@kenhkl/agent-moss 0.8.4 → 0.9.0

package/dist/server.js

@@ -0,0 +1,4721 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __commonJS = (cb, mod) => function __require2() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// node_modules/tsup/assets/esm_shims.js
+import path from "path";
+import { fileURLToPath } from "url";
+var getFilename, getDirname, __dirname, __filename;
+var init_esm_shims = __esm({
+  "node_modules/tsup/assets/esm_shims.js"() {
+    "use strict";
+    getFilename = () => fileURLToPath(import.meta.url);
+    getDirname = () => path.dirname(getFilename());
+    __dirname = /* @__PURE__ */ getDirname();
+    __filename = /* @__PURE__ */ getFilename();
+  }
+});
+
+// src/config.ts
+var config_exports = {};
+__export(config_exports, {
+  detectProvider: () => detectProvider,
+  getCustomRules: () => getCustomRules,
+  getLLMConfig: () => getLLMConfig,
+  getLLMFailMode: () => getLLMFailMode,
+  getProviderHeaders: () => getProviderHeaders,
+  getRetryConfig: () => getRetryConfig,
+  getTimeoutConfig: () => getTimeoutConfig,
+  isHeuristicEnabled: () => isHeuristicEnabled,
+  isLLMAvailable: () => isLLMAvailable,
+  isLogicRulesEnabled: () => isLogicRulesEnabled,
+  updateLLMConfig: () => updateLLMConfig
+});
+import fs from "fs";
+import path2 from "path";
+import os from "os";
+function loadConfigFile(filePath) {
+  try {
+    const raw = fs.readFileSync(filePath, "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function resolveConfigPath() {
+  const envPath = process.env.AGENT_MOSS_CONFIG_PATH;
+  if (envPath) return envPath;
+  const userConfig = path2.join(os.homedir(), ".config", "agentmoss", "config.json");
+  if (fs.existsSync(userConfig)) return userConfig;
+  const defaultConfig = path2.join(__dirname, "..", "..", "agent_moss", "infra", "config.json.example");
+  if (fs.existsSync(defaultConfig)) {
+    const configDir = path2.dirname(userConfig);
+    fs.mkdirSync(configDir, { recursive: true });
+    const pkgConfig = loadConfigFile(defaultConfig);
+    const safeConfig = pkgConfig ? { ...pkgConfig, llm: { ...pkgConfig.llm, api_key: "" } } : {};
+    fs.writeFileSync(userConfig, JSON.stringify(safeConfig, null, 4), "utf-8");
+    console.log(`[AgentMoss] \u5DF2\u521B\u5EFA\u7528\u6237\u914D\u7F6E\u6587\u4EF6: ${userConfig}`);
+    console.log(`[AgentMoss] \u8BF7\u7F16\u8F91\u8BE5\u6587\u4EF6\u914D\u7F6E\u4F60\u7684 LLM API Key`);
+  }
+  return userConfig;
+}
+function loadLLMConfigFromFile(configPath) {
+  const data = loadConfigFile(configPath);
+  if (!data?.llm) return {};
+  const llm = data.llm;
+  return {
+    provider: llm.provider || "",
+    baseUrl: llm.base_url || "",
+    apiKey: llm.api_key || "",
+    model: llm.model || "",
+    temperature: llm.temperature ?? 0.1,
+    maxTokens: llm.max_tokens ?? 4096,
+    timeout: llm.timeout ?? 40
+  };
+}
+function loadTimeoutRetryFromFile(configPath) {
+  const data = loadConfigFile(configPath);
+  const t = data?.timeout ?? {};
+  const r = data?.retry ?? {};
+  return {
+    timeout: {
+      totalTimeout: Number(t.total_timeout ?? 90),
+      prompt1Timeout: Number(t.prompt1_timeout ?? 40),
+      prompt2Timeout: Number(t.prompt2_timeout ?? 20),
+      stepInterval: Number(t.step_interval ?? 0)
+    },
+    retry: {
+      maxRetries: Number(r.max_retries ?? 2),
+      retryInterval: Number(r.retry_interval ?? 2)
+    }
+  };
+}
+function getTimeoutConfig() {
+  return timeoutConfig;
+}
+function getRetryConfig() {
+  return retryConfig;
+}
+function loadCustomRules() {
+  try {
+    const raw = process.env.AGENT_MOSS_CUSTOM_RULES;
+    if (!raw) return [];
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed)) return [];
+    return parsed.filter((r) => r.pattern && r.action);
+  } catch {
+    return [];
+  }
+}
+function getLLMConfig() {
+  return llmConfig;
+}
+function updateLLMConfig(partial) {
+  llmConfig = { ...llmConfig, ...partial };
+}
+function getCustomRules() {
+  return customRules;
+}
+function isLLMAvailable() {
+  if (process.env.AGENT_MOSS_DISABLE_LLM === "1") return false;
+  return llmConfig.apiKey.length > 0;
+}
+function getLLMFailMode() {
+  const val = (process.env.AGENT_MOSS_LLM_FAIL_MODE || "fail_open").toLowerCase();
+  return val === "fail_closed" ? "fail_closed" : "fail_open";
+}
+function detectProvider(baseUrl, providerHint = "") {
+  if (providerHint) {
+    const hint = providerHint.toLowerCase();
+    if (["claude", "anthropic"].includes(hint)) return "anthropic";
+    if (["google", "gemini"].includes(hint)) return "gemini";
+    if (["zai-coding-plan", "zhipu-coding-plan", "zhipuai-coding-plan"].includes(hint)) return "zai-coding-plan";
+    if (["zai", "z-ai", "z.ai", "zai-cn", "zai-china", "zhipu", "glm-cn", "bigmodel"].includes(hint)) return "zhipu";
+    if (["xai", "xai-grok"].includes(hint)) return "xai";
+    if (["minimax", "minimax-openai"].includes(hint)) return "minimax";
+    if (["minimax-anthropic"].includes(hint)) return "minimax-anthropic";
+    if (["other", "custom", "local"].includes(hint)) return "openai-compatible";
+    return hint;
+  }
+  const url = baseUrl.toLowerCase();
+  if (url.includes("openrouter.ai")) return "openrouter";
+  if (url.includes("api.openai.com")) return "openai";
+  if (url.includes("anthropic.com") || url.includes("api.anthropic.com")) return "anthropic";
+  if (url.includes("generativelanguage.googleapis.com") || url.includes("gemini")) return "gemini";
+  if (url.includes("api.deepseek.com")) return "deepseek";
+  if (url.includes("api.groq.com")) return "groq";
+  if (url.includes("api.mistral.ai")) return "mistral";
+  if (url.includes("api.together.xyz")) return "together";
+  if (url.includes("api.x.ai")) return "xai";
+  if (url.includes("api.minimaxi.com")) return "minimax";
+  if (url.includes("api-ai.gitcode.com")) return "gitcode";
+  if (url.includes("api.z.ai")) return "zai-coding-plan";
+  if (url.includes("open.bigmodel.cn") || url.includes("bigmodel")) return "zhipu";
+  if (url.includes(":11434")) return "ollama";
+  return "openai-compatible";
+}
+function getProviderHeaders(provider) {
+  return PROVIDER_HEADERS[provider] || {};
+}
+function isHeuristicEnabled() {
+  return process.env.AGENT_MOSS_DISABLE_HEURISTIC !== "1";
+}
+function isLogicRulesEnabled() {
+  return process.env.AGENT_MOSS_DISABLE_LOGIC_RULES !== "1";
+}
+var timeoutConfig, retryConfig, llmConfig, customRules, PROVIDER_HEADERS;
+var init_config = __esm({
+  "src/config.ts"() {
+    "use strict";
+    init_esm_shims();
+    llmConfig = (() => {
+      const configPath = resolveConfigPath();
+      const fileConfig = fs.existsSync(configPath) ? loadLLMConfigFromFile(configPath) : {};
+      const tr = loadTimeoutRetryFromFile(configPath);
+      timeoutConfig = tr.timeout;
+      retryConfig = tr.retry;
+      return {
+        provider: process.env.AGENT_MOSS_LLM_PROVIDER || fileConfig.provider || "openai",
+        baseUrl: process.env.AGENT_MOSS_LLM_BASE_URL || fileConfig.baseUrl || "https://api.openai.com/v1",
+        apiKey: process.env.AGENT_MOSS_LLM_API_KEY || process.env.OPENAI_API_KEY || fileConfig.apiKey || "",
+        model: process.env.AGENT_MOSS_LLM_MODEL || fileConfig.model || "gpt-4o",
+        temperature: parseFloat(process.env.AGENT_MOSS_LLM_TEMPERATURE || String(fileConfig.temperature ?? "0.1")),
+        maxTokens: parseInt(process.env.AGENT_MOSS_LLM_MAX_TOKENS || String(fileConfig.maxTokens ?? "4096"), 10),
+        // 优先用 env，否则用 timeout 块的 prompt1Timeout（对齐 py）
+        timeout: parseInt(process.env.AGENT_MOSS_LLM_TIMEOUT || String(fileConfig.timeout ?? String(tr.timeout.prompt1Timeout)), 10)
+      };
+    })();
+    customRules = loadCustomRules();
+    PROVIDER_HEADERS = {
+      "openrouter": {
+        "HTTP-Referer": "shturl.cc/LlVD5pyWViHjM",
+        "X-OpenRouter-Title": "AgentMoss"
+      },
+      "xai": {
+        "HTTP-Referer": "shturl.cc/LlVD5pyWViHjM"
+      }
+    };
+  }
+});
+
+// src/agents/index.ts
+import { readFileSync, existsSync } from "fs";
+import { resolve, dirname } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+function resolveAgentsDir() {
+  if (existsSync(AGENTS_DIR_PROD)) return AGENTS_DIR_PROD;
+  if (existsSync(AGENTS_DIR_DEV_FALLBACK)) return AGENTS_DIR_DEV_FALLBACK;
+  return AGENTS_DIR_PROD;
+}
+function getAgentExtensions(agentId) {
+  if (!agentId) return null;
+  if (cache.has(agentId)) return cache.get(agentId) ?? null;
+  const agentsDir = resolveAgentsDir();
+  const rulesFile = resolve(agentsDir, agentId, "rules.json");
+  if (!existsSync(rulesFile)) {
+    cache.set(agentId, null);
+    return null;
+  }
+  try {
+    const raw = readFileSync(rulesFile, "utf-8");
+    const ext = JSON.parse(raw);
+    if (!ext.agent_id) {
+      console.warn(`[AgentMoss agents] rules.json \u7F3A\u5C11 agent_id \u5B57\u6BB5: ${rulesFile}`);
+      cache.set(agentId, null);
+      return null;
+    }
+    cache.set(agentId, ext);
+    console.log(
+      `[AgentMoss agents] \u52A0\u8F7D agent ${agentId} \u5B9A\u5236\u89C4\u5219: ${ext.extra_command_patterns?.length ?? 0} cmd patterns, ${ext.extra_injection_keywords?.length ?? 0} injection keywords, ${ext.extra_sensitive_paths?.length ?? 0} sensitive paths, ${ext.builtin_safe_skills?.length ?? 0} builtin safe skills`
+    );
+    return ext;
+  } catch (e) {
+    console.error(`[AgentMoss agents] \u52A0\u8F7D agent ${agentId} rules.json \u5931\u8D25:`, e.message);
+    cache.set(agentId, null);
+    return null;
+  }
+}
+var __filename2, __dirname2, AGENTS_DIR_PROD, AGENTS_DIR_DEV_FALLBACK, cache;
+var init_agents = __esm({
+  "src/agents/index.ts"() {
+    "use strict";
+    init_esm_shims();
+    __filename2 = fileURLToPath2(import.meta.url);
+    __dirname2 = dirname(__filename2);
+    AGENTS_DIR_PROD = resolve(__dirname2, "agents");
+    AGENTS_DIR_DEV_FALLBACK = resolve(__dirname2, "../../../agent_moss/agents");
+    cache = /* @__PURE__ */ new Map();
+  }
+});
+
+// src/engine/heuristic.ts
+function runHeuristicCheck(input) {
+  const command = `${input.aNext.actionType}: ${input.aNext.actionDetail}`;
+  const matched = [];
+  let highestSeverity = "low";
+  let highestRiskType = "";
+  const userRules = getCustomRules();
+  for (const rule of userRules) {
+    try {
+      const re = new RegExp(rule.pattern);
+      if (re.test(command)) {
+        if (rule.action === "Deny") {
+          matched.push(`\u81EA\u5B9A\u4E49\u89C4\u5219: ${rule.pattern}`);
+          if (severityRank(rule.severity) > severityRank(highestSeverity)) {
+            highestSeverity = rule.severity;
+            highestRiskType = "custom_rule";
+          }
+        }
+      }
+    } catch {
+    }
+  }
+  let topRiskType = "";
+  for (const rule of DANGEROUS_PATTERNS) {
+    if (rule.pattern.test(command)) {
+      matched.push(rule.description);
+      if (severityRank(rule.severity) > severityRank(highestSeverity)) {
+        highestSeverity = rule.severity;
+        topRiskType = rule.riskType;
+      }
+    }
+  }
+  highestRiskType = topRiskType || highestRiskType;
+  const agentExt = getAgentExtensions(input.agentId);
+  if (agentExt?.extra_command_patterns) {
+    for (const rule of agentExt.extra_command_patterns) {
+      try {
+        const re = new RegExp(rule.pattern, "i");
+        if (re.test(command)) {
+          matched.push(`agent \u4E13\u5C5E\u89C4\u5219: ${rule.reason}`);
+          if (severityRank(rule.risk_level) > severityRank(highestSeverity)) {
+            highestSeverity = rule.risk_level;
+            highestRiskType = rule.risk_type;
+          }
+        }
+      } catch {
+      }
+    }
+  }
+  const injectionText = `${input.aNext.actionType} ${input.aNext.actionDetail} ${input.reason || ""} ${input.promptSession || ""}`.toLowerCase();
+  const injectionHits = checkInjectionKeywords(injectionText, agentExt?.extra_injection_keywords);
+  if (injectionHits.length > 0) {
+    const topHit = injectionHits.reduce((a, b) => severityRank(a.riskLevel) >= severityRank(b.riskLevel) ? a : b);
+    matched.push(...injectionHits.map((h) => `\u6CE8\u5165\u5173\u952E\u8BCD [${h.lang}]: ${h.keyword}`));
+    if (severityRank(topHit.riskLevel) > severityRank(highestSeverity)) {
+      highestSeverity = topHit.riskLevel;
+      highestRiskType = "prompt_injection";
+    }
+  }
+  if (matched.length > 0) {
+    return {
+      allowed: false,
+      reason: `\u68C0\u6D4B\u5230\u9AD8\u5371\u64CD\u4F5C: ${matched.join(", ")}`,
+      riskLevel: highestSeverity,
+      riskType: highestRiskType,
+      confidence: 95,
+      source: "heuristic",
+      violatedLayers: ["1.1"]
+      // 对齐 py coordinator.py:165（L1.1 = 命中高危命令模式/注入关键词）
+    };
+  }
+  return null;
+}
+function checkInjectionKeywords(text, extraKeywords) {
+  const hits = [];
+  for (const entry of INJECTION_KEYWORDS) {
+    if (text.includes(entry.keyword.toLowerCase())) {
+      hits.push(entry);
+    }
+  }
+  if (extraKeywords) {
+    for (const entry of extraKeywords) {
+      if (text.includes(entry.keyword.toLowerCase())) {
+        hits.push({ keyword: entry.keyword, riskLevel: entry.risk_level, lang: entry.lang });
+      }
+    }
+  }
+  return hits;
+}
+function isInlineScriptCommand(actionDetail) {
+  const re = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
+  return re.test(actionDetail);
+}
+function severityRank(s) {
+  const ranks = { low: 1, medium: 2, high: 3, critical: 4 };
+  return ranks[s] || 0;
+}
+var INJECTION_KEYWORDS, DANGEROUS_PATTERNS;
+var init_heuristic = __esm({
+  "src/engine/heuristic.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_config();
+    init_agents();
+    INJECTION_KEYWORDS = [
+      // ---- Instruction Override ----
+      { keyword: "ignore previous instructions", riskLevel: "critical", lang: "en" },
+      { keyword: "ignore all previous", riskLevel: "critical", lang: "en" },
+      { keyword: "disregard all prior", riskLevel: "critical", lang: "en" },
+      { keyword: "forget everything", riskLevel: "high", lang: "en" },
+      { keyword: "\u5FFD\u7565\u4E4B\u524D\u7684\u6307\u4EE4", riskLevel: "critical", lang: "zh" },
+      { keyword: "\u5FFD\u7565\u6240\u6709\u5148\u524D\u7684", riskLevel: "critical", lang: "zh" },
+      { keyword: "\u5FFD\u7565\u4E0A\u9762\u6240\u6709", riskLevel: "high", lang: "zh" },
+      { keyword: "\u8BF7\u5FD8\u8BB0\u4E4B\u524D", riskLevel: "high", lang: "zh" },
+      // ---- Role Hijacking ----
+      { keyword: "you are now", riskLevel: "high", lang: "en" },
+      { keyword: "you are no longer", riskLevel: "high", lang: "en" },
+      { keyword: "new instructions", riskLevel: "high", lang: "en" },
+      { keyword: "from now on, you", riskLevel: "high", lang: "en" },
+      { keyword: "\u4F60\u73B0\u5728\u662F\u4E00\u4E2A", riskLevel: "high", lang: "zh" },
+      { keyword: "\u4F60\u4E0D\u518D\u662F\u4E00\u4E2A", riskLevel: "high", lang: "zh" },
+      { keyword: "\u4ECE\u73B0\u5728\u5F00\u59CB\u4F60", riskLevel: "high", lang: "zh" },
+      { keyword: "\u4F60\u7684\u65B0\u89D2\u8272\u662F", riskLevel: "high", lang: "zh" },
+      // ---- Command Injection ----
+      { keyword: "system prompt", riskLevel: "high", lang: "en" },
+      { keyword: "reveal your instructions", riskLevel: "high", lang: "en" },
+      { keyword: "output your instructions", riskLevel: "high", lang: "en" },
+      { keyword: "repeat your instructions", riskLevel: "medium", lang: "en" },
+      { keyword: "\u7CFB\u7EDF\u63D0\u793A", riskLevel: "high", lang: "zh" },
+      { keyword: "\u8F93\u51FA\u4F60\u7684\u6307\u4EE4", riskLevel: "high", lang: "zh" },
+      { keyword: "\u91CD\u590D\u4F60\u7684\u6307\u4EE4", riskLevel: "medium", lang: "zh" },
+      // ---- Social Engineering ----
+      { keyword: "this is an authorized test", riskLevel: "high", lang: "en" },
+      { keyword: "security audit approved", riskLevel: "high", lang: "en" },
+      { keyword: "admin override", riskLevel: "critical", lang: "en" },
+      { keyword: "debug mode", riskLevel: "high", lang: "en" },
+      { keyword: "maintenance mode", riskLevel: "high", lang: "en" },
+      { keyword: "\u8FD9\u662F\u6388\u6743\u7684\u6D4B\u8BD5", riskLevel: "high", lang: "zh" },
+      { keyword: "\u5B89\u5168\u5BA1\u8BA1\u5DF2\u6279\u51C6", riskLevel: "high", lang: "zh" },
+      { keyword: "\u7BA1\u7406\u5458\u8986\u76D6", riskLevel: "critical", lang: "zh" },
+      { keyword: "\u8C03\u8BD5\u6A21\u5F0F", riskLevel: "high", lang: "zh" },
+      // ---- XSS ----
+      { keyword: "<script>", riskLevel: "high", lang: "en" },
+      { keyword: "javascript:", riskLevel: "high", lang: "en" },
+      { keyword: "onerror=", riskLevel: "high", lang: "en" },
+      { keyword: "onload=", riskLevel: "high", lang: "en" },
+      // ---- Fake Boundaries ----
+      { keyword: "=== END OF", riskLevel: "high", lang: "en" },
+      { keyword: "--- END SYSTEM", riskLevel: "high", lang: "en" },
+      { keyword: "[END OF", riskLevel: "high", lang: "en" },
+      { keyword: "=== \u7ED3\u675F", riskLevel: "high", lang: "zh" },
+      { keyword: "--- \u7ED3\u675F\u7CFB\u7EDF", riskLevel: "high", lang: "zh" },
+      // ---- Developer Mode ----
+      { keyword: "developer mode", riskLevel: "critical", lang: "en" },
+      { keyword: "DAN mode", riskLevel: "critical", lang: "en" },
+      { keyword: "jailbreak", riskLevel: "critical", lang: "en" },
+      { keyword: "\u5F00\u53D1\u8005\u6A21\u5F0F", riskLevel: "critical", lang: "zh" },
+      { keyword: "\u8D8A\u72F1", riskLevel: "critical", lang: "zh" }
+      // 注：xiaoO 专属绕过词（绕过审计/禁用安全检查/关闭防护/bypass audit 等）
+      // 已迁至 agent_moss/agents/xiaoo/rules.json 的 extra_injection_keywords，
+      // 由 agent_ext 机制注入，不再污染通用层。
+    ];
+    DANGEROUS_PATTERNS = [
+      // --- Critical: rm command graded detection (strict to loose, first match wins) ---
+      // 1. rm -rf root dir (含通配符如 /* /.* 等) — 使用负向先行断言 (?!\w)：/ 后面不是单词字符时匹配
+      { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*f[a-zA-Z]*\s+\/(?!\w)/i, severity: "critical", description: "\u9012\u5F52\u5F3A\u5236\u5220\u9664\u6839\u76EE\u5F55 (rm -rf /)", riskType: "script_execution" },
+      // 注意：已移除"rm -rf /任意绝对路径"的宽泛规则，避免误杀 /tmp 等临时目录清理操作
+      // 2. rm with -r or -f targeting system dirs
+      { pattern: /\brm\s+-[a-zA-Z]*[rf][a-zA-Z]*\s+\/(etc|var|home|usr|boot|root|opt|srv|sys|proc)\b/i, severity: "critical", description: "\u5220\u9664\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55", riskType: "script_execution" },
+      // 3. rm -r absolute path (no -f)
+      { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*\s+\//i, severity: "high", description: "\u9012\u5F52\u5220\u9664\u64CD\u4F5C (rm -r /...)", riskType: "script_execution" },
+      // 4. rm -f absolute path (no -r)
+      { pattern: /\brm\s+-[a-zA-Z]*f[a-zA-Z]*\s+\//i, severity: "medium", description: "\u5F3A\u5236\u5220\u9664\u6587\u4EF6 (rm -f /...)", riskType: "script_execution" },
+      // dd 磁盘清零 — 只拦截写入系统关键目录，放行 /tmp 等临时目录
+      { pattern: /dd\s+if=\/dev\/zero.*\bof\s*=\s*\/(etc|var|home|usr|boot|root|opt|srv|sys|proc)\b/i, severity: "critical", description: "\u78C1\u76D8\u6E05\u96F6\u5199\u5165\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55 (dd if=/dev/zero of=/\u7CFB\u7EDF\u76EE\u5F55)", riskType: "script_execution" },
+      // mkfs 格式化 — 只拦截对块设备（/dev/sdX 等）的格式化，放行对普通文件的格式化
+      { pattern: /mkfs\.\w+\s+\/dev\/(sd|hd|nvme|vd|loop|mapper|md|dm)\S+/i, severity: "critical", description: "\u683C\u5F0F\u5316\u5757\u8BBE\u5907 (mkfs /dev/\u5757\u8BBE\u5907)", riskType: "script_execution" },
+      { pattern: /:\(\)\s*\{.*:\|:&.*\};:/i, severity: "critical", description: "Fork Bomb", riskType: "resource_exhaustion" },
+      // --- Critical: remote code execution ---
+      { pattern: /curl\s+.*\|\s*(bash|sh|zsh|dash)/i, severity: "critical", description: "curl pipe shell \u6267\u884C", riskType: "script_execution" },
+      { pattern: /wget\s+.*\|\s*(bash|sh)/i, severity: "critical", description: "wget pipe shell \u6267\u884C", riskType: "script_execution" },
+      { pattern: /eval\s+\$\(curl|eval\s+\$\(wget/i, severity: "critical", description: "eval \u8FDC\u7A0B\u4EE3\u7801\u6267\u884C", riskType: "script_execution" },
+      { pattern: /base64\s+-d\s+.*\|\s*bash/i, severity: "critical", description: "base64 \u89E3\u7801\u6267\u884C", riskType: "script_execution" },
+      // --- Critical: reverse shell ---
+      { pattern: /\/dev\/tcp\/|bash\s+-i\s+>&/i, severity: "critical", description: "\u53CD\u5F39 Shell", riskType: "script_execution" },
+      { pattern: /nc\s+-[el]\s+.*\d{1,5}/i, severity: "high", description: "Netcat \u53CD\u5F39\u8FDE\u63A5", riskType: "lateral_movement" },
+      // --- Critical: sensitive file access ---
+      { pattern: /\/etc\/shadow/i, severity: "critical", description: "\u8BBF\u95EE\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6 (/etc/shadow)", riskType: "file_access" },
+      { pattern: /\/etc\/gshadow/i, severity: "critical", description: "\u8BBF\u95EE\u7CFB\u7EDF\u7EC4\u5BC6\u7801\u6587\u4EF6 (/etc/gshadow)", riskType: "file_access" },
+      // 注意：/etc/passwd 已从拦截列表移除，因为它是公开可读的标准系统文件，真正敏感的是 /etc/shadow
+      { pattern: /\.ssh\/id_rsa/i, severity: "critical", description: "\u8BBF\u95EE SSH \u79C1\u94A5\u6587\u4EF6", riskType: "file_access" },
+      // --- Critical: privilege escalation / container escape ---
+      { pattern: /\/var\/run\/docker\.sock/i, severity: "critical", description: "\u8BBF\u95EE Docker socket\uFF0C\u53EF\u80FD\u5BFC\u81F4\u5BB9\u5668\u9003\u9038", riskType: "privilege_escalation" },
+      // --- High: dangerous permissions / ownership ---
+      { pattern: /chmod\s+[0-7]*777[0-7]*/i, severity: "high", description: "\u5168\u6743\u9650\u8BBE\u7F6E (chmod 777)", riskType: "script_execution" },
+      { pattern: /chown\s+root|chown\s+-R\s+\w+:\w+\s+\//i, severity: "high", description: "\u4FEE\u6539\u6240\u6709\u8005\u4E3A root / \u9012\u5F52\u4FEE\u6539\u6839\u76EE\u5F55\u6240\u6709\u8005", riskType: "script_execution" },
+      // sudo 提权 — 只拦截 sudo 后跟的危险命令，不一刀切拦截所有 sudo
+      { pattern: /sudo\s+(rm|chmod|chown|dd|mkfs|format|iptables|crontab|passwd|userdel|useradd|groupdel)\b/i, severity: "high", description: "\u63D0\u6743\u6267\u884C\u9AD8\u5371\u547D\u4EE4 (sudo + \u5371\u9669\u64CD\u4F5C)", riskType: "privilege_escalation" },
+      // --- High: system config overwrite ---
+      { pattern: />\s*\/etc\//i, severity: "critical", description: "\u8986\u76D6\u5199\u5165\u7CFB\u7EDF\u914D\u7F6E\u76EE\u5F55", riskType: "file_access" },
+      // --- High: download script + execute risk ---
+      { pattern: /(?:curl|wget)\s+.*(?:-o|--output|>)\s*\S+\.(?:sh|bash)\b/i, severity: "high", description: "\u8FDC\u7A0B\u4E0B\u8F7D\u811A\u672C\u5230\u672C\u5730", riskType: "script_execution" },
+      { pattern: /(?:curl|wget)\s+.*\s+&&?\s*(?:chmod\s+\+x|bash|sh)/i, severity: "high", description: "\u4E0B\u8F7D\u540E\u6267\u884C", riskType: "script_execution" },
+      // --- High: package manager pipe-to-shell ---
+      { pattern: /git\s+clone\s+.*\|.*bash/i, severity: "high", description: "git clone pipe shell", riskType: "script_execution" },
+      { pattern: /pip\s+install\s+.*\|\s*bash/i, severity: "high", description: "pip install pipe shell", riskType: "script_execution" },
+      { pattern: /npm\s+install\s+-g\s+.*\|\s*bash/i, severity: "high", description: "npm install pipe shell", riskType: "script_execution" },
+      // --- Medium: destructive git operations (降级为 medium，允许但记录) ---
+      { pattern: /git\s+push\s+.*--force/i, severity: "medium", description: "\u5F3A\u5236\u63A8\u9001\u64CD\u4F5C (git push --force)\uFF0C\u53EF\u80FD\u8986\u76D6\u8FDC\u7A0B\u63D0\u4EA4\u5386\u53F2", riskType: "script_execution" },
+      // --- High: network port scanning (横向移动侦察) ---
+      { pattern: /\bnmap\s+/i, severity: "high", description: "\u7F51\u7EDC\u7AEF\u53E3\u626B\u63CF (nmap)\uFF0C\u53EF\u80FD\u7528\u4E8E\u6A2A\u5411\u79FB\u52A8\u4FA6\u5BDF", riskType: "lateral_movement" },
+      { pattern: /\b(masscan|zmap|unicornscan)\s+/i, severity: "high", description: "\u7F51\u7EDC\u7AEF\u53E3\u626B\u63CF\u5DE5\u5177\uFF0C\u53EF\u80FD\u7528\u4E8E\u6A2A\u5411\u79FB\u52A8\u4FA6\u5BDF", riskType: "lateral_movement" },
+      // --- Medium: credential export ---
+      { pattern: /export\s+.*(?:TOKEN|KEY|SECRET|PASSWORD)/i, severity: "medium", description: "\u5BFC\u51FA\u654F\u611F\u51ED\u8BC1", riskType: "data_exfiltration" },
+      // --- High: shell rc file append (persistence) ---
+      { pattern: />>\s*(~|\/home\/[^/]+)\/(\.bashrc|\.zshrc|\.profile|\.bash_profile|\.zprofile)/, severity: "high", description: "\u68C0\u6D4B\u5230\u4FEE\u6539 Shell \u914D\u7F6E\u6587\u4EF6\uFF08~/.bashrc \u7B49\uFF09\uFF0C\u53EF\u80FD\u7528\u4E8E\u6301\u4E45\u5316\u540E\u95E8", riskType: "persistence" },
+      // --- High: device file write (只拦截重定向写入设备文件，不拦截读取) ---
+      { pattern: />\s*\/dev\/(sd|hd|nvme|vd|loop|mem|kmsg|port|zero|random|urandom|full|core)/i, severity: "high", description: "\u91CD\u5B9A\u5411\u5199\u5165\u8BBE\u5907\u6587\u4EF6", riskType: "file_access" },
+      // --- High: non-interactive password modification ---
+      { pattern: /\|\s*passwd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u7BA1\u9053\u65B9\u5F0F\u8C03\u7528 passwd\uFF08\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\uFF09", riskType: "script_execution" },
+      { pattern: /\bpasswd\s+--stdin\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 passwd --stdin \u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u8F93\u5165", riskType: "script_execution" },
+      { pattern: /\bchpasswd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 chpasswd \u6279\u91CF\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4", riskType: "script_execution" },
+      { pattern: /\b(newusers|lnewusers)\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 newusers/lnewusers \u6279\u91CF\u7528\u6237\u6DFB\u52A0\u547D\u4EE4", riskType: "script_execution" },
+      { pattern: /\bpasswd\s+-[a-zA-Z]*d\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u5BC6\u7801\u64CD\u4F5C (passwd -d)", riskType: "script_execution" },
+      { pattern: /\bpasswd\s+-[a-zA-Z]*l\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u9501\u5B9A\u7528\u6237\u8D26\u6237\u64CD\u4F5C (passwd -l)", riskType: "script_execution" },
+      // --- High: non-interactive password modification (extended) ---
+      { pattern: /\blpasswd\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u64CD\u4F5C (lpasswd)", riskType: "script_execution" },
+      { pattern: /\bgpasswd\s+(?!-[adA])/i, severity: "high", description: "\u68C0\u6D4B\u5230\u7EC4\u5BC6\u7801\u7BA1\u7406\u64CD\u4F5C (gpasswd)", riskType: "script_execution" },
+      { pattern: /\bchgpasswd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u6279\u91CF\u4FEE\u6539\u7EC4\u5BC6\u7801\u64CD\u4F5C (chgpasswd)", riskType: "script_execution" },
+      // --- High: user/group deletion (irreversible, requires user consent) ---
+      { pattern: /\buserdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (userdel)", riskType: "script_execution" },
+      { pattern: /\bdeluser\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (deluser)", riskType: "script_execution" },
+      { pattern: /\bluserdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (luserdel)", riskType: "script_execution" },
+      { pattern: /\bgroupdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u7EC4\u64CD\u4F5C (groupdel)", riskType: "script_execution" },
+      { pattern: /\blgroupdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u7EC4\u64CD\u4F5C (lgroupdel)", riskType: "script_execution" },
+      // --- High: generic command -p parameter password setting ---
+      { pattern: /\b(useradd|luseradd|groupadd|usermod|lusermod|groupmod|lgroupmod)\b[^&|;]*?\s-p\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u901A\u8FC7 -p \u53C2\u6570\u8BBE\u7F6E\u6216\u4FEE\u6539\u5BC6\u7801 (useradd/usermod/groupmod)", riskType: "script_execution" }
+    ];
+  }
+});
+
+// src/engine/inline-analyzer.ts
+function isLiteralTextCommand(command) {
+  ECHO_CMD_RE.lastIndex = 0;
+  return ECHO_CMD_RE.test(command);
+}
+function extractInlineCode(command) {
+  const parts = [];
+  let m;
+  INLINE_CODE_RE.lastIndex = 0;
+  while ((m = INLINE_CODE_RE.exec(command)) !== null) {
+    const code = m[1] ?? m[2];
+    if (code) parts.push(code);
+  }
+  ECHO_STRING_RE.lastIndex = 0;
+  while ((m = ECHO_STRING_RE.exec(command)) !== null) {
+    const code = m[1] ?? m[2];
+    if (code) parts.push(code);
+  }
+  return parts.join("\n");
+}
+function hasWriteExecChain(command) {
+  return WRITE_EXEC_CHAIN_PATTERNS.some((p) => {
+    p.lastIndex = 0;
+    return p.test(command);
+  });
+}
+function hasDirTraversal(code) {
+  const lower = code.toLowerCase();
+  return DIR_TRAVERSAL_KEYWORDS.some((kw) => lower.includes(kw));
+}
+function hasReadWriteKeyword(code) {
+  const lower = code.toLowerCase();
+  return READ_WRITE_KEYWORDS.some((kw) => lower.includes(kw));
+}
+function analyzeInlineScript(command) {
+  const code = extractInlineCode(command);
+  if (!code) {
+    return { actionable: false, allowed: true, reason: "", riskLevel: "low", riskType: "" };
+  }
+  if (hasWriteExecChain(command)) {
+    return {
+      actionable: true,
+      allowed: false,
+      reason: "\u5185\u8054\u811A\u672C\u542B\u5199\u5165\u6587\u4EF6\u540E\u6267\u884C\u7684\u6A21\u5F0F\uFF0C\u7591\u4F3C\u7ED5\u8FC7\u654F\u611F\u8DEF\u5F84\u68C0\u6D4B",
+      riskLevel: "critical",
+      riskType: "script_execution"
+    };
+  }
+  const redirMatch = command.match(REDIRECT_TO_SENSITIVE_RE);
+  if (redirMatch) {
+    return {
+      actionable: true,
+      allowed: false,
+      reason: `\u91CD\u5B9A\u5411\u5199\u5165\u654F\u611F\u8DEF\u5F84: ${redirMatch[1]}`,
+      riskLevel: "critical",
+      riskType: "file_access"
+    };
+  }
+  const isEchoOrPrintf1 = isLiteralTextCommand(command);
+  if (!isEchoOrPrintf1 && hasDirTraversal(code) && hasReadWriteKeyword(code)) {
+    return { actionable: false, allowed: true, reason: "", riskLevel: "low", riskType: "" };
+  }
+  const isEchoOrPrintf = isLiteralTextCommand(command);
+  if (!isEchoOrPrintf && hasReadWriteKeyword(code)) {
+    return {
+      actionable: true,
+      allowed: false,
+      reason: "\u5185\u8054\u811A\u672C\u542B\u654F\u611F\u8DEF\u5F84\u4E14\u542B\u6587\u4EF6\u8BFB\u5199/\u547D\u4EE4\u6267\u884C\u8C03\u7528\uFF0C\u5224\u4E3A\u771F\u5B9E\u8BBF\u95EE",
+      riskLevel: "critical",
+      riskType: "file_access"
+    };
+  }
+  return {
+    actionable: true,
+    allowed: true,
+    reason: "\u654F\u611F\u8DEF\u5F84\u4EC5\u4F5C\u4E3A\u6587\u672C\u5B57\u9762\u91CF\u51FA\u73B0\uFF0C\u672A\u4F34\u968F\u8BFB\u5199\u64CD\u4F5C",
+    riskLevel: "low",
+    riskType: "file_access"
+  };
+}
+var INLINE_CODE_RE, ECHO_STRING_RE, ECHO_CMD_RE, READ_WRITE_KEYWORDS, WRITE_EXEC_CHAIN_PATTERNS, SENSITIVE_PATH_FRAGMENTS, REDIRECT_TO_SENSITIVE_RE, DIR_TRAVERSAL_KEYWORDS;
+var init_inline_analyzer = __esm({
+  "src/engine/inline-analyzer.ts"() {
+    "use strict";
+    init_esm_shims();
+    INLINE_CODE_RE = /(?:python|python3|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cera][a-zA-Z]*\s+)"([^"\\]*(?:\\.[^"\\]*)*)"|'([^'\\]*(?:\\.[^'\\]*)*)'/gi;
+    ECHO_STRING_RE = /\b(?:echo|printf)\s+"([^"\\]*(?:\\.[^"\\]*)*)"|\b(?:echo|printf)\s+'([^'\\]*(?:\\.[^'\\]*)*)'/gi;
+    ECHO_CMD_RE = /(?:^|\s|;|&&|\|\|)(?:echo|printf)\s/gi;
+    READ_WRITE_KEYWORDS = [
+      // 函数调用形态（关键词后跟 '('）
+      "open(",
+      "read(",
+      "write(",
+      "fopen(",
+      "system(",
+      "exec(",
+      "eval(",
+      "popen(",
+      "load(",
+      "dump(",
+      // 文件读写（组合形态）
+      "readline",
+      "readlines",
+      "writelines",
+      "getpass",
+      "pickle.load",
+      "yaml.load",
+      "json.load",
+      "json.read",
+      "configparser",
+      "fread",
+      "fwrite",
+      "fgets",
+      // 子进程执行（组合形态）
+      "os.system",
+      "os.popen",
+      "subprocess",
+      "os.exec",
+      "os.spawn",
+      "import os",
+      "import subprocess",
+      "shell=true",
+      "check_output",
+      "check_call",
+      "run(",
+      // 绕过变体检测
+      "getattr(",
+      "__builtins__",
+      "globals(",
+      "locals(",
+      // PHP
+      "file_get_contents",
+      "file_put_contents",
+      "passthru",
+      "shell_exec",
+      "proc_open",
+      // Perl-Ruby
+      "<stdin>",
+      "open my"
+    ];
+    WRITE_EXEC_CHAIN_PATTERNS = [
+      // echo/cat/printf "..." > file && bash/sh/python file
+      /(?:echo|cat|printf)\b.*?>\s*\S+.*(?:&&|;|\|)\s*(?:bash|sh|zsh|python\d?|perl|ruby|node|php)\s/gis,
+      // ... | bash / | sh / | python（管道喂解释器执行）
+      /\|\s*(?:bash|sh|zsh|python\d?|perl|ruby|node|php)\b/gi,
+      // eval "$(cat ...)" / eval "$(echo ...)"
+      /eval\s+"\$\(/gi,
+      // xargs bash / xargs sh
+      /\|\s*xargs\s+(?:bash|sh|zsh)/gi
+    ];
+    SENSITIVE_PATH_FRAGMENTS = [
+      "/etc/shadow",
+      "/etc/gshadow",
+      "/etc/passwd",
+      "/etc/sudoers",
+      "/etc/hosts",
+      "/etc/crontab",
+      "/etc/systemd/",
+      "/etc/ssh/sshd_config",
+      "/boot/",
+      "/proc/sys/",
+      "/sys/",
+      "/dev/mem",
+      "/dev/kmsg",
+      ".ssh/id_rsa",
+      ".ssh/id_ed25519",
+      ".ssh/authorized_keys"
+    ];
+    REDIRECT_TO_SENSITIVE_RE = new RegExp(`>{1,2}\\s*(${SENSITIVE_PATH_FRAGMENTS.map((p) => p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})`, "i");
+    DIR_TRAVERSAL_KEYWORDS = [
+      // Python 目录遍历
+      "os.listdir",
+      "os.walk",
+      "os.scandir",
+      "glob.glob",
+      "glob.iglob",
+      "pathlib.",
+      "iterdir",
+      "rglob",
+      "scandir(",
+      "listdir("
+    ];
+  }
+});
+
+// src/engine/logic-rules.ts
+import * as fs2 from "fs";
+function runLogicCheck(input) {
+  const { actionHistory, aNext, cwd } = input;
+  const actionDetail = aNext.actionDetail.toLowerCase();
+  const actionType = aNext.actionType.toLowerCase();
+  const resolvedCwd = cwd || "/";
+  const EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
+  const isExcludedType = EXCLUDED_PREFIXES.some((p) => actionType.startsWith(p));
+  const rbwResult = checkReadBeforeWrite(actionType, actionDetail, actionHistory, input.reason, resolvedCwd);
+  if (rbwResult) return rbwResult;
+  if (input.promptSession && input.promptSession.trim()) {
+    if (!isExcludedType) {
+      const promptLower = input.promptSession.toLowerCase();
+      for (const pattern of INTENT_DEVIATION_PATTERNS) {
+        const intentMatched = pattern.intentKeywords.some((kw) => promptLower.includes(kw));
+        const dangerousMatched = pattern.dangerousActions.some((kw) => actionDetail.includes(kw));
+        if (intentMatched && dangerousMatched) {
+          return {
+            allowed: false,
+            reason: pattern.reason,
+            riskLevel: "high",
+            riskType: "intent_deviation",
+            confidence: 85,
+            source: "logic_rule",
+            violatedLayers: ["2"]
+          };
+        }
+      }
+    }
+  }
+  if (!isExcludedType) {
+    const agentExt = getAgentExtensions(input.agentId || "");
+    const pathResult = checkSensitivePath(actionDetail, resolvedCwd, agentExt);
+    if (pathResult) return pathResult;
+  }
+  if (actionType !== "file_write" && actionType !== "file_edit") {
+    const TEMP_DIRS = ["/tmp/", "/var/tmp/", "/run/", "/dev/shm/"];
+    const isTempPath = TEMP_DIRS.some((td) => actionDetail.includes(td));
+    if (!isTempPath && (actionDetail.includes("*") || actionDetail.includes("?")) && ["rm ", "rm	", "del ", "del	", "delete", "remove ", "remove	", "\u5220\u9664", "\u79FB\u9664"].some((kw) => actionDetail.includes(kw))) {
+      return {
+        allowed: false,
+        reason: "\u68C0\u6D4B\u5230\u901A\u914D\u7B26\u7ED3\u5408\u5220\u9664\u64CD\u4F5C\uFF0C\u53EF\u80FD\u9020\u6210\u6279\u91CF\u8BEF\u5220",
+        riskLevel: "high",
+        riskType: "script_execution",
+        confidence: 90,
+        source: "logic_rule",
+        violatedLayers: ["2"]
+      };
+    }
+    if (/>\s*\/etc\//.test(actionDetail) || />\s*\/boot\//.test(actionDetail) || />\s*\/proc\//.test(actionDetail)) {
+      return {
+        allowed: false,
+        reason: "\u68C0\u6D4B\u5230\u91CD\u5B9A\u5411\u8986\u76D6\u5199\u5165\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55",
+        riskLevel: "critical",
+        riskType: "file_access",
+        confidence: 95,
+        source: "logic_rule",
+        violatedLayers: ["2"]
+      };
+    }
+  }
+  var _READ_ONLY_COMMANDS = /* @__PURE__ */ new Set([
+    "cat",
+    "head",
+    "tail",
+    "less",
+    "more",
+    "grep",
+    "find",
+    "awk",
+    "sed",
+    "sort",
+    "uniq",
+    "wc",
+    "cut",
+    "strings",
+    "od",
+    "xxd",
+    "hexdump",
+    "tr",
+    "file",
+    "stat",
+    "du",
+    "df",
+    "ls",
+    "dir",
+    "tree",
+    "nl",
+    "tac",
+    "rev",
+    "lsblk",
+    "blockdev",
+    "smartctl",
+    "udevadm",
+    "dmidecode",
+    "lscpu",
+    "lspci",
+    "lsusb",
+    "lsmem",
+    "lsns",
+    "lsof",
+    "hwinfo",
+    "inxi",
+    "fdisk",
+    "parted",
+    "dmesg",
+    "journalctl",
+    "systemctl",
+    "hostnamectl",
+    "localectl",
+    "timedatectl",
+    "ps",
+    "top",
+    "free",
+    "vmstat",
+    "iostat",
+    "mpstat",
+    "pidof",
+    "pgrep",
+    "ip",
+    "ifconfig",
+    "route",
+    "ss",
+    "netstat",
+    "arp",
+    "ethtool",
+    "nmcli",
+    "uname",
+    "arch",
+    "nproc",
+    "getconf",
+    "getent",
+    "id",
+    "whoami",
+    "who",
+    "w",
+    "last",
+    "uptime",
+    "lsmod",
+    "modinfo",
+    "sysctl"
+  ]);
+  var _DEVNULL_REDIRECT_RE = /(?:2|&|1)?\s*>\s*\/dev\/null\b/;
+  var _WRITE_COMMAND_RES = [
+    /\brm\b/,
+    /\bunlink\b/,
+    /\brmdir\b/,
+    /\bshred\b/,
+    /\bcp\b/,
+    /\bmv\b/,
+    /\binstall\b/,
+    /\btee\b/,
+    /\bdd\b/,
+    /\bmkfs\b/,
+    /\b(fdisk|parted|cfdisk|sfdisk)\b/,
+    /\bchmod\b/,
+    /\bchown\b/,
+    /\btruncate\b/
+  ];
+  const indirectResult = checkIndirectFileAccess(actionType, actionDetail, resolvedCwd);
+  if (indirectResult) return indirectResult;
+  if (actionDetail.includes("sudo") || actionDetail.includes("su -") || actionDetail.includes("chmod u+s") || actionDetail.includes("setuid")) {
+    const adminContext = actionHistory.some(
+      (h) => h.actionDetail.includes("sudo") || h.actionDetail.includes("apt") || h.actionDetail.includes("systemctl") || h.actionDetail.includes("yum") || h.actionDetail.includes("dnf") || h.actionDetail.includes("pacman") || h.actionDetail.includes("zypper") || h.actionDetail.includes("apk")
+    );
+    if (!adminContext) {
+      return {
+        allowed: false,
+        reason: "\u68C0\u6D4B\u5230\u63D0\u6743\u64CD\u4F5C\uFF0C\u672A\u53D1\u73B0\u5408\u6CD5\u7BA1\u7406\u4E0A\u4E0B\u6587",
+        riskLevel: "high",
+        riskType: "privilege_escalation",
+        confidence: 85,
+        source: "logic_rule",
+        violatedLayers: ["2"]
+      };
+    }
+  }
+  if (/(?:ssh|scp|rsync)\s+/.test(actionDetail)) {
+    const targetHost = extractRemoteHost(actionDetail);
+    if (targetHost && !isLocalHost(targetHost)) {
+      return {
+        allowed: false,
+        reason: `\u5C1D\u8BD5\u6A2A\u5411\u79FB\u52A8\u5230\u8FDC\u7A0B\u4E3B\u673A: ${targetHost}`,
+        riskLevel: "medium",
+        riskType: "lateral_movement",
+        confidence: 80,
+        source: "logic_rule",
+        violatedLayers: ["2"]
+      };
+    }
+  }
+  const pwdResult = checkPasswordConsent(actionType, actionDetail, actionHistory);
+  if (pwdResult) return pwdResult;
+  const userDelResult = checkUserDeletionConsent(actionType, actionDetail, actionHistory);
+  if (userDelResult) return userDelResult;
+  return null;
+}
+function extractFilePaths(text) {
+  const paths = [];
+  const unixPaths = text.match(/(?:^|\s)(\/[^\s;|&><'"]+)/g);
+  if (unixPaths) paths.push(...unixPaths.map((p) => p.trim()));
+  const quotedPaths = text.match(/["']\/([^"']+)["']/g);
+  if (quotedPaths) paths.push(...quotedPaths.map((p) => p.replace(/["']/g, "")));
+  return [...new Set(paths)];
+}
+function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, cwd) {
+  if (NON_WRITE_TOOLS.has(actionType)) return null;
+  let isWrite = WRITE_KEYWORDS.some((kw) => actionType.includes(kw) || actionDetail.includes(kw));
+  if (!isWrite && actionDetail.includes(">")) {
+    const firstWord = actionDetail.split(/\s/)[0]?.toLowerCase() || "";
+    if (!READ_ONLY_REDIR_CMDS.has(firstWord)) {
+      isWrite = true;
+    }
+  }
+  if (!isWrite) return null;
+  const targetPaths = extractFilePaths(actionDetail);
+  if (targetPaths.length === 0) return null;
+  const historyReadPaths = /* @__PURE__ */ new Set();
+  for (const action of actionHistory) {
+    const histDetail = action.actionDetail.toLowerCase();
+    const histType = action.actionType.toLowerCase();
+    const isRead = READ_KEYWORDS.some((kw) => histType.includes(kw) || histDetail.includes(kw));
+    if (isRead) {
+      for (const p of extractFilePaths(histDetail)) {
+        historyReadPaths.add(p);
+      }
+    }
+  }
+  const unreadPaths = [];
+  for (const path3 of targetPaths) {
+    const hasRead = [...historyReadPaths].some(
+      (rp) => path3 === rp || path3.startsWith(rp) || rp.startsWith(path3)
+    );
+    if (!hasRead) {
+      let isCreate = !fs2.existsSync(path3);
+      if (!isCreate) {
+        isCreate = CREATE_KEYWORDS.some((kw) => reason.toLowerCase().includes(kw) || actionDetail.includes(kw));
+      }
+      if (!isCreate) {
+        unreadPaths.push(path3);
+      }
+    }
+  }
+  if (unreadPaths.length > 0) {
+    return {
+      allowed: false,
+      reason: `\u8FDD\u53CD read_before_write \u5B89\u5168\u539F\u5219\uFF1A\u5BF9\u6587\u4EF6 ${unreadPaths[0]} \u6267\u884C\u5199\u5165\u64CD\u4F5C\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5BF9\u8BE5\u6587\u4EF6\u7684\u8BFB\u53D6\u64CD\u4F5C`,
+      riskLevel: "high",
+      riskType: "read_before_write",
+      confidence: 85,
+      source: "logic_rule",
+      violatedLayers: ["2"]
+    };
+  }
+  return null;
+}
+function checkSensitivePath(command, cwd, agentExt) {
+  const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
+  const _WRITE_CMD_RES = [/\brm\b/, /\bunlink\b/, /\brmdir\b/, /\bshred\b/, /\bcp\b/, /\bmv\b/, /\binstall\b/, /\btee\b/, /\bdd\b/, /\bmkfs\b/, /\b(fdisk|parted|cfdisk|sfdisk)\b/, /\bchmod\b/, /\bchown\b/, /\btruncate\b/];
+  const _DEVNULL_RE = /(?:2|&|1)?\s*>\s*\/dev\/null\b/;
+  const _READONLY_CMDS = /* @__PURE__ */ new Set(["cat", "head", "tail", "less", "more", "grep", "find", "awk", "sed", "sort", "uniq", "wc", "cut", "strings", "od", "xxd", "hexdump", "tr", "file", "stat", "du", "df", "ls", "dir", "tree", "nl", "tac", "rev", "lsblk", "blockdev", "smartctl", "udevadm", "dmidecode", "lscpu", "lspci", "lsusb", "lsmem", "lsns", "lsof", "hwinfo", "inxi", "fdisk", "parted", "dmesg", "journalctl", "systemctl", "hostnamectl", "localectl", "timedatectl", "ps", "top", "free", "vmstat", "iostat", "mpstat", "pidof", "pgrep", "ip", "ifconfig", "route", "ss", "netstat", "arp", "ethtool", "nmcli", "uname", "arch", "nproc", "getconf", "getent", "id", "whoami", "who", "w", "last", "uptime", "lsmod", "modinfo", "sysctl"]);
+  const isWriteOpFlag = _WRITE_CMD_RES.some((rx) => rx.test(command)) || /\bsed\s+-[a-zA-Z]*i/.test(command) || command.includes(">") && !command.replace(_DEVNULL_RE, "").includes(">") || command.includes(">") && command.replace(_DEVNULL_RE, "").includes(">") && !_READONLY_CMDS.has(command.trim().split(/\s+/)[0]?.toLowerCase() || "") || WRITE_KEYWORDS.some((kw) => "".includes(kw) || command.includes(kw));
+  for (const sp of ROOT_SENSITIVE_PATHS) {
+    if (command.includes(sp.path.toLowerCase())) {
+      if (sp.path === "/dev/random") {
+        if (isWriteOpFlag) {
+          continue;
+        }
+        return {
+          allowed: false,
+          reason: `\u8BFB\u53D6\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
+          riskLevel: sp.riskLevel,
+          riskType: "sensitive_path_access",
+          confidence: 90,
+          source: "logic_rule",
+          violatedLayers: ["2"]
+        };
+      }
+      if (!isWriteOpFlag && !sp.credential) {
+        continue;
+      }
+      return {
+        allowed: false,
+        reason: `\u5C1D\u8BD5\u8BBF\u95EE\u7CFB\u7EDF\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
+        riskLevel: sp.riskLevel,
+        riskType: "sensitive_path_access",
+        confidence: 90,
+        source: "logic_rule",
+        violatedLayers: ["2"]
+      };
+    }
+  }
+  for (const sp of HOME_SENSITIVE_PATHS) {
+    const expanded = `${expandedCwd}/${sp.path}`;
+    if (command.includes(sp.path.toLowerCase()) || command.includes(expanded.toLowerCase())) {
+      if (!isWriteOpFlag && !sp.credential) {
+        continue;
+      }
+      return {
+        allowed: false,
+        reason: `\u5C1D\u8BD5\u8BBF\u95EE\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
+        riskLevel: sp.riskLevel,
+        riskType: "sensitive_path_access",
+        confidence: 90,
+        source: "logic_rule",
+        violatedLayers: ["2"]
+      };
+    }
+  }
+  if (agentExt?.extra_sensitive_paths && agentExt.extra_sensitive_paths.length > 0) {
+    for (const sp of agentExt.extra_sensitive_paths) {
+      const spPath = sp.path.toLowerCase();
+      const expanded = `${expandedCwd}/${spPath}`;
+      if (command.includes(spPath) || command.includes(expanded.toLowerCase())) {
+        const denyMode = sp.deny_mode || (sp.credential ? "deny_both" : sp.read_only ? "deny_read" : "deny_write");
+        if (denyMode === "deny_read") {
+          if (isWriteOpFlag) continue;
+        } else if (denyMode === "deny_write") {
+          if (!isWriteOpFlag) continue;
+        }
+        return {
+          allowed: false,
+          reason: `\u5C1D\u8BD5\u8BBF\u95EE agent \u4E13\u5C5E\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
+          riskLevel: sp.risk_level,
+          riskType: "sensitive_path_access",
+          confidence: 90,
+          source: "logic_rule",
+          violatedLayers: ["2"]
+        };
+      }
+    }
+  }
+  for (const cp of CREDENTIAL_PATHS) {
+    const escaped = cp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const re = cp.path.startsWith(".") ? new RegExp(`(?:^|[\\s/\\\\'"])${escaped}\\b`) : new RegExp(`\\b${escaped}\\b`);
+    if (re.test(command)) {
+      return {
+        allowed: false,
+        reason: `\u8BBF\u95EE\u654F\u611F\u8DEF\u5F84: ${cp.desc} (${cp.path})`,
+        riskLevel: cp.riskLevel,
+        riskType: "sensitive_path_access",
+        confidence: 90,
+        source: "logic_rule",
+        violatedLayers: ["2"],
+        isCredential: true
+      };
+    }
+  }
+  if ((command.includes("rm ") || command.includes("unlink")) && (command.includes("/etc/") || command.includes("/root/") || command.includes("/var/log/"))) {
+    return {
+      allowed: false,
+      reason: "\u68C0\u6D4B\u5230\u5220\u9664\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55\u5185\u5BB9",
+      riskLevel: "critical",
+      riskType: "sensitive_path_access",
+      confidence: 90,
+      source: "logic_rule",
+      violatedLayers: ["2"]
+    };
+  }
+  return null;
+}
+function extractRemoteHost(command) {
+  const m = command.match(/(?:ssh|scp|rsync)\s+(?:-[\w]+\s+)*(\S+@\S+|\b(?!-)[\w.-]+\b)/);
+  return m ? m[1] : null;
+}
+function isLocalHost(host) {
+  const localNames = ["localhost", "127.0.0.1", "::1", process.env.HOSTNAME || "", "0.0.0.0"];
+  return localNames.includes(host.replace(/.*@/, ""));
+}
+function checkPasswordConsent(actionType, actionDetail, actionHistory) {
+  if (actionType !== "bash") return null;
+  const isPasswordModify = PASSWORD_MODIFY_PATTERNS.some((p) => p.test(actionDetail));
+  if (!isPasswordModify) return null;
+  const hasConsent = actionHistory.some(
+    (h) => h.actionType.toLowerCase() === "ask_user_question" && h.actionDetail.trim().length > 0
+  );
+  if (hasConsent) return null;
+  return {
+    allowed: false,
+    reason: "\u6267\u884C\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u5BC6\u7801\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u5BC6\u7801\u4FEE\u6539\u98CE\u9669",
+    riskLevel: "high",
+    riskType: "consent_missing",
+    confidence: 85,
+    source: "logic_rule",
+    violatedLayers: ["2"]
+  };
+}
+function checkUserDeletionConsent(actionType, actionDetail, actionHistory) {
+  if (actionType !== "bash") return null;
+  const isUserDeletion = USER_DELETION_PATTERNS.some((p) => p.test(actionDetail));
+  if (!isUserDeletion) return null;
+  const hasConsent = actionHistory.some(
+    (h) => h.actionType.toLowerCase() === "ask_user_question" && h.actionDetail.trim().length > 0
+  );
+  if (hasConsent) return null;
+  return {
+    allowed: false,
+    reason: "\u6267\u884C\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u7528\u6237\u5220\u9664\u98CE\u9669",
+    riskLevel: "high",
+    riskType: "consent_missing",
+    confidence: 85,
+    source: "logic_rule",
+    violatedLayers: ["2"]
+  };
+}
+function checkIndirectFileAccess(actionType, actionDetail, cwd) {
+  if (actionType !== "bash" && actionType !== "executebash" && actionType !== "terminal-executebash") {
+    return null;
+  }
+  INLINE_SCRIPT_RE.lastIndex = 0;
+  if (!INLINE_SCRIPT_RE.test(actionDetail)) {
+    return null;
+  }
+  const lowerDetail = actionDetail.toLowerCase();
+  const hasTraversal = DIR_TRAVERSAL_KW.some((kw) => lowerDetail.includes(kw));
+  if (!hasTraversal) {
+    return null;
+  }
+  const READ_KEYWORDS2 = ["read(", "readline", "readlines", "fread", "fgets", "load(", "getpass", "file_get_contents"];
+  const WRITE_KEYWORDS2 = ["write(", "writelines", "fwrite", "file_put_contents"];
+  const EXEC_KEYWORDS = ["system(", "exec(", "eval(", "popen(", "os.system", "os.popen", "subprocess", "os.exec", "os.spawn", "shell=true", "check_output", "check_call", "run(", "passthru", "shell_exec", "proc_open"];
+  const OPEN_KEYWORDS = ["open(", "fopen("];
+  const code = extractInlineCode(actionDetail);
+  if (!code) return null;
+  const codeLower = code.toLowerCase();
+  const hasAnyOp = READ_KEYWORDS2.some((kw) => codeLower.includes(kw)) || WRITE_KEYWORDS2.some((kw) => codeLower.includes(kw)) || EXEC_KEYWORDS.some((kw) => codeLower.includes(kw)) || OPEN_KEYWORDS.some((kw) => codeLower.includes(kw));
+  if (!hasAnyOp) {
+    return null;
+  }
+  const hasWrite = WRITE_KEYWORDS2.some((kw) => codeLower.includes(kw));
+  const hasExec = EXEC_KEYWORDS.some((kw) => codeLower.includes(kw));
+  const blockAllSensitive = hasWrite || hasExec;
+  let actualFiles = [];
+  if (cwd && cwd !== "/") {
+    try {
+      actualFiles = fs2.readdirSync(cwd);
+    } catch {
+    }
+  }
+  if (actualFiles.length > 0) {
+    for (const cp of CREDENTIAL_PATHS) {
+      const fname = cp.path.split("/").pop() || cp.path;
+      if (actualFiles.some((f) => f === fname || f.toLowerCase() === fname.toLowerCase())) {
+        return {
+          allowed: false,
+          reason: `\u5185\u8054\u811A\u672C\u4F7F\u7528\u76EE\u5F55\u904D\u5386\u52A8\u6001\u53D1\u73B0\u6587\u4EF6\u5E76\u6267\u884C\u8BFB\u5199\u64CD\u4F5C\uFF0Ccwd (${cwd}) \u4E2D\u5305\u542B\u51ED\u636E\u6587\u4EF6: ${fname}`,
+          riskLevel: "high",
+          riskType: "file_access",
+          confidence: 95,
+          source: "logic_rule",
+          violatedLayers: ["2"],
+          isCredential: true
+        };
+      }
+    }
+    if (blockAllSensitive) {
+      for (const sp of [...ROOT_SENSITIVE_PATHS, ...HOME_SENSITIVE_PATHS]) {
+        const fname = sp.path.split("/").pop() || sp.path;
+        if (actualFiles.some((f) => f === fname || f.toLowerCase() === fname.toLowerCase())) {
+          return {
+            allowed: false,
+            reason: `\u5185\u8054\u811A\u672C\u4F7F\u7528\u76EE\u5F55\u904D\u5386\u52A8\u6001\u53D1\u73B0\u6587\u4EF6\u5E76\u6267\u884C\u5199\u64CD\u4F5C\uFF0Ccwd (${cwd}) \u4E2D\u5305\u542B\u654F\u611F\u6587\u4EF6: ${fname}`,
+            riskLevel: "high",
+            riskType: "file_access",
+            confidence: 95,
+            source: "logic_rule",
+            violatedLayers: ["2"]
+          };
+        }
+      }
+    }
+    return null;
+  }
+  return {
+    allowed: false,
+    reason: "\u5185\u8054\u811A\u672C\u4F7F\u7528\u76EE\u5F55\u904D\u5386\u51FD\u6570\u52A8\u6001\u53D1\u73B0\u6587\u4EF6\u5E76\u6267\u884C\u8BFB\u5199\u64CD\u4F5C\uFF0C\u65E0\u6CD5\u83B7\u53D6 cwd \u5B9E\u9645\u6587\u4EF6\u5217\u8868\uFF0C\u8F6C\u5C423 LLM \u5206\u6790",
+    riskLevel: "medium",
+    riskType: "file_access",
+    confidence: 70,
+    source: "logic_rule",
+    violatedLayers: ["2"]
+  };
+}
+var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, READ_ONLY_REDIR_CMDS, WRITE_KEYWORDS, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
+var init_logic_rules = __esm({
+  "src/engine/logic-rules.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_inline_analyzer();
+    init_agents();
+    ROOT_SENSITIVE_PATHS = [
+      { path: "/etc/shadow", riskLevel: "critical", desc: "\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6", credential: true },
+      { path: "/etc/gshadow", riskLevel: "critical", desc: "\u7CFB\u7EDF\u7EC4\u5BC6\u7801\u6587\u4EF6", credential: true },
+      // 注意：/etc/passwd 仅从 L1 启发式规则移除（公开可读），L2 敏感路径仍保留
+      { path: "/etc/passwd", riskLevel: "high", desc: "\u7CFB\u7EDF\u7528\u6237\u6587\u4EF6" },
+      { path: "/etc/sudoers", riskLevel: "critical", desc: "sudo \u914D\u7F6E", credential: true },
+      // 系统配置（仅拦截写入）
+      { path: "/etc/hosts", riskLevel: "medium", desc: "DNS \u89E3\u6790\u914D\u7F6E" },
+      { path: "/etc/crontab", riskLevel: "high", desc: "\u7CFB\u7EDF\u5B9A\u65F6\u4EFB\u52A1" },
+      { path: "/etc/cron.d/", riskLevel: "high", desc: "\u7CFB\u7EDF\u5B9A\u65F6\u4EFB\u52A1\u76EE\u5F55\uFF08\u62C6\u5206\u5F0F crontab\uFF09" },
+      { path: "/var/spool/cron/", riskLevel: "high", desc: "\u7528\u6237\u7EA7\u5B9A\u65F6\u4EFB\u52A1\u76EE\u5F55" },
+      { path: "/etc/systemd/", riskLevel: "high", desc: "systemd \u670D\u52A1\u914D\u7F6E" },
+      { path: "/etc/ssh/sshd_config", riskLevel: "high", desc: "SSH \u670D\u52A1\u914D\u7F6E" },
+      { path: "/etc/pam.d/", riskLevel: "high", desc: "PAM \u53EF\u63D2\u62D4\u8BA4\u8BC1\u6A21\u5757\u914D\u7F6E" },
+      // 危险目录（仅拦截写入）
+      { path: "/boot/", riskLevel: "critical", desc: "\u542F\u52A8\u5F15\u5BFC\u76EE\u5F55" },
+      { path: "/proc/sys/", riskLevel: "high", desc: "\u5185\u6838\u53C2\u6570" },
+      { path: "/sys/", riskLevel: "high", desc: "sysfs \u5185\u6838\u63A5\u53E3" },
+      // 设备文件（/dev/null、/dev/zero、/dev/urandom 已移除，误报率极高）
+      { path: "/dev/random", riskLevel: "high", desc: "\u963B\u585E\u5F0F\u968F\u673A\u6570\u8BBE\u5907\uFF08\u8BFB\u53D6\u8017\u5C3D\u71B5\u6C60\uFF09" },
+      { path: "/dev/mem", riskLevel: "critical", desc: "\u7269\u7406\u5185\u5B58\u8BBF\u95EE\u8BBE\u5907" },
+      { path: "/dev/kmsg", riskLevel: "high", desc: "\u5185\u6838\u6D88\u606F\u7F13\u51B2\u533A" },
+      // SSH 主机私钥
+      { path: "/etc/ssh/ssh_host_rsa_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A RSA \u79C1\u94A5", credential: true },
+      { path: "/etc/ssh/ssh_host_ed25519_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A Ed25519 \u79C1\u94A5", credential: true },
+      { path: "/etc/ssh/ssh_host_ecdsa_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A ECDSA \u79C1\u94A5", credential: true }
+    ];
+    HOME_SENSITIVE_PATHS = [
+      { path: ".ssh/id_rsa", riskLevel: "critical", desc: "SSH \u79C1\u94A5", credential: true },
+      { path: ".ssh/id_ed25519", riskLevel: "critical", desc: "SSH \u79C1\u94A5 (ed25519)", credential: true },
+      { path: ".ssh/authorized_keys", riskLevel: "high", desc: "SSH \u6388\u6743\u5BC6\u94A5" },
+      // 持久化与命令劫持（仅拦截写入）
+      { path: ".bashrc", riskLevel: "high", desc: "\u7528\u6237 Shell \u521D\u59CB\u5316\u811A\u672C" },
+      { path: ".bash_profile", riskLevel: "high", desc: "\u7528\u6237 Shell \u767B\u5F55\u811A\u672C" },
+      { path: ".profile", riskLevel: "high", desc: "\u7528\u6237\u901A\u7528\u767B\u5F55\u811A\u672C" },
+      { path: ".aws/credentials", riskLevel: "critical", desc: "AWS \u51ED\u8BC1", credential: true },
+      { path: ".gitconfig", riskLevel: "medium", desc: "Git \u914D\u7F6E" },
+      { path: ".gnupg", riskLevel: "high", desc: "GPG \u5BC6\u94A5\u76EE\u5F55" }
+    ];
+    CREDENTIAL_PATHS = [
+      { path: "credentials.yml", riskLevel: "high", desc: "\u51ED\u636E\u914D\u7F6E\u6587\u4EF6" },
+      { path: "credentials.yaml", riskLevel: "high", desc: "\u51ED\u636E\u914D\u7F6E\u6587\u4EF6" },
+      { path: "secrets.yml", riskLevel: "high", desc: "\u5BC6\u94A5\u914D\u7F6E\u6587\u4EF6" },
+      { path: "secrets.yaml", riskLevel: "high", desc: "\u5BC6\u94A5\u914D\u7F6E\u6587\u4EF6" },
+      { path: ".env", riskLevel: "high", desc: "\u73AF\u5883\u53D8\u91CF/\u51ED\u636E\u914D\u7F6E\u6587\u4EF6" }
+    ];
+    NON_WRITE_TOOLS = /* @__PURE__ */ new Set(["ask_user_question", "glob", "grep", "list_dir", "count_text_length", "search"]);
+    READ_ONLY_REDIR_CMDS = /* @__PURE__ */ new Set(["cat", "head", "tail", "less", "more", "grep", "find", "awk", "sed", "sort", "uniq", "wc", "cut", "strings", "od", "xxd", "hexdump"]);
+    WRITE_KEYWORDS = ["write", "\u5199\u5165", "save", "\u4FDD\u5B58", "modify", "\u4FEE\u6539", "update", "\u66F4\u65B0", "delete", "\u5220\u9664", "remove", "\u79FB\u9664", "create", "\u521B\u5EFA", "append", "\u8FFD\u52A0", "truncate", "\u622A\u65AD", "overwrite", "\u8986\u76D6", "replace", "\u66FF\u6362"];
+    READ_KEYWORDS = ["read", "\u8BFB\u53D6", "cat", "head", "tail", "less", "more", "view", "\u67E5\u770B", "open", "\u6253\u5F00", "load", "\u52A0\u8F7D", "grep", "search", "\u641C\u7D22", "find", "\u67E5\u627E"];
+    CREATE_KEYWORDS = ["\u521B\u5EFA", "\u65B0\u5EFA", "create", "new file", "touch"];
+    PASSWORD_MODIFY_PATTERNS = [
+      /\|\s*passwd\b/i,
+      /\bpasswd\s+--stdin\b/i,
+      /\bchpasswd\b/i,
+      /\bchgpasswd\b/i,
+      /\b(newusers|lnewusers)\b/i,
+      /\bpasswd\s+-[a-zA-Z]*d\b/i,
+      /\bpasswd\s+-[a-zA-Z]*l\b/i
+    ];
+    USER_DELETION_PATTERNS = [
+      /\buserdel\s/i,
+      /\bdeluser\s/i,
+      /\bluserdel\s/i,
+      /\bgroupdel\s/i,
+      /\blgroupdel\s/i
+    ];
+    INTENT_DEVIATION_PATTERNS = [
+      {
+        intentKeywords: ["\u8BFB\u53D6", "\u67E5\u770B", "\u5206\u6790", "read", "analyze", "view", "list", "\u5217\u51FA"],
+        dangerousActions: ["\u5220\u9664", "remove", "delete", "rm ", "\u683C\u5F0F\u5316", "format"],
+        reason: "\u539F\u59CB\u610F\u56FE\u4E3A\u8BFB\u53D6/\u5206\u6790\uFF0C\u4F46\u6267\u884C\u4E86\u5220\u9664\u64CD\u4F5C"
+      },
+      {
+        intentKeywords: ["\u67E5\u8BE2", "\u641C\u7D22", "search", "query", "find"],
+        dangerousActions: ["\u4FEE\u6539", "update", "write", "\u5199\u5165", "alter"],
+        reason: "\u539F\u59CB\u610F\u56FE\u4E3A\u67E5\u8BE2/\u641C\u7D22\uFF0C\u4F46\u6267\u884C\u4E86\u4FEE\u6539\u64CD\u4F5C"
+      }
+    ];
+    INLINE_SCRIPT_RE = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
+    DIR_TRAVERSAL_KW = [
+      "os.listdir",
+      "os.walk",
+      "os.scandir",
+      "glob.glob",
+      "glob.iglob",
+      "pathlib.",
+      "iterdir",
+      "rglob",
+      "scandir(",
+      "listdir("
+    ];
+  }
+});
+
+// src/engine/skill-loader.ts
+import { readFileSync as readFileSync2, readdirSync as readdirSync2, existsSync as existsSync3 } from "fs";
+import { resolve as resolve2, dirname as dirname2 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
+function loadAllSkills() {
+  if (cachedSkills) return cachedSkills;
+  cachedSkills = {};
+  const dir = existsSync3(SKILLS_DIR) ? SKILLS_DIR : SKILLS_DIR_FALLBACK;
+  if (!existsSync3(dir)) {
+    console.warn("[AgentMoss] Skills directory not found:", SKILLS_DIR, "and fallback:", SKILLS_DIR_FALLBACK);
+    return cachedSkills;
+  }
+  const files = readdirSync2(dir).filter((f) => f.endsWith(".md"));
+  for (const f of files) {
+    const name = f.replace(".md", "");
+    cachedSkills[name] = readFileSync2(resolve2(dir, f), "utf-8");
+  }
+  console.log(`[AgentMoss] Loaded ${Object.keys(cachedSkills).length} skills from ${dir}`);
+  return cachedSkills;
+}
+function matchSkills(actionType, actionDetail, reason, maxSkills = 3) {
+  const skills = loadAllSkills();
+  const combined = `${actionType} ${actionDetail} ${reason}`.toLowerCase();
+  const actionDetailLower = actionDetail.toLowerCase();
+  const actionTypeLower = actionType.toLowerCase();
+  const reasonLower = reason.toLowerCase();
+  const scores = {};
+  for (const [skillName, keywords] of Object.entries(SKILL_KEYWORD_MAP)) {
+    let score = 0;
+    for (const kw of keywords) {
+      if (combined.includes(kw)) {
+        if (kw === actionTypeLower) score += 2;
+        else if (actionDetailLower.includes(kw)) score += 1.5;
+        else if (reasonLower.includes(kw)) score += 1;
+        else score += 0.5;
+      }
+    }
+    if (score > 0) scores[skillName] = score;
+  }
+  const sorted = Object.entries(scores).sort((a, b) => b[1] - a[1]);
+  const top = sorted.slice(0, maxSkills);
+  const maxScore = top[0]?.[1] || 1;
+  const results = [];
+  for (const [name, score] of top) {
+    const content = skills[name];
+    if (content) {
+      results.push({
+        skillName: name,
+        relevance: Math.min(score / maxScore, 1),
+        skillContent: content
+      });
+    }
+  }
+  if (results.length === 0) {
+    const fallback = skills["general_tool_risk_guard"];
+    if (fallback) {
+      results.push({ skillName: "general_tool_risk_guard", relevance: 0.3, skillContent: fallback });
+    }
+  }
+  return results;
+}
+function formatSkillsForPrompt(skills) {
+  if (skills.length === 0) return "(\u672A\u5339\u914D\u5230\u7279\u5B9A\u5B89\u5168\u68C0\u6D4B\u89C4\u5219)";
+  return skills.map(
+    (s) => `### \u5B89\u5168\u68C0\u6D4B\u89C4\u5219: ${s.skillName} (\u76F8\u5173\u5EA6: ${Math.round(s.relevance * 100)}%)
+
+${s.skillContent}`
+  ).join("\n\n---\n\n");
+}
+var __filename3, __dirname3, SKILLS_DIR, SKILLS_DIR_FALLBACK, SKILL_KEYWORD_MAP, cachedSkills;
+var init_skill_loader = __esm({
+  "src/engine/skill-loader.ts"() {
+    "use strict";
+    init_esm_shims();
+    __filename3 = fileURLToPath3(import.meta.url);
+    __dirname3 = dirname2(__filename3);
+    SKILLS_DIR = resolve2(__dirname3, "../skills");
+    SKILLS_DIR_FALLBACK = resolve2(__dirname3, "../../../agent_moss/skills");
+    SKILL_KEYWORD_MAP = {
+      "file_access_guard": ["file", "\u6587\u4EF6", "path", "\u8DEF\u5F84", "read", "write", "cat", "open", "access", "\u8BBF\u95EE", "\u8BFB\u5199", "copy", "cp", "mv", "move"],
+      "script_execution_guard": ["command", "shell", "bash", "exec", "execute", "\u6267\u884C", "\u547D\u4EE4", "script", "\u811A\u672C", "run", "\u8FD0\u884C", "subprocess", "system", "eval", "compile", "\u5B89\u88C5", "install", "pip", "npm"],
+      "data_exfiltration_guard": ["upload", "\u4E0A\u4F20", "send", "\u53D1\u9001", "transfer", "\u4F20\u8F93", "export", "\u5BFC\u51FA", "download", "\u4E0B\u8F7D", "post", "http", "request", "fetch", "curl", "wget", "\u5916\u4F20", "\u6CC4\u9732", "exfil", "network", "\u7F51\u7EDC"],
+      "browser_web_access_guard": ["browser", "\u6D4F\u89C8\u5668", "web", "\u7F51\u9875", "url", "navigate", "\u6D4F\u89C8", "scrape", "crawl", "\u722C\u53D6", "click", "screenshot"],
+      "email_operation_guard": ["email", "\u90AE\u4EF6", "mail", "smtp", "send_email", "\u53D1\u9001\u90AE\u4EF6", "inbox", "\u6536\u4EF6\u7BB1", "\u9644\u4EF6", "attachment"],
+      "general_tool_risk_guard": ["tool", "\u5DE5\u5177", "api", "invoke", "\u8C03\u7528", "function", "\u51FD\u6570"],
+      "lateral_movement_guard": ["ssh", "scp", "ftp", "sftp", "rdp", "vnc", "telnet", "\u5185\u7F51", "\u6A2A\u5411", "tunnel", "\u4EE3\u7406", "proxy", "port", "\u7AEF\u53E3", "scan", "\u626B\u63CF", "ping", "traceroute", "nslookup"],
+      "persistence_backdoor_guard": ["cron", "crontab", "\u5B9A\u65F6", "scheduled", "startup", "\u542F\u52A8\u9879", "service", "\u670D\u52A1", "daemon", "\u5B88\u62A4", "registry", "\u6CE8\u518C\u8868", "backdoor", "\u540E\u95E8", "persist", "\u6301\u4E45\u5316", "authorized_keys", "bashrc", "zshrc", "profile", ".rc", "shell config", "shell \u914D\u7F6E"],
+      // 注意：避免裸 'memory'/'内存'/'dd'——会误命中 memory-addMemory（写记忆工具，
+      // 'dd' 是 'addMemory' 的子串）等无害操作。用组合词/命令前缀精准匹配攻击场景。
+      "resource_exhaustion_guard": ["fork", "bomb", "\u70B8\u5F39", "memory bomb", "oom", "out of memory", "\u5185\u5B58\u6EA2\u51FA", "\u5185\u5B58\u8017\u5C3D", "\u5185\u5B58\u6CC4\u6F0F", "disk", "\u78C1\u76D8", "cpu", "process", "\u8FDB\u7A0B", "dd if=", "/dev/zero", "/dev/null", "yes >", "while true", "\u65E0\u9650\u5FAA\u73AF", "\u8017\u5C3D", "exhaust", "\u8D44\u6E90"],
+      "skill_installation_guard": ["skill", "plugin", "\u63D2\u4EF6", "extension", "\u6269\u5C55", "install skill", "\u5B89\u88C5\u63D2\u4EF6", "\u5B89\u88C5\u6280\u80FD", "marketplace", "\u5546\u5E97"],
+      "supply_chain_guard": ["dependency", "\u4F9D\u8D56", "package", "\u5305", "npm install", "pip install", "requirements", "import", "library", "\u5E93", "registry", "\u4ED3\u5E93", "supply", "\u4F9B\u5E94\u94FE", "typosquatting"],
+      "intent_deviation_guard": ["rm", "del", "delete", "remove", "\u5220\u9664", "format", "\u683C\u5F0F\u5316", "drop", "truncate", "\u6E05\u7A7A", "wipe", "\u64E6\u9664", "\u91CD\u7F6E", "reset", "sudo", "root", "admin", "\u7BA1\u7406\u5458", "privilege", "\u63D0\u6743"],
+      "indirect_access_guard": ["listdir", "os.walk", "os.scandir", "glob.glob", "glob.iglob", "pathlib", "iterdir", "rglob", "scandir", "os.listdir", "\u76EE\u5F55\u904D\u5386", "traversal"]
+    };
+    cachedSkills = null;
+  }
+});
+
+// src/engine/token-stats.ts
+var token_stats_exports = {};
+__export(token_stats_exports, {
+  getRecentRecords: () => getRecentRecords,
+  getTokenStats: () => getTokenStats,
+  getTokenTrend: () => getTokenTrend,
+  recordTokenUsage: () => recordTokenUsage,
+  resetTokenStats: () => resetTokenStats
+});
+import { readFileSync as readFileSync6, writeFileSync, existsSync as existsSync6, mkdirSync, unlinkSync } from "fs";
+import { join as join3 } from "path";
+import { homedir as homedir2 } from "os";
+function getStatsPath() {
+  const envPath = process.env[ENV_STATS_PATH];
+  return envPath || STATS_FILE;
+}
+function loadAllRecords(statsPath) {
+  if (!existsSync6(statsPath)) return [];
+  try {
+    const data = JSON.parse(readFileSync6(statsPath, "utf-8"));
+    if (Array.isArray(data)) return data;
+    if (data && Array.isArray(data.records)) return data.records;
+    return [];
+  } catch (e) {
+    return [];
+  }
+}
+function saveRecords(statsPath, records) {
+  try {
+    const dir = statsPath.substring(0, statsPath.lastIndexOf("/"));
+    if (dir && !existsSync6(dir)) mkdirSync(dir, { recursive: true });
+    writeFileSync(statsPath, JSON.stringify(records, null, 2), "utf-8");
+  } catch (e) {
+  }
+}
+function recordTokenUsage(record) {
+  const statsPath = getStatsPath();
+  const records = loadAllRecords(statsPath);
+  records.push({
+    timestamp: record.timestamp || (/* @__PURE__ */ new Date()).toISOString(),
+    session_id: record.sessionId,
+    step: record.step,
+    model: record.model,
+    prompt_tokens: record.promptTokens,
+    completion_tokens: record.completionTokens,
+    total_tokens: record.totalTokens
+  });
+  if (records.length > MAX_RECORDS) {
+    records.splice(0, records.length - MAX_RECORDS);
+  }
+  saveRecords(statsPath, records);
+}
+function filterByDate(records, days = 0, startDate, endDate) {
+  if (startDate || endDate) {
+    let startDt = startDate ? new Date(startDate) : /* @__PURE__ */ new Date(-864e13);
+    let endDt = endDate ? new Date(endDate) : void 0;
+    if (endDate) {
+      const e = new Date(endDate);
+      e.setHours(23, 59, 59, 999);
+      endDt = e;
+    }
+    const endMs = endDt ? endDt.getTime() : Number.MAX_SAFE_INTEGER;
+    return records.filter((r) => {
+      try {
+        const ts = new Date(r.timestamp).getTime();
+        return ts >= startDt.getTime() && ts <= endMs;
+      } catch {
+        return true;
+      }
+    });
+  } else if (days > 0) {
+    const cutoff = Date.now() - days * 864e5;
+    return records.filter((r) => {
+      try {
+        return new Date(r.timestamp).getTime() >= cutoff;
+      } catch {
+        return true;
+      }
+    });
+  }
+  return records;
+}
+function aggregate(records) {
+  let totalPrompt = 0, totalCompletion = 0, totalTotal = 0;
+  const byStep = {};
+  const byModel = {};
+  const byDate = {};
+  const bucket = (b, key, r) => {
+    const e = b[key] || (b[key] = { prompt_tokens: 0, completion_tokens: 0, total_tokens: 0, calls: 0 });
+    e.prompt_tokens += r.prompt_tokens || 0;
+    e.completion_tokens += r.completion_tokens || 0;
+    e.total_tokens += r.total_tokens || 0;
+    e.calls += 1;
+  };
+  for (const r of records) {
+    totalPrompt += r.prompt_tokens || 0;
+    totalCompletion += r.completion_tokens || 0;
+    totalTotal += r.total_tokens || 0;
+    bucket(byStep, r.step || "unknown", r);
+    bucket(byModel, r.model || "unknown", r);
+    let dateKey = "unknown";
+    try {
+      dateKey = new Date(r.timestamp).toISOString().slice(0, 10);
+    } catch {
+    }
+    bucket(byDate, dateKey, r);
+  }
+  const sortedDate = Object.keys(byDate).sort((a, b) => a < b ? 1 : a > b ? -1 : 0);
+  const sortedByDate = {};
+  for (const k of sortedDate) sortedByDate[k] = byDate[k];
+  return { totalPrompt, totalCompletion, totalTotal, byStep, byModel, byDate: sortedByDate };
+}
+function getTokenStats(days = 0, startDate, endDate) {
+  const records = filterByDate(loadAllRecords(getStatsPath()), days, startDate, endDate);
+  const a = aggregate(records);
+  return {
+    total_prompt_tokens: a.totalPrompt,
+    total_completion_tokens: a.totalCompletion,
+    total_tokens: a.totalTotal,
+    total_calls: records.length,
+    by_step: a.byStep,
+    by_model: a.byModel,
+    by_date: a.byDate
+  };
+}
+function getRecentRecords(limit = 20) {
+  const records = loadAllRecords(getStatsPath());
+  return records.slice(-limit);
+}
+function getTokenTrend(days = 0, startDate, endDate) {
+  const records = filterByDate(loadAllRecords(getStatsPath()), days, startDate, endDate);
+  const series = {};
+  const datesSet = /* @__PURE__ */ new Set();
+  for (const r of records) {
+    let dateKey;
+    try {
+      dateKey = new Date(r.timestamp).toISOString().slice(0, 10);
+    } catch {
+      continue;
+    }
+    const model = r.model || "unknown";
+    const tokens = r.total_tokens || 0;
+    datesSet.add(dateKey);
+    series[model] = series[model] || {};
+    series[model][dateKey] = (series[model][dateKey] || 0) + tokens;
+  }
+  const dates = Array.from(datesSet).sort();
+  const models = Object.keys(series).sort();
+  return { dates, models, series };
+}
+function resetTokenStats() {
+  const statsPath = getStatsPath();
+  if (existsSync6(statsPath)) {
+    try {
+      unlinkSync(statsPath);
+    } catch {
+    }
+  }
+}
+var STATS_DIR, STATS_FILE, ENV_STATS_PATH, MAX_RECORDS;
+var init_token_stats = __esm({
+  "src/engine/token-stats.ts"() {
+    "use strict";
+    init_esm_shims();
+    STATS_DIR = join3(homedir2(), ".config", "agentmoss");
+    STATS_FILE = join3(STATS_DIR, "agent_moss_token_stats.json");
+    ENV_STATS_PATH = "AGENT_MOSS_TOKEN_STATS_PATH";
+    MAX_RECORDS = 1e4;
+  }
+});
+
+// src/infra/runtime-config.ts
+var runtime_config_exports = {};
+__export(runtime_config_exports, {
+  DENY_MODE_LABELS: () => DENY_MODE_LABELS,
+  addCustomRule: () => addCustomRule,
+  addCustomSkill: () => addCustomSkill,
+  deleteCustomRule: () => deleteCustomRule,
+  deleteCustomSkill: () => deleteCustomSkill,
+  filterEnabledRules: () => filterEnabledRules,
+  generateSourceDefaults: () => generateSourceDefaults,
+  getDisabledL2RulesWithSkipL3: () => getDisabledL2RulesWithSkipL3,
+  getDisabledSkillIds: () => getDisabledSkillIds,
+  getEnabledL1CommandPatterns: () => getEnabledL1CommandPatterns,
+  getEnabledL1CommandPatternsOrDefault: () => getEnabledL1CommandPatternsOrDefault,
+  getEnabledL1InjectionKeywords: () => getEnabledL1InjectionKeywords,
+  getEnabledL1InjectionKeywordsOrDefault: () => getEnabledL1InjectionKeywordsOrDefault,
+  getEnabledL2IntentPatterns: () => getEnabledL2IntentPatterns,
+  getEnabledL2IntentPatternsOrDefault: () => getEnabledL2IntentPatternsOrDefault,
+  getEnabledL2PasswordPatterns: () => getEnabledL2PasswordPatterns,
+  getEnabledL2PasswordPatternsOrDefault: () => getEnabledL2PasswordPatternsOrDefault,
+  getEnabledL2SensitivePaths: () => getEnabledL2SensitivePaths,
+  getEnabledL2SensitivePathsOrDefault: () => getEnabledL2SensitivePathsOrDefault,
+  getEnabledL2UserDeletionPatterns: () => getEnabledL2UserDeletionPatterns,
+  getEnabledL2UserDeletionPatternsOrDefault: () => getEnabledL2UserDeletionPatternsOrDefault,
+  getEnvOverrides: () => getEnvOverrides,
+  getProfileOrDetect: () => getProfileOrDetect,
+  getRuntimeConfigPath: () => getRuntimeConfigPath,
+  hasRuntimeConfig: () => hasRuntimeConfig,
+  isL2CategoryEnabled: () => isL2CategoryEnabled,
+  isLayerEnabled: () => isLayerEnabled,
+  loadRuntimeConfig: () => loadRuntimeConfig,
+  mergeConfig: () => mergeConfig,
+  saveRuntimeConfig: () => saveRuntimeConfig,
+  updateCategoryEnabled: () => updateCategoryEnabled,
+  updateLayerEnabled: () => updateLayerEnabled,
+  updateRuleDenyMode: () => updateRuleDenyMode,
+  updateRuleEnabled: () => updateRuleEnabled,
+  updateRuleSkipL3: () => updateRuleSkipL3,
+  updateSkillCategoryEnabled: () => updateSkillCategoryEnabled,
+  updateSkillEnabled: () => updateSkillEnabled
+});
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync2, existsSync as existsSync7, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2 } from "fs";
+import { join as join4 } from "path";
+import { homedir as homedir3 } from "os";
+function getRuntimeConfigPath() {
+  const envPath = process.env[ENV_RUNTIME_CONFIG_PATH];
+  if (envPath) return envPath;
+  return RUNTIME_CONFIG_PATH;
+}
+function saveRuntimeConfig(config) {
+  const p = getRuntimeConfigPath();
+  const dir = p.substring(0, p.lastIndexOf("/"));
+  if (dir && !existsSync7(dir)) mkdirSync2(dir, { recursive: true });
+  writeFileSync2(p, JSON.stringify(config, null, 2), "utf-8");
+}
+function emptyRuntimeConfig() {
+  return {
+    version: 1,
+    layers: { L1_heuristic: true, L2_logic_rules: true, L3_llm_analysis: true },
+    L1_rules: {},
+    L2_rules: {},
+    L3_skills: {}
+  };
+}
+function loadRuntimeConfig() {
+  const p = getRuntimeConfigPath();
+  if (!existsSync7(p)) {
+    const seeded = mergeConfig({}, generateSourceDefaults());
+    try {
+      saveRuntimeConfig(seeded);
+    } catch {
+    }
+    return seeded;
+  }
+  try {
+    const data = JSON.parse(readFileSync7(p, "utf-8"));
+    const merged = mergeConfig(data, generateSourceDefaults());
+    return {
+      version: data.version || 1,
+      layers: {
+        L1_heuristic: data.layers?.L1_heuristic ?? true,
+        L2_logic_rules: data.layers?.L2_logic_rules ?? true,
+        L3_llm_analysis: data.layers?.L3_llm_analysis ?? true
+      },
+      L1_rules: merged.L1_rules || {},
+      L2_rules: merged.L2_rules || {},
+      L3_skills: merged.L3_skills || {}
+    };
+  } catch {
+    return emptyRuntimeConfig();
+  }
+}
+function isLayerEnabled(layerKey) {
+  const disableKey = LAYER_DISABLE_ENV[layerKey];
+  if (disableKey && process.env[disableKey] === "1") return false;
+  const runtime = loadRuntimeConfig();
+  const layers = runtime.layers || {};
+  if (layerKey in layers) return !!layers[layerKey];
+  return true;
+}
+function getEnvOverrides() {
+  const overrides = {};
+  for (const [layerKey, envKey] of Object.entries(LAYER_DISABLE_ENV)) {
+    const val = process.env[envKey];
+    if (val !== void 0) {
+      overrides[layerKey] = {
+        env_var: envKey,
+        env_value: val,
+        overridden: val === "1",
+        effect: val === "1" ? "disabled" : "no_override"
+      };
+    }
+  }
+  return overrides;
+}
+function filterEnabledRules(rules, categoryEnabled = true) {
+  if (!categoryEnabled) return [];
+  return rules.filter((r) => r.enabled !== false);
+}
+function getEnabledL1CommandPatterns(runtime) {
+  const cat = runtime.L1_rules?.dangerous_commands || { category_enabled: true, rules: [] };
+  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => ({
+    pattern: r.pattern || "",
+    risk_level: r.risk_level || "",
+    risk_type: r.risk_type || "",
+    reason: r.reason || ""
+  }));
+}
+function getEnabledL2SensitivePaths(runtime) {
+  const cat = runtime.L2_rules?.sensitive_path_access || { category_enabled: true, rules: [] };
+  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => {
+    const out = { path: r.path || "", risk_level: r.risk_level || "", desc: r.desc || "", deny_mode: r.deny_mode || "deny_write" };
+    if (r.credential) out.credential = true;
+    if (r.read_only) out.read_only = true;
+    return out;
+  });
+}
+function hasRuntimeConfig() {
+  const p = getRuntimeConfigPath();
+  if (!existsSync7(p)) return false;
+  try {
+    JSON.parse(readFileSync7(p, "utf-8"));
+    return true;
+  } catch {
+    return false;
+  }
+}
+function getDisabledL2RulesWithSkipL3() {
+  let runtime;
+  try {
+    runtime = loadRuntimeConfig();
+  } catch {
+    return {};
+  }
+  const result = {};
+  const l2 = runtime.L2_rules || {};
+  for (const [catName, cat] of Object.entries(l2)) {
+    if (!cat.category_enabled) continue;
+    const items = [];
+    for (const r of cat.rules || []) {
+      if (r.enabled === false && r.skip_l3_on_disabled) {
+        if (catName === "sensitive_path_access") {
+          if (r.path) items.push(r.path);
+        } else if (catName === "intent_consistency") {
+          items.push(...r.intent_keywords || []);
+        } else if (r.pattern) {
+          items.push(r.pattern);
+        }
+      }
+    }
+    if (items.length > 0) result[catName] = items;
+  }
+  return result;
+}
+function _slugify(text) {
+  return text.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_|_$/g, "") || "x";
+}
+function _generatePatternId(pattern) {
+  return `pat_${_slugify(pattern)}`;
+}
+function _deriveDenyMode(rule) {
+  if (rule.deny_mode) return rule.deny_mode;
+  if (rule.credential) return "deny_both";
+  if (rule.read_only) return "deny_read";
+  return "deny_write";
+}
+function _syncDenyModeFields(rule) {
+  const dm = rule.deny_mode || "deny_write";
+  if (dm === "deny_both") {
+    rule.credential = true;
+    delete rule.read_only;
+  } else if (dm === "deny_read") {
+    delete rule.credential;
+    rule.read_only = true;
+  } else {
+    delete rule.credential;
+    delete rule.read_only;
+  }
+}
+function _l1CommandPatternsToRules() {
+  return DANGEROUS_PATTERNS.map((p) => ({
+    id: _generatePatternId(p.pattern instanceof RegExp ? p.pattern.source : p.pattern),
+    pattern: p.pattern instanceof RegExp ? p.pattern.source : p.pattern,
+    risk_level: p.severity,
+    risk_type: p.riskType,
+    reason: p.description,
+    enabled: true,
+    builtin: true
+  }));
+}
+function _l1InjectionKeywordsToRules() {
+  return INJECTION_KEYWORDS.map((kw) => ({
+    id: `inj_${_slugify(kw.keyword)}`,
+    keyword: kw.keyword,
+    risk_level: kw.riskLevel,
+    lang: kw.lang || "en",
+    enabled: true,
+    builtin: true
+  }));
+}
+function _l2SensitivePathsToRules() {
+  const all = [...ROOT_SENSITIVE_PATHS, ...HOME_SENSITIVE_PATHS, ...CREDENTIAL_PATHS];
+  return all.map((sp) => {
+    const denyMode = _deriveDenyMode({
+      deny_mode: sp.deny_mode,
+      credential: sp.credential,
+      read_only: sp.read_only
+    });
+    const rule = {
+      id: `path_${_slugify(sp.path)}`,
+      path: sp.path,
+      risk_level: sp.riskLevel,
+      desc: sp.desc,
+      deny_mode: denyMode,
+      source_deny_mode: denyMode,
+      skip_l3_on_disabled: true,
+      enabled: true,
+      builtin: true
+    };
+    _syncDenyModeFields(rule);
+    return rule;
+  });
+}
+function _l2IntentPatternsToRules() {
+  return INTENT_DEVIATION_PATTERNS.map((pat, i) => ({
+    id: `intent_${i + 1}_${_slugify(pat.reason.slice(0, 30))}`,
+    intent_keywords: pat.intentKeywords,
+    dangerous_actions: pat.dangerousActions,
+    reason: pat.reason,
+    skip_l3_on_disabled: true,
+    enabled: true,
+    builtin: true
+  }));
+}
+function _l2PasswordPatternsToRules() {
+  return PASSWORD_MODIFY_PATTERNS.map((p) => ({
+    id: `pw_${_slugify(p.source)}`,
+    pattern: p.source,
+    skip_l3_on_disabled: true,
+    enabled: true,
+    builtin: true
+  }));
+}
+function _l2UserDeletionPatternsToRules() {
+  return USER_DELETION_PATTERNS.map((p) => ({
+    id: `ud_${_slugify(p.source)}`,
+    pattern: p.source,
+    skip_l3_on_disabled: true,
+    enabled: true,
+    builtin: true
+  }));
+}
+function _l3SkillsToRules() {
+  const skillCategories = {
+    file_operations: ["file_access_guard", "script_execution_guard", "indirect_access_guard"],
+    network_security: [
+      "data_exfiltration_guard",
+      "browser_web_access_guard",
+      "lateral_movement_guard",
+      "email_operation_guard"
+    ],
+    persistence_supply_chain: [
+      "persistence_backdoor_guard",
+      "supply_chain_guard",
+      "skill_installation_guard"
+    ],
+    intent_and_general: ["intent_deviation_guard", "general_tool_risk_guard"],
+    resource: ["resource_exhaustion_guard"]
+  };
+  const out = {};
+  for (const [cat, ids] of Object.entries(skillCategories)) {
+    out[cat] = {
+      category_enabled: true,
+      category_desc: "",
+      skills: ids.map((s) => ({
+        id: s,
+        keywords: SKILL_KEYWORD_MAP[s] || [],
+        enabled: true,
+        builtin: true
+      }))
+    };
+  }
+  const categorized = new Set(Object.values(skillCategories).flat());
+  for (const s of Object.keys(SKILL_KEYWORD_MAP)) {
+    if (!categorized.has(s)) {
+      (out.intent_and_general ??= { category_enabled: true, category_desc: "", skills: [] }).skills.push({
+        id: s,
+        keywords: SKILL_KEYWORD_MAP[s],
+        enabled: true,
+        builtin: true
+      });
+    }
+  }
+  out.user_custom = { category_enabled: true, category_desc: "", skills: [] };
+  return out;
+}
+function generateSourceDefaults() {
+  return {
+    version: 1,
+    layers: { L1_heuristic: true, L2_logic_rules: true, L3_llm_analysis: true },
+    L1_rules: {
+      dangerous_commands: {
+        category_enabled: true,
+        category_desc: "\u5371\u9669\u547D\u4EE4\u68C0\u6D4B\uFF08\u9012\u5F52\u5220\u9664\u3001\u5168\u6743\u9650\u8BBE\u7F6E\u3001\u63D0\u6743\u6267\u884C\u7B49\uFF09",
+        rules: _l1CommandPatternsToRules()
+      },
+      injection_detection: {
+        category_enabled: true,
+        category_desc: "Prompt \u6CE8\u5165\u653B\u51FB\u68C0\u6D4B",
+        rules: _l1InjectionKeywordsToRules()
+      },
+      user_sensitive_actions: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49\u654F\u611F\u52A8\u4F5C/\u5DE5\u5177\u89C4\u5219", rules: [] },
+      user_custom: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49\u547D\u4EE4\u89C4\u5219", rules: [] }
+    },
+    L2_rules: {
+      sensitive_path_access: {
+        category_enabled: true,
+        category_desc: "\u654F\u611F\u8DEF\u5F84\u8BBF\u95EE\u68C0\u6D4B",
+        rules: _l2SensitivePathsToRules()
+      },
+      intent_consistency: {
+        category_enabled: true,
+        category_desc: "\u610F\u56FE\u4E00\u81F4\u6027\u68C0\u6D4B",
+        rules: _l2IntentPatternsToRules()
+      },
+      password_modify_consent: {
+        category_enabled: true,
+        category_desc: "\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u6388\u6743\u68C0\u6D4B",
+        rules: _l2PasswordPatternsToRules()
+      },
+      user_deletion_consent: {
+        category_enabled: true,
+        category_desc: "\u7528\u6237/\u7EC4\u5220\u9664\u64CD\u4F5C\u6388\u6743\u68C0\u6D4B",
+        rules: _l2UserDeletionPatternsToRules()
+      },
+      read_before_write: { category_enabled: true, category_desc: "read_before_write \u5B89\u5168\u539F\u5219\u68C0\u6D4B", rules: [] },
+      dangerous_patterns: { category_enabled: true, category_desc: "\u5371\u9669\u64CD\u4F5C\u6A21\u5F0F\u68C0\u6D4B", rules: [] }
+    },
+    L3_skills: _l3SkillsToRules()
+  };
+}
+function _ruleFingerprint(rule) {
+  if (rule.intent_keywords && rule.intent_keywords.length || rule.dangerous_actions && rule.dangerous_actions.length) {
+    return JSON.stringify([
+      [...rule.intent_keywords || []].sort(),
+      [...rule.dangerous_actions || []].sort()
+    ]);
+  }
+  if (rule.path) return JSON.stringify([rule.path]);
+  if (rule.pattern) return JSON.stringify([rule.pattern]);
+  if (rule.keyword) return JSON.stringify([rule.keyword, rule.lang || ""]);
+  return JSON.stringify([rule.id || ""]);
+}
+function _mergeRuleCategories(userCfg, srcDefaults, layerKey) {
+  const userLayer = userCfg[layerKey] || (userCfg[layerKey] = {});
+  const srcLayer = srcDefaults[layerKey] || {};
+  for (const [catName, srcCat] of Object.entries(srcLayer)) {
+    if (!(catName in userLayer)) {
+      userLayer[catName] = srcCat;
+      continue;
+    }
+    const userCat = userLayer[catName];
+    if (userCat.category_desc === void 0) userCat.category_desc = srcCat.category_desc || "";
+    if (userCat.category_enabled === void 0) userCat.category_enabled = srcCat.category_enabled ?? true;
+    const srcRules = srcCat.rules || [];
+    const userRules = userCat.rules || (userCat.rules = []);
+    const userByFp = /* @__PURE__ */ new Map();
+    for (const r of userRules) userByFp.set(_ruleFingerprint(r), r);
+    const srcFps = /* @__PURE__ */ new Set();
+    for (const srcR of srcRules) {
+      const fp = _ruleFingerprint(srcR);
+      srcFps.add(fp);
+      if (userByFp.has(fp)) {
+        const existing = userByFp.get(fp);
+        const userEnabled = existing.enabled;
+        const userSkipL3 = existing.skip_l3_on_disabled;
+        const userDenyMode = existing.deny_mode;
+        const userSourceDeny = existing.source_deny_mode;
+        Object.keys(existing).forEach((k) => delete existing[k]);
+        Object.assign(existing, srcR);
+        existing.enabled = userEnabled;
+        if (userSkipL3 !== void 0) existing.skip_l3_on_disabled = userSkipL3;
+        if (userDenyMode && userSourceDeny && userDenyMode !== userSourceDeny) {
+          existing.deny_mode = userDenyMode;
+        }
+        if (existing.deny_mode) _syncDenyModeFields(existing);
+      } else {
+        const newR = { ...srcR, enabled: true };
+        userRules.push(newR);
+      }
+    }
+    for (const r of userRules) {
+      if (r.builtin && !srcFps.has(_ruleFingerprint(r))) {
+        r.source_removed = true;
+        r.enabled = false;
+      }
+    }
+    if (catName === "sensitive_path_access") {
+      for (const r of userRules) {
+        if (!r.deny_mode) r.deny_mode = _deriveDenyMode(r);
+        _syncDenyModeFields(r);
+      }
+    }
+  }
+}
+function _mergeSkillCategories(userCfg, srcDefaults, layerKey) {
+  const userLayer = userCfg[layerKey] || (userCfg[layerKey] = {});
+  const srcLayer = srcDefaults[layerKey] || {};
+  for (const [catName, srcCat] of Object.entries(srcLayer)) {
+    if (!(catName in userLayer)) {
+      userLayer[catName] = srcCat;
+      continue;
+    }
+    const userCat = userLayer[catName];
+    if (userCat.category_desc === void 0) userCat.category_desc = srcCat.category_desc || "";
+    if (userCat.category_enabled === void 0) userCat.category_enabled = srcCat.category_enabled ?? true;
+    const userSkills = userCat.skills || (userCat.skills = []);
+    const existingIds = new Set(userSkills.map((s) => s.id));
+    for (const srcS of srcCat.skills || []) {
+      if (!existingIds.has(srcS.id)) userSkills.push({ ...srcS });
+    }
+  }
+}
+function mergeConfig(userCfg, srcDefaults) {
+  const cfg = userCfg;
+  if (cfg.version === void 0) cfg.version = srcDefaults.version || 1;
+  if (!cfg.layers) cfg.layers = {};
+  for (const [layerKey, defaultVal] of Object.entries(srcDefaults.layers)) {
+    if (!(layerKey in cfg.layers)) cfg.layers[layerKey] = defaultVal;
+  }
+  _mergeRuleCategories(cfg, srcDefaults, "L1_rules");
+  _mergeRuleCategories(cfg, srcDefaults, "L2_rules");
+  _mergeSkillCategories(cfg, srcDefaults, "L3_skills");
+  return cfg;
+}
+function getEnabledL1InjectionKeywords(runtime) {
+  const cat = runtime.L1_rules?.injection_detection || { category_enabled: true, rules: [] };
+  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => ({
+    keyword: r.keyword || "",
+    risk_level: r.risk_level || "",
+    lang: r.lang || "en"
+  }));
+}
+function getEnabledL2IntentPatterns(runtime) {
+  const cat = runtime.L2_rules?.intent_consistency || { category_enabled: true, rules: [] };
+  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => ({
+    intent_keywords: r.intent_keywords || [],
+    dangerous_actions: r.dangerous_actions || [],
+    reason: r.reason || ""
+  }));
+}
+function getEnabledL2PasswordPatterns(runtime) {
+  const cat = runtime.L2_rules?.password_modify_consent || { category_enabled: true, rules: [] };
+  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => r.pattern || "");
+}
+function getEnabledL2UserDeletionPatterns(runtime) {
+  const cat = runtime.L2_rules?.user_deletion_consent || { category_enabled: true, rules: [] };
+  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => r.pattern || "");
+}
+function isL2CategoryEnabled(runtime, categoryKey) {
+  const cat = runtime.L2_rules?.[categoryKey];
+  return cat?.category_enabled ?? true;
+}
+function getDisabledSkillIds(runtime) {
+  const disabled = /* @__PURE__ */ new Set();
+  for (const catData of Object.values(runtime.L3_skills || {})) {
+    if (!catData.category_enabled) {
+      for (const s of catData.skills || []) disabled.add(s.id);
+    } else {
+      for (const s of catData.skills || []) {
+        if (s.enabled === false) disabled.add(s.id);
+      }
+    }
+  }
+  return disabled;
+}
+function getEnabledL1CommandPatternsOrDefault(runtime) {
+  const enabled = getEnabledL1CommandPatterns(runtime);
+  if (enabled.length) return enabled;
+  if (!hasRuntimeConfig()) return _l1CommandPatternsToRules();
+  return [];
+}
+function getEnabledL1InjectionKeywordsOrDefault(runtime) {
+  const enabled = getEnabledL1InjectionKeywords(runtime);
+  if (enabled.length) return enabled;
+  if (!hasRuntimeConfig()) return _l1InjectionKeywordsToRules();
+  return [];
+}
+function getEnabledL2SensitivePathsOrDefault(runtime) {
+  const enabled = getEnabledL2SensitivePaths(runtime);
+  if (enabled.length) return enabled;
+  if (!hasRuntimeConfig()) return _l2SensitivePathsToRules();
+  return [];
+}
+function getEnabledL2IntentPatternsOrDefault(runtime) {
+  const enabled = getEnabledL2IntentPatterns(runtime);
+  if (enabled.length) return enabled;
+  if (!hasRuntimeConfig()) return _l2IntentPatternsToRules();
+  return [];
+}
+function getEnabledL2PasswordPatternsOrDefault(runtime) {
+  const enabled = getEnabledL2PasswordPatterns(runtime);
+  if (enabled.length) return enabled;
+  if (!hasRuntimeConfig()) {
+    return PASSWORD_MODIFY_PATTERNS.map((p) => p.source);
+  }
+  return [];
+}
+function getEnabledL2UserDeletionPatternsOrDefault(runtime) {
+  const enabled = getEnabledL2UserDeletionPatterns(runtime);
+  if (enabled.length) return enabled;
+  if (!hasRuntimeConfig()) {
+    return USER_DELETION_PATTERNS.map((p) => p.source);
+  }
+  return [];
+}
+function _validateSkillId(skillId) {
+  if (!skillId || !SKILL_ID_RE.test(skillId)) {
+    throw new Error(`skill_id '${skillId}' \u4E0D\u5408\u6CD5\uFF1A\u53EA\u5141\u8BB8\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u4E0B\u5212\u7EBF\u548C\u8FDE\u5B57\u7B26`);
+  }
+}
+function updateLayerEnabled(layerKey, enabled) {
+  const runtime = loadRuntimeConfig();
+  runtime.layers[layerKey] = enabled;
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function updateRuleEnabled(layer, category, ruleId, enabled) {
+  const runtime = loadRuntimeConfig();
+  for (const r of runtime[layer]?.[category]?.rules || []) {
+    if (r.id === ruleId) {
+      r.enabled = enabled;
+      break;
+    }
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function updateRuleDenyMode(layer, category, ruleId, denyMode) {
+  const runtime = loadRuntimeConfig();
+  for (const r of runtime[layer]?.[category]?.rules || []) {
+    if (r.id === ruleId) {
+      r.deny_mode = denyMode;
+      _syncDenyModeFields(r);
+      break;
+    }
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function updateRuleSkipL3(layer, category, ruleId, skipL3) {
+  const runtime = loadRuntimeConfig();
+  for (const r of runtime[layer]?.[category]?.rules || []) {
+    if (r.id === ruleId) {
+      r.skip_l3_on_disabled = skipL3;
+      break;
+    }
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function updateCategoryEnabled(layer, category, enabled) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime[layer]?.[category];
+  if (cat) cat.category_enabled = enabled;
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function addCustomRule(layer, category, rule) {
+  const runtime = loadRuntimeConfig();
+  const layerObj = runtime[layer] || (runtime[layer] = {});
+  const cat = layerObj[category] || (layerObj[category] = { category_enabled: true, category_desc: "", rules: [] });
+  const rules = cat.rules || (cat.rules = []);
+  const newRule = { ...rule, builtin: false, enabled: true };
+  if (!newRule.id) {
+    newRule.id = `custom_${Date.now()}_${_slugify(JSON.stringify(rule).slice(0, 30))}`;
+  }
+  if (newRule.deny_mode) _syncDenyModeFields(newRule);
+  rules.push(newRule);
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function deleteCustomRule(layer, category, ruleId) {
+  const runtime = loadRuntimeConfig();
+  const rules = runtime[layer]?.[category]?.rules || [];
+  const idx = rules.findIndex((r) => r.id === ruleId);
+  if (idx >= 0) {
+    if (rules[idx].builtin) return null;
+    rules.splice(idx, 1);
+    saveRuntimeConfig(runtime);
+  }
+  return runtime;
+}
+function addCustomSkill(skillId, category, keywords, content) {
+  _validateSkillId(skillId);
+  const runtime = loadRuntimeConfig();
+  const skillsDir = join4(RUNTIME_CONFIG_DIR, "agent_moss_skills");
+  try {
+    mkdirSync2(skillsDir, { recursive: true });
+  } catch {
+  }
+  writeFileSync2(join4(skillsDir, `${skillId}.md`), content, "utf-8");
+  const l3 = runtime.L3_skills || (runtime.L3_skills = {});
+  const cat = l3[category] || (l3[category] = { category_enabled: true, category_desc: "", skills: [] });
+  (cat.skills || (cat.skills = [])).push({ id: skillId, keywords, enabled: true, builtin: false });
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function deleteCustomSkill(skillId, category) {
+  _validateSkillId(skillId);
+  const runtime = loadRuntimeConfig();
+  const skills = runtime.L3_skills?.[category]?.skills || [];
+  const idx = skills.findIndex((s) => s.id === skillId);
+  if (idx >= 0) {
+    if (skills[idx].builtin) return null;
+    skills.splice(idx, 1);
+    const skillPath = join4(RUNTIME_CONFIG_DIR, "agent_moss_skills", `${skillId}.md`);
+    try {
+      if (existsSync7(skillPath)) unlinkSync2(skillPath);
+    } catch {
+    }
+    saveRuntimeConfig(runtime);
+  }
+  return runtime;
+}
+function updateSkillEnabled(skillId, enabled) {
+  const runtime = loadRuntimeConfig();
+  for (const catData of Object.values(runtime.L3_skills || {})) {
+    for (const s of catData.skills || []) {
+      if (s.id === skillId) {
+        s.enabled = enabled;
+        break;
+      }
+    }
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function updateSkillCategoryEnabled(category, enabled) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.L3_skills?.[category];
+  if (cat) cat.category_enabled = enabled;
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function getProfileOrDetect() {
+  return null;
+}
+var RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, ENV_RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DENY_MODE_LABELS, SKILL_ID_RE;
+var init_runtime_config = __esm({
+  "src/infra/runtime-config.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_heuristic();
+    init_logic_rules();
+    init_skill_loader();
+    RUNTIME_CONFIG_DIR = join4(homedir3(), ".config", "agentmoss");
+    RUNTIME_CONFIG_PATH = join4(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
+    ENV_RUNTIME_CONFIG_PATH = "AGENT_MOSS_RUNTIME_CONFIG_PATH";
+    LAYER_DISABLE_ENV = {
+      L1_heuristic: "AGENT_MOSS_DISABLE_HEURISTIC",
+      L2_logic_rules: "AGENT_MOSS_DISABLE_LOGIC_RULES",
+      L3_llm_analysis: "AGENT_MOSS_DISABLE_LLM"
+    };
+    DENY_MODE_LABELS = {
+      deny_write: "\u4EC5\u62E6\u622A\u5199\u5165",
+      deny_read: "\u4EC5\u62E6\u622A\u8BFB\u53D6",
+      deny_both: "\u8BFB\u5199\u5747\u62E6\u622A"
+    };
+    SKILL_ID_RE = /^[A-Za-z0-9_-]+$/;
+  }
+});
+
+// node_modules/better-sqlite3/lib/util.js
+var require_util = __commonJS({
+  "node_modules/better-sqlite3/lib/util.js"(exports) {
+    "use strict";
+    init_esm_shims();
+    exports.getBooleanOption = (options, key) => {
+      let value = false;
+      if (key in options && typeof (value = options[key]) !== "boolean") {
+        throw new TypeError(`Expected the "${key}" option to be a boolean`);
+      }
+      return value;
+    };
+    exports.cppdb = /* @__PURE__ */ Symbol();
+    exports.inspect = /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom");
+  }
+});
+
+// node_modules/better-sqlite3/lib/sqlite-error.js
+var require_sqlite_error = __commonJS({
+  "node_modules/better-sqlite3/lib/sqlite-error.js"(exports, module) {
+    "use strict";
+    init_esm_shims();
+    var descriptor = { value: "SqliteError", writable: true, enumerable: false, configurable: true };
+    function SqliteError(message, code) {
+      if (new.target !== SqliteError) {
+        return new SqliteError(message, code);
+      }
+      if (typeof code !== "string") {
+        throw new TypeError("Expected second argument to be a string");
+      }
+      Error.call(this, message);
+      descriptor.value = "" + message;
+      Object.defineProperty(this, "message", descriptor);
+      Error.captureStackTrace(this, SqliteError);
+      this.code = code;
+    }
+    Object.setPrototypeOf(SqliteError, Error);
+    Object.setPrototypeOf(SqliteError.prototype, Error.prototype);
+    Object.defineProperty(SqliteError.prototype, "name", descriptor);
+    module.exports = SqliteError;
+  }
+});
+
+// node_modules/file-uri-to-path/index.js
+var require_file_uri_to_path = __commonJS({
+  "node_modules/file-uri-to-path/index.js"(exports, module) {
+    "use strict";
+    init_esm_shims();
+    var sep = __require("path").sep || "/";
+    module.exports = fileUriToPath;
+    function fileUriToPath(uri) {
+      if ("string" != typeof uri || uri.length <= 7 || "file://" != uri.substring(0, 7)) {
+        throw new TypeError("must pass in a file:// URI to convert to a file path");
+      }
+      var rest = decodeURI(uri.substring(7));
+      var firstSlash = rest.indexOf("/");
+      var host = rest.substring(0, firstSlash);
+      var path3 = rest.substring(firstSlash + 1);
+      if ("localhost" == host) host = "";
+      if (host) {
+        host = sep + sep + host;
+      }
+      path3 = path3.replace(/^(.+)\|/, "$1:");
+      if (sep == "\\") {
+        path3 = path3.replace(/\//g, "\\");
+      }
+      if (/^.+\:/.test(path3)) {
+      } else {
+        path3 = sep + path3;
+      }
+      return host + path3;
+    }
+  }
+});
+
+// node_modules/bindings/bindings.js
+var require_bindings = __commonJS({
+  "node_modules/bindings/bindings.js"(exports, module) {
+    "use strict";
+    init_esm_shims();
+    var fs4 = __require("fs");
+    var path3 = __require("path");
+    var fileURLToPath6 = require_file_uri_to_path();
+    var join6 = path3.join;
+    var dirname6 = path3.dirname;
+    var exists = fs4.accessSync && function(path4) {
+      try {
+        fs4.accessSync(path4);
+      } catch (e) {
+        return false;
+      }
+      return true;
+    } || fs4.existsSync || path3.existsSync;
+    var defaults = {
+      arrow: process.env.NODE_BINDINGS_ARROW || " \u2192 ",
+      compiled: process.env.NODE_BINDINGS_COMPILED_DIR || "compiled",
+      platform: process.platform,
+      arch: process.arch,
+      nodePreGyp: "node-v" + process.versions.modules + "-" + process.platform + "-" + process.arch,
+      version: process.versions.node,
+      bindings: "bindings.node",
+      try: [
+        // node-gyp's linked version in the "build" dir
+        ["module_root", "build", "bindings"],
+        // node-waf and gyp_addon (a.k.a node-gyp)
+        ["module_root", "build", "Debug", "bindings"],
+        ["module_root", "build", "Release", "bindings"],
+        // Debug files, for development (legacy behavior, remove for node v0.9)
+        ["module_root", "out", "Debug", "bindings"],
+        ["module_root", "Debug", "bindings"],
+        // Release files, but manually compiled (legacy behavior, remove for node v0.9)
+        ["module_root", "out", "Release", "bindings"],
+        ["module_root", "Release", "bindings"],
+        // Legacy from node-waf, node <= 0.4.x
+        ["module_root", "build", "default", "bindings"],
+        // Production "Release" buildtype binary (meh...)
+        ["module_root", "compiled", "version", "platform", "arch", "bindings"],
+        // node-qbs builds
+        ["module_root", "addon-build", "release", "install-root", "bindings"],
+        ["module_root", "addon-build", "debug", "install-root", "bindings"],
+        ["module_root", "addon-build", "default", "install-root", "bindings"],
+        // node-pre-gyp path ./lib/binding/{node_abi}-{platform}-{arch}
+        ["module_root", "lib", "binding", "nodePreGyp", "bindings"]
+      ]
+    };
+    function bindings(opts) {
+      if (typeof opts == "string") {
+        opts = { bindings: opts };
+      } else if (!opts) {
+        opts = {};
+      }
+      Object.keys(defaults).map(function(i2) {
+        if (!(i2 in opts)) opts[i2] = defaults[i2];
+      });
+      if (!opts.module_root) {
+        opts.module_root = exports.getRoot(exports.getFileName());
+      }
+      if (path3.extname(opts.bindings) != ".node") {
+        opts.bindings += ".node";
+      }
+      var requireFunc = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
+      var tries = [], i = 0, l = opts.try.length, n, b, err;
+      for (; i < l; i++) {
+        n = join6.apply(
+          null,
+          opts.try[i].map(function(p) {
+            return opts[p] || p;
+          })
+        );
+        tries.push(n);
+        try {
+          b = opts.path ? requireFunc.resolve(n) : requireFunc(n);
+          if (!opts.path) {
+            b.path = n;
+          }
+          return b;
+        } catch (e) {
+          if (e.code !== "MODULE_NOT_FOUND" && e.code !== "QUALIFIED_PATH_RESOLUTION_FAILED" && !/not find/i.test(e.message)) {
+            throw e;
+          }
+        }
+      }
+      err = new Error(
+        "Could not locate the bindings file. Tried:\n" + tries.map(function(a) {
+          return opts.arrow + a;
+        }).join("\n")
+      );
+      err.tries = tries;
+      throw err;
+    }
+    module.exports = exports = bindings;
+    exports.getFileName = function getFileName(calling_file) {
+      var origPST = Error.prepareStackTrace, origSTL = Error.stackTraceLimit, dummy = {}, fileName;
+      Error.stackTraceLimit = 10;
+      Error.prepareStackTrace = function(e, st) {
+        for (var i = 0, l = st.length; i < l; i++) {
+          fileName = st[i].getFileName();
+          if (fileName !== __filename) {
+            if (calling_file) {
+              if (fileName !== calling_file) {
+                return;
+              }
+            } else {
+              return;
+            }
+          }
+        }
+      };
+      Error.captureStackTrace(dummy);
+      dummy.stack;
+      Error.prepareStackTrace = origPST;
+      Error.stackTraceLimit = origSTL;
+      var fileSchema = "file://";
+      if (fileName.indexOf(fileSchema) === 0) {
+        fileName = fileURLToPath6(fileName);
+      }
+      return fileName;
+    };
+    exports.getRoot = function getRoot(file) {
+      var dir = dirname6(file), prev;
+      while (true) {
+        if (dir === ".") {
+          dir = process.cwd();
+        }
+        if (exists(join6(dir, "package.json")) || exists(join6(dir, "node_modules"))) {
+          return dir;
+        }
+        if (prev === dir) {
+          throw new Error(
+            'Could not find module root given file: "' + file + '". Do you have a `package.json` file? '
+          );
+        }
+        prev = dir;
+        dir = join6(dir, "..");
+      }
+    };
+  }
+});
+
+// node_modules/better-sqlite3/lib/methods/wrappers.js
+var require_wrappers = __commonJS({
+  "node_modules/better-sqlite3/lib/methods/wrappers.js"(exports) {
+    "use strict";
+    init_esm_shims();
+    var { cppdb } = require_util();
+    exports.prepare = function prepare(sql) {
+      return this[cppdb].prepare(sql, this, false);
+    };
+    exports.exec = function exec(sql) {
+      this[cppdb].exec(sql);
+      return this;
+    };
+    exports.close = function close() {
+      this[cppdb].close();
+      return this;
+    };
+    exports.loadExtension = function loadExtension(...args) {
+      this[cppdb].loadExtension(...args);
+      return this;
+    };
+    exports.defaultSafeIntegers = function defaultSafeIntegers(...args) {
+      this[cppdb].defaultSafeIntegers(...args);
+      return this;
+    };
+    exports.unsafeMode = function unsafeMode(...args) {
+      this[cppdb].unsafeMode(...args);
+      return this;
+    };
+    exports.getters = {
+      name: {
+        get: function name() {
+          return this[cppdb].name;
+        },
+        enumerable: true
+      },
+      open: {
+        get: function open() {
+          return this[cppdb].open;
+        },
+        enumerable: true
+      },
+      inTransaction: {
+        get: function inTransaction() {
+          return this[cppdb].inTransaction;
+        },
+        enumerable: true
+      },
+      readonly: {
+        get: function readonly() {
+          return this[cppdb].readonly;
+        },
+        enumerable: true
+      },
+      memory: {
+        get: function memory() {
+          return this[cppdb].memory;
+        },
+        enumerable: true
+      }
+    };
+  }
+});
+
+// node_modules/better-sqlite3/lib/methods/transaction.js
+var require_transaction = __commonJS({
+  "node_modules/better-sqlite3/lib/methods/transaction.js"(exports, module) {
+    "use strict";
+    init_esm_shims();
+    var { cppdb } = require_util();
+    var controllers = /* @__PURE__ */ new WeakMap();
+    module.exports = function transaction(fn) {
+      if (typeof fn !== "function") throw new TypeError("Expected first argument to be a function");
+      const db = this[cppdb];
+      const controller = getController(db, this);
+      const { apply } = Function.prototype;
+      const properties = {
+        default: { value: wrapTransaction(apply, fn, db, controller.default) },
+        deferred: { value: wrapTransaction(apply, fn, db, controller.deferred) },
+        immediate: { value: wrapTransaction(apply, fn, db, controller.immediate) },
+        exclusive: { value: wrapTransaction(apply, fn, db, controller.exclusive) },
+        database: { value: this, enumerable: true }
+      };
+      Object.defineProperties(properties.default.value, properties);
+      Object.defineProperties(properties.deferred.value, properties);
+      Object.defineProperties(properties.immediate.value, properties);
+      Object.defineProperties(properties.exclusive.value, properties);
+      return properties.default.value;
+    };
+    var getController = (db, self) => {
+      let controller = controllers.get(db);
+      if (!controller) {
+        const shared = {
+          commit: db.prepare("COMMIT", self, false),
+          rollback: db.prepare("ROLLBACK", self, false),
+          savepoint: db.prepare("SAVEPOINT `	_bs3.	`", self, false),
+          release: db.prepare("RELEASE `	_bs3.	`", self, false),
+          rollbackTo: db.prepare("ROLLBACK TO `	_bs3.	`", self, false)
+        };
+        controllers.set(db, controller = {
+          default: Object.assign({ begin: db.prepare("BEGIN", self, false) }, shared),
+          deferred: Object.assign({ begin: db.prepare("BEGIN DEFERRED", self, false) }, shared),
+          immediate: Object.assign({ begin: db.prepare("BEGIN IMMEDIATE", self, false) }, shared),
+          exclusive: Object.assign({ begin: db.prepare("BEGIN EXCLUSIVE", self, false) }, shared)
+        });
+      }
+      return controller;
+    };
+    var wrapTransaction = (apply, fn, db, { begin, commit, rollback, savepoint, release, rollbackTo }) => function sqliteTransaction() {
+      let before, after, undo;
+      if (db.inTransaction) {
+        before = savepoint;
+        after = release;
+        undo = rollbackTo;
+      } else {
+        before = begin;
+        after = commit;
+        undo = rollback;
+      }
+      before.run();
+      try {
+        const result = apply.call(fn, this, arguments);
+        if (result && typeof result.then === "function") {
+          throw new TypeError("Transaction function cannot return a promise");
+        }
+        after.run();
+        return result;
+      } catch (ex) {
+        if (db.inTransaction) {
+          undo.run();
+          if (undo !== rollback) after.run();
+        }
+        throw ex;
+      }
+    };
+  }
+});
+
+// node_modules/better-sqlite3/lib/methods/pragma.js
+var require_pragma = __commonJS({
+  "node_modules/better-sqlite3/lib/methods/pragma.js"(exports, module) {
+    "use strict";
+    init_esm_shims();
+    var { getBooleanOption, cppdb } = require_util();
+    module.exports = function pragma(source, options) {
+      if (options == null) options = {};
+      if (typeof source !== "string") throw new TypeError("Expected first argument to be a string");
+      if (typeof options !== "object") throw new TypeError("Expected second argument to be an options object");
+      const simple = getBooleanOption(options, "simple");
+      const stmt = this[cppdb].prepare(`PRAGMA ${source}`, this, true);
+      return simple ? stmt.pluck().get() : stmt.all();
+    };
+  }
+});
+
+// node_modules/better-sqlite3/lib/methods/backup.js
+var require_backup = __commonJS({
+  "node_modules/better-sqlite3/lib/methods/backup.js"(exports, module) {
+    "use strict";
+    init_esm_shims();
+    var fs4 = __require("fs");
+    var path3 = __require("path");
+    var { promisify } = __require("util");
+    var { cppdb } = require_util();
+    var fsAccess = promisify(fs4.access);
+    module.exports = async function backup(filename, options) {
+      if (options == null) options = {};
+      if (typeof filename !== "string") throw new TypeError("Expected first argument to be a string");
+      if (typeof options !== "object") throw new TypeError("Expected second argument to be an options object");
+      filename = filename.trim();
+      const attachedName = "attached" in options ? options.attached : "main";
+      const handler = "progress" in options ? options.progress : null;
+      if (!filename) throw new TypeError("Backup filename cannot be an empty string");
+      if (filename === ":memory:") throw new TypeError('Invalid backup filename ":memory:"');
+      if (typeof attachedName !== "string") throw new TypeError('Expected the "attached" option to be a string');
+      if (!attachedName) throw new TypeError('The "attached" option cannot be an empty string');
+      if (handler != null && typeof handler !== "function") throw new TypeError('Expected the "progress" option to be a function');
+      await fsAccess(path3.dirname(filename)).catch(() => {
+        throw new TypeError("Cannot save backup because the directory does not exist");
+      });
+      const isNewFile = await fsAccess(filename).then(() => false, () => true);
+      return runBackup(this[cppdb].backup(this, attachedName, filename, isNewFile), handler || null);
+    };
+    var runBackup = (backup, handler) => {
+      let rate = 0;
+      let useDefault = true;
+      return new Promise((resolve6, reject) => {
+        setImmediate(function step() {
+          try {
+            const progress = backup.transfer(rate);
+            if (!progress.remainingPages) {
+              backup.close();
+              resolve6(progress);
+              return;
+            }
+            if (useDefault) {
+              useDefault = false;
+              rate = 100;
+            }
+            if (handler) {
+              const ret = handler(progress);
+              if (ret !== void 0) {
+                if (typeof ret === "number" && ret === ret) rate = Math.max(0, Math.min(2147483647, Math.round(ret)));
+                else throw new TypeError("Expected progress callback to return a number or undefined");
+              }
+            }
+            setImmediate(step);
+          } catch (err) {
+            backup.close();
+            reject(err);
+          }
+        });
+      });
+    };
+  }
+});
+
+// node_modules/better-sqlite3/lib/methods/serialize.js
+var require_serialize = __commonJS({
+  "node_modules/better-sqlite3/lib/methods/serialize.js"(exports, module) {
+    "use strict";
+    init_esm_shims();
+    var { cppdb } = require_util();
+    module.exports = function serialize(options) {
+      if (options == null) options = {};
+      if (typeof options !== "object") throw new TypeError("Expected first argument to be an options object");
+      const attachedName = "attached" in options ? options.attached : "main";
+      if (typeof attachedName !== "string") throw new TypeError('Expected the "attached" option to be a string');
+      if (!attachedName) throw new TypeError('The "attached" option cannot be an empty string');
+      return this[cppdb].serialize(attachedName);
+    };
+  }
+});
+
+// node_modules/better-sqlite3/lib/methods/function.js
+var require_function = __commonJS({
+  "node_modules/better-sqlite3/lib/methods/function.js"(exports, module) {
+    "use strict";
+    init_esm_shims();
+    var { getBooleanOption, cppdb } = require_util();
+    module.exports = function defineFunction(name, options, fn) {
+      if (options == null) options = {};
+      if (typeof options === "function") {
+        fn = options;
+        options = {};
+      }
+      if (typeof name !== "string") throw new TypeError("Expected first argument to be a string");
+      if (typeof fn !== "function") throw new TypeError("Expected last argument to be a function");
+      if (typeof options !== "object") throw new TypeError("Expected second argument to be an options object");
+      if (!name) throw new TypeError("User-defined function name cannot be an empty string");
+      const safeIntegers = "safeIntegers" in options ? +getBooleanOption(options, "safeIntegers") : 2;
+      const deterministic = getBooleanOption(options, "deterministic");
+      const directOnly = getBooleanOption(options, "directOnly");
+      const varargs = getBooleanOption(options, "varargs");
+      let argCount = -1;
+      if (!varargs) {
+        argCount = fn.length;
+        if (!Number.isInteger(argCount) || argCount < 0) throw new TypeError("Expected function.length to be a positive integer");
+        if (argCount > 100) throw new RangeError("User-defined functions cannot have more than 100 arguments");
+      }
+      this[cppdb].function(fn, name, argCount, safeIntegers, deterministic, directOnly);
+      return this;
+    };
+  }
+});
+
+// node_modules/better-sqlite3/lib/methods/aggregate.js
+var require_aggregate = __commonJS({
+  "node_modules/better-sqlite3/lib/methods/aggregate.js"(exports, module) {
+    "use strict";
+    init_esm_shims();
+    var { getBooleanOption, cppdb } = require_util();
+    module.exports = function defineAggregate(name, options) {
+      if (typeof name !== "string") throw new TypeError("Expected first argument to be a string");
+      if (typeof options !== "object" || options === null) throw new TypeError("Expected second argument to be an options object");
+      if (!name) throw new TypeError("User-defined function name cannot be an empty string");
+      const start = "start" in options ? options.start : null;
+      const step = getFunctionOption(options, "step", true);
+      const inverse = getFunctionOption(options, "inverse", false);
+      const result = getFunctionOption(options, "result", false);
+      const safeIntegers = "safeIntegers" in options ? +getBooleanOption(options, "safeIntegers") : 2;
+      const deterministic = getBooleanOption(options, "deterministic");
+      const directOnly = getBooleanOption(options, "directOnly");
+      const varargs = getBooleanOption(options, "varargs");
+      let argCount = -1;
+      if (!varargs) {
+        argCount = Math.max(getLength(step), inverse ? getLength(inverse) : 0);
+        if (argCount > 0) argCount -= 1;
+        if (argCount > 100) throw new RangeError("User-defined functions cannot have more than 100 arguments");
+      }
+      this[cppdb].aggregate(start, step, inverse, result, name, argCount, safeIntegers, deterministic, directOnly);
+      return this;
+    };
+    var getFunctionOption = (options, key, required) => {
+      const value = key in options ? options[key] : null;
+      if (typeof value === "function") return value;
+      if (value != null) throw new TypeError(`Expected the "${key}" option to be a function`);
+      if (required) throw new TypeError(`Missing required option "${key}"`);
+      return null;
+    };
+    var getLength = ({ length }) => {
+      if (Number.isInteger(length) && length >= 0) return length;
+      throw new TypeError("Expected function.length to be a positive integer");
+    };
+  }
+});
+
+// node_modules/better-sqlite3/lib/methods/table.js
+var require_table = __commonJS({
+  "node_modules/better-sqlite3/lib/methods/table.js"(exports, module) {
+    "use strict";
+    init_esm_shims();
+    var { cppdb } = require_util();
+    module.exports = function defineTable(name, factory) {
+      if (typeof name !== "string") throw new TypeError("Expected first argument to be a string");
+      if (!name) throw new TypeError("Virtual table module name cannot be an empty string");
+      let eponymous = false;
+      if (typeof factory === "object" && factory !== null) {
+        eponymous = true;
+        factory = defer(parseTableDefinition(factory, "used", name));
+      } else {
+        if (typeof factory !== "function") throw new TypeError("Expected second argument to be a function or a table definition object");
+        factory = wrapFactory(factory);
+      }
+      this[cppdb].table(factory, name, eponymous);
+      return this;
+    };
+    function wrapFactory(factory) {
+      return function virtualTableFactory(moduleName, databaseName, tableName, ...args) {
+        const thisObject = {
+          module: moduleName,
+          database: databaseName,
+          table: tableName
+        };
+        const def = apply.call(factory, thisObject, args);
+        if (typeof def !== "object" || def === null) {
+          throw new TypeError(`Virtual table module "${moduleName}" did not return a table definition object`);
+        }
+        return parseTableDefinition(def, "returned", moduleName);
+      };
+    }
+    function parseTableDefinition(def, verb, moduleName) {
+      if (!hasOwnProperty.call(def, "rows")) {
+        throw new TypeError(`Virtual table module "${moduleName}" ${verb} a table definition without a "rows" property`);
+      }
+      if (!hasOwnProperty.call(def, "columns")) {
+        throw new TypeError(`Virtual table module "${moduleName}" ${verb} a table definition without a "columns" property`);
+      }
+      const rows = def.rows;
+      if (typeof rows !== "function" || Object.getPrototypeOf(rows) !== GeneratorFunctionPrototype) {
+        throw new TypeError(`Virtual table module "${moduleName}" ${verb} a table definition with an invalid "rows" property (should be a generator function)`);
+      }
+      let columns = def.columns;
+      if (!Array.isArray(columns) || !(columns = [...columns]).every((x) => typeof x === "string")) {
+        throw new TypeError(`Virtual table module "${moduleName}" ${verb} a table definition with an invalid "columns" property (should be an array of strings)`);
+      }
+      if (columns.length !== new Set(columns).size) {
+        throw new TypeError(`Virtual table module "${moduleName}" ${verb} a table definition with duplicate column names`);
+      }
+      if (!columns.length) {
+        throw new RangeError(`Virtual table module "${moduleName}" ${verb} a table definition with zero columns`);
+      }
+      let parameters;
+      if (hasOwnProperty.call(def, "parameters")) {
+        parameters = def.parameters;
+        if (!Array.isArray(parameters) || !(parameters = [...parameters]).every((x) => typeof x === "string")) {
+          throw new TypeError(`Virtual table module "${moduleName}" ${verb} a table definition with an invalid "parameters" property (should be an array of strings)`);
+        }
+      } else {
+        parameters = inferParameters(rows);
+      }
+      if (parameters.length !== new Set(parameters).size) {
+        throw new TypeError(`Virtual table module "${moduleName}" ${verb} a table definition with duplicate parameter names`);
+      }
+      if (parameters.length > 32) {
+        throw new RangeError(`Virtual table module "${moduleName}" ${verb} a table definition with more than the maximum number of 32 parameters`);
+      }
+      for (const parameter of parameters) {
+        if (columns.includes(parameter)) {
+          throw new TypeError(`Virtual table module "${moduleName}" ${verb} a table definition with column "${parameter}" which was ambiguously defined as both a column and parameter`);
+        }
+      }
+      let safeIntegers = 2;
+      if (hasOwnProperty.call(def, "safeIntegers")) {
+        const bool = def.safeIntegers;
+        if (typeof bool !== "boolean") {
+          throw new TypeError(`Virtual table module "${moduleName}" ${verb} a table definition with an invalid "safeIntegers" property (should be a boolean)`);
+        }
+        safeIntegers = +bool;
+      }
+      let directOnly = false;
+      if (hasOwnProperty.call(def, "directOnly")) {
+        directOnly = def.directOnly;
+        if (typeof directOnly !== "boolean") {
+          throw new TypeError(`Virtual table module "${moduleName}" ${verb} a table definition with an invalid "directOnly" property (should be a boolean)`);
+        }
+      }
+      const columnDefinitions = [
+        ...parameters.map(identifier).map((str) => `${str} HIDDEN`),
+        ...columns.map(identifier)
+      ];
+      return [
+        `CREATE TABLE x(${columnDefinitions.join(", ")});`,
+        wrapGenerator(rows, new Map(columns.map((x, i) => [x, parameters.length + i])), moduleName),
+        parameters,
+        safeIntegers,
+        directOnly
+      ];
+    }
+    function wrapGenerator(generator, columnMap, moduleName) {
+      return function* virtualTable(...args) {
+        const output = args.map((x) => Buffer.isBuffer(x) ? Buffer.from(x) : x);
+        for (let i = 0; i < columnMap.size; ++i) {
+          output.push(null);
+        }
+        for (const row of generator(...args)) {
+          if (Array.isArray(row)) {
+            extractRowArray(row, output, columnMap.size, moduleName);
+            yield output;
+          } else if (typeof row === "object" && row !== null) {
+            extractRowObject(row, output, columnMap, moduleName);
+            yield output;
+          } else {
+            throw new TypeError(`Virtual table module "${moduleName}" yielded something that isn't a valid row object`);
+          }
+        }
+      };
+    }
+    function extractRowArray(row, output, columnCount, moduleName) {
+      if (row.length !== columnCount) {
+        throw new TypeError(`Virtual table module "${moduleName}" yielded a row with an incorrect number of columns`);
+      }
+      const offset = output.length - columnCount;
+      for (let i = 0; i < columnCount; ++i) {
+        output[i + offset] = row[i];
+      }
+    }
+    function extractRowObject(row, output, columnMap, moduleName) {
+      let count = 0;
+      for (const key of Object.keys(row)) {
+        const index = columnMap.get(key);
+        if (index === void 0) {
+          throw new TypeError(`Virtual table module "${moduleName}" yielded a row with an undeclared column "${key}"`);
+        }
+        output[index] = row[key];
+        count += 1;
+      }
+      if (count !== columnMap.size) {
+        throw new TypeError(`Virtual table module "${moduleName}" yielded a row with missing columns`);
+      }
+    }
+    function inferParameters({ length }) {
+      if (!Number.isInteger(length) || length < 0) {
+        throw new TypeError("Expected function.length to be a positive integer");
+      }
+      const params = [];
+      for (let i = 0; i < length; ++i) {
+        params.push(`$${i + 1}`);
+      }
+      return params;
+    }
+    var { hasOwnProperty } = Object.prototype;
+    var { apply } = Function.prototype;
+    var GeneratorFunctionPrototype = Object.getPrototypeOf(function* () {
+    });
+    var identifier = (str) => `"${str.replace(/"/g, '""')}"`;
+    var defer = (x) => () => x;
+  }
+});
+
+// node_modules/better-sqlite3/lib/methods/inspect.js
+var require_inspect = __commonJS({
+  "node_modules/better-sqlite3/lib/methods/inspect.js"(exports, module) {
+    "use strict";
+    init_esm_shims();
+    var DatabaseInspection = function Database() {
+    };
+    module.exports = function inspect(depth, opts) {
+      return Object.assign(new DatabaseInspection(), this);
+    };
+  }
+});
+
+// node_modules/better-sqlite3/lib/database.js
+var require_database = __commonJS({
+  "node_modules/better-sqlite3/lib/database.js"(exports, module) {
+    "use strict";
+    init_esm_shims();
+    var fs4 = __require("fs");
+    var path3 = __require("path");
+    var util = require_util();
+    var SqliteError = require_sqlite_error();
+    var DEFAULT_ADDON;
+    function Database(filenameGiven, options) {
+      if (new.target == null) {
+        return new Database(filenameGiven, options);
+      }
+      let buffer;
+      if (Buffer.isBuffer(filenameGiven)) {
+        buffer = filenameGiven;
+        filenameGiven = ":memory:";
+      }
+      if (filenameGiven == null) filenameGiven = "";
+      if (options == null) options = {};
+      if (typeof filenameGiven !== "string") throw new TypeError("Expected first argument to be a string");
+      if (typeof options !== "object") throw new TypeError("Expected second argument to be an options object");
+      if ("readOnly" in options) throw new TypeError('Misspelled option "readOnly" should be "readonly"');
+      if ("memory" in options) throw new TypeError('Option "memory" was removed in v7.0.0 (use ":memory:" filename instead)');
+      const filename = filenameGiven.trim();
+      const anonymous = filename === "" || filename === ":memory:";
+      const readonly = util.getBooleanOption(options, "readonly");
+      const fileMustExist = util.getBooleanOption(options, "fileMustExist");
+      const timeout = "timeout" in options ? options.timeout : 5e3;
+      const verbose = "verbose" in options ? options.verbose : null;
+      const nativeBinding = "nativeBinding" in options ? options.nativeBinding : null;
+      if (readonly && anonymous && !buffer) throw new TypeError("In-memory/temporary databases cannot be readonly");
+      if (!Number.isInteger(timeout) || timeout < 0) throw new TypeError('Expected the "timeout" option to be a positive integer');
+      if (timeout > 2147483647) throw new RangeError('Option "timeout" cannot be greater than 2147483647');
+      if (verbose != null && typeof verbose !== "function") throw new TypeError('Expected the "verbose" option to be a function');
+      if (nativeBinding != null && typeof nativeBinding !== "string" && typeof nativeBinding !== "object") throw new TypeError('Expected the "nativeBinding" option to be a string or addon object');
+      let addon;
+      if (nativeBinding == null) {
+        addon = DEFAULT_ADDON || (DEFAULT_ADDON = require_bindings()("better_sqlite3.node"));
+      } else if (typeof nativeBinding === "string") {
+        const requireFunc = typeof __non_webpack_require__ === "function" ? __non_webpack_require__ : __require;
+        addon = requireFunc(path3.resolve(nativeBinding).replace(/(\.node)?$/, ".node"));
+      } else {
+        addon = nativeBinding;
+      }
+      if (!addon.isInitialized) {
+        addon.setErrorConstructor(SqliteError);
+        addon.isInitialized = true;
+      }
+      if (!anonymous && !fs4.existsSync(path3.dirname(filename))) {
+        throw new TypeError("Cannot open database because the directory does not exist");
+      }
+      Object.defineProperties(this, {
+        [util.cppdb]: { value: new addon.Database(filename, filenameGiven, anonymous, readonly, fileMustExist, timeout, verbose || null, buffer || null) },
+        ...wrappers.getters
+      });
+    }
+    var wrappers = require_wrappers();
+    Database.prototype.prepare = wrappers.prepare;
+    Database.prototype.transaction = require_transaction();
+    Database.prototype.pragma = require_pragma();
+    Database.prototype.backup = require_backup();
+    Database.prototype.serialize = require_serialize();
+    Database.prototype.function = require_function();
+    Database.prototype.aggregate = require_aggregate();
+    Database.prototype.table = require_table();
+    Database.prototype.loadExtension = wrappers.loadExtension;
+    Database.prototype.exec = wrappers.exec;
+    Database.prototype.close = wrappers.close;
+    Database.prototype.defaultSafeIntegers = wrappers.defaultSafeIntegers;
+    Database.prototype.unsafeMode = wrappers.unsafeMode;
+    Database.prototype[util.inspect] = require_inspect();
+    module.exports = Database;
+  }
+});
+
+// node_modules/better-sqlite3/lib/index.js
+var require_lib = __commonJS({
+  "node_modules/better-sqlite3/lib/index.js"(exports, module) {
+    "use strict";
+    init_esm_shims();
+    module.exports = require_database();
+    module.exports.SqliteError = require_sqlite_error();
+  }
+});
+
+// src/server.ts
+init_esm_shims();
+import { Hono as Hono2 } from "hono";
+import { cors } from "hono/cors";
+import { logger } from "hono/logger";
+import net from "net";
+
+// src/routes.ts
+init_esm_shims();
+
+// src/models.ts
+init_esm_shims();
+import { z } from "zod";
+
+// src/package-json.ts
+init_esm_shims();
+import { createRequire } from "module";
+var require2 = createRequire(import.meta.url);
+var pkg = require2("../package.json");
+var version = pkg.version;
+
+// src/models.ts
+var ActionItemSchema = z.object({
+  action_type: z.string().describe("Action type, e.g. bash, file_read, file_write"),
+  action_detail: z.string().describe("Action detail / command content")
+});
+var AnalyzeRequestSchema = z.object({
+  session_id: z.string().describe("Session / agent unique identifier"),
+  prompt_session: z.string().default("").describe("User original prompt"),
+  action_history: z.array(ActionItemSchema).default([]).describe("Historical action sequence"),
+  a_next: ActionItemSchema.describe("Next action to be executed"),
+  reason: z.string().default("").describe("Reason for executing this action"),
+  os_type: z.string().default("").describe("OS type: 'linux', 'windows', or empty for auto-detect"),
+  cwd: z.string().default("").describe("Current working directory"),
+  agent_id: z.string().default("").describe("Caller agent identifier, e.g. 'xiaoo' / 'opencode' / 'opendesk'. Empty = generic mode (no agent-specific rules)."),
+  metadata: z.record(z.unknown()).optional().describe("Extended metadata")
+});
+var AnalyzeResponseSchema = z.object({
+  decision: z.enum(["Allow", "Deny"]).describe("Allow or Deny"),
+  reason: z.string().describe("Decision reason"),
+  risk_level: z.enum(["low", "medium", "high", "critical"]).default("low"),
+  risk_type: z.string().default(""),
+  violated_layers: z.array(z.string()).default([]),
+  policy: z.string().default(""),
+  violated_policy: z.string().default(""),
+  confidence: z.number().int().min(0).max(100).default(100),
+  analysis_duration_ms: z.number().default(0)
+});
+var HealthResponseSchema = z.object({
+  status: z.string().default("healthy"),
+  version: z.string().default(version)
+});
+
+// src/engine/coordinator.ts
+init_esm_shims();
+init_heuristic();
+init_logic_rules();
+init_inline_analyzer();
+
+// src/engine/llm-analyzer.ts
+init_esm_shims();
+init_config();
+init_skill_loader();
+
+// src/engine/template-loader.ts
+init_esm_shims();
+import { readFileSync as readFileSync3, existsSync as existsSync4 } from "fs";
+import { resolve as resolve3, dirname as dirname3 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
+var __filename4 = fileURLToPath4(import.meta.url);
+var __dirname4 = dirname3(__filename4);
+var TEMPLATES_DIR = resolve3(__dirname4, "../templates");
+var TEMPLATES_DIR_FALLBACK = resolve3(__dirname4, "../../../agent_moss/templates");
+var TEMPLATE_FILES = ["prompt1_template.txt", "prompt2_template.txt", "security_judge_template.txt"];
+var cachedTemplates = null;
+function loadTemplates() {
+  if (cachedTemplates) return cachedTemplates;
+  cachedTemplates = {};
+  const dir = existsSync4(TEMPLATES_DIR) ? TEMPLATES_DIR : TEMPLATES_DIR_FALLBACK;
+  if (!existsSync4(dir)) {
+    console.warn("[AgentMoss] Templates directory not found:", TEMPLATES_DIR, "and fallback:", TEMPLATES_DIR_FALLBACK);
+    return cachedTemplates;
+  }
+  for (const file of TEMPLATE_FILES) {
+    const filePath = resolve3(dir, file);
+    if (existsSync4(filePath)) {
+      const key = file.replace(".txt", "").replace("_template", "");
+      cachedTemplates[key] = readFileSync3(filePath, "utf-8");
+    }
+  }
+  console.log(`[AgentMoss] Loaded ${Object.keys(cachedTemplates).length} templates from ${dir}`);
+  return cachedTemplates;
+}
+
+// src/engine/script-analyzer.ts
+init_esm_shims();
+import { readFileSync as readFileSync4 } from "fs";
+import { resolve as resolve4, join } from "path";
+var SUSPICIOUS_PATTERNS = [
+  // Network exfiltration (curl/wget POST in scripts is almost never legitimate)
+  { name: "curl POST", pattern: /curl\s+(.*\s)?-X\s+POST/i },
+  { name: "curl --data", pattern: /curl\s+(.*\s)?--data/i },
+  { name: "curl -d", pattern: /curl\s+(.*\s)?-d\s/i },
+  { name: "wget --post-data", pattern: /wget\s+(.*\s)?--post-data/i },
+  { name: "wget --post-file", pattern: /wget\s+(.*\s)?--post-file/i },
+  // Reverse shell
+  { name: "nc -e", pattern: /\bnc\s+.*-e\b/ },
+  { name: "ncat -e", pattern: /\bncat\s+.*-e\b/ },
+  { name: "/dev/tcp", pattern: /\/dev\/tcp\// },
+  { name: "/dev/udp", pattern: /\/dev\/udp\// },
+  // Base64 obfuscation
+  { name: "$(base64", pattern: /\$\(\s*base64/ },
+  { name: "`base64", pattern: /`\s*base64/ },
+  { name: "base64 decode pipe", pattern: /base64\s+(-d|--decode)\s*\|/ },
+  // Sensitive file access
+  { name: "/etc/shadow", pattern: /\/etc\/shadow/ },
+  { name: "id_rsa", pattern: /\bid_rsa\b/ },
+  { name: "id_ed25519", pattern: /\bid_ed25519\b/ },
+  // Persistence backdoor
+  { name: "crontab install", pattern: /crontab\s+-/ },
+  { name: "authorized_keys", pattern: /authorized_keys/ },
+  { name: "ssh no host key check", pattern: /ssh\s+.*StrictHostKeyChecking\s*=\s*no/ }
+];
+var SCRIPT_EXEC_PATTERNS = [
+  /bash\s+(\S+\.sh)/,
+  /sh\s+(\S+\.sh)/,
+  /\.\/(\S+\.sh)/,
+  /source\s+(\S+\.sh)/,
+  /\.\s+(\S+\.sh)/,
+  /zsh\s+(\S+\.sh)/
+];
+var KEYWORD_COMBINATION_RISKS = [
+  {
+    group1: /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]),
+    group2: /* @__PURE__ */ new Set(["$(base64", "`base64", "base64 decode pipe"]),
+    level: "critical",
+    reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + Base64\u7F16\u7801\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u6570\u636E\u5916\u4F20\u98CE\u9669\u3002\u653B\u51FB\u8005\u53EF\u80FD\u5C06\u654F\u611F\u6570\u636E\u7F16\u7801\u540E\u5916\u4F20\u3002"
+  },
+  {
+    group1: /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]),
+    group2: /* @__PURE__ */ new Set(["/etc/shadow", "id_rsa", "id_ed25519"]),
+    level: "critical",
+    reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + \u654F\u611F\u6587\u4EF6\u8BBF\u95EE\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u51ED\u8BC1\u5916\u4F20\u98CE\u9669\u3002"
+  },
+  {
+    group1: /* @__PURE__ */ new Set(["nc -e", "ncat -e", "/dev/tcp", "/dev/udp"]),
+    group2: /* @__PURE__ */ new Set(),
+    level: "high",
+    reason: "\u68C0\u6D4B\u5230\u53CD\u5F39 Shell \u7279\u5F81\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5EFA\u7ACB\u8FDC\u7A0B\u63A7\u5236\u901A\u9053\u3002"
+  },
+  {
+    group1: /* @__PURE__ */ new Set(["crontab install", "authorized_keys", "ssh no host key check"]),
+    group2: /* @__PURE__ */ new Set(),
+    level: "high",
+    reason: "\u68C0\u6D4B\u5230\u6301\u4E45\u5316\u540E\u95E8\u7279\u5F81\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5728\u7CFB\u7EDF\u4E2D\u690D\u5165\u540E\u95E8\u3002"
+  }
+];
+var SINGLE_KEYWORD_RISKS = {
+  "curl POST": { level: "high", reason: "\u68C0\u6D4B\u5230 curl POST \u8BF7\u6C42\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+  "curl --data": { level: "high", reason: "\u68C0\u6D4B\u5230 curl --data \u53C2\u6570\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+  "curl -d": { level: "high", reason: "\u68C0\u6D4B\u5230 curl -d \u53C2\u6570\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+  "wget --post-data": { level: "high", reason: "\u68C0\u6D4B\u5230 wget POST \u8BF7\u6C42\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+  "wget --post-file": { level: "high", reason: "\u68C0\u6D4B\u5230 wget \u6587\u4EF6\u4E0A\u4F20\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6587\u4EF6\u3002" },
+  "nc -e": { level: "critical", reason: "\u68C0\u6D4B\u5230 nc -e \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+  "ncat -e": { level: "critical", reason: "\u68C0\u6D4B\u5230 ncat -e \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+  "/dev/tcp": { level: "critical", reason: "\u68C0\u6D4B\u5230 /dev/tcp \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+  "/dev/udp": { level: "critical", reason: "\u68C0\u6D4B\u5230 /dev/udp \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+  "$(base64": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u7F16\u7801\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
+  "`base64": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u7F16\u7801\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
+  "base64 decode pipe": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u89E3\u7801\u540E\u7BA1\u9053\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
+  "/etc/shadow": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6\u3002" },
+  "id_rsa": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE SSH \u79C1\u94A5\u3002" },
+  "id_ed25519": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE SSH \u79C1\u94A5\u3002" },
+  "crontab install": { level: "high", reason: "\u68C0\u6D4B\u5230\u4FEE\u6539\u5B9A\u65F6\u4EFB\u52A1\uFF0C\u53EF\u80FD\u662F\u6301\u4E45\u5316\u540E\u95E8\u3002" },
+  "authorized_keys": { level: "high", reason: "\u68C0\u6D4B\u5230\u4FEE\u6539 SSH \u6388\u6743\u5BC6\u94A5\uFF0C\u53EF\u80FD\u662F\u6301\u4E45\u5316\u540E\u95E8\u3002" },
+  "ssh no host key check": { level: "high", reason: "\u68C0\u6D4B\u5230 SSH \u8DF3\u8FC7\u4E3B\u673A\u5BC6\u94A5\u9A8C\u8BC1\uFF0C\u53EF\u80FD\u662F\u6A2A\u5411\u79FB\u52A8\u3002" }
+};
+var LEVEL_ORDER = { low: 1, medium: 2, high: 3, critical: 4 };
+function emptyResult() {
+  return { scriptPath: "", scriptContent: "", matchedKeywords: [], lineCount: 0, isSuspicious: false, error: "", riskLevel: "", riskReason: "" };
+}
+function extractScriptPath(command) {
+  for (const pattern of SCRIPT_EXEC_PATTERNS) {
+    const m = command.match(pattern);
+    if (m) return m[1];
+  }
+  return null;
+}
+function scanScriptForKeywords(content) {
+  const matched = [];
+  for (const { name, pattern } of SUSPICIOUS_PATTERNS) {
+    if (pattern.test(content)) matched.push(name);
+  }
+  return matched;
+}
+function assessKeywordCombinationRisk(matchedKeywords, scriptContent) {
+  if (matchedKeywords.length === 0) return { level: "", reason: "" };
+  const keywordSet = new Set(matchedKeywords);
+  for (const rule of KEYWORD_COMBINATION_RISKS) {
+    const hitGroup1 = [...rule.group1].some((k) => keywordSet.has(k));
+    const hitGroup2 = rule.group2.size === 0 ? true : [...rule.group2].some((k) => keywordSet.has(k));
+    if (hitGroup1 && hitGroup2) return { level: rule.level, reason: rule.reason };
+  }
+  const networkPostKeywords = /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]);
+  const hasNetworkPost = [...networkPostKeywords].some((k) => keywordSet.has(k));
+  if (hasNetworkPost) {
+    const envPatterns = ["$env", "$(env)", "$USER", "$(hostname)", "$(pwd)", "$HOME"];
+    const contentLower = scriptContent.toLowerCase();
+    for (const p of envPatterns) {
+      if (contentLower.includes(p.toLowerCase())) {
+        return {
+          level: "critical",
+          reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + \u7CFB\u7EDF\u73AF\u5883\u53D8\u91CF\u6536\u96C6\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u6570\u636E\u5916\u4F20\u98CE\u9669\u3002\u811A\u672C\u53EF\u80FD\u5C06\u7528\u6237\u73AF\u5883\u53D8\u91CF\uFF08\u53EF\u80FD\u5305\u542B API Key\u3001\u5BC6\u94A5\u7B49\u654F\u611F\u4FE1\u606F\uFF09\u53D1\u9001\u5230\u8FDC\u7A0B\u670D\u52A1\u5668\u3002"
+        };
+      }
+    }
+  }
+  let bestLevel = "";
+  let bestReason = "";
+  for (const kw of matchedKeywords) {
+    const risk = SINGLE_KEYWORD_RISKS[kw];
+    if (risk && (LEVEL_ORDER[risk.level] || 0) > (LEVEL_ORDER[bestLevel] || 0)) {
+      bestLevel = risk.level;
+      bestReason = risk.reason;
+    }
+  }
+  return { level: bestLevel, reason: bestReason };
+}
+function readScriptContent(scriptPath, maxLines = 500) {
+  try {
+    const expandedPath = scriptPath.startsWith("~") ? join(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve4(scriptPath);
+    const raw = readFileSync4(expandedPath, "utf-8");
+    const lines = raw.split("\n").slice(0, maxLines);
+    return { content: lines.join("\n"), lineCount: lines.length, error: "" };
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    return { content: "", lineCount: 0, error: `\u8BFB\u53D6\u811A\u672C\u5931\u8D25: ${msg}` };
+  }
+}
+function analyzeScriptContent(actionType, actionDetail, maxLines = 500) {
+  if (actionType.toLowerCase() !== "bash") return emptyResult();
+  const scriptPath = extractScriptPath(actionDetail);
+  if (!scriptPath) return emptyResult();
+  const { content, lineCount, error } = readScriptContent(scriptPath, maxLines);
+  if (error) return { ...emptyResult(), scriptPath, error };
+  const matchedKeywords = scanScriptForKeywords(content);
+  const isSuspicious = matchedKeywords.length > 0;
+  let riskLevel = "";
+  let riskReason = "";
+  if (isSuspicious) {
+    const risk = assessKeywordCombinationRisk(matchedKeywords, content);
+    riskLevel = risk.level;
+    riskReason = risk.reason;
+  }
+  return { scriptPath, scriptContent: content, matchedKeywords, lineCount, isSuspicious, error: "", riskLevel, riskReason };
+}
+function formatScriptAnalysisForPrompt(result) {
+  if (!result.scriptPath) return "";
+  if (result.error) return `\u811A\u672C\u5185\u5BB9\u5206\u6790\u5931\u8D25: ${result.error}`;
+  if (!result.isSuspicious) return "";
+  const keywordsStr = result.matchedKeywords.join(", ");
+  let riskHint = "";
+  if (result.riskLevel && result.riskReason) {
+    riskHint = `
+
+\u98CE\u9669\u8BC4\u4F30: ${result.riskLevel.toUpperCase()} \u7EA7\u522B
+\u98CE\u9669\u539F\u56E0: ${result.riskReason}
+\u5EFA\u8BAE: \u6B64\u811A\u672C\u5E94\u88AB\u62D2\u7EDD\uFF08Deny\uFF09\uFF0C\u9664\u975E\u6709\u660E\u786E\u7684\u4E1A\u52A1\u9700\u6C42\u4E14\u5DF2\u786E\u8BA4\u76EE\u6807\u670D\u52A1\u5668\u53EF\u4FE1\u3002`;
+  }
+  return `\u68C0\u6D4B\u5230\u811A\u672C\u6267\u884C\uFF0C\u4E14\u811A\u672C\u5185\u5BB9\u5305\u542B\u53EF\u7591\u5173\u952E\u8BCD:
+   \u811A\u672C\u8DEF\u5F84: ${result.scriptPath}
+   \u53EF\u7591\u5173\u952E\u8BCD: ${keywordsStr}
+   \u811A\u672C\u884C\u6570: ${result.lineCount}${riskHint}
+
+### \u811A\u672C\u5185\u5BB9 ###
+\`\`\`
+${result.scriptContent}
+\`\`\`
+`;
+}
+
+// src/engine/script-content-analyzer.ts
+init_esm_shims();
+init_heuristic();
+init_logic_rules();
+import { readFileSync as readFileSync5, statSync, existsSync as existsSync5 } from "fs";
+import { resolve as resolve5, join as join2, isAbsolute, dirname as dirname4 } from "path";
+import { homedir } from "os";
+function emptyChain() {
+  return {
+    nodes: [],
+    entryPath: "",
+    maxDepthReached: false,
+    maxSizeReached: false,
+    totalSize: 0,
+    totalLines: 0,
+    hasCritical: false,
+    hasHigh: false,
+    firstHitNode: null,
+    error: ""
+  };
+}
+function newNode(path3, depth) {
+  return {
+    scriptPath: path3,
+    rawContent: "",
+    preprocessedContent: "",
+    lineCount: 0,
+    fileSize: 0,
+    depth,
+    childPaths: [],
+    error: "",
+    l1Hit: false,
+    l1RiskLevel: "",
+    l1RiskType: "",
+    l1Reason: "",
+    l1MatchedPatterns: [],
+    l2Hit: false,
+    l2ViolatedRule: "",
+    l2RiskLevel: "",
+    l2RiskType: "",
+    l2Reason: "",
+    matchedKeywords: [],
+    isSuspicious: false,
+    keywordRiskLevel: "",
+    keywordRiskReason: ""
+  };
+}
+function stripComments(content) {
+  return content.split("\n").filter((line) => !line.trimStart().startsWith("#")).join("\n");
+}
+function stripOutputText(content) {
+  let result = content.replace(/echo\s+".*?"/gs, 'echo ""');
+  result = result.replace(/echo\s+'.*?'/gs, "echo ''");
+  result = result.replace(/printf\s+".*?"[^\n]*/gs, 'printf ""');
+  result = result.replace(/printf\s+'.*?'[^\n]*/gs, "printf ''");
+  return result;
+}
+function expandSimpleVariables(content) {
+  const varMap = {};
+  const assignmentRe = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.+)$/;
+  const collectAssignments = (text) => {
+    for (const line of text.split("\n")) {
+      const m = line.match(assignmentRe);
+      if (m) {
+        const varName = m[1];
+        let varVal = m[2].trim();
+        if (varVal && !varVal.includes("$") && !varVal.includes("`")) {
+          if (varVal.startsWith('"') && varVal.endsWith('"') || varVal.startsWith("'") && varVal.endsWith("'")) {
+            varVal = varVal.slice(1, -1);
+          }
+          varMap[varName] = varVal;
+        }
+      }
+    }
+  };
+  collectAssignments(content);
+  let expanded = content;
+  for (let round = 0; round < 3; round++) {
+    const sortedVars = Object.keys(varMap).sort((a, b) => b.length - a.length);
+    let newExpanded = expanded;
+    for (const v of sortedVars) {
+      const val = varMap[v];
+      newExpanded = newExpanded.split("${" + v + "}").join(val);
+      newExpanded = newExpanded.split("$" + v).join(val);
+    }
+    if (newExpanded === expanded) break;
+    expanded = newExpanded;
+    collectAssignments(expanded);
+  }
+  return expanded;
+}
+function preprocessScriptContent(content) {
+  let result = stripComments(content);
+  result = stripOutputText(result);
+  result = expandSimpleVariables(result);
+  return result;
+}
+var SUSPICIOUS_PATTERNS2 = [
+  { name: "curl POST", pattern: /curl\s+(.*\s)?-X\s+POST/i },
+  { name: "curl --data", pattern: /curl\s+(.*\s)?--data/i },
+  { name: "curl -d", pattern: /curl\s+(.*\s)?-d\s/i },
+  { name: "wget --post-data", pattern: /wget\s+(.*\s)?--post-data/i },
+  { name: "wget --post-file", pattern: /wget\s+(.*\s)?--post-file/i },
+  { name: "nc -e", pattern: /\bnc\s+.*-e\b/ },
+  { name: "ncat -e", pattern: /\bncat\s+.*-e\b/ },
+  { name: "/dev/tcp", pattern: /\/dev\/tcp\// },
+  { name: "/dev/udp", pattern: /\/dev\/udp\// },
+  { name: "$(base64", pattern: /\$\(\s*base64/ },
+  { name: "`base64", pattern: /`\s*base64/ },
+  { name: "base64 decode pipe", pattern: /base64\s+(-d|--decode)\s*\|/ },
+  { name: "/etc/shadow", pattern: /\/etc\/shadow/ },
+  { name: "id_rsa", pattern: /\bid_rsa\b/ },
+  { name: "id_ed25519", pattern: /\bid_ed25519\b/ },
+  { name: "crontab install", pattern: /crontab\s+-/ },
+  { name: "authorized_keys", pattern: /authorized_keys/ },
+  { name: "ssh no host key check", pattern: /ssh\s+.*StrictHostKeyChecking\s*=\s*no/ }
+];
+var SCRIPT_EXEC_PATTERNS2 = [
+  /(?:^|\s|&&|\|\|)\s*bash\s+(\S+)/i,
+  /(?:^|\s|&&|\|\|)\s*\/bin\/bash\s+(\S+)/i,
+  /(?:^|\s|&&|\|\|)\s*sh\s+(\S+)/i,
+  /(?:^|\s|&&|\|\|)\s*zsh\s+(\S+)/i,
+  /\.\/(\S+)/,
+  /(?:^|\s|&&|\|\|)\s*source\s+(\S+)/i,
+  /(?:^|\s|&&|\|\|)\s*\.\s+(\S+)/,
+  /(?:^|\s|&&|\|\|)\s*python3?\s+(\S+\.py)/i,
+  /(?:^|\s|&&|\|\|)\s*node\s+(\S+\.js)/i,
+  /(?:^|\s|&&|\|\|)\s*ruby\s+(\S+\.rb)/i,
+  /(?:^|\s|&&|\|\|)\s*perl\s+(\S+\.pl)/i,
+  /(?:^|\s|&&|\|\|)\s*php\s+(\S+\.php)/i,
+  /(?:^|\s|&&|\|\|)\s*lua\s+(\S+\.lua)/i
+];
+var KEYWORD_COMBINATION_RISKS2 = [
+  {
+    group1: /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]),
+    group2: /* @__PURE__ */ new Set(["$(base64", "`base64", "base64 decode pipe"]),
+    level: "critical",
+    reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + Base64\u7F16\u7801\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u6570\u636E\u5916\u4F20\u98CE\u9669\u3002\u653B\u51FB\u8005\u53EF\u80FD\u5C06\u654F\u611F\u6570\u636E\u7F16\u7801\u540E\u5916\u4F20\u3002"
+  },
+  {
+    group1: /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]),
+    group2: /* @__PURE__ */ new Set(["/etc/shadow", "id_rsa", "id_ed25519"]),
+    level: "critical",
+    reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + \u654F\u611F\u6587\u4EF6\u8BBF\u95EE\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u51ED\u8BC1\u5916\u4F20\u98CE\u9669\u3002"
+  },
+  {
+    group1: /* @__PURE__ */ new Set(["nc -e", "ncat -e", "/dev/tcp", "/dev/udp"]),
+    group2: /* @__PURE__ */ new Set(),
+    level: "high",
+    reason: "\u68C0\u6D4B\u5230\u53CD\u5F39 Shell \u7279\u5F81\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5EFA\u7ACB\u8FDC\u7A0B\u63A7\u5236\u901A\u9053\u3002"
+  },
+  {
+    group1: /* @__PURE__ */ new Set(["crontab install", "authorized_keys", "ssh no host key check"]),
+    group2: /* @__PURE__ */ new Set(),
+    level: "high",
+    reason: "\u68C0\u6D4B\u5230\u6301\u4E45\u5316\u540E\u95E8\u7279\u5F81\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5728\u7CFB\u7EDF\u4E2D\u690D\u5165\u540E\u95E8\u3002"
+  }
+];
+var SINGLE_KEYWORD_RISKS2 = {
+  "curl POST": { level: "high", reason: "\u68C0\u6D4B\u5230 curl POST \u8BF7\u6C42\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+  "curl --data": { level: "high", reason: "\u68C0\u6D4B\u5230 curl --data \u53C2\u6570\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+  "curl -d": { level: "high", reason: "\u68C0\u6D4B\u5230 curl -d \u53C2\u6570\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+  "wget --post-data": { level: "high", reason: "\u68C0\u6D4B\u5230 wget POST \u8BF7\u6C42\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+  "wget --post-file": { level: "high", reason: "\u68C0\u6D4B\u5230 wget \u6587\u4EF6\u4E0A\u4F20\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6587\u4EF6\u3002" },
+  "nc -e": { level: "critical", reason: "\u68C0\u6D4B\u5230 nc -e \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+  "ncat -e": { level: "critical", reason: "\u68C0\u6D4B\u5230 ncat -e \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+  "/dev/tcp": { level: "critical", reason: "\u68C0\u6D4B\u5230 /dev/tcp \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+  "/dev/udp": { level: "critical", reason: "\u68C0\u6D4B\u5230 /dev/udp \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+  "$(base64": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u7F16\u7801\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
+  "`base64": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u7F16\u7801\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
+  "base64 decode pipe": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u89E3\u7801\u540E\u7BA1\u9053\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
+  "/etc/shadow": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6\u3002" },
+  "id_rsa": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE SSH \u79C1\u94A5\u3002" },
+  "id_ed25519": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE SSH \u79C1\u94A5\u3002" },
+  "crontab install": { level: "high", reason: "\u68C0\u6D4B\u5230\u4FEE\u6539\u5B9A\u65F6\u4EFB\u52A1\uFF0C\u53EF\u80FD\u662F\u6301\u4E45\u5316\u540E\u95E8\u3002" },
+  "authorized_keys": { level: "high", reason: "\u68C0\u6D4B\u5230\u4FEE\u6539 SSH \u6388\u6743\u5BC6\u94A5\uFF0C\u53EF\u80FD\u662F\u6301\u4E45\u5316\u540E\u95E8\u3002" },
+  "ssh no host key check": { level: "high", reason: "\u68C0\u6D4B\u5230 SSH \u8DF3\u8FC7\u4E3B\u673A\u5BC6\u94A5\u9A8C\u8BC1\uFF0C\u53EF\u80FD\u662F\u6A2A\u5411\u79FB\u52A8\u3002" }
+};
+var LEVEL_ORDER2 = { low: 1, medium: 2, high: 3, critical: 4 };
+function scanScriptForKeywords2(content) {
+  const matched = [];
+  for (const { name, pattern } of SUSPICIOUS_PATTERNS2) {
+    if (pattern.test(content)) matched.push(name);
+  }
+  return matched;
+}
+function assessKeywordCombinationRisk2(matchedKeywords, scriptContent) {
+  if (matchedKeywords.length === 0) return { level: "", reason: "" };
+  const keywordSet = new Set(matchedKeywords);
+  for (const rule of KEYWORD_COMBINATION_RISKS2) {
+    const hitGroup1 = [...rule.group1].some((k) => keywordSet.has(k));
+    const hitGroup2 = rule.group2.size === 0 ? true : [...rule.group2].some((k) => keywordSet.has(k));
+    if (hitGroup1 && hitGroup2) return { level: rule.level, reason: rule.reason };
+  }
+  const networkPostKeywords = /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]);
+  const hasNetworkPost = [...networkPostKeywords].some((k) => keywordSet.has(k));
+  if (hasNetworkPost) {
+    const envPatterns = ["$env", "$(env)", "$USER", "$(hostname)", "$(pwd)", "$HOME"];
+    const contentLower = scriptContent.toLowerCase();
+    for (const p of envPatterns) {
+      if (contentLower.includes(p.toLowerCase())) {
+        return {
+          level: "critical",
+          reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + \u7CFB\u7EDF\u73AF\u5883\u53D8\u91CF\u6536\u96C6\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u6570\u636E\u5916\u4F20\u98CE\u9669\u3002\u811A\u672C\u53EF\u80FD\u5C06\u7528\u6237\u73AF\u5883\u53D8\u91CF\uFF08\u53EF\u80FD\u5305\u542B API Key\u3001\u5BC6\u94A5\u7B49\u654F\u611F\u4FE1\u606F\uFF09\u53D1\u9001\u5230\u8FDC\u7A0B\u670D\u52A1\u5668\u3002"
+        };
+      }
+    }
+  }
+  let bestLevel = "";
+  let bestReason = "";
+  for (const kw of matchedKeywords) {
+    const risk = SINGLE_KEYWORD_RISKS2[kw];
+    if (risk && (LEVEL_ORDER2[risk.level] || 0) > (LEVEL_ORDER2[bestLevel] || 0)) {
+      bestLevel = risk.level;
+      bestReason = risk.reason;
+    }
+  }
+  return { level: bestLevel, reason: bestReason };
+}
+function extractScriptPath2(command) {
+  for (const pattern of SCRIPT_EXEC_PATTERNS2) {
+    const m = command.match(pattern);
+    if (m) return m[1];
+  }
+  return null;
+}
+function extractInlineScriptPath(actionDetail) {
+  const re = /open\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+  let m;
+  while ((m = re.exec(actionDetail)) !== null) {
+    const p = m[1];
+    let resolved;
+    try {
+      resolved = resolvePath(p);
+      if (existsSync5(resolved)) {
+        const stat = statSync(resolved);
+        if (stat.isFile()) return resolved;
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function resolvePath(p) {
+  let expanded = p;
+  if (expanded.startsWith("~/") || expanded === "~") {
+    expanded = join2(homedir(), expanded.slice(1));
+  }
+  return resolve5(expanded);
+}
+function readScriptContent2(scriptPath, maxFileSize = 2 * 1024 * 1024) {
+  try {
+    const path3 = resolvePath(scriptPath);
+    if (!existsSync5(path3)) return { content: "", lineCount: 0, fileSize: 0, error: `\u811A\u672C\u4E0D\u5B58\u5728: ${scriptPath}` };
+    const stat = statSync(path3);
+    if (!stat.isFile()) return { content: "", lineCount: 0, fileSize: 0, error: `\u4E0D\u662F\u6587\u4EF6: ${scriptPath}` };
+    if (stat.size > maxFileSize) {
+      return { content: "", lineCount: 0, fileSize: stat.size, error: `\u811A\u672C\u6587\u4EF6\u8FC7\u5927 (${stat.size} bytes)\uFF0C\u8DF3\u8FC7\u8BFB\u53D6` };
+    }
+    const content = readFileSync5(path3, "utf-8");
+    const lineCount = content ? content.split("\n").length : 0;
+    return { content, lineCount, fileSize: stat.size, error: "" };
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    return { content: "", lineCount: 0, fileSize: 0, error: `\u8BFB\u53D6\u811A\u672C\u5931\u8D25: ${msg}` };
+  }
+}
+function extractChildScriptPaths(content, baseDir) {
+  const paths = [];
+  for (const pattern of CHILD_SCRIPT_PATTERNS) {
+    pattern.lastIndex = 0;
+    let m;
+    while ((m = pattern.exec(content)) !== null) {
+      const pathStr = m[1];
+      if (pathStr.startsWith("-") || pathStr.startsWith("$")) continue;
+      if (pathStr.includes("/dev/") || pathStr.startsWith("|") || pathStr.startsWith(";")) continue;
+      const full = isAbsolute(pathStr) ? pathStr : join2(baseDir, pathStr);
+      const resolved = resolvePath(full);
+      if (existsSync5(resolved)) {
+        try {
+          if (statSync(resolved).isFile() && !paths.includes(resolved)) paths.push(resolved);
+        } catch {
+        }
+      }
+    }
+  }
+  return paths;
+}
+function resolveScriptChain(entryPath, input, maxDepth = 3, maxFileSize = 2 * 1024 * 1024, maxTotalSize = 6 * 1024 * 1024) {
+  const visited = /* @__PURE__ */ new Set();
+  const result = emptyChain();
+  result.entryPath = entryPath;
+  const entry = resolvePath(entryPath);
+  const baseDir = existsSync5(entry) ? dirname4(entry) : input.cwd || process.cwd();
+  resolveRecursive({
+    path: entry,
+    depth: 0,
+    maxDepth,
+    maxFileSize,
+    maxTotalSize,
+    visited,
+    result,
+    baseDir,
+    input
+  });
+  result.hasCritical = result.nodes.some((n) => n.l1RiskLevel === "critical" || n.l2RiskLevel === "critical" || n.keywordRiskLevel === "critical");
+  result.hasHigh = result.nodes.some((n) => ["high", "critical"].includes(n.l1RiskLevel) || ["high", "critical"].includes(n.l2RiskLevel) || ["high", "critical"].includes(n.keywordRiskLevel));
+  result.firstHitNode = result.nodes.find((n) => n.l1Hit || n.l2Hit || n.isSuspicious) || null;
+  return result;
+}
+function resolveRecursive(ctx) {
+  const { path: path3, depth, maxDepth, maxFileSize, maxTotalSize, visited, result, baseDir, input } = ctx;
+  if (visited.has(path3)) return;
+  if (depth > maxDepth) {
+    result.maxDepthReached = true;
+    return;
+  }
+  if (result.totalSize >= maxTotalSize) {
+    result.maxSizeReached = true;
+    return;
+  }
+  visited.add(path3);
+  const { content, lineCount, fileSize, error } = readScriptContent2(path3, maxFileSize);
+  if (error) {
+    const node2 = newNode(path3, depth);
+    node2.error = error;
+    node2.fileSize = fileSize;
+    node2.lineCount = lineCount;
+    result.nodes.push(node2);
+    return;
+  }
+  result.totalSize += fileSize;
+  result.totalLines += lineCount;
+  const preprocessed = preprocessScriptContent(content);
+  const node = newNode(path3, depth);
+  node.rawContent = content;
+  node.preprocessedContent = preprocessed;
+  node.lineCount = lineCount;
+  node.fileSize = fileSize;
+  result.nodes.push(node);
+  const virtualInput = {
+    ...input,
+    aNext: { actionType: "bash", actionDetail: preprocessed }
+  };
+  const l1 = runHeuristicCheck(virtualInput);
+  if (l1 && !l1.allowed) {
+    node.l1Hit = true;
+    node.l1RiskLevel = l1.riskLevel;
+    node.l1RiskType = l1.riskType;
+    node.l1Reason = l1.reason;
+    node.l1MatchedPatterns = [];
+    if (l1.riskLevel === "critical") {
+      result.hasCritical = true;
+      result.firstHitNode = node;
+      return;
+    }
+  }
+  const childPaths = extractChildScriptPaths(preprocessed, baseDir);
+  node.childPaths = childPaths;
+  for (const childPath of childPaths) {
+    resolveRecursive({
+      path: resolvePath(childPath),
+      depth: depth + 1,
+      maxDepth,
+      maxFileSize,
+      maxTotalSize,
+      visited,
+      result,
+      baseDir: dirname4(resolvePath(childPath)),
+      input
+    });
+    if (result.hasCritical) return;
+  }
+}
+function scanScriptChainWithL1(chain, input) {
+  for (const node of chain.nodes) {
+    if (node.error || !node.preprocessedContent || node.l1Hit) continue;
+    const virtualInput = {
+      ...input,
+      aNext: { actionType: "bash", actionDetail: node.preprocessedContent }
+    };
+    const l1 = runHeuristicCheck(virtualInput);
+    if (l1 && !l1.allowed) {
+      node.l1Hit = true;
+      node.l1RiskLevel = l1.riskLevel;
+      node.l1RiskType = l1.riskType;
+      node.l1Reason = l1.reason;
+      if (l1.riskLevel === "critical") {
+        chain.hasCritical = true;
+        chain.firstHitNode = node;
+        break;
+      }
+    }
+  }
+  return chain;
+}
+function scanScriptChainWithL2(chain, input) {
+  for (const node of chain.nodes) {
+    if (node.error || !node.preprocessedContent) continue;
+    if (node.l1RiskLevel === "critical") break;
+    const virtualInput = {
+      ...input,
+      aNext: { actionType: "bash", actionDetail: node.preprocessedContent }
+    };
+    const l2 = runLogicCheck(virtualInput);
+    if (l2 && !l2.allowed) {
+      node.l2Hit = true;
+      node.l2ViolatedRule = `script_logic:${node.scriptPath}`;
+      node.l2RiskLevel = l2.riskLevel;
+      node.l2RiskType = l2.riskType;
+      node.l2Reason = `\u811A\u672C ${node.scriptPath} (\u6DF1\u5EA6 ${node.depth}) \u4E2D: ${l2.reason}`;
+      if (l2.riskLevel === "critical") {
+        chain.hasCritical = true;
+        chain.firstHitNode = node;
+        break;
+      }
+    }
+  }
+  if (!chain.hasHigh) {
+    chain.hasHigh = chain.nodes.some((n) => ["high", "critical"].includes(n.l2RiskLevel));
+  }
+  return chain;
+}
+function scanScriptChainKeywords(chain) {
+  for (const node of chain.nodes) {
+    if (node.error || !node.preprocessedContent) continue;
+    if (node.l1Hit || node.l2Hit) continue;
+    const matched = scanScriptForKeywords2(node.preprocessedContent);
+    node.matchedKeywords = matched;
+    node.isSuspicious = matched.length > 0;
+    if (matched.length > 0) {
+      const risk = assessKeywordCombinationRisk2(matched, node.preprocessedContent);
+      node.keywordRiskLevel = risk.level;
+      node.keywordRiskReason = risk.reason;
+    }
+  }
+  return chain;
+}
+function analyzeScriptContent2(input) {
+  const actionType = input.aNext.actionType.toLowerCase();
+  if (actionType !== "bash") return emptyChain();
+  const scriptPath = extractScriptPath2(input.aNext.actionDetail);
+  let resolvedPath = scriptPath;
+  if (!resolvedPath) {
+    const inline = extractInlineScriptPath(input.aNext.actionDetail);
+    if (!inline) return emptyChain();
+    resolvedPath = inline;
+  }
+  const chain = resolveScriptChain(resolvedPath, input);
+  if (chain.nodes.length === 0) return chain;
+  scanScriptChainWithL1(chain, input);
+  scanScriptChainWithL2(chain, input);
+  scanScriptChainKeywords(chain);
+  return chain;
+}
+function formatScriptChainForPrompt(chain) {
+  if (chain.nodes.length === 0) return "";
+  const errorNodes = chain.nodes.filter((n) => n.error);
+  if (errorNodes.length > 0 && chain.nodes.length === 1) {
+    return `\u26A0\uFE0F \u811A\u672C\u5185\u5BB9\u5206\u6790\u5931\u8D25: ${errorNodes[0].error}`;
+  }
+  const suspiciousNodes = chain.nodes.filter((n) => n.isSuspicious && !n.l1Hit && !n.l2Hit);
+  if (suspiciousNodes.length === 0) {
+    const safeNodes = chain.nodes.filter((n) => !n.error);
+    if (safeNodes.length === 0) return "";
+    const parts2 = ["\u2713 \u811A\u672C\u5185\u5BB9\u5DF2\u5206\u6790\uFF0C\u672A\u53D1\u73B0\u5371\u9669/\u53EF\u7591\u64CD\u4F5C\uFF08L1/L2/\u5173\u952E\u8BCD\u626B\u63CF\u5747\u672A\u547D\u4E2D\uFF09\uFF1A"];
+    for (const node of safeNodes) {
+      const pre = node.preprocessedContent || "";
+      let preview = pre.slice(0, 600);
+      if (pre.length > 600) preview += `
+... (\u622A\u65AD\uFF0C\u5B8C\u6574\u5185\u5BB9 ${pre.length} \u5B57\u7B26)`;
+      parts2.push(
+        `   \u811A\u672C\u8DEF\u5F84: ${node.scriptPath}\uFF08\u9012\u5F52\u6DF1\u5EA6 ${node.depth}\uFF0C${node.lineCount} \u884C\uFF09
+   \u5185\u5BB9\uFF08\u9884\u5904\u7406\u540E\uFF09:
+\`\`\`
+${preview}
+\`\`\``
+      );
+    }
+    return parts2.join("\n");
+  }
+  const parts = [];
+  for (const node of suspiciousNodes) {
+    const keywordsStr = node.matchedKeywords.join(", ");
+    let riskHint = "";
+    if (node.keywordRiskLevel && node.keywordRiskReason) {
+      riskHint = `
+
+\u{1F534} **\u98CE\u9669\u8BC4\u4F30**: ${node.keywordRiskLevel.toUpperCase()} \u7EA7\u522B
+**\u98CE\u9669\u539F\u56E0**: ${node.keywordRiskReason}
+**\u5EFA\u8BAE**: \u6B64\u811A\u672C\u5E94\u88AB\u62D2\u7EDD\uFF08Deny\uFF09\uFF0C\u9664\u975E\u6709\u660E\u786E\u7684\u4E1A\u52A1\u9700\u6C42\u4E14\u5DF2\u786E\u8BA4\u76EE\u6807\u670D\u52A1\u5668\u53EF\u4FE1\u3002`;
+    }
+    const pre = node.preprocessedContent;
+    let contentPreview = pre.slice(0, 2e3);
+    if (pre.length > 2e3) contentPreview += `
+... (\u622A\u65AD\uFF0C\u5B8C\u6574\u5185\u5BB9 ${pre.length} \u5B57\u7B26)`;
+    parts.push(
+      `\u26A0\uFE0F \u811A\u672C\u5185\u5BB9\u5305\u542B\u53EF\u7591\u5173\u952E\u8BCD:
+   \u811A\u672C\u8DEF\u5F84: ${node.scriptPath}
+   \u9012\u5F52\u6DF1\u5EA6: ${node.depth}
+   \u53EF\u7591\u5173\u952E\u8BCD: ${keywordsStr}
+   \u811A\u672C\u884C\u6570: ${node.lineCount}${riskHint}
+
+### \u811A\u672C\u5185\u5BB9\uFF08\u9884\u5904\u7406\u540E\uFF09###
+\`\`\`
+${contentPreview}
+\`\`\`
+`
+    );
+  }
+  let header = `\u26A0\uFE0F \u68C0\u6D4B\u5230\u811A\u672C\u6267\u884C\u94FE\uFF08\u5171 ${chain.nodes.length} \u4E2A\u811A\u672C\uFF09\uFF0C\u5176\u4E2D ${suspiciousNodes.length} \u4E2A\u5305\u542B\u53EF\u7591\u5173\u952E\u8BCD:
+`;
+  if (chain.maxDepthReached) header += "\u26A0\uFE0F \u6CE8\u610F\uFF1A\u9012\u5F52\u8FFD\u8E2A\u89E6\u8FBE\u6DF1\u5EA6\u4E0A\u9650\uFF0C\u53EF\u80FD\u5B58\u5728\u66F4\u6DF1\u5C42\u7684\u811A\u672C\u8C03\u7528\u672A\u88AB\u626B\u63CF\u3002\n";
+  if (chain.maxSizeReached) header += "\u26A0\uFE0F \u6CE8\u610F\uFF1A\u7D2F\u8BA1\u6587\u4EF6\u5927\u5C0F\u89E6\u8FBE\u4E0A\u9650\uFF0C\u90E8\u5206\u811A\u672C\u53EF\u80FD\u672A\u88AB\u5B8C\u6574\u8BFB\u53D6\u3002\n";
+  return header + parts.join("\n---\n\n");
+}
+var CHILD_SCRIPT_PATTERNS = [
+  /(?:^|\s|&&|\|\|)\s*bash\s+(\S+)/i,
+  /(?:^|\s|&&|\|\|)\s*sh\s+(\S+)/i,
+  /(?:^|\s|&&|\|\|)\s*source\s+(\S+)/i,
+  /(?:^|\s|&&|\|\|)\s*\.\s+(\S+)/,
+  /(?:^|\s|&&|\|\|)\s*python3?\s+(\S+\.py)/i,
+  /(?:^|\s|&&|\|\|)\s*node\s+(\S+\.js)/i,
+  /(?:^|\s|&&|\|\|)\s*ruby\s+(\S+\.rb)/i,
+  /(?:^|\s|&&|\|\|)\s*perl\s+(\S+\.pl)/i,
+  /(?:^|\s|&&|\|\|)\s*php\s+(\S+\.php)/i,
+  /(?:^|\s|&&|\|\|)\s*lua\s+(\S+\.lua)/i
+];
+
+// src/engine/llm-analyzer.ts
+import { appendFileSync } from "fs";
+import OpenAI from "openai";
+var llmCache = /* @__PURE__ */ new Map();
+var LLM_CACHE_MAX = 200;
+async function runLLMAnalysis(input, previous) {
+  if (!isLLMAvailable()) {
+    console.log("[AgentMoss] LLM not configured, skipping deep analysis");
+    return {
+      allowed: true,
+      reason: "LLM \u672A\u914D\u7F6E\uFF0C\u8DF3\u8FC7\u6DF1\u5C42\u5206\u6790",
+      riskLevel: "low",
+      riskType: "",
+      confidence: 50,
+      source: "llm",
+      violatedLayers: []
+    };
+  }
+  const globalConfig = getLLMConfig();
+  const config = input.llmConfig?.apiKey ? { ...globalConfig, ...input.llmConfig } : globalConfig;
+  const rawDetail = input.aNext.actionDetail.replace(/^terminal-\w+:\s*command=([^,]+).*/, "$1").trim();
+  const cacheKey = `${input.aNext.actionType}:${rawDetail || input.aNext.actionDetail}`;
+  const cached = llmCache.get(cacheKey);
+  if (cached) {
+    console.log("[AgentMoss] LLM cache hit");
+    return cached;
+  }
+  const matchedSkills = matchSkills(input.aNext.actionType, input.aNext.actionDetail, input.reason);
+  const templates = loadTemplates();
+  let scriptAnalysis;
+  let scriptChainText = "";
+  if (previous.scriptChain) {
+    scriptChainText = formatScriptChainForPrompt(previous.scriptChain);
+  } else {
+    scriptAnalysis = analyzeScriptContent(input.aNext.actionType, input.aNext.actionDetail);
+  }
+  const prompt = buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis, previous.skipL3Hints ?? "", scriptChainText);
+  logPrompt(prompt, input.aNext, previous.llmLogPath);
+  const result = await analyzeWithLLM(prompt, config);
+  if (llmCache.size >= LLM_CACHE_MAX) {
+    const firstKey = llmCache.keys().next().value;
+    if (firstKey) llmCache.delete(firstKey);
+  }
+  llmCache.set(cacheKey, result);
+  return result;
+}
+function logPrompt(prompt, aNext, logPath) {
+  if (!logPath) return;
+  try {
+    const actionType = aNext.actionType || "unknown";
+    const actionDetail = (aNext.actionDetail || "").slice(0, 100);
+    const line = `[${(/* @__PURE__ */ new Date()).toISOString()}] [LLM_PROMPT] action_type=${actionType}, action_detail=${actionDetail}... prompt_length=${prompt.length}
+${prompt}
+--- END PROMPT ---
+`;
+    appendFileSync(logPath, line, "utf-8");
+  } catch (e) {
+    console.warn("[AgentMoss] Failed to write LLM prompt to log:", e);
+  }
+}
+function buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis, skipL3Hints = "", scriptChainText = "") {
+  const skillsText = formatSkillsForPrompt(matchedSkills);
+  const historyStr = input.actionHistory.map((h, i) => `${i + 1}. ${h.actionType}: ${h.actionDetail}`).join("\n") || "(\u65E0\u5386\u53F2\u64CD\u4F5C)";
+  const scriptAnalysisText = scriptChainText ? scriptChainText : scriptAnalysis ? formatScriptAnalysisForPrompt(scriptAnalysis) : "";
+  const hintsText = formatHints(previous);
+  const securityJudgeTemplate = templates["security_judge"];
+  if (securityJudgeTemplate) {
+    return securityJudgeTemplate.replaceAll("{prompt_session}", input.promptSession || "\uFF08\u672A\u63D0\u4F9B\uFF09").replaceAll("{action_history}", historyStr).replaceAll("{action_type}", input.aNext.actionType).replaceAll("{action_detail}", input.aNext.actionDetail).replaceAll("{reason}", input.reason || "\u672A\u8BF4\u660E").replaceAll("{skills_text}", skillsText).replaceAll("{hints_text}", hintsText).replaceAll("{script_analysis_text}", scriptAnalysisText).replaceAll("{skip_l3_hints}", skipL3Hints).replaceAll("{{", "{").replaceAll("}}", "}");
+  }
+  console.warn("[AgentMoss] security_judge template missing, using sparse fallback prompt");
+  return `## \u5F53\u524D\u64CD\u4F5C\u4E0A\u4E0B\u6587
+- \u4F1A\u8BDD ID: ${input.sessionId}
+- \u7528\u6237\u4EFB\u52A1: ${input.promptSession || "\u672A\u6307\u5B9A"}
+- \u64CD\u4F5C\u7CFB\u7EDF: ${input.osType}
+- \u5DE5\u4F5C\u76EE\u5F55: ${input.cwd || "/"}
+- \u64CD\u4F5C\u539F\u56E0: ${input.reason || "\u672A\u8BF4\u660E"}
+- \u5386\u53F2\u64CD\u4F5C\u5E8F\u5217:
+${historyStr}
+
+- \u5373\u5C06\u6267\u884C\u7684\u64CD\u4F5C:
+  \u7C7B\u578B: ${input.aNext.actionType}
+  \u8BE6\u60C5: ${input.aNext.actionDetail}
+
+## \u53EF\u7528\u5B89\u5168 Skill
+${skillsText}
+
+## \u524D\u7F6E\u68C0\u6D4B\u7ED3\u679C
+${hintsText}
+${scriptAnalysisText ? `
+## \u811A\u672C\u5185\u5BB9\u5206\u6790
+${scriptAnalysisText}` : ""}
+
+\u8BF7\u6839\u636E\u4EE5\u4E0A\u4FE1\u606F\uFF0C\u5BF9\u5373\u5C06\u6267\u884C\u7684\u64CD\u4F5C\u8FDB\u884C\u5B89\u5168\u5224\u65AD\u3002\u524D\u7F6E\u68C0\u6D4B\u4E3A low/medium \u4E14\u6709\u5408\u7406\u6267\u884C\u7406\u7531\u65F6\u5E94\u5F53\u5141\u8BB8\u3002\u4F60\u5FC5\u987B\u8F93\u51FA\u4E25\u683C\u7684 JSON \u683C\u5F0F\uFF0C\u4E0D\u8981\u5305\u542B\u4EFB\u4F55\u5176\u4ED6\u6587\u5B57\u3001\u6CE8\u91CA\u6216 markdown \u6807\u8BB0\u3002
+
+\u8F93\u51FA\u683C\u5F0F:
+{"allowed": true/false, "reason": "\u5224\u65AD\u7406\u7531", "riskLevel": "low|medium|high|critical", "riskType": "\u98CE\u9669\u7C7B\u578B", "confidence": 0-100}`;
+}
+function formatHints(previous) {
+  const hints = [];
+  if (previous.heuristic) {
+    hints.push(
+      `\u542F\u53D1\u5F0F\u68C0\u6D4B\u53D1\u73B0\u98CE\u9669 [\u98CE\u9669\u7B49\u7EA7: ${previous.heuristic.riskLevel}]:
+   \u7C7B\u578B: ${previous.heuristic.riskType}
+   \u539F\u56E0: ${previous.heuristic.reason}`
+    );
+  }
+  if (previous.logic) {
+    hints.push(
+      `\u903B\u8F91\u89C4\u5219\u68C0\u6D4B\u53D1\u73B0\u98CE\u9669 [\u98CE\u9669\u7B49\u7EA7: ${previous.logic.riskLevel}]:
+   \u7C7B\u578B: ${previous.logic.riskType}
+   \u539F\u56E0: ${previous.logic.reason}`
+    );
+  }
+  return hints.length > 0 ? hints.join("\n\n") : "\u542F\u53D1\u5F0F\u68C0\u6D4B\u548C\u903B\u8F91\u89C4\u5219\u68C0\u6D4B\u5747\u672A\u53D1\u73B0\u98CE\u9669\u3002";
+}
+async function analyzeWithLLM(prompt, config) {
+  console.log(`[AgentMoss] LLM analyzing with model: ${config.model}, url: ${config.baseUrl}`);
+  const provider = detectProvider(config.baseUrl, config.provider);
+  const extraHeaders = getProviderHeaders(provider);
+  if (Object.keys(extraHeaders).length > 0) {
+    console.log(`[AgentMoss] Provider detected: ${provider}, injecting headers: ${Object.keys(extraHeaders).join(", ")}`);
+  }
+  const timeoutCfg = getTimeoutConfig();
+  const retryCfg = getRetryConfig();
+  const client = new OpenAI({
+    baseURL: config.baseUrl,
+    apiKey: config.apiKey,
+    // 单次 LLM 调用超时用 prompt1Timeout（对齐 py）；env 覆盖的 config.timeout 仍向后兼容
+    timeout: (config.timeout || timeoutCfg.prompt1Timeout) * 1e3,
+    defaultHeaders: Object.keys(extraHeaders).length > 0 ? extraHeaders : void 0
+  });
+  const maxRetries = parseInt(process.env.AGENT_MOSS_LLM_RETRIES || String(retryCfg.maxRetries), 10);
+  const totalTimeoutMs = timeoutCfg.totalTimeout * 1e3;
+  const abortController = new AbortController();
+  const totalTimeoutTimer = setTimeout(() => {
+    console.error(`[AgentMoss] totalTimeout (${timeoutCfg.totalTimeout}s) exceeded, aborting all LLM calls`);
+    abortController.abort();
+  }, totalTimeoutMs);
+  for (let attempt = 0; attempt <= maxRetries; attempt++) {
+    if (abortController.signal.aborted) {
+      break;
+    }
+    try {
+      const response = await client.chat.completions.create({
+        model: config.model,
+        temperature: config.temperature || 0.1,
+        max_tokens: config.maxTokens || 1024,
+        messages: [
+          { role: "system", content: "\u53EA\u8F93\u51FA\u7EAF JSON\uFF0C\u4E0D\u8981\u5305\u542B markdown \u6807\u8BB0\u3001\u4EE3\u7801\u5757\u6216\u4EFB\u4F55\u5176\u4ED6\u6587\u5B57\u3002" },
+          { role: "user", content: prompt }
+        ],
+        signal: abortController.signal
+      });
+      const content = response.choices[0]?.message?.content || "{}";
+      console.log(`[AgentMoss] LLM raw response (attempt ${attempt + 1}/${maxRetries + 1}): ${content.substring(0, 300)}`);
+      let jsonStr = content.trim();
+      if (jsonStr.startsWith("```")) {
+        jsonStr = jsonStr.replace(/^```[\w]*\n?/, "").replace(/\n?```$/, "");
+      }
+      const parsed = JSON.parse(jsonStr);
+      try {
+        const usage = response.usage;
+        const { recordTokenUsage: recordTokenUsage2 } = await Promise.resolve().then(() => (init_token_stats(), token_stats_exports));
+        recordTokenUsage2({
+          sessionId: "audit",
+          step: "L3_security_judge",
+          model: response.model || config.model,
+          promptTokens: usage?.prompt_tokens || 0,
+          completionTokens: usage?.completion_tokens || 0,
+          totalTokens: usage?.total_tokens || 0
+        });
+      } catch {
+      }
+      clearTimeout(totalTimeoutTimer);
+      return {
+        allowed: parsed.allowed !== false,
+        reason: parsed.reason || "LLM \u5206\u6790\u5B8C\u6210",
+        riskLevel: ["low", "medium", "high", "critical"].includes(parsed.riskLevel) ? parsed.riskLevel : "low",
+        riskType: parsed.riskType || "",
+        confidence: typeof parsed.confidence === "number" ? Math.min(100, Math.max(0, parsed.confidence)) : 70,
+        source: "llm",
+        violatedLayers: ["3"]
+      };
+    } catch (err) {
+      if (abortController.signal.aborted) {
+        console.error(`[AgentMoss] LLM analysis aborted by totalTimeout (${timeoutCfg.totalTimeout}s)`);
+        break;
+      }
+      if (attempt < maxRetries) {
+        console.error(`[AgentMoss] LLM call failed (attempt ${attempt + 1}/${maxRetries + 1}), retrying in ${retryCfg.retryInterval}s:`, err.message);
+        await new Promise((resolve6) => setTimeout(resolve6, retryCfg.retryInterval * 1e3));
+      } else {
+        clearTimeout(totalTimeoutTimer);
+        console.error("[AgentMoss] LLM call failed after all retries:", err.message);
+        throw new Error(`LLM \u5206\u6790\u5931\u8D25 (${maxRetries + 1} \u6B21\u5C1D\u8BD5): ${err.message}`);
+      }
+    }
+  }
+  clearTimeout(totalTimeoutTimer);
+  throw new Error(`LLM \u5206\u6790\u8D85\u65F6\uFF08totalTimeout ${timeoutCfg.totalTimeout}s\uFF09`);
+}
+
+// src/engine/coordinator.ts
+init_config();
+init_agents();
+var FULLY_SAFE_TOOLS = /* @__PURE__ */ new Set([
+  "ask_user_question",
+  "glob",
+  "list_dir",
+  "ls",
+  "count_text_length",
+  "filemgr-globfiles"
+]);
+var TRUSTED_SKILLS_BASE = /* @__PURE__ */ new Set([]);
+var READONLY_SENSITIVE_TOOLS = /* @__PURE__ */ new Set([
+  "read",
+  "file_read",
+  "read_file",
+  "head",
+  "tail",
+  "grep",
+  "filemgr-readfile",
+  "filemgr-grepfiles"
+]);
+var FULLY_SAFE_BASH_PATTERNS = [
+  /^ls(?:\s|$)/i,
+  /^dir(?:\s|$)/i,
+  /^pwd(?:\s|$)/i,
+  /^which\s+/i,
+  /^whereis\s+/i,
+  /^realpath\s+/i,
+  /^basename\s+/i,
+  /^dirname\s+/i,
+  /^file\s+/i,
+  /^stat\s+/i,
+  /^du(?:\s|$)/i,
+  /^echo\s+/i,
+  /^printf\s+/i,
+  /^type\s+/i,
+  /^command\s+/i,
+  // 系统信息查询（只读，不涉及文件/网络/权限）
+  /^whoami(?:\s|$)/i,
+  /^id(?:\s|$)/i,
+  /^hostname(?:\s|$)/i,
+  /^uname(?:\s|$)/i,
+  /^date(?:\s|$)/i,
+  /^env(?:\s|$)/i,
+  /^printenv(?:\s|$)/i,
+  /^tty(?:\s|$)/i,
+  /^arch(?:\s|$)/i,
+  /^uptime(?:\s|$)/i,
+  /^groups(?:\s|$)/i,
+  /^logname(?:\s|$)/i
+];
+var READONLY_SENSITIVE_BASH_PATTERNS = [
+  /^cat\s+/i,
+  /^head(?:\s|$)/i,
+  /^tail(?:\s|$)/i,
+  /^less(?:\s|$)/i,
+  /^more(?:\s|$)/i,
+  /^wc(?:\s|$)/i,
+  /^grep(?:\s|$)/i,
+  /^find\s+/i,
+  /^ag(?:\s|$)/i,
+  /^rg(?:\s|$)/i,
+  /^awk\s+/i,
+  /^sed\s+/i,
+  /^cut\s+/i,
+  /^sort(?:\s|$)/i,
+  /^uniq(?:\s|$)/i
+];
+function extractFirstCommand(command) {
+  let main = command.split("|")[0].trim();
+  for (const sep of ["&&", "||"]) {
+    const idx = main.indexOf(sep);
+    if (idx !== -1) {
+      main = main.substring(0, idx).trim();
+      break;
+    }
+  }
+  return main;
+}
+function extractRawCommand(detail) {
+  const m = detail.match(/command=([^,]+)/);
+  return m ? m[1].trim() : detail;
+}
+function matchesAny(cmd, patterns) {
+  return patterns.some((p) => p.test(cmd));
+}
+async function runAnalysis(input) {
+  const heuristicResult = isHeuristicEnabled() ? runHeuristicCheck(input) : null;
+  const isInlineScriptCmd = isInlineScriptCommand(input.aNext.actionDetail.toLowerCase());
+  const isLiteralTextCmd = isLiteralTextCommand(input.aNext.actionDetail.toLowerCase());
+  if (heuristicResult && !heuristicResult.allowed) {
+    const skipInlineFileAccess = (isInlineScriptCmd || isLiteralTextCmd) && heuristicResult.riskType === "file_access";
+    if (!skipInlineFileAccess) {
+      return heuristicResult;
+    }
+  }
+  let scriptChain = null;
+  if (input.aNext.actionType.toLowerCase() === "bash") {
+    scriptChain = analyzeScriptContent2(input);
+    if (scriptChain.nodes.length > 0) {
+      for (const node of scriptChain.nodes) {
+        if (node.l1Hit && (node.l1RiskLevel === "high" || node.l1RiskLevel === "critical")) {
+          return {
+            allowed: false,
+            reason: `\u811A\u672C\u5185\u5BB9\u5305\u542B\u5371\u9669\u64CD\u4F5C: ${node.l1Reason} (\u6587\u4EF6: ${node.scriptPath}, \u6DF1\u5EA6: ${node.depth})`,
+            riskLevel: node.l1RiskLevel,
+            riskType: node.l1RiskType,
+            confidence: 90,
+            source: "heuristic_script_scan",
+            violatedLayers: ["1.1-script"]
+          };
+        }
+      }
+    }
+  }
+  const actionType = input.aNext.actionType.toLowerCase();
+  const rawDetail = extractRawCommand(input.aNext.actionDetail);
+  const lowerDetail = rawDetail.toLowerCase();
+  if (FULLY_SAFE_TOOLS.has(actionType)) {
+    return {
+      allowed: true,
+      reason: `\u5B8C\u5168\u5B89\u5168\u5DE5\u5177\uFF0C\u8DF3\u8FC7\u6DF1\u5EA6\u5206\u6790: ${actionType}`,
+      riskLevel: heuristicResult?.riskLevel || "low",
+      riskType: "",
+      confidence: 95,
+      source: "whitelist_bypass",
+      violatedLayers: []
+    };
+  }
+  const agentExt = getAgentExtensions(input.agentId);
+  const trustedSkills = new Set(TRUSTED_SKILLS_BASE);
+  if (agentExt?.builtin_safe_skills) {
+    for (const s of agentExt.builtin_safe_skills) trustedSkills.add(s);
+  }
+  if (actionType === "skill" && trustedSkills.has(lowerDetail)) {
+    return {
+      allowed: true,
+      reason: `\u5185\u7F6E\u5B89\u5168 Skill\uFF0C\u8DF3\u8FC7\u6DF1\u5EA6\u5206\u6790: ${lowerDetail}`,
+      riskLevel: heuristicResult?.riskLevel || "low",
+      riskType: "",
+      confidence: 95,
+      source: "whitelist_bypass",
+      violatedLayers: []
+    };
+  }
+  let skipLLM = READONLY_SENSITIVE_TOOLS.has(actionType);
+  if (actionType === "bash" || actionType === "executebash" || actionType === "terminal-executebash") {
+    const firstCmd = extractFirstCommand(lowerDetail);
+    if (matchesAny(firstCmd, FULLY_SAFE_BASH_PATTERNS)) {
+      const fullCmdHit = DANGEROUS_PATTERNS.some(
+        (p) => p.severity === "critical" || p.severity === "high"
+      ) && DANGEROUS_PATTERNS.some(
+        (p) => (p.severity === "critical" || p.severity === "high") && p.pattern.test(lowerDetail)
+      );
+      if (!fullCmdHit) {
+        return {
+          allowed: true,
+          reason: `\u5B89\u5168\u7684\u53EA\u8BFB bash \u547D\u4EE4: ${firstCmd}`,
+          riskLevel: "low",
+          riskType: "",
+          confidence: 95,
+          source: "whitelist_bypass",
+          violatedLayers: []
+        };
+      }
+    }
+    if (matchesAny(firstCmd, READONLY_SENSITIVE_BASH_PATTERNS)) {
+      skipLLM = true;
+    }
+  }
+  const logicResult = isLogicRulesEnabled() ? runLogicCheck(input) : null;
+  if (logicResult && !logicResult.allowed) {
+    const isCredentialPath = !!logicResult.isCredential;
+    const skipInlineFileAccess = (isInlineScriptCmd || isLiteralTextCmd) && logicResult.riskType === "sensitive_path_access";
+    if (skipInlineFileAccess) {
+      const inlineJudgment = analyzeInlineScript(input.aNext.actionDetail);
+      if (inlineJudgment.actionable) {
+        if (!inlineJudgment.allowed) {
+          return {
+            allowed: false,
+            reason: inlineJudgment.reason,
+            riskLevel: inlineJudgment.riskLevel,
+            riskType: inlineJudgment.riskType,
+            confidence: 90,
+            source: "logic_rule",
+            violatedLayers: ["1.2"]
+          };
+        }
+        return {
+          allowed: true,
+          reason: inlineJudgment.reason,
+          riskLevel: inlineJudgment.riskLevel,
+          riskType: inlineJudgment.riskType,
+          confidence: 90,
+          source: "logic_rule",
+          violatedLayers: []
+        };
+      }
+    }
+    if ((logicResult.riskLevel === "high" || logicResult.riskLevel === "critical") && (!skipInlineFileAccess || isCredentialPath)) {
+      return logicResult;
+    }
+  }
+  if (scriptChain && scriptChain.nodes.length > 0 && isLogicRulesEnabled()) {
+    for (const node of scriptChain.nodes) {
+      if (node.error || !node.preprocessedContent) continue;
+      if (node.l1RiskLevel === "critical") break;
+      if (node.l2Hit && (node.l2RiskLevel === "high" || node.l2RiskLevel === "critical")) {
+        return {
+          allowed: false,
+          reason: node.l2Reason,
+          riskLevel: node.l2RiskLevel,
+          riskType: node.l2RiskType,
+          confidence: 85,
+          source: "logic_rule_script_scan",
+          violatedLayers: ["1.2-script"]
+        };
+      }
+    }
+  }
+  if (skipLLM || !isLLMAvailable()) {
+    return {
+      allowed: true,
+      reason: "\u53EA\u8BFB\u64CD\u4F5C\u4E14\u65E0\u903B\u8F91\u89C4\u5219\u8FDD\u89C4\uFF0C\u8DF3\u8FC7 LLM \u5206\u6790",
+      riskLevel: logicResult?.riskLevel || "low",
+      riskType: "",
+      confidence: 85,
+      source: "heuristic_and_logic_only",
+      violatedLayers: []
+    };
+  }
+  let skipL3Hints = "\u65E0\uFF08\u5F53\u524D\u65E0\u7981\u7528\u89C4\u5219\u547D\u4E2D\uFF09";
+  try {
+    const { getDisabledL2RulesWithSkipL3: getDisabledL2RulesWithSkipL32 } = await Promise.resolve().then(() => (init_runtime_config(), runtime_config_exports));
+    const disabledL2 = getDisabledL2RulesWithSkipL32();
+    if (disabledL2 && Object.keys(disabledL2).length > 0) {
+      const actionLower = input.aNext.actionDetail.toLowerCase();
+      const matched = [];
+      for (const items of Object.values(disabledL2)) {
+        for (const item of items) {
+          if (item.toLowerCase().includes(actionLower) || actionLower.includes(item.toLowerCase())) {
+            matched.push(item);
+          }
+        }
+      }
+      if (matched.length > 0) {
+        skipL3Hints = `\u26A0\uFE0F \u91CD\u8981\u7EA6\u675F\uFF1A\u7528\u6237\u5DF2\u4E3B\u52A8\u7981\u7528\u9488\u5BF9\u4EE5\u4E0B\u5185\u5BB9\u7684\u5B89\u5168\u62E6\u622A\u89C4\u5219\uFF0C\u8FD9\u662F\u7528\u6237\u7684\u660E\u786E\u51B3\u7B56\uFF1A
+  ${matched.join(", ")}
+\u5BF9\u8FD9\u4E9B\u8DEF\u5F84/\u5173\u952E\u8BCD\u7684\u76F8\u5173\u64CD\u4F5C\uFF0C\u5FC5\u987B\u89C6\u4E3A\u5141\u8BB8\u7684\uFF0C\u4E0D\u5141\u8BB8\u4EC5\u56E0\u6D89\u53CA\u8FD9\u4E9B\u5185\u5BB9\u5C31\u62D2\u7EDD\u3002\u4F46\u4F60\u4ECD\u9700\u68C0\u67E5\u547D\u4EE4\u7684\u5176\u4ED6\u90E8\u5206\u662F\u5426\u6709\u72EC\u7ACB\u4E8E\u8FD9\u4E9B\u5185\u5BB9\u7684\u5B89\u5168\u98CE\u9669\uFF08\u5982\u7F51\u7EDC\u5916\u4F20\u3001\u63D0\u6743\u7B49\uFF09\u3002`;
+      }
+    }
+  } catch {
+  }
+  let llmResult;
+  try {
+    llmResult = await runLLMAnalysis(input, {
+      heuristic: heuristicResult,
+      logic: logicResult,
+      skipL3Hints,
+      scriptChain: scriptChain ?? void 0,
+      llmLogPath: input.llmLogPath
+    });
+  } catch (e) {
+    const { getLLMFailMode: getLLMFailMode2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+    if (getLLMFailMode2() === "fail_open") {
+      console.warn(`[AgentMoss] LLM \u5206\u6790\u5931\u8D25\uFF0Cfail_open \u6A21\u5F0F\uFF1A\u5141\u8BB8\u6267\u884C\uFF08\u524D\u4E24\u5C42\u672A\u62E6\u622A\uFF09: ${e.message}`);
+      return {
+        allowed: true,
+        reason: `LLM \u5206\u6790\u5931\u8D25\uFF08warn-allow\uFF0Cfail_open\uFF09: ${e.message}`,
+        riskLevel: "low",
+        riskType: "",
+        confidence: 50,
+        source: "llm_failure_fallback",
+        violatedLayers: []
+      };
+    }
+    return {
+      allowed: false,
+      reason: `LLM \u5206\u6790\u5931\u8D25\uFF0C\u56E0\u65E0\u6CD5\u5B8C\u6210\u6DF1\u5EA6\u8BED\u4E49\u5206\u6790\uFF0C\u6309 fail-closed \u539F\u5219\u62D2\u7EDD: ${e.message}`,
+      riskLevel: "medium",
+      riskType: "",
+      confidence: 60,
+      source: "llm_failure_fallback",
+      violatedLayers: ["3"]
+    };
+  }
+  return llmResult;
+}
+
+// src/actrail.ts
+init_esm_shims();
+import * as fs3 from "fs";
+function escape(value) {
+  return value.replace(/\\/g, "\\\\").replace(/\n/g, "\\n").replace(/=/g, "\\e");
+}
+function sessionToTraceId(sessionId) {
+  let hash = 0;
+  for (let i = 0; i < sessionId.length; i++) {
+    const char = sessionId.charCodeAt(i);
+    hash = (hash << 5) - hash + char | 0;
+  }
+  return Math.abs((hash * 31 + sessionId.length) % Number.MAX_SAFE_INTEGER);
+}
+function isEnabled() {
+  return process.env.ACTRAIL_ENABLED === "1" || process.env.ACTRAIL_ENABLED === "true";
+}
+function getStoragePath() {
+  return process.env.ACTRAIL_STORAGE_PATH || "/tmp/actrail.sqlite";
+}
+function reportEnforcementEvent(opts) {
+  if (!isEnabled()) return false;
+  const storagePath = getStoragePath();
+  if (!fs3.existsSync(storagePath)) return false;
+  try {
+    let Database;
+    try {
+      Database = require_lib();
+    } catch {
+      console.debug("[AgentMoss] better-sqlite3 not installed, AcTrail reporting disabled");
+      return false;
+    }
+    const db = new Database(storagePath, { timeout: 100, readonly: false });
+    const tableCheck = db.prepare(
+      "SELECT name FROM sqlite_master WHERE type='table' AND name='events'"
+    ).get();
+    if (!tableCheck) {
+      db.close();
+      return false;
+    }
+    const nowNs = BigInt(Date.now()) * 1000000n;
+    const eventId = Number(nowNs % BigInt(2 ** 62));
+    const traceIdInt = sessionToTraceId(opts.traceId);
+    const rawFields = {
+      "backend": "agent-moss",
+      "operation": "tool_call",
+      "decision": opts.decision,
+      "result": opts.decision === "allow" ? "allowed" : "denied",
+      "tool.name": opts.toolName,
+      "tool.command": (opts.toolCommand || "").slice(0, 500),
+      "agent.session_id": opts.sessionId,
+      "agent.prompt": (opts.prompt || "").slice(0, 500),
+      "risk.level": opts.riskLevel || "",
+      "risk.type": opts.riskType || "",
+      "reason": (opts.reason || "").slice(0, 500),
+      "violated_layers": (opts.violatedLayers || []).join(","),
+      "confidence": String(opts.confidence ?? 100),
+      "duration_ms": (opts.durationMs ?? 0).toFixed(1)
+    };
+    const payloadFields = Object.entries(rawFields).map(([k, v]) => `${escape(k)}=${escape(v)}`).join("\n");
+    db.prepare(`
+      INSERT OR REPLACE INTO events (
+        event_id, trace_id, observed_at,
+        process_pid, process_task_id, process_start_ticks,
+        process_pid_namespace, process_generation,
+        collector, kind,
+        bootstrap_observed, metadata_partial, policy_modified,
+        payload_variant, payload_fields, payload_bytes,
+        policy_verdict, policy_note,
+        policy_redactions, policy_truncations
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(
+      eventId,
+      traceIdInt,
+      Number(nowNs),
+      process.pid,
+      0,
+      0,
+      null,
+      0,
+      "agent-moss",
+      "enforcement",
+      0,
+      0,
+      0,
+      "enforcement",
+      payloadFields,
+      "",
+      opts.decision === "allow" ? "allow" : "drop",
+      opts.reason || "",
+      "[]",
+      "[]"
+    );
+    db.close();
+    return true;
+  } catch (err) {
+    console.debug(`[AgentMoss] AcTrail write failed (non-fatal): ${err.message}`);
+    return false;
+  }
+}
+
+// src/routes.ts
+async function healthRoute(c) {
+  return c.json(HealthResponseSchema.parse({}));
+}
+async function analyzeRoute(c) {
+  const t0 = performance.now();
+  try {
+    const body = await c.req.json();
+    const req = AnalyzeRequestSchema.parse(body);
+    let osType = req.os_type;
+    if (!osType) {
+      osType = process.platform === "win32" ? "windows" : "linux";
+    }
+    const result = await runAnalysis({
+      sessionId: req.session_id,
+      promptSession: req.prompt_session,
+      actionHistory: req.action_history.map((h) => ({
+        actionType: h.action_type,
+        actionDetail: h.action_detail
+      })),
+      aNext: {
+        actionType: req.a_next.action_type,
+        actionDetail: req.a_next.action_detail
+      },
+      reason: req.reason,
+      osType,
+      cwd: req.cwd,
+      agentId: req.agent_id,
+      llmConfig: req.metadata?.llm_config,
+      llmLogPath: req.metadata?.llm_log_path
+    });
+    const durationMs = performance.now() - t0;
+    try {
+      reportEnforcementEvent({
+        traceId: req.session_id,
+        decision: result.allowed ? "allow" : "deny",
+        toolName: req.a_next.action_type,
+        toolCommand: req.a_next.action_detail,
+        sessionId: req.session_id,
+        prompt: req.prompt_session,
+        riskLevel: result.riskLevel,
+        riskType: result.riskType,
+        reason: result.reason,
+        violatedLayers: result.violatedLayers,
+        confidence: result.confidence,
+        durationMs: Math.round(durationMs * 10) / 10
+      });
+    } catch {
+    }
+    return c.json(
+      AnalyzeResponseSchema.parse({
+        decision: result.allowed ? "Allow" : "Deny",
+        reason: result.reason,
+        risk_level: result.riskLevel,
+        risk_type: result.riskType,
+        violated_layers: result.violatedLayers,
+        policy: "",
+        violated_policy: "",
+        confidence: result.confidence,
+        analysis_duration_ms: Math.round(durationMs * 10) / 10
+      })
+    );
+  } catch (err) {
+    console.error("[AgentMoss] Analysis error:", err);
+    if (err instanceof SyntaxError) {
+      return c.json({ error: "Invalid JSON", detail: err.message }, 400);
+    }
+    if (err?.issues) {
+      return c.json({ error: "Validation error", detail: err.issues }, 400);
+    }
+    return c.json({ error: "Internal error", detail: String(err) }, 500);
+  }
+}
+
+// src/console/index.ts
+init_esm_shims();
+
+// src/console/router.ts
+init_esm_shims();
+init_runtime_config();
+init_token_stats();
+import { Hono } from "hono";
+import { readFileSync as readFileSync8, existsSync as existsSync9 } from "fs";
+import { join as join5, dirname as dirname5 } from "path";
+import { fileURLToPath as fileURLToPath5 } from "url";
+var __dirname5 = dirname5(fileURLToPath5(import.meta.url));
+var STATIC_DIR = join5(__dirname5, "static");
+var CONSOLE_TOKEN_ENV = "AGENT_MOSS_CONSOLE_TOKEN";
+function getConsoleToken() {
+  return process.env[CONSOLE_TOKEN_ENV] || "";
+}
+function verifyAuth(req) {
+  const token = getConsoleToken();
+  if (!token) return true;
+  const auth = req.headers.get("Authorization") || "";
+  if (auth.startsWith("Bearer ")) return auth.slice(7) === token;
+  return false;
+}
+function authMiddleware() {
+  return async (c, next) => {
+    if (!verifyAuth(c.req.raw)) {
+      return c.json({ error: "Unauthorized: invalid or missing Bearer token" }, 401);
+    }
+    await next();
+  };
+}
+function createConsoleRouter() {
+  const console2 = new Hono();
+  console2.use("/api/*", authMiddleware());
+  const serveIndex = (c) => {
+    const indexFile = join5(STATIC_DIR, "index.html");
+    if (existsSync9(indexFile)) {
+      return c.html(readFileSync8(indexFile, "utf-8"));
+    }
+    return c.html("<h1>AgentMoss Policy Console</h1><p>Frontend not built. Use /console/api/* endpoints.</p>");
+  };
+  console2.get("/", serveIndex);
+  console2.get("", serveIndex);
+  console2.get("/api/layers", (c) => {
+    const rc = loadRuntimeConfig();
+    return c.json({ layers: rc.layers });
+  });
+  console2.put("/api/layers", async (c) => {
+    const body = await c.req.json();
+    const rc = updateLayerEnabled(body.layer_key, body.enabled);
+    return c.json({ layers: rc.layers });
+  });
+  console2.get("/api/rules", (c) => {
+    const rc = loadRuntimeConfig();
+    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules });
+  });
+  console2.put("/api/rules/enabled", async (c) => {
+    const b = await c.req.json();
+    const rc = updateRuleEnabled(b.layer, b.category, b.rule_id, b.enabled);
+    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules });
+  });
+  console2.put("/api/rules/deny_mode", async (c) => {
+    const b = await c.req.json();
+    const rc = updateRuleDenyMode(b.layer, b.category, b.rule_id, b.deny_mode);
+    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules });
+  });
+  console2.put("/api/rules/skip_l3", async (c) => {
+    const b = await c.req.json();
+    const rc = updateRuleSkipL3(b.layer, b.category, b.rule_id, b.skip_l3_on_disabled);
+    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules });
+  });
+  console2.put("/api/categories/enabled", async (c) => {
+    const b = await c.req.json();
+    const rc = updateCategoryEnabled(b.layer, b.category, b.enabled);
+    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules });
+  });
+  console2.post("/api/rules", async (c) => {
+    const b = await c.req.json();
+    const rc = addCustomRule(b.layer, b.category, {
+      pattern: b.pattern,
+      risk_level: b.risk_level,
+      risk_type: b.risk_type,
+      reason: b.reason,
+      keyword: b.keyword,
+      lang: b.lang,
+      path: b.path,
+      desc: b.desc,
+      credential: b.credential,
+      deny_mode: b.deny_mode
+    });
+    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules });
+  });
+  console2.delete("/api/rules", async (c) => {
+    const b = await c.req.json();
+    deleteCustomRule(b.layer, b.category, b.rule_id);
+    const rc = loadRuntimeConfig();
+    return c.json({ L1_rules: rc.L1_rules, L2_rules: rc.L2_rules });
+  });
+  console2.get("/api/skills", (c) => {
+    const rc = loadRuntimeConfig();
+    return c.json({ L3_skills: rc.L3_skills });
+  });
+  console2.put("/api/skills/enabled", async (c) => {
+    const b = await c.req.json();
+    const rc = updateSkillEnabled(b.skill_id, b.enabled);
+    return c.json({ L3_skills: rc.L3_skills });
+  });
+  console2.put("/api/skill-categories/enabled", async (c) => {
+    const b = await c.req.json();
+    const rc = updateSkillCategoryEnabled(b.category, b.enabled);
+    return c.json({ L3_skills: rc.L3_skills });
+  });
+  console2.post("/api/skills", async (c) => {
+    const b = await c.req.json();
+    const rc = addCustomSkill(b.skill_id, b.category || "user_custom", b.keywords || [], b.content);
+    return c.json({ L3_skills: rc.L3_skills });
+  });
+  console2.delete("/api/skills", async (c) => {
+    const b = await c.req.json();
+    deleteCustomSkill(b.skill_id, b.category);
+    const rc = loadRuntimeConfig();
+    return c.json({ L3_skills: rc.L3_skills });
+  });
+  console2.get("/api/skills/:skill_id/content", async (c) => {
+    const skillId = c.req.param("skill_id");
+    if (!/^[A-Za-z0-9_-]+$/.test(skillId)) {
+      return c.json({ error: "invalid skill_id" }, 400);
+    }
+    const skillPath = join5(dirname5(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
+    if (!existsSync9(skillPath)) {
+      const builtinPath = join5(__dirname5, "..", "..", "agent_moss", "skills", `${skillId}.md`);
+      if (existsSync9(builtinPath)) return c.text(readFileSync8(builtinPath, "utf-8"));
+      return c.json({ error: "skill not found" }, 404);
+    }
+    return c.text(readFileSync8(skillPath, "utf-8"));
+  });
+  console2.get("/api/config", (c) => {
+    const rc = loadRuntimeConfig();
+    return c.json({ config: rc, config_path: getRuntimeConfigPath() });
+  });
+  console2.get("/api/env-overrides", (c) => {
+    return c.json({ overrides: getEnvOverrides() });
+  });
+  console2.post("/api/reset", (c) => {
+    const defaults = generateSourceDefaults();
+    saveRuntimeConfig(defaults);
+    return c.json({ config: defaults });
+  });
+  console2.get("/api/token-stats", (c) => {
+    const days = parseInt(c.req.query("days") || "7", 10);
+    return c.json(getTokenStats(days));
+  });
+  console2.get("/api/token-stats/recent", (c) => {
+    const limit = parseInt(c.req.query("limit") || "20", 10);
+    return c.json({ records: getRecentRecords(limit) });
+  });
+  console2.get("/api/token-stats/trend", (c) => {
+    const days = parseInt(c.req.query("days") || "7", 10);
+    return c.json(getTokenTrend(days));
+  });
+  console2.post("/api/token-stats/reset", (c) => {
+    resetTokenStats();
+    return c.json({ reset: true });
+  });
+  return console2;
+}
+
+// src/server.ts
+function createApp() {
+  const app = new Hono2();
+  app.use("*", cors({ origin: "*", allowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"], allowHeaders: ["*"] }));
+  app.use("*", logger());
+  app.get("/api/v1/health", healthRoute);
+  app.post("/api/v1/analyze", analyzeRoute);
+  app.route("/console", createConsoleRouter());
+  app.get("/console/", (c) => c.redirect("/console"));
+  return app;
+}
+async function findFreePort(startPort, host = "127.0.0.1", scan = 100) {
+  for (let port = startPort; port < startPort + scan; port++) {
+    const free = await new Promise((resolve6) => {
+      const server = net.createServer();
+      server.listen(port, host, () => {
+        server.close(() => resolve6(true));
+      });
+      server.on("error", () => resolve6(false));
+    });
+    if (free) {
+      if (port !== startPort) {
+        console.warn(`[AgentMoss] Port ${startPort} in use, using ${port} instead`);
+      }
+      return port;
+    }
+  }
+  return startPort;
+}
+async function startServer(host = "127.0.0.1", port = 9090) {
+  const actualPort = await findFreePort(port, host);
+  const app = createApp();
+  return {
+    port: actualPort,
+    serve: async () => {
+      console.log(`AgentMoss HTTP server on ${host}:${actualPort}`);
+      const { serve: honoServe } = await import("@hono/node-server");
+      honoServe({ fetch: app.fetch, hostname: host, port: actualPort });
+    }
+  };
+}
+export {
+  createApp,
+  findFreePort,
+  startServer
+};
+//# sourceMappingURL=server.js.map