@kenhkl/agent-moss 0.7.13 → 0.8.1

package/dist/cli.js

@@ -29,6 +29,20 @@ var init_esm_shims = __esm({
 });
 
 // src/config.ts
+var config_exports = {};
+__export(config_exports, {
+  detectProvider: () => detectProvider,
+  getCustomRules: () => getCustomRules,
+  getLLMConfig: () => getLLMConfig,
+  getLLMFailMode: () => getLLMFailMode,
+  getProviderHeaders: () => getProviderHeaders,
+  getRetryConfig: () => getRetryConfig,
+  getTimeoutConfig: () => getTimeoutConfig,
+  isHeuristicEnabled: () => isHeuristicEnabled,
+  isLLMAvailable: () => isLLMAvailable,
+  isLogicRulesEnabled: () => isLogicRulesEnabled,
+  updateLLMConfig: () => updateLLMConfig
+});
 import fs from "fs";
 import path2 from "path";
 import os from "os";
@@ -108,6 +122,9 @@ function loadCustomRules() {
 function getLLMConfig() {
   return llmConfig;
 }
+function updateLLMConfig(partial) {
+  llmConfig = { ...llmConfig, ...partial };
+}
 function getCustomRules() {
   return customRules;
 }
@@ -115,6 +132,10 @@ function isLLMAvailable() {
   if (process.env.AGENT_MOSS_DISABLE_LLM === "1") return false;
   return llmConfig.apiKey.length > 0;
 }
+function getLLMFailMode() {
+  const val = (process.env.AGENT_MOSS_LLM_FAIL_MODE || "fail_open").toLowerCase();
+  return val === "fail_closed" ? "fail_closed" : "fail_open";
+}
 function detectProvider(baseUrl, providerHint = "") {
   if (providerHint) {
     const hint = providerHint.toLowerCase();
@@ -189,6 +210,56 @@ var init_config = __esm({
   }
 });
 
+// src/agents/index.ts
+import { readFileSync, existsSync } from "fs";
+import { resolve, dirname } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+function resolveAgentsDir() {
+  if (existsSync(AGENTS_DIR_PROD)) return AGENTS_DIR_PROD;
+  if (existsSync(AGENTS_DIR_DEV_FALLBACK)) return AGENTS_DIR_DEV_FALLBACK;
+  return AGENTS_DIR_PROD;
+}
+function getAgentExtensions(agentId) {
+  if (!agentId) return null;
+  if (cache.has(agentId)) return cache.get(agentId) ?? null;
+  const agentsDir = resolveAgentsDir();
+  const rulesFile = resolve(agentsDir, agentId, "rules.json");
+  if (!existsSync(rulesFile)) {
+    cache.set(agentId, null);
+    return null;
+  }
+  try {
+    const raw = readFileSync(rulesFile, "utf-8");
+    const ext = JSON.parse(raw);
+    if (!ext.agent_id) {
+      console.warn(`[AgentMoss agents] rules.json \u7F3A\u5C11 agent_id \u5B57\u6BB5: ${rulesFile}`);
+      cache.set(agentId, null);
+      return null;
+    }
+    cache.set(agentId, ext);
+    console.log(
+      `[AgentMoss agents] \u52A0\u8F7D agent ${agentId} \u5B9A\u5236\u89C4\u5219: ${ext.extra_command_patterns?.length ?? 0} cmd patterns, ${ext.extra_injection_keywords?.length ?? 0} injection keywords, ${ext.extra_sensitive_paths?.length ?? 0} sensitive paths, ${ext.builtin_safe_skills?.length ?? 0} builtin safe skills`
+    );
+    return ext;
+  } catch (e) {
+    console.error(`[AgentMoss agents] \u52A0\u8F7D agent ${agentId} rules.json \u5931\u8D25:`, e.message);
+    cache.set(agentId, null);
+    return null;
+  }
+}
+var __filename2, __dirname2, AGENTS_DIR_PROD, AGENTS_DIR_DEV_FALLBACK, cache;
+var init_agents = __esm({
+  "src/agents/index.ts"() {
+    "use strict";
+    init_esm_shims();
+    __filename2 = fileURLToPath2(import.meta.url);
+    __dirname2 = dirname(__filename2);
+    AGENTS_DIR_PROD = resolve(__dirname2, "agents");
+    AGENTS_DIR_DEV_FALLBACK = resolve(__dirname2, "../../../agent_moss/agents");
+    cache = /* @__PURE__ */ new Map();
+  }
+});
+
 // src/engine/heuristic.ts
 function runHeuristicCheck(input) {
   const command = `${input.aNext.actionType}: ${input.aNext.actionDetail}`;
@@ -222,8 +293,24 @@ function runHeuristicCheck(input) {
     }
   }
   highestRiskType = topRiskType || highestRiskType;
+  const agentExt = getAgentExtensions(input.agentId);
+  if (agentExt?.extra_command_patterns) {
+    for (const rule of agentExt.extra_command_patterns) {
+      try {
+        const re = new RegExp(rule.pattern, "i");
+        if (re.test(command)) {
+          matched.push(`agent \u4E13\u5C5E\u89C4\u5219: ${rule.reason}`);
+          if (severityRank(rule.risk_level) > severityRank(highestSeverity)) {
+            highestSeverity = rule.risk_level;
+            highestRiskType = rule.risk_type;
+          }
+        }
+      } catch {
+      }
+    }
+  }
   const injectionText = `${input.aNext.actionType} ${input.aNext.actionDetail} ${input.reason || ""} ${input.promptSession || ""}`.toLowerCase();
-  const injectionHits = checkInjectionKeywords(injectionText);
+  const injectionHits = checkInjectionKeywords(injectionText, agentExt?.extra_injection_keywords);
   if (injectionHits.length > 0) {
     const topHit = injectionHits.reduce((a, b) => severityRank(a.riskLevel) >= severityRank(b.riskLevel) ? a : b);
     matched.push(...injectionHits.map((h) => `\u6CE8\u5165\u5173\u952E\u8BCD [${h.lang}]: ${h.keyword}`));
@@ -240,18 +327,26 @@ function runHeuristicCheck(input) {
       riskType: highestRiskType,
       confidence: 95,
       source: "heuristic",
-      violatedLayers: ["1"]
+      violatedLayers: ["1.1"]
+      // 对齐 py coordinator.py:165（L1.1 = 命中高危命令模式/注入关键词）
     };
   }
   return null;
 }
-function checkInjectionKeywords(text) {
+function checkInjectionKeywords(text, extraKeywords) {
   const hits = [];
   for (const entry of INJECTION_KEYWORDS) {
     if (text.includes(entry.keyword.toLowerCase())) {
       hits.push(entry);
     }
   }
+  if (extraKeywords) {
+    for (const entry of extraKeywords) {
+      if (text.includes(entry.keyword.toLowerCase())) {
+        hits.push({ keyword: entry.keyword, riskLevel: entry.risk_level, lang: entry.lang });
+      }
+    }
+  }
   return hits;
 }
 function isInlineScriptCommand(actionDetail) {
@@ -268,6 +363,7 @@ var init_heuristic = __esm({
     "use strict";
     init_esm_shims();
     init_config();
+    init_agents();
     INJECTION_KEYWORDS = [
       // ---- Instruction Override ----
       { keyword: "ignore previous instructions", riskLevel: "critical", lang: "en" },
@@ -321,14 +417,10 @@ var init_heuristic = __esm({
       { keyword: "DAN mode", riskLevel: "critical", lang: "en" },
       { keyword: "jailbreak", riskLevel: "critical", lang: "en" },
       { keyword: "\u5F00\u53D1\u8005\u6A21\u5F0F", riskLevel: "critical", lang: "zh" },
-      { keyword: "\u8D8A\u72F1", riskLevel: "critical", lang: "zh" },
-      // ---- xiaoO-specific bypass ----
-      { keyword: "bypass audit", riskLevel: "critical", lang: "en" },
-      { keyword: "skip security check", riskLevel: "critical", lang: "en" },
-      { keyword: "disable guard", riskLevel: "critical", lang: "en" },
-      { keyword: "\u7ED5\u8FC7\u5BA1\u8BA1", riskLevel: "critical", lang: "zh" },
-      { keyword: "\u7981\u7528\u5B89\u5168\u68C0\u67E5", riskLevel: "critical", lang: "zh" },
-      { keyword: "\u5173\u95ED\u9632\u62A4", riskLevel: "critical", lang: "zh" }
+      { keyword: "\u8D8A\u72F1", riskLevel: "critical", lang: "zh" }
+      // 注：xiaoO 专属绕过词（绕过审计/禁用安全检查/关闭防护/bypass audit 等）
+      // 已迁至 agent_moss/agents/xiaoo/rules.json 的 extra_injection_keywords，
+      // 由 agent_ext 机制注入，不再污染通用层。
     ];
     DANGEROUS_PATTERNS = [
       // --- Critical: rm command graded detection (strict to loose, first match wins) ---
@@ -626,7 +718,8 @@ function runLogicCheck(input) {
     }
   }
   if (!isExcludedType) {
-    const pathResult = checkSensitivePath(actionDetail, resolvedCwd);
+    const agentExt = getAgentExtensions(input.agentId || "");
+    const pathResult = checkSensitivePath(actionDetail, resolvedCwd, agentExt);
     if (pathResult) return pathResult;
   }
   if (actionType !== "file_write" && actionType !== "file_edit") {
@@ -850,7 +943,7 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
   }
   return null;
 }
-function checkSensitivePath(command, cwd) {
+function checkSensitivePath(command, cwd, agentExt) {
   const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
   const _WRITE_CMD_RES = [/\brm\b/, /\bunlink\b/, /\brmdir\b/, /\bshred\b/, /\bcp\b/, /\bmv\b/, /\binstall\b/, /\btee\b/, /\bdd\b/, /\bmkfs\b/, /\b(fdisk|parted|cfdisk|sfdisk)\b/, /\bchmod\b/, /\bchown\b/, /\btruncate\b/];
   const _DEVNULL_RE = /(?:2|&|1)?\s*>\s*\/dev\/null\b/;
@@ -872,7 +965,7 @@ function checkSensitivePath(command, cwd) {
           violatedLayers: ["2"]
         };
       }
-      if (!isWriteOpFlag) {
+      if (!isWriteOpFlag && !sp.credential) {
         continue;
       }
       return {
@@ -889,7 +982,7 @@ function checkSensitivePath(command, cwd) {
   for (const sp of HOME_SENSITIVE_PATHS) {
     const expanded = `${expandedCwd}/${sp.path}`;
     if (command.includes(sp.path.toLowerCase()) || command.includes(expanded.toLowerCase())) {
-      if (!isWriteOpFlag) {
+      if (!isWriteOpFlag && !sp.credential) {
         continue;
       }
       return {
@@ -903,6 +996,29 @@ function checkSensitivePath(command, cwd) {
       };
     }
   }
+  if (agentExt?.extra_sensitive_paths && agentExt.extra_sensitive_paths.length > 0) {
+    for (const sp of agentExt.extra_sensitive_paths) {
+      const spPath = sp.path.toLowerCase();
+      const expanded = `${expandedCwd}/${spPath}`;
+      if (command.includes(spPath) || command.includes(expanded.toLowerCase())) {
+        const denyMode = sp.deny_mode || (sp.credential ? "deny_both" : sp.read_only ? "deny_read" : "deny_write");
+        if (denyMode === "deny_read") {
+          if (isWriteOpFlag) continue;
+        } else if (denyMode === "deny_write") {
+          if (!isWriteOpFlag) continue;
+        }
+        return {
+          allowed: false,
+          reason: `\u5C1D\u8BD5\u8BBF\u95EE agent \u4E13\u5C5E\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
+          riskLevel: sp.risk_level,
+          riskType: "sensitive_path_access",
+          confidence: 90,
+          source: "logic_rule",
+          violatedLayers: ["2"]
+        };
+      }
+    }
+  }
   for (const cp of CREDENTIAL_PATHS) {
     const escaped = cp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     const re = cp.path.startsWith(".") ? new RegExp(`(?:^|[\\s/\\\\'"])${escaped}\\b`) : new RegExp(`\\b${escaped}\\b`);
@@ -1060,12 +1176,13 @@ var init_logic_rules = __esm({
     "use strict";
     init_esm_shims();
     init_inline_analyzer();
+    init_agents();
     ROOT_SENSITIVE_PATHS = [
-      { path: "/etc/shadow", riskLevel: "critical", desc: "\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6" },
-      { path: "/etc/gshadow", riskLevel: "critical", desc: "\u7CFB\u7EDF\u7EC4\u5BC6\u7801\u6587\u4EF6" },
+      { path: "/etc/shadow", riskLevel: "critical", desc: "\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6", credential: true },
+      { path: "/etc/gshadow", riskLevel: "critical", desc: "\u7CFB\u7EDF\u7EC4\u5BC6\u7801\u6587\u4EF6", credential: true },
       // 注意：/etc/passwd 仅从 L1 启发式规则移除（公开可读），L2 敏感路径仍保留
       { path: "/etc/passwd", riskLevel: "high", desc: "\u7CFB\u7EDF\u7528\u6237\u6587\u4EF6" },
-      { path: "/etc/sudoers", riskLevel: "critical", desc: "sudo \u914D\u7F6E" },
+      { path: "/etc/sudoers", riskLevel: "critical", desc: "sudo \u914D\u7F6E", credential: true },
       // 系统配置（仅拦截写入）
       { path: "/etc/hosts", riskLevel: "medium", desc: "DNS \u89E3\u6790\u914D\u7F6E" },
       { path: "/etc/crontab", riskLevel: "high", desc: "\u7CFB\u7EDF\u5B9A\u65F6\u4EFB\u52A1" },
@@ -1083,19 +1200,19 @@ var init_logic_rules = __esm({
       { path: "/dev/mem", riskLevel: "critical", desc: "\u7269\u7406\u5185\u5B58\u8BBF\u95EE\u8BBE\u5907" },
       { path: "/dev/kmsg", riskLevel: "high", desc: "\u5185\u6838\u6D88\u606F\u7F13\u51B2\u533A" },
       // SSH 主机私钥
-      { path: "/etc/ssh/ssh_host_rsa_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A RSA \u79C1\u94A5" },
-      { path: "/etc/ssh/ssh_host_ed25519_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A Ed25519 \u79C1\u94A5" },
-      { path: "/etc/ssh/ssh_host_ecdsa_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A ECDSA \u79C1\u94A5" }
+      { path: "/etc/ssh/ssh_host_rsa_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A RSA \u79C1\u94A5", credential: true },
+      { path: "/etc/ssh/ssh_host_ed25519_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A Ed25519 \u79C1\u94A5", credential: true },
+      { path: "/etc/ssh/ssh_host_ecdsa_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A ECDSA \u79C1\u94A5", credential: true }
     ];
     HOME_SENSITIVE_PATHS = [
-      { path: ".ssh/id_rsa", riskLevel: "critical", desc: "SSH \u79C1\u94A5" },
-      { path: ".ssh/id_ed25519", riskLevel: "critical", desc: "SSH \u79C1\u94A5 (ed25519)" },
+      { path: ".ssh/id_rsa", riskLevel: "critical", desc: "SSH \u79C1\u94A5", credential: true },
+      { path: ".ssh/id_ed25519", riskLevel: "critical", desc: "SSH \u79C1\u94A5 (ed25519)", credential: true },
       { path: ".ssh/authorized_keys", riskLevel: "high", desc: "SSH \u6388\u6743\u5BC6\u94A5" },
       // 持久化与命令劫持（仅拦截写入）
       { path: ".bashrc", riskLevel: "high", desc: "\u7528\u6237 Shell \u521D\u59CB\u5316\u811A\u672C" },
       { path: ".bash_profile", riskLevel: "high", desc: "\u7528\u6237 Shell \u767B\u5F55\u811A\u672C" },
       { path: ".profile", riskLevel: "high", desc: "\u7528\u6237\u901A\u7528\u767B\u5F55\u811A\u672C" },
-      { path: ".aws/credentials", riskLevel: "critical", desc: "AWS \u51ED\u8BC1" },
+      { path: ".aws/credentials", riskLevel: "critical", desc: "AWS \u51ED\u8BC1", credential: true },
       { path: ".gitconfig", riskLevel: "medium", desc: "Git \u914D\u7F6E" },
       { path: ".gnupg", riskLevel: "high", desc: "GPG \u5BC6\u94A5\u76EE\u5F55" }
     ];
@@ -1156,21 +1273,21 @@ var init_logic_rules = __esm({
 });
 
 // src/engine/skill-loader.ts
-import { readFileSync, readdirSync as readdirSync2, existsSync as existsSync2 } from "fs";
-import { resolve, dirname } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { readFileSync as readFileSync2, readdirSync as readdirSync2, existsSync as existsSync3 } from "fs";
+import { resolve as resolve2, dirname as dirname2 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
 function loadAllSkills() {
   if (cachedSkills) return cachedSkills;
   cachedSkills = {};
-  const dir = existsSync2(SKILLS_DIR) ? SKILLS_DIR : SKILLS_DIR_FALLBACK;
-  if (!existsSync2(dir)) {
+  const dir = existsSync3(SKILLS_DIR) ? SKILLS_DIR : SKILLS_DIR_FALLBACK;
+  if (!existsSync3(dir)) {
     console.warn("[AgentMoss] Skills directory not found:", SKILLS_DIR, "and fallback:", SKILLS_DIR_FALLBACK);
     return cachedSkills;
   }
   const files = readdirSync2(dir).filter((f) => f.endsWith(".md"));
   for (const f of files) {
     const name = f.replace(".md", "");
-    cachedSkills[name] = readFileSync(resolve(dir, f), "utf-8");
+    cachedSkills[name] = readFileSync2(resolve2(dir, f), "utf-8");
   }
   console.log(`[AgentMoss] Loaded ${Object.keys(cachedSkills).length} skills from ${dir}`);
   return cachedSkills;
@@ -1224,15 +1341,15 @@ function formatSkillsForPrompt(skills) {
 ${s.skillContent}`
   ).join("\n\n---\n\n");
 }
-var __filename2, __dirname2, SKILLS_DIR, SKILLS_DIR_FALLBACK, SKILL_KEYWORD_MAP, cachedSkills;
+var __filename3, __dirname3, SKILLS_DIR, SKILLS_DIR_FALLBACK, SKILL_KEYWORD_MAP, cachedSkills;
 var init_skill_loader = __esm({
   "src/engine/skill-loader.ts"() {
     "use strict";
     init_esm_shims();
-    __filename2 = fileURLToPath2(import.meta.url);
-    __dirname2 = dirname(__filename2);
-    SKILLS_DIR = resolve(__dirname2, "../skills");
-    SKILLS_DIR_FALLBACK = resolve(__dirname2, "../../agent_moss/skills");
+    __filename3 = fileURLToPath3(import.meta.url);
+    __dirname3 = dirname2(__filename3);
+    SKILLS_DIR = resolve2(__dirname3, "../skills");
+    SKILLS_DIR_FALLBACK = resolve2(__dirname3, "../../../agent_moss/skills");
     SKILL_KEYWORD_MAP = {
       "file_access_guard": ["file", "\u6587\u4EF6", "path", "\u8DEF\u5F84", "read", "write", "cat", "open", "access", "\u8BBF\u95EE", "\u8BFB\u5199", "copy", "cp", "mv", "move"],
       "script_execution_guard": ["command", "shell", "bash", "exec", "execute", "\u6267\u884C", "\u547D\u4EE4", "script", "\u811A\u672C", "run", "\u8FD0\u884C", "subprocess", "system", "eval", "compile", "\u5B89\u88C5", "install", "pip", "npm"],
@@ -1255,44 +1372,44 @@ var init_skill_loader = __esm({
 });
 
 // src/engine/template-loader.ts
-import { readFileSync as readFileSync2, existsSync as existsSync3 } from "fs";
-import { resolve as resolve2, dirname as dirname2 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { readFileSync as readFileSync3, existsSync as existsSync4 } from "fs";
+import { resolve as resolve3, dirname as dirname3 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
 function loadTemplates() {
   if (cachedTemplates) return cachedTemplates;
   cachedTemplates = {};
-  const dir = existsSync3(TEMPLATES_DIR) ? TEMPLATES_DIR : TEMPLATES_DIR_FALLBACK;
-  if (!existsSync3(dir)) {
+  const dir = existsSync4(TEMPLATES_DIR) ? TEMPLATES_DIR : TEMPLATES_DIR_FALLBACK;
+  if (!existsSync4(dir)) {
     console.warn("[AgentMoss] Templates directory not found:", TEMPLATES_DIR, "and fallback:", TEMPLATES_DIR_FALLBACK);
     return cachedTemplates;
   }
   for (const file of TEMPLATE_FILES) {
-    const filePath = resolve2(dir, file);
-    if (existsSync3(filePath)) {
+    const filePath = resolve3(dir, file);
+    if (existsSync4(filePath)) {
       const key = file.replace(".txt", "").replace("_template", "");
-      cachedTemplates[key] = readFileSync2(filePath, "utf-8");
+      cachedTemplates[key] = readFileSync3(filePath, "utf-8");
     }
   }
   console.log(`[AgentMoss] Loaded ${Object.keys(cachedTemplates).length} templates from ${dir}`);
   return cachedTemplates;
 }
-var __filename3, __dirname3, TEMPLATES_DIR, TEMPLATES_DIR_FALLBACK, TEMPLATE_FILES, cachedTemplates;
+var __filename4, __dirname4, TEMPLATES_DIR, TEMPLATES_DIR_FALLBACK, TEMPLATE_FILES, cachedTemplates;
 var init_template_loader = __esm({
   "src/engine/template-loader.ts"() {
     "use strict";
     init_esm_shims();
-    __filename3 = fileURLToPath3(import.meta.url);
-    __dirname3 = dirname2(__filename3);
-    TEMPLATES_DIR = resolve2(__dirname3, "../templates");
-    TEMPLATES_DIR_FALLBACK = resolve2(__dirname3, "../../agent_moss/templates");
+    __filename4 = fileURLToPath4(import.meta.url);
+    __dirname4 = dirname3(__filename4);
+    TEMPLATES_DIR = resolve3(__dirname4, "../templates");
+    TEMPLATES_DIR_FALLBACK = resolve3(__dirname4, "../../../agent_moss/templates");
     TEMPLATE_FILES = ["prompt1_template.txt", "prompt2_template.txt", "security_judge_template.txt"];
     cachedTemplates = null;
   }
 });
 
 // src/engine/script-analyzer.ts
-import { readFileSync as readFileSync3 } from "fs";
-import { resolve as resolve3, join } from "path";
+import { readFileSync as readFileSync4 } from "fs";
+import { resolve as resolve4, join } from "path";
 function emptyResult() {
   return { scriptPath: "", scriptContent: "", matchedKeywords: [], lineCount: 0, isSuspicious: false, error: "", riskLevel: "", riskReason: "" };
 }
@@ -1345,8 +1462,8 @@ function assessKeywordCombinationRisk(matchedKeywords, scriptContent) {
 }
 function readScriptContent(scriptPath, maxLines = 500) {
   try {
-    const expandedPath = scriptPath.startsWith("~") ? join(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve3(scriptPath);
-    const raw = readFileSync3(expandedPath, "utf-8");
+    const expandedPath = scriptPath.startsWith("~") ? join(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve4(scriptPath);
+    const raw = readFileSync4(expandedPath, "utf-8");
     const lines = raw.split("\n").slice(0, maxLines);
     return { content: lines.join("\n"), lineCount: lines.length, error: "" };
   } catch (e) {
@@ -1483,203 +1600,1623 @@ var init_script_analyzer = __esm({
   }
 });
 
-// src/engine/llm-analyzer.ts
-import OpenAI from "openai";
-async function runLLMAnalysis(input, previous) {
-  if (!isLLMAvailable()) {
-    console.log("[AgentMoss] LLM not configured, skipping deep analysis");
-    return {
-      allowed: true,
-      reason: "LLM \u672A\u914D\u7F6E\uFF0C\u8DF3\u8FC7\u6DF1\u5C42\u5206\u6790",
-      riskLevel: "low",
-      riskType: "",
-      confidence: 50,
-      source: "llm",
-      violatedLayers: []
-    };
-  }
-  const globalConfig = getLLMConfig();
-  const config = input.llmConfig?.apiKey ? { ...globalConfig, ...input.llmConfig } : globalConfig;
-  const rawDetail = input.aNext.actionDetail.replace(/^terminal-\w+:\s*command=([^,]+).*/, "$1").trim();
-  const cacheKey = `${input.aNext.actionType}:${rawDetail || input.aNext.actionDetail}`;
-  const cached = llmCache.get(cacheKey);
-  if (cached) {
-    console.log("[AgentMoss] LLM cache hit");
-    return cached;
-  }
-  const matchedSkills = matchSkills(input.aNext.actionType, input.aNext.actionDetail, input.reason);
-  const templates = loadTemplates();
-  const scriptAnalysis = analyzeScriptContent(input.aNext.actionType, input.aNext.actionDetail);
-  const prompt = buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis);
-  const result = await analyzeWithLLM(prompt, config);
-  if (llmCache.size >= LLM_CACHE_MAX) {
-    const firstKey = llmCache.keys().next().value;
-    if (firstKey) llmCache.delete(firstKey);
-  }
-  llmCache.set(cacheKey, result);
+// src/engine/script-content-analyzer.ts
+import { readFileSync as readFileSync5, statSync, existsSync as existsSync5 } from "fs";
+import { resolve as resolve5, join as join2, isAbsolute, dirname as dirname4 } from "path";
+import { homedir } from "os";
+function emptyChain() {
+  return {
+    nodes: [],
+    entryPath: "",
+    maxDepthReached: false,
+    maxSizeReached: false,
+    totalSize: 0,
+    totalLines: 0,
+    hasCritical: false,
+    hasHigh: false,
+    firstHitNode: null,
+    error: ""
+  };
+}
+function newNode(path3, depth) {
+  return {
+    scriptPath: path3,
+    rawContent: "",
+    preprocessedContent: "",
+    lineCount: 0,
+    fileSize: 0,
+    depth,
+    childPaths: [],
+    error: "",
+    l1Hit: false,
+    l1RiskLevel: "",
+    l1RiskType: "",
+    l1Reason: "",
+    l1MatchedPatterns: [],
+    l2Hit: false,
+    l2ViolatedRule: "",
+    l2RiskLevel: "",
+    l2RiskType: "",
+    l2Reason: "",
+    matchedKeywords: [],
+    isSuspicious: false,
+    keywordRiskLevel: "",
+    keywordRiskReason: ""
+  };
+}
+function stripComments(content) {
+  return content.split("\n").filter((line) => !line.trimStart().startsWith("#")).join("\n");
+}
+function stripOutputText(content) {
+  let result = content.replace(/echo\s+".*?"/gs, 'echo ""');
+  result = result.replace(/echo\s+'.*?'/gs, "echo ''");
+  result = result.replace(/printf\s+".*?"[^\n]*/gs, 'printf ""');
+  result = result.replace(/printf\s+'.*?'[^\n]*/gs, "printf ''");
   return result;
 }
-function buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis) {
-  const skillsText = formatSkillsForPrompt(matchedSkills);
-  const historyStr = input.actionHistory.map((h, i) => `${i + 1}. ${h.actionType}: ${h.actionDetail}`).join("\n") || "(\u65E0\u5386\u53F2\u64CD\u4F5C)";
-  const scriptAnalysisText = scriptAnalysis ? formatScriptAnalysisForPrompt(scriptAnalysis) : "";
-  const hintsText = formatHints(previous);
-  const securityJudgeTemplate = templates["security_judge"];
-  if (securityJudgeTemplate) {
-    return securityJudgeTemplate.replaceAll("{prompt_session}", input.promptSession || "\uFF08\u672A\u63D0\u4F9B\uFF09").replaceAll("{action_history}", historyStr).replaceAll("{action_type}", input.aNext.actionType).replaceAll("{action_detail}", input.aNext.actionDetail).replaceAll("{reason}", input.reason || "\u672A\u8BF4\u660E").replaceAll("{skills_text}", skillsText).replaceAll("{hints_text}", hintsText).replaceAll("{script_analysis_text}", scriptAnalysisText).replaceAll("{{", "{").replaceAll("}}", "}");
+function expandSimpleVariables(content) {
+  const varMap = {};
+  const assignmentRe = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.+)$/;
+  const collectAssignments = (text) => {
+    for (const line of text.split("\n")) {
+      const m = line.match(assignmentRe);
+      if (m) {
+        const varName = m[1];
+        let varVal = m[2].trim();
+        if (varVal && !varVal.includes("$") && !varVal.includes("`")) {
+          if (varVal.startsWith('"') && varVal.endsWith('"') || varVal.startsWith("'") && varVal.endsWith("'")) {
+            varVal = varVal.slice(1, -1);
+          }
+          varMap[varName] = varVal;
+        }
+      }
+    }
+  };
+  collectAssignments(content);
+  let expanded = content;
+  for (let round = 0; round < 3; round++) {
+    const sortedVars = Object.keys(varMap).sort((a, b) => b.length - a.length);
+    let newExpanded = expanded;
+    for (const v of sortedVars) {
+      const val = varMap[v];
+      newExpanded = newExpanded.split("${" + v + "}").join(val);
+      newExpanded = newExpanded.split("$" + v).join(val);
+    }
+    if (newExpanded === expanded) break;
+    expanded = newExpanded;
+    collectAssignments(expanded);
   }
-  console.warn("[AgentMoss] security_judge template missing, using sparse fallback prompt");
-  return `## \u5F53\u524D\u64CD\u4F5C\u4E0A\u4E0B\u6587
-- \u4F1A\u8BDD ID: ${input.sessionId}
-- \u7528\u6237\u4EFB\u52A1: ${input.promptSession || "\u672A\u6307\u5B9A"}
-- \u64CD\u4F5C\u7CFB\u7EDF: ${input.osType}
-- \u5DE5\u4F5C\u76EE\u5F55: ${input.cwd || "/"}
-- \u64CD\u4F5C\u539F\u56E0: ${input.reason || "\u672A\u8BF4\u660E"}
-- \u5386\u53F2\u64CD\u4F5C\u5E8F\u5217:
-${historyStr}
-
-- \u5373\u5C06\u6267\u884C\u7684\u64CD\u4F5C:
-  \u7C7B\u578B: ${input.aNext.actionType}
-  \u8BE6\u60C5: ${input.aNext.actionDetail}
-
-## \u53EF\u7528\u5B89\u5168 Skill
-${skillsText}
-
-## \u524D\u7F6E\u68C0\u6D4B\u7ED3\u679C
-${hintsText}
-${scriptAnalysisText ? `
-## \u811A\u672C\u5185\u5BB9\u5206\u6790
-${scriptAnalysisText}` : ""}
-
-\u8BF7\u6839\u636E\u4EE5\u4E0A\u4FE1\u606F\uFF0C\u5BF9\u5373\u5C06\u6267\u884C\u7684\u64CD\u4F5C\u8FDB\u884C\u5B89\u5168\u5224\u65AD\u3002\u524D\u7F6E\u68C0\u6D4B\u4E3A low/medium \u4E14\u6709\u5408\u7406\u6267\u884C\u7406\u7531\u65F6\u5E94\u5F53\u5141\u8BB8\u3002\u4F60\u5FC5\u987B\u8F93\u51FA\u4E25\u683C\u7684 JSON \u683C\u5F0F\uFF0C\u4E0D\u8981\u5305\u542B\u4EFB\u4F55\u5176\u4ED6\u6587\u5B57\u3001\u6CE8\u91CA\u6216 markdown \u6807\u8BB0\u3002
-
-\u8F93\u51FA\u683C\u5F0F:
-{"allowed": true/false, "reason": "\u5224\u65AD\u7406\u7531", "riskLevel": "low|medium|high|critical", "riskType": "\u98CE\u9669\u7C7B\u578B", "confidence": 0-100}`;
+  return expanded;
 }
-function formatHints(previous) {
-  const hints = [];
-  if (previous.heuristic) {
-    hints.push(
-      `\u542F\u53D1\u5F0F\u68C0\u6D4B\u53D1\u73B0\u98CE\u9669 [\u98CE\u9669\u7B49\u7EA7: ${previous.heuristic.riskLevel}]:
-   \u7C7B\u578B: ${previous.heuristic.riskType}
-   \u539F\u56E0: ${previous.heuristic.reason}`
-    );
-  }
-  if (previous.logic) {
-    hints.push(
-      `\u903B\u8F91\u89C4\u5219\u68C0\u6D4B\u53D1\u73B0\u98CE\u9669 [\u98CE\u9669\u7B49\u7EA7: ${previous.logic.riskLevel}]:
-   \u7C7B\u578B: ${previous.logic.riskType}
-   \u539F\u56E0: ${previous.logic.reason}`
-    );
+function preprocessScriptContent(content) {
+  let result = stripComments(content);
+  result = stripOutputText(result);
+  result = expandSimpleVariables(result);
+  return result;
+}
+function scanScriptForKeywords2(content) {
+  const matched = [];
+  for (const { name, pattern } of SUSPICIOUS_PATTERNS2) {
+    if (pattern.test(content)) matched.push(name);
   }
-  return hints.length > 0 ? hints.join("\n\n") : "\u542F\u53D1\u5F0F\u68C0\u6D4B\u548C\u903B\u8F91\u89C4\u5219\u68C0\u6D4B\u5747\u672A\u53D1\u73B0\u98CE\u9669\u3002";
+  return matched;
 }
-async function analyzeWithLLM(prompt, config) {
-  console.log(`[AgentMoss] LLM analyzing with model: ${config.model}, url: ${config.baseUrl}`);
-  const provider = detectProvider(config.baseUrl, config.provider);
-  const extraHeaders = getProviderHeaders(provider);
-  if (Object.keys(extraHeaders).length > 0) {
-    console.log(`[AgentMoss] Provider detected: ${provider}, injecting headers: ${Object.keys(extraHeaders).join(", ")}`);
+function assessKeywordCombinationRisk2(matchedKeywords, scriptContent) {
+  if (matchedKeywords.length === 0) return { level: "", reason: "" };
+  const keywordSet = new Set(matchedKeywords);
+  for (const rule of KEYWORD_COMBINATION_RISKS2) {
+    const hitGroup1 = [...rule.group1].some((k) => keywordSet.has(k));
+    const hitGroup2 = rule.group2.size === 0 ? true : [...rule.group2].some((k) => keywordSet.has(k));
+    if (hitGroup1 && hitGroup2) return { level: rule.level, reason: rule.reason };
   }
-  const timeoutCfg = getTimeoutConfig();
-  const retryCfg = getRetryConfig();
-  const client = new OpenAI({
-    baseURL: config.baseUrl,
-    apiKey: config.apiKey,
-    // 单次 LLM 调用超时用 prompt1Timeout（对齐 py）；env 覆盖的 config.timeout 仍向后兼容
-    timeout: (config.timeout || timeoutCfg.prompt1Timeout) * 1e3,
-    defaultHeaders: Object.keys(extraHeaders).length > 0 ? extraHeaders : void 0
-  });
-  const maxRetries = parseInt(process.env.AGENT_MOSS_LLM_RETRIES || String(retryCfg.maxRetries), 10);
-  const totalTimeoutMs = timeoutCfg.totalTimeout * 1e3;
-  const abortController = new AbortController();
-  const totalTimeoutTimer = setTimeout(() => {
-    console.error(`[AgentMoss] totalTimeout (${timeoutCfg.totalTimeout}s) exceeded, aborting all LLM calls`);
-    abortController.abort();
-  }, totalTimeoutMs);
-  for (let attempt = 0; attempt <= maxRetries; attempt++) {
-    if (abortController.signal.aborted) {
-      break;
-    }
-    try {
-      const response = await client.chat.completions.create({
-        model: config.model,
-        temperature: config.temperature || 0.1,
-        max_tokens: config.maxTokens || 1024,
-        messages: [
-          { role: "system", content: "\u53EA\u8F93\u51FA\u7EAF JSON\uFF0C\u4E0D\u8981\u5305\u542B markdown \u6807\u8BB0\u3001\u4EE3\u7801\u5757\u6216\u4EFB\u4F55\u5176\u4ED6\u6587\u5B57\u3002" },
-          { role: "user", content: prompt }
-        ],
-        signal: abortController.signal
-      });
-      const content = response.choices[0]?.message?.content || "{}";
-      console.log(`[AgentMoss] LLM raw response (attempt ${attempt + 1}/${maxRetries + 1}): ${content.substring(0, 300)}`);
-      let jsonStr = content.trim();
-      if (jsonStr.startsWith("```")) {
-        jsonStr = jsonStr.replace(/^```[\w]*\n?/, "").replace(/\n?```$/, "");
-      }
-      const parsed = JSON.parse(jsonStr);
-      clearTimeout(totalTimeoutTimer);
-      return {
-        allowed: parsed.allowed !== false,
-        reason: parsed.reason || "LLM \u5206\u6790\u5B8C\u6210",
-        riskLevel: ["low", "medium", "high", "critical"].includes(parsed.riskLevel) ? parsed.riskLevel : "low",
-        riskType: parsed.riskType || "",
-        confidence: typeof parsed.confidence === "number" ? Math.min(100, Math.max(0, parsed.confidence)) : 70,
-        source: "llm",
-        violatedLayers: ["3"]
-      };
-    } catch (err) {
-      if (abortController.signal.aborted) {
-        console.error(`[AgentMoss] LLM analysis aborted by totalTimeout (${timeoutCfg.totalTimeout}s)`);
-        break;
-      }
-      if (attempt < maxRetries) {
-        console.error(`[AgentMoss] LLM call failed (attempt ${attempt + 1}/${maxRetries + 1}), retrying in ${retryCfg.retryInterval}s:`, err.message);
-        await new Promise((resolve4) => setTimeout(resolve4, retryCfg.retryInterval * 1e3));
-      } else {
-        clearTimeout(totalTimeoutTimer);
-        console.error("[AgentMoss] LLM call failed after all retries:", err.message);
+  const networkPostKeywords = /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]);
+  const hasNetworkPost = [...networkPostKeywords].some((k) => keywordSet.has(k));
+  if (hasNetworkPost) {
+    const envPatterns = ["$env", "$(env)", "$USER", "$(hostname)", "$(pwd)", "$HOME"];
+    const contentLower = scriptContent.toLowerCase();
+    for (const p of envPatterns) {
+      if (contentLower.includes(p.toLowerCase())) {
         return {
-          allowed: false,
-          reason: `LLM \u5206\u6790\u5931\u8D25\uFF0C\u56E0\u65E0\u6CD5\u5B8C\u6210\u6DF1\u5EA6\u8BED\u4E49\u5206\u6790\uFF0C\u6309 fail-closed \u539F\u5219\u62D2\u7EDD (${maxRetries + 1} \u6B21\u5C1D\u8BD5): ${err.message}`,
-          riskLevel: "medium",
-          riskType: "",
-          confidence: 60,
-          source: "llm_failure",
-          violatedLayers: ["3"]
+          level: "critical",
+          reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + \u7CFB\u7EDF\u73AF\u5883\u53D8\u91CF\u6536\u96C6\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u6570\u636E\u5916\u4F20\u98CE\u9669\u3002\u811A\u672C\u53EF\u80FD\u5C06\u7528\u6237\u73AF\u5883\u53D8\u91CF\uFF08\u53EF\u80FD\u5305\u542B API Key\u3001\u5BC6\u94A5\u7B49\u654F\u611F\u4FE1\u606F\uFF09\u53D1\u9001\u5230\u8FDC\u7A0B\u670D\u52A1\u5668\u3002"
         };
       }
     }
   }
-  clearTimeout(totalTimeoutTimer);
-  return {
-    allowed: false,
-    reason: `LLM \u5206\u6790\u8D85\u65F6\uFF08totalTimeout ${timeoutCfg.totalTimeout}s\uFF09\uFF0C\u6309 fail-closed \u539F\u5219\u62D2\u7EDD`,
-    riskLevel: "medium",
-    riskType: "analysis_timeout",
-    confidence: 60,
-    source: "llm_timeout",
-    violatedLayers: ["3"]
-  };
-}
-var llmCache, LLM_CACHE_MAX;
-var init_llm_analyzer = __esm({
-  "src/engine/llm-analyzer.ts"() {
-    "use strict";
-    init_esm_shims();
-    init_config();
-    init_skill_loader();
-    init_template_loader();
-    init_script_analyzer();
-    llmCache = /* @__PURE__ */ new Map();
-    LLM_CACHE_MAX = 200;
+  let bestLevel = "";
+  let bestReason = "";
+  for (const kw of matchedKeywords) {
+    const risk = SINGLE_KEYWORD_RISKS2[kw];
+    if (risk && (LEVEL_ORDER2[risk.level] || 0) > (LEVEL_ORDER2[bestLevel] || 0)) {
+      bestLevel = risk.level;
+      bestReason = risk.reason;
+    }
+  }
+  return { level: bestLevel, reason: bestReason };
+}
+function extractScriptPath2(command) {
+  for (const pattern of SCRIPT_EXEC_PATTERNS2) {
+    const m = command.match(pattern);
+    if (m) return m[1];
+  }
+  return null;
+}
+function extractInlineScriptPath(actionDetail) {
+  const re = /open\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+  let m;
+  while ((m = re.exec(actionDetail)) !== null) {
+    const p = m[1];
+    let resolved;
+    try {
+      resolved = resolvePath(p);
+      if (existsSync5(resolved)) {
+        const stat = statSync(resolved);
+        if (stat.isFile()) return resolved;
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function resolvePath(p) {
+  let expanded = p;
+  if (expanded.startsWith("~/") || expanded === "~") {
+    expanded = join2(homedir(), expanded.slice(1));
+  }
+  return resolve5(expanded);
+}
+function readScriptContent2(scriptPath, maxFileSize = 2 * 1024 * 1024) {
+  try {
+    const path3 = resolvePath(scriptPath);
+    if (!existsSync5(path3)) return { content: "", lineCount: 0, fileSize: 0, error: `\u811A\u672C\u4E0D\u5B58\u5728: ${scriptPath}` };
+    const stat = statSync(path3);
+    if (!stat.isFile()) return { content: "", lineCount: 0, fileSize: 0, error: `\u4E0D\u662F\u6587\u4EF6: ${scriptPath}` };
+    if (stat.size > maxFileSize) {
+      return { content: "", lineCount: 0, fileSize: stat.size, error: `\u811A\u672C\u6587\u4EF6\u8FC7\u5927 (${stat.size} bytes)\uFF0C\u8DF3\u8FC7\u8BFB\u53D6` };
+    }
+    const content = readFileSync5(path3, "utf-8");
+    const lineCount = content ? content.split("\n").length : 0;
+    return { content, lineCount, fileSize: stat.size, error: "" };
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    return { content: "", lineCount: 0, fileSize: 0, error: `\u8BFB\u53D6\u811A\u672C\u5931\u8D25: ${msg}` };
+  }
+}
+function extractChildScriptPaths(content, baseDir) {
+  const paths = [];
+  for (const pattern of CHILD_SCRIPT_PATTERNS) {
+    pattern.lastIndex = 0;
+    let m;
+    while ((m = pattern.exec(content)) !== null) {
+      const pathStr = m[1];
+      if (pathStr.startsWith("-") || pathStr.startsWith("$")) continue;
+      if (pathStr.includes("/dev/") || pathStr.startsWith("|") || pathStr.startsWith(";")) continue;
+      const full = isAbsolute(pathStr) ? pathStr : join2(baseDir, pathStr);
+      const resolved = resolvePath(full);
+      if (existsSync5(resolved)) {
+        try {
+          if (statSync(resolved).isFile() && !paths.includes(resolved)) paths.push(resolved);
+        } catch {
+        }
+      }
+    }
+  }
+  return paths;
+}
+function resolveScriptChain(entryPath, input, maxDepth = 3, maxFileSize = 2 * 1024 * 1024, maxTotalSize = 6 * 1024 * 1024) {
+  const visited = /* @__PURE__ */ new Set();
+  const result = emptyChain();
+  result.entryPath = entryPath;
+  const entry = resolvePath(entryPath);
+  const baseDir = existsSync5(entry) ? dirname4(entry) : input.cwd || process.cwd();
+  resolveRecursive({
+    path: entry,
+    depth: 0,
+    maxDepth,
+    maxFileSize,
+    maxTotalSize,
+    visited,
+    result,
+    baseDir,
+    input
+  });
+  result.hasCritical = result.nodes.some((n) => n.l1RiskLevel === "critical" || n.l2RiskLevel === "critical" || n.keywordRiskLevel === "critical");
+  result.hasHigh = result.nodes.some((n) => ["high", "critical"].includes(n.l1RiskLevel) || ["high", "critical"].includes(n.l2RiskLevel) || ["high", "critical"].includes(n.keywordRiskLevel));
+  result.firstHitNode = result.nodes.find((n) => n.l1Hit || n.l2Hit || n.isSuspicious) || null;
+  return result;
+}
+function resolveRecursive(ctx) {
+  const { path: path3, depth, maxDepth, maxFileSize, maxTotalSize, visited, result, baseDir, input } = ctx;
+  if (visited.has(path3)) return;
+  if (depth > maxDepth) {
+    result.maxDepthReached = true;
+    return;
+  }
+  if (result.totalSize >= maxTotalSize) {
+    result.maxSizeReached = true;
+    return;
+  }
+  visited.add(path3);
+  const { content, lineCount, fileSize, error } = readScriptContent2(path3, maxFileSize);
+  if (error) {
+    const node2 = newNode(path3, depth);
+    node2.error = error;
+    node2.fileSize = fileSize;
+    node2.lineCount = lineCount;
+    result.nodes.push(node2);
+    return;
+  }
+  result.totalSize += fileSize;
+  result.totalLines += lineCount;
+  const preprocessed = preprocessScriptContent(content);
+  const node = newNode(path3, depth);
+  node.rawContent = content;
+  node.preprocessedContent = preprocessed;
+  node.lineCount = lineCount;
+  node.fileSize = fileSize;
+  result.nodes.push(node);
+  const virtualInput = {
+    ...input,
+    aNext: { actionType: "bash", actionDetail: preprocessed }
+  };
+  const l1 = runHeuristicCheck(virtualInput);
+  if (l1 && !l1.allowed) {
+    node.l1Hit = true;
+    node.l1RiskLevel = l1.riskLevel;
+    node.l1RiskType = l1.riskType;
+    node.l1Reason = l1.reason;
+    node.l1MatchedPatterns = [];
+    if (l1.riskLevel === "critical") {
+      result.hasCritical = true;
+      result.firstHitNode = node;
+      return;
+    }
+  }
+  const childPaths = extractChildScriptPaths(preprocessed, baseDir);
+  node.childPaths = childPaths;
+  for (const childPath of childPaths) {
+    resolveRecursive({
+      path: resolvePath(childPath),
+      depth: depth + 1,
+      maxDepth,
+      maxFileSize,
+      maxTotalSize,
+      visited,
+      result,
+      baseDir: dirname4(resolvePath(childPath)),
+      input
+    });
+    if (result.hasCritical) return;
+  }
+}
+function scanScriptChainWithL1(chain, input) {
+  for (const node of chain.nodes) {
+    if (node.error || !node.preprocessedContent || node.l1Hit) continue;
+    const virtualInput = {
+      ...input,
+      aNext: { actionType: "bash", actionDetail: node.preprocessedContent }
+    };
+    const l1 = runHeuristicCheck(virtualInput);
+    if (l1 && !l1.allowed) {
+      node.l1Hit = true;
+      node.l1RiskLevel = l1.riskLevel;
+      node.l1RiskType = l1.riskType;
+      node.l1Reason = l1.reason;
+      if (l1.riskLevel === "critical") {
+        chain.hasCritical = true;
+        chain.firstHitNode = node;
+        break;
+      }
+    }
+  }
+  return chain;
+}
+function scanScriptChainWithL2(chain, input) {
+  for (const node of chain.nodes) {
+    if (node.error || !node.preprocessedContent) continue;
+    if (node.l1RiskLevel === "critical") break;
+    const virtualInput = {
+      ...input,
+      aNext: { actionType: "bash", actionDetail: node.preprocessedContent }
+    };
+    const l2 = runLogicCheck(virtualInput);
+    if (l2 && !l2.allowed) {
+      node.l2Hit = true;
+      node.l2ViolatedRule = `script_logic:${node.scriptPath}`;
+      node.l2RiskLevel = l2.riskLevel;
+      node.l2RiskType = l2.riskType;
+      node.l2Reason = `\u811A\u672C ${node.scriptPath} (\u6DF1\u5EA6 ${node.depth}) \u4E2D: ${l2.reason}`;
+      if (l2.riskLevel === "critical") {
+        chain.hasCritical = true;
+        chain.firstHitNode = node;
+        break;
+      }
+    }
+  }
+  if (!chain.hasHigh) {
+    chain.hasHigh = chain.nodes.some((n) => ["high", "critical"].includes(n.l2RiskLevel));
+  }
+  return chain;
+}
+function scanScriptChainKeywords(chain) {
+  for (const node of chain.nodes) {
+    if (node.error || !node.preprocessedContent) continue;
+    if (node.l1Hit || node.l2Hit) continue;
+    const matched = scanScriptForKeywords2(node.preprocessedContent);
+    node.matchedKeywords = matched;
+    node.isSuspicious = matched.length > 0;
+    if (matched.length > 0) {
+      const risk = assessKeywordCombinationRisk2(matched, node.preprocessedContent);
+      node.keywordRiskLevel = risk.level;
+      node.keywordRiskReason = risk.reason;
+    }
+  }
+  return chain;
+}
+function analyzeScriptContent2(input) {
+  const actionType = input.aNext.actionType.toLowerCase();
+  if (actionType !== "bash") return emptyChain();
+  const scriptPath = extractScriptPath2(input.aNext.actionDetail);
+  let resolvedPath = scriptPath;
+  if (!resolvedPath) {
+    const inline = extractInlineScriptPath(input.aNext.actionDetail);
+    if (!inline) return emptyChain();
+    resolvedPath = inline;
+  }
+  const chain = resolveScriptChain(resolvedPath, input);
+  if (chain.nodes.length === 0) return chain;
+  scanScriptChainWithL1(chain, input);
+  scanScriptChainWithL2(chain, input);
+  scanScriptChainKeywords(chain);
+  return chain;
+}
+function formatScriptChainForPrompt(chain) {
+  if (chain.nodes.length === 0) return "";
+  const errorNodes = chain.nodes.filter((n) => n.error);
+  if (errorNodes.length > 0 && chain.nodes.length === 1) {
+    return `\u26A0\uFE0F \u811A\u672C\u5185\u5BB9\u5206\u6790\u5931\u8D25: ${errorNodes[0].error}`;
+  }
+  const suspiciousNodes = chain.nodes.filter((n) => n.isSuspicious && !n.l1Hit && !n.l2Hit);
+  if (suspiciousNodes.length === 0) {
+    const safeNodes = chain.nodes.filter((n) => !n.error);
+    if (safeNodes.length === 0) return "";
+    const parts2 = ["\u2713 \u811A\u672C\u5185\u5BB9\u5DF2\u5206\u6790\uFF0C\u672A\u53D1\u73B0\u5371\u9669/\u53EF\u7591\u64CD\u4F5C\uFF08L1/L2/\u5173\u952E\u8BCD\u626B\u63CF\u5747\u672A\u547D\u4E2D\uFF09\uFF1A"];
+    for (const node of safeNodes) {
+      const pre = node.preprocessedContent || "";
+      let preview = pre.slice(0, 600);
+      if (pre.length > 600) preview += `
+... (\u622A\u65AD\uFF0C\u5B8C\u6574\u5185\u5BB9 ${pre.length} \u5B57\u7B26)`;
+      parts2.push(
+        `   \u811A\u672C\u8DEF\u5F84: ${node.scriptPath}\uFF08\u9012\u5F52\u6DF1\u5EA6 ${node.depth}\uFF0C${node.lineCount} \u884C\uFF09
+   \u5185\u5BB9\uFF08\u9884\u5904\u7406\u540E\uFF09:
+\`\`\`
+${preview}
+\`\`\``
+      );
+    }
+    return parts2.join("\n");
+  }
+  const parts = [];
+  for (const node of suspiciousNodes) {
+    const keywordsStr = node.matchedKeywords.join(", ");
+    let riskHint = "";
+    if (node.keywordRiskLevel && node.keywordRiskReason) {
+      riskHint = `
+
+\u{1F534} **\u98CE\u9669\u8BC4\u4F30**: ${node.keywordRiskLevel.toUpperCase()} \u7EA7\u522B
+**\u98CE\u9669\u539F\u56E0**: ${node.keywordRiskReason}
+**\u5EFA\u8BAE**: \u6B64\u811A\u672C\u5E94\u88AB\u62D2\u7EDD\uFF08Deny\uFF09\uFF0C\u9664\u975E\u6709\u660E\u786E\u7684\u4E1A\u52A1\u9700\u6C42\u4E14\u5DF2\u786E\u8BA4\u76EE\u6807\u670D\u52A1\u5668\u53EF\u4FE1\u3002`;
+    }
+    const pre = node.preprocessedContent;
+    let contentPreview = pre.slice(0, 2e3);
+    if (pre.length > 2e3) contentPreview += `
+... (\u622A\u65AD\uFF0C\u5B8C\u6574\u5185\u5BB9 ${pre.length} \u5B57\u7B26)`;
+    parts.push(
+      `\u26A0\uFE0F \u811A\u672C\u5185\u5BB9\u5305\u542B\u53EF\u7591\u5173\u952E\u8BCD:
+   \u811A\u672C\u8DEF\u5F84: ${node.scriptPath}
+   \u9012\u5F52\u6DF1\u5EA6: ${node.depth}
+   \u53EF\u7591\u5173\u952E\u8BCD: ${keywordsStr}
+   \u811A\u672C\u884C\u6570: ${node.lineCount}${riskHint}
+
+### \u811A\u672C\u5185\u5BB9\uFF08\u9884\u5904\u7406\u540E\uFF09###
+\`\`\`
+${contentPreview}
+\`\`\`
+`
+    );
+  }
+  let header = `\u26A0\uFE0F \u68C0\u6D4B\u5230\u811A\u672C\u6267\u884C\u94FE\uFF08\u5171 ${chain.nodes.length} \u4E2A\u811A\u672C\uFF09\uFF0C\u5176\u4E2D ${suspiciousNodes.length} \u4E2A\u5305\u542B\u53EF\u7591\u5173\u952E\u8BCD:
+`;
+  if (chain.maxDepthReached) header += "\u26A0\uFE0F \u6CE8\u610F\uFF1A\u9012\u5F52\u8FFD\u8E2A\u89E6\u8FBE\u6DF1\u5EA6\u4E0A\u9650\uFF0C\u53EF\u80FD\u5B58\u5728\u66F4\u6DF1\u5C42\u7684\u811A\u672C\u8C03\u7528\u672A\u88AB\u626B\u63CF\u3002\n";
+  if (chain.maxSizeReached) header += "\u26A0\uFE0F \u6CE8\u610F\uFF1A\u7D2F\u8BA1\u6587\u4EF6\u5927\u5C0F\u89E6\u8FBE\u4E0A\u9650\uFF0C\u90E8\u5206\u811A\u672C\u53EF\u80FD\u672A\u88AB\u5B8C\u6574\u8BFB\u53D6\u3002\n";
+  return header + parts.join("\n---\n\n");
+}
+var SUSPICIOUS_PATTERNS2, SCRIPT_EXEC_PATTERNS2, KEYWORD_COMBINATION_RISKS2, SINGLE_KEYWORD_RISKS2, LEVEL_ORDER2, CHILD_SCRIPT_PATTERNS;
+var init_script_content_analyzer = __esm({
+  "src/engine/script-content-analyzer.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_heuristic();
+    init_logic_rules();
+    SUSPICIOUS_PATTERNS2 = [
+      { name: "curl POST", pattern: /curl\s+(.*\s)?-X\s+POST/i },
+      { name: "curl --data", pattern: /curl\s+(.*\s)?--data/i },
+      { name: "curl -d", pattern: /curl\s+(.*\s)?-d\s/i },
+      { name: "wget --post-data", pattern: /wget\s+(.*\s)?--post-data/i },
+      { name: "wget --post-file", pattern: /wget\s+(.*\s)?--post-file/i },
+      { name: "nc -e", pattern: /\bnc\s+.*-e\b/ },
+      { name: "ncat -e", pattern: /\bncat\s+.*-e\b/ },
+      { name: "/dev/tcp", pattern: /\/dev\/tcp\// },
+      { name: "/dev/udp", pattern: /\/dev\/udp\// },
+      { name: "$(base64", pattern: /\$\(\s*base64/ },
+      { name: "`base64", pattern: /`\s*base64/ },
+      { name: "base64 decode pipe", pattern: /base64\s+(-d|--decode)\s*\|/ },
+      { name: "/etc/shadow", pattern: /\/etc\/shadow/ },
+      { name: "id_rsa", pattern: /\bid_rsa\b/ },
+      { name: "id_ed25519", pattern: /\bid_ed25519\b/ },
+      { name: "crontab install", pattern: /crontab\s+-/ },
+      { name: "authorized_keys", pattern: /authorized_keys/ },
+      { name: "ssh no host key check", pattern: /ssh\s+.*StrictHostKeyChecking\s*=\s*no/ }
+    ];
+    SCRIPT_EXEC_PATTERNS2 = [
+      /(?:^|\s|&&|\|\|)\s*bash\s+(\S+)/i,
+      /(?:^|\s|&&|\|\|)\s*\/bin\/bash\s+(\S+)/i,
+      /(?:^|\s|&&|\|\|)\s*sh\s+(\S+)/i,
+      /(?:^|\s|&&|\|\|)\s*zsh\s+(\S+)/i,
+      /\.\/(\S+)/,
+      /(?:^|\s|&&|\|\|)\s*source\s+(\S+)/i,
+      /(?:^|\s|&&|\|\|)\s*\.\s+(\S+)/,
+      /(?:^|\s|&&|\|\|)\s*python3?\s+(\S+\.py)/i,
+      /(?:^|\s|&&|\|\|)\s*node\s+(\S+\.js)/i,
+      /(?:^|\s|&&|\|\|)\s*ruby\s+(\S+\.rb)/i,
+      /(?:^|\s|&&|\|\|)\s*perl\s+(\S+\.pl)/i,
+      /(?:^|\s|&&|\|\|)\s*php\s+(\S+\.php)/i,
+      /(?:^|\s|&&|\|\|)\s*lua\s+(\S+\.lua)/i
+    ];
+    KEYWORD_COMBINATION_RISKS2 = [
+      {
+        group1: /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]),
+        group2: /* @__PURE__ */ new Set(["$(base64", "`base64", "base64 decode pipe"]),
+        level: "critical",
+        reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + Base64\u7F16\u7801\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u6570\u636E\u5916\u4F20\u98CE\u9669\u3002\u653B\u51FB\u8005\u53EF\u80FD\u5C06\u654F\u611F\u6570\u636E\u7F16\u7801\u540E\u5916\u4F20\u3002"
+      },
+      {
+        group1: /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]),
+        group2: /* @__PURE__ */ new Set(["/etc/shadow", "id_rsa", "id_ed25519"]),
+        level: "critical",
+        reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + \u654F\u611F\u6587\u4EF6\u8BBF\u95EE\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u51ED\u8BC1\u5916\u4F20\u98CE\u9669\u3002"
+      },
+      {
+        group1: /* @__PURE__ */ new Set(["nc -e", "ncat -e", "/dev/tcp", "/dev/udp"]),
+        group2: /* @__PURE__ */ new Set(),
+        level: "high",
+        reason: "\u68C0\u6D4B\u5230\u53CD\u5F39 Shell \u7279\u5F81\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5EFA\u7ACB\u8FDC\u7A0B\u63A7\u5236\u901A\u9053\u3002"
+      },
+      {
+        group1: /* @__PURE__ */ new Set(["crontab install", "authorized_keys", "ssh no host key check"]),
+        group2: /* @__PURE__ */ new Set(),
+        level: "high",
+        reason: "\u68C0\u6D4B\u5230\u6301\u4E45\u5316\u540E\u95E8\u7279\u5F81\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5728\u7CFB\u7EDF\u4E2D\u690D\u5165\u540E\u95E8\u3002"
+      }
+    ];
+    SINGLE_KEYWORD_RISKS2 = {
+      "curl POST": { level: "high", reason: "\u68C0\u6D4B\u5230 curl POST \u8BF7\u6C42\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+      "curl --data": { level: "high", reason: "\u68C0\u6D4B\u5230 curl --data \u53C2\u6570\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+      "curl -d": { level: "high", reason: "\u68C0\u6D4B\u5230 curl -d \u53C2\u6570\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+      "wget --post-data": { level: "high", reason: "\u68C0\u6D4B\u5230 wget POST \u8BF7\u6C42\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+      "wget --post-file": { level: "high", reason: "\u68C0\u6D4B\u5230 wget \u6587\u4EF6\u4E0A\u4F20\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6587\u4EF6\u3002" },
+      "nc -e": { level: "critical", reason: "\u68C0\u6D4B\u5230 nc -e \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+      "ncat -e": { level: "critical", reason: "\u68C0\u6D4B\u5230 ncat -e \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+      "/dev/tcp": { level: "critical", reason: "\u68C0\u6D4B\u5230 /dev/tcp \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+      "/dev/udp": { level: "critical", reason: "\u68C0\u6D4B\u5230 /dev/udp \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+      "$(base64": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u7F16\u7801\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
+      "`base64": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u7F16\u7801\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
+      "base64 decode pipe": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u89E3\u7801\u540E\u7BA1\u9053\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
+      "/etc/shadow": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6\u3002" },
+      "id_rsa": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE SSH \u79C1\u94A5\u3002" },
+      "id_ed25519": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE SSH \u79C1\u94A5\u3002" },
+      "crontab install": { level: "high", reason: "\u68C0\u6D4B\u5230\u4FEE\u6539\u5B9A\u65F6\u4EFB\u52A1\uFF0C\u53EF\u80FD\u662F\u6301\u4E45\u5316\u540E\u95E8\u3002" },
+      "authorized_keys": { level: "high", reason: "\u68C0\u6D4B\u5230\u4FEE\u6539 SSH \u6388\u6743\u5BC6\u94A5\uFF0C\u53EF\u80FD\u662F\u6301\u4E45\u5316\u540E\u95E8\u3002" },
+      "ssh no host key check": { level: "high", reason: "\u68C0\u6D4B\u5230 SSH \u8DF3\u8FC7\u4E3B\u673A\u5BC6\u94A5\u9A8C\u8BC1\uFF0C\u53EF\u80FD\u662F\u6A2A\u5411\u79FB\u52A8\u3002" }
+    };
+    LEVEL_ORDER2 = { low: 1, medium: 2, high: 3, critical: 4 };
+    CHILD_SCRIPT_PATTERNS = [
+      /(?:^|\s|&&|\|\|)\s*bash\s+(\S+)/i,
+      /(?:^|\s|&&|\|\|)\s*sh\s+(\S+)/i,
+      /(?:^|\s|&&|\|\|)\s*source\s+(\S+)/i,
+      /(?:^|\s|&&|\|\|)\s*\.\s+(\S+)/,
+      /(?:^|\s|&&|\|\|)\s*python3?\s+(\S+\.py)/i,
+      /(?:^|\s|&&|\|\|)\s*node\s+(\S+\.js)/i,
+      /(?:^|\s|&&|\|\|)\s*ruby\s+(\S+\.rb)/i,
+      /(?:^|\s|&&|\|\|)\s*perl\s+(\S+\.pl)/i,
+      /(?:^|\s|&&|\|\|)\s*php\s+(\S+\.php)/i,
+      /(?:^|\s|&&|\|\|)\s*lua\s+(\S+\.lua)/i
+    ];
+  }
+});
+
+// src/engine/token-stats.ts
+var token_stats_exports = {};
+__export(token_stats_exports, {
+  getRecentRecords: () => getRecentRecords,
+  getTokenStats: () => getTokenStats,
+  getTokenTrend: () => getTokenTrend,
+  recordTokenUsage: () => recordTokenUsage,
+  resetTokenStats: () => resetTokenStats
+});
+import { readFileSync as readFileSync6, writeFileSync, existsSync as existsSync6, mkdirSync, unlinkSync } from "fs";
+import { join as join3 } from "path";
+import { homedir as homedir2 } from "os";
+function getStatsPath() {
+  const envPath = process.env[ENV_STATS_PATH];
+  return envPath || STATS_FILE;
+}
+function loadAllRecords(statsPath) {
+  if (!existsSync6(statsPath)) return [];
+  try {
+    const data = JSON.parse(readFileSync6(statsPath, "utf-8"));
+    if (Array.isArray(data)) return data;
+    if (data && Array.isArray(data.records)) return data.records;
+    return [];
+  } catch (e) {
+    return [];
+  }
+}
+function saveRecords(statsPath, records) {
+  try {
+    const dir = statsPath.substring(0, statsPath.lastIndexOf("/"));
+    if (dir && !existsSync6(dir)) mkdirSync(dir, { recursive: true });
+    writeFileSync(statsPath, JSON.stringify(records, null, 2), "utf-8");
+  } catch (e) {
+  }
+}
+function recordTokenUsage(record) {
+  const statsPath = getStatsPath();
+  const records = loadAllRecords(statsPath);
+  records.push({
+    timestamp: record.timestamp || (/* @__PURE__ */ new Date()).toISOString(),
+    session_id: record.sessionId,
+    step: record.step,
+    model: record.model,
+    prompt_tokens: record.promptTokens,
+    completion_tokens: record.completionTokens,
+    total_tokens: record.totalTokens
+  });
+  if (records.length > MAX_RECORDS) {
+    records.splice(0, records.length - MAX_RECORDS);
+  }
+  saveRecords(statsPath, records);
+}
+function filterByDate(records, days = 0, startDate, endDate) {
+  if (startDate || endDate) {
+    let startDt = startDate ? new Date(startDate) : /* @__PURE__ */ new Date(-864e13);
+    let endDt = endDate ? new Date(endDate) : void 0;
+    if (endDate) {
+      const e = new Date(endDate);
+      e.setHours(23, 59, 59, 999);
+      endDt = e;
+    }
+    const endMs = endDt ? endDt.getTime() : Number.MAX_SAFE_INTEGER;
+    return records.filter((r) => {
+      try {
+        const ts = new Date(r.timestamp).getTime();
+        return ts >= startDt.getTime() && ts <= endMs;
+      } catch {
+        return true;
+      }
+    });
+  } else if (days > 0) {
+    const cutoff = Date.now() - days * 864e5;
+    return records.filter((r) => {
+      try {
+        return new Date(r.timestamp).getTime() >= cutoff;
+      } catch {
+        return true;
+      }
+    });
+  }
+  return records;
+}
+function aggregate(records) {
+  let totalPrompt = 0, totalCompletion = 0, totalTotal = 0;
+  const byStep = {};
+  const byModel = {};
+  const byDate = {};
+  const bucket = (b, key, r) => {
+    const e = b[key] || (b[key] = { prompt_tokens: 0, completion_tokens: 0, total_tokens: 0, calls: 0 });
+    e.prompt_tokens += r.prompt_tokens || 0;
+    e.completion_tokens += r.completion_tokens || 0;
+    e.total_tokens += r.total_tokens || 0;
+    e.calls += 1;
+  };
+  for (const r of records) {
+    totalPrompt += r.prompt_tokens || 0;
+    totalCompletion += r.completion_tokens || 0;
+    totalTotal += r.total_tokens || 0;
+    bucket(byStep, r.step || "unknown", r);
+    bucket(byModel, r.model || "unknown", r);
+    let dateKey = "unknown";
+    try {
+      dateKey = new Date(r.timestamp).toISOString().slice(0, 10);
+    } catch {
+    }
+    bucket(byDate, dateKey, r);
+  }
+  const sortedDate = Object.keys(byDate).sort((a, b) => a < b ? 1 : a > b ? -1 : 0);
+  const sortedByDate = {};
+  for (const k of sortedDate) sortedByDate[k] = byDate[k];
+  return { totalPrompt, totalCompletion, totalTotal, byStep, byModel, byDate: sortedByDate };
+}
+function getTokenStats(days = 0, startDate, endDate) {
+  const records = filterByDate(loadAllRecords(getStatsPath()), days, startDate, endDate);
+  const a = aggregate(records);
+  return {
+    total_prompt_tokens: a.totalPrompt,
+    total_completion_tokens: a.totalCompletion,
+    total_tokens: a.totalTotal,
+    total_calls: records.length,
+    by_step: a.byStep,
+    by_model: a.byModel,
+    by_date: a.byDate
+  };
+}
+function getRecentRecords(limit = 20) {
+  const records = loadAllRecords(getStatsPath());
+  return records.slice(-limit);
+}
+function getTokenTrend(days = 0, startDate, endDate) {
+  const records = filterByDate(loadAllRecords(getStatsPath()), days, startDate, endDate);
+  const series = {};
+  const datesSet = /* @__PURE__ */ new Set();
+  for (const r of records) {
+    let dateKey;
+    try {
+      dateKey = new Date(r.timestamp).toISOString().slice(0, 10);
+    } catch {
+      continue;
+    }
+    const model = r.model || "unknown";
+    const tokens = r.total_tokens || 0;
+    datesSet.add(dateKey);
+    series[model] = series[model] || {};
+    series[model][dateKey] = (series[model][dateKey] || 0) + tokens;
+  }
+  const dates = Array.from(datesSet).sort();
+  const models = Object.keys(series).sort();
+  return { dates, models, series };
+}
+function resetTokenStats() {
+  const statsPath = getStatsPath();
+  if (existsSync6(statsPath)) {
+    try {
+      unlinkSync(statsPath);
+    } catch {
+    }
+  }
+}
+var STATS_DIR, STATS_FILE, ENV_STATS_PATH, MAX_RECORDS;
+var init_token_stats = __esm({
+  "src/engine/token-stats.ts"() {
+    "use strict";
+    init_esm_shims();
+    STATS_DIR = join3(homedir2(), ".config", "agentmoss");
+    STATS_FILE = join3(STATS_DIR, "agent_moss_token_stats.json");
+    ENV_STATS_PATH = "AGENT_MOSS_TOKEN_STATS_PATH";
+    MAX_RECORDS = 1e4;
+  }
+});
+
+// src/engine/llm-analyzer.ts
+import { appendFileSync } from "fs";
+import OpenAI from "openai";
+async function runLLMAnalysis(input, previous) {
+  if (!isLLMAvailable()) {
+    console.log("[AgentMoss] LLM not configured, skipping deep analysis");
+    return {
+      allowed: true,
+      reason: "LLM \u672A\u914D\u7F6E\uFF0C\u8DF3\u8FC7\u6DF1\u5C42\u5206\u6790",
+      riskLevel: "low",
+      riskType: "",
+      confidence: 50,
+      source: "llm",
+      violatedLayers: []
+    };
+  }
+  const globalConfig = getLLMConfig();
+  const config = input.llmConfig?.apiKey ? { ...globalConfig, ...input.llmConfig } : globalConfig;
+  const rawDetail = input.aNext.actionDetail.replace(/^terminal-\w+:\s*command=([^,]+).*/, "$1").trim();
+  const cacheKey = `${input.aNext.actionType}:${rawDetail || input.aNext.actionDetail}`;
+  const cached = llmCache.get(cacheKey);
+  if (cached) {
+    console.log("[AgentMoss] LLM cache hit");
+    return cached;
+  }
+  const matchedSkills = matchSkills(input.aNext.actionType, input.aNext.actionDetail, input.reason);
+  const templates = loadTemplates();
+  let scriptAnalysis;
+  let scriptChainText = "";
+  if (previous.scriptChain) {
+    scriptChainText = formatScriptChainForPrompt(previous.scriptChain);
+  } else {
+    scriptAnalysis = analyzeScriptContent(input.aNext.actionType, input.aNext.actionDetail);
+  }
+  const prompt = buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis, previous.skipL3Hints ?? "", scriptChainText);
+  logPrompt(prompt, input.aNext, previous.llmLogPath);
+  const result = await analyzeWithLLM(prompt, config);
+  if (llmCache.size >= LLM_CACHE_MAX) {
+    const firstKey = llmCache.keys().next().value;
+    if (firstKey) llmCache.delete(firstKey);
+  }
+  llmCache.set(cacheKey, result);
+  return result;
+}
+function logPrompt(prompt, aNext, logPath) {
+  if (!logPath) return;
+  try {
+    const actionType = aNext.actionType || "unknown";
+    const actionDetail = (aNext.actionDetail || "").slice(0, 100);
+    const line = `[${(/* @__PURE__ */ new Date()).toISOString()}] [LLM_PROMPT] action_type=${actionType}, action_detail=${actionDetail}... prompt_length=${prompt.length}
+${prompt}
+--- END PROMPT ---
+`;
+    appendFileSync(logPath, line, "utf-8");
+  } catch (e) {
+    console.warn("[AgentMoss] Failed to write LLM prompt to log:", e);
+  }
+}
+function buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis, skipL3Hints = "", scriptChainText = "") {
+  const skillsText = formatSkillsForPrompt(matchedSkills);
+  const historyStr = input.actionHistory.map((h, i) => `${i + 1}. ${h.actionType}: ${h.actionDetail}`).join("\n") || "(\u65E0\u5386\u53F2\u64CD\u4F5C)";
+  const scriptAnalysisText = scriptChainText ? scriptChainText : scriptAnalysis ? formatScriptAnalysisForPrompt(scriptAnalysis) : "";
+  const hintsText = formatHints(previous);
+  const securityJudgeTemplate = templates["security_judge"];
+  if (securityJudgeTemplate) {
+    return securityJudgeTemplate.replaceAll("{prompt_session}", input.promptSession || "\uFF08\u672A\u63D0\u4F9B\uFF09").replaceAll("{action_history}", historyStr).replaceAll("{action_type}", input.aNext.actionType).replaceAll("{action_detail}", input.aNext.actionDetail).replaceAll("{reason}", input.reason || "\u672A\u8BF4\u660E").replaceAll("{skills_text}", skillsText).replaceAll("{hints_text}", hintsText).replaceAll("{script_analysis_text}", scriptAnalysisText).replaceAll("{skip_l3_hints}", skipL3Hints).replaceAll("{{", "{").replaceAll("}}", "}");
+  }
+  console.warn("[AgentMoss] security_judge template missing, using sparse fallback prompt");
+  return `## \u5F53\u524D\u64CD\u4F5C\u4E0A\u4E0B\u6587
+- \u4F1A\u8BDD ID: ${input.sessionId}
+- \u7528\u6237\u4EFB\u52A1: ${input.promptSession || "\u672A\u6307\u5B9A"}
+- \u64CD\u4F5C\u7CFB\u7EDF: ${input.osType}
+- \u5DE5\u4F5C\u76EE\u5F55: ${input.cwd || "/"}
+- \u64CD\u4F5C\u539F\u56E0: ${input.reason || "\u672A\u8BF4\u660E"}
+- \u5386\u53F2\u64CD\u4F5C\u5E8F\u5217:
+${historyStr}
+
+- \u5373\u5C06\u6267\u884C\u7684\u64CD\u4F5C:
+  \u7C7B\u578B: ${input.aNext.actionType}
+  \u8BE6\u60C5: ${input.aNext.actionDetail}
+
+## \u53EF\u7528\u5B89\u5168 Skill
+${skillsText}
+
+## \u524D\u7F6E\u68C0\u6D4B\u7ED3\u679C
+${hintsText}
+${scriptAnalysisText ? `
+## \u811A\u672C\u5185\u5BB9\u5206\u6790
+${scriptAnalysisText}` : ""}
+
+\u8BF7\u6839\u636E\u4EE5\u4E0A\u4FE1\u606F\uFF0C\u5BF9\u5373\u5C06\u6267\u884C\u7684\u64CD\u4F5C\u8FDB\u884C\u5B89\u5168\u5224\u65AD\u3002\u524D\u7F6E\u68C0\u6D4B\u4E3A low/medium \u4E14\u6709\u5408\u7406\u6267\u884C\u7406\u7531\u65F6\u5E94\u5F53\u5141\u8BB8\u3002\u4F60\u5FC5\u987B\u8F93\u51FA\u4E25\u683C\u7684 JSON \u683C\u5F0F\uFF0C\u4E0D\u8981\u5305\u542B\u4EFB\u4F55\u5176\u4ED6\u6587\u5B57\u3001\u6CE8\u91CA\u6216 markdown \u6807\u8BB0\u3002
+
+\u8F93\u51FA\u683C\u5F0F:
+{"allowed": true/false, "reason": "\u5224\u65AD\u7406\u7531", "riskLevel": "low|medium|high|critical", "riskType": "\u98CE\u9669\u7C7B\u578B", "confidence": 0-100}`;
+}
+function formatHints(previous) {
+  const hints = [];
+  if (previous.heuristic) {
+    hints.push(
+      `\u542F\u53D1\u5F0F\u68C0\u6D4B\u53D1\u73B0\u98CE\u9669 [\u98CE\u9669\u7B49\u7EA7: ${previous.heuristic.riskLevel}]:
+   \u7C7B\u578B: ${previous.heuristic.riskType}
+   \u539F\u56E0: ${previous.heuristic.reason}`
+    );
+  }
+  if (previous.logic) {
+    hints.push(
+      `\u903B\u8F91\u89C4\u5219\u68C0\u6D4B\u53D1\u73B0\u98CE\u9669 [\u98CE\u9669\u7B49\u7EA7: ${previous.logic.riskLevel}]:
+   \u7C7B\u578B: ${previous.logic.riskType}
+   \u539F\u56E0: ${previous.logic.reason}`
+    );
+  }
+  return hints.length > 0 ? hints.join("\n\n") : "\u542F\u53D1\u5F0F\u68C0\u6D4B\u548C\u903B\u8F91\u89C4\u5219\u68C0\u6D4B\u5747\u672A\u53D1\u73B0\u98CE\u9669\u3002";
+}
+async function analyzeWithLLM(prompt, config) {
+  console.log(`[AgentMoss] LLM analyzing with model: ${config.model}, url: ${config.baseUrl}`);
+  const provider = detectProvider(config.baseUrl, config.provider);
+  const extraHeaders = getProviderHeaders(provider);
+  if (Object.keys(extraHeaders).length > 0) {
+    console.log(`[AgentMoss] Provider detected: ${provider}, injecting headers: ${Object.keys(extraHeaders).join(", ")}`);
+  }
+  const timeoutCfg = getTimeoutConfig();
+  const retryCfg = getRetryConfig();
+  const client = new OpenAI({
+    baseURL: config.baseUrl,
+    apiKey: config.apiKey,
+    // 单次 LLM 调用超时用 prompt1Timeout（对齐 py）；env 覆盖的 config.timeout 仍向后兼容
+    timeout: (config.timeout || timeoutCfg.prompt1Timeout) * 1e3,
+    defaultHeaders: Object.keys(extraHeaders).length > 0 ? extraHeaders : void 0
+  });
+  const maxRetries = parseInt(process.env.AGENT_MOSS_LLM_RETRIES || String(retryCfg.maxRetries), 10);
+  const totalTimeoutMs = timeoutCfg.totalTimeout * 1e3;
+  const abortController = new AbortController();
+  const totalTimeoutTimer = setTimeout(() => {
+    console.error(`[AgentMoss] totalTimeout (${timeoutCfg.totalTimeout}s) exceeded, aborting all LLM calls`);
+    abortController.abort();
+  }, totalTimeoutMs);
+  for (let attempt = 0; attempt <= maxRetries; attempt++) {
+    if (abortController.signal.aborted) {
+      break;
+    }
+    try {
+      const response = await client.chat.completions.create({
+        model: config.model,
+        temperature: config.temperature || 0.1,
+        max_tokens: config.maxTokens || 1024,
+        messages: [
+          { role: "system", content: "\u53EA\u8F93\u51FA\u7EAF JSON\uFF0C\u4E0D\u8981\u5305\u542B markdown \u6807\u8BB0\u3001\u4EE3\u7801\u5757\u6216\u4EFB\u4F55\u5176\u4ED6\u6587\u5B57\u3002" },
+          { role: "user", content: prompt }
+        ],
+        signal: abortController.signal
+      });
+      const content = response.choices[0]?.message?.content || "{}";
+      console.log(`[AgentMoss] LLM raw response (attempt ${attempt + 1}/${maxRetries + 1}): ${content.substring(0, 300)}`);
+      let jsonStr = content.trim();
+      if (jsonStr.startsWith("```")) {
+        jsonStr = jsonStr.replace(/^```[\w]*\n?/, "").replace(/\n?```$/, "");
+      }
+      const parsed = JSON.parse(jsonStr);
+      try {
+        const usage = response.usage;
+        const { recordTokenUsage: recordTokenUsage2 } = await Promise.resolve().then(() => (init_token_stats(), token_stats_exports));
+        recordTokenUsage2({
+          sessionId: "audit",
+          step: "L3_security_judge",
+          model: response.model || config.model,
+          promptTokens: usage?.prompt_tokens || 0,
+          completionTokens: usage?.completion_tokens || 0,
+          totalTokens: usage?.total_tokens || 0
+        });
+      } catch {
+      }
+      clearTimeout(totalTimeoutTimer);
+      return {
+        allowed: parsed.allowed !== false,
+        reason: parsed.reason || "LLM \u5206\u6790\u5B8C\u6210",
+        riskLevel: ["low", "medium", "high", "critical"].includes(parsed.riskLevel) ? parsed.riskLevel : "low",
+        riskType: parsed.riskType || "",
+        confidence: typeof parsed.confidence === "number" ? Math.min(100, Math.max(0, parsed.confidence)) : 70,
+        source: "llm",
+        violatedLayers: ["3"]
+      };
+    } catch (err) {
+      if (abortController.signal.aborted) {
+        console.error(`[AgentMoss] LLM analysis aborted by totalTimeout (${timeoutCfg.totalTimeout}s)`);
+        break;
+      }
+      if (attempt < maxRetries) {
+        console.error(`[AgentMoss] LLM call failed (attempt ${attempt + 1}/${maxRetries + 1}), retrying in ${retryCfg.retryInterval}s:`, err.message);
+        await new Promise((resolve6) => setTimeout(resolve6, retryCfg.retryInterval * 1e3));
+      } else {
+        clearTimeout(totalTimeoutTimer);
+        console.error("[AgentMoss] LLM call failed after all retries:", err.message);
+        throw new Error(`LLM \u5206\u6790\u5931\u8D25 (${maxRetries + 1} \u6B21\u5C1D\u8BD5): ${err.message}`);
+      }
+    }
+  }
+  clearTimeout(totalTimeoutTimer);
+  throw new Error(`LLM \u5206\u6790\u8D85\u65F6\uFF08totalTimeout ${timeoutCfg.totalTimeout}s\uFF09`);
+}
+var llmCache, LLM_CACHE_MAX;
+var init_llm_analyzer = __esm({
+  "src/engine/llm-analyzer.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_config();
+    init_skill_loader();
+    init_template_loader();
+    init_script_analyzer();
+    init_script_content_analyzer();
+    llmCache = /* @__PURE__ */ new Map();
+    LLM_CACHE_MAX = 200;
+  }
+});
+
+// src/infra/runtime-config.ts
+var runtime_config_exports = {};
+__export(runtime_config_exports, {
+  DENY_MODE_LABELS: () => DENY_MODE_LABELS,
+  addCustomRule: () => addCustomRule,
+  addCustomSkill: () => addCustomSkill,
+  deleteCustomRule: () => deleteCustomRule,
+  deleteCustomSkill: () => deleteCustomSkill,
+  filterEnabledRules: () => filterEnabledRules,
+  generateSourceDefaults: () => generateSourceDefaults,
+  getDisabledL2RulesWithSkipL3: () => getDisabledL2RulesWithSkipL3,
+  getDisabledSkillIds: () => getDisabledSkillIds,
+  getEnabledL1CommandPatterns: () => getEnabledL1CommandPatterns,
+  getEnabledL1CommandPatternsOrDefault: () => getEnabledL1CommandPatternsOrDefault,
+  getEnabledL1InjectionKeywords: () => getEnabledL1InjectionKeywords,
+  getEnabledL1InjectionKeywordsOrDefault: () => getEnabledL1InjectionKeywordsOrDefault,
+  getEnabledL2IntentPatterns: () => getEnabledL2IntentPatterns,
+  getEnabledL2IntentPatternsOrDefault: () => getEnabledL2IntentPatternsOrDefault,
+  getEnabledL2PasswordPatterns: () => getEnabledL2PasswordPatterns,
+  getEnabledL2PasswordPatternsOrDefault: () => getEnabledL2PasswordPatternsOrDefault,
+  getEnabledL2SensitivePaths: () => getEnabledL2SensitivePaths,
+  getEnabledL2SensitivePathsOrDefault: () => getEnabledL2SensitivePathsOrDefault,
+  getEnabledL2UserDeletionPatterns: () => getEnabledL2UserDeletionPatterns,
+  getEnabledL2UserDeletionPatternsOrDefault: () => getEnabledL2UserDeletionPatternsOrDefault,
+  getEnvOverrides: () => getEnvOverrides,
+  getProfileOrDetect: () => getProfileOrDetect,
+  getRuntimeConfigPath: () => getRuntimeConfigPath,
+  hasRuntimeConfig: () => hasRuntimeConfig,
+  isL2CategoryEnabled: () => isL2CategoryEnabled,
+  isLayerEnabled: () => isLayerEnabled,
+  loadRuntimeConfig: () => loadRuntimeConfig,
+  mergeConfig: () => mergeConfig,
+  saveRuntimeConfig: () => saveRuntimeConfig,
+  updateCategoryEnabled: () => updateCategoryEnabled,
+  updateLayerEnabled: () => updateLayerEnabled,
+  updateRuleDenyMode: () => updateRuleDenyMode,
+  updateRuleEnabled: () => updateRuleEnabled,
+  updateRuleSkipL3: () => updateRuleSkipL3,
+  updateSkillCategoryEnabled: () => updateSkillCategoryEnabled,
+  updateSkillEnabled: () => updateSkillEnabled
+});
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync2, existsSync as existsSync7, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2 } from "fs";
+import { join as join4 } from "path";
+import { homedir as homedir3 } from "os";
+function getRuntimeConfigPath() {
+  const envPath = process.env[ENV_RUNTIME_CONFIG_PATH];
+  if (envPath) return envPath;
+  return RUNTIME_CONFIG_PATH;
+}
+function saveRuntimeConfig(config) {
+  const p = getRuntimeConfigPath();
+  const dir = p.substring(0, p.lastIndexOf("/"));
+  if (dir && !existsSync7(dir)) mkdirSync2(dir, { recursive: true });
+  writeFileSync2(p, JSON.stringify(config, null, 2), "utf-8");
+}
+function emptyRuntimeConfig() {
+  return {
+    version: 1,
+    layers: { L1_heuristic: true, L2_logic_rules: true, L3_llm_analysis: true },
+    L1_rules: {},
+    L2_rules: {},
+    L3_skills: {}
+  };
+}
+function loadRuntimeConfig() {
+  const p = getRuntimeConfigPath();
+  if (!existsSync7(p)) {
+    const seeded = mergeConfig({}, generateSourceDefaults());
+    try {
+      saveRuntimeConfig(seeded);
+    } catch {
+    }
+    return seeded;
+  }
+  try {
+    const data = JSON.parse(readFileSync7(p, "utf-8"));
+    const merged = mergeConfig(data, generateSourceDefaults());
+    return {
+      version: data.version || 1,
+      layers: {
+        L1_heuristic: data.layers?.L1_heuristic ?? true,
+        L2_logic_rules: data.layers?.L2_logic_rules ?? true,
+        L3_llm_analysis: data.layers?.L3_llm_analysis ?? true
+      },
+      L1_rules: merged.L1_rules || {},
+      L2_rules: merged.L2_rules || {},
+      L3_skills: merged.L3_skills || {}
+    };
+  } catch {
+    return emptyRuntimeConfig();
+  }
+}
+function isLayerEnabled(layerKey) {
+  const disableKey = LAYER_DISABLE_ENV[layerKey];
+  if (disableKey && process.env[disableKey] === "1") return false;
+  const runtime = loadRuntimeConfig();
+  const layers = runtime.layers || {};
+  if (layerKey in layers) return !!layers[layerKey];
+  return true;
+}
+function getEnvOverrides() {
+  const overrides = {};
+  for (const [layerKey, envKey] of Object.entries(LAYER_DISABLE_ENV)) {
+    const val = process.env[envKey];
+    if (val !== void 0) {
+      overrides[layerKey] = {
+        env_var: envKey,
+        env_value: val,
+        overridden: val === "1",
+        effect: val === "1" ? "disabled" : "no_override"
+      };
+    }
+  }
+  return overrides;
+}
+function filterEnabledRules(rules, categoryEnabled = true) {
+  if (!categoryEnabled) return [];
+  return rules.filter((r) => r.enabled !== false);
+}
+function getEnabledL1CommandPatterns(runtime) {
+  const cat = runtime.L1_rules?.dangerous_commands || { category_enabled: true, rules: [] };
+  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => ({
+    pattern: r.pattern || "",
+    risk_level: r.risk_level || "",
+    risk_type: r.risk_type || "",
+    reason: r.reason || ""
+  }));
+}
+function getEnabledL2SensitivePaths(runtime) {
+  const cat = runtime.L2_rules?.sensitive_path_access || { category_enabled: true, rules: [] };
+  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => {
+    const out = { path: r.path || "", risk_level: r.risk_level || "", desc: r.desc || "", deny_mode: r.deny_mode || "deny_write" };
+    if (r.credential) out.credential = true;
+    if (r.read_only) out.read_only = true;
+    return out;
+  });
+}
+function hasRuntimeConfig() {
+  const p = getRuntimeConfigPath();
+  if (!existsSync7(p)) return false;
+  try {
+    JSON.parse(readFileSync7(p, "utf-8"));
+    return true;
+  } catch {
+    return false;
+  }
+}
+function getDisabledL2RulesWithSkipL3() {
+  let runtime;
+  try {
+    runtime = loadRuntimeConfig();
+  } catch {
+    return {};
+  }
+  const result = {};
+  const l2 = runtime.L2_rules || {};
+  for (const [catName, cat] of Object.entries(l2)) {
+    if (!cat.category_enabled) continue;
+    const items = [];
+    for (const r of cat.rules || []) {
+      if (r.enabled === false && r.skip_l3_on_disabled) {
+        if (catName === "sensitive_path_access") {
+          if (r.path) items.push(r.path);
+        } else if (catName === "intent_consistency") {
+          items.push(...r.intent_keywords || []);
+        } else if (r.pattern) {
+          items.push(r.pattern);
+        }
+      }
+    }
+    if (items.length > 0) result[catName] = items;
+  }
+  return result;
+}
+function _slugify(text) {
+  return text.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_|_$/g, "") || "x";
+}
+function _generatePatternId(pattern) {
+  return `pat_${_slugify(pattern)}`;
+}
+function _deriveDenyMode(rule) {
+  if (rule.deny_mode) return rule.deny_mode;
+  if (rule.credential) return "deny_both";
+  if (rule.read_only) return "deny_read";
+  return "deny_write";
+}
+function _syncDenyModeFields(rule) {
+  const dm = rule.deny_mode || "deny_write";
+  if (dm === "deny_both") {
+    rule.credential = true;
+    delete rule.read_only;
+  } else if (dm === "deny_read") {
+    delete rule.credential;
+    rule.read_only = true;
+  } else {
+    delete rule.credential;
+    delete rule.read_only;
+  }
+}
+function _l1CommandPatternsToRules() {
+  return DANGEROUS_PATTERNS.map((p) => ({
+    id: _generatePatternId(p.pattern instanceof RegExp ? p.pattern.source : p.pattern),
+    pattern: p.pattern instanceof RegExp ? p.pattern.source : p.pattern,
+    risk_level: p.severity,
+    risk_type: p.riskType,
+    reason: p.description,
+    enabled: true,
+    builtin: true
+  }));
+}
+function _l1InjectionKeywordsToRules() {
+  return INJECTION_KEYWORDS.map((kw) => ({
+    id: `inj_${_slugify(kw.keyword)}`,
+    keyword: kw.keyword,
+    risk_level: kw.riskLevel,
+    lang: kw.lang || "en",
+    enabled: true,
+    builtin: true
+  }));
+}
+function _l2SensitivePathsToRules() {
+  const all = [...ROOT_SENSITIVE_PATHS, ...HOME_SENSITIVE_PATHS, ...CREDENTIAL_PATHS];
+  return all.map((sp) => {
+    const denyMode = _deriveDenyMode({
+      deny_mode: sp.deny_mode,
+      credential: sp.credential,
+      read_only: sp.read_only
+    });
+    const rule = {
+      id: `path_${_slugify(sp.path)}`,
+      path: sp.path,
+      risk_level: sp.riskLevel,
+      desc: sp.desc,
+      deny_mode: denyMode,
+      source_deny_mode: denyMode,
+      skip_l3_on_disabled: true,
+      enabled: true,
+      builtin: true
+    };
+    _syncDenyModeFields(rule);
+    return rule;
+  });
+}
+function _l2IntentPatternsToRules() {
+  return INTENT_DEVIATION_PATTERNS.map((pat, i) => ({
+    id: `intent_${i + 1}_${_slugify(pat.reason.slice(0, 30))}`,
+    intent_keywords: pat.intentKeywords,
+    dangerous_actions: pat.dangerousActions,
+    reason: pat.reason,
+    skip_l3_on_disabled: true,
+    enabled: true,
+    builtin: true
+  }));
+}
+function _l2PasswordPatternsToRules() {
+  return PASSWORD_MODIFY_PATTERNS.map((p) => ({
+    id: `pw_${_slugify(p.source)}`,
+    pattern: p.source,
+    skip_l3_on_disabled: true,
+    enabled: true,
+    builtin: true
+  }));
+}
+function _l2UserDeletionPatternsToRules() {
+  return USER_DELETION_PATTERNS.map((p) => ({
+    id: `ud_${_slugify(p.source)}`,
+    pattern: p.source,
+    skip_l3_on_disabled: true,
+    enabled: true,
+    builtin: true
+  }));
+}
+function _l3SkillsToRules() {
+  const skillCategories = {
+    file_operations: ["file_access_guard", "script_execution_guard", "indirect_access_guard"],
+    network_security: [
+      "data_exfiltration_guard",
+      "browser_web_access_guard",
+      "lateral_movement_guard",
+      "email_operation_guard"
+    ],
+    persistence_supply_chain: [
+      "persistence_backdoor_guard",
+      "supply_chain_guard",
+      "skill_installation_guard"
+    ],
+    intent_and_general: ["intent_deviation_guard", "general_tool_risk_guard"],
+    resource: ["resource_exhaustion_guard"]
+  };
+  const out = {};
+  for (const [cat, ids] of Object.entries(skillCategories)) {
+    out[cat] = {
+      category_enabled: true,
+      category_desc: "",
+      skills: ids.map((s) => ({
+        id: s,
+        keywords: SKILL_KEYWORD_MAP[s] || [],
+        enabled: true,
+        builtin: true
+      }))
+    };
+  }
+  const categorized = new Set(Object.values(skillCategories).flat());
+  for (const s of Object.keys(SKILL_KEYWORD_MAP)) {
+    if (!categorized.has(s)) {
+      (out.intent_and_general ??= { category_enabled: true, category_desc: "", skills: [] }).skills.push({
+        id: s,
+        keywords: SKILL_KEYWORD_MAP[s],
+        enabled: true,
+        builtin: true
+      });
+    }
+  }
+  out.user_custom = { category_enabled: true, category_desc: "", skills: [] };
+  return out;
+}
+function generateSourceDefaults() {
+  return {
+    version: 1,
+    layers: { L1_heuristic: true, L2_logic_rules: true, L3_llm_analysis: true },
+    L1_rules: {
+      dangerous_commands: {
+        category_enabled: true,
+        category_desc: "\u5371\u9669\u547D\u4EE4\u68C0\u6D4B\uFF08\u9012\u5F52\u5220\u9664\u3001\u5168\u6743\u9650\u8BBE\u7F6E\u3001\u63D0\u6743\u6267\u884C\u7B49\uFF09",
+        rules: _l1CommandPatternsToRules()
+      },
+      injection_detection: {
+        category_enabled: true,
+        category_desc: "Prompt \u6CE8\u5165\u653B\u51FB\u68C0\u6D4B",
+        rules: _l1InjectionKeywordsToRules()
+      },
+      user_sensitive_actions: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49\u654F\u611F\u52A8\u4F5C/\u5DE5\u5177\u89C4\u5219", rules: [] },
+      user_custom: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49\u547D\u4EE4\u89C4\u5219", rules: [] }
+    },
+    L2_rules: {
+      sensitive_path_access: {
+        category_enabled: true,
+        category_desc: "\u654F\u611F\u8DEF\u5F84\u8BBF\u95EE\u68C0\u6D4B",
+        rules: _l2SensitivePathsToRules()
+      },
+      intent_consistency: {
+        category_enabled: true,
+        category_desc: "\u610F\u56FE\u4E00\u81F4\u6027\u68C0\u6D4B",
+        rules: _l2IntentPatternsToRules()
+      },
+      password_modify_consent: {
+        category_enabled: true,
+        category_desc: "\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u6388\u6743\u68C0\u6D4B",
+        rules: _l2PasswordPatternsToRules()
+      },
+      user_deletion_consent: {
+        category_enabled: true,
+        category_desc: "\u7528\u6237/\u7EC4\u5220\u9664\u64CD\u4F5C\u6388\u6743\u68C0\u6D4B",
+        rules: _l2UserDeletionPatternsToRules()
+      },
+      read_before_write: { category_enabled: true, category_desc: "read_before_write \u5B89\u5168\u539F\u5219\u68C0\u6D4B", rules: [] },
+      dangerous_patterns: { category_enabled: true, category_desc: "\u5371\u9669\u64CD\u4F5C\u6A21\u5F0F\u68C0\u6D4B", rules: [] }
+    },
+    L3_skills: _l3SkillsToRules()
+  };
+}
+function _ruleFingerprint(rule) {
+  if (rule.intent_keywords && rule.intent_keywords.length || rule.dangerous_actions && rule.dangerous_actions.length) {
+    return JSON.stringify([
+      [...rule.intent_keywords || []].sort(),
+      [...rule.dangerous_actions || []].sort()
+    ]);
+  }
+  if (rule.path) return JSON.stringify([rule.path]);
+  if (rule.pattern) return JSON.stringify([rule.pattern]);
+  if (rule.keyword) return JSON.stringify([rule.keyword, rule.lang || ""]);
+  return JSON.stringify([rule.id || ""]);
+}
+function _mergeRuleCategories(userCfg, srcDefaults, layerKey) {
+  const userLayer = userCfg[layerKey] || (userCfg[layerKey] = {});
+  const srcLayer = srcDefaults[layerKey] || {};
+  for (const [catName, srcCat] of Object.entries(srcLayer)) {
+    if (!(catName in userLayer)) {
+      userLayer[catName] = srcCat;
+      continue;
+    }
+    const userCat = userLayer[catName];
+    if (userCat.category_desc === void 0) userCat.category_desc = srcCat.category_desc || "";
+    if (userCat.category_enabled === void 0) userCat.category_enabled = srcCat.category_enabled ?? true;
+    const srcRules = srcCat.rules || [];
+    const userRules = userCat.rules || (userCat.rules = []);
+    const userByFp = /* @__PURE__ */ new Map();
+    for (const r of userRules) userByFp.set(_ruleFingerprint(r), r);
+    const srcFps = /* @__PURE__ */ new Set();
+    for (const srcR of srcRules) {
+      const fp = _ruleFingerprint(srcR);
+      srcFps.add(fp);
+      if (userByFp.has(fp)) {
+        const existing = userByFp.get(fp);
+        const userEnabled = existing.enabled;
+        const userSkipL3 = existing.skip_l3_on_disabled;
+        const userDenyMode = existing.deny_mode;
+        const userSourceDeny = existing.source_deny_mode;
+        Object.keys(existing).forEach((k) => delete existing[k]);
+        Object.assign(existing, srcR);
+        existing.enabled = userEnabled;
+        if (userSkipL3 !== void 0) existing.skip_l3_on_disabled = userSkipL3;
+        if (userDenyMode && userSourceDeny && userDenyMode !== userSourceDeny) {
+          existing.deny_mode = userDenyMode;
+        }
+        if (existing.deny_mode) _syncDenyModeFields(existing);
+      } else {
+        const newR = { ...srcR, enabled: true };
+        userRules.push(newR);
+      }
+    }
+    for (const r of userRules) {
+      if (r.builtin && !srcFps.has(_ruleFingerprint(r))) {
+        r.source_removed = true;
+        r.enabled = false;
+      }
+    }
+    if (catName === "sensitive_path_access") {
+      for (const r of userRules) {
+        if (!r.deny_mode) r.deny_mode = _deriveDenyMode(r);
+        _syncDenyModeFields(r);
+      }
+    }
+  }
+}
+function _mergeSkillCategories(userCfg, srcDefaults, layerKey) {
+  const userLayer = userCfg[layerKey] || (userCfg[layerKey] = {});
+  const srcLayer = srcDefaults[layerKey] || {};
+  for (const [catName, srcCat] of Object.entries(srcLayer)) {
+    if (!(catName in userLayer)) {
+      userLayer[catName] = srcCat;
+      continue;
+    }
+    const userCat = userLayer[catName];
+    if (userCat.category_desc === void 0) userCat.category_desc = srcCat.category_desc || "";
+    if (userCat.category_enabled === void 0) userCat.category_enabled = srcCat.category_enabled ?? true;
+    const userSkills = userCat.skills || (userCat.skills = []);
+    const existingIds = new Set(userSkills.map((s) => s.id));
+    for (const srcS of srcCat.skills || []) {
+      if (!existingIds.has(srcS.id)) userSkills.push({ ...srcS });
+    }
+  }
+}
+function mergeConfig(userCfg, srcDefaults) {
+  const cfg = userCfg;
+  if (cfg.version === void 0) cfg.version = srcDefaults.version || 1;
+  if (!cfg.layers) cfg.layers = {};
+  for (const [layerKey, defaultVal] of Object.entries(srcDefaults.layers)) {
+    if (!(layerKey in cfg.layers)) cfg.layers[layerKey] = defaultVal;
+  }
+  _mergeRuleCategories(cfg, srcDefaults, "L1_rules");
+  _mergeRuleCategories(cfg, srcDefaults, "L2_rules");
+  _mergeSkillCategories(cfg, srcDefaults, "L3_skills");
+  return cfg;
+}
+function getEnabledL1InjectionKeywords(runtime) {
+  const cat = runtime.L1_rules?.injection_detection || { category_enabled: true, rules: [] };
+  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => ({
+    keyword: r.keyword || "",
+    risk_level: r.risk_level || "",
+    lang: r.lang || "en"
+  }));
+}
+function getEnabledL2IntentPatterns(runtime) {
+  const cat = runtime.L2_rules?.intent_consistency || { category_enabled: true, rules: [] };
+  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => ({
+    intent_keywords: r.intent_keywords || [],
+    dangerous_actions: r.dangerous_actions || [],
+    reason: r.reason || ""
+  }));
+}
+function getEnabledL2PasswordPatterns(runtime) {
+  const cat = runtime.L2_rules?.password_modify_consent || { category_enabled: true, rules: [] };
+  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => r.pattern || "");
+}
+function getEnabledL2UserDeletionPatterns(runtime) {
+  const cat = runtime.L2_rules?.user_deletion_consent || { category_enabled: true, rules: [] };
+  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => r.pattern || "");
+}
+function isL2CategoryEnabled(runtime, categoryKey) {
+  const cat = runtime.L2_rules?.[categoryKey];
+  return cat?.category_enabled ?? true;
+}
+function getDisabledSkillIds(runtime) {
+  const disabled = /* @__PURE__ */ new Set();
+  for (const catData of Object.values(runtime.L3_skills || {})) {
+    if (!catData.category_enabled) {
+      for (const s of catData.skills || []) disabled.add(s.id);
+    } else {
+      for (const s of catData.skills || []) {
+        if (s.enabled === false) disabled.add(s.id);
+      }
+    }
+  }
+  return disabled;
+}
+function getEnabledL1CommandPatternsOrDefault(runtime) {
+  const enabled = getEnabledL1CommandPatterns(runtime);
+  if (enabled.length) return enabled;
+  if (!hasRuntimeConfig()) return _l1CommandPatternsToRules();
+  return [];
+}
+function getEnabledL1InjectionKeywordsOrDefault(runtime) {
+  const enabled = getEnabledL1InjectionKeywords(runtime);
+  if (enabled.length) return enabled;
+  if (!hasRuntimeConfig()) return _l1InjectionKeywordsToRules();
+  return [];
+}
+function getEnabledL2SensitivePathsOrDefault(runtime) {
+  const enabled = getEnabledL2SensitivePaths(runtime);
+  if (enabled.length) return enabled;
+  if (!hasRuntimeConfig()) return _l2SensitivePathsToRules();
+  return [];
+}
+function getEnabledL2IntentPatternsOrDefault(runtime) {
+  const enabled = getEnabledL2IntentPatterns(runtime);
+  if (enabled.length) return enabled;
+  if (!hasRuntimeConfig()) return _l2IntentPatternsToRules();
+  return [];
+}
+function getEnabledL2PasswordPatternsOrDefault(runtime) {
+  const enabled = getEnabledL2PasswordPatterns(runtime);
+  if (enabled.length) return enabled;
+  if (!hasRuntimeConfig()) {
+    return PASSWORD_MODIFY_PATTERNS.map((p) => p.source);
+  }
+  return [];
+}
+function getEnabledL2UserDeletionPatternsOrDefault(runtime) {
+  const enabled = getEnabledL2UserDeletionPatterns(runtime);
+  if (enabled.length) return enabled;
+  if (!hasRuntimeConfig()) {
+    return USER_DELETION_PATTERNS.map((p) => p.source);
+  }
+  return [];
+}
+function _validateSkillId(skillId) {
+  if (!skillId || !SKILL_ID_RE.test(skillId)) {
+    throw new Error(`skill_id '${skillId}' \u4E0D\u5408\u6CD5\uFF1A\u53EA\u5141\u8BB8\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u4E0B\u5212\u7EBF\u548C\u8FDE\u5B57\u7B26`);
+  }
+}
+function updateLayerEnabled(layerKey, enabled) {
+  const runtime = loadRuntimeConfig();
+  runtime.layers[layerKey] = enabled;
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function updateRuleEnabled(layer, category, ruleId, enabled) {
+  const runtime = loadRuntimeConfig();
+  for (const r of runtime[layer]?.[category]?.rules || []) {
+    if (r.id === ruleId) {
+      r.enabled = enabled;
+      break;
+    }
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function updateRuleDenyMode(layer, category, ruleId, denyMode) {
+  const runtime = loadRuntimeConfig();
+  for (const r of runtime[layer]?.[category]?.rules || []) {
+    if (r.id === ruleId) {
+      r.deny_mode = denyMode;
+      _syncDenyModeFields(r);
+      break;
+    }
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function updateRuleSkipL3(layer, category, ruleId, skipL3) {
+  const runtime = loadRuntimeConfig();
+  for (const r of runtime[layer]?.[category]?.rules || []) {
+    if (r.id === ruleId) {
+      r.skip_l3_on_disabled = skipL3;
+      break;
+    }
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function updateCategoryEnabled(layer, category, enabled) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime[layer]?.[category];
+  if (cat) cat.category_enabled = enabled;
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function addCustomRule(layer, category, rule) {
+  const runtime = loadRuntimeConfig();
+  const layerObj = runtime[layer] || (runtime[layer] = {});
+  const cat = layerObj[category] || (layerObj[category] = { category_enabled: true, category_desc: "", rules: [] });
+  const rules = cat.rules || (cat.rules = []);
+  const newRule = { ...rule, builtin: false, enabled: true };
+  if (!newRule.id) {
+    newRule.id = `custom_${Date.now()}_${_slugify(JSON.stringify(rule).slice(0, 30))}`;
+  }
+  if (newRule.deny_mode) _syncDenyModeFields(newRule);
+  rules.push(newRule);
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function deleteCustomRule(layer, category, ruleId) {
+  const runtime = loadRuntimeConfig();
+  const rules = runtime[layer]?.[category]?.rules || [];
+  const idx = rules.findIndex((r) => r.id === ruleId);
+  if (idx >= 0) {
+    if (rules[idx].builtin) return null;
+    rules.splice(idx, 1);
+    saveRuntimeConfig(runtime);
+  }
+  return runtime;
+}
+function addCustomSkill(skillId, category, keywords, content) {
+  _validateSkillId(skillId);
+  const runtime = loadRuntimeConfig();
+  const skillsDir = join4(RUNTIME_CONFIG_DIR, "agent_moss_skills");
+  try {
+    mkdirSync2(skillsDir, { recursive: true });
+  } catch {
+  }
+  writeFileSync2(join4(skillsDir, `${skillId}.md`), content, "utf-8");
+  const l3 = runtime.L3_skills || (runtime.L3_skills = {});
+  const cat = l3[category] || (l3[category] = { category_enabled: true, category_desc: "", skills: [] });
+  (cat.skills || (cat.skills = [])).push({ id: skillId, keywords, enabled: true, builtin: false });
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function deleteCustomSkill(skillId, category) {
+  _validateSkillId(skillId);
+  const runtime = loadRuntimeConfig();
+  const skills = runtime.L3_skills?.[category]?.skills || [];
+  const idx = skills.findIndex((s) => s.id === skillId);
+  if (idx >= 0) {
+    if (skills[idx].builtin) return null;
+    skills.splice(idx, 1);
+    const skillPath = join4(RUNTIME_CONFIG_DIR, "agent_moss_skills", `${skillId}.md`);
+    try {
+      if (existsSync7(skillPath)) unlinkSync2(skillPath);
+    } catch {
+    }
+    saveRuntimeConfig(runtime);
+  }
+  return runtime;
+}
+function updateSkillEnabled(skillId, enabled) {
+  const runtime = loadRuntimeConfig();
+  for (const catData of Object.values(runtime.L3_skills || {})) {
+    for (const s of catData.skills || []) {
+      if (s.id === skillId) {
+        s.enabled = enabled;
+        break;
+      }
+    }
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function updateSkillCategoryEnabled(category, enabled) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.L3_skills?.[category];
+  if (cat) cat.category_enabled = enabled;
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function getProfileOrDetect() {
+  return null;
+}
+var RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, ENV_RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DENY_MODE_LABELS, SKILL_ID_RE;
+var init_runtime_config = __esm({
+  "src/infra/runtime-config.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_heuristic();
+    init_logic_rules();
+    init_skill_loader();
+    RUNTIME_CONFIG_DIR = join4(homedir3(), ".config", "agentmoss");
+    RUNTIME_CONFIG_PATH = join4(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
+    ENV_RUNTIME_CONFIG_PATH = "AGENT_MOSS_RUNTIME_CONFIG_PATH";
+    LAYER_DISABLE_ENV = {
+      L1_heuristic: "AGENT_MOSS_DISABLE_HEURISTIC",
+      L2_logic_rules: "AGENT_MOSS_DISABLE_LOGIC_RULES",
+      L3_llm_analysis: "AGENT_MOSS_DISABLE_LLM"
+    };
+    DENY_MODE_LABELS = {
+      deny_write: "\u4EC5\u62E6\u622A\u5199\u5165",
+      deny_read: "\u4EC5\u62E6\u622A\u8BFB\u53D6",
+      deny_both: "\u8BFB\u5199\u5747\u62E6\u622A"
+    };
+    SKILL_ID_RE = /^[A-Za-z0-9_-]+$/;
   }
 });
 
 // src/engine/coordinator.ts
 var coordinator_exports = {};
 __export(coordinator_exports, {
+  TRUSTED_SKILLS_BASE: () => TRUSTED_SKILLS_BASE,
   runAnalysis: () => runAnalysis
 });
 function extractFirstCommand(command) {
@@ -1710,6 +3247,25 @@ async function runAnalysis(input) {
       return heuristicResult;
     }
   }
+  let scriptChain = null;
+  if (input.aNext.actionType.toLowerCase() === "bash") {
+    scriptChain = analyzeScriptContent2(input);
+    if (scriptChain.nodes.length > 0) {
+      for (const node of scriptChain.nodes) {
+        if (node.l1Hit && (node.l1RiskLevel === "high" || node.l1RiskLevel === "critical")) {
+          return {
+            allowed: false,
+            reason: `\u811A\u672C\u5185\u5BB9\u5305\u542B\u5371\u9669\u64CD\u4F5C: ${node.l1Reason} (\u6587\u4EF6: ${node.scriptPath}, \u6DF1\u5EA6: ${node.depth})`,
+            riskLevel: node.l1RiskLevel,
+            riskType: node.l1RiskType,
+            confidence: 90,
+            source: "heuristic_script_scan",
+            violatedLayers: ["1.1-script"]
+          };
+        }
+      }
+    }
+  }
   const actionType = input.aNext.actionType.toLowerCase();
   const rawDetail = extractRawCommand(input.aNext.actionDetail);
   const lowerDetail = rawDetail.toLowerCase();
@@ -1724,7 +3280,12 @@ async function runAnalysis(input) {
       violatedLayers: []
     };
   }
-  if (actionType === "skill" && TRUSTED_SKILLS.has(lowerDetail)) {
+  const agentExt = getAgentExtensions(input.agentId);
+  const trustedSkills = new Set(TRUSTED_SKILLS_BASE);
+  if (agentExt?.builtin_safe_skills) {
+    for (const s of agentExt.builtin_safe_skills) trustedSkills.add(s);
+  }
+  if (actionType === "skill" && trustedSkills.has(lowerDetail)) {
     return {
       allowed: true,
       reason: `\u5185\u7F6E\u5B89\u5168 Skill\uFF0C\u8DF3\u8FC7\u6DF1\u5EA6\u5206\u6790: ${lowerDetail}`,
@@ -1764,7 +3325,7 @@ async function runAnalysis(input) {
   if (logicResult && !logicResult.allowed) {
     const isCredentialPath = !!logicResult.isCredential;
     const skipInlineFileAccess = (isInlineScriptCmd || isLiteralTextCmd) && logicResult.riskType === "sensitive_path_access";
-    if (skipInlineFileAccess && !isCredentialPath) {
+    if (skipInlineFileAccess) {
       const inlineJudgment = analyzeInlineScript(input.aNext.actionDetail);
       if (inlineJudgment.actionable) {
         if (!inlineJudgment.allowed) {
@@ -1793,6 +3354,23 @@ async function runAnalysis(input) {
       return logicResult;
     }
   }
+  if (scriptChain && scriptChain.nodes.length > 0 && isLogicRulesEnabled()) {
+    for (const node of scriptChain.nodes) {
+      if (node.error || !node.preprocessedContent) continue;
+      if (node.l1RiskLevel === "critical") break;
+      if (node.l2Hit && (node.l2RiskLevel === "high" || node.l2RiskLevel === "critical")) {
+        return {
+          allowed: false,
+          reason: node.l2Reason,
+          riskLevel: node.l2RiskLevel,
+          riskType: node.l2RiskType,
+          confidence: 85,
+          source: "logic_rule_script_scan",
+          violatedLayers: ["1.2-script"]
+        };
+      }
+    }
+  }
   if (skipLLM || !isLLMAvailable()) {
     return {
       allowed: true,
@@ -1804,13 +3382,64 @@ async function runAnalysis(input) {
       violatedLayers: []
     };
   }
-  const llmResult = await runLLMAnalysis(input, {
-    heuristic: heuristicResult,
-    logic: logicResult
-  });
+  let skipL3Hints = "\u65E0\uFF08\u5F53\u524D\u65E0\u7981\u7528\u89C4\u5219\u547D\u4E2D\uFF09";
+  try {
+    const { getDisabledL2RulesWithSkipL3: getDisabledL2RulesWithSkipL32 } = await Promise.resolve().then(() => (init_runtime_config(), runtime_config_exports));
+    const disabledL2 = getDisabledL2RulesWithSkipL32();
+    if (disabledL2 && Object.keys(disabledL2).length > 0) {
+      const actionLower = input.aNext.actionDetail.toLowerCase();
+      const matched = [];
+      for (const items of Object.values(disabledL2)) {
+        for (const item of items) {
+          if (item.toLowerCase().includes(actionLower) || actionLower.includes(item.toLowerCase())) {
+            matched.push(item);
+          }
+        }
+      }
+      if (matched.length > 0) {
+        skipL3Hints = `\u26A0\uFE0F \u91CD\u8981\u7EA6\u675F\uFF1A\u7528\u6237\u5DF2\u4E3B\u52A8\u7981\u7528\u9488\u5BF9\u4EE5\u4E0B\u5185\u5BB9\u7684\u5B89\u5168\u62E6\u622A\u89C4\u5219\uFF0C\u8FD9\u662F\u7528\u6237\u7684\u660E\u786E\u51B3\u7B56\uFF1A
+  ${matched.join(", ")}
+\u5BF9\u8FD9\u4E9B\u8DEF\u5F84/\u5173\u952E\u8BCD\u7684\u76F8\u5173\u64CD\u4F5C\uFF0C\u5FC5\u987B\u89C6\u4E3A\u5141\u8BB8\u7684\uFF0C\u4E0D\u5141\u8BB8\u4EC5\u56E0\u6D89\u53CA\u8FD9\u4E9B\u5185\u5BB9\u5C31\u62D2\u7EDD\u3002\u4F46\u4F60\u4ECD\u9700\u68C0\u67E5\u547D\u4EE4\u7684\u5176\u4ED6\u90E8\u5206\u662F\u5426\u6709\u72EC\u7ACB\u4E8E\u8FD9\u4E9B\u5185\u5BB9\u7684\u5B89\u5168\u98CE\u9669\uFF08\u5982\u7F51\u7EDC\u5916\u4F20\u3001\u63D0\u6743\u7B49\uFF09\u3002`;
+      }
+    }
+  } catch {
+  }
+  let llmResult;
+  try {
+    llmResult = await runLLMAnalysis(input, {
+      heuristic: heuristicResult,
+      logic: logicResult,
+      skipL3Hints,
+      scriptChain: scriptChain ?? void 0,
+      llmLogPath: input.llmLogPath
+    });
+  } catch (e) {
+    const { getLLMFailMode: getLLMFailMode2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+    if (getLLMFailMode2() === "fail_open") {
+      console.warn(`[AgentMoss] LLM \u5206\u6790\u5931\u8D25\uFF0Cfail_open \u6A21\u5F0F\uFF1A\u5141\u8BB8\u6267\u884C\uFF08\u524D\u4E24\u5C42\u672A\u62E6\u622A\uFF09: ${e.message}`);
+      return {
+        allowed: true,
+        reason: `LLM \u5206\u6790\u5931\u8D25\uFF08warn-allow\uFF0Cfail_open\uFF09: ${e.message}`,
+        riskLevel: "low",
+        riskType: "",
+        confidence: 50,
+        source: "llm_failure_fallback",
+        violatedLayers: []
+      };
+    }
+    return {
+      allowed: false,
+      reason: `LLM \u5206\u6790\u5931\u8D25\uFF0C\u56E0\u65E0\u6CD5\u5B8C\u6210\u6DF1\u5EA6\u8BED\u4E49\u5206\u6790\uFF0C\u6309 fail-closed \u539F\u5219\u62D2\u7EDD: ${e.message}`,
+      riskLevel: "medium",
+      riskType: "",
+      confidence: 60,
+      source: "llm_failure_fallback",
+      violatedLayers: ["3"]
+    };
+  }
   return llmResult;
 }
-var FULLY_SAFE_TOOLS, TRUSTED_SKILLS, READONLY_SENSITIVE_TOOLS, FULLY_SAFE_BASH_PATTERNS, READONLY_SENSITIVE_BASH_PATTERNS;
+var FULLY_SAFE_TOOLS, TRUSTED_SKILLS_BASE, READONLY_SENSITIVE_TOOLS, FULLY_SAFE_BASH_PATTERNS, READONLY_SENSITIVE_BASH_PATTERNS;
 var init_coordinator = __esm({
   "src/engine/coordinator.ts"() {
     "use strict";
@@ -1819,7 +3448,9 @@ var init_coordinator = __esm({
     init_logic_rules();
     init_inline_analyzer();
     init_llm_analyzer();
+    init_script_content_analyzer();
     init_config();
+    init_agents();
     FULLY_SAFE_TOOLS = /* @__PURE__ */ new Set([
       "ask_user_question",
       "glob",
@@ -1828,7 +3459,7 @@ var init_coordinator = __esm({
       "count_text_length",
       "filemgr-globfiles"
     ]);
-    TRUSTED_SKILLS = /* @__PURE__ */ new Set(["xiaoo-guardian"]);
+    TRUSTED_SKILLS_BASE = /* @__PURE__ */ new Set([]);
     READONLY_SENSITIVE_TOOLS = /* @__PURE__ */ new Set([
       "read",
       "file_read",
@@ -1894,9 +3525,10 @@ init_esm_shims();
 
 // src/server.ts
 init_esm_shims();
-import { Hono } from "hono";
+import { Hono as Hono2 } from "hono";
 import { cors } from "hono/cors";
 import { logger } from "hono/logger";
+import net from "net";
 
 // src/routes.ts
 init_esm_shims();
@@ -1925,6 +3557,7 @@ var AnalyzeRequestSchema = z.object({
   reason: z.string().default("").describe("Reason for executing this action"),
   os_type: z.string().default("").describe("OS type: 'linux', 'windows', or empty for auto-detect"),
   cwd: z.string().default("").describe("Current working directory"),
+  agent_id: z.string().default("").describe("Caller agent identifier, e.g. 'xiaoo' / 'opencode' / 'opendesk'. Empty = generic mode (no agent-specific rules)."),
   metadata: z.record(z.unknown()).optional().describe("Extended metadata")
 });
 var AnalyzeResponseSchema = z.object({
@@ -2074,7 +3707,9 @@ async function analyzeRoute(c) {
       reason: req.reason,
       osType,
       cwd: req.cwd,
-      llmConfig: req.metadata?.llm_config
+      agentId: req.agent_id,
+      llmConfig: req.metadata?.llm_config,
+      llmLogPath: req.metadata?.llm_log_path
     });
     const durationMs = performance.now() - t0;
     try {
@@ -2119,15 +3754,216 @@ async function analyzeRoute(c) {
   }
 }
 
+// src/console/index.ts
+init_esm_shims();
+
+// src/console/router.ts
+init_esm_shims();
+init_runtime_config();
+init_token_stats();
+import { Hono } from "hono";
+import { readFileSync as readFileSync8, existsSync as existsSync9 } from "fs";
+import { join as join5, dirname as dirname5 } from "path";
+import { fileURLToPath as fileURLToPath5 } from "url";
+var __dirname5 = dirname5(fileURLToPath5(import.meta.url));
+var STATIC_DIR = join5(__dirname5, "static");
+var CONSOLE_TOKEN_ENV = "AGENT_MOSS_CONSOLE_TOKEN";
+function getConsoleToken() {
+  return process.env[CONSOLE_TOKEN_ENV] || "";
+}
+function verifyAuth(req) {
+  const token = getConsoleToken();
+  if (!token) return true;
+  const auth = req.headers.get("Authorization") || "";
+  if (auth.startsWith("Bearer ")) return auth.slice(7) === token;
+  return false;
+}
+function authMiddleware() {
+  return async (c, next) => {
+    if (!verifyAuth(c.req.raw)) {
+      return c.json({ error: "Unauthorized: invalid or missing Bearer token" }, 401);
+    }
+    await next();
+  };
+}
+function createConsoleRouter() {
+  const console2 = new Hono();
+  console2.use("/api/*", authMiddleware());
+  const serveIndex = (c) => {
+    const indexFile = join5(STATIC_DIR, "index.html");
+    if (existsSync9(indexFile)) {
+      return c.html(readFileSync8(indexFile, "utf-8"));
+    }
+    return c.html("<h1>AgentMoss Policy Console</h1><p>Frontend not built. Use /console/api/* endpoints.</p>");
+  };
+  console2.get("/", serveIndex);
+  console2.get("", serveIndex);
+  console2.get("/api/layers", (c) => {
+    const rc = loadRuntimeConfig();
+    return c.json({ layers: rc.layers });
+  });
+  console2.put("/api/layers", async (c) => {
+    const body = await c.req.json();
+    const rc = updateLayerEnabled(body.layer_key, body.enabled);
+    return c.json({ layers: rc.layers });
+  });
+  console2.get("/api/rules", (c) => {
+    const rc = loadRuntimeConfig();
+    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules });
+  });
+  console2.put("/api/rules/enabled", async (c) => {
+    const b = await c.req.json();
+    const rc = updateRuleEnabled(b.layer, b.category, b.rule_id, b.enabled);
+    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules });
+  });
+  console2.put("/api/rules/deny_mode", async (c) => {
+    const b = await c.req.json();
+    const rc = updateRuleDenyMode(b.layer, b.category, b.rule_id, b.deny_mode);
+    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules });
+  });
+  console2.put("/api/rules/skip_l3", async (c) => {
+    const b = await c.req.json();
+    const rc = updateRuleSkipL3(b.layer, b.category, b.rule_id, b.skip_l3_on_disabled);
+    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules });
+  });
+  console2.put("/api/categories/enabled", async (c) => {
+    const b = await c.req.json();
+    const rc = updateCategoryEnabled(b.layer, b.category, b.enabled);
+    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules });
+  });
+  console2.post("/api/rules", async (c) => {
+    const b = await c.req.json();
+    const rc = addCustomRule(b.layer, b.category, {
+      pattern: b.pattern,
+      risk_level: b.risk_level,
+      risk_type: b.risk_type,
+      reason: b.reason,
+      keyword: b.keyword,
+      lang: b.lang,
+      path: b.path,
+      desc: b.desc,
+      credential: b.credential,
+      deny_mode: b.deny_mode
+    });
+    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules });
+  });
+  console2.delete("/api/rules", async (c) => {
+    const b = await c.req.json();
+    deleteCustomRule(b.layer, b.category, b.rule_id);
+    const rc = loadRuntimeConfig();
+    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules });
+  });
+  console2.get("/api/skills", (c) => {
+    const rc = loadRuntimeConfig();
+    return c.json({ L3_skills: rc.L3_skills });
+  });
+  console2.put("/api/skills/enabled", async (c) => {
+    const b = await c.req.json();
+    const rc = updateSkillEnabled(b.skill_id, b.enabled);
+    return c.json({ L3_skills: rc.L3_skills });
+  });
+  console2.put("/api/skill-categories/enabled", async (c) => {
+    const b = await c.req.json();
+    const rc = updateSkillCategoryEnabled(b.category, b.enabled);
+    return c.json({ L3_skills: rc.L3_skills });
+  });
+  console2.post("/api/skills", async (c) => {
+    const b = await c.req.json();
+    const rc = addCustomSkill(b.skill_id, b.category || "user_custom", b.keywords || [], b.content);
+    return c.json({ L3_skills: rc.L3_skills });
+  });
+  console2.delete("/api/skills", async (c) => {
+    const b = await c.req.json();
+    deleteCustomSkill(b.skill_id, b.category);
+    const rc = loadRuntimeConfig();
+    return c.json({ L3_skills: rc.L3_skills });
+  });
+  console2.get("/api/skills/:skill_id/content", async (c) => {
+    const skillId = c.req.param("skill_id");
+    if (!/^[A-Za-z0-9_-]+$/.test(skillId)) {
+      return c.json({ error: "invalid skill_id" }, 400);
+    }
+    const skillPath = join5(dirname5(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
+    if (!existsSync9(skillPath)) {
+      const builtinPath = join5(__dirname5, "..", "..", "agent_moss", "skills", `${skillId}.md`);
+      if (existsSync9(builtinPath)) return c.text(readFileSync8(builtinPath, "utf-8"));
+      return c.json({ error: "skill not found" }, 404);
+    }
+    return c.text(readFileSync8(skillPath, "utf-8"));
+  });
+  console2.get("/api/config", (c) => {
+    const rc = loadRuntimeConfig();
+    return c.json({ config: rc, config_path: getRuntimeConfigPath() });
+  });
+  console2.get("/api/env-overrides", (c) => {
+    return c.json({ overrides: getEnvOverrides() });
+  });
+  console2.post("/api/reset", (c) => {
+    const defaults = generateSourceDefaults();
+    saveRuntimeConfig(defaults);
+    return c.json({ config: defaults });
+  });
+  console2.get("/api/token-stats", (c) => {
+    const days = parseInt(c.req.query("days") || "7", 10);
+    return c.json(getTokenStats(days));
+  });
+  console2.get("/api/token-stats/recent", (c) => {
+    const limit = parseInt(c.req.query("limit") || "20", 10);
+    return c.json({ records: getRecentRecords(limit) });
+  });
+  console2.get("/api/token-stats/trend", (c) => {
+    const days = parseInt(c.req.query("days") || "7", 10);
+    return c.json(getTokenTrend(days));
+  });
+  console2.post("/api/token-stats/reset", (c) => {
+    resetTokenStats();
+    return c.json({ reset: true });
+  });
+  return console2;
+}
+
 // src/server.ts
 function createApp() {
-  const app = new Hono();
-  app.use("*", cors({ origin: "*", allowMethods: ["GET", "POST", "OPTIONS"], allowHeaders: ["*"] }));
+  const app = new Hono2();
+  app.use("*", cors({ origin: "*", allowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"], allowHeaders: ["*"] }));
   app.use("*", logger());
   app.get("/api/v1/health", healthRoute);
   app.post("/api/v1/analyze", analyzeRoute);
+  app.route("/console", createConsoleRouter());
+  app.get("/console/", (c) => c.redirect("/console"));
   return app;
 }
+async function findFreePort(startPort, host = "127.0.0.1", scan = 100) {
+  for (let port = startPort; port < startPort + scan; port++) {
+    const free = await new Promise((resolve6) => {
+      const server = net.createServer();
+      server.listen(port, host, () => {
+        server.close(() => resolve6(true));
+      });
+      server.on("error", () => resolve6(false));
+    });
+    if (free) {
+      if (port !== startPort) {
+        console.warn(`[AgentMoss] Port ${startPort} in use, using ${port} instead`);
+      }
+      return port;
+    }
+  }
+  return startPort;
+}
+async function startServer(host = "127.0.0.1", port = 9090) {
+  const actualPort = await findFreePort(port, host);
+  const app = createApp();
+  return {
+    port: actualPort,
+    serve: () => {
+      console.log(`AgentMoss HTTP server on ${host}:${actualPort}`);
+      import("@hono/node-server").then(({ serve: honoServe }) => {
+        honoServe({ fetch: app.fetch, hostname: host, port: actualPort });
+      });
+    }
+  };
+}
 
 // src/cli.ts
 function printHelp() {
@@ -2137,10 +3973,14 @@ Commands:
   init                  Generate input.json template
   analyze <input>       Run security analysis on input JSON
   server                Start HTTP API server
+  install               Install systemd service for AgentMoss
 
 Server options:
   --host <host>         Listen host (default: 127.0.0.1)
-  --port <port>         Listen port (default: 9090)
+  --port <port>         Listen port (default: 9090, 0=auto assign)
+
+Install options:
+  --enable              Enable service on boot (systemctl enable)
 `);
 }
 async function main() {
@@ -2190,7 +4030,8 @@ async function main() {
         },
         reason: data.reason || "",
         osType: data.os_type || (process.platform === "win32" ? "windows" : "linux"),
-        cwd: data.cwd || process.cwd()
+        cwd: data.cwd || process.cwd(),
+        agentId: data.agent_id || ""
       });
       console.log(JSON.stringify(result, null, 2));
       process.exit(result.allowed ? 0 : 1);
@@ -2203,12 +4044,51 @@ async function main() {
         if (args[i] === "--host" && args[i + 1]) host = args[++i];
         else if (args[i] === "--port" && args[i + 1]) port = parseInt(args[++i], 10);
       }
-      const { serve } = await import("@hono/node-server");
-      const app = createApp();
-      console.log(`AgentMoss HTTP server on ${host}:${port}`);
-      serve({ fetch: app.fetch, hostname: host, port }, (info) => {
-        console.log(`Listening on http://${host}:${port}`);
-      });
+      const server = await startServer(host, port);
+      console.log(`Listening on http://${host}:${server.port}`);
+      server.serve();
+      break;
+    }
+    case "install": {
+      const enable = args.includes("--enable");
+      const { execSync } = await import("child_process");
+      const fs4 = await import("fs");
+      const path3 = await import("path");
+      const { fileURLToPath: fileURLToPath6 } = await import("url");
+      if (process.getuid?.() !== 0) {
+        const sudoArgs = ["sudo", process.execPath, ...process.argv.slice(1)];
+        if (enable) sudoArgs.push("--enable");
+        console.log("\u9700\u8981 root \u6743\u9650\u5B89\u88C5 systemd service\uFF0C\u6B63\u5728\u901A\u8FC7 sudo \u91CD\u65B0\u6267\u884C...");
+        execSync(sudoArgs.join(" "), { stdio: "inherit" });
+        process.exit(0);
+      }
+      const __filename5 = fileURLToPath6(import.meta.url);
+      const __dirname6 = path3.dirname(__filename5);
+      let srcPath = path3.join(__dirname6, "data", "agent_moss.service");
+      if (!fs4.existsSync(srcPath)) {
+        srcPath = path3.join(__dirname6, "..", "src", "data", "agent_moss.service");
+      }
+      if (!fs4.existsSync(srcPath)) {
+        console.error("\u9519\u8BEF\uFF1A\u627E\u4E0D\u5230 agent_moss.service \u6A21\u677F\u6587\u4EF6");
+        process.exit(1);
+      }
+      const which = execSync("which agent-moss 2>/dev/null || true", { encoding: "utf-8" }).trim();
+      const binPath = which || `${process.execPath} ${path3.join(__dirname6, "cli.js")}`;
+      let content = fs4.readFileSync(srcPath, "utf-8");
+      content = content.replace("__AGENT_MOSS_BIN__", binPath);
+      const dst = "/etc/systemd/system/agent_moss.service";
+      fs4.writeFileSync(dst, content, "utf-8");
+      fs4.chmodSync(dst, 420);
+      console.log(`\u2705 \u5DF2\u5B89\u88C5 systemd service: ${dst}`);
+      execSync("systemctl daemon-reload", { stdio: "inherit" });
+      console.log("\u2705 systemctl daemon-reload \u5B8C\u6210");
+      if (enable) {
+        execSync("systemctl enable agent_moss", { stdio: "inherit" });
+        console.log("\u2705 systemctl enable agent_moss \u5B8C\u6210");
+      }
+      console.log("\n\u542F\u52A8\u670D\u52A1\uFF1A  sudo systemctl start agent_moss");
+      console.log("\u67E5\u770B\u72B6\u6001\uFF1A  sudo systemctl status agent_moss");
+      console.log("\u67E5\u770B\u65E5\u5FD7\uFF1A  journalctl -u agent_moss -f");
       break;
     }
     default: