E90\u6A21\u5F0F\u3002");
+    } else {
+      console.log(`runtime \u914D\u7F6E: ${getRuntimeConfigPath()}`);
+    }
+    const layerKeys = ["L1_heuristic", "L2_logic_rules", "L3_llm_analysis", "agent_rules_enabled", "scenario_rules_enabled"];
+    console.log("\u5C42\u7EA7\u5F00\u5173: " + layerKeys.map((k) => `${k}=${isLayerEnabled(k) ? "on" : "OFF"}`).join(" "));
+    if (!builtinOnly) {
+      try {
+        const dirs = rulesDirs().filter((d) => existsSync19(d));
+        if (dirs.length > 0) {
+          console.log(`\u89C4\u5219\u76EE\u5F55: ${dirs.join(", ")}\uFF08\u53EA\u8BFB\u5176\u4E2D ${OVERRIDE_FILENAME} / ${EXTRA_FILENAME}\uFF09`);
+        }
+        const loaded = ruleFilesLoaded();
+        if (loaded.length > 0) {
+          const ov = loadOverrideRules();
+          const ex = loadExtraRules();
+          console.error(`\u26A0\uFE0F  \u5DF2\u4ECE\u89C4\u5219\u76EE\u5F55\u52A0\u8F7D ${loaded.length} \u4E2A\u6587\u4EF6\uFF08\u6574\u4EFD\u66FF\u6362 / \u8FFD\u52A0\uFF0C\u5185\u7F6E\u66F4\u65B0\u4E0D\u4F1A\u53CD\u6620\u5230\u5B83\u4EEC\u4E0A\u9762\uFF09:`);
+          for (const f of loaded) console.error(`      ${f}`);
+          const ovs = Object.entries(ov).sort().map(([k, v]) => `${k}\xD7${v.length}`).join(", ");
+          if (ovs) console.error(`      \u8986\u76D6\u7C7B\u522B: ${ovs}\uFF08**\u6574\u4EFD\u66FF\u6362**\uFF1A\u672A\u5217\u51FA\u7684\u5185\u7F6E\u89C4\u5219\u4E0D\u518D\u751F\u6548\uFF09`);
+          const exs = Object.entries(ex).sort().map(([k, v]) => `${k}\xD7${v.length}`).join(", ");
+          if (exs) console.log(`      \u8FFD\u52A0\u7C7B\u522B: ${exs}\uFF08\u5185\u7F6E\u4FDD\u7559\uFF0C\u8FFD\u52A0\u5728\u5176\u540E\u4E00\u8D77\u5224\u5B9A\uFF09`);
+        }
+        const ignored = ignoredRuleFiles();
+        if (ignored.length > 0) {
+          console.error(
+            `\u26A0\uFE0F  \u89C4\u5219\u76EE\u5F55\u91CC\u6709 ${ignored.length} \u4E2A json **\u4E0D\u4F1A\u88AB\u8BFB\u53D6**\uFF08\u53EA\u8BA4 ${OVERRIDE_FILENAME} / ${EXTRA_FILENAME}\uFF09:`
+          );
+          for (const f of ignored) console.error(`      ${f}`);
+        }
+      } catch {
       }
-    } catch {
     }
     const scenarioRaw = (process.env.AGENT_MOSS_SCENARIO || "").trim();
     if (scenarioRaw) {

package/dist/static/index.html

@@ -201,7 +201,10 @@ body {
 .ag-link:hover { text-decoration: underline; }
 
 /* Toast */
-.ag-toast { position: fixed; top: 20px; right: 20px; padding: 12px 20px; border-radius: 8px; font-size: 13px; z-index: 200; box-shadow: 0 4px 12px rgba(0,0,0,.15); animation: ag-slide-in .3s ease; }
+.ag-toast { position: fixed; top: 20px; right: 20px; padding: 12px 20px; border-radius: 8px; font-size: 13px; z-index: 10000; box-shadow: 0 4px 12px rgba(0,0,0,.15); animation: ag-slide-in .3s ease; }
+/* 仅内置规则模式的顶部横幅是 sticky + z-index 9999；toast 必须在其之上，
+   并下移一个横幅高度，否则错误提示会被横幅挡住。 */
+body.builtin-only-mode .ag-toast { top: calc(20px + var(--am-builtin-banner-height, 48px)); }
 .ag-toast-success { background: var(--ag-green); color: #fff; }
 .ag-toast-error { background: var(--ag-red); color: #fff; }
 .ag-toast-warning { background: var(--ag-orange); color: #fff; }
@@ -246,6 +249,10 @@ body {
 </style>
 </head>
 <body>
+<div id="builtin-only-banner" style="display:none;background:#b45309;color:#fff;padding:6px 14px;font-size:12px;line-height:1.5;text-align:center;position:sticky;top:0;z-index:9999">
+  仅内置规则模式：已忽略 runtime 配置与 Console 自定义，修改规则不会生效。需重启服务并移除 <code>AGENT_MOSS_RULES_BUILTIN_ONLY</code> 后再改规则。<br>
+  Built-in rules only: runtime config and Console changes are ignored. Restart without <code>AGENT_MOSS_RULES_BUILTIN_ONLY</code> to edit rules.
+</div>
 <div class="ag-wrap">
   <div class="ag-tabs" id="tabs">
     <div class="ag-tab active" data-page="overview">概览</div>
@@ -553,6 +560,24 @@ function agPrompt(title, opts = {}) {
 // ===== Pages =====
 async function refreshConfig() {
   state.config = await api('config');
+  // cold / builtin 模式：顶部显示只读横幅（写接口由后端统一 403）
+  const rulesMode = state.config.rules_mode || (state.config.builtin_only ? 'builtin' : 'hot');
+  if (rulesMode === 'cold' || rulesMode === 'builtin') {
+    const banner = el('builtin-only-banner');
+    if (banner) {
+      banner.innerHTML = rulesMode === 'cold'
+        ? '冷启动规则模式：runtime 配置与 Console 自定义已忽略；规则目录仅在启动时读取一次，修改规则目录需重启服务。<br>'
+          + 'Cold-start rules mode: runtime config and Console changes are ignored. Rule directories are loaded once at startup; restart to apply changes.'
+        : '仅内置规则模式：已忽略 runtime 配置与 Console 自定义，修改规则不会生效。需重启服务并移除 <code>AGENT_MOSS_RULES_BUILTIN_ONLY</code> 后再改规则。<br>'
+          + 'Built-in rules only: runtime config and Console changes are ignored. Restart without <code>AGENT_MOSS_RULES_BUILTIN_ONLY</code> to edit rules.';
+      banner.style.display = 'block';
+      // 记录横幅实际高度（窄屏会换行），让 toast 显示在横幅下方而不是被挡住
+      document.documentElement.style.setProperty(
+        '--am-builtin-banner-height', banner.offsetHeight + 'px'
+      );
+      document.body.classList.add('builtin-only-mode');
+    }
+  }
   state.envOverrides = await loadEnvOverrides();
   state.agentRules = await api('agents');
   // 场景定制规则：后端按 AGENT_MOSS_SCENARIO env 过滤（无 env 返回空 → 场景页显示"未启用"提示）

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kenhkl/agent-moss",
-  "version": "0.16.12",
+  "version": "0.16.13",
   "description": "Multi-layer security analysis engine for AI agents (TypeScript)",
   "type": "module",
   "main": "dist/server.js",