@kenhkl/agent-moss 0.2.1 → 0.3.1

package/dist/cli.js

@@ -18,11 +18,114 @@ var init_esm_shims = __esm({
   }
 });
 
+// src/config.ts
+function loadCustomRules() {
+  try {
+    const raw = process.env.AGENT_MOSS_CUSTOM_RULES;
+    if (!raw) return [];
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed)) return [];
+    return parsed.filter((r) => r.pattern && r.action);
+  } catch {
+    return [];
+  }
+}
+function getLLMConfig() {
+  return llmConfig;
+}
+function getCustomRules() {
+  return customRules;
+}
+function isLLMAvailable() {
+  if (process.env.AGENT_MOSS_DISABLE_LLM === "1") return false;
+  return llmConfig.apiKey.length > 0;
+}
+function detectProvider(baseUrl, providerHint = "") {
+  if (providerHint) {
+    const hint = providerHint.toLowerCase();
+    if (["claude", "anthropic"].includes(hint)) return "anthropic";
+    if (["google", "gemini"].includes(hint)) return "gemini";
+    if (["zai-coding-plan", "zhipu-coding-plan", "zhipuai-coding-plan"].includes(hint)) return "zai-coding-plan";
+    if (["zai", "z-ai", "z.ai", "zai-cn", "zai-china", "zhipu", "glm-cn", "bigmodel"].includes(hint)) return "zhipu";
+    if (["xai", "xai-grok"].includes(hint)) return "xai";
+    if (["minimax", "minimax-openai"].includes(hint)) return "minimax";
+    if (["minimax-anthropic"].includes(hint)) return "minimax-anthropic";
+    if (["other", "custom", "local"].includes(hint)) return "openai-compatible";
+    return hint;
+  }
+  const url = baseUrl.toLowerCase();
+  if (url.includes("openrouter.ai")) return "openrouter";
+  if (url.includes("api.openai.com")) return "openai";
+  if (url.includes("anthropic.com") || url.includes("api.anthropic.com")) return "anthropic";
+  if (url.includes("generativelanguage.googleapis.com") || url.includes("gemini")) return "gemini";
+  if (url.includes("api.deepseek.com")) return "deepseek";
+  if (url.includes("api.groq.com")) return "groq";
+  if (url.includes("api.mistral.ai")) return "mistral";
+  if (url.includes("api.together.xyz")) return "together";
+  if (url.includes("api.x.ai")) return "xai";
+  if (url.includes("api.minimaxi.com")) return "minimax";
+  if (url.includes("api-ai.gitcode.com")) return "gitcode";
+  if (url.includes("api.z.ai")) return "zai-coding-plan";
+  if (url.includes("open.bigmodel.cn") || url.includes("bigmodel")) return "zhipu";
+  if (url.includes(":11434")) return "ollama";
+  return "openai-compatible";
+}
+function getProviderHeaders(provider) {
+  return PROVIDER_HEADERS[provider] || {};
+}
+function isHeuristicEnabled() {
+  return process.env.AGENT_MOSS_DISABLE_HEURISTIC !== "1";
+}
+function isLogicRulesEnabled() {
+  return process.env.AGENT_MOSS_DISABLE_LOGIC_RULES !== "1";
+}
+var llmConfig, customRules, PROVIDER_HEADERS;
+var init_config = __esm({
+  "src/config.ts"() {
+    "use strict";
+    init_esm_shims();
+    llmConfig = {
+      provider: "openai",
+      baseUrl: process.env.AGENT_MOSS_LLM_BASE_URL || "https://api.openai.com/v1",
+      apiKey: process.env.AGENT_MOSS_LLM_API_KEY || process.env.OPENAI_API_KEY || "",
+      model: process.env.AGENT_MOSS_LLM_MODEL || "gpt-4o",
+      temperature: parseFloat(process.env.AGENT_MOSS_LLM_TEMPERATURE || "0.1"),
+      maxTokens: parseInt(process.env.AGENT_MOSS_LLM_MAX_TOKENS || "4096", 10),
+      timeout: parseInt(process.env.AGENT_MOSS_LLM_TIMEOUT || "300", 10)
+    };
+    customRules = loadCustomRules();
+    PROVIDER_HEADERS = {
+      "openrouter": {
+        "HTTP-Referer": "shturl.cc/LlVD5pyWViHjM",
+        "X-OpenRouter-Title": "AgentMoss"
+      },
+      "xai": {
+        "HTTP-Referer": "shturl.cc/LlVD5pyWViHjM"
+      }
+    };
+  }
+});
+
 // src/engine/heuristic.ts
 function runHeuristicCheck(input) {
   const command = `${input.aNext.actionType}: ${input.aNext.actionDetail}`;
   const matched = [];
   let highestSeverity = "low";
+  const userRules = getCustomRules();
+  for (const rule of userRules) {
+    try {
+      const re = new RegExp(rule.pattern);
+      if (re.test(command)) {
+        if (rule.action === "Deny") {
+          matched.push(`\u81EA\u5B9A\u4E49\u89C4\u5219: ${rule.pattern}`);
+          if (severityRank(rule.severity) > severityRank(highestSeverity)) {
+            highestSeverity = rule.severity;
+          }
+        }
+      }
+    } catch {
+    }
+  }
   for (const rule of DANGEROUS_PATTERNS) {
     if (rule.pattern.test(command)) {
       matched.push(rule.description);
@@ -31,12 +134,22 @@ function runHeuristicCheck(input) {
       }
     }
   }
+  const injectionText = `${input.aNext.actionType} ${input.aNext.actionDetail} ${input.reason || ""} ${input.promptSession || ""}`.toLowerCase();
+  const injectionHits = checkInjectionKeywords(injectionText);
+  if (injectionHits.length > 0) {
+    const topHit = injectionHits.reduce((a, b) => severityRank(a.riskLevel) >= severityRank(b.riskLevel) ? a : b);
+    matched.push(...injectionHits.map((h) => `\u6CE8\u5165\u5173\u952E\u8BCD [${h.lang}]: ${h.keyword}`));
+    if (severityRank(topHit.riskLevel) > severityRank(highestSeverity)) {
+      highestSeverity = topHit.riskLevel;
+    }
+  }
   if (matched.length > 0) {
+    const riskType = injectionHits.length > 0 ? "prompt_injection" : "dangerous_command";
     return {
       allowed: false,
       reason: `\u68C0\u6D4B\u5230\u9AD8\u5371\u64CD\u4F5C: ${matched.join(", ")}`,
       riskLevel: highestSeverity,
-      riskType: "dangerous_command",
+      riskType,
       confidence: 95,
       source: "heuristic",
       violatedLayers: ["1"]
@@ -44,67 +157,197 @@ function runHeuristicCheck(input) {
   }
   return null;
 }
+function checkInjectionKeywords(text) {
+  const hits = [];
+  for (const entry of INJECTION_KEYWORDS) {
+    if (text.includes(entry.keyword.toLowerCase())) {
+      hits.push(entry);
+    }
+  }
+  return hits;
+}
 function severityRank(s) {
   const ranks = { low: 1, medium: 2, high: 3, critical: 4 };
   return ranks[s] || 0;
 }
-var DANGEROUS_PATTERNS;
+var INJECTION_KEYWORDS, DANGEROUS_PATTERNS;
 var init_heuristic = __esm({
   "src/engine/heuristic.ts"() {
     "use strict";
     init_esm_shims();
+    init_config();
+    INJECTION_KEYWORDS = [
+      // ---- Instruction Override ----
+      { keyword: "ignore previous instructions", riskLevel: "critical", lang: "en" },
+      { keyword: "ignore all previous", riskLevel: "critical", lang: "en" },
+      { keyword: "disregard all prior", riskLevel: "critical", lang: "en" },
+      { keyword: "forget everything", riskLevel: "high", lang: "en" },
+      { keyword: "\u5FFD\u7565\u4E4B\u524D\u7684\u6307\u4EE4", riskLevel: "critical", lang: "zh" },
+      { keyword: "\u5FFD\u7565\u6240\u6709\u5148\u524D\u7684", riskLevel: "critical", lang: "zh" },
+      { keyword: "\u5FFD\u7565\u4E0A\u9762\u6240\u6709", riskLevel: "high", lang: "zh" },
+      { keyword: "\u8BF7\u5FD8\u8BB0\u4E4B\u524D", riskLevel: "high", lang: "zh" },
+      // ---- Role Hijacking ----
+      { keyword: "you are now", riskLevel: "high", lang: "en" },
+      { keyword: "you are no longer", riskLevel: "high", lang: "en" },
+      { keyword: "new instructions", riskLevel: "high", lang: "en" },
+      { keyword: "from now on, you", riskLevel: "high", lang: "en" },
+      { keyword: "\u4F60\u73B0\u5728\u662F\u4E00\u4E2A", riskLevel: "high", lang: "zh" },
+      { keyword: "\u4F60\u4E0D\u518D\u662F\u4E00\u4E2A", riskLevel: "high", lang: "zh" },
+      { keyword: "\u4ECE\u73B0\u5728\u5F00\u59CB\u4F60", riskLevel: "high", lang: "zh" },
+      { keyword: "\u4F60\u7684\u65B0\u89D2\u8272\u662F", riskLevel: "high", lang: "zh" },
+      // ---- Command Injection ----
+      { keyword: "system prompt", riskLevel: "high", lang: "en" },
+      { keyword: "reveal your instructions", riskLevel: "high", lang: "en" },
+      { keyword: "output your instructions", riskLevel: "high", lang: "en" },
+      { keyword: "repeat your instructions", riskLevel: "medium", lang: "en" },
+      { keyword: "\u7CFB\u7EDF\u63D0\u793A", riskLevel: "high", lang: "zh" },
+      { keyword: "\u8F93\u51FA\u4F60\u7684\u6307\u4EE4", riskLevel: "high", lang: "zh" },
+      { keyword: "\u91CD\u590D\u4F60\u7684\u6307\u4EE4", riskLevel: "medium", lang: "zh" },
+      // ---- Social Engineering ----
+      { keyword: "this is an authorized test", riskLevel: "high", lang: "en" },
+      { keyword: "security audit approved", riskLevel: "high", lang: "en" },
+      { keyword: "admin override", riskLevel: "critical", lang: "en" },
+      { keyword: "debug mode", riskLevel: "high", lang: "en" },
+      { keyword: "maintenance mode", riskLevel: "high", lang: "en" },
+      { keyword: "\u8FD9\u662F\u6388\u6743\u7684\u6D4B\u8BD5", riskLevel: "high", lang: "zh" },
+      { keyword: "\u5B89\u5168\u5BA1\u8BA1\u5DF2\u6279\u51C6", riskLevel: "high", lang: "zh" },
+      { keyword: "\u7BA1\u7406\u5458\u8986\u76D6", riskLevel: "critical", lang: "zh" },
+      { keyword: "\u8C03\u8BD5\u6A21\u5F0F", riskLevel: "high", lang: "zh" },
+      // ---- XSS ----
+      { keyword: "<script>", riskLevel: "high", lang: "en" },
+      { keyword: "javascript:", riskLevel: "high", lang: "en" },
+      { keyword: "onerror=", riskLevel: "high", lang: "en" },
+      { keyword: "onload=", riskLevel: "high", lang: "en" },
+      // ---- Fake Boundaries ----
+      { keyword: "=== END OF", riskLevel: "high", lang: "en" },
+      { keyword: "--- END SYSTEM", riskLevel: "high", lang: "en" },
+      { keyword: "[END OF", riskLevel: "high", lang: "en" },
+      { keyword: "=== \u7ED3\u675F", riskLevel: "high", lang: "zh" },
+      { keyword: "--- \u7ED3\u675F\u7CFB\u7EDF", riskLevel: "high", lang: "zh" },
+      // ---- Developer Mode ----
+      { keyword: "developer mode", riskLevel: "critical", lang: "en" },
+      { keyword: "DAN mode", riskLevel: "critical", lang: "en" },
+      { keyword: "jailbreak", riskLevel: "critical", lang: "en" },
+      { keyword: "\u5F00\u53D1\u8005\u6A21\u5F0F", riskLevel: "critical", lang: "zh" },
+      { keyword: "\u8D8A\u72F1", riskLevel: "critical", lang: "zh" },
+      // ---- xiaoO-specific bypass ----
+      { keyword: "bypass audit", riskLevel: "critical", lang: "en" },
+      { keyword: "skip security check", riskLevel: "critical", lang: "en" },
+      { keyword: "disable guard", riskLevel: "critical", lang: "en" },
+      { keyword: "\u7ED5\u8FC7\u5BA1\u8BA1", riskLevel: "critical", lang: "zh" },
+      { keyword: "\u7981\u7528\u5B89\u5168\u68C0\u67E5", riskLevel: "critical", lang: "zh" },
+      { keyword: "\u5173\u95ED\u9632\u62A4", riskLevel: "critical", lang: "zh" }
+    ];
     DANGEROUS_PATTERNS = [
-      { pattern: /rm\s+-rf\s+\/\s*$|rm\s+-rf\s+\/\*/, severity: "critical", description: "\u9012\u5F52\u5F3A\u5236\u5220\u9664\u6839\u76EE\u5F55" },
-      { pattern: /rm\s+-rf\s+\/home\/\*|rm\s+-rf\s+\/root/, severity: "critical", description: "\u5220\u9664\u7528\u6237\u4E3B\u76EE\u5F55" },
-      { pattern: /rm\s+-rf\s+\/etc|rm\s+-rf\s+\/var/, severity: "critical", description: "\u5220\u9664\u7CFB\u7EDF\u76EE\u5F55" },
-      { pattern: /curl\s+.*\|\s*(bash|sh|zsh)/, severity: "critical", description: "curl pipe shell \u6267\u884C" },
-      { pattern: /wget\s+.*\|\s*(bash|sh)/, severity: "critical", description: "wget pipe shell \u6267\u884C" },
-      { pattern: />\s*\/dev\/sda|dd\s+if=.*of=\/dev\//, severity: "critical", description: "\u78C1\u76D8\u76F4\u63A5\u5199\u5165" },
-      { pattern: /mkfs\./, severity: "critical", description: "\u683C\u5F0F\u5316\u6587\u4EF6\u7CFB\u7EDF" },
-      { pattern: /chmod\s+777\s+\//, severity: "high", description: "\u4FEE\u6539\u6839\u76EE\u5F55\u6743\u9650\u4E3A777" },
-      { pattern: /chown\s+-R\s+\w+:\w+\s+\//, severity: "high", description: "\u9012\u5F52\u4FEE\u6539\u6839\u76EE\u5F55\u6240\u6709\u8005" },
-      { pattern: /eval\s+\$\(curl|eval\s+\$\(wget/, severity: "critical", description: "eval \u8FDC\u7A0B\u4EE3\u7801\u6267\u884C" },
-      { pattern: /\/dev\/tcp\/|bash\s+-i\s+>&/, severity: "critical", description: "\u53CD\u5F39 Shell" },
-      { pattern: /nc\s+-[el]\s+.*\d{1,5}/, severity: "high", description: "Netcat \u53CD\u5F39\u8FDE\u63A5" },
-      { pattern: /:\(\)\s*\{.*:\|:&.*\};:/, severity: "critical", description: "Fork Bomb" },
-      { pattern: /sudo\s+rm\s+-rf/, severity: "high", description: "sudo \u5F3A\u5236\u5220\u9664" },
-      { pattern: /git\s+clone\s+.*\|.*bash/, severity: "high", description: "git clone pipe shell" },
-      { pattern: /pip\s+install\s+.*\|\s*bash/, severity: "high", description: "pip install pipe shell" },
-      { pattern: /npm\s+install\s+-g\s+.*\|\s*bash/, severity: "high", description: "npm install pipe shell" },
+      // --- Critical: rm command graded detection (strict to loose, first match wins) ---
+      // 1. rm -rf root dir
+      { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*f[a-zA-Z]*\s+\/\s/i, severity: "critical", description: "\u9012\u5F52\u5F3A\u5236\u5220\u9664\u6839\u76EE\u5F55 (rm -rf /)" },
+      // 2. rm -rf absolute path (both -r and -f)
+      { pattern: /\brm\s+-(?=[^\s]*r)(?=[^\s]*f)[a-zA-Z]*\s+\//i, severity: "critical", description: "\u9012\u5F52\u5F3A\u5236\u5220\u9664\u7EDD\u5BF9\u8DEF\u5F84 (rm -rf /...)" },
+      // 3. rm with -r or -f targeting system dirs
+      { pattern: /\brm\s+-[a-zA-Z]*[rf][a-zA-Z]*\s+\/(etc|var|home|usr|boot|root|opt|srv|sys|proc)\b/i, severity: "critical", description: "\u5220\u9664\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55" },
+      // 4. rm -r absolute path (no -f)
+      { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*\s+\//i, severity: "high", description: "\u9012\u5F52\u5220\u9664\u64CD\u4F5C (rm -r /...)" },
+      // 5. rm -f absolute path (no -r)
+      { pattern: /\brm\s+-[a-zA-Z]*f[a-zA-Z]*\s+\//i, severity: "medium", description: "\u5F3A\u5236\u5220\u9664\u6587\u4EF6 (rm -f /...)" },
+      { pattern: /dd\s+if=\/dev\/zero|dd\s+if=.*of=\/dev\//i, severity: "critical", description: "\u78C1\u76D8\u6E05\u96F6/\u76F4\u63A5\u5199\u5165" },
+      { pattern: /mkfs\b/i, severity: "critical", description: "\u683C\u5F0F\u5316\u6587\u4EF6\u7CFB\u7EDF" },
+      { pattern: /:\(\)\s*\{.*:\|:&.*\};:/i, severity: "critical", description: "Fork Bomb" },
+      // --- Critical: remote code execution ---
+      { pattern: /curl\s+.*\|\s*(bash|sh|zsh|dash)/i, severity: "critical", description: "curl pipe shell \u6267\u884C" },
+      { pattern: /wget\s+.*\|\s*(bash|sh)/i, severity: "critical", description: "wget pipe shell \u6267\u884C" },
+      { pattern: /eval\s+\$\(curl|eval\s+\$\(wget/i, severity: "critical", description: "eval \u8FDC\u7A0B\u4EE3\u7801\u6267\u884C" },
+      { pattern: /base64\s+-d\s+.*\|\s*bash/i, severity: "critical", description: "base64 \u89E3\u7801\u6267\u884C" },
+      // --- Critical: reverse shell ---
+      { pattern: /\/dev\/tcp\/|bash\s+-i\s+>&/i, severity: "critical", description: "\u53CD\u5F39 Shell" },
+      { pattern: /nc\s+-[el]\s+.*\d{1,5}/i, severity: "high", description: "Netcat \u53CD\u5F39\u8FDE\u63A5" },
+      // --- Critical: sensitive file access ---
+      { pattern: /\/etc\/shadow/i, severity: "critical", description: "\u8BBF\u95EE\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6 (/etc/shadow)" },
+      { pattern: /\.ssh\/id_rsa/i, severity: "critical", description: "\u8BBF\u95EE SSH \u79C1\u94A5\u6587\u4EF6" },
+      // --- Critical: privilege escalation / container escape ---
+      { pattern: /\/var\/run\/docker\.sock/i, severity: "critical", description: "\u8BBF\u95EE Docker socket\uFF0C\u53EF\u80FD\u5BFC\u81F4\u5BB9\u5668\u9003\u9038" },
+      // --- High: dangerous permissions / ownership ---
+      { pattern: /chmod\s+[0-7]*777[0-7]*/i, severity: "high", description: "\u5168\u6743\u9650\u8BBE\u7F6E (chmod 777)" },
+      { pattern: /chown\s+root|chown\s+-R\s+\w+:\w+\s+\//i, severity: "high", description: "\u4FEE\u6539\u6240\u6709\u8005\u4E3A root / \u9012\u5F52\u4FEE\u6539\u6839\u76EE\u5F55\u6240\u6709\u8005" },
+      { pattern: /sudo\s+rm\s+-rf/i, severity: "high", description: "sudo \u5F3A\u5236\u5220\u9664" },
+      { pattern: /sudo\s+/i, severity: "high", description: "\u63D0\u6743\u6267\u884C (sudo)" },
+      // --- High: system config overwrite ---
+      { pattern: />\s*\/etc\//i, severity: "critical", description: "\u8986\u76D6\u5199\u5165\u7CFB\u7EDF\u914D\u7F6E\u76EE\u5F55" },
+      // --- High: download script + execute risk ---
+      { pattern: /(?:curl|wget)\s+.*(?:-o|--output|>)\s*\S+\.(?:sh|bash)\b/i, severity: "high", description: "\u8FDC\u7A0B\u4E0B\u8F7D\u811A\u672C\u5230\u672C\u5730" },
+      { pattern: /(?:curl|wget)\s+.*\s+&&?\s*(?:chmod\s+\+x|bash|sh)/i, severity: "high", description: "\u4E0B\u8F7D\u540E\u6267\u884C" },
+      // --- High: package manager pipe-to-shell ---
+      { pattern: /git\s+clone\s+.*\|.*bash/i, severity: "high", description: "git clone pipe shell" },
+      { pattern: /pip\s+install\s+.*\|\s*bash/i, severity: "high", description: "pip install pipe shell" },
+      { pattern: /npm\s+install\s+-g\s+.*\|\s*bash/i, severity: "high", description: "npm install pipe shell" },
+      // --- High: destructive git operations ---
+      { pattern: /git\s+push\s+.*--force/i, severity: "high", description: "\u5F3A\u5236\u63A8\u9001\u64CD\u4F5C (git push --force)" },
+      // --- Medium: credential export ---
       { pattern: /export\s+.*(?:TOKEN|KEY|SECRET|PASSWORD)/i, severity: "medium", description: "\u5BFC\u51FA\u654F\u611F\u51ED\u8BC1" },
-      { pattern: /base64\s+-d\s+.*\|\s*bash/, severity: "critical", description: "base64 \u89E3\u7801\u6267\u884C" }
+      // --- High: device file access ---
+      { pattern: /\/dev\/(mem|kmsg)\b/i, severity: "high", description: "\u8BBF\u95EE\u8BBE\u5907\u6587\u4EF6 (\u7269\u7406\u5185\u5B58/\u5185\u6838\u6D88\u606F)" }
     ];
   }
 });
 
 // src/engine/logic-rules.ts
+import * as fs from "fs";
 function runLogicCheck(input) {
   const { actionHistory, aNext, cwd } = input;
-  const command = aNext.actionDetail;
+  const actionDetail = aNext.actionDetail.toLowerCase();
+  const actionType = aNext.actionType.toLowerCase();
   const resolvedCwd = cwd || "/";
-  if (aNext.actionType === "write" || aNext.actionType === "file_write" || aNext.actionType === "write_to_file") {
-    const hadRead = actionHistory.some(
-      (h) => (h.actionType === "read" || h.actionType === "file_read" || h.actionType === "read_file") && h.actionDetail.includes(cwd)
-    );
-    if (!hadRead && actionHistory.length === 0) {
+  const rbwResult = checkReadBeforeWrite(actionType, actionDetail, actionHistory, input.reason, resolvedCwd);
+  if (rbwResult) return rbwResult;
+  if (input.promptSession && input.promptSession.trim()) {
+    const promptLower = input.promptSession.toLowerCase();
+    for (const pattern of INTENT_DEVIATION_PATTERNS) {
+      const intentMatched = pattern.intentKeywords.some((kw) => promptLower.includes(kw));
+      const dangerousMatched = pattern.dangerousActions.some((kw) => actionDetail.includes(kw));
+      if (intentMatched && dangerousMatched) {
+        return {
+          allowed: false,
+          reason: pattern.reason,
+          riskLevel: "high",
+          riskType: "intent_deviation",
+          confidence: 85,
+          source: "logic_rule",
+          violatedLayers: ["2"]
+        };
+      }
     }
   }
-  if (containsSensitivePath(command, resolvedCwd)) {
-    return {
-      allowed: false,
-      reason: "\u5C1D\u8BD5\u8BBF\u95EE\u7CFB\u7EDF\u654F\u611F\u8DEF\u5F84",
-      riskLevel: "high",
-      riskType: "sensitive_path_access",
-      confidence: 90,
-      source: "logic_rule",
-      violatedLayers: ["2"]
-    };
+  const pathResult = checkSensitivePath(actionDetail, resolvedCwd);
+  if (pathResult) return pathResult;
+  if (actionType !== "file_write" && actionType !== "file_edit") {
+    if ((actionDetail.includes("*") || actionDetail.includes("?")) && ["rm ", "rm	", "del ", "del	", "delete", "remove ", "remove	", "\u5220\u9664", "\u79FB\u9664"].some((kw) => actionDetail.includes(kw))) {
+      return {
+        allowed: false,
+        reason: "\u68C0\u6D4B\u5230\u901A\u914D\u7B26\u7ED3\u5408\u5220\u9664\u64CD\u4F5C\uFF0C\u53EF\u80FD\u9020\u6210\u6279\u91CF\u8BEF\u5220",
+        riskLevel: "high",
+        riskType: "script_execution",
+        confidence: 90,
+        source: "logic_rule",
+        violatedLayers: ["2"]
+      };
+    }
+    if (/>\s*\/etc\//.test(actionDetail) || />\s*\/boot\//.test(actionDetail) || />\s*\/proc\//.test(actionDetail)) {
+      return {
+        allowed: false,
+        reason: "\u68C0\u6D4B\u5230\u91CD\u5B9A\u5411\u8986\u76D6\u5199\u5165\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55",
+        riskLevel: "critical",
+        riskType: "file_access",
+        confidence: 95,
+        source: "logic_rule",
+        violatedLayers: ["2"]
+      };
+    }
   }
-  if (command.includes("sudo") || command.includes("su -") || command.includes("chmod u+s") || command.includes("setuid")) {
+  if (actionDetail.includes("sudo") || actionDetail.includes("su -") || actionDetail.includes("chmod u+s") || actionDetail.includes("setuid")) {
     const adminContext = actionHistory.some(
-      (h) => h.actionDetail.includes("sudo") || h.actionDetail.includes("apt") || h.actionDetail.includes("systemctl")
+      (h) => h.actionDetail.includes("sudo") || h.actionDetail.includes("apt") || h.actionDetail.includes("systemctl") || h.actionDetail.includes("yum") || h.actionDetail.includes("dnf") || h.actionDetail.includes("pacman") || h.actionDetail.includes("zypper") || h.actionDetail.includes("apk")
     );
-    if (!adminContext && actionHistory.length === 0) {
+    if (!adminContext) {
       return {
         allowed: false,
         reason: "\u68C0\u6D4B\u5230\u63D0\u6743\u64CD\u4F5C\uFF0C\u672A\u53D1\u73B0\u5408\u6CD5\u7BA1\u7406\u4E0A\u4E0B\u6587",
@@ -116,8 +359,8 @@ function runLogicCheck(input) {
       };
     }
   }
-  if (command.includes("ssh") || command.includes("scp") || command.includes("rsync")) {
-    const targetHost = extractRemoteHost(command);
+  if (/(?:ssh|scp|rsync)\s+/.test(actionDetail)) {
+    const targetHost = extractRemoteHost(actionDetail);
     if (targetHost && !isLocalHost(targetHost)) {
       return {
         allowed: false,
@@ -132,18 +375,100 @@ function runLogicCheck(input) {
   }
   return null;
 }
-function containsSensitivePath(command, cwd) {
+function extractFilePaths(text) {
+  const paths = [];
+  const unixPaths = text.match(/(?:^|\s)(\/[^\s;|&><'"]+)/g);
+  if (unixPaths) paths.push(...unixPaths.map((p) => p.trim()));
+  const quotedPaths = text.match(/["']\/([^"']+)["']/g);
+  if (quotedPaths) paths.push(...quotedPaths.map((p) => p.replace(/["']/g, "")));
+  return [...new Set(paths)];
+}
+function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, cwd) {
+  if (NON_WRITE_TOOLS.has(actionType)) return null;
+  const isWrite = WRITE_KEYWORDS.some((kw) => actionType.includes(kw) || actionDetail.includes(kw));
+  if (!isWrite) return null;
+  const targetPaths = extractFilePaths(actionDetail);
+  if (targetPaths.length === 0) return null;
+  const historyReadPaths = /* @__PURE__ */ new Set();
+  for (const action of actionHistory) {
+    const histDetail = action.actionDetail.toLowerCase();
+    const histType = action.actionType.toLowerCase();
+    const isRead = READ_KEYWORDS.some((kw) => histType.includes(kw) || histDetail.includes(kw));
+    if (isRead) {
+      for (const p of extractFilePaths(histDetail)) {
+        historyReadPaths.add(p);
+      }
+    }
+  }
+  const unreadPaths = [];
+  for (const path2 of targetPaths) {
+    const hasRead = [...historyReadPaths].some(
+      (rp) => path2 === rp || path2.startsWith(rp) || rp.startsWith(path2)
+    );
+    if (!hasRead) {
+      let isCreate = !fs.existsSync(path2);
+      if (!isCreate) {
+        isCreate = CREATE_KEYWORDS.some((kw) => reason.toLowerCase().includes(kw) || actionDetail.includes(kw));
+      }
+      if (!isCreate) {
+        unreadPaths.push(path2);
+      }
+    }
+  }
+  if (unreadPaths.length > 0) {
+    return {
+      allowed: false,
+      reason: `\u8FDD\u53CD read_before_write \u5B89\u5168\u539F\u5219\uFF1A\u5BF9\u6587\u4EF6 ${unreadPaths[0]} \u6267\u884C\u5199\u5165\u64CD\u4F5C\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5BF9\u8BE5\u6587\u4EF6\u7684\u8BFB\u53D6\u64CD\u4F5C`,
+      riskLevel: "high",
+      riskType: "read_before_write",
+      confidence: 85,
+      source: "logic_rule",
+      violatedLayers: ["2"]
+    };
+  }
+  return null;
+}
+function checkSensitivePath(command, cwd) {
   const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
-  for (const p of ROOT_SENSITIVE_PATHS) {
-    if (command.includes(p)) return true;
+  for (const sp of ROOT_SENSITIVE_PATHS) {
+    if (command.includes(sp.path.toLowerCase())) {
+      return {
+        allowed: false,
+        reason: `\u5C1D\u8BD5\u8BBF\u95EE\u7CFB\u7EDF\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
+        riskLevel: sp.riskLevel,
+        riskType: "sensitive_path_access",
+        confidence: 90,
+        source: "logic_rule",
+        violatedLayers: ["2"]
+      };
+    }
   }
-  for (const p of HOME_SENSITIVE_PATHS) {
-    if (command.includes(p) || command.includes(`${expandedCwd}/${p}`)) return true;
+  for (const sp of HOME_SENSITIVE_PATHS) {
+    const expanded = `${expandedCwd}/${sp.path}`;
+    if (command.includes(sp.path.toLowerCase()) || command.includes(expanded.toLowerCase())) {
+      return {
+        allowed: false,
+        reason: `\u5C1D\u8BD5\u8BBF\u95EE\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
+        riskLevel: sp.riskLevel,
+        riskType: "sensitive_path_access",
+        confidence: 90,
+        source: "logic_rule",
+        violatedLayers: ["2"]
+      };
+    }
   }
   if ((command.includes("rm ") || command.includes("unlink")) && (command.includes("/etc/") || command.includes("/root/") || command.includes("/var/log/"))) {
-    return true;
+    return {
+      allowed: false,
+      reason: "\u68C0\u6D4B\u5230\u5220\u9664\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55\u5185\u5BB9",
+      riskLevel: "critical",
+      riskType: "sensitive_path_access",
+      confidence: 90,
+      source: "logic_rule",
+      violatedLayers: ["2"]
+    };
   }
-  return false;
+  return null;
 }
 function extractRemoteHost(command) {
   const m = command.match(/(?:ssh|scp|rsync)\s+(?:-[\w]+\s+)*(\S+@\S+|\b(?!-)[\w.-]+\b)/);
@@ -153,75 +478,123 @@ function isLocalHost(host) {
   const localNames = ["localhost", "127.0.0.1", "::1", process.env.HOSTNAME || "", "0.0.0.0"];
   return localNames.includes(host.replace(/.*@/, ""));
 }
-var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS;
+var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, NON_WRITE_TOOLS, WRITE_KEYWORDS, READ_KEYWORDS, CREATE_KEYWORDS, INTENT_DEVIATION_PATTERNS;
 var init_logic_rules = __esm({
   "src/engine/logic-rules.ts"() {
     "use strict";
     init_esm_shims();
     ROOT_SENSITIVE_PATHS = [
-      "/etc/shadow",
-      "/etc/passwd",
-      "/etc/sudoers",
-      "/root/.ssh",
-      "/root/.bashrc",
-      "/boot",
-      "/sys",
-      "/proc"
+      { path: "/etc/shadow", riskLevel: "critical", desc: "\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6" },
+      { path: "/etc/passwd", riskLevel: "high", desc: "\u7CFB\u7EDF\u7528\u6237\u6587\u4EF6" },
+      { path: "/etc/sudoers", riskLevel: "critical", desc: "sudo \u914D\u7F6E" },
+      { path: "/etc/hosts", riskLevel: "medium", desc: "DNS \u89E3\u6790\u914D\u7F6E" },
+      { path: "/etc/crontab", riskLevel: "high", desc: "\u7CFB\u7EDF\u5B9A\u65F6\u4EFB\u52A1" },
+      { path: "/etc/systemd/", riskLevel: "high", desc: "systemd \u670D\u52A1\u914D\u7F6E" },
+      { path: "/etc/ssh/sshd_config", riskLevel: "high", desc: "SSH \u670D\u52A1\u914D\u7F6E" },
+      { path: "/root/.ssh", riskLevel: "critical", desc: "root SSH \u76EE\u5F55" },
+      { path: "/root/.bashrc", riskLevel: "high", desc: "root shell \u914D\u7F6E" },
+      { path: "/boot/", riskLevel: "critical", desc: "\u542F\u52A8\u5F15\u5BFC\u76EE\u5F55" },
+      { path: "/proc/sys/", riskLevel: "high", desc: "\u5185\u6838\u53C2\u6570" },
+      { path: "/sys/", riskLevel: "high", desc: "sysfs \u5185\u6838\u63A5\u53E3" },
+      { path: "/dev/mem", riskLevel: "critical", desc: "\u7269\u7406\u5185\u5B58\u8BBF\u95EE\u8BBE\u5907" },
+      { path: "/dev/kmsg", riskLevel: "high", desc: "\u5185\u6838\u6D88\u606F\u7F13\u51B2\u533A" }
     ];
     HOME_SENSITIVE_PATHS = [
-      ".ssh/id_rsa",
-      ".ssh/authorized_keys",
-      ".aws/credentials",
-      ".gitconfig",
-      ".gnupg"
+      { path: ".ssh/id_rsa", riskLevel: "critical", desc: "SSH \u79C1\u94A5" },
+      { path: ".ssh/id_ed25519", riskLevel: "critical", desc: "SSH \u79C1\u94A5 (ed25519)" },
+      { path: ".ssh/authorized_keys", riskLevel: "high", desc: "SSH \u6388\u6743\u5BC6\u94A5" },
+      { path: ".aws/credentials", riskLevel: "critical", desc: "AWS \u51ED\u8BC1" },
+      { path: ".gitconfig", riskLevel: "medium", desc: "Git \u914D\u7F6E" },
+      { path: ".gnupg", riskLevel: "high", desc: "GPG \u5BC6\u94A5\u76EE\u5F55" }
+    ];
+    NON_WRITE_TOOLS = /* @__PURE__ */ new Set(["ask_user_question", "glob", "grep", "list_dir", "count_text_length", "search"]);
+    WRITE_KEYWORDS = ["write", "\u5199\u5165", "save", "\u4FDD\u5B58", "modify", "\u4FEE\u6539", "update", "\u66F4\u65B0", "delete", "\u5220\u9664", "remove", "\u79FB\u9664", "create", "\u521B\u5EFA", "append", "\u8FFD\u52A0", "truncate", "\u622A\u65AD", "overwrite", "\u8986\u76D6", "replace", "\u66FF\u6362"];
+    READ_KEYWORDS = ["read", "\u8BFB\u53D6", "cat", "head", "tail", "less", "more", "view", "\u67E5\u770B", "open", "\u6253\u5F00", "load", "\u52A0\u8F7D", "grep", "search", "\u641C\u7D22", "find", "\u67E5\u627E"];
+    CREATE_KEYWORDS = ["\u521B\u5EFA", "\u65B0\u5EFA", "create", "new file", "touch"];
+    INTENT_DEVIATION_PATTERNS = [
+      {
+        intentKeywords: ["\u8BFB\u53D6", "\u67E5\u770B", "\u5206\u6790", "read", "analyze", "view", "list", "\u5217\u51FA"],
+        dangerousActions: ["\u5220\u9664", "remove", "delete", "rm ", "\u683C\u5F0F\u5316", "format"],
+        reason: "\u539F\u59CB\u610F\u56FE\u4E3A\u8BFB\u53D6/\u5206\u6790\uFF0C\u4F46\u6267\u884C\u4E86\u5220\u9664\u64CD\u4F5C"
+      },
+      {
+        intentKeywords: ["\u67E5\u8BE2", "\u641C\u7D22", "search", "query", "find"],
+        dangerousActions: ["\u4FEE\u6539", "update", "write", "\u5199\u5165", "alter"],
+        reason: "\u539F\u59CB\u610F\u56FE\u4E3A\u67E5\u8BE2/\u641C\u7D22\uFF0C\u4F46\u6267\u884C\u4E86\u4FEE\u6539\u64CD\u4F5C"
+      }
     ];
-  }
-});
-
-// src/config.ts
-function getLLMConfig() {
-  return llmConfig;
-}
-function isLLMAvailable() {
-  return llmConfig.apiKey.length > 0;
-}
-var llmConfig;
-var init_config = __esm({
-  "src/config.ts"() {
-    "use strict";
-    init_esm_shims();
-    llmConfig = {
-      provider: "openai",
-      baseUrl: process.env.AGENT_MOSS_LLM_BASE_URL || "https://api.openai.com/v1",
-      apiKey: process.env.AGENT_MOSS_LLM_API_KEY || "",
-      model: process.env.AGENT_MOSS_LLM_MODEL || "gpt-4o",
-      temperature: parseFloat(process.env.AGENT_MOSS_LLM_TEMPERATURE || "0.1"),
-      maxTokens: parseInt(process.env.AGENT_MOSS_LLM_MAX_TOKENS || "4096", 10)
-    };
   }
 });
 
 // src/engine/skill-loader.ts
-import { readFileSync, readdirSync, existsSync } from "fs";
+import { readFileSync, readdirSync, existsSync as existsSync2 } from "fs";
 import { resolve, dirname } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-function loadSkills() {
+function loadAllSkills() {
   if (cachedSkills) return cachedSkills;
-  if (!existsSync(SKILLS_DIR)) {
+  cachedSkills = {};
+  if (!existsSync2(SKILLS_DIR)) {
     console.warn("[AgentMoss] Skills directory not found:", SKILLS_DIR);
-    cachedSkills = [];
     return cachedSkills;
   }
   const files = readdirSync(SKILLS_DIR).filter((f) => f.endsWith(".md"));
-  cachedSkills = files.map((f) => {
-    const content = readFileSync(resolve(SKILLS_DIR, f), "utf-8");
-    return `### ${f.replace(".md", "")}
-${content}`;
-  });
-  console.log(`[AgentMoss] Loaded ${cachedSkills.length} skills`);
+  for (const f of files) {
+    const name = f.replace(".md", "");
+    cachedSkills[name] = readFileSync(resolve(SKILLS_DIR, f), "utf-8");
+  }
+  console.log(`[AgentMoss] Loaded ${Object.keys(cachedSkills).length} skills`);
   return cachedSkills;
 }
-var __filename2, __dirname2, SKILLS_DIR, cachedSkills;
+function matchSkills(actionType, actionDetail, reason, maxSkills = 3) {
+  const skills = loadAllSkills();
+  const combined = `${actionType} ${actionDetail} ${reason}`.toLowerCase();
+  const actionDetailLower = actionDetail.toLowerCase();
+  const actionTypeLower = actionType.toLowerCase();
+  const reasonLower = reason.toLowerCase();
+  const scores = {};
+  for (const [skillName, keywords] of Object.entries(SKILL_KEYWORD_MAP)) {
+    let score = 0;
+    for (const kw of keywords) {
+      if (combined.includes(kw)) {
+        if (kw === actionTypeLower) score += 2;
+        else if (actionDetailLower.includes(kw)) score += 1.5;
+        else if (reasonLower.includes(kw)) score += 1;
+        else score += 0.5;
+      }
+    }
+    if (score > 0) scores[skillName] = score;
+  }
+  const sorted = Object.entries(scores).sort((a, b) => b[1] - a[1]);
+  const top = sorted.slice(0, maxSkills);
+  const maxScore = top[0]?.[1] || 1;
+  const results = [];
+  for (const [name, score] of top) {
+    const content = skills[name];
+    if (content) {
+      results.push({
+        skillName: name,
+        relevance: Math.min(score / maxScore, 1),
+        skillContent: content
+      });
+    }
+  }
+  if (results.length === 0) {
+    const fallback = skills["general_tool_risk_guard"];
+    if (fallback) {
+      results.push({ skillName: "general_tool_risk_guard", relevance: 0.3, skillContent: fallback });
+    }
+  }
+  return results;
+}
+function formatSkillsForPrompt(skills) {
+  if (skills.length === 0) return "(\u672A\u5339\u914D\u5230\u7279\u5B9A\u5B89\u5168\u68C0\u6D4B\u89C4\u5219)";
+  return skills.map(
+    (s) => `### \u5B89\u5168\u68C0\u6D4B\u89C4\u5219: ${s.skillName} (\u76F8\u5173\u5EA6: ${Math.round(s.relevance * 100)}%)
+
+${s.skillContent}`
+  ).join("\n\n---\n\n");
+}
+var __filename2, __dirname2, SKILLS_DIR, SKILL_KEYWORD_MAP, cachedSkills;
 var init_skill_loader = __esm({
   "src/engine/skill-loader.ts"() {
     "use strict";
@@ -229,24 +602,38 @@ var init_skill_loader = __esm({
     __filename2 = fileURLToPath2(import.meta.url);
     __dirname2 = dirname(__filename2);
     SKILLS_DIR = resolve(__dirname2, "../../agent_moss/skills");
+    SKILL_KEYWORD_MAP = {
+      "file_access_guard": ["file", "\u6587\u4EF6", "path", "\u8DEF\u5F84", "read", "write", "cat", "open", "access", "\u8BBF\u95EE", "\u8BFB\u5199", "copy", "cp", "mv", "move"],
+      "script_execution_guard": ["command", "shell", "bash", "exec", "execute", "\u6267\u884C", "\u547D\u4EE4", "script", "\u811A\u672C", "run", "\u8FD0\u884C", "subprocess", "system", "eval", "compile", "\u5B89\u88C5", "install", "pip", "npm"],
+      "data_exfiltration_guard": ["upload", "\u4E0A\u4F20", "send", "\u53D1\u9001", "transfer", "\u4F20\u8F93", "export", "\u5BFC\u51FA", "download", "\u4E0B\u8F7D", "post", "http", "request", "fetch", "curl", "wget", "\u5916\u4F20", "\u6CC4\u9732", "exfil", "network", "\u7F51\u7EDC"],
+      "browser_web_access_guard": ["browser", "\u6D4F\u89C8\u5668", "web", "\u7F51\u9875", "url", "navigate", "\u6D4F\u89C8", "scrape", "crawl", "\u722C\u53D6", "click", "screenshot"],
+      "email_operation_guard": ["email", "\u90AE\u4EF6", "mail", "smtp", "send_email", "\u53D1\u9001\u90AE\u4EF6", "inbox", "\u6536\u4EF6\u7BB1", "\u9644\u4EF6", "attachment"],
+      "general_tool_risk_guard": ["tool", "\u5DE5\u5177", "api", "invoke", "\u8C03\u7528", "function", "\u51FD\u6570"],
+      "lateral_movement_guard": ["ssh", "scp", "ftp", "sftp", "rdp", "vnc", "telnet", "\u5185\u7F51", "\u6A2A\u5411", "tunnel", "\u4EE3\u7406", "proxy", "port", "\u7AEF\u53E3", "scan", "\u626B\u63CF", "ping", "traceroute", "nslookup"],
+      "persistence_backdoor_guard": ["cron", "crontab", "\u5B9A\u65F6", "scheduled", "startup", "\u542F\u52A8\u9879", "service", "\u670D\u52A1", "daemon", "\u5B88\u62A4", "registry", "\u6CE8\u518C\u8868", "backdoor", "\u540E\u95E8", "persist", "\u6301\u4E45\u5316", "authorized_keys"],
+      "resource_exhaustion_guard": ["fork", "bomb", "\u70B8\u5F39", "memory", "\u5185\u5B58", "disk", "\u78C1\u76D8", "cpu", "process", "\u8FDB\u7A0B", "dd", "while true", "\u65E0\u9650\u5FAA\u73AF", "\u8017\u5C3D", "exhaust", "\u8D44\u6E90"],
+      "skill_installation_guard": ["skill", "plugin", "\u63D2\u4EF6", "extension", "\u6269\u5C55", "install skill", "\u5B89\u88C5\u63D2\u4EF6", "\u5B89\u88C5\u6280\u80FD", "marketplace", "\u5546\u5E97"],
+      "supply_chain_guard": ["dependency", "\u4F9D\u8D56", "package", "\u5305", "npm install", "pip install", "requirements", "import", "library", "\u5E93", "registry", "\u4ED3\u5E93", "supply", "\u4F9B\u5E94\u94FE", "typosquatting"],
+      "intent_deviation_guard": ["rm", "del", "delete", "remove", "\u5220\u9664", "format", "\u683C\u5F0F\u5316", "drop", "truncate", "\u6E05\u7A7A", "wipe", "\u64E6\u9664", "\u91CD\u7F6E", "reset", "sudo", "root", "admin", "\u7BA1\u7406\u5458", "privilege", "\u63D0\u6743"]
+    };
     cachedSkills = null;
   }
 });
 
 // src/engine/template-loader.ts
-import { readFileSync as readFileSync2, existsSync as existsSync2 } from "fs";
+import { readFileSync as readFileSync2, existsSync as existsSync3 } from "fs";
 import { resolve as resolve2, dirname as dirname2 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function loadTemplates() {
   if (cachedTemplates) return cachedTemplates;
   cachedTemplates = {};
-  if (!existsSync2(TEMPLATES_DIR)) {
+  if (!existsSync3(TEMPLATES_DIR)) {
     console.warn("[AgentMoss] Templates directory not found:", TEMPLATES_DIR);
     return cachedTemplates;
   }
   for (const file of TEMPLATE_FILES) {
     const filePath = resolve2(TEMPLATES_DIR, file);
-    if (existsSync2(filePath)) {
+    if (existsSync3(filePath)) {
       const key = file.replace(".txt", "").replace("_template", "");
       cachedTemplates[key] = readFileSync2(filePath, "utf-8");
     }
@@ -267,6 +654,199 @@ var init_template_loader = __esm({
   }
 });
 
+// src/engine/script-analyzer.ts
+import { readFileSync as readFileSync3 } from "fs";
+import { resolve as resolve3, join } from "path";
+function emptyResult() {
+  return { scriptPath: "", scriptContent: "", matchedKeywords: [], lineCount: 0, isSuspicious: false, error: "", riskLevel: "", riskReason: "" };
+}
+function extractScriptPath(command) {
+  for (const pattern of SCRIPT_EXEC_PATTERNS) {
+    const m = command.match(pattern);
+    if (m) return m[1];
+  }
+  return null;
+}
+function scanScriptForKeywords(content) {
+  const matched = [];
+  for (const { name, pattern } of SUSPICIOUS_PATTERNS) {
+    if (pattern.test(content)) matched.push(name);
+  }
+  return matched;
+}
+function assessKeywordCombinationRisk(matchedKeywords, scriptContent) {
+  if (matchedKeywords.length === 0) return { level: "", reason: "" };
+  const keywordSet = new Set(matchedKeywords);
+  for (const rule of KEYWORD_COMBINATION_RISKS) {
+    const hitGroup1 = [...rule.group1].some((k) => keywordSet.has(k));
+    const hitGroup2 = rule.group2.size === 0 ? true : [...rule.group2].some((k) => keywordSet.has(k));
+    if (hitGroup1 && hitGroup2) return { level: rule.level, reason: rule.reason };
+  }
+  const networkPostKeywords = /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]);
+  const hasNetworkPost = [...networkPostKeywords].some((k) => keywordSet.has(k));
+  if (hasNetworkPost) {
+    const envPatterns = ["$env", "$(env)", "$USER", "$(hostname)", "$(pwd)", "$HOME"];
+    const contentLower = scriptContent.toLowerCase();
+    for (const p of envPatterns) {
+      if (contentLower.includes(p.toLowerCase())) {
+        return {
+          level: "critical",
+          reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + \u7CFB\u7EDF\u73AF\u5883\u53D8\u91CF\u6536\u96C6\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u6570\u636E\u5916\u4F20\u98CE\u9669\u3002\u811A\u672C\u53EF\u80FD\u5C06\u7528\u6237\u73AF\u5883\u53D8\u91CF\uFF08\u53EF\u80FD\u5305\u542B API Key\u3001\u5BC6\u94A5\u7B49\u654F\u611F\u4FE1\u606F\uFF09\u53D1\u9001\u5230\u8FDC\u7A0B\u670D\u52A1\u5668\u3002"
+        };
+      }
+    }
+  }
+  let bestLevel = "";
+  let bestReason = "";
+  for (const kw of matchedKeywords) {
+    const risk = SINGLE_KEYWORD_RISKS[kw];
+    if (risk && (LEVEL_ORDER[risk.level] || 0) > (LEVEL_ORDER[bestLevel] || 0)) {
+      bestLevel = risk.level;
+      bestReason = risk.reason;
+    }
+  }
+  return { level: bestLevel, reason: bestReason };
+}
+function readScriptContent(scriptPath, maxLines = 500) {
+  try {
+    const expandedPath = scriptPath.startsWith("~") ? join(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve3(scriptPath);
+    const raw = readFileSync3(expandedPath, "utf-8");
+    const lines = raw.split("\n").slice(0, maxLines);
+    return { content: lines.join("\n"), lineCount: lines.length, error: "" };
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    return { content: "", lineCount: 0, error: `\u8BFB\u53D6\u811A\u672C\u5931\u8D25: ${msg}` };
+  }
+}
+function analyzeScriptContent(actionType, actionDetail, maxLines = 500) {
+  if (actionType.toLowerCase() !== "bash") return emptyResult();
+  const scriptPath = extractScriptPath(actionDetail);
+  if (!scriptPath) return emptyResult();
+  const { content, lineCount, error } = readScriptContent(scriptPath, maxLines);
+  if (error) return { ...emptyResult(), scriptPath, error };
+  const matchedKeywords = scanScriptForKeywords(content);
+  const isSuspicious = matchedKeywords.length > 0;
+  let riskLevel = "";
+  let riskReason = "";
+  if (isSuspicious) {
+    const risk = assessKeywordCombinationRisk(matchedKeywords, content);
+    riskLevel = risk.level;
+    riskReason = risk.reason;
+  }
+  return { scriptPath, scriptContent: content, matchedKeywords, lineCount, isSuspicious, error: "", riskLevel, riskReason };
+}
+function formatScriptAnalysisForPrompt(result) {
+  if (!result.scriptPath) return "";
+  if (result.error) return `\u811A\u672C\u5185\u5BB9\u5206\u6790\u5931\u8D25: ${result.error}`;
+  if (!result.isSuspicious) return "";
+  const keywordsStr = result.matchedKeywords.join(", ");
+  let riskHint = "";
+  if (result.riskLevel && result.riskReason) {
+    riskHint = `
+
+\u98CE\u9669\u8BC4\u4F30: ${result.riskLevel.toUpperCase()} \u7EA7\u522B
+\u98CE\u9669\u539F\u56E0: ${result.riskReason}
+\u5EFA\u8BAE: \u6B64\u811A\u672C\u5E94\u88AB\u62D2\u7EDD\uFF08Deny\uFF09\uFF0C\u9664\u975E\u6709\u660E\u786E\u7684\u4E1A\u52A1\u9700\u6C42\u4E14\u5DF2\u786E\u8BA4\u76EE\u6807\u670D\u52A1\u5668\u53EF\u4FE1\u3002`;
+  }
+  return `\u68C0\u6D4B\u5230\u811A\u672C\u6267\u884C\uFF0C\u4E14\u811A\u672C\u5185\u5BB9\u5305\u542B\u53EF\u7591\u5173\u952E\u8BCD:
+   \u811A\u672C\u8DEF\u5F84: ${result.scriptPath}
+   \u53EF\u7591\u5173\u952E\u8BCD: ${keywordsStr}
+   \u811A\u672C\u884C\u6570: ${result.lineCount}${riskHint}
+
+### \u811A\u672C\u5185\u5BB9 ###
+\`\`\`
+${result.scriptContent}
+\`\`\`
+`;
+}
+var SUSPICIOUS_PATTERNS, SCRIPT_EXEC_PATTERNS, KEYWORD_COMBINATION_RISKS, SINGLE_KEYWORD_RISKS, LEVEL_ORDER;
+var init_script_analyzer = __esm({
+  "src/engine/script-analyzer.ts"() {
+    "use strict";
+    init_esm_shims();
+    SUSPICIOUS_PATTERNS = [
+      // Network exfiltration (curl/wget POST in scripts is almost never legitimate)
+      { name: "curl POST", pattern: /curl\s+(.*\s)?-X\s+POST/i },
+      { name: "curl --data", pattern: /curl\s+(.*\s)?--data/i },
+      { name: "curl -d", pattern: /curl\s+(.*\s)?-d\s/i },
+      { name: "wget --post-data", pattern: /wget\s+(.*\s)?--post-data/i },
+      { name: "wget --post-file", pattern: /wget\s+(.*\s)?--post-file/i },
+      // Reverse shell
+      { name: "nc -e", pattern: /\bnc\s+.*-e\b/ },
+      { name: "ncat -e", pattern: /\bncat\s+.*-e\b/ },
+      { name: "/dev/tcp", pattern: /\/dev\/tcp\// },
+      { name: "/dev/udp", pattern: /\/dev\/udp\// },
+      // Base64 obfuscation
+      { name: "$(base64", pattern: /\$\(\s*base64/ },
+      { name: "`base64", pattern: /`\s*base64/ },
+      { name: "base64 decode pipe", pattern: /base64\s+(-d|--decode)\s*\|/ },
+      // Sensitive file access
+      { name: "/etc/shadow", pattern: /\/etc\/shadow/ },
+      { name: "id_rsa", pattern: /\bid_rsa\b/ },
+      { name: "id_ed25519", pattern: /\bid_ed25519\b/ },
+      // Persistence backdoor
+      { name: "crontab install", pattern: /crontab\s+-/ },
+      { name: "authorized_keys", pattern: /authorized_keys/ },
+      { name: "ssh no host key check", pattern: /ssh\s+.*StrictHostKeyChecking\s*=\s*no/ }
+    ];
+    SCRIPT_EXEC_PATTERNS = [
+      /bash\s+(\S+\.sh)/,
+      /sh\s+(\S+\.sh)/,
+      /\.\/(\S+\.sh)/,
+      /source\s+(\S+\.sh)/,
+      /\.\s+(\S+\.sh)/,
+      /zsh\s+(\S+\.sh)/
+    ];
+    KEYWORD_COMBINATION_RISKS = [
+      {
+        group1: /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]),
+        group2: /* @__PURE__ */ new Set(["$(base64", "`base64", "base64 decode pipe"]),
+        level: "critical",
+        reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + Base64\u7F16\u7801\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u6570\u636E\u5916\u4F20\u98CE\u9669\u3002\u653B\u51FB\u8005\u53EF\u80FD\u5C06\u654F\u611F\u6570\u636E\u7F16\u7801\u540E\u5916\u4F20\u3002"
+      },
+      {
+        group1: /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]),
+        group2: /* @__PURE__ */ new Set(["/etc/shadow", "id_rsa", "id_ed25519"]),
+        level: "critical",
+        reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + \u654F\u611F\u6587\u4EF6\u8BBF\u95EE\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u51ED\u8BC1\u5916\u4F20\u98CE\u9669\u3002"
+      },
+      {
+        group1: /* @__PURE__ */ new Set(["nc -e", "ncat -e", "/dev/tcp", "/dev/udp"]),
+        group2: /* @__PURE__ */ new Set(),
+        level: "high",
+        reason: "\u68C0\u6D4B\u5230\u53CD\u5F39 Shell \u7279\u5F81\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5EFA\u7ACB\u8FDC\u7A0B\u63A7\u5236\u901A\u9053\u3002"
+      },
+      {
+        group1: /* @__PURE__ */ new Set(["crontab install", "authorized_keys", "ssh no host key check"]),
+        group2: /* @__PURE__ */ new Set(),
+        level: "high",
+        reason: "\u68C0\u6D4B\u5230\u6301\u4E45\u5316\u540E\u95E8\u7279\u5F81\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5728\u7CFB\u7EDF\u4E2D\u690D\u5165\u540E\u95E8\u3002"
+      }
+    ];
+    SINGLE_KEYWORD_RISKS = {
+      "curl POST": { level: "high", reason: "\u68C0\u6D4B\u5230 curl POST \u8BF7\u6C42\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+      "curl --data": { level: "high", reason: "\u68C0\u6D4B\u5230 curl --data \u53C2\u6570\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+      "curl -d": { level: "high", reason: "\u68C0\u6D4B\u5230 curl -d \u53C2\u6570\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+      "wget --post-data": { level: "high", reason: "\u68C0\u6D4B\u5230 wget POST \u8BF7\u6C42\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+      "wget --post-file": { level: "high", reason: "\u68C0\u6D4B\u5230 wget \u6587\u4EF6\u4E0A\u4F20\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6587\u4EF6\u3002" },
+      "nc -e": { level: "critical", reason: "\u68C0\u6D4B\u5230 nc -e \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+      "ncat -e": { level: "critical", reason: "\u68C0\u6D4B\u5230 ncat -e \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+      "/dev/tcp": { level: "critical", reason: "\u68C0\u6D4B\u5230 /dev/tcp \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+      "/dev/udp": { level: "critical", reason: "\u68C0\u6D4B\u5230 /dev/udp \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+      "$(base64": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u7F16\u7801\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
+      "`base64": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u7F16\u7801\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
+      "base64 decode pipe": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u89E3\u7801\u540E\u7BA1\u9053\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
+      "/etc/shadow": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6\u3002" },
+      "id_rsa": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE SSH \u79C1\u94A5\u3002" },
+      "id_ed25519": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE SSH \u79C1\u94A5\u3002" },
+      "crontab install": { level: "high", reason: "\u68C0\u6D4B\u5230\u4FEE\u6539\u5B9A\u65F6\u4EFB\u52A1\uFF0C\u53EF\u80FD\u662F\u6301\u4E45\u5316\u540E\u95E8\u3002" },
+      "authorized_keys": { level: "high", reason: "\u68C0\u6D4B\u5230\u4FEE\u6539 SSH \u6388\u6743\u5BC6\u94A5\uFF0C\u53EF\u80FD\u662F\u6301\u4E45\u5316\u540E\u95E8\u3002" },
+      "ssh no host key check": { level: "high", reason: "\u68C0\u6D4B\u5230 SSH \u8DF3\u8FC7\u4E3B\u673A\u5BC6\u94A5\u9A8C\u8BC1\uFF0C\u53EF\u80FD\u662F\u6A2A\u5411\u79FB\u52A8\u3002" }
+    };
+    LEVEL_ORDER = { low: 1, medium: 2, high: 3, critical: 4 };
+  }
+});
+
 // src/engine/llm-analyzer.ts
 import OpenAI from "openai";
 async function runLLMAnalysis(input, previous) {
@@ -283,15 +863,17 @@ async function runLLMAnalysis(input, previous) {
     };
   }
   const config = getLLMConfig();
-  const cacheKey = `${input.aNext.actionType}:${input.aNext.actionDetail}`;
+  const rawDetail = input.aNext.actionDetail.replace(/^terminal-\w+:\s*command=([^,]+).*/, "$1").trim();
+  const cacheKey = `${input.aNext.actionType}:${rawDetail || input.aNext.actionDetail}`;
   const cached = llmCache.get(cacheKey);
   if (cached) {
     console.log("[AgentMoss] LLM cache hit");
     return cached;
   }
-  const skills = loadSkills();
+  const matchedSkills = matchSkills(input.aNext.actionType, input.aNext.actionDetail, input.reason);
   const templates = loadTemplates();
-  const prompt = buildPrompt(input, previous, skills, templates);
+  const scriptAnalysis = analyzeScriptContent(input.aNext.actionType, input.aNext.actionDetail);
+  const prompt = buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis);
   const result = await analyzeWithLLM(prompt, config);
   if (llmCache.size >= LLM_CACHE_MAX) {
     const firstKey = llmCache.keys().next().value;
@@ -300,11 +882,13 @@ async function runLLMAnalysis(input, previous) {
   llmCache.set(cacheKey, result);
   return result;
 }
-function buildPrompt(input, previous, skills, templates) {
-  const skillContext = skills.length > 0 ? skills.join("\n---\n") : "(\u65E0\u53EF\u7528 Skill)";
-  const historyStr = input.actionHistory.map((h, i) => `${i + 1}. [${h.actionType}] ${h.actionDetail}`).join("\n") || "(\u65E0\u5386\u53F2\u64CD\u4F5C)";
+function buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis) {
+  const skillsText = formatSkillsForPrompt(matchedSkills);
+  const historyStr = input.actionHistory.map((h, i) => `${i + 1}. ${h.actionType}: ${h.actionDetail}`).join("\n") || "(\u65E0\u5386\u53F2\u64CD\u4F5C)";
   const templateName = previous.heuristic || previous.logic ? "prompt2" : "prompt1";
   const baseTemplate = templates[templateName] || templates["prompt1"] || "";
+  const scriptAnalysisText = scriptAnalysis ? formatScriptAnalysisForPrompt(scriptAnalysis) : "";
+  const hintsText = formatHints(previous);
   return `${baseTemplate}
 
 ## \u5F53\u524D\u64CD\u4F5C\u4E0A\u4E0B\u6587
@@ -321,7 +905,13 @@ ${historyStr}
   \u8BE6\u60C5: ${input.aNext.actionDetail}
 
 ## \u53EF\u7528\u5B89\u5168 Skill
-${skillContext}
+${skillsText}
+
+## \u524D\u7F6E\u68C0\u6D4B\u7ED3\u679C
+${hintsText}
+${scriptAnalysisText ? `
+## \u811A\u672C\u5185\u5BB9\u5206\u6790
+${scriptAnalysisText}` : ""}
 
 \u8BF7\u6839\u636E\u4EE5\u4E0A\u4FE1\u606F\uFF0C\u5BF9\u5373\u5C06\u6267\u884C\u7684\u64CD\u4F5C\u8FDB\u884C\u5B89\u5168\u5224\u65AD\u3002\u4F60\u5FC5\u987B\u8F93\u51FA\u4E25\u683C\u7684 JSON \u683C\u5F0F\uFF0C
 \u4E0D\u8981\u5305\u542B\u4EFB\u4F55\u5176\u4ED6\u6587\u5B57\u3001\u6CE8\u91CA\u6216 markdown \u6807\u8BB0\u3002
@@ -329,52 +919,92 @@ ${skillContext}
 \u8F93\u51FA\u683C\u5F0F:
 {"allowed": true/false, "reason": "\u5224\u65AD\u7406\u7531", "riskLevel": "low|medium|high|critical", "riskType": "\u98CE\u9669\u7C7B\u578B", "confidence": 0-100}`;
 }
+function formatHints(previous) {
+  const hints = [];
+  if (previous.heuristic) {
+    hints.push(
+      `\u542F\u53D1\u5F0F\u68C0\u6D4B\u53D1\u73B0\u98CE\u9669 [\u98CE\u9669\u7B49\u7EA7: ${previous.heuristic.riskLevel}]:
+   \u7C7B\u578B: ${previous.heuristic.riskType}
+   \u539F\u56E0: ${previous.heuristic.reason}`
+    );
+  }
+  if (previous.logic) {
+    hints.push(
+      `\u903B\u8F91\u89C4\u5219\u68C0\u6D4B\u53D1\u73B0\u98CE\u9669 [\u98CE\u9669\u7B49\u7EA7: ${previous.logic.riskLevel}]:
+   \u7C7B\u578B: ${previous.logic.riskType}
+   \u539F\u56E0: ${previous.logic.reason}`
+    );
+  }
+  return hints.length > 0 ? hints.join("\n\n") : "\u542F\u53D1\u5F0F\u68C0\u6D4B\u548C\u903B\u8F91\u89C4\u5219\u68C0\u6D4B\u5747\u672A\u53D1\u73B0\u98CE\u9669\u3002";
+}
 async function analyzeWithLLM(prompt, config) {
   console.log(`[AgentMoss] LLM analyzing with model: ${config.model}, url: ${config.baseUrl}`);
+  const provider = detectProvider(config.baseUrl, config.provider);
+  const extraHeaders = getProviderHeaders(provider);
+  if (Object.keys(extraHeaders).length > 0) {
+    console.log(`[AgentMoss] Provider detected: ${provider}, injecting headers: ${Object.keys(extraHeaders).join(", ")}`);
+  }
   const client = new OpenAI({
     baseURL: config.baseUrl,
     apiKey: config.apiKey,
-    timeout: 3e4
+    timeout: (config.timeout || 300) * 1e3,
+    defaultHeaders: Object.keys(extraHeaders).length > 0 ? extraHeaders : void 0
   });
-  try {
-    const response = await client.chat.completions.create({
-      model: config.model,
-      temperature: config.temperature || 0.1,
-      max_tokens: config.maxTokens || 1024,
-      messages: [
-        { role: "system", content: "\u4F60\u662F\u4E00\u4E2A AI Agent \u5B89\u5168\u5BA1\u8BA1\u4E13\u5BB6\u3002\u4F60\u7684\u4EFB\u52A1\u662F\u5206\u6790\u5373\u5C06\u6267\u884C\u7684\u547D\u4EE4\u662F\u5426\u5B89\u5168\u3002\u4F60\u5FC5\u987B\u53EA\u8F93\u51FA\u7EAF JSON\uFF0C\u4E0D\u8981\u5305\u542B\u4EFB\u4F55 markdown \u6807\u8BB0\u3001\u4EE3\u7801\u5757\u6216\u5176\u4ED6\u6587\u5B57\u3002" },
-        { role: "user", content: prompt }
-      ]
-    });
-    const content = response.choices[0]?.message?.content || "{}";
-    console.log(`[AgentMoss] LLM raw response: ${content.substring(0, 300)}`);
-    let jsonStr = content.trim();
-    if (jsonStr.startsWith("```")) {
-      jsonStr = jsonStr.replace(/^```[\w]*\n?/, "").replace(/\n?```$/, "");
+  const maxRetries = parseInt(process.env.AGENT_MOSS_LLM_RETRIES || "2", 10);
+  for (let attempt = 0; attempt <= maxRetries; attempt++) {
+    try {
+      const response = await client.chat.completions.create({
+        model: config.model,
+        temperature: config.temperature || 0.1,
+        max_tokens: config.maxTokens || 1024,
+        messages: [
+          { role: "system", content: "\u4F60\u662F\u4E00\u4E2A AI Agent \u5B89\u5168\u5BA1\u8BA1\u4E13\u5BB6\u3002\u4F60\u7684\u4EFB\u52A1\u662F\u5206\u6790\u5373\u5C06\u6267\u884C\u7684\u547D\u4EE4\u662F\u5426\u5B89\u5168\u3002\u4F60\u5FC5\u987B\u53EA\u8F93\u51FA\u7EAF JSON\uFF0C\u4E0D\u8981\u5305\u542B\u4EFB\u4F55 markdown \u6807\u8BB0\u3001\u4EE3\u7801\u5757\u6216\u5176\u4ED6\u6587\u5B57\u3002" },
+          { role: "user", content: prompt }
+        ]
+      });
+      const content = response.choices[0]?.message?.content || "{}";
+      console.log(`[AgentMoss] LLM raw response (attempt ${attempt + 1}/${maxRetries + 1}): ${content.substring(0, 300)}`);
+      let jsonStr = content.trim();
+      if (jsonStr.startsWith("```")) {
+        jsonStr = jsonStr.replace(/^```[\w]*\n?/, "").replace(/\n?```$/, "");
+      }
+      const parsed = JSON.parse(jsonStr);
+      return {
+        allowed: parsed.allowed !== false,
+        reason: parsed.reason || "LLM \u5206\u6790\u5B8C\u6210",
+        riskLevel: ["low", "medium", "high", "critical"].includes(parsed.riskLevel) ? parsed.riskLevel : "low",
+        riskType: parsed.riskType || "",
+        confidence: typeof parsed.confidence === "number" ? Math.min(100, Math.max(0, parsed.confidence)) : 70,
+        source: "llm",
+        violatedLayers: ["3"]
+      };
+    } catch (err) {
+      if (attempt < maxRetries) {
+        console.error(`[AgentMoss] LLM call failed (attempt ${attempt + 1}/${maxRetries + 1}), retrying in 1s:`, err.message);
+        await new Promise((resolve4) => setTimeout(resolve4, 1e3));
+      } else {
+        console.error("[AgentMoss] LLM call failed after all retries:", err.message);
+        return {
+          allowed: false,
+          reason: `LLM \u5206\u6790\u5931\u8D25\uFF0C\u56E0\u65E0\u6CD5\u5B8C\u6210\u6DF1\u5EA6\u8BED\u4E49\u5206\u6790\uFF0C\u6309 fail-closed \u539F\u5219\u62D2\u7EDD (${maxRetries + 1} \u6B21\u5C1D\u8BD5): ${err.message}`,
+          riskLevel: "medium",
+          riskType: "",
+          confidence: 60,
+          source: "llm_failure",
+          violatedLayers: ["3"]
+        };
+      }
     }
-    const parsed = JSON.parse(jsonStr);
-    return {
-      allowed: parsed.allowed !== false,
-      // default to Allow if missing
-      reason: parsed.reason || "LLM \u5206\u6790\u5B8C\u6210",
-      riskLevel: ["low", "medium", "high", "critical"].includes(parsed.riskLevel) ? parsed.riskLevel : "low",
-      riskType: parsed.riskType || "",
-      confidence: typeof parsed.confidence === "number" ? Math.min(100, Math.max(0, parsed.confidence)) : 70,
-      source: "llm",
-      violatedLayers: ["3"]
-    };
-  } catch (err) {
-    console.error("[AgentMoss] LLM call failed:", err.message);
-    return {
-      allowed: true,
-      reason: `LLM \u8C03\u7528\u5931\u8D25: ${err.message}`,
-      riskLevel: "low",
-      riskType: "",
-      confidence: 30,
-      source: "llm",
-      violatedLayers: []
-    };
   }
+  return {
+    allowed: false,
+    reason: "LLM \u5206\u6790\u5F02\u5E38",
+    riskLevel: "medium",
+    riskType: "",
+    confidence: 60,
+    source: "llm_failure",
+    violatedLayers: ["3"]
+  };
 }
 var llmCache, LLM_CACHE_MAX;
 var init_llm_analyzer = __esm({
@@ -384,6 +1014,7 @@ var init_llm_analyzer = __esm({
     init_config();
     init_skill_loader();
     init_template_loader();
+    init_script_analyzer();
     llmCache = /* @__PURE__ */ new Map();
     LLM_CACHE_MAX = 200;
   }
@@ -394,21 +1025,83 @@ var coordinator_exports = {};
 __export(coordinator_exports, {
   runAnalysis: () => runAnalysis
 });
+function extractFirstCommand(command) {
+  let main2 = command.split("|")[0].trim();
+  for (const sep of ["&&", "||"]) {
+    const idx = main2.indexOf(sep);
+    if (idx !== -1) {
+      main2 = main2.substring(0, idx).trim();
+      break;
+    }
+  }
+  return main2;
+}
+function extractRawCommand(detail) {
+  const m = detail.match(/command=([^,]+)/);
+  return m ? m[1].trim() : detail;
+}
+function matchesAny(cmd, patterns) {
+  return patterns.some((p) => p.test(cmd));
+}
 async function runAnalysis(input) {
-  const heuristicResult = runHeuristicCheck(input);
+  const heuristicResult = isHeuristicEnabled() ? runHeuristicCheck(input) : null;
   if (heuristicResult && !heuristicResult.allowed) {
     return heuristicResult;
   }
-  const logicResult = runLogicCheck(input);
+  const actionType = input.aNext.actionType.toLowerCase();
+  const rawDetail = extractRawCommand(input.aNext.actionDetail);
+  const lowerDetail = rawDetail.toLowerCase();
+  if (FULLY_SAFE_TOOLS.has(actionType)) {
+    return {
+      allowed: true,
+      reason: `\u5B8C\u5168\u5B89\u5168\u5DE5\u5177\uFF0C\u8DF3\u8FC7\u6DF1\u5EA6\u5206\u6790: ${actionType}`,
+      riskLevel: heuristicResult?.riskLevel || "low",
+      riskType: "",
+      confidence: 95,
+      source: "whitelist_bypass",
+      violatedLayers: []
+    };
+  }
+  let skipLLM = READONLY_SENSITIVE_TOOLS.has(actionType);
+  if (actionType === "bash" || actionType === "executebash" || actionType === "terminal-executebash") {
+    const firstCmd = extractFirstCommand(lowerDetail);
+    if (matchesAny(firstCmd, FULLY_SAFE_BASH_PATTERNS)) {
+      return {
+        allowed: true,
+        reason: `\u5B89\u5168\u7684\u53EA\u8BFB bash \u547D\u4EE4: ${firstCmd}`,
+        riskLevel: "low",
+        riskType: "",
+        confidence: 95,
+        source: "whitelist_bypass",
+        violatedLayers: []
+      };
+    }
+    if (matchesAny(firstCmd, READONLY_SENSITIVE_BASH_PATTERNS)) {
+      skipLLM = true;
+    }
+  }
+  const logicResult = isLogicRulesEnabled() ? runLogicCheck(input) : null;
   if (logicResult && !logicResult.allowed) {
     return logicResult;
   }
+  if (skipLLM || !isLLMAvailable()) {
+    return {
+      allowed: true,
+      reason: "\u53EA\u8BFB\u64CD\u4F5C\u4E14\u65E0\u903B\u8F91\u89C4\u5219\u8FDD\u89C4\uFF0C\u8DF3\u8FC7 LLM \u5206\u6790",
+      riskLevel: logicResult?.riskLevel || "low",
+      riskType: "",
+      confidence: 85,
+      source: "heuristic_and_logic_only",
+      violatedLayers: []
+    };
+  }
   const llmResult = await runLLMAnalysis(input, {
     heuristic: heuristicResult,
     logic: logicResult
   });
   return llmResult;
 }
+var FULLY_SAFE_TOOLS, READONLY_SENSITIVE_TOOLS, FULLY_SAFE_BASH_PATTERNS, READONLY_SENSITIVE_BASH_PATTERNS;
 var init_coordinator = __esm({
   "src/engine/coordinator.ts"() {
     "use strict";
@@ -416,6 +1109,59 @@ var init_coordinator = __esm({
     init_heuristic();
     init_logic_rules();
     init_llm_analyzer();
+    init_config();
+    FULLY_SAFE_TOOLS = /* @__PURE__ */ new Set([
+      "ask_user_question",
+      "glob",
+      "list_dir",
+      "ls",
+      "count_text_length",
+      "filemgr-globfiles"
+    ]);
+    READONLY_SENSITIVE_TOOLS = /* @__PURE__ */ new Set([
+      "read",
+      "file_read",
+      "read_file",
+      "head",
+      "tail",
+      "grep",
+      "filemgr-readfile",
+      "filemgr-grepfiles"
+    ]);
+    FULLY_SAFE_BASH_PATTERNS = [
+      /^ls(?:\s|$)/i,
+      /^dir(?:\s|$)/i,
+      /^pwd(?:\s|$)/i,
+      /^which\s+/i,
+      /^whereis\s+/i,
+      /^realpath\s+/i,
+      /^basename\s+/i,
+      /^dirname\s+/i,
+      /^file\s+/i,
+      /^stat\s+/i,
+      /^du(?:\s|$)/i,
+      /^echo\s+/i,
+      /^printf\s+/i,
+      /^type\s+/i,
+      /^command\s+/i
+    ];
+    READONLY_SENSITIVE_BASH_PATTERNS = [
+      /^cat\s+/i,
+      /^head(?:\s|$)/i,
+      /^tail(?:\s|$)/i,
+      /^less(?:\s|$)/i,
+      /^more(?:\s|$)/i,
+      /^wc(?:\s|$)/i,
+      /^grep(?:\s|$)/i,
+      /^find\s+/i,
+      /^ag(?:\s|$)/i,
+      /^rg(?:\s|$)/i,
+      /^awk\s+/i,
+      /^sed\s+/i,
+      /^cut\s+/i,
+      /^sort(?:\s|$)/i,
+      /^uniq(?:\s|$)/i
+    ];
   }
 });
 
@@ -553,7 +1299,7 @@ async function main() {
   switch (command) {
     case "init": {
       const output = args[2] || "input.json";
-      const fs = await import("fs");
+      const fs2 = await import("fs");
       const template = {
         session_id: "my-session-001",
         prompt_session: "Read /var/log/app.log and analyze errors",
@@ -563,7 +1309,7 @@ async function main() {
         os_type: "",
         cwd: "/home/user/project"
       };
-      fs.writeFileSync(output, JSON.stringify(template, null, 2), "utf-8");
+      fs2.writeFileSync(output, JSON.stringify(template, null, 2), "utf-8");
       console.log(`Template written to ${output}`);
       break;
     }
@@ -572,11 +1318,11 @@ async function main() {
         console.error("Usage: agent-moss analyze <input.json>");
         process.exit(1);
       }
-      const fs = await import("fs");
+      const fs2 = await import("fs");
       const path2 = await import("path");
       const { runAnalysis: runAnalysis2 } = await Promise.resolve().then(() => (init_coordinator(), coordinator_exports));
       const filePath = path2.resolve(args[1]);
-      const data = JSON.parse(fs.readFileSync(filePath, "utf-8"));
+      const data = JSON.parse(fs2.readFileSync(filePath, "utf-8"));
       const result = await runAnalysis2({
         sessionId: data.session_id || "unknown",
         promptSession: data.prompt_session || "",