@kenhkl/agent-moss 0.16.14 → 0.17.0

package/dist/server.js

@@ -1,5 +1,11 @@
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
@@ -25,6 +31,10 @@ var init_esm_shims = __esm({
 import { join } from "path";
 import { homedir } from "os";
 import { readFileSync } from "fs";
+function isSafeId(value) {
+  if (!value || value.length > ID_MAX_LEN) return false;
+  return ID_PATTERN.test(value);
+}
 function getRulesRoot() {
   const raw = (process.env[ENV_RULES_ROOT] ?? "").trim();
   return raw ? raw : null;
@@ -98,7 +108,7 @@ function getTokenStatsPath() {
   }
   return join(getDataRoot(), "agent_moss_token_stats.json");
 }
-var ENV_DATA_ROOT, ENV_INSTANCE, DEFAULT_DATA_ROOT, ENV_RULES_ROOT;
+var ENV_DATA_ROOT, ENV_INSTANCE, DEFAULT_DATA_ROOT, ENV_RULES_ROOT, ID_MAX_LEN, ID_PATTERN;
 var init_paths = __esm({
   "src/infra/paths.ts"() {
     "use strict";
@@ -107,6 +117,8 @@ var init_paths = __esm({
     ENV_INSTANCE = "AGENT_MOSS_INSTANCE";
     DEFAULT_DATA_ROOT = join(homedir(), ".config", "agentmoss");
     ENV_RULES_ROOT = "AGENT_MOSS_RULES_ROOT";
+    ID_MAX_LEN = 64;
+    ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
   }
 });
 
@@ -184,7 +196,7 @@ function parseDirEnv(envName) {
 function rulesDirs() {
   if (isBuiltinOnly()) return [];
   const dirs = [];
-  for (const env of RULES_DIR_ENVS) dirs.push(...parseDirEnv(env));
+  for (const env2 of RULES_DIR_ENVS) dirs.push(...parseDirEnv(env2));
   dirs.push(resolve(dataRootDir(), "rules"));
   return [...new Set(dirs)];
 }
@@ -232,6 +244,7 @@ function loadJson(name) {
   }
 }
 function resolveScenarioRulesFile(scenarioId) {
+  if (!isSafeId(scenarioId)) return null;
   const rel = join2("scenarios", scenarioId, "rules.json");
   for (const dir of rulesDirs()) {
     const p = resolve(dir, rel);
@@ -716,6 +729,491 @@ var init_rules_loader = __esm({
   }
 });
 
+// src/infra/security-policy.ts
+import { createHash as createHash2, randomBytes, timingSafeEqual } from "crypto";
+import { chmodSync, closeSync, existsSync as existsSync3, lstatSync, mkdirSync, openSync, readFileSync as readFileSync4, readSync, realpathSync, writeSync } from "fs";
+import { homedir as homedir2, tmpdir } from "os";
+import { basename, isAbsolute, join as join4, relative, resolve as resolve2, dirname as dirname2 } from "path";
+function env(name, dflt = "") {
+  return (process.env[name] ?? dflt).trim();
+}
+function envInt(name, dflt) {
+  const raw = env(name);
+  if (!raw) return dflt;
+  const n = Number.parseInt(raw, 10);
+  return Number.isFinite(n) ? n : dflt;
+}
+function splitList(raw) {
+  return raw.replace(/;/g, ",").split(",").map((x) => x.trim()).filter(Boolean);
+}
+function originCheckEnabled() {
+  return TRUTHY2.includes(env("AGENT_MOSS_ORIGIN_CHECK", "1").toLowerCase());
+}
+function allowedOrigins() {
+  return splitList(env("AGENT_MOSS_CORS_ORIGINS"));
+}
+function normOrigin(o) {
+  return (o || "").trim().replace(/\/+$/, "");
+}
+function originAllowed(origin, hostHeader, extra) {
+  const o = normOrigin(origin);
+  if (!o) return true;
+  const entries = (extra ?? allowedOrigins()).map(normOrigin);
+  if (entries.includes(o)) return true;
+  const host = (hostHeader || "").trim();
+  if (!host) return false;
+  try {
+    const u = new URL(o);
+    return u.host === host;
+  } catch {
+    return false;
+  }
+}
+function authMode() {
+  return (env("AGENT_MOSS_AUTH_MODE", AUTH_MODE_AUTO) || AUTH_MODE_AUTO).toLowerCase();
+}
+function autoTokenPath() {
+  let root;
+  try {
+    root = getDataRoot();
+  } catch {
+    root = join4(homedir2(), ".config", "agentmoss");
+  }
+  return join4(root, "auth_token");
+}
+function readFdToken() {
+  const raw = env("AGENT_MOSS_AUTH_TOKEN_FD");
+  if (!raw) return "";
+  const fd = Number.parseInt(raw, 10);
+  if (!Number.isFinite(fd)) return "";
+  if (fdTokenCache.has(fd)) return fdTokenCache.get(fd);
+  const buf = Buffer.alloc(8192);
+  let n = 0;
+  try {
+    n = readSync(fd, buf, 0, buf.length, null);
+  } catch (e) {
+    console.error(`[AgentMoss] \u4ECE fd ${fd} \u8BFB\u53D6\u8BBF\u95EE token \u5931\u8D25:`, e);
+  }
+  try {
+    closeSync(fd);
+  } catch {
+  }
+  const tok = n > 0 ? buf.subarray(0, n).toString("utf-8").trim() : "";
+  fdTokenCache.set(fd, tok);
+  return tok;
+}
+function readExplicitToken() {
+  const tok = env("AGENT_MOSS_AUTH_TOKEN");
+  if (tok) return tok;
+  const fdTok = readFdToken();
+  if (fdTok) return fdTok;
+  const path6 = env("AGENT_MOSS_AUTH_TOKEN_FILE");
+  if (path6) {
+    try {
+      return readFileSync4(path6, "utf-8").trim();
+    } catch {
+      return "";
+    }
+  }
+  return "";
+}
+function ensureAutoToken() {
+  const path6 = autoTokenPath();
+  try {
+    if (existsSync3(path6) && !lstatSync(path6).isSymbolicLink()) {
+      const tok2 = readFileSync4(path6, "utf-8").trim();
+      if (tok2) {
+        try {
+          chmodSync(path6, 384);
+        } catch {
+        }
+        return tok2;
+      }
+    }
+    const tok = randomBytes(32).toString("base64url");
+    ensurePrivateDir(dirname2(path6));
+    if (!writePrivateText(path6, tok + "\n")) return "";
+    console.warn(
+      `[AgentMoss] \u5DF2\u751F\u6210\u8BBF\u95EE token \u5E76\u5199\u5165 ${path6}\uFF080600\uFF09\u3002\u5BA2\u6237\u7AEF\u9700\u5E26 \`Authorization: Bearer <token>\`\uFF1B\u67E5\u770B\uFF1Acat ${path6}\uFF1B\u5982\u9700\u5173\u95ED\u9274\u6743\uFF1AAGENT_MOSS_AUTH_MODE=off`
+    );
+    return tok;
+  } catch (e) {
+    console.error("[AgentMoss] \u751F\u6210\u8BBF\u95EE token \u5931\u8D25\uFF08\u672C\u6B21\u8FD0\u884C\u5C06\u4E0D\u9274\u6743\uFF09:", e);
+    return "";
+  }
+}
+function parseAgentTokens(raw) {
+  const out = {};
+  for (const pair of splitList(raw)) {
+    const i = pair.indexOf("=");
+    if (i > 0) {
+      const a = pair.slice(0, i).trim();
+      const t = pair.slice(i + 1).trim();
+      if (a && t) out[a] = t;
+    }
+  }
+  return out;
+}
+function resolveAuth() {
+  const rawAgents = env("AGENT_MOSS_AGENT_TOKENS");
+  const key = [
+    authMode(),
+    env("AGENT_MOSS_AUTH_TOKEN"),
+    env("AGENT_MOSS_AUTH_TOKEN_FILE"),
+    env("AGENT_MOSS_AUTH_TOKEN_FD"),
+    rawAgents,
+    env("AGENT_MOSS_DATA_DIR")
+  ].join("\0");
+  if (tokenCache && tokenCache.key === key) {
+    return [tokenCache.token, tokenCache.agents, tokenCache.error];
+  }
+  let error = "";
+  let token = readExplicitToken();
+  if (!token && env("AGENT_MOSS_AUTH_TOKEN_FD") && authMode() !== AUTH_MODE_OFF) {
+    error = "AGENT_MOSS_AUTH_TOKEN_FD \u5DF2\u8BBE\u7F6E\uFF0C\u4F46\u6CA1\u80FD\u4ECE\u8BE5\u6587\u4EF6\u63CF\u8FF0\u7B26\u8BFB\u5230 token\u3002\u62D2\u7EDD\u964D\u7EA7\u5230\u78C1\u76D8 token\uFF08\u90A3\u4F1A\u5728\u672C\u673A\u7559\u4E0B\u4E00\u4EFD\u540C\u7528\u6237\u53EF\u8BFB\u7684\u51ED\u8BC1\uFF09\u3002";
+    console.error(`[agent-moss] ${error}`);
+  }
+  if (!token && !error && authMode() !== AUTH_MODE_OFF) token = ensureAutoToken();
+  const agents = parseAgentTokens(rawAgents);
+  tokenCache = { key, token, agents, error };
+  return [token, agents, error];
+}
+function agentTokens() {
+  return resolveAuth()[1];
+}
+function authConfigError() {
+  return resolveAuth()[2];
+}
+function failFastOnAuthError() {
+  const err = authConfigError();
+  if (err) {
+    console.error(`[agent-moss] \u9274\u6743\u914D\u7F6E\u9519\u8BEF\uFF0C\u62D2\u7EDD\u542F\u52A8: ${err}`);
+    process.exit(1);
+  }
+}
+function authEnabled() {
+  if (authMode() === AUTH_MODE_OFF) return false;
+  const [tok, agents] = resolveAuth();
+  return Boolean(tok) || Object.keys(agents).length > 0;
+}
+function bearer(headers) {
+  const get = (k) => headers instanceof Headers ? headers.get(k) ?? "" : headers[k] ?? "";
+  const v = get("authorization") || get("Authorization");
+  return v.toLowerCase().startsWith("bearer ") ? v.slice(7).trim() : "";
+}
+function constEq(a, b) {
+  const ba = Buffer.from(a, "utf-8");
+  const bb = Buffer.from(b, "utf-8");
+  if (ba.length !== bb.length) return false;
+  return timingSafeEqual(ba, bb);
+}
+function checkRequestAuth(headers, path6) {
+  if (authMode() === AUTH_MODE_OFF) return [true, ""];
+  const isHealth = HEALTH_PATHS.includes(path6.replace(/\/+$/, ""));
+  const [gt0, agents, err] = resolveAuth();
+  if (err) return isHealth ? [true, ""] : [false, ""];
+  if (!gt0 && Object.keys(agents).length === 0) return [true, ""];
+  if (isHealth) return [true, ""];
+  const tok = bearer(headers);
+  if (!tok) return [false, ""];
+  if (path6.startsWith("/console/api")) {
+    const consoleTok = env("AGENT_MOSS_CONSOLE_TOKEN");
+    if (consoleTok && constEq(tok, consoleTok)) return [true, "console"];
+  }
+  const gt = gt0;
+  if (gt && constEq(tok, gt)) return [true, "global"];
+  for (const [agent, expected] of Object.entries(agents)) {
+    if (constEq(tok, expected)) return [true, `agent:${agent}`];
+  }
+  return [false, ""];
+}
+function bindAgent(principal, agentId) {
+  const tokens = agentTokens();
+  if (Object.keys(tokens).length === 0) return [true, agentId];
+  if (!principal.startsWith("agent:")) return [true, agentId];
+  const bound = principal.slice(6);
+  if (!agentId) return [true, bound];
+  return [bound === agentId, bound];
+}
+function principalOf(headers, path6 = "") {
+  const [ok, principal] = checkRequestAuth(headers, path6);
+  return ok ? principal : "";
+}
+function principalHash(principal) {
+  if (!principal) return "";
+  return createHash2("sha256").update(principal, "utf-8").digest("hex").slice(0, 12);
+}
+function homeDir() {
+  try {
+    return homedir2();
+  } catch {
+    return tmpdir();
+  }
+}
+function logRoots() {
+  const raw = env("AGENT_MOSS_LOG_ROOTS");
+  if (raw) return splitList(raw);
+  return [.../* @__PURE__ */ new Set([homeDir(), "/tmp", tmpdir()])];
+}
+function reviewRoots() {
+  const roots = [join4(homeDir(), ".local", "share", "agent_gate")];
+  for (const name of ["AGENT_GATE_DB", "AGENT_GATE_JSON_PATH"]) {
+    const v = env(name);
+    if (v) roots.push(existsSync3(v) && lstatSync(v).isDirectory() ? v : dirname2(v));
+  }
+  roots.push(...splitList(env("AGENT_MOSS_REVIEW_PATHS")));
+  return [...new Set(roots)];
+}
+function realpathLoose(p) {
+  const abs = resolve2(p.replace(/^~(?=$|\/)/, homeDir()));
+  try {
+    return realpathSync(abs);
+  } catch {
+  }
+  const parts = [];
+  let cur = abs;
+  for (; ; ) {
+    const parent = dirname2(cur);
+    if (parent === cur) return null;
+    parts.unshift(basename(cur));
+    cur = parent;
+    try {
+      return join4(realpathSync(cur), ...parts);
+    } catch {
+    }
+  }
+}
+function pathWithin(p, roots) {
+  if (!p) return true;
+  const target = realpathLoose(p);
+  if (target === null) return false;
+  for (const root of roots) {
+    const rootReal = realpathLoose(root);
+    if (rootReal === null) continue;
+    const rel = relative(rootReal, target);
+    if (rel === "" || !rel.startsWith("..") && !isAbsolute(rel)) return true;
+  }
+  return false;
+}
+function ensurePrivateDir(dir) {
+  try {
+    mkdirSync(dir, { recursive: true });
+    if (lstatSync(dir).isSymbolicLink()) return false;
+    if (typeof process.getuid === "function" && lstatSync(dir).uid !== process.getuid()) return false;
+    chmodSync(dir, 448);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function writePrivateText(file, text) {
+  try {
+    const flags = __require("fs").constants;
+    let openFlags = flags.O_WRONLY | flags.O_CREAT | flags.O_TRUNC;
+    if (flags.O_NOFOLLOW) openFlags |= flags.O_NOFOLLOW;
+    const fd = openSync(file, openFlags, 384);
+    try {
+      writeSync(fd, text);
+    } finally {
+      closeSync(fd);
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+function perRequestLlmEnabled() {
+  return TRUTHY2.includes(env("AGENT_MOSS_ALLOW_PER_REQUEST_LLM", "1").toLowerCase());
+}
+function validateLlmBaseUrl(url, allowPrivate) {
+  if (!url) return [true, ""];
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return [false, "baseUrl \u4E0D\u662F\u5408\u6CD5 URL"];
+  }
+  if (u.protocol !== "http:" && u.protocol !== "https:") {
+    return [false, `baseUrl \u534F\u8BAE\u4E0D\u53D7\u652F\u6301: ${u.protocol}`];
+  }
+  const host = (u.hostname || "").toLowerCase();
+  if (!host) return [false, "baseUrl \u7F3A\u5C11\u4E3B\u673A\u540D"];
+  if (BLOCKED_HOSTS.includes(host)) return [false, `baseUrl \u6307\u5411\u4E91\u5143\u6570\u636E\u5730\u5740\uFF0C\u5DF2\u62D2\u7EDD: ${host}`];
+  if (/^169\.254\.\d{1,3}\.\d{1,3}$/.test(host)) {
+    return [false, `baseUrl \u6307\u5411\u94FE\u8DEF\u672C\u5730\u5730\u5740\uFF0C\u5DF2\u62D2\u7EDD: ${host}`];
+  }
+  const allowlist = splitList(env("AGENT_MOSS_LLM_HOST_ALLOWLIST")).map((h) => h.toLowerCase());
+  if (allowlist.length && !allowlist.includes(host)) {
+    return [false, `baseUrl \u4E3B\u673A\u4E0D\u5728\u5141\u8BB8\u5217\u8868: ${host}`];
+  }
+  if (allowPrivate === void 0) {
+    allowPrivate = TRUTHY2.includes(env("AGENT_MOSS_TRUST_PRIVATE_LLM", "1").toLowerCase());
+  }
+  if (!allowPrivate) {
+    if (host === "localhost" || host === "::1") return [false, "baseUrl \u6307\u5411\u672C\u673A\uFF0C\u5DF2\u62D2\u7EDD"];
+    const m = host.match(/^(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
+    if (m) {
+      const [a, b] = [Number(m[1]), Number(m[2])];
+      if (a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 127 || a === 169 && b === 254) {
+        return [false, `baseUrl \u6307\u5411\u5185\u7F51\u5730\u5740\uFF0C\u5DF2\u62D2\u7EDD: ${host}`];
+      }
+    }
+  }
+  return [true, ""];
+}
+function hardenExistingPaths() {
+  try {
+    const roots = [join4(homeDir(), ".config", "agentmoss"), join4(homeDir(), ".agentmoss")];
+    const names = [
+      "agent_moss_runtime.json",
+      "config.json",
+      "agent_moss_settings.json",
+      "agent_moss_token_stats.json",
+      "stateful_chains.db",
+      "stateful_chains.db-wal",
+      "stateful_chains.db-shm"
+    ];
+    for (const root of roots) {
+      try {
+        if (existsSync3(root) && !lstatSync(root).isSymbolicLink()) chmodSync(root, 448);
+      } catch {
+      }
+      for (const n of names) {
+        const p = join4(root, n);
+        try {
+          if (existsSync3(p) && !lstatSync(p).isSymbolicLink()) chmodSync(p, 384);
+        } catch {
+        }
+      }
+    }
+  } catch {
+  }
+}
+function chainDetailMode() {
+  return (env("AGENT_MOSS_CHAIN_DETAIL", "redacted") || "redacted").toLowerCase();
+}
+function redactChain(chain, currentSessionId) {
+  if (!chain || chain.length === 0) return [];
+  if (chainDetailMode() === "full") return [...chain];
+  return chain.map((step) => {
+    if (Array.isArray(step) && step.length >= 3) {
+      const [sid, seq, , ts] = step;
+      if (String(sid) === String(currentSessionId)) return [...step];
+      return ["<other-session>", seq, "<\u5DF2\u9690\u85CF>", ts ?? ""];
+    }
+    return step;
+  });
+}
+function sessionSweepThreshold() {
+  return envInt("AGENT_MOSS_SESSION_SWEEP_THRESHOLD", 50);
+}
+function sessionSweepWindow() {
+  return envInt("AGENT_MOSS_SESSION_SWEEP_WINDOW_SEC", 300);
+}
+function sessionSweepAction() {
+  return (env("AGENT_MOSS_SESSION_SWEEP_ACTION", "log") || "log").toLowerCase();
+}
+function noteSessionAccess(key, sessionId) {
+  const limit = sessionSweepThreshold();
+  if (limit <= 0 || !sessionId) return [0, false];
+  const now = Date.now() / 1e3;
+  const cutoff = now - sessionSweepWindow();
+  let entries = (sessionWindow.get(key) ?? []).filter(([t]) => t >= cutoff);
+  entries.push([now, sessionId]);
+  if (entries.length > limit * 4) entries = entries.slice(-limit * 4);
+  sessionWindow.set(key, entries);
+  if (sessionWindow.size > 1e4) sessionWindow.clear();
+  const distinct = new Set(entries.map(([, s]) => s)).size;
+  return [distinct, distinct > limit];
+}
+function queueAbuseThreshold() {
+  return envInt("AGENT_MOSS_QUEUE_ABUSE_THRESHOLD", 10);
+}
+function queueAbuseWindow() {
+  return envInt("AGENT_MOSS_QUEUE_ABUSE_WINDOW_SEC", 60);
+}
+function queueAbuseAction() {
+  return (env("AGENT_MOSS_QUEUE_ABUSE_ACTION", "log") || "log").toLowerCase();
+}
+function noteQueueReject(key) {
+  const limit = queueAbuseThreshold();
+  if (limit <= 0 || !key) return [0, false];
+  const now = Date.now() / 1e3;
+  const cutoff = now - queueAbuseWindow();
+  let entries = (queueRejects.get(key) ?? []).filter((t) => t >= cutoff);
+  entries.push(now);
+  if (entries.length > limit * 4) entries = entries.slice(-limit * 4);
+  queueRejects.set(key, entries);
+  if (queueRejects.size > 1e4) queueRejects.clear();
+  return [entries.length, entries.length > limit];
+}
+function socketMode() {
+  const raw = env("AGENT_MOSS_SOCKET_MODE", "600");
+  const mode = parseInt(raw, 8);
+  if (!Number.isFinite(mode) || mode < 0 || mode > 511) {
+    console.warn(`[agent-moss] AGENT_MOSS_SOCKET_MODE=${raw} \u975E\u6CD5\uFF0C\u56DE\u9000 600`);
+    return 384;
+  }
+  return mode;
+}
+function errorDetailMode() {
+  return (env("AGENT_MOSS_ERROR_DETAIL", "generic") || "generic").toLowerCase();
+}
+function maxBodyBytes() {
+  return envInt("AGENT_MOSS_MAX_BODY_BYTES", 16 * 1024 * 1024);
+}
+function poolOf(path6) {
+  if (path6 === "/api/v1/analyze" || path6.startsWith("/api/v1/analyze/")) return "biz";
+  if (path6 === "/api/v1/review" || path6.startsWith("/api/v1/review/")) return "review";
+  if (path6 === "/console" || path6.startsWith("/console/") || path6.startsWith("/api/v1/brain")) return "ops";
+  if (path6 === "/api/v1/health") return "health";
+  return "other";
+}
+function poolLimit(name) {
+  let dflt = POOL_DEFAULTS[name] ?? 4;
+  if (name === "biz") dflt = envInt("AGENT_MOSS_MAX_INFLIGHT", dflt);
+  return envInt(`AGENT_MOSS_POOL_${name.toUpperCase()}`, dflt);
+}
+function unauthInflight() {
+  return envInt("AGENT_MOSS_MAX_UNAUTH_INFLIGHT", 4);
+}
+function unauthPerIp() {
+  return envInt("AGENT_MOSS_MAX_UNAUTH_PER_IP", 2);
+}
+function agentInflight() {
+  return envInt("AGENT_MOSS_MAX_AGENT_INFLIGHT", 8);
+}
+function boundAgentOf(principal) {
+  return principal.startsWith("agent:") ? principal.slice("agent:".length) : "";
+}
+function rateLimitQps() {
+  return envInt("AGENT_MOSS_RATE_LIMIT_QPS", 100);
+}
+function maxConnections() {
+  return envInt("AGENT_MOSS_MAX_CONNECTIONS", 128);
+}
+function keepAliveSec() {
+  return envInt("AGENT_MOSS_KEEP_ALIVE_SEC", 5);
+}
+var TRUTHY2, HEALTH_PATHS, AUTH_MODE_AUTO, AUTH_MODE_OFF, tokenCache, fdTokenCache, BLOCKED_HOSTS, sessionWindow, queueRejects, POOL_DEFAULTS;
+var init_security_policy = __esm({
+  "src/infra/security-policy.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_paths();
+    TRUTHY2 = ["1", "true", "yes", "on"];
+    HEALTH_PATHS = ["/api/v1/health"];
+    AUTH_MODE_AUTO = "auto";
+    AUTH_MODE_OFF = "off";
+    tokenCache = null;
+    fdTokenCache = /* @__PURE__ */ new Map();
+    BLOCKED_HOSTS = ["169.254.169.254", "metadata.google.internal", "metadata.tencentyun.com"];
+    sessionWindow = /* @__PURE__ */ new Map();
+    queueRejects = /* @__PURE__ */ new Map();
+    POOL_DEFAULTS = { biz: 16, review: 1, ops: 4, health: 4, other: 4 };
+  }
+});
+
 // src/engine/shell-split.ts
 function hasCommandSubstitution(text) {
   return CMD_SUBSTITUTION.test(text);
@@ -1291,7 +1789,7 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
       targetPaths.push(...segPathsFiltered);
     }
   }
-  const uniqueTargetPaths = [...new Set(targetPaths)];
+  const uniqueTargetPaths = [...new Set(targetPaths)].filter((p) => !PSEUDO_FS_PREFIXES.some((pfx) => p.startsWith(pfx)));
   if (uniqueTargetPaths.length === 0) return null;
   const historyReadPaths = /* @__PURE__ */ new Set();
   for (const action of actionHistory) {
@@ -1470,7 +1968,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd, osType) {
     violatedLayers: ["L2.1"]
   };
 }
-var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
+var _LOGIC, _HEURISTIC, EXCLUDED_PREFIXES, TEMP_DIRS, ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, PSEUDO_FS_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW, _IFA, IFA_READ_KEYWORDS, IFA_WRITE_KEYWORDS, IFA_EXEC_KEYWORDS, IFA_OPEN_KEYWORDS;
 var init_logic_rules = __esm({
   "src/engine/logic-rules.ts"() {
     "use strict";
@@ -1517,6 +2015,7 @@ var init_logic_rules = __esm({
       "cat"
     ]);
     NON_WRITE_TOOL_PREFIXES = _LOGIC.non_write_tool_prefixes ?? [];
+    PSEUDO_FS_PREFIXES = ["/sys/", "/proc/", "/dev/", "/run/"];
     WRITE_KEYWORDS = ["write", "\u5199\u5165", "save", "\u4FDD\u5B58", "modify", "\u4FEE\u6539", "update", "\u66F4\u65B0", "delete", "\u5220\u9664", "remove", "\u79FB\u9664", "create", "\u521B\u5EFA", "append", "\u8FFD\u52A0", "truncate", "\u622A\u65AD", "overwrite", "\u8986\u76D6", "replace", "\u66FF\u6362", "edit"];
     SED_INPLACE_RE = /\bsed\s+(?:-\S+\s+)*(?:-[a-zA-Z]*i[a-zA-Z]*|--in-place)\b/i;
     DEVNULL_REDIRECT_RE = /(?:2|&|1)?\s*>\s*\/dev\/null\b/g;
@@ -1567,22 +2066,22 @@ var init_logic_rules = __esm({
 });
 
 // src/engine/asset-dir.ts
-import { existsSync as existsSync4 } from "fs";
-import { join as join4, resolve as resolve2 } from "path";
+import { existsSync as existsSync5 } from "fs";
+import { join as join5, resolve as resolve3 } from "path";
 function assetDirCandidates(moduleDir, name) {
   const root = getRulesRoot();
   if (root) {
-    const p = join4(root, name);
+    const p = join5(root, name);
     return [p, p];
   }
   return [
-    resolve2(moduleDir, name),
-    resolve2(moduleDir, "../../..", "agent_moss", name)
+    resolve3(moduleDir, name),
+    resolve3(moduleDir, "../../..", "agent_moss", name)
   ];
 }
 function resolveAssetDir(moduleDir, name) {
   for (const dir of assetDirCandidates(moduleDir, name)) {
-    if (existsSync4(dir)) return dir;
+    if (existsSync5(dir)) return dir;
   }
   return null;
 }
@@ -1595,8 +2094,8 @@ var init_asset_dir = __esm({
 });
 
 // src/engine/skill-loader.ts
-import { readFileSync as readFileSync4, readdirSync as readdirSync3, existsSync as existsSync5 } from "fs";
-import { resolve as resolve3, dirname as dirname2 } from "path";
+import { readFileSync as readFileSync5, readdirSync as readdirSync3, existsSync as existsSync6 } from "fs";
+import { resolve as resolve4, dirname as dirname3 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function loadAllSkills() {
   if (cachedSkills) return cachedSkills;
@@ -1610,13 +2109,13 @@ function loadAllSkills() {
   const files = readdirSync3(dir).filter((f) => f.endsWith(".md"));
   for (const f of files) {
     const name = f.replace(".md", "");
-    cachedSkills[name] = readFileSync4(resolve3(dir, f), "utf-8");
+    cachedSkills[name] = readFileSync5(resolve4(dir, f), "utf-8");
   }
   console.log(`[AgentMoss] Loaded ${Object.keys(cachedSkills).length} skills from ${dir}`);
   return cachedSkills;
 }
 function userSkillsDir() {
-  return resolve3(getDataRoot(), "agent_moss_skills");
+  return resolve4(getDataRoot(), "agent_moss_skills");
 }
 function runtimeCustomSkillKeywords() {
   if (isRuntimeConfigDisabled()) return {};
@@ -1640,8 +2139,8 @@ function loadUserSkill(name) {
   if (isRuntimeConfigDisabled()) return "";
   if (userSkillCache[name] !== void 0) return userSkillCache[name];
   try {
-    const p = resolve3(userSkillsDir(), `${name}.md`);
-    userSkillCache[name] = existsSync5(p) ? readFileSync4(p, "utf-8") : "";
+    const p = resolve4(userSkillsDir(), `${name}.md`);
+    userSkillCache[name] = existsSync6(p) ? readFileSync5(p, "utf-8") : "";
   } catch {
     userSkillCache[name] = "";
   }
@@ -1710,7 +2209,7 @@ var init_skill_loader = __esm({
     init_asset_dir();
     init_runtime_config_bridge();
     __filename3 = fileURLToPath3(import.meta.url);
-    __dirname3 = dirname2(__filename3);
+    __dirname3 = dirname3(__filename3);
     SKILL_KEYWORD_MAP = (() => {
       const map = {};
       const cats = loadL3();
@@ -1790,10 +2289,10 @@ __export(runtime_config_exports, {
   updateSkillCategoryEnabled: () => updateSkillCategoryEnabled,
   updateSkillEnabled: () => updateSkillEnabled
 });
-import { readFileSync as readFileSync5, writeFileSync, existsSync as existsSync6, mkdirSync, unlinkSync, readdirSync as readdirSync4, statSync as statSync2 } from "fs";
-import { join as join5 } from "path";
+import { readFileSync as readFileSync6, writeFileSync, existsSync as existsSync7, mkdirSync as mkdirSync2, unlinkSync, readdirSync as readdirSync4, statSync as statSync2 } from "fs";
+import { join as join6 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
-import { dirname as dirname3 } from "path";
+import { dirname as dirname4 } from "path";
 function runtimeDir() {
   return getRuntimeConfigDir();
 }
@@ -1820,7 +2319,7 @@ function saveRuntimeConfig(config) {
   }
   const p = getRuntimeConfigPath();
   const dir = p.substring(0, p.lastIndexOf("/"));
-  if (dir && !existsSync6(dir)) mkdirSync(dir, { recursive: true });
+  if (dir && !existsSync7(dir)) mkdirSync2(dir, { recursive: true });
   writeFileSync(p, JSON.stringify(config, null, 2), "utf-8");
   invalidateRuntimeConfigCache();
 }
@@ -1854,7 +2353,7 @@ function loadRuntimeConfig() {
     };
   }
   const p = getRuntimeConfigPath();
-  if (!existsSync6(p)) {
+  if (!existsSync7(p)) {
     const seeded = mergeConfig({}, generateSourceDefaults());
     try {
       saveRuntimeConfig(seeded);
@@ -1868,7 +2367,7 @@ function loadRuntimeConfig() {
     if (runtimeConfigCache && runtimeConfigCache.key === cacheKey) {
       return runtimeConfigCache.value;
     }
-    const data = JSON.parse(readFileSync5(p, "utf-8"));
+    const data = JSON.parse(readFileSync6(p, "utf-8"));
     const merged = mergeConfig(data, generateSourceDefaults());
     const result = {
       version: data.version || 1,
@@ -2016,7 +2515,7 @@ function hasRuntimeConfig() {
   if (cached2 !== void 0) return cached2;
   let ok = false;
   try {
-    JSON.parse(readFileSync5(p, "utf-8"));
+    JSON.parse(readFileSync6(p, "utf-8"));
     ok = true;
   } catch {
     ok = false;
@@ -2131,7 +2630,7 @@ function _l2SensitivePathsToRules() {
     const all = [...root, ...home, ...credential];
     for (const sp of all) {
       const os4 = String(sp.os || "linux").toLowerCase();
-      const denyMode = _deriveDenyMode({
+      const denyMode = sp.denyMode || _deriveDenyMode({
         deny_mode: sp.deny_mode,
         credential: sp.credential,
         read_only: sp.read_only
@@ -2237,8 +2736,8 @@ function _l3SkillsToRules() {
 function _scenarioRulesToDefaults() {
   const out = {};
   const _root = getRulesRoot();
-  const scenDir = _root ? join5(_root, "scenarios") : existsSync6(_SCENARIOS_DIR_PROD) ? _SCENARIOS_DIR_PROD : existsSync6(_SCENARIOS_DIR_DEV) ? _SCENARIOS_DIR_DEV : _SCENARIOS_DIR_PROD;
-  if (!existsSync6(scenDir)) return out;
+  const scenDir = _root ? join6(_root, "scenarios") : existsSync7(_SCENARIOS_DIR_PROD) ? _SCENARIOS_DIR_PROD : existsSync7(_SCENARIOS_DIR_DEV) ? _SCENARIOS_DIR_DEV : _SCENARIOS_DIR_PROD;
+  if (!existsSync7(scenDir)) return out;
   let entries;
   try {
     entries = readdirSync4(scenDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
@@ -2246,11 +2745,11 @@ function _scenarioRulesToDefaults() {
     return out;
   }
   for (const scenarioId of entries) {
-    const rulesFile = resolveScenarioRulesFile(scenarioId) ?? join5(scenDir, scenarioId, "rules.json");
-    if (!existsSync6(rulesFile)) continue;
+    const rulesFile = resolveScenarioRulesFile(scenarioId) ?? join6(scenDir, scenarioId, "rules.json");
+    if (!existsSync7(rulesFile)) continue;
     let data;
     try {
-      data = JSON.parse(readFileSync5(rulesFile, "utf-8"));
+      data = JSON.parse(readFileSync6(rulesFile, "utf-8"));
     } catch {
       continue;
     }
@@ -2287,8 +2786,8 @@ function _scenarioRulesToDefaults() {
 function _agentRulesToDefaults() {
   const out = {};
   const _root = getRulesRoot();
-  const agentsDir = _root ? join5(_root, "agents") : existsSync6(_AGENTS_DIR_PROD) ? _AGENTS_DIR_PROD : existsSync6(_AGENTS_DIR_DEV) ? _AGENTS_DIR_DEV : _AGENTS_DIR_PROD;
-  if (!existsSync6(agentsDir)) return out;
+  const agentsDir = _root ? join6(_root, "agents") : existsSync7(_AGENTS_DIR_PROD) ? _AGENTS_DIR_PROD : existsSync7(_AGENTS_DIR_DEV) ? _AGENTS_DIR_DEV : _AGENTS_DIR_PROD;
+  if (!existsSync7(agentsDir)) return out;
   let entries;
   try {
     entries = readdirSync4(agentsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
@@ -2296,11 +2795,11 @@ function _agentRulesToDefaults() {
     return out;
   }
   for (const agentId of entries) {
-    const rulesFile = join5(agentsDir, agentId, "rules.json");
-    if (!existsSync6(rulesFile)) continue;
+    const rulesFile = join6(agentsDir, agentId, "rules.json");
+    if (!existsSync7(rulesFile)) continue;
     let data;
     try {
-      data = JSON.parse(readFileSync5(rulesFile, "utf-8"));
+      data = JSON.parse(readFileSync6(rulesFile, "utf-8"));
     } catch {
       continue;
     }
@@ -2908,12 +3407,12 @@ function addCustomSkill(skillId, category, keywords, content) {
     );
   }
   const runtime = loadRuntimeConfig();
-  const skillsDir = join5(getRuntimeConfigDir(), "agent_moss_skills");
+  const skillsDir = join6(getRuntimeConfigDir(), "agent_moss_skills");
   try {
-    mkdirSync(skillsDir, { recursive: true });
+    mkdirSync2(skillsDir, { recursive: true });
   } catch {
   }
-  writeFileSync(join5(skillsDir, `${skillId}.md`), content, "utf-8");
+  writeFileSync(join6(skillsDir, `${skillId}.md`), content, "utf-8");
   const l3 = runtime.L3_skills || (runtime.L3_skills = {});
   const cat = l3[category] || (l3[category] = { category_enabled: true, category_desc: "", skills: [] });
   (cat.skills || (cat.skills = [])).push({ id: skillId, keywords, enabled: true, builtin: false });
@@ -2928,9 +3427,9 @@ function deleteCustomSkill(skillId, category) {
   if (idx >= 0) {
     if (skills[idx].builtin) return null;
     skills.splice(idx, 1);
-    const skillPath = join5(getRuntimeConfigDir(), "agent_moss_skills", `${skillId}.md`);
+    const skillPath = join6(getRuntimeConfigDir(), "agent_moss_skills", `${skillId}.md`);
     try {
-      if (existsSync6(skillPath)) unlinkSync(skillPath);
+      if (existsSync7(skillPath)) unlinkSync(skillPath);
     } catch {
     }
     saveRuntimeConfig(runtime);
@@ -3134,10 +3633,10 @@ var init_runtime_config = __esm({
     init_rules_loader();
     init_runtime_config_bridge();
     init_rules_mode();
-    __dirname4 = dirname3(fileURLToPath4(import.meta.url));
+    __dirname4 = dirname4(fileURLToPath4(import.meta.url));
     ENV_RUNTIME_CONFIG_PATH = "AGENT_MOSS_RUNTIME_CONFIG_PATH";
     RUNTIME_CONFIG_DIR = runtimeDir();
-    RUNTIME_CONFIG_PATH = join5(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
+    RUNTIME_CONFIG_PATH = join6(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
     LAYER_DISABLE_ENV = {
       L1_heuristic: "AGENT_MOSS_DISABLE_HEURISTIC",
       L2_logic_rules: "AGENT_MOSS_DISABLE_LOGIC_RULES",
@@ -3165,10 +3664,10 @@ var init_runtime_config = __esm({
       intent_consistency: ["intent_keywords", "reason"]
     };
     hasRuntimeConfigCache = /* @__PURE__ */ new Map();
-    _AGENTS_DIR_PROD = join5(__dirname4, "agents");
-    _AGENTS_DIR_DEV = join5(__dirname4, "..", "..", "..", "agent_moss", "agents");
-    _SCENARIOS_DIR_PROD = join5(__dirname4, "scenarios");
-    _SCENARIOS_DIR_DEV = join5(__dirname4, "..", "..", "..", "agent_moss", "scenarios");
+    _AGENTS_DIR_PROD = join6(__dirname4, "agents");
+    _AGENTS_DIR_DEV = join6(__dirname4, "..", "..", "..", "agent_moss", "agents");
+    _SCENARIOS_DIR_PROD = join6(__dirname4, "scenarios");
+    _SCENARIOS_DIR_DEV = join6(__dirname4, "..", "..", "..", "agent_moss", "scenarios");
     _effectiveCache = /* @__PURE__ */ new WeakMap();
     SKILL_ID_RE = /^[A-Za-z0-9_-]+$/;
     registerRuntimeConfigBridge({
@@ -3506,18 +4005,23 @@ var init_config = __esm({
 });
 
 // src/agents/index.ts
-import { readFileSync as readFileSync6, existsSync as existsSync7 } from "fs";
-import { resolve as resolve4, dirname as dirname4, join as join6 } from "path";
+import { readFileSync as readFileSync7, existsSync as existsSync8 } from "fs";
+import { resolve as resolve5, dirname as dirname5, join as join7 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 function resolveAgentsDir() {
   const root = getRulesRoot();
-  if (root) return join6(root, "agents");
-  if (existsSync7(AGENTS_DIR_PROD)) return AGENTS_DIR_PROD;
-  if (existsSync7(AGENTS_DIR_DEV_FALLBACK)) return AGENTS_DIR_DEV_FALLBACK;
+  if (root) return join7(root, "agents");
+  if (existsSync8(AGENTS_DIR_PROD)) return AGENTS_DIR_PROD;
+  if (existsSync8(AGENTS_DIR_DEV_FALLBACK)) return AGENTS_DIR_DEV_FALLBACK;
   return AGENTS_DIR_PROD;
 }
 function getAgentExtensions(agentId) {
   if (!agentId) return null;
+  if (!isSafeId(agentId)) {
+    console.warn(`[AgentMoss agents] \u975E\u6CD5 agent_id \u5DF2\u5FFD\u7565\uFF08\u542B\u8DEF\u5F84\u5B57\u7B26\u6216\u8D85\u957F\uFF09: ${agentId.slice(0, 120)}`);
+    return null;
+  }
+  if (cache.size >= CACHE_MAX) cache.clear();
   const fp = getRuleSourceFingerprint();
   const cached2 = cache.get(agentId);
   if (cached2 && cached2.fp === fp) return cached2.ext;
@@ -3530,13 +4034,13 @@ function getAgentExtensions(agentId) {
   }
   if (ext === null) {
     const agentsDir = resolveAgentsDir();
-    const rulesFile = resolve4(agentsDir, agentId, "rules.json");
-    if (!existsSync7(rulesFile)) {
+    const rulesFile = resolve5(agentsDir, agentId, "rules.json");
+    if (!existsSync8(rulesFile)) {
       cache.set(agentId, { fp, ext: null });
       return null;
     }
     try {
-      const raw = readFileSync6(rulesFile, "utf-8");
+      const raw = readFileSync7(rulesFile, "utf-8");
       ext = JSON.parse(raw);
       if (!ext.agent_id) {
         console.warn(`[AgentMoss agents] rules.json \u7F3A\u5C11 agent_id \u5B57\u6BB5: ${rulesFile}`);
@@ -3570,7 +4074,7 @@ function mergeAgentExtensions(...exts) {
     extra_skills: nonNull.flatMap((e) => e.extra_skills || [])
   };
 }
-var __filename4, __dirname5, AGENTS_DIR_PROD, AGENTS_DIR_DEV_FALLBACK, cache;
+var __filename4, __dirname5, AGENTS_DIR_PROD, AGENTS_DIR_DEV_FALLBACK, cache, CACHE_MAX;
 var init_agents = __esm({
   "src/agents/index.ts"() {
     "use strict";
@@ -3578,26 +4082,32 @@ var init_agents = __esm({
     init_paths();
     init_runtime_config();
     __filename4 = fileURLToPath6(import.meta.url);
-    __dirname5 = dirname4(__filename4);
-    AGENTS_DIR_PROD = resolve4(__dirname5, "agents");
-    AGENTS_DIR_DEV_FALLBACK = resolve4(__dirname5, "../../../agent_moss/agents");
+    __dirname5 = dirname5(__filename4);
+    AGENTS_DIR_PROD = resolve5(__dirname5, "agents");
+    AGENTS_DIR_DEV_FALLBACK = resolve5(__dirname5, "../../../agent_moss/agents");
     cache = /* @__PURE__ */ new Map();
+    CACHE_MAX = 512;
   }
 });
 
 // src/scenarios/index.ts
-import { readFileSync as readFileSync7, existsSync as existsSync8 } from "fs";
-import { resolve as resolve5, dirname as dirname5, join as join7 } from "path";
+import { readFileSync as readFileSync8, existsSync as existsSync9 } from "fs";
+import { resolve as resolve6, dirname as dirname6, join as join8 } from "path";
 import { fileURLToPath as fileURLToPath7 } from "url";
 function resolveScenariosDir() {
   const root = getRulesRoot();
-  if (root) return join7(root, "scenarios");
-  if (existsSync8(SCENARIOS_DIR_PROD)) return SCENARIOS_DIR_PROD;
-  if (existsSync8(SCENARIOS_DIR_DEV_FALLBACK)) return SCENARIOS_DIR_DEV_FALLBACK;
+  if (root) return join8(root, "scenarios");
+  if (existsSync9(SCENARIOS_DIR_PROD)) return SCENARIOS_DIR_PROD;
+  if (existsSync9(SCENARIOS_DIR_DEV_FALLBACK)) return SCENARIOS_DIR_DEV_FALLBACK;
   return SCENARIOS_DIR_PROD;
 }
 function getScenarioExtensions(scenarioId) {
   if (!scenarioId) return null;
+  if (!isSafeId(scenarioId)) {
+    console.warn(`[AgentMoss scenarios] \u975E\u6CD5 scenario_id \u5DF2\u5FFD\u7565\uFF08\u542B\u8DEF\u5F84\u5B57\u7B26\u6216\u8D85\u957F\uFF09: ${scenarioId.slice(0, 120)}`);
+    return null;
+  }
+  if (cache2.size >= CACHE_MAX2) cache2.clear();
   const fp = getRuleSourceFingerprint();
   const cached2 = cache2.get(scenarioId);
   if (cached2 && cached2.fp === fp) return cached2.ext;
@@ -3616,19 +4126,19 @@ function getScenarioExtensions(scenarioId) {
     }
   }
   if (ext === null) {
-    const builtinFile = resolve5(resolveScenariosDir(), scenarioId, "rules.json");
+    const builtinFile = resolve6(resolveScenariosDir(), scenarioId, "rules.json");
     const rulesFile = overrideHit ?? builtinFile;
     if (overrideHit) {
       console.warn(
         `[AgentMoss] \u26A0\uFE0F  \u573A\u666F ${scenarioId} \u89C4\u5219\u88AB\u8986\u76D6\u76EE\u5F55\u8986\u76D6: ${overrideHit}\uFF08\u5185\u7F6E\u9ED8\u8BA4 ${builtinFile} \u88AB\u5FFD\u7565\uFF09\u3002\u8BE5\u6587\u4EF6\u7531\u90E8\u7F72\u4FA7\u81EA\u884C\u7EF4\u62A4\uFF0C\u5185\u7F6E\u573A\u666F\u89C4\u5219\u66F4\u65B0\u4E0D\u4F1A\u53CD\u6620\u5230\u5B83\u4E0A\u9762\u3002`
       );
     }
-    if (!existsSync8(rulesFile)) {
+    if (!existsSync9(rulesFile)) {
       cache2.set(scenarioId, { fp, ext: null });
       return null;
     }
     try {
-      const raw = readFileSync7(rulesFile, "utf-8");
+      const raw = readFileSync8(rulesFile, "utf-8");
       const data = JSON.parse(raw);
       const id = data.scenario_id || data.agent_id || "";
       if (!id) {
@@ -3667,7 +4177,7 @@ function getScenarioExtensionsMulti(scenarioSpec) {
   if (nonNull.length === 0) return null;
   return mergeAgentExtensions(...nonNull);
 }
-var __filename5, __dirname6, SCENARIOS_DIR_PROD, SCENARIOS_DIR_DEV_FALLBACK, cache2;
+var __filename5, __dirname6, SCENARIOS_DIR_PROD, SCENARIOS_DIR_DEV_FALLBACK, cache2, CACHE_MAX2;
 var init_scenarios = __esm({
   "src/scenarios/index.ts"() {
     "use strict";
@@ -3677,10 +4187,11 @@ var init_scenarios = __esm({
     init_runtime_config();
     init_rules_loader();
     __filename5 = fileURLToPath7(import.meta.url);
-    __dirname6 = dirname5(__filename5);
-    SCENARIOS_DIR_PROD = resolve5(__dirname6, "scenarios");
-    SCENARIOS_DIR_DEV_FALLBACK = resolve5(__dirname6, "../../../agent_moss/scenarios");
+    __dirname6 = dirname6(__filename5);
+    SCENARIOS_DIR_PROD = resolve6(__dirname6, "scenarios");
+    SCENARIOS_DIR_DEV_FALLBACK = resolve6(__dirname6, "../../../agent_moss/scenarios");
     cache2 = /* @__PURE__ */ new Map();
+    CACHE_MAX2 = 512;
   }
 });
 
@@ -4560,8 +5071,8 @@ var init_heuristic = __esm({
 });
 
 // src/engine/template-loader.ts
-import { readFileSync as readFileSync8, existsSync as existsSync9 } from "fs";
-import { resolve as resolve6, dirname as dirname6 } from "path";
+import { readFileSync as readFileSync9, existsSync as existsSync10 } from "fs";
+import { resolve as resolve7, dirname as dirname7 } from "path";
 import { fileURLToPath as fileURLToPath8 } from "url";
 function loadTemplates() {
   if (cachedTemplates) return cachedTemplates;
@@ -4573,10 +5084,10 @@ function loadTemplates() {
     return cachedTemplates;
   }
   for (const file of TEMPLATE_FILES) {
-    const filePath = resolve6(dir, file);
-    if (existsSync9(filePath)) {
+    const filePath = resolve7(dir, file);
+    if (existsSync10(filePath)) {
       const key = file.replace(".txt", "").replace("_template", "");
-      cachedTemplates[key] = readFileSync8(filePath, "utf-8");
+      cachedTemplates[key] = readFileSync9(filePath, "utf-8");
     }
   }
   console.log(`[AgentMoss] Loaded ${Object.keys(cachedTemplates).length} templates from ${dir}`);
@@ -4589,15 +5100,15 @@ var init_template_loader = __esm({
     init_esm_shims();
     init_asset_dir();
     __filename6 = fileURLToPath8(import.meta.url);
-    __dirname7 = dirname6(__filename6);
+    __dirname7 = dirname7(__filename6);
     TEMPLATE_FILES = ["prompt1_template.txt", "prompt2_template.txt", "security_judge_template.txt"];
     cachedTemplates = null;
   }
 });
 
 // src/engine/script-analyzer.ts
-import { readFileSync as readFileSync9 } from "fs";
-import { resolve as resolve7, join as join8 } from "path";
+import { readFileSync as readFileSync10 } from "fs";
+import { resolve as resolve8, join as join9 } from "path";
 function emptyResult() {
   return { scriptPath: "", scriptContent: "", matchedKeywords: [], lineCount: 0, isSuspicious: false, error: "", riskLevel: "", riskReason: "" };
 }
@@ -4650,8 +5161,8 @@ function assessKeywordCombinationRisk(matchedKeywords, scriptContent) {
 }
 function readScriptContent(scriptPath, maxLines = 500) {
   try {
-    const expandedPath = scriptPath === "~" || scriptPath.startsWith("~/") ? join8(process.env.HOME || "/home/user", scriptPath.slice(1)) : resolve7(scriptPath);
-    const raw = readFileSync9(expandedPath, "utf-8");
+    const expandedPath = scriptPath === "~" || scriptPath.startsWith("~/") ? join9(process.env.HOME || "/home/user", scriptPath.slice(1)) : resolve8(scriptPath);
+    const raw = readFileSync10(expandedPath, "utf-8");
     const lines = raw.split("\n").slice(0, maxLines);
     return { content: lines.join("\n"), lineCount: lines.length, error: "" };
   } catch (e) {
@@ -4779,14 +5290,14 @@ function isSysArgv(node) {
   const prop = node.getChild("PropertyName");
   return prop !== null && srcSlice(prop) === "argv";
 }
-function evalExpr(node, env) {
+function evalExpr(node, env2) {
   if (!node) return null;
   const name = node.name;
   if (name === "String") return stringValue(srcSlice(node));
   if (name === "Number") return srcSlice(node);
   if (name === "VariableName") {
     const id = srcSlice(node);
-    return id in env.vars ? env.vars[id] : null;
+    return id in env2.vars ? env2.vars[id] : null;
   }
   if (name === "MemberExpression") {
     const bracket = node.getChild("[");
@@ -4796,13 +5307,13 @@ function evalExpr(node, env) {
         const idxNode = bracket.nextSibling;
         if (idxNode && idxNode.name === "Number") {
           const idx = parseInt(srcSlice(idxNode), 10);
-          if (idx >= 1 && idx <= env.argv.length) return env.argv[idx - 1];
+          if (idx >= 1 && idx <= env2.argv.length) return env2.argv[idx - 1];
           return null;
         }
       }
       return null;
     }
-    if (isSysArgv(node)) return env.argv[0] ?? null;
+    if (isSysArgv(node)) return env2.argv[0] ?? null;
     return null;
   }
   if (name === "CallExpression") {
@@ -4810,7 +5321,7 @@ function evalExpr(node, env) {
     if (func && func.name === "VariableName" && srcSlice(func) === "len") {
       const argList = node.getChild("ArgList");
       const inner = argList ? firstNamedChild(argList) : null;
-      if (inner && isSysArgv(inner)) return String(env.argv.length + 1);
+      if (inner && isSysArgv(inner)) return String(env2.argv.length + 1);
     }
     return null;
   }
@@ -4822,16 +5333,16 @@ function evalExpr(node, env) {
     const condNode = ifKw.nextSibling;
     const orelseNode = elseKw.nextSibling;
     if (!thenNode || !condNode || !orelseNode) return null;
-    const cond = evalCondition(condNode, env);
-    if (cond === true) return evalExpr(thenNode, env);
-    if (cond === false) return evalExpr(orelseNode, env);
+    const cond = evalCondition(condNode, env2);
+    if (cond === true) return evalExpr(thenNode, env2);
+    if (cond === false) return evalExpr(orelseNode, env2);
     return null;
   }
   if (name === "BinaryExpression") {
     const op = findOp(node);
     if (op === "+") {
-      const left = evalExpr(node.firstChild, env);
-      const right = evalExpr(lastNamedChild(node), env);
+      const left = evalExpr(node.firstChild, env2);
+      const right = evalExpr(lastNamedChild(node), env2);
       if (left !== null && right !== null) return left + right;
     }
     return null;
@@ -4864,7 +5375,7 @@ function findOp(node) {
   }
   return null;
 }
-function evalCondition(node, env) {
+function evalCondition(node, env2) {
   if (!node) return null;
   const name = node.name;
   if (name === "Boolean") {
@@ -4875,7 +5386,7 @@ function evalCondition(node, env) {
     const op = findOp(node);
     if (op === "and" || op === "or") {
       const parts2 = namedChildren(node);
-      const vals = parts2.map((p) => evalCondition(p, env));
+      const vals = parts2.map((p) => evalCondition(p, env2));
       if (op === "and") {
         if (vals.some((v) => v === false)) return false;
         if (vals.every((v) => v === true)) return true;
@@ -4889,13 +5400,13 @@ function evalCondition(node, env) {
     if (parts.length !== 3) return null;
     const [left, opNode, right] = parts;
     const opText = srcSlice(opNode).trim();
-    return evalCompare(left, opText, right, env);
+    return evalCompare(left, opText, right, env2);
   }
   if (name === "UnaryExpression") {
     const kw = node.getChild("not");
     if (kw) {
       const operand = kw.nextSibling;
-      const v = evalCondition(operand, env);
+      const v = evalCondition(operand, env2);
       return v === null ? null : !v;
     }
     return null;
@@ -4916,39 +5427,39 @@ function namedChildren(node) {
   }
   return out;
 }
-function evalCompare(left, opText, right, env) {
+function evalCompare(left, opText, right, env2) {
   if (opText === "==" && left.name === "VariableName" && srcSlice(left) === "__name__") {
-    const rv = evalExpr(right, env);
+    const rv = evalExpr(right, env2);
     if (rv !== null) return rv === "__main__";
     return null;
   }
   if (opText === "==" || opText === "!=") {
-    const lv = evalExpr(left, env);
-    const rv = evalExpr(right, env);
+    const lv = evalExpr(left, env2);
+    const rv = evalExpr(right, env2);
     if (lv !== null && rv !== null) {
       return opText === "==" ? lv === rv : lv !== rv;
     }
     return null;
   }
   if (opText === "in") {
-    const lv = evalExpr(left, env);
+    const lv = evalExpr(left, env2);
     if (lv === null) return null;
     const rightName = right.name;
     if (rightName === "TupleExpression" || rightName === "ArrayExpression" || rightName === "SetExpression" || rightName === "ParenthesizedExpression") {
       const container = rightName === "ParenthesizedExpression" && right.firstChild && right.firstChild.name === "TupleExpression" ? right.firstChild : right;
       for (const elt of namedChildren(container)) {
-        const ev = evalExpr(elt, env);
+        const ev = evalExpr(elt, env2);
         if (ev !== null && ev === lv) return true;
       }
       return false;
     }
-    const rv = evalExpr(right, env);
+    const rv = evalExpr(right, env2);
     if (rv !== null) return rv.includes(lv);
     return null;
   }
   if (opText === ">" || opText === ">=" || opText === "<" || opText === "<=") {
-    const lv = evalExpr(left, env);
-    const rv = evalExpr(right, env);
+    const lv = evalExpr(left, env2);
+    const rv = evalExpr(right, env2);
     if (lv === null || rv === null) return null;
     const ln = parseInt(lv, 10);
     const rn = parseInt(rv, 10);
@@ -4960,71 +5471,71 @@ function evalCompare(left, opText, right, env) {
   }
   return null;
 }
-function processStmts(stmts, env, lineStarts, lines, branches) {
-  for (const s of stmts) processStmt(s, env, lineStarts, lines, branches);
+function processStmts(stmts, env2, lineStarts, lines, branches) {
+  for (const s of stmts) processStmt(s, env2, lineStarts, lines, branches);
 }
-function invalidateEnvOnCalls(node, env) {
+function invalidateEnvOnCalls(node, env2) {
   const cursor = node.cursor();
   cursor.iterate((n) => {
     const nd = n.node;
     if (nd.name !== "CallExpression") return true;
     const func = nd.firstChild;
     if (func && func.name === "VariableName" && !PURE_BUILTINS.has(srcSlice(func))) {
-      for (const k of Object.keys(env.vars)) env.vars[k] = null;
+      for (const k of Object.keys(env2.vars)) env2.vars[k] = null;
       return false;
     }
     return true;
   });
 }
-function processStmt(stmt, env, lineStarts, lines, branches) {
+function processStmt(stmt, env2, lineStarts, lines, branches) {
   const name = stmt.name;
   if (name === "AssignStatement") {
     const target = stmt.firstChild;
     if (target && target.name === "VariableName") {
       const valNode = target.nextSibling ? target.nextSibling.nextSibling : null;
-      invalidateEnvOnCalls(stmt, env);
-      const val = evalExpr(valNode, env);
-      env.vars[srcSlice(target)] = val;
+      invalidateEnvOnCalls(stmt, env2);
+      const val = evalExpr(valNode, env2);
+      env2.vars[srcSlice(target)] = val;
     }
     markNodeLines(stmt, lines, lineStarts);
     return;
   }
   if (name === "UpdateStatement") {
     const target = stmt.firstChild;
-    if (target && target.name === "VariableName") env.vars[srcSlice(target)] = null;
-    invalidateEnvOnCalls(stmt, env);
+    if (target && target.name === "VariableName") env2.vars[srcSlice(target)] = null;
+    invalidateEnvOnCalls(stmt, env2);
     markNodeLines(stmt, lines, lineStarts);
     return;
   }
   if (name === "IfStatement") {
-    processIf(stmt, env, lineStarts, lines, branches);
+    processIf(stmt, env2, lineStarts, lines, branches);
     return;
   }
   if (name === "ForStatement" || name === "WhileStatement") {
     markNodeLines(stmt, lines, lineStarts);
     for (const body of stmt.getChildren("Body")) {
-      processStmts(bodyStmts(body), { argv: env.argv, vars: { ...env.vars } }, lineStarts, lines, branches);
+      processStmts(bodyStmts(body), { argv: env2.argv, vars: { ...env2.vars } }, lineStarts, lines, branches);
     }
     return;
   }
   if (name === "TryStatement") {
     markNodeLines(stmt, lines, lineStarts);
     for (const body of stmt.getChildren("Body")) {
-      processStmts(bodyStmts(body), { argv: env.argv, vars: { ...env.vars } }, lineStarts, lines, branches);
+      processStmts(bodyStmts(body), { argv: env2.argv, vars: { ...env2.vars } }, lineStarts, lines, branches);
     }
     return;
   }
   if (name === "WithStatement") {
     markNodeLines(stmt, lines, lineStarts);
     const body = stmt.getChild("Body");
-    if (body) processStmts(bodyStmts(body), { argv: env.argv, vars: { ...env.vars } }, lineStarts, lines, branches);
+    if (body) processStmts(bodyStmts(body), { argv: env2.argv, vars: { ...env2.vars } }, lineStarts, lines, branches);
     return;
   }
   if (name === "MatchStatement") {
     markNodeLines(stmt, lines, lineStarts);
     for (const clause of stmt.getChildren("MatchClause")) {
       const body = clause.getChild("Body");
-      if (body) processStmts(bodyStmts(body), { argv: env.argv, vars: { ...env.vars } }, lineStarts, lines, branches);
+      if (body) processStmts(bodyStmts(body), { argv: env2.argv, vars: { ...env2.vars } }, lineStarts, lines, branches);
     }
     return;
   }
@@ -5033,7 +5544,7 @@ function processStmt(stmt, env, lineStarts, lines, branches) {
     return;
   }
   if (name === "ExpressionStatement") {
-    invalidateEnvOnCalls(stmt, env);
+    invalidateEnvOnCalls(stmt, env2);
   }
   markNodeLines(stmt, lines, lineStarts);
 }
@@ -5053,7 +5564,7 @@ function bodyStmts(body) {
   }
   return out;
 }
-function processIf(stmt, env, lineStarts, lines, branches) {
+function processIf(stmt, env2, lineStarts, lines, branches) {
   const sections = [];
   let c = stmt.firstChild;
   while (c) {
@@ -5068,17 +5579,17 @@ function processIf(stmt, env, lineStarts, lines, branches) {
     }
     c = c.nextSibling;
   }
-  processIfSections(stmt, sections, 0, env, lineStarts, lines, branches);
+  processIfSections(stmt, sections, 0, env2, lineStarts, lines, branches);
 }
-function processIfSections(_stmt, sections, idx, env, lineStarts, lines, branches) {
+function processIfSections(_stmt, sections, idx, env2, lineStarts, lines, branches) {
   if (idx >= sections.length) return;
   const s = sections[idx];
   if (s.cond) markNodeLines(s.cond, lines, lineStarts);
   if (s.isElse) {
-    if (s.body) processStmts(bodyStmts(s.body), env, lineStarts, lines, branches);
+    if (s.body) processStmts(bodyStmts(s.body), env2, lineStarts, lines, branches);
     return;
   }
-  const cond = s.cond ? evalCondition(s.cond, env) : null;
+  const cond = s.cond ? evalCondition(s.cond, env2) : null;
   branches.push({
     kind: "if",
     label: s.cond ? srcSlice(s.cond) : "",
@@ -5086,18 +5597,18 @@ function processIfSections(_stmt, sections, idx, env, lineStarts, lines, branche
     reachable: cond !== false
   });
   if (cond === true) {
-    if (s.body) processStmts(bodyStmts(s.body), env, lineStarts, lines, branches);
+    if (s.body) processStmts(bodyStmts(s.body), env2, lineStarts, lines, branches);
     return;
   }
   if (cond === false) {
-    processIfSections(_stmt, sections, idx + 1, env, lineStarts, lines, branches);
+    processIfSections(_stmt, sections, idx + 1, env2, lineStarts, lines, branches);
     return;
   }
-  if (s.body) processStmts(bodyStmts(s.body), env, lineStarts, lines, branches);
+  if (s.body) processStmts(bodyStmts(s.body), env2, lineStarts, lines, branches);
   for (let j = idx + 1; j < sections.length; j++) {
     const sj = sections[j];
     if (sj.cond) markNodeLines(sj.cond, lines, lineStarts);
-    if (sj.body) processStmts(bodyStmts(sj.body), env, lineStarts, lines, branches);
+    if (sj.body) processStmts(bodyStmts(sj.body), env2, lineStarts, lines, branches);
   }
 }
 function parseShellString(s) {
@@ -5273,7 +5784,7 @@ var init_python_backend = __esm({
         SOURCE = c;
         const sourceLines = c.split("\n");
         const lineStarts = buildLineStarts(c);
-        const env = makeEnv(entryArgs || []);
+        const env2 = makeEnv(entryArgs || []);
         const lines = /* @__PURE__ */ new Set();
         const branches = [];
         if (sourceLines.length > MAX_LINES) {
@@ -5300,7 +5811,7 @@ var init_python_backend = __esm({
           };
         }
         const stmts = bodyStmts(tree);
-        processStmts(stmts, env, lineStarts, lines, branches);
+        processStmts(stmts, env2, lineStarts, lines, branches);
         const reachable = reconstruct(sourceLines, lines);
         let calls = extractCallsFromTree(tree, lines);
         if (calls.length === 0) calls = extractCallsRegex(c);
@@ -5528,7 +6039,7 @@ function tokenize(content) {
   }
   return stmts;
 }
-function evalExpr2(text, env) {
+function evalExpr2(text, env2) {
   const isSingleQuoted = text.length >= 2 && text[0] === "'" && text[text.length - 1] === "'";
   if (text.length >= 2 && (text[0] === '"' || text[0] === "'") && text[text.length - 1] === text[0]) {
     text = text.slice(1, -1);
@@ -5544,19 +6055,19 @@ function evalExpr2(text, env) {
       const dm = inner.match(/^([A-Za-z_][A-Za-z0-9_]*|\d+):?-(.*)$/s);
       if (dm) {
         const key = /^\d+$/.test(dm[1]) ? `$${dm[1]}` : dm[1];
-        const bound = env.get(key);
+        const bound = env2.get(key);
         if (bound && !(bound.kind === "concrete" && !bound.value)) {
           result.push(bound);
         } else {
-          result.push(evalExpr2(dm[2], env));
+          result.push(evalExpr2(dm[2], env2));
         }
         continue;
       }
       if (/^\d+$/.test(inner)) {
-        const v = env.get(`$${inner}`);
+        const v = env2.get(`$${inner}`);
         result.push(v || svalSym(`$${inner}`));
       } else {
-        const v = env.get(inner);
+        const v = env2.get(inner);
         result.push(v || svalSym(inner));
       }
       continue;
@@ -5565,7 +6076,7 @@ function evalExpr2(text, env) {
     if (bare) {
       const varName = bare[1];
       const key = /^\d+$/.test(varName) ? `$${varName}` : varName;
-      const v = env.get(key);
+      const v = env2.get(key);
       result.push(v || svalSym(p));
       continue;
     }
@@ -5575,13 +6086,13 @@ function evalExpr2(text, env) {
   return fold(svalExpr(result));
 }
 function initEnv(entryArgs) {
-  const env = /* @__PURE__ */ new Map();
+  const env2 = /* @__PURE__ */ new Map();
   if (entryArgs && entryArgs.length) {
-    entryArgs.forEach((a, idx) => env.set(`$${idx + 1}`, svalConc(a)));
-    env.set("$@", svalConc(entryArgs.join(" ")));
-    env.set("$*", svalConc(entryArgs.join(" ")));
+    entryArgs.forEach((a, idx) => env2.set(`$${idx + 1}`, svalConc(a)));
+    env2.set("$@", svalConc(entryArgs.join(" ")));
+    env2.set("$*", svalConc(entryArgs.join(" ")));
   }
-  return env;
+  return env2;
 }
 function globToRegex(pattern) {
   let out = "^";
@@ -5639,12 +6150,12 @@ function evalNumericCompare(op, left, right) {
       return null;
   }
 }
-function resolveVarSide(tok, env) {
+function resolveVarSide(tok, env2) {
   if (!tok.startsWith("$")) return tok;
-  const ev = evalExpr2(tok, env);
+  const ev = evalExpr2(tok, env2);
   return ev.kind === "concrete" ? ev.value : null;
 }
-function evalCondition2(cond, env) {
+function evalCondition2(cond, env2) {
   let inner = cond.trim().replace(/^\[\[?|\]\]?$/g, "").trim();
   if (/^-[A-Za-z]\s/.test(inner) || inner.startsWith("-d") || inner.startsWith("-f")) return null;
   const innerQ = inner.replace(/"/g, "").replace(/'/g, "");
@@ -5654,8 +6165,8 @@ function evalCondition2(cond, env) {
     if (!opm) continue;
     const left2 = innerQ.slice(0, opm.index).trim();
     const right2 = innerQ.slice(opm.index + opm[0].length).trim();
-    const lv2 = resolveVarSide(left2, env);
-    const rv2 = resolveVarSide(right2, env);
+    const lv2 = resolveVarSide(left2, env2);
+    const rv2 = resolveVarSide(right2, env2);
     if (lv2 === null || rv2 === null) return null;
     return evalNumericCompare(op2, lv2, rv2);
   }
@@ -5666,7 +6177,7 @@ function evalCondition2(cond, env) {
   let right = sm[3].trim();
   if (op === "=~") {
     if (right.startsWith("/") && right.endsWith("/")) right = right.slice(1, -1);
-    const lv2 = resolveVarSide(left, env);
+    const lv2 = resolveVarSide(left, env2);
     if (lv2 === null) return null;
     try {
       return new RegExp(right).test(lv2);
@@ -5674,8 +6185,8 @@ function evalCondition2(cond, env) {
       return null;
     }
   }
-  const lv = resolveVarSide(left, env);
-  const rv = resolveVarSide(right, env);
+  const lv = resolveVarSide(left, env2);
+  const rv = resolveVarSide(right, env2);
   if (lv === null || rv === null) return null;
   if (op === "!=") return lv !== rv;
   return lv === rv;
@@ -5685,7 +6196,7 @@ function symbolicProcess(content, entryArgs) {
   const stmts = tokenize(content);
   if (!stmts.some((s) => s.kind === "case" || s.kind === "if" || s.kind === "assign")) return null;
   if (stmts.some((s) => !s.modelable)) return null;
-  const env = initEnv(entryArgs);
+  const env2 = initEnv(entryArgs);
   let linesBudget = 0;
   let branchesBudget = 0;
   let modelable = false;
@@ -5695,9 +6206,9 @@ function symbolicProcess(content, entryArgs) {
     if (linesBudget > MAX_LINES2) return null;
     if (s.kind === "assign") {
       modelable = true;
-      if (env.size >= MAX_VARS) return null;
-      const v = evalExpr2(s.rhs, env);
-      env.set(s.name, fold(v));
+      if (env2.size >= MAX_VARS) return null;
+      const v = evalExpr2(s.rhs, env2);
+      env2.set(s.name, fold(v));
       out.push(s.line);
       continue;
     }
@@ -5705,7 +6216,7 @@ function symbolicProcess(content, entryArgs) {
       modelable = true;
       branchesBudget += s.branches.length;
       if (branchesBudget > MAX_BRANCHES) return null;
-      const selVal = fold(evalExpr2(s.selector, env));
+      const selVal = fold(evalExpr2(s.selector, env2));
       if (selVal.kind !== "concrete") return null;
       const concrete = selVal.value || "";
       let selected = null;
@@ -5732,7 +6243,7 @@ esac`);
       modelable = true;
       branchesBudget++;
       if (branchesBudget > MAX_BRANCHES) return null;
-      const truth = evalCondition2(s.cond, env);
+      const truth = evalCondition2(s.cond, env2);
       if (truth === null) return null;
       const chosen = truth ? s.thenBody : s.elseBody;
       if (chosen === null) return null;
@@ -6265,9 +6776,9 @@ var init_tracker = __esm({
 });
 
 // src/engine/script-content-analyzer.ts
-import { statSync as statSync4, existsSync as existsSync11 } from "fs";
-import { resolve as resolve9, join as join10, isAbsolute as isAbsolute2 } from "path";
-import { homedir as homedir3 } from "os";
+import { statSync as statSync4, existsSync as existsSync12 } from "fs";
+import { resolve as resolve10, join as join11, isAbsolute as isAbsolute3 } from "path";
+import { homedir as homedir4 } from "os";
 function emptyChain() {
   return {
     nodes: [],
@@ -6378,7 +6889,7 @@ function extractInlineScriptPath(actionDetail) {
         if (looksLikeScriptPath(tok)) {
           try {
             const resolved = resolvePath2(tok.replace(/^['"]|['"]$/g, ""));
-            if (existsSync11(resolved)) {
+            if (existsSync12(resolved)) {
               const stat = statSync4(resolved);
               if (stat.isFile()) return resolved;
             }
@@ -6392,7 +6903,7 @@ function extractInlineScriptPath(actionDetail) {
       const p = m[1];
       try {
         const resolved = resolvePath2(p);
-        if (existsSync11(resolved)) {
+        if (existsSync12(resolved)) {
           const stat = statSync4(resolved);
           if (stat.isFile()) return resolved;
         }
@@ -6408,7 +6919,7 @@ function extractInlineScriptPath(actionDetail) {
     let resolved;
     try {
       resolved = resolvePath2(p);
-      if (existsSync11(resolved)) {
+      if (existsSync12(resolved)) {
         const stat = statSync4(resolved);
         if (stat.isFile()) return resolved;
       }
@@ -6449,9 +6960,9 @@ function shlexSplit(s) {
 function resolvePath2(p) {
   let expanded = p;
   if (expanded.startsWith("~/") || expanded === "~") {
-    expanded = join10(homedir3(), expanded.slice(1));
+    expanded = join11(homedir4(), expanded.slice(1));
   }
-  return resolve9(expanded);
+  return resolve10(expanded);
 }
 function scanExtensionPatterns(ext, content) {
   const pats = ext?.extra_command_patterns;
@@ -6572,8 +7083,8 @@ function analyzeScriptContent2(input, ext) {
     resolvedPath = inline;
     isInline = true;
   }
-  if (resolvedPath && !isAbsolute2(resolvedPath) && !resolvedPath.startsWith("~/")) {
-    resolvedPath = join10(input.cwd || process.cwd(), resolvedPath);
+  if (resolvedPath && !isAbsolute3(resolvedPath) && !resolvedPath.startsWith("~/")) {
+    resolvedPath = join11(input.cwd || process.cwd(), resolvedPath);
   }
   const l1Adapter = (content) => {
     const j = scanDangerousCommandPatterns("bash", content, input.osType);
@@ -6699,16 +7210,16 @@ __export(token_stats_exports, {
   recordTokenUsage: () => recordTokenUsage,
   resetTokenStats: () => resetTokenStats
 });
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync2, existsSync as existsSync12, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2 } from "fs";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync2, existsSync as existsSync13, mkdirSync as mkdirSync3, unlinkSync as unlinkSync2 } from "fs";
 function getStatsPath() {
   const envPath = process.env[ENV_STATS_PATH];
   if (envPath) return envPath;
   return getTokenStatsPath();
 }
 function loadAllRecords(statsPath) {
-  if (!existsSync12(statsPath)) return [];
+  if (!existsSync13(statsPath)) return [];
   try {
-    const data = JSON.parse(readFileSync12(statsPath, "utf-8"));
+    const data = JSON.parse(readFileSync13(statsPath, "utf-8"));
     if (Array.isArray(data)) return data;
     if (data && Array.isArray(data.records)) return data.records;
     return [];
@@ -6719,7 +7230,7 @@ function loadAllRecords(statsPath) {
 function saveRecords(statsPath, records) {
   try {
     const dir = statsPath.substring(0, statsPath.lastIndexOf("/"));
-    if (dir && !existsSync12(dir)) mkdirSync2(dir, { recursive: true });
+    if (dir && !existsSync13(dir)) mkdirSync3(dir, { recursive: true });
     writeFileSync2(statsPath, JSON.stringify(records, null, 2), "utf-8");
   } catch (e) {
   }
@@ -6846,7 +7357,7 @@ function getTokenTrend(days = 0, startDate, endDate) {
 }
 function resetTokenStats() {
   const statsPath = getStatsPath();
-  if (existsSync12(statsPath)) {
+  if (existsSync13(statsPath)) {
     try {
       unlinkSync2(statsPath);
     } catch {
@@ -6865,7 +7376,7 @@ var init_token_stats = __esm({
 });
 
 // src/engine/llm-analyzer.ts
-import { appendFileSync } from "fs";
+import { openSync as openSync2, writeSync as writeSync2, closeSync as closeSync2, constants as fsConstants } from "fs";
 import OpenAI from "openai";
 async function runLLMAnalysis(input, previous) {
   if (!isLLMAvailable()) {
@@ -6881,7 +7392,15 @@ async function runLLMAnalysis(input, previous) {
     };
   }
   const globalConfig = getLLMConfig();
-  const config = input.llmConfig?.apiKey ? { ...globalConfig, ...input.llmConfig } : globalConfig;
+  let perRequest = input.llmConfig;
+  if (perRequest?.apiKey) {
+    const [okUrl, why] = validateLlmBaseUrl(String(perRequest.baseUrl || ""));
+    if (!okUrl) {
+      console.warn("[AgentMoss] \u5FFD\u7565\u4E0D\u88AB\u5141\u8BB8\u7684 per-request llmConfig.baseUrl:", why);
+      perRequest = { ...perRequest, baseUrl: void 0 };
+    }
+  }
+  const config = perRequest?.apiKey ? { ...globalConfig, ...perRequest } : globalConfig;
   const rawDetail = input.aNext.actionDetail.replace(/^terminal-\w+:\s*command=([^,]+).*/, "$1").trim();
   const cacheKey = `${input.aNext.actionType}:${rawDetail || input.aNext.actionDetail}`;
   const cached2 = llmCache.get(cacheKey);
@@ -6910,6 +7429,10 @@ async function runLLMAnalysis(input, previous) {
 }
 function logPrompt(prompt, aNext, logPath) {
   if (!logPath) return;
+  if (!pathWithin(logPath, logRoots())) {
+    console.warn("[AgentMoss] \u5FFD\u7565\u8D8A\u754C\u7684 llm_log_path\uFF08\u4E0D\u5728\u5141\u8BB8\u6839\u76EE\u5F55\u5185\uFF09:", logPath);
+    return;
+  }
   try {
     const actionType = aNext.actionType || "unknown";
     const actionDetail = (aNext.actionDetail || "").slice(0, 100);
@@ -6917,7 +7440,14 @@ function logPrompt(prompt, aNext, logPath) {
 ${prompt}
 --- END PROMPT ---
 `;
-    appendFileSync(logPath, line, "utf-8");
+    let flags = fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_APPEND;
+    if (fsConstants.O_NOFOLLOW) flags |= fsConstants.O_NOFOLLOW;
+    const fd = openSync2(logPath, flags, 384);
+    try {
+      writeSync2(fd, line);
+    } finally {
+      closeSync2(fd);
+    }
   } catch (e) {
     console.warn("[AgentMoss] Failed to write LLM prompt to log:", e);
   }
@@ -7076,7 +7606,7 @@ async function analyzeWithLLM(prompt, config) {
       }
       if (attempt < maxRetries) {
         console.error(`[AgentMoss] LLM call failed (attempt ${attempt + 1}/${maxRetries + 1}), retrying in ${retryCfg.retryInterval}s:`, err.message);
-        await new Promise((resolve11) => setTimeout(resolve11, retryCfg.retryInterval * 1e3));
+        await new Promise((resolve12) => setTimeout(resolve12, retryCfg.retryInterval * 1e3));
       } else {
         clearTimeout(totalTimeoutTimer);
         console.error("[AgentMoss] LLM call failed after all retries:", err.message);
@@ -7092,6 +7622,7 @@ var init_llm_analyzer = __esm({
   "src/engine/llm-analyzer.ts"() {
     "use strict";
     init_esm_shims();
+    init_security_policy();
     init_config();
     init_skill_loader();
     init_template_loader();
@@ -7103,9 +7634,9 @@ var init_llm_analyzer = __esm({
 });
 
 // src/brain/rule-store.ts
-import { existsSync as existsSync13, readFileSync as readFileSync13, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
-import { join as join11 } from "path";
-import { homedir as homedir4 } from "os";
+import { existsSync as existsSync14, readFileSync as readFileSync14, writeFileSync as writeFileSync3, mkdirSync as mkdirSync4 } from "fs";
+import { join as join12 } from "path";
+import { homedir as homedir5 } from "os";
 function getRulesPath() {
   const envPath = process.env[ENV_RULES_PATH];
   if (envPath) return envPath;
@@ -7123,7 +7654,7 @@ var init_rule_store = __esm({
   "src/brain/rule-store.ts"() {
     "use strict";
     init_esm_shims();
-    DEFAULT_RULES_PATH = join11(homedir4(), ".agentmoss", "brain", "rules.json");
+    DEFAULT_RULES_PATH = join12(homedir5(), ".agentmoss", "brain", "rules.json");
     ENV_RULES_PATH = "AGENT_MOSS_BRAIN_RULES_PATH";
     STATUS_DRAFT = "draft";
     STATUS_APPROVED = "approved";
@@ -7140,11 +7671,11 @@ var init_rule_store = __esm({
         this.data = this.load();
       }
       load() {
-        if (!existsSync13(this.path)) {
+        if (!existsSync14(this.path)) {
           return { version: 1, rules: [], pattern_candidates: [] };
         }
         try {
-          const raw = JSON.parse(readFileSync13(this.path, "utf-8"));
+          const raw = JSON.parse(readFileSync14(this.path, "utf-8"));
           return {
             version: raw.version || 1,
             rules: raw.rules || [],
@@ -7156,7 +7687,7 @@ var init_rule_store = __esm({
       }
       save() {
         const dir = this.path.substring(0, this.path.lastIndexOf("/"));
-        if (dir) mkdirSync3(dir, { recursive: true });
+        if (dir) mkdirSync4(dir, { recursive: true });
         writeFileSync3(this.path, JSON.stringify(this.data, null, 2), "utf-8");
       }
       addRule(rule) {
@@ -7738,9 +8269,9 @@ var init_reviewer = __esm({
 });
 
 // src/brain/skill-manager.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync4, readFileSync as readFileSync14, renameSync, writeFileSync as writeFileSync4 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join12 } from "path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync5, readFileSync as readFileSync15, renameSync, writeFileSync as writeFileSync4 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join13 } from "path";
 import { randomUUID } from "crypto";
 function getMetaPath(override) {
   return override || process.env[ENV_SKILL_META_PATH] || DEFAULT_SKILL_META_PATH;
@@ -7750,14 +8281,14 @@ var init_skill_manager = __esm({
   "src/brain/skill-manager.ts"() {
     "use strict";
     init_esm_shims();
-    DEFAULT_SKILL_META_PATH = join12(homedir5(), ".agentmoss", "brain", "skill_meta.json");
+    DEFAULT_SKILL_META_PATH = join13(homedir6(), ".agentmoss", "brain", "skill_meta.json");
     ENV_SKILL_META_PATH = "AGENT_MOSS_BRAIN_SKILL_META_PATH";
     BrainSkillManager = class {
       constructor(skillsDir, metaPath) {
         this.skillsDir = skillsDir;
         this.metaPath = getMetaPath(metaPath);
         try {
-          mkdirSync4(join12(this.metaPath, ".."), { recursive: true });
+          mkdirSync5(join13(this.metaPath, ".."), { recursive: true });
         } catch {
         }
         this.load();
@@ -7767,9 +8298,9 @@ var init_skill_manager = __esm({
       skills = [];
       metaPath;
       load() {
-        if (!existsSync14(this.metaPath)) return;
+        if (!existsSync15(this.metaPath)) return;
         try {
-          const data = JSON.parse(readFileSync14(this.metaPath, "utf-8"));
+          const data = JSON.parse(readFileSync15(this.metaPath, "utf-8"));
           this.skills = data.skills || [];
         } catch {
           this.skills = [];
@@ -7792,7 +8323,7 @@ var init_skill_manager = __esm({
         let changed = false;
         for (const sk of this.skills) {
           if (sk.status !== "active") continue;
-          if (!existsSync14(join12(this.skillsDir, `${sk.name}.md`))) {
+          if (!existsSync15(join13(this.skillsDir, `${sk.name}.md`))) {
             sk.status = "stale";
             changed = true;
           }
@@ -7803,9 +8334,9 @@ var init_skill_manager = __esm({
       addSkill(skill) {
         const id = skill.id || randomUUID();
         const name = skill.name || `brain_${id.slice(0, 8)}`;
-        if (!existsSync14(this.skillsDir)) return "";
-        const mdPath = join12(this.skillsDir, `${name}.md`);
-        if (existsSync14(mdPath)) return "";
+        if (!existsSync15(this.skillsDir)) return "";
+        const mdPath = join13(this.skillsDir, `${name}.md`);
+        if (existsSync15(mdPath)) return "";
         try {
           writeFileSync4(mdPath, skill.content, "utf-8");
         } catch {
@@ -7854,12 +8385,12 @@ var init_skill_manager = __esm({
         const out = [];
         for (const sk of this.skills) {
           if (sk.origin_node !== "local" || sk.status !== "active") continue;
-          const mdPath = join12(this.skillsDir, `${sk.name}.md`);
-          if (!existsSync14(mdPath)) continue;
+          const mdPath = join13(this.skillsDir, `${sk.name}.md`);
+          if (!existsSync15(mdPath)) continue;
           out.push({
             name: sk.name,
             category: sk.category || "",
-            content: readFileSync14(mdPath, "utf-8"),
+            content: readFileSync15(mdPath, "utf-8"),
             keywords: sk.keywords || []
           });
         }
@@ -7946,7 +8477,7 @@ var init_curator = __esm({
 });
 
 // src/brain/contributor.ts
-import { dirname as dirname9 } from "path";
+import { dirname as dirname10 } from "path";
 import { fileURLToPath as fileURLToPath9 } from "url";
 var __dirname8;
 var init_contributor = __esm({
@@ -7956,7 +8487,7 @@ var init_contributor = __esm({
     init_rule_store();
     init_skill_manager();
     init_asset_dir();
-    __dirname8 = dirname9(fileURLToPath9(import.meta.url));
+    __dirname8 = dirname10(fileURLToPath9(import.meta.url));
   }
 });
 
@@ -8324,7 +8855,7 @@ function markIntegrity(actionDetail) {
   }
   return { integrity: "medium", isLowSource: false };
 }
-function initNode(sessionId, seq, actionType, actionDetail) {
+function initNode(sessionId, seq, actionType, actionDetail, timestamp) {
   const { integrity, isLowSource } = markIntegrity(actionDetail);
   return {
     sessionId,
@@ -8334,7 +8865,8 @@ function initNode(sessionId, seq, actionType, actionDetail) {
     stage: markStage(actionDetail),
     resources: extractResources(actionDetail),
     integrity,
-    isLowSource
+    isLowSource,
+    timestamp: timestamp || void 0
   };
 }
 function buildSessionGraph(actionHistory, aNext, sessionId = "current") {
@@ -8344,13 +8876,21 @@ function buildSessionGraph(actionHistory, aNext, sessionId = "current") {
   const details = [];
   for (const a of actionHistory) {
     const ad = String(a.actionDetail || "");
-    if (ad) details.push({ actionType: String(a.actionType || ""), actionDetail: ad });
+    if (ad) details.push({
+      actionType: String(a.actionType || ""),
+      actionDetail: ad,
+      calledAt: a.calledAt || void 0
+    });
   }
   if (aNext) {
-    details.push({ actionType: String(aNext.actionType || ""), actionDetail: String(aNext.actionDetail || "") });
+    details.push({
+      actionType: String(aNext.actionType || ""),
+      actionDetail: String(aNext.actionDetail || ""),
+      calledAt: aNext.calledAt || void 0
+    });
   }
   details.forEach((d, seq) => {
-    const node = initNode(sessionId, seq, d.actionType, d.actionDetail);
+    const node = initNode(sessionId, seq, d.actionType, d.actionDetail, d.calledAt);
     nodes.push(node);
     if (node.stage) stageFlags.add(node.stage);
   });
@@ -8376,7 +8916,8 @@ function buildMultiSessionGraph(sessions, aNext) {
         last.sessionId,
         last.nodes.length,
         String(aNext.actionType || ""),
-        String(aNext.actionDetail || "")
+        String(aNext.actionDetail || ""),
+        aNext.calledAt || void 0
       ));
       if (last.nodes.length > 1) {
         last.edges.push({ src: last.nodes.length - 2, dst: last.nodes.length - 1, kind: "next" });
@@ -8434,6 +8975,27 @@ var init_builder = __esm({
 });
 
 // src/engine/formal-engine/properties.ts
+function parseTs(ts) {
+  if (!ts) return null;
+  const t = Date.parse(String(ts).trim());
+  return Number.isFinite(t) ? t : null;
+}
+function privescExfilWindowSec() {
+  const raw = (process.env.AGENT_MOSS_PRIVESC_EXFIL_WINDOW_SEC || "").trim();
+  if (!raw) return 1800;
+  const n = parseInt(raw, 10);
+  return Number.isFinite(n) ? Math.max(0, n) : 1800;
+}
+function privescInWindow(nodes, indexes, exfilIdx, windowSec) {
+  const before = indexes.filter((i) => i < exfilIdx);
+  if (windowSec <= 0) return before;
+  const exfilTs = parseTs(nodes[exfilIdx].timestamp);
+  if (exfilTs === null) return before;
+  return before.filter((i) => {
+    const ts = parseTs(nodes[i].timestamp);
+    return ts === null || exfilTs - ts <= windowSec * 1e3;
+  });
+}
 function loadCrossSessionChains() {
   if (CROSS_SESSION_CHAINS) return CROSS_SESSION_CHAINS;
   const combo = loadL2().combo_chains || {};
@@ -8625,6 +9187,7 @@ function checkNeverExfilAfterPrivesc(graph) {
   const nodes = allNodes(graph);
   if (nodes.length < 2) return violations;
   const witness = graph.witnessIdx;
+  const windowSec = privescExfilWindowSec();
   if (witness !== void 0) {
     const evIdx = [];
     nodes.forEach((n, i) => {
@@ -8632,15 +9195,17 @@ function checkNeverExfilAfterPrivesc(graph) {
     });
     if (evIdx.length === 0) return violations;
     const firstEv = Math.min(...evIdx);
-    let pre = null;
-    for (let i = 0; i < firstEv; i++) {
-      if (isPrivescNode(nodes[i])) pre = nodes[i];
-    }
-    if (pre) {
+    const privescIdx = [];
+    nodes.forEach((n, i) => {
+      if (isPrivescNode(n)) privescIdx.push(i);
+    });
+    const candidates = privescInWindow(nodes, privescIdx, firstEv, windowSec);
+    if (candidates.length > 0) {
+      const pre = nodes[candidates[candidates.length - 1]];
       const post = nodes[firstEv];
       return [{
         propertyId: "no-exfil-after-privesc",
-        reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\xAC\u25C7EXFIL)",
+        reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\u25C7EXFIL) \u7A97\u53E3\u7EA6\u675F",
         riskLevel: "critical",
         path: [
           { sessionId: pre.sessionId, seq: pre.seq, detail: pre.actionDetail.slice(0, 60) },
@@ -8653,18 +9218,18 @@ function checkNeverExfilAfterPrivesc(graph) {
   for (let i = 0; i < nodes.length; i++) {
     if (!isPrivescNode(nodes[i])) continue;
     for (let j = i + 1; j < nodes.length; j++) {
-      if (isExfilNode(nodes[j])) {
-        violations.push({
-          propertyId: "no-exfil-after-privesc",
-          reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\xAC\u25C7EXFIL)",
-          riskLevel: "critical",
-          path: [
-            { sessionId: nodes[i].sessionId, seq: nodes[i].seq, detail: nodes[i].actionDetail.slice(0, 60) },
-            { sessionId: nodes[j].sessionId, seq: nodes[j].seq, detail: nodes[j].actionDetail.slice(0, 60) }
-          ]
-        });
-        return violations;
-      }
+      if (!isExfilNode(nodes[j])) continue;
+      if (privescInWindow(nodes, [i], j, windowSec).length === 0) continue;
+      violations.push({
+        propertyId: "no-exfil-after-privesc",
+        reason: "\u63D0\u6743\u540E\u51FA\u73B0\u5916\u4F20\uFF1A\u63D0\u6743(\u524D) \u2192 \u5916\u4F20(\u540E)\uFF0C\u8FDD\u53CD \u25A1(PRIVESC\u2192\u25C7EXFIL) \u7A97\u53E3\u7EA6\u675F",
+        riskLevel: "critical",
+        path: [
+          { sessionId: nodes[i].sessionId, seq: nodes[i].seq, detail: nodes[i].actionDetail.slice(0, 60) },
+          { sessionId: nodes[j].sessionId, seq: nodes[j].seq, detail: nodes[j].actionDetail.slice(0, 60) }
+        ]
+      });
+      return violations;
     }
   }
   return violations;
@@ -8827,6 +9392,10 @@ function checkCrossSessionReachability(graph) {
   }
   return violations;
 }
+function isDataSourceNode(n) {
+  if (n.stage === "CRED" || n.isLowSource) return true;
+  return DATA_SOURCE_READ_RE.test(n.actionDetail);
+}
 function checkSensitiveDataAggregation(graph) {
   const violations = [];
   const nodes = allNodes(graph);
@@ -8846,6 +9415,7 @@ function checkSensitiveDataAggregation(graph) {
     for (const r of n.resources) {
       for (const j of resIndex.get(r) || []) {
         if (j === exfilIdx) continue;
+        if (!isDataSourceNode(nodes[j])) continue;
         srcs.add(`${nodes[j].sessionId}#${nodes[j].seq}`);
       }
     }
@@ -8868,7 +9438,7 @@ function checkSensitiveDataAggregation(graph) {
   }
   return violations;
 }
-var CROSS_SESSION_CHAINS, CRED_FILE_RE, EXFIL_RE, EBPF_NET_RE, REMOTE_RE, EXFIL_ACTION_RE, CRED_STRICT_RE, INLINE_SHELL_RE, FORMAL_RULES, PKG_MGR, SHELLS, TOOL_REGISTRY, COMPUTE_RE, STRONG_COMPUTE_TYPES, DL_OR_LOW_RE, ALL_PROPERTIES;
+var CROSS_SESSION_CHAINS, CRED_FILE_RE, EXFIL_RE, EBPF_NET_RE, REMOTE_RE, EXFIL_ACTION_RE, CRED_STRICT_RE, INLINE_SHELL_RE, FORMAL_RULES, PKG_MGR, SHELLS, TOOL_REGISTRY, COMPUTE_RE, STRONG_COMPUTE_TYPES, DL_OR_LOW_RE, DATA_SOURCE_READ_RE, ALL_PROPERTIES;
 var init_properties = __esm({
   "src/engine/formal-engine/properties.ts"() {
     "use strict";
@@ -8892,6 +9462,7 @@ var init_properties = __esm({
     COMPUTE_RE = /subprocess|os\.system|shell\s*=\s*True|\beval\(|\bexec\(|bash\s+[^\s]|sh\s+-c|python3?\s+|node\s+|\btimeout\s+|nohup\s+|\b\.\/[\w./-]+/i;
     STRONG_COMPUTE_TYPES = new Set(FORMAL_RULES.compute_action_types ?? []);
     DL_OR_LOW_RE = /curl\s+.*-o\b|wget\s+.*\s+-O\b|curl\s+.*\|\s*(bash|sh|python)|wget\s+.*\|\s*(bash|sh|python)|git\s+clone|docker\s+pull|pip\s+install|npm\s+install|base64\s+-d/i;
+    DATA_SOURCE_READ_RE = /\b(?:cat|head|tail|less|more|sed|awk|grep|strings|base64|xxd|od|dd)\b|\b(?:open|read_text|read_bytes)\s*\(/i;
     ALL_PROPERTIES = [
       { id: "cross-session-chain", check: checkCrossSessionChain, shortName: "P1" },
       { id: "sensitive-data-flow", check: checkSensitiveDataFlow, shortName: "P2" },
@@ -9414,10 +9985,10 @@ var init_stateful = __esm({
 import * as fs4 from "fs";
 import * as os2 from "os";
 import * as path4 from "path";
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 function defaultStateDbPath() {
   const dir = process.env.AGENT_MOSS_STATE_DIR || path4.join(os2.homedir(), ".agentmoss");
-  const tag = createHash2("sha1").update("agentmoss-stateful").digest("hex").slice(0, 8);
+  const tag = createHash3("sha1").update("agentmoss-stateful").digest("hex").slice(0, 8);
   return path4.join(dir, `stateful_chains_${tag}.json`);
 }
 var ChainStateStore;
@@ -9425,6 +9996,7 @@ var init_chain_state = __esm({
   "src/engine/formal-engine/chain_state.ts"() {
     "use strict";
     init_esm_shims();
+    init_security_policy();
     init_stateful();
     ChainStateStore = class {
       filePath;
@@ -9451,8 +10023,8 @@ var init_chain_state = __esm({
         this._timer = setTimeout(() => {
           this._timer = null;
           try {
-            fs4.mkdirSync(path4.dirname(this.filePath), { recursive: true });
-            fs4.writeFileSync(this.filePath, JSON.stringify(this.data, null, 2), "utf-8");
+            ensurePrivateDir(path4.dirname(this.filePath));
+            writePrivateText(this.filePath, JSON.stringify(this.data, null, 2));
           } catch {
           }
         }, this._flushDelayMs);
@@ -9464,8 +10036,8 @@ var init_chain_state = __esm({
           this._timer = null;
         }
         try {
-          fs4.mkdirSync(path4.dirname(this.filePath), { recursive: true });
-          fs4.writeFileSync(this.filePath, JSON.stringify(this.data, null, 2), "utf-8");
+          ensurePrivateDir(path4.dirname(this.filePath));
+          writePrivateText(this.filePath, JSON.stringify(this.data, null, 2));
         } catch {
         }
       }
@@ -10130,13 +10702,16 @@ function enforceRulesContract() {
 }
 
 // src/server.ts
+init_security_policy();
 import { cors } from "hono/cors";
 import { logger } from "hono/logger";
 import net from "net";
-import { existsSync as existsSync20 } from "fs";
+import { existsSync as existsSync21 } from "fs";
 
 // src/routes.ts
 init_esm_shims();
+init_security_policy();
+import { randomBytes as randomBytes2 } from "crypto";
 
 // src/models.ts
 init_esm_shims();
@@ -10156,7 +10731,10 @@ var ActionItemSchema = z.object({
   // 工具返回给 agent 的内容。仅 L2 的授权（consent）判定用：判断「用户是否已授权」
   // 看的是 ask_user_question 的**回答**，不是提问正文。历史 bug：模型里没有这个字段、
   // 路由也没透传，TS 的授权判定退化成「提问正文非空」，等于问过任何问题即已授权。
-  output: z.string().optional().describe("Tool result / user answer (needed by L2 consent checks)")
+  output: z.string().optional().describe("Tool result / user answer (needed by L2 consent checks)"),
+  // 动作真实发生时间（可选）。供 P4「提权→外传」时间窗口判定；缺省时该性质
+  // 退回不设窗口的旧行为。与 Python ActionItem.called_at 对齐。
+  called_at: z.string().optional().describe("Action timestamp (optional)")
 });
 var PromptTurnSchema = z.object({
   text: z.string().default("").describe("User prompt text at this turn"),
@@ -10222,23 +10800,39 @@ var ReviewResponseSchema = z.object({
 
 // src/engine/analyzer.ts
 init_esm_shims();
+init_security_policy();
 init_coordinator();
-import { existsSync as existsSync17, mkdirSync as mkdirSync7, readFileSync as readFileSync17, writeFileSync as writeFileSync7 } from "fs";
-import { tmpdir as tmpdir2 } from "os";
-import { join as join15, resolve as resolve10 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync18 } from "fs";
+import { tmpdir as tmpdir3 } from "os";
+import { join as join16, resolve as resolve11 } from "path";
 
 // src/infra/policy-cache.ts
 init_esm_shims();
+init_security_policy();
+init_paths();
 init_config();
-import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync16, mkdirSync as mkdirSync6, readdirSync as readdirSync5, readFileSync as readFileSync16, rmdirSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync6 } from "fs";
-import { tmpdir } from "os";
-import { join as join14 } from "path";
-var CACHE_DIR = join14(tmpdir(), "agent_moss_policy_cache");
+import { createHash as createHash4 } from "crypto";
+import { existsSync as existsSync17, lstatSync as lstatSync2, readdirSync as readdirSync5, readFileSync as readFileSync17, rmdirSync, unlinkSync as unlinkSync3 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join15 } from "path";
+var CACHE_DIR = join15(tmpdir2(), "agent_moss_policy_cache");
 var cacheDirOverride = null;
 function cacheDir() {
   return cacheDirOverride ?? CACHE_DIR;
 }
+function safeCacheDir() {
+  const dir = cacheDir();
+  if (ensurePrivateDir(dir)) return dir;
+  try {
+    const fallback = join15(getDataRoot(), "policy_cache");
+    if (ensurePrivateDir(fallback)) {
+      console.warn(`[AgentMoss] \u7F13\u5B58\u76EE\u5F55 ${dir} \u4E0D\u5B89\u5168\uFF08\u88AB\u5176\u4ED6\u7528\u6237\u62E5\u6709\u6216\u4E3A\u7B26\u53F7\u94FE\u63A5\uFF09\uFF0C\u5DF2\u56DE\u9000\u5230 ${fallback}`);
+      return fallback;
+    }
+  } catch {
+  }
+  return dir;
+}
 var PolicyCache = class {
   // Map 的插入序即 LRU 序（get 时重新 set 到末尾）
   constructor(options) {
@@ -10250,9 +10844,9 @@ var PolicyCache = class {
     return `${sessionId}::${promptSession}`;
   }
   cacheFilePath(sessionId, promptSession) {
-    const promptHash = createHash3("md5").update(promptSession).digest("hex").slice(0, 12);
-    const safeSessionId = sessionId.replace(/\//g, "_").replace(/\\/g, "_");
-    return join14(cacheDir(), safeSessionId, `${promptHash}.toml`);
+    const promptHash = createHash4("md5").update(promptSession).digest("hex").slice(0, 12);
+    const safeSessionId = sessionId.replace(/\//g, "_").replace(/\\/g, "_").replace(/\.\./g, "__");
+    return join15(safeCacheDir(), safeSessionId, `${promptHash}.toml`);
   }
   /** 取缓存：内存 → 文件；未命中返回 null。 */
   get(sessionId, promptSession) {
@@ -10265,9 +10859,9 @@ var PolicyCache = class {
       return hit;
     }
     const file = this.cacheFilePath(sessionId, promptSession);
-    if (existsSync16(file)) {
+    if (existsSync17(file) && !lstatSync2(file).isSymbolicLink()) {
       try {
-        const policy = readFileSync16(file, "utf-8");
+        const policy = readFileSync17(file, "utf-8");
         this.remember(key, policy);
         return policy;
       } catch {
@@ -10281,8 +10875,10 @@ var PolicyCache = class {
     this.remember(this.cacheKey(sessionId, promptSession), policy);
     const file = this.cacheFilePath(sessionId, promptSession);
     try {
-      mkdirSync6(join14(cacheDir(), sessionId.replace(/\//g, "_").replace(/\\/g, "_")), { recursive: true });
-      writeFileSync6(file, policy, "utf-8");
+      const dir = safeCacheDir();
+      const sub = sessionId.replace(/\//g, "_").replace(/\\/g, "_").replace(/\.\./g, "__");
+      if (!ensurePrivateDir(join15(dir, sub))) return;
+      writePrivateText(file, policy);
     } catch {
     }
   }
@@ -10306,13 +10902,13 @@ var PolicyCache = class {
     for (const k of [...this.memory.keys()]) {
       if (k.startsWith(`${sessionId}::`)) this.memory.delete(k);
     }
-    const safeSessionId = sessionId.replace(/\//g, "_").replace(/\\/g, "_");
-    const dir = join14(cacheDir(), safeSessionId);
+    const safeSessionId = sessionId.replace(/\//g, "_").replace(/\\/g, "_").replace(/\.\./g, "__");
+    const dir = join15(cacheDir(), safeSessionId);
     try {
-      if (existsSync16(dir)) {
+      if (existsSync17(dir)) {
         for (const f of readdirSync5(dir)) {
           try {
-            unlinkSync3(join14(dir, f));
+            unlinkSync3(join15(dir, f));
           } catch {
           }
         }
@@ -10324,11 +10920,11 @@ var PolicyCache = class {
   clear() {
     this.memory.clear();
     try {
-      if (existsSync16(cacheDir())) {
+      if (existsSync17(cacheDir())) {
         for (const sessionDir of readdirSync5(cacheDir())) {
-          const dir = join14(cacheDir(), sessionDir);
+          const dir = join15(cacheDir(), sessionDir);
           try {
-            for (const f of readdirSync5(dir)) unlinkSync3(join14(dir, f));
+            for (const f of readdirSync5(dir)) unlinkSync3(join15(dir, f));
             rmdirSync(dir);
           } catch {
           }
@@ -10415,7 +11011,7 @@ ${safe(policy, 2e3)}`);
 
 // src/engine/analyzer.ts
 import { parse as parseToml } from "smol-toml";
-var POLICY_OUTPUT_DIR = join15(tmpdir2(), "agent_moss");
+var POLICY_OUTPUT_DIR = join16(tmpdir3(), "agent_moss");
 var policyOutputDirOverride = null;
 function policyOutputDir() {
   return policyOutputDirOverride ?? POLICY_OUTPUT_DIR;
@@ -10449,10 +11045,13 @@ function savePolicyToFile(sessionId, policyToml) {
   if (!isPolicySaveEnabled()) return null;
   try {
     const outDir = policyOutputDir();
-    mkdirSync7(outDir, { recursive: true });
-    const safeName = sessionId.replace(/\//g, "_").replace(/\\/g, "_");
-    const filepath = join15(outDir, `${safeName}.toml`);
-    writeFileSync7(filepath, policyToml, "utf-8");
+    if (!ensurePrivateDir(outDir)) {
+      console.warn(`[AgentMoss] Policy \u8F93\u51FA\u76EE\u5F55 ${outDir} \u4E0D\u5B89\u5168\uFF0C\u8DF3\u8FC7\u843D\u76D8\uFF08\u4E0D\u5F71\u54CD\u5224\u5B9A\uFF09`);
+      return null;
+    }
+    const safeName = sessionId.replace(/\//g, "_").replace(/\\/g, "_").replace(/\.\./g, "__");
+    const filepath = join16(outDir, `${safeName}.toml`);
+    writePrivateText(filepath, policyToml);
     return filepath;
   } catch (err) {
     console.warn(`[AgentMoss] \u7B56\u7565\u6587\u4EF6\u843D\u76D8\u5931\u8D25\uFF08\u4E0D\u5F71\u54CD\u5224\u5B9A\uFF09: ${policyOutputDir()}: ${String(err)}`);
@@ -10489,12 +11088,12 @@ function validateToml(tomlStr) {
 function loadPolicyMappingDoc() {
   const dir = resolveAssetDir(__dirname, "templates");
   if (dir) {
-    const p = resolve10(dir, "policy_mapping.md");
-    if (existsSync17(p)) return readFileSync17(p, "utf-8");
+    const p = resolve11(dir, "policy_mapping.md");
+    if (existsSync18(p)) return readFileSync18(p, "utf-8");
   }
   for (const cand of assetDirCandidates(__dirname, "templates")) {
-    const p = resolve10(cand, "policy_mapping.md");
-    if (existsSync17(p)) return readFileSync17(p, "utf-8");
+    const p = resolve11(cand, "policy_mapping.md");
+    if (existsSync18(p)) return readFileSync18(p, "utf-8");
   }
   return "";
 }
@@ -11013,9 +11612,9 @@ function normalizeObservablePayload(body) {
 init_rule_store();
 init_skill_manager();
 init_asset_dir();
-import { join as join17, dirname as dirname11 } from "path";
+import { join as join18, dirname as dirname12 } from "path";
 import { fileURLToPath as fileURLToPath10 } from "url";
-var __dirname9 = dirname11(fileURLToPath10(import.meta.url));
+var __dirname9 = dirname12(fileURLToPath10(import.meta.url));
 async function healthRoute(c) {
   return c.json(HealthResponseSchema.parse({
     instance: process.env.AGENT_MOSS_INSTANCE || ""
@@ -11030,7 +11629,23 @@ async function analyzeRoute(c) {
     if (!osType) {
       osType = process.platform === "win32" ? "windows" : "linux";
     }
-    const agentId = req.agent_id || req.metadata?.agent_type || "";
+    const _principal = principalOf(c.req.raw.headers, new URL(c.req.url).pathname);
+    const [_boundOk, agentId] = bindAgent(_principal, req.agent_id || req.metadata?.agent_type || "");
+    if (!_boundOk) {
+      return c.json({ detail: `agent_id \u4E0E\u6240\u6301\u51ED\u8BC1\u4E0D\u5339\u914D: ${agentId}` }, 403);
+    }
+    const _sweepKey = _principal || `ip:${c.req.header("x-forwarded-for") || "local"}`;
+    const [_sweepN, _sweepHit] = noteSessionAccess(_sweepKey, req.session_id);
+    if (_sweepHit) {
+      if (sessionSweepAction() === "deny") {
+        return c.json({
+          detail: `\u77ED\u65F6\u95F4\u5185\u8BBF\u95EE\u4E86 ${_sweepN} \u4E2A\u4E0D\u540C\u4F1A\u8BDD\uFF0C\u8D85\u51FA\u9608\u503C ${sessionSweepThreshold()}\uFF08\u7591\u4F3C\u5192\u5145/\u626B\u63CF\uFF09`
+        }, 429);
+      }
+      console.warn(
+        `[AgentMoss] \u26A0\uFE0F \u8DE8\u4F1A\u8BDD\u6279\u91CF\u8BBF\u95EE: key=${_sweepKey} \u7A97\u53E3\u5185 ${_sweepN} \u4E2A\u4E0D\u540C session\uFF08\u9608\u503C ${sessionSweepThreshold()}\uFF09`
+      );
+    }
     const result = await analyze({
       sessionId: req.session_id,
       promptSession: req.prompt_session,
@@ -11041,14 +11656,16 @@ async function analyzeRoute(c) {
       actionHistory: req.action_history.map((h) => ({
         actionType: h.action_type,
         actionDetail: h.action_detail,
-        output: h.output
+        output: h.output,
+        calledAt: h.called_at
       })),
       sessionHistory: (req.session_history || []).map((s) => ({
         sessionId: s.session_id,
         actionHistory: (s.action_history || []).map((h) => ({
           actionType: h.action_type,
           actionDetail: h.action_detail,
-          output: h.output
+          output: h.output,
+          calledAt: h.called_at
         }))
       })),
       // prompt_history 必须透传：L2 意图一致性（logic-rules.ts 的
@@ -11075,7 +11692,8 @@ async function analyzeRoute(c) {
       // agent_id：AgentGate V1 normalizer 历史上把 agent_type 塞 metadata，
       // 顶层为空时兜底（OpenDesk 的 agent-moss 需 agent_id 加载专属规则）。
       agentId,
-      llmConfig: req.metadata?.llm_config,
+      // 严格模式：完全不接受 per-request LLM 配置（默认接受，保持原行为）
+      llmConfig: perRequestLlmEnabled() ? req.metadata?.llm_config : void 0,
       llmLogPath: req.metadata?.llm_log_path
     });
     const durationMs = performance.now() - t0;
@@ -11123,7 +11741,8 @@ async function analyzeRoute(c) {
               violated_policy: "",
               confidence: 90,
               analysis_duration_ms: Math.round((performance.now() - t0) * 10) / 10,
-              violation_chain: judgment.violation_chain
+              // 跨会话节点脱敏（时间线按 agent_id 共享，原样返回等于泄露别人的命令原文）
+              violation_chain: redactChain(judgment.violation_chain, req.session_id)
             })
           );
         }
@@ -11147,14 +11766,19 @@ async function analyzeRoute(c) {
       })
     );
   } catch (err) {
-    console.error("[AgentMoss] Analysis error:", err);
     if (err instanceof SyntaxError) {
       return c.json({ detail: err.message, error: "Invalid JSON" }, 422);
     }
     if (err?.issues) {
       return c.json({ detail: err.issues, error: "Validation error" }, 422);
     }
-    return c.json({ detail: String(err), error: "Internal error" }, 500);
+    if (errorDetailMode() === "full") {
+      console.error("[AgentMoss] Analysis error:", err);
+      return c.json({ detail: String(err), error: "Internal error" }, 500);
+    }
+    const ref = randomBytes2(4).toString("hex");
+    console.error(`[AgentMoss] Analysis internal error (ref=${ref}):`, err);
+    return c.json({ detail: `Internal server error (ref: ${ref})`, error: "Internal error" }, 500);
   }
 }
 var reviewStore = null;
@@ -11193,6 +11817,11 @@ async function reviewRoute(c) {
     if (!tracker) {
       tracker = new StatefulChainTracker(agentId);
     }
+    if (req.db_path && !pathWithin(req.db_path, reviewRoots())) {
+      return c.json({
+        detail: "db_path \u4E0D\u5728\u5141\u8BB8\u8BFB\u53D6\u7684\u76EE\u5F55\u5185\uFF1B\u6807\u51C6 AgentGate \u90E8\u7F72\u65E0\u9700\u914D\u7F6E\uFF0C\u81EA\u5B9A\u4E49\u8DEF\u5F84\u8BF7\u52A0\u5165 AGENT_MOSS_REVIEW_PATHS"
+      }, 403);
+    }
     let sessions = [];
     if (req.db_path) {
       sessions = loadAgentGateSessions(req.db_path);
@@ -11256,15 +11885,20 @@ async function reviewRoute(c) {
       discovered_patterns: discovered
     }));
   } catch (err) {
-    console.error("[AgentMoss] Review error:", err);
-    return c.json({ error: "Internal error", detail: String(err) }, 500);
+    if (errorDetailMode() === "full") {
+      console.error("[AgentMoss] Review error:", err);
+      return c.json({ error: "Internal error", detail: String(err) }, 500);
+    }
+    const ref = randomBytes2(4).toString("hex");
+    console.error(`[AgentMoss] Review internal error (ref=${ref}):`, err);
+    return c.json({ error: "Internal error", detail: `Internal server error (ref: ${ref})` }, 500);
   }
 }
 function getBrainRuleStore() {
   return new BrainRuleStore();
 }
 function getBrainSkillManager() {
-  const dir = resolveAssetDir(__dirname9, "skills") ?? join17(__dirname9, "..", "..", "agent_moss", "skills");
+  const dir = resolveAssetDir(__dirname9, "skills") ?? join18(__dirname9, "..", "..", "agent_moss", "skills");
   return new BrainSkillManager(dir);
 }
 async function brainRulesRoute(c) {
@@ -11367,11 +12001,12 @@ init_rules_loader();
 init_asset_dir();
 init_rules_mode();
 import { Hono } from "hono";
-import { readFileSync as readFileSync19, existsSync as existsSync19, unlinkSync as unlinkSync4 } from "fs";
-import { join as join18, dirname as dirname12 } from "path";
+import { timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { readFileSync as readFileSync20, existsSync as existsSync20, unlinkSync as unlinkSync4 } from "fs";
+import { join as join19, dirname as dirname13 } from "path";
 import { fileURLToPath as fileURLToPath11 } from "url";
-var __dirname10 = dirname12(fileURLToPath11(import.meta.url));
-var STATIC_DIR = join18(__dirname10, "static");
+var __dirname10 = dirname13(fileURLToPath11(import.meta.url));
+var STATIC_DIR = join19(__dirname10, "static");
 var CONSOLE_TOKEN_ENV = "AGENT_MOSS_CONSOLE_TOKEN";
 function getConsoleToken() {
   return process.env[CONSOLE_TOKEN_ENV] || "";
@@ -11380,7 +12015,11 @@ function verifyAuth(req) {
   const token = getConsoleToken();
   if (!token) return true;
   const auth = req.headers.get("Authorization") || "";
-  if (auth.startsWith("Bearer ")) return auth.slice(7) === token;
+  if (auth.startsWith("Bearer ")) {
+    const a = Buffer.from(auth.slice(7), "utf-8");
+    const b = Buffer.from(token, "utf-8");
+    return a.length === b.length && timingSafeEqual2(a, b);
+  }
   return false;
 }
 function authMiddleware() {
@@ -11409,9 +12048,9 @@ function createConsoleRouter() {
   console2.use("/api/*", authMiddleware());
   console2.use("/api/*", builtinOnlyReadOnlyMiddleware());
   const serveIndex = (c) => {
-    const indexFile = join18(STATIC_DIR, "index.html");
-    if (existsSync19(indexFile)) {
-      return c.html(readFileSync19(indexFile, "utf-8"));
+    const indexFile = join19(STATIC_DIR, "index.html");
+    if (existsSync20(indexFile)) {
+      return c.html(readFileSync20(indexFile, "utf-8"));
     }
     return c.html("<h1>AgentMoss Policy Console</h1><p>Frontend not built. Use /console/api/* endpoints.</p>");
   };
@@ -11606,15 +12245,15 @@ function createConsoleRouter() {
     if (!/^[A-Za-z0-9_-]+$/.test(skillId)) {
       return c.json({ detail: "\u975E\u6CD5 skill id" }, 400);
     }
-    const userPath = join18(dirname12(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
+    const userPath = join19(dirname13(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
     const builtinDir = resolveAssetDir(__dirname10, "skills");
     const candidates = [
       ...isRuntimeConfigDisabled() ? [] : [userPath],
-      builtinDir ? join18(builtinDir, `${skillId}.md`) : ""
+      builtinDir ? join19(builtinDir, `${skillId}.md`) : ""
     ].filter(Boolean);
     for (const p of candidates) {
-      if (existsSync19(p)) {
-        return c.json({ skill_id: skillId, path: p, content: readFileSync19(p, "utf-8") });
+      if (existsSync20(p)) {
+        return c.json({ skill_id: skillId, path: p, content: readFileSync20(p, "utf-8") });
       }
     }
     return c.json({ detail: `skill ${skillId} \u4E0D\u5B58\u5728` }, 404);
@@ -11711,7 +12350,7 @@ function createConsoleRouter() {
     const defaults = generateSourceDefaults();
     try {
       const p = getRuntimeConfigPath();
-      if (existsSync19(p)) unlinkSync4(p);
+      if (existsSync20(p)) unlinkSync4(p);
     } catch {
     }
     return c.json(withL22View(defaults));
@@ -11768,7 +12407,7 @@ function logDeploymentSelfCheck() {
     console.log("\u5C42\u7EA7\u5F00\u5173: " + layerKeys.map((k) => `${k}=${isLayerEnabled(k) ? "on" : "OFF"}`).join(" "));
     if (!builtinOnly) {
       try {
-        const dirs = rulesDirs().filter((d) => existsSync20(d));
+        const dirs = rulesDirs().filter((d) => existsSync21(d));
         if (dirs.length > 0) {
           console.log(`\u89C4\u5219\u76EE\u5F55: ${dirs.join(", ")}\uFF08\u53EA\u8BFB\u5176\u4E2D ${OVERRIDE_FILENAME} / ${EXTRA_FILENAME}\uFF09`);
         }
@@ -11806,11 +12445,134 @@ function logDeploymentSelfCheck() {
     console.error(`\u90E8\u7F72\u81EA\u68C0\u5931\u8D25\uFF08\u4E0D\u5F71\u54CD\u670D\u52A1\uFF09: ${exc instanceof Error ? exc.message : String(exc)}`);
   }
 }
+var PooledLimiter = class {
+  counts = /* @__PURE__ */ new Map();
+  tryAcquire(key, limit) {
+    if (limit <= 0) return true;
+    const cur = this.counts.get(key) || 0;
+    if (cur >= limit) return false;
+    this.counts.set(key, cur + 1);
+    return true;
+  }
+  release(key) {
+    const cur = this.counts.get(key) || 0;
+    if (cur <= 1) this.counts.delete(key);
+    else this.counts.set(key, cur - 1);
+  }
+};
+var RateLimiter = class {
+  constructor(qps, burst) {
+    this.qps = qps;
+    this.burst = burst;
+  }
+  qps;
+  burst;
+  buckets = /* @__PURE__ */ new Map();
+  get enabled() {
+    return this.qps > 0;
+  }
+  allow(key) {
+    if (!this.enabled) return true;
+    const burst = this.burst ?? Math.max(this.qps, 1) * 2;
+    const now = Date.now() / 1e3;
+    const [tokens, last] = this.buckets.get(key) ?? [burst, now];
+    const next = Math.min(burst, tokens + (now - last) * this.qps);
+    if (next < 1) {
+      this.buckets.set(key, [next, now]);
+      return false;
+    }
+    this.buckets.set(key, [next - 1, now]);
+    if (this.buckets.size > 1e4) this.buckets.clear();
+    return true;
+  }
+};
 function createApp() {
   enforceRulesContract();
+  hardenExistingPaths();
   const app = new Hono2();
-  app.use("*", cors({ origin: "*", allowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"], allowHeaders: ["*"] }));
+  app.use("*", cors({
+    origin: (o) => allowedOrigins().includes(o) ? o : null,
+    allowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
+    allowHeaders: ["*"]
+  }));
   app.use("*", logger());
+  const pools = new PooledLimiter();
+  const limiter = new RateLimiter(rateLimitQps());
+  app.use("*", async (c, next) => {
+    const path6 = new URL(c.req.url).pathname;
+    const method = c.req.method.toUpperCase();
+    if (method === "OPTIONS") return next();
+    const maxBody = maxBodyBytes();
+    const cl = c.req.header("content-length");
+    if (cl && maxBody > 0) {
+      const n = Number.parseInt(cl, 10);
+      if (Number.isFinite(n) && n > maxBody) {
+        return c.json({ detail: `\u8BF7\u6C42\u4F53\u8D85\u8FC7\u4E0A\u9650 ${maxBody} \u5B57\u8282` }, 413);
+      }
+    }
+    if (originCheckEnabled()) {
+      const origin = c.req.header("origin") || "";
+      if (origin && !originAllowed(origin, c.req.header("host") || "")) {
+        console.warn(`[AgentMoss] \u5DF2\u62E6\u622A\u8DE8\u6E90\u8BF7\u6C42: origin=${origin} path=${path6}`);
+        return c.json({ detail: `\u8DE8\u6E90\u6765\u6E90\u672A\u88AB\u5141\u8BB8: ${origin}` }, 403);
+      }
+    }
+    const [okAuth, principal] = checkRequestAuth(c.req.raw.headers, path6);
+    const isPublicPage = !path6.startsWith("/console/api") && (path6 === "/console" || path6.startsWith("/console/"));
+    if (!okAuth && !isPublicPage) {
+      return c.json({ detail: "Unauthorized: invalid or missing Bearer token" }, 401);
+    }
+    if (limiter.enabled && path6.startsWith("/api/")) {
+      const key = principal ? "p:" + principalHash(principal) : "c:" + (c.req.header("x-forwarded-for") || "local");
+      if (!limiter.allow(key)) {
+        return c.json({ detail: "\u8BF7\u6C42\u8FC7\u4E8E\u9891\u7E41\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5" }, 429);
+      }
+    }
+    const ip = c.req.header("x-forwarded-for") || "local";
+    const keys = [];
+    const take = (key, limit) => {
+      if (pools.tryAcquire(key, limit)) {
+        keys.push(key);
+        return true;
+      }
+      return false;
+    };
+    const busy = (detail, status = 503) => {
+      c.header("Retry-After", "1");
+      c.header("Connection", "close");
+      return c.json({ detail }, status);
+    };
+    try {
+      if (!principal && authEnabled()) {
+        if (!take("unauth:total", unauthInflight())) {
+          return busy("\u672A\u8BA4\u8BC1\u8BF7\u6C42\u5E76\u53D1\u8D85\u9650\uFF0C\u8BF7\u6301\u51ED\u8BC1\u8BBF\u95EE");
+        }
+        if (!take(`unauth:ip:${ip}`, unauthPerIp())) {
+          return busy("\u8BE5\u6765\u6E90\u7684\u672A\u8BA4\u8BC1\u8BF7\u6C42\u5E76\u53D1\u8D85\u9650");
+        }
+      } else {
+        const bound = boundAgentOf(principal);
+        if (bound && !take(`agent:${bound}`, agentInflight())) {
+          return busy(`agent '${bound}' \u7684\u5E76\u53D1\u8D85\u9650\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5`, 429);
+        }
+      }
+      const pool = poolOf(path6);
+      if (!take(`pool:${pool}`, poolLimit(pool))) {
+        const qkey = principal ? "p:" + principalHash(principal) : "c:local";
+        const [qn, abusive] = noteQueueReject(qkey);
+        if (abusive && queueAbuseAction() === "deny") {
+          return busy("\u5E76\u53D1\u62D2\u7EDD\u8FC7\u4E8E\u9891\u7E41\uFF0C\u7591\u4F3C\u6076\u610F\u8BF7\u6C42", 429);
+        }
+        if (abusive) {
+          console.warn(`[AgentMoss] \u26A0\uFE0F \u7591\u4F3C\u6076\u610F\u5E76\u53D1\u5360\u7528: key=${qkey} \u7A97\u53E3\u5185\u88AB\u62D2 ${qn} \u6B21`);
+        }
+        return busy("\u670D\u52A1\u7E41\u5FD9\uFF08\u5E76\u53D1\u5DF2\u6EE1\uFF09\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5");
+      }
+      return await next();
+    } finally {
+      while (keys.length) pools.release(keys.pop());
+    }
+  });
   app.get("/api/v1/health", healthRoute);
   app.post("/api/v1/analyze", analyzeRoute);
   app.post("/api/v1/review", reviewRoute);
@@ -11828,12 +12590,12 @@ function createApp() {
 }
 async function findFreePort(startPort, host = "127.0.0.1", scan = 100) {
   for (let port = startPort; port < startPort + scan; port++) {
-    const free = await new Promise((resolve11) => {
+    const free = await new Promise((resolve12) => {
       const server = net.createServer();
       server.listen(port, host, () => {
-        server.close(() => resolve11(true));
+        server.close(() => resolve12(true));
       });
-      server.on("error", () => resolve11(false));
+      server.on("error", () => resolve12(false));
     });
     if (free) {
       if (port !== startPort) {
@@ -11876,6 +12638,7 @@ async function warmUpEngine() {
   }
 }
 async function startServer(host = "127.0.0.1", port = 9090) {
+  failFastOnAuthError();
   const actualPort = await findFreePort(port, host);
   const app = createApp();
   return {
@@ -11885,7 +12648,12 @@ async function startServer(host = "127.0.0.1", port = 9090) {
       logDeploymentSelfCheck();
       await warmUpEngine();
       const { serve: honoServe } = await import("@hono/node-server");
-      honoServe({ fetch: app.fetch, hostname: host, port: actualPort });
+      const srv = honoServe({ fetch: app.fetch, hostname: host, port: actualPort });
+      try {
+        srv.maxConnections = maxConnections();
+        srv.keepAliveTimeout = keepAliveSec() * 1e3;
+      } catch {
+      }
     }
   };
 }
@@ -11896,28 +12664,29 @@ async function startUnixSocketServer(socketPath = "/var/run/agent_moss/agent_mos
     socketPath,
     close: async () => {
       if (!server) return;
-      await new Promise((resolve11) => {
-        server.close(() => resolve11());
+      await new Promise((resolve12) => {
+        server.close(() => resolve12());
       });
       server = null;
     },
     serve: async () => {
-      const { mkdirSync: mkdirSync8, existsSync: existsSync21, unlinkSync: unlinkSync5 } = await import("fs");
-      const { dirname: dirname13 } = await import("path");
-      const dir = dirname13(socketPath);
+      failFastOnAuthError();
+      const { mkdirSync: mkdirSync8, existsSync: existsSync22, unlinkSync: unlinkSync5 } = await import("fs");
+      const { dirname: dirname14 } = await import("path");
+      const dir = dirname14(socketPath);
       if (dir) {
         try {
           mkdirSync8(dir, { recursive: true });
         } catch {
         }
       }
-      if (existsSync21(socketPath)) {
+      if (existsSync22(socketPath)) {
         const { connect } = await import("net");
-        const inUse = await new Promise((resolve11) => {
+        const inUse = await new Promise((resolve12) => {
           const probe = connect(socketPath);
           const done = (v) => {
             probe.destroy();
-            resolve11(v);
+            resolve12(v);
           };
           probe.once("connect", () => done(true));
           probe.once("error", () => done(false));
@@ -11940,10 +12709,22 @@ async function startUnixSocketServer(socketPath = "/var/run/agent_moss/agent_mos
       const { getRequestListener } = await import("@hono/node-server");
       const { createServer } = await import("http");
       server = createServer(getRequestListener(app.fetch));
-      await new Promise((resolve11, reject) => {
+      try {
+        server.maxConnections = maxConnections();
+        server.keepAliveTimeout = keepAliveSec() * 1e3;
+      } catch {
+      }
+      await new Promise((resolve12, reject) => {
         server.once("error", reject);
-        server.listen(socketPath, () => resolve11());
+        server.listen(socketPath, () => resolve12());
       });
+      try {
+        const { chmodSync: chmodSync2 } = await import("fs");
+        chmodSync2(socketPath, socketMode());
+        console.log(`[AgentMoss] socket \u6743\u9650: 0${socketMode().toString(8)}\uFF08AGENT_MOSS_SOCKET_MODE\uFF09`);
+      } catch (e) {
+        console.warn(`[AgentMoss] \u8BBE\u7F6E socket \u6743\u9650\u5931\u8D25: ${String(e)}`);
+      }
       console.log(`AgentMoss HTTP server on unix socket: ${socketPath}`);
     }
   };