@kenhkl/agent-moss 0.16.4 → 0.16.6

package/dist/engine/coordinator.js

@@ -110,18 +110,41 @@ function hasCommandSubstitution(text) {
   return CMD_SUBSTITUTION.test(text);
 }
 function splitCommandSegments(command) {
-  return command.split(CMD_SEPARATORS).map((s) => s.trim()).filter((s) => s.length > 0);
+  const segments = [];
+  let cur = "";
+  let quote = null;
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+    if (quote) {
+      cur += ch;
+      if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      cur += ch;
+      continue;
+    }
+    if (/\||&|;|\n/.test(ch)) {
+      segments.push(cur);
+      segments.push(ch);
+      cur = "";
+      continue;
+    }
+    cur += ch;
+  }
+  if (cur) segments.push(cur);
+  return segments.map((s) => s.trim()).filter((s) => s.length > 0 && !/^(?:\|\||&&|[|;&])$/.test(s));
 }
 function extractFirstCommand(command) {
   const segments = splitCommandSegments(command);
   return segments.length ? segments[0] : "";
 }
-var CMD_SEPARATORS, CMD_SUBSTITUTION;
+var CMD_SUBSTITUTION;
 var init_shell_split = __esm({
   "src/engine/shell-split.ts"() {
     "use strict";
     init_esm_shims();
-    CMD_SEPARATORS = /\|\||&&|[|;&\n]/;
     CMD_SUBSTITUTION = /\$\(|`|</;
   }
 });
@@ -372,20 +395,25 @@ var init_runtime_config_bridge = __esm({
 });
 
 // src/infra/rules-loader.ts
-import { readFileSync as readFileSync2, existsSync } from "fs";
-import { resolve, dirname } from "path";
+import { readFileSync as readFileSync2, existsSync, readdirSync, statSync } from "fs";
+import { resolve, dirname, join as join2 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function dataRootDir() {
   return getDataRoot();
 }
-function overrideRulesDir() {
-  return resolve(dataRootDir(), "rules");
+function parseDirEnv(envName) {
+  const raw = (process.env[envName] || "").trim();
+  if (!raw) return [];
+  return raw.split(/[,;]/).map((s) => s.trim()).filter(Boolean).map((s) => resolve(s));
+}
+function overrideRulesDirs() {
+  return [...parseDirEnv("AGENT_MOSS_OVERRIDE_RULES_DIR"), resolve(dataRootDir(), "rules")];
 }
 function warnOverride(name, path5, data) {
   if (warnedOverride.has(path5)) return;
   warnedOverride.add(path5);
   console.warn(
-    `[AgentMoss] \u89C4\u5219\u6587\u4EF6\u88AB\u7528\u6237\u6570\u636E\u76EE\u5F55\u8986\u76D6: ${path5}\uFF08\u5185\u7F6E\u9ED8\u8BA4\u88AB\u5FFD\u7565\uFF09\u3002\u8BE5\u6587\u4EF6\u7531\u90E8\u7F72\u4FA7\u81EA\u884C\u7EF4\u62A4 \u2014\u2014 **\u5185\u7F6E\u89C4\u5219\u66F4\u65B0\u4E0D\u4F1A\u53CD\u6620\u5230\u5B83\u4E0A\u9762**\uFF1B\u5220\u9664\u8BE5\u6587\u4EF6\u5373\u6062\u590D\u5185\u7F6E\u89C4\u5219\u3002\u82E5\u53EA\u60F3\u9010\u6761\u542F\u505C/\u589E\u5220\uFF0C\u8BF7\u6539\u7528 runtime config\uFF08Console\uFF09\u3002`
+    `[AgentMoss] \u89C4\u5219\u6587\u4EF6\u88AB\u8986\u76D6\u76EE\u5F55\u8986\u76D6: ${path5}\uFF08\u5185\u7F6E\u9ED8\u8BA4\u88AB\u5FFD\u7565\uFF09\u3002\u8BE5\u6587\u4EF6\u7531\u90E8\u7F72\u4FA7\u81EA\u884C\u7EF4\u62A4 \u2014\u2014 **\u5185\u7F6E\u89C4\u5219\u66F4\u65B0\u4E0D\u4F1A\u53CD\u6620\u5230\u5B83\u4E0A\u9762**\uFF1B\u5220\u9664\u8BE5\u6587\u4EF6\uFF08\u6216\u6E05\u7A7A AGENT_MOSS_OVERRIDE_RULES_DIR\uFF09\u5373\u6062\u590D\u5185\u7F6E\u89C4\u5219\u3002\u82E5\u53EA\u60F3\u9010\u6761\u542F\u505C/\u589E\u5220\uFF0C\u8BF7\u6539\u7528 runtime config\uFF08Console\uFF09\u3002`
   );
   const missing = (EXPECTED_KEYS[name] || []).filter((k) => !(k in data));
   if (missing.length > 0) {
@@ -395,18 +423,23 @@ function warnOverride(name, path5, data) {
   }
 }
 function findRulesFile(name) {
-  const override = resolve(overrideRulesDir(), name);
-  if (existsSync(override)) return override;
+  for (const dir of overrideRulesDirs()) {
+    const p = resolve(dir, name);
+    if (existsSync(p)) return p;
+  }
   for (const dir of RULES_DIR_CANDS) {
     const p = resolve(dir, name);
     if (existsSync(p)) return p;
   }
   return null;
 }
+function isOverridePath(name, p) {
+  return overrideRulesDirs().some((dir) => resolve(dir, name) === p);
+}
 function loadJson(name) {
   const p = findRulesFile(name);
   if (!p) return {};
-  const isOverride = p === resolve(overrideRulesDir(), name);
+  const isOverride = isOverridePath(name, p);
   let data;
   try {
     data = JSON.parse(readFileSync2(p, "utf-8")) || {};
@@ -417,6 +450,14 @@ function loadJson(name) {
   if (isOverride) warnOverride(name, p, data);
   return data;
 }
+function resolveScenarioRulesFile(scenarioId) {
+  const rel = join2("scenarios", scenarioId, "rules.json");
+  for (const dir of overrideRulesDirs()) {
+    const p = resolve(dir, rel);
+    if (existsSync(p)) return p;
+  }
+  return null;
+}
 function loadL1() {
   return loadJson("l1_rules.json");
 }
@@ -449,7 +490,138 @@ function loadMC() {
 function loadToolRegistry() {
   return loadJson("tool_registry.json");
 }
-var __filename2, __dirname2, EXPECTED_KEYS, warnedOverride, RULES_DIR_CANDS;
+function extraRulesDirs() {
+  return parseDirEnv("AGENT_MOSS_EXTRA_RULES_DIR");
+}
+function listJsonFilesDeep(dir) {
+  const out = [];
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true }).map((d) => d.name);
+  } catch {
+    return out;
+  }
+  for (const name of entries.sort()) {
+    const p = resolve(dir, name);
+    let isDir = false;
+    try {
+      isDir = statSync(p).isDirectory();
+    } catch {
+      continue;
+    }
+    if (isDir) out.push(...listJsonFilesDeep(p));
+    else if (name.toLowerCase().endsWith(".json")) out.push(p);
+  }
+  return out;
+}
+function scanExtraFiles(files) {
+  const data = {};
+  const loaded = [];
+  const seenIds = /* @__PURE__ */ new Map();
+  const classifyFlat = (r) => {
+    for (const [keys, cat] of EXTRA_FLAT_FIELD) {
+      if (r && typeof r === "object" && keys.every((k) => r[k])) return cat;
+    }
+    return null;
+  };
+  for (const p of files) {
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync2(p, "utf-8"));
+    } catch (e) {
+      console.warn(`[AgentMoss] \u8FFD\u52A0\u89C4\u5219\u6587\u4EF6\u635F\u574F/\u4E0D\u53EF\u8BFB\uFF0C\u5DF2\u8DF3\u8FC7: ${p}\uFF08${e.message}\uFF09`);
+      continue;
+    }
+    let pairs = [];
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      pairs = Object.entries(parsed);
+    } else if (Array.isArray(parsed)) {
+      let flatBad = 0;
+      for (const r of parsed) {
+        const cat = classifyFlat(r);
+        if (cat === null) {
+          flatBad += 1;
+          continue;
+        }
+        pairs.push([cat, [r]]);
+      }
+      if (flatBad > 0) {
+        console.warn(
+          `[AgentMoss] \u8FFD\u52A0\u89C4\u5219\u6587\u4EF6 ${p} \u6709 ${flatBad} \u6761\u5E73\u94FA\u6761\u76EE\u65E0\u6CD5\u5F52\u7C7B\uFF08\u88F8 pattern \u4E0D\u5E26 risk_level/risk_type \u65F6\u533A\u5206\u4E0D\u4E86 L1 \u5371\u9669\u547D\u4EE4\u4E0E L2 \u6388\u6743\u7C7B\uFF09\u2014\u2014 \u8BF7\u6539\u7528\u5BF9\u8C61\u5F62\u5F0F\uFF1A{"\u7C7B\u522B\u952E": [\u6761\u76EE...]}\u3002`
+        );
+      }
+    } else {
+      console.warn(
+        `[AgentMoss] \u8FFD\u52A0\u89C4\u5219\u6587\u4EF6 ${p} \u9876\u5C42\u5E94\u662F\u5BF9\u8C61\uFF08\u7C7B\u522B\u952E\u2192\u6761\u76EE\u6570\u7EC4\uFF09\u6216\u6570\u7EC4\uFF0C\u5DF2\u8DF3\u8FC7\u3002`
+      );
+      continue;
+    }
+    let nLoaded = 0;
+    for (const [cat, rules] of pairs) {
+      const required = EXTRA_CATEGORIES[cat];
+      if (!required) {
+        console.warn(
+          `[AgentMoss] \u8FFD\u52A0\u89C4\u5219\u6587\u4EF6 ${p} \u542B\u672A\u77E5\u7C7B\u522B\u952E "${cat}"\uFF08\u53EF\u7528\uFF1A${Object.keys(EXTRA_CATEGORIES).join(", ")}\uFF09\u2014\u2014 \u5DF2\u8DF3\u8FC7\u8BE5\u7C7B\u522B\u3002`
+        );
+        continue;
+      }
+      if (!Array.isArray(rules)) {
+        console.warn(`[AgentMoss] \u8FFD\u52A0\u89C4\u5219\u6587\u4EF6 ${p} \u7C7B\u522B ${cat} \u7684\u503C\u5E94\u662F\u6570\u7EC4 \u2014\u2014 \u5DF2\u8DF3\u8FC7\u3002`);
+        continue;
+      }
+      for (const r of rules) {
+        if (!r || typeof r !== "object" || !required.every((k) => r[k])) {
+          console.warn(
+            `[AgentMoss] \u8FFD\u52A0\u89C4\u5219\u6587\u4EF6 ${p} \u7C7B\u522B ${cat} \u6709\u6761\u76EE\u7F3A\u5FC5\u9700\u5B57\u6BB5 [${required.join(", ")}] \u2014\u2014 \u5DF2\u8DF3\u8FC7\u8BE5\u6761\u3002`
+          );
+          continue;
+        }
+        const rid = r && typeof r === "object" ? String(r.id || "") : "";
+        if (rid) {
+          if (seenIds.has(rid)) {
+            console.warn(
+              `[AgentMoss] \u8FFD\u52A0\u89C4\u5219 id "${rid}" \u91CD\u590D\uFF08\u5148\u89C1\u4E8E ${seenIds.get(rid)}\uFF0C\u672C\u6761\u6765\u81EA ${p}\uFF09\u2014\u2014 \u5DF2\u8DF3\u8FC7\u672C\u6761\u3002`
+            );
+            continue;
+          }
+          seenIds.set(rid, p);
+        }
+        (data[cat] = data[cat] || []).push(r);
+        nLoaded += 1;
+      }
+    }
+    if (nLoaded > 0) {
+      loaded.push(p);
+      console.info(`[AgentMoss] \u5DF2\u52A0\u8F7D\u8FFD\u52A0\u89C4\u5219\u6587\u4EF6 ${p}\uFF1A${nLoaded} \u6761`);
+    }
+  }
+  return { data, loaded };
+}
+function loadExtraRules() {
+  const raw = (process.env.AGENT_MOSS_EXTRA_RULES_DIR || "").trim();
+  const dirs = extraRulesDirs();
+  let files = [];
+  for (const d of dirs) {
+    if (existsSync(d)) files.push(...listJsonFilesDeep(d));
+    else console.warn(`[AgentMoss] \u8FFD\u52A0\u89C4\u5219\u76EE\u5F55\u4E0D\u5B58\u5728\uFF0C\u5DF2\u8DF3\u8FC7: ${d}\uFF08AGENT_MOSS_EXTRA_RULES_DIR\uFF09`);
+  }
+  files = files.sort();
+  const fp = files.map((p) => {
+    try {
+      const st = statSync(p);
+      return [p, st.mtimeMs, st.size];
+    } catch {
+      return [p, -1, -1];
+    }
+  });
+  if (extraCache && extraCache.raw === raw && JSON.stringify(extraCache.fp) === JSON.stringify(fp)) {
+    return extraCache.data;
+  }
+  const { data, loaded } = scanExtraFiles(files);
+  extraCache = { raw, fp, data, loaded };
+  return data;
+}
+var __filename2, __dirname2, EXPECTED_KEYS, warnedOverride, RULES_DIR_CANDS, EXTRA_CATEGORIES, EXTRA_FLAT_FIELD, extraCache;
 var init_rules_loader = __esm({
   "src/infra/rules-loader.ts"() {
     "use strict";
@@ -484,6 +656,22 @@ var init_rules_loader = __esm({
       ];
       return cands.filter((c) => existsSync(c));
     })();
+    EXTRA_CATEGORIES = {
+      dangerous_commands: ["pattern"],
+      injection_detection: ["keyword", "lang"],
+      sensitive_path_access: ["path"],
+      intent_consistency: ["intent_keywords"],
+      password_modify_consent: ["pattern"],
+      user_deletion_consent: ["pattern"]
+    };
+    EXTRA_FLAT_FIELD = [
+      [["path"], "sensitive_path_access"],
+      [["keyword", "lang"], "injection_detection"],
+      [["intent_keywords"], "intent_consistency"],
+      [["pattern", "risk_level"], "dangerous_commands"],
+      [["pattern", "risk_type"], "dangerous_commands"]
+    ];
+    extraCache = null;
   }
 });
 
@@ -700,7 +888,9 @@ var init_platform_traits = __esm({
         /^ag(?:\s|$)/i,
         /^rg(?:\s|$)/i,
         /^awk\s+/i,
-        /^sed\s+/i,
+        // NEW-FN-P（M03）：sed -i/--in-place 是原地写，挡出白名单走 L2 read_before_write。
+        // 前瞻放最前（外层 ^sed\s+ 会消费 -i 前的空格）。与 Python profiles/linux.py 对齐。
+        /^(?!.*(?:\s|['"])-[a-zA-Z]*i[a-zA-Z]*\b)(?!.*(?:\s|['"])--in-place)sed\s+/i,
         /^cut\s+/i,
         /^sort(?:\s|$)/i,
         /^uniq(?:\s|$)/i,
@@ -936,8 +1126,8 @@ function isWriteOperation(actionType, actionDetail, writeKeywords = WRITE_KEYWOR
   if (writeKeywords.some((kw) => actionType.includes(kw) || actionDetail.includes(kw))) return true;
   const { writeCommandRes } = getPlatformTraits(osType);
   if (writeCommandRes.some((rx) => rx.test(actionDetail))) return true;
-  if (/\bsed\s+-[a-zA-Z]*i/i.test(actionDetail)) return true;
-  for (const seg of actionDetail.split(/&&|\|\||;|\n/)) {
+  if (SED_INPLACE_RE.test(actionDetail)) return true;
+  for (const seg of splitCommandSegments(actionDetail)) {
     const trimmed = seg.trim();
     if (!trimmed) continue;
     const parts = trimmed.split(/\s+/);
@@ -1165,11 +1355,11 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
     const hasRedirectWrite = />{1,2}\s*(?!&)\S/.test(detailNoQuotes);
     let hasWriteSeg = hasRedirectWrite;
     if (!hasWriteSeg) {
-      for (const seg of actionDetail.split(/&&|\|\||;|\n/)) {
+      for (const seg of splitCommandSegments(actionDetail)) {
         const trimmed = seg.trim();
         if (!trimmed) continue;
         const fw = trimmed.split(/\s+/)[0]?.toLowerCase() || "";
-        if (WRITE_CMDS.has(fw) || /\bsed\s+-[a-zA-Z]*i/i.test(trimmed)) {
+        if (WRITE_CMDS.has(fw) || SED_INPLACE_RE.test(trimmed)) {
           hasWriteSeg = true;
           break;
         }
@@ -1188,14 +1378,15 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
   const SOURCE_ARG_CMDS = /* @__PURE__ */ new Set(["cp", "mv", "install", "rsync"]);
   const REDIRECT_TARGET_RE = new RegExp(`>{1,2}\\s*(?!&)(?:'(/[^']+)'|"(/[^\\"]+)"|(/[^\\s;|&><'\\"]+))`);
   const targetPaths = [];
-  for (const seg of actionDetail.split(/&&|\|\||;|\n/)) {
+  for (const seg of splitCommandSegments(actionDetail)) {
     const trimmed = seg.trim();
     if (!trimmed) continue;
     const firstWord = trimmed.split(/\s+/)[0]?.toLowerCase() || "";
     if (firstWord === "cd") {
       continue;
     }
-    if (getPlatformTraits(osType).readOnlyCommands.has(firstWord)) {
+    if (firstWord === "sed" && SED_INPLACE_RE.test(trimmed)) {
+    } else if (getPlatformTraits(osType).readOnlyCommands.has(firstWord)) {
       const segUnquoted = trimmed.replace(new RegExp(`>{1,2}\\s*(['"])([~./][^'"]+)\\1`, "g"), (_m, _q, p) => ">" + p);
       const segNoDevnull = segUnquoted.replace(DEVNULL_REDIRECT_RE, "");
       const segNoQuotes = segNoDevnull.replace(/'[^']*'|"[^"]*"/g, "");
@@ -1310,7 +1501,7 @@ function checkUserDeletionConsent(actionType, actionDetail, actionHistory, osTyp
 }
 function containsPrivilegeEscalation(actionDetail) {
   const ad = actionDetail.toLowerCase();
-  for (const seg of ad.split(/&&|\|\||;|\n/)) {
+  for (const seg of splitCommandSegments(ad)) {
     const trimmed = seg.trim();
     if (!trimmed) continue;
     const parts = trimmed.split(/\s+/);
@@ -1399,7 +1590,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd, osType) {
     violatedLayers: ["L2.1"]
   };
 }
-var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, WRITE_KEYWORDS, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
+var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, ROOT_SENSITIVE_PATHS_WINDOWS, HOME_SENSITIVE_PATHS_WINDOWS, CREDENTIAL_PATHS_WINDOWS, ROOT_SENSITIVE_PATHS_MACOS, HOME_SENSITIVE_PATHS_MACOS, CREDENTIAL_PATHS_MACOS, ROOT_SENSITIVE_PATHS_HARMONY, HOME_SENSITIVE_PATHS_HARMONY, CREDENTIAL_PATHS_HARMONY, _scopeIndex, NON_WRITE_TOOLS, NON_WRITE_TOOL_PREFIXES, WRITE_KEYWORDS, SED_INPLACE_RE, DEVNULL_REDIRECT_RE, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, COMBO_STAGES, COMBO_CHAINS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
 var init_logic_rules = __esm({
   "src/engine/logic-rules.ts"() {
     "use strict";
@@ -1408,6 +1599,7 @@ var init_logic_rules = __esm({
     init_runtime_config_bridge();
     init_rules_loader();
     init_platform_traits();
+    init_shell_split();
     ROOT_SENSITIVE_PATHS = _loadSensitivePathScope("root");
     HOME_SENSITIVE_PATHS = _loadSensitivePathScope("home");
     CREDENTIAL_PATHS = _loadSensitivePathScope("credential").map(({ path: path5, riskLevel, desc, dirDelOnly }) => ({ path: path5, riskLevel, desc, credential: true, dirDelOnly }));
@@ -1442,6 +1634,7 @@ var init_logic_rules = __esm({
     ]);
     NON_WRITE_TOOL_PREFIXES = ["memory-", "skill-manager-", "mailbox-", "app-"];
     WRITE_KEYWORDS = ["write", "\u5199\u5165", "save", "\u4FDD\u5B58", "modify", "\u4FEE\u6539", "update", "\u66F4\u65B0", "delete", "\u5220\u9664", "remove", "\u79FB\u9664", "create", "\u521B\u5EFA", "append", "\u8FFD\u52A0", "truncate", "\u622A\u65AD", "overwrite", "\u8986\u76D6", "replace", "\u66FF\u6362", "edit"];
+    SED_INPLACE_RE = /\bsed\s+(?:-\S+\s+)*(?:-[a-zA-Z]*i[a-zA-Z]*|--in-place)\b/i;
     DEVNULL_REDIRECT_RE = /(?:2|&|1)?\s*>\s*\/dev\/null\b/g;
     CREATE_KEYWORDS = ["\u521B\u5EFA", "\u65B0\u5EFA", "create", "new file", "touch"];
     PASSWORD_MODIFY_PATTERNS = (() => {
@@ -1518,7 +1711,7 @@ var init_asset_dir = __esm({
 });
 
 // src/engine/skill-loader.ts
-import { readFileSync as readFileSync3, readdirSync as readdirSync2, existsSync as existsSync4 } from "fs";
+import { readFileSync as readFileSync3, readdirSync as readdirSync3, existsSync as existsSync4 } from "fs";
 import { resolve as resolve3, dirname as dirname2 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function loadAllSkills() {
@@ -1530,7 +1723,7 @@ function loadAllSkills() {
     console.warn("[AgentMoss] Skills directory not found:", primary, "and fallback:", fallback);
     return cachedSkills;
   }
-  const files = readdirSync2(dir).filter((f) => f.endsWith(".md"));
+  const files = readdirSync3(dir).filter((f) => f.endsWith(".md"));
   for (const f of files) {
     const name = f.replace(".md", "");
     cachedSkills[name] = readFileSync3(resolve3(dir, f), "utf-8");
@@ -1709,7 +1902,7 @@ __export(runtime_config_exports, {
   updateSkillCategoryEnabled: () => updateSkillCategoryEnabled,
   updateSkillEnabled: () => updateSkillEnabled
 });
-import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync5, mkdirSync, unlinkSync, readdirSync as readdirSync3, statSync } from "fs";
+import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync5, mkdirSync, unlinkSync, readdirSync as readdirSync4, statSync as statSync2 } from "fs";
 import { join as join3 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import { dirname as dirname3 } from "path";
@@ -1755,7 +1948,7 @@ function loadRuntimeConfig() {
     return seeded;
   }
   try {
-    const st = statSync(p);
+    const st = statSync2(p);
     const cacheKey = `${p}|${st.mtimeMs}|${st.size}`;
     if (runtimeConfigCache && runtimeConfigCache.key === cacheKey) {
       return runtimeConfigCache.value;
@@ -1836,9 +2029,18 @@ function _mergeUserCustom(primary, runtime, layers, key) {
   const extra = _userCustomRules(runtime, layers, key);
   return extra.length > 0 ? [...primary, ...extra] : [...primary];
 }
+function _mergeExtraDirRules(primary, category) {
+  try {
+    const extra = loadExtraRules()[category] || [];
+    return extra.length > 0 ? [...primary, ...extra] : [...primary];
+  } catch {
+    return [...primary];
+  }
+}
 function getEnabledL1CommandPatterns(runtime, osType) {
   const cat = runtime.L1_rules?.dangerous_commands || { category_enabled: true, rules: [] };
   let rules = filterEnabledRules(cat.rules || [], cat.category_enabled);
+  rules = _mergeExtraDirRules(rules, "dangerous_commands");
   rules = _mergeUserCustom(rules, runtime, "L1_rules", "pattern");
   if (osType) rules = _filterRulesByOs(rules, osType);
   return rules.map((r) => ({
@@ -1854,6 +2056,7 @@ function getEnabledL2SensitivePaths(runtime, osType) {
     cat = runtime.L2_rules?.sensitive_path_access || { category_enabled: true, rules: [] };
   }
   let rules = filterEnabledRules(cat.rules || [], cat.category_enabled);
+  rules = _mergeExtraDirRules(rules, "sensitive_path_access");
   rules = _mergeUserCustom(rules, runtime, ["L1_rules", "L2_rules"], "path");
   if (osType) rules = _filterRulesByOs(rules, osType);
   return rules.map((r) => {
@@ -1868,7 +2071,7 @@ function hasRuntimeConfig() {
   const p = getRuntimeConfigPath();
   let key;
   try {
-    const st = statSync(p);
+    const st = statSync2(p);
     key = `${p}|${st.mtimeMs}|${st.size}`;
   } catch {
     return false;
@@ -2098,12 +2301,12 @@ function _scenarioRulesToDefaults() {
   if (!existsSync5(scenDir)) return out;
   let entries;
   try {
-    entries = readdirSync3(scenDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    entries = readdirSync4(scenDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
     return out;
   }
   for (const scenarioId of entries) {
-    const rulesFile = join3(scenDir, scenarioId, "rules.json");
+    const rulesFile = resolveScenarioRulesFile(scenarioId) ?? join3(scenDir, scenarioId, "rules.json");
     if (!existsSync5(rulesFile)) continue;
     let data;
     try {
@@ -2147,7 +2350,7 @@ function _agentRulesToDefaults() {
   if (!existsSync5(agentsDir)) return out;
   let entries;
   try {
-    entries = readdirSync3(agentsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    entries = readdirSync4(agentsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
     return out;
   }
@@ -2485,6 +2688,7 @@ function _migrateCategoriesAcrossLayers(cfg, srcLayer, dstLayer, catNames) {
 function getEnabledL1InjectionKeywords(runtime, osType) {
   const cat = runtime.L1_rules?.injection_detection || { category_enabled: true, rules: [] };
   let rules = filterEnabledRules(cat.rules || [], cat.category_enabled);
+  rules = _mergeExtraDirRules(rules, "injection_detection");
   rules = _mergeUserCustom(rules, runtime, "L1_rules", "keyword");
   if (osType) rules = _filterRulesByOs(rules, osType);
   return rules.map((r) => ({
@@ -2496,6 +2700,7 @@ function getEnabledL1InjectionKeywords(runtime, osType) {
 function getEnabledL2IntentPatterns(runtime, osType) {
   const cat = runtime.L2_rules?.intent_consistency || { category_enabled: true, rules: [] };
   let rules = filterEnabledRules(cat.rules || [], cat.category_enabled);
+  rules = _mergeExtraDirRules(rules, "intent_consistency");
   rules = _mergeUserCustom(rules, runtime, "L2_rules", "intent_keywords");
   if (osType) rules = _filterRulesByOs(rules, osType);
   return rules.map((r) => ({
@@ -2506,12 +2711,22 @@ function getEnabledL2IntentPatterns(runtime, osType) {
 }
 function getEnabledL2PasswordPatterns(runtime) {
   const cat = runtime.L2_rules?.password_modify_consent || { category_enabled: true, rules: [] };
-  const rules = _mergeUserCustom(filterEnabledRules(cat.rules || [], cat.category_enabled), runtime, "L2_rules", "pattern");
+  const rules = _mergeUserCustom(
+    _mergeExtraDirRules(filterEnabledRules(cat.rules || [], cat.category_enabled), "password_modify_consent"),
+    runtime,
+    "L2_rules",
+    "pattern"
+  );
   return rules.map((r) => r.pattern || "");
 }
 function getEnabledL2UserDeletionPatterns(runtime) {
   const cat = runtime.L2_rules?.user_deletion_consent || { category_enabled: true, rules: [] };
-  const rules = _mergeUserCustom(filterEnabledRules(cat.rules || [], cat.category_enabled), runtime, "L2_rules", "pattern");
+  const rules = _mergeUserCustom(
+    _mergeExtraDirRules(filterEnabledRules(cat.rules || [], cat.category_enabled), "user_deletion_consent"),
+    runtime,
+    "L2_rules",
+    "pattern"
+  );
   return rules.map((r) => r.pattern || "");
 }
 function isL2CategoryEnabled(runtime, categoryKey) {
@@ -2543,28 +2758,48 @@ function getEnabledL1CommandPatternsOrDefault(runtime, osType) {
   if (_hasRulesForOs(cat?.rules, osType)) {
     return getEnabledL1CommandPatterns(runtime, osType);
   }
-  return _mergeUserCustom(_filterDefaultsByOs(_l1CommandPatternsToRules(), osType), runtime, "L1_rules", "pattern");
+  return _mergeUserCustom(
+    _mergeExtraDirRules(_filterDefaultsByOs(_l1CommandPatternsToRules(), osType), "dangerous_commands"),
+    runtime,
+    "L1_rules",
+    "pattern"
+  );
 }
 function getEnabledL1InjectionKeywordsOrDefault(runtime, osType) {
   const cat = runtime.L1_rules?.injection_detection;
   if (_hasRulesForOs(cat?.rules, osType)) {
     return getEnabledL1InjectionKeywords(runtime, osType);
   }
-  return _mergeUserCustom(_l1InjectionKeywordsToRules(), runtime, "L1_rules", "keyword");
+  return _mergeUserCustom(
+    _mergeExtraDirRules(_l1InjectionKeywordsToRules(), "injection_detection"),
+    runtime,
+    "L1_rules",
+    "keyword"
+  );
 }
 function getEnabledL2SensitivePathsOrDefault(runtime, osType) {
   const spCat = _sensitivePathCategoryOf(runtime);
   if (_hasRulesForOs(spCat?.rules, osType)) {
     return getEnabledL2SensitivePaths(runtime, osType);
   }
-  return _mergeUserCustom(_filterDefaultsByOs(_l2SensitivePathsToRules(), osType), runtime, ["L1_rules", "L2_rules"], "path");
+  return _mergeUserCustom(
+    _mergeExtraDirRules(_filterDefaultsByOs(_l2SensitivePathsToRules(), osType), "sensitive_path_access"),
+    runtime,
+    ["L1_rules", "L2_rules"],
+    "path"
+  );
 }
 function getEnabledL2IntentPatternsOrDefault(runtime, osType) {
   const cat = runtime.L2_rules?.intent_consistency;
   if (_hasRulesForOs(cat?.rules, osType)) {
     return getEnabledL2IntentPatterns(runtime, osType);
   }
-  return _mergeUserCustom(_filterDefaultsByOs(_l2IntentPatternsToRules(), osType), runtime, "L2_rules", "intent_keywords");
+  return _mergeUserCustom(
+    _mergeExtraDirRules(_filterDefaultsByOs(_l2IntentPatternsToRules(), osType), "intent_consistency"),
+    runtime,
+    "L2_rules",
+    "intent_keywords"
+  );
 }
 function getEnabledL2PasswordPatternsOrDefault(runtime, osType) {
   const cat = runtime.L2_rules?.password_modify_consent;
@@ -2960,6 +3195,7 @@ var init_runtime_config = __esm({
     init_heuristic();
     init_logic_rules();
     init_skill_loader();
+    init_rules_loader();
     init_runtime_config_bridge();
     __dirname4 = dirname3(fileURLToPath4(import.meta.url));
     ENV_RUNTIME_CONFIG_PATH = "AGENT_MOSS_RUNTIME_CONFIG_PATH";
@@ -3020,7 +3256,9 @@ __export(config_exports, {
   isLLMAvailable: () => isLLMAvailable,
   isLogicRulesEnabled: () => isLogicRulesEnabled,
   probeLLMConnection: () => probeLLMConnection,
-  updateLLMConfig: () => updateLLMConfig
+  updateLLMConfig: () => updateLLMConfig,
+  userRuleVariantPattern: () => userRuleVariantPattern,
+  wildcardToRegExp: () => wildcardToRegExp
 });
 import fs2 from "fs";
 import path2 from "path";
@@ -3117,6 +3355,8 @@ function loadCustomRules() {
         const p = r?.pattern;
         if (!p) continue;
         rules.push({ pattern: wildcardToRegExp(p), action: "Deny", severity: "high" });
+        const variant = userRuleVariantPattern(p);
+        if (variant) rules.push({ pattern: wildcardToRegExp(variant), action: "Deny", severity: "high" });
       }
       break;
     } catch {
@@ -3124,6 +3364,15 @@ function loadCustomRules() {
   }
   return rules;
 }
+function userRuleVariantPattern(pattern) {
+  const tokens = pattern.split(/\s+/);
+  if (tokens.length >= 3 && tokens[1] === "*" && tokens[2] !== "*") {
+    let variant = [tokens[0], ...tokens.slice(2)].join(" ");
+    if (!variant.endsWith("*")) variant += " *";
+    return variant;
+  }
+  return null;
+}
 function getLLMConfig() {
   return llmConfig;
 }
@@ -3360,15 +3609,27 @@ function getScenarioExtensions(scenarioId) {
   if (!scenarioId) return null;
   if (cache2.has(scenarioId)) return cache2.get(scenarioId) ?? null;
   let ext = null;
+  let overrideHit = null;
   try {
-    if (hasRuntimeConfig()) {
-      ext = getEnabledScenarioExtensions(loadRuntimeConfig(), scenarioId);
-    }
+    overrideHit = resolveScenarioRulesFile(scenarioId);
   } catch {
   }
+  if (!overrideHit) {
+    try {
+      if (hasRuntimeConfig()) {
+        ext = getEnabledScenarioExtensions(loadRuntimeConfig(), scenarioId);
+      }
+    } catch {
+    }
+  }
   if (ext === null) {
-    const scenariosDir = resolveScenariosDir();
-    const rulesFile = resolve5(scenariosDir, scenarioId, "rules.json");
+    const builtinFile = resolve5(resolveScenariosDir(), scenarioId, "rules.json");
+    const rulesFile = overrideHit ?? builtinFile;
+    if (overrideHit) {
+      console.warn(
+        `[AgentMoss] \u26A0\uFE0F  \u573A\u666F ${scenarioId} \u89C4\u5219\u88AB\u8986\u76D6\u76EE\u5F55\u8986\u76D6: ${overrideHit}\uFF08\u5185\u7F6E\u9ED8\u8BA4 ${builtinFile} \u88AB\u5FFD\u7565\uFF09\u3002\u8BE5\u6587\u4EF6\u7531\u90E8\u7F72\u4FA7\u81EA\u884C\u7EF4\u62A4\uFF0C\u5185\u7F6E\u573A\u666F\u89C4\u5219\u66F4\u65B0\u4E0D\u4F1A\u53CD\u6620\u5230\u5B83\u4E0A\u9762\u3002`
+      );
+    }
     if (!existsSync7(rulesFile)) {
       cache2.set(scenarioId, null);
       return null;
@@ -3420,6 +3681,7 @@ var init_scenarios = __esm({
     init_esm_shims();
     init_agents();
     init_runtime_config();
+    init_rules_loader();
     __filename5 = fileURLToPath7(import.meta.url);
     __dirname6 = dirname5(__filename5);
     SCENARIOS_DIR_PROD = resolve5(__dirname6, "scenarios");
@@ -3485,16 +3747,41 @@ function scanDangerousCommandPatterns(actionType, actionDetail, osType) {
     violatedLayers: ["L1.1"]
   };
 }
+function allUrlsLoopback(actionDetail) {
+  const hosts = actionDetail.match(new RegExp(LOOPBACK_URL_RE.source, "gi"));
+  if (!hosts || hosts.length === 0) return false;
+  return hosts.every((u) => {
+    const raw = u.replace(/^https?:\/\//i, "");
+    const host = raw.split("@").pop().split(":")[0].replace(/^\[|\]$/g, "").toLowerCase();
+    return LOOPBACK_HOSTS.has(host) || host.startsWith("127.");
+  });
+}
+function stripEchoParamsForUserRules(actionDetail) {
+  return splitCommandSegments2(actionDetail).map((seg) => {
+    const m = seg.match(/^(echo|printf)(?![a-zA-Z0-9_])\s*/i);
+    if (!m) return seg;
+    const head = m[1].toLowerCase();
+    const rest = seg.slice(m[0].length);
+    const cut = rest.search(/>+|\|/);
+    return `${head} ` + (cut >= 0 ? rest.slice(cut) : "");
+  }).join(" ");
+}
 function runHeuristicCheck(input) {
   const command = `${input.aNext.actionType}: ${input.aNext.actionDetail}`;
   const matched = [];
   let highestSeverity = "low";
   let highestRiskType = "";
   const userRules = getCustomRules();
+  const atLower = input.aNext.actionType.toLowerCase();
+  const isBashLike = ["bash", "executebash", "terminal-executebash"].includes(atLower);
+  const urlsAllLoopback = allUrlsLoopback(input.aNext.actionDetail);
+  const userRuleScanDetail = isBashLike ? stripEchoParamsForUserRules(input.aNext.actionDetail) : input.aNext.actionDetail;
+  const scanCommand = `${input.aNext.actionType}: ${userRuleScanDetail}`;
   for (const rule of userRules) {
     try {
       const re = new RegExp(rule.pattern);
-      if (re.test(command)) {
+      if (re.test(command) || re.test(scanCommand)) {
+        if (urlsAllLoopback) continue;
         if (rule.action === "Deny") {
           return {
             allowed: false,
@@ -3677,6 +3964,23 @@ function buildPathContext(actionDetail) {
   if (!lines.length) return "";
   return "## \u8DEF\u5F84\u89E3\u6790\u4E8B\u5B9E\uFF08\u8BCD\u6CD5\u5206\u6790\uFF0C\u786E\u5B9A\u6027\u7ED3\u8BBA\uFF09\n" + lines.join("\n") + "\n\n## \u8FD0\u884C\u65F6\u672A\u9A8C\u8BC1\uFF08\u4F9B\u53C2\u8003\uFF0C\u975E\u4E8B\u5B9E\uFF09\n- \u5206\u6790\u5668\u4E0D\u8BFB\u6587\u4EF6\u7CFB\u7EDF\uFF1A\u65E0\u6CD5\u786E\u8BA4\u8DEF\u5F84\u4E2D\u7684\u4E2D\u95F4\u76EE\u5F55\u662F\u5426\u4E3A\u7B26\u53F7\u94FE\u63A5\uFF1B\u82E5\u4E2D\u95F4\u6BB5\u5728\u6267\u884C\u65F6\u662F\uFF08\u6216\u88AB\u66FF\u6362\u4E3A\uFF09\u6307\u5411\u4E3B\u76EE\u5F55\u5916\u7684\u8F6F\u94FE\uFF0C\u5B9E\u9645\u64CD\u4F5C\u76EE\u6807\u53EF\u80FD\u968F\u4E4B\u6539\u53D8\u3002\u8BCD\u6CD5\u89E3\u6790\u7ED3\u679C\u57FA\u4E8E\u6807\u51C6\u8DEF\u5F84\u8BED\u4E49\uFF0C\u4E0D\u5E94\u56E0\u731C\u6D4B\u300C\u89E3\u6790\u4F9D\u8D56\u67D0\u6BB5\u662F\u5426\u5B58\u5728\u300D\u800C\u5426\u5B9A\u5B83\u3002";
 }
+function isPurePrintCode(code) {
+  if (code.includes("\\")) return false;
+  if (PY_EXEC_IO_RE.test(code) || PY_BIGNUM_RE.test(code)) return false;
+  return PY_PRINT_RE.test(code) || !/\w+\s*\(/.test(code);
+}
+function stripInlinePythonLiterals(text) {
+  const subst = (_m, g1, g2, g3) => isPurePrintCode(g2 ?? g3 ?? "") ? "$(<<pylit>>)" : _m;
+  const plain = (_m, g1, g2, g3) => {
+    if (!isPurePrintCode(g2 ?? g3 ?? "")) return _m;
+    const q = _m.trimEnd().endsWith('"') ? '"' : "'";
+    return `${g1} -c ${q}<<pylit>>${q}`;
+  };
+  let out = text;
+  out = out.replace(new RegExp(PY_CMD_SUBST_C_RE.source, PY_CMD_SUBST_C_RE.flags), subst);
+  out = out.replace(new RegExp(PY_INLINE_C_RE.source, PY_INLINE_C_RE.flags), plain);
+  return out;
+}
 function stripLiteralTextSegments(actionDetail) {
   const writeScriptExec = />\s*[/~]\S*\.(sh|py|pl|rb)\b/.test(actionDetail) && /(?:&&|\|\||;|\n|\|)\s*(?:bash|sh|zsh|dash|python|perl|ruby|node)/.test(actionDetail);
   const pipeToInterpreter = /\|\s*(?:bash|sh|zsh|dash|python|perl|ruby|node|crontab|at)\b/.test(actionDetail);
@@ -3687,13 +3991,14 @@ function stripLiteralTextSegments(actionDetail) {
   for (const seg of splitCommandSegments2(actionDetail)) {
     const fw = (seg.trim().split(/\s+/)[0] || "").toLowerCase();
     if (fw === "echo" || fw === "printf") {
-      const segUnquotedRedirect = seg.replace(
+      const segPy = stripInlinePythonLiterals(seg);
+      const segUnquotedRedirect = segPy.replace(
         />{1,2}\s*(['"])([~./][^'"]+)\1/g,
         (_m, _q, p) => ">" + p
       );
       resultParts.push(segUnquotedRedirect.replace(/'[^']*'|"[^"]*"/g, ""));
     } else {
-      resultParts.push(seg);
+      resultParts.push(stripInlinePythonLiterals(seg));
     }
   }
   return resultParts.join("");
@@ -4217,7 +4522,7 @@ function checkLateralMovement(actionDetail) {
   }
   return null;
 }
-var INJECTION_KEYWORDS, DANGEROUS_PATTERNS2, DANGEROUS_PATTERNS_WINDOWS, DANGEROUS_PATTERNS_MACOS, DANGEROUS_PATTERNS_HARMONY, PATH_CONTEXT_TRIGGER_RE, HOME_PREFIX_RE, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES, HOME_TARGET_RE, HOME_ASSIGN_RE;
+var INJECTION_KEYWORDS, DANGEROUS_PATTERNS2, DANGEROUS_PATTERNS_WINDOWS, DANGEROUS_PATTERNS_MACOS, DANGEROUS_PATTERNS_HARMONY, LOOPBACK_URL_RE, LOOPBACK_HOSTS, PATH_CONTEXT_TRIGGER_RE, HOME_PREFIX_RE, PY_EXEC_IO_RE, PY_PRINT_RE, PY_BIGNUM_RE, PY_INLINE_C_RE, PY_CMD_SUBST_C_RE, SENSITIVE_EXCLUDED_PREFIXES, SEARCH_ACTION_PREFIXES, HOME_TARGET_RE, HOME_ASSIGN_RE;
 var init_heuristic = __esm({
   "src/engine/heuristic.ts"() {
     "use strict";
@@ -4241,8 +4546,15 @@ var init_heuristic = __esm({
     DANGEROUS_PATTERNS_WINDOWS = _loadDangerousPatterns("windows");
     DANGEROUS_PATTERNS_MACOS = _loadDangerousPatterns("macos");
     DANGEROUS_PATTERNS_HARMONY = _loadDangerousPatterns("harmony");
+    LOOPBACK_URL_RE = /https?:\/\/([^\/\s;'"|&)]+)/i;
+    LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "::1", "0.0.0.0", "[::1]"]);
     PATH_CONTEXT_TRIGGER_RE = /(?:^|[;&|]\s*)(?:rm|rmdir|unlink|ln|mv|cp|dd|truncate|shred|chmod|chown)\b/i;
     HOME_PREFIX_RE = /(?:~|~(?=\/)|\$HOME\b|\$\{HOME\}|\/home\/[a-z0-9_.-]+)/gi;
+    PY_EXEC_IO_RE = /os\.system|os\.popen|subprocess|eval\s*\(|exec\s*\(|__import__|open\s*\(|socket|urllib|requests\.|shutil|os\.(?:remove|unlink|rename|makedirs?|listdir|scandir|walk|chmod|chown|kill|environ)|iterdir|glob\s*\(|path\(/i;
+    PY_PRINT_RE = /\b(?:print|sys\.stdout\.write)\s*\(/;
+    PY_BIGNUM_RE = /\d{6,}/;
+    PY_INLINE_C_RE = /(python(?:3(?:\.\d+)?)?|perl5?|ruby|node|php|lua)\s+(?:-[a-zA-Z]+\s+)*-c\s+(?:"([^"]*)"|'([^']*)')/i;
+    PY_CMD_SUBST_C_RE = /\$\(\s*(python(?:3(?:\.\d+)?)?|perl5?|ruby|node|php|lua)\s+(?:-[a-zA-Z]+\s+)*-c\s+(?:"([^"]*)"'|'([^']*)')\s*\)/i;
     SENSITIVE_EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
     SEARCH_ACTION_PREFIXES = ["search-", "web-", "browser-", "query-", "websearch", "web_search"];
     HOME_TARGET_RE = /(?:^|[\s="'($])(?:~|(?:\$home|\$\{home\}))(?:\/(?:\.\*|\*|\.)?)?(?=[\s"';}|&)]|$)/i;
@@ -4661,7 +4973,7 @@ init_heuristic();
 init_config();
 init_logic_rules();
 init_inline_analyzer();
-import { statSync as statSync3, existsSync as existsSync10 } from "fs";
+import { statSync as statSync4, existsSync as existsSync10 } from "fs";
 import { resolve as resolve9, join as join6, isAbsolute as isAbsolute2 } from "path";
 import { homedir as homedir3 } from "os";
 
@@ -5901,6 +6213,28 @@ function parseIf(content, args) {
 ${chosen}
 ${content.slice(fiPos + 2)}`;
 }
+var HEREDOC_RE = /<<-?\s*['"]?(\w+)['"]?/;
+function stripNonExecutableLines(content) {
+  if (!content) return content;
+  const out = [];
+  let heredocEnd = null;
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (heredocEnd !== null) {
+      if (line.trim() === heredocEnd) heredocEnd = null;
+      out.push(line);
+      continue;
+    }
+    const m = HEREDOC_RE.exec(line);
+    if (m) heredocEnd = m[1];
+    const stripped = line.replace(/^\s+/, "");
+    if (i === 0 && stripped.startsWith("#!")) continue;
+    if (stripped.startsWith("#")) continue;
+    out.push(line);
+  }
+  return out.join("\n");
+}
 function markLoopsReachable(content) {
   return content;
 }
@@ -5951,6 +6285,7 @@ var ShellBackend = class {
         bound = symOut;
       }
     }
+    bound = stripNonExecutableLines(bound);
     const loopMarked = markLoopsReachable(bound);
     const calls = extractCallsFromContent(loopMarked);
     return {
@@ -6343,7 +6678,7 @@ function extractInlineScriptPath(actionDetail) {
           try {
             const resolved = resolvePath2(tok.replace(/^['"]|['"]$/g, ""));
             if (existsSync10(resolved)) {
-              const stat = statSync3(resolved);
+              const stat = statSync4(resolved);
               if (stat.isFile()) return resolved;
             }
           } catch {
@@ -6357,7 +6692,7 @@ function extractInlineScriptPath(actionDetail) {
       try {
         const resolved = resolvePath2(p);
         if (existsSync10(resolved)) {
-          const stat = statSync3(resolved);
+          const stat = statSync4(resolved);
           if (stat.isFile()) return resolved;
         }
       } catch {
@@ -6373,7 +6708,7 @@ function extractInlineScriptPath(actionDetail) {
     try {
       resolved = resolvePath2(p);
       if (existsSync10(resolved)) {
-        const stat = statSync3(resolved);
+        const stat = statSync4(resolved);
         if (stat.isFile()) return resolved;
       }
     } catch {
@@ -6417,7 +6752,30 @@ function resolvePath2(p) {
   }
   return resolve9(expanded);
 }
-function scanScriptChainWithL1(chain, input) {
+function scanExtensionPatterns(ext, content) {
+  const pats = ext?.extra_command_patterns;
+  if (!pats || pats.length === 0) return null;
+  for (const p of pats) {
+    const src = typeof p === "string" ? p : p?.pattern;
+    if (!src) continue;
+    let re;
+    try {
+      re = new RegExp(src, "i");
+    } catch {
+      continue;
+    }
+    if (re.test(content)) {
+      const risk = typeof p === "string" ? "high" : p.risk_level || "high";
+      return {
+        riskLevel: risk,
+        riskType: typeof p === "string" ? "sensitive_action" : p.risk_type || "sensitive_action",
+        reason: typeof p === "string" ? `\u547D\u4E2D\u6269\u5C55\u89C4\u5219: ${src}` : p.reason || `\u547D\u4E2D\u6269\u5C55\u89C4\u5219: ${src}`
+      };
+    }
+  }
+  return null;
+}
+function scanScriptChainWithL1(chain, input, ext) {
   for (const node of chain.nodes) {
     if (node.error || !node.preprocessedContent || node.l1Hit) continue;
     const virtualInput = {
@@ -6425,6 +6783,19 @@ function scanScriptChainWithL1(chain, input) {
       aNext: { actionType: "bash", actionDetail: node.preprocessedContent }
     };
     const l1 = scanDangerousCommandPatterns("bash", node.preprocessedContent, input.osType);
+    const extHit = scanExtensionPatterns(ext, node.preprocessedContent);
+    if (extHit) {
+      node.l1Hit = true;
+      node.l1RiskLevel = extHit.riskLevel;
+      node.l1RiskType = extHit.riskType;
+      node.l1Reason = extHit.reason;
+      if (extHit.riskLevel === "critical") {
+        chain.hasCritical = true;
+        chain.firstHitNode = node;
+        break;
+      }
+      continue;
+    }
     if (l1 && !l1.allowed) {
       node.l1Hit = true;
       node.l1RiskLevel = l1.riskLevel;
@@ -6488,7 +6859,7 @@ function scanScriptChainKeywords(chain) {
   }
   return chain;
 }
-function analyzeScriptContent2(input) {
+function analyzeScriptContent2(input, ext) {
   const actionType = input.aNext.actionType.toLowerCase();
   if (actionType !== "bash") return emptyChain();
   const { path: scriptPath, args: scriptArgs } = extractScriptPathWithArgs(input.aNext.actionDetail);
@@ -6520,7 +6891,7 @@ function analyzeScriptContent2(input) {
   const tracker = new RecursiveTracker(l1Adapter);
   const chain = tracker.track(resolvedPath, isInline ? null : scriptArgs, input.cwd || process.cwd());
   if (chain.nodes.length === 0) return chain;
-  scanScriptChainWithL1(chain, input);
+  scanScriptChainWithL1(chain, input, ext);
   scanScriptChainWithL2(chain, input);
   scanScriptChainKeywords(chain);
   return chain;
@@ -8343,9 +8714,13 @@ async function runAnalysis(input) {
       }
     }
   }
+  const agentExt = mergeAgentExtensions(
+    isLayerEnabled("agent_rules_enabled") ? getAgentExtensions(input.agentId) : null,
+    isLayerEnabled("scenario_rules_enabled") ? getScenarioExtensionsMulti(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "") : null
+  );
   let scriptChain = null;
   if (input.aNext.actionType.toLowerCase() === "bash") {
-    scriptChain = analyzeScriptContent2(input);
+    scriptChain = analyzeScriptContent2(input, agentExt);
     if (scriptChain.nodes.length > 0) {
       for (const node of scriptChain.nodes) {
         if (node.unanalyzable) {
@@ -8397,10 +8772,6 @@ async function runAnalysis(input) {
   const actionType = input.aNext.actionType.toLowerCase();
   const rawDetail = extractRawCommand(input.aNext.actionDetail);
   const lowerDetail = rawDetail.toLowerCase();
-  const agentExt = mergeAgentExtensions(
-    isLayerEnabled("agent_rules_enabled") ? getAgentExtensions(input.agentId) : null,
-    isLayerEnabled("scenario_rules_enabled") ? getScenarioExtensionsMulti(input.scenarioId || process.env.AGENT_MOSS_SCENARIO || "") : null
-  );
   if (FULLY_SAFE_TOOLS.has(actionType)) {
     return {
       allowed: true,