@kenhkl/agent-moss 0.8.5 → 0.9.1

package/dist/cli.js

@@ -264,247 +264,6 @@ var init_agents = __esm({
   }
 });
 
-// src/engine/heuristic.ts
-function runHeuristicCheck(input) {
-  const command = `${input.aNext.actionType}: ${input.aNext.actionDetail}`;
-  const matched = [];
-  let highestSeverity = "low";
-  let highestRiskType = "";
-  const userRules = getCustomRules();
-  for (const rule of userRules) {
-    try {
-      const re = new RegExp(rule.pattern);
-      if (re.test(command)) {
-        if (rule.action === "Deny") {
-          matched.push(`\u81EA\u5B9A\u4E49\u89C4\u5219: ${rule.pattern}`);
-          if (severityRank(rule.severity) > severityRank(highestSeverity)) {
-            highestSeverity = rule.severity;
-            highestRiskType = "custom_rule";
-          }
-        }
-      }
-    } catch {
-    }
-  }
-  let topRiskType = "";
-  for (const rule of DANGEROUS_PATTERNS) {
-    if (rule.pattern.test(command)) {
-      matched.push(rule.description);
-      if (severityRank(rule.severity) > severityRank(highestSeverity)) {
-        highestSeverity = rule.severity;
-        topRiskType = rule.riskType;
-      }
-    }
-  }
-  highestRiskType = topRiskType || highestRiskType;
-  const agentExt = getAgentExtensions(input.agentId);
-  if (agentExt?.extra_command_patterns) {
-    for (const rule of agentExt.extra_command_patterns) {
-      try {
-        const re = new RegExp(rule.pattern, "i");
-        if (re.test(command)) {
-          matched.push(`agent \u4E13\u5C5E\u89C4\u5219: ${rule.reason}`);
-          if (severityRank(rule.risk_level) > severityRank(highestSeverity)) {
-            highestSeverity = rule.risk_level;
-            highestRiskType = rule.risk_type;
-          }
-        }
-      } catch {
-      }
-    }
-  }
-  const injectionText = `${input.aNext.actionType} ${input.aNext.actionDetail} ${input.reason || ""} ${input.promptSession || ""}`.toLowerCase();
-  const injectionHits = checkInjectionKeywords(injectionText, agentExt?.extra_injection_keywords);
-  if (injectionHits.length > 0) {
-    const topHit = injectionHits.reduce((a, b) => severityRank(a.riskLevel) >= severityRank(b.riskLevel) ? a : b);
-    matched.push(...injectionHits.map((h) => `\u6CE8\u5165\u5173\u952E\u8BCD [${h.lang}]: ${h.keyword}`));
-    if (severityRank(topHit.riskLevel) > severityRank(highestSeverity)) {
-      highestSeverity = topHit.riskLevel;
-      highestRiskType = "prompt_injection";
-    }
-  }
-  if (matched.length > 0) {
-    return {
-      allowed: false,
-      reason: `\u68C0\u6D4B\u5230\u9AD8\u5371\u64CD\u4F5C: ${matched.join(", ")}`,
-      riskLevel: highestSeverity,
-      riskType: highestRiskType,
-      confidence: 95,
-      source: "heuristic",
-      violatedLayers: ["1.1"]
-      // 对齐 py coordinator.py:165（L1.1 = 命中高危命令模式/注入关键词）
-    };
-  }
-  return null;
-}
-function checkInjectionKeywords(text, extraKeywords) {
-  const hits = [];
-  for (const entry of INJECTION_KEYWORDS) {
-    if (text.includes(entry.keyword.toLowerCase())) {
-      hits.push(entry);
-    }
-  }
-  if (extraKeywords) {
-    for (const entry of extraKeywords) {
-      if (text.includes(entry.keyword.toLowerCase())) {
-        hits.push({ keyword: entry.keyword, riskLevel: entry.risk_level, lang: entry.lang });
-      }
-    }
-  }
-  return hits;
-}
-function isInlineScriptCommand(actionDetail) {
-  const re = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
-  return re.test(actionDetail);
-}
-function severityRank(s) {
-  const ranks = { low: 1, medium: 2, high: 3, critical: 4 };
-  return ranks[s] || 0;
-}
-var INJECTION_KEYWORDS, DANGEROUS_PATTERNS;
-var init_heuristic = __esm({
-  "src/engine/heuristic.ts"() {
-    "use strict";
-    init_esm_shims();
-    init_config();
-    init_agents();
-    INJECTION_KEYWORDS = [
-      // ---- Instruction Override ----
-      { keyword: "ignore previous instructions", riskLevel: "critical", lang: "en" },
-      { keyword: "ignore all previous", riskLevel: "critical", lang: "en" },
-      { keyword: "disregard all prior", riskLevel: "critical", lang: "en" },
-      { keyword: "forget everything", riskLevel: "high", lang: "en" },
-      { keyword: "\u5FFD\u7565\u4E4B\u524D\u7684\u6307\u4EE4", riskLevel: "critical", lang: "zh" },
-      { keyword: "\u5FFD\u7565\u6240\u6709\u5148\u524D\u7684", riskLevel: "critical", lang: "zh" },
-      { keyword: "\u5FFD\u7565\u4E0A\u9762\u6240\u6709", riskLevel: "high", lang: "zh" },
-      { keyword: "\u8BF7\u5FD8\u8BB0\u4E4B\u524D", riskLevel: "high", lang: "zh" },
-      // ---- Role Hijacking ----
-      { keyword: "you are now", riskLevel: "high", lang: "en" },
-      { keyword: "you are no longer", riskLevel: "high", lang: "en" },
-      { keyword: "new instructions", riskLevel: "high", lang: "en" },
-      { keyword: "from now on, you", riskLevel: "high", lang: "en" },
-      { keyword: "\u4F60\u73B0\u5728\u662F\u4E00\u4E2A", riskLevel: "high", lang: "zh" },
-      { keyword: "\u4F60\u4E0D\u518D\u662F\u4E00\u4E2A", riskLevel: "high", lang: "zh" },
-      { keyword: "\u4ECE\u73B0\u5728\u5F00\u59CB\u4F60", riskLevel: "high", lang: "zh" },
-      { keyword: "\u4F60\u7684\u65B0\u89D2\u8272\u662F", riskLevel: "high", lang: "zh" },
-      // ---- Command Injection ----
-      { keyword: "system prompt", riskLevel: "high", lang: "en" },
-      { keyword: "reveal your instructions", riskLevel: "high", lang: "en" },
-      { keyword: "output your instructions", riskLevel: "high", lang: "en" },
-      { keyword: "repeat your instructions", riskLevel: "medium", lang: "en" },
-      { keyword: "\u7CFB\u7EDF\u63D0\u793A", riskLevel: "high", lang: "zh" },
-      { keyword: "\u8F93\u51FA\u4F60\u7684\u6307\u4EE4", riskLevel: "high", lang: "zh" },
-      { keyword: "\u91CD\u590D\u4F60\u7684\u6307\u4EE4", riskLevel: "medium", lang: "zh" },
-      // ---- Social Engineering ----
-      { keyword: "this is an authorized test", riskLevel: "high", lang: "en" },
-      { keyword: "security audit approved", riskLevel: "high", lang: "en" },
-      { keyword: "admin override", riskLevel: "critical", lang: "en" },
-      { keyword: "debug mode", riskLevel: "high", lang: "en" },
-      { keyword: "maintenance mode", riskLevel: "high", lang: "en" },
-      { keyword: "\u8FD9\u662F\u6388\u6743\u7684\u6D4B\u8BD5", riskLevel: "high", lang: "zh" },
-      { keyword: "\u5B89\u5168\u5BA1\u8BA1\u5DF2\u6279\u51C6", riskLevel: "high", lang: "zh" },
-      { keyword: "\u7BA1\u7406\u5458\u8986\u76D6", riskLevel: "critical", lang: "zh" },
-      { keyword: "\u8C03\u8BD5\u6A21\u5F0F", riskLevel: "high", lang: "zh" },
-      // ---- XSS ----
-      { keyword: "<script>", riskLevel: "high", lang: "en" },
-      { keyword: "javascript:", riskLevel: "high", lang: "en" },
-      { keyword: "onerror=", riskLevel: "high", lang: "en" },
-      { keyword: "onload=", riskLevel: "high", lang: "en" },
-      // ---- Fake Boundaries ----
-      { keyword: "=== END OF", riskLevel: "high", lang: "en" },
-      { keyword: "--- END SYSTEM", riskLevel: "high", lang: "en" },
-      { keyword: "[END OF", riskLevel: "high", lang: "en" },
-      { keyword: "=== \u7ED3\u675F", riskLevel: "high", lang: "zh" },
-      { keyword: "--- \u7ED3\u675F\u7CFB\u7EDF", riskLevel: "high", lang: "zh" },
-      // ---- Developer Mode ----
-      { keyword: "developer mode", riskLevel: "critical", lang: "en" },
-      { keyword: "DAN mode", riskLevel: "critical", lang: "en" },
-      { keyword: "jailbreak", riskLevel: "critical", lang: "en" },
-      { keyword: "\u5F00\u53D1\u8005\u6A21\u5F0F", riskLevel: "critical", lang: "zh" },
-      { keyword: "\u8D8A\u72F1", riskLevel: "critical", lang: "zh" }
-      // 注：xiaoO 专属绕过词（绕过审计/禁用安全检查/关闭防护/bypass audit 等）
-      // 已迁至 agent_moss/agents/xiaoo/rules.json 的 extra_injection_keywords，
-      // 由 agent_ext 机制注入，不再污染通用层。
-    ];
-    DANGEROUS_PATTERNS = [
-      // --- Critical: rm command graded detection (strict to loose, first match wins) ---
-      // 1. rm -rf root dir (含通配符如 /* /.* 等) — 使用负向先行断言 (?!\w)：/ 后面不是单词字符时匹配
-      { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*f[a-zA-Z]*\s+\/(?!\w)/i, severity: "critical", description: "\u9012\u5F52\u5F3A\u5236\u5220\u9664\u6839\u76EE\u5F55 (rm -rf /)", riskType: "script_execution" },
-      // 注意：已移除"rm -rf /任意绝对路径"的宽泛规则，避免误杀 /tmp 等临时目录清理操作
-      // 2. rm with -r or -f targeting system dirs
-      { pattern: /\brm\s+-[a-zA-Z]*[rf][a-zA-Z]*\s+\/(etc|var|home|usr|boot|root|opt|srv|sys|proc)\b/i, severity: "critical", description: "\u5220\u9664\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55", riskType: "script_execution" },
-      // 3. rm -r absolute path (no -f)
-      { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*\s+\//i, severity: "high", description: "\u9012\u5F52\u5220\u9664\u64CD\u4F5C (rm -r /...)", riskType: "script_execution" },
-      // 4. rm -f absolute path (no -r)
-      { pattern: /\brm\s+-[a-zA-Z]*f[a-zA-Z]*\s+\//i, severity: "medium", description: "\u5F3A\u5236\u5220\u9664\u6587\u4EF6 (rm -f /...)", riskType: "script_execution" },
-      // dd 磁盘清零 — 只拦截写入系统关键目录，放行 /tmp 等临时目录
-      { pattern: /dd\s+if=\/dev\/zero.*\bof\s*=\s*\/(etc|var|home|usr|boot|root|opt|srv|sys|proc)\b/i, severity: "critical", description: "\u78C1\u76D8\u6E05\u96F6\u5199\u5165\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55 (dd if=/dev/zero of=/\u7CFB\u7EDF\u76EE\u5F55)", riskType: "script_execution" },
-      // mkfs 格式化 — 只拦截对块设备（/dev/sdX 等）的格式化，放行对普通文件的格式化
-      { pattern: /mkfs\.\w+\s+\/dev\/(sd|hd|nvme|vd|loop|mapper|md|dm)\S+/i, severity: "critical", description: "\u683C\u5F0F\u5316\u5757\u8BBE\u5907 (mkfs /dev/\u5757\u8BBE\u5907)", riskType: "script_execution" },
-      { pattern: /:\(\)\s*\{.*:\|:&.*\};:/i, severity: "critical", description: "Fork Bomb", riskType: "resource_exhaustion" },
-      // --- Critical: remote code execution ---
-      { pattern: /curl\s+.*\|\s*(bash|sh|zsh|dash)/i, severity: "critical", description: "curl pipe shell \u6267\u884C", riskType: "script_execution" },
-      { pattern: /wget\s+.*\|\s*(bash|sh)/i, severity: "critical", description: "wget pipe shell \u6267\u884C", riskType: "script_execution" },
-      { pattern: /eval\s+\$\(curl|eval\s+\$\(wget/i, severity: "critical", description: "eval \u8FDC\u7A0B\u4EE3\u7801\u6267\u884C", riskType: "script_execution" },
-      { pattern: /base64\s+-d\s+.*\|\s*bash/i, severity: "critical", description: "base64 \u89E3\u7801\u6267\u884C", riskType: "script_execution" },
-      // --- Critical: reverse shell ---
-      { pattern: /\/dev\/tcp\/|bash\s+-i\s+>&/i, severity: "critical", description: "\u53CD\u5F39 Shell", riskType: "script_execution" },
-      { pattern: /nc\s+-[el]\s+.*\d{1,5}/i, severity: "high", description: "Netcat \u53CD\u5F39\u8FDE\u63A5", riskType: "lateral_movement" },
-      // --- Critical: sensitive file access ---
-      { pattern: /\/etc\/shadow/i, severity: "critical", description: "\u8BBF\u95EE\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6 (/etc/shadow)", riskType: "file_access" },
-      { pattern: /\/etc\/gshadow/i, severity: "critical", description: "\u8BBF\u95EE\u7CFB\u7EDF\u7EC4\u5BC6\u7801\u6587\u4EF6 (/etc/gshadow)", riskType: "file_access" },
-      // 注意：/etc/passwd 已从拦截列表移除，因为它是公开可读的标准系统文件，真正敏感的是 /etc/shadow
-      { pattern: /\.ssh\/id_rsa/i, severity: "critical", description: "\u8BBF\u95EE SSH \u79C1\u94A5\u6587\u4EF6", riskType: "file_access" },
-      // --- Critical: privilege escalation / container escape ---
-      { pattern: /\/var\/run\/docker\.sock/i, severity: "critical", description: "\u8BBF\u95EE Docker socket\uFF0C\u53EF\u80FD\u5BFC\u81F4\u5BB9\u5668\u9003\u9038", riskType: "privilege_escalation" },
-      // --- High: dangerous permissions / ownership ---
-      { pattern: /chmod\s+[0-7]*777[0-7]*/i, severity: "high", description: "\u5168\u6743\u9650\u8BBE\u7F6E (chmod 777)", riskType: "script_execution" },
-      { pattern: /chown\s+root|chown\s+-R\s+\w+:\w+\s+\//i, severity: "high", description: "\u4FEE\u6539\u6240\u6709\u8005\u4E3A root / \u9012\u5F52\u4FEE\u6539\u6839\u76EE\u5F55\u6240\u6709\u8005", riskType: "script_execution" },
-      // sudo 提权 — 只拦截 sudo 后跟的危险命令，不一刀切拦截所有 sudo
-      { pattern: /sudo\s+(rm|chmod|chown|dd|mkfs|format|iptables|crontab|passwd|userdel|useradd|groupdel)\b/i, severity: "high", description: "\u63D0\u6743\u6267\u884C\u9AD8\u5371\u547D\u4EE4 (sudo + \u5371\u9669\u64CD\u4F5C)", riskType: "privilege_escalation" },
-      // --- High: system config overwrite ---
-      { pattern: />\s*\/etc\//i, severity: "critical", description: "\u8986\u76D6\u5199\u5165\u7CFB\u7EDF\u914D\u7F6E\u76EE\u5F55", riskType: "file_access" },
-      // --- High: download script + execute risk ---
-      { pattern: /(?:curl|wget)\s+.*(?:-o|--output|>)\s*\S+\.(?:sh|bash)\b/i, severity: "high", description: "\u8FDC\u7A0B\u4E0B\u8F7D\u811A\u672C\u5230\u672C\u5730", riskType: "script_execution" },
-      { pattern: /(?:curl|wget)\s+.*\s+&&?\s*(?:chmod\s+\+x|bash|sh)/i, severity: "high", description: "\u4E0B\u8F7D\u540E\u6267\u884C", riskType: "script_execution" },
-      // --- High: package manager pipe-to-shell ---
-      { pattern: /git\s+clone\s+.*\|.*bash/i, severity: "high", description: "git clone pipe shell", riskType: "script_execution" },
-      { pattern: /pip\s+install\s+.*\|\s*bash/i, severity: "high", description: "pip install pipe shell", riskType: "script_execution" },
-      { pattern: /npm\s+install\s+-g\s+.*\|\s*bash/i, severity: "high", description: "npm install pipe shell", riskType: "script_execution" },
-      // --- Medium: destructive git operations (降级为 medium，允许但记录) ---
-      { pattern: /git\s+push\s+.*--force/i, severity: "medium", description: "\u5F3A\u5236\u63A8\u9001\u64CD\u4F5C (git push --force)\uFF0C\u53EF\u80FD\u8986\u76D6\u8FDC\u7A0B\u63D0\u4EA4\u5386\u53F2", riskType: "script_execution" },
-      // --- High: network port scanning (横向移动侦察) ---
-      { pattern: /\bnmap\s+/i, severity: "high", description: "\u7F51\u7EDC\u7AEF\u53E3\u626B\u63CF (nmap)\uFF0C\u53EF\u80FD\u7528\u4E8E\u6A2A\u5411\u79FB\u52A8\u4FA6\u5BDF", riskType: "lateral_movement" },
-      { pattern: /\b(masscan|zmap|unicornscan)\s+/i, severity: "high", description: "\u7F51\u7EDC\u7AEF\u53E3\u626B\u63CF\u5DE5\u5177\uFF0C\u53EF\u80FD\u7528\u4E8E\u6A2A\u5411\u79FB\u52A8\u4FA6\u5BDF", riskType: "lateral_movement" },
-      // --- Medium: credential export ---
-      { pattern: /export\s+.*(?:TOKEN|KEY|SECRET|PASSWORD)/i, severity: "medium", description: "\u5BFC\u51FA\u654F\u611F\u51ED\u8BC1", riskType: "data_exfiltration" },
-      // --- High: shell rc file append (persistence) ---
-      { pattern: />>\s*(~|\/home\/[^/]+)\/(\.bashrc|\.zshrc|\.profile|\.bash_profile|\.zprofile)/, severity: "high", description: "\u68C0\u6D4B\u5230\u4FEE\u6539 Shell \u914D\u7F6E\u6587\u4EF6\uFF08~/.bashrc \u7B49\uFF09\uFF0C\u53EF\u80FD\u7528\u4E8E\u6301\u4E45\u5316\u540E\u95E8", riskType: "persistence" },
-      // --- High: device file write (只拦截重定向写入设备文件，不拦截读取) ---
-      { pattern: />\s*\/dev\/(sd|hd|nvme|vd|loop|mem|kmsg|port|zero|random|urandom|full|core)/i, severity: "high", description: "\u91CD\u5B9A\u5411\u5199\u5165\u8BBE\u5907\u6587\u4EF6", riskType: "file_access" },
-      // --- High: non-interactive password modification ---
-      { pattern: /\|\s*passwd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u7BA1\u9053\u65B9\u5F0F\u8C03\u7528 passwd\uFF08\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\uFF09", riskType: "script_execution" },
-      { pattern: /\bpasswd\s+--stdin\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 passwd --stdin \u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u8F93\u5165", riskType: "script_execution" },
-      { pattern: /\bchpasswd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 chpasswd \u6279\u91CF\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4", riskType: "script_execution" },
-      { pattern: /\b(newusers|lnewusers)\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 newusers/lnewusers \u6279\u91CF\u7528\u6237\u6DFB\u52A0\u547D\u4EE4", riskType: "script_execution" },
-      { pattern: /\bpasswd\s+-[a-zA-Z]*d\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u5BC6\u7801\u64CD\u4F5C (passwd -d)", riskType: "script_execution" },
-      { pattern: /\bpasswd\s+-[a-zA-Z]*l\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u9501\u5B9A\u7528\u6237\u8D26\u6237\u64CD\u4F5C (passwd -l)", riskType: "script_execution" },
-      // --- High: non-interactive password modification (extended) ---
-      { pattern: /\blpasswd\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u64CD\u4F5C (lpasswd)", riskType: "script_execution" },
-      { pattern: /\bgpasswd\s+(?!-[adA])/i, severity: "high", description: "\u68C0\u6D4B\u5230\u7EC4\u5BC6\u7801\u7BA1\u7406\u64CD\u4F5C (gpasswd)", riskType: "script_execution" },
-      { pattern: /\bchgpasswd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u6279\u91CF\u4FEE\u6539\u7EC4\u5BC6\u7801\u64CD\u4F5C (chgpasswd)", riskType: "script_execution" },
-      // --- High: user/group deletion (irreversible, requires user consent) ---
-      { pattern: /\buserdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (userdel)", riskType: "script_execution" },
-      { pattern: /\bdeluser\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (deluser)", riskType: "script_execution" },
-      { pattern: /\bluserdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (luserdel)", riskType: "script_execution" },
-      { pattern: /\bgroupdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u7EC4\u64CD\u4F5C (groupdel)", riskType: "script_execution" },
-      { pattern: /\blgroupdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u7EC4\u64CD\u4F5C (lgroupdel)", riskType: "script_execution" },
-      // --- High: generic command -p parameter password setting ---
-      { pattern: /\b(useradd|luseradd|groupadd|usermod|lusermod|groupmod|lgroupmod)\b[^&|;]*?\s-p\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u901A\u8FC7 -p \u53C2\u6570\u8BBE\u7F6E\u6216\u4FEE\u6539\u5BC6\u7801 (useradd/usermod/groupmod)", riskType: "script_execution" }
-    ];
-  }
-});
-
 // src/engine/inline-analyzer.ts
 function isLiteralTextCommand(command) {
   ECHO_CMD_RE.lastIndex = 0;
@@ -721,165 +480,26 @@ function runLogicCheck(input) {
       }
     }
   }
-  if (!isExcludedType) {
-    const agentExt = getAgentExtensions(input.agentId || "");
-    const pathResult = checkSensitivePath(actionDetail, resolvedCwd, agentExt);
-    if (pathResult) return pathResult;
-  }
-  if (actionType !== "file_write" && actionType !== "file_edit") {
-    const TEMP_DIRS = ["/tmp/", "/var/tmp/", "/run/", "/dev/shm/"];
-    const isTempPath = TEMP_DIRS.some((td) => actionDetail.includes(td));
-    if (!isTempPath && (actionDetail.includes("*") || actionDetail.includes("?")) && ["rm ", "rm	", "del ", "del	", "delete", "remove ", "remove	", "\u5220\u9664", "\u79FB\u9664"].some((kw) => actionDetail.includes(kw))) {
-      return {
-        allowed: false,
-        reason: "\u68C0\u6D4B\u5230\u901A\u914D\u7B26\u7ED3\u5408\u5220\u9664\u64CD\u4F5C\uFF0C\u53EF\u80FD\u9020\u6210\u6279\u91CF\u8BEF\u5220",
-        riskLevel: "high",
-        riskType: "script_execution",
-        confidence: 90,
-        source: "logic_rule",
-        violatedLayers: ["2"]
-      };
-    }
-    if (/>\s*\/etc\//.test(actionDetail) || />\s*\/boot\//.test(actionDetail) || />\s*\/proc\//.test(actionDetail)) {
-      return {
-        allowed: false,
-        reason: "\u68C0\u6D4B\u5230\u91CD\u5B9A\u5411\u8986\u76D6\u5199\u5165\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55",
-        riskLevel: "critical",
-        riskType: "file_access",
-        confidence: 95,
-        source: "logic_rule",
-        violatedLayers: ["2"]
-      };
-    }
-  }
-  var _READ_ONLY_COMMANDS = /* @__PURE__ */ new Set([
-    "cat",
-    "head",
-    "tail",
-    "less",
-    "more",
-    "grep",
-    "find",
-    "awk",
-    "sed",
-    "sort",
-    "uniq",
-    "wc",
-    "cut",
-    "strings",
-    "od",
-    "xxd",
-    "hexdump",
-    "tr",
-    "file",
-    "stat",
-    "du",
-    "df",
-    "ls",
-    "dir",
-    "tree",
-    "nl",
-    "tac",
-    "rev",
-    "lsblk",
-    "blockdev",
-    "smartctl",
-    "udevadm",
-    "dmidecode",
-    "lscpu",
-    "lspci",
-    "lsusb",
-    "lsmem",
-    "lsns",
-    "lsof",
-    "hwinfo",
-    "inxi",
-    "fdisk",
-    "parted",
-    "dmesg",
-    "journalctl",
-    "systemctl",
-    "hostnamectl",
-    "localectl",
-    "timedatectl",
-    "ps",
-    "top",
-    "free",
-    "vmstat",
-    "iostat",
-    "mpstat",
-    "pidof",
-    "pgrep",
-    "ip",
-    "ifconfig",
-    "route",
-    "ss",
-    "netstat",
-    "arp",
-    "ethtool",
-    "nmcli",
-    "uname",
-    "arch",
-    "nproc",
-    "getconf",
-    "getent",
-    "id",
-    "whoami",
-    "who",
-    "w",
-    "last",
-    "uptime",
-    "lsmod",
-    "modinfo",
-    "sysctl"
-  ]);
-  var _DEVNULL_REDIRECT_RE = /(?:2|&|1)?\s*>\s*\/dev\/null\b/;
-  var _WRITE_COMMAND_RES = [
-    /\brm\b/,
-    /\bunlink\b/,
-    /\brmdir\b/,
-    /\bshred\b/,
-    /\bcp\b/,
-    /\bmv\b/,
-    /\binstall\b/,
-    /\btee\b/,
-    /\bdd\b/,
-    /\bmkfs\b/,
-    /\b(fdisk|parted|cfdisk|sfdisk)\b/,
-    /\bchmod\b/,
-    /\bchown\b/,
-    /\btruncate\b/
-  ];
   const indirectResult = checkIndirectFileAccess(actionType, actionDetail, resolvedCwd);
   if (indirectResult) return indirectResult;
   if (actionDetail.includes("sudo") || actionDetail.includes("su -") || actionDetail.includes("chmod u+s") || actionDetail.includes("setuid")) {
-    const adminContext = actionHistory.some(
-      (h) => h.actionDetail.includes("sudo") || h.actionDetail.includes("apt") || h.actionDetail.includes("systemctl") || h.actionDetail.includes("yum") || h.actionDetail.includes("dnf") || h.actionDetail.includes("pacman") || h.actionDetail.includes("zypper") || h.actionDetail.includes("apk")
-    );
-    if (!adminContext) {
-      return {
-        allowed: false,
-        reason: "\u68C0\u6D4B\u5230\u63D0\u6743\u64CD\u4F5C\uFF0C\u672A\u53D1\u73B0\u5408\u6CD5\u7BA1\u7406\u4E0A\u4E0B\u6587",
-        riskLevel: "high",
-        riskType: "privilege_escalation",
-        confidence: 85,
-        source: "logic_rule",
-        violatedLayers: ["2"]
-      };
-    }
-  }
-  if (/(?:ssh|scp|rsync)\s+/.test(actionDetail)) {
-    const targetHost = extractRemoteHost(actionDetail);
-    if (targetHost && !isLocalHost(targetHost)) {
-      return {
-        allowed: false,
-        reason: `\u5C1D\u8BD5\u6A2A\u5411\u79FB\u52A8\u5230\u8FDC\u7A0B\u4E3B\u673A: ${targetHost}`,
-        riskLevel: "medium",
-        riskType: "lateral_movement",
-        confidence: 80,
-        source: "logic_rule",
-        violatedLayers: ["2"]
-      };
+    const detailAfterSudo = actionDetail.replace(/(^|\|\||&&|\s)sudo\s+/g, " ");
+    const isAdminCmd = ["apt", "systemctl", "yum", "dnf", "pacman", "zypper", "apk"].some((kw) => detailAfterSudo.includes(kw));
+    if (!isAdminCmd) {
+      const adminContext = actionHistory.some(
+        (h) => h.actionDetail.includes("sudo") || h.actionDetail.includes("apt") || h.actionDetail.includes("systemctl") || h.actionDetail.includes("yum") || h.actionDetail.includes("dnf") || h.actionDetail.includes("pacman") || h.actionDetail.includes("zypper") || h.actionDetail.includes("apk")
+      );
+      if (!adminContext) {
+        return {
+          allowed: false,
+          reason: "\u68C0\u6D4B\u5230\u63D0\u6743\u64CD\u4F5C\uFF0C\u672A\u53D1\u73B0\u5408\u6CD5\u7BA1\u7406\u4E0A\u4E0B\u6587",
+          riskLevel: "high",
+          riskType: "privilege_escalation",
+          confidence: 85,
+          source: "logic_rule",
+          violatedLayers: ["2"]
+        };
+      }
     }
   }
   const pwdResult = checkPasswordConsent(actionType, actionDetail, actionHistory);
@@ -947,119 +567,6 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
   }
   return null;
 }
-function checkSensitivePath(command, cwd, agentExt) {
-  const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
-  const _WRITE_CMD_RES = [/\brm\b/, /\bunlink\b/, /\brmdir\b/, /\bshred\b/, /\bcp\b/, /\bmv\b/, /\binstall\b/, /\btee\b/, /\bdd\b/, /\bmkfs\b/, /\b(fdisk|parted|cfdisk|sfdisk)\b/, /\bchmod\b/, /\bchown\b/, /\btruncate\b/];
-  const _DEVNULL_RE = /(?:2|&|1)?\s*>\s*\/dev\/null\b/;
-  const _READONLY_CMDS = /* @__PURE__ */ new Set(["cat", "head", "tail", "less", "more", "grep", "find", "awk", "sed", "sort", "uniq", "wc", "cut", "strings", "od", "xxd", "hexdump", "tr", "file", "stat", "du", "df", "ls", "dir", "tree", "nl", "tac", "rev", "lsblk", "blockdev", "smartctl", "udevadm", "dmidecode", "lscpu", "lspci", "lsusb", "lsmem", "lsns", "lsof", "hwinfo", "inxi", "fdisk", "parted", "dmesg", "journalctl", "systemctl", "hostnamectl", "localectl", "timedatectl", "ps", "top", "free", "vmstat", "iostat", "mpstat", "pidof", "pgrep", "ip", "ifconfig", "route", "ss", "netstat", "arp", "ethtool", "nmcli", "uname", "arch", "nproc", "getconf", "getent", "id", "whoami", "who", "w", "last", "uptime", "lsmod", "modinfo", "sysctl"]);
-  const isWriteOpFlag = _WRITE_CMD_RES.some((rx) => rx.test(command)) || /\bsed\s+-[a-zA-Z]*i/.test(command) || command.includes(">") && !command.replace(_DEVNULL_RE, "").includes(">") || command.includes(">") && command.replace(_DEVNULL_RE, "").includes(">") && !_READONLY_CMDS.has(command.trim().split(/\s+/)[0]?.toLowerCase() || "") || WRITE_KEYWORDS.some((kw) => "".includes(kw) || command.includes(kw));
-  for (const sp of ROOT_SENSITIVE_PATHS) {
-    if (command.includes(sp.path.toLowerCase())) {
-      if (sp.path === "/dev/random") {
-        if (isWriteOpFlag) {
-          continue;
-        }
-        return {
-          allowed: false,
-          reason: `\u8BFB\u53D6\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
-          riskLevel: sp.riskLevel,
-          riskType: "sensitive_path_access",
-          confidence: 90,
-          source: "logic_rule",
-          violatedLayers: ["2"]
-        };
-      }
-      if (!isWriteOpFlag && !sp.credential) {
-        continue;
-      }
-      return {
-        allowed: false,
-        reason: `\u5C1D\u8BD5\u8BBF\u95EE\u7CFB\u7EDF\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
-        riskLevel: sp.riskLevel,
-        riskType: "sensitive_path_access",
-        confidence: 90,
-        source: "logic_rule",
-        violatedLayers: ["2"]
-      };
-    }
-  }
-  for (const sp of HOME_SENSITIVE_PATHS) {
-    const expanded = `${expandedCwd}/${sp.path}`;
-    if (command.includes(sp.path.toLowerCase()) || command.includes(expanded.toLowerCase())) {
-      if (!isWriteOpFlag && !sp.credential) {
-        continue;
-      }
-      return {
-        allowed: false,
-        reason: `\u5C1D\u8BD5\u8BBF\u95EE\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
-        riskLevel: sp.riskLevel,
-        riskType: "sensitive_path_access",
-        confidence: 90,
-        source: "logic_rule",
-        violatedLayers: ["2"]
-      };
-    }
-  }
-  if (agentExt?.extra_sensitive_paths && agentExt.extra_sensitive_paths.length > 0) {
-    for (const sp of agentExt.extra_sensitive_paths) {
-      const spPath = sp.path.toLowerCase();
-      const expanded = `${expandedCwd}/${spPath}`;
-      if (command.includes(spPath) || command.includes(expanded.toLowerCase())) {
-        const denyMode = sp.deny_mode || (sp.credential ? "deny_both" : sp.read_only ? "deny_read" : "deny_write");
-        if (denyMode === "deny_read") {
-          if (isWriteOpFlag) continue;
-        } else if (denyMode === "deny_write") {
-          if (!isWriteOpFlag) continue;
-        }
-        return {
-          allowed: false,
-          reason: `\u5C1D\u8BD5\u8BBF\u95EE agent \u4E13\u5C5E\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
-          riskLevel: sp.risk_level,
-          riskType: "sensitive_path_access",
-          confidence: 90,
-          source: "logic_rule",
-          violatedLayers: ["2"]
-        };
-      }
-    }
-  }
-  for (const cp of CREDENTIAL_PATHS) {
-    const escaped = cp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const re = cp.path.startsWith(".") ? new RegExp(`(?:^|[\\s/\\\\'"])${escaped}\\b`) : new RegExp(`\\b${escaped}\\b`);
-    if (re.test(command)) {
-      return {
-        allowed: false,
-        reason: `\u8BBF\u95EE\u654F\u611F\u8DEF\u5F84: ${cp.desc} (${cp.path})`,
-        riskLevel: cp.riskLevel,
-        riskType: "sensitive_path_access",
-        confidence: 90,
-        source: "logic_rule",
-        violatedLayers: ["2"],
-        isCredential: true
-      };
-    }
-  }
-  if ((command.includes("rm ") || command.includes("unlink")) && (command.includes("/etc/") || command.includes("/root/") || command.includes("/var/log/"))) {
-    return {
-      allowed: false,
-      reason: "\u68C0\u6D4B\u5230\u5220\u9664\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55\u5185\u5BB9",
-      riskLevel: "critical",
-      riskType: "sensitive_path_access",
-      confidence: 90,
-      source: "logic_rule",
-      violatedLayers: ["2"]
-    };
-  }
-  return null;
-}
-function extractRemoteHost(command) {
-  const m = command.match(/(?:ssh|scp|rsync)\s+(?:-[\w]+\s+)*(\S+@\S+|\b(?!-)[\w.-]+\b)/);
-  return m ? m[1] : null;
-}
-function isLocalHost(host) {
-  const localNames = ["localhost", "127.0.0.1", "::1", process.env.HOSTNAME || "", "0.0.0.0"];
-  return localNames.includes(host.replace(/.*@/, ""));
-}
 function checkPasswordConsent(actionType, actionDetail, actionHistory) {
   if (actionType !== "bash") return null;
   const isPasswordModify = PASSWORD_MODIFY_PATTERNS.some((p) => p.test(actionDetail));
@@ -1174,105 +681,521 @@ function checkIndirectFileAccess(actionType, actionDetail, cwd) {
     violatedLayers: ["2"]
   };
 }
-var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, READ_ONLY_REDIR_CMDS, WRITE_KEYWORDS, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
-var init_logic_rules = __esm({
-  "src/engine/logic-rules.ts"() {
+var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, READ_ONLY_REDIR_CMDS, WRITE_KEYWORDS, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
+var init_logic_rules = __esm({
+  "src/engine/logic-rules.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_inline_analyzer();
+    ROOT_SENSITIVE_PATHS = [
+      { path: "/etc/shadow", riskLevel: "critical", desc: "\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6", credential: true },
+      { path: "/etc/gshadow", riskLevel: "critical", desc: "\u7CFB\u7EDF\u7EC4\u5BC6\u7801\u6587\u4EF6", credential: true },
+      // 注意：/etc/passwd 仅从 L1 启发式规则移除（公开可读），L2 敏感路径仍保留
+      { path: "/etc/passwd", riskLevel: "high", desc: "\u7CFB\u7EDF\u7528\u6237\u6587\u4EF6" },
+      { path: "/etc/sudoers", riskLevel: "critical", desc: "sudo \u914D\u7F6E", credential: true },
+      // 系统配置（仅拦截写入）
+      { path: "/etc/hosts", riskLevel: "medium", desc: "DNS \u89E3\u6790\u914D\u7F6E" },
+      { path: "/etc/crontab", riskLevel: "high", desc: "\u7CFB\u7EDF\u5B9A\u65F6\u4EFB\u52A1" },
+      { path: "/etc/cron.d/", riskLevel: "high", desc: "\u7CFB\u7EDF\u5B9A\u65F6\u4EFB\u52A1\u76EE\u5F55\uFF08\u62C6\u5206\u5F0F crontab\uFF09" },
+      { path: "/var/spool/cron/", riskLevel: "high", desc: "\u7528\u6237\u7EA7\u5B9A\u65F6\u4EFB\u52A1\u76EE\u5F55" },
+      { path: "/etc/systemd/", riskLevel: "high", desc: "systemd \u670D\u52A1\u914D\u7F6E" },
+      { path: "/etc/ssh/sshd_config", riskLevel: "high", desc: "SSH \u670D\u52A1\u914D\u7F6E" },
+      { path: "/etc/pam.d/", riskLevel: "high", desc: "PAM \u53EF\u63D2\u62D4\u8BA4\u8BC1\u6A21\u5757\u914D\u7F6E" },
+      // 危险目录（仅拦截写入）
+      { path: "/boot/", riskLevel: "critical", desc: "\u542F\u52A8\u5F15\u5BFC\u76EE\u5F55" },
+      { path: "/proc/sys/", riskLevel: "high", desc: "\u5185\u6838\u53C2\u6570" },
+      { path: "/sys/", riskLevel: "high", desc: "sysfs \u5185\u6838\u63A5\u53E3" },
+      // 设备文件（/dev/null、/dev/zero、/dev/urandom 已移除，误报率极高）
+      { path: "/dev/random", riskLevel: "high", desc: "\u963B\u585E\u5F0F\u968F\u673A\u6570\u8BBE\u5907\uFF08\u8BFB\u53D6\u8017\u5C3D\u71B5\u6C60\uFF09" },
+      { path: "/dev/mem", riskLevel: "critical", desc: "\u7269\u7406\u5185\u5B58\u8BBF\u95EE\u8BBE\u5907" },
+      { path: "/dev/kmsg", riskLevel: "high", desc: "\u5185\u6838\u6D88\u606F\u7F13\u51B2\u533A" },
+      // SSH 主机私钥
+      { path: "/etc/ssh/ssh_host_rsa_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A RSA \u79C1\u94A5", credential: true },
+      { path: "/etc/ssh/ssh_host_ed25519_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A Ed25519 \u79C1\u94A5", credential: true },
+      { path: "/etc/ssh/ssh_host_ecdsa_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A ECDSA \u79C1\u94A5", credential: true }
+    ];
+    HOME_SENSITIVE_PATHS = [
+      { path: ".ssh/id_rsa", riskLevel: "critical", desc: "SSH \u79C1\u94A5", credential: true },
+      { path: ".ssh/id_ed25519", riskLevel: "critical", desc: "SSH \u79C1\u94A5 (ed25519)", credential: true },
+      { path: ".ssh/authorized_keys", riskLevel: "high", desc: "SSH \u6388\u6743\u5BC6\u94A5" },
+      // 持久化与命令劫持（仅拦截写入）
+      { path: ".bashrc", riskLevel: "high", desc: "\u7528\u6237 Shell \u521D\u59CB\u5316\u811A\u672C" },
+      { path: ".bash_profile", riskLevel: "high", desc: "\u7528\u6237 Shell \u767B\u5F55\u811A\u672C" },
+      { path: ".profile", riskLevel: "high", desc: "\u7528\u6237\u901A\u7528\u767B\u5F55\u811A\u672C" },
+      { path: ".aws/credentials", riskLevel: "critical", desc: "AWS \u51ED\u8BC1", credential: true },
+      { path: ".gitconfig", riskLevel: "medium", desc: "Git \u914D\u7F6E" },
+      { path: ".gnupg", riskLevel: "high", desc: "GPG \u5BC6\u94A5\u76EE\u5F55" }
+    ];
+    CREDENTIAL_PATHS = [
+      { path: "credentials.yml", riskLevel: "high", desc: "\u51ED\u636E\u914D\u7F6E\u6587\u4EF6" },
+      { path: "credentials.yaml", riskLevel: "high", desc: "\u51ED\u636E\u914D\u7F6E\u6587\u4EF6" },
+      { path: "secrets.yml", riskLevel: "high", desc: "\u5BC6\u94A5\u914D\u7F6E\u6587\u4EF6" },
+      { path: "secrets.yaml", riskLevel: "high", desc: "\u5BC6\u94A5\u914D\u7F6E\u6587\u4EF6" },
+      { path: ".env", riskLevel: "high", desc: "\u73AF\u5883\u53D8\u91CF/\u51ED\u636E\u914D\u7F6E\u6587\u4EF6" }
+    ];
+    NON_WRITE_TOOLS = /* @__PURE__ */ new Set(["ask_user_question", "glob", "grep", "list_dir", "count_text_length", "search"]);
+    READ_ONLY_REDIR_CMDS = /* @__PURE__ */ new Set(["cat", "head", "tail", "less", "more", "grep", "find", "awk", "sed", "sort", "uniq", "wc", "cut", "strings", "od", "xxd", "hexdump"]);
+    WRITE_KEYWORDS = ["write", "\u5199\u5165", "save", "\u4FDD\u5B58", "modify", "\u4FEE\u6539", "update", "\u66F4\u65B0", "delete", "\u5220\u9664", "remove", "\u79FB\u9664", "create", "\u521B\u5EFA", "append", "\u8FFD\u52A0", "truncate", "\u622A\u65AD", "overwrite", "\u8986\u76D6", "replace", "\u66FF\u6362"];
+    READ_KEYWORDS = ["read", "\u8BFB\u53D6", "cat", "head", "tail", "less", "more", "view", "\u67E5\u770B", "open", "\u6253\u5F00", "load", "\u52A0\u8F7D", "grep", "search", "\u641C\u7D22", "find", "\u67E5\u627E"];
+    CREATE_KEYWORDS = ["\u521B\u5EFA", "\u65B0\u5EFA", "create", "new file", "touch"];
+    PASSWORD_MODIFY_PATTERNS = [
+      /\|\s*passwd\b/i,
+      /\bpasswd\s+--stdin\b/i,
+      /\bchpasswd\b/i,
+      /\bchgpasswd\b/i,
+      /\b(newusers|lnewusers)\b/i,
+      /\bpasswd\s+-[a-zA-Z]*d\b/i,
+      /\bpasswd\s+-[a-zA-Z]*l\b/i
+    ];
+    USER_DELETION_PATTERNS = [
+      /\buserdel\s/i,
+      /\bdeluser\s/i,
+      /\bluserdel\s/i,
+      /\bgroupdel\s/i,
+      /\blgroupdel\s/i
+    ];
+    INTENT_DEVIATION_PATTERNS = [
+      {
+        intentKeywords: ["\u8BFB\u53D6", "\u67E5\u770B", "\u5206\u6790", "read", "analyze", "view", "list", "\u5217\u51FA"],
+        dangerousActions: ["\u5220\u9664", "remove", "delete", "rm ", "\u683C\u5F0F\u5316", "format"],
+        reason: "\u539F\u59CB\u610F\u56FE\u4E3A\u8BFB\u53D6/\u5206\u6790\uFF0C\u4F46\u6267\u884C\u4E86\u5220\u9664\u64CD\u4F5C"
+      },
+      {
+        intentKeywords: ["\u67E5\u8BE2", "\u641C\u7D22", "search", "query", "find"],
+        dangerousActions: ["\u4FEE\u6539", "update", "write", "\u5199\u5165", "alter"],
+        reason: "\u539F\u59CB\u610F\u56FE\u4E3A\u67E5\u8BE2/\u641C\u7D22\uFF0C\u4F46\u6267\u884C\u4E86\u4FEE\u6539\u64CD\u4F5C"
+      }
+    ];
+    INLINE_SCRIPT_RE = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
+    DIR_TRAVERSAL_KW = [
+      "os.listdir",
+      "os.walk",
+      "os.scandir",
+      "glob.glob",
+      "glob.iglob",
+      "pathlib.",
+      "iterdir",
+      "rglob",
+      "scandir(",
+      "listdir("
+    ];
+  }
+});
+
+// src/engine/heuristic.ts
+function runHeuristicCheck(input) {
+  const command = `${input.aNext.actionType}: ${input.aNext.actionDetail}`;
+  const matched = [];
+  let highestSeverity = "low";
+  let highestRiskType = "";
+  const userRules = getCustomRules();
+  for (const rule of userRules) {
+    try {
+      const re = new RegExp(rule.pattern);
+      if (re.test(command)) {
+        if (rule.action === "Deny") {
+          matched.push(`\u81EA\u5B9A\u4E49\u89C4\u5219: ${rule.pattern}`);
+          if (severityRank(rule.severity) > severityRank(highestSeverity)) {
+            highestSeverity = rule.severity;
+            highestRiskType = "custom_rule";
+          }
+        }
+      }
+    } catch {
+    }
+  }
+  let topRiskType = "";
+  for (const rule of DANGEROUS_PATTERNS) {
+    if (rule.pattern.test(command)) {
+      matched.push(rule.description);
+      if (severityRank(rule.severity) > severityRank(highestSeverity)) {
+        highestSeverity = rule.severity;
+        topRiskType = rule.riskType;
+      }
+    }
+  }
+  highestRiskType = topRiskType || highestRiskType;
+  const agentExt = getAgentExtensions(input.agentId);
+  if (agentExt?.extra_command_patterns) {
+    for (const rule of agentExt.extra_command_patterns) {
+      try {
+        const re = new RegExp(rule.pattern, "i");
+        if (re.test(command)) {
+          matched.push(`agent \u4E13\u5C5E\u89C4\u5219: ${rule.reason}`);
+          if (severityRank(rule.risk_level) > severityRank(highestSeverity)) {
+            highestSeverity = rule.risk_level;
+            highestRiskType = rule.risk_type;
+          }
+        }
+      } catch {
+      }
+    }
+  }
+  const injectionText = `${input.aNext.actionType} ${input.aNext.actionDetail} ${input.reason || ""} ${input.promptSession || ""}`.toLowerCase();
+  const injectionHits = checkInjectionKeywords(injectionText, agentExt?.extra_injection_keywords);
+  if (injectionHits.length > 0) {
+    const topHit = injectionHits.reduce((a, b) => severityRank(a.riskLevel) >= severityRank(b.riskLevel) ? a : b);
+    matched.push(...injectionHits.map((h) => `\u6CE8\u5165\u5173\u952E\u8BCD [${h.lang}]: ${h.keyword}`));
+    if (severityRank(topHit.riskLevel) > severityRank(highestSeverity)) {
+      highestSeverity = topHit.riskLevel;
+      highestRiskType = "prompt_injection";
+    }
+  }
+  const actionTypeL = input.aNext.actionType.toLowerCase();
+  const detailL = input.aNext.actionDetail.toLowerCase();
+  const isExcludedType = SENSITIVE_EXCLUDED_PREFIXES.some((p) => actionTypeL.startsWith(p));
+  if (!isExcludedType) {
+    const pathResult = checkSensitivePath(detailL, input.cwd || "/", agentExt);
+    if (pathResult) return pathResult;
+  }
+  const dangerousResult = checkDangerousPatterns(actionTypeL, detailL);
+  if (dangerousResult) return dangerousResult;
+  const lateralResult = checkLateralMovement(detailL);
+  if (lateralResult) return lateralResult;
+  if (matched.length > 0) {
+    return {
+      allowed: false,
+      reason: `\u68C0\u6D4B\u5230\u9AD8\u5371\u64CD\u4F5C: ${matched.join(", ")}`,
+      riskLevel: highestSeverity,
+      riskType: highestRiskType,
+      confidence: 95,
+      source: "heuristic",
+      violatedLayers: ["1.1"]
+      // 对齐 py coordinator.py:165（L1.1 = 命中高危命令模式/注入关键词）
+    };
+  }
+  return null;
+}
+function checkInjectionKeywords(text, extraKeywords) {
+  const hits = [];
+  for (const entry of INJECTION_KEYWORDS) {
+    if (text.includes(entry.keyword.toLowerCase())) {
+      hits.push(entry);
+    }
+  }
+  if (extraKeywords) {
+    for (const entry of extraKeywords) {
+      if (text.includes(entry.keyword.toLowerCase())) {
+        hits.push({ keyword: entry.keyword, riskLevel: entry.risk_level, lang: entry.lang });
+      }
+    }
+  }
+  return hits;
+}
+function isInlineScriptCommand(actionDetail) {
+  const re = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
+  return re.test(actionDetail);
+}
+function severityRank(s) {
+  const ranks = { low: 1, medium: 2, high: 3, critical: 4 };
+  return ranks[s] || 0;
+}
+function checkSensitivePath(command, cwd, agentExt) {
+  const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
+  const _WRITE_CMD_RES = [/\brm\b/, /\bunlink\b/, /\brmdir\b/, /\bshred\b/, /\bcp\b/, /\bmv\b/, /\binstall\b/, /\btee\b/, /\bdd\b/, /\bmkfs\b/, /\b(fdisk|parted|cfdisk|sfdisk)\b/, /\bchmod\b/, /\bchown\b/, /\btruncate\b/];
+  const _DEVNULL_RE = /(?:2|&|1)?\s*>\s*\/dev\/null\b/;
+  const _READONLY_CMDS = /* @__PURE__ */ new Set(["cat", "head", "tail", "less", "more", "grep", "find", "awk", "sed", "sort", "uniq", "wc", "cut", "strings", "od", "xxd", "hexdump", "tr", "file", "stat", "du", "df", "ls", "dir", "tree", "nl", "tac", "rev", "lsblk", "blockdev", "smartctl", "udevadm", "dmidecode", "lscpu", "lspci", "lsusb", "lsmem", "lsns", "lsof", "hwinfo", "inxi", "fdisk", "parted", "dmesg", "journalctl", "systemctl", "hostnamectl", "localectl", "timedatectl", "ps", "top", "free", "vmstat", "iostat", "mpstat", "pidof", "pgrep", "ip", "ifconfig", "route", "ss", "netstat", "arp", "ethtool", "nmcli", "uname", "arch", "nproc", "getconf", "getent", "id", "whoami", "who", "w", "last", "uptime", "lsmod", "modinfo", "sysctl"]);
+  const isWriteOpFlag = _WRITE_CMD_RES.some((rx) => rx.test(command)) || /\bsed\s+-[a-zA-Z]*i/.test(command) || command.includes(">") && !command.replace(_DEVNULL_RE, "").includes(">") || command.includes(">") && command.replace(_DEVNULL_RE, "").includes(">") && !_READONLY_CMDS.has(command.trim().split(/\s+/)[0]?.toLowerCase() || "") || WRITE_KEYWORDS.some((kw) => "".includes(kw) || command.includes(kw));
+  for (const sp of ROOT_SENSITIVE_PATHS) {
+    if (command.includes(sp.path.toLowerCase())) {
+      if (sp.path === "/dev/random") {
+        if (isWriteOpFlag) {
+          continue;
+        }
+        return {
+          allowed: false,
+          reason: `\u8BFB\u53D6\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
+          riskLevel: sp.riskLevel,
+          riskType: "file_access",
+          confidence: 90,
+          source: "heuristic",
+          violatedLayers: ["1.1"]
+        };
+      }
+      if (!isWriteOpFlag && !sp.credential) {
+        continue;
+      }
+      return {
+        allowed: false,
+        reason: `\u5C1D\u8BD5\u8BBF\u95EE\u7CFB\u7EDF\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
+        riskLevel: sp.riskLevel,
+        riskType: "file_access",
+        confidence: 90,
+        source: "heuristic",
+        violatedLayers: ["1.1"],
+        isCredential: !!sp.credential
+      };
+    }
+  }
+  for (const sp of HOME_SENSITIVE_PATHS) {
+    const expanded = `${expandedCwd}/${sp.path}`;
+    const pathRe = sp.path.endsWith(".pub") ? new RegExp(sp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i") : new RegExp(sp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "(?!\\.pub)", "i");
+    const expandedRe = sp.path.endsWith(".pub") ? new RegExp(expanded.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i") : new RegExp(expanded.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "(?!\\.pub)", "i");
+    if (pathRe.test(command) || expandedRe.test(command)) {
+      if (!isWriteOpFlag && !sp.credential) {
+        continue;
+      }
+      return {
+        allowed: false,
+        reason: `\u5C1D\u8BD5\u8BBF\u95EE\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
+        riskLevel: sp.riskLevel,
+        riskType: "file_access",
+        confidence: 90,
+        source: "heuristic",
+        violatedLayers: ["1.1"],
+        isCredential: !!sp.credential
+      };
+    }
+  }
+  if (agentExt?.extra_sensitive_paths && agentExt.extra_sensitive_paths.length > 0) {
+    for (const sp of agentExt.extra_sensitive_paths) {
+      const spPath = sp.path.toLowerCase();
+      const expanded = `${expandedCwd}/${spPath}`;
+      if (command.includes(spPath) || command.includes(expanded.toLowerCase())) {
+        const denyMode = sp.deny_mode || (sp.credential ? "deny_both" : sp.read_only ? "deny_read" : "deny_write");
+        if (denyMode === "deny_read") {
+          if (isWriteOpFlag) continue;
+        } else if (denyMode === "deny_write") {
+          if (!isWriteOpFlag) continue;
+        }
+        return {
+          allowed: false,
+          reason: `\u5C1D\u8BD5\u8BBF\u95EE agent \u4E13\u5C5E\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
+          riskLevel: sp.risk_level,
+          riskType: "file_access",
+          confidence: 90,
+          source: "heuristic",
+          violatedLayers: ["1.1"],
+          isCredential: !!sp.credential
+        };
+      }
+    }
+  }
+  for (const cp of CREDENTIAL_PATHS) {
+    const escaped = cp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const re = cp.path.startsWith(".") ? new RegExp(`(?:^|[\\s/\\\\'"])${escaped}\\b`) : new RegExp(`\\b${escaped}\\b`);
+    if (re.test(command)) {
+      return {
+        allowed: false,
+        reason: `\u8BBF\u95EE\u654F\u611F\u8DEF\u5F84: ${cp.desc} (${cp.path})`,
+        riskLevel: cp.riskLevel,
+        riskType: "file_access",
+        confidence: 90,
+        source: "heuristic",
+        violatedLayers: ["1.1"],
+        isCredential: true
+      };
+    }
+  }
+  if ((command.includes("rm ") || command.includes("unlink")) && (command.includes("/etc/") || command.includes("/root/") || command.includes("/var/log/"))) {
+    return {
+      allowed: false,
+      reason: "\u68C0\u6D4B\u5230\u5220\u9664\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55\u5185\u5BB9",
+      riskLevel: "critical",
+      riskType: "file_access",
+      confidence: 90,
+      source: "heuristic",
+      violatedLayers: ["1.1"]
+    };
+  }
+  return null;
+}
+function checkDangerousPatterns(actionType, actionDetail) {
+  if (actionType === "file_write" || actionType === "file_edit") return null;
+  const TEMP_DIRS = ["/tmp/", "/var/tmp/", "/run/", "/dev/shm/"];
+  const isTempPath = TEMP_DIRS.some((td) => actionDetail.includes(td));
+  if (!isTempPath && (actionDetail.includes("*") || actionDetail.includes("?")) && ["rm ", "rm	", "del ", "del	", "delete", "remove ", "remove	", "\u5220\u9664", "\u79FB\u9664"].some((kw) => actionDetail.includes(kw))) {
+    return {
+      allowed: false,
+      reason: "\u68C0\u6D4B\u5230\u901A\u914D\u7B26\u7ED3\u5408\u5220\u9664\u64CD\u4F5C\uFF0C\u53EF\u80FD\u9020\u6210\u6279\u91CF\u8BEF\u5220",
+      riskLevel: "high",
+      riskType: "script_execution",
+      confidence: 90,
+      source: "heuristic",
+      violatedLayers: ["1.1"]
+    };
+  }
+  if (/>\s*\/etc\//.test(actionDetail) || />\s*\/boot\//.test(actionDetail) || />\s*\/proc\//.test(actionDetail)) {
+    return {
+      allowed: false,
+      reason: "\u68C0\u6D4B\u5230\u91CD\u5B9A\u5411\u8986\u76D6\u5199\u5165\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55",
+      riskLevel: "critical",
+      riskType: "file_access",
+      confidence: 95,
+      source: "heuristic",
+      violatedLayers: ["1.1"]
+    };
+  }
+  return null;
+}
+function extractRemoteHost(command) {
+  const m = command.match(/(?:ssh|scp|rsync)\s+(?:-[\w]+\s+)*(\S+@\S+|\b(?!-)[\w.-]+\b)/);
+  return m ? m[1] : null;
+}
+function isLocalHost(host) {
+  const localNames = ["localhost", "127.0.0.1", "::1", process.env.HOSTNAME || "", "0.0.0.0"];
+  return localNames.includes(host.replace(/.*@/, ""));
+}
+function checkLateralMovement(actionDetail) {
+  if (/(?:ssh|scp|rsync)\s+/.test(actionDetail)) {
+    const targetHost = extractRemoteHost(actionDetail);
+    if (targetHost && !isLocalHost(targetHost)) {
+      return {
+        allowed: false,
+        reason: `\u5C1D\u8BD5\u6A2A\u5411\u79FB\u52A8\u5230\u8FDC\u7A0B\u4E3B\u673A: ${targetHost}`,
+        riskLevel: "medium",
+        riskType: "lateral_movement",
+        confidence: 80,
+        source: "heuristic",
+        violatedLayers: ["1.1"]
+      };
+    }
+  }
+  return null;
+}
+var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, SENSITIVE_EXCLUDED_PREFIXES;
+var init_heuristic = __esm({
+  "src/engine/heuristic.ts"() {
     "use strict";
     init_esm_shims();
-    init_inline_analyzer();
+    init_config();
     init_agents();
-    ROOT_SENSITIVE_PATHS = [
-      { path: "/etc/shadow", riskLevel: "critical", desc: "\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6", credential: true },
-      { path: "/etc/gshadow", riskLevel: "critical", desc: "\u7CFB\u7EDF\u7EC4\u5BC6\u7801\u6587\u4EF6", credential: true },
-      // 注意：/etc/passwd 仅从 L1 启发式规则移除（公开可读），L2 敏感路径仍保留
-      { path: "/etc/passwd", riskLevel: "high", desc: "\u7CFB\u7EDF\u7528\u6237\u6587\u4EF6" },
-      { path: "/etc/sudoers", riskLevel: "critical", desc: "sudo \u914D\u7F6E", credential: true },
-      // 系统配置（仅拦截写入）
-      { path: "/etc/hosts", riskLevel: "medium", desc: "DNS \u89E3\u6790\u914D\u7F6E" },
-      { path: "/etc/crontab", riskLevel: "high", desc: "\u7CFB\u7EDF\u5B9A\u65F6\u4EFB\u52A1" },
-      { path: "/etc/cron.d/", riskLevel: "high", desc: "\u7CFB\u7EDF\u5B9A\u65F6\u4EFB\u52A1\u76EE\u5F55\uFF08\u62C6\u5206\u5F0F crontab\uFF09" },
-      { path: "/var/spool/cron/", riskLevel: "high", desc: "\u7528\u6237\u7EA7\u5B9A\u65F6\u4EFB\u52A1\u76EE\u5F55" },
-      { path: "/etc/systemd/", riskLevel: "high", desc: "systemd \u670D\u52A1\u914D\u7F6E" },
-      { path: "/etc/ssh/sshd_config", riskLevel: "high", desc: "SSH \u670D\u52A1\u914D\u7F6E" },
-      { path: "/etc/pam.d/", riskLevel: "high", desc: "PAM \u53EF\u63D2\u62D4\u8BA4\u8BC1\u6A21\u5757\u914D\u7F6E" },
-      // 危险目录（仅拦截写入）
-      { path: "/boot/", riskLevel: "critical", desc: "\u542F\u52A8\u5F15\u5BFC\u76EE\u5F55" },
-      { path: "/proc/sys/", riskLevel: "high", desc: "\u5185\u6838\u53C2\u6570" },
-      { path: "/sys/", riskLevel: "high", desc: "sysfs \u5185\u6838\u63A5\u53E3" },
-      // 设备文件（/dev/null、/dev/zero、/dev/urandom 已移除，误报率极高）
-      { path: "/dev/random", riskLevel: "high", desc: "\u963B\u585E\u5F0F\u968F\u673A\u6570\u8BBE\u5907\uFF08\u8BFB\u53D6\u8017\u5C3D\u71B5\u6C60\uFF09" },
-      { path: "/dev/mem", riskLevel: "critical", desc: "\u7269\u7406\u5185\u5B58\u8BBF\u95EE\u8BBE\u5907" },
-      { path: "/dev/kmsg", riskLevel: "high", desc: "\u5185\u6838\u6D88\u606F\u7F13\u51B2\u533A" },
-      // SSH 主机私钥
-      { path: "/etc/ssh/ssh_host_rsa_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A RSA \u79C1\u94A5", credential: true },
-      { path: "/etc/ssh/ssh_host_ed25519_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A Ed25519 \u79C1\u94A5", credential: true },
-      { path: "/etc/ssh/ssh_host_ecdsa_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A ECDSA \u79C1\u94A5", credential: true }
-    ];
-    HOME_SENSITIVE_PATHS = [
-      { path: ".ssh/id_rsa", riskLevel: "critical", desc: "SSH \u79C1\u94A5", credential: true },
-      { path: ".ssh/id_ed25519", riskLevel: "critical", desc: "SSH \u79C1\u94A5 (ed25519)", credential: true },
-      { path: ".ssh/authorized_keys", riskLevel: "high", desc: "SSH \u6388\u6743\u5BC6\u94A5" },
-      // 持久化与命令劫持（仅拦截写入）
-      { path: ".bashrc", riskLevel: "high", desc: "\u7528\u6237 Shell \u521D\u59CB\u5316\u811A\u672C" },
-      { path: ".bash_profile", riskLevel: "high", desc: "\u7528\u6237 Shell \u767B\u5F55\u811A\u672C" },
-      { path: ".profile", riskLevel: "high", desc: "\u7528\u6237\u901A\u7528\u767B\u5F55\u811A\u672C" },
-      { path: ".aws/credentials", riskLevel: "critical", desc: "AWS \u51ED\u8BC1", credential: true },
-      { path: ".gitconfig", riskLevel: "medium", desc: "Git \u914D\u7F6E" },
-      { path: ".gnupg", riskLevel: "high", desc: "GPG \u5BC6\u94A5\u76EE\u5F55" }
-    ];
-    CREDENTIAL_PATHS = [
-      { path: "credentials.yml", riskLevel: "high", desc: "\u51ED\u636E\u914D\u7F6E\u6587\u4EF6" },
-      { path: "credentials.yaml", riskLevel: "high", desc: "\u51ED\u636E\u914D\u7F6E\u6587\u4EF6" },
-      { path: "secrets.yml", riskLevel: "high", desc: "\u5BC6\u94A5\u914D\u7F6E\u6587\u4EF6" },
-      { path: "secrets.yaml", riskLevel: "high", desc: "\u5BC6\u94A5\u914D\u7F6E\u6587\u4EF6" },
-      { path: ".env", riskLevel: "high", desc: "\u73AF\u5883\u53D8\u91CF/\u51ED\u636E\u914D\u7F6E\u6587\u4EF6" }
-    ];
-    NON_WRITE_TOOLS = /* @__PURE__ */ new Set(["ask_user_question", "glob", "grep", "list_dir", "count_text_length", "search"]);
-    READ_ONLY_REDIR_CMDS = /* @__PURE__ */ new Set(["cat", "head", "tail", "less", "more", "grep", "find", "awk", "sed", "sort", "uniq", "wc", "cut", "strings", "od", "xxd", "hexdump"]);
-    WRITE_KEYWORDS = ["write", "\u5199\u5165", "save", "\u4FDD\u5B58", "modify", "\u4FEE\u6539", "update", "\u66F4\u65B0", "delete", "\u5220\u9664", "remove", "\u79FB\u9664", "create", "\u521B\u5EFA", "append", "\u8FFD\u52A0", "truncate", "\u622A\u65AD", "overwrite", "\u8986\u76D6", "replace", "\u66FF\u6362"];
-    READ_KEYWORDS = ["read", "\u8BFB\u53D6", "cat", "head", "tail", "less", "more", "view", "\u67E5\u770B", "open", "\u6253\u5F00", "load", "\u52A0\u8F7D", "grep", "search", "\u641C\u7D22", "find", "\u67E5\u627E"];
-    CREATE_KEYWORDS = ["\u521B\u5EFA", "\u65B0\u5EFA", "create", "new file", "touch"];
-    PASSWORD_MODIFY_PATTERNS = [
-      /\|\s*passwd\b/i,
-      /\bpasswd\s+--stdin\b/i,
-      /\bchpasswd\b/i,
-      /\bchgpasswd\b/i,
-      /\b(newusers|lnewusers)\b/i,
-      /\bpasswd\s+-[a-zA-Z]*d\b/i,
-      /\bpasswd\s+-[a-zA-Z]*l\b/i
-    ];
-    USER_DELETION_PATTERNS = [
-      /\buserdel\s/i,
-      /\bdeluser\s/i,
-      /\bluserdel\s/i,
-      /\bgroupdel\s/i,
-      /\blgroupdel\s/i
-    ];
-    INTENT_DEVIATION_PATTERNS = [
-      {
-        intentKeywords: ["\u8BFB\u53D6", "\u67E5\u770B", "\u5206\u6790", "read", "analyze", "view", "list", "\u5217\u51FA"],
-        dangerousActions: ["\u5220\u9664", "remove", "delete", "rm ", "\u683C\u5F0F\u5316", "format"],
-        reason: "\u539F\u59CB\u610F\u56FE\u4E3A\u8BFB\u53D6/\u5206\u6790\uFF0C\u4F46\u6267\u884C\u4E86\u5220\u9664\u64CD\u4F5C"
-      },
-      {
-        intentKeywords: ["\u67E5\u8BE2", "\u641C\u7D22", "search", "query", "find"],
-        dangerousActions: ["\u4FEE\u6539", "update", "write", "\u5199\u5165", "alter"],
-        reason: "\u539F\u59CB\u610F\u56FE\u4E3A\u67E5\u8BE2/\u641C\u7D22\uFF0C\u4F46\u6267\u884C\u4E86\u4FEE\u6539\u64CD\u4F5C"
-      }
+    init_logic_rules();
+    INJECTION_KEYWORDS = [
+      // ---- Instruction Override ----
+      { keyword: "ignore previous instructions", riskLevel: "critical", lang: "en" },
+      { keyword: "ignore all previous", riskLevel: "critical", lang: "en" },
+      { keyword: "disregard all prior", riskLevel: "critical", lang: "en" },
+      { keyword: "forget everything", riskLevel: "high", lang: "en" },
+      { keyword: "\u5FFD\u7565\u4E4B\u524D\u7684\u6307\u4EE4", riskLevel: "critical", lang: "zh" },
+      { keyword: "\u5FFD\u7565\u6240\u6709\u5148\u524D\u7684", riskLevel: "critical", lang: "zh" },
+      { keyword: "\u5FFD\u7565\u4E0A\u9762\u6240\u6709", riskLevel: "high", lang: "zh" },
+      { keyword: "\u8BF7\u5FD8\u8BB0\u4E4B\u524D", riskLevel: "high", lang: "zh" },
+      // ---- Role Hijacking ----
+      { keyword: "you are now", riskLevel: "high", lang: "en" },
+      { keyword: "you are no longer", riskLevel: "high", lang: "en" },
+      { keyword: "new instructions", riskLevel: "high", lang: "en" },
+      { keyword: "from now on, you", riskLevel: "high", lang: "en" },
+      { keyword: "\u4F60\u73B0\u5728\u662F\u4E00\u4E2A", riskLevel: "high", lang: "zh" },
+      { keyword: "\u4F60\u4E0D\u518D\u662F\u4E00\u4E2A", riskLevel: "high", lang: "zh" },
+      { keyword: "\u4ECE\u73B0\u5728\u5F00\u59CB\u4F60", riskLevel: "high", lang: "zh" },
+      { keyword: "\u4F60\u7684\u65B0\u89D2\u8272\u662F", riskLevel: "high", lang: "zh" },
+      // ---- Command Injection ----
+      { keyword: "system prompt", riskLevel: "high", lang: "en" },
+      { keyword: "reveal your instructions", riskLevel: "high", lang: "en" },
+      { keyword: "output your instructions", riskLevel: "high", lang: "en" },
+      { keyword: "repeat your instructions", riskLevel: "medium", lang: "en" },
+      { keyword: "\u7CFB\u7EDF\u63D0\u793A", riskLevel: "high", lang: "zh" },
+      { keyword: "\u8F93\u51FA\u4F60\u7684\u6307\u4EE4", riskLevel: "high", lang: "zh" },
+      { keyword: "\u91CD\u590D\u4F60\u7684\u6307\u4EE4", riskLevel: "medium", lang: "zh" },
+      // ---- Social Engineering ----
+      { keyword: "this is an authorized test", riskLevel: "high", lang: "en" },
+      { keyword: "security audit approved", riskLevel: "high", lang: "en" },
+      { keyword: "admin override", riskLevel: "critical", lang: "en" },
+      { keyword: "debug mode", riskLevel: "high", lang: "en" },
+      { keyword: "maintenance mode", riskLevel: "high", lang: "en" },
+      { keyword: "\u8FD9\u662F\u6388\u6743\u7684\u6D4B\u8BD5", riskLevel: "high", lang: "zh" },
+      { keyword: "\u5B89\u5168\u5BA1\u8BA1\u5DF2\u6279\u51C6", riskLevel: "high", lang: "zh" },
+      { keyword: "\u7BA1\u7406\u5458\u8986\u76D6", riskLevel: "critical", lang: "zh" },
+      { keyword: "\u8C03\u8BD5\u6A21\u5F0F", riskLevel: "high", lang: "zh" },
+      // ---- XSS ----
+      { keyword: "<script>", riskLevel: "high", lang: "en" },
+      { keyword: "javascript:", riskLevel: "high", lang: "en" },
+      { keyword: "onerror=", riskLevel: "high", lang: "en" },
+      { keyword: "onload=", riskLevel: "high", lang: "en" },
+      // ---- Fake Boundaries ----
+      { keyword: "=== END OF", riskLevel: "high", lang: "en" },
+      { keyword: "--- END SYSTEM", riskLevel: "high", lang: "en" },
+      { keyword: "[END OF", riskLevel: "high", lang: "en" },
+      { keyword: "=== \u7ED3\u675F", riskLevel: "high", lang: "zh" },
+      { keyword: "--- \u7ED3\u675F\u7CFB\u7EDF", riskLevel: "high", lang: "zh" },
+      // ---- Developer Mode ----
+      { keyword: "developer mode", riskLevel: "critical", lang: "en" },
+      { keyword: "DAN mode", riskLevel: "critical", lang: "en" },
+      { keyword: "jailbreak", riskLevel: "critical", lang: "en" },
+      { keyword: "\u5F00\u53D1\u8005\u6A21\u5F0F", riskLevel: "critical", lang: "zh" },
+      { keyword: "\u8D8A\u72F1", riskLevel: "critical", lang: "zh" }
+      // 注：xiaoO 专属绕过词（绕过审计/禁用安全检查/关闭防护/bypass audit 等）
+      // 已迁至 agent_moss/agents/xiaoo/rules.json 的 extra_injection_keywords，
+      // 由 agent_ext 机制注入，不再污染通用层。
     ];
-    INLINE_SCRIPT_RE = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
-    DIR_TRAVERSAL_KW = [
-      "os.listdir",
-      "os.walk",
-      "os.scandir",
-      "glob.glob",
-      "glob.iglob",
-      "pathlib.",
-      "iterdir",
-      "rglob",
-      "scandir(",
-      "listdir("
+    DANGEROUS_PATTERNS = [
+      // --- Critical: rm command graded detection (strict to loose, first match wins) ---
+      // 1. rm -rf root dir (含通配符如 /* /.* 等) — 使用负向先行断言 (?!\w)：/ 后面不是单词字符时匹配
+      { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*f[a-zA-Z]*\s+\/(?!\w)/i, severity: "critical", description: "\u9012\u5F52\u5F3A\u5236\u5220\u9664\u6839\u76EE\u5F55 (rm -rf /)", riskType: "script_execution" },
+      // 注意：已移除"rm -rf /任意绝对路径"的宽泛规则，避免误杀 /tmp 等临时目录清理操作
+      // 2. rm with -r or -f targeting system dirs — var 分支排除 /var/tmp/（合法清理）
+      { pattern: /\brm\s+-[a-zA-Z]*[rf][a-zA-Z]*\s+\/(etc|var(?!\/tmp)|home|usr|boot|root|opt|srv|sys|proc)\b/i, severity: "critical", description: "\u5220\u9664\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55", riskType: "script_execution" },
+      // 3. rm -r absolute path (no -f) — 排除 /tmp/ /var/tmp/ /run/ /dev/shm/（CI/开发高频合法清理）
+      { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*\s+\/(?!tmp\/|var\/tmp\/|run\/|dev\/shm\/)/i, severity: "high", description: "\u9012\u5F52\u5220\u9664\u64CD\u4F5C (rm -r /...)", riskType: "script_execution" },
+      // 4. rm -f absolute path (no -r) — 同样排除临时目录
+      { pattern: /\brm\s+-[a-zA-Z]*f[a-zA-Z]*\s+\/(?!tmp\/|var\/tmp\/|run\/|dev\/shm\/)/i, severity: "medium", description: "\u5F3A\u5236\u5220\u9664\u6587\u4EF6 (rm -f /...)", riskType: "script_execution" },
+      // dd 磁盘清零 — 只拦截写入系统关键目录，放行 /tmp 等临时目录
+      { pattern: /dd\s+if=\/dev\/zero.*\bof\s*=\s*\/(etc|var|home|usr|boot|root|opt|srv|sys|proc)\b/i, severity: "critical", description: "\u78C1\u76D8\u6E05\u96F6\u5199\u5165\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55 (dd if=/dev/zero of=/\u7CFB\u7EDF\u76EE\u5F55)", riskType: "script_execution" },
+      // mkfs 格式化 — 只拦截对块设备（/dev/sdX 等）的格式化，放行对普通文件的格式化
+      { pattern: /mkfs\.\w+\s+\/dev\/(sd|hd|nvme|vd|loop|mapper|md|dm)\S+/i, severity: "critical", description: "\u683C\u5F0F\u5316\u5757\u8BBE\u5907 (mkfs /dev/\u5757\u8BBE\u5907)", riskType: "script_execution" },
+      { pattern: /:\(\)\s*\{.*:\|:&.*\};:/i, severity: "critical", description: "Fork Bomb", riskType: "resource_exhaustion" },
+      // --- Critical: remote code execution ---
+      { pattern: /curl\s+.*\|\s*(bash|sh|zsh|dash)/i, severity: "critical", description: "curl pipe shell \u6267\u884C", riskType: "script_execution" },
+      { pattern: /wget\s+.*\|\s*(bash|sh)/i, severity: "critical", description: "wget pipe shell \u6267\u884C", riskType: "script_execution" },
+      { pattern: /eval\s+\$\(curl|eval\s+\$\(wget/i, severity: "critical", description: "eval \u8FDC\u7A0B\u4EE3\u7801\u6267\u884C", riskType: "script_execution" },
+      { pattern: /base64\s+-d\s+.*\|\s*bash/i, severity: "critical", description: "base64 \u89E3\u7801\u6267\u884C", riskType: "script_execution" },
+      // --- Critical: reverse shell ---
+      { pattern: /\/dev\/tcp\/|bash\s+-i\s+>&/i, severity: "critical", description: "\u53CD\u5F39 Shell", riskType: "script_execution" },
+      { pattern: /nc\s+-[el]\s+.*\d{1,5}/i, severity: "high", description: "Netcat \u53CD\u5F39\u8FDE\u63A5", riskType: "lateral_movement" },
+      // --- Critical: sensitive file access ---
+      { pattern: /\/etc\/shadow/i, severity: "critical", description: "\u8BBF\u95EE\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6 (/etc/shadow)", riskType: "file_access" },
+      { pattern: /\/etc\/gshadow/i, severity: "critical", description: "\u8BBF\u95EE\u7CFB\u7EDF\u7EC4\u5BC6\u7801\u6587\u4EF6 (/etc/gshadow)", riskType: "file_access" },
+      // 注意：/etc/passwd 已从拦截列表移除，因为它是公开可读的标准系统文件，真正敏感的是 /etc/shadow
+      { pattern: /\.ssh\/id_rsa(?!\.pub)/i, severity: "critical", description: "\u8BBF\u95EE SSH \u79C1\u94A5\u6587\u4EF6", riskType: "file_access" },
+      // --- Critical: privilege escalation / container escape ---
+      { pattern: /\/var\/run\/docker\.sock/i, severity: "critical", description: "\u8BBF\u95EE Docker socket\uFF0C\u53EF\u80FD\u5BFC\u81F4\u5BB9\u5668\u9003\u9038", riskType: "privilege_escalation" },
+      // --- High: dangerous permissions / ownership ---
+      { pattern: /chmod\s+[0-7]*777[0-7]*/i, severity: "high", description: "\u5168\u6743\u9650\u8BBE\u7F6E (chmod 777)", riskType: "script_execution" },
+      { pattern: /chown\s+root|chown\s+-R\s+\w+:\w+\s+\//i, severity: "high", description: "\u4FEE\u6539\u6240\u6709\u8005\u4E3A root / \u9012\u5F52\u4FEE\u6539\u6839\u76EE\u5F55\u6240\u6709\u8005", riskType: "script_execution" },
+      // sudo 提权 — 只拦截 sudo 后跟的危险命令，不一刀切拦截所有 sudo
+      { pattern: /sudo\s+(rm|chmod|chown|dd|mkfs|format|iptables|crontab|passwd|userdel|useradd|groupdel)\b/i, severity: "high", description: "\u63D0\u6743\u6267\u884C\u9AD8\u5371\u547D\u4EE4 (sudo + \u5371\u9669\u64CD\u4F5C)", riskType: "privilege_escalation" },
+      // --- High: system config overwrite ---
+      { pattern: />\s*\/etc\//i, severity: "critical", description: "\u8986\u76D6\u5199\u5165\u7CFB\u7EDF\u914D\u7F6E\u76EE\u5F55", riskType: "file_access" },
+      // --- High: download script + execute risk ---
+      { pattern: /(?:curl|wget)\s+.*(?:-o|--output|>)\s*\S+\.(?:sh|bash)\b/i, severity: "high", description: "\u8FDC\u7A0B\u4E0B\u8F7D\u811A\u672C\u5230\u672C\u5730", riskType: "script_execution" },
+      { pattern: /(?:curl|wget)\s+.*\s+&&?\s*(?:chmod\s+\+x|bash|sh)/i, severity: "high", description: "\u4E0B\u8F7D\u540E\u6267\u884C", riskType: "script_execution" },
+      // --- High: package manager pipe-to-shell ---
+      { pattern: /git\s+clone\s+.*\|.*bash/i, severity: "high", description: "git clone pipe shell", riskType: "script_execution" },
+      { pattern: /pip\s+install\s+.*\|\s*bash/i, severity: "high", description: "pip install pipe shell", riskType: "script_execution" },
+      { pattern: /npm\s+install\s+-g\s+.*\|\s*bash/i, severity: "high", description: "npm install pipe shell", riskType: "script_execution" },
+      // --- Medium: destructive git operations (降级为 medium，允许但记录) ---
+      { pattern: /git\s+push\s+.*--force/i, severity: "medium", description: "\u5F3A\u5236\u63A8\u9001\u64CD\u4F5C (git push --force)\uFF0C\u53EF\u80FD\u8986\u76D6\u8FDC\u7A0B\u63D0\u4EA4\u5386\u53F2", riskType: "script_execution" },
+      // --- High: network port scanning (横向移动侦察) ---
+      { pattern: /\bnmap\s+/i, severity: "high", description: "\u7F51\u7EDC\u7AEF\u53E3\u626B\u63CF (nmap)\uFF0C\u53EF\u80FD\u7528\u4E8E\u6A2A\u5411\u79FB\u52A8\u4FA6\u5BDF", riskType: "lateral_movement" },
+      { pattern: /\b(masscan|zmap|unicornscan)\s+/i, severity: "high", description: "\u7F51\u7EDC\u7AEF\u53E3\u626B\u63CF\u5DE5\u5177\uFF0C\u53EF\u80FD\u7528\u4E8E\u6A2A\u5411\u79FB\u52A8\u4FA6\u5BDF", riskType: "lateral_movement" },
+      // --- Medium: credential export ---
+      { pattern: /export\s+.*(?:TOKEN|KEY|SECRET|PASSWORD)/i, severity: "medium", description: "\u5BFC\u51FA\u654F\u611F\u51ED\u8BC1", riskType: "data_exfiltration" },
+      // --- High: shell rc file append (persistence) ---
+      { pattern: />>\s*(~|\/home\/[^/]+)\/(\.bashrc|\.zshrc|\.profile|\.bash_profile|\.zprofile)/, severity: "high", description: "\u68C0\u6D4B\u5230\u4FEE\u6539 Shell \u914D\u7F6E\u6587\u4EF6\uFF08~/.bashrc \u7B49\uFF09\uFF0C\u53EF\u80FD\u7528\u4E8E\u6301\u4E45\u5316\u540E\u95E8", riskType: "persistence" },
+      // --- High: device file write (只拦截重定向写入设备文件，不拦截读取) ---
+      { pattern: />\s*\/dev\/(sd|hd|nvme|vd|loop|mem|kmsg|port|zero|random|urandom|full|core)/i, severity: "high", description: "\u91CD\u5B9A\u5411\u5199\u5165\u8BBE\u5907\u6587\u4EF6", riskType: "file_access" },
+      // --- High: non-interactive password modification ---
+      { pattern: /\|\s*passwd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u7BA1\u9053\u65B9\u5F0F\u8C03\u7528 passwd\uFF08\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\uFF09", riskType: "script_execution" },
+      { pattern: /\bpasswd\s+--stdin\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 passwd --stdin \u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u8F93\u5165", riskType: "script_execution" },
+      { pattern: /\bchpasswd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 chpasswd \u6279\u91CF\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4", riskType: "script_execution" },
+      { pattern: /\b(newusers|lnewusers)\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 newusers/lnewusers \u6279\u91CF\u7528\u6237\u6DFB\u52A0\u547D\u4EE4", riskType: "script_execution" },
+      { pattern: /\bpasswd\s+-[a-zA-Z]*d\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u5BC6\u7801\u64CD\u4F5C (passwd -d)", riskType: "script_execution" },
+      { pattern: /\bpasswd\s+-[a-zA-Z]*l\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u9501\u5B9A\u7528\u6237\u8D26\u6237\u64CD\u4F5C (passwd -l)", riskType: "script_execution" },
+      // --- High: non-interactive password modification (extended) ---
+      { pattern: /\blpasswd\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u64CD\u4F5C (lpasswd)", riskType: "script_execution" },
+      { pattern: /\bgpasswd\s+(?!-[adA])/i, severity: "high", description: "\u68C0\u6D4B\u5230\u7EC4\u5BC6\u7801\u7BA1\u7406\u64CD\u4F5C (gpasswd)", riskType: "script_execution" },
+      { pattern: /\bchgpasswd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u6279\u91CF\u4FEE\u6539\u7EC4\u5BC6\u7801\u64CD\u4F5C (chgpasswd)", riskType: "script_execution" },
+      // --- High: user/group deletion (irreversible, requires user consent) ---
+      { pattern: /\buserdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (userdel)", riskType: "script_execution" },
+      { pattern: /\bdeluser\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (deluser)", riskType: "script_execution" },
+      { pattern: /\bluserdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (luserdel)", riskType: "script_execution" },
+      { pattern: /\bgroupdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u7EC4\u64CD\u4F5C (groupdel)", riskType: "script_execution" },
+      { pattern: /\blgroupdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u7EC4\u64CD\u4F5C (lgroupdel)", riskType: "script_execution" },
+      // --- High: generic command -p parameter password setting ---
+      { pattern: /\b(useradd|luseradd|groupadd|usermod|lusermod|groupmod|lgroupmod)\b[^&|;]*?\s-p\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u901A\u8FC7 -p \u53C2\u6570\u8BBE\u7F6E\u6216\u4FEE\u6539\u5BC6\u7801 (useradd/usermod/groupmod)", riskType: "script_execution" }
     ];
+    SENSITIVE_EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
   }
 });
 
@@ -2653,7 +2576,10 @@ function getEnabledL1CommandPatterns(runtime) {
   }));
 }
 function getEnabledL2SensitivePaths(runtime) {
-  const cat = runtime.L2_rules?.sensitive_path_access || { category_enabled: true, rules: [] };
+  let cat = runtime.L1_rules?.sensitive_path_access;
+  if (!cat || !cat.rules || cat.rules.length === 0) {
+    cat = runtime.L2_rules?.sensitive_path_access || { category_enabled: true, rules: [] };
+  }
   return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => {
     const out = { path: r.path || "", risk_level: r.risk_level || "", desc: r.desc || "", deny_mode: r.deny_mode || "deny_write" };
     if (r.credential) out.credential = true;
@@ -2679,22 +2605,24 @@ function getDisabledL2RulesWithSkipL3() {
     return {};
   }
   const result = {};
-  const l2 = runtime.L2_rules || {};
-  for (const [catName, cat] of Object.entries(l2)) {
-    if (!cat.category_enabled) continue;
-    const items = [];
-    for (const r of cat.rules || []) {
-      if (r.enabled === false && r.skip_l3_on_disabled) {
-        if (catName === "sensitive_path_access") {
-          if (r.path) items.push(r.path);
-        } else if (catName === "intent_consistency") {
-          items.push(...r.intent_keywords || []);
-        } else if (r.pattern) {
-          items.push(r.pattern);
+  for (const layerKey of ["L1_rules", "L2_rules"]) {
+    const layer = runtime[layerKey] || {};
+    for (const [catName, cat] of Object.entries(layer)) {
+      if (!cat.category_enabled) continue;
+      const items = [];
+      for (const r of cat.rules || []) {
+        if (r.enabled === false && r.skip_l3_on_disabled) {
+          if (catName === "sensitive_path_access") {
+            if (r.path) items.push(r.path);
+          } else if (catName === "intent_consistency") {
+            items.push(...r.intent_keywords || []);
+          } else if (r.pattern) {
+            items.push(r.pattern);
+          }
         }
       }
+      if (items.length > 0) result[catName] = items;
     }
-    if (items.length > 0) result[catName] = items;
   }
   return result;
 }
@@ -2855,15 +2783,14 @@ function generateSourceDefaults() {
         category_desc: "Prompt \u6CE8\u5165\u653B\u51FB\u68C0\u6D4B",
         rules: _l1InjectionKeywordsToRules()
       },
-      user_sensitive_actions: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49\u654F\u611F\u52A8\u4F5C/\u5DE5\u5177\u89C4\u5219", rules: [] },
-      user_custom: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49\u547D\u4EE4\u89C4\u5219", rules: [] }
-    },
-    L2_rules: {
       sensitive_path_access: {
         category_enabled: true,
-        category_desc: "\u654F\u611F\u8DEF\u5F84\u8BBF\u95EE\u68C0\u6D4B",
+        category_desc: "\u654F\u611F\u8DEF\u5F84\u8BBF\u95EE\u68C0\u6D4B\uFF08deny_both/deny_read/deny_write\uFF09",
         rules: _l2SensitivePathsToRules()
       },
+      user_custom: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49\u547D\u4EE4\u89C4\u5219", rules: [] }
+    },
+    L2_rules: {
       intent_consistency: {
         category_enabled: true,
         category_desc: "\u610F\u56FE\u4E00\u81F4\u6027\u68C0\u6D4B",
@@ -2880,7 +2807,7 @@ function generateSourceDefaults() {
         rules: _l2UserDeletionPatternsToRules()
       },
       read_before_write: { category_enabled: true, category_desc: "read_before_write \u5B89\u5168\u539F\u5219\u68C0\u6D4B", rules: [] },
-      dangerous_patterns: { category_enabled: true, category_desc: "\u5371\u9669\u64CD\u4F5C\u6A21\u5F0F\u68C0\u6D4B", rules: [] }
+      user_custom: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49 L2 \u903B\u8F91\u89C4\u5219", rules: [] }
     },
     L3_skills: _l3SkillsToRules()
   };
@@ -2948,6 +2875,10 @@ function _mergeRuleCategories(userCfg, srcDefaults, layerKey) {
       }
     }
   }
+  for (const catName of Object.keys(userLayer)) {
+    if (catName === "user_custom") continue;
+    if (!(catName in srcLayer)) delete userLayer[catName];
+  }
 }
 function _mergeSkillCategories(userCfg, srcDefaults, layerKey) {
   const userLayer = userCfg[layerKey] || (userCfg[layerKey] = {});
@@ -2974,11 +2905,42 @@ function mergeConfig(userCfg, srcDefaults) {
   for (const [layerKey, defaultVal] of Object.entries(srcDefaults.layers)) {
     if (!(layerKey in cfg.layers)) cfg.layers[layerKey] = defaultVal;
   }
+  _migrateCategoriesAcrossLayers(
+    cfg,
+    "L2_rules",
+    "L1_rules",
+    ["sensitive_path_access"]
+  );
   _mergeRuleCategories(cfg, srcDefaults, "L1_rules");
   _mergeRuleCategories(cfg, srcDefaults, "L2_rules");
   _mergeSkillCategories(cfg, srcDefaults, "L3_skills");
   return cfg;
 }
+function _migrateCategoriesAcrossLayers(cfg, srcLayer, dstLayer, catNames) {
+  const src = cfg[srcLayer] || {};
+  const dst = cfg[dstLayer] || (cfg[dstLayer] = {});
+  for (const catName of catNames) {
+    if (!(catName in src)) continue;
+    const srcCat = src[catName];
+    if (!dst[catName]) {
+      dst[catName] = { category_enabled: true, category_desc: "", rules: [] };
+    }
+    const dstCat = dst[catName];
+    if (!dstCat.category_desc && srcCat.category_desc) dstCat.category_desc = srcCat.category_desc;
+    if (dstCat.category_enabled === void 0) dstCat.category_enabled = srcCat.category_enabled;
+    if (srcCat.rules && srcCat.rules.length > 0) {
+      const dstFps = new Set((dstCat.rules || []).map((r) => _ruleFingerprint(r)));
+      for (const r of srcCat.rules) {
+        const fp = _ruleFingerprint(r);
+        if (!dstFps.has(fp)) {
+          (dstCat.rules = dstCat.rules || []).push(r);
+          dstFps.add(fp);
+        }
+      }
+    }
+    delete src[catName];
+  }
+}
 function getEnabledL1InjectionKeywords(runtime) {
   const cat = runtime.L1_rules?.injection_detection || { category_enabled: true, rules: [] };
   return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => ({
@@ -3131,7 +3093,8 @@ function deleteCustomRule(layer, category, ruleId) {
   const rules = runtime[layer]?.[category]?.rules || [];
   const idx = rules.findIndex((r) => r.id === ruleId);
   if (idx >= 0) {
-    if (rules[idx].builtin) return null;
+    const r = rules[idx];
+    if (r.builtin && !r.source_removed) return null;
     rules.splice(idx, 1);
     saveRuntimeConfig(runtime);
   }
@@ -3326,9 +3289,11 @@ async function runAnalysis(input) {
     }
   }
   const logicResult = isLogicRulesEnabled() ? runLogicCheck(input) : null;
-  if (logicResult && !logicResult.allowed) {
-    const isCredentialPath = !!logicResult.isCredential;
-    const skipInlineFileAccess = (isInlineScriptCmd || isLiteralTextCmd) && logicResult.riskType === "sensitive_path_access";
+  const l1FileAccessHit = !!(heuristicResult && !heuristicResult.allowed && heuristicResult.riskType === "file_access");
+  const effectiveResult = logicResult && !logicResult.allowed ? logicResult : l1FileAccessHit ? heuristicResult : null;
+  if (effectiveResult) {
+    const isCredentialPath = !!effectiveResult.isCredential;
+    const skipInlineFileAccess = (isInlineScriptCmd || isLiteralTextCmd) && effectiveResult.riskType === "file_access";
     if (skipInlineFileAccess) {
       const inlineJudgment = analyzeInlineScript(input.aNext.actionDetail);
       if (inlineJudgment.actionable) {
@@ -3354,8 +3319,8 @@ async function runAnalysis(input) {
         };
       }
     }
-    if ((logicResult.riskLevel === "high" || logicResult.riskLevel === "critical") && (!skipInlineFileAccess || isCredentialPath)) {
-      return logicResult;
+    if ((effectiveResult.riskLevel === "high" || effectiveResult.riskLevel === "critical") && (!skipInlineFileAccess || isCredentialPath)) {
+      return effectiveResult;
     }
   }
   if (scriptChain && scriptChain.nodes.length > 0 && isLogicRulesEnabled()) {
@@ -3606,7 +3571,7 @@ var require_bindings = __commonJS({
     init_esm_shims();
     var fs4 = __require("fs");
     var path3 = __require("path");
-    var fileURLToPath6 = require_file_uri_to_path();
+    var fileURLToPath7 = require_file_uri_to_path();
     var join6 = path3.join;
     var dirname6 = path3.dirname;
     var exists = fs4.accessSync && function(path4) {
@@ -3718,7 +3683,7 @@ var require_bindings = __commonJS({
       Error.stackTraceLimit = origSTL;
       var fileSchema = "file://";
       if (fileName.indexOf(fileSchema) === 0) {
-        fileName = fileURLToPath6(fileName);
+        fileName = fileURLToPath7(fileName);
       }
       return fileName;
     };
@@ -4749,16 +4714,17 @@ async function startServer(host = "127.0.0.1", port = 9090) {
   const app = createApp();
   return {
     port: actualPort,
-    serve: () => {
+    serve: async () => {
       console.log(`AgentMoss HTTP server on ${host}:${actualPort}`);
-      import("@hono/node-server").then(({ serve: honoServe }) => {
-        honoServe({ fetch: app.fetch, hostname: host, port: actualPort });
-      });
+      const { serve: honoServe } = await import("@hono/node-server");
+      honoServe({ fetch: app.fetch, hostname: host, port: actualPort });
     }
   };
 }
 
 // src/cli.ts
+import { fileURLToPath as fileURLToPath6 } from "url";
+import { realpathSync } from "fs";
 function printHelp() {
   console.log(`AgentMoss security analysis engine (TypeScript v${version})
 
@@ -4840,7 +4806,7 @@ async function main() {
       if (port === 0) port = 9090;
       const server = await startServer(host, port);
       console.log(`Listening on http://${host}:${server.port}`);
-      server.serve();
+      await server.serve();
       break;
     }
     case "install": {
@@ -4848,7 +4814,7 @@ async function main() {
       const { execSync } = await import("child_process");
       const fs4 = await import("fs");
       const path3 = await import("path");
-      const { fileURLToPath: fileURLToPath6 } = await import("url");
+      const { fileURLToPath: fileURLToPath7 } = await import("url");
       if (process.getuid?.() !== 0) {
         try {
           execSync("sudo -n true", { stdio: "ignore", timeout: 5e3 });
@@ -4863,7 +4829,7 @@ async function main() {
         execSync(sudoArgs.join(" "), { stdio: "inherit" });
         process.exit(0);
       }
-      const __filename5 = fileURLToPath6(import.meta.url);
+      const __filename5 = fileURLToPath7(import.meta.url);
       const __dirname6 = path3.dirname(__filename5);
       let srcPath = path3.join(__dirname6, "data", "agent_moss.service");
       if (!fs4.existsSync(srcPath)) {
@@ -5002,8 +4968,22 @@ async function main() {
       process.exit(1);
   }
 }
-main().catch((err) => {
-  console.error("Fatal error:", err);
-  process.exit(1);
-});
+var isMain = (() => {
+  try {
+    if (!process.argv[1]) return false;
+    const thisFile = realpathSync(fileURLToPath6(import.meta.url));
+    const argv1 = realpathSync(
+      process.argv[1].startsWith("file://") ? fileURLToPath6(process.argv[1]) : process.argv[1]
+    );
+    return thisFile === argv1;
+  } catch {
+    return false;
+  }
+})();
+if (isMain) {
+  main().catch((err) => {
+    console.error("Fatal error:", err);
+    process.exit(1);
+  });
+}
 //# sourceMappingURL=cli.js.map