@kenhkl/agent-moss 0.16.9 → 0.16.12

package/dist/cli.js

@@ -22,6 +22,99 @@ var init_esm_shims = __esm({
   }
 });
 
+// src/package-json.ts
+import { createRequire } from "module";
+var require2, pkg, version;
+var init_package_json = __esm({
+  "src/package-json.ts"() {
+    "use strict";
+    init_esm_shims();
+    require2 = createRequire(import.meta.url);
+    pkg = require2("../package.json");
+    version = pkg.version;
+  }
+});
+
+// src/models.ts
+import { z } from "zod";
+var ActionItemSchema, PromptTurnSchema, AnalyzeRequestSchema, AnalyzeResponseSchema, HealthResponseSchema, ReviewRequestSchema, ReviewResponseSchema;
+var init_models = __esm({
+  "src/models.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_package_json();
+    ActionItemSchema = z.object({
+      action_type: z.string().describe("Action type, e.g. bash, file_read, file_write"),
+      action_detail: z.string().describe("Action detail / command content"),
+      // 工具返回给 agent 的内容。仅 L2 的授权（consent）判定用：判断「用户是否已授权」
+      // 看的是 ask_user_question 的**回答**，不是提问正文。历史 bug：模型里没有这个字段、
+      // 路由也没透传，TS 的授权判定退化成「提问正文非空」，等于问过任何问题即已授权。
+      output: z.string().optional().describe("Tool result / user answer (needed by L2 consent checks)")
+    });
+    PromptTurnSchema = z.object({
+      text: z.string().default("").describe("User prompt text at this turn"),
+      actions: z.array(ActionItemSchema).default([]).describe("Actions triggered by this prompt, in order, until the next prompt")
+    });
+    AnalyzeRequestSchema = z.object({
+      session_id: z.string().describe("Session / agent unique identifier"),
+      prompt_session: z.string().default("").describe("User original prompt (most recent user message; backward compat)"),
+      prompt_history: z.array(PromptTurnSchema).default([]).describe("Full interleaved prompt history (ordered turns, each with its triggered actions). Optional; empty = fall back to prompt_session only."),
+      action_history: z.array(ActionItemSchema).default([]).describe("Historical action sequence"),
+      session_history: z.array(z.object({
+        session_id: z.string(),
+        action_history: z.array(ActionItemSchema).default([])
+      })).default([]).describe("Multi-session historical actions (optional): for L2.2 formal engine cross-session combo-chain / sensitive-data-flow verification. Provided by caller (incl. future agentgate)."),
+      a_next: ActionItemSchema.describe("Next action to be executed"),
+      reason: z.string().default("").describe("Reason for executing this action"),
+      os_type: z.string().default("").describe("OS type: 'linux', 'windows', or empty for auto-detect"),
+      cwd: z.string().default("").describe("Current working directory"),
+      agent_id: z.string().default("").describe("Caller agent identifier, e.g. 'xiaoo' / 'opencode' / 'opendesk'. Empty = generic mode (no agent-specific rules)."),
+      metadata: z.record(z.unknown()).optional().describe("Extended metadata")
+    });
+    AnalyzeResponseSchema = z.object({
+      decision: z.enum(["Allow", "Deny"]).describe("Allow or Deny"),
+      reason: z.string().describe("Decision reason"),
+      risk_level: z.enum(["low", "medium", "high", "critical"]).default("low"),
+      risk_type: z.string().default(""),
+      violated_layers: z.array(z.string()).default([]),
+      policy: z.string().default(""),
+      violated_policy: z.string().default(""),
+      confidence: z.number().int().min(0).max(100).default(100),
+      analysis_duration_ms: z.number().default(0),
+      // 组合攻击链反例路径：每步 [session_id, seq, stage, timestamp]，含真实发生时间
+      violation_chain: z.array(z.array(z.union([z.string(), z.number()]).nullable())).default([])
+    });
+    HealthResponseSchema = z.object({
+      status: z.string().default("healthy"),
+      version: z.string().default(version),
+      // 归属实例标识：值来自 env AGENT_MOSS_INSTANCE（spawn/systemd 注入），默认空串。
+      // 多个 agentmoss 同机并存时，调用方按 instance 过滤避免连到别人的进程。
+      // 空=未配置（独立部署或旧版），调用方可选择兼容或严格过滤。
+      instance: z.string().default("")
+    });
+    ReviewRequestSchema = z.object({
+      agent_id: z.string().default("").describe("\u76EE\u6807 agent \u6807\u8BC6\uFF08\u51B3\u5B9A\u72B6\u6001\u5E93\u5206\u6876\uFF09"),
+      db_path: z.string().default("").describe("AgentGate \u672C\u5730\u5B58\u50A8\u8DEF\u5F84\uFF08SQLite \u6587\u4EF6 \u6216 tool_calls JSON \u76EE\u5F55\uFF09\uFF1B\u4E3A\u7A7A\u5219\u7528 sessions"),
+      sessions: z.array(z.object({
+        session_id: z.string(),
+        action_history: z.array(ActionItemSchema).default([])
+      })).default([]).describe("\u591A session \u5386\u53F2\u52A8\u4F5C\uFF08\u66FF\u4EE3/\u515C\u5E95 db_path\uFF09"),
+      a_next: ActionItemSchema.optional().describe("\u53EF\u9009\uFF1Aseed \u540E\u8FDE\u540C\u5F53\u524D\u52A8\u4F5C\u4E00\u8D77\u5224\u5B9A"),
+      is_error: z.boolean().default(false).describe("\u5F53\u524D\u52A8\u4F5C\u6267\u884C\u662F\u5426\u5931\u8D25"),
+      output_pending: z.boolean().default(false).describe("\u8FD4\u56DE\u524D\u5E8F\u94FE\u6E05\u5355 pending_prefixes")
+    });
+    ReviewResponseSchema = z.object({
+      agent_id: z.string().default(""),
+      seeded_nodes: z.number().default(0),
+      verified: z.boolean().default(true),
+      violations: z.array(z.record(z.unknown())).default([]),
+      pending_prefixes: z.array(z.record(z.unknown())).default([]),
+      state_nodes: z.number().default(0),
+      discovered_patterns: z.array(z.record(z.unknown())).default([]).describe("\u6570\u636E\u9A71\u52A8\u53D1\u73B0\uFF1A\u8DE8 session \u9891\u7E41\u5371\u9669\u7EC4\u5408\uFF08\u9884\u7F6E\u94FE\u76F2\u533A\uFF0CPatternMiner\uFF09")
+    });
+  }
+});
+
 // src/infra/paths.ts
 import { join } from "path";
 import { homedir } from "os";
@@ -407,71 +500,60 @@ function parseDirEnv(envName) {
   if (!raw) return [];
   return raw.split(/[,;]/).map((s) => s.trim()).filter(Boolean).map((s) => resolve(s));
 }
-function overrideRulesDirs() {
-  return [...parseDirEnv("AGENT_MOSS_OVERRIDE_RULES_DIR"), resolve(dataRootDir(), "rules")];
-}
-function warnOverride(name, path6, data) {
-  if (warnedOverride.has(path6)) return;
-  warnedOverride.add(path6);
-  console.warn(
-    `[AgentMoss] \u89C4\u5219\u6587\u4EF6\u88AB\u8986\u76D6\u76EE\u5F55\u8986\u76D6: ${path6}\uFF08\u5185\u7F6E\u9ED8\u8BA4\u88AB\u5FFD\u7565\uFF09\u3002\u8BE5\u6587\u4EF6\u7531\u90E8\u7F72\u4FA7\u81EA\u884C\u7EF4\u62A4 \u2014\u2014 **\u5185\u7F6E\u89C4\u5219\u66F4\u65B0\u4E0D\u4F1A\u53CD\u6620\u5230\u5B83\u4E0A\u9762**\uFF1B\u5220\u9664\u8BE5\u6587\u4EF6\uFF08\u6216\u6E05\u7A7A AGENT_MOSS_OVERRIDE_RULES_DIR\uFF09\u5373\u6062\u590D\u5185\u7F6E\u89C4\u5219\u3002\u82E5\u53EA\u60F3\u9010\u6761\u542F\u505C/\u589E\u5220\uFF0C\u8BF7\u6539\u7528 runtime config\uFF08Console\uFF09\u3002`
-  );
-  const missing = (EXPECTED_KEYS[name] || []).filter((k) => !(k in data));
-  if (missing.length > 0) {
-    console.warn(
-      `\u26A0\uFE0F  [AgentMoss] \u8986\u76D6\u6587\u4EF6 ${path6} \u7F3A\u5C11\u9876\u5C42\u952E [${missing.join(", ")}] \u2014\u2014 \u5BF9\u5E94\u7C7B\u522B\u4F1A**\u4E00\u6761\u89C4\u5219\u90FD\u4E0D\u8DD1**\uFF08\u9759\u9ED8\u5931\u6548\uFF09\u3002\u82E5\u53EA\u60F3\u6539\u5176\u4E2D\u4E00\u7C7B\uFF0C\u8BF7\u5148\u62F7\u8D1D\u5B8C\u6574\u7684\u5185\u7F6E\u6587\u4EF6\u518D\u6539\u3002`
-    );
-  }
-}
-function overriddenRuleFiles() {
-  const out = [];
-  for (const name of Object.keys(EXPECTED_KEYS)) {
-    for (const dir of overrideRulesDirs()) {
-      const p = resolve(dir, name);
-      if (existsSync(p)) {
-        out.push(p);
-        break;
-      }
-    }
-  }
-  return out;
+function rulesDirs() {
+  const dirs = [];
+  for (const env of RULES_DIR_ENVS) dirs.push(...parseDirEnv(env));
+  dirs.push(resolve(dataRootDir(), "rules"));
+  return [...new Set(dirs)];
 }
 function findRulesFile(name) {
-  for (const dir of overrideRulesDirs()) {
-    const p = resolve(dir, name);
-    if (existsSync(p)) return p;
-  }
   for (const dir of RULES_DIR_CANDS) {
     const p = resolve(dir, name);
     if (existsSync(p)) return p;
   }
   return null;
 }
-function isOverridePath(name, p) {
-  return overrideRulesDirs().some((dir) => resolve(dir, name) === p);
+function resolveRulesFile(name) {
+  return findRulesFile(name);
 }
 function loadJson(name) {
   const p = findRulesFile(name);
   if (!p) return {};
-  const isOverride = isOverridePath(name, p);
-  let data;
   try {
-    data = JSON.parse(readFileSync2(p, "utf-8")) || {};
+    return JSON.parse(readFileSync2(p, "utf-8")) || {};
   } catch {
-    if (isOverride) warnOverride(name, p, {});
     return {};
   }
-  if (isOverride) warnOverride(name, p, data);
-  return data;
 }
 function resolveScenarioRulesFile(scenarioId) {
   const rel = join2("scenarios", scenarioId, "rules.json");
-  for (const dir of overrideRulesDirs()) {
+  for (const dir of rulesDirs()) {
     const p = resolve(dir, rel);
-    if (existsSync(p)) return p;
+    if (!existsSync(p)) continue;
+    let reason = "";
+    try {
+      reason = invalidScenarioRulesReason(JSON.parse(readFileSync2(p, "utf-8")) || {});
+    } catch (err) {
+      reason = `\u8BFB\u53D6/\u89E3\u6790\u5931\u8D25: ${String(err)}`;
+    }
+    if (reason) {
+      console.error(
+        `[AgentMoss] \u274C \u573A\u666F\u89C4\u5219\u8986\u76D6\u6587\u4EF6\u7ED3\u6784\u4E0D\u53EF\u7528\uFF0C**\u5DF2\u5FFD\u7565\u5E76\u56DE\u9000\u5185\u7F6E**: ${p}
+    \u539F\u56E0: ${reason}`
+      );
+      return null;
+    }
+    console.warn(`[AgentMoss] \u26A0\uFE0F  \u573A\u666F ${scenarioId} \u89C4\u5219\u88AB\u8986\u76D6: ${p}\uFF08\u5185\u7F6E\u66F4\u65B0\u4E0D\u4F1A\u53CD\u6620\u5230\u5B83\u4E0A\u9762\uFF09`);
+    return p;
   }
   return null;
 }
+function invalidScenarioRulesReason(data) {
+  if (!data || typeof data !== "object" || Array.isArray(data)) {
+    return `\u9876\u5C42\u5FC5\u987B\u662F JSON \u5BF9\u8C61\uFF0C\u5B9E\u9645\u662F ${Array.isArray(data) ? "array" : typeof data}`;
+  }
+  return SCENARIO_LIST_KEYS.filter((k) => k in data && !Array.isArray(data[k])).map((k) => `"${k}" \u5E94\u4E3A\u6570\u7EC4\uFF08\u5BF9\u8C61\u6570\u7EC4\uFF09\uFF0C\u5B9E\u9645\u662F ${typeof data[k]}`).join("\uFF1B");
+}
 function loadL1() {
   return loadJson("l1_rules.json");
 }
@@ -479,10 +561,40 @@ function loadL2() {
   return loadJson("l2_rules.json");
 }
 function loadL3() {
-  return loadJson("l3_rules.json");
+  const data = { ...loadJson("l3_rules.json") };
+  try {
+    const ov = loadOverrideRules().skills;
+    const ex = loadExtraRules().skills || {};
+    if (ov && typeof ov === "object") {
+      for (const [cat, skills] of Object.entries(ov)) data[cat] = { ...skills };
+    }
+    if (ex && typeof ex === "object") {
+      for (const [cat, skills] of Object.entries(ex)) data[cat] = { ...data[cat] || {}, ...skills };
+    }
+  } catch {
+  }
+  return data;
+}
+function loadMCRaw() {
+  const mc = { ...loadJson("mc_rules.json") };
+  let rules = [...mc.rules || []];
+  try {
+    const ov = loadOverrideRules().ltl_rules;
+    const ex = loadExtraRules().ltl_rules || [];
+    if (Array.isArray(ov)) rules = [...ov];
+    if (Array.isArray(ex) && ex.length > 0) {
+      const byId = /* @__PURE__ */ new Map();
+      for (const r of rules) if (r && r.id) byId.set(r.id, r);
+      for (const r of ex) if (r && r.id) byId.set(r.id, r);
+      rules = [...byId.values()];
+    }
+  } catch {
+  }
+  mc.rules = rules;
+  return mc;
 }
 function loadMC() {
-  const mc = loadJson("mc_rules.json");
+  const mc = loadMCRaw();
   const rules = mc.rules || [];
   try {
     const rt = runtimeConfigBridge.current;
@@ -502,144 +614,284 @@ function loadMC() {
   return mc;
 }
 function loadToolRegistry() {
-  return loadJson("tool_registry.json");
-}
-function extraRulesDirs() {
-  return parseDirEnv("AGENT_MOSS_EXTRA_RULES_DIR");
-}
-function listJsonFilesDeep(dir) {
-  const out = [];
-  let entries;
+  const data = { ...loadJson("tool_registry.json") };
+  let tools = { ...data.tools || {} };
   try {
-    entries = readdirSync(dir, { withFileTypes: true }).map((d) => d.name);
+    const ov = loadOverrideRules().tools;
+    const ex = loadExtraRules().tools || {};
+    if (ov && typeof ov === "object") tools = { ...ov };
+    if (ex && typeof ex === "object") tools = { ...tools, ...ex };
   } catch {
-    return out;
   }
-  for (const name of entries.sort()) {
-    const p = resolve(dir, name);
-    let isDir = false;
-    try {
-      isDir = statSync(p).isDirectory();
-    } catch {
-      continue;
+  data.tools = tools;
+  return data;
+}
+function scanStructEntry(cat, value, path6) {
+  if (cat === "skills") {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      console.error(`[AgentMoss] \u89C4\u5219\u6587\u4EF6 ${path6} \u7684 skills \u5E94\u4E3A\u5BF9\u8C61\uFF08{\u7C7B\u522B: {\u6280\u80FD\u540D: [\u5173\u952E\u8BCD]}}\uFF09\u2014\u2014 \u5DF2\u8DF3\u8FC7\u3002`);
+      return null;
+    }
+    const out = {};
+    for (const [skCat, skills] of Object.entries(value)) {
+      if (!skills || typeof skills !== "object" || Array.isArray(skills)) {
+        console.error(`[AgentMoss] \u89C4\u5219\u6587\u4EF6 ${path6} \u7684 skills.${skCat} \u5E94\u4E3A\u5BF9\u8C61\uFF08\u6280\u80FD\u540D \u2192 \u5173\u952E\u8BCD\u6570\u7EC4\uFF09\u2014\u2014 \u5DF2\u8DF3\u8FC7\u8BE5\u7C7B\u522B\u3002`);
+        continue;
+      }
+      const keep = {};
+      for (const [name, kws] of Object.entries(skills)) {
+        if (Array.isArray(kws)) keep[name] = kws;
+        else console.warn(`[AgentMoss] \u89C4\u5219\u6587\u4EF6 ${path6} \u7684 skills.${skCat}.${name} \u5173\u952E\u8BCD\u4E0D\u662F\u6570\u7EC4 \u2014\u2014 \u5DF2\u8DF3\u8FC7\u8BE5\u6761\u3002`);
+      }
+      if (Object.keys(keep).length > 0) out[skCat] = keep;
     }
-    if (isDir) out.push(...listJsonFilesDeep(p));
-    else if (name.toLowerCase().endsWith(".json")) out.push(p);
+    return Object.keys(out).length > 0 ? out : null;
   }
-  return out;
+  if (cat === "ltl_rules") {
+    if (!Array.isArray(value)) {
+      console.error(`[AgentMoss] \u89C4\u5219\u6587\u4EF6 ${path6} \u7684 ltl_rules \u5E94\u4E3A\u5BF9\u8C61\u6570\u7EC4 \u2014\u2014 \u5DF2\u8DF3\u8FC7\u3002`);
+      return null;
+    }
+    const keep = value.filter((r) => r && typeof r === "object" && r.id);
+    if (keep.length !== value.length) {
+      console.warn(`[AgentMoss] \u89C4\u5219\u6587\u4EF6 ${path6} \u7684 ltl_rules \u6709\u6761\u76EE\u7F3A id \u6216\u4E0D\u662F\u5BF9\u8C61 \u2014\u2014 \u5DF2\u8DF3\u8FC7\u8BE5\u6761\u3002`);
+    }
+    return keep.length > 0 ? keep : null;
+  }
+  if (cat === "tools") {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      console.error(`[AgentMoss] \u89C4\u5219\u6587\u4EF6 ${path6} \u7684 tools \u5E94\u4E3A\u5BF9\u8C61\uFF08{\u5DE5\u5177\u540D: {actionClass, ...}}\uFF09\u2014\u2014 \u5DF2\u8DF3\u8FC7\u3002`);
+      return null;
+    }
+    const keep = {};
+    for (const [k, v] of Object.entries(value)) {
+      if (v && typeof v === "object" && !Array.isArray(v)) keep[k] = v;
+      else console.warn(`[AgentMoss] \u89C4\u5219\u6587\u4EF6 ${path6} \u7684 tools.${k} \u4E0D\u662F\u5BF9\u8C61 \u2014\u2014 \u5DF2\u8DF3\u8FC7\u8BE5\u6761\u3002`);
+    }
+    return Object.keys(keep).length > 0 ? keep : null;
+  }
+  return null;
 }
-function scanExtraFiles(files) {
-  const data = {};
-  const loaded = [];
-  const seenIds = /* @__PURE__ */ new Map();
+function scanRulesFile(path6, kind) {
+  const out = {};
+  const label = kind === "override" ? "\u8986\u76D6" : "\u8FFD\u52A0";
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync2(path6, "utf-8"));
+  } catch (e) {
+    console.error(`[AgentMoss] \u89C4\u5219\u6587\u4EF6 ${path6} \u635F\u574F/\u4E0D\u53EF\u8BFB\uFF0C\u5DF2\u8DF3\u8FC7\uFF08${kind} \u89C4\u5219\u4E0D\u751F\u6548\uFF09: ${e.message}`);
+    return out;
+  }
   const classifyFlat = (r) => {
     for (const [keys, cat] of EXTRA_FLAT_FIELD) {
       if (r && typeof r === "object" && keys.every((k) => r[k])) return cat;
     }
     return null;
   };
-  for (const p of files) {
-    let parsed;
-    try {
-      parsed = JSON.parse(readFileSync2(p, "utf-8"));
-    } catch (e) {
-      console.warn(`[AgentMoss] \u8FFD\u52A0\u89C4\u5219\u6587\u4EF6\u635F\u574F/\u4E0D\u53EF\u8BFB\uFF0C\u5DF2\u8DF3\u8FC7: ${p}\uFF08${e.message}\uFF09`);
+  let pairs = [];
+  if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+    pairs = Object.entries(parsed);
+  } else if (Array.isArray(parsed)) {
+    let flatBad = 0;
+    for (const r of parsed) {
+      const cat = classifyFlat(r);
+      if (cat === null) {
+        flatBad += 1;
+        continue;
+      }
+      pairs.push([cat, [r]]);
+    }
+    if (flatBad > 0) {
+      console.warn(
+        `[AgentMoss] \u89C4\u5219\u6587\u4EF6 ${path6} \u6709 ${flatBad} \u6761\u5E73\u94FA\u6761\u76EE\u65E0\u6CD5\u5F52\u7C7B\uFF08\u88F8 pattern \u4E0D\u5E26 risk_level/risk_type \u65F6\u533A\u5206\u4E0D\u4E86 L1 \u5371\u9669\u547D\u4EE4\u4E0E L2 \u6388\u6743\u7C7B\uFF09\u2014\u2014 \u8BF7\u6539\u7528\u5BF9\u8C61\u5F62\u5F0F\uFF1A{"\u7C7B\u522B\u952E": [\u6761\u76EE...]}\u3002`
+      );
+    }
+  } else {
+    console.error(`[AgentMoss] \u89C4\u5219\u6587\u4EF6 ${path6} \u9876\u5C42\u5E94\u662F\u5BF9\u8C61\uFF08\u7C7B\u522B\u952E\u2192\u6761\u76EE\u6570\u7EC4\uFF09\u6216\u6570\u7EC4\uFF0C\u5DF2\u8DF3\u8FC7\u3002`);
+    return out;
+  }
+  for (const [cat, rules] of pairs) {
+    if (String(cat).startsWith("_")) continue;
+    if (STRUCT_KEYS.includes(cat)) {
+      const got = scanStructEntry(cat, rules, path6);
+      if (got !== null) out[cat] = got;
       continue;
     }
-    let pairs = [];
-    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-      pairs = Object.entries(parsed);
-    } else if (Array.isArray(parsed)) {
-      let flatBad = 0;
-      for (const r of parsed) {
-        const cat = classifyFlat(r);
-        if (cat === null) {
-          flatBad += 1;
-          continue;
-        }
-        pairs.push([cat, [r]]);
-      }
-      if (flatBad > 0) {
-        console.warn(
-          `[AgentMoss] \u8FFD\u52A0\u89C4\u5219\u6587\u4EF6 ${p} \u6709 ${flatBad} \u6761\u5E73\u94FA\u6761\u76EE\u65E0\u6CD5\u5F52\u7C7B\uFF08\u88F8 pattern \u4E0D\u5E26 risk_level/risk_type \u65F6\u533A\u5206\u4E0D\u4E86 L1 \u5371\u9669\u547D\u4EE4\u4E0E L2 \u6388\u6743\u7C7B\uFF09\u2014\u2014 \u8BF7\u6539\u7528\u5BF9\u8C61\u5F62\u5F0F\uFF1A{"\u7C7B\u522B\u952E": [\u6761\u76EE...]}\u3002`
-        );
-      }
-    } else {
+    const required = EXTRA_CATEGORIES[cat];
+    if (!required) {
       console.warn(
-        `[AgentMoss] \u8FFD\u52A0\u89C4\u5219\u6587\u4EF6 ${p} \u9876\u5C42\u5E94\u662F\u5BF9\u8C61\uFF08\u7C7B\u522B\u952E\u2192\u6761\u76EE\u6570\u7EC4\uFF09\u6216\u6570\u7EC4\uFF0C\u5DF2\u8DF3\u8FC7\u3002`
+        `[AgentMoss] \u89C4\u5219\u6587\u4EF6 ${path6} \u542B\u672A\u77E5\u7C7B\u522B\u952E "${cat}"\uFF08\u53EF\u7528\uFF1A${Object.keys(EXTRA_CATEGORIES).join(", ")}\uFF09\u2014\u2014 \u5DF2\u8DF3\u8FC7\u8BE5\u7C7B\u522B\u3002`
+      );
+      continue;
+    }
+    if (rules && typeof rules === "object" && !Array.isArray(rules)) {
+      console.error(
+        `[AgentMoss] \u274C \u89C4\u5219\u6587\u4EF6 ${path6} \u7684\u7C7B\u522B "${cat}" \u662F**\u5BF9\u8C61**\uFF0C\u5E94\u4E3A**\u5BF9\u8C61\u6570\u7EC4** \u2014\u2014 \u5DF2\u8DF3\u8FC7\u8BE5\u7C7B\u522B\u3002
+    \u6B63\u786E\u5199\u6CD5: {"${cat}": [{"pattern": "...", "risk_level": "high", ...}]}
+    \u4F60\u5199\u7684\u50CF\u662F runtime config \u7684\u683C\u5F0F\uFF08{"category_enabled": ..., "rules": [...]}\uFF09\u2014\u2014\u90A3\u662F ~/.config/agentmoss/agent_moss_runtime.json \u7684\u683C\u5F0F\uFF0C\u4E0D\u80FD\u76F4\u63A5\u5F53\u89C4\u5219\u6587\u4EF6\u7528\u3002`
       );
       continue;
     }
-    let nLoaded = 0;
-    for (const [cat, rules] of pairs) {
-      const required = EXTRA_CATEGORIES[cat];
-      if (!required) {
+    if (!Array.isArray(rules)) {
+      console.warn(`[AgentMoss] \u89C4\u5219\u6587\u4EF6 ${path6} \u7684\u7C7B\u522B "${cat}" \u5E94\u4E3A\u6570\u7EC4\uFF0C\u5B9E\u9645\u662F ${typeof rules} \u2014\u2014 \u5DF2\u8DF3\u8FC7\u8BE5\u7C7B\u522B\u3002`);
+      continue;
+    }
+    const items = [];
+    for (const r of rules) {
+      if (!r || typeof r !== "object" || !required.every((k) => r[k])) {
         console.warn(
-          `[AgentMoss] \u8FFD\u52A0\u89C4\u5219\u6587\u4EF6 ${p} \u542B\u672A\u77E5\u7C7B\u522B\u952E "${cat}"\uFF08\u53EF\u7528\uFF1A${Object.keys(EXTRA_CATEGORIES).join(", ")}\uFF09\u2014\u2014 \u5DF2\u8DF3\u8FC7\u8BE5\u7C7B\u522B\u3002`
+          `[AgentMoss] \u89C4\u5219\u6587\u4EF6 ${path6} \u7C7B\u522B ${cat} \u6709\u6761\u76EE\u7F3A\u5FC5\u9700\u5B57\u6BB5 [${required.join(", ")}] \u2014\u2014 \u5DF2\u8DF3\u8FC7\u8BE5\u6761\u3002`
         );
         continue;
       }
-      if (!Array.isArray(rules)) {
-        console.warn(`[AgentMoss] \u8FFD\u52A0\u89C4\u5219\u6587\u4EF6 ${p} \u7C7B\u522B ${cat} \u7684\u503C\u5E94\u662F\u6570\u7EC4 \u2014\u2014 \u5DF2\u8DF3\u8FC7\u3002`);
+      items.push(r);
+    }
+    if (items.length > 0) out[cat] = (out[cat] || []).concat(items);
+  }
+  if (Object.keys(out).length > 0) {
+    console.info(
+      `[AgentMoss] \u5DF2\u52A0\u8F7D${label}\u89C4\u5219\u6587\u4EF6 ${path6}\uFF1A` + Object.entries(out).map(([k, v]) => `${k}\xD7${v.length}`).join(", ")
+    );
+  }
+  return out;
+}
+function scanRuleDirs() {
+  const override = {};
+  const extra = {};
+  const loaded = [];
+  const ignored = [];
+  for (const d of rulesDirs()) {
+    if (!existsSync(d)) continue;
+    let entries = [];
+    try {
+      entries = readdirSync(d).sort();
+    } catch {
+      continue;
+    }
+    for (const name of entries) {
+      const f = resolve(d, name);
+      try {
+        if (statSync(f).isDirectory()) continue;
+      } catch {
         continue;
       }
-      for (const r of rules) {
-        if (!r || typeof r !== "object" || !required.every((k) => r[k])) {
-          console.warn(
-            `[AgentMoss] \u8FFD\u52A0\u89C4\u5219\u6587\u4EF6 ${p} \u7C7B\u522B ${cat} \u6709\u6761\u76EE\u7F3A\u5FC5\u9700\u5B57\u6BB5 [${required.join(", ")}] \u2014\u2014 \u5DF2\u8DF3\u8FC7\u8BE5\u6761\u3002`
-          );
-          continue;
+      if (name === OVERRIDE_FILENAME) {
+        const got = scanRulesFile(f, "override");
+        if (Object.keys(got).length > 0) loaded.push(f);
+        for (const [cat, items] of Object.entries(got)) {
+          if (Array.isArray(items)) {
+            override[cat] = (override[cat] || []).concat(items);
+          } else {
+            override[cat] = { ...override[cat] || {}, ...items };
+          }
         }
-        const rid = r && typeof r === "object" ? String(r.id || "") : "";
-        if (rid) {
-          if (seenIds.has(rid)) {
-            console.warn(
-              `[AgentMoss] \u8FFD\u52A0\u89C4\u5219 id "${rid}" \u91CD\u590D\uFF08\u5148\u89C1\u4E8E ${seenIds.get(rid)}\uFF0C\u672C\u6761\u6765\u81EA ${p}\uFF09\u2014\u2014 \u5DF2\u8DF3\u8FC7\u672C\u6761\u3002`
-            );
-            continue;
+      } else if (name === EXTRA_FILENAME) {
+        const got = scanRulesFile(f, "extra");
+        if (Object.values(got).some((v) => v.length > 0)) loaded.push(f);
+        for (const [cat, items] of Object.entries(got)) {
+          if (Array.isArray(items)) {
+            extra[cat] = (extra[cat] || []).concat(items);
+          } else {
+            extra[cat] = { ...extra[cat] || {}, ...items };
           }
-          seenIds.set(rid, p);
         }
-        (data[cat] = data[cat] || []).push(r);
-        nLoaded += 1;
+      } else if (name.toLowerCase().endsWith(".json")) {
+        ignored.push(f);
+      }
+    }
+  }
+  if (Object.keys(override).length > 0 && identicalToBuiltin(override)) {
+    const key = "override-identical::" + Object.entries(override).map(([c, v]) => `${c}=${v.length}`).sort().join("|");
+    if (!warnedIgnored.has(key)) {
+      warnedIgnored.add(key);
+      console.warn(
+        `[AgentMoss] \u2139\uFE0F  ${OVERRIDE_FILENAME} \u4E0E**\u5185\u7F6E\u89C4\u5219\u5B8C\u5168\u4E00\u81F4**\uFF08` + Object.entries(override).sort().map(([c, v]) => `${c}\xD7${v.length}`).join(", ") + `\uFF09\u2014\u2014 \u770B\u8D77\u6765\u662F\u6A21\u677F\u539F\u6837\u62F7\u8FDB\u6765\u6CA1\u6539\u3002
+    \u5B83\u73B0\u5728\u7684\u6548\u679C = \u5185\u7F6E\u89C4\u5219\uFF1B\u4F46**\u4EE5\u540E\u5347\u7EA7\u5185\u7F6E\u89C4\u5219\u4E0D\u4F1A\u53CD\u6620\u5230\u8FD9\u4EFD\u4E0A**\uFF08\u88AB\u9489\u4F4F\u4E86\uFF09\u3002
+    \u53EA\u60F3\u8FFD\u52A0\u89C4\u5219\uFF1A\u5220\u6389 ${OVERRIDE_FILENAME}\uFF0C\u6539\u7528 ${EXTRA_FILENAME}\u3002`
+      );
+    }
+  }
+  if (Object.keys(override).length > 0) {
+    const key = "override-summary::" + Object.entries(override).map(([c, v]) => `${c}=${v.length}`).sort().join("|");
+    if (!warnedIgnored.has(key)) {
+      warnedIgnored.add(key);
+      const l1 = loadL1();
+      const l2 = loadL2();
+      const builtinCounts = {
+        dangerous_commands: (l1.dangerous_commands || []).length,
+        injection_detection: (l1.injection_detection || []).length,
+        sensitive_path_access: (l1.sensitive_path_access || []).length,
+        intent_consistency: (l2.intent_consistency || []).length,
+        password_modify_consent: (l2.password_modify_consent || []).length,
+        user_deletion_consent: (l2.user_deletion_consent || []).length
+      };
+      console.warn(`[AgentMoss] \u26A0\uFE0F  ${OVERRIDE_FILENAME} \u751F\u6548\uFF08**\u6574\u4EFD\u66FF\u6362**\uFF0C\u672A\u5217\u51FA\u7684\u5185\u7F6E\u89C4\u5219\u4E0D\u518D\u751F\u6548\uFF09\uFF1A`);
+      for (const [cat, items] of Object.entries(override).sort()) {
+        console.warn(`      \u7C7B\u522B ${cat}\uFF1A\u5185\u7F6E ${builtinCounts[cat] ?? 0} \u6761 \u2192 \u4F60\u7684 ${items.length} \u6761`);
       }
+      console.warn(`    \u53EA\u60F3**\u8FFD\u52A0**\u89C4\u5219\u8BF7\u6539\u7528 ${EXTRA_FILENAME}\uFF1B\u8981\u6539\u67D0\u4E00\u6761\u5185\u7F6E\u89C4\u5219\uFF0C\u8BF7\u5148\u62F7\u8D1D\u5185\u7F6E\u6587\u4EF6\u518D\u6539\u3002`);
     }
-    if (nLoaded > 0) {
-      loaded.push(p);
-      console.info(`[AgentMoss] \u5DF2\u52A0\u8F7D\u8FFD\u52A0\u89C4\u5219\u6587\u4EF6 ${p}\uFF1A${nLoaded} \u6761`);
+  }
+  if (ignored.length > 0) {
+    const key = "ignored::" + ignored.join("|");
+    if (!warnedIgnored.has(key)) {
+      warnedIgnored.add(key);
+      console.warn(
+        `[AgentMoss] \u26A0\uFE0F  \u89C4\u5219\u76EE\u5F55\u91CC\u6709 ${ignored.length} \u4E2A json **\u4E0D\u4F1A\u88AB\u8BFB\u53D6**\uFF08\u53EA\u6709 ${OVERRIDE_FILENAME} \u4E0E ${EXTRA_FILENAME} \u4F1A\u88AB\u8BFB\uFF09: ${ignored.join(", ")}
+    \u8981\u8986\u76D6\u5185\u7F6E\u89C4\u5219 \u2192 \u5185\u5BB9\u653E\u8FDB ${OVERRIDE_FILENAME}\uFF1B\u8981\u8FFD\u52A0 \u2192 \u653E\u8FDB ${EXTRA_FILENAME}\u3002`
+      );
     }
   }
-  return { data, loaded };
+  return { override, extra, loaded, ignored };
 }
-function loadExtraRules() {
-  const raw = (process.env.AGENT_MOSS_EXTRA_RULES_DIR || "").trim();
-  const dirs = extraRulesDirs();
-  let files = [];
+function rulesCached() {
+  const dirs = rulesDirs();
+  const sig = RULES_DIR_ENVS.map((e) => `${e}=${process.env[e] || ""}`).join("|") + "|" + dirs.join("|");
+  const files = [];
   for (const d of dirs) {
-    if (existsSync(d)) files.push(...listJsonFilesDeep(d));
-    else console.warn(`[AgentMoss] \u8FFD\u52A0\u89C4\u5219\u76EE\u5F55\u4E0D\u5B58\u5728\uFF0C\u5DF2\u8DF3\u8FC7: ${d}\uFF08AGENT_MOSS_EXTRA_RULES_DIR\uFF09`);
+    if (!existsSync(d)) continue;
+    try {
+      for (const name of readdirSync(d).sort()) {
+        if (name.toLowerCase().endsWith(".json")) files.push(resolve(d, name));
+      }
+    } catch {
+    }
   }
-  files = files.sort();
-  const fp = files.map((p) => {
+  const fp = JSON.stringify(files.map((p) => {
     try {
       const st = statSync(p);
       return [p, st.mtimeMs, st.size];
     } catch {
       return [p, -1, -1];
     }
-  });
-  if (extraCache && extraCache.raw === raw && JSON.stringify(extraCache.fp) === JSON.stringify(fp)) {
-    return extraCache.data;
+  }));
+  if (_RULES_CACHE && _RULES_CACHE.sig === sig && _RULES_CACHE.fp === fp) return _RULES_CACHE;
+  _RULES_CACHE = { sig, fp, ...scanRuleDirs() };
+  return _RULES_CACHE;
+}
+function identicalToBuiltin(override) {
+  const l1 = loadL1();
+  const l2 = loadL2();
+  for (const [cat, items] of Object.entries(override)) {
+    const builtin = l1[cat] ?? l2[cat];
+    if (!Array.isArray(builtin) || builtin.length !== items.length) return false;
+    if (JSON.stringify(builtin) !== JSON.stringify(items)) return false;
   }
-  const { data, loaded } = scanExtraFiles(files);
-  extraCache = { raw, fp, data, loaded };
-  return data;
+  return Object.keys(override).length > 0;
+}
+function loadOverrideRules() {
+  return rulesCached().override;
+}
+function loadExtraRules() {
+  return rulesCached().extra;
 }
-function extraRuleFiles() {
-  loadExtraRules();
-  return extraCache ? [...extraCache.loaded] : [];
+function ruleFilesLoaded() {
+  return rulesCached().loaded;
 }
-var __filename2, __dirname2, EXPECTED_KEYS, warnedOverride, RULES_DIR_CANDS, EXTRA_CATEGORIES, EXTRA_FLAT_FIELD, extraCache;
+function ignoredRuleFiles() {
+  return rulesCached().ignored;
+}
+var __filename2, __dirname2, OVERRIDE_FILENAME, EXTRA_FILENAME, RULES_DIR_ENVS, RULES_DIR_CANDS, SCENARIO_LIST_KEYS, EXTRA_CATEGORIES, STRUCT_KEYS, EXTRA_FLAT_FIELD, _RULES_CACHE, warnedIgnored;
 var init_rules_loader = __esm({
   "src/infra/rules-loader.ts"() {
     "use strict";
@@ -648,20 +900,13 @@ var init_rules_loader = __esm({
     init_runtime_config_bridge();
     __filename2 = fileURLToPath2(import.meta.url);
     __dirname2 = dirname(__filename2);
-    EXPECTED_KEYS = {
-      "l1_rules.json": ["dangerous_commands", "injection_detection", "sensitive_path_access"],
-      "l2_rules.json": ["intent_consistency", "password_modify_consent", "user_deletion_consent"],
-      "l3_rules.json": [],
-      "mc_rules.json": ["rules"],
-      "tool_registry.json": ["tools"]
-    };
-    warnedOverride = /* @__PURE__ */ new Set();
+    OVERRIDE_FILENAME = "override.json";
+    EXTRA_FILENAME = "extra.json";
+    RULES_DIR_ENVS = ["AGENT_MOSS_EXTRA_RULES_DIR", "AGENT_MOSS_OVERRIDE_RULES_DIR"];
     RULES_DIR_CANDS = (() => {
       const cands = [
-        // 用户数据目录覆盖优先（与 Python rules_loader.resolve_rules_file 的
-        // <data_root>/rules/<name> 优先逻辑对齐）。用户安装 pip/npm 包后把自定义
-        // mc_rules.json 放到 <data_root>/rules/ 即可覆盖内置默认，无需改源码。
-        resolve(dataRootDir(), "rules"),
+        // 注：`<data_root>/rules/` 不再是"按内置文件名覆盖"的查找位 —— 2026-10 起
+        // 规则目录只认 override.json / extra.json（见 rulesDirs()）。
         // dist: __dirname=dist/ → dist/rules；__dirname=dist/engine/ → dist/engine/../rules=dist/rules
         resolve(__dirname2, "../rules"),
         resolve(__dirname2, "rules"),
@@ -674,6 +919,7 @@ var init_rules_loader = __esm({
       ];
       return cands.filter((c) => existsSync(c));
     })();
+    SCENARIO_LIST_KEYS = ["extra_command_patterns", "extra_injection_keywords", "extra_sensitive_paths"];
     EXTRA_CATEGORIES = {
       dangerous_commands: ["pattern"],
       injection_detection: ["keyword", "lang"],
@@ -682,6 +928,7 @@ var init_rules_loader = __esm({
       password_modify_consent: ["pattern"],
       user_deletion_consent: ["pattern"]
     };
+    STRUCT_KEYS = ["skills", "ltl_rules", "tools"];
     EXTRA_FLAT_FIELD = [
       [["path"], "sensitive_path_access"],
       [["keyword", "lang"], "injection_detection"],
@@ -689,7 +936,8 @@ var init_rules_loader = __esm({
       [["pattern", "risk_level"], "dangerous_commands"],
       [["pattern", "risk_type"], "dangerous_commands"]
     ];
-    extraCache = null;
+    _RULES_CACHE = null;
+    warnedIgnored = /* @__PURE__ */ new Set();
   }
 });
 
@@ -2047,18 +2295,34 @@ function _mergeUserCustom(primary, runtime, layers, key) {
   const extra = _userCustomRules(runtime, layers, key);
   return extra.length > 0 ? [...primary, ...extra] : [...primary];
 }
-function _mergeExtraDirRules(primary, category) {
+function _dedup(rules, category) {
+  const keys = _DEDUP_KEYS[category];
+  if (!keys) return rules;
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const r of rules) {
+    const k = keys.map((x) => String(r?.[x] ?? "")).join("\0");
+    if (seen.has(k)) continue;
+    seen.add(k);
+    out.push(r);
+  }
+  return out;
+}
+function _mergeRulesFromDirs(primary, category) {
+  let base = [...primary];
   try {
+    const override = loadOverrideRules()[category];
+    if (override !== void 0 && override !== null) base = [...override];
     const extra = loadExtraRules()[category] || [];
-    return extra.length > 0 ? [...primary, ...extra] : [...primary];
+    return _dedup([...base, ...extra], category);
   } catch {
-    return [...primary];
+    return base;
   }
 }
 function getEnabledL1CommandPatterns(runtime, osType) {
   const cat = runtime.L1_rules?.dangerous_commands || { category_enabled: true, rules: [] };
   let rules = filterEnabledRules(cat.rules || [], cat.category_enabled);
-  rules = _mergeExtraDirRules(rules, "dangerous_commands");
+  rules = _mergeRulesFromDirs(rules, "dangerous_commands");
   rules = _mergeUserCustom(rules, runtime, "L1_rules", "pattern");
   if (osType) rules = _filterRulesByOs(rules, osType);
   return rules.map((r) => ({
@@ -2074,7 +2338,7 @@ function getEnabledL2SensitivePaths(runtime, osType) {
     cat = runtime.L2_rules?.sensitive_path_access || { category_enabled: true, rules: [] };
   }
   let rules = filterEnabledRules(cat.rules || [], cat.category_enabled);
-  rules = _mergeExtraDirRules(rules, "sensitive_path_access");
+  rules = _mergeRulesFromDirs(rules, "sensitive_path_access");
   rules = _mergeUserCustom(rules, runtime, ["L1_rules", "L2_rules"], "path");
   if (osType) rules = _filterRulesByOs(rules, osType);
   return rules.map((r) => {
@@ -2459,25 +2723,11 @@ function generateSourceDefaults() {
   };
 }
 function _ltlRulesToRuntime() {
-  const cands = [
-    getRuntimeConfigDir() && join3(getRuntimeConfigDir(), "rules"),
-    join3(__dirname4, "../rules"),
-    join3(__dirname4, "rules"),
-    join3(__dirname4, "../../../agent_moss/rules"),
-    join3(__dirname4, "../../../../agent_moss/rules"),
-    join3(process.cwd(), "agent_moss/rules")
-  ].filter(Boolean);
   let mc = {};
-  for (const dir of cands) {
-    const p = join3(dir, "mc_rules.json");
-    if (existsSync5(p)) {
-      try {
-        mc = JSON.parse(readFileSync4(p, "utf-8")) || {};
-      } catch {
-        mc = {};
-      }
-      break;
-    }
+  try {
+    mc = loadMCRaw();
+  } catch {
+    mc = {};
   }
   const rules = mc.rules || [];
   return {
@@ -2706,7 +2956,7 @@ function _migrateCategoriesAcrossLayers(cfg, srcLayer, dstLayer, catNames) {
 function getEnabledL1InjectionKeywords(runtime, osType) {
   const cat = runtime.L1_rules?.injection_detection || { category_enabled: true, rules: [] };
   let rules = filterEnabledRules(cat.rules || [], cat.category_enabled);
-  rules = _mergeExtraDirRules(rules, "injection_detection");
+  rules = _mergeRulesFromDirs(rules, "injection_detection");
   rules = _mergeUserCustom(rules, runtime, "L1_rules", "keyword");
   if (osType) rules = _filterRulesByOs(rules, osType);
   return rules.map((r) => ({
@@ -2718,7 +2968,7 @@ function getEnabledL1InjectionKeywords(runtime, osType) {
 function getEnabledL2IntentPatterns(runtime, osType) {
   const cat = runtime.L2_rules?.intent_consistency || { category_enabled: true, rules: [] };
   let rules = filterEnabledRules(cat.rules || [], cat.category_enabled);
-  rules = _mergeExtraDirRules(rules, "intent_consistency");
+  rules = _mergeRulesFromDirs(rules, "intent_consistency");
   rules = _mergeUserCustom(rules, runtime, "L2_rules", "intent_keywords");
   if (osType) rules = _filterRulesByOs(rules, osType);
   return rules.map((r) => ({
@@ -2730,7 +2980,7 @@ function getEnabledL2IntentPatterns(runtime, osType) {
 function getEnabledL2PasswordPatterns(runtime) {
   const cat = runtime.L2_rules?.password_modify_consent || { category_enabled: true, rules: [] };
   const rules = _mergeUserCustom(
-    _mergeExtraDirRules(filterEnabledRules(cat.rules || [], cat.category_enabled), "password_modify_consent"),
+    _mergeRulesFromDirs(filterEnabledRules(cat.rules || [], cat.category_enabled), "password_modify_consent"),
     runtime,
     "L2_rules",
     "pattern"
@@ -2740,7 +2990,7 @@ function getEnabledL2PasswordPatterns(runtime) {
 function getEnabledL2UserDeletionPatterns(runtime) {
   const cat = runtime.L2_rules?.user_deletion_consent || { category_enabled: true, rules: [] };
   const rules = _mergeUserCustom(
-    _mergeExtraDirRules(filterEnabledRules(cat.rules || [], cat.category_enabled), "user_deletion_consent"),
+    _mergeRulesFromDirs(filterEnabledRules(cat.rules || [], cat.category_enabled), "user_deletion_consent"),
     runtime,
     "L2_rules",
     "pattern"
@@ -2777,7 +3027,7 @@ function getEnabledL1CommandPatternsOrDefault(runtime, osType) {
     return getEnabledL1CommandPatterns(runtime, osType);
   }
   return _mergeUserCustom(
-    _mergeExtraDirRules(_filterDefaultsByOs(_l1CommandPatternsToRules(), osType), "dangerous_commands"),
+    _mergeRulesFromDirs(_filterDefaultsByOs(_l1CommandPatternsToRules(), osType), "dangerous_commands"),
     runtime,
     "L1_rules",
     "pattern"
@@ -2789,7 +3039,7 @@ function getEnabledL1InjectionKeywordsOrDefault(runtime, osType) {
     return getEnabledL1InjectionKeywords(runtime, osType);
   }
   return _mergeUserCustom(
-    _mergeExtraDirRules(_l1InjectionKeywordsToRules(), "injection_detection"),
+    _mergeRulesFromDirs(_l1InjectionKeywordsToRules(), "injection_detection"),
     runtime,
     "L1_rules",
     "keyword"
@@ -2801,7 +3051,7 @@ function getEnabledL2SensitivePathsOrDefault(runtime, osType) {
     return getEnabledL2SensitivePaths(runtime, osType);
   }
   return _mergeUserCustom(
-    _mergeExtraDirRules(_filterDefaultsByOs(_l2SensitivePathsToRules(), osType), "sensitive_path_access"),
+    _mergeRulesFromDirs(_filterDefaultsByOs(_l2SensitivePathsToRules(), osType), "sensitive_path_access"),
     runtime,
     ["L1_rules", "L2_rules"],
     "path"
@@ -2813,7 +3063,7 @@ function getEnabledL2IntentPatternsOrDefault(runtime, osType) {
     return getEnabledL2IntentPatterns(runtime, osType);
   }
   return _mergeUserCustom(
-    _mergeExtraDirRules(_filterDefaultsByOs(_l2IntentPatternsToRules(), osType), "intent_consistency"),
+    _mergeRulesFromDirs(_filterDefaultsByOs(_l2IntentPatternsToRules(), osType), "intent_consistency"),
     runtime,
     "L2_rules",
     "intent_keywords"
@@ -3204,7 +3454,7 @@ function updateScenarioCategoryEnabled(scenarioId, category, enabled) {
   saveRuntimeConfig(runtime);
   return runtime;
 }
-var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DEFAULT_LAYERS, DENY_MODE_LABELS, runtimeConfigCache, hasRuntimeConfigCache, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, _effectiveCache, SKILL_ID_RE;
+var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DEFAULT_LAYERS, DENY_MODE_LABELS, runtimeConfigCache, _DEDUP_KEYS, hasRuntimeConfigCache, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, _effectiveCache, SKILL_ID_RE;
 var init_runtime_config = __esm({
   "src/infra/runtime-config.ts"() {
     "use strict";
@@ -3237,6 +3487,14 @@ var init_runtime_config = __esm({
       deny_both: "\u8BFB\u5199\u5747\u62E6\u622A"
     };
     runtimeConfigCache = null;
+    _DEDUP_KEYS = {
+      dangerous_commands: ["pattern"],
+      password_modify_consent: ["pattern"],
+      user_deletion_consent: ["pattern"],
+      sensitive_path_access: ["path"],
+      injection_detection: ["keyword", "lang"],
+      intent_consistency: ["intent_keywords", "reason"]
+    };
     hasRuntimeConfigCache = /* @__PURE__ */ new Map();
     _AGENTS_DIR_PROD = join3(__dirname4, "agents");
     _AGENTS_DIR_DEV = join3(__dirname4, "..", "..", "..", "agent_moss", "agents");
@@ -3262,6 +3520,8 @@ var init_runtime_config = __esm({
 var config_exports = {};
 __export(config_exports, {
   detectProvider: () => detectProvider,
+  getAgentMossSetting: () => getAgentMossSetting,
+  getCacheOptions: () => getCacheOptions,
   getCustomRules: () => getCustomRules,
   getLLMConfig: () => getLLMConfig,
   getLLMFailMode: () => getLLMFailMode,
@@ -3273,6 +3533,8 @@ __export(config_exports, {
   isHeuristicEnabled: () => isHeuristicEnabled,
   isLLMAvailable: () => isLLMAvailable,
   isLogicRulesEnabled: () => isLogicRulesEnabled,
+  isPolicyGenEnabled: () => isPolicyGenEnabled,
+  isPolicySaveEnabled: () => isPolicySaveEnabled,
   probeLLMConnection: () => probeLLMConnection,
   updateLLMConfig: () => updateLLMConfig,
   userRuleVariantPattern: () => userRuleVariantPattern,
@@ -3295,8 +3557,10 @@ function resolveConfigPath() {
   const userConfig = path2.join(getConfigDir(), "config.json");
   if (fs2.existsSync(userConfig)) return userConfig;
   const defaultCandidates = [
-    path2.join(__dirname, "config.json.example"),
-    path2.join(__dirname, "..", "..", "agent_moss", "infra", "config.json.example")
+    path2.join(__configModuleDir, "config.json.example"),
+    path2.join(__configModuleDir, "..", "config.json.example"),
+    path2.join(__configModuleDir, "..", "..", "agent_moss", "infra", "config.json.example"),
+    path2.join(__configModuleDir, "..", "..", "..", "agent_moss", "infra", "config.json.example")
   ];
   const defaultConfig = defaultCandidates.find((p) => fs2.existsSync(p));
   if (defaultConfig) {
@@ -3305,8 +3569,8 @@ function resolveConfigPath() {
     const pkgConfig = loadConfigFile(defaultConfig);
     const safeConfig = pkgConfig ? { ...pkgConfig, llm: { ...pkgConfig.llm, api_key: "" } } : {};
     fs2.writeFileSync(userConfig, JSON.stringify(safeConfig, null, 4), "utf-8");
-    console.log(`[AgentMoss] \u5DF2\u521B\u5EFA\u7528\u6237\u914D\u7F6E\u6587\u4EF6: ${userConfig}`);
-    console.log(`[AgentMoss] \u8BF7\u7F16\u8F91\u8BE5\u6587\u4EF6\u914D\u7F6E\u4F60\u7684 LLM API Key`);
+    console.error(`[AgentMoss] \u5DF2\u521B\u5EFA\u7528\u6237\u914D\u7F6E\u6587\u4EF6: ${userConfig}`);
+    console.error(`[AgentMoss] \u8BF7\u7F16\u8F91\u8BE5\u6587\u4EF6\u914D\u7F6E\u4F60\u7684 LLM API Key`);
   }
   return userConfig;
 }
@@ -3478,7 +3742,32 @@ function layerEnabledOrDefault(key) {
   }
 }
 function isBrainEnabled() {
-  return process.env.AGENT_MOSS_BRAIN_ENABLED === "1";
+  return getAgentMossSetting("AGENT_MOSS_BRAIN_ENABLED", "") === "1";
+}
+function getAgentMossSetting(key, def = "") {
+  const envValue = process.env[key];
+  if (envValue !== void 0) return envValue;
+  const cfg = loadConfigFile(resolveConfigPath());
+  if (cfg && key in cfg) return String(cfg[key]);
+  return def;
+}
+function isPolicyGenEnabled() {
+  return getAgentMossSetting("AGENT_MOSS_ENABLE_POLICY_GEN", "") === "1";
+}
+function getCacheOptions() {
+  let enabled = true;
+  let maxSize = 1e3;
+  const cfg = loadConfigFile(resolveConfigPath());
+  const cache3 = cfg?.cache;
+  if (cache3 && typeof cache3 === "object") {
+    if (typeof cache3.enabled === "boolean") enabled = cache3.enabled;
+    if (typeof cache3.max_size === "number" && cache3.max_size > 0) maxSize = cache3.max_size;
+  }
+  if (process.env.AGENT_MOSS_DISABLE_CACHE === "1") enabled = false;
+  return { enabled, maxSize };
+}
+function isPolicySaveEnabled() {
+  return getAgentMossSetting("AGENT_MOSS_SAVE_POLICY", "1") !== "0";
 }
 function isLogicRulesEnabled() {
   if (process.env.AGENT_MOSS_DISABLE_LOGIC_RULES === "1") return false;
@@ -3487,13 +3776,20 @@ function isLogicRulesEnabled() {
 function isFormalObserveMode() {
   return process.env.AGENT_MOSS_FORMAL_OBSERVE === "1";
 }
-var timeoutConfig, retryConfig, llmConfig, __configModuleDir, USER_RULES_PATHS, customRules, PROVIDER_HEADERS;
+var __configModuleDir, timeoutConfig, retryConfig, llmConfig, USER_RULES_PATHS, customRules, PROVIDER_HEADERS;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
     init_esm_shims();
     init_paths();
     init_runtime_config();
+    __configModuleDir = (() => {
+      try {
+        return path2.dirname(fileURLToPath5(import.meta.url));
+      } catch {
+        return typeof __dirname !== "undefined" ? __dirname : process.cwd();
+      }
+    })();
     llmConfig = (() => {
       const configPath = resolveConfigPath();
       const fileConfig = fs2.existsSync(configPath) ? loadLLMConfigFromFile(configPath) : {};
@@ -3511,13 +3807,6 @@ var init_config = __esm({
         timeout: parseInt(process.env.AGENT_MOSS_LLM_TIMEOUT || String(fileConfig.timeout ?? String(tr.timeout.prompt1Timeout)), 10)
       };
     })();
-    __configModuleDir = (() => {
-      try {
-        return path2.dirname(fileURLToPath5(import.meta.url));
-      } catch {
-        return typeof __dirname !== "undefined" ? __dirname : process.cwd();
-      }
-    })();
     USER_RULES_PATHS = [
       path2.join(__configModuleDir, "rules", "user_rules.json"),
       // 源在 ts/src/rules（一般不存在）
@@ -7223,7 +7512,7 @@ async function analyzeWithLLM(prompt, config) {
       }
       if (attempt < maxRetries) {
         console.error(`[AgentMoss] LLM call failed (attempt ${attempt + 1}/${maxRetries + 1}), retrying in ${retryCfg.retryInterval}s:`, err.message);
-        await new Promise((resolve10) => setTimeout(resolve10, retryCfg.retryInterval * 1e3));
+        await new Promise((resolve11) => setTimeout(resolve11, retryCfg.retryInterval * 1e3));
       } else {
         clearTimeout(totalTimeoutTimer);
         console.error("[AgentMoss] LLM call failed after all retries:", err.message);
@@ -7346,6 +7635,56 @@ var init_rule_store = __esm({
       getRule(ruleId) {
         return this.data.rules.find((r) => r.id === ruleId);
       }
+      /** 质疑：active → disputed，并把 disputed_count +1（镜像 Python dispute_rule）。 */
+      disputeRule(ruleId, _reason = "") {
+        const rule = this.getRule(ruleId);
+        if (!rule) throw new Error(`\u89C4\u5219\u4E0D\u5B58\u5728: ${ruleId}`);
+        if (rule.status !== STATUS_ACTIVE) throw new Error(`\u53EA\u6709 active \u72B6\u6001\u53EF\u8D28\u7591\uFF0C\u5F53\u524D: ${rule.status}`);
+        rule.status = STATUS_DISPUTED;
+        rule.disputedCount += 1;
+        this.save();
+      }
+      // ==================== 生命周期（curator 用，镜像 Python rule_store） ====================
+      /** 长期未触发的 active/disputed 规则 → stale。 */
+      markStale(staleDays = 30) {
+        const cutoff = Date.now() - staleDays * 864e5;
+        for (const r of this.data.rules) {
+          if ((r.status === STATUS_ACTIVE || r.status === STATUS_DISPUTED) && r.lastTriggeredAt > 0 && r.lastTriggeredAt < cutoff) {
+            r.status = STATUS_STALE;
+          }
+        }
+        this.save();
+      }
+      /** 长期 stale 的规则 → archived。 */
+      markArchived(archiveDays = 90) {
+        const cutoff = Date.now() - archiveDays * 864e5;
+        for (const r of this.data.rules) {
+          if (r.status === STATUS_STALE && r.lastTriggeredAt > 0 && r.lastTriggeredAt < cutoff) {
+            r.status = STATUS_ARCHIVED;
+          }
+        }
+        this.save();
+      }
+      /** disputed 次数达阈值 → 自动降级 stale（自动纠错闭环）。 */
+      autoDemoteDisputed(disputeThreshold = 3) {
+        for (const r of this.data.rules) {
+          if (r.status === STATUS_DISPUTED && r.disputedCount >= disputeThreshold) {
+            r.status = STATUS_STALE;
+          }
+        }
+        this.save();
+      }
+      // ==================== 中心化预留（镜像 Python） ====================
+      /** 导出本地新增（非 central 来源）的 active 规则。 */
+      getRulesForExport() {
+        return this.data.rules.filter((r) => r.source !== "central" && r.status === STATUS_ACTIVE);
+      }
+      /** 导入中心下发规则（强制标 central 来源，避免被再次回流）。 */
+      importRules(rules) {
+        for (const rule of rules) {
+          this.addRule({ ...rule, source: "central", originNode: "central" });
+        }
+      }
       getActiveRules(layer) {
         return this.data.rules.filter((r) => r.status === STATUS_ACTIVE && (layer === void 0 || r.layer === layer));
       }
@@ -7453,12 +7792,14 @@ var init_pattern_extractor = __esm({
       minOccurrences;
       builtinPatterns;
       reviewFn;
+      skillManager;
       constructor(ruleStore, opts) {
         this.ruleStore = ruleStore;
         this.minConfidence = opts?.minConfidence ?? 0.9;
         this.minOccurrences = opts?.minOccurrences ?? 3;
         this.builtinPatterns = opts?.builtinPatterns ?? [];
         this.reviewFn = opts?.review ?? null;
+        this.skillManager = opts?.skillManager ?? null;
       }
       async extract(event, llmResult) {
         const result = { rulesCreated: 0, patternsRecorded: 0, skippedReason: "", deduped: [] };
@@ -7547,8 +7888,96 @@ var init_pattern_extractor = __esm({
             result.rulesCreated += 1;
           }
         }
+        if (this.skillManager) {
+          const skill = this.buildSkill(actionDetail, reason, riskType, eventId);
+          if (skill) {
+            const id = this.skillManager.addSkill(skill);
+            if (id) {
+              result.skillsCreated = (result.skillsCreated ?? 0) + 1;
+            }
+          }
+        }
         return result;
       }
+      /**
+       * 生成候选 Skill；不值得沉淀时返回 null（镜像 Python `_extract_skill` 的三道价值评估）。
+       *
+       * 评估 1：reason 太短（<50 字）说明没有可复用的判断逻辑，不沉淀；
+       * 评估 2：同名 skill 已存在 → 跳过；
+       * 评估 3：与已有 active skill 关键词重叠 >= 2 → 跳过（防同类案例重复沉淀，
+       *        如 cat /etc/shadow 与 cat /etc/sudoers 生成两个近乎重复的 skill）。
+       */
+      buildSkill(actionDetail, reason, riskType, eventId) {
+        if (!reason || reason.length < 50) return null;
+        if (!riskType) return null;
+        const detailWords = (actionDetail.toLowerCase().match(/[a-z]+/g) || []).slice(0, 3);
+        const name = detailWords.length > 0 ? `brain_${riskType}_${detailWords.join("_")}` : `brain_${riskType}`;
+        if (this.skillManager.getSkillMeta(name)) return null;
+        const keywords = this.extractSkillKeywords(actionDetail, reason, riskType);
+        if (this.isCoveredByExistingSkill(keywords)) return null;
+        return {
+          name,
+          category: this.categorizeRisk(riskType),
+          content: this.generateSkillContent(name, actionDetail, reason, riskType),
+          keywords,
+          sourceEventIds: eventId ? [eventId] : [],
+          status: "active"
+        };
+      }
+      /** 关键词提取（镜像 Python `_extract_keywords`）。 */
+      extractSkillKeywords(actionDetail, reason, riskType) {
+        const keywords = /* @__PURE__ */ new Set();
+        if (riskType) keywords.add(riskType);
+        for (const w of (actionDetail.toLowerCase().match(/[a-z_]{3,}/g) || []).slice(0, 10)) keywords.add(w);
+        for (const w of (reason.toLowerCase().match(/[a-z_]{3,}/g) || []).slice(0, 5)) keywords.add(w);
+        return [...keywords];
+      }
+      /** 与已有 active skill 关键词重叠 >= 2 → 视为已覆盖（镜像 `_is_covered_by_existing_skill`）。 */
+      isCoveredByExistingSkill(keywords) {
+        if (keywords.length === 0) return false;
+        let existing = [];
+        try {
+          existing = this.skillManager.getActiveSkills();
+        } catch {
+          return false;
+        }
+        const cand = new Set(keywords.map((k) => k.toLowerCase()));
+        for (const meta of existing) {
+          const metaKeywords = (meta.keywords || []).map((k) => String(k).toLowerCase());
+          if (metaKeywords.length === 0) continue;
+          const overlap = metaKeywords.filter((k) => cand.has(k)).length;
+          if (overlap >= 2) return true;
+        }
+        return false;
+      }
+      /** 风险类型 → skill 分类（镜像 Python `_categorize_risk`）。 */
+      categorizeRisk(riskType) {
+        if (!riskType) return "edge_case";
+        if (["inject", "backdoor", "persist"].some((k) => riskType.includes(k))) return "attack_pattern";
+        if (["exfil", "leak", "export"].some((k) => riskType.includes(k))) return "attack_pattern";
+        return "defense_strategy";
+      }
+      /** skill 正文（与 Python `_generate_skill_content` 同结构，便于双端对拍）。 */
+      generateSkillContent(name, actionDetail, reason, riskType) {
+        return `# ${name}
+
+## \u6765\u6E90
+Brain \u81EA\u52A8\u63D0\u53D6\uFF08LLM \u5206\u6790\u6C89\u6DC0\uFF09
+
+## \u573A\u666F
+\u5F53 Agent \u6267\u884C\u4EE5\u4E0B\u7C7B\u578B\u64CD\u4F5C\u65F6\u89E6\u53D1\uFF1A
+- \u98CE\u9669\u7C7B\u578B: ${riskType}
+- \u64CD\u4F5C\u7279\u5F81: ${actionDetail.slice(0, 200)}
+
+## \u5224\u65AD\u4F9D\u636E
+${reason.slice(0, 500)}
+
+## \u5904\u7406\u5EFA\u8BAE
+- \u4F18\u5148\u68C0\u67E5\u64CD\u4F5C\u7684\u4E0A\u4E0B\u6587\u548C\u610F\u56FE
+- \u7ED3\u5408 action_history \u5224\u65AD\u662F\u5426\u5B58\u5728\u6076\u610F\u94FE
+- \u5FC5\u8981\u65F6 Deny \u5E76\u8BB0\u5F55\u539F\u56E0
+`;
+      }
       extractPatterns(actionDetail, reason, riskType) {
         const patterns = [];
         const detailLower = actionDetail.toLowerCase();
@@ -7744,21 +8173,509 @@ var init_reviewer = __esm({
   }
 });
 
-// src/brain/index.ts
-function checkBrainRules(store, opts) {
-  if (!store) return null;
-  const rules = store.getActiveRules(opts.layer);
-  if (rules.length === 0) return null;
-  const combined = `${opts.actionType} ${opts.actionDetail}`;
-  for (const rule of rules) {
-    try {
-      if (new RegExp(rule.pattern, "i").test(combined)) {
-        if (opts.layer === 2 && opts.actionHistory) {
-          if (!checkLayer2Context(rule.pattern, opts.actionHistory, opts.actionDetail)) {
-            continue;
-          }
+// src/brain/skill-manager.ts
+import { existsSync as existsSync13, mkdirSync as mkdirSync4, readFileSync as readFileSync13, renameSync, writeFileSync as writeFileSync4 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join8 } from "path";
+import { randomUUID } from "crypto";
+function getMetaPath(override) {
+  return override || process.env[ENV_SKILL_META_PATH] || DEFAULT_SKILL_META_PATH;
+}
+var DEFAULT_SKILL_META_PATH, ENV_SKILL_META_PATH, BrainSkillManager;
+var init_skill_manager = __esm({
+  "src/brain/skill-manager.ts"() {
+    "use strict";
+    init_esm_shims();
+    DEFAULT_SKILL_META_PATH = join8(homedir5(), ".agentmoss", "brain", "skill_meta.json");
+    ENV_SKILL_META_PATH = "AGENT_MOSS_BRAIN_SKILL_META_PATH";
+    BrainSkillManager = class {
+      constructor(skillsDir, metaPath) {
+        this.skillsDir = skillsDir;
+        this.metaPath = getMetaPath(metaPath);
+        try {
+          mkdirSync4(join8(this.metaPath, ".."), { recursive: true });
+        } catch {
         }
-        store.recordTrigger(rule.id);
+        this.load();
+        this.cleanupGhostSkills();
+      }
+      skillsDir;
+      skills = [];
+      metaPath;
+      load() {
+        if (!existsSync13(this.metaPath)) return;
+        try {
+          const data = JSON.parse(readFileSync13(this.metaPath, "utf-8"));
+          this.skills = data.skills || [];
+        } catch {
+          this.skills = [];
+        }
+      }
+      save() {
+        const out = { version: 1, skills: this.skills };
+        const tmp = `${this.metaPath}.tmp`;
+        try {
+          writeFileSync4(tmp, JSON.stringify(out, null, 2), "utf-8");
+          renameSync(tmp, this.metaPath);
+        } catch {
+        }
+      }
+      /**
+       * 清理"幽灵 skill"：meta 记 active 但磁盘 .md 已不存在。
+       * （沿用 Python 的处理：置 stale，避免污染关键词表并阻塞同名新 skill 生成。）
+       */
+      cleanupGhostSkills() {
+        let changed = false;
+        for (const sk of this.skills) {
+          if (sk.status !== "active") continue;
+          if (!existsSync13(join8(this.skillsDir, `${sk.name}.md`))) {
+            sk.status = "stale";
+            changed = true;
+          }
+        }
+        if (changed) this.save();
+      }
+      /** 新增 Skill：写 .md + 记元数据。目录缺失或同名已存在时跳过（返回 ""）。 */
+      addSkill(skill) {
+        const id = skill.id || randomUUID();
+        const name = skill.name || `brain_${id.slice(0, 8)}`;
+        if (!existsSync13(this.skillsDir)) return "";
+        const mdPath = join8(this.skillsDir, `${name}.md`);
+        if (existsSync13(mdPath)) return "";
+        try {
+          writeFileSync4(mdPath, skill.content, "utf-8");
+        } catch {
+          return "";
+        }
+        this.skills.push({
+          id,
+          name,
+          category: skill.category || "",
+          keywords: skill.keywords || [],
+          source_event_ids: skill.sourceEventIds || [],
+          status: skill.status || "draft",
+          created_at: skill.createdAt || Date.now() / 1e3,
+          usage_count: skill.usageCount || 0,
+          origin_node: skill.originNode || "local"
+        });
+        this.save();
+        return id;
+      }
+      getSkillMeta(name) {
+        return this.skills.find((s) => s.name === name);
+      }
+      getActiveSkills() {
+        return this.skills.filter((s) => s.status === "active").sort((a, b) => (b.created_at || 0) - (a.created_at || 0));
+      }
+      recordUsage(name) {
+        const sk = this.getSkillMeta(name);
+        if (!sk) return;
+        sk.usage_count = (sk.usage_count || 0) + 1;
+        this.save();
+      }
+      /** 长期未使用（usage_count=0）且创建超过 staleDays 的 active skill → stale。 */
+      markStale(staleDays = 60) {
+        const cutoff = Date.now() / 1e3 - staleDays * 86400;
+        let changed = false;
+        for (const sk of this.skills) {
+          if (sk.status === "active" && (sk.usage_count || 0) === 0 && (sk.created_at || 0) < cutoff) {
+            sk.status = "stale";
+            changed = true;
+          }
+        }
+        if (changed) this.save();
+      }
+      /** 导出本地 active skill（含正文），供回流中心。 */
+      exportSkills() {
+        const out = [];
+        for (const sk of this.skills) {
+          if (sk.origin_node !== "local" || sk.status !== "active") continue;
+          const mdPath = join8(this.skillsDir, `${sk.name}.md`);
+          if (!existsSync13(mdPath)) continue;
+          out.push({
+            name: sk.name,
+            category: sk.category || "",
+            content: readFileSync13(mdPath, "utf-8"),
+            keywords: sk.keywords || []
+          });
+        }
+        return out;
+      }
+      /** 导入中心下发 skill（标 central，避免被再次回流）。 */
+      importSkills(skills) {
+        for (const s of skills) {
+          this.addSkill({
+            name: s.name,
+            category: s.category || "",
+            content: s.content,
+            keywords: s.keywords || [],
+            status: "active",
+            originNode: "central"
+          });
+        }
+      }
+      /** 保留 close 签名（JSON 落盘已逐次持久化）。 */
+      close() {
+        this.save();
+      }
+    };
+  }
+});
+
+// src/brain/curator.ts
+var BrainCurator;
+var init_curator = __esm({
+  "src/brain/curator.ts"() {
+    "use strict";
+    init_esm_shims();
+    BrainCurator = class {
+      constructor(ruleStore, skillManager) {
+        this.ruleStore = ruleStore;
+        this.skillManager = skillManager;
+      }
+      ruleStore;
+      skillManager;
+      /**
+       * 执行一次维护，返回报告。
+       *
+       * autoApprove 默认 true：brain 提取的规则达阈值后自动生效（学习闭环）；
+       * 需人工审核时设 false（由 Console 手动 approve）。
+       */
+      runMaintenance(opts = {}) {
+        const {
+          staleRuleDays = 30,
+          archiveRuleDays = 90,
+          staleSkillDays = 60,
+          disputeThreshold = 3,
+          autoApprove = true
+        } = opts;
+        const autoApproved = autoApprove ? this.autoApproveDrafts() : [];
+        this.ruleStore.markStale(staleRuleDays);
+        this.ruleStore.markArchived(archiveRuleDays);
+        this.ruleStore.autoDemoteDisputed(disputeThreshold);
+        this.skillManager.markStale(staleSkillDays);
+        return {
+          rule_stats: this.ruleStore.getStats(),
+          auto_approved: autoApproved
+        };
+      }
+      /** draft → active（仅未 disputed 的 draft）。返回被激活规则的 pattern 前缀。 */
+      autoApproveDrafts() {
+        const approved = [];
+        let drafts;
+        try {
+          drafts = this.ruleStore.getDraftRules();
+        } catch {
+          return approved;
+        }
+        for (const rule of drafts) {
+          try {
+            this.ruleStore.approveRule(rule.id);
+            approved.push(rule.pattern.slice(0, 60));
+          } catch {
+          }
+        }
+        return approved;
+      }
+    };
+  }
+});
+
+// src/brain/contributor.ts
+var contributor_exports = {};
+__export(contributor_exports, {
+  CONTACT_EMAIL: () => CONTACT_EMAIL,
+  ContributionError: () => ContributionError,
+  DEFAULT_TARGET_REPO: () => DEFAULT_TARGET_REPO,
+  EXPORT_RULE_SOURCES: () => EXPORT_RULE_SOURCES,
+  PLATFORM_SSH_HOST: () => PLATFORM_SSH_HOST,
+  TOKEN_ENV: () => TOKEN_ENV,
+  buildCommitMessage: () => buildCommitMessage,
+  buildForkSshUrl: () => buildForkSshUrl,
+  collectRules: () => collectRules,
+  collectSkills: () => collectSkills,
+  contribute: () => contribute,
+  createMrViaApi: () => createMrViaApi,
+  extractMrUrl: () => extractMrUrl,
+  extractRepoPath: () => extractRepoPath,
+  getCurrentUsername: () => getCurrentUsername,
+  gitCommitAndPush: () => gitCommitAndPush,
+  probeAccess: () => probeAccess,
+  resolvePushTarget: () => resolvePushTarget,
+  runGit: () => runGit,
+  writeExportFiles: () => writeExportFiles
+});
+import { mkdirSync as mkdirSync5, mkdtempSync, rmSync, writeFileSync as writeFileSync5 } from "fs";
+import { tmpdir } from "os";
+import { join as join9 } from "path";
+import { spawnSync } from "child_process";
+import { dirname as dirname9 } from "path";
+import { fileURLToPath as fileURLToPath9 } from "url";
+function collectRules(store) {
+  return store.getActiveRules().filter((r) => EXPORT_RULE_SOURCES.includes(r.source)).map((r) => ({
+    layer: r.layer,
+    rule_type: r.ruleType,
+    pattern: r.pattern,
+    scope: r.scope,
+    confidence: r.confidence,
+    explanation: r.explanation,
+    source_event_count: (r.sourceEventIds || []).length,
+    trigger_count: r.triggerCount
+  }));
+}
+function collectSkills(skillMgr) {
+  return skillMgr.exportSkills();
+}
+function writeExportFiles(outDir, rules, skills) {
+  const written = [];
+  const rulesDir = join9(outDir, "rules");
+  mkdirSync5(rulesDir, { recursive: true });
+  const byLayer = /* @__PURE__ */ new Map();
+  for (const r of rules) {
+    if (!byLayer.has(r.layer)) byLayer.set(r.layer, []);
+    byLayer.get(r.layer).push(r);
+  }
+  for (const layer of [...byLayer.keys()].sort((a, b) => a - b)) {
+    const path6 = join9(rulesDir, `l${layer}_brain_rules.json`);
+    writeFileSync5(path6, JSON.stringify(byLayer.get(layer), null, 2), "utf-8");
+    written.push(path6);
+  }
+  if (rules.length === 0) {
+    const path6 = join9(rulesDir, "empty.txt");
+    writeFileSync5(path6, "(no brain rules to contribute)", "utf-8");
+    written.push(path6);
+  }
+  const skillsDir = join9(outDir, "skills");
+  mkdirSync5(skillsDir, { recursive: true });
+  for (const sk of skills) {
+    const path6 = join9(skillsDir, `${sk.name}.md`);
+    writeFileSync5(path6, sk.content || "", "utf-8");
+    written.push(path6);
+  }
+  if (skills.length === 0) {
+    const path6 = join9(skillsDir, "empty.txt");
+    writeFileSync5(path6, "(no brain skills to contribute)", "utf-8");
+    written.push(path6);
+  }
+  return written;
+}
+function runGit(args, cwd) {
+  const res = spawnSync("git", args, { cwd, encoding: "utf-8", timeout: 6e4 });
+  return {
+    code: res.status ?? 1,
+    stdout: res.stdout ?? "",
+    stderr: res.stderr ?? String(res.error ?? "")
+  };
+}
+function probeAccess(targetRepo) {
+  return runGit(["ls-remote", "--heads", targetRepo]).code === 0;
+}
+function buildCommitMessage(rules, skills) {
+  const lines = [
+    "feat(brain): \u8D21\u732E\u672C\u5730 LLM \u81EA\u5B66\u4E60\u6C89\u6DC0\u7684\u89C4\u5219\u4E0E Skill",
+    "",
+    `\u672C\u6B21\u8D21\u732E\u7531 AgentMoss Brain \u4ECE ${rules.length} \u6761\u89C4\u5219\u4E0E ${skills.length} \u4E2A Skill \u7EC4\u6210\uFF0C`,
+    "\u5747\u4E3A\u672C\u5730 LLM \u63D0\u53D6 + \u5BA1\u6838\u901A\u8FC7\u7684 active \u9879\u3002"
+  ];
+  if (rules.length > 0) {
+    lines.push("", "## \u89C4\u5219");
+    const byLayer = /* @__PURE__ */ new Map();
+    for (const r of rules) byLayer.set(r.layer, (byLayer.get(r.layer) ?? 0) + 1);
+    for (const [layer, cnt] of [...byLayer.entries()].sort((a, b) => a[0] - b[0])) {
+      lines.push(`- Layer ${layer}: ${cnt} \u6761`);
+    }
+    for (const r of rules.slice(0, 5)) {
+      lines.push(`  - [${r.rule_type}] ${r.pattern.slice(0, 80)} \u2014 ${r.explanation.slice(0, 60)}`);
+    }
+  }
+  if (skills.length > 0) {
+    lines.push("", "## Skill");
+    for (const sk of skills.slice(0, 5)) lines.push(`- ${sk.name}: ${sk.category || ""}`);
+  }
+  lines.push("", "Co-Authored-By: AgentMoss Brain <brain@agentmoss.local>");
+  return lines.join("\n");
+}
+function gitCommitAndPush(workdir, targetRepo, branch, rules, skills) {
+  runGit(["init", "-q"], workdir);
+  runGit(["remote", "add", "origin", targetRepo], workdir);
+  runGit(["fetch", "--depth", "1", "origin", "master"], workdir);
+  runGit(["checkout", "-q", "-b", branch, "FETCH_HEAD"], workdir);
+  runGit(["add", "-A"], workdir);
+  runGit(["commit", "-q", "-m", buildCommitMessage(rules, skills)], workdir);
+  const push = runGit(["push", "origin", branch], workdir);
+  if (push.code !== 0) {
+    throw new ContributionError(`push \u5230 ${targetRepo} \u5931\u8D25\uFF1A${push.stderr.trim().slice(0, 300)}`);
+  }
+  return push.stdout + push.stderr;
+}
+function extractMrUrl(pushOutput, targetRepo) {
+  for (const rawLine of pushOutput.split("\n")) {
+    const line = rawLine.trim();
+    if (line.includes("merge_requests/new") || line.includes("pull/new") || line.includes("new?source_branch")) {
+      return line;
+    }
+  }
+  if (targetRepo.includes("gitcode.com") || targetRepo.includes("atomgit.com")) {
+    return `https://gitcode.com/${extractRepoPath(targetRepo)}/branches`;
+  }
+  return "";
+}
+function extractRepoPath(repoUrl) {
+  let url = repoUrl;
+  if (url.startsWith("ssh://")) {
+    url = url.split("://")[1];
+    const first = url.split("/")[0];
+    if (first.includes("@")) url = url.slice(url.indexOf("/") + 1);
+  } else if (url.startsWith("git@") && url.includes(":")) {
+    url = url.split(":")[1];
+  } else if (url.startsWith("http")) {
+    url = url.split("://")[1];
+    const slash = url.indexOf("/");
+    if (slash >= 0) url = url.slice(slash + 1);
+  }
+  return url.replace(/\.git$/, "").replace(/^\/+|\/+$/g, "");
+}
+async function createMrViaApi(targetRepo, branch, title, desc) {
+  const token = process.env[TOKEN_ENV] || "";
+  if (!token) return false;
+  const repoPath = extractRepoPath(targetRepo);
+  const apiUrl = `https://gitcode.com/api/v4/projects/${encodeURIComponent(repoPath)}/merge_requests`;
+  try {
+    const resp = await fetch(apiUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "PRIVATE-TOKEN": token },
+      body: JSON.stringify({ source_branch: branch, target_branch: "master", title, description: desc }),
+      signal: AbortSignal.timeout(2e4)
+    });
+    return resp.status === 200 || resp.status === 201;
+  } catch {
+    return false;
+  }
+}
+function getCurrentUsername() {
+  const res = runGit(["config", "--get", "user.name"]);
+  return res.code === 0 ? res.stdout.trim() : "";
+}
+function buildForkSshUrl(username) {
+  return `ssh://git@${PLATFORM_SSH_HOST}/${username}/AgentMoss.git`;
+}
+function resolvePushTarget(opts) {
+  if (opts.target) return opts.target;
+  if (opts.forkUser) return buildForkSshUrl(opts.forkUser);
+  const username = getCurrentUsername();
+  if (username) return buildForkSshUrl(username);
+  throw new ContributionError(
+    "\u65E0\u6CD5\u786E\u5B9A push \u76EE\u6807\uFF1A\u8BF7\u5728\u7F51\u9875\u7AEF fork \u76EE\u6807\u4ED3\u5E93\u540E\u4F7F\u7528 --fork-user <\u7528\u6237\u540D>\uFF08\u6216\u76F4\u63A5 --target <\u4F60\u7684 fork SSH URL>\uFF09"
+  );
+}
+async function contribute(opts = {}) {
+  if (runGit(["version"]).code !== 0) {
+    console.log("\u9519\u8BEF\uFF1A\u672A\u68C0\u6D4B\u5230 git\uFF0C\u8D21\u732E\u529F\u80FD\u9700\u8981 git CLI\u3002");
+    return 2;
+  }
+  let pushTarget;
+  try {
+    pushTarget = resolvePushTarget(opts);
+  } catch (err) {
+    console.log(`[Brain] ${err.message}`);
+    return 2;
+  }
+  console.log(`[Brain] push \u76EE\u6807: ${pushTarget}`);
+  console.log(`[Brain] MR \u6307\u5411: ${DEFAULT_TARGET_REPO}`);
+  const store = new BrainRuleStore();
+  const skillsDir = resolveAssetDir(__dirname8, "skills") ?? join9(__dirname8, "..", "..", "agent_moss", "skills");
+  const skillMgr = new BrainSkillManager(skillsDir);
+  let rules;
+  let skills;
+  try {
+    rules = collectRules(store);
+    skills = collectSkills(skillMgr);
+  } finally {
+    skillMgr.close();
+  }
+  if (rules.length === 0 && skills.length === 0) {
+    console.log("[Brain] \u672C\u5730\u6CA1\u6709 active \u7684 brain \u89C4\u5219\u6216 skill\uFF0C\u65E0\u53EF\u8D21\u732E\u5185\u5BB9\u3002");
+    return 0;
+  }
+  console.log(`[Brain] \u5BFC\u51FA: ${rules.length} \u6761\u89C4\u5219, ${skills.length} \u4E2A Skill`);
+  const workdir = mkdtempSync(join9(tmpdir(), "agentmoss-contrib-"));
+  try {
+    writeExportFiles(join9(workdir, "agent_moss", "brain_contrib"), rules, skills);
+    console.log(`[Brain] \u63A2\u6D4B ${pushTarget} \u8BBF\u95EE\u6743\u9650 ...`);
+    if (!probeAccess(pushTarget)) {
+      const username = getCurrentUsername();
+      console.log(`[Brain] \u65E0\u6CD5\u8BBF\u95EE ${pushTarget}`, "");
+      if (username) {
+        console.log(`  \u5F53\u524D git \u7528\u6237: ${username}`);
+        console.log("  \u53EF\u80FD\u539F\u56E0\uFF1A\u4F60\u8FD8\u6CA1\u6709 fork \u76EE\u6807\u4ED3\u5E93\uFF0C\u6216 fork \u540D\u4E0D\u5339\u914D\u3002");
+        console.log(`  \u8BF7\u5148\u5728\u7F51\u9875\u7AEF fork: ${DEFAULT_TARGET_REPO}`);
+        console.log(`    \uFF08fork \u540E\u4F60\u7684\u4ED3\u5E94\u8BE5\u662F: ${buildForkSshUrl(username)}\uFF09`);
+      }
+      console.log("");
+      console.log("  \u5982\u679C\u4F60\u786E\u8BA4\u5DF2 fork \u4F46\u5BF9\u79C1\u4ED3\u8BBF\u95EE\u53D7\u9650\uFF1A");
+      console.log(`    \u6536\u4EF6\u4EBA: ${CONTACT_EMAIL}`);
+      console.log("    \u90AE\u4EF6\u6CE8\u660E: \u4F60\u7684 gitcode \u8D26\u53F7 + \u7533\u8BF7\u7406\u7531\uFF08\u8BBF\u95EE AgentMoss \u4ED3\u5E93\u4EE5\u63D0\u4EA4 PR\uFF09");
+      console.log("    fork \u540E\u91CD\u8BD5\u672C\u547D\u4EE4\uFF0C\u6216\u7528 --target <\u4F60\u7684 fork URL> \u663E\u5F0F\u6307\u5B9A\u3002");
+      return 1;
+    }
+    const branch = opts.branch || `brain-contrib/${(/* @__PURE__ */ new Date()).toISOString().replace(/[-:T]/g, "").slice(0, 15)}`;
+    console.log(`[Brain] \u63A8\u9001\u5206\u652F ${branch} \u2192 ${pushTarget}`);
+    const pushOutput = gitCommitAndPush(workdir, pushTarget, branch, rules, skills);
+    console.log("[Brain] \u63A8\u9001\u6210\u529F\u3002");
+    const title = `[Brain] \u8D21\u732E ${rules.length} \u6761\u89C4\u5219 + ${skills.length} \u4E2A Skill`;
+    const desc = buildCommitMessage(rules, skills);
+    if (await createMrViaApi(pushTarget, branch, title, desc)) {
+      console.log("[Brain] \u5DF2\u901A\u8FC7 API \u521B\u5EFA Merge Request\uFF1A");
+      console.log(`  ${branch} \u2192 master (MR \u6307\u5411 ${DEFAULT_TARGET_REPO})`);
+    } else {
+      const mrUrl = extractMrUrl(pushOutput, pushTarget);
+      console.log("");
+      console.log("[Brain] \u8BF7\u5728\u7F51\u9875\u7AEF\u521B\u5EFA Merge Request\uFF08from \u4F60\u7684 fork \u2192 shared \u4ED3 master\uFF09\uFF1A");
+      if (mrUrl) console.log(`  ${mrUrl}`);
+      console.log(`  \u5206\u652F: ${branch}  \u2192  master (\u76EE\u6807\u4ED3: ${DEFAULT_TARGET_REPO})`);
+      if (!process.env[TOKEN_ENV]) {
+        console.log(`  \uFF08\u63D0\u793A\uFF1A\u8BBE\u7F6E env ${TOKEN_ENV} \u53EF\u8BA9\u672C\u547D\u4EE4\u81EA\u52A8\u521B\u5EFA MR\uFF09`);
+      }
+    }
+    return 0;
+  } finally {
+    rmSync(workdir, { recursive: true, force: true });
+  }
+}
+var __dirname8, DEFAULT_TARGET_REPO, CONTACT_EMAIL, TOKEN_ENV, PLATFORM_SSH_HOST, EXPORT_RULE_SOURCES, ContributionError;
+var init_contributor = __esm({
+  "src/brain/contributor.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_rule_store();
+    init_skill_manager();
+    init_asset_dir();
+    __dirname8 = dirname9(fileURLToPath9(import.meta.url));
+    DEFAULT_TARGET_REPO = "ssh://git@atomgit.com/kenhkl/AgentMoss.git";
+    CONTACT_EMAIL = "kenhkl11@hotmail.com";
+    TOKEN_ENV = "AGENT_MOSS_CONTRIBUTE_TOKEN";
+    PLATFORM_SSH_HOST = "atomgit.com";
+    EXPORT_RULE_SOURCES = ["llm_extracted", "user"];
+    ContributionError = class extends Error {
+    };
+  }
+});
+
+// src/brain/index.ts
+function checkBrainRules(store, opts) {
+  if (!store) return null;
+  const rules = store.getActiveRules(opts.layer);
+  if (rules.length === 0) return null;
+  const combined = `${opts.actionType} ${opts.actionDetail}`;
+  for (const rule of rules) {
+    try {
+      if (new RegExp(rule.pattern, "i").test(combined)) {
+        if (opts.layer === 2 && opts.actionHistory) {
+          if (!checkLayer2Context(rule.pattern, opts.actionHistory, opts.actionDetail)) {
+            continue;
+          }
+        }
+        store.recordTrigger(rule.id);
         return {
           ruleId: rule.id,
           pattern: rule.pattern,
@@ -7796,6 +8713,9 @@ var init_brain = __esm({
     init_rule_store();
     init_pattern_extractor();
     init_reviewer();
+    init_skill_manager();
+    init_curator();
+    init_contributor();
   }
 });
 
@@ -9325,19 +10245,64 @@ function extractRawCommand(detail) {
 function matchesAny(cmd, patterns) {
   return patterns.some((p) => p.test(cmd));
 }
-function getBrainStore() {
+function getBrainStore(osType) {
   if (!isBrainEnabled()) return null;
   if (!_brainInitialized) {
     _brainStore = new BrainRuleStore();
-    _brainExtractor = new PatternExtractor(_brainStore, { review: createBrainReviewer() });
+    const skillsDir = resolveAssetDir(__dirname, "skills");
+    _brainSkillManager = skillsDir ? new BrainSkillManager(skillsDir) : null;
+    _brainExtractor = new PatternExtractor(_brainStore, {
+      review: createBrainReviewer(),
+      // 内置规则去重集（对齐 Python coordinator._ensure_brain 收集的 builtin_patterns）：
+      // 危险命令正则 + 敏感路径（deny_* 或 credential）。
+      // 历史 bug：TS 这里只传 review，不传 builtinPatterns → 提取器拿不到内置规则，
+      // `isCoveredByBuiltin` 恒 False → 把 L1/L2 本来就能拦的案例重复沉淀成 Brain 规则。
+      builtinPatterns: collectBrainBuiltinPatterns(osType),
+      skillManager: _brainSkillManager
+    });
+    if (_brainSkillManager) {
+      _brainCurator = new BrainCurator(_brainStore, _brainSkillManager);
+    }
     _brainInitialized = true;
   }
+  const now = Date.now();
+  if (_brainCurator && now - _brainLastMaintenance >= BRAIN_MAINT_INTERVAL_MS) {
+    try {
+      _brainCurator.runMaintenance({ autoApprove: true });
+    } catch {
+    }
+    _brainLastMaintenance = now;
+  }
   return _brainStore;
 }
+function collectBrainBuiltinPatterns(osType) {
+  const bridge = runtimeConfigBridge.current;
+  if (!bridge) return [];
+  const out = [];
+  try {
+    for (const cp of bridge.effectiveDangerousPatterns(osType)) {
+      if (cp?.pattern?.source) out.push(cp.pattern.source);
+    }
+  } catch {
+  }
+  try {
+    for (const sp of bridge.effectiveSensitivePaths(osType)) {
+      const denyMode = String(sp?.denyMode || "");
+      if (["deny_both", "deny_write", "deny_read"].includes(denyMode) || sp?.credential) {
+        if (sp?.path) out.push(sp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+      }
+    }
+  } catch {
+  }
+  return out.filter(Boolean);
+}
 function _resetBrainForTest() {
   _brainStore = null;
   _brainExtractor = null;
+  _brainSkillManager = null;
+  _brainCurator = null;
   _brainInitialized = false;
+  _brainLastMaintenance = 0;
 }
 async function runAnalysis(input) {
   const observedFormalLayers = [];
@@ -9389,7 +10354,7 @@ async function runAnalysis(input) {
       }
     }
   }
-  const brainStore = getBrainStore();
+  const brainStore = getBrainStore(input.osType);
   if (brainStore) {
     const brainL1 = checkBrainRules(brainStore, {
       layer: 1,
@@ -9686,7 +10651,7 @@ async function runAnalysis(input) {
   }
   return llmResult;
 }
-var FULLY_SAFE_TOOLS, TRUSTED_SKILLS_BASE, READONLY_SENSITIVE_TOOLS, _brainStore, _brainExtractor, _brainInitialized, formalEngine;
+var FULLY_SAFE_TOOLS, TRUSTED_SKILLS_BASE, READONLY_SENSITIVE_TOOLS, _brainStore, _brainExtractor, _brainSkillManager, _brainCurator, _brainInitialized, _brainLastMaintenance, BRAIN_MAINT_INTERVAL_MS, formalEngine;
 var init_coordinator = __esm({
   "src/engine/coordinator.ts"() {
     "use strict";
@@ -9703,7 +10668,11 @@ var init_coordinator = __esm({
     init_agents();
     init_scenarios();
     init_brain();
+    init_skill_manager();
+    init_curator();
     init_reviewer();
+    init_asset_dir();
+    init_runtime_config_bridge();
     init_formal_engine();
     FULLY_SAFE_TOOLS = /* @__PURE__ */ new Set([
       "ask_user_question",
@@ -9726,122 +10695,495 @@ var init_coordinator = __esm({
     ]);
     _brainStore = null;
     _brainExtractor = null;
+    _brainSkillManager = null;
+    _brainCurator = null;
     _brainInitialized = false;
+    _brainLastMaintenance = 0;
+    BRAIN_MAINT_INTERVAL_MS = 3e5;
     formalEngine = new FormalEngine();
   }
 });
 
-// src/cli.ts
-init_esm_shims();
-
-// src/server.ts
-init_esm_shims();
-import { Hono as Hono2 } from "hono";
-import { cors } from "hono/cors";
-import { logger } from "hono/logger";
-import net from "net";
-
-// src/routes.ts
-init_esm_shims();
-
-// src/models.ts
-init_esm_shims();
-import { z } from "zod";
-
-// src/package-json.ts
-init_esm_shims();
-import { createRequire } from "module";
-var require2 = createRequire(import.meta.url);
-var pkg = require2("../package.json");
-var version = pkg.version;
-
-// src/models.ts
-var ActionItemSchema = z.object({
-  action_type: z.string().describe("Action type, e.g. bash, file_read, file_write"),
-  action_detail: z.string().describe("Action detail / command content"),
-  // 工具返回给 agent 的内容。仅 L2 的授权（consent）判定用：判断「用户是否已授权」
-  // 看的是 ask_user_question 的**回答**，不是提问正文。历史 bug：模型里没有这个字段、
-  // 路由也没透传，TS 的授权判定退化成「提问正文非空」，等于问过任何问题即已授权。
-  output: z.string().optional().describe("Tool result / user answer (needed by L2 consent checks)")
-});
-var PromptTurnSchema = z.object({
-  text: z.string().default("").describe("User prompt text at this turn"),
-  actions: z.array(ActionItemSchema).default([]).describe("Actions triggered by this prompt, in order, until the next prompt")
-});
-var AnalyzeRequestSchema = z.object({
-  session_id: z.string().describe("Session / agent unique identifier"),
-  prompt_session: z.string().default("").describe("User original prompt (most recent user message; backward compat)"),
-  prompt_history: z.array(PromptTurnSchema).default([]).describe("Full interleaved prompt history (ordered turns, each with its triggered actions). Optional; empty = fall back to prompt_session only."),
-  action_history: z.array(ActionItemSchema).default([]).describe("Historical action sequence"),
-  session_history: z.array(z.object({
-    session_id: z.string(),
-    action_history: z.array(ActionItemSchema).default([])
-  })).default([]).describe("Multi-session historical actions (optional): for L2.2 formal engine cross-session combo-chain / sensitive-data-flow verification. Provided by caller (incl. future agentgate)."),
-  a_next: ActionItemSchema.describe("Next action to be executed"),
-  reason: z.string().default("").describe("Reason for executing this action"),
-  os_type: z.string().default("").describe("OS type: 'linux', 'windows', or empty for auto-detect"),
-  cwd: z.string().default("").describe("Current working directory"),
-  agent_id: z.string().default("").describe("Caller agent identifier, e.g. 'xiaoo' / 'opencode' / 'opendesk'. Empty = generic mode (no agent-specific rules)."),
-  metadata: z.record(z.unknown()).optional().describe("Extended metadata")
-});
-var AnalyzeResponseSchema = z.object({
-  decision: z.enum(["Allow", "Deny"]).describe("Allow or Deny"),
-  reason: z.string().describe("Decision reason"),
-  risk_level: z.enum(["low", "medium", "high", "critical"]).default("low"),
-  risk_type: z.string().default(""),
-  violated_layers: z.array(z.string()).default([]),
-  policy: z.string().default(""),
-  violated_policy: z.string().default(""),
-  confidence: z.number().int().min(0).max(100).default(100),
-  analysis_duration_ms: z.number().default(0),
-  // 组合攻击链反例路径：每步 [session_id, seq, stage, timestamp]，含真实发生时间
-  violation_chain: z.array(z.array(z.union([z.string(), z.number()]).nullable())).default([])
-});
-var HealthResponseSchema = z.object({
-  status: z.string().default("healthy"),
-  version: z.string().default(version),
-  // 归属实例标识：值来自 env AGENT_MOSS_INSTANCE（spawn/systemd 注入），默认空串。
-  // 多个 agentmoss 同机并存时，调用方按 instance 过滤避免连到别人的进程。
-  // 空=未配置（独立部署或旧版），调用方可选择兼容或严格过滤。
-  instance: z.string().default("")
-});
-var ReviewRequestSchema = z.object({
-  agent_id: z.string().default("").describe("\u76EE\u6807 agent \u6807\u8BC6\uFF08\u51B3\u5B9A\u72B6\u6001\u5E93\u5206\u6876\uFF09"),
-  db_path: z.string().default("").describe("AgentGate \u672C\u5730\u5B58\u50A8\u8DEF\u5F84\uFF08SQLite \u6587\u4EF6 \u6216 tool_calls JSON \u76EE\u5F55\uFF09\uFF1B\u4E3A\u7A7A\u5219\u7528 sessions"),
-  sessions: z.array(z.object({
-    session_id: z.string(),
-    action_history: z.array(ActionItemSchema).default([])
-  })).default([]).describe("\u591A session \u5386\u53F2\u52A8\u4F5C\uFF08\u66FF\u4EE3/\u515C\u5E95 db_path\uFF09"),
-  a_next: ActionItemSchema.optional().describe("\u53EF\u9009\uFF1Aseed \u540E\u8FDE\u540C\u5F53\u524D\u52A8\u4F5C\u4E00\u8D77\u5224\u5B9A"),
-  is_error: z.boolean().default(false).describe("\u5F53\u524D\u52A8\u4F5C\u6267\u884C\u662F\u5426\u5931\u8D25"),
-  output_pending: z.boolean().default(false).describe("\u8FD4\u56DE\u524D\u5E8F\u94FE\u6E05\u5355 pending_prefixes")
-});
-var ReviewResponseSchema = z.object({
-  agent_id: z.string().default(""),
-  seeded_nodes: z.number().default(0),
-  verified: z.boolean().default(true),
-  violations: z.array(z.record(z.unknown())).default([]),
-  pending_prefixes: z.array(z.record(z.unknown())).default([]),
-  state_nodes: z.number().default(0),
-  discovered_patterns: z.array(z.record(z.unknown())).default([]).describe("\u6570\u636E\u9A71\u52A8\u53D1\u73B0\uFF1A\u8DE8 session \u9891\u7E41\u5371\u9669\u7EC4\u5408\uFF08\u9884\u7F6E\u94FE\u76F2\u533A\uFF0CPatternMiner\uFF09")
+// src/infra/policy-cache.ts
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync15, mkdirSync as mkdirSync7, readdirSync as readdirSync5, readFileSync as readFileSync15, rmdirSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync7 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join11 } from "path";
+function cacheDir() {
+  return cacheDirOverride ?? CACHE_DIR;
+}
+function getDefaultCache() {
+  if (!defaultCache) defaultCache = new PolicyCache(getCacheOptions());
+  return defaultCache;
+}
+var CACHE_DIR, cacheDirOverride, PolicyCache, defaultCache;
+var init_policy_cache = __esm({
+  "src/infra/policy-cache.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_config();
+    CACHE_DIR = join11(tmpdir2(), "agent_moss_policy_cache");
+    cacheDirOverride = null;
+    PolicyCache = class {
+      // Map 的插入序即 LRU 序（get 时重新 set 到末尾）
+      constructor(options) {
+        this.options = options;
+      }
+      options;
+      memory = /* @__PURE__ */ new Map();
+      cacheKey(sessionId, promptSession) {
+        return `${sessionId}::${promptSession}`;
+      }
+      cacheFilePath(sessionId, promptSession) {
+        const promptHash = createHash2("md5").update(promptSession).digest("hex").slice(0, 12);
+        const safeSessionId = sessionId.replace(/\//g, "_").replace(/\\/g, "_");
+        return join11(cacheDir(), safeSessionId, `${promptHash}.toml`);
+      }
+      /** 取缓存：内存 → 文件；未命中返回 null。 */
+      get(sessionId, promptSession) {
+        if (!this.options.enabled) return null;
+        const key = this.cacheKey(sessionId, promptSession);
+        const hit = this.memory.get(key);
+        if (hit !== void 0) {
+          this.memory.delete(key);
+          this.memory.set(key, hit);
+          return hit;
+        }
+        const file = this.cacheFilePath(sessionId, promptSession);
+        if (existsSync15(file)) {
+          try {
+            const policy = readFileSync15(file, "utf-8");
+            this.remember(key, policy);
+            return policy;
+          } catch {
+          }
+        }
+        return null;
+      }
+      /** 写缓存（内存 + 文件）。落盘失败不影响判定（缓存是旁路产物）。 */
+      put(sessionId, promptSession, policy) {
+        if (!this.options.enabled) return;
+        this.remember(this.cacheKey(sessionId, promptSession), policy);
+        const file = this.cacheFilePath(sessionId, promptSession);
+        try {
+          mkdirSync7(join11(cacheDir(), sessionId.replace(/\//g, "_").replace(/\\/g, "_")), { recursive: true });
+          writeFileSync7(file, policy, "utf-8");
+        } catch {
+        }
+      }
+      remember(key, policy) {
+        if (this.memory.has(key)) this.memory.delete(key);
+        this.memory.set(key, policy);
+        while (this.memory.size > this.options.maxSize) {
+          const oldest = this.memory.keys().next().value;
+          if (oldest === void 0) break;
+          this.memory.delete(oldest);
+        }
+      }
+      invalidate(sessionId, promptSession) {
+        this.memory.delete(this.cacheKey(sessionId, promptSession));
+        try {
+          unlinkSync3(this.cacheFilePath(sessionId, promptSession));
+        } catch {
+        }
+      }
+      invalidateSession(sessionId) {
+        for (const k of [...this.memory.keys()]) {
+          if (k.startsWith(`${sessionId}::`)) this.memory.delete(k);
+        }
+        const safeSessionId = sessionId.replace(/\//g, "_").replace(/\\/g, "_");
+        const dir = join11(cacheDir(), safeSessionId);
+        try {
+          if (existsSync15(dir)) {
+            for (const f of readdirSync5(dir)) {
+              try {
+                unlinkSync3(join11(dir, f));
+              } catch {
+              }
+            }
+            rmdirSync(dir);
+          }
+        } catch {
+        }
+      }
+      clear() {
+        this.memory.clear();
+        try {
+          if (existsSync15(cacheDir())) {
+            for (const sessionDir of readdirSync5(cacheDir())) {
+              const dir = join11(cacheDir(), sessionDir);
+              try {
+                for (const f of readdirSync5(dir)) unlinkSync3(join11(dir, f));
+                rmdirSync(dir);
+              } catch {
+              }
+            }
+          }
+        } catch {
+        }
+      }
+      /** 当前内存缓存条目数。 */
+      size() {
+        return this.memory.size;
+      }
+    };
+    defaultCache = null;
+  }
 });
 
-// src/routes.ts
-init_coordinator();
-
-// src/actrail.ts
-init_esm_shims();
-import * as fs5 from "fs";
+// src/infra/logging.ts
+function safe(value, limit = 200) {
+  const s = String(value ?? "");
+  return s.length > limit ? `${s.slice(0, limit)}\u2026` : s;
+}
+var MossLogger;
+var init_logging = __esm({
+  "src/infra/logging.ts"() {
+    "use strict";
+    init_esm_shims();
+    MossLogger = class {
+      constructor(sessionId) {
+        this.sessionId = sessionId;
+      }
+      sessionId;
+      stepTimes = {};
+      stepStart = null;
+      startTime = Date.now();
+      prefix() {
+        return `[${safe(this.sessionId, 64)}]`;
+      }
+      logInput(promptSession, actionHistory, aNext, reason) {
+        console.error(
+          `${this.prefix()} agent_moss \u8F93\u5165 | prompt=${safe(promptSession, 100)}\u2026 | \u5386\u53F2\u52A8\u4F5C\u6570=${actionHistory.length} | \u4E0B\u4E00\u6B65\u52A8\u4F5C=${safe(aNext?.action_type ?? "?", 32)}:${safe(aNext?.action_detail ?? "?", 80)} | \u7406\u7531=${safe(reason, 80)}`
+        );
+      }
+      startStep(stepName) {
+        this.stepStart = Date.now();
+      }
+      endStep(stepName, detail = "") {
+        if (this.stepStart === null) return;
+        const elapsed = (Date.now() - this.stepStart) / 1e3;
+        this.stepTimes[stepName] = elapsed;
+        const detailStr = detail ? ` | ${safe(detail)}` : "";
+        console.error(
+          `${this.prefix()} \u6B65\u9AA4\u5B8C\u6210: ${safe(stepName, 48)} | \u8017\u65F6=${elapsed.toFixed(3)}s${detailStr}`
+        );
+        this.stepStart = null;
+      }
+      logLlmInteraction(step, promptSummary, responseSummary) {
+        console.error(
+          `${this.prefix()} LLM\u4EA4\u4E92 | \u6B65\u9AA4=${safe(step, 48)} | PROMPT\u6458\u8981=${safe(promptSummary, 200)} | \u54CD\u5E94\u6458\u8981=${safe(responseSummary, 200)}`
+        );
+      }
+      logResult(decision, reason, policy = "") {
+        const total = (Date.now() - this.startTime) / 1e3;
+        const steps = Object.entries(this.stepTimes).map(([k, v]) => `${safe(k, 48)}=${v.toFixed(3)}s`).join(", ");
+        console.error(
+          `${this.prefix()} agent_moss \u7ED3\u679C | \u51B3\u7B56=${safe(decision, 16)} | \u7406\u7531=${safe(reason, 150)} | \u6B65\u9AA4\u8017\u65F6=[${steps}] | \u603B\u8017\u65F6=${total.toFixed(3)}s`
+        );
+        if (policy) {
+          console.error(`${this.prefix()} \u751F\u6210\u7684Policy:
+${safe(policy, 2e3)}`);
+        }
+      }
+      logError(step, error) {
+        const name = error?.name ?? typeof error;
+        console.error(
+          `${this.prefix()} \u6B65\u9AA4\u5F02\u5E38: ${safe(step, 48)} | \u9519\u8BEF=${name}: ${safe(error?.message ?? error)}`
+        );
+      }
+    };
+  }
+});
 
-// src/infra/esm-require.ts
-init_esm_shims();
-import { createRequire as createRequire2 } from "module";
-var requireFromHere = createRequire2(import.meta.url);
-function esmRequire(id) {
-  return requireFromHere(id);
+// src/engine/analyzer.ts
+var analyzer_exports = {};
+__export(analyzer_exports, {
+  DEFAULT_READONLY_POLICY: () => DEFAULT_READONLY_POLICY,
+  POLICY_OUTPUT_DIR: () => POLICY_OUTPUT_DIR,
+  _setPolicyOutputDirForTest: () => _setPolicyOutputDirForTest,
+  analyze: () => analyze,
+  buildPolicyPrompt: () => buildPolicyPrompt,
+  parsePolicyFromLlm: () => parsePolicyFromLlm,
+  policyOutputDir: () => policyOutputDir,
+  savePolicyToFile: () => savePolicyToFile,
+  validateToml: () => validateToml
+});
+import { existsSync as existsSync16, mkdirSync as mkdirSync8, readFileSync as readFileSync16, writeFileSync as writeFileSync8 } from "fs";
+import { tmpdir as tmpdir3 } from "os";
+import { join as join12, resolve as resolve10 } from "path";
+import { parse as parseToml } from "smol-toml";
+function _setPolicyOutputDirForTest(dir) {
+  policyOutputDirOverride = dir;
+}
+function policyOutputDir() {
+  return policyOutputDirOverride ?? POLICY_OUTPUT_DIR;
+}
+function savePolicyToFile(sessionId, policyToml) {
+  if (!isPolicySaveEnabled()) return null;
+  try {
+    const outDir = policyOutputDir();
+    mkdirSync8(outDir, { recursive: true });
+    const safeName = sessionId.replace(/\//g, "_").replace(/\\/g, "_");
+    const filepath = join12(outDir, `${safeName}.toml`);
+    writeFileSync8(filepath, policyToml, "utf-8");
+    return filepath;
+  } catch (err) {
+    console.warn(`[AgentMoss] \u7B56\u7565\u6587\u4EF6\u843D\u76D8\u5931\u8D25\uFF08\u4E0D\u5F71\u54CD\u5224\u5B9A\uFF09: ${policyOutputDir()}: ${String(err)}`);
+    return null;
+  }
+}
+function parsePolicyFromLlm(response) {
+  const tomlBlock = response.match(/```toml\s*\n([\s\S]*?)```/);
+  if (tomlBlock) {
+    const s = tomlBlock[1].trim();
+    validateToml(s);
+    return s;
+  }
+  const anyBlock = response.match(/```\s*\n([\s\S]*?)```/);
+  if (anyBlock) {
+    const s = anyBlock[1].trim();
+    try {
+      validateToml(s);
+      return s;
+    } catch {
+    }
+  }
+  const whole = response.trim();
+  validateToml(whole);
+  return whole;
+}
+function validateToml(tomlStr) {
+  try {
+    parseToml(tomlStr);
+  } catch (err) {
+    throw new Error(`TOML \u89E3\u6790\u5931\u8D25: ${err.message}`);
+  }
+}
+function loadPolicyMappingDoc() {
+  const dir = resolveAssetDir(__dirname, "templates");
+  if (dir) {
+    const p = resolve10(dir, "policy_mapping.md");
+    if (existsSync16(p)) return readFileSync16(p, "utf-8");
+  }
+  for (const cand of assetDirCandidates(__dirname, "templates")) {
+    const p = resolve10(cand, "policy_mapping.md");
+    if (existsSync16(p)) return readFileSync16(p, "utf-8");
+  }
+  return "";
+}
+function buildPolicyPrompt(promptSession) {
+  const template = loadTemplates()["prompt1"] || "";
+  return template.replaceAll("{prompt_policy_mapping_doc}", loadPolicyMappingDoc()).replaceAll("{prompt_session}", promptSession);
+}
+async function generatePolicyWithLLM(sessionId, promptSession) {
+  const { default: OpenAI3 } = await import("openai");
+  const cfg = getLLMConfig();
+  const timeoutCfg = getTimeoutConfig();
+  const retryCfg = getRetryConfig();
+  const client = new OpenAI3({
+    baseURL: cfg.baseUrl,
+    apiKey: cfg.apiKey,
+    timeout: (cfg.timeout || timeoutCfg.prompt1Timeout) * 1e3
+  });
+  const prompt1 = buildPolicyPrompt(promptSession);
+  let lastErr = null;
+  for (let attempt = 1; attempt <= Math.max(1, retryCfg.maxRetries); attempt++) {
+    try {
+      const resp = await client.chat.completions.create({
+        model: cfg.model,
+        temperature: 0.1,
+        messages: [{ role: "user", content: prompt1 }]
+      });
+      try {
+        const usage = resp.usage || {};
+        recordTokenUsage({
+          sessionId,
+          step: "step2_policy_gen",
+          model: cfg.model,
+          promptTokens: usage.prompt_tokens || 0,
+          completionTokens: usage.completion_tokens || 0,
+          totalTokens: usage.total_tokens || 0
+        });
+      } catch {
+      }
+      return parsePolicyFromLlm(resp.choices?.[0]?.message?.content || "");
+    } catch (err) {
+      lastErr = err;
+      if (attempt < Math.max(1, retryCfg.maxRetries)) {
+        await new Promise((r) => setTimeout(r, retryCfg.retryInterval * 1e3));
+      }
+    }
+  }
+  throw lastErr ?? new Error("\u7B56\u7565\u751F\u6210\u5931\u8D25");
 }
+function allowResult(policy, judgment) {
+  return {
+    decision: "Allow",
+    reason: judgment.reason,
+    risk_level: judgment.riskLevel,
+    risk_type: judgment.riskType,
+    violated_layers: judgment.violatedLayers || [],
+    policy,
+    violated_policy: "",
+    confidence: judgment.confidence
+  };
+}
+async function analyze(input) {
+  const mossLog = new MossLogger(input.sessionId);
+  try {
+    return await analyzeInner(input, mossLog);
+  } catch (err) {
+    mossLog.logError("unknown", err);
+    const result = {
+      decision: "Deny",
+      reason: `\u5206\u6790\u8FC7\u7A0B\u53D1\u751F\u672A\u9884\u671F\u5F02\u5E38\uFF1A${String(err)}`,
+      risk_level: "high",
+      risk_type: "",
+      violated_layers: [],
+      policy: "",
+      violated_policy: "\u672A\u77E5\u5F02\u5E38",
+      confidence: 100
+    };
+    mossLog.logResult("Deny", result.reason);
+    return result;
+  }
+}
+async function analyzeInner(input, mossLog) {
+  mossLog.logInput(input.promptSession, input.actionHistory || [], input.aNext, input.reason || "");
+  mossLog.startStep("step1_security_judge");
+  const judgment = await runAnalysis(input);
+  mossLog.endStep(
+    "step1_security_judge",
+    `allowed=${judgment.allowed}, risk_level=${judgment.riskLevel}, source=${judgment.source}`
+  );
+  if (!judgment.allowed) {
+    const denied = {
+      decision: "Deny",
+      reason: judgment.reason,
+      risk_level: judgment.riskLevel,
+      risk_type: judgment.riskType,
+      violated_layers: judgment.violatedLayers || [],
+      policy: "",
+      violated_policy: `[${judgment.riskType}] ${judgment.reason}`,
+      confidence: judgment.confidence
+    };
+    mossLog.logResult("Deny", denied.reason);
+    return denied;
+  }
+  const cache3 = getDefaultCache();
+  mossLog.startStep("step2_cache_lookup");
+  const cached = cache3.get(input.sessionId, input.promptSession);
+  if (cached !== null) {
+    mossLog.endStep("step2_cache_lookup", "\u7F13\u5B58\u547D\u4E2D");
+    savePolicyToFile(input.sessionId, cached);
+    const res = allowResult(cached, judgment);
+    mossLog.logResult("Allow", res.reason, cached);
+    return res;
+  }
+  if (!isPolicyGenEnabled()) {
+    mossLog.endStep("step2_cache_lookup", "\u7F13\u5B58\u672A\u547D\u4E2D\uFF0CPolicy \u751F\u6210\u5DF2\u7981\u7528");
+    mossLog.startStep("step2_default_policy");
+    cache3.put(input.sessionId, input.promptSession, DEFAULT_READONLY_POLICY);
+    savePolicyToFile(input.sessionId, DEFAULT_READONLY_POLICY);
+    const res = allowResult(DEFAULT_READONLY_POLICY, judgment);
+    mossLog.endStep("step2_default_policy", "\u4F7F\u7528\u9ED8\u8BA4\u6700\u5C0F\u6743\u9650 Policy");
+    mossLog.logResult("Allow", res.reason, DEFAULT_READONLY_POLICY);
+    return res;
+  }
+  if (judgment.source === "whitelist_bypass") {
+    mossLog.endStep("step2_cache_lookup", "\u7F13\u5B58\u672A\u547D\u4E2D\uFF0C\u767D\u540D\u5355\u5DE5\u5177");
+    cache3.put(input.sessionId, input.promptSession, DEFAULT_READONLY_POLICY);
+    savePolicyToFile(input.sessionId, DEFAULT_READONLY_POLICY);
+    const res = allowResult(DEFAULT_READONLY_POLICY, judgment);
+    mossLog.logResult("Allow", res.reason, DEFAULT_READONLY_POLICY);
+    return res;
+  }
+  mossLog.endStep("step2_cache_lookup", "\u7F13\u5B58\u672A\u547D\u4E2D\uFF0C\u542F\u7528 LLM \u751F\u6210");
+  mossLog.startStep("step2_generate_policy");
+  try {
+    const policy = await generatePolicyWithLLM(input.sessionId, input.promptSession);
+    cache3.put(input.sessionId, input.promptSession, policy);
+    savePolicyToFile(input.sessionId, policy);
+    mossLog.endStep("step2_generate_policy", "Policy \u751F\u6210\u5E76\u7F13\u5B58\u6210\u529F");
+    const res = allowResult(policy, judgment);
+    mossLog.logResult("Allow", res.reason, policy);
+    return res;
+  } catch (err) {
+    mossLog.endStep("step2_generate_policy", `\u5931\u8D25: ${String(err)}`);
+    mossLog.logError("step2_generate_policy", err);
+    const failed = {
+      decision: "Deny",
+      reason: `\u5B89\u5168\u68C0\u6D4B\u901A\u8FC7\uFF0C\u4F46\u7B56\u7565\u751F\u6210\u5931\u8D25\uFF1A${String(err)}`,
+      risk_level: judgment.riskLevel,
+      risk_type: judgment.riskType,
+      violated_layers: judgment.violatedLayers || [],
+      policy: "",
+      violated_policy: "\u65E0\u6CD5\u751F\u6210\u7B56\u7565\uFF1ALLM \u670D\u52A1\u5F02\u5E38\u6216\u8FD4\u56DE\u683C\u5F0F\u65E0\u6548",
+      confidence: judgment.confidence
+    };
+    mossLog.logResult("Deny", failed.reason);
+    return failed;
+  }
+}
+var POLICY_OUTPUT_DIR, policyOutputDirOverride, DEFAULT_READONLY_POLICY;
+var init_analyzer = __esm({
+  "src/engine/analyzer.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_coordinator();
+    init_policy_cache();
+    init_config();
+    init_template_loader();
+    init_asset_dir();
+    init_token_stats();
+    init_logging();
+    POLICY_OUTPUT_DIR = join12(tmpdir3(), "agent_moss");
+    policyOutputDirOverride = null;
+    DEFAULT_READONLY_POLICY = `landlock_optional = false
+mount_isolation_fallback = false
+
+[path_groups]
+system_binaries = true
+system_libraries = true
+temp_directories = true
+device_files = false
+proc_filesystem = false
+network_config = false
+wsl_paths = false
+
+[namespaces]
+mount = true
+pid = false
+network = true
+user = false
+
+[resources]
+timeout_secs = 30
+max_memory_bytes = 268435456
+
+[environment]
+whitelist = ["PATH", "LANG", "HOME", "USER", "HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy", "ALL_PROXY", "all_proxy", "NO_PROXY", "no_proxy"]
+`;
+  }
+});
+
+// src/infra/esm-require.ts
+import { createRequire as createRequire2 } from "module";
+function esmRequire(id) {
+  return requireFromHere(id);
+}
+var requireFromHere;
+var init_esm_require = __esm({
+  "src/infra/esm-require.ts"() {
+    "use strict";
+    init_esm_shims();
+    requireFromHere = createRequire2(import.meta.url);
+  }
+});
 
 // src/actrail.ts
+import * as fs5 from "fs";
 function escape(value) {
   return value.replace(/\\/g, "\\\\").replace(/\n/g, "\\n").replace(/=/g, "\\e");
 }
@@ -9939,15 +11281,15 @@ function reportEnforcementEvent(opts) {
     return false;
   }
 }
-
-// src/routes.ts
-init_formal_engine();
+var init_actrail = __esm({
+  "src/actrail.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_esm_require();
+  }
+});
 
 // src/engine/formal-engine/pattern_miner.ts
-init_esm_shims();
-init_builder();
-var DANGER_STAGES = /* @__PURE__ */ new Set(["PRIVESC", "EXFIL", "LISTEN"]);
-var SENSITIVE_PAIRS = /* @__PURE__ */ new Set(["CRED|LISTEN", "LISTEN|CRED"]);
 function projectStages(actionHistory) {
   const stages = [];
   let prev = null;
@@ -10019,19 +11361,21 @@ function mineDangerousPatterns(sessions, minSup = 2, maxLen = 4) {
   out.sort((a, b) => b.support - a.support || b.pattern.length - a.pattern.length);
   return out;
 }
+var DANGER_STAGES, SENSITIVE_PAIRS;
+var init_pattern_miner = __esm({
+  "src/engine/formal-engine/pattern_miner.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_builder();
+    DANGER_STAGES = /* @__PURE__ */ new Set(["PRIVESC", "EXFIL", "LISTEN"]);
+    SENSITIVE_PAIRS = /* @__PURE__ */ new Set(["CRED|LISTEN", "LISTEN|CRED"]);
+  }
+});
 
 // src/agent-gate-reader.ts
-init_esm_shims();
 import * as fs6 from "fs";
 import * as os3 from "os";
 import * as path5 from "path";
-var DEFAULT_AGENTGATE_SQLITE = path5.join(
-  os3.homedir(),
-  ".local",
-  "share",
-  "agent_gate",
-  "agent_gate_ts.db"
-);
 function normalizeAction(row) {
   return {
     actionType: String(row.action_type || row.tool_name || row.name || ""),
@@ -10115,8 +11459,97 @@ function loadAgentGateSessions(dbPath = "") {
   const jsonDefault = path5.join(os3.homedir(), ".local", "share", "agent_gate", "tool_calls");
   return readJsonDir(jsonDefault);
 }
+var DEFAULT_AGENTGATE_SQLITE;
+var init_agent_gate_reader = __esm({
+  "src/agent-gate-reader.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_esm_require();
+    DEFAULT_AGENTGATE_SQLITE = path5.join(
+      os3.homedir(),
+      ".local",
+      "share",
+      "agent_gate",
+      "agent_gate_ts.db"
+    );
+  }
+});
+
+// src/adapters/observable.ts
+function isRawFormat(data) {
+  if (!data || typeof data !== "object") return false;
+  const d = data;
+  if ("current_action" in d) return true;
+  if (!("a_next" in d)) return true;
+  if (!("session_id" in d) && "agent_id" in d) return true;
+  return false;
+}
+function adaptObservable(rawData) {
+  const sessionId = rawData.session_id || rawData.agent_id || "unknown";
+  const actionRaw = rawData.a_next || rawData.current_action || {};
+  const aNext = actionRaw && typeof actionRaw === "object" ? {
+    action_type: actionRaw.action_type || actionRaw.tool || "unknown",
+    action_detail: actionRaw.action_detail || actionRaw.command || ""
+  } : { action_type: "unknown", action_detail: "" };
+  const historyRaw = Array.isArray(rawData.action_history) ? rawData.action_history : [];
+  const actionHistory = historyRaw.filter((h) => h && typeof h === "object").map((h) => {
+    const item = {
+      action_type: String(h.action_type || h.name || h.tool || ""),
+      action_detail: String(h.action_detail || h.command || "")
+    };
+    if ("output" in h) item.output = h.output ?? "";
+    return item;
+  });
+  const result = {
+    session_id: sessionId,
+    prompt_session: rawData.prompt_session || rawData.prompt || "",
+    action_history: actionHistory,
+    a_next: aNext,
+    reason: rawData.reason || (actionRaw && typeof actionRaw === "object" ? actionRaw.description : "") || "",
+    os_type: rawData.os_type || "",
+    cwd: rawData.cwd || "",
+    agent_id: rawData.agent_id || ""
+  };
+  if (!result.reason && actionRaw && typeof actionRaw === "object") {
+    result.reason = actionRaw.description || "";
+  }
+  let metadata = rawData.metadata;
+  if (!metadata || typeof metadata !== "object" || Object.keys(metadata).length === 0) {
+    metadata = {};
+    for (const k of ["agent_id", "sandbox_id", "trace_id"]) {
+      if (k in rawData && !(k in result)) metadata[k] = rawData[k];
+    }
+  }
+  if (metadata && Object.keys(metadata).length > 0) result.metadata = metadata;
+  return result;
+}
+function normalizeObservablePayload(body) {
+  if (!isRawFormat(body)) return body;
+  const adapted = adaptObservable(body);
+  const actionType = String(adapted.a_next?.action_type || "").trim().toLowerCase();
+  const actionDetail = String(adapted.a_next?.action_detail || "").trim();
+  if (!actionDetail && (actionType === "" || actionType === "unknown")) {
+    const err = new Error(
+      "\u65E0\u6CD5\u8BC6\u522B\u672C\u6B21\u52A8\u4F5C\uFF1A\u65E2\u6CA1\u6709 a_next\uFF08\u6807\u51C6\u683C\u5F0F\uFF09\uFF0C\u4E5F\u6CA1\u6709 current_action\uFF08\u53EF\u89C2\u6D4B\u670D\u52A1\u539F\u59CB\u683C\u5F0F\uFF09"
+    );
+    err.issues = [{
+      path: ["a_next"],
+      message: err.message
+    }];
+    throw err;
+  }
+  return adapted;
+}
+var init_observable = __esm({
+  "src/adapters/observable.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
 
 // src/routes.ts
+import { join as join14, dirname as dirname11 } from "path";
+import { fileURLToPath as fileURLToPath10 } from "url";
 async function healthRoute(c) {
   return c.json(HealthResponseSchema.parse({
     instance: process.env.AGENT_MOSS_INSTANCE || ""
@@ -10126,13 +11559,13 @@ async function analyzeRoute(c) {
   const t0 = performance.now();
   try {
     const body = await c.req.json();
-    const req = AnalyzeRequestSchema.parse(body);
+    const req = AnalyzeRequestSchema.parse(normalizeObservablePayload(body));
     let osType = req.os_type;
     if (!osType) {
       osType = process.platform === "win32" ? "windows" : "linux";
     }
     const agentId = req.agent_id || req.metadata?.agent_type || "";
-    const result = await runAnalysis({
+    const result = await analyze({
       sessionId: req.session_id,
       promptSession: req.prompt_session,
       // output 必须透传：L2 的「授权（consent）」判定看的是**用户对提问的回答**，
@@ -10152,6 +11585,20 @@ async function analyzeRoute(c) {
           output: h.output
         }))
       })),
+      // prompt_history 必须透传：L2 意图一致性（logic-rules.ts 的
+      // checkIntentConsistency）与 L3 语义分析（llm-analyzer.ts 的
+      // formatPromptHistory）都靠它看**完整的交错历史**；只传 prompt_session
+      // （最后一条用户消息）会让这两处在压缩/续跑场景下失明。
+      // 历史 bug：请求模型里有这个字段，但路由的 runAnalysis 调用没映射它 →
+      // 经 TS HTTP 入口的判定与 Python HTTP（routes.py 有透传）、与库内直调
+      // runAnalysis 的结果都不一致（2026-10 修正，映射口径对齐 Python）。
+      promptHistory: (req.prompt_history || []).map((t) => ({
+        text: t.text,
+        actions: t.actions.map((a) => ({
+          actionType: a.action_type,
+          actionDetail: a.action_detail
+        }))
+      })),
       aNext: {
         actionType: req.a_next.action_type,
         actionDetail: req.a_next.action_detail
@@ -10169,15 +11616,15 @@ async function analyzeRoute(c) {
     try {
       reportEnforcementEvent({
         traceId: req.session_id,
-        decision: result.allowed ? "allow" : "deny",
+        decision: result.decision === "Allow" ? "allow" : "deny",
         toolName: req.a_next.action_type,
         toolCommand: req.a_next.action_detail,
         sessionId: req.session_id,
         prompt: req.prompt_session,
-        riskLevel: result.riskLevel,
-        riskType: result.riskType,
+        riskLevel: result.risk_level,
+        riskType: result.risk_type,
         reason: result.reason,
-        violatedLayers: result.violatedLayers,
+        violatedLayers: result.violated_layers,
         confidence: result.confidence,
         durationMs: Math.round(durationMs * 10) / 10
       });
@@ -10194,7 +11641,7 @@ async function analyzeRoute(c) {
         }, req.session_id, Boolean(meta.is_error));
         const judgment = incMatchedToDeny(inc);
         if (judgment) {
-          const layers = [...result.violatedLayers];
+          const layers = [...result.violated_layers];
           if (!layers.includes("L2.2-stateful")) layers.push("L2.2-stateful");
           console.error(
             `[AgentMoss] stateful \u589E\u91CF\u62E6\u622A: agent=${agentId || "-"} property=${judgment.property_id} risk=${judgment.risk_level}`
@@ -10220,13 +11667,15 @@ async function analyzeRoute(c) {
     }
     return c.json(
       AnalyzeResponseSchema.parse({
-        decision: result.allowed ? "Allow" : "Deny",
+        decision: result.decision,
         reason: result.reason,
-        risk_level: result.riskLevel,
-        risk_type: result.riskType,
-        violated_layers: result.violatedLayers,
-        policy: "",
-        violated_policy: "",
+        risk_level: result.risk_level,
+        risk_type: result.risk_type,
+        violated_layers: result.violated_layers,
+        // policy / violated_policy 现在真的有值（镜像 Python analyze()）：
+        // Allow → 最小权限 TOML；Deny → 空 policy + violated_policy 描述
+        policy: result.policy,
+        violated_policy: result.violated_policy,
         confidence: result.confidence,
         analysis_duration_ms: Math.round(durationMs * 10) / 10
       })
@@ -10234,15 +11683,14 @@ async function analyzeRoute(c) {
   } catch (err) {
     console.error("[AgentMoss] Analysis error:", err);
     if (err instanceof SyntaxError) {
-      return c.json({ error: "Invalid JSON", detail: err.message }, 400);
+      return c.json({ detail: err.message, error: "Invalid JSON" }, 422);
     }
     if (err?.issues) {
-      return c.json({ error: "Validation error", detail: err.issues }, 400);
+      return c.json({ detail: err.issues, error: "Validation error" }, 422);
     }
-    return c.json({ error: "Internal error", detail: String(err) }, 500);
+    return c.json({ detail: String(err), error: "Internal error" }, 500);
   }
 }
-var reviewStore = null;
 function getChainStateStoreFor(_agentId) {
   if (!reviewStore) reviewStore = new ChainStateStore();
   return reviewStore;
@@ -10297,13 +11745,25 @@ async function reviewRoute(c) {
     const violations = [];
     if (sessions.length > 0 || tracker.nodes.length > 0) {
       const eng = new FormalEngine();
+      const verifySessions = sessions.length > 0 ? sessions.map((s) => ({ sessionId: s.sessionId, actionHistory: s.actionHistory })) : tracker.nodes.length > 0 ? [{
+        sessionId: tracker.agentId,
+        actionHistory: tracker.nodes.map((n) => ({
+          actionType: n.actionType,
+          actionDetail: n.actionDetail
+        }))
+      }] : [];
       const full = eng.verify(
-        sessions.map((s) => ({ sessionId: s.sessionId, actionHistory: s.actionHistory })),
+        verifySessions,
         req.a_next ? { actionType: req.a_next.action_type, actionDetail: req.a_next.action_detail } : void 0
       );
       verified = full.verified;
       for (const v of full.violations) {
-        violations.push({ property_id: v.propertyId, reason: v.reason, risk_level: v.riskLevel });
+        violations.push({
+          property_id: v.propertyId,
+          reason: v.reason,
+          risk_level: v.riskLevel,
+          path: v.path
+        });
       }
     }
     const pending = tracker.pendingPrefixes.map((p) => ({
@@ -10333,22 +11793,126 @@ async function reviewRoute(c) {
     return c.json({ error: "Internal error", detail: String(err) }, 500);
   }
 }
-
-// src/console/index.ts
-init_esm_shims();
+function getBrainRuleStore() {
+  return new BrainRuleStore();
+}
+function getBrainSkillManager() {
+  const dir = resolveAssetDir(__dirname9, "skills") ?? join14(__dirname9, "..", "..", "agent_moss", "skills");
+  return new BrainSkillManager(dir);
+}
+async function brainRulesRoute(c) {
+  const store = getBrainRuleStore();
+  const layerRaw = c.req.query("layer");
+  const layer = layerRaw ? parseInt(layerRaw, 10) : void 0;
+  const rules = store.getActiveRules(layer);
+  return c.json({
+    rules: rules.map((r) => ({
+      id: r.id,
+      layer: r.layer,
+      rule_type: r.ruleType,
+      pattern: r.pattern,
+      scope: r.scope,
+      confidence: r.confidence,
+      explanation: r.explanation
+    }))
+  });
+}
+async function brainDraftsRoute(c) {
+  const store = getBrainRuleStore();
+  return c.json({
+    drafts: store.getDraftRules().map((r) => ({
+      id: r.id,
+      layer: r.layer,
+      rule_type: r.ruleType,
+      pattern: r.pattern,
+      scope: r.scope,
+      confidence: r.confidence,
+      explanation: r.explanation,
+      source_event_ids: r.sourceEventIds
+    }))
+  });
+}
+async function brainApproveRoute(c) {
+  const ruleId = c.req.param("rule_id") ?? "";
+  try {
+    getBrainRuleStore().approveRule(ruleId);
+    return c.json({ status: "approved" });
+  } catch (err) {
+    return c.json({ detail: String(err.message) }, 400);
+  }
+}
+async function brainRejectRoute(c) {
+  const ruleId = c.req.param("rule_id") ?? "";
+  const reason = c.req.query("reason") || "";
+  try {
+    getBrainRuleStore().rejectRule(ruleId);
+    return c.json({ status: "rejected" });
+  } catch (err) {
+    return c.json({ detail: String(err.message) }, 400);
+  }
+}
+async function brainStatsRoute(c) {
+  return c.json(getBrainRuleStore().getStats());
+}
+async function brainSkillsRoute(c) {
+  const mgr = getBrainSkillManager();
+  const skills = mgr.getActiveSkills();
+  mgr.close();
+  return c.json({ skills });
+}
+async function brainExportRoute(c) {
+  const store = getBrainRuleStore();
+  return c.json({
+    rules: store.getRulesForExport().map((r) => ({
+      id: r.id,
+      layer: r.layer,
+      rule_type: r.ruleType,
+      pattern: r.pattern,
+      scope: r.scope,
+      confidence: r.confidence,
+      explanation: r.explanation,
+      origin_node: r.originNode
+    }))
+  });
+}
+async function brainImportRoute(c) {
+  const body = await c.req.json();
+  const rules = Array.isArray(body) ? body : [];
+  getBrainRuleStore().importRules(rules.map((r) => ({
+    layer: r.layer ?? 1,
+    ruleType: r.rule_type ?? "",
+    pattern: r.pattern ?? "",
+    scope: r.scope ?? "all",
+    confidence: r.confidence ?? 0.9,
+    explanation: r.explanation ?? ""
+  })));
+  return c.json({ imported: rules.length });
+}
+var __dirname9, reviewStore;
+var init_routes = __esm({
+  "src/routes.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_models();
+    init_analyzer();
+    init_actrail();
+    init_formal_engine();
+    init_pattern_miner();
+    init_agent_gate_reader();
+    init_observable();
+    init_rule_store();
+    init_skill_manager();
+    init_asset_dir();
+    __dirname9 = dirname11(fileURLToPath10(import.meta.url));
+    reviewStore = null;
+  }
+});
 
 // src/console/router.ts
-init_esm_shims();
-init_runtime_config();
-init_token_stats();
-init_rules_loader();
 import { Hono } from "hono";
-import { readFileSync as readFileSync15, existsSync as existsSync15 } from "fs";
-import { join as join10, dirname as dirname10 } from "path";
-import { fileURLToPath as fileURLToPath9 } from "url";
-var __dirname8 = dirname10(fileURLToPath9(import.meta.url));
-var STATIC_DIR = join10(__dirname8, "static");
-var CONSOLE_TOKEN_ENV = "AGENT_MOSS_CONSOLE_TOKEN";
+import { readFileSync as readFileSync18, existsSync as existsSync18, unlinkSync as unlinkSync4 } from "fs";
+import { join as join15, dirname as dirname12 } from "path";
+import { fileURLToPath as fileURLToPath11 } from "url";
 function getConsoleToken() {
   return process.env[CONSOLE_TOKEN_ENV] || "";
 }
@@ -10362,7 +11926,7 @@ function verifyAuth(req) {
 function authMiddleware() {
   return async (c, next) => {
     if (!verifyAuth(c.req.raw)) {
-      return c.json({ error: "Unauthorized: invalid or missing Bearer token" }, 401);
+      return c.json({ detail: "Unauthorized: invalid or missing Bearer token" }, 401);
     }
     await next();
   };
@@ -10371,9 +11935,9 @@ function createConsoleRouter() {
   const console2 = new Hono();
   console2.use("/api/*", authMiddleware());
   const serveIndex = (c) => {
-    const indexFile = join10(STATIC_DIR, "index.html");
-    if (existsSync15(indexFile)) {
-      return c.html(readFileSync15(indexFile, "utf-8"));
+    const indexFile = join15(STATIC_DIR, "index.html");
+    if (existsSync18(indexFile)) {
+      return c.html(readFileSync18(indexFile, "utf-8"));
     }
     return c.html("<h1>AgentMoss Policy Console</h1><p>Frontend not built. Use /console/api/* endpoints.</p>");
   };
@@ -10385,8 +11949,18 @@ function createConsoleRouter() {
   });
   console2.put("/api/layers", async (c) => {
     const body = await c.req.json();
+    const validKeys = /* @__PURE__ */ new Set(["L1_heuristic", "L2_logic_rules", "L3_llm_analysis"]);
+    if (!validKeys.has(body.layer_key)) {
+      return c.json({ detail: `Invalid layer_key: ${body.layer_key}` }, 400);
+    }
+    const envOverrides = getEnvOverrides();
+    if (envOverrides[body.layer_key]?.overridden) {
+      return c.json({
+        detail: `\u5C42\u7EA7 ${body.layer_key} \u88AB\u73AF\u5883\u53D8\u91CF ${envOverrides[body.layer_key].env_var}=1 \u5F3A\u5236\u8986\u76D6\uFF0CWeb \u8BBE\u7F6E\u65E0\u6548`
+      }, 409);
+    }
     const rc = updateLayerEnabled(body.layer_key, body.enabled);
-    return c.json({ layers: rc.layers, env_overrides: getEnvOverrides() });
+    return c.json({ layers: rc.layers, env_overrides: envOverrides });
   });
   function getL22View() {
     const ltlHuman = {
@@ -10463,7 +12037,21 @@ function createConsoleRouter() {
   }
   console2.get("/api/rules", (c) => {
     const rc = loadRuntimeConfig();
-    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules, L2_2: getL22View() });
+    const layer = c.req.query("layer");
+    const category = c.req.query("category");
+    const out = {};
+    for (const layerKey of ["L1_rules", "L2_rules"]) {
+      if (layer && layer !== layerKey) continue;
+      const layerData = rc[layerKey] || {};
+      const picked = {};
+      for (const [catName, catData] of Object.entries(layerData)) {
+        if (category && category !== catName) continue;
+        picked[catName] = catData;
+      }
+      out[layerKey] = picked;
+    }
+    if (!category) out.L2_2 = getL22View();
+    return c.json(out);
   });
   console2.put("/api/rules/enabled", async (c) => {
     const b = await c.req.json();
@@ -10472,6 +12060,9 @@ function createConsoleRouter() {
   });
   console2.put("/api/rules/deny_mode", async (c) => {
     const b = await c.req.json();
+    if (!["deny_write", "deny_read", "deny_both"].includes(b.deny_mode)) {
+      return c.json({ detail: `\u65E0\u6548\u7684 deny_mode: ${b.deny_mode}` }, 400);
+    }
     const rc = updateRuleDenyMode(b.layer, b.category, b.rule_id, b.deny_mode);
     return c.json(withL22View(rc));
   });
@@ -10503,8 +12094,10 @@ function createConsoleRouter() {
   });
   console2.delete("/api/rules", async (c) => {
     const b = await c.req.json();
-    deleteCustomRule(b.layer, b.category, b.rule_id);
-    const rc = loadRuntimeConfig();
+    const rc = deleteCustomRule(b.layer, b.category, b.rule_id);
+    if (rc === null) {
+      return c.json({ detail: "\u5185\u7F6E\u89C4\u5219\u4E0D\u53EF\u5220\u9664\uFF0C\u53EA\u80FD\u7981\u7528" }, 403);
+    }
     return c.json(withL22View(rc));
   });
   console2.get("/api/skills", (c) => {
@@ -10528,22 +12121,26 @@ function createConsoleRouter() {
   });
   console2.delete("/api/skills", async (c) => {
     const b = await c.req.json();
-    deleteCustomSkill(b.skill_id, b.category);
-    const rc = loadRuntimeConfig();
+    const rc = deleteCustomSkill(b.skill_id, b.category);
+    if (rc === null) {
+      return c.json({ detail: "\u5185\u7F6E skill \u4E0D\u53EF\u5220\u9664\uFF0C\u53EA\u80FD\u7981\u7528" }, 403);
+    }
     return c.json(withL22View(rc));
   });
   console2.get("/api/skills/:skill_id/content", async (c) => {
     const skillId = c.req.param("skill_id");
     if (!/^[A-Za-z0-9_-]+$/.test(skillId)) {
-      return c.json({ error: "invalid skill_id" }, 400);
+      return c.json({ detail: "\u975E\u6CD5 skill id" }, 400);
     }
-    const skillPath = join10(dirname10(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
-    if (!existsSync15(skillPath)) {
-      const builtinPath = join10(__dirname8, "..", "..", "agent_moss", "skills", `${skillId}.md`);
-      if (existsSync15(builtinPath)) return c.text(readFileSync15(builtinPath, "utf-8"));
-      return c.json({ error: "skill not found" }, 404);
+    const userPath = join15(dirname12(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
+    const builtinDir = resolveAssetDir(__dirname10, "skills");
+    const candidates = [userPath, builtinDir ? join15(builtinDir, `${skillId}.md`) : ""].filter(Boolean);
+    for (const p of candidates) {
+      if (existsSync18(p)) {
+        return c.json({ skill_id: skillId, path: p, content: readFileSync18(p, "utf-8") });
+      }
     }
-    return c.text(readFileSync15(skillPath, "utf-8"));
+    return c.json({ detail: `skill ${skillId} \u4E0D\u5B58\u5728` }, 404);
   });
   console2.get("/api/agents", (c) => {
     const rc = loadRuntimeConfig();
@@ -10635,12 +12232,19 @@ function createConsoleRouter() {
   });
   console2.post("/api/reset", (c) => {
     const defaults = generateSourceDefaults();
-    saveRuntimeConfig(defaults);
+    try {
+      const p = getRuntimeConfigPath();
+      if (existsSync18(p)) unlinkSync4(p);
+    } catch {
+    }
     return c.json(withL22View(defaults));
   });
+  const parseDays = (v) => {
+    const n = parseInt(v || "0", 10);
+    return Number.isFinite(n) ? n : 0;
+  };
   console2.get("/api/token-stats", (c) => {
-    const days = parseInt(c.req.query("days") || "7", 10);
-    return c.json(getTokenStats(days));
+    return c.json(getTokenStats(parseDays(c.req.query("days"))));
   });
   console2.get("/api/token-stats/recent", (c) => {
     const limit = parseInt(c.req.query("limit") || "20", 10);
@@ -10648,19 +12252,52 @@ function createConsoleRouter() {
     return c.json({ records: getRecentRecords(limit, offset), total: getRecentRecordsCount() });
   });
   console2.get("/api/token-stats/trend", (c) => {
-    const days = parseInt(c.req.query("days") || "7", 10);
-    return c.json(getTokenTrend(days));
+    return c.json(getTokenTrend(parseDays(c.req.query("days"))));
   });
   console2.post("/api/token-stats/reset", (c) => {
     resetTokenStats();
-    return c.json({ reset: true });
+    return c.json({ detail: "Token stats reset successfully" });
   });
   return console2;
 }
+var __dirname10, STATIC_DIR, CONSOLE_TOKEN_ENV;
+var init_router = __esm({
+  "src/console/router.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_runtime_config();
+    init_token_stats();
+    init_rules_loader();
+    init_asset_dir();
+    __dirname10 = dirname12(fileURLToPath11(import.meta.url));
+    STATIC_DIR = join15(__dirname10, "static");
+    CONSOLE_TOKEN_ENV = "AGENT_MOSS_CONSOLE_TOKEN";
+  }
+});
+
+// src/console/index.ts
+var init_console = __esm({
+  "src/console/index.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_router();
+  }
+});
 
 // src/server.ts
-init_runtime_config();
-init_rules_loader();
+var server_exports = {};
+__export(server_exports, {
+  createApp: () => createApp,
+  findFreePort: () => findFreePort,
+  logDeploymentSelfCheck: () => logDeploymentSelfCheck,
+  startServer: () => startServer,
+  startUnixSocketServer: () => startUnixSocketServer
+});
+import { Hono as Hono2 } from "hono";
+import { cors } from "hono/cors";
+import { logger } from "hono/logger";
+import net from "net";
+import { existsSync as existsSync19 } from "fs";
 function logDeploymentSelfCheck() {
   try {
     console.log("================ AgentMoss \u90E8\u7F72\u81EA\u68C0 ================");
@@ -10668,25 +12305,27 @@ function logDeploymentSelfCheck() {
     const layerKeys = ["L1_heuristic", "L2_logic_rules", "L3_llm_analysis", "agent_rules_enabled", "scenario_rules_enabled"];
     console.log("\u5C42\u7EA7\u5F00\u5173: " + layerKeys.map((k) => `${k}=${isLayerEnabled(k) ? "on" : "OFF"}`).join(" "));
     try {
-      const overrides = overriddenRuleFiles();
-      if (overrides.length > 0) {
-        console.error(`\u26A0\uFE0F  \u68C0\u6D4B\u5230 ${overrides.length} \u4E2A\u89C4\u5219\u8986\u76D6\u6587\u4EF6\uFF0C**\u6574\u4EFD\u66FF\u6362**\u4E86\u5185\u7F6E\u89C4\u5219\uFF1A`);
-        for (const p of overrides) console.error(`      ${p}`);
+      const dirs = rulesDirs().filter((d) => existsSync19(d));
+      if (dirs.length > 0) {
+        console.log(`\u89C4\u5219\u76EE\u5F55: ${dirs.join(", ")}\uFF08\u53EA\u8BFB\u5176\u4E2D ${OVERRIDE_FILENAME} / ${EXTRA_FILENAME}\uFF09`);
+      }
+      const loaded = ruleFilesLoaded();
+      if (loaded.length > 0) {
+        const ov = loadOverrideRules();
+        const ex = loadExtraRules();
+        console.error(`\u26A0\uFE0F  \u5DF2\u4ECE\u89C4\u5219\u76EE\u5F55\u52A0\u8F7D ${loaded.length} \u4E2A\u6587\u4EF6\uFF08\u6574\u4EFD\u66FF\u6362 / \u8FFD\u52A0\uFF0C\u5185\u7F6E\u66F4\u65B0\u4E0D\u4F1A\u53CD\u6620\u5230\u5B83\u4EEC\u4E0A\u9762\uFF09:`);
+        for (const f of loaded) console.error(`      ${f}`);
+        const ovs = Object.entries(ov).sort().map(([k, v]) => `${k}\xD7${v.length}`).join(", ");
+        if (ovs) console.error(`      \u8986\u76D6\u7C7B\u522B: ${ovs}\uFF08**\u6574\u4EFD\u66FF\u6362**\uFF1A\u672A\u5217\u51FA\u7684\u5185\u7F6E\u89C4\u5219\u4E0D\u518D\u751F\u6548\uFF09`);
+        const exs = Object.entries(ex).sort().map(([k, v]) => `${k}\xD7${v.length}`).join(", ");
+        if (exs) console.log(`      \u8FFD\u52A0\u7C7B\u522B: ${exs}\uFF08\u5185\u7F6E\u4FDD\u7559\uFF0C\u8FFD\u52A0\u5728\u5176\u540E\u4E00\u8D77\u5224\u5B9A\uFF09`);
+      }
+      const ignored = ignoredRuleFiles();
+      if (ignored.length > 0) {
         console.error(
-          "    \u8FD9\u4E9B\u6587\u4EF6\u7531\u90E8\u7F72\u4FA7\u81EA\u884C\u7EF4\u62A4\uFF0C**\u5185\u7F6E\u89C4\u5219\u66F4\u65B0\u4E0D\u4F1A\u53CD\u6620\u5230\u5B83\u4EEC\u4E0A\u9762**\uFF1B\u5220\u9664\u5BF9\u5E94\u6587\u4EF6\uFF08\u6216\u6E05\u7A7A AGENT_MOSS_OVERRIDE_RULES_DIR\uFF09\u5373\u6062\u590D\u5185\u7F6E\u3002\u82E5\u53EA\u60F3\u9010\u6761\u542F\u505C/\u589E\u5220\uFF0C\u8BF7\u6539\u7528 runtime config\uFF08Console\uFF09\u3002"
-        );
-      }
-    } catch {
-    }
-    try {
-      const extras = extraRuleFiles();
-      if (extras.length > 0) {
-        const cats = loadExtraRules();
-        const total = Object.values(cats).reduce((n, v) => n + v.length, 0);
-        const catSummary = Object.entries(cats).sort(([a], [b]) => a.localeCompare(b)).map(([k, v]) => `${k}\xD7${v.length}`).join(", ");
-        console.log(
-          `\u5DF2\u4ECE\u8FFD\u52A0\u76EE\u5F55 ${extraRulesDirs().join(", ")} \u52A0\u8F7D ${extras.length} \u4E2A\u89C4\u5219\u6587\u4EF6\uFF08\u5171 ${total} \u6761${catSummary ? `\uFF0C\u7C7B\u522B\uFF1A${catSummary}` : ""}\uFF09\u3002\u8FFD\u52A0\u8BED\u4E49\uFF1A\u5185\u7F6E\u89C4\u5219\u5168\u90E8\u4FDD\u7559\uFF0C\u8FD9\u4E9B\u89C4\u5219\u6302\u5728\u5176\u540E\u4E00\u8D77\u5224\u5B9A\u3002`
+          `\u26A0\uFE0F  \u89C4\u5219\u76EE\u5F55\u91CC\u6709 ${ignored.length} \u4E2A json **\u4E0D\u4F1A\u88AB\u8BFB\u53D6**\uFF08\u53EA\u8BA4 ${OVERRIDE_FILENAME} / ${EXTRA_FILENAME}\uFF09:`
         );
+        for (const f of ignored) console.error(`      ${f}`);
       }
     } catch {
     }
@@ -10710,18 +12349,26 @@ function createApp() {
   app.get("/api/v1/health", healthRoute);
   app.post("/api/v1/analyze", analyzeRoute);
   app.post("/api/v1/review", reviewRoute);
+  app.get("/api/v1/brain/rules", brainRulesRoute);
+  app.get("/api/v1/brain/rules/drafts", brainDraftsRoute);
+  app.post("/api/v1/brain/rules/:rule_id/approve", brainApproveRoute);
+  app.post("/api/v1/brain/rules/:rule_id/reject", brainRejectRoute);
+  app.get("/api/v1/brain/stats", brainStatsRoute);
+  app.get("/api/v1/brain/skills", brainSkillsRoute);
+  app.get("/api/v1/brain/rules/export", brainExportRoute);
+  app.post("/api/v1/brain/rules/import", brainImportRoute);
   app.route("/console", createConsoleRouter());
   app.get("/console/", (c) => c.redirect("/console"));
   return app;
 }
 async function findFreePort(startPort, host = "127.0.0.1", scan = 100) {
   for (let port = startPort; port < startPort + scan; port++) {
-    const free = await new Promise((resolve10) => {
+    const free = await new Promise((resolve11) => {
       const server = net.createServer();
       server.listen(port, host, () => {
-        server.close(() => resolve10(true));
+        server.close(() => resolve11(true));
       });
-      server.on("error", () => resolve10(false));
+      server.on("error", () => resolve11(false));
     });
     if (free) {
       if (port !== startPort) {
@@ -10732,12 +12379,6 @@ async function findFreePort(startPort, host = "127.0.0.1", scan = 100) {
   }
   return startPort;
 }
-var WARMUP_COMMANDS = {
-  linux: "whoami",
-  macos: "whoami",
-  harmony: "whoami",
-  windows: "dir"
-};
 async function warmUpEngine() {
   const prevSavePolicy = process.env.AGENT_MOSS_SAVE_POLICY;
   try {
@@ -10777,9 +12418,240 @@ async function startServer(host = "127.0.0.1", port = 9090) {
     }
   };
 }
+async function startUnixSocketServer(socketPath = "/var/run/agent_moss/agent_moss.sock") {
+  const app = createApp();
+  let server = null;
+  return {
+    socketPath,
+    close: async () => {
+      if (!server) return;
+      await new Promise((resolve11) => {
+        server.close(() => resolve11());
+      });
+      server = null;
+    },
+    serve: async () => {
+      const { mkdirSync: mkdirSync10, existsSync: existsSync21, unlinkSync: unlinkSync5 } = await import("fs");
+      const { dirname: dirname14 } = await import("path");
+      const dir = dirname14(socketPath);
+      if (dir) {
+        try {
+          mkdirSync10(dir, { recursive: true });
+        } catch {
+        }
+      }
+      if (existsSync21(socketPath)) {
+        const { connect } = await import("net");
+        const inUse = await new Promise((resolve11) => {
+          const probe = connect(socketPath);
+          const done = (v) => {
+            probe.destroy();
+            resolve11(v);
+          };
+          probe.once("connect", () => done(true));
+          probe.once("error", () => done(false));
+          probe.setTimeout(500, () => done(false));
+        });
+        if (inUse) {
+          console.warn(
+            `[AgentMoss] socket ${socketPath} \u5DF2\u6709\u670D\u52A1\u5728\u76D1\u542C\uFF0C\u4E0D\u6E05\u7406\uFF08bind \u4F1A\u56E0\u5360\u7528\u800C\u5931\u8D25\uFF09`
+          );
+        } else {
+          try {
+            unlinkSync5(socketPath);
+            console.log(`[AgentMoss] \u6E05\u7406\u6B8B\u7559 socket \u6587\u4EF6: ${socketPath}`);
+          } catch {
+          }
+        }
+      }
+      logDeploymentSelfCheck();
+      await warmUpEngine();
+      const { getRequestListener } = await import("@hono/node-server");
+      const { createServer } = await import("http");
+      server = createServer(getRequestListener(app.fetch));
+      await new Promise((resolve11, reject) => {
+        server.once("error", reject);
+        server.listen(socketPath, () => resolve11());
+      });
+      console.log(`AgentMoss HTTP server on unix socket: ${socketPath}`);
+    }
+  };
+}
+var WARMUP_COMMANDS;
+var init_server = __esm({
+  "src/server.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_routes();
+    init_console();
+    init_runtime_config();
+    init_rules_loader();
+    WARMUP_COMMANDS = {
+      linux: "whoami",
+      macos: "whoami",
+      harmony: "whoami",
+      windows: "dir"
+    };
+  }
+});
+
+// src/rules-tools.ts
+var rules_tools_exports = {};
+__export(rules_tools_exports, {
+  EXTRA_TEMPLATE: () => EXTRA_TEMPLATE,
+  OVERRIDE_TEMPLATE: () => OVERRIDE_TEMPLATE,
+  initRulesDir: () => initRulesDir,
+  rulesStatusText: () => rulesStatusText,
+  templateSourceDir: () => templateSourceDir
+});
+import { existsSync as existsSync20, mkdirSync as mkdirSync9, readdirSync as readdirSync7, readFileSync as readFileSync19, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname13, join as join16 } from "path";
+import { fileURLToPath as fileURLToPath12 } from "url";
+function initRulesDir(targetDir, opts = {}) {
+  mkdirSync9(targetDir, { recursive: true });
+  const written = [];
+  const extraPath = join16(targetDir, EXTRA_FILENAME);
+  if (opts.force || !existsSync20(extraPath)) {
+    writeFileSync9(extraPath, JSON.stringify(EXTRA_TEMPLATE, null, 2), "utf-8");
+    written.push(extraPath);
+  }
+  const samplePath = join16(targetDir, OVERRIDE_FILENAME);
+  if (opts.force || !existsSync20(samplePath)) {
+    let payload = OVERRIDE_TEMPLATE;
+    if (opts.withBuiltin) {
+      let data = {};
+      const builtin = resolveRulesFile("l1_rules.json");
+      if (builtin && existsSync20(builtin)) {
+        try {
+          data = JSON.parse(readFileSync19(builtin, "utf-8")) || {};
+        } catch {
+          data = {};
+        }
+      }
+      payload = { _\u8BF4\u660E: OVERRIDE_BUILTIN_NOTE };
+      for (const k of L1_KEYS) payload[k] = data[k] || [];
+    }
+    writeFileSync9(samplePath, JSON.stringify(payload, null, 2), "utf-8");
+    written.push(samplePath);
+  }
+  const readmeSrc = join16(templateSourceDir(), "README.md");
+  const readmeDst = join16(targetDir, "README.md");
+  if (existsSync20(readmeSrc) && (opts.force || !existsSync20(readmeDst))) {
+    writeFileSync9(readmeDst, readFileSync19(readmeSrc, "utf-8"), "utf-8");
+    written.push(readmeDst);
+  }
+  return written;
+}
+function templateSourceDir() {
+  const cands = [join16(__dirname11, "data", "rules_template"), join16(__dirname11, "..", "..", "agent_moss", "data", "rules_template")];
+  for (const c of cands) if (existsSync20(c)) return c;
+  return cands[0];
+}
+function templateFiles(dirs) {
+  const out = [];
+  for (const d of dirs) {
+    try {
+      for (const name of readdirSync7(d)) {
+        if (name.endsWith(".json.\u793A\u4F8B")) out.push(join16(d, name));
+      }
+    } catch {
+    }
+  }
+  return out.sort();
+}
+function rulesStatusText() {
+  const lines = [];
+  const existing = rulesDirs().filter((d) => existsSync20(d));
+  lines.push("\u89C4\u5219\u76EE\u5F55: " + (existing.length > 0 ? existing.join(", ") : "\uFF08\u672A\u8BBE\u7F6E / \u4E0D\u5B58\u5728\uFF09"));
+  if (existing.length > 0) {
+    lines.push(`  \uFF08\u53EA\u8BFB\u5176\u4E2D\u7684 ${OVERRIDE_FILENAME} \u4E0E ${EXTRA_FILENAME}\uFF1B\u5176\u4ED6\u6587\u4EF6\u540D\u4E00\u5F8B\u4E0D\u8BFB\uFF09`);
+  }
+  const override = loadOverrideRules();
+  const extraAll = loadExtraRules();
+  const extra = {};
+  for (const [k, v] of Object.entries(extraAll)) if (v.length > 0) extra[k] = v;
+  const loaded = ruleFilesLoaded();
+  if (Object.keys(override).length > 0) {
+    lines.push(`\u2705 \u8986\u76D6\u751F\u6548\uFF08${OVERRIDE_FILENAME}\uFF0C**\u6574\u4EFD\u66FF\u6362**\uFF1A\u4E0B\u9762\u8FD9\u4E9B\u7C7B\u522B\u7684\u5185\u7F6E\u89C4\u5219\u4E0D\u518D\u751F\u6548\uFF09:`);
+    for (const [cat, items] of Object.entries(override).sort()) lines.push(`     ${cat}: \u4F60\u7684 ${items.length} \u6761`);
+  }
+  if (Object.keys(extra).length > 0) {
+    lines.push(`\u2705 \u8FFD\u52A0\u751F\u6548\uFF08${EXTRA_FILENAME}\uFF0C\u5185\u7F6E\u89C4\u5219\u4FDD\u7559\uFF0C\u8FD9\u4E9B\u6302\u5728\u5176\u540E\uFF09:`);
+    for (const [cat, items] of Object.entries(extra).sort()) lines.push(`     ${cat}: ${items.length} \u6761`);
+  }
+  if (Object.keys(override).length === 0 && Object.keys(extra).length === 0) {
+    if (loaded.length > 0 || templateFiles(existing).length > 0) {
+      lines.push("\u2139\uFE0F  \u89C4\u5219\u6587\u4EF6\u5DF2\u627E\u5230\uFF0C\u4F46\u91CC\u9762**\u8FD8\u6CA1\u6709\u4EFB\u4F55\u89C4\u5219**\uFF08\u7C7B\u522B\u90FD\u662F\u7A7A\u6570\u7EC4\uFF09\u2014\u2014 \u52A0\u4E0A\u6761\u76EE\u540E\u91CD\u542F\u5373\u53EF\u751F\u6548\u3002");
+    } else {
+      lines.push(`\u2139\uFE0F  \u8FD9\u4E2A\u76EE\u5F55\u91CC\u6CA1\u6709 ${OVERRIDE_FILENAME} / ${EXTRA_FILENAME}\uFF0C\u5F53\u524D\u7528\u7684\u662F\u5185\u7F6E\u89C4\u5219\u3002`);
+      lines.push(`   \u6A21\u677F\u968F\u5305\u5206\u53D1\uFF08\u4E0D\u7528\u8DD1\u547D\u4EE4\uFF09: ${templateSourceDir()}`);
+      lines.push("   \u6216\u4E00\u884C\u547D\u4EE4\u751F\u6210\u5230\u76EE\u6807\u76EE\u5F55: agent-moss rules init --dir <\u76EE\u5F55>");
+    }
+  }
+  const templates = templateFiles(existing);
+  if (templates.length > 0) {
+    lines.push("\u2139\uFE0F  \u53D1\u73B0 `*.json.\u793A\u4F8B` \u6587\u4EF6\uFF08**\u4E0D\u4F1A\u88AB\u8BFB\u53D6**\uFF1B\u82E5\u786E\u5B9E\u8981\u7528\uFF0C\u53BB\u6389 .\u793A\u4F8B \u540E\u7F00\uFF09:");
+    for (const p of templates) lines.push(`     ${p}`);
+  }
+  const ignored = ignoredRuleFiles();
+  if (ignored.length > 0) {
+    lines.push(`\u26A0\uFE0F  \u4EE5\u4E0B ${ignored.length} \u4E2A\u6587\u4EF6**\u4E0D\u4F1A\u88AB\u8BFB\u53D6**\uFF08\u540D\u5B57\u4E0D\u5BF9\uFF1B\u53EA\u8BA4 ${OVERRIDE_FILENAME} / ${EXTRA_FILENAME}\uFF09:`);
+    for (const p of ignored) lines.push(`     ${p}`);
+  }
+  lines.push("");
+  lines.push("\u63D0\u793A\uFF1A\u8FFD\u52A0\u7528 extra.json\uFF1B\u8981\u6539/\u5220\u5185\u7F6E\u7684\u67D0\u4E00\u6761 \u2192 \u7528 override.json\uFF08\u5185\u7F6E L1 \u5168\u91CF\u62F7\u8D1D\uFF0C\u5220\u6389\u4E0D\u8981\u7684\u90A3\u6761\u5373\u53EF\uFF09\u3002");
+  return lines.join("\n");
+}
+var __dirname11, EXTRA_TEMPLATE, OVERRIDE_TEMPLATE, OVERRIDE_BUILTIN_NOTE, L1_KEYS;
+var init_rules_tools = __esm({
+  "src/rules-tools.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_rules_loader();
+    __dirname11 = dirname13(fileURLToPath12(import.meta.url));
+    EXTRA_TEMPLATE = {
+      _\u8BF4\u660E: [
+        "\u8FFD\u52A0\u89C4\u5219\uFF1A\u5185\u7F6E\u89C4\u5219\u5168\u90E8\u4FDD\u7559\uFF0C\u4F60\u5199\u5728\u8FD9\u91CC\u7684\u89C4\u5219\u52A0\u5728\u5185\u7F6E\u4E4B\u540E\u4E00\u8D77\u5224\u5B9A\u3002",
+        "\u53EA\u8DD1 L1 \u7684\u90E8\u7F72\u53EA\u9700\u8981\u524D\u4E09\u4E2A\u7C7B\u522B\uFF08\u540E\u4E09\u4E2A\u5C5E\u4E8E L2\uFF0C\u5199\u4E86\u4E5F\u4E0D\u751F\u6548\uFF09\u3002",
+        "\u600E\u4E48\u586B\u3001\u53EF\u76F4\u63A5\u7167\u6284\u7684\u6837\u4F8B\uFF1A\u89C1\u540C\u76EE\u5F55 README.md\u3002",
+        "\u6539\u5B8C\u81EA\u67E5\uFF1Aagent-moss rules status"
+      ],
+      dangerous_commands: [],
+      injection_detection: [],
+      sensitive_path_access: [],
+      intent_consistency: [],
+      password_modify_consent: [],
+      user_deletion_consent: []
+    };
+    OVERRIDE_TEMPLATE = {
+      _\u8BF4\u660E: [
+        "\u8986\u76D6\u89C4\u5219\uFF1A\u4F60\u5199\u4E86\u54EA\u4E2A\u7C7B\u522B\uFF0C\u90A3\u4E2A\u7C7B\u522B\u5C31\u6574\u4EFD\u4EE5\u4F60\u7684\u4E3A\u51C6\uFF08\u5185\u7F6E\u540C\u540D\u7C7B\u522B\u4E0D\u518D\u751F\u6548\uFF09\uFF1B",
+        "\u6CA1\u5199\u7684\u7C7B\u522B\u7167\u5E38\u7528\u5185\u7F6E\u3002\u7A7A\u6570\u7EC4 = \u4E0D\u8986\u76D6\uFF0C\u6240\u4EE5\u672C\u6587\u4EF6**\u539F\u6837\u653E\u7740 = \u4EC0\u4E48\u90FD\u4E0D\u6539**\u3002",
+        "\u600E\u4E48\u586B\u3001\u53EF\u76F4\u63A5\u7167\u6284\u7684\u6837\u4F8B\uFF1A\u89C1\u540C\u76EE\u5F55 README.md\u3002",
+        "\u8981\u5220\u6389\u5185\u7F6E\u7684\u67D0\u4E00\u6761\uFF08\u800C\u4E0D\u662F\u6574\u7C7B\u66FF\u6362\uFF09\uFF1A\u7528 agent-moss rules init --with-builtin\u3002",
+        "\u6539\u5B8C\u81EA\u67E5\uFF1Aagent-moss rules status"
+      ],
+      dangerous_commands: [],
+      injection_detection: [],
+      sensitive_path_access: [],
+      intent_consistency: [],
+      password_modify_consent: [],
+      user_deletion_consent: []
+    };
+    OVERRIDE_BUILTIN_NOTE = [
+      "\u8FD9\u662F\u3010\u8986\u76D6\u3011\u89C4\u5219\u6587\u4EF6\uFF0C\u5185\u5BB9 = \u5185\u7F6E L1 \u89C4\u5219\u7684**\u5B8C\u6574\u62F7\u8D1D**\uFF08\u5C31\u5730\u5220/\u6539\u5185\u7F6E\u67D0\u4E00\u6761\u65F6\u7528\uFF09\u3002",
+      "\u26A0\uFE0F \u5B83\u653E\u8FDB\u76EE\u5F55\u5373\u751F\u6548\uFF0C\u7B49\u4E8E\u628A\u5185\u7F6E L1 \u89C4\u5219**\u9489\u5728**\u8FD9\u4E00\u7248\uFF08\u4EE5\u540E\u5347\u7EA7\u4E0D\u8DDF\u968F\uFF09\u2014\u2014 \u53EA\u505A\u4E34\u65F6\u6539\u52A8\u7528\u3002",
+      "\u5220\u6389/\u4FEE\u6539\u4F60\u4E0D\u8981\u7684\u90A3\u6761\u5373\u53EF\uFF1B\u6539\u5B8C\u81EA\u67E5\uFF1Aagent-moss rules status"
+    ];
+    L1_KEYS = ["dangerous_commands", "injection_detection", "sensitive_path_access"];
+  }
+});
 
 // src/cli.ts
-import { fileURLToPath as fileURLToPath10 } from "url";
+init_esm_shims();
+init_server();
+init_package_json();
+import { fileURLToPath as fileURLToPath13 } from "url";
 import { realpathSync } from "fs";
 function printHelp() {
   console.log(`AgentMoss security analysis engine (TypeScript v${version})
@@ -10802,9 +12674,29 @@ Install options:
   --enable              Enable service on boot (systemctl enable)
 `);
 }
+function buildAnalysisInputFromFile(data) {
+  return {
+    sessionId: data.session_id || "unknown",
+    promptSession: data.prompt_session || "",
+    actionHistory: (data.action_history || []).map((h) => ({
+      actionType: h.action_type || h.name || "",
+      actionDetail: h.action_detail || "",
+      output: h.output
+    })),
+    aNext: {
+      actionType: data.a_next?.action_type || "",
+      actionDetail: data.a_next?.action_detail || ""
+    },
+    reason: data.reason || "",
+    osType: data.os_type || (process.platform === "win32" ? "windows" : "linux"),
+    cwd: data.cwd || process.cwd(),
+    agentId: data.agent_id || "",
+    scenarioId: data.scenario_id || ""
+  };
+}
 async function analyzeRawCommand(command, useJson = false) {
-  const { runAnalysis: runAnalysis2 } = await Promise.resolve().then(() => (init_coordinator(), coordinator_exports));
-  const result = await runAnalysis2({
+  const { analyze: analyze2 } = await Promise.resolve().then(() => (init_analyzer(), analyzer_exports));
+  const result = await analyze2({
     sessionId: "cli-command",
     promptSession: "",
     actionHistory: [],
@@ -10815,19 +12707,24 @@ async function analyzeRawCommand(command, useJson = false) {
     agentId: ""
   });
   if (useJson) console.log(JSON.stringify(result, null, 2));
-  else console.log(result.allowed ? "Allow" : "Deny");
-  return result.allowed ? 0 : 1;
+  else console.log(result.decision);
+  return result.decision === "Allow" ? 0 : 1;
 }
 async function main() {
   const args = process.argv.slice(2);
   const command = args[0];
+  if (command === "--version" || command === "-V") {
+    console.log(`agent-moss ${version}`);
+    process.exit(0);
+  }
   if (!command || command === "--help" || command === "-h") {
     printHelp();
     process.exit(command ? 0 : 1);
   }
   switch (command) {
     case "init": {
-      const output = args[2] || "input.json";
+      const flagIdx = args.findIndex((a) => a === "--output" || a === "-o");
+      const output = (flagIdx >= 0 ? args[flagIdx + 1] : void 0) || args.slice(1).find((a) => !a.startsWith("-")) || "input.json";
       const fs7 = await import("fs");
       const template = {
         session_id: "my-session-001",
@@ -10850,7 +12747,6 @@ async function main() {
       }
       const fs7 = await import("fs");
       const path6 = await import("path");
-      const { runAnalysis: runAnalysis2 } = await Promise.resolve().then(() => (init_coordinator(), coordinator_exports));
       const useJson = args.includes("--json");
       const osType = process.platform === "win32" ? "windows" : "linux";
       const isFile = fs7.existsSync(target) && fs7.statSync(target).isFile();
@@ -10871,34 +12767,102 @@ async function main() {
       }
       const filePath = path6.resolve(target);
       const data = JSON.parse(fs7.readFileSync(filePath, "utf-8"));
-      const result = await runAnalysis2({
-        sessionId: data.session_id || "unknown",
-        promptSession: data.prompt_session || "",
-        actionHistory: (data.action_history || []).map((h) => ({
-          actionType: h.action_type || h.name || "",
-          actionDetail: h.action_detail || ""
-        })),
-        aNext: {
-          actionType: data.a_next?.action_type || "",
-          actionDetail: data.a_next?.action_detail || ""
-        },
-        reason: data.reason || "",
-        osType: data.os_type || (process.platform === "win32" ? "windows" : "linux"),
-        cwd: data.cwd || process.cwd(),
-        agentId: data.agent_id || ""
-      });
+      const { analyze: analyze2 } = await Promise.resolve().then(() => (init_analyzer(), analyzer_exports));
+      const sessionId = String(data.session_id || "unknown");
+      const result = await analyze2(buildAnalysisInputFromFile(data));
       console.log(JSON.stringify(result, null, 2));
-      process.exit(result.allowed ? 0 : 1);
+      if (!args.includes("--no-file")) {
+        const outDirIdx = args.findIndex((a) => a === "--output-dir" || a === "-o");
+        const outDir = outDirIdx >= 0 && args[outDirIdx + 1] ? args[outDirIdx + 1] : process.cwd();
+        fs7.mkdirSync(outDir, { recursive: true });
+        const safeSession = sessionId.replace(/\//g, "_");
+        if (result.decision === "Allow") {
+          const policyPath = path6.join(outDir, `${safeSession}_policy.toml`);
+          fs7.writeFileSync(policyPath, result.policy || "", "utf-8");
+          console.log(`Policy written to ${policyPath}`);
+        } else {
+          const denyPath = path6.join(outDir, `${safeSession}_deny_reason.txt`);
+          fs7.writeFileSync(denyPath, result.violated_policy || result.reason || "", "utf-8");
+          console.log(`Deny reason written to ${denyPath}`);
+        }
+      }
+      process.exit(result.decision === "Allow" ? 0 : 1);
+      break;
+    }
+    case "rules": {
+      const sub = args[1];
+      const dirIdx = args.findIndex((a) => a === "--dir" || a === "-d");
+      const dir = dirIdx >= 0 ? args[dirIdx + 1] : void 0;
+      const { initRulesDir: initRulesDir2, rulesStatusText: rulesStatusText2 } = await Promise.resolve().then(() => (init_rules_tools(), rules_tools_exports));
+      if (sub === "init") {
+        if (!dir) {
+          console.error("\u7528\u6CD5: agent-moss rules init --dir <\u76EE\u5F55>");
+          process.exit(2);
+        }
+        const written = initRulesDir2(dir, { force: args.includes("--force"), withBuiltin: args.includes("--with-builtin") });
+        for (const p of written) console.log(`\u5DF2\u751F\u6210: ${p}`);
+        if (written.length === 0) console.log("\uFF08\u6A21\u677F\u5DF2\u5B58\u5728\uFF0C\u672A\u8986\u76D6\uFF1B\u8981\u91CD\u65B0\u751F\u6210\u52A0 --force\uFF09");
+        console.log("");
+        console.log("\u4E0B\u4E00\u6B65\uFF1A");
+        console.log(`  1) \u8FFD\u52A0\u89C4\u5219\uFF1A\u7F16\u8F91 ${dir}/extra.json\uFF0C\u628A\u6761\u76EE\u52A0\u8FDB\u5BF9\u5E94\u7C7B\u522B\u7684\u6570\u7EC4\u91CC`);
+        console.log(`  2) \u8986\u76D6\u5185\u7F6E\uFF1A\u7F16\u8F91 ${dir}/override.json.\u793A\u4F8B\uFF08\u5185\u7F6E L1 \u5168\u91CF\u62F7\u8D1D\uFF09\u2014\u2014 \u5220\u6389/\u6539\u6389\u4E0D\u8981\u7684\u90A3\u6761\uFF0C\u7136\u540E\u6539\u540D\u4E3A override.json`);
+        console.log(`  3) \u8BA9 AgentMoss \u8BFB\u8FD9\u4E2A\u76EE\u5F55\uFF1Aexport AGENT_MOSS_EXTRA_RULES_DIR=${dir}\uFF08\u91CD\u542F\u8FDB\u7A0B\uFF09`);
+        console.log("  4) \u81EA\u67E5\uFF1Aagent-moss rules status");
+        process.exit(0);
+      }
+      if (sub === "status") {
+        if (dir) process.env.AGENT_MOSS_EXTRA_RULES_DIR = dir;
+        console.log(rulesStatusText2());
+        process.exit(0);
+      }
+      console.log("rules \u5B50\u547D\u4EE4\uFF1Astatus\uFF08\u81EA\u67E5\u89C4\u5219\u76EE\u5F55\uFF09/ init\uFF08\u751F\u6210\u6A21\u677F\uFF09");
+      process.exit(1);
+      break;
+    }
+    case "brain": {
+      const sub = args[1];
+      if (sub !== "contribute") {
+        console.log("Brain \u5B50\u547D\u4EE4\uFF1Acontribute\uFF08\u8D21\u732E\u672C\u5730\u89C4\u5219/Skill \u4E3A MR\uFF09");
+        process.exit(1);
+      }
+      let target;
+      let forkUser;
+      let branch;
+      for (let i = 2; i < args.length; i++) {
+        if ((args[i] === "--target" || args[i] === "-t") && args[i + 1]) target = args[++i];
+        else if (args[i] === "--fork-user" && args[i + 1]) forkUser = args[++i];
+        else if (args[i] === "--branch" && args[i + 1]) branch = args[++i];
+      }
+      const { contribute: contribute2 } = await Promise.resolve().then(() => (init_contributor(), contributor_exports));
+      process.exit(await contribute2({ target, forkUser, branch }));
       break;
     }
     case "server": {
       let host = "127.0.0.1";
       let port = 9090;
+      let mode = "http";
+      let socketPath = "/var/run/agent_moss/agent_moss.sock";
+      let configPath = "";
       for (let i = 1; i < args.length; i++) {
         if (args[i] === "--host" && args[i + 1]) host = args[++i];
         else if (args[i] === "--port" && args[i + 1]) port = parseInt(args[++i], 10);
+        else if (args[i] === "--mode" && args[i + 1]) mode = args[++i];
+        else if ((args[i] === "--socket" || args[i] === "-s") && args[i + 1]) socketPath = args[++i];
+        else if ((args[i] === "--config" || args[i] === "-c") && args[i + 1]) configPath = args[++i];
       }
+      if (configPath) process.env.AGENT_MOSS_CONFIG_PATH = configPath;
       if (port === 0) port = 9090;
+      if (mode === "socket") {
+        const { startUnixSocketServer: startUnixSocketServer2 } = await Promise.resolve().then(() => (init_server(), server_exports));
+        const srv = await startUnixSocketServer2(socketPath);
+        console.log(`Listening on unix socket ${srv.socketPath}`);
+        await srv.serve();
+        break;
+      }
+      if (mode !== "http") {
+        console.error(`\u9519\u8BEF: \u672A\u77E5\u7684 --mode ${mode}\uFF08\u53EF\u9009 http / socket\uFF09`);
+        process.exit(2);
+      }
       const server = await startServer(host, port);
       console.log(`Listening on http://${host}:${server.port}`);
       await server.serve();
@@ -10909,7 +12873,7 @@ async function main() {
       const { execSync } = await import("child_process");
       const fs7 = await import("fs");
       const path6 = await import("path");
-      const { fileURLToPath: fileURLToPath11 } = await import("url");
+      const { fileURLToPath: fileURLToPath14 } = await import("url");
       if (process.getuid?.() !== 0) {
         try {
           execSync("sudo -n true", { stdio: "ignore", timeout: 5e3 });
@@ -10924,18 +12888,18 @@ async function main() {
         execSync(sudoArgs.join(" "), { stdio: "inherit" });
         process.exit(0);
       }
-      const __filename7 = fileURLToPath11(import.meta.url);
-      const __dirname9 = path6.dirname(__filename7);
-      let srcPath = path6.join(__dirname9, "data", "agent_moss.service");
+      const __filename7 = fileURLToPath14(import.meta.url);
+      const __dirname12 = path6.dirname(__filename7);
+      let srcPath = path6.join(__dirname12, "data", "agent_moss.service");
       if (!fs7.existsSync(srcPath)) {
-        srcPath = path6.join(__dirname9, "..", "src", "data", "agent_moss.service");
+        srcPath = path6.join(__dirname12, "..", "src", "data", "agent_moss.service");
       }
       if (!fs7.existsSync(srcPath)) {
         console.error("\u9519\u8BEF\uFF1A\u627E\u4E0D\u5230 agent_moss.service \u6A21\u677F\u6587\u4EF6");
         process.exit(1);
       }
       const which = execSync("which agent-moss 2>/dev/null || true", { encoding: "utf-8" }).trim();
-      const binPath = which || `${process.execPath} ${path6.join(__dirname9, "cli.js")}`;
+      const binPath = which || `${process.execPath} ${path6.join(__dirname12, "cli.js")}`;
       let content = fs7.readFileSync(srcPath, "utf-8");
       content = content.replace("__AGENT_MOSS_BIN__", binPath);
       const dst = "/etc/systemd/system/agent-moss.service";
@@ -10975,17 +12939,19 @@ async function main() {
         }
       } catch {
       }
+      const expectInstance = process.env.AGENT_MOSS_INSTANCE || "";
       let foundPort = 0;
       let version2 = "";
+      const otherInstances = [];
       for (let port = 9090; port <= 9095; port++) {
         try {
-          const data = await new Promise((resolve10, reject) => {
+          const data = await new Promise((resolve11, reject) => {
             const req = http.get(`http://127.0.0.1:${port}/api/v1/health`, { timeout: 2e3 }, (res) => {
               let body = "";
               res.on("data", (chunk) => body += chunk);
               res.on("end", () => {
                 try {
-                  resolve10(JSON.parse(body));
+                  resolve11(JSON.parse(body));
                 } catch {
                   reject();
                 }
@@ -10994,9 +12960,13 @@ async function main() {
             req.on("error", reject);
           });
           if (data.status === "healthy") {
-            foundPort = port;
-            version2 = data.version || "";
-            break;
+            const inst = data.instance || "";
+            if (inst === expectInstance) {
+              foundPort = port;
+              version2 = data.version || "";
+              break;
+            }
+            otherInstances.push({ port, instance: inst });
           }
         } catch {
         }
@@ -11013,13 +12983,13 @@ async function main() {
           console.log(`   Systemd:  \u672A\u6CE8\u518C\uFF08\u8FD0\u884C agent-moss install --enable \u5B89\u88C5\uFF09`);
         }
         try {
-          const data = await new Promise((resolve10, reject) => {
+          const data = await new Promise((resolve11, reject) => {
             const req = http.get(`http://127.0.0.1:${foundPort}/console/api/config`, { timeout: 3e3 }, (res) => {
               let body = "";
               res.on("data", (chunk) => body += chunk);
               res.on("end", () => {
                 try {
-                  resolve10(JSON.parse(body));
+                  resolve11(JSON.parse(body));
                 } catch {
                   reject();
                 }
@@ -11043,6 +13013,14 @@ async function main() {
         console.log("     systemctl restart agent-moss \u91CD\u542F");
         console.log("     systemctl status agent-moss  \u72B6\u6001");
         console.log("     journalctl -u agent_moss -f  \u65E5\u5FD7");
+      } else if (otherInstances.length > 0) {
+        console.log(`\u274C AgentMoss \u670D\u52A1\u672A\u8FD0\u884C\uFF08instance=${expectInstance || "(\u7A7A)"}\uFF09`);
+        console.log(`   Systemd:  ${systemdInfo ? "active" : "inactive"}`);
+        const detail = otherInstances.map((o) => `\u7AEF\u53E3 ${o.port} (instance=${o.instance || "(\u7A7A)"})`).join("; ");
+        console.log(`   \u26A0\uFE0F \u68C0\u6D4B\u5230\u5176\u4ED6 agent \u7684 agentmoss \u5B9E\u4F8B: ${detail}`);
+        console.log(`   \u8FD9\u4E9B\u4E0D\u5C5E\u4E8E\u672C\u5B9E\u4F8B\uFF08instance=${expectInstance || "(\u7A7A)"}\uFF09\uFF0C\u672A\u8BA1\u5165\u8FD0\u884C\u72B6\u6001\u3002`);
+        console.log(`   \u542F\u52A8\u672C\u5B9E\u4F8B: AGENT_MOSS_INSTANCE=${expectInstance || "xiaoo"} agent-moss server`);
+        process.exit(1);
       } else {
         console.log(`\u274C AgentMoss \u670D\u52A1\u672A\u8FD0\u884C`);
         if (systemdInfo) {
@@ -11066,9 +13044,9 @@ async function main() {
 var isMain = (() => {
   try {
     if (!process.argv[1]) return false;
-    const thisFile = realpathSync(fileURLToPath10(import.meta.url));
+    const thisFile = realpathSync(fileURLToPath13(import.meta.url));
     const argv1 = realpathSync(
-      process.argv[1].startsWith("file://") ? fileURLToPath10(process.argv[1]) : process.argv[1]
+      process.argv[1].startsWith("file://") ? fileURLToPath13(process.argv[1]) : process.argv[1]
     );
     return thisFile === argv1;
   } catch {
@@ -11082,7 +13060,8 @@ if (isMain) {
   });
 }
 export {
-  analyzeRawCommand
+  analyzeRawCommand,
+  buildAnalysisInputFromFile
 };
 //! 顺序即 fail-closed 短路优先级：verify 逐个执行，首个返回违规的性质成为
 //! first_violation，后续不再评估。调整顺序影响判定归属，须与 Python