@kenhkl/agent-moss 0.3.2 → 0.5.0

package/dist/cli.js

@@ -1,6 +1,12 @@
 #!/usr/bin/env node
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
@@ -12,13 +18,59 @@ var __export = (target, all) => {
 // node_modules/tsup/assets/esm_shims.js
 import path from "path";
 import { fileURLToPath } from "url";
+var getFilename, getDirname, __dirname;
 var init_esm_shims = __esm({
   "node_modules/tsup/assets/esm_shims.js"() {
     "use strict";
+    getFilename = () => fileURLToPath(import.meta.url);
+    getDirname = () => path.dirname(getFilename());
+    __dirname = /* @__PURE__ */ getDirname();
   }
 });
 
 // src/config.ts
+import fs from "fs";
+import path2 from "path";
+import os from "os";
+function loadConfigFile(filePath) {
+  try {
+    const raw = fs.readFileSync(filePath, "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function resolveConfigPath() {
+  const envPath = process.env.AGENT_MOSS_CONFIG_PATH;
+  if (envPath) return envPath;
+  const userConfig = path2.join(os.homedir(), ".config", "agentmoss", "config.json");
+  if (fs.existsSync(userConfig)) return userConfig;
+  const defaultConfig = path2.join(__dirname, "..", "..", "agent_moss", "infra", "config.json.example");
+  if (fs.existsSync(defaultConfig)) {
+    const configDir = path2.dirname(userConfig);
+    fs.mkdirSync(configDir, { recursive: true });
+    const pkgConfig = loadConfigFile(defaultConfig);
+    const safeConfig = pkgConfig ? { ...pkgConfig, llm: { ...pkgConfig.llm, api_key: "" } } : {};
+    fs.writeFileSync(userConfig, JSON.stringify(safeConfig, null, 4), "utf-8");
+    console.log(`[AgentMoss] \u5DF2\u521B\u5EFA\u7528\u6237\u914D\u7F6E\u6587\u4EF6: ${userConfig}`);
+    console.log(`[AgentMoss] \u8BF7\u7F16\u8F91\u8BE5\u6587\u4EF6\u914D\u7F6E\u4F60\u7684 LLM API Key`);
+  }
+  return userConfig;
+}
+function loadLLMConfigFromFile(configPath) {
+  const data = loadConfigFile(configPath);
+  if (!data?.llm) return {};
+  const llm = data.llm;
+  return {
+    provider: llm.provider || "",
+    baseUrl: llm.base_url || "",
+    apiKey: llm.api_key || "",
+    model: llm.model || "",
+    temperature: llm.temperature ?? 0.1,
+    maxTokens: llm.max_tokens ?? 4096,
+    timeout: llm.timeout ?? 300
+  };
+}
 function loadCustomRules() {
   try {
     const raw = process.env.AGENT_MOSS_CUSTOM_RULES;
@@ -84,15 +136,19 @@ var init_config = __esm({
   "src/config.ts"() {
     "use strict";
     init_esm_shims();
-    llmConfig = {
-      provider: "openai",
-      baseUrl: process.env.AGENT_MOSS_LLM_BASE_URL || "https://api.openai.com/v1",
-      apiKey: process.env.AGENT_MOSS_LLM_API_KEY || process.env.OPENAI_API_KEY || "",
-      model: process.env.AGENT_MOSS_LLM_MODEL || "gpt-4o",
-      temperature: parseFloat(process.env.AGENT_MOSS_LLM_TEMPERATURE || "0.1"),
-      maxTokens: parseInt(process.env.AGENT_MOSS_LLM_MAX_TOKENS || "4096", 10),
-      timeout: parseInt(process.env.AGENT_MOSS_LLM_TIMEOUT || "300", 10)
-    };
+    llmConfig = (() => {
+      const configPath = resolveConfigPath();
+      const fileConfig = fs.existsSync(configPath) ? loadLLMConfigFromFile(configPath) : {};
+      return {
+        provider: process.env.AGENT_MOSS_LLM_PROVIDER || fileConfig.provider || "openai",
+        baseUrl: process.env.AGENT_MOSS_LLM_BASE_URL || fileConfig.baseUrl || "https://api.openai.com/v1",
+        apiKey: process.env.AGENT_MOSS_LLM_API_KEY || process.env.OPENAI_API_KEY || fileConfig.apiKey || "",
+        model: process.env.AGENT_MOSS_LLM_MODEL || fileConfig.model || "gpt-4o",
+        temperature: parseFloat(process.env.AGENT_MOSS_LLM_TEMPERATURE || String(fileConfig.temperature ?? "0.1")),
+        maxTokens: parseInt(process.env.AGENT_MOSS_LLM_MAX_TOKENS || String(fileConfig.maxTokens ?? "4096"), 10),
+        timeout: parseInt(process.env.AGENT_MOSS_LLM_TIMEOUT || String(fileConfig.timeout ?? "300"), 10)
+      };
+    })();
     customRules = loadCustomRules();
     PROVIDER_HEADERS = {
       "openrouter": {
@@ -111,6 +167,7 @@ function runHeuristicCheck(input) {
   const command = `${input.aNext.actionType}: ${input.aNext.actionDetail}`;
   const matched = [];
   let highestSeverity = "low";
+  let highestRiskType = "";
   const userRules = getCustomRules();
   for (const rule of userRules) {
     try {
@@ -120,20 +177,24 @@ function runHeuristicCheck(input) {
           matched.push(`\u81EA\u5B9A\u4E49\u89C4\u5219: ${rule.pattern}`);
           if (severityRank(rule.severity) > severityRank(highestSeverity)) {
             highestSeverity = rule.severity;
+            highestRiskType = "custom_rule";
           }
         }
       }
     } catch {
     }
   }
+  let topRiskType = "";
   for (const rule of DANGEROUS_PATTERNS) {
     if (rule.pattern.test(command)) {
       matched.push(rule.description);
       if (severityRank(rule.severity) > severityRank(highestSeverity)) {
         highestSeverity = rule.severity;
+        topRiskType = rule.riskType;
       }
     }
   }
+  highestRiskType = topRiskType || highestRiskType;
   const injectionText = `${input.aNext.actionType} ${input.aNext.actionDetail} ${input.reason || ""} ${input.promptSession || ""}`.toLowerCase();
   const injectionHits = checkInjectionKeywords(injectionText);
   if (injectionHits.length > 0) {
@@ -141,15 +202,15 @@ function runHeuristicCheck(input) {
     matched.push(...injectionHits.map((h) => `\u6CE8\u5165\u5173\u952E\u8BCD [${h.lang}]: ${h.keyword}`));
     if (severityRank(topHit.riskLevel) > severityRank(highestSeverity)) {
       highestSeverity = topHit.riskLevel;
+      highestRiskType = "prompt_injection";
     }
   }
   if (matched.length > 0) {
-    const riskType = injectionHits.length > 0 ? "prompt_injection" : "dangerous_command";
     return {
       allowed: false,
       reason: `\u68C0\u6D4B\u5230\u9AD8\u5371\u64CD\u4F5C: ${matched.join(", ")}`,
       riskLevel: highestSeverity,
-      riskType,
+      riskType: highestRiskType,
       confidence: 95,
       source: "heuristic",
       violatedLayers: ["1"]
@@ -166,6 +227,10 @@ function checkInjectionKeywords(text) {
   }
   return hits;
 }
+function isInlineScriptCommand(actionDetail) {
+  const re = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
+  return re.test(actionDetail);
+}
 function severityRank(s) {
   const ranks = { low: 1, medium: 2, high: 3, critical: 4 };
   return ranks[s] || 0;
@@ -241,59 +306,66 @@ var init_heuristic = __esm({
     DANGEROUS_PATTERNS = [
       // --- Critical: rm command graded detection (strict to loose, first match wins) ---
       // 1. rm -rf root dir
-      { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*f[a-zA-Z]*\s+\/\s/i, severity: "critical", description: "\u9012\u5F52\u5F3A\u5236\u5220\u9664\u6839\u76EE\u5F55 (rm -rf /)" },
+      { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*f[a-zA-Z]*\s+\/\s/i, severity: "critical", description: "\u9012\u5F52\u5F3A\u5236\u5220\u9664\u6839\u76EE\u5F55 (rm -rf /)", riskType: "script_execution" },
       // 2. rm -rf absolute path (both -r and -f)
-      { pattern: /\brm\s+-(?=[^\s]*r)(?=[^\s]*f)[a-zA-Z]*\s+\//i, severity: "critical", description: "\u9012\u5F52\u5F3A\u5236\u5220\u9664\u7EDD\u5BF9\u8DEF\u5F84 (rm -rf /...)" },
+      { pattern: /\brm\s+-(?=[^\s]*r)(?=[^\s]*f)[a-zA-Z]*\s+\//i, severity: "critical", description: "\u9012\u5F52\u5F3A\u5236\u5220\u9664\u7EDD\u5BF9\u8DEF\u5F84 (rm -rf /...)", riskType: "script_execution" },
       // 3. rm with -r or -f targeting system dirs
-      { pattern: /\brm\s+-[a-zA-Z]*[rf][a-zA-Z]*\s+\/(etc|var|home|usr|boot|root|opt|srv|sys|proc)\b/i, severity: "critical", description: "\u5220\u9664\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55" },
+      { pattern: /\brm\s+-[a-zA-Z]*[rf][a-zA-Z]*\s+\/(etc|var|home|usr|boot|root|opt|srv|sys|proc)\b/i, severity: "critical", description: "\u5220\u9664\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55", riskType: "script_execution" },
       // 4. rm -r absolute path (no -f)
-      { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*\s+\//i, severity: "high", description: "\u9012\u5F52\u5220\u9664\u64CD\u4F5C (rm -r /...)" },
+      { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*\s+\//i, severity: "high", description: "\u9012\u5F52\u5220\u9664\u64CD\u4F5C (rm -r /...)", riskType: "script_execution" },
       // 5. rm -f absolute path (no -r)
-      { pattern: /\brm\s+-[a-zA-Z]*f[a-zA-Z]*\s+\//i, severity: "medium", description: "\u5F3A\u5236\u5220\u9664\u6587\u4EF6 (rm -f /...)" },
-      { pattern: /dd\s+if=\/dev\/zero|dd\s+if=.*of=\/dev\//i, severity: "critical", description: "\u78C1\u76D8\u6E05\u96F6/\u76F4\u63A5\u5199\u5165" },
-      { pattern: /mkfs\b/i, severity: "critical", description: "\u683C\u5F0F\u5316\u6587\u4EF6\u7CFB\u7EDF" },
-      { pattern: /:\(\)\s*\{.*:\|:&.*\};:/i, severity: "critical", description: "Fork Bomb" },
+      { pattern: /\brm\s+-[a-zA-Z]*f[a-zA-Z]*\s+\//i, severity: "medium", description: "\u5F3A\u5236\u5220\u9664\u6587\u4EF6 (rm -f /...)", riskType: "script_execution" },
+      { pattern: /dd\s+if=\/dev\/zero|dd\s+if=.*of=\/dev\//i, severity: "critical", description: "\u78C1\u76D8\u6E05\u96F6/\u76F4\u63A5\u5199\u5165", riskType: "script_execution" },
+      { pattern: /mkfs\b/i, severity: "critical", description: "\u683C\u5F0F\u5316\u6587\u4EF6\u7CFB\u7EDF", riskType: "script_execution" },
+      { pattern: /:\(\)\s*\{.*:\|:&.*\};:/i, severity: "critical", description: "Fork Bomb", riskType: "resource_exhaustion" },
       // --- Critical: remote code execution ---
-      { pattern: /curl\s+.*\|\s*(bash|sh|zsh|dash)/i, severity: "critical", description: "curl pipe shell \u6267\u884C" },
-      { pattern: /wget\s+.*\|\s*(bash|sh)/i, severity: "critical", description: "wget pipe shell \u6267\u884C" },
-      { pattern: /eval\s+\$\(curl|eval\s+\$\(wget/i, severity: "critical", description: "eval \u8FDC\u7A0B\u4EE3\u7801\u6267\u884C" },
-      { pattern: /base64\s+-d\s+.*\|\s*bash/i, severity: "critical", description: "base64 \u89E3\u7801\u6267\u884C" },
+      { pattern: /curl\s+.*\|\s*(bash|sh|zsh|dash)/i, severity: "critical", description: "curl pipe shell \u6267\u884C", riskType: "script_execution" },
+      { pattern: /wget\s+.*\|\s*(bash|sh)/i, severity: "critical", description: "wget pipe shell \u6267\u884C", riskType: "script_execution" },
+      { pattern: /eval\s+\$\(curl|eval\s+\$\(wget/i, severity: "critical", description: "eval \u8FDC\u7A0B\u4EE3\u7801\u6267\u884C", riskType: "script_execution" },
+      { pattern: /base64\s+-d\s+.*\|\s*bash/i, severity: "critical", description: "base64 \u89E3\u7801\u6267\u884C", riskType: "script_execution" },
       // --- Critical: reverse shell ---
-      { pattern: /\/dev\/tcp\/|bash\s+-i\s+>&/i, severity: "critical", description: "\u53CD\u5F39 Shell" },
-      { pattern: /nc\s+-[el]\s+.*\d{1,5}/i, severity: "high", description: "Netcat \u53CD\u5F39\u8FDE\u63A5" },
+      { pattern: /\/dev\/tcp\/|bash\s+-i\s+>&/i, severity: "critical", description: "\u53CD\u5F39 Shell", riskType: "script_execution" },
+      { pattern: /nc\s+-[el]\s+.*\d{1,5}/i, severity: "high", description: "Netcat \u53CD\u5F39\u8FDE\u63A5", riskType: "lateral_movement" },
       // --- Critical: sensitive file access ---
-      { pattern: /\/etc\/shadow/i, severity: "critical", description: "\u8BBF\u95EE\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6 (/etc/shadow)" },
-      { pattern: /\.ssh\/id_rsa/i, severity: "critical", description: "\u8BBF\u95EE SSH \u79C1\u94A5\u6587\u4EF6" },
+      { pattern: /\/etc\/shadow/i, severity: "critical", description: "\u8BBF\u95EE\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6 (/etc/shadow)", riskType: "file_access" },
+      { pattern: /\.ssh\/id_rsa/i, severity: "critical", description: "\u8BBF\u95EE SSH \u79C1\u94A5\u6587\u4EF6", riskType: "file_access" },
       // --- Critical: privilege escalation / container escape ---
-      { pattern: /\/var\/run\/docker\.sock/i, severity: "critical", description: "\u8BBF\u95EE Docker socket\uFF0C\u53EF\u80FD\u5BFC\u81F4\u5BB9\u5668\u9003\u9038" },
+      { pattern: /\/var\/run\/docker\.sock/i, severity: "critical", description: "\u8BBF\u95EE Docker socket\uFF0C\u53EF\u80FD\u5BFC\u81F4\u5BB9\u5668\u9003\u9038", riskType: "privilege_escalation" },
       // --- High: dangerous permissions / ownership ---
-      { pattern: /chmod\s+[0-7]*777[0-7]*/i, severity: "high", description: "\u5168\u6743\u9650\u8BBE\u7F6E (chmod 777)" },
-      { pattern: /chown\s+root|chown\s+-R\s+\w+:\w+\s+\//i, severity: "high", description: "\u4FEE\u6539\u6240\u6709\u8005\u4E3A root / \u9012\u5F52\u4FEE\u6539\u6839\u76EE\u5F55\u6240\u6709\u8005" },
-      { pattern: /sudo\s+rm\s+-rf/i, severity: "high", description: "sudo \u5F3A\u5236\u5220\u9664" },
-      { pattern: /sudo\s+/i, severity: "high", description: "\u63D0\u6743\u6267\u884C (sudo)" },
+      { pattern: /chmod\s+[0-7]*777[0-7]*/i, severity: "high", description: "\u5168\u6743\u9650\u8BBE\u7F6E (chmod 777)", riskType: "script_execution" },
+      { pattern: /chown\s+root|chown\s+-R\s+\w+:\w+\s+\//i, severity: "high", description: "\u4FEE\u6539\u6240\u6709\u8005\u4E3A root / \u9012\u5F52\u4FEE\u6539\u6839\u76EE\u5F55\u6240\u6709\u8005", riskType: "script_execution" },
+      { pattern: /sudo\s+rm\s+-rf/i, severity: "high", description: "sudo \u5F3A\u5236\u5220\u9664", riskType: "script_execution" },
+      { pattern: /sudo\s+/i, severity: "high", description: "\u63D0\u6743\u6267\u884C (sudo)", riskType: "privilege_escalation" },
       // --- High: system config overwrite ---
-      { pattern: />\s*\/etc\//i, severity: "critical", description: "\u8986\u76D6\u5199\u5165\u7CFB\u7EDF\u914D\u7F6E\u76EE\u5F55" },
+      { pattern: />\s*\/etc\//i, severity: "critical", description: "\u8986\u76D6\u5199\u5165\u7CFB\u7EDF\u914D\u7F6E\u76EE\u5F55", riskType: "file_access" },
       // --- High: download script + execute risk ---
-      { pattern: /(?:curl|wget)\s+.*(?:-o|--output|>)\s*\S+\.(?:sh|bash)\b/i, severity: "high", description: "\u8FDC\u7A0B\u4E0B\u8F7D\u811A\u672C\u5230\u672C\u5730" },
-      { pattern: /(?:curl|wget)\s+.*\s+&&?\s*(?:chmod\s+\+x|bash|sh)/i, severity: "high", description: "\u4E0B\u8F7D\u540E\u6267\u884C" },
+      { pattern: /(?:curl|wget)\s+.*(?:-o|--output|>)\s*\S+\.(?:sh|bash)\b/i, severity: "high", description: "\u8FDC\u7A0B\u4E0B\u8F7D\u811A\u672C\u5230\u672C\u5730", riskType: "script_execution" },
+      { pattern: /(?:curl|wget)\s+.*\s+&&?\s*(?:chmod\s+\+x|bash|sh)/i, severity: "high", description: "\u4E0B\u8F7D\u540E\u6267\u884C", riskType: "script_execution" },
       // --- High: package manager pipe-to-shell ---
-      { pattern: /git\s+clone\s+.*\|.*bash/i, severity: "high", description: "git clone pipe shell" },
-      { pattern: /pip\s+install\s+.*\|\s*bash/i, severity: "high", description: "pip install pipe shell" },
-      { pattern: /npm\s+install\s+-g\s+.*\|\s*bash/i, severity: "high", description: "npm install pipe shell" },
+      { pattern: /git\s+clone\s+.*\|.*bash/i, severity: "high", description: "git clone pipe shell", riskType: "script_execution" },
+      { pattern: /pip\s+install\s+.*\|\s*bash/i, severity: "high", description: "pip install pipe shell", riskType: "script_execution" },
+      { pattern: /npm\s+install\s+-g\s+.*\|\s*bash/i, severity: "high", description: "npm install pipe shell", riskType: "script_execution" },
       // --- High: destructive git operations ---
-      { pattern: /git\s+push\s+.*--force/i, severity: "high", description: "\u5F3A\u5236\u63A8\u9001\u64CD\u4F5C (git push --force)" },
+      { pattern: /git\s+push\s+.*--force/i, severity: "high", description: "\u5F3A\u5236\u63A8\u9001\u64CD\u4F5C (git push --force)", riskType: "script_execution" },
       // --- Medium: credential export ---
-      { pattern: /export\s+.*(?:TOKEN|KEY|SECRET|PASSWORD)/i, severity: "medium", description: "\u5BFC\u51FA\u654F\u611F\u51ED\u8BC1" },
+      { pattern: /export\s+.*(?:TOKEN|KEY|SECRET|PASSWORD)/i, severity: "medium", description: "\u5BFC\u51FA\u654F\u611F\u51ED\u8BC1", riskType: "data_exfiltration" },
       // --- High: shell rc file append (persistence) ---
-      { pattern: />>\s*(~|\/home\/[^/]+)\/(\.bashrc|\.zshrc|\.profile|\.bash_profile|\.zprofile)/, severity: "high", description: "\u68C0\u6D4B\u5230\u4FEE\u6539 Shell \u914D\u7F6E\u6587\u4EF6\uFF08~/.bashrc \u7B49\uFF09\uFF0C\u53EF\u80FD\u7528\u4E8E\u6301\u4E45\u5316\u540E\u95E8" },
+      { pattern: />>\s*(~|\/home\/[^/]+)\/(\.bashrc|\.zshrc|\.profile|\.bash_profile|\.zprofile)/, severity: "high", description: "\u68C0\u6D4B\u5230\u4FEE\u6539 Shell \u914D\u7F6E\u6587\u4EF6\uFF08~/.bashrc \u7B49\uFF09\uFF0C\u53EF\u80FD\u7528\u4E8E\u6301\u4E45\u5316\u540E\u95E8", riskType: "persistence" },
       // --- High: device file access ---
-      { pattern: /\/dev\/(mem|kmsg)\b/i, severity: "high", description: "\u8BBF\u95EE\u8BBE\u5907\u6587\u4EF6 (\u7269\u7406\u5185\u5B58/\u5185\u6838\u6D88\u606F)" }
+      { pattern: /\/dev\/(mem|kmsg)\b/i, severity: "high", description: "\u8BBF\u95EE\u8BBE\u5907\u6587\u4EF6 (\u7269\u7406\u5185\u5B58/\u5185\u6838\u6D88\u606F)", riskType: "file_access" },
+      // --- High: non-interactive password modification ---
+      { pattern: /\|\s*passwd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u7BA1\u9053\u65B9\u5F0F\u8C03\u7528 passwd\uFF08\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\uFF09", riskType: "script_execution" },
+      { pattern: /\bpasswd\s+--stdin\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 passwd --stdin \u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u8F93\u5165", riskType: "script_execution" },
+      { pattern: /\bchpasswd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 chpasswd \u6279\u91CF\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4", riskType: "script_execution" },
+      { pattern: /\bnewusers\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 newusers \u6279\u91CF\u7528\u6237\u6DFB\u52A0\u547D\u4EE4", riskType: "script_execution" },
+      { pattern: /\bpasswd\s+-[a-zA-Z]*d\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u5BC6\u7801\u64CD\u4F5C (passwd -d)", riskType: "script_execution" },
+      { pattern: /\bpasswd\s+-[a-zA-Z]*l\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u9501\u5B9A\u7528\u6237\u8D26\u6237\u64CD\u4F5C (passwd -l)", riskType: "script_execution" }
     ];
   }
 });
 
 // src/engine/logic-rules.ts
-import * as fs from "fs";
+import * as fs2 from "fs";
 function runLogicCheck(input) {
   const { actionHistory, aNext, cwd } = input;
   const actionDetail = aNext.actionDetail.toLowerCase();
@@ -375,6 +447,8 @@ function runLogicCheck(input) {
       };
     }
   }
+  const pwdResult = checkPasswordConsent(actionType, actionDetail, actionHistory);
+  if (pwdResult) return pwdResult;
   return null;
 }
 function extractFilePaths(text) {
@@ -387,7 +461,13 @@ function extractFilePaths(text) {
 }
 function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, cwd) {
   if (NON_WRITE_TOOLS.has(actionType)) return null;
-  const isWrite = WRITE_KEYWORDS.some((kw) => actionType.includes(kw) || actionDetail.includes(kw));
+  let isWrite = WRITE_KEYWORDS.some((kw) => actionType.includes(kw) || actionDetail.includes(kw));
+  if (!isWrite && actionDetail.includes(">")) {
+    const firstWord = actionDetail.split(/\s/)[0]?.toLowerCase() || "";
+    if (!READ_ONLY_REDIR_CMDS.has(firstWord)) {
+      isWrite = true;
+    }
+  }
   if (!isWrite) return null;
   const targetPaths = extractFilePaths(actionDetail);
   if (targetPaths.length === 0) return null;
@@ -403,17 +483,17 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
     }
   }
   const unreadPaths = [];
-  for (const path2 of targetPaths) {
+  for (const path3 of targetPaths) {
     const hasRead = [...historyReadPaths].some(
-      (rp) => path2 === rp || path2.startsWith(rp) || rp.startsWith(path2)
+      (rp) => path3 === rp || path3.startsWith(rp) || rp.startsWith(path3)
     );
     if (!hasRead) {
-      let isCreate = !fs.existsSync(path2);
+      let isCreate = !fs2.existsSync(path3);
       if (!isCreate) {
         isCreate = CREATE_KEYWORDS.some((kw) => reason.toLowerCase().includes(kw) || actionDetail.includes(kw));
       }
       if (!isCreate) {
-        unreadPaths.push(path2);
+        unreadPaths.push(path3);
       }
     }
   }
@@ -495,7 +575,25 @@ function isLocalHost(host) {
   const localNames = ["localhost", "127.0.0.1", "::1", process.env.HOSTNAME || "", "0.0.0.0"];
   return localNames.includes(host.replace(/.*@/, ""));
 }
-var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, WRITE_KEYWORDS, READ_KEYWORDS, CREATE_KEYWORDS, INTENT_DEVIATION_PATTERNS;
+function checkPasswordConsent(actionType, actionDetail, actionHistory) {
+  if (actionType !== "bash") return null;
+  const isPasswordModify = PASSWORD_MODIFY_PATTERNS.some((p) => p.test(actionDetail));
+  if (!isPasswordModify) return null;
+  const hasConsent = actionHistory.some(
+    (h) => h.actionType.toLowerCase() === "ask_user_question" && h.actionDetail.trim().length > 0
+  );
+  if (hasConsent) return null;
+  return {
+    allowed: false,
+    reason: "\u6267\u884C\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u5BC6\u7801\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u5BC6\u7801\u4FEE\u6539\u98CE\u9669",
+    riskLevel: "high",
+    riskType: "consent_missing",
+    confidence: 85,
+    source: "logic_rule",
+    violatedLayers: ["2"]
+  };
+}
+var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, READ_ONLY_REDIR_CMDS, WRITE_KEYWORDS, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, INTENT_DEVIATION_PATTERNS;
 var init_logic_rules = __esm({
   "src/engine/logic-rules.ts"() {
     "use strict";
@@ -532,9 +630,18 @@ var init_logic_rules = __esm({
       { path: ".env", riskLevel: "high", desc: "\u73AF\u5883\u53D8\u91CF/\u51ED\u636E\u914D\u7F6E\u6587\u4EF6" }
     ];
     NON_WRITE_TOOLS = /* @__PURE__ */ new Set(["ask_user_question", "glob", "grep", "list_dir", "count_text_length", "search"]);
+    READ_ONLY_REDIR_CMDS = /* @__PURE__ */ new Set(["cat", "head", "tail", "less", "more", "grep", "find", "awk", "sed", "sort", "uniq", "wc", "cut", "strings", "od", "xxd", "hexdump"]);
     WRITE_KEYWORDS = ["write", "\u5199\u5165", "save", "\u4FDD\u5B58", "modify", "\u4FEE\u6539", "update", "\u66F4\u65B0", "delete", "\u5220\u9664", "remove", "\u79FB\u9664", "create", "\u521B\u5EFA", "append", "\u8FFD\u52A0", "truncate", "\u622A\u65AD", "overwrite", "\u8986\u76D6", "replace", "\u66FF\u6362"];
     READ_KEYWORDS = ["read", "\u8BFB\u53D6", "cat", "head", "tail", "less", "more", "view", "\u67E5\u770B", "open", "\u6253\u5F00", "load", "\u52A0\u8F7D", "grep", "search", "\u641C\u7D22", "find", "\u67E5\u627E"];
     CREATE_KEYWORDS = ["\u521B\u5EFA", "\u65B0\u5EFA", "create", "new file", "touch"];
+    PASSWORD_MODIFY_PATTERNS = [
+      /\|\s*passwd\b/i,
+      /\bpasswd\s+--stdin\b/i,
+      /\bchpasswd\b/i,
+      /\bnewusers\b/i,
+      /\bpasswd\s+-[a-zA-Z]*d\b/i,
+      /\bpasswd\s+-[a-zA-Z]*l\b/i
+    ];
     INTENT_DEVIATION_PATTERNS = [
       {
         intentKeywords: ["\u8BFB\u53D6", "\u67E5\u770B", "\u5206\u6790", "read", "analyze", "view", "list", "\u5217\u51FA"],
@@ -1069,8 +1176,12 @@ function matchesAny(cmd, patterns) {
 }
 async function runAnalysis(input) {
   const heuristicResult = isHeuristicEnabled() ? runHeuristicCheck(input) : null;
+  const isInlineScriptCmd = isInlineScriptCommand(input.aNext.actionDetail.toLowerCase());
   if (heuristicResult && !heuristicResult.allowed) {
-    return heuristicResult;
+    const skipInlineFileAccess = isInlineScriptCmd && heuristicResult.riskType === "file_access";
+    if (!skipInlineFileAccess) {
+      return heuristicResult;
+    }
   }
   const actionType = input.aNext.actionType.toLowerCase();
   const rawDetail = extractRawCommand(input.aNext.actionDetail);
@@ -1086,19 +1197,37 @@ async function runAnalysis(input) {
       violatedLayers: []
     };
   }
+  if (actionType === "skill" && TRUSTED_SKILLS.has(lowerDetail)) {
+    return {
+      allowed: true,
+      reason: `\u5185\u7F6E\u5B89\u5168 Skill\uFF0C\u8DF3\u8FC7\u6DF1\u5EA6\u5206\u6790: ${lowerDetail}`,
+      riskLevel: heuristicResult?.riskLevel || "low",
+      riskType: "",
+      confidence: 95,
+      source: "whitelist_bypass",
+      violatedLayers: []
+    };
+  }
   let skipLLM = READONLY_SENSITIVE_TOOLS.has(actionType);
   if (actionType === "bash" || actionType === "executebash" || actionType === "terminal-executebash") {
     const firstCmd = extractFirstCommand(lowerDetail);
     if (matchesAny(firstCmd, FULLY_SAFE_BASH_PATTERNS)) {
-      return {
-        allowed: true,
-        reason: `\u5B89\u5168\u7684\u53EA\u8BFB bash \u547D\u4EE4: ${firstCmd}`,
-        riskLevel: "low",
-        riskType: "",
-        confidence: 95,
-        source: "whitelist_bypass",
-        violatedLayers: []
-      };
+      const fullCmdHit = DANGEROUS_PATTERNS.some(
+        (p) => p.severity === "critical" || p.severity === "high"
+      ) && DANGEROUS_PATTERNS.some(
+        (p) => (p.severity === "critical" || p.severity === "high") && p.pattern.test(lowerDetail)
+      );
+      if (!fullCmdHit) {
+        return {
+          allowed: true,
+          reason: `\u5B89\u5168\u7684\u53EA\u8BFB bash \u547D\u4EE4: ${firstCmd}`,
+          riskLevel: "low",
+          riskType: "",
+          confidence: 95,
+          source: "whitelist_bypass",
+          violatedLayers: []
+        };
+      }
     }
     if (matchesAny(firstCmd, READONLY_SENSITIVE_BASH_PATTERNS)) {
       skipLLM = true;
@@ -1106,7 +1235,10 @@ async function runAnalysis(input) {
   }
   const logicResult = isLogicRulesEnabled() ? runLogicCheck(input) : null;
   if (logicResult && !logicResult.allowed) {
-    return logicResult;
+    const skipInlineFileAccess = isInlineScriptCmd && logicResult.riskType === "sensitive_path_access";
+    if (!skipInlineFileAccess) {
+      return logicResult;
+    }
   }
   if (skipLLM || !isLLMAvailable()) {
     return {
@@ -1125,7 +1257,7 @@ async function runAnalysis(input) {
   });
   return llmResult;
 }
-var FULLY_SAFE_TOOLS, READONLY_SENSITIVE_TOOLS, FULLY_SAFE_BASH_PATTERNS, READONLY_SENSITIVE_BASH_PATTERNS;
+var FULLY_SAFE_TOOLS, TRUSTED_SKILLS, READONLY_SENSITIVE_TOOLS, FULLY_SAFE_BASH_PATTERNS, READONLY_SENSITIVE_BASH_PATTERNS;
 var init_coordinator = __esm({
   "src/engine/coordinator.ts"() {
     "use strict";
@@ -1142,6 +1274,7 @@ var init_coordinator = __esm({
       "count_text_length",
       "filemgr-globfiles"
     ]);
+    TRUSTED_SKILLS = /* @__PURE__ */ new Set(["xiaoo-guardian"]);
     READONLY_SENSITIVE_TOOLS = /* @__PURE__ */ new Set([
       "read",
       "file_read",
@@ -1167,7 +1300,20 @@ var init_coordinator = __esm({
       /^echo\s+/i,
       /^printf\s+/i,
       /^type\s+/i,
-      /^command\s+/i
+      /^command\s+/i,
+      // 系统信息查询（只读，不涉及文件/网络/权限）
+      /^whoami(?:\s|$)/i,
+      /^id(?:\s|$)/i,
+      /^hostname(?:\s|$)/i,
+      /^uname(?:\s|$)/i,
+      /^date(?:\s|$)/i,
+      /^env(?:\s|$)/i,
+      /^printenv(?:\s|$)/i,
+      /^tty(?:\s|$)/i,
+      /^arch(?:\s|$)/i,
+      /^uptime(?:\s|$)/i,
+      /^groups(?:\s|$)/i,
+      /^logname(?:\s|$)/i
     ];
     READONLY_SENSITIVE_BASH_PATTERNS = [
       /^cat\s+/i,
@@ -1236,6 +1382,109 @@ var HealthResponseSchema = z.object({
 
 // src/routes.ts
 init_coordinator();
+
+// src/actrail.ts
+init_esm_shims();
+import * as fs3 from "fs";
+function escape(value) {
+  return value.replace(/\\/g, "\\\\").replace(/\n/g, "\\n").replace(/=/g, "\\e");
+}
+function sessionToTraceId(sessionId) {
+  let hash = 0;
+  for (let i = 0; i < sessionId.length; i++) {
+    const char = sessionId.charCodeAt(i);
+    hash = (hash << 5) - hash + char | 0;
+  }
+  return Math.abs((hash * 31 + sessionId.length) % Number.MAX_SAFE_INTEGER);
+}
+function isEnabled() {
+  return process.env.ACTRAIL_ENABLED === "1" || process.env.ACTRAIL_ENABLED === "true";
+}
+function getStoragePath() {
+  return process.env.ACTRAIL_STORAGE_PATH || "/tmp/actrail.sqlite";
+}
+function reportEnforcementEvent(opts) {
+  if (!isEnabled()) return false;
+  const storagePath = getStoragePath();
+  if (!fs3.existsSync(storagePath)) return false;
+  try {
+    let Database;
+    try {
+      Database = __require("better-sqlite3");
+    } catch {
+      console.debug("[AgentMoss] better-sqlite3 not installed, AcTrail reporting disabled");
+      return false;
+    }
+    const db = new Database(storagePath, { timeout: 100, readonly: false });
+    const tableCheck = db.prepare(
+      "SELECT name FROM sqlite_master WHERE type='table' AND name='events'"
+    ).get();
+    if (!tableCheck) {
+      db.close();
+      return false;
+    }
+    const nowNs = BigInt(Date.now()) * 1000000n;
+    const eventId = Number(nowNs % BigInt(2 ** 62));
+    const traceIdInt = sessionToTraceId(opts.traceId);
+    const rawFields = {
+      "backend": "agent-moss",
+      "operation": "tool_call",
+      "decision": opts.decision,
+      "result": opts.decision === "allow" ? "allowed" : "denied",
+      "tool.name": opts.toolName,
+      "tool.command": (opts.toolCommand || "").slice(0, 500),
+      "agent.session_id": opts.sessionId,
+      "agent.prompt": (opts.prompt || "").slice(0, 500),
+      "risk.level": opts.riskLevel || "",
+      "risk.type": opts.riskType || "",
+      "reason": (opts.reason || "").slice(0, 500),
+      "violated_layers": (opts.violatedLayers || []).join(","),
+      "confidence": String(opts.confidence ?? 100),
+      "duration_ms": (opts.durationMs ?? 0).toFixed(1)
+    };
+    const payloadFields = Object.entries(rawFields).map(([k, v]) => `${escape(k)}=${escape(v)}`).join("\n");
+    db.prepare(`
+      INSERT OR REPLACE INTO events (
+        event_id, trace_id, observed_at,
+        process_pid, process_task_id, process_start_ticks,
+        process_pid_namespace, process_generation,
+        collector, kind,
+        bootstrap_observed, metadata_partial, policy_modified,
+        payload_variant, payload_fields, payload_bytes,
+        policy_verdict, policy_note,
+        policy_redactions, policy_truncations
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(
+      eventId,
+      traceIdInt,
+      Number(nowNs),
+      process.pid,
+      0,
+      0,
+      null,
+      0,
+      "agent-moss",
+      "enforcement",
+      0,
+      0,
+      0,
+      "enforcement",
+      payloadFields,
+      "",
+      opts.decision === "allow" ? "allow" : "drop",
+      opts.reason || "",
+      "[]",
+      "[]"
+    );
+    db.close();
+    return true;
+  } catch (err) {
+    console.debug(`[AgentMoss] AcTrail write failed (non-fatal): ${err.message}`);
+    return false;
+  }
+}
+
+// src/routes.ts
 async function healthRoute(c) {
   return c.json(HealthResponseSchema.parse({}));
 }
@@ -1264,6 +1513,23 @@ async function analyzeRoute(c) {
       cwd: req.cwd
     });
     const durationMs = performance.now() - t0;
+    try {
+      reportEnforcementEvent({
+        traceId: req.session_id,
+        decision: result.allowed ? "allow" : "deny",
+        toolName: req.a_next.action_type,
+        toolCommand: req.a_next.action_detail,
+        sessionId: req.session_id,
+        prompt: req.prompt_session,
+        riskLevel: result.riskLevel,
+        riskType: result.riskType,
+        reason: result.reason,
+        violatedLayers: result.violatedLayers,
+        confidence: result.confidence,
+        durationMs: Math.round(durationMs * 10) / 10
+      });
+    } catch {
+    }
     return c.json(
       AnalyzeResponseSchema.parse({
         decision: result.allowed ? "Allow" : "Deny",
@@ -1323,7 +1589,7 @@ async function main() {
   switch (command) {
     case "init": {
       const output = args[2] || "input.json";
-      const fs2 = await import("fs");
+      const fs4 = await import("fs");
       const template = {
         session_id: "my-session-001",
         prompt_session: "Read /var/log/app.log and analyze errors",
@@ -1333,7 +1599,7 @@ async function main() {
         os_type: "",
         cwd: "/home/user/project"
       };
-      fs2.writeFileSync(output, JSON.stringify(template, null, 2), "utf-8");
+      fs4.writeFileSync(output, JSON.stringify(template, null, 2), "utf-8");
       console.log(`Template written to ${output}`);
       break;
     }
@@ -1342,11 +1608,11 @@ async function main() {
         console.error("Usage: agent-moss analyze <input.json>");
         process.exit(1);
       }
-      const fs2 = await import("fs");
-      const path2 = await import("path");
+      const fs4 = await import("fs");
+      const path3 = await import("path");
       const { runAnalysis: runAnalysis2 } = await Promise.resolve().then(() => (init_coordinator(), coordinator_exports));
-      const filePath = path2.resolve(args[1]);
-      const data = JSON.parse(fs2.readFileSync(filePath, "utf-8"));
+      const filePath = path3.resolve(args[1]);
+      const data = JSON.parse(fs4.readFileSync(filePath, "utf-8"));
       const result = await runAnalysis2({
         sessionId: data.session_id || "unknown",
         promptSession: data.prompt_session || "",