@kenhkl/agent-moss 0.7.12 → 0.8.0

package/dist/cli.js

@@ -29,6 +29,20 @@ var init_esm_shims = __esm({
 });
 
 // src/config.ts
+var config_exports = {};
+__export(config_exports, {
+  detectProvider: () => detectProvider,
+  getCustomRules: () => getCustomRules,
+  getLLMConfig: () => getLLMConfig,
+  getLLMFailMode: () => getLLMFailMode,
+  getProviderHeaders: () => getProviderHeaders,
+  getRetryConfig: () => getRetryConfig,
+  getTimeoutConfig: () => getTimeoutConfig,
+  isHeuristicEnabled: () => isHeuristicEnabled,
+  isLLMAvailable: () => isLLMAvailable,
+  isLogicRulesEnabled: () => isLogicRulesEnabled,
+  updateLLMConfig: () => updateLLMConfig
+});
 import fs from "fs";
 import path2 from "path";
 import os from "os";
@@ -108,6 +122,9 @@ function loadCustomRules() {
 function getLLMConfig() {
   return llmConfig;
 }
+function updateLLMConfig(partial) {
+  llmConfig = { ...llmConfig, ...partial };
+}
 function getCustomRules() {
   return customRules;
 }
@@ -115,6 +132,10 @@ function isLLMAvailable() {
   if (process.env.AGENT_MOSS_DISABLE_LLM === "1") return false;
   return llmConfig.apiKey.length > 0;
 }
+function getLLMFailMode() {
+  const val = (process.env.AGENT_MOSS_LLM_FAIL_MODE || "fail_open").toLowerCase();
+  return val === "fail_closed" ? "fail_closed" : "fail_open";
+}
 function detectProvider(baseUrl, providerHint = "") {
   if (providerHint) {
     const hint = providerHint.toLowerCase();
@@ -189,6 +210,56 @@ var init_config = __esm({
   }
 });
 
+// src/agents/index.ts
+import { readFileSync, existsSync } from "fs";
+import { resolve, dirname } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+function resolveAgentsDir() {
+  if (existsSync(AGENTS_DIR_PROD)) return AGENTS_DIR_PROD;
+  if (existsSync(AGENTS_DIR_DEV_FALLBACK)) return AGENTS_DIR_DEV_FALLBACK;
+  return AGENTS_DIR_PROD;
+}
+function getAgentExtensions(agentId) {
+  if (!agentId) return null;
+  if (cache.has(agentId)) return cache.get(agentId) ?? null;
+  const agentsDir = resolveAgentsDir();
+  const rulesFile = resolve(agentsDir, agentId, "rules.json");
+  if (!existsSync(rulesFile)) {
+    cache.set(agentId, null);
+    return null;
+  }
+  try {
+    const raw = readFileSync(rulesFile, "utf-8");
+    const ext = JSON.parse(raw);
+    if (!ext.agent_id) {
+      console.warn(`[AgentMoss agents] rules.json \u7F3A\u5C11 agent_id \u5B57\u6BB5: ${rulesFile}`);
+      cache.set(agentId, null);
+      return null;
+    }
+    cache.set(agentId, ext);
+    console.log(
+      `[AgentMoss agents] \u52A0\u8F7D agent ${agentId} \u5B9A\u5236\u89C4\u5219: ${ext.extra_command_patterns?.length ?? 0} cmd patterns, ${ext.extra_injection_keywords?.length ?? 0} injection keywords, ${ext.extra_sensitive_paths?.length ?? 0} sensitive paths, ${ext.builtin_safe_skills?.length ?? 0} builtin safe skills`
+    );
+    return ext;
+  } catch (e) {
+    console.error(`[AgentMoss agents] \u52A0\u8F7D agent ${agentId} rules.json \u5931\u8D25:`, e.message);
+    cache.set(agentId, null);
+    return null;
+  }
+}
+var __filename2, __dirname2, AGENTS_DIR_PROD, AGENTS_DIR_DEV_FALLBACK, cache;
+var init_agents = __esm({
+  "src/agents/index.ts"() {
+    "use strict";
+    init_esm_shims();
+    __filename2 = fileURLToPath2(import.meta.url);
+    __dirname2 = dirname(__filename2);
+    AGENTS_DIR_PROD = resolve(__dirname2, "agents");
+    AGENTS_DIR_DEV_FALLBACK = resolve(__dirname2, "../../../agent_moss/agents");
+    cache = /* @__PURE__ */ new Map();
+  }
+});
+
 // src/engine/heuristic.ts
 function runHeuristicCheck(input) {
   const command = `${input.aNext.actionType}: ${input.aNext.actionDetail}`;
@@ -222,8 +293,24 @@ function runHeuristicCheck(input) {
     }
   }
   highestRiskType = topRiskType || highestRiskType;
+  const agentExt = getAgentExtensions(input.agentId);
+  if (agentExt?.extra_command_patterns) {
+    for (const rule of agentExt.extra_command_patterns) {
+      try {
+        const re = new RegExp(rule.pattern, "i");
+        if (re.test(command)) {
+          matched.push(`agent \u4E13\u5C5E\u89C4\u5219: ${rule.reason}`);
+          if (severityRank(rule.risk_level) > severityRank(highestSeverity)) {
+            highestSeverity = rule.risk_level;
+            highestRiskType = rule.risk_type;
+          }
+        }
+      } catch {
+      }
+    }
+  }
   const injectionText = `${input.aNext.actionType} ${input.aNext.actionDetail} ${input.reason || ""} ${input.promptSession || ""}`.toLowerCase();
-  const injectionHits = checkInjectionKeywords(injectionText);
+  const injectionHits = checkInjectionKeywords(injectionText, agentExt?.extra_injection_keywords);
   if (injectionHits.length > 0) {
     const topHit = injectionHits.reduce((a, b) => severityRank(a.riskLevel) >= severityRank(b.riskLevel) ? a : b);
     matched.push(...injectionHits.map((h) => `\u6CE8\u5165\u5173\u952E\u8BCD [${h.lang}]: ${h.keyword}`));
@@ -240,18 +327,26 @@ function runHeuristicCheck(input) {
       riskType: highestRiskType,
       confidence: 95,
       source: "heuristic",
-      violatedLayers: ["1"]
+      violatedLayers: ["1.1"]
+      // 对齐 py coordinator.py:165（L1.1 = 命中高危命令模式/注入关键词）
     };
   }
   return null;
 }
-function checkInjectionKeywords(text) {
+function checkInjectionKeywords(text, extraKeywords) {
   const hits = [];
   for (const entry of INJECTION_KEYWORDS) {
     if (text.includes(entry.keyword.toLowerCase())) {
       hits.push(entry);
     }
   }
+  if (extraKeywords) {
+    for (const entry of extraKeywords) {
+      if (text.includes(entry.keyword.toLowerCase())) {
+        hits.push({ keyword: entry.keyword, riskLevel: entry.risk_level, lang: entry.lang });
+      }
+    }
+  }
   return hits;
 }
 function isInlineScriptCommand(actionDetail) {
@@ -268,6 +363,7 @@ var init_heuristic = __esm({
     "use strict";
     init_esm_shims();
     init_config();
+    init_agents();
     INJECTION_KEYWORDS = [
       // ---- Instruction Override ----
       { keyword: "ignore previous instructions", riskLevel: "critical", lang: "en" },
@@ -321,14 +417,10 @@ var init_heuristic = __esm({
       { keyword: "DAN mode", riskLevel: "critical", lang: "en" },
       { keyword: "jailbreak", riskLevel: "critical", lang: "en" },
       { keyword: "\u5F00\u53D1\u8005\u6A21\u5F0F", riskLevel: "critical", lang: "zh" },
-      { keyword: "\u8D8A\u72F1", riskLevel: "critical", lang: "zh" },
-      // ---- xiaoO-specific bypass ----
-      { keyword: "bypass audit", riskLevel: "critical", lang: "en" },
-      { keyword: "skip security check", riskLevel: "critical", lang: "en" },
-      { keyword: "disable guard", riskLevel: "critical", lang: "en" },
-      { keyword: "\u7ED5\u8FC7\u5BA1\u8BA1", riskLevel: "critical", lang: "zh" },
-      { keyword: "\u7981\u7528\u5B89\u5168\u68C0\u67E5", riskLevel: "critical", lang: "zh" },
-      { keyword: "\u5173\u95ED\u9632\u62A4", riskLevel: "critical", lang: "zh" }
+      { keyword: "\u8D8A\u72F1", riskLevel: "critical", lang: "zh" }
+      // 注：xiaoO 专属绕过词（绕过审计/禁用安全检查/关闭防护/bypass audit 等）
+      // 已迁至 agent_moss/agents/xiaoo/rules.json 的 extra_injection_keywords，
+      // 由 agent_ext 机制注入，不再污染通用层。
     ];
     DANGEROUS_PATTERNS = [
       // --- Critical: rm command graded detection (strict to loose, first match wins) ---
@@ -626,7 +718,8 @@ function runLogicCheck(input) {
     }
   }
   if (!isExcludedType) {
-    const pathResult = checkSensitivePath(actionDetail, resolvedCwd);
+    const agentExt = getAgentExtensions(input.agentId || "");
+    const pathResult = checkSensitivePath(actionDetail, resolvedCwd, agentExt);
     if (pathResult) return pathResult;
   }
   if (actionType !== "file_write" && actionType !== "file_edit") {
@@ -655,7 +748,7 @@ function runLogicCheck(input) {
       };
     }
   }
-  const READ_ONLY_COMMANDS2 = /* @__PURE__ */ new Set([
+  var _READ_ONLY_COMMANDS = /* @__PURE__ */ new Set([
     "cat",
     "head",
     "tail",
@@ -736,8 +829,8 @@ function runLogicCheck(input) {
     "modinfo",
     "sysctl"
   ]);
-  const DEVNULL_REDIRECT_RE2 = /(?:2|&|1)?\s*>\s*\/dev\/null\b/;
-  const WRITE_COMMAND_RES2 = [
+  var _DEVNULL_REDIRECT_RE = /(?:2|&|1)?\s*>\s*\/dev\/null\b/;
+  var _WRITE_COMMAND_RES = [
     /\brm\b/,
     /\bunlink\b/,
     /\brmdir\b/,
@@ -850,29 +943,12 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
   }
   return null;
 }
-function checkSensitivePath(command, cwd) {
+function checkSensitivePath(command, cwd, agentExt) {
   const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
-  const isWriteOpFlag = (() => {
-    if (WRITE_KEYWORDS.some((kw) => "".includes(kw) || command.includes(kw))) {
-      return true;
-    }
-    if (WRITE_COMMAND_RES.some((rx) => rx.test(command))) {
-      return true;
-    }
-    if (/\bsed\s+-[a-zA-Z]*i/.test(command)) {
-      return true;
-    }
-    if (command.includes(">")) {
-      const withoutDevNull = command.replace(DEVNULL_REDIRECT_RE, "");
-      if (withoutDevNull.includes(">")) {
-        const firstWord = command.trim().split(/\s+/)[0]?.toLowerCase() || "";
-        if (!READ_ONLY_COMMANDS.has(firstWord)) {
-          return true;
-        }
-      }
-    }
-    return false;
-  })();
+  const _WRITE_CMD_RES = [/\brm\b/, /\bunlink\b/, /\brmdir\b/, /\bshred\b/, /\bcp\b/, /\bmv\b/, /\binstall\b/, /\btee\b/, /\bdd\b/, /\bmkfs\b/, /\b(fdisk|parted|cfdisk|sfdisk)\b/, /\bchmod\b/, /\bchown\b/, /\btruncate\b/];
+  const _DEVNULL_RE = /(?:2|&|1)?\s*>\s*\/dev\/null\b/;
+  const _READONLY_CMDS = /* @__PURE__ */ new Set(["cat", "head", "tail", "less", "more", "grep", "find", "awk", "sed", "sort", "uniq", "wc", "cut", "strings", "od", "xxd", "hexdump", "tr", "file", "stat", "du", "df", "ls", "dir", "tree", "nl", "tac", "rev", "lsblk", "blockdev", "smartctl", "udevadm", "dmidecode", "lscpu", "lspci", "lsusb", "lsmem", "lsns", "lsof", "hwinfo", "inxi", "fdisk", "parted", "dmesg", "journalctl", "systemctl", "hostnamectl", "localectl", "timedatectl", "ps", "top", "free", "vmstat", "iostat", "mpstat", "pidof", "pgrep", "ip", "ifconfig", "route", "ss", "netstat", "arp", "ethtool", "nmcli", "uname", "arch", "nproc", "getconf", "getent", "id", "whoami", "who", "w", "last", "uptime", "lsmod", "modinfo", "sysctl"]);
+  const isWriteOpFlag = _WRITE_CMD_RES.some((rx) => rx.test(command)) || /\bsed\s+-[a-zA-Z]*i/.test(command) || command.includes(">") && !command.replace(_DEVNULL_RE, "").includes(">") || command.includes(">") && command.replace(_DEVNULL_RE, "").includes(">") && !_READONLY_CMDS.has(command.trim().split(/\s+/)[0]?.toLowerCase() || "") || WRITE_KEYWORDS.some((kw) => "".includes(kw) || command.includes(kw));
   for (const sp of ROOT_SENSITIVE_PATHS) {
     if (command.includes(sp.path.toLowerCase())) {
       if (sp.path === "/dev/random") {
@@ -889,7 +965,7 @@ function checkSensitivePath(command, cwd) {
           violatedLayers: ["2"]
         };
       }
-      if (!isWriteOpFlag) {
+      if (!isWriteOpFlag && !sp.credential) {
         continue;
       }
       return {
@@ -906,7 +982,7 @@ function checkSensitivePath(command, cwd) {
   for (const sp of HOME_SENSITIVE_PATHS) {
     const expanded = `${expandedCwd}/${sp.path}`;
     if (command.includes(sp.path.toLowerCase()) || command.includes(expanded.toLowerCase())) {
-      if (!isWriteOpFlag) {
+      if (!isWriteOpFlag && !sp.credential) {
         continue;
       }
       return {
@@ -920,6 +996,29 @@ function checkSensitivePath(command, cwd) {
       };
     }
   }
+  if (agentExt?.extra_sensitive_paths && agentExt.extra_sensitive_paths.length > 0) {
+    for (const sp of agentExt.extra_sensitive_paths) {
+      const spPath = sp.path.toLowerCase();
+      const expanded = `${expandedCwd}/${spPath}`;
+      if (command.includes(spPath) || command.includes(expanded.toLowerCase())) {
+        const denyMode = sp.deny_mode || (sp.credential ? "deny_both" : sp.read_only ? "deny_read" : "deny_write");
+        if (denyMode === "deny_read") {
+          if (isWriteOpFlag) continue;
+        } else if (denyMode === "deny_write") {
+          if (!isWriteOpFlag) continue;
+        }
+        return {
+          allowed: false,
+          reason: `\u5C1D\u8BD5\u8BBF\u95EE agent \u4E13\u5C5E\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
+          riskLevel: sp.risk_level,
+          riskType: "sensitive_path_access",
+          confidence: 90,
+          source: "logic_rule",
+          violatedLayers: ["2"]
+        };
+      }
+    }
+  }
   for (const cp of CREDENTIAL_PATHS) {
     const escaped = cp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     const re = cp.path.startsWith(".") ? new RegExp(`(?:^|[\\s/\\\\'"])${escaped}\\b`) : new RegExp(`\\b${escaped}\\b`);
@@ -1002,7 +1101,7 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
     return null;
   }
   const lowerDetail = actionDetail.toLowerCase();
-  const hasTraversal = DIR_TRAVERSAL_KEYWORDS2.some((kw) => lowerDetail.includes(kw));
+  const hasTraversal = DIR_TRAVERSAL_KW.some((kw) => lowerDetail.includes(kw));
   if (!hasTraversal) {
     return null;
   }
@@ -1071,18 +1170,19 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
     violatedLayers: ["2"]
   };
 }
-var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, READ_ONLY_REDIR_CMDS, WRITE_KEYWORDS, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KEYWORDS2;
+var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, READ_ONLY_REDIR_CMDS, WRITE_KEYWORDS, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
 var init_logic_rules = __esm({
   "src/engine/logic-rules.ts"() {
     "use strict";
     init_esm_shims();
     init_inline_analyzer();
+    init_agents();
     ROOT_SENSITIVE_PATHS = [
-      { path: "/etc/shadow", riskLevel: "critical", desc: "\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6" },
-      { path: "/etc/gshadow", riskLevel: "critical", desc: "\u7CFB\u7EDF\u7EC4\u5BC6\u7801\u6587\u4EF6" },
+      { path: "/etc/shadow", riskLevel: "critical", desc: "\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6", credential: true },
+      { path: "/etc/gshadow", riskLevel: "critical", desc: "\u7CFB\u7EDF\u7EC4\u5BC6\u7801\u6587\u4EF6", credential: true },
       // 注意：/etc/passwd 仅从 L1 启发式规则移除（公开可读），L2 敏感路径仍保留
       { path: "/etc/passwd", riskLevel: "high", desc: "\u7CFB\u7EDF\u7528\u6237\u6587\u4EF6" },
-      { path: "/etc/sudoers", riskLevel: "critical", desc: "sudo \u914D\u7F6E" },
+      { path: "/etc/sudoers", riskLevel: "critical", desc: "sudo \u914D\u7F6E", credential: true },
       // 系统配置（仅拦截写入）
       { path: "/etc/hosts", riskLevel: "medium", desc: "DNS \u89E3\u6790\u914D\u7F6E" },
       { path: "/etc/crontab", riskLevel: "high", desc: "\u7CFB\u7EDF\u5B9A\u65F6\u4EFB\u52A1" },
@@ -1100,19 +1200,19 @@ var init_logic_rules = __esm({
       { path: "/dev/mem", riskLevel: "critical", desc: "\u7269\u7406\u5185\u5B58\u8BBF\u95EE\u8BBE\u5907" },
       { path: "/dev/kmsg", riskLevel: "high", desc: "\u5185\u6838\u6D88\u606F\u7F13\u51B2\u533A" },
       // SSH 主机私钥
-      { path: "/etc/ssh/ssh_host_rsa_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A RSA \u79C1\u94A5" },
-      { path: "/etc/ssh/ssh_host_ed25519_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A Ed25519 \u79C1\u94A5" },
-      { path: "/etc/ssh/ssh_host_ecdsa_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A ECDSA \u79C1\u94A5" }
+      { path: "/etc/ssh/ssh_host_rsa_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A RSA \u79C1\u94A5", credential: true },
+      { path: "/etc/ssh/ssh_host_ed25519_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A Ed25519 \u79C1\u94A5", credential: true },
+      { path: "/etc/ssh/ssh_host_ecdsa_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A ECDSA \u79C1\u94A5", credential: true }
     ];
     HOME_SENSITIVE_PATHS = [
-      { path: ".ssh/id_rsa", riskLevel: "critical", desc: "SSH \u79C1\u94A5" },
-      { path: ".ssh/id_ed25519", riskLevel: "critical", desc: "SSH \u79C1\u94A5 (ed25519)" },
+      { path: ".ssh/id_rsa", riskLevel: "critical", desc: "SSH \u79C1\u94A5", credential: true },
+      { path: ".ssh/id_ed25519", riskLevel: "critical", desc: "SSH \u79C1\u94A5 (ed25519)", credential: true },
       { path: ".ssh/authorized_keys", riskLevel: "high", desc: "SSH \u6388\u6743\u5BC6\u94A5" },
       // 持久化与命令劫持（仅拦截写入）
       { path: ".bashrc", riskLevel: "high", desc: "\u7528\u6237 Shell \u521D\u59CB\u5316\u811A\u672C" },
       { path: ".bash_profile", riskLevel: "high", desc: "\u7528\u6237 Shell \u767B\u5F55\u811A\u672C" },
       { path: ".profile", riskLevel: "high", desc: "\u7528\u6237\u901A\u7528\u767B\u5F55\u811A\u672C" },
-      { path: ".aws/credentials", riskLevel: "critical", desc: "AWS \u51ED\u8BC1" },
+      { path: ".aws/credentials", riskLevel: "critical", desc: "AWS \u51ED\u8BC1", credential: true },
       { path: ".gitconfig", riskLevel: "medium", desc: "Git \u914D\u7F6E" },
       { path: ".gnupg", riskLevel: "high", desc: "GPG \u5BC6\u94A5\u76EE\u5F55" }
     ];
@@ -1157,7 +1257,7 @@ var init_logic_rules = __esm({
       }
     ];
     INLINE_SCRIPT_RE = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
-    DIR_TRAVERSAL_KEYWORDS2 = [
+    DIR_TRAVERSAL_KW = [
       "os.listdir",
       "os.walk",
       "os.scandir",
@@ -1173,21 +1273,21 @@ var init_logic_rules = __esm({
 });
 
 // src/engine/skill-loader.ts
-import { readFileSync, readdirSync as readdirSync2, existsSync as existsSync2 } from "fs";
-import { resolve, dirname } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { readFileSync as readFileSync2, readdirSync as readdirSync2, existsSync as existsSync3 } from "fs";
+import { resolve as resolve2, dirname as dirname2 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
 function loadAllSkills() {
   if (cachedSkills) return cachedSkills;
   cachedSkills = {};
-  const dir = existsSync2(SKILLS_DIR) ? SKILLS_DIR : SKILLS_DIR_FALLBACK;
-  if (!existsSync2(dir)) {
+  const dir = existsSync3(SKILLS_DIR) ? SKILLS_DIR : SKILLS_DIR_FALLBACK;
+  if (!existsSync3(dir)) {
     console.warn("[AgentMoss] Skills directory not found:", SKILLS_DIR, "and fallback:", SKILLS_DIR_FALLBACK);
     return cachedSkills;
   }
   const files = readdirSync2(dir).filter((f) => f.endsWith(".md"));
   for (const f of files) {
     const name = f.replace(".md", "");
-    cachedSkills[name] = readFileSync(resolve(dir, f), "utf-8");
+    cachedSkills[name] = readFileSync2(resolve2(dir, f), "utf-8");
   }
   console.log(`[AgentMoss] Loaded ${Object.keys(cachedSkills).length} skills from ${dir}`);
   return cachedSkills;
@@ -1241,15 +1341,15 @@ function formatSkillsForPrompt(skills) {
 ${s.skillContent}`
   ).join("\n\n---\n\n");
 }
-var __filename2, __dirname2, SKILLS_DIR, SKILLS_DIR_FALLBACK, SKILL_KEYWORD_MAP, cachedSkills;
+var __filename3, __dirname3, SKILLS_DIR, SKILLS_DIR_FALLBACK, SKILL_KEYWORD_MAP, cachedSkills;
 var init_skill_loader = __esm({
   "src/engine/skill-loader.ts"() {
     "use strict";
     init_esm_shims();
-    __filename2 = fileURLToPath2(import.meta.url);
-    __dirname2 = dirname(__filename2);
-    SKILLS_DIR = resolve(__dirname2, "../skills");
-    SKILLS_DIR_FALLBACK = resolve(__dirname2, "../../agent_moss/skills");
+    __filename3 = fileURLToPath3(import.meta.url);
+    __dirname3 = dirname2(__filename3);
+    SKILLS_DIR = resolve2(__dirname3, "../skills");
+    SKILLS_DIR_FALLBACK = resolve2(__dirname3, "../../../agent_moss/skills");
     SKILL_KEYWORD_MAP = {
       "file_access_guard": ["file", "\u6587\u4EF6", "path", "\u8DEF\u5F84", "read", "write", "cat", "open", "access", "\u8BBF\u95EE", "\u8BFB\u5199", "copy", "cp", "mv", "move"],
       "script_execution_guard": ["command", "shell", "bash", "exec", "execute", "\u6267\u884C", "\u547D\u4EE4", "script", "\u811A\u672C", "run", "\u8FD0\u884C", "subprocess", "system", "eval", "compile", "\u5B89\u88C5", "install", "pip", "npm"],
@@ -1272,44 +1372,44 @@ var init_skill_loader = __esm({
 });
 
 // src/engine/template-loader.ts
-import { readFileSync as readFileSync2, existsSync as existsSync3 } from "fs";
-import { resolve as resolve2, dirname as dirname2 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { readFileSync as readFileSync3, existsSync as existsSync4 } from "fs";
+import { resolve as resolve3, dirname as dirname3 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
 function loadTemplates() {
   if (cachedTemplates) return cachedTemplates;
   cachedTemplates = {};
-  const dir = existsSync3(TEMPLATES_DIR) ? TEMPLATES_DIR : TEMPLATES_DIR_FALLBACK;
-  if (!existsSync3(dir)) {
+  const dir = existsSync4(TEMPLATES_DIR) ? TEMPLATES_DIR : TEMPLATES_DIR_FALLBACK;
+  if (!existsSync4(dir)) {
     console.warn("[AgentMoss] Templates directory not found:", TEMPLATES_DIR, "and fallback:", TEMPLATES_DIR_FALLBACK);
     return cachedTemplates;
   }
   for (const file of TEMPLATE_FILES) {
-    const filePath = resolve2(dir, file);
-    if (existsSync3(filePath)) {
+    const filePath = resolve3(dir, file);
+    if (existsSync4(filePath)) {
       const key = file.replace(".txt", "").replace("_template", "");
-      cachedTemplates[key] = readFileSync2(filePath, "utf-8");
+      cachedTemplates[key] = readFileSync3(filePath, "utf-8");
     }
   }
   console.log(`[AgentMoss] Loaded ${Object.keys(cachedTemplates).length} templates from ${dir}`);
   return cachedTemplates;
 }
-var __filename3, __dirname3, TEMPLATES_DIR, TEMPLATES_DIR_FALLBACK, TEMPLATE_FILES, cachedTemplates;
+var __filename4, __dirname4, TEMPLATES_DIR, TEMPLATES_DIR_FALLBACK, TEMPLATE_FILES, cachedTemplates;
 var init_template_loader = __esm({
   "src/engine/template-loader.ts"() {
     "use strict";
     init_esm_shims();
-    __filename3 = fileURLToPath3(import.meta.url);
-    __dirname3 = dirname2(__filename3);
-    TEMPLATES_DIR = resolve2(__dirname3, "../templates");
-    TEMPLATES_DIR_FALLBACK = resolve2(__dirname3, "../../agent_moss/templates");
+    __filename4 = fileURLToPath4(import.meta.url);
+    __dirname4 = dirname3(__filename4);
+    TEMPLATES_DIR = resolve3(__dirname4, "../templates");
+    TEMPLATES_DIR_FALLBACK = resolve3(__dirname4, "../../../agent_moss/templates");
     TEMPLATE_FILES = ["prompt1_template.txt", "prompt2_template.txt", "security_judge_template.txt"];
     cachedTemplates = null;
   }
 });
 
 // src/engine/script-analyzer.ts
-import { readFileSync as readFileSync3 } from "fs";
-import { resolve as resolve3, join } from "path";
+import { readFileSync as readFileSync4 } from "fs";
+import { resolve as resolve4, join } from "path";
 function emptyResult() {
   return { scriptPath: "", scriptContent: "", matchedKeywords: [], lineCount: 0, isSuspicious: false, error: "", riskLevel: "", riskReason: "" };
 }
@@ -1362,8 +1462,8 @@ function assessKeywordCombinationRisk(matchedKeywords, scriptContent) {
 }
 function readScriptContent(scriptPath, maxLines = 500) {
   try {
-    const expandedPath = scriptPath.startsWith("~") ? join(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve3(scriptPath);
-    const raw = readFileSync3(expandedPath, "utf-8");
+    const expandedPath = scriptPath.startsWith("~") ? join(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve4(scriptPath);
+    const raw = readFileSync4(expandedPath, "utf-8");
     const lines = raw.split("\n").slice(0, maxLines);
     return { content: lines.join("\n"), lineCount: lines.length, error: "" };
   } catch (e) {
@@ -1500,6 +1600,712 @@ var init_script_analyzer = __esm({
   }
 });
 
+// src/engine/script-content-analyzer.ts
+import { readFileSync as readFileSync5, statSync, existsSync as existsSync5 } from "fs";
+import { resolve as resolve5, join as join2, isAbsolute, dirname as dirname4 } from "path";
+import { homedir } from "os";
+function emptyChain() {
+  return {
+    nodes: [],
+    entryPath: "",
+    maxDepthReached: false,
+    maxSizeReached: false,
+    totalSize: 0,
+    totalLines: 0,
+    hasCritical: false,
+    hasHigh: false,
+    firstHitNode: null,
+    error: ""
+  };
+}
+function newNode(path3, depth) {
+  return {
+    scriptPath: path3,
+    rawContent: "",
+    preprocessedContent: "",
+    lineCount: 0,
+    fileSize: 0,
+    depth,
+    childPaths: [],
+    error: "",
+    l1Hit: false,
+    l1RiskLevel: "",
+    l1RiskType: "",
+    l1Reason: "",
+    l1MatchedPatterns: [],
+    l2Hit: false,
+    l2ViolatedRule: "",
+    l2RiskLevel: "",
+    l2RiskType: "",
+    l2Reason: "",
+    matchedKeywords: [],
+    isSuspicious: false,
+    keywordRiskLevel: "",
+    keywordRiskReason: ""
+  };
+}
+function stripComments(content) {
+  return content.split("\n").filter((line) => !line.trimStart().startsWith("#")).join("\n");
+}
+function stripOutputText(content) {
+  let result = content.replace(/echo\s+".*?"/gs, 'echo ""');
+  result = result.replace(/echo\s+'.*?'/gs, "echo ''");
+  result = result.replace(/printf\s+".*?"[^\n]*/gs, 'printf ""');
+  result = result.replace(/printf\s+'.*?'[^\n]*/gs, "printf ''");
+  return result;
+}
+function expandSimpleVariables(content) {
+  const varMap = {};
+  const assignmentRe = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.+)$/;
+  const collectAssignments = (text) => {
+    for (const line of text.split("\n")) {
+      const m = line.match(assignmentRe);
+      if (m) {
+        const varName = m[1];
+        let varVal = m[2].trim();
+        if (varVal && !varVal.includes("$") && !varVal.includes("`")) {
+          if (varVal.startsWith('"') && varVal.endsWith('"') || varVal.startsWith("'") && varVal.endsWith("'")) {
+            varVal = varVal.slice(1, -1);
+          }
+          varMap[varName] = varVal;
+        }
+      }
+    }
+  };
+  collectAssignments(content);
+  let expanded = content;
+  for (let round = 0; round < 3; round++) {
+    const sortedVars = Object.keys(varMap).sort((a, b) => b.length - a.length);
+    let newExpanded = expanded;
+    for (const v of sortedVars) {
+      const val = varMap[v];
+      newExpanded = newExpanded.split("${" + v + "}").join(val);
+      newExpanded = newExpanded.split("$" + v).join(val);
+    }
+    if (newExpanded === expanded) break;
+    expanded = newExpanded;
+    collectAssignments(expanded);
+  }
+  return expanded;
+}
+function preprocessScriptContent(content) {
+  let result = stripComments(content);
+  result = stripOutputText(result);
+  result = expandSimpleVariables(result);
+  return result;
+}
+function scanScriptForKeywords2(content) {
+  const matched = [];
+  for (const { name, pattern } of SUSPICIOUS_PATTERNS2) {
+    if (pattern.test(content)) matched.push(name);
+  }
+  return matched;
+}
+function assessKeywordCombinationRisk2(matchedKeywords, scriptContent) {
+  if (matchedKeywords.length === 0) return { level: "", reason: "" };
+  const keywordSet = new Set(matchedKeywords);
+  for (const rule of KEYWORD_COMBINATION_RISKS2) {
+    const hitGroup1 = [...rule.group1].some((k) => keywordSet.has(k));
+    const hitGroup2 = rule.group2.size === 0 ? true : [...rule.group2].some((k) => keywordSet.has(k));
+    if (hitGroup1 && hitGroup2) return { level: rule.level, reason: rule.reason };
+  }
+  const networkPostKeywords = /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]);
+  const hasNetworkPost = [...networkPostKeywords].some((k) => keywordSet.has(k));
+  if (hasNetworkPost) {
+    const envPatterns = ["$env", "$(env)", "$USER", "$(hostname)", "$(pwd)", "$HOME"];
+    const contentLower = scriptContent.toLowerCase();
+    for (const p of envPatterns) {
+      if (contentLower.includes(p.toLowerCase())) {
+        return {
+          level: "critical",
+          reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + \u7CFB\u7EDF\u73AF\u5883\u53D8\u91CF\u6536\u96C6\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u6570\u636E\u5916\u4F20\u98CE\u9669\u3002\u811A\u672C\u53EF\u80FD\u5C06\u7528\u6237\u73AF\u5883\u53D8\u91CF\uFF08\u53EF\u80FD\u5305\u542B API Key\u3001\u5BC6\u94A5\u7B49\u654F\u611F\u4FE1\u606F\uFF09\u53D1\u9001\u5230\u8FDC\u7A0B\u670D\u52A1\u5668\u3002"
+        };
+      }
+    }
+  }
+  let bestLevel = "";
+  let bestReason = "";
+  for (const kw of matchedKeywords) {
+    const risk = SINGLE_KEYWORD_RISKS2[kw];
+    if (risk && (LEVEL_ORDER2[risk.level] || 0) > (LEVEL_ORDER2[bestLevel] || 0)) {
+      bestLevel = risk.level;
+      bestReason = risk.reason;
+    }
+  }
+  return { level: bestLevel, reason: bestReason };
+}
+function extractScriptPath2(command) {
+  for (const pattern of SCRIPT_EXEC_PATTERNS2) {
+    const m = command.match(pattern);
+    if (m) return m[1];
+  }
+  return null;
+}
+function extractInlineScriptPath(actionDetail) {
+  const re = /open\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+  let m;
+  while ((m = re.exec(actionDetail)) !== null) {
+    const p = m[1];
+    let resolved;
+    try {
+      resolved = resolvePath(p);
+      if (existsSync5(resolved)) {
+        const stat = statSync(resolved);
+        if (stat.isFile()) return resolved;
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function resolvePath(p) {
+  let expanded = p;
+  if (expanded.startsWith("~/") || expanded === "~") {
+    expanded = join2(homedir(), expanded.slice(1));
+  }
+  return resolve5(expanded);
+}
+function readScriptContent2(scriptPath, maxFileSize = 2 * 1024 * 1024) {
+  try {
+    const path3 = resolvePath(scriptPath);
+    if (!existsSync5(path3)) return { content: "", lineCount: 0, fileSize: 0, error: `\u811A\u672C\u4E0D\u5B58\u5728: ${scriptPath}` };
+    const stat = statSync(path3);
+    if (!stat.isFile()) return { content: "", lineCount: 0, fileSize: 0, error: `\u4E0D\u662F\u6587\u4EF6: ${scriptPath}` };
+    if (stat.size > maxFileSize) {
+      return { content: "", lineCount: 0, fileSize: stat.size, error: `\u811A\u672C\u6587\u4EF6\u8FC7\u5927 (${stat.size} bytes)\uFF0C\u8DF3\u8FC7\u8BFB\u53D6` };
+    }
+    const content = readFileSync5(path3, "utf-8");
+    const lineCount = content ? content.split("\n").length : 0;
+    return { content, lineCount, fileSize: stat.size, error: "" };
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    return { content: "", lineCount: 0, fileSize: 0, error: `\u8BFB\u53D6\u811A\u672C\u5931\u8D25: ${msg}` };
+  }
+}
+function extractChildScriptPaths(content, baseDir) {
+  const paths = [];
+  for (const pattern of CHILD_SCRIPT_PATTERNS) {
+    pattern.lastIndex = 0;
+    let m;
+    while ((m = pattern.exec(content)) !== null) {
+      const pathStr = m[1];
+      if (pathStr.startsWith("-") || pathStr.startsWith("$")) continue;
+      if (pathStr.includes("/dev/") || pathStr.startsWith("|") || pathStr.startsWith(";")) continue;
+      const full = isAbsolute(pathStr) ? pathStr : join2(baseDir, pathStr);
+      const resolved = resolvePath(full);
+      if (existsSync5(resolved)) {
+        try {
+          if (statSync(resolved).isFile() && !paths.includes(resolved)) paths.push(resolved);
+        } catch {
+        }
+      }
+    }
+  }
+  return paths;
+}
+function resolveScriptChain(entryPath, input, maxDepth = 3, maxFileSize = 2 * 1024 * 1024, maxTotalSize = 6 * 1024 * 1024) {
+  const visited = /* @__PURE__ */ new Set();
+  const result = emptyChain();
+  result.entryPath = entryPath;
+  const entry = resolvePath(entryPath);
+  const baseDir = existsSync5(entry) ? dirname4(entry) : input.cwd || process.cwd();
+  resolveRecursive({
+    path: entry,
+    depth: 0,
+    maxDepth,
+    maxFileSize,
+    maxTotalSize,
+    visited,
+    result,
+    baseDir,
+    input
+  });
+  result.hasCritical = result.nodes.some((n) => n.l1RiskLevel === "critical" || n.l2RiskLevel === "critical" || n.keywordRiskLevel === "critical");
+  result.hasHigh = result.nodes.some((n) => ["high", "critical"].includes(n.l1RiskLevel) || ["high", "critical"].includes(n.l2RiskLevel) || ["high", "critical"].includes(n.keywordRiskLevel));
+  result.firstHitNode = result.nodes.find((n) => n.l1Hit || n.l2Hit || n.isSuspicious) || null;
+  return result;
+}
+function resolveRecursive(ctx) {
+  const { path: path3, depth, maxDepth, maxFileSize, maxTotalSize, visited, result, baseDir, input } = ctx;
+  if (visited.has(path3)) return;
+  if (depth > maxDepth) {
+    result.maxDepthReached = true;
+    return;
+  }
+  if (result.totalSize >= maxTotalSize) {
+    result.maxSizeReached = true;
+    return;
+  }
+  visited.add(path3);
+  const { content, lineCount, fileSize, error } = readScriptContent2(path3, maxFileSize);
+  if (error) {
+    const node2 = newNode(path3, depth);
+    node2.error = error;
+    node2.fileSize = fileSize;
+    node2.lineCount = lineCount;
+    result.nodes.push(node2);
+    return;
+  }
+  result.totalSize += fileSize;
+  result.totalLines += lineCount;
+  const preprocessed = preprocessScriptContent(content);
+  const node = newNode(path3, depth);
+  node.rawContent = content;
+  node.preprocessedContent = preprocessed;
+  node.lineCount = lineCount;
+  node.fileSize = fileSize;
+  result.nodes.push(node);
+  const virtualInput = {
+    ...input,
+    aNext: { actionType: "bash", actionDetail: preprocessed }
+  };
+  const l1 = runHeuristicCheck(virtualInput);
+  if (l1 && !l1.allowed) {
+    node.l1Hit = true;
+    node.l1RiskLevel = l1.riskLevel;
+    node.l1RiskType = l1.riskType;
+    node.l1Reason = l1.reason;
+    node.l1MatchedPatterns = [];
+    if (l1.riskLevel === "critical") {
+      result.hasCritical = true;
+      result.firstHitNode = node;
+      return;
+    }
+  }
+  const childPaths = extractChildScriptPaths(preprocessed, baseDir);
+  node.childPaths = childPaths;
+  for (const childPath of childPaths) {
+    resolveRecursive({
+      path: resolvePath(childPath),
+      depth: depth + 1,
+      maxDepth,
+      maxFileSize,
+      maxTotalSize,
+      visited,
+      result,
+      baseDir: dirname4(resolvePath(childPath)),
+      input
+    });
+    if (result.hasCritical) return;
+  }
+}
+function scanScriptChainWithL1(chain, input) {
+  for (const node of chain.nodes) {
+    if (node.error || !node.preprocessedContent || node.l1Hit) continue;
+    const virtualInput = {
+      ...input,
+      aNext: { actionType: "bash", actionDetail: node.preprocessedContent }
+    };
+    const l1 = runHeuristicCheck(virtualInput);
+    if (l1 && !l1.allowed) {
+      node.l1Hit = true;
+      node.l1RiskLevel = l1.riskLevel;
+      node.l1RiskType = l1.riskType;
+      node.l1Reason = l1.reason;
+      if (l1.riskLevel === "critical") {
+        chain.hasCritical = true;
+        chain.firstHitNode = node;
+        break;
+      }
+    }
+  }
+  return chain;
+}
+function scanScriptChainWithL2(chain, input) {
+  for (const node of chain.nodes) {
+    if (node.error || !node.preprocessedContent) continue;
+    if (node.l1RiskLevel === "critical") break;
+    const virtualInput = {
+      ...input,
+      aNext: { actionType: "bash", actionDetail: node.preprocessedContent }
+    };
+    const l2 = runLogicCheck(virtualInput);
+    if (l2 && !l2.allowed) {
+      node.l2Hit = true;
+      node.l2ViolatedRule = `script_logic:${node.scriptPath}`;
+      node.l2RiskLevel = l2.riskLevel;
+      node.l2RiskType = l2.riskType;
+      node.l2Reason = `\u811A\u672C ${node.scriptPath} (\u6DF1\u5EA6 ${node.depth}) \u4E2D: ${l2.reason}`;
+      if (l2.riskLevel === "critical") {
+        chain.hasCritical = true;
+        chain.firstHitNode = node;
+        break;
+      }
+    }
+  }
+  if (!chain.hasHigh) {
+    chain.hasHigh = chain.nodes.some((n) => ["high", "critical"].includes(n.l2RiskLevel));
+  }
+  return chain;
+}
+function scanScriptChainKeywords(chain) {
+  for (const node of chain.nodes) {
+    if (node.error || !node.preprocessedContent) continue;
+    if (node.l1Hit || node.l2Hit) continue;
+    const matched = scanScriptForKeywords2(node.preprocessedContent);
+    node.matchedKeywords = matched;
+    node.isSuspicious = matched.length > 0;
+    if (matched.length > 0) {
+      const risk = assessKeywordCombinationRisk2(matched, node.preprocessedContent);
+      node.keywordRiskLevel = risk.level;
+      node.keywordRiskReason = risk.reason;
+    }
+  }
+  return chain;
+}
+function analyzeScriptContent2(input) {
+  const actionType = input.aNext.actionType.toLowerCase();
+  if (actionType !== "bash") return emptyChain();
+  const scriptPath = extractScriptPath2(input.aNext.actionDetail);
+  let resolvedPath = scriptPath;
+  if (!resolvedPath) {
+    const inline = extractInlineScriptPath(input.aNext.actionDetail);
+    if (!inline) return emptyChain();
+    resolvedPath = inline;
+  }
+  const chain = resolveScriptChain(resolvedPath, input);
+  if (chain.nodes.length === 0) return chain;
+  scanScriptChainWithL1(chain, input);
+  scanScriptChainWithL2(chain, input);
+  scanScriptChainKeywords(chain);
+  return chain;
+}
+function formatScriptChainForPrompt(chain) {
+  if (chain.nodes.length === 0) return "";
+  const errorNodes = chain.nodes.filter((n) => n.error);
+  if (errorNodes.length > 0 && chain.nodes.length === 1) {
+    return `\u26A0\uFE0F \u811A\u672C\u5185\u5BB9\u5206\u6790\u5931\u8D25: ${errorNodes[0].error}`;
+  }
+  const suspiciousNodes = chain.nodes.filter((n) => n.isSuspicious && !n.l1Hit && !n.l2Hit);
+  if (suspiciousNodes.length === 0) {
+    const safeNodes = chain.nodes.filter((n) => !n.error);
+    if (safeNodes.length === 0) return "";
+    const parts2 = ["\u2713 \u811A\u672C\u5185\u5BB9\u5DF2\u5206\u6790\uFF0C\u672A\u53D1\u73B0\u5371\u9669/\u53EF\u7591\u64CD\u4F5C\uFF08L1/L2/\u5173\u952E\u8BCD\u626B\u63CF\u5747\u672A\u547D\u4E2D\uFF09\uFF1A"];
+    for (const node of safeNodes) {
+      const pre = node.preprocessedContent || "";
+      let preview = pre.slice(0, 600);
+      if (pre.length > 600) preview += `
+... (\u622A\u65AD\uFF0C\u5B8C\u6574\u5185\u5BB9 ${pre.length} \u5B57\u7B26)`;
+      parts2.push(
+        `   \u811A\u672C\u8DEF\u5F84: ${node.scriptPath}\uFF08\u9012\u5F52\u6DF1\u5EA6 ${node.depth}\uFF0C${node.lineCount} \u884C\uFF09
+   \u5185\u5BB9\uFF08\u9884\u5904\u7406\u540E\uFF09:
+\`\`\`
+${preview}
+\`\`\``
+      );
+    }
+    return parts2.join("\n");
+  }
+  const parts = [];
+  for (const node of suspiciousNodes) {
+    const keywordsStr = node.matchedKeywords.join(", ");
+    let riskHint = "";
+    if (node.keywordRiskLevel && node.keywordRiskReason) {
+      riskHint = `
+
+\u{1F534} **\u98CE\u9669\u8BC4\u4F30**: ${node.keywordRiskLevel.toUpperCase()} \u7EA7\u522B
+**\u98CE\u9669\u539F\u56E0**: ${node.keywordRiskReason}
+**\u5EFA\u8BAE**: \u6B64\u811A\u672C\u5E94\u88AB\u62D2\u7EDD\uFF08Deny\uFF09\uFF0C\u9664\u975E\u6709\u660E\u786E\u7684\u4E1A\u52A1\u9700\u6C42\u4E14\u5DF2\u786E\u8BA4\u76EE\u6807\u670D\u52A1\u5668\u53EF\u4FE1\u3002`;
+    }
+    const pre = node.preprocessedContent;
+    let contentPreview = pre.slice(0, 2e3);
+    if (pre.length > 2e3) contentPreview += `
+... (\u622A\u65AD\uFF0C\u5B8C\u6574\u5185\u5BB9 ${pre.length} \u5B57\u7B26)`;
+    parts.push(
+      `\u26A0\uFE0F \u811A\u672C\u5185\u5BB9\u5305\u542B\u53EF\u7591\u5173\u952E\u8BCD:
+   \u811A\u672C\u8DEF\u5F84: ${node.scriptPath}
+   \u9012\u5F52\u6DF1\u5EA6: ${node.depth}
+   \u53EF\u7591\u5173\u952E\u8BCD: ${keywordsStr}
+   \u811A\u672C\u884C\u6570: ${node.lineCount}${riskHint}
+
+### \u811A\u672C\u5185\u5BB9\uFF08\u9884\u5904\u7406\u540E\uFF09###
+\`\`\`
+${contentPreview}
+\`\`\`
+`
+    );
+  }
+  let header = `\u26A0\uFE0F \u68C0\u6D4B\u5230\u811A\u672C\u6267\u884C\u94FE\uFF08\u5171 ${chain.nodes.length} \u4E2A\u811A\u672C\uFF09\uFF0C\u5176\u4E2D ${suspiciousNodes.length} \u4E2A\u5305\u542B\u53EF\u7591\u5173\u952E\u8BCD:
+`;
+  if (chain.maxDepthReached) header += "\u26A0\uFE0F \u6CE8\u610F\uFF1A\u9012\u5F52\u8FFD\u8E2A\u89E6\u8FBE\u6DF1\u5EA6\u4E0A\u9650\uFF0C\u53EF\u80FD\u5B58\u5728\u66F4\u6DF1\u5C42\u7684\u811A\u672C\u8C03\u7528\u672A\u88AB\u626B\u63CF\u3002\n";
+  if (chain.maxSizeReached) header += "\u26A0\uFE0F \u6CE8\u610F\uFF1A\u7D2F\u8BA1\u6587\u4EF6\u5927\u5C0F\u89E6\u8FBE\u4E0A\u9650\uFF0C\u90E8\u5206\u811A\u672C\u53EF\u80FD\u672A\u88AB\u5B8C\u6574\u8BFB\u53D6\u3002\n";
+  return header + parts.join("\n---\n\n");
+}
+var SUSPICIOUS_PATTERNS2, SCRIPT_EXEC_PATTERNS2, KEYWORD_COMBINATION_RISKS2, SINGLE_KEYWORD_RISKS2, LEVEL_ORDER2, CHILD_SCRIPT_PATTERNS;
+var init_script_content_analyzer = __esm({
+  "src/engine/script-content-analyzer.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_heuristic();
+    init_logic_rules();
+    SUSPICIOUS_PATTERNS2 = [
+      { name: "curl POST", pattern: /curl\s+(.*\s)?-X\s+POST/i },
+      { name: "curl --data", pattern: /curl\s+(.*\s)?--data/i },
+      { name: "curl -d", pattern: /curl\s+(.*\s)?-d\s/i },
+      { name: "wget --post-data", pattern: /wget\s+(.*\s)?--post-data/i },
+      { name: "wget --post-file", pattern: /wget\s+(.*\s)?--post-file/i },
+      { name: "nc -e", pattern: /\bnc\s+.*-e\b/ },
+      { name: "ncat -e", pattern: /\bncat\s+.*-e\b/ },
+      { name: "/dev/tcp", pattern: /\/dev\/tcp\// },
+      { name: "/dev/udp", pattern: /\/dev\/udp\// },
+      { name: "$(base64", pattern: /\$\(\s*base64/ },
+      { name: "`base64", pattern: /`\s*base64/ },
+      { name: "base64 decode pipe", pattern: /base64\s+(-d|--decode)\s*\|/ },
+      { name: "/etc/shadow", pattern: /\/etc\/shadow/ },
+      { name: "id_rsa", pattern: /\bid_rsa\b/ },
+      { name: "id_ed25519", pattern: /\bid_ed25519\b/ },
+      { name: "crontab install", pattern: /crontab\s+-/ },
+      { name: "authorized_keys", pattern: /authorized_keys/ },
+      { name: "ssh no host key check", pattern: /ssh\s+.*StrictHostKeyChecking\s*=\s*no/ }
+    ];
+    SCRIPT_EXEC_PATTERNS2 = [
+      /(?:^|\s|&&|\|\|)\s*bash\s+(\S+)/i,
+      /(?:^|\s|&&|\|\|)\s*\/bin\/bash\s+(\S+)/i,
+      /(?:^|\s|&&|\|\|)\s*sh\s+(\S+)/i,
+      /(?:^|\s|&&|\|\|)\s*zsh\s+(\S+)/i,
+      /\.\/(\S+)/,
+      /(?:^|\s|&&|\|\|)\s*source\s+(\S+)/i,
+      /(?:^|\s|&&|\|\|)\s*\.\s+(\S+)/,
+      /(?:^|\s|&&|\|\|)\s*python3?\s+(\S+\.py)/i,
+      /(?:^|\s|&&|\|\|)\s*node\s+(\S+\.js)/i,
+      /(?:^|\s|&&|\|\|)\s*ruby\s+(\S+\.rb)/i,
+      /(?:^|\s|&&|\|\|)\s*perl\s+(\S+\.pl)/i,
+      /(?:^|\s|&&|\|\|)\s*php\s+(\S+\.php)/i,
+      /(?:^|\s|&&|\|\|)\s*lua\s+(\S+\.lua)/i
+    ];
+    KEYWORD_COMBINATION_RISKS2 = [
+      {
+        group1: /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]),
+        group2: /* @__PURE__ */ new Set(["$(base64", "`base64", "base64 decode pipe"]),
+        level: "critical",
+        reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + Base64\u7F16\u7801\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u6570\u636E\u5916\u4F20\u98CE\u9669\u3002\u653B\u51FB\u8005\u53EF\u80FD\u5C06\u654F\u611F\u6570\u636E\u7F16\u7801\u540E\u5916\u4F20\u3002"
+      },
+      {
+        group1: /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]),
+        group2: /* @__PURE__ */ new Set(["/etc/shadow", "id_rsa", "id_ed25519"]),
+        level: "critical",
+        reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + \u654F\u611F\u6587\u4EF6\u8BBF\u95EE\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u51ED\u8BC1\u5916\u4F20\u98CE\u9669\u3002"
+      },
+      {
+        group1: /* @__PURE__ */ new Set(["nc -e", "ncat -e", "/dev/tcp", "/dev/udp"]),
+        group2: /* @__PURE__ */ new Set(),
+        level: "high",
+        reason: "\u68C0\u6D4B\u5230\u53CD\u5F39 Shell \u7279\u5F81\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5EFA\u7ACB\u8FDC\u7A0B\u63A7\u5236\u901A\u9053\u3002"
+      },
+      {
+        group1: /* @__PURE__ */ new Set(["crontab install", "authorized_keys", "ssh no host key check"]),
+        group2: /* @__PURE__ */ new Set(),
+        level: "high",
+        reason: "\u68C0\u6D4B\u5230\u6301\u4E45\u5316\u540E\u95E8\u7279\u5F81\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5728\u7CFB\u7EDF\u4E2D\u690D\u5165\u540E\u95E8\u3002"
+      }
+    ];
+    SINGLE_KEYWORD_RISKS2 = {
+      "curl POST": { level: "high", reason: "\u68C0\u6D4B\u5230 curl POST \u8BF7\u6C42\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+      "curl --data": { level: "high", reason: "\u68C0\u6D4B\u5230 curl --data \u53C2\u6570\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+      "curl -d": { level: "high", reason: "\u68C0\u6D4B\u5230 curl -d \u53C2\u6570\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+      "wget --post-data": { level: "high", reason: "\u68C0\u6D4B\u5230 wget POST \u8BF7\u6C42\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+      "wget --post-file": { level: "high", reason: "\u68C0\u6D4B\u5230 wget \u6587\u4EF6\u4E0A\u4F20\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6587\u4EF6\u3002" },
+      "nc -e": { level: "critical", reason: "\u68C0\u6D4B\u5230 nc -e \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+      "ncat -e": { level: "critical", reason: "\u68C0\u6D4B\u5230 ncat -e \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+      "/dev/tcp": { level: "critical", reason: "\u68C0\u6D4B\u5230 /dev/tcp \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+      "/dev/udp": { level: "critical", reason: "\u68C0\u6D4B\u5230 /dev/udp \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+      "$(base64": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u7F16\u7801\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
+      "`base64": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u7F16\u7801\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
+      "base64 decode pipe": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u89E3\u7801\u540E\u7BA1\u9053\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
+      "/etc/shadow": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6\u3002" },
+      "id_rsa": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE SSH \u79C1\u94A5\u3002" },
+      "id_ed25519": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE SSH \u79C1\u94A5\u3002" },
+      "crontab install": { level: "high", reason: "\u68C0\u6D4B\u5230\u4FEE\u6539\u5B9A\u65F6\u4EFB\u52A1\uFF0C\u53EF\u80FD\u662F\u6301\u4E45\u5316\u540E\u95E8\u3002" },
+      "authorized_keys": { level: "high", reason: "\u68C0\u6D4B\u5230\u4FEE\u6539 SSH \u6388\u6743\u5BC6\u94A5\uFF0C\u53EF\u80FD\u662F\u6301\u4E45\u5316\u540E\u95E8\u3002" },
+      "ssh no host key check": { level: "high", reason: "\u68C0\u6D4B\u5230 SSH \u8DF3\u8FC7\u4E3B\u673A\u5BC6\u94A5\u9A8C\u8BC1\uFF0C\u53EF\u80FD\u662F\u6A2A\u5411\u79FB\u52A8\u3002" }
+    };
+    LEVEL_ORDER2 = { low: 1, medium: 2, high: 3, critical: 4 };
+    CHILD_SCRIPT_PATTERNS = [
+      /(?:^|\s|&&|\|\|)\s*bash\s+(\S+)/i,
+      /(?:^|\s|&&|\|\|)\s*sh\s+(\S+)/i,
+      /(?:^|\s|&&|\|\|)\s*source\s+(\S+)/i,
+      /(?:^|\s|&&|\|\|)\s*\.\s+(\S+)/,
+      /(?:^|\s|&&|\|\|)\s*python3?\s+(\S+\.py)/i,
+      /(?:^|\s|&&|\|\|)\s*node\s+(\S+\.js)/i,
+      /(?:^|\s|&&|\|\|)\s*ruby\s+(\S+\.rb)/i,
+      /(?:^|\s|&&|\|\|)\s*perl\s+(\S+\.pl)/i,
+      /(?:^|\s|&&|\|\|)\s*php\s+(\S+\.php)/i,
+      /(?:^|\s|&&|\|\|)\s*lua\s+(\S+\.lua)/i
+    ];
+  }
+});
+
+// src/engine/token-stats.ts
+var token_stats_exports = {};
+__export(token_stats_exports, {
+  getRecentRecords: () => getRecentRecords,
+  getTokenStats: () => getTokenStats,
+  getTokenTrend: () => getTokenTrend,
+  recordTokenUsage: () => recordTokenUsage,
+  resetTokenStats: () => resetTokenStats
+});
+import { readFileSync as readFileSync6, writeFileSync, existsSync as existsSync6, mkdirSync, unlinkSync } from "fs";
+import { join as join3 } from "path";
+import { homedir as homedir2 } from "os";
+function getStatsPath() {
+  const envPath = process.env[ENV_STATS_PATH];
+  return envPath || STATS_FILE;
+}
+function loadAllRecords(statsPath) {
+  if (!existsSync6(statsPath)) return [];
+  try {
+    const data = JSON.parse(readFileSync6(statsPath, "utf-8"));
+    if (Array.isArray(data)) return data;
+    if (data && Array.isArray(data.records)) return data.records;
+    return [];
+  } catch (e) {
+    return [];
+  }
+}
+function saveRecords(statsPath, records) {
+  try {
+    const dir = statsPath.substring(0, statsPath.lastIndexOf("/"));
+    if (dir && !existsSync6(dir)) mkdirSync(dir, { recursive: true });
+    writeFileSync(statsPath, JSON.stringify(records, null, 2), "utf-8");
+  } catch (e) {
+  }
+}
+function recordTokenUsage(record) {
+  const statsPath = getStatsPath();
+  const records = loadAllRecords(statsPath);
+  records.push({
+    timestamp: record.timestamp || (/* @__PURE__ */ new Date()).toISOString(),
+    session_id: record.sessionId,
+    step: record.step,
+    model: record.model,
+    prompt_tokens: record.promptTokens,
+    completion_tokens: record.completionTokens,
+    total_tokens: record.totalTokens
+  });
+  if (records.length > MAX_RECORDS) {
+    records.splice(0, records.length - MAX_RECORDS);
+  }
+  saveRecords(statsPath, records);
+}
+function filterByDate(records, days = 0, startDate, endDate) {
+  if (startDate || endDate) {
+    let startDt = startDate ? new Date(startDate) : /* @__PURE__ */ new Date(-864e13);
+    let endDt = endDate ? new Date(endDate) : void 0;
+    if (endDate) {
+      const e = new Date(endDate);
+      e.setHours(23, 59, 59, 999);
+      endDt = e;
+    }
+    const endMs = endDt ? endDt.getTime() : Number.MAX_SAFE_INTEGER;
+    return records.filter((r) => {
+      try {
+        const ts = new Date(r.timestamp).getTime();
+        return ts >= startDt.getTime() && ts <= endMs;
+      } catch {
+        return true;
+      }
+    });
+  } else if (days > 0) {
+    const cutoff = Date.now() - days * 864e5;
+    return records.filter((r) => {
+      try {
+        return new Date(r.timestamp).getTime() >= cutoff;
+      } catch {
+        return true;
+      }
+    });
+  }
+  return records;
+}
+function aggregate(records) {
+  let totalPrompt = 0, totalCompletion = 0, totalTotal = 0;
+  const byStep = {};
+  const byModel = {};
+  const byDate = {};
+  const bucket = (b, key, r) => {
+    const e = b[key] || (b[key] = { prompt_tokens: 0, completion_tokens: 0, total_tokens: 0, calls: 0 });
+    e.prompt_tokens += r.prompt_tokens || 0;
+    e.completion_tokens += r.completion_tokens || 0;
+    e.total_tokens += r.total_tokens || 0;
+    e.calls += 1;
+  };
+  for (const r of records) {
+    totalPrompt += r.prompt_tokens || 0;
+    totalCompletion += r.completion_tokens || 0;
+    totalTotal += r.total_tokens || 0;
+    bucket(byStep, r.step || "unknown", r);
+    bucket(byModel, r.model || "unknown", r);
+    let dateKey = "unknown";
+    try {
+      dateKey = new Date(r.timestamp).toISOString().slice(0, 10);
+    } catch {
+    }
+    bucket(byDate, dateKey, r);
+  }
+  const sortedDate = Object.keys(byDate).sort((a, b) => a < b ? 1 : a > b ? -1 : 0);
+  const sortedByDate = {};
+  for (const k of sortedDate) sortedByDate[k] = byDate[k];
+  return { totalPrompt, totalCompletion, totalTotal, byStep, byModel, byDate: sortedByDate };
+}
+function getTokenStats(days = 0, startDate, endDate) {
+  const records = filterByDate(loadAllRecords(getStatsPath()), days, startDate, endDate);
+  const a = aggregate(records);
+  return {
+    total_prompt_tokens: a.totalPrompt,
+    total_completion_tokens: a.totalCompletion,
+    total_tokens: a.totalTotal,
+    total_calls: records.length,
+    by_step: a.byStep,
+    by_model: a.byModel,
+    by_date: a.byDate
+  };
+}
+function getRecentRecords(limit = 20) {
+  const records = loadAllRecords(getStatsPath());
+  return records.slice(-limit);
+}
+function getTokenTrend(days = 0, startDate, endDate) {
+  const records = filterByDate(loadAllRecords(getStatsPath()), days, startDate, endDate);
+  const series = {};
+  const datesSet = /* @__PURE__ */ new Set();
+  for (const r of records) {
+    let dateKey;
+    try {
+      dateKey = new Date(r.timestamp).toISOString().slice(0, 10);
+    } catch {
+      continue;
+    }
+    const model = r.model || "unknown";
+    const tokens = r.total_tokens || 0;
+    datesSet.add(dateKey);
+    series[model] = series[model] || {};
+    series[model][dateKey] = (series[model][dateKey] || 0) + tokens;
+  }
+  const dates = Array.from(datesSet).sort();
+  const models = Object.keys(series).sort();
+  return { dates, models, series };
+}
+function resetTokenStats() {
+  const statsPath = getStatsPath();
+  if (existsSync6(statsPath)) {
+    try {
+      unlinkSync(statsPath);
+    } catch {
+    }
+  }
+}
+var STATS_DIR, STATS_FILE, ENV_STATS_PATH, MAX_RECORDS;
+var init_token_stats = __esm({
+  "src/engine/token-stats.ts"() {
+    "use strict";
+    init_esm_shims();
+    STATS_DIR = join3(homedir2(), ".config", "agentmoss");
+    STATS_FILE = join3(STATS_DIR, "agent_moss_token_stats.json");
+    ENV_STATS_PATH = "AGENT_MOSS_TOKEN_STATS_PATH";
+    MAX_RECORDS = 1e4;
+  }
+});
+
 // src/engine/llm-analyzer.ts
 import OpenAI from "openai";
 async function runLLMAnalysis(input, previous) {
@@ -1526,8 +2332,14 @@ async function runLLMAnalysis(input, previous) {
   }
   const matchedSkills = matchSkills(input.aNext.actionType, input.aNext.actionDetail, input.reason);
   const templates = loadTemplates();
-  const scriptAnalysis = analyzeScriptContent(input.aNext.actionType, input.aNext.actionDetail);
-  const prompt = buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis);
+  let scriptAnalysis;
+  let scriptChainText = "";
+  if (previous.scriptChain) {
+    scriptChainText = formatScriptChainForPrompt(previous.scriptChain);
+  } else {
+    scriptAnalysis = analyzeScriptContent(input.aNext.actionType, input.aNext.actionDetail);
+  }
+  const prompt = buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis, previous.skipL3Hints ?? "", scriptChainText);
   const result = await analyzeWithLLM(prompt, config);
   if (llmCache.size >= LLM_CACHE_MAX) {
     const firstKey = llmCache.keys().next().value;
@@ -1536,14 +2348,14 @@ async function runLLMAnalysis(input, previous) {
   llmCache.set(cacheKey, result);
   return result;
 }
-function buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis) {
+function buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis, skipL3Hints = "", scriptChainText = "") {
   const skillsText = formatSkillsForPrompt(matchedSkills);
   const historyStr = input.actionHistory.map((h, i) => `${i + 1}. ${h.actionType}: ${h.actionDetail}`).join("\n") || "(\u65E0\u5386\u53F2\u64CD\u4F5C)";
-  const scriptAnalysisText = scriptAnalysis ? formatScriptAnalysisForPrompt(scriptAnalysis) : "";
+  const scriptAnalysisText = scriptChainText ? scriptChainText : scriptAnalysis ? formatScriptAnalysisForPrompt(scriptAnalysis) : "";
   const hintsText = formatHints(previous);
   const securityJudgeTemplate = templates["security_judge"];
   if (securityJudgeTemplate) {
-    return securityJudgeTemplate.replaceAll("{prompt_session}", input.promptSession || "\uFF08\u672A\u63D0\u4F9B\uFF09").replaceAll("{action_history}", historyStr).replaceAll("{action_type}", input.aNext.actionType).replaceAll("{action_detail}", input.aNext.actionDetail).replaceAll("{reason}", input.reason || "\u672A\u8BF4\u660E").replaceAll("{skills_text}", skillsText).replaceAll("{hints_text}", hintsText).replaceAll("{script_analysis_text}", scriptAnalysisText).replaceAll("{{", "{").replaceAll("}}", "}");
+    return securityJudgeTemplate.replaceAll("{prompt_session}", input.promptSession || "\uFF08\u672A\u63D0\u4F9B\uFF09").replaceAll("{action_history}", historyStr).replaceAll("{action_type}", input.aNext.actionType).replaceAll("{action_detail}", input.aNext.actionDetail).replaceAll("{reason}", input.reason || "\u672A\u8BF4\u660E").replaceAll("{skills_text}", skillsText).replaceAll("{hints_text}", hintsText).replaceAll("{script_analysis_text}", scriptAnalysisText).replaceAll("{skip_l3_hints}", skipL3Hints).replaceAll("{{", "{").replaceAll("}}", "}");
   }
   console.warn("[AgentMoss] security_judge template missing, using sparse fallback prompt");
   return `## \u5F53\u524D\u64CD\u4F5C\u4E0A\u4E0B\u6587
@@ -1636,6 +2448,19 @@ async function analyzeWithLLM(prompt, config) {
         jsonStr = jsonStr.replace(/^```[\w]*\n?/, "").replace(/\n?```$/, "");
       }
       const parsed = JSON.parse(jsonStr);
+      try {
+        const usage = response.usage;
+        const { recordTokenUsage: recordTokenUsage2 } = await Promise.resolve().then(() => (init_token_stats(), token_stats_exports));
+        recordTokenUsage2({
+          sessionId: "audit",
+          step: "L3_security_judge",
+          model: response.model || config.model,
+          promptTokens: usage?.prompt_tokens || 0,
+          completionTokens: usage?.completion_tokens || 0,
+          totalTokens: usage?.total_tokens || 0
+        });
+      } catch {
+      }
       clearTimeout(totalTimeoutTimer);
       return {
         allowed: parsed.allowed !== false,
@@ -1653,32 +2478,16 @@ async function analyzeWithLLM(prompt, config) {
       }
       if (attempt < maxRetries) {
         console.error(`[AgentMoss] LLM call failed (attempt ${attempt + 1}/${maxRetries + 1}), retrying in ${retryCfg.retryInterval}s:`, err.message);
-        await new Promise((resolve4) => setTimeout(resolve4, retryCfg.retryInterval * 1e3));
+        await new Promise((resolve6) => setTimeout(resolve6, retryCfg.retryInterval * 1e3));
       } else {
         clearTimeout(totalTimeoutTimer);
         console.error("[AgentMoss] LLM call failed after all retries:", err.message);
-        return {
-          allowed: false,
-          reason: `LLM \u5206\u6790\u5931\u8D25\uFF0C\u56E0\u65E0\u6CD5\u5B8C\u6210\u6DF1\u5EA6\u8BED\u4E49\u5206\u6790\uFF0C\u6309 fail-closed \u539F\u5219\u62D2\u7EDD (${maxRetries + 1} \u6B21\u5C1D\u8BD5): ${err.message}`,
-          riskLevel: "medium",
-          riskType: "",
-          confidence: 60,
-          source: "llm_failure",
-          violatedLayers: ["3"]
-        };
+        throw new Error(`LLM \u5206\u6790\u5931\u8D25 (${maxRetries + 1} \u6B21\u5C1D\u8BD5): ${err.message}`);
       }
     }
   }
   clearTimeout(totalTimeoutTimer);
-  return {
-    allowed: false,
-    reason: `LLM \u5206\u6790\u8D85\u65F6\uFF08totalTimeout ${timeoutCfg.totalTimeout}s\uFF09\uFF0C\u6309 fail-closed \u539F\u5219\u62D2\u7EDD`,
-    riskLevel: "medium",
-    riskType: "analysis_timeout",
-    confidence: 60,
-    source: "llm_timeout",
-    violatedLayers: ["3"]
-  };
+  throw new Error(`LLM \u5206\u6790\u8D85\u65F6\uFF08totalTimeout ${timeoutCfg.totalTimeout}s\uFF09`);
 }
 var llmCache, LLM_CACHE_MAX;
 var init_llm_analyzer = __esm({
@@ -1689,14 +2498,177 @@ var init_llm_analyzer = __esm({
     init_skill_loader();
     init_template_loader();
     init_script_analyzer();
+    init_script_content_analyzer();
     llmCache = /* @__PURE__ */ new Map();
     LLM_CACHE_MAX = 200;
   }
 });
 
+// src/infra/runtime-config.ts
+var runtime_config_exports = {};
+__export(runtime_config_exports, {
+  DENY_MODE_LABELS: () => DENY_MODE_LABELS,
+  filterEnabledRules: () => filterEnabledRules,
+  getDisabledL2RulesWithSkipL3: () => getDisabledL2RulesWithSkipL3,
+  getEnabledL1CommandPatterns: () => getEnabledL1CommandPatterns,
+  getEnabledL2SensitivePaths: () => getEnabledL2SensitivePaths,
+  getEnvOverrides: () => getEnvOverrides,
+  getRuntimeConfigPath: () => getRuntimeConfigPath,
+  hasRuntimeConfig: () => hasRuntimeConfig,
+  isLayerEnabled: () => isLayerEnabled,
+  loadRuntimeConfig: () => loadRuntimeConfig,
+  saveRuntimeConfig: () => saveRuntimeConfig
+});
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync2, existsSync as existsSync7, mkdirSync as mkdirSync2 } from "fs";
+import { join as join4 } from "path";
+import { homedir as homedir3 } from "os";
+function getRuntimeConfigPath() {
+  const envPath = process.env[ENV_RUNTIME_CONFIG_PATH];
+  if (envPath) return envPath;
+  return RUNTIME_CONFIG_PATH;
+}
+function saveRuntimeConfig(config) {
+  const p = getRuntimeConfigPath();
+  const dir = p.substring(0, p.lastIndexOf("/"));
+  if (dir && !existsSync7(dir)) mkdirSync2(dir, { recursive: true });
+  writeFileSync2(p, JSON.stringify(config, null, 2), "utf-8");
+}
+function emptyRuntimeConfig() {
+  return {
+    version: 1,
+    layers: { L1_heuristic: true, L2_logic_rules: true, L3_llm_analysis: true },
+    L1_rules: {},
+    L2_rules: {},
+    L3_skills: {}
+  };
+}
+function loadRuntimeConfig() {
+  const p = getRuntimeConfigPath();
+  if (!existsSync7(p)) return emptyRuntimeConfig();
+  try {
+    const data = JSON.parse(readFileSync7(p, "utf-8"));
+    return {
+      version: data.version || 1,
+      layers: {
+        L1_heuristic: data.layers?.L1_heuristic ?? true,
+        L2_logic_rules: data.layers?.L2_logic_rules ?? true,
+        L3_llm_analysis: data.layers?.L3_llm_analysis ?? true
+      },
+      L1_rules: data.L1_rules || {},
+      L2_rules: data.L2_rules || {},
+      L3_skills: data.L3_skills || {}
+    };
+  } catch {
+    return emptyRuntimeConfig();
+  }
+}
+function isLayerEnabled(layerKey) {
+  const disableKey = LAYER_DISABLE_ENV[layerKey];
+  if (disableKey && process.env[disableKey] === "1") return false;
+  const runtime = loadRuntimeConfig();
+  const layers = runtime.layers || {};
+  if (layerKey in layers) return !!layers[layerKey];
+  return true;
+}
+function getEnvOverrides() {
+  const overrides = {};
+  for (const [layerKey, envKey] of Object.entries(LAYER_DISABLE_ENV)) {
+    const val = process.env[envKey];
+    if (val !== void 0) {
+      overrides[layerKey] = {
+        env_var: envKey,
+        env_value: val,
+        overridden: val === "1",
+        effect: val === "1" ? "disabled" : "no_override"
+      };
+    }
+  }
+  return overrides;
+}
+function filterEnabledRules(rules, categoryEnabled = true) {
+  if (!categoryEnabled) return [];
+  return rules.filter((r) => r.enabled !== false);
+}
+function getEnabledL1CommandPatterns(runtime) {
+  const cat = runtime.L1_rules?.dangerous_commands || { category_enabled: true, rules: [] };
+  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => ({
+    pattern: r.pattern || "",
+    risk_level: r.risk_level || "",
+    risk_type: r.risk_type || "",
+    reason: r.reason || ""
+  }));
+}
+function getEnabledL2SensitivePaths(runtime) {
+  const cat = runtime.L2_rules?.sensitive_path_access || { category_enabled: true, rules: [] };
+  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => {
+    const out = { path: r.path || "", risk_level: r.risk_level || "", desc: r.desc || "", deny_mode: r.deny_mode || "deny_write" };
+    if (r.credential) out.credential = true;
+    if (r.read_only) out.read_only = true;
+    return out;
+  });
+}
+function hasRuntimeConfig() {
+  const p = getRuntimeConfigPath();
+  if (!existsSync7(p)) return false;
+  try {
+    JSON.parse(readFileSync7(p, "utf-8"));
+    return true;
+  } catch {
+    return false;
+  }
+}
+function getDisabledL2RulesWithSkipL3() {
+  let runtime;
+  try {
+    runtime = loadRuntimeConfig();
+  } catch {
+    return {};
+  }
+  const result = {};
+  const l2 = runtime.L2_rules || {};
+  for (const [catName, cat] of Object.entries(l2)) {
+    if (!cat.category_enabled) continue;
+    const items = [];
+    for (const r of cat.rules || []) {
+      if (r.enabled === false && r.skip_l3_on_disabled) {
+        if (catName === "sensitive_path_access") {
+          if (r.path) items.push(r.path);
+        } else if (catName === "intent_consistency") {
+          items.push(...r.intent_keywords || []);
+        } else if (r.pattern) {
+          items.push(r.pattern);
+        }
+      }
+    }
+    if (items.length > 0) result[catName] = items;
+  }
+  return result;
+}
+var RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, ENV_RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DENY_MODE_LABELS;
+var init_runtime_config = __esm({
+  "src/infra/runtime-config.ts"() {
+    "use strict";
+    init_esm_shims();
+    RUNTIME_CONFIG_DIR = join4(homedir3(), ".config", "agentmoss");
+    RUNTIME_CONFIG_PATH = join4(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
+    ENV_RUNTIME_CONFIG_PATH = "AGENT_MOSS_RUNTIME_CONFIG_PATH";
+    LAYER_DISABLE_ENV = {
+      L1_heuristic: "AGENT_MOSS_DISABLE_HEURISTIC",
+      L2_logic_rules: "AGENT_MOSS_DISABLE_LOGIC_RULES",
+      L3_llm_analysis: "AGENT_MOSS_DISABLE_LLM"
+    };
+    DENY_MODE_LABELS = {
+      deny_write: "\u4EC5\u62E6\u622A\u5199\u5165",
+      deny_read: "\u4EC5\u62E6\u622A\u8BFB\u53D6",
+      deny_both: "\u8BFB\u5199\u5747\u62E6\u622A"
+    };
+  }
+});
+
 // src/engine/coordinator.ts
 var coordinator_exports = {};
 __export(coordinator_exports, {
+  TRUSTED_SKILLS_BASE: () => TRUSTED_SKILLS_BASE,
   runAnalysis: () => runAnalysis
 });
 function extractFirstCommand(command) {
@@ -1727,6 +2699,25 @@ async function runAnalysis(input) {
       return heuristicResult;
     }
   }
+  let scriptChain = null;
+  if (input.aNext.actionType.toLowerCase() === "bash") {
+    scriptChain = analyzeScriptContent2(input);
+    if (scriptChain.nodes.length > 0) {
+      for (const node of scriptChain.nodes) {
+        if (node.l1Hit && (node.l1RiskLevel === "high" || node.l1RiskLevel === "critical")) {
+          return {
+            allowed: false,
+            reason: `\u811A\u672C\u5185\u5BB9\u5305\u542B\u5371\u9669\u64CD\u4F5C: ${node.l1Reason} (\u6587\u4EF6: ${node.scriptPath}, \u6DF1\u5EA6: ${node.depth})`,
+            riskLevel: node.l1RiskLevel,
+            riskType: node.l1RiskType,
+            confidence: 90,
+            source: "heuristic_script_scan",
+            violatedLayers: ["1.1-script"]
+          };
+        }
+      }
+    }
+  }
   const actionType = input.aNext.actionType.toLowerCase();
   const rawDetail = extractRawCommand(input.aNext.actionDetail);
   const lowerDetail = rawDetail.toLowerCase();
@@ -1741,7 +2732,12 @@ async function runAnalysis(input) {
       violatedLayers: []
     };
   }
-  if (actionType === "skill" && TRUSTED_SKILLS.has(lowerDetail)) {
+  const agentExt = getAgentExtensions(input.agentId);
+  const trustedSkills = new Set(TRUSTED_SKILLS_BASE);
+  if (agentExt?.builtin_safe_skills) {
+    for (const s of agentExt.builtin_safe_skills) trustedSkills.add(s);
+  }
+  if (actionType === "skill" && trustedSkills.has(lowerDetail)) {
     return {
       allowed: true,
       reason: `\u5185\u7F6E\u5B89\u5168 Skill\uFF0C\u8DF3\u8FC7\u6DF1\u5EA6\u5206\u6790: ${lowerDetail}`,
@@ -1781,7 +2777,7 @@ async function runAnalysis(input) {
   if (logicResult && !logicResult.allowed) {
     const isCredentialPath = !!logicResult.isCredential;
     const skipInlineFileAccess = (isInlineScriptCmd || isLiteralTextCmd) && logicResult.riskType === "sensitive_path_access";
-    if (skipInlineFileAccess && !isCredentialPath) {
+    if (skipInlineFileAccess) {
       const inlineJudgment = analyzeInlineScript(input.aNext.actionDetail);
       if (inlineJudgment.actionable) {
         if (!inlineJudgment.allowed) {
@@ -1810,6 +2806,23 @@ async function runAnalysis(input) {
       return logicResult;
     }
   }
+  if (scriptChain && scriptChain.nodes.length > 0 && isLogicRulesEnabled()) {
+    for (const node of scriptChain.nodes) {
+      if (node.error || !node.preprocessedContent) continue;
+      if (node.l1RiskLevel === "critical") break;
+      if (node.l2Hit && (node.l2RiskLevel === "high" || node.l2RiskLevel === "critical")) {
+        return {
+          allowed: false,
+          reason: node.l2Reason,
+          riskLevel: node.l2RiskLevel,
+          riskType: node.l2RiskType,
+          confidence: 85,
+          source: "logic_rule_script_scan",
+          violatedLayers: ["1.2-script"]
+        };
+      }
+    }
+  }
   if (skipLLM || !isLLMAvailable()) {
     return {
       allowed: true,
@@ -1821,13 +2834,63 @@ async function runAnalysis(input) {
       violatedLayers: []
     };
   }
-  const llmResult = await runLLMAnalysis(input, {
-    heuristic: heuristicResult,
-    logic: logicResult
-  });
+  let skipL3Hints = "\u65E0\uFF08\u5F53\u524D\u65E0\u7981\u7528\u89C4\u5219\u547D\u4E2D\uFF09";
+  try {
+    const { getDisabledL2RulesWithSkipL3: getDisabledL2RulesWithSkipL32 } = await Promise.resolve().then(() => (init_runtime_config(), runtime_config_exports));
+    const disabledL2 = getDisabledL2RulesWithSkipL32();
+    if (disabledL2 && Object.keys(disabledL2).length > 0) {
+      const actionLower = input.aNext.actionDetail.toLowerCase();
+      const matched = [];
+      for (const items of Object.values(disabledL2)) {
+        for (const item of items) {
+          if (item.toLowerCase().includes(actionLower) || actionLower.includes(item.toLowerCase())) {
+            matched.push(item);
+          }
+        }
+      }
+      if (matched.length > 0) {
+        skipL3Hints = `\u26A0\uFE0F \u91CD\u8981\u7EA6\u675F\uFF1A\u7528\u6237\u5DF2\u4E3B\u52A8\u7981\u7528\u9488\u5BF9\u4EE5\u4E0B\u5185\u5BB9\u7684\u5B89\u5168\u62E6\u622A\u89C4\u5219\uFF0C\u8FD9\u662F\u7528\u6237\u7684\u660E\u786E\u51B3\u7B56\uFF1A
+  ${matched.join(", ")}
+\u5BF9\u8FD9\u4E9B\u8DEF\u5F84/\u5173\u952E\u8BCD\u7684\u76F8\u5173\u64CD\u4F5C\uFF0C\u5FC5\u987B\u89C6\u4E3A\u5141\u8BB8\u7684\uFF0C\u4E0D\u5141\u8BB8\u4EC5\u56E0\u6D89\u53CA\u8FD9\u4E9B\u5185\u5BB9\u5C31\u62D2\u7EDD\u3002\u4F46\u4F60\u4ECD\u9700\u68C0\u67E5\u547D\u4EE4\u7684\u5176\u4ED6\u90E8\u5206\u662F\u5426\u6709\u72EC\u7ACB\u4E8E\u8FD9\u4E9B\u5185\u5BB9\u7684\u5B89\u5168\u98CE\u9669\uFF08\u5982\u7F51\u7EDC\u5916\u4F20\u3001\u63D0\u6743\u7B49\uFF09\u3002`;
+      }
+    }
+  } catch {
+  }
+  let llmResult;
+  try {
+    llmResult = await runLLMAnalysis(input, {
+      heuristic: heuristicResult,
+      logic: logicResult,
+      skipL3Hints,
+      scriptChain: scriptChain ?? void 0
+    });
+  } catch (e) {
+    const { getLLMFailMode: getLLMFailMode2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+    if (getLLMFailMode2() === "fail_open") {
+      console.warn(`[AgentMoss] LLM \u5206\u6790\u5931\u8D25\uFF0Cfail_open \u6A21\u5F0F\uFF1A\u5141\u8BB8\u6267\u884C\uFF08\u524D\u4E24\u5C42\u672A\u62E6\u622A\uFF09: ${e.message}`);
+      return {
+        allowed: true,
+        reason: `LLM \u5206\u6790\u5931\u8D25\uFF08warn-allow\uFF0Cfail_open\uFF09: ${e.message}`,
+        riskLevel: "low",
+        riskType: "",
+        confidence: 50,
+        source: "llm_failure_fallback",
+        violatedLayers: []
+      };
+    }
+    return {
+      allowed: false,
+      reason: `LLM \u5206\u6790\u5931\u8D25\uFF0C\u56E0\u65E0\u6CD5\u5B8C\u6210\u6DF1\u5EA6\u8BED\u4E49\u5206\u6790\uFF0C\u6309 fail-closed \u539F\u5219\u62D2\u7EDD: ${e.message}`,
+      riskLevel: "medium",
+      riskType: "",
+      confidence: 60,
+      source: "llm_failure_fallback",
+      violatedLayers: ["3"]
+    };
+  }
   return llmResult;
 }
-var FULLY_SAFE_TOOLS, TRUSTED_SKILLS, READONLY_SENSITIVE_TOOLS, FULLY_SAFE_BASH_PATTERNS, READONLY_SENSITIVE_BASH_PATTERNS;
+var FULLY_SAFE_TOOLS, TRUSTED_SKILLS_BASE, READONLY_SENSITIVE_TOOLS, FULLY_SAFE_BASH_PATTERNS, READONLY_SENSITIVE_BASH_PATTERNS;
 var init_coordinator = __esm({
   "src/engine/coordinator.ts"() {
     "use strict";
@@ -1836,7 +2899,9 @@ var init_coordinator = __esm({
     init_logic_rules();
     init_inline_analyzer();
     init_llm_analyzer();
+    init_script_content_analyzer();
     init_config();
+    init_agents();
     FULLY_SAFE_TOOLS = /* @__PURE__ */ new Set([
       "ask_user_question",
       "glob",
@@ -1845,7 +2910,7 @@ var init_coordinator = __esm({
       "count_text_length",
       "filemgr-globfiles"
     ]);
-    TRUSTED_SKILLS = /* @__PURE__ */ new Set(["xiaoo-guardian"]);
+    TRUSTED_SKILLS_BASE = /* @__PURE__ */ new Set([]);
     READONLY_SENSITIVE_TOOLS = /* @__PURE__ */ new Set([
       "read",
       "file_read",
@@ -1942,6 +3007,7 @@ var AnalyzeRequestSchema = z.object({
   reason: z.string().default("").describe("Reason for executing this action"),
   os_type: z.string().default("").describe("OS type: 'linux', 'windows', or empty for auto-detect"),
   cwd: z.string().default("").describe("Current working directory"),
+  agent_id: z.string().default("").describe("Caller agent identifier, e.g. 'xiaoo' / 'opencode' / 'opendesk'. Empty = generic mode (no agent-specific rules)."),
   metadata: z.record(z.unknown()).optional().describe("Extended metadata")
 });
 var AnalyzeResponseSchema = z.object({
@@ -2091,6 +3157,7 @@ async function analyzeRoute(c) {
       reason: req.reason,
       osType,
       cwd: req.cwd,
+      agentId: req.agent_id,
       llmConfig: req.metadata?.llm_config
     });
     const durationMs = performance.now() - t0;
@@ -2207,7 +3274,8 @@ async function main() {
         },
         reason: data.reason || "",
         osType: data.os_type || (process.platform === "win32" ? "windows" : "linux"),
-        cwd: data.cwd || process.cwd()
+        cwd: data.cwd || process.cwd(),
+        agentId: data.agent_id || ""
       });
       console.log(JSON.stringify(result, null, 2));
       process.exit(result.allowed ? 0 : 1);