@kenhkl/agent-moss 0.16.13 → 0.16.14

package/dist/cli.js

@@ -22,103 +22,14 @@ var init_esm_shims = __esm({
   }
 });
 
-// src/package-json.ts
-import { createRequire } from "module";
-var require2, pkg, version;
-var init_package_json = __esm({
-  "src/package-json.ts"() {
-    "use strict";
-    init_esm_shims();
-    require2 = createRequire(import.meta.url);
-    pkg = require2("../package.json");
-    version = pkg.version;
-  }
-});
-
-// src/models.ts
-import { z } from "zod";
-var ActionItemSchema, PromptTurnSchema, AnalyzeRequestSchema, AnalyzeResponseSchema, HealthResponseSchema, ReviewRequestSchema, ReviewResponseSchema;
-var init_models = __esm({
-  "src/models.ts"() {
-    "use strict";
-    init_esm_shims();
-    init_package_json();
-    ActionItemSchema = z.object({
-      action_type: z.string().describe("Action type, e.g. bash, file_read, file_write"),
-      action_detail: z.string().describe("Action detail / command content"),
-      // 工具返回给 agent 的内容。仅 L2 的授权（consent）判定用：判断「用户是否已授权」
-      // 看的是 ask_user_question 的**回答**，不是提问正文。历史 bug：模型里没有这个字段、
-      // 路由也没透传，TS 的授权判定退化成「提问正文非空」，等于问过任何问题即已授权。
-      output: z.string().optional().describe("Tool result / user answer (needed by L2 consent checks)")
-    });
-    PromptTurnSchema = z.object({
-      text: z.string().default("").describe("User prompt text at this turn"),
-      actions: z.array(ActionItemSchema).default([]).describe("Actions triggered by this prompt, in order, until the next prompt")
-    });
-    AnalyzeRequestSchema = z.object({
-      session_id: z.string().describe("Session / agent unique identifier"),
-      prompt_session: z.string().default("").describe("User original prompt (most recent user message; backward compat)"),
-      prompt_history: z.array(PromptTurnSchema).default([]).describe("Full interleaved prompt history (ordered turns, each with its triggered actions). Optional; empty = fall back to prompt_session only."),
-      action_history: z.array(ActionItemSchema).default([]).describe("Historical action sequence"),
-      session_history: z.array(z.object({
-        session_id: z.string(),
-        action_history: z.array(ActionItemSchema).default([])
-      })).default([]).describe("Multi-session historical actions (optional): for L2.2 formal engine cross-session combo-chain / sensitive-data-flow verification. Provided by caller (incl. future agentgate)."),
-      a_next: ActionItemSchema.describe("Next action to be executed"),
-      reason: z.string().default("").describe("Reason for executing this action"),
-      os_type: z.string().default("").describe("OS type: 'linux', 'windows', or empty for auto-detect"),
-      cwd: z.string().default("").describe("Current working directory"),
-      agent_id: z.string().default("").describe("Caller agent identifier, e.g. 'xiaoo' / 'opencode' / 'opendesk'. Empty = generic mode (no agent-specific rules)."),
-      metadata: z.record(z.unknown()).optional().describe("Extended metadata")
-    });
-    AnalyzeResponseSchema = z.object({
-      decision: z.enum(["Allow", "Deny"]).describe("Allow or Deny"),
-      reason: z.string().describe("Decision reason"),
-      risk_level: z.enum(["low", "medium", "high", "critical"]).default("low"),
-      risk_type: z.string().default(""),
-      violated_layers: z.array(z.string()).default([]),
-      policy: z.string().default(""),
-      violated_policy: z.string().default(""),
-      confidence: z.number().int().min(0).max(100).default(100),
-      analysis_duration_ms: z.number().default(0),
-      // 组合攻击链反例路径：每步 [session_id, seq, stage, timestamp]，含真实发生时间
-      violation_chain: z.array(z.array(z.union([z.string(), z.number()]).nullable())).default([])
-    });
-    HealthResponseSchema = z.object({
-      status: z.string().default("healthy"),
-      version: z.string().default(version),
-      // 归属实例标识：值来自 env AGENT_MOSS_INSTANCE（spawn/systemd 注入），默认空串。
-      // 多个 agentmoss 同机并存时，调用方按 instance 过滤避免连到别人的进程。
-      // 空=未配置（独立部署或旧版），调用方可选择兼容或严格过滤。
-      instance: z.string().default("")
-    });
-    ReviewRequestSchema = z.object({
-      agent_id: z.string().default("").describe("\u76EE\u6807 agent \u6807\u8BC6\uFF08\u51B3\u5B9A\u72B6\u6001\u5E93\u5206\u6876\uFF09"),
-      db_path: z.string().default("").describe("AgentGate \u672C\u5730\u5B58\u50A8\u8DEF\u5F84\uFF08SQLite \u6587\u4EF6 \u6216 tool_calls JSON \u76EE\u5F55\uFF09\uFF1B\u4E3A\u7A7A\u5219\u7528 sessions"),
-      sessions: z.array(z.object({
-        session_id: z.string(),
-        action_history: z.array(ActionItemSchema).default([])
-      })).default([]).describe("\u591A session \u5386\u53F2\u52A8\u4F5C\uFF08\u66FF\u4EE3/\u515C\u5E95 db_path\uFF09"),
-      a_next: ActionItemSchema.optional().describe("\u53EF\u9009\uFF1Aseed \u540E\u8FDE\u540C\u5F53\u524D\u52A8\u4F5C\u4E00\u8D77\u5224\u5B9A"),
-      is_error: z.boolean().default(false).describe("\u5F53\u524D\u52A8\u4F5C\u6267\u884C\u662F\u5426\u5931\u8D25"),
-      output_pending: z.boolean().default(false).describe("\u8FD4\u56DE\u524D\u5E8F\u94FE\u6E05\u5355 pending_prefixes")
-    });
-    ReviewResponseSchema = z.object({
-      agent_id: z.string().default(""),
-      seeded_nodes: z.number().default(0),
-      verified: z.boolean().default(true),
-      violations: z.array(z.record(z.unknown())).default([]),
-      pending_prefixes: z.array(z.record(z.unknown())).default([]),
-      state_nodes: z.number().default(0),
-      discovered_patterns: z.array(z.record(z.unknown())).default([]).describe("\u6570\u636E\u9A71\u52A8\u53D1\u73B0\uFF1A\u8DE8 session \u9891\u7E41\u5371\u9669\u7EC4\u5408\uFF08\u9884\u7F6E\u94FE\u76F2\u533A\uFF0CPatternMiner\uFF09")
-    });
-  }
-});
-
 // src/infra/paths.ts
 import { join } from "path";
 import { homedir } from "os";
 import { readFileSync } from "fs";
+function getRulesRoot() {
+  const raw = (process.env[ENV_RULES_ROOT] ?? "").trim();
+  return raw ? raw : null;
+}
 function isRoot() {
   const getuid = process.getuid;
   return typeof getuid === "function" && getuid() === 0;
@@ -188,7 +99,7 @@ function getTokenStatsPath() {
   }
   return join(getDataRoot(), "agent_moss_token_stats.json");
 }
-var ENV_DATA_ROOT, ENV_INSTANCE, DEFAULT_DATA_ROOT;
+var ENV_DATA_ROOT, ENV_INSTANCE, DEFAULT_DATA_ROOT, ENV_RULES_ROOT;
 var init_paths = __esm({
   "src/infra/paths.ts"() {
     "use strict";
@@ -196,367 +107,110 @@ var init_paths = __esm({
     ENV_DATA_ROOT = "AGENT_MOSS_DATA_DIR";
     ENV_INSTANCE = "AGENT_MOSS_INSTANCE";
     DEFAULT_DATA_ROOT = join(homedir(), ".config", "agentmoss");
+    ENV_RULES_ROOT = "AGENT_MOSS_RULES_ROOT";
   }
 });
 
-// src/engine/shell-split.ts
-function hasCommandSubstitution(text) {
-  return CMD_SUBSTITUTION.test(text);
+// src/infra/rules-mode.ts
+function truthy(name) {
+  return TRUTHY.has((process.env[name] || "").trim().toLowerCase());
 }
-function splitCommandSegments(command) {
-  const segments = [];
-  let cur = "";
-  let quote = null;
-  for (let i = 0; i < command.length; i++) {
-    const ch = command[i];
-    if (quote) {
-      cur += ch;
-      if (ch === quote) quote = null;
-      continue;
-    }
-    if (ch === "'" || ch === '"') {
-      quote = ch;
-      cur += ch;
-      continue;
-    }
-    if (/\||&|;|\n/.test(ch)) {
-      segments.push(cur);
-      segments.push(ch);
-      cur = "";
-      continue;
+function getRulesMode() {
+  if (cached !== null) return cached;
+  const raw = (process.env[ENV_RULES_MODE] || "").trim().toLowerCase();
+  if (raw) {
+    if (VALID_MODES.has(raw)) {
+      cached = raw;
+    } else {
+      console.error(
+        `[AgentMoss] ${ENV_RULES_MODE}=${JSON.stringify(raw)} \u975E\u6CD5\uFF08\u53EA\u652F\u6301 hot / cold / builtin\uFF09\uFF1B\u4E3A\u5B89\u5168\u8D77\u89C1\u6309 builtin\uFF08\u4EC5\u5185\u7F6E\u89C4\u5219\uFF09\u5904\u7406`
+      );
+      cached = "builtin";
     }
-    cur += ch;
+    return cached;
   }
-  if (cur) segments.push(cur);
-  return segments.map((s) => s.trim()).filter((s) => s.length > 0 && !/^(?:\|\||&&|[|;&])$/.test(s));
+  if (truthy(ENV_RULES_BUILTIN_ONLY)) cached = "builtin";
+  else if (truthy(ENV_DISABLE_RULE_HOT_RELOAD)) cached = "cold";
+  else cached = "hot";
+  return cached;
 }
-function extractFirstCommand(command) {
-  const segments = splitCommandSegments(command);
-  return segments.length ? segments[0] : "";
+function isHotReloadEnabled() {
+  return getRulesMode() === "hot";
 }
-var CMD_SUBSTITUTION;
-var init_shell_split = __esm({
-  "src/engine/shell-split.ts"() {
+function isRuntimeConfigDisabled() {
+  return getRulesMode() !== "hot";
+}
+function isBuiltinOnly() {
+  return getRulesMode() === "builtin";
+}
+var ENV_RULES_MODE, ENV_RULES_BUILTIN_ONLY, ENV_DISABLE_RULE_HOT_RELOAD, TRUTHY, VALID_MODES, cached;
+var init_rules_mode = __esm({
+  "src/infra/rules-mode.ts"() {
     "use strict";
     init_esm_shims();
-    CMD_SUBSTITUTION = /\$\(|`|</;
+    ENV_RULES_MODE = "AGENT_MOSS_RULES_MODE";
+    ENV_RULES_BUILTIN_ONLY = "AGENT_MOSS_RULES_BUILTIN_ONLY";
+    ENV_DISABLE_RULE_HOT_RELOAD = "AGENT_MOSS_DISABLE_RULE_HOT_RELOAD";
+    TRUTHY = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
+    VALID_MODES = /* @__PURE__ */ new Set(["hot", "cold", "builtin"]);
+    cached = null;
   }
 });
 
-// src/engine/inline-analyzer.ts
-function isLiteralTextCommand(command) {
-  const segments = splitCommandSegments(command);
-  if (segments.length === 0 || segments.some((s) => !ECHO_SEG_RE.test(s))) return false;
-  if (command.includes(">")) {
-    let d = command.replace(/<=>|>=|<=|<>|=>/g, " ");
-    d = d.replace(/(?:2|&|1)?\s*>\s*\/dev\/null\b/g, "");
-    d = d.replace(new RegExp(`>{1,2}\\s*(['"])([~./][^'"]+)\\1`, "g"), (_m, _q, p) => ">" + p);
-    d = d.replace(/'[^']*'|"[^"]*"/g, "");
-    if (/>{1,2}\s*(?!&)\S/.test(d)) {
-      return false;
-    }
-  }
-  if (/\|\s*\b(?:tee|tac|install)\b/i.test(command)) {
-    return false;
-  }
-  return true;
+// src/infra/runtime-config-bridge.ts
+function registerRuntimeConfigBridge(bridge) {
+  runtimeConfigBridge.current = bridge;
 }
-function extractInlineCode(command) {
-  const parts = [];
-  let m;
-  INLINE_CODE_RE.lastIndex = 0;
-  while ((m = INLINE_CODE_RE.exec(command)) !== null) {
-    const code = m[1] ?? m[2];
-    if (code) parts.push(code);
-  }
-  ECHO_STRING_RE.lastIndex = 0;
-  while ((m = ECHO_STRING_RE.exec(command)) !== null) {
-    const code = m[1] ?? m[2];
-    if (code) parts.push(code);
+var runtimeConfigBridge;
+var init_runtime_config_bridge = __esm({
+  "src/infra/runtime-config-bridge.ts"() {
+    "use strict";
+    init_esm_shims();
+    runtimeConfigBridge = { current: null };
   }
-  return parts.join("\n");
+});
+
+// src/infra/rules-loader.ts
+import { readFileSync as readFileSync2, existsSync, readdirSync, statSync } from "fs";
+import { resolve, dirname, join as join2 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+function dataRootDir() {
+  return getDataRoot();
 }
-function hasWriteExecChain(command) {
-  return WRITE_EXEC_CHAIN_PATTERNS.some((p) => {
-    p.lastIndex = 0;
-    return p.test(command);
-  });
+function parseDirEnv(envName) {
+  const raw = (process.env[envName] || "").trim();
+  if (!raw) return [];
+  return raw.split(/[,;]/).map((s) => s.trim()).filter(Boolean).map((s) => resolve(s));
 }
-function hasDirTraversal(code) {
-  const lower = code.toLowerCase();
-  return DIR_TRAVERSAL_KEYWORDS.some((kw) => lower.includes(kw));
+function rulesDirs() {
+  if (isBuiltinOnly()) return [];
+  const dirs = [];
+  for (const env of RULES_DIR_ENVS) dirs.push(...parseDirEnv(env));
+  dirs.push(resolve(dataRootDir(), "rules"));
+  return [...new Set(dirs)];
 }
-function hasReadWriteKeyword(code) {
-  const lower = code.toLowerCase();
-  return READ_WRITE_KEYWORDS.some((kw) => lower.includes(kw));
+function rulesDirCands() {
+  const root = getRulesRoot();
+  if (root) return [join2(root, "rules")];
+  const cands = [
+    // 注：`<data_root>/rules/` 不再是"按内置文件名覆盖"的查找位 —— 2026-10 起
+    // 规则目录只认 override.json / extra.json（见 rulesDirs()）。
+    // dist: __dirname=dist/ → dist/rules；__dirname=dist/engine/ → dist/engine/../rules=dist/rules
+    resolve(__dirname2, "../rules"),
+    resolve(__dirname2, "rules"),
+    // dev src: __dirname=ts/src/infra/ → ts/src/infra/../../../agent_moss/rules = 仓库根 agent_moss/rules
+    resolve(__dirname2, "../../../agent_moss/rules"),
+    // dist 但 __dirname 指向 dist/engine 再往上两级的仓库根 agent_moss/rules
+    resolve(__dirname2, "../../../../agent_moss/rules"),
+    // 相对当前工作目录的仓库根（兜底，兼容以仓库根为 cwd 运行）
+    resolve(process.cwd(), "agent_moss/rules")
+  ];
+  return cands.filter((c) => existsSync(c));
 }
-function analyzeInlineScript(command) {
-  const code = extractInlineCode(command);
-  if (!code) {
-    return { actionable: false, allowed: true, reason: "", riskLevel: "low", riskType: "" };
-  }
-  if (hasWriteExecChain(command)) {
-    return {
-      actionable: true,
-      allowed: false,
-      reason: "\u5185\u8054\u811A\u672C\u542B\u5199\u5165\u6587\u4EF6\u540E\u6267\u884C\u7684\u6A21\u5F0F\uFF0C\u7591\u4F3C\u7ED5\u8FC7\u654F\u611F\u8DEF\u5F84\u68C0\u6D4B",
-      riskLevel: "critical",
-      riskType: "script_execution"
-    };
-  }
-  const redirMatch = command.match(REDIRECT_TO_SENSITIVE_RE);
-  if (redirMatch) {
-    return {
-      actionable: true,
-      allowed: false,
-      reason: `\u91CD\u5B9A\u5411\u5199\u5165\u654F\u611F\u8DEF\u5F84: ${redirMatch[1]}`,
-      riskLevel: "critical",
-      riskType: "file_access"
-    };
-  }
-  const isEchoOrPrintf1 = isLiteralTextCommand(command);
-  if (!isEchoOrPrintf1 && hasDirTraversal(code) && hasReadWriteKeyword(code)) {
-    return { actionable: false, allowed: true, reason: "", riskLevel: "low", riskType: "" };
-  }
-  const isEchoOrPrintf = isLiteralTextCommand(command);
-  if (!isEchoOrPrintf && hasReadWriteKeyword(code)) {
-    return {
-      actionable: true,
-      allowed: false,
-      reason: "\u5185\u8054\u811A\u672C\u542B\u654F\u611F\u8DEF\u5F84\u4E14\u542B\u6587\u4EF6\u8BFB\u5199/\u547D\u4EE4\u6267\u884C\u8C03\u7528\uFF0C\u5224\u4E3A\u771F\u5B9E\u8BBF\u95EE",
-      riskLevel: "critical",
-      riskType: "file_access"
-    };
-  }
-  return {
-    actionable: true,
-    allowed: true,
-    reason: "\u654F\u611F\u8DEF\u5F84\u4EC5\u4F5C\u4E3A\u6587\u672C\u5B57\u9762\u91CF\u51FA\u73B0\uFF0C\u672A\u4F34\u968F\u8BFB\u5199\u64CD\u4F5C",
-    riskLevel: "low",
-    riskType: "file_access"
-  };
-}
-var INLINE_CODE_RE, ECHO_STRING_RE, ECHO_SEG_RE, READ_WRITE_KEYWORDS, WRITE_EXEC_CHAIN_PATTERNS, SHELL_RC_FRAGMENTS, SENSITIVE_PATH_FRAGMENTS, REDIRECT_TO_SENSITIVE_RE, DIR_TRAVERSAL_KEYWORDS;
-var init_inline_analyzer = __esm({
-  "src/engine/inline-analyzer.ts"() {
-    "use strict";
-    init_esm_shims();
-    init_shell_split();
-    INLINE_CODE_RE = /(?:python|python3|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cera][a-zA-Z]*\s+)"([^"\\]*(?:\\.[^"\\]*)*)"|'([^'\\]*(?:\\.[^'\\]*)*)'/gi;
-    ECHO_STRING_RE = /\b(?:echo|printf)\s+"([^"\\]*(?:\\.[^"\\]*)*)"|\b(?:echo|printf)\s+'([^'\\]*(?:\\.[^'\\]*)*)'/gi;
-    ECHO_SEG_RE = /^\s*(?:echo|printf)(?:\s|$)/i;
-    READ_WRITE_KEYWORDS = [
-      // 函数调用形态（关键词后跟 '('）
-      "open(",
-      "read(",
-      "write(",
-      "fopen(",
-      "system(",
-      "exec(",
-      "eval(",
-      "popen(",
-      "load(",
-      "dump(",
-      // 文件读写（组合形态）
-      "readline",
-      "readlines",
-      "writelines",
-      "getpass",
-      "pickle.load",
-      "yaml.load",
-      "json.load",
-      "json.read",
-      "configparser",
-      "fread",
-      "fwrite",
-      "fgets",
-      // 子进程执行（组合形态）
-      "os.system",
-      "os.popen",
-      "subprocess",
-      "os.exec",
-      "os.spawn",
-      "import os",
-      "import subprocess",
-      "shell=true",
-      "check_output",
-      "check_call",
-      "run(",
-      // 绕过变体检测
-      "getattr(",
-      "__builtins__",
-      "globals(",
-      "locals(",
-      // PHP
-      "file_get_contents",
-      "file_put_contents",
-      "passthru",
-      "shell_exec",
-      "proc_open",
-      // Perl/Ruby
-      "<stdin>",
-      "open my",
-      // Node/JS（2026-09 补，与 Python _READ_WRITE_KEYWORDS 同步）：历史缺口 ——
-      // 识别表里一条 Node API 都没有，于是 node -e "require('fs').readFileSync('/etc/shadow')"
-      // 判为纯文本字面量 → 放行（真漏报）。
-      "readfilesync(",
-      "writefilesync(",
-      "appendfilesync(",
-      "unlinksync(",
-      "rmsync(",
-      "mkdirsync(",
-      "execsync(",
-      "spawnsync(",
-      "execfile",
-      "createreadstream",
-      "createwritestream",
-      "fs.read",
-      "fs.write",
-      "fs.promises",
-      "require('fs')",
-      'require("fs")',
-      "require('node:fs')",
-      'require("node:fs")',
-      "require('child_process')",
-      'require("child_process")',
-      "require('https')",
-      'require("https")'
-    ];
-    WRITE_EXEC_CHAIN_PATTERNS = [
-      // echo/cat/printf "..." > file && bash/sh/python file
-      /(?:echo|cat|printf)\b.*?>\s*\S+.*(?:&&|;|\|)\s*(?:bash|sh|zsh|python\d?|perl|ruby|node|php)\s/gis,
-      // ... | bash / | sh / | python（管道喂解释器执行）
-      /\|\s*(?:bash|sh|zsh|python\d?|perl|ruby|node|php)\b/gi,
-      // eval "$(cat ...)" / eval "$(echo ...)"
-      /eval\s+"\$\(/gi,
-      // xargs bash / xargs sh
-      /\|\s*xargs\s+(?:bash|sh|zsh)/gi
-    ];
-    SHELL_RC_FRAGMENTS = [
-      ".bashrc",
-      ".zshrc",
-      ".profile",
-      ".bash_profile",
-      ".zprofile"
-    ];
-    SENSITIVE_PATH_FRAGMENTS = [
-      "/etc/shadow",
-      "/etc/gshadow",
-      "/etc/passwd",
-      "/etc/sudoers",
-      "/etc/hosts",
-      "/etc/crontab",
-      "/etc/systemd/",
-      "/etc/ssh/sshd_config",
-      "/boot/",
-      "/proc/sys/",
-      "/sys/",
-      "/dev/mem",
-      "/dev/kmsg",
-      ".ssh/id_rsa",
-      ".ssh/id_ed25519",
-      ".ssh/authorized_keys",
-      ...SHELL_RC_FRAGMENTS
-    ];
-    REDIRECT_TO_SENSITIVE_RE = new RegExp(`>{1,2}\\s*(?:\\S*/)?(${SENSITIVE_PATH_FRAGMENTS.map((p) => p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})(?:\\s|$)`, "i");
-    DIR_TRAVERSAL_KEYWORDS = [
-      // Python 目录遍历
-      "os.listdir",
-      "os.walk",
-      "os.scandir",
-      "glob.glob",
-      "glob.iglob",
-      "pathlib.",
-      "iterdir",
-      "rglob",
-      "scandir(",
-      "listdir("
-    ];
-  }
-});
-
-// src/infra/runtime-config-bridge.ts
-function registerRuntimeConfigBridge(bridge) {
-  runtimeConfigBridge.current = bridge;
-}
-var runtimeConfigBridge;
-var init_runtime_config_bridge = __esm({
-  "src/infra/runtime-config-bridge.ts"() {
-    "use strict";
-    init_esm_shims();
-    runtimeConfigBridge = { current: null };
-  }
-});
-
-// src/infra/rules-mode.ts
-function truthy(name) {
-  return TRUTHY.has((process.env[name] || "").trim().toLowerCase());
-}
-function getRulesMode() {
-  if (cached !== null) return cached;
-  const raw = (process.env[ENV_RULES_MODE] || "").trim().toLowerCase();
-  if (raw) {
-    if (VALID_MODES.has(raw)) {
-      cached = raw;
-    } else {
-      console.error(
-        `[AgentMoss] ${ENV_RULES_MODE}=${JSON.stringify(raw)} \u975E\u6CD5\uFF08\u53EA\u652F\u6301 hot / cold / builtin\uFF09\uFF1B\u4E3A\u5B89\u5168\u8D77\u89C1\u6309 builtin\uFF08\u4EC5\u5185\u7F6E\u89C4\u5219\uFF09\u5904\u7406`
-      );
-      cached = "builtin";
-    }
-    return cached;
-  }
-  if (truthy(ENV_RULES_BUILTIN_ONLY)) cached = "builtin";
-  else if (truthy(ENV_DISABLE_RULE_HOT_RELOAD)) cached = "cold";
-  else cached = "hot";
-  return cached;
-}
-function isHotReloadEnabled() {
-  return getRulesMode() === "hot";
-}
-function isRuntimeConfigDisabled() {
-  return getRulesMode() !== "hot";
-}
-function isBuiltinOnly() {
-  return getRulesMode() === "builtin";
-}
-var ENV_RULES_MODE, ENV_RULES_BUILTIN_ONLY, ENV_DISABLE_RULE_HOT_RELOAD, TRUTHY, VALID_MODES, cached;
-var init_rules_mode = __esm({
-  "src/infra/rules-mode.ts"() {
-    "use strict";
-    init_esm_shims();
-    ENV_RULES_MODE = "AGENT_MOSS_RULES_MODE";
-    ENV_RULES_BUILTIN_ONLY = "AGENT_MOSS_RULES_BUILTIN_ONLY";
-    ENV_DISABLE_RULE_HOT_RELOAD = "AGENT_MOSS_DISABLE_RULE_HOT_RELOAD";
-    TRUTHY = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
-    VALID_MODES = /* @__PURE__ */ new Set(["hot", "cold", "builtin"]);
-    cached = null;
-  }
-});
-
-// src/infra/rules-loader.ts
-import { readFileSync as readFileSync2, existsSync, readdirSync, statSync } from "fs";
-import { resolve, dirname, join as join2 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-function dataRootDir() {
-  return getDataRoot();
-}
-function parseDirEnv(envName) {
-  const raw = (process.env[envName] || "").trim();
-  if (!raw) return [];
-  return raw.split(/[,;]/).map((s) => s.trim()).filter(Boolean).map((s) => resolve(s));
-}
-function rulesDirs() {
-  if (isBuiltinOnly()) return [];
-  const dirs = [];
-  for (const env of RULES_DIR_ENVS) dirs.push(...parseDirEnv(env));
-  dirs.push(resolve(dataRootDir(), "rules"));
-  return [...new Set(dirs)];
-}
-function findRulesFile(name) {
-  for (const dir of RULES_DIR_CANDS) {
-    const p = resolve(dir, name);
-    if (existsSync(p)) return p;
+function findRulesFile(name) {
+  for (const dir of rulesDirCands()) {
+    const p = resolve(dir, name);
+    if (existsSync(p)) return p;
   }
   return null;
 }
@@ -613,6 +267,74 @@ function loadL1() {
 function loadL2() {
   return loadJson("l2_rules.json");
 }
+function regexFlags(flags) {
+  let out = "";
+  for (const ch of String(flags ?? "")) if (RE_FLAG_MAP[ch]) out += RE_FLAG_MAP[ch];
+  return out;
+}
+function compileRuleRegex(rule, extraFlags = "") {
+  return new RegExp(String(rule.pattern), regexFlags(rule.flags) + extraFlags);
+}
+function resolveKeywordSet(group, keywordSets) {
+  if (typeof group === "string") return new Set(keywordSets[group.slice(1)] ?? []);
+  return new Set(Array.isArray(group) ? group : []);
+}
+function loadFormalRules() {
+  return loadJson("formal_rules.json");
+}
+function loadLogicRules() {
+  return loadJson("logic_rules.json");
+}
+function loadHeuristicRules() {
+  return loadJson("heuristic_rules.json");
+}
+function loadScriptRules() {
+  return loadJson("script_rules.json");
+}
+function loadInline() {
+  return loadJson("inline_rules.json");
+}
+function loadPlatformTraits(osName) {
+  const data = loadJson("platform_traits.json");
+  if (!data || Object.keys(data).length === 0) {
+    console.error(
+      "[AgentMoss] \u274C \u89C4\u5219\u6587\u4EF6 platform_traits.json \u7F3A\u5931\u6216\u635F\u574F \u2014\u2014 \u5E73\u53F0\u7279\u5F81\u56DE\u843D\u4E3A\u7A7A\uFF08\u767D\u540D\u5355\u4E3A\u7A7A\uFF0C\u5224\u5B9A\u4F1A\u53D8\u4E25\uFF09\u3002\u8BF7\u68C0\u67E5\u5305\u5B8C\u6574\u6027\u3002"
+    );
+    return {};
+  }
+  const name = resolveTraitsOs(osName);
+  const entry = data[name];
+  if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+    console.error(`[AgentMoss] platform_traits.json \u91CC\u6CA1\u6709\u53EF\u7528\u7684 ${name} \u6761\u76EE \u2014\u2014 \u5E73\u53F0\u7279\u5F81\u4E3A\u7A7A\u3002`);
+    return {};
+  }
+  const out = {};
+  for (const f of TRAITS_FIELDS) if (f in entry) out[f] = entry[f];
+  return out;
+}
+function resolveTraitsOs(osName) {
+  const data = loadJson("platform_traits.json");
+  let name = String(osName || "").trim().toLowerCase() || TRAITS_OS_FALLBACK;
+  const seen = /* @__PURE__ */ new Set();
+  for (; ; ) {
+    if (seen.has(name)) {
+      console.error(`[AgentMoss] platform_traits.json \u7684 inherits \u6210\u73AF\uFF08${name}\uFF09\u2014\u2014 \u56DE\u843D linux\u3002`);
+      return TRAITS_OS_FALLBACK;
+    }
+    seen.add(name);
+    const entry = data[name];
+    if (entry && typeof entry === "object" && !Array.isArray(entry)) {
+      const nxt = entry.inherits;
+      if (typeof nxt === "string" && nxt.trim().toLowerCase() !== name) {
+        name = nxt.trim().toLowerCase();
+        continue;
+      }
+      return name;
+    }
+    if (name === TRAITS_OS_FALLBACK) return name;
+    name = TRAITS_OS_FALLBACK;
+  }
+}
 function loadL3() {
   const data = { ...loadJson("l3_rules.json") };
   try {
@@ -895,111 +617,545 @@ function scanRuleDirs() {
       );
     }
   }
-  return { override, extra, loaded, ignored };
+  return { override, extra, loaded, ignored };
+}
+function rulesCached() {
+  if (!isHotReloadEnabled() && _RULES_CACHE) return _RULES_CACHE;
+  const dirs = rulesDirs();
+  const sig = RULES_DIR_ENVS.map((e) => `${e}=${process.env[e] || ""}`).join("|") + "|" + dirs.join("|");
+  const files = [];
+  for (const d of dirs) {
+    if (!existsSync(d)) continue;
+    try {
+      for (const name of readdirSync(d).sort()) {
+        if (name.toLowerCase().endsWith(".json")) files.push(resolve(d, name));
+      }
+    } catch {
+    }
+  }
+  const fp = JSON.stringify(files.map((p) => {
+    try {
+      const st = statSync(p);
+      return [p, st.mtimeMs, st.size];
+    } catch {
+      return [p, -1, -1];
+    }
+  }));
+  if (_RULES_CACHE && _RULES_CACHE.sig === sig && _RULES_CACHE.fp === fp) return _RULES_CACHE;
+  _RULES_CACHE = { sig, fp, ...scanRuleDirs() };
+  return _RULES_CACHE;
+}
+function identicalToBuiltin(override) {
+  const l1 = loadL1();
+  const l2 = loadL2();
+  for (const [cat, items] of Object.entries(override)) {
+    const builtin = l1[cat] ?? l2[cat];
+    if (!Array.isArray(builtin) || builtin.length !== items.length) return false;
+    if (JSON.stringify(builtin) !== JSON.stringify(items)) return false;
+  }
+  return Object.keys(override).length > 0;
+}
+function loadOverrideRules() {
+  if (isBuiltinOnly()) return {};
+  return rulesCached().override;
+}
+function loadExtraRules() {
+  if (isBuiltinOnly()) return {};
+  return rulesCached().extra;
+}
+function ruleFilesLoaded() {
+  return rulesCached().loaded;
+}
+function ignoredRuleFiles() {
+  return rulesCached().ignored;
+}
+var __filename2, __dirname2, OVERRIDE_FILENAME, EXTRA_FILENAME, RULES_DIR_ENVS, frozenJsonCache, SCENARIO_LIST_KEYS, RE_FLAG_MAP, TRAITS_FIELDS, TRAITS_OS_FALLBACK, EXTRA_CATEGORIES, STRUCT_KEYS, EXTRA_FLAT_FIELD, _RULES_CACHE, warnedIgnored;
+var init_rules_loader = __esm({
+  "src/infra/rules-loader.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_paths();
+    init_rules_mode();
+    init_runtime_config_bridge();
+    __filename2 = fileURLToPath2(import.meta.url);
+    __dirname2 = dirname(__filename2);
+    OVERRIDE_FILENAME = "override.json";
+    EXTRA_FILENAME = "extra.json";
+    RULES_DIR_ENVS = ["AGENT_MOSS_EXTRA_RULES_DIR", "AGENT_MOSS_OVERRIDE_RULES_DIR"];
+    frozenJsonCache = /* @__PURE__ */ new Map();
+    SCENARIO_LIST_KEYS = ["extra_command_patterns", "extra_injection_keywords", "extra_sensitive_paths"];
+    RE_FLAG_MAP = { i: "i", s: "s", m: "m" };
+    TRAITS_FIELDS = [
+      "write_keywords",
+      "read_keywords",
+      "write_command_res",
+      "read_only_commands",
+      "fully_safe_commands",
+      "readonly_sensitive_commands",
+      "safe_action_types",
+      "readonly_sensitive_action_types"
+    ];
+    TRAITS_OS_FALLBACK = "linux";
+    EXTRA_CATEGORIES = {
+      dangerous_commands: ["pattern"],
+      injection_detection: ["keyword", "lang"],
+      sensitive_path_access: ["path"],
+      intent_consistency: ["intent_keywords"],
+      password_modify_consent: ["pattern"],
+      user_deletion_consent: ["pattern"]
+    };
+    STRUCT_KEYS = ["skills", "ltl_rules", "tools"];
+    EXTRA_FLAT_FIELD = [
+      [["path"], "sensitive_path_access"],
+      [["keyword", "lang"], "injection_detection"],
+      [["intent_keywords"], "intent_consistency"],
+      [["pattern", "risk_level"], "dangerous_commands"],
+      [["pattern", "risk_type"], "dangerous_commands"]
+    ];
+    _RULES_CACHE = null;
+    warnedIgnored = /* @__PURE__ */ new Set();
+  }
+});
+
+// src/infra/rules-contract.ts
+var rules_contract_exports = {};
+__export(rules_contract_exports, {
+  MANIFEST_FILE: () => MANIFEST_FILE,
+  REQUIRED_RULE_FILES: () => REQUIRED_RULE_FILES,
+  RULES_SCHEMA_VERSION: () => RULES_SCHEMA_VERSION,
+  checkRulesAssets: () => checkRulesAssets,
+  enforceRulesContract: () => enforceRulesContract,
+  formatRulesIntegrity: () => formatRulesIntegrity
+});
+import { createHash } from "crypto";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+import { join as join3 } from "path";
+function sha256Short(data, n = 12) {
+  return createHash("sha256").update(data).digest("hex").slice(0, n);
+}
+function rulesDir() {
+  if (getRulesRoot()) return join3(getRulesRoot(), "rules");
+  const probe = resolveRulesFile("l1_rules.json");
+  return probe ? probe.slice(0, probe.length - "l1_rules.json".length - 1) : null;
+}
+function checkRulesAssets() {
+  const rep = {
+    ok: true,
+    schemaVersion: 0,
+    fingerprint: "",
+    fileHashes: {},
+    errors: [],
+    external: getRulesRoot() !== null
+  };
+  const dir = rulesDir();
+  if (!dir) {
+    rep.errors.push("\u627E\u4E0D\u5230\u89C4\u5219\u76EE\u5F55\uFF08\u5305\u5185\u89C4\u5219\u6587\u4EF6\u7F3A\u5931\uFF0C\u4E14\u672A\u8BBE AGENT_MOSS_RULES_ROOT\uFF09");
+    rep.ok = false;
+    return rep;
+  }
+  const manifestPath = join3(dir, MANIFEST_FILE);
+  if (!existsSync2(manifestPath)) {
+    rep.errors.push(`\u7F3A\u5C11 ${MANIFEST_FILE}\uFF08\u89C4\u5219\u5305\u5FC5\u987B\u58F0\u660E schema \u7248\u672C\uFF09`);
+  } else {
+    try {
+      const m = JSON.parse(readFileSync3(manifestPath, "utf-8")) || {};
+      const ver = m.schema_version;
+      if (typeof ver !== "number" || !Number.isInteger(ver)) {
+        rep.errors.push(`${MANIFEST_FILE} \u7F3A\u5C11\u6574\u6570 schema_version`);
+      } else {
+        rep.schemaVersion = ver;
+        if (ver !== RULES_SCHEMA_VERSION) {
+          rep.errors.push(
+            `schema \u7248\u672C\u4E0D\u5339\u914D\uFF1A\u89C4\u5219\u5305\u662F ${ver}\uFF0C\u672C\u5F15\u64CE\u8BA4\u8BC6 ${RULES_SCHEMA_VERSION}\u3002\u8BF7\u5347\u7EA7\u5F15\u64CE\u6216\u6539\u7528\u5BF9\u5E94\u7248\u672C\u7684\u89C4\u5219\u5305\u3002`
+          );
+        }
+      }
+    } catch (e) {
+      rep.errors.push(`${MANIFEST_FILE} \u8BFB\u53D6/\u89E3\u6790\u5931\u8D25: ${String(e)}`);
+    }
+  }
+  const fpParts = [];
+  for (const [name, requiredKeys] of Object.entries(REQUIRED_RULE_FILES)) {
+    const p = join3(dir, name);
+    if (!existsSync2(p)) {
+      rep.errors.push(`\u7F3A\u5C11\u89C4\u5219\u6587\u4EF6 ${name}`);
+      rep.fileHashes[name] = "MISSING";
+      fpParts.push(`${name}:MISSING`);
+      continue;
+    }
+    let raw = null;
+    try {
+      raw = readFileSync3(p);
+    } catch (e) {
+      rep.errors.push(`${name} \u8BFB\u53D6\u5931\u8D25: ${String(e)}`);
+      rep.fileHashes[name] = "UNREADABLE";
+      fpParts.push(`${name}:UNREADABLE`);
+      continue;
+    }
+    rep.fileHashes[name] = sha256Short(raw);
+    fpParts.push(`${name}:${rep.fileHashes[name]}`);
+    let data = null;
+    try {
+      data = JSON.parse(raw.toString("utf-8")) || {};
+    } catch (e) {
+      rep.errors.push(`${name} \u89E3\u6790\u5931\u8D25: ${String(e)}`);
+      rep.fileHashes[name] = "BADJSON";
+      continue;
+    }
+    if (typeof data !== "object" || Array.isArray(data)) {
+      rep.errors.push(`${name} \u9876\u5C42\u5FC5\u987B\u662F JSON \u5BF9\u8C61`);
+      continue;
+    }
+    const missing = requiredKeys.filter((k) => !(k in data));
+    if (missing.length) rep.errors.push(`${name} \u7F3A\u5C11\u9876\u5C42\u952E: ${missing.join(", ")}`);
+  }
+  rep.fingerprint = sha256Short([...fpParts].sort().join("\n"));
+  rep.ok = rep.errors.length === 0;
+  return rep;
+}
+function formatRulesIntegrity(rep) {
+  const src = rep.external ? `\u5916\u90E8\u89C4\u5219\u5305 ${getRulesRoot()}` : "\u5305\u5185\u89C4\u5219";
+  const head = `\u89C4\u5219\u5305: ${src} | schema v${rep.schemaVersion} | \u6307\u7EB9 ${rep.fingerprint || "-"}`;
+  if (rep.ok) return head;
+  return `${head} | \u274C ${rep.errors.length} \u4E2A\u95EE\u9898: ${rep.errors.slice(0, 5).join("\uFF1B")}`;
+}
+function enforceRulesContract() {
+  const rep = checkRulesAssets();
+  if (rep.ok) {
+    console.log(`[AgentMoss] ${formatRulesIntegrity(rep)}`);
+    return rep;
+  }
+  const msg = formatRulesIntegrity(rep);
+  if (rep.external) {
+    console.error(`[AgentMoss] \u274C ${msg}`);
+    throw new Error(
+      `\u89C4\u5219\u5305\u6821\u9A8C\u5931\u8D25\uFF0C\u62D2\u7EDD\u542F\u52A8\uFF08AGENT_MOSS_RULES_ROOT \u5DF2\u663E\u5F0F\u6307\u5B9A\uFF0C\u4E0D\u5141\u8BB8\u5E26\u7740\u6B8B\u7F3A\u89C4\u5219\u8FD0\u884C\uFF09\uFF1A${rep.errors.join("\uFF1B")}`
+    );
+  }
+  console.error(`[AgentMoss] \u26A0\uFE0F  ${msg}\uFF08\u4F7F\u7528\u5305\u5185\u89C4\u5219\uFF0C\u7167\u5E38\u542F\u52A8\uFF1B\u82E5\u662F npm \u5B89\u88C5\u8BF7\u91CD\u88C5\uFF09`);
+  return rep;
+}
+var RULES_SCHEMA_VERSION, REQUIRED_RULE_FILES, MANIFEST_FILE;
+var init_rules_contract = __esm({
+  "src/infra/rules-contract.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_paths();
+    init_rules_loader();
+    RULES_SCHEMA_VERSION = 1;
+    REQUIRED_RULE_FILES = {
+      "l1_rules.json": ["dangerous_commands", "injection_detection", "sensitive_path_access"],
+      "l2_rules.json": ["intent_consistency", "password_modify_consent", "user_deletion_consent"],
+      "l3_rules.json": [],
+      "mc_rules.json": ["rules", "ap_patterns"],
+      "tool_registry.json": ["tools"],
+      "platform_traits.json": ["linux", "windows"],
+      "inline_rules.json": ["read_write_keywords", "dir_traversal_keywords", "write_exec_chain_patterns"],
+      "script_rules.json": [
+        "suspicious_patterns",
+        "keyword_combination_risks",
+        "single_keyword_risks",
+        "script_exec_patterns"
+      ],
+      "heuristic_rules.json": [
+        "sensitive_excluded_prefixes",
+        "search_action_prefixes",
+        "loopback_hosts",
+        "temp_dirs"
+      ],
+      "logic_rules.json": ["indirect_file_access", "write_commands", "source_arg_commands"],
+      "formal_rules.json": ["privesc", "compute_action_types", "pattern_miner", "output_commands"]
+    };
+    MANIFEST_FILE = "manifest.json";
+  }
+});
+
+// src/package-json.ts
+import { createRequire } from "module";
+var require2, pkg, version;
+var init_package_json = __esm({
+  "src/package-json.ts"() {
+    "use strict";
+    init_esm_shims();
+    require2 = createRequire(import.meta.url);
+    pkg = require2("../package.json");
+    version = pkg.version;
+  }
+});
+
+// src/models.ts
+import { z } from "zod";
+var ActionItemSchema, PromptTurnSchema, AnalyzeRequestSchema, AnalyzeResponseSchema, HealthResponseSchema, ReviewRequestSchema, ReviewResponseSchema;
+var init_models = __esm({
+  "src/models.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_package_json();
+    ActionItemSchema = z.object({
+      action_type: z.string().describe("Action type, e.g. bash, file_read, file_write"),
+      action_detail: z.string().describe("Action detail / command content"),
+      // 工具返回给 agent 的内容。仅 L2 的授权（consent）判定用：判断「用户是否已授权」
+      // 看的是 ask_user_question 的**回答**，不是提问正文。历史 bug：模型里没有这个字段、
+      // 路由也没透传，TS 的授权判定退化成「提问正文非空」，等于问过任何问题即已授权。
+      output: z.string().optional().describe("Tool result / user answer (needed by L2 consent checks)")
+    });
+    PromptTurnSchema = z.object({
+      text: z.string().default("").describe("User prompt text at this turn"),
+      actions: z.array(ActionItemSchema).default([]).describe("Actions triggered by this prompt, in order, until the next prompt")
+    });
+    AnalyzeRequestSchema = z.object({
+      session_id: z.string().describe("Session / agent unique identifier"),
+      prompt_session: z.string().default("").describe("User original prompt (most recent user message; backward compat)"),
+      prompt_history: z.array(PromptTurnSchema).default([]).describe("Full interleaved prompt history (ordered turns, each with its triggered actions). Optional; empty = fall back to prompt_session only."),
+      action_history: z.array(ActionItemSchema).default([]).describe("Historical action sequence"),
+      session_history: z.array(z.object({
+        session_id: z.string(),
+        action_history: z.array(ActionItemSchema).default([])
+      })).default([]).describe("Multi-session historical actions (optional): for L2.2 formal engine cross-session combo-chain / sensitive-data-flow verification. Provided by caller (incl. future agentgate)."),
+      a_next: ActionItemSchema.describe("Next action to be executed"),
+      reason: z.string().default("").describe("Reason for executing this action"),
+      os_type: z.string().default("").describe("OS type: 'linux', 'windows', or empty for auto-detect"),
+      cwd: z.string().default("").describe("Current working directory"),
+      agent_id: z.string().default("").describe("Caller agent identifier, e.g. 'xiaoo' / 'opencode' / 'opendesk'. Empty = generic mode (no agent-specific rules)."),
+      metadata: z.record(z.unknown()).optional().describe("Extended metadata")
+    });
+    AnalyzeResponseSchema = z.object({
+      decision: z.enum(["Allow", "Deny"]).describe("Allow or Deny"),
+      reason: z.string().describe("Decision reason"),
+      risk_level: z.enum(["low", "medium", "high", "critical"]).default("low"),
+      risk_type: z.string().default(""),
+      violated_layers: z.array(z.string()).default([]),
+      policy: z.string().default(""),
+      violated_policy: z.string().default(""),
+      confidence: z.number().int().min(0).max(100).default(100),
+      analysis_duration_ms: z.number().default(0),
+      // 组合攻击链反例路径：每步 [session_id, seq, stage, timestamp]，含真实发生时间
+      violation_chain: z.array(z.array(z.union([z.string(), z.number()]).nullable())).default([])
+    });
+    HealthResponseSchema = z.object({
+      status: z.string().default("healthy"),
+      version: z.string().default(version),
+      // 归属实例标识：值来自 env AGENT_MOSS_INSTANCE（spawn/systemd 注入），默认空串。
+      // 多个 agentmoss 同机并存时，调用方按 instance 过滤避免连到别人的进程。
+      // 空=未配置（独立部署或旧版），调用方可选择兼容或严格过滤。
+      instance: z.string().default("")
+    });
+    ReviewRequestSchema = z.object({
+      agent_id: z.string().default("").describe("\u76EE\u6807 agent \u6807\u8BC6\uFF08\u51B3\u5B9A\u72B6\u6001\u5E93\u5206\u6876\uFF09"),
+      db_path: z.string().default("").describe("AgentGate \u672C\u5730\u5B58\u50A8\u8DEF\u5F84\uFF08SQLite \u6587\u4EF6 \u6216 tool_calls JSON \u76EE\u5F55\uFF09\uFF1B\u4E3A\u7A7A\u5219\u7528 sessions"),
+      sessions: z.array(z.object({
+        session_id: z.string(),
+        action_history: z.array(ActionItemSchema).default([])
+      })).default([]).describe("\u591A session \u5386\u53F2\u52A8\u4F5C\uFF08\u66FF\u4EE3/\u515C\u5E95 db_path\uFF09"),
+      a_next: ActionItemSchema.optional().describe("\u53EF\u9009\uFF1Aseed \u540E\u8FDE\u540C\u5F53\u524D\u52A8\u4F5C\u4E00\u8D77\u5224\u5B9A"),
+      is_error: z.boolean().default(false).describe("\u5F53\u524D\u52A8\u4F5C\u6267\u884C\u662F\u5426\u5931\u8D25"),
+      output_pending: z.boolean().default(false).describe("\u8FD4\u56DE\u524D\u5E8F\u94FE\u6E05\u5355 pending_prefixes")
+    });
+    ReviewResponseSchema = z.object({
+      agent_id: z.string().default(""),
+      seeded_nodes: z.number().default(0),
+      verified: z.boolean().default(true),
+      violations: z.array(z.record(z.unknown())).default([]),
+      pending_prefixes: z.array(z.record(z.unknown())).default([]),
+      state_nodes: z.number().default(0),
+      discovered_patterns: z.array(z.record(z.unknown())).default([]).describe("\u6570\u636E\u9A71\u52A8\u53D1\u73B0\uFF1A\u8DE8 session \u9891\u7E41\u5371\u9669\u7EC4\u5408\uFF08\u9884\u7F6E\u94FE\u76F2\u533A\uFF0CPatternMiner\uFF09")
+    });
+  }
+});
+
+// src/engine/shell-split.ts
+function hasCommandSubstitution(text) {
+  return CMD_SUBSTITUTION.test(text);
+}
+function splitCommandSegments(command) {
+  const segments = [];
+  let cur = "";
+  let quote = null;
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+    if (quote) {
+      cur += ch;
+      if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      cur += ch;
+      continue;
+    }
+    if (/\||&|;|\n/.test(ch)) {
+      segments.push(cur);
+      segments.push(ch);
+      cur = "";
+      continue;
+    }
+    cur += ch;
+  }
+  if (cur) segments.push(cur);
+  return segments.map((s) => s.trim()).filter((s) => s.length > 0 && !/^(?:\|\||&&|[|;&])$/.test(s));
+}
+function extractFirstCommand(command) {
+  const segments = splitCommandSegments(command);
+  return segments.length ? segments[0] : "";
+}
+var CMD_SUBSTITUTION;
+var init_shell_split = __esm({
+  "src/engine/shell-split.ts"() {
+    "use strict";
+    init_esm_shims();
+    CMD_SUBSTITUTION = /\$\(|`|</;
+  }
+});
+
+// src/engine/inline-analyzer.ts
+function buildChainRegex(pattern, flags) {
+  return new RegExp(pattern, (flags || "") + "g");
 }
-function rulesCached() {
-  if (!isHotReloadEnabled() && _RULES_CACHE) return _RULES_CACHE;
-  const dirs = rulesDirs();
-  const sig = RULES_DIR_ENVS.map((e) => `${e}=${process.env[e] || ""}`).join("|") + "|" + dirs.join("|");
-  const files = [];
-  for (const d of dirs) {
-    if (!existsSync(d)) continue;
-    try {
-      for (const name of readdirSync(d).sort()) {
-        if (name.toLowerCase().endsWith(".json")) files.push(resolve(d, name));
-      }
-    } catch {
+function isLiteralTextCommand(command) {
+  const segments = splitCommandSegments(command);
+  if (segments.length === 0 || segments.some((s) => !ECHO_SEG_RE.test(s))) return false;
+  if (command.includes(">")) {
+    let d = command.replace(/<=>|>=|<=|<>|=>/g, " ");
+    d = d.replace(/(?:2|&|1)?\s*>\s*\/dev\/null\b/g, "");
+    d = d.replace(new RegExp(`>{1,2}\\s*(['"])([~./][^'"]+)\\1`, "g"), (_m, _q, p) => ">" + p);
+    d = d.replace(/'[^']*'|"[^"]*"/g, "");
+    if (/>{1,2}\s*(?!&)\S/.test(d)) {
+      return false;
     }
   }
-  const fp = JSON.stringify(files.map((p) => {
-    try {
-      const st = statSync(p);
-      return [p, st.mtimeMs, st.size];
-    } catch {
-      return [p, -1, -1];
-    }
-  }));
-  if (_RULES_CACHE && _RULES_CACHE.sig === sig && _RULES_CACHE.fp === fp) return _RULES_CACHE;
-  _RULES_CACHE = { sig, fp, ...scanRuleDirs() };
-  return _RULES_CACHE;
+  if (/\|\s*\b(?:tee|tac|install)\b/i.test(command)) {
+    return false;
+  }
+  return true;
 }
-function identicalToBuiltin(override) {
-  const l1 = loadL1();
-  const l2 = loadL2();
-  for (const [cat, items] of Object.entries(override)) {
-    const builtin = l1[cat] ?? l2[cat];
-    if (!Array.isArray(builtin) || builtin.length !== items.length) return false;
-    if (JSON.stringify(builtin) !== JSON.stringify(items)) return false;
+function extractInlineCode(command) {
+  const parts = [];
+  let m;
+  INLINE_CODE_RE.lastIndex = 0;
+  while ((m = INLINE_CODE_RE.exec(command)) !== null) {
+    const code = m[1] ?? m[2];
+    if (code) parts.push(code);
   }
-  return Object.keys(override).length > 0;
+  ECHO_STRING_RE.lastIndex = 0;
+  while ((m = ECHO_STRING_RE.exec(command)) !== null) {
+    const code = m[1] ?? m[2];
+    if (code) parts.push(code);
+  }
+  return parts.join("\n");
 }
-function loadOverrideRules() {
-  if (isBuiltinOnly()) return {};
-  return rulesCached().override;
+function hasWriteExecChain(command) {
+  return WRITE_EXEC_CHAIN_PATTERNS.some((p) => {
+    p.lastIndex = 0;
+    return p.test(command);
+  });
 }
-function loadExtraRules() {
-  if (isBuiltinOnly()) return {};
-  return rulesCached().extra;
+function hasDirTraversal(code) {
+  const lower = code.toLowerCase();
+  return DIR_TRAVERSAL_KEYWORDS.some((kw) => lower.includes(kw));
 }
-function ruleFilesLoaded() {
-  return rulesCached().loaded;
+function hasReadWriteKeyword(code) {
+  const lower = code.toLowerCase();
+  return READ_WRITE_KEYWORDS.some((kw) => lower.includes(kw));
 }
-function ignoredRuleFiles() {
-  return rulesCached().ignored;
+function analyzeInlineScript(command) {
+  const code = extractInlineCode(command);
+  if (!code) {
+    return { actionable: false, allowed: true, reason: "", riskLevel: "low", riskType: "" };
+  }
+  if (hasWriteExecChain(command)) {
+    return {
+      actionable: true,
+      allowed: false,
+      reason: "\u5185\u8054\u811A\u672C\u542B\u5199\u5165\u6587\u4EF6\u540E\u6267\u884C\u7684\u6A21\u5F0F\uFF0C\u7591\u4F3C\u7ED5\u8FC7\u654F\u611F\u8DEF\u5F84\u68C0\u6D4B",
+      riskLevel: "critical",
+      riskType: "script_execution"
+    };
+  }
+  const redirMatch = command.match(REDIRECT_TO_SENSITIVE_RE);
+  if (redirMatch) {
+    return {
+      actionable: true,
+      allowed: false,
+      reason: `\u91CD\u5B9A\u5411\u5199\u5165\u654F\u611F\u8DEF\u5F84: ${redirMatch[1]}`,
+      riskLevel: "critical",
+      riskType: "file_access"
+    };
+  }
+  const isEchoOrPrintf1 = isLiteralTextCommand(command);
+  if (!isEchoOrPrintf1 && hasDirTraversal(code) && hasReadWriteKeyword(code)) {
+    return { actionable: false, allowed: true, reason: "", riskLevel: "low", riskType: "" };
+  }
+  const isEchoOrPrintf = isLiteralTextCommand(command);
+  if (!isEchoOrPrintf && hasReadWriteKeyword(code)) {
+    return {
+      actionable: true,
+      allowed: false,
+      reason: "\u5185\u8054\u811A\u672C\u542B\u654F\u611F\u8DEF\u5F84\u4E14\u542B\u6587\u4EF6\u8BFB\u5199/\u547D\u4EE4\u6267\u884C\u8C03\u7528\uFF0C\u5224\u4E3A\u771F\u5B9E\u8BBF\u95EE",
+      riskLevel: "critical",
+      riskType: "file_access"
+    };
+  }
+  return {
+    actionable: true,
+    allowed: true,
+    reason: "\u654F\u611F\u8DEF\u5F84\u4EC5\u4F5C\u4E3A\u6587\u672C\u5B57\u9762\u91CF\u51FA\u73B0\uFF0C\u672A\u4F34\u968F\u8BFB\u5199\u64CD\u4F5C",
+    riskLevel: "low",
+    riskType: "file_access"
+  };
 }
-var __filename2, __dirname2, OVERRIDE_FILENAME, EXTRA_FILENAME, RULES_DIR_ENVS, RULES_DIR_CANDS, frozenJsonCache, SCENARIO_LIST_KEYS, EXTRA_CATEGORIES, STRUCT_KEYS, EXTRA_FLAT_FIELD, _RULES_CACHE, warnedIgnored;
-var init_rules_loader = __esm({
-  "src/infra/rules-loader.ts"() {
+var INLINE_RULES, INLINE_CODE_RE, ECHO_STRING_RE, ECHO_SEG_RE, READ_WRITE_KEYWORDS, WRITE_EXEC_CHAIN_PATTERNS, _REDIRECT_PATHS, SHELL_RC_FRAGMENTS, SENSITIVE_PATH_FRAGMENTS, REDIRECT_TO_SENSITIVE_RE, DIR_TRAVERSAL_KEYWORDS;
+var init_inline_analyzer = __esm({
+  "src/engine/inline-analyzer.ts"() {
     "use strict";
     init_esm_shims();
-    init_paths();
-    init_rules_mode();
-    init_runtime_config_bridge();
-    __filename2 = fileURLToPath2(import.meta.url);
-    __dirname2 = dirname(__filename2);
-    OVERRIDE_FILENAME = "override.json";
-    EXTRA_FILENAME = "extra.json";
-    RULES_DIR_ENVS = ["AGENT_MOSS_EXTRA_RULES_DIR", "AGENT_MOSS_OVERRIDE_RULES_DIR"];
-    RULES_DIR_CANDS = (() => {
-      const cands = [
-        // 注：`<data_root>/rules/` 不再是"按内置文件名覆盖"的查找位 —— 2026-10 起
-        // 规则目录只认 override.json / extra.json（见 rulesDirs()）。
-        // dist: __dirname=dist/ → dist/rules；__dirname=dist/engine/ → dist/engine/../rules=dist/rules
-        resolve(__dirname2, "../rules"),
-        resolve(__dirname2, "rules"),
-        // dev src: __dirname=ts/src/infra/ → ts/src/infra/../../../agent_moss/rules = 仓库根 agent_moss/rules
-        resolve(__dirname2, "../../../agent_moss/rules"),
-        // dist 但 __dirname 指向 dist/engine 再往上两级的仓库根 agent_moss/rules
-        resolve(__dirname2, "../../../../agent_moss/rules"),
-        // 相对当前工作目录的仓库根（兜底，兼容以仓库根为 cwd 运行）
-        resolve(process.cwd(), "agent_moss/rules")
-      ];
-      return cands.filter((c) => existsSync(c));
-    })();
-    frozenJsonCache = /* @__PURE__ */ new Map();
-    SCENARIO_LIST_KEYS = ["extra_command_patterns", "extra_injection_keywords", "extra_sensitive_paths"];
-    EXTRA_CATEGORIES = {
-      dangerous_commands: ["pattern"],
-      injection_detection: ["keyword", "lang"],
-      sensitive_path_access: ["path"],
-      intent_consistency: ["intent_keywords"],
-      password_modify_consent: ["pattern"],
-      user_deletion_consent: ["pattern"]
-    };
-    STRUCT_KEYS = ["skills", "ltl_rules", "tools"];
-    EXTRA_FLAT_FIELD = [
-      [["path"], "sensitive_path_access"],
-      [["keyword", "lang"], "injection_detection"],
-      [["intent_keywords"], "intent_consistency"],
-      [["pattern", "risk_level"], "dangerous_commands"],
-      [["pattern", "risk_type"], "dangerous_commands"]
+    init_shell_split();
+    init_rules_loader();
+    INLINE_RULES = loadInline();
+    if (!INLINE_RULES || Object.keys(INLINE_RULES).length === 0) {
+      console.error(
+        "[AgentMoss] \u274C \u89C4\u5219\u6587\u4EF6 inline_rules.json \u7F3A\u5931\u6216\u635F\u574F \u2014\u2014 \u5185\u8054\u811A\u672C\u5224\u5B9A\u8BCD\u8868\u4E3A\u7A7A\uFF0C\u5185\u8054\u811A\u672C\u4E2D\u7684\u654F\u611F\u8DEF\u5F84\u8BFB\u5199\u5C06\u6309\u300C\u6587\u672C\u5B57\u9762\u91CF\u300D\u653E\u884C\uFF08\u6BD4\u6B63\u5E38\u66F4\u677E\uFF09\u3002\u8BF7\u68C0\u67E5\u5305\u5B8C\u6574\u6027\u3002"
+      );
+    }
+    INLINE_CODE_RE = /(?:python|python3|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cera][a-zA-Z]*\s+)"([^"\\]*(?:\\.[^"\\]*)*)"|'([^'\\]*(?:\\.[^'\\]*)*)'/gi;
+    ECHO_STRING_RE = /\b(?:echo|printf)\s+"([^"\\]*(?:\\.[^"\\]*)*)"|\b(?:echo|printf)\s+'([^'\\]*(?:\\.[^'\\]*)*)'/gi;
+    ECHO_SEG_RE = /^\s*(?:echo|printf)(?:\s|$)/i;
+    READ_WRITE_KEYWORDS = INLINE_RULES.read_write_keywords ?? [];
+    WRITE_EXEC_CHAIN_PATTERNS = (INLINE_RULES.write_exec_chain_patterns ?? []).filter((p) => p && typeof p.pattern === "string").map((p) => buildChainRegex(p.pattern, p.flags ?? ""));
+    _REDIRECT_PATHS = INLINE_RULES.redirect_sensitive_paths ?? {};
+    SHELL_RC_FRAGMENTS = _REDIRECT_PATHS.shell_rc_fragments ?? [];
+    SENSITIVE_PATH_FRAGMENTS = [
+      ..._REDIRECT_PATHS.ts_static ?? [],
+      ...SHELL_RC_FRAGMENTS
     ];
-    _RULES_CACHE = null;
-    warnedIgnored = /* @__PURE__ */ new Set();
+    REDIRECT_TO_SENSITIVE_RE = new RegExp(`>{1,2}\\s*(?:\\S*/)?(${SENSITIVE_PATH_FRAGMENTS.map((p) => p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})(?:\\s|$)`, "i");
+    DIR_TRAVERSAL_KEYWORDS = INLINE_RULES.dir_traversal_keywords ?? [];
   }
 });
 
 // src/engine/platform-traits.ts
+function buildTraits(osName) {
+  const t = loadPlatformTraits(osName);
+  const strs = (k) => Array.isArray(t[k]) ? t[k] : [];
+  return {
+    writeKeywords: strs("write_keywords"),
+    readKeywords: strs("read_keywords"),
+    writeCommandRes: strs("write_command_res").map((p) => new RegExp(p)),
+    readOnlyCommands: new Set(strs("read_only_commands")),
+    fullySafeCommands: strs("fully_safe_commands").map((p) => new RegExp(p, "i")),
+    readonlySensitiveCommands: strs("readonly_sensitive_commands").map((p) => new RegExp(p, "i")),
+    safeActionTypes: new Set(strs("safe_action_types")),
+    readonlySensitiveActionTypes: new Set(strs("readonly_sensitive_action_types"))
+  };
+}
+function traitsFor(key) {
+  const resolved = resolveTraitsOs(key);
+  let t = traitsCache.get(resolved);
+  if (!t) {
+    t = buildTraits(resolved);
+    traitsCache.set(resolved, t);
+  }
+  return t;
+}
 function getPlatformTraits(osType) {
   const accepted = acceptedOsValues(osType);
   if (accepted.includes("windows")) return WINDOWS_TRAITS;
@@ -1007,368 +1163,18 @@ function getPlatformTraits(osType) {
   if (accepted.includes("harmony")) return HARMONY_TRAITS;
   return LINUX_TRAITS;
 }
-var LINUX_TRAITS, WINDOWS_TRAITS, MACOS_TRAITS, HARMONY_TRAITS;
+var traitsCache, LINUX_TRAITS, WINDOWS_TRAITS, MACOS_TRAITS, HARMONY_TRAITS;
 var init_platform_traits = __esm({
   "src/engine/platform-traits.ts"() {
     "use strict";
     init_esm_shims();
     init_logic_rules();
-    LINUX_TRAITS = {
-      writeKeywords: [
-        "write",
-        "\u5199\u5165",
-        "save",
-        "\u4FDD\u5B58",
-        "modify",
-        "\u4FEE\u6539",
-        "update",
-        "\u66F4\u65B0",
-        "delete",
-        "\u5220\u9664",
-        "remove",
-        "\u79FB\u9664",
-        "create",
-        "\u521B\u5EFA",
-        "append",
-        "\u8FFD\u52A0",
-        "truncate",
-        "\u622A\u65AD",
-        "overwrite",
-        "\u8986\u76D6",
-        "replace",
-        "\u66FF\u6362",
-        "edit"
-      ],
-      readKeywords: [
-        "read",
-        "\u8BFB\u53D6",
-        "cat",
-        "head",
-        "tail",
-        "less",
-        "more",
-        "view",
-        "\u67E5\u770B",
-        "open",
-        "\u6253\u5F00",
-        "load",
-        "\u52A0\u8F7D",
-        "grep",
-        "search",
-        "\u641C\u7D22",
-        "find",
-        "\u67E5\u627E"
-      ],
-      writeCommandRes: [
-        /\brm\b/,
-        /\bunlink\b/,
-        /\brmdir\b/,
-        /\bshred\b/,
-        /\bcp\b/,
-        /\bmv\b/,
-        /\binstall\b/,
-        /\btee\b/,
-        /\bdd\b/,
-        /\bmkfs\b/,
-        /\b(fdisk|parted|cfdisk|sfdisk)\b/,
-        /\bchmod\b/,
-        /\bchown\b/,
-        /\btruncate\b/
-      ],
-      readOnlyCommands: /* @__PURE__ */ new Set([
-        "cat",
-        "head",
-        "tail",
-        "less",
-        "more",
-        "grep",
-        "find",
-        "awk",
-        "sed",
-        "sort",
-        "uniq",
-        "wc",
-        "cut",
-        "strings",
-        "od",
-        "xxd",
-        "hexdump",
-        "tr",
-        "file",
-        "stat",
-        "du",
-        "df",
-        "ls",
-        "dir",
-        "tree",
-        "nl",
-        "tac",
-        "rev",
-        "echo",
-        "printf",
-        "lsblk",
-        "blockdev",
-        "smartctl",
-        "udevadm",
-        "dmidecode",
-        "lscpu",
-        "lspci",
-        "lsusb",
-        "lsmem",
-        "lsns",
-        "lsof",
-        "hwinfo",
-        "inxi",
-        "fdisk",
-        "parted",
-        "dmesg",
-        "journalctl",
-        "systemctl",
-        "hostnamectl",
-        "localectl",
-        "timedatectl",
-        "ps",
-        "top",
-        "free",
-        "vmstat",
-        "iostat",
-        "mpstat",
-        "pidof",
-        "pgrep",
-        "ip",
-        "ifconfig",
-        "route",
-        "ss",
-        "netstat",
-        "arp",
-        "ethtool",
-        "nmcli",
-        "uname",
-        "arch",
-        "nproc",
-        "getconf",
-        "getent",
-        "id",
-        "whoami",
-        "who",
-        "w",
-        "last",
-        "uptime",
-        "lsmod",
-        "modinfo",
-        "sysctl"
-      ]),
-      fullySafeCommands: [
-        /^ls(?:\s|$)/i,
-        /^dir(?:\s|$)/i,
-        /^pwd(?:\s|$)/i,
-        /^which\s+/i,
-        /^whereis\s+/i,
-        /^realpath\s+/i,
-        /^basename\s+/i,
-        /^dirname\s+/i,
-        /^file\s+/i,
-        /^stat\s+/i,
-        /^du(?:\s|$)/i,
-        /^echo\s+/i,
-        /^printf\s+/i,
-        /^type\s+/i,
-        /^command\s+/i,
-        // 系统信息查询（只读，不涉及文件/网络/权限）
-        /^whoami(?:\s|$)/i,
-        /^id(?:\s|$)/i,
-        /^hostname(?:\s|$)/i,
-        /^uname(?:\s|$)/i,
-        /^date(?:\s|$)/i,
-        /^env(?:\s|$)/i,
-        /^printenv(?:\s|$)/i,
-        /^tty(?:\s|$)/i,
-        /^arch(?:\s|$)/i,
-        /^uptime(?:\s|$)/i,
-        /^groups(?:\s|$)/i,
-        /^logname(?:\s|$)/i,
-        // 系统资源/硬件信息（只读，不读文件内容、无状态变更选项）
-        // 与上面 uptime/uname/id 同性质；缺了它们时开 L3 的部署每查一次磁盘/内存
-        // 都要走 LLM（实测 df -h 从 5ms 变成十几秒）。
-        /^df(?:\s|$)/i,
-        /^free(?:\s|$)/i,
-        /^vmstat(?:\s|$)/i,
-        /^nproc(?:\s|$)/i,
-        /^lscpu(?:\s|$)/i,
-        /^lsblk(?:\s|$)/i,
-        /^lspci(?:\s|$)/i,
-        /^lsusb(?:\s|$)/i,
-        /^lsmod(?:\s|$)/i
-      ],
-      readonlySensitiveCommands: [
-        /^cat\s+/i,
-        /^head(?:\s|$)/i,
-        /^tail(?:\s|$)/i,
-        /^less(?:\s|$)/i,
-        /^more(?:\s|$)/i,
-        /^wc(?:\s|$)/i,
-        /^grep(?:\s|$)/i,
-        /^find\s+/i,
-        /^ag(?:\s|$)/i,
-        /^rg(?:\s|$)/i,
-        /^awk\s+/i,
-        // NEW-FN-P（M03）：sed -i/--in-place 是原地写，挡出白名单走 L2 read_before_write。
-        // 前瞻放最前（外层 ^sed\s+ 会消费 -i 前的空格）。与 Python profiles/linux.py 对齐。
-        /^(?!.*(?:\s|['"])-[a-zA-Z]*i[a-zA-Z]*\b)(?!.*(?:\s|['"])--in-place)sed\s+/i,
-        /^cut\s+/i,
-        /^sort(?:\s|$)/i,
-        /^uniq(?:\s|$)/i,
-        // 进程/网络/打开文件信息：只读，但会暴露进程命令行、连接对端、打开的文件
-        // 路径，故只跳 L3、保留 L2（L1 敏感路径检测照常生效）。
-        /^ps(?:\s|$)/i,
-        /^ss(?:\s|$)/i,
-        /^netstat(?:\s|$)/i,
-        /^lsof(?:\s|$)/i,
-        // 只读子命令级白名单：匹配的是「第一段命令」而非首词（extractFirstCommand
-        // 按 | && || 切分），所以能精确到子命令。systemctl stop/disable 等不在此列。
-        /^systemctl\s+(?:status|is-active|is-enabled|is-failed|list-units|list-unit-files|list-dependencies|show|cat)\b/i,
-        /^service\s+\S+\s+status\b/i,
-        // journalctl 整族是只读的，但 --vacuum-*/--rotate/--flush/--sync 会删改日志，
-        // 用否定前瞻挡掉后再放行。注意前瞻里必须用 .* 扫描**整段**：只写 (?!\s+--...)
-        // 的话只看紧跟 journalctl 的第一个参数，
-        // `journalctl -u sshd --vacuum-size=100M` 就漏过去了。
-        /^journalctl\b(?!.*--(?:vacuum-size|vacuum-time|vacuum-files|rotate|flush|sync)\b)/i
-      ]
-    };
-    WINDOWS_TRAITS = {
-      writeKeywords: [
-        "write",
-        "\u5199\u5165",
-        "save",
-        "\u4FDD\u5B58",
-        "modify",
-        "\u4FEE\u6539",
-        "update",
-        "\u66F4\u65B0",
-        "delete",
-        "\u5220\u9664",
-        "remove",
-        "\u79FB\u9664",
-        "create",
-        "\u521B\u5EFA",
-        "append",
-        "\u8FFD\u52A0",
-        "overwrite",
-        "\u8986\u76D6",
-        "replace",
-        "\u66FF\u6362",
-        "set",
-        "\u8BBE\u7F6E"
-        // 注意：这里**不能放 `reg` / `注册表`**。关键词是子串包含匹配，放进去等于
-        // 「只要命令里出现 reg 字样就算写操作」——`reg query`（读）会被判成写，
-        // 进而误拦对 deny_write 路径的只读查询。注册表的写判定交给下面的
-        // writeCommandRes（只认写子命令）。两端语义必须一致。
-      ],
-      readKeywords: [
-        "read",
-        "\u8BFB\u53D6",
-        "type",
-        "findstr",
-        "dir",
-        "view",
-        "\u67E5\u770B",
-        "open",
-        "\u6253\u5F00",
-        "load",
-        "\u52A0\u8F7D",
-        "search",
-        "\u641C\u7D22",
-        "find",
-        "\u67E5\u627E",
-        "get",
-        "\u83B7\u53D6"
-      ],
-      // Windows 写/删命令：del/copy/move/xcopy/replace/rmdir/icacls/reg delete 等
-      writeCommandRes: [
-        /\b(del|erase)\b/,
-        /\brmdir\b/,
-        /\b(rd)\b/,
-        /\bcopy\b/,
-        /\b(xcopy|robocopy)\b/,
-        /\b(move|movefile)\b/,
-        /\breplace\b/,
-        /\bicacls\b/,
-        /\battrib\b/,
-        // 注册表：**只认写子命令**（对齐 Python WindowsProfile.write_command_res）。
-        // 此前是 /\breg\b/，把 reg query（读）也判成写 → 误拦对 deny_write 路径的只读查询。
-        // 写子命令 add/delete/copy/save/restore/import/load/unload；
-        // 读子命令 query/compare/export/flags/help 不在此列。
-        /\breg(?:\.exe)?\s+(?:add|delete|copy|save|restore|import|load|unload)\b/,
-        /\bformat\b/,
-        /\bdiskpart\b/,
-        /\bmkdir\b/,
-        /\bmd\b/,
-        /\bsetx\b/,
-        /\bwmic\b/
-      ],
-      // Windows 只读命令（重定向写判定用）：type/findstr/more/tree/dir 等
-      readOnlyCommands: /* @__PURE__ */ new Set([
-        "type",
-        "findstr",
-        "more",
-        "tree",
-        "dir",
-        "where",
-        "ver",
-        "cls",
-        "echo",
-        "help",
-        "fc",
-        "comp",
-        "find",
-        "sort",
-        "powershell",
-        "cmd",
-        "netstat",
-        "ipconfig",
-        "tasklist",
-        "systeminfo",
-        "driverquery",
-        "reg",
-        "wmic",
-        "whoami",
-        "hostname",
-        "getmac",
-        "query",
-        "w32tm",
-        "diskpart"
-      ]),
-      // Windows 完全安全命令（对齐 WindowsProfile.fully_safe_commands）
-      fullySafeCommands: [
-        /^dir(?:\s|$)/,
-        /^where\s+/,
-        /^echo\s+/,
-        /^cd(?:\s|$)/,
-        /^tree(?:\s|$)/,
-        /^help(?:\s|$)/,
-        /^cls(?:\s|$)/,
-        /^ver(?:\s|$)/,
-        // 系统信息查询（只读，不读文件内容、无状态变更选项），与 Linux 侧 df/free 对齐
-        /^whoami(?:\s|$)/,
-        /^hostname(?:\s|$)/,
-        /^systeminfo(?:\s|$)/,
-        /^tasklist(?:\s|$)/,
-        /^getmac(?:\s|$)/,
-        /^driverquery(?:\s|$)/,
-        /^netstat(?:\s|$)/
-      ],
-      // Windows 安全但可能访问敏感路径的命令（对齐 WindowsProfile.readonly_sensitive_commands）
-      readonlySensitiveCommands: [
-        /^type\s+/,
-        /^findstr\s+/,
-        // 只读子命令级白名单（匹配「第一段命令」而非首词）；
-        // sc create/delete/start/stop、reg add/delete/set 均不在此列。
-        /^sc\s+query\b/,
-        /^reg\s+query\b/
-      ]
-    };
-    MACOS_TRAITS = LINUX_TRAITS;
-    HARMONY_TRAITS = LINUX_TRAITS;
+    init_rules_loader();
+    traitsCache = /* @__PURE__ */ new Map();
+    LINUX_TRAITS = traitsFor("linux");
+    WINDOWS_TRAITS = traitsFor("windows");
+    MACOS_TRAITS = traitsFor("macos");
+    HARMONY_TRAITS = traitsFor("harmony");
   }
 });
 
@@ -1527,7 +1333,6 @@ function checkIntentConsistency(input) {
   const { aNext, promptSession, promptHistory } = input;
   const actionDetail = aNext.actionDetail.toLowerCase();
   const actionType = aNext.actionType.toLowerCase();
-  const EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
   if (EXCLUDED_PREFIXES.some((p) => actionType.startsWith(p))) return null;
   if (INLINE_SCRIPT_RE.test(actionDetail)) return null;
   const intentTexts = collectIntentTexts(promptSession, promptHistory);
@@ -1555,7 +1360,6 @@ function runLogicCheck(input, opts) {
   const actionDetail = aNext.actionDetail.toLowerCase();
   const actionType = aNext.actionType.toLowerCase();
   const resolvedCwd = cwd || "/";
-  const EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
   const isExcludedType = EXCLUDED_PREFIXES.some((p) => actionType.startsWith(p));
   if (!opts?.skipReadBeforeWrite) {
     const rbwResult = checkReadBeforeWrite(actionType, actionDetail, actionHistory, input.reason, resolvedCwd, input.osType);
@@ -1667,7 +1471,7 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
   const isBashLike = actionType === "bash" || actionType === "executebash" || actionType === "terminal-executebash";
   const isWrite = isBashLike ? isWriteOperation(actionType, actionDetail, void 0, osType) : getPlatformTraits(osType).writeKeywords.some((kw) => actionType.includes(kw));
   if (!isWrite) return null;
-  const WRITE_CMDS = /* @__PURE__ */ new Set(["cp", "mv", "install", "tee", "dd", "truncate", "mkfs", "fdisk", "parted"]);
+  const WRITE_CMDS = new Set(_LOGIC.write_commands ?? []);
   if (isBashLike) {
     const detailNoCompare = actionDetail.replace(/<=>|>=|<=|<>|=>/g, " ");
     const detailNoDevnull = detailNoCompare.replace(DEVNULL_REDIRECT_RE, "");
@@ -1699,7 +1503,7 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
     }
     if (!hasWriteSeg) return null;
   }
-  const SOURCE_ARG_CMDS = /* @__PURE__ */ new Set(["cp", "mv", "install", "rsync"]);
+  const SOURCE_ARG_CMDS = new Set(_LOGIC.source_arg_commands ?? []);
   const REDIRECT_TARGET_RE = new RegExp(`>{1,2}\\s*(?!&)(?:'(/[^']+)'|"(/[^\\"]+)"|(/[^\\s;|&><'\\"]+))`);
   const targetPaths = [];
   for (const seg of splitCommandSegments(actionDetail)) {
@@ -1747,7 +1551,6 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
       }
     }
   }
-  const TEMP_DIRS = ["/tmp/", "/var/tmp/", "/dev/shm/", "/run/"];
   let filteredPaths = uniqueTargetPaths;
   if (/\bdd\b/i.test(actionDetail) && /\bif=\/dev\/zero\b/i.test(actionDetail)) {
     filteredPaths = uniqueTargetPaths.filter(
@@ -1848,10 +1651,10 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd, osType) {
   if (!hasTraversal) {
     return null;
   }
-  const READ_KEYWORDS = ["read(", "readline", "readlines", "fread", "fgets", "load(", "getpass", "file_get_contents"];
-  const WRITE_KEYWORDS2 = ["write(", "writelines", "fwrite", "file_put_contents"];
-  const EXEC_KEYWORDS = ["system(", "exec(", "eval(", "popen(", "os.system", "os.popen", "subprocess", "os.exec", "os.spawn", "shell=true", "check_output", "check_call", "run(", "passthru", "shell_exec", "proc_open"];
-  const OPEN_KEYWORDS = ["open(", "fopen("];
+  const READ_KEYWORDS = IFA_READ_KEYWORDS;
+  const WRITE_KEYWORDS2 = IFA_WRITE_KEYWORDS;
+  const EXEC_KEYWORDS = IFA_EXEC_KEYWORDS;
+  const OPEN_KEYWORDS = IFA_OPEN_KEYWORDS;
   const code = extractInlineCode(actionDetail);
   if (!code) return null;
   const codeLower = code.toLowerCase();
@@ -1914,7 +1717,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd, osType) {
     violatedLayers: ["L2.1"]
   };
 }
-var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
+var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
 var init_logic_rules = __esm({
   "src/engine/logic-rules.ts"() {
     "use strict";
@@ -1924,6 +1727,10 @@ var init_logic_rules = __esm({
     init_rules_loader();
     init_platform_traits();
     init_shell_split();
+    _LOGIC = loadLogicRules();
+    _HEURISTIC = loadHeuristicRules();
+    EXCLUDED_PREFIXES = _HEURISTIC.sensitive_excluded_prefixes ?? [];
+    TEMP_DIRS = (_HEURISTIC.temp_dirs ?? []).map((d) => d + "/");
     ROOT_SENSITIVE_PATHS = _loadSensitivePathScope("root");
     HOME_SENSITIVE_PATHS = _loadSensitivePathScope("home");
     CREDENTIAL_PATHS = _loadSensitivePathScope("credential").map(({ path: path6, riskLevel, desc, dirDelOnly }) => ({ path: path6, riskLevel, desc, credential: true, dirDelOnly }));
@@ -1944,7 +1751,7 @@ var init_logic_rules = __esm({
       "list_dir",
       "count_text_length",
       "search",
-      // filemgr 只读三件套（globfiles 在 coordinator FULLY_SAFE_TOOLS 提前放行，此处兜底防御非 coordinator 入口）
+      // filemgr 只读三件套（globfiles 在 platform-traits 的 safeActionTypes 提前放行，此处兜底防御非 coordinator 入口）
       "filemgr-globfiles",
       "filemgr-readfile",
       "filemgr-grepfiles",
@@ -1956,7 +1763,7 @@ var init_logic_rules = __esm({
       "tail",
       "cat"
     ]);
-    NON_WRITE_TOOL_PREFIXES = ["memory-", "skill-manager-", "mailbox-", "app-"];
+    NON_WRITE_TOOL_PREFIXES = _LOGIC.non_write_tool_prefixes ?? [];
     WRITE_KEYWORDS = ["write", "\u5199\u5165", "save", "\u4FDD\u5B58", "modify", "\u4FEE\u6539", "update", "\u66F4\u65B0", "delete", "\u5220\u9664", "remove", "\u79FB\u9664", "create", "\u521B\u5EFA", "append", "\u8FFD\u52A0", "truncate", "\u622A\u65AD", "overwrite", "\u8986\u76D6", "replace", "\u66FF\u6362", "edit"];
     SED_INPLACE_RE = /\bsed\s+(?:-\S+\s+)*(?:-[a-zA-Z]*i[a-zA-Z]*|--in-place)\b/i;
     DEVNULL_REDIRECT_RE = /(?:2|&|1)?\s*>\s*\/dev\/null\b/g;
@@ -1997,25 +1804,24 @@ var init_logic_rules = __esm({
       }));
     })();
     INLINE_SCRIPT_RE = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
-    DIR_TRAVERSAL_KW = [
-      "os.listdir",
-      "os.walk",
-      "os.scandir",
-      "glob.glob",
-      "glob.iglob",
-      "pathlib.",
-      "iterdir",
-      "rglob",
-      "scandir(",
-      "listdir("
-    ];
+    DIR_TRAVERSAL_KW = loadInline().dir_traversal_keywords ?? [];
+    _IFA = loadLogicRules().indirect_file_access ?? {};
+    IFA_READ_KEYWORDS = _IFA.read_keywords ?? [];
+    IFA_WRITE_KEYWORDS = _IFA.write_keywords ?? [];
+    IFA_EXEC_KEYWORDS = _IFA.exec_keywords ?? [];
+    IFA_OPEN_KEYWORDS = _IFA.open_keywords ?? [];
   }
 });
 
 // src/engine/asset-dir.ts
-import { existsSync as existsSync3 } from "fs";
-import { resolve as resolve2 } from "path";
+import { existsSync as existsSync4 } from "fs";
+import { join as join4, resolve as resolve2 } from "path";
 function assetDirCandidates(moduleDir, name) {
+  const root = getRulesRoot();
+  if (root) {
+    const p = join4(root, name);
+    return [p, p];
+  }
   return [
     resolve2(moduleDir, name),
     resolve2(moduleDir, "../../..", "agent_moss", name)
@@ -2023,7 +1829,7 @@ function assetDirCandidates(moduleDir, name) {
 }
 function resolveAssetDir(moduleDir, name) {
   for (const dir of assetDirCandidates(moduleDir, name)) {
-    if (existsSync3(dir)) return dir;
+    if (existsSync4(dir)) return dir;
   }
   return null;
 }
@@ -2031,11 +1837,12 @@ var init_asset_dir = __esm({
   "src/engine/asset-dir.ts"() {
     "use strict";
     init_esm_shims();
+    init_paths();
   }
 });
 
 // src/engine/skill-loader.ts
-import { readFileSync as readFileSync3, readdirSync as readdirSync3, existsSync as existsSync4 } from "fs";
+import { readFileSync as readFileSync4, readdirSync as readdirSync3, existsSync as existsSync5 } from "fs";
 import { resolve as resolve3, dirname as dirname2 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function loadAllSkills() {
@@ -2050,7 +1857,7 @@ function loadAllSkills() {
   const files = readdirSync3(dir).filter((f) => f.endsWith(".md"));
   for (const f of files) {
     const name = f.replace(".md", "");
-    cachedSkills[name] = readFileSync3(resolve3(dir, f), "utf-8");
+    cachedSkills[name] = readFileSync4(resolve3(dir, f), "utf-8");
   }
   console.log(`[AgentMoss] Loaded ${Object.keys(cachedSkills).length} skills from ${dir}`);
   return cachedSkills;
@@ -2081,7 +1888,7 @@ function loadUserSkill(name) {
   if (userSkillCache[name] !== void 0) return userSkillCache[name];
   try {
     const p = resolve3(userSkillsDir(), `${name}.md`);
-    userSkillCache[name] = existsSync4(p) ? readFileSync3(p, "utf-8") : "";
+    userSkillCache[name] = existsSync5(p) ? readFileSync4(p, "utf-8") : "";
   } catch {
     userSkillCache[name] = "";
   }
@@ -2230,8 +2037,8 @@ __export(runtime_config_exports, {
   updateSkillCategoryEnabled: () => updateSkillCategoryEnabled,
   updateSkillEnabled: () => updateSkillEnabled
 });
-import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync5, mkdirSync, unlinkSync, readdirSync as readdirSync4, statSync as statSync2 } from "fs";
-import { join as join3 } from "path";
+import { readFileSync as readFileSync5, writeFileSync, existsSync as existsSync6, mkdirSync, unlinkSync, readdirSync as readdirSync4, statSync as statSync2 } from "fs";
+import { join as join5 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { dirname as dirname3 } from "path";
 function runtimeDir() {
@@ -2260,7 +2067,7 @@ function saveRuntimeConfig(config) {
   }
   const p = getRuntimeConfigPath();
   const dir = p.substring(0, p.lastIndexOf("/"));
-  if (dir && !existsSync5(dir)) mkdirSync(dir, { recursive: true });
+  if (dir && !existsSync6(dir)) mkdirSync(dir, { recursive: true });
   writeFileSync(p, JSON.stringify(config, null, 2), "utf-8");
   invalidateRuntimeConfigCache();
 }
@@ -2294,7 +2101,7 @@ function loadRuntimeConfig() {
     };
   }
   const p = getRuntimeConfigPath();
-  if (!existsSync5(p)) {
+  if (!existsSync6(p)) {
     const seeded = mergeConfig({}, generateSourceDefaults());
     try {
       saveRuntimeConfig(seeded);
@@ -2308,7 +2115,7 @@ function loadRuntimeConfig() {
     if (runtimeConfigCache && runtimeConfigCache.key === cacheKey) {
       return runtimeConfigCache.value;
     }
-    const data = JSON.parse(readFileSync4(p, "utf-8"));
+    const data = JSON.parse(readFileSync5(p, "utf-8"));
     const merged = mergeConfig(data, generateSourceDefaults());
     const result = {
       version: data.version || 1,
@@ -2366,7 +2173,10 @@ function filterEnabledRules(rules, categoryEnabled = true) {
 }
 function _filterRulesByOs(rules, osType) {
   const accepted = acceptedOsValues(osType);
-  return rules.filter((r) => accepted.includes(String(r.os || "linux").toLowerCase()));
+  return rules.filter((r) => {
+    const os4 = String(r.os || "linux").toLowerCase();
+    return os4 === "all" || accepted.includes(os4);
+  });
 }
 function _userCustomRules(runtime, layers, requiredKey) {
   const list = Array.isArray(layers) ? layers : [layers];
@@ -2453,7 +2263,7 @@ function hasRuntimeConfig() {
   if (cached2 !== void 0) return cached2;
   let ok = false;
   try {
-    JSON.parse(readFileSync4(p, "utf-8"));
+    JSON.parse(readFileSync5(p, "utf-8"));
     ok = true;
   } catch {
     ok = false;
@@ -2553,6 +2363,9 @@ function _l1InjectionKeywordsToRules() {
     keyword: kw.keyword,
     risk_level: kw.riskLevel,
     lang: kw.lang || "en",
+    // 带上条目自己的 os（`all` = 全平台通用），别丢 —— 丢了 Windows 会拿到
+    // 本不该给它的条目。与 Python `_l1_injection_keywords_to_rules` 对齐。
+    os: kw.os,
     enabled: true,
     builtin: true
   }));
@@ -2670,8 +2483,9 @@ function _l3SkillsToRules() {
 }
 function _scenarioRulesToDefaults() {
   const out = {};
-  const scenDir = existsSync5(_SCENARIOS_DIR_PROD) ? _SCENARIOS_DIR_PROD : existsSync5(_SCENARIOS_DIR_DEV) ? _SCENARIOS_DIR_DEV : _SCENARIOS_DIR_PROD;
-  if (!existsSync5(scenDir)) return out;
+  const _root = getRulesRoot();
+  const scenDir = _root ? join5(_root, "scenarios") : existsSync6(_SCENARIOS_DIR_PROD) ? _SCENARIOS_DIR_PROD : existsSync6(_SCENARIOS_DIR_DEV) ? _SCENARIOS_DIR_DEV : _SCENARIOS_DIR_PROD;
+  if (!existsSync6(scenDir)) return out;
   let entries;
   try {
     entries = readdirSync4(scenDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
@@ -2679,11 +2493,11 @@ function _scenarioRulesToDefaults() {
     return out;
   }
   for (const scenarioId of entries) {
-    const rulesFile = resolveScenarioRulesFile(scenarioId) ?? join3(scenDir, scenarioId, "rules.json");
-    if (!existsSync5(rulesFile)) continue;
+    const rulesFile = resolveScenarioRulesFile(scenarioId) ?? join5(scenDir, scenarioId, "rules.json");
+    if (!existsSync6(rulesFile)) continue;
     let data;
     try {
-      data = JSON.parse(readFileSync4(rulesFile, "utf-8"));
+      data = JSON.parse(readFileSync5(rulesFile, "utf-8"));
     } catch {
       continue;
     }
@@ -2719,8 +2533,9 @@ function _scenarioRulesToDefaults() {
 }
 function _agentRulesToDefaults() {
   const out = {};
-  const agentsDir = existsSync5(_AGENTS_DIR_PROD) ? _AGENTS_DIR_PROD : existsSync5(_AGENTS_DIR_DEV) ? _AGENTS_DIR_DEV : _AGENTS_DIR_PROD;
-  if (!existsSync5(agentsDir)) return out;
+  const _root = getRulesRoot();
+  const agentsDir = _root ? join5(_root, "agents") : existsSync6(_AGENTS_DIR_PROD) ? _AGENTS_DIR_PROD : existsSync6(_AGENTS_DIR_DEV) ? _AGENTS_DIR_DEV : _AGENTS_DIR_PROD;
+  if (!existsSync6(agentsDir)) return out;
   let entries;
   try {
     entries = readdirSync4(agentsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
@@ -2728,11 +2543,11 @@ function _agentRulesToDefaults() {
     return out;
   }
   for (const agentId of entries) {
-    const rulesFile = join3(agentsDir, agentId, "rules.json");
-    if (!existsSync5(rulesFile)) continue;
+    const rulesFile = join5(agentsDir, agentId, "rules.json");
+    if (!existsSync6(rulesFile)) continue;
     let data;
     try {
-      data = JSON.parse(readFileSync4(rulesFile, "utf-8"));
+      data = JSON.parse(readFileSync5(rulesFile, "utf-8"));
     } catch {
       continue;
     }
@@ -3107,7 +2922,11 @@ function getDisabledSkillIds(runtime) {
 }
 function _filterDefaultsByOs(rules, osType) {
   const accepted = acceptedOsValues(osType);
-  return rules.filter((r) => !r.os || accepted.includes(String(r.os).toLowerCase()));
+  return rules.filter((r) => {
+    if (!r.os) return true;
+    const os4 = String(r.os).toLowerCase();
+    return os4 === "all" || accepted.includes(os4);
+  });
 }
 function _hasRulesForOs(rules, osType) {
   return _filterRulesByOs(rules || [], osType || "linux").length > 0;
@@ -3336,12 +3155,12 @@ function addCustomSkill(skillId, category, keywords, content) {
     );
   }
   const runtime = loadRuntimeConfig();
-  const skillsDir = join3(getRuntimeConfigDir(), "agent_moss_skills");
+  const skillsDir = join5(getRuntimeConfigDir(), "agent_moss_skills");
   try {
     mkdirSync(skillsDir, { recursive: true });
   } catch {
   }
-  writeFileSync(join3(skillsDir, `${skillId}.md`), content, "utf-8");
+  writeFileSync(join5(skillsDir, `${skillId}.md`), content, "utf-8");
   const l3 = runtime.L3_skills || (runtime.L3_skills = {});
   const cat = l3[category] || (l3[category] = { category_enabled: true, category_desc: "", skills: [] });
   (cat.skills || (cat.skills = [])).push({ id: skillId, keywords, enabled: true, builtin: false });
@@ -3356,9 +3175,9 @@ function deleteCustomSkill(skillId, category) {
   if (idx >= 0) {
     if (skills[idx].builtin) return null;
     skills.splice(idx, 1);
-    const skillPath = join3(getRuntimeConfigDir(), "agent_moss_skills", `${skillId}.md`);
+    const skillPath = join5(getRuntimeConfigDir(), "agent_moss_skills", `${skillId}.md`);
     try {
-      if (existsSync5(skillPath)) unlinkSync(skillPath);
+      if (existsSync6(skillPath)) unlinkSync(skillPath);
     } catch {
     }
     saveRuntimeConfig(runtime);
@@ -3565,7 +3384,7 @@ var init_runtime_config = __esm({
     __dirname4 = dirname3(fileURLToPath4(import.meta.url));
     ENV_RUNTIME_CONFIG_PATH = "AGENT_MOSS_RUNTIME_CONFIG_PATH";
     RUNTIME_CONFIG_DIR = runtimeDir();
-    RUNTIME_CONFIG_PATH = join3(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
+    RUNTIME_CONFIG_PATH = join5(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
     LAYER_DISABLE_ENV = {
       L1_heuristic: "AGENT_MOSS_DISABLE_HEURISTIC",
       L2_logic_rules: "AGENT_MOSS_DISABLE_LOGIC_RULES",
@@ -3593,10 +3412,10 @@ var init_runtime_config = __esm({
       intent_consistency: ["intent_keywords", "reason"]
     };
     hasRuntimeConfigCache = /* @__PURE__ */ new Map();
-    _AGENTS_DIR_PROD = join3(__dirname4, "agents");
-    _AGENTS_DIR_DEV = join3(__dirname4, "..", "..", "..", "agent_moss", "agents");
-    _SCENARIOS_DIR_PROD = join3(__dirname4, "scenarios");
-    _SCENARIOS_DIR_DEV = join3(__dirname4, "..", "..", "..", "agent_moss", "scenarios");
+    _AGENTS_DIR_PROD = join5(__dirname4, "agents");
+    _AGENTS_DIR_DEV = join5(__dirname4, "..", "..", "..", "agent_moss", "agents");
+    _SCENARIOS_DIR_PROD = join5(__dirname4, "scenarios");
+    _SCENARIOS_DIR_DEV = join5(__dirname4, "..", "..", "..", "agent_moss", "scenarios");
     _effectiveCache = /* @__PURE__ */ new WeakMap();
     SKILL_ID_RE = /^[A-Za-z0-9_-]+$/;
     registerRuntimeConfigBridge({
@@ -3934,12 +3753,14 @@ var init_config = __esm({
 });
 
 // src/agents/index.ts
-import { readFileSync as readFileSync5, existsSync as existsSync6 } from "fs";
-import { resolve as resolve4, dirname as dirname4 } from "path";
+import { readFileSync as readFileSync6, existsSync as existsSync7 } from "fs";
+import { resolve as resolve4, dirname as dirname4, join as join6 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 function resolveAgentsDir() {
-  if (existsSync6(AGENTS_DIR_PROD)) return AGENTS_DIR_PROD;
-  if (existsSync6(AGENTS_DIR_DEV_FALLBACK)) return AGENTS_DIR_DEV_FALLBACK;
+  const root = getRulesRoot();
+  if (root) return join6(root, "agents");
+  if (existsSync7(AGENTS_DIR_PROD)) return AGENTS_DIR_PROD;
+  if (existsSync7(AGENTS_DIR_DEV_FALLBACK)) return AGENTS_DIR_DEV_FALLBACK;
   return AGENTS_DIR_PROD;
 }
 function getAgentExtensions(agentId) {
@@ -3957,12 +3778,12 @@ function getAgentExtensions(agentId) {
   if (ext === null) {
     const agentsDir = resolveAgentsDir();
     const rulesFile = resolve4(agentsDir, agentId, "rules.json");
-    if (!existsSync6(rulesFile)) {
+    if (!existsSync7(rulesFile)) {
       cache.set(agentId, { fp, ext: null });
       return null;
     }
     try {
-      const raw = readFileSync5(rulesFile, "utf-8");
+      const raw = readFileSync6(rulesFile, "utf-8");
       ext = JSON.parse(raw);
       if (!ext.agent_id) {
         console.warn(`[AgentMoss agents] rules.json \u7F3A\u5C11 agent_id \u5B57\u6BB5: ${rulesFile}`);
@@ -4001,6 +3822,7 @@ var init_agents = __esm({
   "src/agents/index.ts"() {
     "use strict";
     init_esm_shims();
+    init_paths();
     init_runtime_config();
     __filename4 = fileURLToPath6(import.meta.url);
     __dirname5 = dirname4(__filename4);
@@ -4011,12 +3833,14 @@ var init_agents = __esm({
 });
 
 // src/scenarios/index.ts
-import { readFileSync as readFileSync6, existsSync as existsSync7 } from "fs";
-import { resolve as resolve5, dirname as dirname5 } from "path";
+import { readFileSync as readFileSync7, existsSync as existsSync8 } from "fs";
+import { resolve as resolve5, dirname as dirname5, join as join7 } from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 function resolveScenariosDir() {
-  if (existsSync7(SCENARIOS_DIR_PROD)) return SCENARIOS_DIR_PROD;
-  if (existsSync7(SCENARIOS_DIR_DEV_FALLBACK)) return SCENARIOS_DIR_DEV_FALLBACK;
+  const root = getRulesRoot();
+  if (root) return join7(root, "scenarios");
+  if (existsSync8(SCENARIOS_DIR_PROD)) return SCENARIOS_DIR_PROD;
+  if (existsSync8(SCENARIOS_DIR_DEV_FALLBACK)) return SCENARIOS_DIR_DEV_FALLBACK;
   return SCENARIOS_DIR_PROD;
 }
 function getScenarioExtensions(scenarioId) {
@@ -4046,12 +3870,12 @@ function getScenarioExtensions(scenarioId) {
         `[AgentMoss] \u26A0\uFE0F  \u573A\u666F ${scenarioId} \u89C4\u5219\u88AB\u8986\u76D6\u76EE\u5F55\u8986\u76D6: ${overrideHit}\uFF08\u5185\u7F6E\u9ED8\u8BA4 ${builtinFile} \u88AB\u5FFD\u7565\uFF09\u3002\u8BE5\u6587\u4EF6\u7531\u90E8\u7F72\u4FA7\u81EA\u884C\u7EF4\u62A4\uFF0C\u5185\u7F6E\u573A\u666F\u89C4\u5219\u66F4\u65B0\u4E0D\u4F1A\u53CD\u6620\u5230\u5B83\u4E0A\u9762\u3002`
       );
     }
-    if (!existsSync7(rulesFile)) {
+    if (!existsSync8(rulesFile)) {
       cache2.set(scenarioId, { fp, ext: null });
       return null;
     }
     try {
-      const raw = readFileSync6(rulesFile, "utf-8");
+      const raw = readFileSync7(rulesFile, "utf-8");
       const data = JSON.parse(raw);
       const id = data.scenario_id || data.agent_id || "";
       if (!id) {
@@ -4095,6 +3919,7 @@ var init_scenarios = __esm({
   "src/scenarios/index.ts"() {
     "use strict";
     init_esm_shims();
+    init_paths();
     init_agents();
     init_runtime_config();
     init_rules_loader();
@@ -4501,7 +4326,7 @@ function severityRank(s) {
 }
 function isSearchActionType(actionType) {
   const at = actionType.toLowerCase();
-  return SEARCH_ACTION_PREFIXES.some((p) => at.startsWith(p)) || ["websearch", "web_search", "search", "query"].includes(at);
+  return SEARCH_ACTION_PREFIXES.some((p) => at.startsWith(p)) || SEARCH_ACTION_EXACT.includes(at);
 }
 function checkSensitivePath(command, cwd, agentExt, osType) {
   const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
@@ -4791,8 +4616,7 @@ function isSshKeygenGenerate(command) {
 function checkDangerousPatterns(actionType, actionDetail) {
   if (actionType === "file_write" || actionType === "file_edit") return null;
   const scan = stripHeredocContent(actionDetail);
-  const TEMP_DIRS = ["/tmp", "/var/tmp", "/run", "/dev/shm"];
-  const isTempPath = TEMP_DIRS.some(
+  const isTempPath = TEMP_DIRS2.some(
     (td) => new RegExp(`(?:^|[\\s/])${td.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[\\s/]|$)`).test(actionDetail)
   ) || /(?:^|[\s;]|&&\s*|\|\|\s*)var\/tmp(?:[/\s;]|$)/.test(actionDetail);
   const wildcardDeleteRe = /(?:\brm\b|\b(r?mdir|del|delete|remove|rmdir|unlink)\b|\b删除\b|\b移除\b)[\s\S]{0,40}?[*?]|[*?][\s\S]{0,40}?\b(?:rm|del|delete|remove|rmdir|unlink)\b|rm\s+-[a-zA-Z]*[rf][a-zA-Z]*\s+\S*[*?]/i;
@@ -4938,7 +4762,7 @@ function checkLateralMovement(actionDetail) {
   }
   return null;
 }
-var INJECTION_KEYWORDS, DANGEROUS_PATTERNS2, DANGEROUS_PATTERNS_WINDOWS, DANGEROUS_PATTERNS_MACOS, DANGEROUS_PATTERNS_HARMONY, LOOPBACK_URL_RE, LOOPBACK_HOSTS, PATH_CONTEXT_TRIGGER_RE, HOME_PREFIX_RE, PY_EXEC_IO_RE, PY_PRINT_RE, PY_BIGNUM_RE, PY_INLINE_C_RE, PY_CMD_SUBST_C_RE, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES, HOME_TARGET_RE, HOME_ASSIGN_RE;
+var INJECTION_KEYWORDS, DANGEROUS_PATTERNS2, DANGEROUS_PATTERNS_WINDOWS, DANGEROUS_PATTERNS_MACOS, DANGEROUS_PATTERNS_HARMONY, LOOPBACK_URL_RE, HEURISTIC_RULES, LOOPBACK_HOSTS, TEMP_DIRS2, PATH_CONTEXT_TRIGGER_RE, HOME_PREFIX_RE, PY_EXEC_IO_RE, PY_PRINT_RE, PY_BIGNUM_RE, PY_INLINE_C_RE, PY_CMD_SUBST_C_RE, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES, SEARCH_ACTION_EXACT, HOME_TARGET_RE, HOME_ASSIGN_RE;
 var init_heuristic = __esm({
   "src/engine/heuristic.ts"() {
     "use strict";
@@ -4955,7 +4779,8 @@ var init_heuristic = __esm({
       return kws.map((k) => ({
         keyword: k.keyword,
         riskLevel: k.risk_level,
-        lang: k.lang || "en"
+        lang: k.lang || "en",
+        os: String(k.os || "all").toLowerCase()
       }));
     })();
     DANGEROUS_PATTERNS2 = _loadDangerousPatterns("linux");
@@ -4963,7 +4788,9 @@ var init_heuristic = __esm({
     DANGEROUS_PATTERNS_MACOS = _loadDangerousPatterns("macos");
     DANGEROUS_PATTERNS_HARMONY = _loadDangerousPatterns("harmony");
     LOOPBACK_URL_RE = /https?:\/\/([^\/\s;'"|&)]+)/i;
-    LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "::1", "0.0.0.0", "[::1]"]);
+    HEURISTIC_RULES = loadHeuristicRules();
+    LOOPBACK_HOSTS = new Set(HEURISTIC_RULES.loopback_hosts ?? []);
+    TEMP_DIRS2 = HEURISTIC_RULES.temp_dirs ?? [];
     PATH_CONTEXT_TRIGGER_RE = /(?:^|[;&|]\s*)(?:rm|rmdir|unlink|ln|mv|cp|dd|truncate|shred|chmod|chown)\b/i;
     HOME_PREFIX_RE = /(?:~|~(?=\/)|\$HOME\b|\$\{HOME\}|\/home\/[a-z0-9_.-]+)/gi;
     PY_EXEC_IO_RE = /os\.system|os\.popen|subprocess|eval\s*\(|exec\s*\(|__import__|open\s*\(|socket|urllib|requests\.|shutil|os\.(?:remove|unlink|rename|makedirs?|listdir|scandir|walk|chmod|chown|kill|environ)|iterdir|glob\s*\(|path\(/i;
@@ -4971,15 +4798,16 @@ var init_heuristic = __esm({
     PY_BIGNUM_RE = /\d{6,}/;
     PY_INLINE_C_RE = /(python(?:3(?:\.\d+)?)?|perl5?|ruby|node|php|lua)\s+(?:-[a-zA-Z]+\s+)*-c\s+(?:"([^"]*)"|'([^']*)')/i;
     PY_CMD_SUBST_C_RE = /\$\(\s*(python(?:3(?:\.\d+)?)?|perl5?|ruby|node|php|lua)\s+(?:-[a-zA-Z]+\s+)*-c\s+(?:"([^"]*)"'|'([^']*)')\s*\)/i;
-    SENSITIVE_EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
-    SEARCH_ACTION_PREFIXES = ["search-", "web-", "browser-", "query-", "websearch", "web_search"];
+    SENSITIVE_EXCLUDED_PREFIXES = HEURISTIC_RULES.sensitive_excluded_prefixes ?? [];
+    SEARCH_ACTION_PREFIXES = HEURISTIC_RULES.search_action_prefixes ?? [];
+    SEARCH_ACTION_EXACT = HEURISTIC_RULES.search_action_exact ?? [];
     HOME_TARGET_RE = /(?:^|[\s="'($])(?:~|(?:\$home|\$\{home\}))(?:\/(?:\.\*|\*|\.)?)?(?=[\s"';}|&)]|$)/i;
     HOME_ASSIGN_RE = /([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(~[A-Za-z0-9_./-]*|\$HOME[A-Za-z0-9_./-]*|\$\{HOME\}[A-Za-z0-9_./-]*|\/home\/[^\s;|&]+|\$\((?:[^()]|\([^()]*\))*\))(?=\s|;|$|\||&)/gi;
   }
 });
 
 // src/engine/template-loader.ts
-import { readFileSync as readFileSync7, existsSync as existsSync8 } from "fs";
+import { readFileSync as readFileSync8, existsSync as existsSync9 } from "fs";
 import { resolve as resolve6, dirname as dirname6 } from "path";
 import { fileURLToPath as fileURLToPath8 } from "url";
 function loadTemplates() {
@@ -4993,9 +4821,9 @@ function loadTemplates() {
   }
   for (const file of TEMPLATE_FILES) {
     const filePath = resolve6(dir, file);
-    if (existsSync8(filePath)) {
+    if (existsSync9(filePath)) {
       const key = file.replace(".txt", "").replace("_template", "");
-      cachedTemplates[key] = readFileSync7(filePath, "utf-8");
+      cachedTemplates[key] = readFileSync8(filePath, "utf-8");
     }
   }
   console.log(`[AgentMoss] Loaded ${Object.keys(cachedTemplates).length} templates from ${dir}`);
@@ -5015,8 +4843,8 @@ var init_template_loader = __esm({
 });
 
 // src/engine/script-analyzer.ts
-import { readFileSync as readFileSync8 } from "fs";
-import { resolve as resolve7, join as join4 } from "path";
+import { readFileSync as readFileSync9 } from "fs";
+import { resolve as resolve7, join as join8 } from "path";
 function emptyResult() {
   return { scriptPath: "", scriptContent: "", matchedKeywords: [], lineCount: 0, isSuspicious: false, error: "", riskLevel: "", riskReason: "" };
 }
@@ -5042,10 +4870,10 @@ function assessKeywordCombinationRisk(matchedKeywords, scriptContent) {
     const hitGroup2 = rule.group2.size === 0 ? true : [...rule.group2].some((k) => keywordSet.has(k));
     if (hitGroup1 && hitGroup2) return { level: rule.level, reason: rule.reason };
   }
-  const networkPostKeywords = /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]);
+  const networkPostKeywords = new Set(KEYWORD_SETS.network_post ?? []);
   const hasNetworkPost = [...networkPostKeywords].some((k) => keywordSet.has(k));
   if (hasNetworkPost) {
-    const envPatterns = ["$env", "$(env)", "$USER", "$(hostname)", "$(pwd)", "$HOME"];
+    const envPatterns = SCRIPT_RULES.env_exfil_patterns ?? [];
     const contentLower = scriptContent.toLowerCase();
     for (const p of envPatterns) {
       if (contentLower.includes(p.toLowerCase())) {
@@ -5069,8 +4897,8 @@ function assessKeywordCombinationRisk(matchedKeywords, scriptContent) {
 }
 function readScriptContent(scriptPath, maxLines = 500) {
   try {
-    const expandedPath = scriptPath === "~" || scriptPath.startsWith("~/") ? join4(process.env.HOME || "/home/user", scriptPath.slice(1)) : resolve7(scriptPath);
-    const raw = readFileSync8(expandedPath, "utf-8");
+    const expandedPath = scriptPath === "~" || scriptPath.startsWith("~/") ? join8(process.env.HOME || "/home/user", scriptPath.slice(1)) : resolve7(scriptPath);
+    const raw = readFileSync9(expandedPath, "utf-8");
     const lines = raw.split("\n").slice(0, maxLines);
     return { content: lines.join("\n"), lineCount: lines.length, error: "" };
   } catch (e) {
@@ -5119,90 +4947,28 @@ ${result.scriptContent}
 \`\`\`
 `;
 }
-var SUSPICIOUS_PATTERNS, SCRIPT_EXEC_PATTERNS, KEYWORD_COMBINATION_RISKS, SINGLE_KEYWORD_RISKS, LEVEL_ORDER;
+var SCRIPT_RULES, SUSPICIOUS_PATTERNS, SCRIPT_EXEC_PATTERNS, KEYWORD_SETS, KEYWORD_COMBINATION_RISKS, SINGLE_KEYWORD_RISKS, LEVEL_ORDER;
 var init_script_analyzer = __esm({
   "src/engine/script-analyzer.ts"() {
     "use strict";
     init_esm_shims();
-    SUSPICIOUS_PATTERNS = [
-      // Network exfiltration (curl/wget POST in scripts is almost never legitimate)
-      { name: "curl POST", pattern: /curl\s+(.*\s)?-X\s+POST/i },
-      { name: "curl --data", pattern: /curl\s+(.*\s)?--data/i },
-      { name: "curl -d", pattern: /curl\s+(.*\s)?-d\s/i },
-      { name: "wget --post-data", pattern: /wget\s+(.*\s)?--post-data/i },
-      { name: "wget --post-file", pattern: /wget\s+(.*\s)?--post-file/i },
-      // Reverse shell
-      { name: "nc -e", pattern: /\bnc\s+.*-e\b/ },
-      { name: "ncat -e", pattern: /\bncat\s+.*-e\b/ },
-      { name: "/dev/tcp", pattern: /\/dev\/tcp\// },
-      { name: "/dev/udp", pattern: /\/dev\/udp\// },
-      // Base64 obfuscation
-      { name: "$(base64", pattern: /\$\(\s*base64/ },
-      { name: "`base64", pattern: /`\s*base64/ },
-      { name: "base64 decode pipe", pattern: /base64\s+(-d|--decode)\s*\|/ },
-      // Sensitive file access
-      { name: "/etc/shadow", pattern: /\/etc\/shadow/ },
-      { name: "id_rsa", pattern: /\bid_rsa\b/ },
-      { name: "id_ed25519", pattern: /\bid_ed25519\b/ },
-      // Persistence backdoor
-      { name: "crontab install", pattern: /crontab\s+-/ },
-      { name: "authorized_keys", pattern: /authorized_keys/ },
-      { name: "ssh no host key check", pattern: /ssh\s+.*StrictHostKeyChecking\s*=\s*no/ }
-    ];
-    SCRIPT_EXEC_PATTERNS = [
-      /bash\s+(\S+\.sh)/,
-      /sh\s+(\S+\.sh)/,
-      /\.\/(\S+\.sh)/,
-      /source\s+(\S+\.sh)/,
-      /\.\s+(\S+\.sh)/,
-      /zsh\s+(\S+\.sh)/
-    ];
-    KEYWORD_COMBINATION_RISKS = [
-      {
-        group1: /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]),
-        group2: /* @__PURE__ */ new Set(["$(base64", "`base64", "base64 decode pipe"]),
-        level: "critical",
-        reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + Base64\u7F16\u7801\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u6570\u636E\u5916\u4F20\u98CE\u9669\u3002\u653B\u51FB\u8005\u53EF\u80FD\u5C06\u654F\u611F\u6570\u636E\u7F16\u7801\u540E\u5916\u4F20\u3002"
-      },
-      {
-        group1: /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]),
-        group2: /* @__PURE__ */ new Set(["/etc/shadow", "id_rsa", "id_ed25519"]),
-        level: "critical",
-        reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + \u654F\u611F\u6587\u4EF6\u8BBF\u95EE\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u51ED\u8BC1\u5916\u4F20\u98CE\u9669\u3002"
-      },
-      {
-        group1: /* @__PURE__ */ new Set(["nc -e", "ncat -e", "/dev/tcp", "/dev/udp"]),
-        group2: /* @__PURE__ */ new Set(),
-        level: "high",
-        reason: "\u68C0\u6D4B\u5230\u53CD\u5F39 Shell \u7279\u5F81\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5EFA\u7ACB\u8FDC\u7A0B\u63A7\u5236\u901A\u9053\u3002"
-      },
-      {
-        group1: /* @__PURE__ */ new Set(["crontab install", "authorized_keys", "ssh no host key check"]),
-        group2: /* @__PURE__ */ new Set(),
-        level: "high",
-        reason: "\u68C0\u6D4B\u5230\u6301\u4E45\u5316\u540E\u95E8\u7279\u5F81\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5728\u7CFB\u7EDF\u4E2D\u690D\u5165\u540E\u95E8\u3002"
-      }
-    ];
-    SINGLE_KEYWORD_RISKS = {
-      "curl POST": { level: "high", reason: "\u68C0\u6D4B\u5230 curl POST \u8BF7\u6C42\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
-      "curl --data": { level: "high", reason: "\u68C0\u6D4B\u5230 curl --data \u53C2\u6570\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
-      "curl -d": { level: "high", reason: "\u68C0\u6D4B\u5230 curl -d \u53C2\u6570\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
-      "wget --post-data": { level: "high", reason: "\u68C0\u6D4B\u5230 wget POST \u8BF7\u6C42\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
-      "wget --post-file": { level: "high", reason: "\u68C0\u6D4B\u5230 wget \u6587\u4EF6\u4E0A\u4F20\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6587\u4EF6\u3002" },
-      "nc -e": { level: "critical", reason: "\u68C0\u6D4B\u5230 nc -e \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
-      "ncat -e": { level: "critical", reason: "\u68C0\u6D4B\u5230 ncat -e \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
-      "/dev/tcp": { level: "critical", reason: "\u68C0\u6D4B\u5230 /dev/tcp \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
-      "/dev/udp": { level: "critical", reason: "\u68C0\u6D4B\u5230 /dev/udp \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
-      "$(base64": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u7F16\u7801\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
-      "`base64": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u7F16\u7801\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
-      "base64 decode pipe": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u89E3\u7801\u540E\u7BA1\u9053\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
-      "/etc/shadow": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6\u3002" },
-      "id_rsa": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE SSH \u79C1\u94A5\u3002" },
-      "id_ed25519": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE SSH \u79C1\u94A5\u3002" },
-      "crontab install": { level: "high", reason: "\u68C0\u6D4B\u5230\u4FEE\u6539\u5B9A\u65F6\u4EFB\u52A1\uFF0C\u53EF\u80FD\u662F\u6301\u4E45\u5316\u540E\u95E8\u3002" },
-      "authorized_keys": { level: "high", reason: "\u68C0\u6D4B\u5230\u4FEE\u6539 SSH \u6388\u6743\u5BC6\u94A5\uFF0C\u53EF\u80FD\u662F\u6301\u4E45\u5316\u540E\u95E8\u3002" },
-      "ssh no host key check": { level: "high", reason: "\u68C0\u6D4B\u5230 SSH \u8DF3\u8FC7\u4E3B\u673A\u5BC6\u94A5\u9A8C\u8BC1\uFF0C\u53EF\u80FD\u662F\u6A2A\u5411\u79FB\u52A8\u3002" }
-    };
+    init_rules_loader();
+    SCRIPT_RULES = loadScriptRules();
+    if (!SCRIPT_RULES || Object.keys(SCRIPT_RULES).length === 0) {
+      console.error(
+        "[AgentMoss] \u274C \u89C4\u5219\u6587\u4EF6 script_rules.json \u7F3A\u5931\u6216\u635F\u574F \u2014\u2014 \u811A\u672C\u5173\u952E\u8BCD\u626B\u63CF\u5C06\u4E0D\u547D\u4E2D\u4EFB\u4F55\u6A21\u5F0F\uFF08\u6BD4\u6B63\u5E38\u66F4\u677E\uFF09\u3002\u8BF7\u68C0\u67E5\u5305\u5B8C\u6574\u6027\u3002"
+      );
+    }
+    SUSPICIOUS_PATTERNS = (SCRIPT_RULES.suspicious_patterns ?? []).map((r) => ({ name: r.name, pattern: compileRuleRegex(r) }));
+    SCRIPT_EXEC_PATTERNS = ((SCRIPT_RULES.script_exec_patterns ?? {}).legacy ?? []).map((r) => compileRuleRegex(r));
+    KEYWORD_SETS = SCRIPT_RULES.keyword_sets ?? {};
+    KEYWORD_COMBINATION_RISKS = (SCRIPT_RULES.keyword_combination_risks ?? []).map((r) => ({
+      group1: resolveKeywordSet(r.group1, KEYWORD_SETS),
+      group2: resolveKeywordSet(r.group2, KEYWORD_SETS),
+      level: String(r.level),
+      reason: String(r.reason)
+    }));
+    SINGLE_KEYWORD_RISKS = SCRIPT_RULES.single_keyword_risks ?? {};
     LEVEL_ORDER = { low: 1, medium: 2, high: 3, critical: 4 };
   }
 });
@@ -6746,8 +6512,8 @@ var init_tracker = __esm({
 });
 
 // src/engine/script-content-analyzer.ts
-import { statSync as statSync4, existsSync as existsSync10 } from "fs";
-import { resolve as resolve9, join as join6, isAbsolute as isAbsolute2 } from "path";
+import { statSync as statSync4, existsSync as existsSync11 } from "fs";
+import { resolve as resolve9, join as join10, isAbsolute as isAbsolute2 } from "path";
 import { homedir as homedir3 } from "os";
 function emptyChain() {
   return {
@@ -6780,10 +6546,10 @@ function assessKeywordCombinationRisk2(matchedKeywords, scriptContent) {
     const hitGroup2 = rule.group2.size === 0 ? true : [...rule.group2].some((k) => keywordSet.has(k));
     if (hitGroup1 && hitGroup2) return { level: rule.level, reason: rule.reason };
   }
-  const networkPostKeywords = /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]);
+  const networkPostKeywords = new Set(KEYWORD_SETS2.network_post ?? []);
   const hasNetworkPost = [...networkPostKeywords].some((k) => keywordSet.has(k));
   if (hasNetworkPost) {
-    const envPatterns = ["$env", "$(env)", "$USER", "$(hostname)", "$(pwd)", "$HOME"];
+    const envPatterns = SCRIPT_RULES2.env_exfil_patterns ?? [];
     const contentLower = scriptContent.toLowerCase();
     for (const p of envPatterns) {
       if (contentLower.includes(p.toLowerCase())) {
@@ -6859,7 +6625,7 @@ function extractInlineScriptPath(actionDetail) {
         if (looksLikeScriptPath(tok)) {
           try {
             const resolved = resolvePath2(tok.replace(/^['"]|['"]$/g, ""));
-            if (existsSync10(resolved)) {
+            if (existsSync11(resolved)) {
               const stat = statSync4(resolved);
               if (stat.isFile()) return resolved;
             }
@@ -6873,7 +6639,7 @@ function extractInlineScriptPath(actionDetail) {
       const p = m[1];
       try {
         const resolved = resolvePath2(p);
-        if (existsSync10(resolved)) {
+        if (existsSync11(resolved)) {
           const stat = statSync4(resolved);
           if (stat.isFile()) return resolved;
         }
@@ -6889,7 +6655,7 @@ function extractInlineScriptPath(actionDetail) {
     let resolved;
     try {
       resolved = resolvePath2(p);
-      if (existsSync10(resolved)) {
+      if (existsSync11(resolved)) {
         const stat = statSync4(resolved);
         if (stat.isFile()) return resolved;
       }
@@ -6930,7 +6696,7 @@ function shlexSplit(s) {
 function resolvePath2(p) {
   let expanded = p;
   if (expanded.startsWith("~/") || expanded === "~") {
-    expanded = join6(homedir3(), expanded.slice(1));
+    expanded = join10(homedir3(), expanded.slice(1));
   }
   return resolve9(expanded);
 }
@@ -7054,7 +6820,7 @@ function analyzeScriptContent2(input, ext) {
     isInline = true;
   }
   if (resolvedPath && !isAbsolute2(resolvedPath) && !resolvedPath.startsWith("~/")) {
-    resolvedPath = join6(input.cwd || process.cwd(), resolvedPath);
+    resolvedPath = join10(input.cwd || process.cwd(), resolvedPath);
   }
   const l1Adapter = (content) => {
     const j = scanDangerousCommandPatterns("bash", content, input.osType);
@@ -7139,7 +6905,7 @@ ${contentPreview}
   if (chain.maxSizeReached) header += "\u26A0\uFE0F \u6CE8\u610F\uFF1A\u7D2F\u8BA1\u6587\u4EF6\u5927\u5C0F\u89E6\u8FBE\u4E0A\u9650\uFF0C\u90E8\u5206\u811A\u672C\u53EF\u80FD\u672A\u88AB\u5B8C\u6574\u8BFB\u53D6\u3002\n";
   return header + parts.join("\n---\n\n");
 }
-var SUSPICIOUS_PATTERNS2, SCRIPT_EXEC_PATTERNS2, KEYWORD_COMBINATION_RISKS2, SINGLE_KEYWORD_RISKS2, LEVEL_ORDER2;
+var SCRIPT_RULES2, SUSPICIOUS_PATTERNS2, SCRIPT_EXEC_PATTERNS2, KEYWORD_SETS2, KEYWORD_COMBINATION_RISKS2, SINGLE_KEYWORD_RISKS2, LEVEL_ORDER2;
 var init_script_content_analyzer = __esm({
   "src/engine/script-content-analyzer.ts"() {
     "use strict";
@@ -7149,87 +6915,23 @@ var init_script_content_analyzer = __esm({
     init_logic_rules();
     init_inline_analyzer();
     init_tracker();
-    SUSPICIOUS_PATTERNS2 = [
-      { name: "curl POST", pattern: /curl\s+(.*\s)?-X\s+POST/i },
-      { name: "curl --data", pattern: /curl\s+(.*\s)?--data/i },
-      { name: "curl -d", pattern: /curl\s+(.*\s)?-d\s/i },
-      { name: "wget --post-data", pattern: /wget\s+(.*\s)?--post-data/i },
-      { name: "wget --post-file", pattern: /wget\s+(.*\s)?--post-file/i },
-      { name: "nc -e", pattern: /\bnc\s+.*-e\b/ },
-      { name: "ncat -e", pattern: /\bncat\s+.*-e\b/ },
-      { name: "/dev/tcp", pattern: /\/dev\/tcp\// },
-      { name: "/dev/udp", pattern: /\/dev\/udp\// },
-      { name: "$(base64", pattern: /\$\(\s*base64/ },
-      { name: "`base64", pattern: /`\s*base64/ },
-      { name: "base64 decode pipe", pattern: /base64\s+(-d|--decode)\s*\|/ },
-      { name: "/etc/shadow", pattern: /\/etc\/shadow/ },
-      { name: "id_rsa", pattern: /\bid_rsa\b/ },
-      { name: "id_ed25519", pattern: /\bid_ed25519\b/ },
-      { name: "crontab install", pattern: /crontab\s+-/ },
-      { name: "authorized_keys", pattern: /authorized_keys/ },
-      { name: "ssh no host key check", pattern: /ssh\s+.*StrictHostKeyChecking\s*=\s*no/ }
-    ];
-    SCRIPT_EXEC_PATTERNS2 = [
-      /(?:^|\s|&&|\|\|)\s*bash\s+(\S+)/i,
-      /(?:^|\s|&&|\|\|)\s*\/bin\/bash\s+(\S+)/i,
-      /(?:^|\s|&&|\|\|)\s*sh\s+(\S+)/i,
-      /(?:^|\s|&&|\|\|)\s*zsh\s+(\S+)/i,
-      /\.\/(\S+)/,
-      /(?:^|\s|&&|\|\|)\s*source\s+(\S+)/i,
-      /(?:^|\s|&&|\|\|)\s*\.\s+(\S+)/,
-      /(?:^|\s|&&|\|\|)\s*python3?\s+(\S+\.py)/i,
-      /(?:^|\s|&&|\|\|)\s*node\s+(\S+\.js)/i,
-      /(?:^|\s|&&|\|\|)\s*ruby\s+(\S+\.rb)/i,
-      /(?:^|\s|&&|\|\|)\s*perl\s+(\S+\.pl)/i,
-      /(?:^|\s|&&|\|\|)\s*php\s+(\S+\.php)/i,
-      /(?:^|\s|&&|\|\|)\s*lua\s+(\S+\.lua)/i
-    ];
-    KEYWORD_COMBINATION_RISKS2 = [
-      {
-        group1: /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]),
-        group2: /* @__PURE__ */ new Set(["$(base64", "`base64", "base64 decode pipe"]),
-        level: "critical",
-        reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + Base64\u7F16\u7801\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u6570\u636E\u5916\u4F20\u98CE\u9669\u3002\u653B\u51FB\u8005\u53EF\u80FD\u5C06\u654F\u611F\u6570\u636E\u7F16\u7801\u540E\u5916\u4F20\u3002"
-      },
-      {
-        group1: /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]),
-        group2: /* @__PURE__ */ new Set(["/etc/shadow", "id_rsa", "id_ed25519"]),
-        level: "critical",
-        reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + \u654F\u611F\u6587\u4EF6\u8BBF\u95EE\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u51ED\u8BC1\u5916\u4F20\u98CE\u9669\u3002"
-      },
-      {
-        group1: /* @__PURE__ */ new Set(["nc -e", "ncat -e", "/dev/tcp", "/dev/udp"]),
-        group2: /* @__PURE__ */ new Set(),
-        level: "high",
-        reason: "\u68C0\u6D4B\u5230\u53CD\u5F39 Shell \u7279\u5F81\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5EFA\u7ACB\u8FDC\u7A0B\u63A7\u5236\u901A\u9053\u3002"
-      },
-      {
-        group1: /* @__PURE__ */ new Set(["crontab install", "authorized_keys", "ssh no host key check"]),
-        group2: /* @__PURE__ */ new Set(),
-        level: "high",
-        reason: "\u68C0\u6D4B\u5230\u6301\u4E45\u5316\u540E\u95E8\u7279\u5F81\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5728\u7CFB\u7EDF\u4E2D\u690D\u5165\u540E\u95E8\u3002"
-      }
-    ];
-    SINGLE_KEYWORD_RISKS2 = {
-      "curl POST": { level: "high", reason: "\u68C0\u6D4B\u5230 curl POST \u8BF7\u6C42\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
-      "curl --data": { level: "high", reason: "\u68C0\u6D4B\u5230 curl --data \u53C2\u6570\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
-      "curl -d": { level: "high", reason: "\u68C0\u6D4B\u5230 curl -d \u53C2\u6570\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
-      "wget --post-data": { level: "high", reason: "\u68C0\u6D4B\u5230 wget POST \u8BF7\u6C42\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
-      "wget --post-file": { level: "high", reason: "\u68C0\u6D4B\u5230 wget \u6587\u4EF6\u4E0A\u4F20\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6587\u4EF6\u3002" },
-      "nc -e": { level: "critical", reason: "\u68C0\u6D4B\u5230 nc -e \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
-      "ncat -e": { level: "critical", reason: "\u68C0\u6D4B\u5230 ncat -e \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
-      "/dev/tcp": { level: "critical", reason: "\u68C0\u6D4B\u5230 /dev/tcp \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
-      "/dev/udp": { level: "critical", reason: "\u68C0\u6D4B\u5230 /dev/udp \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
-      "$(base64": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u7F16\u7801\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
-      "`base64": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u7F16\u7801\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
-      "base64 decode pipe": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u89E3\u7801\u540E\u7BA1\u9053\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
-      "/etc/shadow": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6\u3002" },
-      "id_rsa": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE SSH \u79C1\u94A5\u3002" },
-      "id_ed25519": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE SSH \u79C1\u94A5\u3002" },
-      "crontab install": { level: "high", reason: "\u68C0\u6D4B\u5230\u4FEE\u6539\u5B9A\u65F6\u4EFB\u52A1\uFF0C\u53EF\u80FD\u662F\u6301\u4E45\u5316\u540E\u95E8\u3002" },
-      "authorized_keys": { level: "high", reason: "\u68C0\u6D4B\u5230\u4FEE\u6539 SSH \u6388\u6743\u5BC6\u94A5\uFF0C\u53EF\u80FD\u662F\u6301\u4E45\u5316\u540E\u95E8\u3002" },
-      "ssh no host key check": { level: "high", reason: "\u68C0\u6D4B\u5230 SSH \u8DF3\u8FC7\u4E3B\u673A\u5BC6\u94A5\u9A8C\u8BC1\uFF0C\u53EF\u80FD\u662F\u6A2A\u5411\u79FB\u52A8\u3002" }
-    };
+    init_rules_loader();
+    SCRIPT_RULES2 = loadScriptRules();
+    if (!SCRIPT_RULES2 || Object.keys(SCRIPT_RULES2).length === 0) {
+      console.error(
+        "[AgentMoss] \u274C \u89C4\u5219\u6587\u4EF6 script_rules.json \u7F3A\u5931\u6216\u635F\u574F \u2014\u2014 \u811A\u672C\u5185\u5BB9\u5173\u952E\u8BCD\u626B\u63CF\u5C06\u4E0D\u547D\u4E2D\u4EFB\u4F55\u6A21\u5F0F\uFF08\u6BD4\u6B63\u5E38\u66F4\u677E\uFF09\u3002\u8BF7\u68C0\u67E5\u5305\u5B8C\u6574\u6027\u3002"
+      );
+    }
+    SUSPICIOUS_PATTERNS2 = (SCRIPT_RULES2.suspicious_patterns ?? []).map((r) => ({ name: r.name, pattern: compileRuleRegex(r) }));
+    SCRIPT_EXEC_PATTERNS2 = ((SCRIPT_RULES2.script_exec_patterns ?? {}).chain ?? []).map((r) => compileRuleRegex(r));
+    KEYWORD_SETS2 = SCRIPT_RULES2.keyword_sets ?? {};
+    KEYWORD_COMBINATION_RISKS2 = (SCRIPT_RULES2.keyword_combination_risks ?? []).map((r) => ({
+      group1: resolveKeywordSet(r.group1, KEYWORD_SETS2),
+      group2: resolveKeywordSet(r.group2, KEYWORD_SETS2),
+      level: String(r.level),
+      reason: String(r.reason)
+    }));
+    SINGLE_KEYWORD_RISKS2 = SCRIPT_RULES2.single_keyword_risks ?? {};
     LEVEL_ORDER2 = { low: 1, medium: 2, high: 3, critical: 4 };
   }
 });
@@ -7244,16 +6946,16 @@ __export(token_stats_exports, {
   recordTokenUsage: () => recordTokenUsage,
   resetTokenStats: () => resetTokenStats
 });
-import { readFileSync as readFileSync11, writeFileSync as writeFileSync2, existsSync as existsSync11, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2 } from "fs";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync2, existsSync as existsSync12, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2 } from "fs";
 function getStatsPath() {
   const envPath = process.env[ENV_STATS_PATH];
   if (envPath) return envPath;
   return getTokenStatsPath();
 }
 function loadAllRecords(statsPath) {
-  if (!existsSync11(statsPath)) return [];
+  if (!existsSync12(statsPath)) return [];
   try {
-    const data = JSON.parse(readFileSync11(statsPath, "utf-8"));
+    const data = JSON.parse(readFileSync12(statsPath, "utf-8"));
     if (Array.isArray(data)) return data;
     if (data && Array.isArray(data.records)) return data.records;
     return [];
@@ -7264,7 +6966,7 @@ function loadAllRecords(statsPath) {
 function saveRecords(statsPath, records) {
   try {
     const dir = statsPath.substring(0, statsPath.lastIndexOf("/"));
-    if (dir && !existsSync11(dir)) mkdirSync2(dir, { recursive: true });
+    if (dir && !existsSync12(dir)) mkdirSync2(dir, { recursive: true });
     writeFileSync2(statsPath, JSON.stringify(records, null, 2), "utf-8");
   } catch (e) {
   }
@@ -7391,7 +7093,7 @@ function getTokenTrend(days = 0, startDate, endDate) {
 }
 function resetTokenStats() {
   const statsPath = getStatsPath();
-  if (existsSync11(statsPath)) {
+  if (existsSync12(statsPath)) {
     try {
       unlinkSync2(statsPath);
     } catch {
@@ -7648,8 +7350,8 @@ var init_llm_analyzer = __esm({
 });
 
 // src/brain/rule-store.ts
-import { existsSync as existsSync12, readFileSync as readFileSync12, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync13, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
+import { join as join11 } from "path";
 import { homedir as homedir4 } from "os";
 function getRulesPath() {
   const envPath = process.env[ENV_RULES_PATH];
@@ -7668,7 +7370,7 @@ var init_rule_store = __esm({
   "src/brain/rule-store.ts"() {
     "use strict";
     init_esm_shims();
-    DEFAULT_RULES_PATH = join7(homedir4(), ".agentmoss", "brain", "rules.json");
+    DEFAULT_RULES_PATH = join11(homedir4(), ".agentmoss", "brain", "rules.json");
     ENV_RULES_PATH = "AGENT_MOSS_BRAIN_RULES_PATH";
     STATUS_DRAFT = "draft";
     STATUS_APPROVED = "approved";
@@ -7685,11 +7387,11 @@ var init_rule_store = __esm({
         this.data = this.load();
       }
       load() {
-        if (!existsSync12(this.path)) {
+        if (!existsSync13(this.path)) {
           return { version: 1, rules: [], pattern_candidates: [] };
         }
         try {
-          const raw = JSON.parse(readFileSync12(this.path, "utf-8"));
+          const raw = JSON.parse(readFileSync13(this.path, "utf-8"));
           return {
             version: raw.version || 1,
             rules: raw.rules || [],
@@ -8283,9 +7985,9 @@ var init_reviewer = __esm({
 });
 
 // src/brain/skill-manager.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync4, readFileSync as readFileSync13, renameSync, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync4, readFileSync as readFileSync14, renameSync, writeFileSync as writeFileSync4 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join8 } from "path";
+import { join as join12 } from "path";
 import { randomUUID } from "crypto";
 function getMetaPath(override) {
   return override || process.env[ENV_SKILL_META_PATH] || DEFAULT_SKILL_META_PATH;
@@ -8295,14 +7997,14 @@ var init_skill_manager = __esm({
   "src/brain/skill-manager.ts"() {
     "use strict";
     init_esm_shims();
-    DEFAULT_SKILL_META_PATH = join8(homedir5(), ".agentmoss", "brain", "skill_meta.json");
+    DEFAULT_SKILL_META_PATH = join12(homedir5(), ".agentmoss", "brain", "skill_meta.json");
     ENV_SKILL_META_PATH = "AGENT_MOSS_BRAIN_SKILL_META_PATH";
     BrainSkillManager = class {
       constructor(skillsDir, metaPath) {
         this.skillsDir = skillsDir;
         this.metaPath = getMetaPath(metaPath);
         try {
-          mkdirSync4(join8(this.metaPath, ".."), { recursive: true });
+          mkdirSync4(join12(this.metaPath, ".."), { recursive: true });
         } catch {
         }
         this.load();
@@ -8312,9 +8014,9 @@ var init_skill_manager = __esm({
       skills = [];
       metaPath;
       load() {
-        if (!existsSync13(this.metaPath)) return;
+        if (!existsSync14(this.metaPath)) return;
         try {
-          const data = JSON.parse(readFileSync13(this.metaPath, "utf-8"));
+          const data = JSON.parse(readFileSync14(this.metaPath, "utf-8"));
           this.skills = data.skills || [];
         } catch {
           this.skills = [];
@@ -8337,7 +8039,7 @@ var init_skill_manager = __esm({
         let changed = false;
         for (const sk of this.skills) {
           if (sk.status !== "active") continue;
-          if (!existsSync13(join8(this.skillsDir, `${sk.name}.md`))) {
+          if (!existsSync14(join12(this.skillsDir, `${sk.name}.md`))) {
             sk.status = "stale";
             changed = true;
           }
@@ -8348,9 +8050,9 @@ var init_skill_manager = __esm({
       addSkill(skill) {
         const id = skill.id || randomUUID();
         const name = skill.name || `brain_${id.slice(0, 8)}`;
-        if (!existsSync13(this.skillsDir)) return "";
-        const mdPath = join8(this.skillsDir, `${name}.md`);
-        if (existsSync13(mdPath)) return "";
+        if (!existsSync14(this.skillsDir)) return "";
+        const mdPath = join12(this.skillsDir, `${name}.md`);
+        if (existsSync14(mdPath)) return "";
         try {
           writeFileSync4(mdPath, skill.content, "utf-8");
         } catch {
@@ -8399,12 +8101,12 @@ var init_skill_manager = __esm({
         const out = [];
         for (const sk of this.skills) {
           if (sk.origin_node !== "local" || sk.status !== "active") continue;
-          const mdPath = join8(this.skillsDir, `${sk.name}.md`);
-          if (!existsSync13(mdPath)) continue;
+          const mdPath = join12(this.skillsDir, `${sk.name}.md`);
+          if (!existsSync14(mdPath)) continue;
           out.push({
             name: sk.name,
             category: sk.category || "",
-            content: readFileSync13(mdPath, "utf-8"),
+            content: readFileSync14(mdPath, "utf-8"),
             keywords: sk.keywords || []
           });
         }
@@ -8516,7 +8218,7 @@ __export(contributor_exports, {
 });
 import { mkdirSync as mkdirSync5, mkdtempSync, rmSync, writeFileSync as writeFileSync5 } from "fs";
 import { tmpdir } from "os";
-import { join as join9 } from "path";
+import { join as join13 } from "path";
 import { spawnSync } from "child_process";
 import { dirname as dirname9 } from "path";
 import { fileURLToPath as fileURLToPath9 } from "url";
@@ -8537,32 +8239,32 @@ function collectSkills(skillMgr) {
 }
 function writeExportFiles(outDir, rules, skills) {
   const written = [];
-  const rulesDir = join9(outDir, "rules");
-  mkdirSync5(rulesDir, { recursive: true });
+  const rulesDir2 = join13(outDir, "rules");
+  mkdirSync5(rulesDir2, { recursive: true });
   const byLayer = /* @__PURE__ */ new Map();
   for (const r of rules) {
     if (!byLayer.has(r.layer)) byLayer.set(r.layer, []);
     byLayer.get(r.layer).push(r);
   }
   for (const layer of [...byLayer.keys()].sort((a, b) => a - b)) {
-    const path6 = join9(rulesDir, `l${layer}_brain_rules.json`);
+    const path6 = join13(rulesDir2, `l${layer}_brain_rules.json`);
     writeFileSync5(path6, JSON.stringify(byLayer.get(layer), null, 2), "utf-8");
     written.push(path6);
   }
   if (rules.length === 0) {
-    const path6 = join9(rulesDir, "empty.txt");
+    const path6 = join13(rulesDir2, "empty.txt");
     writeFileSync5(path6, "(no brain rules to contribute)", "utf-8");
     written.push(path6);
   }
-  const skillsDir = join9(outDir, "skills");
+  const skillsDir = join13(outDir, "skills");
   mkdirSync5(skillsDir, { recursive: true });
   for (const sk of skills) {
-    const path6 = join9(skillsDir, `${sk.name}.md`);
+    const path6 = join13(skillsDir, `${sk.name}.md`);
     writeFileSync5(path6, sk.content || "", "utf-8");
     written.push(path6);
   }
   if (skills.length === 0) {
-    const path6 = join9(skillsDir, "empty.txt");
+    const path6 = join13(skillsDir, "empty.txt");
     writeFileSync5(path6, "(no brain skills to contribute)", "utf-8");
     written.push(path6);
   }
@@ -8692,7 +8394,7 @@ async function contribute(opts = {}) {
   console.log(`[Brain] push \u76EE\u6807: ${pushTarget}`);
   console.log(`[Brain] MR \u6307\u5411: ${DEFAULT_TARGET_REPO}`);
   const store = new BrainRuleStore();
-  const skillsDir = resolveAssetDir(__dirname8, "skills") ?? join9(__dirname8, "..", "..", "agent_moss", "skills");
+  const skillsDir = resolveAssetDir(__dirname8, "skills") ?? join13(__dirname8, "..", "..", "agent_moss", "skills");
   const skillMgr = new BrainSkillManager(skillsDir);
   let rules;
   let skills;
@@ -8707,9 +8409,9 @@ async function contribute(opts = {}) {
     return 0;
   }
   console.log(`[Brain] \u5BFC\u51FA: ${rules.length} \u6761\u89C4\u5219, ${skills.length} \u4E2A Skill`);
-  const workdir = mkdtempSync(join9(tmpdir(), "agentmoss-contrib-"));
+  const workdir = mkdtempSync(join13(tmpdir(), "agentmoss-contrib-"));
   try {
-    writeExportFiles(join9(workdir, "agent_moss", "brain_contrib"), rules, skills);
+    writeExportFiles(join13(workdir, "agent_moss", "brain_contrib"), rules, skills);
     console.log(`[Brain] \u63A2\u6D4B ${pushTarget} \u8BBF\u95EE\u6743\u9650 ...`);
     if (!probeAccess(pushTarget)) {
       const username = getCurrentUsername();
@@ -8957,9 +8659,10 @@ var init_decode = __esm({
   "src/engine/formal-engine/decode.ts"() {
     "use strict";
     init_esm_shims();
+    init_rules_loader();
     B64_TOKEN_RE = /[A-Za-z0-9+/]+={0,2}/g;
     QUOTED_STR_RE = /('(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"|`(?:[^`\\]|\\.)*`)/g;
-    OUTPUT_CMDS = /* @__PURE__ */ new Set(["echo", "printf", "print"]);
+    OUTPUT_CMDS = new Set(loadFormalRules().output_commands ?? []);
     STAGE_PRIORITY = ["EXFIL", "PRIVESC", "PERSIST", "SCAN", "LISTEN"];
     PURPOSE_EXEC_RE = /subprocess\.\w+\s*\(|os\.system\s*\(|shell\s*=\s*True|\beval\s*\(|\bexec\s*\(|os\.popen\s*\(|\/exec\b/i;
     LISTEN_LEAD_RE = /http\.server|flask\s+run|nohup\b|nc\s+-l|socat\s+TCP-LISTEN/i;
@@ -9677,7 +9380,7 @@ function checkSensitiveDataAggregation(graph) {
   }
   return violations;
 }
-var CROSS_SESSION_CHAINS, CRED_FILE_RE, EXFIL_RE, EBPF_NET_RE, REMOTE_RE, EXFIL_ACTION_RE, CRED_STRICT_RE, INLINE_SHELL_RE, PKG_MGR, SHELLS, TOOL_REGISTRY, COMPUTE_RE, STRONG_COMPUTE_TYPES, DL_OR_LOW_RE, ALL_PROPERTIES;
+var CROSS_SESSION_CHAINS, CRED_FILE_RE, EXFIL_RE, EBPF_NET_RE, REMOTE_RE, EXFIL_ACTION_RE, CRED_STRICT_RE, INLINE_SHELL_RE, FORMAL_RULES, PKG_MGR, SHELLS, TOOL_REGISTRY, COMPUTE_RE, STRONG_COMPUTE_TYPES, DL_OR_LOW_RE, ALL_PROPERTIES;
 var init_properties = __esm({
   "src/engine/formal-engine/properties.ts"() {
     "use strict";
@@ -9694,11 +9397,12 @@ var init_properties = __esm({
     EXFIL_ACTION_RE = /\bcurl\b|\bwget\b|\bscp\b|\brsync\b|\brclone\b|\bftp\b|connect\s+.*\d+\.\d+\.\d+\.\d+|open\s+.*tcp|base64\s+.*\-o/i;
     CRED_STRICT_RE = /(known_hosts|\.ssh|id_rsa|\.pem|\b\.key\b|\/etc\/shadow|\/etc\/passwd|\.aws\/credentials|credentials\.json|netrc|password|secrets?\.ya?ml|credentials?\s*(file|path)?\s*(=|\:)|\bconfig.*(password|token))/i;
     INLINE_SHELL_RE = /(?:os\.system|os\.popen)\s*\(\s*['"]([^'"]+)['"]|subprocess\.[a-z_]+\(\s*\[([^\]]+)\]|subprocess\.[a-z_]+\(\s*['"]([^'"]+)['"]|(?:bash|sh|zsh)\s+-c\s*['"]([^'"]+)['"]/gi;
-    PKG_MGR = /* @__PURE__ */ new Set(["apt", "apt-get", "aptitude", "yum", "dnf", "pacman", "zypper", "apk", "brew"]);
-    SHELLS = /* @__PURE__ */ new Set(["bash", "sh", "zsh", "dash", "fish", "ksh", "csh", "tcsh", "nologin"]);
+    FORMAL_RULES = loadFormalRules();
+    PKG_MGR = new Set(FORMAL_RULES.privesc?.package_managers ?? []);
+    SHELLS = new Set(FORMAL_RULES.privesc?.bare_shells ?? []);
     TOOL_REGISTRY = null;
     COMPUTE_RE = /subprocess|os\.system|shell\s*=\s*True|\beval\(|\bexec\(|bash\s+[^\s]|sh\s+-c|python3?\s+|node\s+|\btimeout\s+|nohup\s+|\b\.\/[\w./-]+/i;
-    STRONG_COMPUTE_TYPES = /* @__PURE__ */ new Set(["python", "node", "exec", "terminal", "cmd"]);
+    STRONG_COMPUTE_TYPES = new Set(FORMAL_RULES.compute_action_types ?? []);
     DL_OR_LOW_RE = /curl\s+.*-o\b|wget\s+.*\s+-O\b|curl\s+.*\|\s*(bash|sh|python)|wget\s+.*\|\s*(bash|sh|python)|git\s+clone|docker\s+pull|pip\s+install|npm\s+install|base64\s+-d/i;
     ALL_PROPERTIES = [
       { id: "cross-session-chain", check: checkCrossSessionChain, shortName: "P1" },
@@ -10222,10 +9926,10 @@ var init_stateful = __esm({
 import * as fs4 from "fs";
 import * as os2 from "os";
 import * as path4 from "path";
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 function defaultStateDbPath() {
   const dir = process.env.AGENT_MOSS_STATE_DIR || path4.join(os2.homedir(), ".agentmoss");
-  const tag = createHash("sha1").update("agentmoss-stateful").digest("hex").slice(0, 8);
+  const tag = createHash2("sha1").update("agentmoss-stateful").digest("hex").slice(0, 8);
   return path4.join(dir, `stateful_chains_${tag}.json`);
 }
 var ChainStateStore;
@@ -10485,7 +10189,7 @@ async function runAnalysis(input) {
   const actionType = input.aNext.actionType.toLowerCase();
   const rawDetail = extractRawCommand(input.aNext.actionDetail);
   const lowerDetail = rawDetail.toLowerCase();
-  if (FULLY_SAFE_TOOLS.has(actionType)) {
+  if (getPlatformTraits(input.osType).safeActionTypes.has(actionType)) {
     return {
       allowed: true,
       reason: `\u5B8C\u5168\u5B89\u5168\u5DE5\u5177\uFF0C\u8DF3\u8FC7\u6DF1\u5EA6\u5206\u6790: ${actionType}`,
@@ -10528,7 +10232,7 @@ async function runAnalysis(input) {
       violatedLayers: []
     };
   }
-  let skipLLM = READONLY_SENSITIVE_TOOLS.has(actionType);
+  let skipLLM = getPlatformTraits(input.osType).readonlySensitiveActionTypes.has(actionType);
   if (actionType === "bash" || actionType === "executebash" || actionType === "terminal-executebash") {
     const firstCmd = extractFirstCommand(lowerDetail);
     const { fullySafeCommands, readonlySensitiveCommands } = getPlatformTraits(input.osType);
@@ -10760,7 +10464,7 @@ async function runAnalysis(input) {
   }
   return llmResult;
 }
-var FULLY_SAFE_TOOLS, TRUSTED_SKILLS_BASE, READONLY_SENSITIVE_TOOLS, _brainStore, _brainExtractor, _brainSkillManager, _brainCurator, _brainInitialized, _brainLastMaintenance, BRAIN_MAINT_INTERVAL_MS, formalEngine;
+var TRUSTED_SKILLS_BASE, _brainStore, _brainExtractor, _brainSkillManager, _brainCurator, _brainInitialized, _brainLastMaintenance, BRAIN_MAINT_INTERVAL_MS, formalEngine;
 var init_coordinator = __esm({
   "src/engine/coordinator.ts"() {
     "use strict";
@@ -10783,25 +10487,7 @@ var init_coordinator = __esm({
     init_asset_dir();
     init_runtime_config_bridge();
     init_formal_engine();
-    FULLY_SAFE_TOOLS = /* @__PURE__ */ new Set([
-      "ask_user_question",
-      "glob",
-      "list_dir",
-      "ls",
-      "count_text_length",
-      "filemgr-globfiles"
-    ]);
     TRUSTED_SKILLS_BASE = /* @__PURE__ */ new Set([]);
-    READONLY_SENSITIVE_TOOLS = /* @__PURE__ */ new Set([
-      "read",
-      "file_read",
-      "read_file",
-      "head",
-      "tail",
-      "grep",
-      "filemgr-readfile",
-      "filemgr-grepfiles"
-    ]);
     _brainStore = null;
     _brainExtractor = null;
     _brainSkillManager = null;
@@ -10814,10 +10500,10 @@ var init_coordinator = __esm({
 });
 
 // src/infra/policy-cache.ts
-import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync15, mkdirSync as mkdirSync7, readdirSync as readdirSync5, readFileSync as readFileSync15, rmdirSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync7 } from "fs";
+import { createHash as createHash3 } from "crypto";
+import { existsSync as existsSync16, mkdirSync as mkdirSync7, readdirSync as readdirSync5, readFileSync as readFileSync16, rmdirSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync7 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join11 } from "path";
+import { join as join15 } from "path";
 function cacheDir() {
   return cacheDirOverride ?? CACHE_DIR;
 }
@@ -10831,7 +10517,7 @@ var init_policy_cache = __esm({
     "use strict";
     init_esm_shims();
     init_config();
-    CACHE_DIR = join11(tmpdir2(), "agent_moss_policy_cache");
+    CACHE_DIR = join15(tmpdir2(), "agent_moss_policy_cache");
     cacheDirOverride = null;
     PolicyCache = class {
       // Map 的插入序即 LRU 序（get 时重新 set 到末尾）
@@ -10844,9 +10530,9 @@ var init_policy_cache = __esm({
         return `${sessionId}::${promptSession}`;
       }
       cacheFilePath(sessionId, promptSession) {
-        const promptHash = createHash2("md5").update(promptSession).digest("hex").slice(0, 12);
+        const promptHash = createHash3("md5").update(promptSession).digest("hex").slice(0, 12);
         const safeSessionId = sessionId.replace(/\//g, "_").replace(/\\/g, "_");
-        return join11(cacheDir(), safeSessionId, `${promptHash}.toml`);
+        return join15(cacheDir(), safeSessionId, `${promptHash}.toml`);
       }
       /** 取缓存：内存 → 文件；未命中返回 null。 */
       get(sessionId, promptSession) {
@@ -10859,9 +10545,9 @@ var init_policy_cache = __esm({
           return hit;
         }
         const file = this.cacheFilePath(sessionId, promptSession);
-        if (existsSync15(file)) {
+        if (existsSync16(file)) {
           try {
-            const policy = readFileSync15(file, "utf-8");
+            const policy = readFileSync16(file, "utf-8");
             this.remember(key, policy);
             return policy;
           } catch {
@@ -10875,7 +10561,7 @@ var init_policy_cache = __esm({
         this.remember(this.cacheKey(sessionId, promptSession), policy);
         const file = this.cacheFilePath(sessionId, promptSession);
         try {
-          mkdirSync7(join11(cacheDir(), sessionId.replace(/\//g, "_").replace(/\\/g, "_")), { recursive: true });
+          mkdirSync7(join15(cacheDir(), sessionId.replace(/\//g, "_").replace(/\\/g, "_")), { recursive: true });
           writeFileSync7(file, policy, "utf-8");
         } catch {
         }
@@ -10901,12 +10587,12 @@ var init_policy_cache = __esm({
           if (k.startsWith(`${sessionId}::`)) this.memory.delete(k);
         }
         const safeSessionId = sessionId.replace(/\//g, "_").replace(/\\/g, "_");
-        const dir = join11(cacheDir(), safeSessionId);
+        const dir = join15(cacheDir(), safeSessionId);
         try {
-          if (existsSync15(dir)) {
+          if (existsSync16(dir)) {
             for (const f of readdirSync5(dir)) {
               try {
-                unlinkSync3(join11(dir, f));
+                unlinkSync3(join15(dir, f));
               } catch {
               }
             }
@@ -10918,11 +10604,11 @@ var init_policy_cache = __esm({
       clear() {
         this.memory.clear();
         try {
-          if (existsSync15(cacheDir())) {
+          if (existsSync16(cacheDir())) {
             for (const sessionDir of readdirSync5(cacheDir())) {
-              const dir = join11(cacheDir(), sessionDir);
+              const dir = join15(cacheDir(), sessionDir);
               try {
-                for (const f of readdirSync5(dir)) unlinkSync3(join11(dir, f));
+                for (const f of readdirSync5(dir)) unlinkSync3(join15(dir, f));
                 rmdirSync(dir);
               } catch {
               }
@@ -11018,9 +10704,9 @@ __export(analyzer_exports, {
   savePolicyToFile: () => savePolicyToFile,
   validateToml: () => validateToml
 });
-import { existsSync as existsSync16, mkdirSync as mkdirSync8, readFileSync as readFileSync16, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync17, mkdirSync as mkdirSync8, readFileSync as readFileSync17, writeFileSync as writeFileSync8 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
-import { join as join12, resolve as resolve10 } from "path";
+import { join as join16, resolve as resolve10 } from "path";
 import { parse as parseToml } from "smol-toml";
 function _setPolicyOutputDirForTest(dir) {
   policyOutputDirOverride = dir;
@@ -11034,7 +10720,7 @@ function savePolicyToFile(sessionId, policyToml) {
     const outDir = policyOutputDir();
     mkdirSync8(outDir, { recursive: true });
     const safeName = sessionId.replace(/\//g, "_").replace(/\\/g, "_");
-    const filepath = join12(outDir, `${safeName}.toml`);
+    const filepath = join16(outDir, `${safeName}.toml`);
     writeFileSync8(filepath, policyToml, "utf-8");
     return filepath;
   } catch (err) {
@@ -11073,11 +10759,11 @@ function loadPolicyMappingDoc() {
   const dir = resolveAssetDir(__dirname, "templates");
   if (dir) {
     const p = resolve10(dir, "policy_mapping.md");
-    if (existsSync16(p)) return readFileSync16(p, "utf-8");
+    if (existsSync17(p)) return readFileSync17(p, "utf-8");
   }
   for (const cand of assetDirCandidates(__dirname, "templates")) {
     const p = resolve10(cand, "policy_mapping.md");
-    if (existsSync16(p)) return readFileSync16(p, "utf-8");
+    if (existsSync17(p)) return readFileSync17(p, "utf-8");
   }
   return "";
 }
@@ -11247,7 +10933,7 @@ var init_analyzer = __esm({
     init_asset_dir();
     init_token_stats();
     init_logging();
-    POLICY_OUTPUT_DIR = join12(tmpdir3(), "agent_moss");
+    POLICY_OUTPUT_DIR = join16(tmpdir3(), "agent_moss");
     policyOutputDirOverride = null;
     DEFAULT_READONLY_POLICY = `landlock_optional = false
 mount_isolation_fallback = false
@@ -11470,14 +11156,16 @@ function mineDangerousPatterns(sessions, minSup = 2, maxLen = 4) {
   out.sort((a, b) => b.support - a.support || b.pattern.length - a.pattern.length);
   return out;
 }
-var DANGER_STAGES, SENSITIVE_PAIRS;
+var _PM, DANGER_STAGES, SENSITIVE_PAIRS;
 var init_pattern_miner = __esm({
   "src/engine/formal-engine/pattern_miner.ts"() {
     "use strict";
     init_esm_shims();
+    init_rules_loader();
     init_builder();
-    DANGER_STAGES = /* @__PURE__ */ new Set(["PRIVESC", "EXFIL", "LISTEN"]);
-    SENSITIVE_PAIRS = /* @__PURE__ */ new Set(["CRED|LISTEN", "LISTEN|CRED"]);
+    _PM = loadFormalRules().pattern_miner ?? {};
+    DANGER_STAGES = new Set(_PM.danger_stages ?? []);
+    SENSITIVE_PAIRS = new Set((_PM.sensitive_pairs ?? []).map((p) => p.join("|")));
   }
 });
 
@@ -11657,7 +11345,7 @@ var init_observable = __esm({
 });
 
 // src/routes.ts
-import { join as join14, dirname as dirname11 } from "path";
+import { join as join18, dirname as dirname11 } from "path";
 import { fileURLToPath as fileURLToPath10 } from "url";
 async function healthRoute(c) {
   return c.json(HealthResponseSchema.parse({
@@ -11906,7 +11594,7 @@ function getBrainRuleStore() {
   return new BrainRuleStore();
 }
 function getBrainSkillManager() {
-  const dir = resolveAssetDir(__dirname9, "skills") ?? join14(__dirname9, "..", "..", "agent_moss", "skills");
+  const dir = resolveAssetDir(__dirname9, "skills") ?? join18(__dirname9, "..", "..", "agent_moss", "skills");
   return new BrainSkillManager(dir);
 }
 async function brainRulesRoute(c) {
@@ -12019,8 +11707,8 @@ var init_routes = __esm({
 
 // src/console/router.ts
 import { Hono } from "hono";
-import { readFileSync as readFileSync18, existsSync as existsSync18, unlinkSync as unlinkSync4 } from "fs";
-import { join as join15, dirname as dirname12 } from "path";
+import { readFileSync as readFileSync19, existsSync as existsSync19, unlinkSync as unlinkSync4 } from "fs";
+import { join as join19, dirname as dirname12 } from "path";
 import { fileURLToPath as fileURLToPath11 } from "url";
 function getConsoleToken() {
   return process.env[CONSOLE_TOKEN_ENV] || "";
@@ -12058,9 +11746,9 @@ function createConsoleRouter() {
   console2.use("/api/*", authMiddleware());
   console2.use("/api/*", builtinOnlyReadOnlyMiddleware());
   const serveIndex = (c) => {
-    const indexFile = join15(STATIC_DIR, "index.html");
-    if (existsSync18(indexFile)) {
-      return c.html(readFileSync18(indexFile, "utf-8"));
+    const indexFile = join19(STATIC_DIR, "index.html");
+    if (existsSync19(indexFile)) {
+      return c.html(readFileSync19(indexFile, "utf-8"));
     }
     return c.html("<h1>AgentMoss Policy Console</h1><p>Frontend not built. Use /console/api/* endpoints.</p>");
   };
@@ -12255,15 +11943,15 @@ function createConsoleRouter() {
     if (!/^[A-Za-z0-9_-]+$/.test(skillId)) {
       return c.json({ detail: "\u975E\u6CD5 skill id" }, 400);
     }
-    const userPath = join15(dirname12(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
+    const userPath = join19(dirname12(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
     const builtinDir = resolveAssetDir(__dirname10, "skills");
     const candidates = [
       ...isRuntimeConfigDisabled() ? [] : [userPath],
-      builtinDir ? join15(builtinDir, `${skillId}.md`) : ""
+      builtinDir ? join19(builtinDir, `${skillId}.md`) : ""
     ].filter(Boolean);
     for (const p of candidates) {
-      if (existsSync18(p)) {
-        return c.json({ skill_id: skillId, path: p, content: readFileSync18(p, "utf-8") });
+      if (existsSync19(p)) {
+        return c.json({ skill_id: skillId, path: p, content: readFileSync19(p, "utf-8") });
       }
     }
     return c.json({ detail: `skill ${skillId} \u4E0D\u5B58\u5728` }, 404);
@@ -12360,7 +12048,7 @@ function createConsoleRouter() {
     const defaults = generateSourceDefaults();
     try {
       const p = getRuntimeConfigPath();
-      if (existsSync18(p)) unlinkSync4(p);
+      if (existsSync19(p)) unlinkSync4(p);
     } catch {
     }
     return c.json(withL22View(defaults));
@@ -12397,7 +12085,7 @@ var init_router = __esm({
     init_asset_dir();
     init_rules_mode();
     __dirname10 = dirname12(fileURLToPath11(import.meta.url));
-    STATIC_DIR = join15(__dirname10, "static");
+    STATIC_DIR = join19(__dirname10, "static");
     CONSOLE_TOKEN_ENV = "AGENT_MOSS_CONSOLE_TOKEN";
   }
 });
@@ -12424,7 +12112,7 @@ import { Hono as Hono2 } from "hono";
 import { cors } from "hono/cors";
 import { logger } from "hono/logger";
 import net from "net";
-import { existsSync as existsSync19 } from "fs";
+import { existsSync as existsSync20 } from "fs";
 function logDeploymentSelfCheck() {
   try {
     const mode = getRulesMode();
@@ -12451,7 +12139,7 @@ function logDeploymentSelfCheck() {
     console.log("\u5C42\u7EA7\u5F00\u5173: " + layerKeys.map((k) => `${k}=${isLayerEnabled(k) ? "on" : "OFF"}`).join(" "));
     if (!builtinOnly) {
       try {
-        const dirs = rulesDirs().filter((d) => existsSync19(d));
+        const dirs = rulesDirs().filter((d) => existsSync20(d));
         if (dirs.length > 0) {
           console.log(`\u89C4\u5219\u76EE\u5F55: ${dirs.join(", ")}\uFF08\u53EA\u8BFB\u5176\u4E2D ${OVERRIDE_FILENAME} / ${EXTRA_FILENAME}\uFF09`);
         }
@@ -12490,6 +12178,7 @@ function logDeploymentSelfCheck() {
   }
 }
 function createApp() {
+  enforceRulesContract();
   const app = new Hono2();
   app.use("*", cors({ origin: "*", allowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"], allowHeaders: ["*"] }));
   app.use("*", logger());
@@ -12578,7 +12267,7 @@ async function startUnixSocketServer(socketPath = "/var/run/agent_moss/agent_mos
       server = null;
     },
     serve: async () => {
-      const { mkdirSync: mkdirSync10, existsSync: existsSync21, unlinkSync: unlinkSync5 } = await import("fs");
+      const { mkdirSync: mkdirSync10, existsSync: existsSync22, unlinkSync: unlinkSync5 } = await import("fs");
       const { dirname: dirname14 } = await import("path");
       const dir = dirname14(socketPath);
       if (dir) {
@@ -12587,7 +12276,7 @@ async function startUnixSocketServer(socketPath = "/var/run/agent_moss/agent_mos
         } catch {
         }
       }
-      if (existsSync21(socketPath)) {
+      if (existsSync22(socketPath)) {
         const { connect } = await import("net");
         const inUse = await new Promise((resolve11) => {
           const probe = connect(socketPath);
@@ -12629,6 +12318,7 @@ var init_server = __esm({
   "src/server.ts"() {
     "use strict";
     init_esm_shims();
+    init_rules_contract();
     init_routes();
     init_console();
     init_runtime_config();
@@ -12652,26 +12342,26 @@ __export(rules_tools_exports, {
   rulesStatusText: () => rulesStatusText,
   templateSourceDir: () => templateSourceDir
 });
-import { existsSync as existsSync20, mkdirSync as mkdirSync9, readdirSync as readdirSync7, readFileSync as readFileSync19, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname13, join as join16 } from "path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync9, readdirSync as readdirSync7, readFileSync as readFileSync20, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname13, join as join20 } from "path";
 import { fileURLToPath as fileURLToPath12 } from "url";
 function initRulesDir(targetDir, opts = {}) {
   mkdirSync9(targetDir, { recursive: true });
   const written = [];
-  const extraPath = join16(targetDir, EXTRA_FILENAME);
-  if (opts.force || !existsSync20(extraPath)) {
+  const extraPath = join20(targetDir, EXTRA_FILENAME);
+  if (opts.force || !existsSync21(extraPath)) {
     writeFileSync9(extraPath, JSON.stringify(EXTRA_TEMPLATE, null, 2), "utf-8");
     written.push(extraPath);
   }
-  const samplePath = join16(targetDir, OVERRIDE_FILENAME);
-  if (opts.force || !existsSync20(samplePath)) {
+  const samplePath = join20(targetDir, OVERRIDE_FILENAME);
+  if (opts.force || !existsSync21(samplePath)) {
     let payload = OVERRIDE_TEMPLATE;
     if (opts.withBuiltin) {
       let data = {};
       const builtin = resolveRulesFile("l1_rules.json");
-      if (builtin && existsSync20(builtin)) {
+      if (builtin && existsSync21(builtin)) {
         try {
-          data = JSON.parse(readFileSync19(builtin, "utf-8")) || {};
+          data = JSON.parse(readFileSync20(builtin, "utf-8")) || {};
         } catch {
           data = {};
         }
@@ -12682,17 +12372,17 @@ function initRulesDir(targetDir, opts = {}) {
     writeFileSync9(samplePath, JSON.stringify(payload, null, 2), "utf-8");
     written.push(samplePath);
   }
-  const readmeSrc = join16(templateSourceDir(), "README.md");
-  const readmeDst = join16(targetDir, "README.md");
-  if (existsSync20(readmeSrc) && (opts.force || !existsSync20(readmeDst))) {
-    writeFileSync9(readmeDst, readFileSync19(readmeSrc, "utf-8"), "utf-8");
+  const readmeSrc = join20(templateSourceDir(), "README.md");
+  const readmeDst = join20(targetDir, "README.md");
+  if (existsSync21(readmeSrc) && (opts.force || !existsSync21(readmeDst))) {
+    writeFileSync9(readmeDst, readFileSync20(readmeSrc, "utf-8"), "utf-8");
     written.push(readmeDst);
   }
   return written;
 }
 function templateSourceDir() {
-  const cands = [join16(__dirname11, "data", "rules_template"), join16(__dirname11, "..", "..", "agent_moss", "data", "rules_template")];
-  for (const c of cands) if (existsSync20(c)) return c;
+  const cands = [join20(__dirname11, "data", "rules_template"), join20(__dirname11, "..", "..", "agent_moss", "data", "rules_template")];
+  for (const c of cands) if (existsSync21(c)) return c;
   return cands[0];
 }
 function templateFiles(dirs) {
@@ -12700,7 +12390,7 @@ function templateFiles(dirs) {
   for (const d of dirs) {
     try {
       for (const name of readdirSync7(d)) {
-        if (name.endsWith(".json.\u793A\u4F8B")) out.push(join16(d, name));
+        if (name.endsWith(".json.\u793A\u4F8B")) out.push(join20(d, name));
       }
     } catch {
     }
@@ -12709,7 +12399,7 @@ function templateFiles(dirs) {
 }
 function rulesStatusText() {
   const lines = [];
-  const existing = rulesDirs().filter((d) => existsSync20(d));
+  const existing = rulesDirs().filter((d) => existsSync21(d));
   lines.push("\u89C4\u5219\u76EE\u5F55: " + (existing.length > 0 ? existing.join(", ") : "\uFF08\u672A\u8BBE\u7F6E / \u4E0D\u5B58\u5728\uFF09"));
   if (existing.length > 0) {
     lines.push(`  \uFF08\u53EA\u8BFB\u5176\u4E2D\u7684 ${OVERRIDE_FILENAME} \u4E0E ${EXTRA_FILENAME}\uFF1B\u5176\u4ED6\u6587\u4EF6\u540D\u4E00\u5F8B\u4E0D\u8BFB\uFF09`);
@@ -12861,6 +12551,17 @@ async function analyzeRawCommand(command, useJson = false) {
 async function main() {
   const args = process.argv.slice(2);
   const command = args[0];
+  try {
+    const { checkRulesAssets: checkRulesAssets2, enforceRulesContract: enforceRulesContract2, formatRulesIntegrity: formatRulesIntegrity2 } = await Promise.resolve().then(() => (init_rules_contract(), rules_contract_exports));
+    const rep = checkRulesAssets2();
+    if (!rep.ok) {
+      enforceRulesContract2();
+    }
+    if (rep.external) console.error(formatRulesIntegrity2(rep));
+  } catch (e) {
+    console.error(`\u274C ${e instanceof Error ? e.message : String(e)}`);
+    process.exit(2);
+  }
   if (command === "--version" || command === "-V") {
     console.log(`agent-moss ${version}`);
     process.exit(0);