@kenhkl/agent-moss 0.7.9 → 0.7.11

package/dist/cli.js

@@ -409,6 +409,191 @@ var init_heuristic = __esm({
   }
 });
 
+// src/engine/inline-analyzer.ts
+function isLiteralTextCommand(command) {
+  ECHO_CMD_RE.lastIndex = 0;
+  return ECHO_CMD_RE.test(command);
+}
+function extractInlineCode(command) {
+  const parts = [];
+  let m;
+  INLINE_CODE_RE.lastIndex = 0;
+  while ((m = INLINE_CODE_RE.exec(command)) !== null) {
+    const code = m[1] ?? m[2];
+    if (code) parts.push(code);
+  }
+  ECHO_STRING_RE.lastIndex = 0;
+  while ((m = ECHO_STRING_RE.exec(command)) !== null) {
+    const code = m[1] ?? m[2];
+    if (code) parts.push(code);
+  }
+  return parts.join("\n");
+}
+function hasWriteExecChain(command) {
+  return WRITE_EXEC_CHAIN_PATTERNS.some((p) => {
+    p.lastIndex = 0;
+    return p.test(command);
+  });
+}
+function hasDirTraversal(code) {
+  const lower = code.toLowerCase();
+  return DIR_TRAVERSAL_KEYWORDS.some((kw) => lower.includes(kw));
+}
+function hasReadWriteKeyword(code) {
+  const lower = code.toLowerCase();
+  return READ_WRITE_KEYWORDS.some((kw) => lower.includes(kw));
+}
+function analyzeInlineScript(command) {
+  const code = extractInlineCode(command);
+  if (!code) {
+    return { actionable: false, allowed: true, reason: "", riskLevel: "low", riskType: "" };
+  }
+  if (hasWriteExecChain(command)) {
+    return {
+      actionable: true,
+      allowed: false,
+      reason: "\u5185\u8054\u811A\u672C\u542B\u5199\u5165\u6587\u4EF6\u540E\u6267\u884C\u7684\u6A21\u5F0F\uFF0C\u7591\u4F3C\u7ED5\u8FC7\u654F\u611F\u8DEF\u5F84\u68C0\u6D4B",
+      riskLevel: "critical",
+      riskType: "script_execution"
+    };
+  }
+  const redirMatch = command.match(REDIRECT_TO_SENSITIVE_RE);
+  if (redirMatch) {
+    return {
+      actionable: true,
+      allowed: false,
+      reason: `\u91CD\u5B9A\u5411\u5199\u5165\u654F\u611F\u8DEF\u5F84: ${redirMatch[1]}`,
+      riskLevel: "critical",
+      riskType: "file_access"
+    };
+  }
+  const isEchoOrPrintf1 = isLiteralTextCommand(command);
+  if (!isEchoOrPrintf1 && hasDirTraversal(code) && hasReadWriteKeyword(code)) {
+    return { actionable: false, allowed: true, reason: "", riskLevel: "low", riskType: "" };
+  }
+  const isEchoOrPrintf = isLiteralTextCommand(command);
+  if (!isEchoOrPrintf && hasReadWriteKeyword(code)) {
+    return {
+      actionable: true,
+      allowed: false,
+      reason: "\u5185\u8054\u811A\u672C\u542B\u654F\u611F\u8DEF\u5F84\u4E14\u542B\u6587\u4EF6\u8BFB\u5199/\u547D\u4EE4\u6267\u884C\u8C03\u7528\uFF0C\u5224\u4E3A\u771F\u5B9E\u8BBF\u95EE",
+      riskLevel: "critical",
+      riskType: "file_access"
+    };
+  }
+  return {
+    actionable: true,
+    allowed: true,
+    reason: "\u654F\u611F\u8DEF\u5F84\u4EC5\u4F5C\u4E3A\u6587\u672C\u5B57\u9762\u91CF\u51FA\u73B0\uFF0C\u672A\u4F34\u968F\u8BFB\u5199\u64CD\u4F5C",
+    riskLevel: "low",
+    riskType: "file_access"
+  };
+}
+var INLINE_CODE_RE, ECHO_STRING_RE, ECHO_CMD_RE, READ_WRITE_KEYWORDS, WRITE_EXEC_CHAIN_PATTERNS, SENSITIVE_PATH_FRAGMENTS, REDIRECT_TO_SENSITIVE_RE, DIR_TRAVERSAL_KEYWORDS;
+var init_inline_analyzer = __esm({
+  "src/engine/inline-analyzer.ts"() {
+    "use strict";
+    init_esm_shims();
+    INLINE_CODE_RE = /(?:python|python3|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cera][a-zA-Z]*\s+)"([^"\\]*(?:\\.[^"\\]*)*)"|'([^'\\]*(?:\\.[^'\\]*)*)'/gi;
+    ECHO_STRING_RE = /\b(?:echo|printf)\s+"([^"\\]*(?:\\.[^"\\]*)*)"|\b(?:echo|printf)\s+'([^'\\]*(?:\\.[^'\\]*)*)'/gi;
+    ECHO_CMD_RE = /(?:^|\s|;|&&|\|\|)(?:echo|printf)\s/gi;
+    READ_WRITE_KEYWORDS = [
+      // 函数调用形态（关键词后跟 '('）
+      "open(",
+      "read(",
+      "write(",
+      "fopen(",
+      "system(",
+      "exec(",
+      "eval(",
+      "popen(",
+      "load(",
+      "dump(",
+      // 文件读写（组合形态）
+      "readline",
+      "readlines",
+      "writelines",
+      "getpass",
+      "pickle.load",
+      "yaml.load",
+      "json.load",
+      "json.read",
+      "configparser",
+      "fread",
+      "fwrite",
+      "fgets",
+      // 子进程执行（组合形态）
+      "os.system",
+      "os.popen",
+      "subprocess",
+      "os.exec",
+      "os.spawn",
+      "import os",
+      "import subprocess",
+      "shell=true",
+      "check_output",
+      "check_call",
+      "run(",
+      // 绕过变体检测
+      "getattr(",
+      "__builtins__",
+      "globals(",
+      "locals(",
+      // PHP
+      "file_get_contents",
+      "file_put_contents",
+      "passthru",
+      "shell_exec",
+      "proc_open",
+      // Perl-Ruby
+      "<stdin>",
+      "open my"
+    ];
+    WRITE_EXEC_CHAIN_PATTERNS = [
+      // echo/cat/printf "..." > file && bash/sh/python file
+      /(?:echo|cat|printf)\b.*?>\s*\S+.*(?:&&|;|\|)\s*(?:bash|sh|zsh|python\d?|perl|ruby|node|php)\s/gis,
+      // ... | bash / | sh / | python（管道喂解释器执行）
+      /\|\s*(?:bash|sh|zsh|python\d?|perl|ruby|node|php)\b/gi,
+      // eval "$(cat ...)" / eval "$(echo ...)"
+      /eval\s+"\$\(/gi,
+      // xargs bash / xargs sh
+      /\|\s*xargs\s+(?:bash|sh|zsh)/gi
+    ];
+    SENSITIVE_PATH_FRAGMENTS = [
+      "/etc/shadow",
+      "/etc/gshadow",
+      "/etc/passwd",
+      "/etc/sudoers",
+      "/etc/hosts",
+      "/etc/crontab",
+      "/etc/systemd/",
+      "/etc/ssh/sshd_config",
+      "/boot/",
+      "/proc/sys/",
+      "/sys/",
+      "/dev/mem",
+      "/dev/kmsg",
+      ".ssh/id_rsa",
+      ".ssh/id_ed25519",
+      ".ssh/authorized_keys"
+    ];
+    REDIRECT_TO_SENSITIVE_RE = new RegExp(`>{1,2}\\s*(${SENSITIVE_PATH_FRAGMENTS.map((p) => p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})`, "i");
+    DIR_TRAVERSAL_KEYWORDS = [
+      // Python 目录遍历
+      "os.listdir",
+      "os.walk",
+      "os.scandir",
+      "glob.glob",
+      "glob.iglob",
+      "pathlib.",
+      "iterdir",
+      "rglob",
+      "scandir(",
+      "listdir("
+    ];
+  }
+});
+
 // src/engine/logic-rules.ts
 import * as fs2 from "fs";
 function runLogicCheck(input) {
@@ -470,6 +655,127 @@ function runLogicCheck(input) {
       };
     }
   }
+  const READ_ONLY_COMMANDS = /* @__PURE__ */ new Set([
+    "cat",
+    "head",
+    "tail",
+    "less",
+    "more",
+    "grep",
+    "find",
+    "awk",
+    "sed",
+    "sort",
+    "uniq",
+    "wc",
+    "cut",
+    "strings",
+    "od",
+    "xxd",
+    "hexdump",
+    "tr",
+    "file",
+    "stat",
+    "du",
+    "df",
+    "ls",
+    "dir",
+    "tree",
+    "nl",
+    "tac",
+    "rev",
+    "lsblk",
+    "blockdev",
+    "smartctl",
+    "udevadm",
+    "dmidecode",
+    "lscpu",
+    "lspci",
+    "lsusb",
+    "lsmem",
+    "lsns",
+    "lsof",
+    "hwinfo",
+    "inxi",
+    "fdisk",
+    "parted",
+    "dmesg",
+    "journalctl",
+    "systemctl",
+    "hostnamectl",
+    "localectl",
+    "timedatectl",
+    "ps",
+    "top",
+    "free",
+    "vmstat",
+    "iostat",
+    "mpstat",
+    "pidof",
+    "pgrep",
+    "ip",
+    "ifconfig",
+    "route",
+    "ss",
+    "netstat",
+    "arp",
+    "ethtool",
+    "nmcli",
+    "uname",
+    "arch",
+    "nproc",
+    "getconf",
+    "getent",
+    "id",
+    "whoami",
+    "who",
+    "w",
+    "last",
+    "uptime",
+    "lsmod",
+    "modinfo",
+    "sysctl"
+  ]);
+  const DEVNULL_REDIRECT_RE = /(?:2|&|1)?\s*>\s*\/dev\/null\b/;
+  const WRITE_COMMAND_RES = [
+    /\brm\b/,
+    /\bunlink\b/,
+    /\brmdir\b/,
+    /\bshred\b/,
+    /\bcp\b/,
+    /\bmv\b/,
+    /\binstall\b/,
+    /\btee\b/,
+    /\bdd\b/,
+    /\bmkfs\b/,
+    /\b(fdisk|parted|cfdisk|sfdisk)\b/,
+    /\bchmod\b/,
+    /\bchown\b/,
+    /\btruncate\b/
+  ];
+  function isWriteOperation2(actionType2, actionDetail2) {
+    if (WRITE_KEYWORDS.some((kw) => actionType2.includes(kw) || actionDetail2.includes(kw))) {
+      return true;
+    }
+    if (WRITE_COMMAND_RES.some((rx) => rx.test(actionDetail2))) {
+      return true;
+    }
+    if (/\bsed\s+-[a-zA-Z]*i/.test(actionDetail2)) {
+      return true;
+    }
+    if (actionDetail2.includes(">")) {
+      const withoutDevNull = actionDetail2.replace(DEVNULL_REDIRECT_RE, "");
+      if (withoutDevNull.includes(">")) {
+        const firstWord = actionDetail2.trim().split(/\s+/)[0]?.toLowerCase() || "";
+        if (!READ_ONLY_COMMANDS.has(firstWord)) {
+          return true;
+        }
+      }
+    }
+    return false;
+  }
+  const indirectResult = checkIndirectFileAccess(actionType, actionDetail, resolvedCwd);
+  if (indirectResult) return indirectResult;
   if (actionDetail.includes("sudo") || actionDetail.includes("su -") || actionDetail.includes("chmod u+s") || actionDetail.includes("setuid")) {
     const adminContext = actionHistory.some(
       (h) => h.actionDetail.includes("sudo") || h.actionDetail.includes("apt") || h.actionDetail.includes("systemctl") || h.actionDetail.includes("yum") || h.actionDetail.includes("dnf") || h.actionDetail.includes("pacman") || h.actionDetail.includes("zypper") || h.actionDetail.includes("apk")
@@ -567,8 +873,26 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
 }
 function checkSensitivePath(command, cwd) {
   const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
+  const isWriteOp = isWriteOperation("", command);
   for (const sp of ROOT_SENSITIVE_PATHS) {
     if (command.includes(sp.path.toLowerCase())) {
+      if (sp.path === "/dev/random") {
+        if (isWriteOp) {
+          continue;
+        }
+        return {
+          allowed: false,
+          reason: `\u8BFB\u53D6\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
+          riskLevel: sp.riskLevel,
+          riskType: "sensitive_path_access",
+          confidence: 90,
+          source: "logic_rule",
+          violatedLayers: ["2"]
+        };
+      }
+      if (!isWriteOp) {
+        continue;
+      }
       return {
         allowed: false,
         reason: `\u5C1D\u8BD5\u8BBF\u95EE\u7CFB\u7EDF\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
@@ -583,6 +907,9 @@ function checkSensitivePath(command, cwd) {
   for (const sp of HOME_SENSITIVE_PATHS) {
     const expanded = `${expandedCwd}/${sp.path}`;
     if (command.includes(sp.path.toLowerCase()) || command.includes(expanded.toLowerCase())) {
+      if (!isWriteOp) {
+        continue;
+      }
       return {
         allowed: false,
         reason: `\u5C1D\u8BD5\u8BBF\u95EE\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
@@ -667,33 +994,125 @@ function checkUserDeletionConsent(actionType, actionDetail, actionHistory) {
     violatedLayers: ["2"]
   };
 }
-var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, READ_ONLY_REDIR_CMDS, WRITE_KEYWORDS, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS;
+function checkIndirectFileAccess(actionType, actionDetail, cwd) {
+  if (actionType !== "bash" && actionType !== "executebash" && actionType !== "terminal-executebash") {
+    return null;
+  }
+  INLINE_SCRIPT_RE.lastIndex = 0;
+  if (!INLINE_SCRIPT_RE.test(actionDetail)) {
+    return null;
+  }
+  const lowerDetail = actionDetail.toLowerCase();
+  const hasTraversal = DIR_TRAVERSAL_KEYWORDS2.some((kw) => lowerDetail.includes(kw));
+  if (!hasTraversal) {
+    return null;
+  }
+  const READ_KEYWORDS2 = ["read(", "readline", "readlines", "fread", "fgets", "load(", "getpass", "file_get_contents"];
+  const WRITE_KEYWORDS2 = ["write(", "writelines", "fwrite", "file_put_contents"];
+  const EXEC_KEYWORDS = ["system(", "exec(", "eval(", "popen(", "os.system", "os.popen", "subprocess", "os.exec", "os.spawn", "shell=true", "check_output", "check_call", "run(", "passthru", "shell_exec", "proc_open"];
+  const OPEN_KEYWORDS = ["open(", "fopen("];
+  const code = extractInlineCode(actionDetail);
+  if (!code) return null;
+  const codeLower = code.toLowerCase();
+  const hasAnyOp = READ_KEYWORDS2.some((kw) => codeLower.includes(kw)) || WRITE_KEYWORDS2.some((kw) => codeLower.includes(kw)) || EXEC_KEYWORDS.some((kw) => codeLower.includes(kw)) || OPEN_KEYWORDS.some((kw) => codeLower.includes(kw));
+  if (!hasAnyOp) {
+    return null;
+  }
+  const hasWrite = WRITE_KEYWORDS2.some((kw) => codeLower.includes(kw));
+  const hasExec = EXEC_KEYWORDS.some((kw) => codeLower.includes(kw));
+  const blockAllSensitive = hasWrite || hasExec;
+  let actualFiles = [];
+  if (cwd && cwd !== "/") {
+    try {
+      actualFiles = fs2.readdirSync(cwd);
+    } catch {
+    }
+  }
+  if (actualFiles.length > 0) {
+    for (const cp of CREDENTIAL_PATHS) {
+      const fname = cp.path.split("/").pop() || cp.path;
+      if (actualFiles.some((f) => f === fname || f.toLowerCase() === fname.toLowerCase())) {
+        return {
+          allowed: false,
+          reason: `\u5185\u8054\u811A\u672C\u4F7F\u7528\u76EE\u5F55\u904D\u5386\u52A8\u6001\u53D1\u73B0\u6587\u4EF6\u5E76\u6267\u884C\u8BFB\u5199\u64CD\u4F5C\uFF0Ccwd (${cwd}) \u4E2D\u5305\u542B\u51ED\u636E\u6587\u4EF6: ${fname}`,
+          riskLevel: "high",
+          riskType: "file_access",
+          confidence: 95,
+          source: "logic_rule",
+          violatedLayers: ["2"],
+          isCredential: true
+        };
+      }
+    }
+    if (blockAllSensitive) {
+      for (const sp of [...ROOT_SENSITIVE_PATHS, ...HOME_SENSITIVE_PATHS]) {
+        const fname = sp.path.split("/").pop() || sp.path;
+        if (actualFiles.some((f) => f === fname || f.toLowerCase() === fname.toLowerCase())) {
+          return {
+            allowed: false,
+            reason: `\u5185\u8054\u811A\u672C\u4F7F\u7528\u76EE\u5F55\u904D\u5386\u52A8\u6001\u53D1\u73B0\u6587\u4EF6\u5E76\u6267\u884C\u5199\u64CD\u4F5C\uFF0Ccwd (${cwd}) \u4E2D\u5305\u542B\u654F\u611F\u6587\u4EF6: ${fname}`,
+            riskLevel: "high",
+            riskType: "file_access",
+            confidence: 95,
+            source: "logic_rule",
+            violatedLayers: ["2"]
+          };
+        }
+      }
+    }
+    return null;
+  }
+  return {
+    allowed: false,
+    reason: "\u5185\u8054\u811A\u672C\u4F7F\u7528\u76EE\u5F55\u904D\u5386\u51FD\u6570\u52A8\u6001\u53D1\u73B0\u6587\u4EF6\u5E76\u6267\u884C\u8BFB\u5199\u64CD\u4F5C\uFF0C\u65E0\u6CD5\u83B7\u53D6 cwd \u5B9E\u9645\u6587\u4EF6\u5217\u8868\uFF0C\u8F6C\u5C423 LLM \u5206\u6790",
+    riskLevel: "medium",
+    riskType: "file_access",
+    confidence: 70,
+    source: "logic_rule",
+    violatedLayers: ["2"]
+  };
+}
+var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, READ_ONLY_REDIR_CMDS, WRITE_KEYWORDS, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KEYWORDS2;
 var init_logic_rules = __esm({
   "src/engine/logic-rules.ts"() {
     "use strict";
     init_esm_shims();
+    init_inline_analyzer();
     ROOT_SENSITIVE_PATHS = [
       { path: "/etc/shadow", riskLevel: "critical", desc: "\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6" },
       { path: "/etc/gshadow", riskLevel: "critical", desc: "\u7CFB\u7EDF\u7EC4\u5BC6\u7801\u6587\u4EF6" },
       // 注意：/etc/passwd 仅从 L1 启发式规则移除（公开可读），L2 敏感路径仍保留
       { path: "/etc/passwd", riskLevel: "high", desc: "\u7CFB\u7EDF\u7528\u6237\u6587\u4EF6" },
       { path: "/etc/sudoers", riskLevel: "critical", desc: "sudo \u914D\u7F6E" },
+      // 系统配置（仅拦截写入）
       { path: "/etc/hosts", riskLevel: "medium", desc: "DNS \u89E3\u6790\u914D\u7F6E" },
       { path: "/etc/crontab", riskLevel: "high", desc: "\u7CFB\u7EDF\u5B9A\u65F6\u4EFB\u52A1" },
+      { path: "/etc/cron.d/", riskLevel: "high", desc: "\u7CFB\u7EDF\u5B9A\u65F6\u4EFB\u52A1\u76EE\u5F55\uFF08\u62C6\u5206\u5F0F crontab\uFF09" },
+      { path: "/var/spool/cron/", riskLevel: "high", desc: "\u7528\u6237\u7EA7\u5B9A\u65F6\u4EFB\u52A1\u76EE\u5F55" },
       { path: "/etc/systemd/", riskLevel: "high", desc: "systemd \u670D\u52A1\u914D\u7F6E" },
       { path: "/etc/ssh/sshd_config", riskLevel: "high", desc: "SSH \u670D\u52A1\u914D\u7F6E" },
-      { path: "/root/.ssh", riskLevel: "critical", desc: "root SSH \u76EE\u5F55" },
-      { path: "/root/.bashrc", riskLevel: "high", desc: "root shell \u914D\u7F6E" },
+      { path: "/etc/pam.d/", riskLevel: "high", desc: "PAM \u53EF\u63D2\u62D4\u8BA4\u8BC1\u6A21\u5757\u914D\u7F6E" },
+      // 危险目录（仅拦截写入）
       { path: "/boot/", riskLevel: "critical", desc: "\u542F\u52A8\u5F15\u5BFC\u76EE\u5F55" },
       { path: "/proc/sys/", riskLevel: "high", desc: "\u5185\u6838\u53C2\u6570" },
       { path: "/sys/", riskLevel: "high", desc: "sysfs \u5185\u6838\u63A5\u53E3" },
+      // 设备文件（/dev/null、/dev/zero、/dev/urandom 已移除，误报率极高）
+      { path: "/dev/random", riskLevel: "high", desc: "\u963B\u585E\u5F0F\u968F\u673A\u6570\u8BBE\u5907\uFF08\u8BFB\u53D6\u8017\u5C3D\u71B5\u6C60\uFF09" },
       { path: "/dev/mem", riskLevel: "critical", desc: "\u7269\u7406\u5185\u5B58\u8BBF\u95EE\u8BBE\u5907" },
-      { path: "/dev/kmsg", riskLevel: "high", desc: "\u5185\u6838\u6D88\u606F\u7F13\u51B2\u533A" }
+      { path: "/dev/kmsg", riskLevel: "high", desc: "\u5185\u6838\u6D88\u606F\u7F13\u51B2\u533A" },
+      // SSH 主机私钥
+      { path: "/etc/ssh/ssh_host_rsa_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A RSA \u79C1\u94A5" },
+      { path: "/etc/ssh/ssh_host_ed25519_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A Ed25519 \u79C1\u94A5" },
+      { path: "/etc/ssh/ssh_host_ecdsa_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A ECDSA \u79C1\u94A5" }
     ];
     HOME_SENSITIVE_PATHS = [
       { path: ".ssh/id_rsa", riskLevel: "critical", desc: "SSH \u79C1\u94A5" },
       { path: ".ssh/id_ed25519", riskLevel: "critical", desc: "SSH \u79C1\u94A5 (ed25519)" },
       { path: ".ssh/authorized_keys", riskLevel: "high", desc: "SSH \u6388\u6743\u5BC6\u94A5" },
+      // 持久化与命令劫持（仅拦截写入）
+      { path: ".bashrc", riskLevel: "high", desc: "\u7528\u6237 Shell \u521D\u59CB\u5316\u811A\u672C" },
+      { path: ".bash_profile", riskLevel: "high", desc: "\u7528\u6237 Shell \u767B\u5F55\u811A\u672C" },
+      { path: ".profile", riskLevel: "high", desc: "\u7528\u6237\u901A\u7528\u767B\u5F55\u811A\u672C" },
       { path: ".aws/credentials", riskLevel: "critical", desc: "AWS \u51ED\u8BC1" },
       { path: ".gitconfig", riskLevel: "medium", desc: "Git \u914D\u7F6E" },
       { path: ".gnupg", riskLevel: "high", desc: "GPG \u5BC6\u94A5\u76EE\u5F55" }
@@ -738,175 +1157,24 @@ var init_logic_rules = __esm({
         reason: "\u539F\u59CB\u610F\u56FE\u4E3A\u67E5\u8BE2/\u641C\u7D22\uFF0C\u4F46\u6267\u884C\u4E86\u4FEE\u6539\u64CD\u4F5C"
       }
     ];
-  }
-});
-
-// src/engine/inline-analyzer.ts
-function isLiteralTextCommand(command) {
-  ECHO_CMD_RE.lastIndex = 0;
-  return ECHO_CMD_RE.test(command);
-}
-function extractInlineCode(command) {
-  const parts = [];
-  let m;
-  INLINE_CODE_RE.lastIndex = 0;
-  while ((m = INLINE_CODE_RE.exec(command)) !== null) {
-    const code = m[1] ?? m[2];
-    if (code) parts.push(code);
-  }
-  ECHO_STRING_RE.lastIndex = 0;
-  while ((m = ECHO_STRING_RE.exec(command)) !== null) {
-    const code = m[1] ?? m[2];
-    if (code) parts.push(code);
-  }
-  return parts.join("\n");
-}
-function hasWriteExecChain(command) {
-  return WRITE_EXEC_CHAIN_PATTERNS.some((p) => {
-    p.lastIndex = 0;
-    return p.test(command);
-  });
-}
-function hasReadWriteKeyword(code) {
-  const lower = code.toLowerCase();
-  return READ_WRITE_KEYWORDS.some((kw) => lower.includes(kw));
-}
-function analyzeInlineScript(command) {
-  const code = extractInlineCode(command);
-  if (!code) {
-    return { actionable: false, allowed: true, reason: "", riskLevel: "low", riskType: "" };
-  }
-  if (hasWriteExecChain(command)) {
-    return {
-      actionable: true,
-      allowed: false,
-      reason: "\u5185\u8054\u811A\u672C\u542B\u5199\u5165\u6587\u4EF6\u540E\u6267\u884C\u7684\u6A21\u5F0F\uFF0C\u7591\u4F3C\u7ED5\u8FC7\u654F\u611F\u8DEF\u5F84\u68C0\u6D4B",
-      riskLevel: "critical",
-      riskType: "script_execution"
-    };
-  }
-  const redirMatch = command.match(REDIRECT_TO_SENSITIVE_RE);
-  if (redirMatch) {
-    return {
-      actionable: true,
-      allowed: false,
-      reason: `\u91CD\u5B9A\u5411\u5199\u5165\u654F\u611F\u8DEF\u5F84: ${redirMatch[1]}`,
-      riskLevel: "critical",
-      riskType: "file_access"
-    };
-  }
-  const isEchoOrPrintf = isLiteralTextCommand(command);
-  if (!isEchoOrPrintf && hasReadWriteKeyword(code)) {
-    return {
-      actionable: true,
-      allowed: false,
-      reason: "\u5185\u8054\u811A\u672C\u542B\u654F\u611F\u8DEF\u5F84\u4E14\u542B\u6587\u4EF6\u8BFB\u5199/\u547D\u4EE4\u6267\u884C\u8C03\u7528\uFF0C\u5224\u4E3A\u771F\u5B9E\u8BBF\u95EE",
-      riskLevel: "critical",
-      riskType: "file_access"
-    };
-  }
-  return {
-    actionable: true,
-    allowed: true,
-    reason: "\u654F\u611F\u8DEF\u5F84\u4EC5\u4F5C\u4E3A\u6587\u672C\u5B57\u9762\u91CF\u51FA\u73B0\uFF0C\u672A\u4F34\u968F\u8BFB\u5199\u64CD\u4F5C",
-    riskLevel: "low",
-    riskType: "file_access"
-  };
-}
-var INLINE_CODE_RE, ECHO_STRING_RE, ECHO_CMD_RE, READ_WRITE_KEYWORDS, WRITE_EXEC_CHAIN_PATTERNS, SENSITIVE_PATH_FRAGMENTS, REDIRECT_TO_SENSITIVE_RE;
-var init_inline_analyzer = __esm({
-  "src/engine/inline-analyzer.ts"() {
-    "use strict";
-    init_esm_shims();
-    INLINE_CODE_RE = /(?:python|python3|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cera][a-zA-Z]*\s+)"([^"\\]*(?:\\.[^"\\]*)*)"|'([^'\\]*(?:\\.[^'\\]*)*)'/gi;
-    ECHO_STRING_RE = /\b(?:echo|printf)\s+"([^"\\]*(?:\\.[^"\\]*)*)"|\b(?:echo|printf)\s+'([^'\\]*(?:\\.[^'\\]*)*)'/gi;
-    ECHO_CMD_RE = /(?:^|\s|;|&&|\|\|)(?:echo|printf)\s/gi;
-    READ_WRITE_KEYWORDS = [
-      // 函数调用形态（关键词后跟 '('）
-      "open(",
-      "read(",
-      "write(",
-      "fopen(",
-      "system(",
-      "exec(",
-      "eval(",
-      "popen(",
-      "load(",
-      "dump(",
-      // 文件读写（组合形态）
-      "readline",
-      "readlines",
-      "writelines",
-      "getpass",
-      "pickle.load",
-      "yaml.load",
-      "json.load",
-      "json.read",
-      "configparser",
-      "fread",
-      "fwrite",
-      "fgets",
-      // 子进程执行（组合形态）
-      "os.system",
-      "os.popen",
-      "subprocess",
-      "os.exec",
-      "os.spawn",
-      "import os",
-      "import subprocess",
-      "shell=true",
-      "check_output",
-      "check_call",
-      "run(",
-      // 绕过变体检测
-      "getattr(",
-      "__builtins__",
-      "globals(",
-      "locals(",
-      // PHP
-      "file_get_contents",
-      "file_put_contents",
-      "passthru",
-      "shell_exec",
-      "proc_open",
-      // Perl-Ruby
-      "<stdin>",
-      "open my"
-    ];
-    WRITE_EXEC_CHAIN_PATTERNS = [
-      // echo/cat/printf "..." > file && bash/sh/python file
-      /(?:echo|cat|printf)\b.*?>\s*\S+.*(?:&&|;|\|)\s*(?:bash|sh|zsh|python\d?|perl|ruby|node|php)\s/gis,
-      // ... | bash / | sh / | python（管道喂解释器执行）
-      /\|\s*(?:bash|sh|zsh|python\d?|perl|ruby|node|php)\b/gi,
-      // eval "$(cat ...)" / eval "$(echo ...)"
-      /eval\s+"\$\(/gi,
-      // xargs bash / xargs sh
-      /\|\s*xargs\s+(?:bash|sh|zsh)/gi
-    ];
-    SENSITIVE_PATH_FRAGMENTS = [
-      "/etc/shadow",
-      "/etc/gshadow",
-      "/etc/passwd",
-      "/etc/sudoers",
-      "/etc/hosts",
-      "/etc/crontab",
-      "/etc/systemd/",
-      "/etc/ssh/sshd_config",
-      "/boot/",
-      "/proc/sys/",
-      "/sys/",
-      "/dev/mem",
-      "/dev/kmsg",
-      ".ssh/id_rsa",
-      ".ssh/id_ed25519",
-      ".ssh/authorized_keys"
+    INLINE_SCRIPT_RE = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
+    DIR_TRAVERSAL_KEYWORDS2 = [
+      "os.listdir",
+      "os.walk",
+      "os.scandir",
+      "glob.glob",
+      "glob.iglob",
+      "pathlib.",
+      "iterdir",
+      "rglob",
+      "scandir(",
+      "listdir("
     ];
-    REDIRECT_TO_SENSITIVE_RE = new RegExp(`>{1,2}\\s*(${SENSITIVE_PATH_FRAGMENTS.map((p) => p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})`, "i");
   }
 });
 
 // src/engine/skill-loader.ts
-import { readFileSync, readdirSync, existsSync as existsSync2 } from "fs";
+import { readFileSync, readdirSync as readdirSync2, existsSync as existsSync2 } from "fs";
 import { resolve, dirname } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function loadAllSkills() {
@@ -917,7 +1185,7 @@ function loadAllSkills() {
     console.warn("[AgentMoss] Skills directory not found:", SKILLS_DIR, "and fallback:", SKILLS_DIR_FALLBACK);
     return cachedSkills;
   }
-  const files = readdirSync(dir).filter((f) => f.endsWith(".md"));
+  const files = readdirSync2(dir).filter((f) => f.endsWith(".md"));
   for (const f of files) {
     const name = f.replace(".md", "");
     cachedSkills[name] = readFileSync(resolve(dir, f), "utf-8");
@@ -997,7 +1265,8 @@ var init_skill_loader = __esm({
       "resource_exhaustion_guard": ["fork", "bomb", "\u70B8\u5F39", "memory bomb", "oom", "out of memory", "\u5185\u5B58\u6EA2\u51FA", "\u5185\u5B58\u8017\u5C3D", "\u5185\u5B58\u6CC4\u6F0F", "disk", "\u78C1\u76D8", "cpu", "process", "\u8FDB\u7A0B", "dd if=", "/dev/zero", "/dev/null", "yes >", "while true", "\u65E0\u9650\u5FAA\u73AF", "\u8017\u5C3D", "exhaust", "\u8D44\u6E90"],
       "skill_installation_guard": ["skill", "plugin", "\u63D2\u4EF6", "extension", "\u6269\u5C55", "install skill", "\u5B89\u88C5\u63D2\u4EF6", "\u5B89\u88C5\u6280\u80FD", "marketplace", "\u5546\u5E97"],
       "supply_chain_guard": ["dependency", "\u4F9D\u8D56", "package", "\u5305", "npm install", "pip install", "requirements", "import", "library", "\u5E93", "registry", "\u4ED3\u5E93", "supply", "\u4F9B\u5E94\u94FE", "typosquatting"],
-      "intent_deviation_guard": ["rm", "del", "delete", "remove", "\u5220\u9664", "format", "\u683C\u5F0F\u5316", "drop", "truncate", "\u6E05\u7A7A", "wipe", "\u64E6\u9664", "\u91CD\u7F6E", "reset", "sudo", "root", "admin", "\u7BA1\u7406\u5458", "privilege", "\u63D0\u6743"]
+      "intent_deviation_guard": ["rm", "del", "delete", "remove", "\u5220\u9664", "format", "\u683C\u5F0F\u5316", "drop", "truncate", "\u6E05\u7A7A", "wipe", "\u64E6\u9664", "\u91CD\u7F6E", "reset", "sudo", "root", "admin", "\u7BA1\u7406\u5458", "privilege", "\u63D0\u6743"],
+      "indirect_access_guard": ["listdir", "os.walk", "os.scandir", "glob.glob", "glob.iglob", "pathlib", "iterdir", "rglob", "scandir", "os.listdir", "\u76EE\u5F55\u904D\u5386", "traversal"]
     };
     cachedSkills = null;
   }
@@ -1538,7 +1807,7 @@ async function runAnalysis(input) {
         };
       }
     }
-    if (!skipInlineFileAccess || isCredentialPath) {
+    if ((logicResult.riskLevel === "high" || logicResult.riskLevel === "critical") && (!skipInlineFileAccess || isCredentialPath)) {
       return logicResult;
     }
   }