@kenhkl/agent-moss 0.16.14 → 0.17.0

package/dist/engine/coordinator.js

@@ -25,6 +25,10 @@ var init_esm_shims = __esm({
 import { join } from "path";
 import { homedir } from "os";
 import { readFileSync } from "fs";
+function isSafeId(value) {
+  if (!value || value.length > ID_MAX_LEN) return false;
+  return ID_PATTERN.test(value);
+}
 function getRulesRoot() {
   const raw = (process.env[ENV_RULES_ROOT] ?? "").trim();
   return raw ? raw : null;
@@ -98,7 +102,7 @@ function getTokenStatsPath() {
   }
   return join(getDataRoot(), "agent_moss_token_stats.json");
 }
-var ENV_DATA_ROOT, ENV_INSTANCE, DEFAULT_DATA_ROOT, ENV_RULES_ROOT;
+var ENV_DATA_ROOT, ENV_INSTANCE, DEFAULT_DATA_ROOT, ENV_RULES_ROOT, ID_MAX_LEN, ID_PATTERN;
 var init_paths = __esm({
   "src/infra/paths.ts"() {
     "use strict";
@@ -107,6 +111,8 @@ var init_paths = __esm({
     ENV_INSTANCE = "AGENT_MOSS_INSTANCE";
     DEFAULT_DATA_ROOT = join(homedir(), ".config", "agentmoss");
     ENV_RULES_ROOT = "AGENT_MOSS_RULES_ROOT";
+    ID_MAX_LEN = 64;
+    ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
   }
 });
 
@@ -228,7 +234,7 @@ function parseDirEnv(envName) {
 function rulesDirs() {
   if (isBuiltinOnly()) return [];
   const dirs = [];
-  for (const env of RULES_DIR_ENVS) dirs.push(...parseDirEnv(env));
+  for (const env2 of RULES_DIR_ENVS) dirs.push(...parseDirEnv(env2));
   dirs.push(resolve(dataRootDir(), "rules"));
   return [...new Set(dirs)];
 }
@@ -273,6 +279,7 @@ function loadJson(name) {
   }
 }
 function resolveScenarioRulesFile(scenarioId) {
+  if (!isSafeId(scenarioId)) return null;
   const rel = join2("scenarios", scenarioId, "rules.json");
   for (const dir of rulesDirs()) {
     const p = resolve(dir, rel);
@@ -1282,7 +1289,7 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
       targetPaths.push(...segPathsFiltered);
     }
   }
-  const uniqueTargetPaths = [...new Set(targetPaths)];
+  const uniqueTargetPaths = [...new Set(targetPaths)].filter((p) => !PSEUDO_FS_PREFIXES.some((pfx) => p.startsWith(pfx)));
   if (uniqueTargetPaths.length === 0) return null;
   const historyReadPaths = /* @__PURE__ */ new Set();
   for (const action of actionHistory) {
@@ -1461,7 +1468,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd, osType) {
     violatedLayers: ["L2.1"]
   };
 }
-var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
+var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, PSEUDO_FS_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
 var init_logic_rules = __esm({
   "src/engine/logic-rules.ts"() {
     "use strict";
@@ -1508,6 +1515,7 @@ var init_logic_rules = __esm({
       "cat"
     ]);
     NON_WRITE_TOOL_PREFIXES = _LOGIC.non_write_tool_prefixes ?? [];
+    PSEUDO_FS_PREFIXES = ["/sys/", "/proc/", "/dev/", "/run/"];
     WRITE_KEYWORDS = ["write", "\u5199\u5165", "save", "\u4FDD\u5B58", "modify", "\u4FEE\u6539", "update", "\u66F4\u65B0", "delete", "\u5220\u9664", "remove", "\u79FB\u9664", "create", "\u521B\u5EFA", "append", "\u8FFD\u52A0", "truncate", "\u622A\u65AD", "overwrite", "\u8986\u76D6", "replace", "\u66FF\u6362", "edit"];
     SED_INPLACE_RE = /\bsed\s+(?:-\S+\s+)*(?:-[a-zA-Z]*i[a-zA-Z]*|--in-place)\b/i;
     DEVNULL_REDIRECT_RE = /(?:2|&|1)?\s*>\s*\/dev\/null\b/g;
@@ -2122,7 +2130,7 @@ function _l2SensitivePathsToRules() {
     const all = [...root, ...home, ...credential];
     for (const sp of all) {
       const os3 = String(sp.os || "linux").toLowerCase();
-      const denyMode = _deriveDenyMode({
+      const denyMode = sp.denyMode || _deriveDenyMode({
         deny_mode: sp.deny_mode,
         credential: sp.credential,
         read_only: sp.read_only
@@ -3509,6 +3517,11 @@ function resolveAgentsDir() {
 }
 function getAgentExtensions(agentId) {
   if (!agentId) return null;
+  if (!isSafeId(agentId)) {
+    console.warn(`[AgentMoss agents] \u975E\u6CD5 agent_id \u5DF2\u5FFD\u7565\uFF08\u542B\u8DEF\u5F84\u5B57\u7B26\u6216\u8D85\u957F\uFF09: ${agentId.slice(0, 120)}`);
+    return null;
+  }
+  if (cache.size >= CACHE_MAX) cache.clear();
   const fp = getRuleSourceFingerprint();
   const cached2 = cache.get(agentId);
   if (cached2 && cached2.fp === fp) return cached2.ext;
@@ -3561,7 +3574,7 @@ function mergeAgentExtensions(...exts) {
     extra_skills: nonNull.flatMap((e) => e.extra_skills || [])
   };
 }
-var __filename4, __dirname5, AGENTS_DIR_PROD, AGENTS_DIR_DEV_FALLBACK, cache;
+var __filename4, __dirname5, AGENTS_DIR_PROD, AGENTS_DIR_DEV_FALLBACK, cache, CACHE_MAX;
 var init_agents = __esm({
   "src/agents/index.ts"() {
     "use strict";
@@ -3573,6 +3586,7 @@ var init_agents = __esm({
     AGENTS_DIR_PROD = resolve4(__dirname5, "agents");
     AGENTS_DIR_DEV_FALLBACK = resolve4(__dirname5, "../../../agent_moss/agents");
     cache = /* @__PURE__ */ new Map();
+    CACHE_MAX = 512;
   }
 });
 
@@ -3589,6 +3603,11 @@ function resolveScenariosDir() {
 }
 function getScenarioExtensions(scenarioId) {
   if (!scenarioId) return null;
+  if (!isSafeId(scenarioId)) {
+    console.warn(`[AgentMoss scenarios] \u975E\u6CD5 scenario_id \u5DF2\u5FFD\u7565\uFF08\u542B\u8DEF\u5F84\u5B57\u7B26\u6216\u8D85\u957F\uFF09: ${scenarioId.slice(0, 120)}`);
+    return null;
+  }
+  if (cache2.size >= CACHE_MAX2) cache2.clear();
   const fp = getRuleSourceFingerprint();
   const cached2 = cache2.get(scenarioId);
   if (cached2 && cached2.fp === fp) return cached2.ext;
@@ -3658,7 +3677,7 @@ function getScenarioExtensionsMulti(scenarioSpec) {
   if (nonNull.length === 0) return null;
   return mergeAgentExtensions(...nonNull);
 }
-var __filename5, __dirname6, SCENARIOS_DIR_PROD, SCENARIOS_DIR_DEV_FALLBACK, cache2;
+var __filename5, __dirname6, SCENARIOS_DIR_PROD, SCENARIOS_DIR_DEV_FALLBACK, cache2, CACHE_MAX2;
 var init_scenarios = __esm({
   "src/scenarios/index.ts"() {
     "use strict";
@@ -3672,6 +3691,7 @@ var init_scenarios = __esm({
     SCENARIOS_DIR_PROD = resolve5(__dirname6, "scenarios");
     SCENARIOS_DIR_DEV_FALLBACK = resolve5(__dirname6, "../../../agent_moss/scenarios");
     cache2 = /* @__PURE__ */ new Map();
+    CACHE_MAX2 = 512;
   }
 });
 
@@ -4560,16 +4580,16 @@ __export(token_stats_exports, {
   recordTokenUsage: () => recordTokenUsage,
   resetTokenStats: () => resetTokenStats
 });
-import { readFileSync as readFileSync11, writeFileSync as writeFileSync2, existsSync as existsSync11, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2 } from "fs";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync2, existsSync as existsSync12, mkdirSync as mkdirSync3, unlinkSync as unlinkSync2 } from "fs";
 function getStatsPath() {
   const envPath = process.env[ENV_STATS_PATH];
   if (envPath) return envPath;
   return getTokenStatsPath();
 }
 function loadAllRecords(statsPath) {
-  if (!existsSync11(statsPath)) return [];
+  if (!existsSync12(statsPath)) return [];
   try {
-    const data = JSON.parse(readFileSync11(statsPath, "utf-8"));
+    const data = JSON.parse(readFileSync12(statsPath, "utf-8"));
     if (Array.isArray(data)) return data;
     if (data && Array.isArray(data.records)) return data.records;
     return [];
@@ -4580,7 +4600,7 @@ function loadAllRecords(statsPath) {
 function saveRecords(statsPath, records) {
   try {
     const dir = statsPath.substring(0, statsPath.lastIndexOf("/"));
-    if (dir && !existsSync11(dir)) mkdirSync2(dir, { recursive: true });
+    if (dir && !existsSync12(dir)) mkdirSync3(dir, { recursive: true });
     writeFileSync2(statsPath, JSON.stringify(records, null, 2), "utf-8");
   } catch (e) {
   }
@@ -4707,7 +4727,7 @@ function getTokenTrend(days = 0, startDate, endDate) {
 }
 function resetTokenStats() {
   const statsPath = getStatsPath();
-  if (existsSync11(statsPath)) {
+  if (existsSync12(statsPath)) {
     try {
       unlinkSync2(statsPath);
     } catch {
@@ -4735,17 +4755,113 @@ init_inline_analyzer();
 
 // src/engine/llm-analyzer.ts
 init_esm_shims();
+
+// src/infra/security-policy.ts
+init_esm_shims();
+init_paths();
+import { chmodSync, closeSync, existsSync as existsSync8, lstatSync, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync7, readSync, realpathSync, writeSync } from "fs";
+import { homedir as homedir2, tmpdir } from "os";
+import { basename, isAbsolute, join as join7, relative, resolve as resolve6, dirname as dirname6 } from "path";
+var TRUTHY2 = ["1", "true", "yes", "on"];
+function env(name, dflt = "") {
+  return (process.env[name] ?? dflt).trim();
+}
+function splitList(raw) {
+  return raw.replace(/;/g, ",").split(",").map((x) => x.trim()).filter(Boolean);
+}
+function homeDir() {
+  try {
+    return homedir2();
+  } catch {
+    return tmpdir();
+  }
+}
+function logRoots() {
+  const raw = env("AGENT_MOSS_LOG_ROOTS");
+  if (raw) return splitList(raw);
+  return [.../* @__PURE__ */ new Set([homeDir(), "/tmp", tmpdir()])];
+}
+function realpathLoose(p) {
+  const abs = resolve6(p.replace(/^~(?=$|\/)/, homeDir()));
+  try {
+    return realpathSync(abs);
+  } catch {
+  }
+  const parts = [];
+  let cur = abs;
+  for (; ; ) {
+    const parent = dirname6(cur);
+    if (parent === cur) return null;
+    parts.unshift(basename(cur));
+    cur = parent;
+    try {
+      return join7(realpathSync(cur), ...parts);
+    } catch {
+    }
+  }
+}
+function pathWithin(p, roots) {
+  if (!p) return true;
+  const target = realpathLoose(p);
+  if (target === null) return false;
+  for (const root of roots) {
+    const rootReal = realpathLoose(root);
+    if (rootReal === null) continue;
+    const rel = relative(rootReal, target);
+    if (rel === "" || !rel.startsWith("..") && !isAbsolute(rel)) return true;
+  }
+  return false;
+}
+var BLOCKED_HOSTS = ["169.254.169.254", "metadata.google.internal", "metadata.tencentyun.com"];
+function validateLlmBaseUrl(url, allowPrivate) {
+  if (!url) return [true, ""];
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return [false, "baseUrl \u4E0D\u662F\u5408\u6CD5 URL"];
+  }
+  if (u.protocol !== "http:" && u.protocol !== "https:") {
+    return [false, `baseUrl \u534F\u8BAE\u4E0D\u53D7\u652F\u6301: ${u.protocol}`];
+  }
+  const host = (u.hostname || "").toLowerCase();
+  if (!host) return [false, "baseUrl \u7F3A\u5C11\u4E3B\u673A\u540D"];
+  if (BLOCKED_HOSTS.includes(host)) return [false, `baseUrl \u6307\u5411\u4E91\u5143\u6570\u636E\u5730\u5740\uFF0C\u5DF2\u62D2\u7EDD: ${host}`];
+  if (/^169\.254\.\d{1,3}\.\d{1,3}$/.test(host)) {
+    return [false, `baseUrl \u6307\u5411\u94FE\u8DEF\u672C\u5730\u5730\u5740\uFF0C\u5DF2\u62D2\u7EDD: ${host}`];
+  }
+  const allowlist = splitList(env("AGENT_MOSS_LLM_HOST_ALLOWLIST")).map((h) => h.toLowerCase());
+  if (allowlist.length && !allowlist.includes(host)) {
+    return [false, `baseUrl \u4E3B\u673A\u4E0D\u5728\u5141\u8BB8\u5217\u8868: ${host}`];
+  }
+  if (allowPrivate === void 0) {
+    allowPrivate = TRUTHY2.includes(env("AGENT_MOSS_TRUST_PRIVATE_LLM", "1").toLowerCase());
+  }
+  if (!allowPrivate) {
+    if (host === "localhost" || host === "::1") return [false, "baseUrl \u6307\u5411\u672C\u673A\uFF0C\u5DF2\u62D2\u7EDD"];
+    const m = host.match(/^(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
+    if (m) {
+      const [a, b] = [Number(m[1]), Number(m[2])];
+      if (a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 127 || a === 169 && b === 254) {
+        return [false, `baseUrl \u6307\u5411\u5185\u7F51\u5730\u5740\uFF0C\u5DF2\u62D2\u7EDD: ${host}`];
+      }
+    }
+  }
+  return [true, ""];
+}
+
+// src/engine/llm-analyzer.ts
 init_config();
 init_skill_loader();
 
 // src/engine/template-loader.ts
 init_esm_shims();
 init_asset_dir();
-import { readFileSync as readFileSync7, existsSync as existsSync8 } from "fs";
-import { resolve as resolve6, dirname as dirname6 } from "path";
+import { readFileSync as readFileSync8, existsSync as existsSync9 } from "fs";
+import { resolve as resolve7, dirname as dirname7 } from "path";
 import { fileURLToPath as fileURLToPath8 } from "url";
 var __filename6 = fileURLToPath8(import.meta.url);
-var __dirname7 = dirname6(__filename6);
+var __dirname7 = dirname7(__filename6);
 var TEMPLATE_FILES = ["prompt1_template.txt", "prompt2_template.txt", "security_judge_template.txt"];
 var cachedTemplates = null;
 function loadTemplates() {
@@ -4758,10 +4874,10 @@ function loadTemplates() {
     return cachedTemplates;
   }
   for (const file of TEMPLATE_FILES) {
-    const filePath = resolve6(dir, file);
-    if (existsSync8(filePath)) {
+    const filePath = resolve7(dir, file);
+    if (existsSync9(filePath)) {
       const key = file.replace(".txt", "").replace("_template", "");
-      cachedTemplates[key] = readFileSync7(filePath, "utf-8");
+      cachedTemplates[key] = readFileSync8(filePath, "utf-8");
     }
   }
   console.log(`[AgentMoss] Loaded ${Object.keys(cachedTemplates).length} templates from ${dir}`);
@@ -4771,8 +4887,8 @@ function loadTemplates() {
 // src/engine/script-analyzer.ts
 init_esm_shims();
 init_rules_loader();
-import { readFileSync as readFileSync8 } from "fs";
-import { resolve as resolve7, join as join7 } from "path";
+import { readFileSync as readFileSync9 } from "fs";
+import { resolve as resolve8, join as join8 } from "path";
 var SCRIPT_RULES = loadScriptRules();
 if (!SCRIPT_RULES || Object.keys(SCRIPT_RULES).length === 0) {
   console.error(
@@ -4842,8 +4958,8 @@ function assessKeywordCombinationRisk(matchedKeywords, scriptContent) {
 }
 function readScriptContent(scriptPath, maxLines = 500) {
   try {
-    const expandedPath = scriptPath === "~" || scriptPath.startsWith("~/") ? join7(process.env.HOME || "/home/user", scriptPath.slice(1)) : resolve7(scriptPath);
-    const raw = readFileSync8(expandedPath, "utf-8");
+    const expandedPath = scriptPath === "~" || scriptPath.startsWith("~/") ? join8(process.env.HOME || "/home/user", scriptPath.slice(1)) : resolve8(scriptPath);
+    const raw = readFileSync9(expandedPath, "utf-8");
     const lines = raw.split("\n").slice(0, maxLines);
     return { content: lines.join("\n"), lineCount: lines.length, error: "" };
   } catch (e) {
@@ -4899,9 +5015,9 @@ init_heuristic();
 init_config();
 init_logic_rules();
 init_inline_analyzer();
-import { statSync as statSync4, existsSync as existsSync10 } from "fs";
-import { resolve as resolve9, join as join9, isAbsolute as isAbsolute2 } from "path";
-import { homedir as homedir3 } from "os";
+import { statSync as statSync4, existsSync as existsSync11 } from "fs";
+import { resolve as resolve10, join as join10, isAbsolute as isAbsolute3 } from "path";
+import { homedir as homedir4 } from "os";
 
 // src/engine/script-engine/tracker.ts
 init_esm_shims();
@@ -5011,14 +5127,14 @@ function isSysArgv(node) {
   const prop = node.getChild("PropertyName");
   return prop !== null && srcSlice(prop) === "argv";
 }
-function evalExpr(node, env) {
+function evalExpr(node, env2) {
   if (!node) return null;
   const name = node.name;
   if (name === "String") return stringValue(srcSlice(node));
   if (name === "Number") return srcSlice(node);
   if (name === "VariableName") {
     const id = srcSlice(node);
-    return id in env.vars ? env.vars[id] : null;
+    return id in env2.vars ? env2.vars[id] : null;
   }
   if (name === "MemberExpression") {
     const bracket = node.getChild("[");
@@ -5028,13 +5144,13 @@ function evalExpr(node, env) {
         const idxNode = bracket.nextSibling;
         if (idxNode && idxNode.name === "Number") {
           const idx = parseInt(srcSlice(idxNode), 10);
-          if (idx >= 1 && idx <= env.argv.length) return env.argv[idx - 1];
+          if (idx >= 1 && idx <= env2.argv.length) return env2.argv[idx - 1];
           return null;
         }
       }
       return null;
     }
-    if (isSysArgv(node)) return env.argv[0] ?? null;
+    if (isSysArgv(node)) return env2.argv[0] ?? null;
     return null;
   }
   if (name === "CallExpression") {
@@ -5042,7 +5158,7 @@ function evalExpr(node, env) {
     if (func && func.name === "VariableName" && srcSlice(func) === "len") {
       const argList = node.getChild("ArgList");
       const inner = argList ? firstNamedChild(argList) : null;
-      if (inner && isSysArgv(inner)) return String(env.argv.length + 1);
+      if (inner && isSysArgv(inner)) return String(env2.argv.length + 1);
     }
     return null;
   }
@@ -5054,16 +5170,16 @@ function evalExpr(node, env) {
     const condNode = ifKw.nextSibling;
     const orelseNode = elseKw.nextSibling;
     if (!thenNode || !condNode || !orelseNode) return null;
-    const cond = evalCondition(condNode, env);
-    if (cond === true) return evalExpr(thenNode, env);
-    if (cond === false) return evalExpr(orelseNode, env);
+    const cond = evalCondition(condNode, env2);
+    if (cond === true) return evalExpr(thenNode, env2);
+    if (cond === false) return evalExpr(orelseNode, env2);
     return null;
   }
   if (name === "BinaryExpression") {
     const op = findOp(node);
     if (op === "+") {
-      const left = evalExpr(node.firstChild, env);
-      const right = evalExpr(lastNamedChild(node), env);
+      const left = evalExpr(node.firstChild, env2);
+      const right = evalExpr(lastNamedChild(node), env2);
       if (left !== null && right !== null) return left + right;
     }
     return null;
@@ -5096,7 +5212,7 @@ function findOp(node) {
   }
   return null;
 }
-function evalCondition(node, env) {
+function evalCondition(node, env2) {
   if (!node) return null;
   const name = node.name;
   if (name === "Boolean") {
@@ -5107,7 +5223,7 @@ function evalCondition(node, env) {
     const op = findOp(node);
     if (op === "and" || op === "or") {
       const parts2 = namedChildren(node);
-      const vals = parts2.map((p) => evalCondition(p, env));
+      const vals = parts2.map((p) => evalCondition(p, env2));
       if (op === "and") {
         if (vals.some((v) => v === false)) return false;
         if (vals.every((v) => v === true)) return true;
@@ -5121,13 +5237,13 @@ function evalCondition(node, env) {
     if (parts.length !== 3) return null;
     const [left, opNode, right] = parts;
     const opText = srcSlice(opNode).trim();
-    return evalCompare(left, opText, right, env);
+    return evalCompare(left, opText, right, env2);
   }
   if (name === "UnaryExpression") {
     const kw = node.getChild("not");
     if (kw) {
       const operand = kw.nextSibling;
-      const v = evalCondition(operand, env);
+      const v = evalCondition(operand, env2);
       return v === null ? null : !v;
     }
     return null;
@@ -5148,39 +5264,39 @@ function namedChildren(node) {
   }
   return out;
 }
-function evalCompare(left, opText, right, env) {
+function evalCompare(left, opText, right, env2) {
   if (opText === "==" && left.name === "VariableName" && srcSlice(left) === "__name__") {
-    const rv = evalExpr(right, env);
+    const rv = evalExpr(right, env2);
     if (rv !== null) return rv === "__main__";
     return null;
   }
   if (opText === "==" || opText === "!=") {
-    const lv = evalExpr(left, env);
-    const rv = evalExpr(right, env);
+    const lv = evalExpr(left, env2);
+    const rv = evalExpr(right, env2);
     if (lv !== null && rv !== null) {
       return opText === "==" ? lv === rv : lv !== rv;
     }
     return null;
   }
   if (opText === "in") {
-    const lv = evalExpr(left, env);
+    const lv = evalExpr(left, env2);
     if (lv === null) return null;
     const rightName = right.name;
     if (rightName === "TupleExpression" || rightName === "ArrayExpression" || rightName === "SetExpression" || rightName === "ParenthesizedExpression") {
       const container = rightName === "ParenthesizedExpression" && right.firstChild && right.firstChild.name === "TupleExpression" ? right.firstChild : right;
       for (const elt of namedChildren(container)) {
-        const ev = evalExpr(elt, env);
+        const ev = evalExpr(elt, env2);
         if (ev !== null && ev === lv) return true;
       }
       return false;
     }
-    const rv = evalExpr(right, env);
+    const rv = evalExpr(right, env2);
     if (rv !== null) return rv.includes(lv);
     return null;
   }
   if (opText === ">" || opText === ">=" || opText === "<" || opText === "<=") {
-    const lv = evalExpr(left, env);
-    const rv = evalExpr(right, env);
+    const lv = evalExpr(left, env2);
+    const rv = evalExpr(right, env2);
     if (lv === null || rv === null) return null;
     const ln = parseInt(lv, 10);
     const rn = parseInt(rv, 10);
@@ -5192,71 +5308,71 @@ function evalCompare(left, opText, right, env) {
   }
   return null;
 }
-function processStmts(stmts, env, lineStarts, lines, branches) {
-  for (const s of stmts) processStmt(s, env, lineStarts, lines, branches);
+function processStmts(stmts, env2, lineStarts, lines, branches) {
+  for (const s of stmts) processStmt(s, env2, lineStarts, lines, branches);
 }
-function invalidateEnvOnCalls(node, env) {
+function invalidateEnvOnCalls(node, env2) {
   const cursor = node.cursor();
   cursor.iterate((n) => {
     const nd = n.node;
     if (nd.name !== "CallExpression") return true;
     const func = nd.firstChild;
     if (func && func.name === "VariableName" && !PURE_BUILTINS.has(srcSlice(func))) {
-      for (const k of Object.keys(env.vars)) env.vars[k] = null;
+      for (const k of Object.keys(env2.vars)) env2.vars[k] = null;
       return false;
     }
     return true;
   });
 }
-function processStmt(stmt, env, lineStarts, lines, branches) {
+function processStmt(stmt, env2, lineStarts, lines, branches) {
   const name = stmt.name;
   if (name === "AssignStatement") {
     const target = stmt.firstChild;
     if (target && target.name === "VariableName") {
       const valNode = target.nextSibling ? target.nextSibling.nextSibling : null;
-      invalidateEnvOnCalls(stmt, env);
-      const val = evalExpr(valNode, env);
-      env.vars[srcSlice(target)] = val;
+      invalidateEnvOnCalls(stmt, env2);
+      const val = evalExpr(valNode, env2);
+      env2.vars[srcSlice(target)] = val;
     }
     markNodeLines(stmt, lines, lineStarts);
     return;
   }
   if (name === "UpdateStatement") {
     const target = stmt.firstChild;
-    if (target && target.name === "VariableName") env.vars[srcSlice(target)] = null;
-    invalidateEnvOnCalls(stmt, env);
+    if (target && target.name === "VariableName") env2.vars[srcSlice(target)] = null;
+    invalidateEnvOnCalls(stmt, env2);
     markNodeLines(stmt, lines, lineStarts);
     return;
   }
   if (name === "IfStatement") {
-    processIf(stmt, env, lineStarts, lines, branches);
+    processIf(stmt, env2, lineStarts, lines, branches);
     return;
   }
   if (name === "ForStatement" || name === "WhileStatement") {
     markNodeLines(stmt, lines, lineStarts);
     for (const body of stmt.getChildren("Body")) {
-      processStmts(bodyStmts(body), { argv: env.argv, vars: { ...env.vars } }, lineStarts, lines, branches);
+      processStmts(bodyStmts(body), { argv: env2.argv, vars: { ...env2.vars } }, lineStarts, lines, branches);
     }
     return;
   }
   if (name === "TryStatement") {
     markNodeLines(stmt, lines, lineStarts);
     for (const body of stmt.getChildren("Body")) {
-      processStmts(bodyStmts(body), { argv: env.argv, vars: { ...env.vars } }, lineStarts, lines, branches);
+      processStmts(bodyStmts(body), { argv: env2.argv, vars: { ...env2.vars } }, lineStarts, lines, branches);
     }
     return;
   }
   if (name === "WithStatement") {
     markNodeLines(stmt, lines, lineStarts);
     const body = stmt.getChild("Body");
-    if (body) processStmts(bodyStmts(body), { argv: env.argv, vars: { ...env.vars } }, lineStarts, lines, branches);
+    if (body) processStmts(bodyStmts(body), { argv: env2.argv, vars: { ...env2.vars } }, lineStarts, lines, branches);
     return;
   }
   if (name === "MatchStatement") {
     markNodeLines(stmt, lines, lineStarts);
     for (const clause of stmt.getChildren("MatchClause")) {
       const body = clause.getChild("Body");
-      if (body) processStmts(bodyStmts(body), { argv: env.argv, vars: { ...env.vars } }, lineStarts, lines, branches);
+      if (body) processStmts(bodyStmts(body), { argv: env2.argv, vars: { ...env2.vars } }, lineStarts, lines, branches);
     }
     return;
   }
@@ -5265,7 +5381,7 @@ function processStmt(stmt, env, lineStarts, lines, branches) {
     return;
   }
   if (name === "ExpressionStatement") {
-    invalidateEnvOnCalls(stmt, env);
+    invalidateEnvOnCalls(stmt, env2);
   }
   markNodeLines(stmt, lines, lineStarts);
 }
@@ -5285,7 +5401,7 @@ function bodyStmts(body) {
   }
   return out;
 }
-function processIf(stmt, env, lineStarts, lines, branches) {
+function processIf(stmt, env2, lineStarts, lines, branches) {
   const sections = [];
   let c = stmt.firstChild;
   while (c) {
@@ -5300,17 +5416,17 @@ function processIf(stmt, env, lineStarts, lines, branches) {
     }
     c = c.nextSibling;
   }
-  processIfSections(stmt, sections, 0, env, lineStarts, lines, branches);
+  processIfSections(stmt, sections, 0, env2, lineStarts, lines, branches);
 }
-function processIfSections(_stmt, sections, idx, env, lineStarts, lines, branches) {
+function processIfSections(_stmt, sections, idx, env2, lineStarts, lines, branches) {
   if (idx >= sections.length) return;
   const s = sections[idx];
   if (s.cond) markNodeLines(s.cond, lines, lineStarts);
   if (s.isElse) {
-    if (s.body) processStmts(bodyStmts(s.body), env, lineStarts, lines, branches);
+    if (s.body) processStmts(bodyStmts(s.body), env2, lineStarts, lines, branches);
     return;
   }
-  const cond = s.cond ? evalCondition(s.cond, env) : null;
+  const cond = s.cond ? evalCondition(s.cond, env2) : null;
   branches.push({
     kind: "if",
     label: s.cond ? srcSlice(s.cond) : "",
@@ -5318,18 +5434,18 @@ function processIfSections(_stmt, sections, idx, env, lineStarts, lines, branche
     reachable: cond !== false
   });
   if (cond === true) {
-    if (s.body) processStmts(bodyStmts(s.body), env, lineStarts, lines, branches);
+    if (s.body) processStmts(bodyStmts(s.body), env2, lineStarts, lines, branches);
     return;
   }
   if (cond === false) {
-    processIfSections(_stmt, sections, idx + 1, env, lineStarts, lines, branches);
+    processIfSections(_stmt, sections, idx + 1, env2, lineStarts, lines, branches);
     return;
   }
-  if (s.body) processStmts(bodyStmts(s.body), env, lineStarts, lines, branches);
+  if (s.body) processStmts(bodyStmts(s.body), env2, lineStarts, lines, branches);
   for (let j = idx + 1; j < sections.length; j++) {
     const sj = sections[j];
     if (sj.cond) markNodeLines(sj.cond, lines, lineStarts);
-    if (sj.body) processStmts(bodyStmts(sj.body), env, lineStarts, lines, branches);
+    if (sj.body) processStmts(bodyStmts(sj.body), env2, lineStarts, lines, branches);
   }
 }
 function parseShellString(s) {
@@ -5452,7 +5568,7 @@ var PythonBackend = class {
     SOURCE = c;
     const sourceLines = c.split("\n");
     const lineStarts = buildLineStarts(c);
-    const env = makeEnv(entryArgs || []);
+    const env2 = makeEnv(entryArgs || []);
     const lines = /* @__PURE__ */ new Set();
     const branches = [];
     if (sourceLines.length > MAX_LINES) {
@@ -5479,7 +5595,7 @@ var PythonBackend = class {
       };
     }
     const stmts = bodyStmts(tree);
-    processStmts(stmts, env, lineStarts, lines, branches);
+    processStmts(stmts, env2, lineStarts, lines, branches);
     const reachable = reconstruct(sourceLines, lines);
     let calls = extractCallsFromTree(tree, lines);
     if (calls.length === 0) calls = extractCallsRegex(c);
@@ -5729,7 +5845,7 @@ function tokenize(content) {
   return stmts;
 }
 var EXPR_SPLIT_RE = /(\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*|\$\d+)/;
-function evalExpr2(text, env) {
+function evalExpr2(text, env2) {
   const isSingleQuoted = text.length >= 2 && text[0] === "'" && text[text.length - 1] === "'";
   if (text.length >= 2 && (text[0] === '"' || text[0] === "'") && text[text.length - 1] === text[0]) {
     text = text.slice(1, -1);
@@ -5745,19 +5861,19 @@ function evalExpr2(text, env) {
       const dm = inner.match(/^([A-Za-z_][A-Za-z0-9_]*|\d+):?-(.*)$/s);
       if (dm) {
         const key = /^\d+$/.test(dm[1]) ? `$${dm[1]}` : dm[1];
-        const bound = env.get(key);
+        const bound = env2.get(key);
         if (bound && !(bound.kind === "concrete" && !bound.value)) {
           result.push(bound);
         } else {
-          result.push(evalExpr2(dm[2], env));
+          result.push(evalExpr2(dm[2], env2));
         }
         continue;
       }
       if (/^\d+$/.test(inner)) {
-        const v = env.get(`$${inner}`);
+        const v = env2.get(`$${inner}`);
         result.push(v || svalSym(`$${inner}`));
       } else {
-        const v = env.get(inner);
+        const v = env2.get(inner);
         result.push(v || svalSym(inner));
       }
       continue;
@@ -5766,7 +5882,7 @@ function evalExpr2(text, env) {
     if (bare) {
       const varName = bare[1];
       const key = /^\d+$/.test(varName) ? `$${varName}` : varName;
-      const v = env.get(key);
+      const v = env2.get(key);
       result.push(v || svalSym(p));
       continue;
     }
@@ -5776,13 +5892,13 @@ function evalExpr2(text, env) {
   return fold(svalExpr(result));
 }
 function initEnv(entryArgs) {
-  const env = /* @__PURE__ */ new Map();
+  const env2 = /* @__PURE__ */ new Map();
   if (entryArgs && entryArgs.length) {
-    entryArgs.forEach((a, idx) => env.set(`$${idx + 1}`, svalConc(a)));
-    env.set("$@", svalConc(entryArgs.join(" ")));
-    env.set("$*", svalConc(entryArgs.join(" ")));
+    entryArgs.forEach((a, idx) => env2.set(`$${idx + 1}`, svalConc(a)));
+    env2.set("$@", svalConc(entryArgs.join(" ")));
+    env2.set("$*", svalConc(entryArgs.join(" ")));
   }
-  return env;
+  return env2;
 }
 var HAS_GLOB = /[*?[]/;
 function globToRegex(pattern) {
@@ -5841,12 +5957,12 @@ function evalNumericCompare(op, left, right) {
       return null;
   }
 }
-function resolveVarSide(tok, env) {
+function resolveVarSide(tok, env2) {
   if (!tok.startsWith("$")) return tok;
-  const ev = evalExpr2(tok, env);
+  const ev = evalExpr2(tok, env2);
   return ev.kind === "concrete" ? ev.value : null;
 }
-function evalCondition2(cond, env) {
+function evalCondition2(cond, env2) {
   let inner = cond.trim().replace(/^\[\[?|\]\]?$/g, "").trim();
   if (/^-[A-Za-z]\s/.test(inner) || inner.startsWith("-d") || inner.startsWith("-f")) return null;
   const innerQ = inner.replace(/"/g, "").replace(/'/g, "");
@@ -5856,8 +5972,8 @@ function evalCondition2(cond, env) {
     if (!opm) continue;
     const left2 = innerQ.slice(0, opm.index).trim();
     const right2 = innerQ.slice(opm.index + opm[0].length).trim();
-    const lv2 = resolveVarSide(left2, env);
-    const rv2 = resolveVarSide(right2, env);
+    const lv2 = resolveVarSide(left2, env2);
+    const rv2 = resolveVarSide(right2, env2);
     if (lv2 === null || rv2 === null) return null;
     return evalNumericCompare(op2, lv2, rv2);
   }
@@ -5868,7 +5984,7 @@ function evalCondition2(cond, env) {
   let right = sm[3].trim();
   if (op === "=~") {
     if (right.startsWith("/") && right.endsWith("/")) right = right.slice(1, -1);
-    const lv2 = resolveVarSide(left, env);
+    const lv2 = resolveVarSide(left, env2);
     if (lv2 === null) return null;
     try {
       return new RegExp(right).test(lv2);
@@ -5876,8 +5992,8 @@ function evalCondition2(cond, env) {
       return null;
     }
   }
-  const lv = resolveVarSide(left, env);
-  const rv = resolveVarSide(right, env);
+  const lv = resolveVarSide(left, env2);
+  const rv = resolveVarSide(right, env2);
   if (lv === null || rv === null) return null;
   if (op === "!=") return lv !== rv;
   return lv === rv;
@@ -5887,7 +6003,7 @@ function symbolicProcess(content, entryArgs) {
   const stmts = tokenize(content);
   if (!stmts.some((s) => s.kind === "case" || s.kind === "if" || s.kind === "assign")) return null;
   if (stmts.some((s) => !s.modelable)) return null;
-  const env = initEnv(entryArgs);
+  const env2 = initEnv(entryArgs);
   let linesBudget = 0;
   let branchesBudget = 0;
   let modelable = false;
@@ -5897,9 +6013,9 @@ function symbolicProcess(content, entryArgs) {
     if (linesBudget > MAX_LINES2) return null;
     if (s.kind === "assign") {
       modelable = true;
-      if (env.size >= MAX_VARS) return null;
-      const v = evalExpr2(s.rhs, env);
-      env.set(s.name, fold(v));
+      if (env2.size >= MAX_VARS) return null;
+      const v = evalExpr2(s.rhs, env2);
+      env2.set(s.name, fold(v));
       out.push(s.line);
       continue;
     }
@@ -5907,7 +6023,7 @@ function symbolicProcess(content, entryArgs) {
       modelable = true;
       branchesBudget += s.branches.length;
       if (branchesBudget > MAX_BRANCHES) return null;
-      const selVal = fold(evalExpr2(s.selector, env));
+      const selVal = fold(evalExpr2(s.selector, env2));
       if (selVal.kind !== "concrete") return null;
       const concrete = selVal.value || "";
       let selected = null;
@@ -5934,7 +6050,7 @@ esac`);
       modelable = true;
       branchesBudget++;
       if (branchesBudget > MAX_BRANCHES) return null;
-      const truth = evalCondition2(s.cond, env);
+      const truth = evalCondition2(s.cond, env2);
       if (truth === null) return null;
       const chosen = truth ? s.thenBody : s.elseBody;
       if (chosen === null) return null;
@@ -6539,7 +6655,7 @@ function extractInlineScriptPath(actionDetail) {
         if (looksLikeScriptPath(tok)) {
           try {
             const resolved = resolvePath2(tok.replace(/^['"]|['"]$/g, ""));
-            if (existsSync10(resolved)) {
+            if (existsSync11(resolved)) {
               const stat = statSync4(resolved);
               if (stat.isFile()) return resolved;
             }
@@ -6553,7 +6669,7 @@ function extractInlineScriptPath(actionDetail) {
       const p = m[1];
       try {
         const resolved = resolvePath2(p);
-        if (existsSync10(resolved)) {
+        if (existsSync11(resolved)) {
           const stat = statSync4(resolved);
           if (stat.isFile()) return resolved;
         }
@@ -6569,7 +6685,7 @@ function extractInlineScriptPath(actionDetail) {
     let resolved;
     try {
       resolved = resolvePath2(p);
-      if (existsSync10(resolved)) {
+      if (existsSync11(resolved)) {
         const stat = statSync4(resolved);
         if (stat.isFile()) return resolved;
       }
@@ -6610,9 +6726,9 @@ function shlexSplit(s) {
 function resolvePath2(p) {
   let expanded = p;
   if (expanded.startsWith("~/") || expanded === "~") {
-    expanded = join9(homedir3(), expanded.slice(1));
+    expanded = join10(homedir4(), expanded.slice(1));
   }
-  return resolve9(expanded);
+  return resolve10(expanded);
 }
 function scanExtensionPatterns(ext, content) {
   const pats = ext?.extra_command_patterns;
@@ -6733,8 +6849,8 @@ function analyzeScriptContent2(input, ext) {
     resolvedPath = inline;
     isInline = true;
   }
-  if (resolvedPath && !isAbsolute2(resolvedPath) && !resolvedPath.startsWith("~/")) {
-    resolvedPath = join9(input.cwd || process.cwd(), resolvedPath);
+  if (resolvedPath && !isAbsolute3(resolvedPath) && !resolvedPath.startsWith("~/")) {
+    resolvedPath = join10(input.cwd || process.cwd(), resolvedPath);
   }
   const l1Adapter = (content) => {
     const j = scanDangerousCommandPatterns("bash", content, input.osType);
@@ -6821,7 +6937,7 @@ ${contentPreview}
 }
 
 // src/engine/llm-analyzer.ts
-import { appendFileSync } from "fs";
+import { openSync as openSync2, writeSync as writeSync2, closeSync as closeSync2, constants as fsConstants } from "fs";
 import OpenAI from "openai";
 var llmCache = /* @__PURE__ */ new Map();
 var LLM_CACHE_MAX = 200;
@@ -6839,7 +6955,15 @@ async function runLLMAnalysis(input, previous) {
     };
   }
   const globalConfig = getLLMConfig();
-  const config = input.llmConfig?.apiKey ? { ...globalConfig, ...input.llmConfig } : globalConfig;
+  let perRequest = input.llmConfig;
+  if (perRequest?.apiKey) {
+    const [okUrl, why] = validateLlmBaseUrl(String(perRequest.baseUrl || ""));
+    if (!okUrl) {
+      console.warn("[AgentMoss] \u5FFD\u7565\u4E0D\u88AB\u5141\u8BB8\u7684 per-request llmConfig.baseUrl:", why);
+      perRequest = { ...perRequest, baseUrl: void 0 };
+    }
+  }
+  const config = perRequest?.apiKey ? { ...globalConfig, ...perRequest } : globalConfig;
   const rawDetail = input.aNext.actionDetail.replace(/^terminal-\w+:\s*command=([^,]+).*/, "$1").trim();
   const cacheKey = `${input.aNext.actionType}:${rawDetail || input.aNext.actionDetail}`;
   const cached2 = llmCache.get(cacheKey);
@@ -6868,6 +6992,10 @@ async function runLLMAnalysis(input, previous) {
 }
 function logPrompt(prompt, aNext, logPath) {
   if (!logPath) return;
+  if (!pathWithin(logPath, logRoots())) {
+    console.warn("[AgentMoss] \u5FFD\u7565\u8D8A\u754C\u7684 llm_log_path\uFF08\u4E0D\u5728\u5141\u8BB8\u6839\u76EE\u5F55\u5185\uFF09:", logPath);
+    return;
+  }
   try {
     const actionType = aNext.actionType || "unknown";
     const actionDetail = (aNext.actionDetail || "").slice(0, 100);
@@ -6875,7 +7003,14 @@ function logPrompt(prompt, aNext, logPath) {
 ${prompt}
 --- END PROMPT ---
 `;
-    appendFileSync(logPath, line, "utf-8");
+    let flags = fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_APPEND;
+    if (fsConstants.O_NOFOLLOW) flags |= fsConstants.O_NOFOLLOW;
+    const fd = openSync2(logPath, flags, 384);
+    try {
+      writeSync2(fd, line);
+    } finally {
+      closeSync2(fd);
+    }
   } catch (e) {
     console.warn("[AgentMoss] Failed to write LLM prompt to log:", e);
   }
@@ -7034,7 +7169,7 @@ async function analyzeWithLLM(prompt, config) {
       }
       if (attempt < maxRetries) {
         console.error(`[AgentMoss] LLM call failed (attempt ${attempt + 1}/${maxRetries + 1}), retrying in ${retryCfg.retryInterval}s:`, err.message);
-        await new Promise((resolve10) => setTimeout(resolve10, retryCfg.retryInterval * 1e3));
+        await new Promise((resolve11) => setTimeout(resolve11, retryCfg.retryInterval * 1e3));
       } else {
         clearTimeout(totalTimeoutTimer);
         console.error("[AgentMoss] LLM call failed after all retries:", err.message);
@@ -7057,10 +7192,10 @@ init_esm_shims();
 
 // src/brain/rule-store.ts
 init_esm_shims();
-import { existsSync as existsSync12, readFileSync as readFileSync12, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
-import { join as join10 } from "path";
-import { homedir as homedir4 } from "os";
-var DEFAULT_RULES_PATH = join10(homedir4(), ".agentmoss", "brain", "rules.json");
+import { existsSync as existsSync13, readFileSync as readFileSync13, writeFileSync as writeFileSync3, mkdirSync as mkdirSync4 } from "fs";
+import { join as join11 } from "path";
+import { homedir as homedir5 } from "os";
+var DEFAULT_RULES_PATH = join11(homedir5(), ".agentmoss", "brain", "rules.json");
 var ENV_RULES_PATH = "AGENT_MOSS_BRAIN_RULES_PATH";
 var STATUS_DRAFT = "draft";
 var STATUS_APPROVED = "approved";
@@ -7089,11 +7224,11 @@ var BrainRuleStore = class {
     this.data = this.load();
   }
   load() {
-    if (!existsSync12(this.path)) {
+    if (!existsSync13(this.path)) {
       return { version: 1, rules: [], pattern_candidates: [] };
     }
     try {
-      const raw = JSON.parse(readFileSync12(this.path, "utf-8"));
+      const raw = JSON.parse(readFileSync13(this.path, "utf-8"));
       return {
         version: raw.version || 1,
         rules: raw.rules || [],
@@ -7105,7 +7240,7 @@ var BrainRuleStore = class {
   }
   save() {
     const dir = this.path.substring(0, this.path.lastIndexOf("/"));
-    if (dir) mkdirSync3(dir, { recursive: true });
+    if (dir) mkdirSync4(dir, { recursive: true });
     writeFileSync3(this.path, JSON.stringify(this.data, null, 2), "utf-8");
   }
   addRule(rule) {
@@ -7673,11 +7808,11 @@ function parseReview(content) {
 
 // src/brain/skill-manager.ts
 init_esm_shims();
-import { existsSync as existsSync13, mkdirSync as mkdirSync4, readFileSync as readFileSync13, renameSync, writeFileSync as writeFileSync4 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join11 } from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync5, readFileSync as readFileSync14, renameSync, writeFileSync as writeFileSync4 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join12 } from "path";
 import { randomUUID } from "crypto";
-var DEFAULT_SKILL_META_PATH = join11(homedir5(), ".agentmoss", "brain", "skill_meta.json");
+var DEFAULT_SKILL_META_PATH = join12(homedir6(), ".agentmoss", "brain", "skill_meta.json");
 var ENV_SKILL_META_PATH = "AGENT_MOSS_BRAIN_SKILL_META_PATH";
 function getMetaPath(override) {
   return override || process.env[ENV_SKILL_META_PATH] || DEFAULT_SKILL_META_PATH;
@@ -7687,7 +7822,7 @@ var BrainSkillManager = class {
     this.skillsDir = skillsDir;
     this.metaPath = getMetaPath(metaPath);
     try {
-      mkdirSync4(join11(this.metaPath, ".."), { recursive: true });
+      mkdirSync5(join12(this.metaPath, ".."), { recursive: true });
     } catch {
     }
     this.load();
@@ -7697,9 +7832,9 @@ var BrainSkillManager = class {
   skills = [];
   metaPath;
   load() {
-    if (!existsSync13(this.metaPath)) return;
+    if (!existsSync14(this.metaPath)) return;
     try {
-      const data = JSON.parse(readFileSync13(this.metaPath, "utf-8"));
+      const data = JSON.parse(readFileSync14(this.metaPath, "utf-8"));
       this.skills = data.skills || [];
     } catch {
       this.skills = [];
@@ -7722,7 +7857,7 @@ var BrainSkillManager = class {
     let changed = false;
     for (const sk of this.skills) {
       if (sk.status !== "active") continue;
-      if (!existsSync13(join11(this.skillsDir, `${sk.name}.md`))) {
+      if (!existsSync14(join12(this.skillsDir, `${sk.name}.md`))) {
         sk.status = "stale";
         changed = true;
       }
@@ -7733,9 +7868,9 @@ var BrainSkillManager = class {
   addSkill(skill) {
     const id = skill.id || randomUUID();
     const name = skill.name || `brain_${id.slice(0, 8)}`;
-    if (!existsSync13(this.skillsDir)) return "";
-    const mdPath = join11(this.skillsDir, `${name}.md`);
-    if (existsSync13(mdPath)) return "";
+    if (!existsSync14(this.skillsDir)) return "";
+    const mdPath = join12(this.skillsDir, `${name}.md`);
+    if (existsSync14(mdPath)) return "";
     try {
       writeFileSync4(mdPath, skill.content, "utf-8");
     } catch {
@@ -7784,12 +7919,12 @@ var BrainSkillManager = class {
     const out = [];
     for (const sk of this.skills) {
       if (sk.origin_node !== "local" || sk.status !== "active") continue;
-      const mdPath = join11(this.skillsDir, `${sk.name}.md`);
-      if (!existsSync13(mdPath)) continue;
+      const mdPath = join12(this.skillsDir, `${sk.name}.md`);
+      if (!existsSync14(mdPath)) continue;
       out.push({
         name: sk.name,
         category: sk.category || "",
-        content: readFileSync13(mdPath, "utf-8"),
+        content: readFileSync14(mdPath, "utf-8"),
         keywords: sk.keywords || []
       });
     }
@@ -7870,9 +8005,9 @@ var BrainCurator = class {
 // src/brain/contributor.ts
 init_esm_shims();
 init_asset_dir();
-import { dirname as dirname9 } from "path";
+import { dirname as dirname10 } from "path";
 import { fileURLToPath as fileURLToPath9 } from "url";
-var __dirname8 = dirname9(fileURLToPath9(import.meta.url));
+var __dirname8 = dirname10(fileURLToPath9(import.meta.url));
 
 // src/brain/index.ts
 function checkBrainRules(store, opts) {
@@ -8225,7 +8360,7 @@ function markIntegrity(actionDetail) {
   }
   return { integrity: "medium", isLowSource: false };
 }
-function initNode(sessionId, seq, actionType, actionDetail) {
+function initNode(sessionId, seq, actionType, actionDetail, timestamp) {
   const { integrity, isLowSource } = markIntegrity(actionDetail);
   return {
     sessionId,
@@ -8235,7 +8370,8 @@ function initNode(sessionId, seq, actionType, actionDetail) {
     stage: markStage(actionDetail),
     resources: extractResources(actionDetail),
     integrity,
-    isLowSource
+    isLowSource,
+    timestamp: timestamp || void 0
   };
 }
 function buildSessionGraph(actionHistory, aNext, sessionId = "current") {
@@ -8245,13 +8381,21 @@ function buildSessionGraph(actionHistory, aNext, sessionId = "current") {
   const details = [];
   for (const a of actionHistory) {
     const ad = String(a.actionDetail || "");
-    if (ad) details.push({ actionType: String(a.actionType || ""), actionDetail: ad });
+    if (ad) details.push({
+      actionType: String(a.actionType || ""),
+      actionDetail: ad,
+      calledAt: a.calledAt || void 0
+    });
   }
   if (aNext) {
-    details.push({ actionType: String(aNext.actionType || ""), actionDetail: String(aNext.actionDetail || "") });
+    details.push({
+      actionType: String(aNext.actionType || ""),
+      actionDetail: String(aNext.actionDetail || ""),
+      calledAt: aNext.calledAt || void 0
+    });
   }
   details.forEach((d, seq) => {
-    const node = initNode(sessionId, seq, d.actionType, d.actionDetail);
+    const node = initNode(sessionId, seq, d.actionType, d.actionDetail, d.calledAt);
     nodes.push(node);
     if (node.stage) stageFlags.add(node.stage);
   });
@@ -8277,7 +8421,8 @@ function buildMultiSessionGraph(sessions, aNext) {
         last.sessionId,
         last.nodes.length,
         String(aNext.actionType || ""),
-        String(aNext.actionDetail || "")
+        String(aNext.actionDetail || ""),
+        aNext.calledAt || void 0
       ));
       if (last.nodes.length > 1) {
         last.edges.push({ src: last.nodes.length - 2, dst: last.nodes.length - 1, kind: "next" });
@@ -8325,6 +8470,27 @@ function allNodesFlat(mg) {
 // src/engine/formal-engine/properties.ts
 init_esm_shims();
 init_rules_loader();
+function parseTs(ts) {
+  if (!ts) return null;
+  const t = Date.parse(String(ts).trim());
+  return Number.isFinite(t) ? t : null;
+}
+function privescExfilWindowSec() {
+  const raw = (process.env.AGENT_MOSS_PRIVESC_EXFIL_WINDOW_SEC || "").trim();
+  if (!raw) return 1800;
+  const n = parseInt(raw, 10);
+  return Number.isFinite(n) ? Math.max(0, n) : 1800;
+}
+function privescInWindow(nodes, indexes, exfilIdx, windowSec) {
+  const before = indexes.filter((i) => i < exfilIdx);
+  if (windowSec <= 0) return before;
+  const exfilTs = parseTs(nodes[exfilIdx].timestamp);
+  if (exfilTs === null) return before;
+  return before.filter((i) => {
+    const ts = parseTs(nodes[i].timestamp);
+    return ts === null || exfilTs - ts <= windowSec * 1e3;
+  });
+}
 var CROSS_SESSION_CHAINS = null;
 function loadCrossSessionChains() {
   if (CROSS_SESSION_CHAINS) return CROSS_SESSION_CHAINS;
@@ -8527,6 +8693,7 @@ function checkNeverExfilAfterPrivesc(graph) {
   const nodes = allNodes(graph);
   if (nodes.length < 2) return violations;
   const witness = graph.witnessIdx;
+  const windowSec = privescExfilWindowSec();
   if (witness !== void 0) {
     const evIdx = [];
     nodes.forEach((n, i) => {
@@ -8534,15 +8701,17 @@ function checkNeverExfilAfterPrivesc(graph) {
     });
     if (evIdx.length === 0) return violations;
     const firstEv = Math.min(...evIdx);
-    let pre = null;
-    for (let i = 0; i < firstEv; i++) {
-      if (isPrivescNode(nodes[i])) pre = nodes[i];
-    }
-    if (pre) {
+    const privescIdx = [];
+    nodes.forEach((n, i) => {
+      if (isPrivescNode(n)) privescIdx.push(i);
+    });
+    const candidates = privescInWindow(nodes, privescIdx, firstEv, windowSec);
+    if (candidates.length > 0) {
+      const pre = nodes[candidates[candidates.length - 1]];
       const post = nodes[firstEv];
       return [{
         propertyId: "no-exfil-after-privesc",
-        reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\xAC\u25C7EXFIL)",
+        reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\u25C7EXFIL) \u7A97\u53E3\u7EA6\u675F",
         riskLevel: "critical",
         path: [
           { sessionId: pre.sessionId, seq: pre.seq, detail: pre.actionDetail.slice(0, 60) },
@@ -8555,18 +8724,18 @@ function checkNeverExfilAfterPrivesc(graph) {
   for (let i = 0; i < nodes.length; i++) {
     if (!isPrivescNode(nodes[i])) continue;
     for (let j = i + 1; j < nodes.length; j++) {
-      if (isExfilNode(nodes[j])) {
-        violations.push({
-          propertyId: "no-exfil-after-privesc",
-          reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\xAC\u25C7EXFIL)",
-          riskLevel: "critical",
-          path: [
-            { sessionId: nodes[i].sessionId, seq: nodes[i].seq, detail: nodes[i].actionDetail.slice(0, 60) },
-            { sessionId: nodes[j].sessionId, seq: nodes[j].seq, detail: nodes[j].actionDetail.slice(0, 60) }
-          ]
-        });
-        return violations;
-      }
+      if (!isExfilNode(nodes[j])) continue;
+      if (privescInWindow(nodes, [i], j, windowSec).length === 0) continue;
+      violations.push({
+        propertyId: "no-exfil-after-privesc",
+        reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\u25C7EXFIL) \u7A97\u53E3\u7EA6\u675F",
+        riskLevel: "critical",
+        path: [
+          { sessionId: nodes[i].sessionId, seq: nodes[i].seq, detail: nodes[i].actionDetail.slice(0, 60) },
+          { sessionId: nodes[j].sessionId, seq: nodes[j].seq, detail: nodes[j].actionDetail.slice(0, 60) }
+        ]
+      });
+      return violations;
     }
   }
   return violations;
@@ -8733,6 +8902,11 @@ function checkCrossSessionReachability(graph) {
   }
   return violations;
 }
+var DATA_SOURCE_READ_RE = /\b(?:cat|head|tail|less|more|sed|awk|grep|strings|base64|xxd|od|dd)\b|\b(?:open|read_text|read_bytes)\s*\(/i;
+function isDataSourceNode(n) {
+  if (n.stage === "CRED" || n.isLowSource) return true;
+  return DATA_SOURCE_READ_RE.test(n.actionDetail);
+}
 function checkSensitiveDataAggregation(graph) {
   const violations = [];
   const nodes = allNodes(graph);
@@ -8752,6 +8926,7 @@ function checkSensitiveDataAggregation(graph) {
     for (const r of n.resources) {
       for (const j of resIndex.get(r) || []) {
         if (j === exfilIdx) continue;
+        if (!isDataSourceNode(nodes[j])) continue;
         srcs.add(`${nodes[j].sessionId}#${nodes[j].seq}`);
       }
     }