@kenhkl/agent-moss 0.16.9 → 0.16.13

package/dist/server.js

@@ -394,6 +394,52 @@ var init_runtime_config_bridge = __esm({
   }
 });
 
+// src/infra/rules-mode.ts
+function truthy(name) {
+  return TRUTHY.has((process.env[name] || "").trim().toLowerCase());
+}
+function getRulesMode() {
+  if (cached !== null) return cached;
+  const raw = (process.env[ENV_RULES_MODE] || "").trim().toLowerCase();
+  if (raw) {
+    if (VALID_MODES.has(raw)) {
+      cached = raw;
+    } else {
+      console.error(
+        `[AgentMoss] ${ENV_RULES_MODE}=${JSON.stringify(raw)} \u975E\u6CD5\uFF08\u53EA\u652F\u6301 hot / cold / builtin\uFF09\uFF1B\u4E3A\u5B89\u5168\u8D77\u89C1\u6309 builtin\uFF08\u4EC5\u5185\u7F6E\u89C4\u5219\uFF09\u5904\u7406`
+      );
+      cached = "builtin";
+    }
+    return cached;
+  }
+  if (truthy(ENV_RULES_BUILTIN_ONLY)) cached = "builtin";
+  else if (truthy(ENV_DISABLE_RULE_HOT_RELOAD)) cached = "cold";
+  else cached = "hot";
+  return cached;
+}
+function isHotReloadEnabled() {
+  return getRulesMode() === "hot";
+}
+function isRuntimeConfigDisabled() {
+  return getRulesMode() !== "hot";
+}
+function isBuiltinOnly() {
+  return getRulesMode() === "builtin";
+}
+var ENV_RULES_MODE, ENV_RULES_BUILTIN_ONLY, ENV_DISABLE_RULE_HOT_RELOAD, TRUTHY, VALID_MODES, cached;
+var init_rules_mode = __esm({
+  "src/infra/rules-mode.ts"() {
+    "use strict";
+    init_esm_shims();
+    ENV_RULES_MODE = "AGENT_MOSS_RULES_MODE";
+    ENV_RULES_BUILTIN_ONLY = "AGENT_MOSS_RULES_BUILTIN_ONLY";
+    ENV_DISABLE_RULE_HOT_RELOAD = "AGENT_MOSS_DISABLE_RULE_HOT_RELOAD";
+    TRUTHY = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
+    VALID_MODES = /* @__PURE__ */ new Set(["hot", "cold", "builtin"]);
+    cached = null;
+  }
+});
+
 // src/infra/rules-loader.ts
 import { readFileSync as readFileSync2, existsSync, readdirSync, statSync } from "fs";
 import { resolve, dirname, join as join2 } from "path";
@@ -406,71 +452,64 @@ function parseDirEnv(envName) {
   if (!raw) return [];
   return raw.split(/[,;]/).map((s) => s.trim()).filter(Boolean).map((s) => resolve(s));
 }
-function overrideRulesDirs() {
-  return [...parseDirEnv("AGENT_MOSS_OVERRIDE_RULES_DIR"), resolve(dataRootDir(), "rules")];
-}
-function warnOverride(name, path6, data) {
-  if (warnedOverride.has(path6)) return;
-  warnedOverride.add(path6);
-  console.warn(
-    `[AgentMoss] \u89C4\u5219\u6587\u4EF6\u88AB\u8986\u76D6\u76EE\u5F55\u8986\u76D6: ${path6}\uFF08\u5185\u7F6E\u9ED8\u8BA4\u88AB\u5FFD\u7565\uFF09\u3002\u8BE5\u6587\u4EF6\u7531\u90E8\u7F72\u4FA7\u81EA\u884C\u7EF4\u62A4 \u2014\u2014 **\u5185\u7F6E\u89C4\u5219\u66F4\u65B0\u4E0D\u4F1A\u53CD\u6620\u5230\u5B83\u4E0A\u9762**\uFF1B\u5220\u9664\u8BE5\u6587\u4EF6\uFF08\u6216\u6E05\u7A7A AGENT_MOSS_OVERRIDE_RULES_DIR\uFF09\u5373\u6062\u590D\u5185\u7F6E\u89C4\u5219\u3002\u82E5\u53EA\u60F3\u9010\u6761\u542F\u505C/\u589E\u5220\uFF0C\u8BF7\u6539\u7528 runtime config\uFF08Console\uFF09\u3002`
-  );
-  const missing = (EXPECTED_KEYS[name] || []).filter((k) => !(k in data));
-  if (missing.length > 0) {
-    console.warn(
-      `\u26A0\uFE0F  [AgentMoss] \u8986\u76D6\u6587\u4EF6 ${path6} \u7F3A\u5C11\u9876\u5C42\u952E [${missing.join(", ")}] \u2014\u2014 \u5BF9\u5E94\u7C7B\u522B\u4F1A**\u4E00\u6761\u89C4\u5219\u90FD\u4E0D\u8DD1**\uFF08\u9759\u9ED8\u5931\u6548\uFF09\u3002\u82E5\u53EA\u60F3\u6539\u5176\u4E2D\u4E00\u7C7B\uFF0C\u8BF7\u5148\u62F7\u8D1D\u5B8C\u6574\u7684\u5185\u7F6E\u6587\u4EF6\u518D\u6539\u3002`
-    );
-  }
-}
-function overriddenRuleFiles() {
-  const out = [];
-  for (const name of Object.keys(EXPECTED_KEYS)) {
-    for (const dir of overrideRulesDirs()) {
-      const p = resolve(dir, name);
-      if (existsSync(p)) {
-        out.push(p);
-        break;
-      }
-    }
-  }
-  return out;
+function rulesDirs() {
+  if (isBuiltinOnly()) return [];
+  const dirs = [];
+  for (const env of RULES_DIR_ENVS) dirs.push(...parseDirEnv(env));
+  dirs.push(resolve(dataRootDir(), "rules"));
+  return [...new Set(dirs)];
 }
 function findRulesFile(name) {
-  for (const dir of overrideRulesDirs()) {
-    const p = resolve(dir, name);
-    if (existsSync(p)) return p;
-  }
   for (const dir of RULES_DIR_CANDS) {
     const p = resolve(dir, name);
     if (existsSync(p)) return p;
   }
   return null;
 }
-function isOverridePath(name, p) {
-  return overrideRulesDirs().some((dir) => resolve(dir, name) === p);
-}
 function loadJson(name) {
+  if (!isHotReloadEnabled()) {
+    const cached2 = frozenJsonCache.get(name);
+    if (cached2 !== void 0) return cached2;
+  }
   const p = findRulesFile(name);
   if (!p) return {};
-  const isOverride = isOverridePath(name, p);
-  let data;
   try {
-    data = JSON.parse(readFileSync2(p, "utf-8")) || {};
+    const parsed = JSON.parse(readFileSync2(p, "utf-8")) || {};
+    if (!isHotReloadEnabled()) frozenJsonCache.set(name, parsed);
+    return parsed;
   } catch {
-    if (isOverride) warnOverride(name, p, {});
     return {};
   }
-  if (isOverride) warnOverride(name, p, data);
-  return data;
 }
 function resolveScenarioRulesFile(scenarioId) {
   const rel = join2("scenarios", scenarioId, "rules.json");
-  for (const dir of overrideRulesDirs()) {
+  for (const dir of rulesDirs()) {
     const p = resolve(dir, rel);
-    if (existsSync(p)) return p;
+    if (!existsSync(p)) continue;
+    let reason = "";
+    try {
+      reason = invalidScenarioRulesReason(JSON.parse(readFileSync2(p, "utf-8")) || {});
+    } catch (err) {
+      reason = `\u8BFB\u53D6/\u89E3\u6790\u5931\u8D25: ${String(err)}`;
+    }
+    if (reason) {
+      console.error(
+        `[AgentMoss] \u274C \u573A\u666F\u89C4\u5219\u8986\u76D6\u6587\u4EF6\u7ED3\u6784\u4E0D\u53EF\u7528\uFF0C**\u5DF2\u5FFD\u7565\u5E76\u56DE\u9000\u5185\u7F6E**: ${p}
+    \u539F\u56E0: ${reason}`
+      );
+      return null;
+    }
+    console.warn(`[AgentMoss] \u26A0\uFE0F  \u573A\u666F ${scenarioId} \u89C4\u5219\u88AB\u8986\u76D6: ${p}\uFF08\u5185\u7F6E\u66F4\u65B0\u4E0D\u4F1A\u53CD\u6620\u5230\u5B83\u4E0A\u9762\uFF09`);
+    return p;
   }
   return null;
 }
+function invalidScenarioRulesReason(data) {
+  if (!data || typeof data !== "object" || Array.isArray(data)) {
+    return `\u9876\u5C42\u5FC5\u987B\u662F JSON \u5BF9\u8C61\uFF0C\u5B9E\u9645\u662F ${Array.isArray(data) ? "array" : typeof data}`;
+  }
+  return SCENARIO_LIST_KEYS.filter((k) => k in data && !Array.isArray(data[k])).map((k) => `"${k}" \u5E94\u4E3A\u6570\u7EC4\uFF08\u5BF9\u8C61\u6570\u7EC4\uFF09\uFF0C\u5B9E\u9645\u662F ${typeof data[k]}`).join("\uFF1B");
+}
 function loadL1() {
   return loadJson("l1_rules.json");
 }
@@ -478,10 +517,40 @@ function loadL2() {
   return loadJson("l2_rules.json");
 }
 function loadL3() {
-  return loadJson("l3_rules.json");
+  const data = { ...loadJson("l3_rules.json") };
+  try {
+    const ov = loadOverrideRules().skills;
+    const ex = loadExtraRules().skills || {};
+    if (ov && typeof ov === "object") {
+      for (const [cat, skills] of Object.entries(ov)) data[cat] = { ...skills };
+    }
+    if (ex && typeof ex === "object") {
+      for (const [cat, skills] of Object.entries(ex)) data[cat] = { ...data[cat] || {}, ...skills };
+    }
+  } catch {
+  }
+  return data;
+}
+function loadMCRaw() {
+  const mc = { ...loadJson("mc_rules.json") };
+  let rules = [...mc.rules || []];
+  try {
+    const ov = loadOverrideRules().ltl_rules;
+    const ex = loadExtraRules().ltl_rules || [];
+    if (Array.isArray(ov)) rules = [...ov];
+    if (Array.isArray(ex) && ex.length > 0) {
+      const byId = /* @__PURE__ */ new Map();
+      for (const r of rules) if (r && r.id) byId.set(r.id, r);
+      for (const r of ex) if (r && r.id) byId.set(r.id, r);
+      rules = [...byId.values()];
+    }
+  } catch {
+  }
+  mc.rules = rules;
+  return mc;
 }
 function loadMC() {
-  const mc = loadJson("mc_rules.json");
+  const mc = loadMCRaw();
   const rules = mc.rules || [];
   try {
     const rt = runtimeConfigBridge.current;
@@ -501,166 +570,303 @@ function loadMC() {
   return mc;
 }
 function loadToolRegistry() {
-  return loadJson("tool_registry.json");
-}
-function extraRulesDirs() {
-  return parseDirEnv("AGENT_MOSS_EXTRA_RULES_DIR");
-}
-function listJsonFilesDeep(dir) {
-  const out = [];
-  let entries;
+  const data = { ...loadJson("tool_registry.json") };
+  let tools = { ...data.tools || {} };
   try {
-    entries = readdirSync(dir, { withFileTypes: true }).map((d) => d.name);
+    const ov = loadOverrideRules().tools;
+    const ex = loadExtraRules().tools || {};
+    if (ov && typeof ov === "object") tools = { ...ov };
+    if (ex && typeof ex === "object") tools = { ...tools, ...ex };
   } catch {
-    return out;
   }
-  for (const name of entries.sort()) {
-    const p = resolve(dir, name);
-    let isDir = false;
-    try {
-      isDir = statSync(p).isDirectory();
-    } catch {
-      continue;
+  data.tools = tools;
+  return data;
+}
+function scanStructEntry(cat, value, path6) {
+  if (cat === "skills") {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      console.error(`[AgentMoss] \u89C4\u5219\u6587\u4EF6 ${path6} \u7684 skills \u5E94\u4E3A\u5BF9\u8C61\uFF08{\u7C7B\u522B: {\u6280\u80FD\u540D: [\u5173\u952E\u8BCD]}}\uFF09\u2014\u2014 \u5DF2\u8DF3\u8FC7\u3002`);
+      return null;
+    }
+    const out = {};
+    for (const [skCat, skills] of Object.entries(value)) {
+      if (!skills || typeof skills !== "object" || Array.isArray(skills)) {
+        console.error(`[AgentMoss] \u89C4\u5219\u6587\u4EF6 ${path6} \u7684 skills.${skCat} \u5E94\u4E3A\u5BF9\u8C61\uFF08\u6280\u80FD\u540D \u2192 \u5173\u952E\u8BCD\u6570\u7EC4\uFF09\u2014\u2014 \u5DF2\u8DF3\u8FC7\u8BE5\u7C7B\u522B\u3002`);
+        continue;
+      }
+      const keep = {};
+      for (const [name, kws] of Object.entries(skills)) {
+        if (Array.isArray(kws)) keep[name] = kws;
+        else console.warn(`[AgentMoss] \u89C4\u5219\u6587\u4EF6 ${path6} \u7684 skills.${skCat}.${name} \u5173\u952E\u8BCD\u4E0D\u662F\u6570\u7EC4 \u2014\u2014 \u5DF2\u8DF3\u8FC7\u8BE5\u6761\u3002`);
+      }
+      if (Object.keys(keep).length > 0) out[skCat] = keep;
     }
-    if (isDir) out.push(...listJsonFilesDeep(p));
-    else if (name.toLowerCase().endsWith(".json")) out.push(p);
+    return Object.keys(out).length > 0 ? out : null;
   }
-  return out;
+  if (cat === "ltl_rules") {
+    if (!Array.isArray(value)) {
+      console.error(`[AgentMoss] \u89C4\u5219\u6587\u4EF6 ${path6} \u7684 ltl_rules \u5E94\u4E3A\u5BF9\u8C61\u6570\u7EC4 \u2014\u2014 \u5DF2\u8DF3\u8FC7\u3002`);
+      return null;
+    }
+    const keep = value.filter((r) => r && typeof r === "object" && r.id);
+    if (keep.length !== value.length) {
+      console.warn(`[AgentMoss] \u89C4\u5219\u6587\u4EF6 ${path6} \u7684 ltl_rules \u6709\u6761\u76EE\u7F3A id \u6216\u4E0D\u662F\u5BF9\u8C61 \u2014\u2014 \u5DF2\u8DF3\u8FC7\u8BE5\u6761\u3002`);
+    }
+    return keep.length > 0 ? keep : null;
+  }
+  if (cat === "tools") {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      console.error(`[AgentMoss] \u89C4\u5219\u6587\u4EF6 ${path6} \u7684 tools \u5E94\u4E3A\u5BF9\u8C61\uFF08{\u5DE5\u5177\u540D: {actionClass, ...}}\uFF09\u2014\u2014 \u5DF2\u8DF3\u8FC7\u3002`);
+      return null;
+    }
+    const keep = {};
+    for (const [k, v] of Object.entries(value)) {
+      if (v && typeof v === "object" && !Array.isArray(v)) keep[k] = v;
+      else console.warn(`[AgentMoss] \u89C4\u5219\u6587\u4EF6 ${path6} \u7684 tools.${k} \u4E0D\u662F\u5BF9\u8C61 \u2014\u2014 \u5DF2\u8DF3\u8FC7\u8BE5\u6761\u3002`);
+    }
+    return Object.keys(keep).length > 0 ? keep : null;
+  }
+  return null;
 }
-function scanExtraFiles(files) {
-  const data = {};
-  const loaded = [];
-  const seenIds = /* @__PURE__ */ new Map();
+function scanRulesFile(path6, kind) {
+  const out = {};
+  const label = kind === "override" ? "\u8986\u76D6" : "\u8FFD\u52A0";
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync2(path6, "utf-8"));
+  } catch (e) {
+    console.error(`[AgentMoss] \u89C4\u5219\u6587\u4EF6 ${path6} \u635F\u574F/\u4E0D\u53EF\u8BFB\uFF0C\u5DF2\u8DF3\u8FC7\uFF08${kind} \u89C4\u5219\u4E0D\u751F\u6548\uFF09: ${e.message}`);
+    return out;
+  }
   const classifyFlat = (r) => {
     for (const [keys, cat] of EXTRA_FLAT_FIELD) {
       if (r && typeof r === "object" && keys.every((k) => r[k])) return cat;
     }
     return null;
   };
-  for (const p of files) {
-    let parsed;
-    try {
-      parsed = JSON.parse(readFileSync2(p, "utf-8"));
-    } catch (e) {
-      console.warn(`[AgentMoss] \u8FFD\u52A0\u89C4\u5219\u6587\u4EF6\u635F\u574F/\u4E0D\u53EF\u8BFB\uFF0C\u5DF2\u8DF3\u8FC7: ${p}\uFF08${e.message}\uFF09`);
+  let pairs = [];
+  if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+    pairs = Object.entries(parsed);
+  } else if (Array.isArray(parsed)) {
+    let flatBad = 0;
+    for (const r of parsed) {
+      const cat = classifyFlat(r);
+      if (cat === null) {
+        flatBad += 1;
+        continue;
+      }
+      pairs.push([cat, [r]]);
+    }
+    if (flatBad > 0) {
+      console.warn(
+        `[AgentMoss] \u89C4\u5219\u6587\u4EF6 ${path6} \u6709 ${flatBad} \u6761\u5E73\u94FA\u6761\u76EE\u65E0\u6CD5\u5F52\u7C7B\uFF08\u88F8 pattern \u4E0D\u5E26 risk_level/risk_type \u65F6\u533A\u5206\u4E0D\u4E86 L1 \u5371\u9669\u547D\u4EE4\u4E0E L2 \u6388\u6743\u7C7B\uFF09\u2014\u2014 \u8BF7\u6539\u7528\u5BF9\u8C61\u5F62\u5F0F\uFF1A{"\u7C7B\u522B\u952E": [\u6761\u76EE...]}\u3002`
+      );
+    }
+  } else {
+    console.error(`[AgentMoss] \u89C4\u5219\u6587\u4EF6 ${path6} \u9876\u5C42\u5E94\u662F\u5BF9\u8C61\uFF08\u7C7B\u522B\u952E\u2192\u6761\u76EE\u6570\u7EC4\uFF09\u6216\u6570\u7EC4\uFF0C\u5DF2\u8DF3\u8FC7\u3002`);
+    return out;
+  }
+  for (const [cat, rules] of pairs) {
+    if (String(cat).startsWith("_")) continue;
+    if (STRUCT_KEYS.includes(cat)) {
+      const got = scanStructEntry(cat, rules, path6);
+      if (got !== null) out[cat] = got;
       continue;
     }
-    let pairs = [];
-    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-      pairs = Object.entries(parsed);
-    } else if (Array.isArray(parsed)) {
-      let flatBad = 0;
-      for (const r of parsed) {
-        const cat = classifyFlat(r);
-        if (cat === null) {
-          flatBad += 1;
-          continue;
-        }
-        pairs.push([cat, [r]]);
-      }
-      if (flatBad > 0) {
-        console.warn(
-          `[AgentMoss] \u8FFD\u52A0\u89C4\u5219\u6587\u4EF6 ${p} \u6709 ${flatBad} \u6761\u5E73\u94FA\u6761\u76EE\u65E0\u6CD5\u5F52\u7C7B\uFF08\u88F8 pattern \u4E0D\u5E26 risk_level/risk_type \u65F6\u533A\u5206\u4E0D\u4E86 L1 \u5371\u9669\u547D\u4EE4\u4E0E L2 \u6388\u6743\u7C7B\uFF09\u2014\u2014 \u8BF7\u6539\u7528\u5BF9\u8C61\u5F62\u5F0F\uFF1A{"\u7C7B\u522B\u952E": [\u6761\u76EE...]}\u3002`
-        );
-      }
-    } else {
+    const required = EXTRA_CATEGORIES[cat];
+    if (!required) {
       console.warn(
-        `[AgentMoss] \u8FFD\u52A0\u89C4\u5219\u6587\u4EF6 ${p} \u9876\u5C42\u5E94\u662F\u5BF9\u8C61\uFF08\u7C7B\u522B\u952E\u2192\u6761\u76EE\u6570\u7EC4\uFF09\u6216\u6570\u7EC4\uFF0C\u5DF2\u8DF3\u8FC7\u3002`
+        `[AgentMoss] \u89C4\u5219\u6587\u4EF6 ${path6} \u542B\u672A\u77E5\u7C7B\u522B\u952E "${cat}"\uFF08\u53EF\u7528\uFF1A${Object.keys(EXTRA_CATEGORIES).join(", ")}\uFF09\u2014\u2014 \u5DF2\u8DF3\u8FC7\u8BE5\u7C7B\u522B\u3002`
+      );
+      continue;
+    }
+    if (rules && typeof rules === "object" && !Array.isArray(rules)) {
+      console.error(
+        `[AgentMoss] \u274C \u89C4\u5219\u6587\u4EF6 ${path6} \u7684\u7C7B\u522B "${cat}" \u662F**\u5BF9\u8C61**\uFF0C\u5E94\u4E3A**\u5BF9\u8C61\u6570\u7EC4** \u2014\u2014 \u5DF2\u8DF3\u8FC7\u8BE5\u7C7B\u522B\u3002
+    \u6B63\u786E\u5199\u6CD5: {"${cat}": [{"pattern": "...", "risk_level": "high", ...}]}
+    \u4F60\u5199\u7684\u50CF\u662F runtime config \u7684\u683C\u5F0F\uFF08{"category_enabled": ..., "rules": [...]}\uFF09\u2014\u2014\u90A3\u662F ~/.config/agentmoss/agent_moss_runtime.json \u7684\u683C\u5F0F\uFF0C\u4E0D\u80FD\u76F4\u63A5\u5F53\u89C4\u5219\u6587\u4EF6\u7528\u3002`
       );
       continue;
     }
-    let nLoaded = 0;
-    for (const [cat, rules] of pairs) {
-      const required = EXTRA_CATEGORIES[cat];
-      if (!required) {
+    if (!Array.isArray(rules)) {
+      console.warn(`[AgentMoss] \u89C4\u5219\u6587\u4EF6 ${path6} \u7684\u7C7B\u522B "${cat}" \u5E94\u4E3A\u6570\u7EC4\uFF0C\u5B9E\u9645\u662F ${typeof rules} \u2014\u2014 \u5DF2\u8DF3\u8FC7\u8BE5\u7C7B\u522B\u3002`);
+      continue;
+    }
+    const items = [];
+    for (const r of rules) {
+      if (!r || typeof r !== "object" || !required.every((k) => r[k])) {
         console.warn(
-          `[AgentMoss] \u8FFD\u52A0\u89C4\u5219\u6587\u4EF6 ${p} \u542B\u672A\u77E5\u7C7B\u522B\u952E "${cat}"\uFF08\u53EF\u7528\uFF1A${Object.keys(EXTRA_CATEGORIES).join(", ")}\uFF09\u2014\u2014 \u5DF2\u8DF3\u8FC7\u8BE5\u7C7B\u522B\u3002`
+          `[AgentMoss] \u89C4\u5219\u6587\u4EF6 ${path6} \u7C7B\u522B ${cat} \u6709\u6761\u76EE\u7F3A\u5FC5\u9700\u5B57\u6BB5 [${required.join(", ")}] \u2014\u2014 \u5DF2\u8DF3\u8FC7\u8BE5\u6761\u3002`
         );
         continue;
       }
-      if (!Array.isArray(rules)) {
-        console.warn(`[AgentMoss] \u8FFD\u52A0\u89C4\u5219\u6587\u4EF6 ${p} \u7C7B\u522B ${cat} \u7684\u503C\u5E94\u662F\u6570\u7EC4 \u2014\u2014 \u5DF2\u8DF3\u8FC7\u3002`);
+      items.push(r);
+    }
+    if (items.length > 0) out[cat] = (out[cat] || []).concat(items);
+  }
+  if (Object.keys(out).length > 0) {
+    console.info(
+      `[AgentMoss] \u5DF2\u52A0\u8F7D${label}\u89C4\u5219\u6587\u4EF6 ${path6}\uFF1A` + Object.entries(out).map(([k, v]) => `${k}\xD7${v.length}`).join(", ")
+    );
+  }
+  return out;
+}
+function scanRuleDirs() {
+  const override = {};
+  const extra = {};
+  const loaded = [];
+  const ignored = [];
+  for (const d of rulesDirs()) {
+    if (!existsSync(d)) continue;
+    let entries = [];
+    try {
+      entries = readdirSync(d).sort();
+    } catch {
+      continue;
+    }
+    for (const name of entries) {
+      const f = resolve(d, name);
+      try {
+        if (statSync(f).isDirectory()) continue;
+      } catch {
         continue;
       }
-      for (const r of rules) {
-        if (!r || typeof r !== "object" || !required.every((k) => r[k])) {
-          console.warn(
-            `[AgentMoss] \u8FFD\u52A0\u89C4\u5219\u6587\u4EF6 ${p} \u7C7B\u522B ${cat} \u6709\u6761\u76EE\u7F3A\u5FC5\u9700\u5B57\u6BB5 [${required.join(", ")}] \u2014\u2014 \u5DF2\u8DF3\u8FC7\u8BE5\u6761\u3002`
-          );
-          continue;
+      if (name === OVERRIDE_FILENAME) {
+        const got = scanRulesFile(f, "override");
+        if (Object.keys(got).length > 0) loaded.push(f);
+        for (const [cat, items] of Object.entries(got)) {
+          if (Array.isArray(items)) {
+            override[cat] = (override[cat] || []).concat(items);
+          } else {
+            override[cat] = { ...override[cat] || {}, ...items };
+          }
         }
-        const rid = r && typeof r === "object" ? String(r.id || "") : "";
-        if (rid) {
-          if (seenIds.has(rid)) {
-            console.warn(
-              `[AgentMoss] \u8FFD\u52A0\u89C4\u5219 id "${rid}" \u91CD\u590D\uFF08\u5148\u89C1\u4E8E ${seenIds.get(rid)}\uFF0C\u672C\u6761\u6765\u81EA ${p}\uFF09\u2014\u2014 \u5DF2\u8DF3\u8FC7\u672C\u6761\u3002`
-            );
-            continue;
+      } else if (name === EXTRA_FILENAME) {
+        const got = scanRulesFile(f, "extra");
+        if (Object.values(got).some((v) => v.length > 0)) loaded.push(f);
+        for (const [cat, items] of Object.entries(got)) {
+          if (Array.isArray(items)) {
+            extra[cat] = (extra[cat] || []).concat(items);
+          } else {
+            extra[cat] = { ...extra[cat] || {}, ...items };
           }
-          seenIds.set(rid, p);
         }
-        (data[cat] = data[cat] || []).push(r);
-        nLoaded += 1;
+      } else if (name.toLowerCase().endsWith(".json")) {
+        ignored.push(f);
+      }
+    }
+  }
+  if (Object.keys(override).length > 0 && identicalToBuiltin(override)) {
+    const key = "override-identical::" + Object.entries(override).map(([c, v]) => `${c}=${v.length}`).sort().join("|");
+    if (!warnedIgnored.has(key)) {
+      warnedIgnored.add(key);
+      console.warn(
+        `[AgentMoss] \u2139\uFE0F  ${OVERRIDE_FILENAME} \u4E0E**\u5185\u7F6E\u89C4\u5219\u5B8C\u5168\u4E00\u81F4**\uFF08` + Object.entries(override).sort().map(([c, v]) => `${c}\xD7${v.length}`).join(", ") + `\uFF09\u2014\u2014 \u770B\u8D77\u6765\u662F\u6A21\u677F\u539F\u6837\u62F7\u8FDB\u6765\u6CA1\u6539\u3002
+    \u5B83\u73B0\u5728\u7684\u6548\u679C = \u5185\u7F6E\u89C4\u5219\uFF1B\u4F46**\u4EE5\u540E\u5347\u7EA7\u5185\u7F6E\u89C4\u5219\u4E0D\u4F1A\u53CD\u6620\u5230\u8FD9\u4EFD\u4E0A**\uFF08\u88AB\u9489\u4F4F\u4E86\uFF09\u3002
+    \u53EA\u60F3\u8FFD\u52A0\u89C4\u5219\uFF1A\u5220\u6389 ${OVERRIDE_FILENAME}\uFF0C\u6539\u7528 ${EXTRA_FILENAME}\u3002`
+      );
+    }
+  }
+  if (Object.keys(override).length > 0) {
+    const key = "override-summary::" + Object.entries(override).map(([c, v]) => `${c}=${v.length}`).sort().join("|");
+    if (!warnedIgnored.has(key)) {
+      warnedIgnored.add(key);
+      const l1 = loadL1();
+      const l2 = loadL2();
+      const builtinCounts = {
+        dangerous_commands: (l1.dangerous_commands || []).length,
+        injection_detection: (l1.injection_detection || []).length,
+        sensitive_path_access: (l1.sensitive_path_access || []).length,
+        intent_consistency: (l2.intent_consistency || []).length,
+        password_modify_consent: (l2.password_modify_consent || []).length,
+        user_deletion_consent: (l2.user_deletion_consent || []).length
+      };
+      console.warn(`[AgentMoss] \u26A0\uFE0F  ${OVERRIDE_FILENAME} \u751F\u6548\uFF08**\u6574\u4EFD\u66FF\u6362**\uFF0C\u672A\u5217\u51FA\u7684\u5185\u7F6E\u89C4\u5219\u4E0D\u518D\u751F\u6548\uFF09\uFF1A`);
+      for (const [cat, items] of Object.entries(override).sort()) {
+        console.warn(`      \u7C7B\u522B ${cat}\uFF1A\u5185\u7F6E ${builtinCounts[cat] ?? 0} \u6761 \u2192 \u4F60\u7684 ${items.length} \u6761`);
       }
+      console.warn(`    \u53EA\u60F3**\u8FFD\u52A0**\u89C4\u5219\u8BF7\u6539\u7528 ${EXTRA_FILENAME}\uFF1B\u8981\u6539\u67D0\u4E00\u6761\u5185\u7F6E\u89C4\u5219\uFF0C\u8BF7\u5148\u62F7\u8D1D\u5185\u7F6E\u6587\u4EF6\u518D\u6539\u3002`);
     }
-    if (nLoaded > 0) {
-      loaded.push(p);
-      console.info(`[AgentMoss] \u5DF2\u52A0\u8F7D\u8FFD\u52A0\u89C4\u5219\u6587\u4EF6 ${p}\uFF1A${nLoaded} \u6761`);
+  }
+  if (ignored.length > 0) {
+    const key = "ignored::" + ignored.join("|");
+    if (!warnedIgnored.has(key)) {
+      warnedIgnored.add(key);
+      console.warn(
+        `[AgentMoss] \u26A0\uFE0F  \u89C4\u5219\u76EE\u5F55\u91CC\u6709 ${ignored.length} \u4E2A json **\u4E0D\u4F1A\u88AB\u8BFB\u53D6**\uFF08\u53EA\u6709 ${OVERRIDE_FILENAME} \u4E0E ${EXTRA_FILENAME} \u4F1A\u88AB\u8BFB\uFF09: ${ignored.join(", ")}
+    \u8981\u8986\u76D6\u5185\u7F6E\u89C4\u5219 \u2192 \u5185\u5BB9\u653E\u8FDB ${OVERRIDE_FILENAME}\uFF1B\u8981\u8FFD\u52A0 \u2192 \u653E\u8FDB ${EXTRA_FILENAME}\u3002`
+      );
     }
   }
-  return { data, loaded };
+  return { override, extra, loaded, ignored };
 }
-function loadExtraRules() {
-  const raw = (process.env.AGENT_MOSS_EXTRA_RULES_DIR || "").trim();
-  const dirs = extraRulesDirs();
-  let files = [];
+function rulesCached() {
+  if (!isHotReloadEnabled() && _RULES_CACHE) return _RULES_CACHE;
+  const dirs = rulesDirs();
+  const sig = RULES_DIR_ENVS.map((e) => `${e}=${process.env[e] || ""}`).join("|") + "|" + dirs.join("|");
+  const files = [];
   for (const d of dirs) {
-    if (existsSync(d)) files.push(...listJsonFilesDeep(d));
-    else console.warn(`[AgentMoss] \u8FFD\u52A0\u89C4\u5219\u76EE\u5F55\u4E0D\u5B58\u5728\uFF0C\u5DF2\u8DF3\u8FC7: ${d}\uFF08AGENT_MOSS_EXTRA_RULES_DIR\uFF09`);
+    if (!existsSync(d)) continue;
+    try {
+      for (const name of readdirSync(d).sort()) {
+        if (name.toLowerCase().endsWith(".json")) files.push(resolve(d, name));
+      }
+    } catch {
+    }
   }
-  files = files.sort();
-  const fp = files.map((p) => {
+  const fp = JSON.stringify(files.map((p) => {
     try {
       const st = statSync(p);
       return [p, st.mtimeMs, st.size];
     } catch {
       return [p, -1, -1];
     }
-  });
-  if (extraCache && extraCache.raw === raw && JSON.stringify(extraCache.fp) === JSON.stringify(fp)) {
-    return extraCache.data;
+  }));
+  if (_RULES_CACHE && _RULES_CACHE.sig === sig && _RULES_CACHE.fp === fp) return _RULES_CACHE;
+  _RULES_CACHE = { sig, fp, ...scanRuleDirs() };
+  return _RULES_CACHE;
+}
+function identicalToBuiltin(override) {
+  const l1 = loadL1();
+  const l2 = loadL2();
+  for (const [cat, items] of Object.entries(override)) {
+    const builtin = l1[cat] ?? l2[cat];
+    if (!Array.isArray(builtin) || builtin.length !== items.length) return false;
+    if (JSON.stringify(builtin) !== JSON.stringify(items)) return false;
   }
-  const { data, loaded } = scanExtraFiles(files);
-  extraCache = { raw, fp, data, loaded };
-  return data;
+  return Object.keys(override).length > 0;
+}
+function loadOverrideRules() {
+  if (isBuiltinOnly()) return {};
+  return rulesCached().override;
 }
-function extraRuleFiles() {
-  loadExtraRules();
-  return extraCache ? [...extraCache.loaded] : [];
+function loadExtraRules() {
+  if (isBuiltinOnly()) return {};
+  return rulesCached().extra;
+}
+function ruleFilesLoaded() {
+  return rulesCached().loaded;
 }
-var __filename2, __dirname2, EXPECTED_KEYS, warnedOverride, RULES_DIR_CANDS, EXTRA_CATEGORIES, EXTRA_FLAT_FIELD, extraCache;
+function ignoredRuleFiles() {
+  return rulesCached().ignored;
+}
+var __filename2, __dirname2, OVERRIDE_FILENAME, EXTRA_FILENAME, RULES_DIR_ENVS, RULES_DIR_CANDS, frozenJsonCache, SCENARIO_LIST_KEYS, EXTRA_CATEGORIES, STRUCT_KEYS, EXTRA_FLAT_FIELD, _RULES_CACHE, warnedIgnored;
 var init_rules_loader = __esm({
   "src/infra/rules-loader.ts"() {
     "use strict";
     init_esm_shims();
     init_paths();
+    init_rules_mode();
     init_runtime_config_bridge();
     __filename2 = fileURLToPath2(import.meta.url);
     __dirname2 = dirname(__filename2);
-    EXPECTED_KEYS = {
-      "l1_rules.json": ["dangerous_commands", "injection_detection", "sensitive_path_access"],
-      "l2_rules.json": ["intent_consistency", "password_modify_consent", "user_deletion_consent"],
-      "l3_rules.json": [],
-      "mc_rules.json": ["rules"],
-      "tool_registry.json": ["tools"]
-    };
-    warnedOverride = /* @__PURE__ */ new Set();
+    OVERRIDE_FILENAME = "override.json";
+    EXTRA_FILENAME = "extra.json";
+    RULES_DIR_ENVS = ["AGENT_MOSS_EXTRA_RULES_DIR", "AGENT_MOSS_OVERRIDE_RULES_DIR"];
     RULES_DIR_CANDS = (() => {
       const cands = [
-        // 用户数据目录覆盖优先（与 Python rules_loader.resolve_rules_file 的
-        // <data_root>/rules/<name> 优先逻辑对齐）。用户安装 pip/npm 包后把自定义
-        // mc_rules.json 放到 <data_root>/rules/ 即可覆盖内置默认，无需改源码。
-        resolve(dataRootDir(), "rules"),
+        // 注：`<data_root>/rules/` 不再是"按内置文件名覆盖"的查找位 —— 2026-10 起
+        // 规则目录只认 override.json / extra.json（见 rulesDirs()）。
         // dist: __dirname=dist/ → dist/rules；__dirname=dist/engine/ → dist/engine/../rules=dist/rules
         resolve(__dirname2, "../rules"),
         resolve(__dirname2, "rules"),
@@ -673,6 +879,8 @@ var init_rules_loader = __esm({
       ];
       return cands.filter((c) => existsSync(c));
     })();
+    frozenJsonCache = /* @__PURE__ */ new Map();
+    SCENARIO_LIST_KEYS = ["extra_command_patterns", "extra_injection_keywords", "extra_sensitive_paths"];
     EXTRA_CATEGORIES = {
       dangerous_commands: ["pattern"],
       injection_detection: ["keyword", "lang"],
@@ -681,6 +889,7 @@ var init_rules_loader = __esm({
       password_modify_consent: ["pattern"],
       user_deletion_consent: ["pattern"]
     };
+    STRUCT_KEYS = ["skills", "ltl_rules", "tools"];
     EXTRA_FLAT_FIELD = [
       [["path"], "sensitive_path_access"],
       [["keyword", "lang"], "injection_detection"],
@@ -688,7 +897,8 @@ var init_rules_loader = __esm({
       [["pattern", "risk_level"], "dangerous_commands"],
       [["pattern", "risk_type"], "dangerous_commands"]
     ];
-    extraCache = null;
+    _RULES_CACHE = null;
+    warnedIgnored = /* @__PURE__ */ new Set();
   }
 });
 
@@ -1752,6 +1962,7 @@ function userSkillsDir() {
   return resolve3(getDataRoot(), "agent_moss_skills");
 }
 function runtimeCustomSkillKeywords() {
+  if (isRuntimeConfigDisabled()) return {};
   try {
     const rt = runtimeConfigBridge.current?.loadRuntimeConfig?.();
     if (!rt) return {};
@@ -1769,6 +1980,7 @@ function runtimeCustomSkillKeywords() {
   }
 }
 function loadUserSkill(name) {
+  if (isRuntimeConfigDisabled()) return "";
   if (userSkillCache[name] !== void 0) return userSkillCache[name];
   try {
     const p = resolve3(userSkillsDir(), `${name}.md`);
@@ -1837,6 +2049,7 @@ var init_skill_loader = __esm({
     init_esm_shims();
     init_rules_loader();
     init_paths();
+    init_rules_mode();
     init_asset_dir();
     init_runtime_config_bridge();
     __filename3 = fileURLToPath3(import.meta.url);
@@ -1897,6 +2110,7 @@ __export(runtime_config_exports, {
   getEnabledScenarioExtensions: () => getEnabledScenarioExtensions,
   getEnvOverrides: () => getEnvOverrides,
   getProfileOrDetect: () => getProfileOrDetect,
+  getRuleSourceFingerprint: () => getRuleSourceFingerprint,
   getRuntimeConfigPath: () => getRuntimeConfigPath,
   getScenarioRules: () => getScenarioRules,
   hasRuntimeConfig: () => hasRuntimeConfig,
@@ -1931,7 +2145,22 @@ function getRuntimeConfigPath() {
   if (envPath) return envPath;
   return RUNTIME_CONFIG_PATH;
 }
+function getRuleSourceFingerprint() {
+  if (isRuntimeConfigDisabled()) return `mode:${getRulesMode()}`;
+  const p = getRuntimeConfigPath();
+  try {
+    const st = statSync2(p);
+    return `${p}|${st.mtimeMs}|${st.size}`;
+  } catch {
+    return `${p}|absent`;
+  }
+}
 function saveRuntimeConfig(config) {
+  if (isRuntimeConfigDisabled()) {
+    throw new Error(
+      `\u89C4\u5219\u6765\u6E90\u6A21\u5F0F\u4E3A ${getRulesMode()}\uFF08runtime \u914D\u7F6E\u5DF2\u7981\u7528\uFF09\uFF1A\u4FEE\u6539\u89C4\u5219\u4E0D\u4F1A\u751F\u6548\uFF0C\u8BF7\u5207\u6362\u89C4\u5219\u6765\u6E90\u6A21\u5F0F\u5E76\u91CD\u542F\u670D\u52A1\u3002`
+    );
+  }
   const p = getRuntimeConfigPath();
   const dir = p.substring(0, p.lastIndexOf("/"));
   if (dir && !existsSync5(dir)) mkdirSync(dir, { recursive: true });
@@ -1955,6 +2184,18 @@ function invalidateRuntimeConfigCache() {
   hasRuntimeConfigCache.clear();
 }
 function loadRuntimeConfig() {
+  if (isRuntimeConfigDisabled()) {
+    return {
+      version: 1,
+      layers: { ...DEFAULT_LAYERS },
+      L1_rules: {},
+      L2_rules: {},
+      L3_skills: {},
+      L2_2: {},
+      agent_rules: {},
+      scenario_rules: {}
+    };
+  }
   const p = getRuntimeConfigPath();
   if (!existsSync5(p)) {
     const seeded = mergeConfig({}, generateSourceDefaults());
@@ -2001,6 +2242,7 @@ function loadRuntimeConfig() {
 function isLayerEnabled(layerKey) {
   const disableKey = LAYER_DISABLE_ENV[layerKey];
   if (disableKey && process.env[disableKey] === "1") return false;
+  if (isRuntimeConfigDisabled()) return true;
   const runtime = loadRuntimeConfig();
   const layers = runtime.layers || {};
   if (layerKey in layers) return !!layers[layerKey];
@@ -2046,18 +2288,34 @@ function _mergeUserCustom(primary, runtime, layers, key) {
   const extra = _userCustomRules(runtime, layers, key);
   return extra.length > 0 ? [...primary, ...extra] : [...primary];
 }
-function _mergeExtraDirRules(primary, category) {
+function _dedup(rules, category) {
+  const keys = _DEDUP_KEYS[category];
+  if (!keys) return rules;
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const r of rules) {
+    const k = keys.map((x) => String(r?.[x] ?? "")).join("\0");
+    if (seen.has(k)) continue;
+    seen.add(k);
+    out.push(r);
+  }
+  return out;
+}
+function _mergeRulesFromDirs(primary, category) {
+  let base = [...primary];
   try {
+    const override = loadOverrideRules()[category];
+    if (override !== void 0 && override !== null) base = [...override];
     const extra = loadExtraRules()[category] || [];
-    return extra.length > 0 ? [...primary, ...extra] : [...primary];
+    return _dedup([...base, ...extra], category);
   } catch {
-    return [...primary];
+    return base;
   }
 }
 function getEnabledL1CommandPatterns(runtime, osType) {
   const cat = runtime.L1_rules?.dangerous_commands || { category_enabled: true, rules: [] };
   let rules = filterEnabledRules(cat.rules || [], cat.category_enabled);
-  rules = _mergeExtraDirRules(rules, "dangerous_commands");
+  rules = _mergeRulesFromDirs(rules, "dangerous_commands");
   rules = _mergeUserCustom(rules, runtime, "L1_rules", "pattern");
   if (osType) rules = _filterRulesByOs(rules, osType);
   return rules.map((r) => ({
@@ -2073,7 +2331,7 @@ function getEnabledL2SensitivePaths(runtime, osType) {
     cat = runtime.L2_rules?.sensitive_path_access || { category_enabled: true, rules: [] };
   }
   let rules = filterEnabledRules(cat.rules || [], cat.category_enabled);
-  rules = _mergeExtraDirRules(rules, "sensitive_path_access");
+  rules = _mergeRulesFromDirs(rules, "sensitive_path_access");
   rules = _mergeUserCustom(rules, runtime, ["L1_rules", "L2_rules"], "path");
   if (osType) rules = _filterRulesByOs(rules, osType);
   return rules.map((r) => {
@@ -2085,6 +2343,7 @@ function getEnabledL2SensitivePaths(runtime, osType) {
   });
 }
 function hasRuntimeConfig() {
+  if (isRuntimeConfigDisabled()) return false;
   const p = getRuntimeConfigPath();
   let key;
   try {
@@ -2093,8 +2352,8 @@ function hasRuntimeConfig() {
   } catch {
     return false;
   }
-  const cached = hasRuntimeConfigCache.get(key);
-  if (cached !== void 0) return cached;
+  const cached2 = hasRuntimeConfigCache.get(key);
+  if (cached2 !== void 0) return cached2;
   let ok = false;
   try {
     JSON.parse(readFileSync4(p, "utf-8"));
@@ -2458,25 +2717,11 @@ function generateSourceDefaults() {
   };
 }
 function _ltlRulesToRuntime() {
-  const cands = [
-    getRuntimeConfigDir() && join3(getRuntimeConfigDir(), "rules"),
-    join3(__dirname4, "../rules"),
-    join3(__dirname4, "rules"),
-    join3(__dirname4, "../../../agent_moss/rules"),
-    join3(__dirname4, "../../../../agent_moss/rules"),
-    join3(process.cwd(), "agent_moss/rules")
-  ].filter(Boolean);
   let mc = {};
-  for (const dir of cands) {
-    const p = join3(dir, "mc_rules.json");
-    if (existsSync5(p)) {
-      try {
-        mc = JSON.parse(readFileSync4(p, "utf-8")) || {};
-      } catch {
-        mc = {};
-      }
-      break;
-    }
+  try {
+    mc = loadMCRaw();
+  } catch {
+    mc = {};
   }
   const rules = mc.rules || [];
   return {
@@ -2705,7 +2950,7 @@ function _migrateCategoriesAcrossLayers(cfg, srcLayer, dstLayer, catNames) {
 function getEnabledL1InjectionKeywords(runtime, osType) {
   const cat = runtime.L1_rules?.injection_detection || { category_enabled: true, rules: [] };
   let rules = filterEnabledRules(cat.rules || [], cat.category_enabled);
-  rules = _mergeExtraDirRules(rules, "injection_detection");
+  rules = _mergeRulesFromDirs(rules, "injection_detection");
   rules = _mergeUserCustom(rules, runtime, "L1_rules", "keyword");
   if (osType) rules = _filterRulesByOs(rules, osType);
   return rules.map((r) => ({
@@ -2717,7 +2962,7 @@ function getEnabledL1InjectionKeywords(runtime, osType) {
 function getEnabledL2IntentPatterns(runtime, osType) {
   const cat = runtime.L2_rules?.intent_consistency || { category_enabled: true, rules: [] };
   let rules = filterEnabledRules(cat.rules || [], cat.category_enabled);
-  rules = _mergeExtraDirRules(rules, "intent_consistency");
+  rules = _mergeRulesFromDirs(rules, "intent_consistency");
   rules = _mergeUserCustom(rules, runtime, "L2_rules", "intent_keywords");
   if (osType) rules = _filterRulesByOs(rules, osType);
   return rules.map((r) => ({
@@ -2729,7 +2974,7 @@ function getEnabledL2IntentPatterns(runtime, osType) {
 function getEnabledL2PasswordPatterns(runtime) {
   const cat = runtime.L2_rules?.password_modify_consent || { category_enabled: true, rules: [] };
   const rules = _mergeUserCustom(
-    _mergeExtraDirRules(filterEnabledRules(cat.rules || [], cat.category_enabled), "password_modify_consent"),
+    _mergeRulesFromDirs(filterEnabledRules(cat.rules || [], cat.category_enabled), "password_modify_consent"),
     runtime,
     "L2_rules",
     "pattern"
@@ -2739,7 +2984,7 @@ function getEnabledL2PasswordPatterns(runtime) {
 function getEnabledL2UserDeletionPatterns(runtime) {
   const cat = runtime.L2_rules?.user_deletion_consent || { category_enabled: true, rules: [] };
   const rules = _mergeUserCustom(
-    _mergeExtraDirRules(filterEnabledRules(cat.rules || [], cat.category_enabled), "user_deletion_consent"),
+    _mergeRulesFromDirs(filterEnabledRules(cat.rules || [], cat.category_enabled), "user_deletion_consent"),
     runtime,
     "L2_rules",
     "pattern"
@@ -2776,7 +3021,7 @@ function getEnabledL1CommandPatternsOrDefault(runtime, osType) {
     return getEnabledL1CommandPatterns(runtime, osType);
   }
   return _mergeUserCustom(
-    _mergeExtraDirRules(_filterDefaultsByOs(_l1CommandPatternsToRules(), osType), "dangerous_commands"),
+    _mergeRulesFromDirs(_filterDefaultsByOs(_l1CommandPatternsToRules(), osType), "dangerous_commands"),
     runtime,
     "L1_rules",
     "pattern"
@@ -2788,7 +3033,7 @@ function getEnabledL1InjectionKeywordsOrDefault(runtime, osType) {
     return getEnabledL1InjectionKeywords(runtime, osType);
   }
   return _mergeUserCustom(
-    _mergeExtraDirRules(_l1InjectionKeywordsToRules(), "injection_detection"),
+    _mergeRulesFromDirs(_l1InjectionKeywordsToRules(), "injection_detection"),
     runtime,
     "L1_rules",
     "keyword"
@@ -2800,7 +3045,7 @@ function getEnabledL2SensitivePathsOrDefault(runtime, osType) {
     return getEnabledL2SensitivePaths(runtime, osType);
   }
   return _mergeUserCustom(
-    _mergeExtraDirRules(_filterDefaultsByOs(_l2SensitivePathsToRules(), osType), "sensitive_path_access"),
+    _mergeRulesFromDirs(_filterDefaultsByOs(_l2SensitivePathsToRules(), osType), "sensitive_path_access"),
     runtime,
     ["L1_rules", "L2_rules"],
     "path"
@@ -2812,7 +3057,7 @@ function getEnabledL2IntentPatternsOrDefault(runtime, osType) {
     return getEnabledL2IntentPatterns(runtime, osType);
   }
   return _mergeUserCustom(
-    _mergeExtraDirRules(_filterDefaultsByOs(_l2IntentPatternsToRules(), osType), "intent_consistency"),
+    _mergeRulesFromDirs(_filterDefaultsByOs(_l2IntentPatternsToRules(), osType), "intent_consistency"),
     runtime,
     "L2_rules",
     "intent_keywords"
@@ -2988,6 +3233,11 @@ function deleteCustomRule(layer, category, ruleId) {
 }
 function addCustomSkill(skillId, category, keywords, content) {
   _validateSkillId(skillId);
+  if (isRuntimeConfigDisabled()) {
+    throw new Error(
+      `\u89C4\u5219\u6765\u6E90\u6A21\u5F0F\u4E3A ${getRulesMode()}\uFF08runtime \u914D\u7F6E\u5DF2\u7981\u7528\uFF09\uFF0C\u4E0D\u5141\u8BB8\u65B0\u589E\u81EA\u5B9A\u4E49 skill\u3002`
+    );
+  }
   const runtime = loadRuntimeConfig();
   const skillsDir = join3(getRuntimeConfigDir(), "agent_moss_skills");
   try {
@@ -3203,7 +3453,7 @@ function updateScenarioCategoryEnabled(scenarioId, category, enabled) {
   saveRuntimeConfig(runtime);
   return runtime;
 }
-var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DEFAULT_LAYERS, DENY_MODE_LABELS, runtimeConfigCache, hasRuntimeConfigCache, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, _effectiveCache, SKILL_ID_RE;
+var __dirname4, ENV_RUNTIME_CONFIG_PATH, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DEFAULT_LAYERS, DENY_MODE_LABELS, runtimeConfigCache, _DEDUP_KEYS, hasRuntimeConfigCache, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, _SCENARIOS_DIR_PROD, _SCENARIOS_DIR_DEV, _effectiveCache, SKILL_ID_RE;
 var init_runtime_config = __esm({
   "src/infra/runtime-config.ts"() {
     "use strict";
@@ -3214,6 +3464,7 @@ var init_runtime_config = __esm({
     init_skill_loader();
     init_rules_loader();
     init_runtime_config_bridge();
+    init_rules_mode();
     __dirname4 = dirname3(fileURLToPath4(import.meta.url));
     ENV_RUNTIME_CONFIG_PATH = "AGENT_MOSS_RUNTIME_CONFIG_PATH";
     RUNTIME_CONFIG_DIR = runtimeDir();
@@ -3236,6 +3487,14 @@ var init_runtime_config = __esm({
       deny_both: "\u8BFB\u5199\u5747\u62E6\u622A"
     };
     runtimeConfigCache = null;
+    _DEDUP_KEYS = {
+      dangerous_commands: ["pattern"],
+      password_modify_consent: ["pattern"],
+      user_deletion_consent: ["pattern"],
+      sensitive_path_access: ["path"],
+      injection_detection: ["keyword", "lang"],
+      intent_consistency: ["intent_keywords", "reason"]
+    };
     hasRuntimeConfigCache = /* @__PURE__ */ new Map();
     _AGENTS_DIR_PROD = join3(__dirname4, "agents");
     _AGENTS_DIR_DEV = join3(__dirname4, "..", "..", "..", "agent_moss", "agents");
@@ -3261,6 +3520,8 @@ var init_runtime_config = __esm({
 var config_exports = {};
 __export(config_exports, {
   detectProvider: () => detectProvider,
+  getAgentMossSetting: () => getAgentMossSetting,
+  getCacheOptions: () => getCacheOptions,
   getCustomRules: () => getCustomRules,
   getLLMConfig: () => getLLMConfig,
   getLLMFailMode: () => getLLMFailMode,
@@ -3272,7 +3533,10 @@ __export(config_exports, {
   isHeuristicEnabled: () => isHeuristicEnabled,
   isLLMAvailable: () => isLLMAvailable,
   isLogicRulesEnabled: () => isLogicRulesEnabled,
+  isPolicyGenEnabled: () => isPolicyGenEnabled,
+  isPolicySaveEnabled: () => isPolicySaveEnabled,
   probeLLMConnection: () => probeLLMConnection,
+  reloadCustomRules: () => reloadCustomRules,
   updateLLMConfig: () => updateLLMConfig,
   userRuleVariantPattern: () => userRuleVariantPattern,
   wildcardToRegExp: () => wildcardToRegExp
@@ -3294,8 +3558,10 @@ function resolveConfigPath() {
   const userConfig = path2.join(getConfigDir(), "config.json");
   if (fs2.existsSync(userConfig)) return userConfig;
   const defaultCandidates = [
-    path2.join(__dirname, "config.json.example"),
-    path2.join(__dirname, "..", "..", "agent_moss", "infra", "config.json.example")
+    path2.join(__configModuleDir, "config.json.example"),
+    path2.join(__configModuleDir, "..", "config.json.example"),
+    path2.join(__configModuleDir, "..", "..", "agent_moss", "infra", "config.json.example"),
+    path2.join(__configModuleDir, "..", "..", "..", "agent_moss", "infra", "config.json.example")
   ];
   const defaultConfig = defaultCandidates.find((p) => fs2.existsSync(p));
   if (defaultConfig) {
@@ -3304,8 +3570,8 @@ function resolveConfigPath() {
     const pkgConfig = loadConfigFile(defaultConfig);
     const safeConfig = pkgConfig ? { ...pkgConfig, llm: { ...pkgConfig.llm, api_key: "" } } : {};
     fs2.writeFileSync(userConfig, JSON.stringify(safeConfig, null, 4), "utf-8");
-    console.log(`[AgentMoss] \u5DF2\u521B\u5EFA\u7528\u6237\u914D\u7F6E\u6587\u4EF6: ${userConfig}`);
-    console.log(`[AgentMoss] \u8BF7\u7F16\u8F91\u8BE5\u6587\u4EF6\u914D\u7F6E\u4F60\u7684 LLM API Key`);
+    console.error(`[AgentMoss] \u5DF2\u521B\u5EFA\u7528\u6237\u914D\u7F6E\u6587\u4EF6: ${userConfig}`);
+    console.error(`[AgentMoss] \u8BF7\u7F16\u8F91\u8BE5\u6587\u4EF6\u914D\u7F6E\u4F60\u7684 LLM API Key`);
   }
   return userConfig;
 }
@@ -3351,17 +3617,19 @@ function wildcardToRegExp(pattern) {
 }
 function loadCustomRules() {
   const rules = [];
-  try {
-    const raw = process.env.AGENT_MOSS_CUSTOM_RULES;
-    if (raw) {
-      const parsed = JSON.parse(raw);
-      if (Array.isArray(parsed)) {
-        for (const r of parsed) {
-          if (r && r.pattern && r.action) rules.push({ pattern: r.pattern, action: r.action, severity: r.severity || "high" });
+  if (!isBuiltinOnly()) {
+    try {
+      const raw = process.env.AGENT_MOSS_CUSTOM_RULES;
+      if (raw) {
+        const parsed = JSON.parse(raw);
+        if (Array.isArray(parsed)) {
+          for (const r of parsed) {
+            if (r && r.pattern && r.action) rules.push({ pattern: r.pattern, action: r.action, severity: r.severity || "high" });
+          }
         }
       }
+    } catch {
     }
-  } catch {
   }
   for (const rulesPath of USER_RULES_PATHS) {
     try {
@@ -3390,6 +3658,9 @@ function userRuleVariantPattern(pattern) {
   }
   return null;
 }
+function reloadCustomRules() {
+  customRules = loadCustomRules();
+}
 function getLLMConfig() {
   return llmConfig;
 }
@@ -3477,7 +3748,33 @@ function layerEnabledOrDefault(key) {
   }
 }
 function isBrainEnabled() {
-  return process.env.AGENT_MOSS_BRAIN_ENABLED === "1";
+  if (isRuntimeConfigDisabled()) return false;
+  return getAgentMossSetting("AGENT_MOSS_BRAIN_ENABLED", "") === "1";
+}
+function getAgentMossSetting(key, def = "") {
+  const envValue = process.env[key];
+  if (envValue !== void 0) return envValue;
+  const cfg = loadConfigFile(resolveConfigPath());
+  if (cfg && key in cfg) return String(cfg[key]);
+  return def;
+}
+function isPolicyGenEnabled() {
+  return getAgentMossSetting("AGENT_MOSS_ENABLE_POLICY_GEN", "") === "1";
+}
+function getCacheOptions() {
+  let enabled = true;
+  let maxSize = 1e3;
+  const cfg = loadConfigFile(resolveConfigPath());
+  const cache3 = cfg?.cache;
+  if (cache3 && typeof cache3 === "object") {
+    if (typeof cache3.enabled === "boolean") enabled = cache3.enabled;
+    if (typeof cache3.max_size === "number" && cache3.max_size > 0) maxSize = cache3.max_size;
+  }
+  if (process.env.AGENT_MOSS_DISABLE_CACHE === "1") enabled = false;
+  return { enabled, maxSize };
+}
+function isPolicySaveEnabled() {
+  return getAgentMossSetting("AGENT_MOSS_SAVE_POLICY", "1") !== "0";
 }
 function isLogicRulesEnabled() {
   if (process.env.AGENT_MOSS_DISABLE_LOGIC_RULES === "1") return false;
@@ -3486,13 +3783,21 @@ function isLogicRulesEnabled() {
 function isFormalObserveMode() {
   return process.env.AGENT_MOSS_FORMAL_OBSERVE === "1";
 }
-var timeoutConfig, retryConfig, llmConfig, __configModuleDir, USER_RULES_PATHS, customRules, PROVIDER_HEADERS;
+var __configModuleDir, timeoutConfig, retryConfig, llmConfig, USER_RULES_PATHS, customRules, PROVIDER_HEADERS;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
     init_esm_shims();
     init_paths();
     init_runtime_config();
+    init_rules_mode();
+    __configModuleDir = (() => {
+      try {
+        return path2.dirname(fileURLToPath5(import.meta.url));
+      } catch {
+        return typeof __dirname !== "undefined" ? __dirname : process.cwd();
+      }
+    })();
     llmConfig = (() => {
       const configPath = resolveConfigPath();
       const fileConfig = fs2.existsSync(configPath) ? loadLLMConfigFromFile(configPath) : {};
@@ -3510,13 +3815,6 @@ var init_config = __esm({
         timeout: parseInt(process.env.AGENT_MOSS_LLM_TIMEOUT || String(fileConfig.timeout ?? String(tr.timeout.prompt1Timeout)), 10)
       };
     })();
-    __configModuleDir = (() => {
-      try {
-        return path2.dirname(fileURLToPath5(import.meta.url));
-      } catch {
-        return typeof __dirname !== "undefined" ? __dirname : process.cwd();
-      }
-    })();
     USER_RULES_PATHS = [
       path2.join(__configModuleDir, "rules", "user_rules.json"),
       // 源在 ts/src/rules（一般不存在）
@@ -3549,7 +3847,9 @@ function resolveAgentsDir() {
 }
 function getAgentExtensions(agentId) {
   if (!agentId) return null;
-  if (cache.has(agentId)) return cache.get(agentId) ?? null;
+  const fp = getRuleSourceFingerprint();
+  const cached2 = cache.get(agentId);
+  if (cached2 && cached2.fp === fp) return cached2.ext;
   let ext = null;
   try {
     if (hasRuntimeConfig()) {
@@ -3561,7 +3861,7 @@ function getAgentExtensions(agentId) {
     const agentsDir = resolveAgentsDir();
     const rulesFile = resolve4(agentsDir, agentId, "rules.json");
     if (!existsSync6(rulesFile)) {
-      cache.set(agentId, null);
+      cache.set(agentId, { fp, ext: null });
       return null;
     }
     try {
@@ -3569,16 +3869,16 @@ function getAgentExtensions(agentId) {
       ext = JSON.parse(raw);
       if (!ext.agent_id) {
         console.warn(`[AgentMoss agents] rules.json \u7F3A\u5C11 agent_id \u5B57\u6BB5: ${rulesFile}`);
-        cache.set(agentId, null);
+        cache.set(agentId, { fp, ext: null });
         return null;
       }
     } catch (e) {
       console.error(`[AgentMoss agents] \u52A0\u8F7D agent ${agentId} rules.json \u5931\u8D25:`, e.message);
-      cache.set(agentId, null);
+      cache.set(agentId, { fp, ext: null });
       return null;
     }
   }
-  cache.set(agentId, ext);
+  cache.set(agentId, { fp, ext });
   console.error(
     `[AgentMoss agents] \u52A0\u8F7D agent ${agentId} \u5B9A\u5236\u89C4\u5219: ${ext.extra_command_patterns?.length ?? 0} cmd patterns, ${ext.extra_injection_keywords?.length ?? 0} injection keywords, ${ext.extra_sensitive_paths?.length ?? 0} sensitive paths, ${ext.builtin_safe_skills?.length ?? 0} builtin safe skills, ${ext.builtin_safe_action_types?.length ?? 0} builtin safe action types`
   );
@@ -3624,7 +3924,9 @@ function resolveScenariosDir() {
 }
 function getScenarioExtensions(scenarioId) {
   if (!scenarioId) return null;
-  if (cache2.has(scenarioId)) return cache2.get(scenarioId) ?? null;
+  const fp = getRuleSourceFingerprint();
+  const cached2 = cache2.get(scenarioId);
+  if (cached2 && cached2.fp === fp) return cached2.ext;
   let ext = null;
   let overrideHit = null;
   try {
@@ -3648,7 +3950,7 @@ function getScenarioExtensions(scenarioId) {
       );
     }
     if (!existsSync7(rulesFile)) {
-      cache2.set(scenarioId, null);
+      cache2.set(scenarioId, { fp, ext: null });
       return null;
     }
     try {
@@ -3657,7 +3959,7 @@ function getScenarioExtensions(scenarioId) {
       const id = data.scenario_id || data.agent_id || "";
       if (!id) {
         console.warn(`[AgentMoss scenarios] rules.json \u7F3A\u5C11 scenario_id \u5B57\u6BB5: ${rulesFile}`);
-        cache2.set(scenarioId, null);
+        cache2.set(scenarioId, { fp, ext: null });
         return null;
       }
       ext = {
@@ -3672,11 +3974,11 @@ function getScenarioExtensions(scenarioId) {
       };
     } catch (e) {
       console.error(`[AgentMoss scenarios] \u52A0\u8F7D\u573A\u666F ${scenarioId} rules.json \u5931\u8D25:`, e.message);
-      cache2.set(scenarioId, null);
+      cache2.set(scenarioId, { fp, ext: null });
       return null;
     }
   }
-  cache2.set(scenarioId, ext);
+  cache2.set(scenarioId, { fp, ext });
   console.error(
     `[AgentMoss scenarios] \u52A0\u8F7D\u573A\u666F ${scenarioId} \u5B9A\u5236\u89C4\u5219: ${ext.extra_command_patterns?.length ?? 0} cmd patterns, ${ext.extra_injection_keywords?.length ?? 0} injection keywords, ${ext.extra_sensitive_paths?.length ?? 0} sensitive paths`
   );
@@ -7030,10 +7332,10 @@ async function runLLMAnalysis(input, previous) {
   const config = input.llmConfig?.apiKey ? { ...globalConfig, ...input.llmConfig } : globalConfig;
   const rawDetail = input.aNext.actionDetail.replace(/^terminal-\w+:\s*command=([^,]+).*/, "$1").trim();
   const cacheKey = `${input.aNext.actionType}:${rawDetail || input.aNext.actionDetail}`;
-  const cached = llmCache.get(cacheKey);
-  if (cached) {
+  const cached2 = llmCache.get(cacheKey);
+  if (cached2) {
     console.log("[AgentMoss] LLM cache hit");
-    return cached;
+    return cached2;
   }
   const matchedSkills = matchSkills(input.aNext.actionType, input.aNext.actionDetail, input.reason);
   const templates = loadTemplates();
@@ -7222,7 +7524,7 @@ async function analyzeWithLLM(prompt, config) {
       }
       if (attempt < maxRetries) {
         console.error(`[AgentMoss] LLM call failed (attempt ${attempt + 1}/${maxRetries + 1}), retrying in ${retryCfg.retryInterval}s:`, err.message);
-        await new Promise((resolve10) => setTimeout(resolve10, retryCfg.retryInterval * 1e3));
+        await new Promise((resolve11) => setTimeout(resolve11, retryCfg.retryInterval * 1e3));
       } else {
         clearTimeout(totalTimeoutTimer);
         console.error("[AgentMoss] LLM call failed after all retries:", err.message);
@@ -7345,6 +7647,56 @@ var init_rule_store = __esm({
       getRule(ruleId) {
         return this.data.rules.find((r) => r.id === ruleId);
       }
+      /** 质疑：active → disputed，并把 disputed_count +1（镜像 Python dispute_rule）。 */
+      disputeRule(ruleId, _reason = "") {
+        const rule = this.getRule(ruleId);
+        if (!rule) throw new Error(`\u89C4\u5219\u4E0D\u5B58\u5728: ${ruleId}`);
+        if (rule.status !== STATUS_ACTIVE) throw new Error(`\u53EA\u6709 active \u72B6\u6001\u53EF\u8D28\u7591\uFF0C\u5F53\u524D: ${rule.status}`);
+        rule.status = STATUS_DISPUTED;
+        rule.disputedCount += 1;
+        this.save();
+      }
+      // ==================== 生命周期（curator 用，镜像 Python rule_store） ====================
+      /** 长期未触发的 active/disputed 规则 → stale。 */
+      markStale(staleDays = 30) {
+        const cutoff = Date.now() - staleDays * 864e5;
+        for (const r of this.data.rules) {
+          if ((r.status === STATUS_ACTIVE || r.status === STATUS_DISPUTED) && r.lastTriggeredAt > 0 && r.lastTriggeredAt < cutoff) {
+            r.status = STATUS_STALE;
+          }
+        }
+        this.save();
+      }
+      /** 长期 stale 的规则 → archived。 */
+      markArchived(archiveDays = 90) {
+        const cutoff = Date.now() - archiveDays * 864e5;
+        for (const r of this.data.rules) {
+          if (r.status === STATUS_STALE && r.lastTriggeredAt > 0 && r.lastTriggeredAt < cutoff) {
+            r.status = STATUS_ARCHIVED;
+          }
+        }
+        this.save();
+      }
+      /** disputed 次数达阈值 → 自动降级 stale（自动纠错闭环）。 */
+      autoDemoteDisputed(disputeThreshold = 3) {
+        for (const r of this.data.rules) {
+          if (r.status === STATUS_DISPUTED && r.disputedCount >= disputeThreshold) {
+            r.status = STATUS_STALE;
+          }
+        }
+        this.save();
+      }
+      // ==================== 中心化预留（镜像 Python） ====================
+      /** 导出本地新增（非 central 来源）的 active 规则。 */
+      getRulesForExport() {
+        return this.data.rules.filter((r) => r.source !== "central" && r.status === STATUS_ACTIVE);
+      }
+      /** 导入中心下发规则（强制标 central 来源，避免被再次回流）。 */
+      importRules(rules) {
+        for (const rule of rules) {
+          this.addRule({ ...rule, source: "central", originNode: "central" });
+        }
+      }
       getActiveRules(layer) {
         return this.data.rules.filter((r) => r.status === STATUS_ACTIVE && (layer === void 0 || r.layer === layer));
       }
@@ -7452,12 +7804,14 @@ var init_pattern_extractor = __esm({
       minOccurrences;
       builtinPatterns;
       reviewFn;
+      skillManager;
       constructor(ruleStore, opts) {
         this.ruleStore = ruleStore;
         this.minConfidence = opts?.minConfidence ?? 0.9;
         this.minOccurrences = opts?.minOccurrences ?? 3;
         this.builtinPatterns = opts?.builtinPatterns ?? [];
         this.reviewFn = opts?.review ?? null;
+        this.skillManager = opts?.skillManager ?? null;
       }
       async extract(event, llmResult) {
         const result = { rulesCreated: 0, patternsRecorded: 0, skippedReason: "", deduped: [] };
@@ -7546,8 +7900,96 @@ var init_pattern_extractor = __esm({
             result.rulesCreated += 1;
           }
         }
+        if (this.skillManager) {
+          const skill = this.buildSkill(actionDetail, reason, riskType, eventId);
+          if (skill) {
+            const id = this.skillManager.addSkill(skill);
+            if (id) {
+              result.skillsCreated = (result.skillsCreated ?? 0) + 1;
+            }
+          }
+        }
         return result;
       }
+      /**
+       * 生成候选 Skill；不值得沉淀时返回 null（镜像 Python `_extract_skill` 的三道价值评估）。
+       *
+       * 评估 1：reason 太短（<50 字）说明没有可复用的判断逻辑，不沉淀；
+       * 评估 2：同名 skill 已存在 → 跳过；
+       * 评估 3：与已有 active skill 关键词重叠 >= 2 → 跳过（防同类案例重复沉淀，
+       *        如 cat /etc/shadow 与 cat /etc/sudoers 生成两个近乎重复的 skill）。
+       */
+      buildSkill(actionDetail, reason, riskType, eventId) {
+        if (!reason || reason.length < 50) return null;
+        if (!riskType) return null;
+        const detailWords = (actionDetail.toLowerCase().match(/[a-z]+/g) || []).slice(0, 3);
+        const name = detailWords.length > 0 ? `brain_${riskType}_${detailWords.join("_")}` : `brain_${riskType}`;
+        if (this.skillManager.getSkillMeta(name)) return null;
+        const keywords = this.extractSkillKeywords(actionDetail, reason, riskType);
+        if (this.isCoveredByExistingSkill(keywords)) return null;
+        return {
+          name,
+          category: this.categorizeRisk(riskType),
+          content: this.generateSkillContent(name, actionDetail, reason, riskType),
+          keywords,
+          sourceEventIds: eventId ? [eventId] : [],
+          status: "active"
+        };
+      }
+      /** 关键词提取（镜像 Python `_extract_keywords`）。 */
+      extractSkillKeywords(actionDetail, reason, riskType) {
+        const keywords = /* @__PURE__ */ new Set();
+        if (riskType) keywords.add(riskType);
+        for (const w of (actionDetail.toLowerCase().match(/[a-z_]{3,}/g) || []).slice(0, 10)) keywords.add(w);
+        for (const w of (reason.toLowerCase().match(/[a-z_]{3,}/g) || []).slice(0, 5)) keywords.add(w);
+        return [...keywords];
+      }
+      /** 与已有 active skill 关键词重叠 >= 2 → 视为已覆盖（镜像 `_is_covered_by_existing_skill`）。 */
+      isCoveredByExistingSkill(keywords) {
+        if (keywords.length === 0) return false;
+        let existing = [];
+        try {
+          existing = this.skillManager.getActiveSkills();
+        } catch {
+          return false;
+        }
+        const cand = new Set(keywords.map((k) => k.toLowerCase()));
+        for (const meta of existing) {
+          const metaKeywords = (meta.keywords || []).map((k) => String(k).toLowerCase());
+          if (metaKeywords.length === 0) continue;
+          const overlap = metaKeywords.filter((k) => cand.has(k)).length;
+          if (overlap >= 2) return true;
+        }
+        return false;
+      }
+      /** 风险类型 → skill 分类（镜像 Python `_categorize_risk`）。 */
+      categorizeRisk(riskType) {
+        if (!riskType) return "edge_case";
+        if (["inject", "backdoor", "persist"].some((k) => riskType.includes(k))) return "attack_pattern";
+        if (["exfil", "leak", "export"].some((k) => riskType.includes(k))) return "attack_pattern";
+        return "defense_strategy";
+      }
+      /** skill 正文（与 Python `_generate_skill_content` 同结构，便于双端对拍）。 */
+      generateSkillContent(name, actionDetail, reason, riskType) {
+        return `# ${name}
+
+## \u6765\u6E90
+Brain \u81EA\u52A8\u63D0\u53D6\uFF08LLM \u5206\u6790\u6C89\u6DC0\uFF09
+
+## \u573A\u666F
+\u5F53 Agent \u6267\u884C\u4EE5\u4E0B\u7C7B\u578B\u64CD\u4F5C\u65F6\u89E6\u53D1\uFF1A
+- \u98CE\u9669\u7C7B\u578B: ${riskType}
+- \u64CD\u4F5C\u7279\u5F81: ${actionDetail.slice(0, 200)}
+
+## \u5224\u65AD\u4F9D\u636E
+${reason.slice(0, 500)}
+
+## \u5904\u7406\u5EFA\u8BAE
+- \u4F18\u5148\u68C0\u67E5\u64CD\u4F5C\u7684\u4E0A\u4E0B\u6587\u548C\u610F\u56FE
+- \u7ED3\u5408 action_history \u5224\u65AD\u662F\u5426\u5B58\u5728\u6076\u610F\u94FE
+- \u5FC5\u8981\u65F6 Deny \u5E76\u8BB0\u5F55\u539F\u56E0
+`;
+      }
       extractPatterns(actionDetail, reason, riskType) {
         const patterns = [];
         const detailLower = actionDetail.toLowerCase();
@@ -7743,11 +8185,234 @@ var init_reviewer = __esm({
   }
 });
 
-// src/brain/index.ts
-function checkBrainRules(store, opts) {
-  if (!store) return null;
-  const rules = store.getActiveRules(opts.layer);
-  if (rules.length === 0) return null;
+// src/brain/skill-manager.ts
+import { existsSync as existsSync13, mkdirSync as mkdirSync4, readFileSync as readFileSync13, renameSync, writeFileSync as writeFileSync4 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join8 } from "path";
+import { randomUUID } from "crypto";
+function getMetaPath(override) {
+  return override || process.env[ENV_SKILL_META_PATH] || DEFAULT_SKILL_META_PATH;
+}
+var DEFAULT_SKILL_META_PATH, ENV_SKILL_META_PATH, BrainSkillManager;
+var init_skill_manager = __esm({
+  "src/brain/skill-manager.ts"() {
+    "use strict";
+    init_esm_shims();
+    DEFAULT_SKILL_META_PATH = join8(homedir5(), ".agentmoss", "brain", "skill_meta.json");
+    ENV_SKILL_META_PATH = "AGENT_MOSS_BRAIN_SKILL_META_PATH";
+    BrainSkillManager = class {
+      constructor(skillsDir, metaPath) {
+        this.skillsDir = skillsDir;
+        this.metaPath = getMetaPath(metaPath);
+        try {
+          mkdirSync4(join8(this.metaPath, ".."), { recursive: true });
+        } catch {
+        }
+        this.load();
+        this.cleanupGhostSkills();
+      }
+      skillsDir;
+      skills = [];
+      metaPath;
+      load() {
+        if (!existsSync13(this.metaPath)) return;
+        try {
+          const data = JSON.parse(readFileSync13(this.metaPath, "utf-8"));
+          this.skills = data.skills || [];
+        } catch {
+          this.skills = [];
+        }
+      }
+      save() {
+        const out = { version: 1, skills: this.skills };
+        const tmp = `${this.metaPath}.tmp`;
+        try {
+          writeFileSync4(tmp, JSON.stringify(out, null, 2), "utf-8");
+          renameSync(tmp, this.metaPath);
+        } catch {
+        }
+      }
+      /**
+       * 清理"幽灵 skill"：meta 记 active 但磁盘 .md 已不存在。
+       * （沿用 Python 的处理：置 stale，避免污染关键词表并阻塞同名新 skill 生成。）
+       */
+      cleanupGhostSkills() {
+        let changed = false;
+        for (const sk of this.skills) {
+          if (sk.status !== "active") continue;
+          if (!existsSync13(join8(this.skillsDir, `${sk.name}.md`))) {
+            sk.status = "stale";
+            changed = true;
+          }
+        }
+        if (changed) this.save();
+      }
+      /** 新增 Skill：写 .md + 记元数据。目录缺失或同名已存在时跳过（返回 ""）。 */
+      addSkill(skill) {
+        const id = skill.id || randomUUID();
+        const name = skill.name || `brain_${id.slice(0, 8)}`;
+        if (!existsSync13(this.skillsDir)) return "";
+        const mdPath = join8(this.skillsDir, `${name}.md`);
+        if (existsSync13(mdPath)) return "";
+        try {
+          writeFileSync4(mdPath, skill.content, "utf-8");
+        } catch {
+          return "";
+        }
+        this.skills.push({
+          id,
+          name,
+          category: skill.category || "",
+          keywords: skill.keywords || [],
+          source_event_ids: skill.sourceEventIds || [],
+          status: skill.status || "draft",
+          created_at: skill.createdAt || Date.now() / 1e3,
+          usage_count: skill.usageCount || 0,
+          origin_node: skill.originNode || "local"
+        });
+        this.save();
+        return id;
+      }
+      getSkillMeta(name) {
+        return this.skills.find((s) => s.name === name);
+      }
+      getActiveSkills() {
+        return this.skills.filter((s) => s.status === "active").sort((a, b) => (b.created_at || 0) - (a.created_at || 0));
+      }
+      recordUsage(name) {
+        const sk = this.getSkillMeta(name);
+        if (!sk) return;
+        sk.usage_count = (sk.usage_count || 0) + 1;
+        this.save();
+      }
+      /** 长期未使用（usage_count=0）且创建超过 staleDays 的 active skill → stale。 */
+      markStale(staleDays = 60) {
+        const cutoff = Date.now() / 1e3 - staleDays * 86400;
+        let changed = false;
+        for (const sk of this.skills) {
+          if (sk.status === "active" && (sk.usage_count || 0) === 0 && (sk.created_at || 0) < cutoff) {
+            sk.status = "stale";
+            changed = true;
+          }
+        }
+        if (changed) this.save();
+      }
+      /** 导出本地 active skill（含正文），供回流中心。 */
+      exportSkills() {
+        const out = [];
+        for (const sk of this.skills) {
+          if (sk.origin_node !== "local" || sk.status !== "active") continue;
+          const mdPath = join8(this.skillsDir, `${sk.name}.md`);
+          if (!existsSync13(mdPath)) continue;
+          out.push({
+            name: sk.name,
+            category: sk.category || "",
+            content: readFileSync13(mdPath, "utf-8"),
+            keywords: sk.keywords || []
+          });
+        }
+        return out;
+      }
+      /** 导入中心下发 skill（标 central，避免被再次回流）。 */
+      importSkills(skills) {
+        for (const s of skills) {
+          this.addSkill({
+            name: s.name,
+            category: s.category || "",
+            content: s.content,
+            keywords: s.keywords || [],
+            status: "active",
+            originNode: "central"
+          });
+        }
+      }
+      /** 保留 close 签名（JSON 落盘已逐次持久化）。 */
+      close() {
+        this.save();
+      }
+    };
+  }
+});
+
+// src/brain/curator.ts
+var BrainCurator;
+var init_curator = __esm({
+  "src/brain/curator.ts"() {
+    "use strict";
+    init_esm_shims();
+    BrainCurator = class {
+      constructor(ruleStore, skillManager) {
+        this.ruleStore = ruleStore;
+        this.skillManager = skillManager;
+      }
+      ruleStore;
+      skillManager;
+      /**
+       * 执行一次维护，返回报告。
+       *
+       * autoApprove 默认 true：brain 提取的规则达阈值后自动生效（学习闭环）；
+       * 需人工审核时设 false（由 Console 手动 approve）。
+       */
+      runMaintenance(opts = {}) {
+        const {
+          staleRuleDays = 30,
+          archiveRuleDays = 90,
+          staleSkillDays = 60,
+          disputeThreshold = 3,
+          autoApprove = true
+        } = opts;
+        const autoApproved = autoApprove ? this.autoApproveDrafts() : [];
+        this.ruleStore.markStale(staleRuleDays);
+        this.ruleStore.markArchived(archiveRuleDays);
+        this.ruleStore.autoDemoteDisputed(disputeThreshold);
+        this.skillManager.markStale(staleSkillDays);
+        return {
+          rule_stats: this.ruleStore.getStats(),
+          auto_approved: autoApproved
+        };
+      }
+      /** draft → active（仅未 disputed 的 draft）。返回被激活规则的 pattern 前缀。 */
+      autoApproveDrafts() {
+        const approved = [];
+        let drafts;
+        try {
+          drafts = this.ruleStore.getDraftRules();
+        } catch {
+          return approved;
+        }
+        for (const rule of drafts) {
+          try {
+            this.ruleStore.approveRule(rule.id);
+            approved.push(rule.pattern.slice(0, 60));
+          } catch {
+          }
+        }
+        return approved;
+      }
+    };
+  }
+});
+
+// src/brain/contributor.ts
+import { dirname as dirname9 } from "path";
+import { fileURLToPath as fileURLToPath9 } from "url";
+var __dirname8;
+var init_contributor = __esm({
+  "src/brain/contributor.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_rule_store();
+    init_skill_manager();
+    init_asset_dir();
+    __dirname8 = dirname9(fileURLToPath9(import.meta.url));
+  }
+});
+
+// src/brain/index.ts
+function checkBrainRules(store, opts) {
+  if (!store) return null;
+  const rules = store.getActiveRules(opts.layer);
+  if (rules.length === 0) return null;
   const combined = `${opts.actionType} ${opts.actionDetail}`;
   for (const rule of rules) {
     try {
@@ -7795,6 +8460,9 @@ var init_brain = __esm({
     init_rule_store();
     init_pattern_extractor();
     init_reviewer();
+    init_skill_manager();
+    init_curator();
+    init_contributor();
   }
 });
 
@@ -9324,19 +9992,64 @@ function extractRawCommand(detail) {
 function matchesAny(cmd, patterns) {
   return patterns.some((p) => p.test(cmd));
 }
-function getBrainStore() {
+function getBrainStore(osType) {
   if (!isBrainEnabled()) return null;
   if (!_brainInitialized) {
     _brainStore = new BrainRuleStore();
-    _brainExtractor = new PatternExtractor(_brainStore, { review: createBrainReviewer() });
+    const skillsDir = resolveAssetDir(__dirname, "skills");
+    _brainSkillManager = skillsDir ? new BrainSkillManager(skillsDir) : null;
+    _brainExtractor = new PatternExtractor(_brainStore, {
+      review: createBrainReviewer(),
+      // 内置规则去重集（对齐 Python coordinator._ensure_brain 收集的 builtin_patterns）：
+      // 危险命令正则 + 敏感路径（deny_* 或 credential）。
+      // 历史 bug：TS 这里只传 review，不传 builtinPatterns → 提取器拿不到内置规则，
+      // `isCoveredByBuiltin` 恒 False → 把 L1/L2 本来就能拦的案例重复沉淀成 Brain 规则。
+      builtinPatterns: collectBrainBuiltinPatterns(osType),
+      skillManager: _brainSkillManager
+    });
+    if (_brainSkillManager) {
+      _brainCurator = new BrainCurator(_brainStore, _brainSkillManager);
+    }
     _brainInitialized = true;
   }
+  const now = Date.now();
+  if (_brainCurator && now - _brainLastMaintenance >= BRAIN_MAINT_INTERVAL_MS) {
+    try {
+      _brainCurator.runMaintenance({ autoApprove: true });
+    } catch {
+    }
+    _brainLastMaintenance = now;
+  }
   return _brainStore;
 }
+function collectBrainBuiltinPatterns(osType) {
+  const bridge = runtimeConfigBridge.current;
+  if (!bridge) return [];
+  const out = [];
+  try {
+    for (const cp of bridge.effectiveDangerousPatterns(osType)) {
+      if (cp?.pattern?.source) out.push(cp.pattern.source);
+    }
+  } catch {
+  }
+  try {
+    for (const sp of bridge.effectiveSensitivePaths(osType)) {
+      const denyMode = String(sp?.denyMode || "");
+      if (["deny_both", "deny_write", "deny_read"].includes(denyMode) || sp?.credential) {
+        if (sp?.path) out.push(sp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+      }
+    }
+  } catch {
+  }
+  return out.filter(Boolean);
+}
 function _resetBrainForTest() {
   _brainStore = null;
   _brainExtractor = null;
+  _brainSkillManager = null;
+  _brainCurator = null;
   _brainInitialized = false;
+  _brainLastMaintenance = 0;
 }
 async function runAnalysis(input) {
   const observedFormalLayers = [];
@@ -9388,7 +10101,7 @@ async function runAnalysis(input) {
       }
     }
   }
-  const brainStore = getBrainStore();
+  const brainStore = getBrainStore(input.osType);
   if (brainStore) {
     const brainL1 = checkBrainRules(brainStore, {
       layer: 1,
@@ -9685,7 +10398,7 @@ async function runAnalysis(input) {
   }
   return llmResult;
 }
-var FULLY_SAFE_TOOLS, TRUSTED_SKILLS_BASE, READONLY_SENSITIVE_TOOLS, _brainStore, _brainExtractor, _brainInitialized, formalEngine;
+var FULLY_SAFE_TOOLS, TRUSTED_SKILLS_BASE, READONLY_SENSITIVE_TOOLS, _brainStore, _brainExtractor, _brainSkillManager, _brainCurator, _brainInitialized, _brainLastMaintenance, BRAIN_MAINT_INTERVAL_MS, formalEngine;
 var init_coordinator = __esm({
   "src/engine/coordinator.ts"() {
     "use strict";
@@ -9702,7 +10415,11 @@ var init_coordinator = __esm({
     init_agents();
     init_scenarios();
     init_brain();
+    init_skill_manager();
+    init_curator();
     init_reviewer();
+    init_asset_dir();
+    init_runtime_config_bridge();
     init_formal_engine();
     FULLY_SAFE_TOOLS = /* @__PURE__ */ new Set([
       "ask_user_question",
@@ -9725,7 +10442,11 @@ var init_coordinator = __esm({
     ]);
     _brainStore = null;
     _brainExtractor = null;
+    _brainSkillManager = null;
+    _brainCurator = null;
     _brainInitialized = false;
+    _brainLastMaintenance = 0;
+    BRAIN_MAINT_INTERVAL_MS = 3e5;
     formalEngine = new FormalEngine();
   }
 });
@@ -9736,6 +10457,7 @@ import { Hono as Hono2 } from "hono";
 import { cors } from "hono/cors";
 import { logger } from "hono/logger";
 import net from "net";
+import { existsSync as existsSync19 } from "fs";
 
 // src/routes.ts
 init_esm_shims();
@@ -9822,8 +10544,438 @@ var ReviewResponseSchema = z.object({
   discovered_patterns: z.array(z.record(z.unknown())).default([]).describe("\u6570\u636E\u9A71\u52A8\u53D1\u73B0\uFF1A\u8DE8 session \u9891\u7E41\u5371\u9669\u7EC4\u5408\uFF08\u9884\u7F6E\u94FE\u76F2\u533A\uFF0CPatternMiner\uFF09")
 });
 
-// src/routes.ts
+// src/engine/analyzer.ts
+init_esm_shims();
 init_coordinator();
+import { existsSync as existsSync16, mkdirSync as mkdirSync7, readFileSync as readFileSync16, writeFileSync as writeFileSync7 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join11, resolve as resolve10 } from "path";
+
+// src/infra/policy-cache.ts
+init_esm_shims();
+init_config();
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync15, mkdirSync as mkdirSync6, readdirSync as readdirSync5, readFileSync as readFileSync15, rmdirSync, unlinkSync as unlinkSync3, writeFileSync as writeFileSync6 } from "fs";
+import { tmpdir } from "os";
+import { join as join10 } from "path";
+var CACHE_DIR = join10(tmpdir(), "agent_moss_policy_cache");
+var cacheDirOverride = null;
+function cacheDir() {
+  return cacheDirOverride ?? CACHE_DIR;
+}
+var PolicyCache = class {
+  // Map 的插入序即 LRU 序（get 时重新 set 到末尾）
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  memory = /* @__PURE__ */ new Map();
+  cacheKey(sessionId, promptSession) {
+    return `${sessionId}::${promptSession}`;
+  }
+  cacheFilePath(sessionId, promptSession) {
+    const promptHash = createHash2("md5").update(promptSession).digest("hex").slice(0, 12);
+    const safeSessionId = sessionId.replace(/\//g, "_").replace(/\\/g, "_");
+    return join10(cacheDir(), safeSessionId, `${promptHash}.toml`);
+  }
+  /** 取缓存：内存 → 文件；未命中返回 null。 */
+  get(sessionId, promptSession) {
+    if (!this.options.enabled) return null;
+    const key = this.cacheKey(sessionId, promptSession);
+    const hit = this.memory.get(key);
+    if (hit !== void 0) {
+      this.memory.delete(key);
+      this.memory.set(key, hit);
+      return hit;
+    }
+    const file = this.cacheFilePath(sessionId, promptSession);
+    if (existsSync15(file)) {
+      try {
+        const policy = readFileSync15(file, "utf-8");
+        this.remember(key, policy);
+        return policy;
+      } catch {
+      }
+    }
+    return null;
+  }
+  /** 写缓存（内存 + 文件）。落盘失败不影响判定（缓存是旁路产物）。 */
+  put(sessionId, promptSession, policy) {
+    if (!this.options.enabled) return;
+    this.remember(this.cacheKey(sessionId, promptSession), policy);
+    const file = this.cacheFilePath(sessionId, promptSession);
+    try {
+      mkdirSync6(join10(cacheDir(), sessionId.replace(/\//g, "_").replace(/\\/g, "_")), { recursive: true });
+      writeFileSync6(file, policy, "utf-8");
+    } catch {
+    }
+  }
+  remember(key, policy) {
+    if (this.memory.has(key)) this.memory.delete(key);
+    this.memory.set(key, policy);
+    while (this.memory.size > this.options.maxSize) {
+      const oldest = this.memory.keys().next().value;
+      if (oldest === void 0) break;
+      this.memory.delete(oldest);
+    }
+  }
+  invalidate(sessionId, promptSession) {
+    this.memory.delete(this.cacheKey(sessionId, promptSession));
+    try {
+      unlinkSync3(this.cacheFilePath(sessionId, promptSession));
+    } catch {
+    }
+  }
+  invalidateSession(sessionId) {
+    for (const k of [...this.memory.keys()]) {
+      if (k.startsWith(`${sessionId}::`)) this.memory.delete(k);
+    }
+    const safeSessionId = sessionId.replace(/\//g, "_").replace(/\\/g, "_");
+    const dir = join10(cacheDir(), safeSessionId);
+    try {
+      if (existsSync15(dir)) {
+        for (const f of readdirSync5(dir)) {
+          try {
+            unlinkSync3(join10(dir, f));
+          } catch {
+          }
+        }
+        rmdirSync(dir);
+      }
+    } catch {
+    }
+  }
+  clear() {
+    this.memory.clear();
+    try {
+      if (existsSync15(cacheDir())) {
+        for (const sessionDir of readdirSync5(cacheDir())) {
+          const dir = join10(cacheDir(), sessionDir);
+          try {
+            for (const f of readdirSync5(dir)) unlinkSync3(join10(dir, f));
+            rmdirSync(dir);
+          } catch {
+          }
+        }
+      }
+    } catch {
+    }
+  }
+  /** 当前内存缓存条目数。 */
+  size() {
+    return this.memory.size;
+  }
+};
+var defaultCache = null;
+function getDefaultCache() {
+  if (!defaultCache) defaultCache = new PolicyCache(getCacheOptions());
+  return defaultCache;
+}
+
+// src/engine/analyzer.ts
+init_config();
+init_template_loader();
+init_asset_dir();
+init_token_stats();
+
+// src/infra/logging.ts
+init_esm_shims();
+function safe(value, limit = 200) {
+  const s = String(value ?? "");
+  return s.length > limit ? `${s.slice(0, limit)}\u2026` : s;
+}
+var MossLogger = class {
+  constructor(sessionId) {
+    this.sessionId = sessionId;
+  }
+  sessionId;
+  stepTimes = {};
+  stepStart = null;
+  startTime = Date.now();
+  prefix() {
+    return `[${safe(this.sessionId, 64)}]`;
+  }
+  logInput(promptSession, actionHistory, aNext, reason) {
+    console.error(
+      `${this.prefix()} agent_moss \u8F93\u5165 | prompt=${safe(promptSession, 100)}\u2026 | \u5386\u53F2\u52A8\u4F5C\u6570=${actionHistory.length} | \u4E0B\u4E00\u6B65\u52A8\u4F5C=${safe(aNext?.action_type ?? "?", 32)}:${safe(aNext?.action_detail ?? "?", 80)} | \u7406\u7531=${safe(reason, 80)}`
+    );
+  }
+  startStep(stepName) {
+    this.stepStart = Date.now();
+  }
+  endStep(stepName, detail = "") {
+    if (this.stepStart === null) return;
+    const elapsed = (Date.now() - this.stepStart) / 1e3;
+    this.stepTimes[stepName] = elapsed;
+    const detailStr = detail ? ` | ${safe(detail)}` : "";
+    console.error(
+      `${this.prefix()} \u6B65\u9AA4\u5B8C\u6210: ${safe(stepName, 48)} | \u8017\u65F6=${elapsed.toFixed(3)}s${detailStr}`
+    );
+    this.stepStart = null;
+  }
+  logLlmInteraction(step, promptSummary, responseSummary) {
+    console.error(
+      `${this.prefix()} LLM\u4EA4\u4E92 | \u6B65\u9AA4=${safe(step, 48)} | PROMPT\u6458\u8981=${safe(promptSummary, 200)} | \u54CD\u5E94\u6458\u8981=${safe(responseSummary, 200)}`
+    );
+  }
+  logResult(decision, reason, policy = "") {
+    const total = (Date.now() - this.startTime) / 1e3;
+    const steps = Object.entries(this.stepTimes).map(([k, v]) => `${safe(k, 48)}=${v.toFixed(3)}s`).join(", ");
+    console.error(
+      `${this.prefix()} agent_moss \u7ED3\u679C | \u51B3\u7B56=${safe(decision, 16)} | \u7406\u7531=${safe(reason, 150)} | \u6B65\u9AA4\u8017\u65F6=[${steps}] | \u603B\u8017\u65F6=${total.toFixed(3)}s`
+    );
+    if (policy) {
+      console.error(`${this.prefix()} \u751F\u6210\u7684Policy:
+${safe(policy, 2e3)}`);
+    }
+  }
+  logError(step, error) {
+    const name = error?.name ?? typeof error;
+    console.error(
+      `${this.prefix()} \u6B65\u9AA4\u5F02\u5E38: ${safe(step, 48)} | \u9519\u8BEF=${name}: ${safe(error?.message ?? error)}`
+    );
+  }
+};
+
+// src/engine/analyzer.ts
+import { parse as parseToml } from "smol-toml";
+var POLICY_OUTPUT_DIR = join11(tmpdir2(), "agent_moss");
+var policyOutputDirOverride = null;
+function policyOutputDir() {
+  return policyOutputDirOverride ?? POLICY_OUTPUT_DIR;
+}
+var DEFAULT_READONLY_POLICY = `landlock_optional = false
+mount_isolation_fallback = false
+
+[path_groups]
+system_binaries = true
+system_libraries = true
+temp_directories = true
+device_files = false
+proc_filesystem = false
+network_config = false
+wsl_paths = false
+
+[namespaces]
+mount = true
+pid = false
+network = true
+user = false
+
+[resources]
+timeout_secs = 30
+max_memory_bytes = 268435456
+
+[environment]
+whitelist = ["PATH", "LANG", "HOME", "USER", "HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy", "ALL_PROXY", "all_proxy", "NO_PROXY", "no_proxy"]
+`;
+function savePolicyToFile(sessionId, policyToml) {
+  if (!isPolicySaveEnabled()) return null;
+  try {
+    const outDir = policyOutputDir();
+    mkdirSync7(outDir, { recursive: true });
+    const safeName = sessionId.replace(/\//g, "_").replace(/\\/g, "_");
+    const filepath = join11(outDir, `${safeName}.toml`);
+    writeFileSync7(filepath, policyToml, "utf-8");
+    return filepath;
+  } catch (err) {
+    console.warn(`[AgentMoss] \u7B56\u7565\u6587\u4EF6\u843D\u76D8\u5931\u8D25\uFF08\u4E0D\u5F71\u54CD\u5224\u5B9A\uFF09: ${policyOutputDir()}: ${String(err)}`);
+    return null;
+  }
+}
+function parsePolicyFromLlm(response) {
+  const tomlBlock = response.match(/```toml\s*\n([\s\S]*?)```/);
+  if (tomlBlock) {
+    const s = tomlBlock[1].trim();
+    validateToml(s);
+    return s;
+  }
+  const anyBlock = response.match(/```\s*\n([\s\S]*?)```/);
+  if (anyBlock) {
+    const s = anyBlock[1].trim();
+    try {
+      validateToml(s);
+      return s;
+    } catch {
+    }
+  }
+  const whole = response.trim();
+  validateToml(whole);
+  return whole;
+}
+function validateToml(tomlStr) {
+  try {
+    parseToml(tomlStr);
+  } catch (err) {
+    throw new Error(`TOML \u89E3\u6790\u5931\u8D25: ${err.message}`);
+  }
+}
+function loadPolicyMappingDoc() {
+  const dir = resolveAssetDir(__dirname, "templates");
+  if (dir) {
+    const p = resolve10(dir, "policy_mapping.md");
+    if (existsSync16(p)) return readFileSync16(p, "utf-8");
+  }
+  for (const cand of assetDirCandidates(__dirname, "templates")) {
+    const p = resolve10(cand, "policy_mapping.md");
+    if (existsSync16(p)) return readFileSync16(p, "utf-8");
+  }
+  return "";
+}
+function buildPolicyPrompt(promptSession) {
+  const template = loadTemplates()["prompt1"] || "";
+  return template.replaceAll("{prompt_policy_mapping_doc}", loadPolicyMappingDoc()).replaceAll("{prompt_session}", promptSession);
+}
+async function generatePolicyWithLLM(sessionId, promptSession) {
+  const { default: OpenAI3 } = await import("openai");
+  const cfg = getLLMConfig();
+  const timeoutCfg = getTimeoutConfig();
+  const retryCfg = getRetryConfig();
+  const client = new OpenAI3({
+    baseURL: cfg.baseUrl,
+    apiKey: cfg.apiKey,
+    timeout: (cfg.timeout || timeoutCfg.prompt1Timeout) * 1e3
+  });
+  const prompt1 = buildPolicyPrompt(promptSession);
+  let lastErr = null;
+  for (let attempt = 1; attempt <= Math.max(1, retryCfg.maxRetries); attempt++) {
+    try {
+      const resp = await client.chat.completions.create({
+        model: cfg.model,
+        temperature: 0.1,
+        messages: [{ role: "user", content: prompt1 }]
+      });
+      try {
+        const usage = resp.usage || {};
+        recordTokenUsage({
+          sessionId,
+          step: "step2_policy_gen",
+          model: cfg.model,
+          promptTokens: usage.prompt_tokens || 0,
+          completionTokens: usage.completion_tokens || 0,
+          totalTokens: usage.total_tokens || 0
+        });
+      } catch {
+      }
+      return parsePolicyFromLlm(resp.choices?.[0]?.message?.content || "");
+    } catch (err) {
+      lastErr = err;
+      if (attempt < Math.max(1, retryCfg.maxRetries)) {
+        await new Promise((r) => setTimeout(r, retryCfg.retryInterval * 1e3));
+      }
+    }
+  }
+  throw lastErr ?? new Error("\u7B56\u7565\u751F\u6210\u5931\u8D25");
+}
+function allowResult(policy, judgment) {
+  return {
+    decision: "Allow",
+    reason: judgment.reason,
+    risk_level: judgment.riskLevel,
+    risk_type: judgment.riskType,
+    violated_layers: judgment.violatedLayers || [],
+    policy,
+    violated_policy: "",
+    confidence: judgment.confidence
+  };
+}
+async function analyze(input) {
+  const mossLog = new MossLogger(input.sessionId);
+  try {
+    return await analyzeInner(input, mossLog);
+  } catch (err) {
+    mossLog.logError("unknown", err);
+    const result = {
+      decision: "Deny",
+      reason: `\u5206\u6790\u8FC7\u7A0B\u53D1\u751F\u672A\u9884\u671F\u5F02\u5E38\uFF1A${String(err)}`,
+      risk_level: "high",
+      risk_type: "",
+      violated_layers: [],
+      policy: "",
+      violated_policy: "\u672A\u77E5\u5F02\u5E38",
+      confidence: 100
+    };
+    mossLog.logResult("Deny", result.reason);
+    return result;
+  }
+}
+async function analyzeInner(input, mossLog) {
+  mossLog.logInput(input.promptSession, input.actionHistory || [], input.aNext, input.reason || "");
+  mossLog.startStep("step1_security_judge");
+  const judgment = await runAnalysis(input);
+  mossLog.endStep(
+    "step1_security_judge",
+    `allowed=${judgment.allowed}, risk_level=${judgment.riskLevel}, source=${judgment.source}`
+  );
+  if (!judgment.allowed) {
+    const denied = {
+      decision: "Deny",
+      reason: judgment.reason,
+      risk_level: judgment.riskLevel,
+      risk_type: judgment.riskType,
+      violated_layers: judgment.violatedLayers || [],
+      policy: "",
+      violated_policy: `[${judgment.riskType}] ${judgment.reason}`,
+      confidence: judgment.confidence
+    };
+    mossLog.logResult("Deny", denied.reason);
+    return denied;
+  }
+  const cache3 = getDefaultCache();
+  mossLog.startStep("step2_cache_lookup");
+  const cached2 = cache3.get(input.sessionId, input.promptSession);
+  if (cached2 !== null) {
+    mossLog.endStep("step2_cache_lookup", "\u7F13\u5B58\u547D\u4E2D");
+    savePolicyToFile(input.sessionId, cached2);
+    const res = allowResult(cached2, judgment);
+    mossLog.logResult("Allow", res.reason, cached2);
+    return res;
+  }
+  if (!isPolicyGenEnabled()) {
+    mossLog.endStep("step2_cache_lookup", "\u7F13\u5B58\u672A\u547D\u4E2D\uFF0CPolicy \u751F\u6210\u5DF2\u7981\u7528");
+    mossLog.startStep("step2_default_policy");
+    cache3.put(input.sessionId, input.promptSession, DEFAULT_READONLY_POLICY);
+    savePolicyToFile(input.sessionId, DEFAULT_READONLY_POLICY);
+    const res = allowResult(DEFAULT_READONLY_POLICY, judgment);
+    mossLog.endStep("step2_default_policy", "\u4F7F\u7528\u9ED8\u8BA4\u6700\u5C0F\u6743\u9650 Policy");
+    mossLog.logResult("Allow", res.reason, DEFAULT_READONLY_POLICY);
+    return res;
+  }
+  if (judgment.source === "whitelist_bypass") {
+    mossLog.endStep("step2_cache_lookup", "\u7F13\u5B58\u672A\u547D\u4E2D\uFF0C\u767D\u540D\u5355\u5DE5\u5177");
+    cache3.put(input.sessionId, input.promptSession, DEFAULT_READONLY_POLICY);
+    savePolicyToFile(input.sessionId, DEFAULT_READONLY_POLICY);
+    const res = allowResult(DEFAULT_READONLY_POLICY, judgment);
+    mossLog.logResult("Allow", res.reason, DEFAULT_READONLY_POLICY);
+    return res;
+  }
+  mossLog.endStep("step2_cache_lookup", "\u7F13\u5B58\u672A\u547D\u4E2D\uFF0C\u542F\u7528 LLM \u751F\u6210");
+  mossLog.startStep("step2_generate_policy");
+  try {
+    const policy = await generatePolicyWithLLM(input.sessionId, input.promptSession);
+    cache3.put(input.sessionId, input.promptSession, policy);
+    savePolicyToFile(input.sessionId, policy);
+    mossLog.endStep("step2_generate_policy", "Policy \u751F\u6210\u5E76\u7F13\u5B58\u6210\u529F");
+    const res = allowResult(policy, judgment);
+    mossLog.logResult("Allow", res.reason, policy);
+    return res;
+  } catch (err) {
+    mossLog.endStep("step2_generate_policy", `\u5931\u8D25: ${String(err)}`);
+    mossLog.logError("step2_generate_policy", err);
+    const failed = {
+      decision: "Deny",
+      reason: `\u5B89\u5168\u68C0\u6D4B\u901A\u8FC7\uFF0C\u4F46\u7B56\u7565\u751F\u6210\u5931\u8D25\uFF1A${String(err)}`,
+      risk_level: judgment.riskLevel,
+      risk_type: judgment.riskType,
+      violated_layers: judgment.violatedLayers || [],
+      policy: "",
+      violated_policy: "\u65E0\u6CD5\u751F\u6210\u7B56\u7565\uFF1ALLM \u670D\u52A1\u5F02\u5E38\u6216\u8FD4\u56DE\u683C\u5F0F\u65E0\u6548",
+      confidence: judgment.confidence
+    };
+    mossLog.logResult("Deny", failed.reason);
+    return failed;
+  }
+}
 
 // src/actrail.ts
 init_esm_shims();
@@ -10112,7 +11264,80 @@ function loadAgentGateSessions(dbPath = "") {
   return readJsonDir(jsonDefault);
 }
 
+// src/adapters/observable.ts
+init_esm_shims();
+function isRawFormat(data) {
+  if (!data || typeof data !== "object") return false;
+  const d = data;
+  if ("current_action" in d) return true;
+  if (!("a_next" in d)) return true;
+  if (!("session_id" in d) && "agent_id" in d) return true;
+  return false;
+}
+function adaptObservable(rawData) {
+  const sessionId = rawData.session_id || rawData.agent_id || "unknown";
+  const actionRaw = rawData.a_next || rawData.current_action || {};
+  const aNext = actionRaw && typeof actionRaw === "object" ? {
+    action_type: actionRaw.action_type || actionRaw.tool || "unknown",
+    action_detail: actionRaw.action_detail || actionRaw.command || ""
+  } : { action_type: "unknown", action_detail: "" };
+  const historyRaw = Array.isArray(rawData.action_history) ? rawData.action_history : [];
+  const actionHistory = historyRaw.filter((h) => h && typeof h === "object").map((h) => {
+    const item = {
+      action_type: String(h.action_type || h.name || h.tool || ""),
+      action_detail: String(h.action_detail || h.command || "")
+    };
+    if ("output" in h) item.output = h.output ?? "";
+    return item;
+  });
+  const result = {
+    session_id: sessionId,
+    prompt_session: rawData.prompt_session || rawData.prompt || "",
+    action_history: actionHistory,
+    a_next: aNext,
+    reason: rawData.reason || (actionRaw && typeof actionRaw === "object" ? actionRaw.description : "") || "",
+    os_type: rawData.os_type || "",
+    cwd: rawData.cwd || "",
+    agent_id: rawData.agent_id || ""
+  };
+  if (!result.reason && actionRaw && typeof actionRaw === "object") {
+    result.reason = actionRaw.description || "";
+  }
+  let metadata = rawData.metadata;
+  if (!metadata || typeof metadata !== "object" || Object.keys(metadata).length === 0) {
+    metadata = {};
+    for (const k of ["agent_id", "sandbox_id", "trace_id"]) {
+      if (k in rawData && !(k in result)) metadata[k] = rawData[k];
+    }
+  }
+  if (metadata && Object.keys(metadata).length > 0) result.metadata = metadata;
+  return result;
+}
+function normalizeObservablePayload(body) {
+  if (!isRawFormat(body)) return body;
+  const adapted = adaptObservable(body);
+  const actionType = String(adapted.a_next?.action_type || "").trim().toLowerCase();
+  const actionDetail = String(adapted.a_next?.action_detail || "").trim();
+  if (!actionDetail && (actionType === "" || actionType === "unknown")) {
+    const err = new Error(
+      "\u65E0\u6CD5\u8BC6\u522B\u672C\u6B21\u52A8\u4F5C\uFF1A\u65E2\u6CA1\u6709 a_next\uFF08\u6807\u51C6\u683C\u5F0F\uFF09\uFF0C\u4E5F\u6CA1\u6709 current_action\uFF08\u53EF\u89C2\u6D4B\u670D\u52A1\u539F\u59CB\u683C\u5F0F\uFF09"
+    );
+    err.issues = [{
+      path: ["a_next"],
+      message: err.message
+    }];
+    throw err;
+  }
+  return adapted;
+}
+
 // src/routes.ts
+init_rule_store();
+init_skill_manager();
+init_asset_dir();
+import { join as join13, dirname as dirname11 } from "path";
+import { fileURLToPath as fileURLToPath10 } from "url";
+var __dirname9 = dirname11(fileURLToPath10(import.meta.url));
 async function healthRoute(c) {
   return c.json(HealthResponseSchema.parse({
     instance: process.env.AGENT_MOSS_INSTANCE || ""
@@ -10122,13 +11347,13 @@ async function analyzeRoute(c) {
   const t0 = performance.now();
   try {
     const body = await c.req.json();
-    const req = AnalyzeRequestSchema.parse(body);
+    const req = AnalyzeRequestSchema.parse(normalizeObservablePayload(body));
     let osType = req.os_type;
     if (!osType) {
       osType = process.platform === "win32" ? "windows" : "linux";
     }
     const agentId = req.agent_id || req.metadata?.agent_type || "";
-    const result = await runAnalysis({
+    const result = await analyze({
       sessionId: req.session_id,
       promptSession: req.prompt_session,
       // output 必须透传：L2 的「授权（consent）」判定看的是**用户对提问的回答**，
@@ -10148,6 +11373,20 @@ async function analyzeRoute(c) {
           output: h.output
         }))
       })),
+      // prompt_history 必须透传：L2 意图一致性（logic-rules.ts 的
+      // checkIntentConsistency）与 L3 语义分析（llm-analyzer.ts 的
+      // formatPromptHistory）都靠它看**完整的交错历史**；只传 prompt_session
+      // （最后一条用户消息）会让这两处在压缩/续跑场景下失明。
+      // 历史 bug：请求模型里有这个字段，但路由的 runAnalysis 调用没映射它 →
+      // 经 TS HTTP 入口的判定与 Python HTTP（routes.py 有透传）、与库内直调
+      // runAnalysis 的结果都不一致（2026-10 修正，映射口径对齐 Python）。
+      promptHistory: (req.prompt_history || []).map((t) => ({
+        text: t.text,
+        actions: t.actions.map((a) => ({
+          actionType: a.action_type,
+          actionDetail: a.action_detail
+        }))
+      })),
       aNext: {
         actionType: req.a_next.action_type,
         actionDetail: req.a_next.action_detail
@@ -10165,15 +11404,15 @@ async function analyzeRoute(c) {
     try {
       reportEnforcementEvent({
         traceId: req.session_id,
-        decision: result.allowed ? "allow" : "deny",
+        decision: result.decision === "Allow" ? "allow" : "deny",
         toolName: req.a_next.action_type,
         toolCommand: req.a_next.action_detail,
         sessionId: req.session_id,
         prompt: req.prompt_session,
-        riskLevel: result.riskLevel,
-        riskType: result.riskType,
+        riskLevel: result.risk_level,
+        riskType: result.risk_type,
         reason: result.reason,
-        violatedLayers: result.violatedLayers,
+        violatedLayers: result.violated_layers,
         confidence: result.confidence,
         durationMs: Math.round(durationMs * 10) / 10
       });
@@ -10190,7 +11429,7 @@ async function analyzeRoute(c) {
         }, req.session_id, Boolean(meta.is_error));
         const judgment = incMatchedToDeny(inc);
         if (judgment) {
-          const layers = [...result.violatedLayers];
+          const layers = [...result.violated_layers];
           if (!layers.includes("L2.2-stateful")) layers.push("L2.2-stateful");
           console.error(
             `[AgentMoss] stateful \u589E\u91CF\u62E6\u622A: agent=${agentId || "-"} property=${judgment.property_id} risk=${judgment.risk_level}`
@@ -10216,13 +11455,15 @@ async function analyzeRoute(c) {
     }
     return c.json(
       AnalyzeResponseSchema.parse({
-        decision: result.allowed ? "Allow" : "Deny",
+        decision: result.decision,
         reason: result.reason,
-        risk_level: result.riskLevel,
-        risk_type: result.riskType,
-        violated_layers: result.violatedLayers,
-        policy: "",
-        violated_policy: "",
+        risk_level: result.risk_level,
+        risk_type: result.risk_type,
+        violated_layers: result.violated_layers,
+        // policy / violated_policy 现在真的有值（镜像 Python analyze()）：
+        // Allow → 最小权限 TOML；Deny → 空 policy + violated_policy 描述
+        policy: result.policy,
+        violated_policy: result.violated_policy,
         confidence: result.confidence,
         analysis_duration_ms: Math.round(durationMs * 10) / 10
       })
@@ -10230,12 +11471,12 @@ async function analyzeRoute(c) {
   } catch (err) {
     console.error("[AgentMoss] Analysis error:", err);
     if (err instanceof SyntaxError) {
-      return c.json({ error: "Invalid JSON", detail: err.message }, 400);
+      return c.json({ detail: err.message, error: "Invalid JSON" }, 422);
     }
     if (err?.issues) {
-      return c.json({ error: "Validation error", detail: err.issues }, 400);
+      return c.json({ detail: err.issues, error: "Validation error" }, 422);
     }
-    return c.json({ error: "Internal error", detail: String(err) }, 500);
+    return c.json({ detail: String(err), error: "Internal error" }, 500);
   }
 }
 var reviewStore = null;
@@ -10293,13 +11534,25 @@ async function reviewRoute(c) {
     const violations = [];
     if (sessions.length > 0 || tracker.nodes.length > 0) {
       const eng = new FormalEngine();
+      const verifySessions = sessions.length > 0 ? sessions.map((s) => ({ sessionId: s.sessionId, actionHistory: s.actionHistory })) : tracker.nodes.length > 0 ? [{
+        sessionId: tracker.agentId,
+        actionHistory: tracker.nodes.map((n) => ({
+          actionType: n.actionType,
+          actionDetail: n.actionDetail
+        }))
+      }] : [];
       const full = eng.verify(
-        sessions.map((s) => ({ sessionId: s.sessionId, actionHistory: s.actionHistory })),
+        verifySessions,
         req.a_next ? { actionType: req.a_next.action_type, actionDetail: req.a_next.action_detail } : void 0
       );
       verified = full.verified;
       for (const v of full.violations) {
-        violations.push({ property_id: v.propertyId, reason: v.reason, risk_level: v.riskLevel });
+        violations.push({
+          property_id: v.propertyId,
+          reason: v.reason,
+          risk_level: v.riskLevel,
+          path: v.path
+        });
       }
     }
     const pending = tracker.pendingPrefixes.map((p) => ({
@@ -10329,6 +11582,101 @@ async function reviewRoute(c) {
     return c.json({ error: "Internal error", detail: String(err) }, 500);
   }
 }
+function getBrainRuleStore() {
+  return new BrainRuleStore();
+}
+function getBrainSkillManager() {
+  const dir = resolveAssetDir(__dirname9, "skills") ?? join13(__dirname9, "..", "..", "agent_moss", "skills");
+  return new BrainSkillManager(dir);
+}
+async function brainRulesRoute(c) {
+  const store = getBrainRuleStore();
+  const layerRaw = c.req.query("layer");
+  const layer = layerRaw ? parseInt(layerRaw, 10) : void 0;
+  const rules = store.getActiveRules(layer);
+  return c.json({
+    rules: rules.map((r) => ({
+      id: r.id,
+      layer: r.layer,
+      rule_type: r.ruleType,
+      pattern: r.pattern,
+      scope: r.scope,
+      confidence: r.confidence,
+      explanation: r.explanation
+    }))
+  });
+}
+async function brainDraftsRoute(c) {
+  const store = getBrainRuleStore();
+  return c.json({
+    drafts: store.getDraftRules().map((r) => ({
+      id: r.id,
+      layer: r.layer,
+      rule_type: r.ruleType,
+      pattern: r.pattern,
+      scope: r.scope,
+      confidence: r.confidence,
+      explanation: r.explanation,
+      source_event_ids: r.sourceEventIds
+    }))
+  });
+}
+async function brainApproveRoute(c) {
+  const ruleId = c.req.param("rule_id") ?? "";
+  try {
+    getBrainRuleStore().approveRule(ruleId);
+    return c.json({ status: "approved" });
+  } catch (err) {
+    return c.json({ detail: String(err.message) }, 400);
+  }
+}
+async function brainRejectRoute(c) {
+  const ruleId = c.req.param("rule_id") ?? "";
+  const reason = c.req.query("reason") || "";
+  try {
+    getBrainRuleStore().rejectRule(ruleId);
+    return c.json({ status: "rejected" });
+  } catch (err) {
+    return c.json({ detail: String(err.message) }, 400);
+  }
+}
+async function brainStatsRoute(c) {
+  return c.json(getBrainRuleStore().getStats());
+}
+async function brainSkillsRoute(c) {
+  const mgr = getBrainSkillManager();
+  const skills = mgr.getActiveSkills();
+  mgr.close();
+  return c.json({ skills });
+}
+async function brainExportRoute(c) {
+  const store = getBrainRuleStore();
+  return c.json({
+    rules: store.getRulesForExport().map((r) => ({
+      id: r.id,
+      layer: r.layer,
+      rule_type: r.ruleType,
+      pattern: r.pattern,
+      scope: r.scope,
+      confidence: r.confidence,
+      explanation: r.explanation,
+      origin_node: r.originNode
+    }))
+  });
+}
+async function brainImportRoute(c) {
+  const body = await c.req.json();
+  const rules = Array.isArray(body) ? body : [];
+  getBrainRuleStore().importRules(rules.map((r) => ({
+    layer: r.layer ?? 1,
+    ruleType: r.rule_type ?? "",
+    pattern: r.pattern ?? "",
+    scope: r.scope ?? "all",
+    confidence: r.confidence ?? 0.9,
+    explanation: r.explanation ?? ""
+  })));
+  return c.json({ imported: rules.length });
+}
 
 // src/console/index.ts
 init_esm_shims();
@@ -10338,12 +11686,14 @@ init_esm_shims();
 init_runtime_config();
 init_token_stats();
 init_rules_loader();
+init_asset_dir();
+init_rules_mode();
 import { Hono } from "hono";
-import { readFileSync as readFileSync15, existsSync as existsSync15 } from "fs";
-import { join as join10, dirname as dirname10 } from "path";
-import { fileURLToPath as fileURLToPath9 } from "url";
-var __dirname8 = dirname10(fileURLToPath9(import.meta.url));
-var STATIC_DIR = join10(__dirname8, "static");
+import { readFileSync as readFileSync18, existsSync as existsSync18, unlinkSync as unlinkSync4 } from "fs";
+import { join as join14, dirname as dirname12 } from "path";
+import { fileURLToPath as fileURLToPath11 } from "url";
+var __dirname10 = dirname12(fileURLToPath11(import.meta.url));
+var STATIC_DIR = join14(__dirname10, "static");
 var CONSOLE_TOKEN_ENV = "AGENT_MOSS_CONSOLE_TOKEN";
 function getConsoleToken() {
   return process.env[CONSOLE_TOKEN_ENV] || "";
@@ -10358,7 +11708,20 @@ function verifyAuth(req) {
 function authMiddleware() {
   return async (c, next) => {
     if (!verifyAuth(c.req.raw)) {
-      return c.json({ error: "Unauthorized: invalid or missing Bearer token" }, 401);
+      return c.json({ detail: "Unauthorized: invalid or missing Bearer token" }, 401);
+    }
+    await next();
+  };
+}
+function displayRuntimeConfig() {
+  return isRuntimeConfigDisabled() ? generateSourceDefaults() : loadRuntimeConfig();
+}
+function builtinOnlyReadOnlyMiddleware() {
+  return async (c, next) => {
+    if (isRuntimeConfigDisabled() && !["GET", "HEAD", "OPTIONS"].includes(c.req.method)) {
+      return c.json({
+        detail: `\u89C4\u5219\u6765\u6E90\u6A21\u5F0F\u4E3A ${getRulesMode()}\uFF08runtime \u914D\u7F6E\u5DF2\u7981\u7528\uFF09\uFF1AConsole \u53EA\u8BFB\uFF0C\u4FEE\u6539\u4E0D\u4F1A\u4FDD\u5B58\u3002\u8BF7\u5207\u6362\u89C4\u5219\u6765\u6E90\u6A21\u5F0F\u5E76\u91CD\u542F\u670D\u52A1\u540E\u518D\u6539\u89C4\u5219\u3002`
+      }, 403);
     }
     await next();
   };
@@ -10366,23 +11729,34 @@ function authMiddleware() {
 function createConsoleRouter() {
   const console2 = new Hono();
   console2.use("/api/*", authMiddleware());
+  console2.use("/api/*", builtinOnlyReadOnlyMiddleware());
   const serveIndex = (c) => {
-    const indexFile = join10(STATIC_DIR, "index.html");
-    if (existsSync15(indexFile)) {
-      return c.html(readFileSync15(indexFile, "utf-8"));
+    const indexFile = join14(STATIC_DIR, "index.html");
+    if (existsSync18(indexFile)) {
+      return c.html(readFileSync18(indexFile, "utf-8"));
     }
     return c.html("<h1>AgentMoss Policy Console</h1><p>Frontend not built. Use /console/api/* endpoints.</p>");
   };
   console2.get("/", serveIndex);
   console2.get("", serveIndex);
   console2.get("/api/layers", (c) => {
-    const rc = loadRuntimeConfig();
-    return c.json({ layers: rc.layers, env_overrides: getEnvOverrides() });
+    const rc = displayRuntimeConfig();
+    return c.json({ layers: rc.layers, env_overrides: getEnvOverrides(), builtin_only: isBuiltinOnly(), rules_mode: getRulesMode() });
   });
   console2.put("/api/layers", async (c) => {
     const body = await c.req.json();
+    const validKeys = /* @__PURE__ */ new Set(["L1_heuristic", "L2_logic_rules", "L3_llm_analysis"]);
+    if (!validKeys.has(body.layer_key)) {
+      return c.json({ detail: `Invalid layer_key: ${body.layer_key}` }, 400);
+    }
+    const envOverrides = getEnvOverrides();
+    if (envOverrides[body.layer_key]?.overridden) {
+      return c.json({
+        detail: `\u5C42\u7EA7 ${body.layer_key} \u88AB\u73AF\u5883\u53D8\u91CF ${envOverrides[body.layer_key].env_var}=1 \u5F3A\u5236\u8986\u76D6\uFF0CWeb \u8BBE\u7F6E\u65E0\u6548`
+      }, 409);
+    }
     const rc = updateLayerEnabled(body.layer_key, body.enabled);
-    return c.json({ layers: rc.layers, env_overrides: getEnvOverrides() });
+    return c.json({ layers: rc.layers, env_overrides: envOverrides });
   });
   function getL22View() {
     const ltlHuman = {
@@ -10402,7 +11776,7 @@ function createConsoleRouter() {
     const rules = mc.rules || [];
     let catEnabled = true;
     try {
-      const rt = loadRuntimeConfig();
+      const rt = displayRuntimeConfig();
       catEnabled = rt.L2_2?.ltl_rules?.category_enabled !== false;
     } catch {
     }
@@ -10458,8 +11832,22 @@ function createConsoleRouter() {
     return rc;
   }
   console2.get("/api/rules", (c) => {
-    const rc = loadRuntimeConfig();
-    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules, L2_2: getL22View() });
+    const rc = displayRuntimeConfig();
+    const layer = c.req.query("layer");
+    const category = c.req.query("category");
+    const out = {};
+    for (const layerKey of ["L1_rules", "L2_rules"]) {
+      if (layer && layer !== layerKey) continue;
+      const layerData = rc[layerKey] || {};
+      const picked = {};
+      for (const [catName, catData] of Object.entries(layerData)) {
+        if (category && category !== catName) continue;
+        picked[catName] = catData;
+      }
+      out[layerKey] = picked;
+    }
+    if (!category) out.L2_2 = getL22View();
+    return c.json(out);
   });
   console2.put("/api/rules/enabled", async (c) => {
     const b = await c.req.json();
@@ -10468,6 +11856,9 @@ function createConsoleRouter() {
   });
   console2.put("/api/rules/deny_mode", async (c) => {
     const b = await c.req.json();
+    if (!["deny_write", "deny_read", "deny_both"].includes(b.deny_mode)) {
+      return c.json({ detail: `\u65E0\u6548\u7684 deny_mode: ${b.deny_mode}` }, 400);
+    }
     const rc = updateRuleDenyMode(b.layer, b.category, b.rule_id, b.deny_mode);
     return c.json(withL22View(rc));
   });
@@ -10499,13 +11890,15 @@ function createConsoleRouter() {
   });
   console2.delete("/api/rules", async (c) => {
     const b = await c.req.json();
-    deleteCustomRule(b.layer, b.category, b.rule_id);
-    const rc = loadRuntimeConfig();
+    const rc = deleteCustomRule(b.layer, b.category, b.rule_id);
+    if (rc === null) {
+      return c.json({ detail: "\u5185\u7F6E\u89C4\u5219\u4E0D\u53EF\u5220\u9664\uFF0C\u53EA\u80FD\u7981\u7528" }, 403);
+    }
     return c.json(withL22View(rc));
   });
   console2.get("/api/skills", (c) => {
-    const rc = loadRuntimeConfig();
-    return c.json(rc.L3_skills);
+    const rc = displayRuntimeConfig();
+    return c.json(rc.L3_skills || {});
   });
   console2.put("/api/skills/enabled", async (c) => {
     const b = await c.req.json();
@@ -10524,25 +11917,32 @@ function createConsoleRouter() {
   });
   console2.delete("/api/skills", async (c) => {
     const b = await c.req.json();
-    deleteCustomSkill(b.skill_id, b.category);
-    const rc = loadRuntimeConfig();
+    const rc = deleteCustomSkill(b.skill_id, b.category);
+    if (rc === null) {
+      return c.json({ detail: "\u5185\u7F6E skill \u4E0D\u53EF\u5220\u9664\uFF0C\u53EA\u80FD\u7981\u7528" }, 403);
+    }
     return c.json(withL22View(rc));
   });
   console2.get("/api/skills/:skill_id/content", async (c) => {
     const skillId = c.req.param("skill_id");
     if (!/^[A-Za-z0-9_-]+$/.test(skillId)) {
-      return c.json({ error: "invalid skill_id" }, 400);
+      return c.json({ detail: "\u975E\u6CD5 skill id" }, 400);
     }
-    const skillPath = join10(dirname10(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
-    if (!existsSync15(skillPath)) {
-      const builtinPath = join10(__dirname8, "..", "..", "agent_moss", "skills", `${skillId}.md`);
-      if (existsSync15(builtinPath)) return c.text(readFileSync15(builtinPath, "utf-8"));
-      return c.json({ error: "skill not found" }, 404);
+    const userPath = join14(dirname12(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
+    const builtinDir = resolveAssetDir(__dirname10, "skills");
+    const candidates = [
+      ...isRuntimeConfigDisabled() ? [] : [userPath],
+      builtinDir ? join14(builtinDir, `${skillId}.md`) : ""
+    ].filter(Boolean);
+    for (const p of candidates) {
+      if (existsSync18(p)) {
+        return c.json({ skill_id: skillId, path: p, content: readFileSync18(p, "utf-8") });
+      }
     }
-    return c.text(readFileSync15(skillPath, "utf-8"));
+    return c.json({ detail: `skill ${skillId} \u4E0D\u5B58\u5728` }, 404);
   });
   console2.get("/api/agents", (c) => {
-    const rc = loadRuntimeConfig();
+    const rc = displayRuntimeConfig();
     return c.json({ agents: getAgentRules(rc) });
   });
   console2.put("/api/agents/rules/enabled", async (c) => {
@@ -10581,7 +11981,7 @@ function createConsoleRouter() {
   });
   const enabledScenarioIds = () => (process.env.AGENT_MOSS_SCENARIO || "").split(",").map((s) => s.trim()).filter(Boolean);
   console2.get("/api/scenarios", (c) => {
-    const all = getScenarioRules(loadRuntimeConfig());
+    const all = getScenarioRules(displayRuntimeConfig());
     const enabled = enabledScenarioIds();
     if (!enabled.length) return c.json({ scenarios: {}, enabled: [] });
     const shown = {};
@@ -10623,20 +12023,27 @@ function createConsoleRouter() {
     return c.json({ scenarios: getScenarioRules(rc), enabled: enabledScenarioIds() });
   });
   console2.get("/api/config", (c) => {
-    const rc = loadRuntimeConfig();
-    return c.json({ ...rc, L2_2: getL22View() });
+    const rc = displayRuntimeConfig();
+    return c.json({ ...rc, L2_2: getL22View(), builtin_only: isBuiltinOnly(), rules_mode: getRulesMode() });
   });
   console2.get("/api/env-overrides", (c) => {
     return c.json({ overrides: getEnvOverrides() });
   });
   console2.post("/api/reset", (c) => {
     const defaults = generateSourceDefaults();
-    saveRuntimeConfig(defaults);
+    try {
+      const p = getRuntimeConfigPath();
+      if (existsSync18(p)) unlinkSync4(p);
+    } catch {
+    }
     return c.json(withL22View(defaults));
   });
+  const parseDays = (v) => {
+    const n = parseInt(v || "0", 10);
+    return Number.isFinite(n) ? n : 0;
+  };
   console2.get("/api/token-stats", (c) => {
-    const days = parseInt(c.req.query("days") || "7", 10);
-    return c.json(getTokenStats(days));
+    return c.json(getTokenStats(parseDays(c.req.query("days"))));
   });
   console2.get("/api/token-stats/recent", (c) => {
     const limit = parseInt(c.req.query("limit") || "20", 10);
@@ -10644,47 +12051,69 @@ function createConsoleRouter() {
     return c.json({ records: getRecentRecords(limit, offset), total: getRecentRecordsCount() });
   });
   console2.get("/api/token-stats/trend", (c) => {
-    const days = parseInt(c.req.query("days") || "7", 10);
-    return c.json(getTokenTrend(days));
+    return c.json(getTokenTrend(parseDays(c.req.query("days"))));
   });
   console2.post("/api/token-stats/reset", (c) => {
     resetTokenStats();
-    return c.json({ reset: true });
+    return c.json({ detail: "Token stats reset successfully" });
   });
   return console2;
 }
 
 // src/server.ts
 init_runtime_config();
+init_rules_mode();
 init_rules_loader();
 function logDeploymentSelfCheck() {
   try {
+    const mode = getRulesMode();
+    const builtinOnly = isBuiltinOnly();
+    const runtimeDisabled = isRuntimeConfigDisabled();
     console.log("================ AgentMoss \u90E8\u7F72\u81EA\u68C0 ================");
-    console.log(`runtime \u914D\u7F6E: ${getRuntimeConfigPath()}`);
-    const layerKeys = ["L1_heuristic", "L2_logic_rules", "L3_llm_analysis", "agent_rules_enabled", "scenario_rules_enabled"];
-    console.log("\u5C42\u7EA7\u5F00\u5173: " + layerKeys.map((k) => `${k}=${isLayerEnabled(k) ? "on" : "OFF"}`).join(" "));
-    try {
-      const overrides = overriddenRuleFiles();
-      if (overrides.length > 0) {
-        console.error(`\u26A0\uFE0F  \u68C0\u6D4B\u5230 ${overrides.length} \u4E2A\u89C4\u5219\u8986\u76D6\u6587\u4EF6\uFF0C**\u6574\u4EFD\u66FF\u6362**\u4E86\u5185\u7F6E\u89C4\u5219\uFF1A`);
-        for (const p of overrides) console.error(`      ${p}`);
+    if (runtimeDisabled) {
+      console.log(`runtime \u914D\u7F6E: ${getRuntimeConfigPath()}\uFF08**\u5DF2\u5FFD\u7565**\uFF1A\u89C4\u5219\u6765\u6E90\u6A21\u5F0F=${mode}\uFF09`);
+      if (builtinOnly) {
+        console.error(
+          "\u89C4\u5219\u6765\u6E90: **\u4EC5\u5185\u7F6E** \u2014\u2014 \u4E0D\u8BFB runtime \u914D\u7F6E / Console \u81EA\u5B9A\u4E49 / \u89C4\u5219\u76EE\u5F55 / AGENT_MOSS_CUSTOM_RULES\uFF1B\u4E0D seed\u3001\u4E0D merge\u3001\u4E0D\u5199\u56DE\u3002"
+        );
+      } else {
         console.error(
-          "    \u8FD9\u4E9B\u6587\u4EF6\u7531\u90E8\u7F72\u4FA7\u81EA\u884C\u7EF4\u62A4\uFF0C**\u5185\u7F6E\u89C4\u5219\u66F4\u65B0\u4E0D\u4F1A\u53CD\u6620\u5230\u5B83\u4EEC\u4E0A\u9762**\uFF1B\u5220\u9664\u5BF9\u5E94\u6587\u4EF6\uFF08\u6216\u6E05\u7A7A AGENT_MOSS_OVERRIDE_RULES_DIR\uFF09\u5373\u6062\u590D\u5185\u7F6E\u3002\u82E5\u53EA\u60F3\u9010\u6761\u542F\u505C/\u589E\u5220\uFF0C\u8BF7\u6539\u7528 runtime config\uFF08Console\uFF09\u3002"
+          "\u89C4\u5219\u6765\u6E90: **\u51B7\u542F\u52A8\uFF08cold\uFF09** \u2014\u2014 \u542F\u52A8\u65F6\u8BFB\u53D6\u5185\u7F6E\u89C4\u5219 + \u89C4\u5219\u76EE\u5F55 / AGENT_MOSS_CUSTOM_RULES / \u573A\u666F\uFF0C\u4E4B\u540E\u51BB\u7ED3\uFF1B\u4E0D\u8BFB runtime \u914D\u7F6E / Console\uFF0C\u4E0D seed\u3001\u4E0D merge\u3001\u4E0D\u5199\u56DE\u3002"
         );
+        console.error("\u89C4\u5219\u76EE\u5F55\u5185\u5BB9\u6539\u52A8\u9700\u91CD\u542F\u670D\u52A1\u624D\u751F\u6548\u3002");
       }
-    } catch {
+      console.error("Console: \u53EA\u8BFB\uFF08\u89C4\u5219\u5199\u63A5\u53E3\u8FD4\u56DE 403\uFF09\uFF1B\u4FEE\u6539\u89C4\u5219\u9700\u91CD\u542F\u670D\u52A1\u5E76\u5207\u6362\u89C4\u5219\u6765\u6E90\u6A21\u5F0F\u3002");
+    } else {
+      console.log(`runtime \u914D\u7F6E: ${getRuntimeConfigPath()}`);
     }
-    try {
-      const extras = extraRuleFiles();
-      if (extras.length > 0) {
-        const cats = loadExtraRules();
-        const total = Object.values(cats).reduce((n, v) => n + v.length, 0);
-        const catSummary = Object.entries(cats).sort(([a], [b]) => a.localeCompare(b)).map(([k, v]) => `${k}\xD7${v.length}`).join(", ");
-        console.log(
-          `\u5DF2\u4ECE\u8FFD\u52A0\u76EE\u5F55 ${extraRulesDirs().join(", ")} \u52A0\u8F7D ${extras.length} \u4E2A\u89C4\u5219\u6587\u4EF6\uFF08\u5171 ${total} \u6761${catSummary ? `\uFF0C\u7C7B\u522B\uFF1A${catSummary}` : ""}\uFF09\u3002\u8FFD\u52A0\u8BED\u4E49\uFF1A\u5185\u7F6E\u89C4\u5219\u5168\u90E8\u4FDD\u7559\uFF0C\u8FD9\u4E9B\u89C4\u5219\u6302\u5728\u5176\u540E\u4E00\u8D77\u5224\u5B9A\u3002`
-        );
+    const layerKeys = ["L1_heuristic", "L2_logic_rules", "L3_llm_analysis", "agent_rules_enabled", "scenario_rules_enabled"];
+    console.log("\u5C42\u7EA7\u5F00\u5173: " + layerKeys.map((k) => `${k}=${isLayerEnabled(k) ? "on" : "OFF"}`).join(" "));
+    if (!builtinOnly) {
+      try {
+        const dirs = rulesDirs().filter((d) => existsSync19(d));
+        if (dirs.length > 0) {
+          console.log(`\u89C4\u5219\u76EE\u5F55: ${dirs.join(", ")}\uFF08\u53EA\u8BFB\u5176\u4E2D ${OVERRIDE_FILENAME} / ${EXTRA_FILENAME}\uFF09`);
+        }
+        const loaded = ruleFilesLoaded();
+        if (loaded.length > 0) {
+          const ov = loadOverrideRules();
+          const ex = loadExtraRules();
+          console.error(`\u26A0\uFE0F  \u5DF2\u4ECE\u89C4\u5219\u76EE\u5F55\u52A0\u8F7D ${loaded.length} \u4E2A\u6587\u4EF6\uFF08\u6574\u4EFD\u66FF\u6362 / \u8FFD\u52A0\uFF0C\u5185\u7F6E\u66F4\u65B0\u4E0D\u4F1A\u53CD\u6620\u5230\u5B83\u4EEC\u4E0A\u9762\uFF09:`);
+          for (const f of loaded) console.error(`      ${f}`);
+          const ovs = Object.entries(ov).sort().map(([k, v]) => `${k}\xD7${v.length}`).join(", ");
+          if (ovs) console.error(`      \u8986\u76D6\u7C7B\u522B: ${ovs}\uFF08**\u6574\u4EFD\u66FF\u6362**\uFF1A\u672A\u5217\u51FA\u7684\u5185\u7F6E\u89C4\u5219\u4E0D\u518D\u751F\u6548\uFF09`);
+          const exs = Object.entries(ex).sort().map(([k, v]) => `${k}\xD7${v.length}`).join(", ");
+          if (exs) console.log(`      \u8FFD\u52A0\u7C7B\u522B: ${exs}\uFF08\u5185\u7F6E\u4FDD\u7559\uFF0C\u8FFD\u52A0\u5728\u5176\u540E\u4E00\u8D77\u5224\u5B9A\uFF09`);
+        }
+        const ignored = ignoredRuleFiles();
+        if (ignored.length > 0) {
+          console.error(
+            `\u26A0\uFE0F  \u89C4\u5219\u76EE\u5F55\u91CC\u6709 ${ignored.length} \u4E2A json **\u4E0D\u4F1A\u88AB\u8BFB\u53D6**\uFF08\u53EA\u8BA4 ${OVERRIDE_FILENAME} / ${EXTRA_FILENAME}\uFF09:`
+          );
+          for (const f of ignored) console.error(`      ${f}`);
+        }
+      } catch {
       }
-    } catch {
     }
     const scenarioRaw = (process.env.AGENT_MOSS_SCENARIO || "").trim();
     if (scenarioRaw) {
@@ -10706,18 +12135,26 @@ function createApp() {
   app.get("/api/v1/health", healthRoute);
   app.post("/api/v1/analyze", analyzeRoute);
   app.post("/api/v1/review", reviewRoute);
+  app.get("/api/v1/brain/rules", brainRulesRoute);
+  app.get("/api/v1/brain/rules/drafts", brainDraftsRoute);
+  app.post("/api/v1/brain/rules/:rule_id/approve", brainApproveRoute);
+  app.post("/api/v1/brain/rules/:rule_id/reject", brainRejectRoute);
+  app.get("/api/v1/brain/stats", brainStatsRoute);
+  app.get("/api/v1/brain/skills", brainSkillsRoute);
+  app.get("/api/v1/brain/rules/export", brainExportRoute);
+  app.post("/api/v1/brain/rules/import", brainImportRoute);
   app.route("/console", createConsoleRouter());
   app.get("/console/", (c) => c.redirect("/console"));
   return app;
 }
 async function findFreePort(startPort, host = "127.0.0.1", scan = 100) {
   for (let port = startPort; port < startPort + scan; port++) {
-    const free = await new Promise((resolve10) => {
+    const free = await new Promise((resolve11) => {
       const server = net.createServer();
       server.listen(port, host, () => {
-        server.close(() => resolve10(true));
+        server.close(() => resolve11(true));
       });
-      server.on("error", () => resolve10(false));
+      server.on("error", () => resolve11(false));
     });
     if (free) {
       if (port !== startPort) {
@@ -10773,11 +12210,71 @@ async function startServer(host = "127.0.0.1", port = 9090) {
     }
   };
 }
+async function startUnixSocketServer(socketPath = "/var/run/agent_moss/agent_moss.sock") {
+  const app = createApp();
+  let server = null;
+  return {
+    socketPath,
+    close: async () => {
+      if (!server) return;
+      await new Promise((resolve11) => {
+        server.close(() => resolve11());
+      });
+      server = null;
+    },
+    serve: async () => {
+      const { mkdirSync: mkdirSync8, existsSync: existsSync20, unlinkSync: unlinkSync5 } = await import("fs");
+      const { dirname: dirname13 } = await import("path");
+      const dir = dirname13(socketPath);
+      if (dir) {
+        try {
+          mkdirSync8(dir, { recursive: true });
+        } catch {
+        }
+      }
+      if (existsSync20(socketPath)) {
+        const { connect } = await import("net");
+        const inUse = await new Promise((resolve11) => {
+          const probe = connect(socketPath);
+          const done = (v) => {
+            probe.destroy();
+            resolve11(v);
+          };
+          probe.once("connect", () => done(true));
+          probe.once("error", () => done(false));
+          probe.setTimeout(500, () => done(false));
+        });
+        if (inUse) {
+          console.warn(
+            `[AgentMoss] socket ${socketPath} \u5DF2\u6709\u670D\u52A1\u5728\u76D1\u542C\uFF0C\u4E0D\u6E05\u7406\uFF08bind \u4F1A\u56E0\u5360\u7528\u800C\u5931\u8D25\uFF09`
+          );
+        } else {
+          try {
+            unlinkSync5(socketPath);
+            console.log(`[AgentMoss] \u6E05\u7406\u6B8B\u7559 socket \u6587\u4EF6: ${socketPath}`);
+          } catch {
+          }
+        }
+      }
+      logDeploymentSelfCheck();
+      await warmUpEngine();
+      const { getRequestListener } = await import("@hono/node-server");
+      const { createServer } = await import("http");
+      server = createServer(getRequestListener(app.fetch));
+      await new Promise((resolve11, reject) => {
+        server.once("error", reject);
+        server.listen(socketPath, () => resolve11());
+      });
+      console.log(`AgentMoss HTTP server on unix socket: ${socketPath}`);
+    }
+  };
+}
 export {
   createApp,
   findFreePort,
   logDeploymentSelfCheck,
-  startServer
+  startServer,
+  startUnixSocketServer
 };
 //! 顺序即 fail-closed 短路优先级：verify 逐个执行，首个返回违规的性质成为
 //! first_violation，后续不再评估。调整顺序影响判定归属，须与 Python