@kenhkl/agent-moss 0.8.5 → 0.9.1

package/dist/engine/coordinator.js

@@ -0,0 +1,3448 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// node_modules/tsup/assets/esm_shims.js
+import path from "path";
+import { fileURLToPath } from "url";
+var getFilename, getDirname, __dirname;
+var init_esm_shims = __esm({
+  "node_modules/tsup/assets/esm_shims.js"() {
+    "use strict";
+    getFilename = () => fileURLToPath(import.meta.url);
+    getDirname = () => path.dirname(getFilename());
+    __dirname = /* @__PURE__ */ getDirname();
+  }
+});
+
+// src/config.ts
+var config_exports = {};
+__export(config_exports, {
+  detectProvider: () => detectProvider,
+  getCustomRules: () => getCustomRules,
+  getLLMConfig: () => getLLMConfig,
+  getLLMFailMode: () => getLLMFailMode,
+  getProviderHeaders: () => getProviderHeaders,
+  getRetryConfig: () => getRetryConfig,
+  getTimeoutConfig: () => getTimeoutConfig,
+  isHeuristicEnabled: () => isHeuristicEnabled,
+  isLLMAvailable: () => isLLMAvailable,
+  isLogicRulesEnabled: () => isLogicRulesEnabled,
+  updateLLMConfig: () => updateLLMConfig
+});
+import fs from "fs";
+import path2 from "path";
+import os from "os";
+function loadConfigFile(filePath) {
+  try {
+    const raw = fs.readFileSync(filePath, "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function resolveConfigPath() {
+  const envPath = process.env.AGENT_MOSS_CONFIG_PATH;
+  if (envPath) return envPath;
+  const userConfig = path2.join(os.homedir(), ".config", "agentmoss", "config.json");
+  if (fs.existsSync(userConfig)) return userConfig;
+  const defaultConfig = path2.join(__dirname, "..", "..", "agent_moss", "infra", "config.json.example");
+  if (fs.existsSync(defaultConfig)) {
+    const configDir = path2.dirname(userConfig);
+    fs.mkdirSync(configDir, { recursive: true });
+    const pkgConfig = loadConfigFile(defaultConfig);
+    const safeConfig = pkgConfig ? { ...pkgConfig, llm: { ...pkgConfig.llm, api_key: "" } } : {};
+    fs.writeFileSync(userConfig, JSON.stringify(safeConfig, null, 4), "utf-8");
+    console.log(`[AgentMoss] \u5DF2\u521B\u5EFA\u7528\u6237\u914D\u7F6E\u6587\u4EF6: ${userConfig}`);
+    console.log(`[AgentMoss] \u8BF7\u7F16\u8F91\u8BE5\u6587\u4EF6\u914D\u7F6E\u4F60\u7684 LLM API Key`);
+  }
+  return userConfig;
+}
+function loadLLMConfigFromFile(configPath) {
+  const data = loadConfigFile(configPath);
+  if (!data?.llm) return {};
+  const llm = data.llm;
+  return {
+    provider: llm.provider || "",
+    baseUrl: llm.base_url || "",
+    apiKey: llm.api_key || "",
+    model: llm.model || "",
+    temperature: llm.temperature ?? 0.1,
+    maxTokens: llm.max_tokens ?? 4096,
+    timeout: llm.timeout ?? 40
+  };
+}
+function loadTimeoutRetryFromFile(configPath) {
+  const data = loadConfigFile(configPath);
+  const t = data?.timeout ?? {};
+  const r = data?.retry ?? {};
+  return {
+    timeout: {
+      totalTimeout: Number(t.total_timeout ?? 90),
+      prompt1Timeout: Number(t.prompt1_timeout ?? 40),
+      prompt2Timeout: Number(t.prompt2_timeout ?? 20),
+      stepInterval: Number(t.step_interval ?? 0)
+    },
+    retry: {
+      maxRetries: Number(r.max_retries ?? 2),
+      retryInterval: Number(r.retry_interval ?? 2)
+    }
+  };
+}
+function getTimeoutConfig() {
+  return timeoutConfig;
+}
+function getRetryConfig() {
+  return retryConfig;
+}
+function loadCustomRules() {
+  try {
+    const raw = process.env.AGENT_MOSS_CUSTOM_RULES;
+    if (!raw) return [];
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed)) return [];
+    return parsed.filter((r) => r.pattern && r.action);
+  } catch {
+    return [];
+  }
+}
+function getLLMConfig() {
+  return llmConfig;
+}
+function updateLLMConfig(partial) {
+  llmConfig = { ...llmConfig, ...partial };
+}
+function getCustomRules() {
+  return customRules;
+}
+function isLLMAvailable() {
+  if (process.env.AGENT_MOSS_DISABLE_LLM === "1") return false;
+  return llmConfig.apiKey.length > 0;
+}
+function getLLMFailMode() {
+  const val = (process.env.AGENT_MOSS_LLM_FAIL_MODE || "fail_open").toLowerCase();
+  return val === "fail_closed" ? "fail_closed" : "fail_open";
+}
+function detectProvider(baseUrl, providerHint = "") {
+  if (providerHint) {
+    const hint = providerHint.toLowerCase();
+    if (["claude", "anthropic"].includes(hint)) return "anthropic";
+    if (["google", "gemini"].includes(hint)) return "gemini";
+    if (["zai-coding-plan", "zhipu-coding-plan", "zhipuai-coding-plan"].includes(hint)) return "zai-coding-plan";
+    if (["zai", "z-ai", "z.ai", "zai-cn", "zai-china", "zhipu", "glm-cn", "bigmodel"].includes(hint)) return "zhipu";
+    if (["xai", "xai-grok"].includes(hint)) return "xai";
+    if (["minimax", "minimax-openai"].includes(hint)) return "minimax";
+    if (["minimax-anthropic"].includes(hint)) return "minimax-anthropic";
+    if (["other", "custom", "local"].includes(hint)) return "openai-compatible";
+    return hint;
+  }
+  const url = baseUrl.toLowerCase();
+  if (url.includes("openrouter.ai")) return "openrouter";
+  if (url.includes("api.openai.com")) return "openai";
+  if (url.includes("anthropic.com") || url.includes("api.anthropic.com")) return "anthropic";
+  if (url.includes("generativelanguage.googleapis.com") || url.includes("gemini")) return "gemini";
+  if (url.includes("api.deepseek.com")) return "deepseek";
+  if (url.includes("api.groq.com")) return "groq";
+  if (url.includes("api.mistral.ai")) return "mistral";
+  if (url.includes("api.together.xyz")) return "together";
+  if (url.includes("api.x.ai")) return "xai";
+  if (url.includes("api.minimaxi.com")) return "minimax";
+  if (url.includes("api-ai.gitcode.com")) return "gitcode";
+  if (url.includes("api.z.ai")) return "zai-coding-plan";
+  if (url.includes("open.bigmodel.cn") || url.includes("bigmodel")) return "zhipu";
+  if (url.includes(":11434")) return "ollama";
+  return "openai-compatible";
+}
+function getProviderHeaders(provider) {
+  return PROVIDER_HEADERS[provider] || {};
+}
+function isHeuristicEnabled() {
+  return process.env.AGENT_MOSS_DISABLE_HEURISTIC !== "1";
+}
+function isLogicRulesEnabled() {
+  return process.env.AGENT_MOSS_DISABLE_LOGIC_RULES !== "1";
+}
+var timeoutConfig, retryConfig, llmConfig, customRules, PROVIDER_HEADERS;
+var init_config = __esm({
+  "src/config.ts"() {
+    "use strict";
+    init_esm_shims();
+    llmConfig = (() => {
+      const configPath = resolveConfigPath();
+      const fileConfig = fs.existsSync(configPath) ? loadLLMConfigFromFile(configPath) : {};
+      const tr = loadTimeoutRetryFromFile(configPath);
+      timeoutConfig = tr.timeout;
+      retryConfig = tr.retry;
+      return {
+        provider: process.env.AGENT_MOSS_LLM_PROVIDER || fileConfig.provider || "openai",
+        baseUrl: process.env.AGENT_MOSS_LLM_BASE_URL || fileConfig.baseUrl || "https://api.openai.com/v1",
+        apiKey: process.env.AGENT_MOSS_LLM_API_KEY || process.env.OPENAI_API_KEY || fileConfig.apiKey || "",
+        model: process.env.AGENT_MOSS_LLM_MODEL || fileConfig.model || "gpt-4o",
+        temperature: parseFloat(process.env.AGENT_MOSS_LLM_TEMPERATURE || String(fileConfig.temperature ?? "0.1")),
+        maxTokens: parseInt(process.env.AGENT_MOSS_LLM_MAX_TOKENS || String(fileConfig.maxTokens ?? "4096"), 10),
+        // 优先用 env，否则用 timeout 块的 prompt1Timeout（对齐 py）
+        timeout: parseInt(process.env.AGENT_MOSS_LLM_TIMEOUT || String(fileConfig.timeout ?? String(tr.timeout.prompt1Timeout)), 10)
+      };
+    })();
+    customRules = loadCustomRules();
+    PROVIDER_HEADERS = {
+      "openrouter": {
+        "HTTP-Referer": "shturl.cc/LlVD5pyWViHjM",
+        "X-OpenRouter-Title": "AgentMoss"
+      },
+      "xai": {
+        "HTTP-Referer": "shturl.cc/LlVD5pyWViHjM"
+      }
+    };
+  }
+});
+
+// src/agents/index.ts
+import { readFileSync, existsSync } from "fs";
+import { resolve, dirname } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+function resolveAgentsDir() {
+  if (existsSync(AGENTS_DIR_PROD)) return AGENTS_DIR_PROD;
+  if (existsSync(AGENTS_DIR_DEV_FALLBACK)) return AGENTS_DIR_DEV_FALLBACK;
+  return AGENTS_DIR_PROD;
+}
+function getAgentExtensions(agentId) {
+  if (!agentId) return null;
+  if (cache.has(agentId)) return cache.get(agentId) ?? null;
+  const agentsDir = resolveAgentsDir();
+  const rulesFile = resolve(agentsDir, agentId, "rules.json");
+  if (!existsSync(rulesFile)) {
+    cache.set(agentId, null);
+    return null;
+  }
+  try {
+    const raw = readFileSync(rulesFile, "utf-8");
+    const ext = JSON.parse(raw);
+    if (!ext.agent_id) {
+      console.warn(`[AgentMoss agents] rules.json \u7F3A\u5C11 agent_id \u5B57\u6BB5: ${rulesFile}`);
+      cache.set(agentId, null);
+      return null;
+    }
+    cache.set(agentId, ext);
+    console.log(
+      `[AgentMoss agents] \u52A0\u8F7D agent ${agentId} \u5B9A\u5236\u89C4\u5219: ${ext.extra_command_patterns?.length ?? 0} cmd patterns, ${ext.extra_injection_keywords?.length ?? 0} injection keywords, ${ext.extra_sensitive_paths?.length ?? 0} sensitive paths, ${ext.builtin_safe_skills?.length ?? 0} builtin safe skills`
+    );
+    return ext;
+  } catch (e) {
+    console.error(`[AgentMoss agents] \u52A0\u8F7D agent ${agentId} rules.json \u5931\u8D25:`, e.message);
+    cache.set(agentId, null);
+    return null;
+  }
+}
+var __filename2, __dirname2, AGENTS_DIR_PROD, AGENTS_DIR_DEV_FALLBACK, cache;
+var init_agents = __esm({
+  "src/agents/index.ts"() {
+    "use strict";
+    init_esm_shims();
+    __filename2 = fileURLToPath2(import.meta.url);
+    __dirname2 = dirname(__filename2);
+    AGENTS_DIR_PROD = resolve(__dirname2, "agents");
+    AGENTS_DIR_DEV_FALLBACK = resolve(__dirname2, "../../../agent_moss/agents");
+    cache = /* @__PURE__ */ new Map();
+  }
+});
+
+// src/engine/inline-analyzer.ts
+function isLiteralTextCommand(command) {
+  ECHO_CMD_RE.lastIndex = 0;
+  return ECHO_CMD_RE.test(command);
+}
+function extractInlineCode(command) {
+  const parts = [];
+  let m;
+  INLINE_CODE_RE.lastIndex = 0;
+  while ((m = INLINE_CODE_RE.exec(command)) !== null) {
+    const code = m[1] ?? m[2];
+    if (code) parts.push(code);
+  }
+  ECHO_STRING_RE.lastIndex = 0;
+  while ((m = ECHO_STRING_RE.exec(command)) !== null) {
+    const code = m[1] ?? m[2];
+    if (code) parts.push(code);
+  }
+  return parts.join("\n");
+}
+function hasWriteExecChain(command) {
+  return WRITE_EXEC_CHAIN_PATTERNS.some((p) => {
+    p.lastIndex = 0;
+    return p.test(command);
+  });
+}
+function hasDirTraversal(code) {
+  const lower = code.toLowerCase();
+  return DIR_TRAVERSAL_KEYWORDS.some((kw) => lower.includes(kw));
+}
+function hasReadWriteKeyword(code) {
+  const lower = code.toLowerCase();
+  return READ_WRITE_KEYWORDS.some((kw) => lower.includes(kw));
+}
+function analyzeInlineScript(command) {
+  const code = extractInlineCode(command);
+  if (!code) {
+    return { actionable: false, allowed: true, reason: "", riskLevel: "low", riskType: "" };
+  }
+  if (hasWriteExecChain(command)) {
+    return {
+      actionable: true,
+      allowed: false,
+      reason: "\u5185\u8054\u811A\u672C\u542B\u5199\u5165\u6587\u4EF6\u540E\u6267\u884C\u7684\u6A21\u5F0F\uFF0C\u7591\u4F3C\u7ED5\u8FC7\u654F\u611F\u8DEF\u5F84\u68C0\u6D4B",
+      riskLevel: "critical",
+      riskType: "script_execution"
+    };
+  }
+  const redirMatch = command.match(REDIRECT_TO_SENSITIVE_RE);
+  if (redirMatch) {
+    return {
+      actionable: true,
+      allowed: false,
+      reason: `\u91CD\u5B9A\u5411\u5199\u5165\u654F\u611F\u8DEF\u5F84: ${redirMatch[1]}`,
+      riskLevel: "critical",
+      riskType: "file_access"
+    };
+  }
+  const isEchoOrPrintf1 = isLiteralTextCommand(command);
+  if (!isEchoOrPrintf1 && hasDirTraversal(code) && hasReadWriteKeyword(code)) {
+    return { actionable: false, allowed: true, reason: "", riskLevel: "low", riskType: "" };
+  }
+  const isEchoOrPrintf = isLiteralTextCommand(command);
+  if (!isEchoOrPrintf && hasReadWriteKeyword(code)) {
+    return {
+      actionable: true,
+      allowed: false,
+      reason: "\u5185\u8054\u811A\u672C\u542B\u654F\u611F\u8DEF\u5F84\u4E14\u542B\u6587\u4EF6\u8BFB\u5199/\u547D\u4EE4\u6267\u884C\u8C03\u7528\uFF0C\u5224\u4E3A\u771F\u5B9E\u8BBF\u95EE",
+      riskLevel: "critical",
+      riskType: "file_access"
+    };
+  }
+  return {
+    actionable: true,
+    allowed: true,
+    reason: "\u654F\u611F\u8DEF\u5F84\u4EC5\u4F5C\u4E3A\u6587\u672C\u5B57\u9762\u91CF\u51FA\u73B0\uFF0C\u672A\u4F34\u968F\u8BFB\u5199\u64CD\u4F5C",
+    riskLevel: "low",
+    riskType: "file_access"
+  };
+}
+var INLINE_CODE_RE, ECHO_STRING_RE, ECHO_CMD_RE, READ_WRITE_KEYWORDS, WRITE_EXEC_CHAIN_PATTERNS, SENSITIVE_PATH_FRAGMENTS, REDIRECT_TO_SENSITIVE_RE, DIR_TRAVERSAL_KEYWORDS;
+var init_inline_analyzer = __esm({
+  "src/engine/inline-analyzer.ts"() {
+    "use strict";
+    init_esm_shims();
+    INLINE_CODE_RE = /(?:python|python3|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cera][a-zA-Z]*\s+)"([^"\\]*(?:\\.[^"\\]*)*)"|'([^'\\]*(?:\\.[^'\\]*)*)'/gi;
+    ECHO_STRING_RE = /\b(?:echo|printf)\s+"([^"\\]*(?:\\.[^"\\]*)*)"|\b(?:echo|printf)\s+'([^'\\]*(?:\\.[^'\\]*)*)'/gi;
+    ECHO_CMD_RE = /(?:^|\s|;|&&|\|\|)(?:echo|printf)\s/gi;
+    READ_WRITE_KEYWORDS = [
+      // 函数调用形态（关键词后跟 '('）
+      "open(",
+      "read(",
+      "write(",
+      "fopen(",
+      "system(",
+      "exec(",
+      "eval(",
+      "popen(",
+      "load(",
+      "dump(",
+      // 文件读写（组合形态）
+      "readline",
+      "readlines",
+      "writelines",
+      "getpass",
+      "pickle.load",
+      "yaml.load",
+      "json.load",
+      "json.read",
+      "configparser",
+      "fread",
+      "fwrite",
+      "fgets",
+      // 子进程执行（组合形态）
+      "os.system",
+      "os.popen",
+      "subprocess",
+      "os.exec",
+      "os.spawn",
+      "import os",
+      "import subprocess",
+      "shell=true",
+      "check_output",
+      "check_call",
+      "run(",
+      // 绕过变体检测
+      "getattr(",
+      "__builtins__",
+      "globals(",
+      "locals(",
+      // PHP
+      "file_get_contents",
+      "file_put_contents",
+      "passthru",
+      "shell_exec",
+      "proc_open",
+      // Perl-Ruby
+      "<stdin>",
+      "open my"
+    ];
+    WRITE_EXEC_CHAIN_PATTERNS = [
+      // echo/cat/printf "..." > file && bash/sh/python file
+      /(?:echo|cat|printf)\b.*?>\s*\S+.*(?:&&|;|\|)\s*(?:bash|sh|zsh|python\d?|perl|ruby|node|php)\s/gis,
+      // ... | bash / | sh / | python（管道喂解释器执行）
+      /\|\s*(?:bash|sh|zsh|python\d?|perl|ruby|node|php)\b/gi,
+      // eval "$(cat ...)" / eval "$(echo ...)"
+      /eval\s+"\$\(/gi,
+      // xargs bash / xargs sh
+      /\|\s*xargs\s+(?:bash|sh|zsh)/gi
+    ];
+    SENSITIVE_PATH_FRAGMENTS = [
+      "/etc/shadow",
+      "/etc/gshadow",
+      "/etc/passwd",
+      "/etc/sudoers",
+      "/etc/hosts",
+      "/etc/crontab",
+      "/etc/systemd/",
+      "/etc/ssh/sshd_config",
+      "/boot/",
+      "/proc/sys/",
+      "/sys/",
+      "/dev/mem",
+      "/dev/kmsg",
+      ".ssh/id_rsa",
+      ".ssh/id_ed25519",
+      ".ssh/authorized_keys"
+    ];
+    REDIRECT_TO_SENSITIVE_RE = new RegExp(`>{1,2}\\s*(${SENSITIVE_PATH_FRAGMENTS.map((p) => p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})`, "i");
+    DIR_TRAVERSAL_KEYWORDS = [
+      // Python 目录遍历
+      "os.listdir",
+      "os.walk",
+      "os.scandir",
+      "glob.glob",
+      "glob.iglob",
+      "pathlib.",
+      "iterdir",
+      "rglob",
+      "scandir(",
+      "listdir("
+    ];
+  }
+});
+
+// src/engine/logic-rules.ts
+import * as fs2 from "fs";
+function runLogicCheck(input) {
+  const { actionHistory, aNext, cwd } = input;
+  const actionDetail = aNext.actionDetail.toLowerCase();
+  const actionType = aNext.actionType.toLowerCase();
+  const resolvedCwd = cwd || "/";
+  const EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
+  const isExcludedType = EXCLUDED_PREFIXES.some((p) => actionType.startsWith(p));
+  const rbwResult = checkReadBeforeWrite(actionType, actionDetail, actionHistory, input.reason, resolvedCwd);
+  if (rbwResult) return rbwResult;
+  if (input.promptSession && input.promptSession.trim()) {
+    if (!isExcludedType) {
+      const promptLower = input.promptSession.toLowerCase();
+      for (const pattern of INTENT_DEVIATION_PATTERNS) {
+        const intentMatched = pattern.intentKeywords.some((kw) => promptLower.includes(kw));
+        const dangerousMatched = pattern.dangerousActions.some((kw) => actionDetail.includes(kw));
+        if (intentMatched && dangerousMatched) {
+          return {
+            allowed: false,
+            reason: pattern.reason,
+            riskLevel: "high",
+            riskType: "intent_deviation",
+            confidence: 85,
+            source: "logic_rule",
+            violatedLayers: ["2"]
+          };
+        }
+      }
+    }
+  }
+  const indirectResult = checkIndirectFileAccess(actionType, actionDetail, resolvedCwd);
+  if (indirectResult) return indirectResult;
+  if (actionDetail.includes("sudo") || actionDetail.includes("su -") || actionDetail.includes("chmod u+s") || actionDetail.includes("setuid")) {
+    const detailAfterSudo = actionDetail.replace(/(^|\|\||&&|\s)sudo\s+/g, " ");
+    const isAdminCmd = ["apt", "systemctl", "yum", "dnf", "pacman", "zypper", "apk"].some((kw) => detailAfterSudo.includes(kw));
+    if (!isAdminCmd) {
+      const adminContext = actionHistory.some(
+        (h) => h.actionDetail.includes("sudo") || h.actionDetail.includes("apt") || h.actionDetail.includes("systemctl") || h.actionDetail.includes("yum") || h.actionDetail.includes("dnf") || h.actionDetail.includes("pacman") || h.actionDetail.includes("zypper") || h.actionDetail.includes("apk")
+      );
+      if (!adminContext) {
+        return {
+          allowed: false,
+          reason: "\u68C0\u6D4B\u5230\u63D0\u6743\u64CD\u4F5C\uFF0C\u672A\u53D1\u73B0\u5408\u6CD5\u7BA1\u7406\u4E0A\u4E0B\u6587",
+          riskLevel: "high",
+          riskType: "privilege_escalation",
+          confidence: 85,
+          source: "logic_rule",
+          violatedLayers: ["2"]
+        };
+      }
+    }
+  }
+  const pwdResult = checkPasswordConsent(actionType, actionDetail, actionHistory);
+  if (pwdResult) return pwdResult;
+  const userDelResult = checkUserDeletionConsent(actionType, actionDetail, actionHistory);
+  if (userDelResult) return userDelResult;
+  return null;
+}
+function extractFilePaths(text) {
+  const paths = [];
+  const unixPaths = text.match(/(?:^|\s)(\/[^\s;|&><'"]+)/g);
+  if (unixPaths) paths.push(...unixPaths.map((p) => p.trim()));
+  const quotedPaths = text.match(/["']\/([^"']+)["']/g);
+  if (quotedPaths) paths.push(...quotedPaths.map((p) => p.replace(/["']/g, "")));
+  return [...new Set(paths)];
+}
+function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, cwd) {
+  if (NON_WRITE_TOOLS.has(actionType)) return null;
+  let isWrite = WRITE_KEYWORDS.some((kw) => actionType.includes(kw) || actionDetail.includes(kw));
+  if (!isWrite && actionDetail.includes(">")) {
+    const firstWord = actionDetail.split(/\s/)[0]?.toLowerCase() || "";
+    if (!READ_ONLY_REDIR_CMDS.has(firstWord)) {
+      isWrite = true;
+    }
+  }
+  if (!isWrite) return null;
+  const targetPaths = extractFilePaths(actionDetail);
+  if (targetPaths.length === 0) return null;
+  const historyReadPaths = /* @__PURE__ */ new Set();
+  for (const action of actionHistory) {
+    const histDetail = action.actionDetail.toLowerCase();
+    const histType = action.actionType.toLowerCase();
+    const isRead = READ_KEYWORDS.some((kw) => histType.includes(kw) || histDetail.includes(kw));
+    if (isRead) {
+      for (const p of extractFilePaths(histDetail)) {
+        historyReadPaths.add(p);
+      }
+    }
+  }
+  const unreadPaths = [];
+  for (const path3 of targetPaths) {
+    const hasRead = [...historyReadPaths].some(
+      (rp) => path3 === rp || path3.startsWith(rp) || rp.startsWith(path3)
+    );
+    if (!hasRead) {
+      let isCreate = !fs2.existsSync(path3);
+      if (!isCreate) {
+        isCreate = CREATE_KEYWORDS.some((kw) => reason.toLowerCase().includes(kw) || actionDetail.includes(kw));
+      }
+      if (!isCreate) {
+        unreadPaths.push(path3);
+      }
+    }
+  }
+  if (unreadPaths.length > 0) {
+    return {
+      allowed: false,
+      reason: `\u8FDD\u53CD read_before_write \u5B89\u5168\u539F\u5219\uFF1A\u5BF9\u6587\u4EF6 ${unreadPaths[0]} \u6267\u884C\u5199\u5165\u64CD\u4F5C\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5BF9\u8BE5\u6587\u4EF6\u7684\u8BFB\u53D6\u64CD\u4F5C`,
+      riskLevel: "high",
+      riskType: "read_before_write",
+      confidence: 85,
+      source: "logic_rule",
+      violatedLayers: ["2"]
+    };
+  }
+  return null;
+}
+function checkPasswordConsent(actionType, actionDetail, actionHistory) {
+  if (actionType !== "bash") return null;
+  const isPasswordModify = PASSWORD_MODIFY_PATTERNS.some((p) => p.test(actionDetail));
+  if (!isPasswordModify) return null;
+  const hasConsent = actionHistory.some(
+    (h) => h.actionType.toLowerCase() === "ask_user_question" && h.actionDetail.trim().length > 0
+  );
+  if (hasConsent) return null;
+  return {
+    allowed: false,
+    reason: "\u6267\u884C\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u5BC6\u7801\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u5BC6\u7801\u4FEE\u6539\u98CE\u9669",
+    riskLevel: "high",
+    riskType: "consent_missing",
+    confidence: 85,
+    source: "logic_rule",
+    violatedLayers: ["2"]
+  };
+}
+function checkUserDeletionConsent(actionType, actionDetail, actionHistory) {
+  if (actionType !== "bash") return null;
+  const isUserDeletion = USER_DELETION_PATTERNS.some((p) => p.test(actionDetail));
+  if (!isUserDeletion) return null;
+  const hasConsent = actionHistory.some(
+    (h) => h.actionType.toLowerCase() === "ask_user_question" && h.actionDetail.trim().length > 0
+  );
+  if (hasConsent) return null;
+  return {
+    allowed: false,
+    reason: "\u6267\u884C\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u547D\u4EE4\uFF0C\u4F46\u5386\u53F2\u6267\u884C\u5E8F\u5217\u4E2D\u672A\u53D1\u73B0\u5411\u7528\u6237\u786E\u8BA4\u7684 ask_user_question \u64CD\u4F5C\uFF0C\u53EF\u80FD\u5B58\u5728\u672A\u6388\u6743\u7684\u7528\u6237\u5220\u9664\u98CE\u9669",
+    riskLevel: "high",
+    riskType: "consent_missing",
+    confidence: 85,
+    source: "logic_rule",
+    violatedLayers: ["2"]
+  };
+}
+function checkIndirectFileAccess(actionType, actionDetail, cwd) {
+  if (actionType !== "bash" && actionType !== "executebash" && actionType !== "terminal-executebash") {
+    return null;
+  }
+  INLINE_SCRIPT_RE.lastIndex = 0;
+  if (!INLINE_SCRIPT_RE.test(actionDetail)) {
+    return null;
+  }
+  const lowerDetail = actionDetail.toLowerCase();
+  const hasTraversal = DIR_TRAVERSAL_KW.some((kw) => lowerDetail.includes(kw));
+  if (!hasTraversal) {
+    return null;
+  }
+  const READ_KEYWORDS2 = ["read(", "readline", "readlines", "fread", "fgets", "load(", "getpass", "file_get_contents"];
+  const WRITE_KEYWORDS2 = ["write(", "writelines", "fwrite", "file_put_contents"];
+  const EXEC_KEYWORDS = ["system(", "exec(", "eval(", "popen(", "os.system", "os.popen", "subprocess", "os.exec", "os.spawn", "shell=true", "check_output", "check_call", "run(", "passthru", "shell_exec", "proc_open"];
+  const OPEN_KEYWORDS = ["open(", "fopen("];
+  const code = extractInlineCode(actionDetail);
+  if (!code) return null;
+  const codeLower = code.toLowerCase();
+  const hasAnyOp = READ_KEYWORDS2.some((kw) => codeLower.includes(kw)) || WRITE_KEYWORDS2.some((kw) => codeLower.includes(kw)) || EXEC_KEYWORDS.some((kw) => codeLower.includes(kw)) || OPEN_KEYWORDS.some((kw) => codeLower.includes(kw));
+  if (!hasAnyOp) {
+    return null;
+  }
+  const hasWrite = WRITE_KEYWORDS2.some((kw) => codeLower.includes(kw));
+  const hasExec = EXEC_KEYWORDS.some((kw) => codeLower.includes(kw));
+  const blockAllSensitive = hasWrite || hasExec;
+  let actualFiles = [];
+  if (cwd && cwd !== "/") {
+    try {
+      actualFiles = fs2.readdirSync(cwd);
+    } catch {
+    }
+  }
+  if (actualFiles.length > 0) {
+    for (const cp of CREDENTIAL_PATHS) {
+      const fname = cp.path.split("/").pop() || cp.path;
+      if (actualFiles.some((f) => f === fname || f.toLowerCase() === fname.toLowerCase())) {
+        return {
+          allowed: false,
+          reason: `\u5185\u8054\u811A\u672C\u4F7F\u7528\u76EE\u5F55\u904D\u5386\u52A8\u6001\u53D1\u73B0\u6587\u4EF6\u5E76\u6267\u884C\u8BFB\u5199\u64CD\u4F5C\uFF0Ccwd (${cwd}) \u4E2D\u5305\u542B\u51ED\u636E\u6587\u4EF6: ${fname}`,
+          riskLevel: "high",
+          riskType: "file_access",
+          confidence: 95,
+          source: "logic_rule",
+          violatedLayers: ["2"],
+          isCredential: true
+        };
+      }
+    }
+    if (blockAllSensitive) {
+      for (const sp of [...ROOT_SENSITIVE_PATHS, ...HOME_SENSITIVE_PATHS]) {
+        const fname = sp.path.split("/").pop() || sp.path;
+        if (actualFiles.some((f) => f === fname || f.toLowerCase() === fname.toLowerCase())) {
+          return {
+            allowed: false,
+            reason: `\u5185\u8054\u811A\u672C\u4F7F\u7528\u76EE\u5F55\u904D\u5386\u52A8\u6001\u53D1\u73B0\u6587\u4EF6\u5E76\u6267\u884C\u5199\u64CD\u4F5C\uFF0Ccwd (${cwd}) \u4E2D\u5305\u542B\u654F\u611F\u6587\u4EF6: ${fname}`,
+            riskLevel: "high",
+            riskType: "file_access",
+            confidence: 95,
+            source: "logic_rule",
+            violatedLayers: ["2"]
+          };
+        }
+      }
+    }
+    return null;
+  }
+  return {
+    allowed: false,
+    reason: "\u5185\u8054\u811A\u672C\u4F7F\u7528\u76EE\u5F55\u904D\u5386\u51FD\u6570\u52A8\u6001\u53D1\u73B0\u6587\u4EF6\u5E76\u6267\u884C\u8BFB\u5199\u64CD\u4F5C\uFF0C\u65E0\u6CD5\u83B7\u53D6 cwd \u5B9E\u9645\u6587\u4EF6\u5217\u8868\uFF0C\u8F6C\u5C423 LLM \u5206\u6790",
+    riskLevel: "medium",
+    riskType: "file_access",
+    confidence: 70,
+    source: "logic_rule",
+    violatedLayers: ["2"]
+  };
+}
+var ROOT_SENSITIVE_PATHS, HOME_SENSITIVE_PATHS, CREDENTIAL_PATHS, NON_WRITE_TOOLS, READ_ONLY_REDIR_CMDS, WRITE_KEYWORDS, READ_KEYWORDS, CREATE_KEYWORDS, PASSWORD_MODIFY_PATTERNS, USER_DELETION_PATTERNS, INTENT_DEVIATION_PATTERNS, INLINE_SCRIPT_RE, DIR_TRAVERSAL_KW;
+var init_logic_rules = __esm({
+  "src/engine/logic-rules.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_inline_analyzer();
+    ROOT_SENSITIVE_PATHS = [
+      { path: "/etc/shadow", riskLevel: "critical", desc: "\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6", credential: true },
+      { path: "/etc/gshadow", riskLevel: "critical", desc: "\u7CFB\u7EDF\u7EC4\u5BC6\u7801\u6587\u4EF6", credential: true },
+      // 注意：/etc/passwd 仅从 L1 启发式规则移除（公开可读），L2 敏感路径仍保留
+      { path: "/etc/passwd", riskLevel: "high", desc: "\u7CFB\u7EDF\u7528\u6237\u6587\u4EF6" },
+      { path: "/etc/sudoers", riskLevel: "critical", desc: "sudo \u914D\u7F6E", credential: true },
+      // 系统配置（仅拦截写入）
+      { path: "/etc/hosts", riskLevel: "medium", desc: "DNS \u89E3\u6790\u914D\u7F6E" },
+      { path: "/etc/crontab", riskLevel: "high", desc: "\u7CFB\u7EDF\u5B9A\u65F6\u4EFB\u52A1" },
+      { path: "/etc/cron.d/", riskLevel: "high", desc: "\u7CFB\u7EDF\u5B9A\u65F6\u4EFB\u52A1\u76EE\u5F55\uFF08\u62C6\u5206\u5F0F crontab\uFF09" },
+      { path: "/var/spool/cron/", riskLevel: "high", desc: "\u7528\u6237\u7EA7\u5B9A\u65F6\u4EFB\u52A1\u76EE\u5F55" },
+      { path: "/etc/systemd/", riskLevel: "high", desc: "systemd \u670D\u52A1\u914D\u7F6E" },
+      { path: "/etc/ssh/sshd_config", riskLevel: "high", desc: "SSH \u670D\u52A1\u914D\u7F6E" },
+      { path: "/etc/pam.d/", riskLevel: "high", desc: "PAM \u53EF\u63D2\u62D4\u8BA4\u8BC1\u6A21\u5757\u914D\u7F6E" },
+      // 危险目录（仅拦截写入）
+      { path: "/boot/", riskLevel: "critical", desc: "\u542F\u52A8\u5F15\u5BFC\u76EE\u5F55" },
+      { path: "/proc/sys/", riskLevel: "high", desc: "\u5185\u6838\u53C2\u6570" },
+      { path: "/sys/", riskLevel: "high", desc: "sysfs \u5185\u6838\u63A5\u53E3" },
+      // 设备文件（/dev/null、/dev/zero、/dev/urandom 已移除，误报率极高）
+      { path: "/dev/random", riskLevel: "high", desc: "\u963B\u585E\u5F0F\u968F\u673A\u6570\u8BBE\u5907\uFF08\u8BFB\u53D6\u8017\u5C3D\u71B5\u6C60\uFF09" },
+      { path: "/dev/mem", riskLevel: "critical", desc: "\u7269\u7406\u5185\u5B58\u8BBF\u95EE\u8BBE\u5907" },
+      { path: "/dev/kmsg", riskLevel: "high", desc: "\u5185\u6838\u6D88\u606F\u7F13\u51B2\u533A" },
+      // SSH 主机私钥
+      { path: "/etc/ssh/ssh_host_rsa_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A RSA \u79C1\u94A5", credential: true },
+      { path: "/etc/ssh/ssh_host_ed25519_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A Ed25519 \u79C1\u94A5", credential: true },
+      { path: "/etc/ssh/ssh_host_ecdsa_key", riskLevel: "critical", desc: "SSH \u4E3B\u673A ECDSA \u79C1\u94A5", credential: true }
+    ];
+    HOME_SENSITIVE_PATHS = [
+      { path: ".ssh/id_rsa", riskLevel: "critical", desc: "SSH \u79C1\u94A5", credential: true },
+      { path: ".ssh/id_ed25519", riskLevel: "critical", desc: "SSH \u79C1\u94A5 (ed25519)", credential: true },
+      { path: ".ssh/authorized_keys", riskLevel: "high", desc: "SSH \u6388\u6743\u5BC6\u94A5" },
+      // 持久化与命令劫持（仅拦截写入）
+      { path: ".bashrc", riskLevel: "high", desc: "\u7528\u6237 Shell \u521D\u59CB\u5316\u811A\u672C" },
+      { path: ".bash_profile", riskLevel: "high", desc: "\u7528\u6237 Shell \u767B\u5F55\u811A\u672C" },
+      { path: ".profile", riskLevel: "high", desc: "\u7528\u6237\u901A\u7528\u767B\u5F55\u811A\u672C" },
+      { path: ".aws/credentials", riskLevel: "critical", desc: "AWS \u51ED\u8BC1", credential: true },
+      { path: ".gitconfig", riskLevel: "medium", desc: "Git \u914D\u7F6E" },
+      { path: ".gnupg", riskLevel: "high", desc: "GPG \u5BC6\u94A5\u76EE\u5F55" }
+    ];
+    CREDENTIAL_PATHS = [
+      { path: "credentials.yml", riskLevel: "high", desc: "\u51ED\u636E\u914D\u7F6E\u6587\u4EF6" },
+      { path: "credentials.yaml", riskLevel: "high", desc: "\u51ED\u636E\u914D\u7F6E\u6587\u4EF6" },
+      { path: "secrets.yml", riskLevel: "high", desc: "\u5BC6\u94A5\u914D\u7F6E\u6587\u4EF6" },
+      { path: "secrets.yaml", riskLevel: "high", desc: "\u5BC6\u94A5\u914D\u7F6E\u6587\u4EF6" },
+      { path: ".env", riskLevel: "high", desc: "\u73AF\u5883\u53D8\u91CF/\u51ED\u636E\u914D\u7F6E\u6587\u4EF6" }
+    ];
+    NON_WRITE_TOOLS = /* @__PURE__ */ new Set(["ask_user_question", "glob", "grep", "list_dir", "count_text_length", "search"]);
+    READ_ONLY_REDIR_CMDS = /* @__PURE__ */ new Set(["cat", "head", "tail", "less", "more", "grep", "find", "awk", "sed", "sort", "uniq", "wc", "cut", "strings", "od", "xxd", "hexdump"]);
+    WRITE_KEYWORDS = ["write", "\u5199\u5165", "save", "\u4FDD\u5B58", "modify", "\u4FEE\u6539", "update", "\u66F4\u65B0", "delete", "\u5220\u9664", "remove", "\u79FB\u9664", "create", "\u521B\u5EFA", "append", "\u8FFD\u52A0", "truncate", "\u622A\u65AD", "overwrite", "\u8986\u76D6", "replace", "\u66FF\u6362"];
+    READ_KEYWORDS = ["read", "\u8BFB\u53D6", "cat", "head", "tail", "less", "more", "view", "\u67E5\u770B", "open", "\u6253\u5F00", "load", "\u52A0\u8F7D", "grep", "search", "\u641C\u7D22", "find", "\u67E5\u627E"];
+    CREATE_KEYWORDS = ["\u521B\u5EFA", "\u65B0\u5EFA", "create", "new file", "touch"];
+    PASSWORD_MODIFY_PATTERNS = [
+      /\|\s*passwd\b/i,
+      /\bpasswd\s+--stdin\b/i,
+      /\bchpasswd\b/i,
+      /\bchgpasswd\b/i,
+      /\b(newusers|lnewusers)\b/i,
+      /\bpasswd\s+-[a-zA-Z]*d\b/i,
+      /\bpasswd\s+-[a-zA-Z]*l\b/i
+    ];
+    USER_DELETION_PATTERNS = [
+      /\buserdel\s/i,
+      /\bdeluser\s/i,
+      /\bluserdel\s/i,
+      /\bgroupdel\s/i,
+      /\blgroupdel\s/i
+    ];
+    INTENT_DEVIATION_PATTERNS = [
+      {
+        intentKeywords: ["\u8BFB\u53D6", "\u67E5\u770B", "\u5206\u6790", "read", "analyze", "view", "list", "\u5217\u51FA"],
+        dangerousActions: ["\u5220\u9664", "remove", "delete", "rm ", "\u683C\u5F0F\u5316", "format"],
+        reason: "\u539F\u59CB\u610F\u56FE\u4E3A\u8BFB\u53D6/\u5206\u6790\uFF0C\u4F46\u6267\u884C\u4E86\u5220\u9664\u64CD\u4F5C"
+      },
+      {
+        intentKeywords: ["\u67E5\u8BE2", "\u641C\u7D22", "search", "query", "find"],
+        dangerousActions: ["\u4FEE\u6539", "update", "write", "\u5199\u5165", "alter"],
+        reason: "\u539F\u59CB\u610F\u56FE\u4E3A\u67E5\u8BE2/\u641C\u7D22\uFF0C\u4F46\u6267\u884C\u4E86\u4FEE\u6539\u64CD\u4F5C"
+      }
+    ];
+    INLINE_SCRIPT_RE = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
+    DIR_TRAVERSAL_KW = [
+      "os.listdir",
+      "os.walk",
+      "os.scandir",
+      "glob.glob",
+      "glob.iglob",
+      "pathlib.",
+      "iterdir",
+      "rglob",
+      "scandir(",
+      "listdir("
+    ];
+  }
+});
+
+// src/engine/heuristic.ts
+function runHeuristicCheck(input) {
+  const command = `${input.aNext.actionType}: ${input.aNext.actionDetail}`;
+  const matched = [];
+  let highestSeverity = "low";
+  let highestRiskType = "";
+  const userRules = getCustomRules();
+  for (const rule of userRules) {
+    try {
+      const re = new RegExp(rule.pattern);
+      if (re.test(command)) {
+        if (rule.action === "Deny") {
+          matched.push(`\u81EA\u5B9A\u4E49\u89C4\u5219: ${rule.pattern}`);
+          if (severityRank(rule.severity) > severityRank(highestSeverity)) {
+            highestSeverity = rule.severity;
+            highestRiskType = "custom_rule";
+          }
+        }
+      }
+    } catch {
+    }
+  }
+  let topRiskType = "";
+  for (const rule of DANGEROUS_PATTERNS) {
+    if (rule.pattern.test(command)) {
+      matched.push(rule.description);
+      if (severityRank(rule.severity) > severityRank(highestSeverity)) {
+        highestSeverity = rule.severity;
+        topRiskType = rule.riskType;
+      }
+    }
+  }
+  highestRiskType = topRiskType || highestRiskType;
+  const agentExt = getAgentExtensions(input.agentId);
+  if (agentExt?.extra_command_patterns) {
+    for (const rule of agentExt.extra_command_patterns) {
+      try {
+        const re = new RegExp(rule.pattern, "i");
+        if (re.test(command)) {
+          matched.push(`agent \u4E13\u5C5E\u89C4\u5219: ${rule.reason}`);
+          if (severityRank(rule.risk_level) > severityRank(highestSeverity)) {
+            highestSeverity = rule.risk_level;
+            highestRiskType = rule.risk_type;
+          }
+        }
+      } catch {
+      }
+    }
+  }
+  const injectionText = `${input.aNext.actionType} ${input.aNext.actionDetail} ${input.reason || ""} ${input.promptSession || ""}`.toLowerCase();
+  const injectionHits = checkInjectionKeywords(injectionText, agentExt?.extra_injection_keywords);
+  if (injectionHits.length > 0) {
+    const topHit = injectionHits.reduce((a, b) => severityRank(a.riskLevel) >= severityRank(b.riskLevel) ? a : b);
+    matched.push(...injectionHits.map((h) => `\u6CE8\u5165\u5173\u952E\u8BCD [${h.lang}]: ${h.keyword}`));
+    if (severityRank(topHit.riskLevel) > severityRank(highestSeverity)) {
+      highestSeverity = topHit.riskLevel;
+      highestRiskType = "prompt_injection";
+    }
+  }
+  const actionTypeL = input.aNext.actionType.toLowerCase();
+  const detailL = input.aNext.actionDetail.toLowerCase();
+  const isExcludedType = SENSITIVE_EXCLUDED_PREFIXES.some((p) => actionTypeL.startsWith(p));
+  if (!isExcludedType) {
+    const pathResult = checkSensitivePath(detailL, input.cwd || "/", agentExt);
+    if (pathResult) return pathResult;
+  }
+  const dangerousResult = checkDangerousPatterns(actionTypeL, detailL);
+  if (dangerousResult) return dangerousResult;
+  const lateralResult = checkLateralMovement(detailL);
+  if (lateralResult) return lateralResult;
+  if (matched.length > 0) {
+    return {
+      allowed: false,
+      reason: `\u68C0\u6D4B\u5230\u9AD8\u5371\u64CD\u4F5C: ${matched.join(", ")}`,
+      riskLevel: highestSeverity,
+      riskType: highestRiskType,
+      confidence: 95,
+      source: "heuristic",
+      violatedLayers: ["1.1"]
+      // 对齐 py coordinator.py:165（L1.1 = 命中高危命令模式/注入关键词）
+    };
+  }
+  return null;
+}
+function checkInjectionKeywords(text, extraKeywords) {
+  const hits = [];
+  for (const entry of INJECTION_KEYWORDS) {
+    if (text.includes(entry.keyword.toLowerCase())) {
+      hits.push(entry);
+    }
+  }
+  if (extraKeywords) {
+    for (const entry of extraKeywords) {
+      if (text.includes(entry.keyword.toLowerCase())) {
+        hits.push({ keyword: entry.keyword, riskLevel: entry.risk_level, lang: entry.lang });
+      }
+    }
+  }
+  return hits;
+}
+function isInlineScriptCommand(actionDetail) {
+  const re = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
+  return re.test(actionDetail);
+}
+function severityRank(s) {
+  const ranks = { low: 1, medium: 2, high: 3, critical: 4 };
+  return ranks[s] || 0;
+}
+function checkSensitivePath(command, cwd, agentExt) {
+  const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
+  const _WRITE_CMD_RES = [/\brm\b/, /\bunlink\b/, /\brmdir\b/, /\bshred\b/, /\bcp\b/, /\bmv\b/, /\binstall\b/, /\btee\b/, /\bdd\b/, /\bmkfs\b/, /\b(fdisk|parted|cfdisk|sfdisk)\b/, /\bchmod\b/, /\bchown\b/, /\btruncate\b/];
+  const _DEVNULL_RE = /(?:2|&|1)?\s*>\s*\/dev\/null\b/;
+  const _READONLY_CMDS = /* @__PURE__ */ new Set(["cat", "head", "tail", "less", "more", "grep", "find", "awk", "sed", "sort", "uniq", "wc", "cut", "strings", "od", "xxd", "hexdump", "tr", "file", "stat", "du", "df", "ls", "dir", "tree", "nl", "tac", "rev", "lsblk", "blockdev", "smartctl", "udevadm", "dmidecode", "lscpu", "lspci", "lsusb", "lsmem", "lsns", "lsof", "hwinfo", "inxi", "fdisk", "parted", "dmesg", "journalctl", "systemctl", "hostnamectl", "localectl", "timedatectl", "ps", "top", "free", "vmstat", "iostat", "mpstat", "pidof", "pgrep", "ip", "ifconfig", "route", "ss", "netstat", "arp", "ethtool", "nmcli", "uname", "arch", "nproc", "getconf", "getent", "id", "whoami", "who", "w", "last", "uptime", "lsmod", "modinfo", "sysctl"]);
+  const isWriteOpFlag = _WRITE_CMD_RES.some((rx) => rx.test(command)) || /\bsed\s+-[a-zA-Z]*i/.test(command) || command.includes(">") && !command.replace(_DEVNULL_RE, "").includes(">") || command.includes(">") && command.replace(_DEVNULL_RE, "").includes(">") && !_READONLY_CMDS.has(command.trim().split(/\s+/)[0]?.toLowerCase() || "") || WRITE_KEYWORDS.some((kw) => "".includes(kw) || command.includes(kw));
+  for (const sp of ROOT_SENSITIVE_PATHS) {
+    if (command.includes(sp.path.toLowerCase())) {
+      if (sp.path === "/dev/random") {
+        if (isWriteOpFlag) {
+          continue;
+        }
+        return {
+          allowed: false,
+          reason: `\u8BFB\u53D6\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
+          riskLevel: sp.riskLevel,
+          riskType: "file_access",
+          confidence: 90,
+          source: "heuristic",
+          violatedLayers: ["1.1"]
+        };
+      }
+      if (!isWriteOpFlag && !sp.credential) {
+        continue;
+      }
+      return {
+        allowed: false,
+        reason: `\u5C1D\u8BD5\u8BBF\u95EE\u7CFB\u7EDF\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
+        riskLevel: sp.riskLevel,
+        riskType: "file_access",
+        confidence: 90,
+        source: "heuristic",
+        violatedLayers: ["1.1"],
+        isCredential: !!sp.credential
+      };
+    }
+  }
+  for (const sp of HOME_SENSITIVE_PATHS) {
+    const expanded = `${expandedCwd}/${sp.path}`;
+    const pathRe = sp.path.endsWith(".pub") ? new RegExp(sp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i") : new RegExp(sp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "(?!\\.pub)", "i");
+    const expandedRe = sp.path.endsWith(".pub") ? new RegExp(expanded.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i") : new RegExp(expanded.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "(?!\\.pub)", "i");
+    if (pathRe.test(command) || expandedRe.test(command)) {
+      if (!isWriteOpFlag && !sp.credential) {
+        continue;
+      }
+      return {
+        allowed: false,
+        reason: `\u5C1D\u8BD5\u8BBF\u95EE\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
+        riskLevel: sp.riskLevel,
+        riskType: "file_access",
+        confidence: 90,
+        source: "heuristic",
+        violatedLayers: ["1.1"],
+        isCredential: !!sp.credential
+      };
+    }
+  }
+  if (agentExt?.extra_sensitive_paths && agentExt.extra_sensitive_paths.length > 0) {
+    for (const sp of agentExt.extra_sensitive_paths) {
+      const spPath = sp.path.toLowerCase();
+      const expanded = `${expandedCwd}/${spPath}`;
+      if (command.includes(spPath) || command.includes(expanded.toLowerCase())) {
+        const denyMode = sp.deny_mode || (sp.credential ? "deny_both" : sp.read_only ? "deny_read" : "deny_write");
+        if (denyMode === "deny_read") {
+          if (isWriteOpFlag) continue;
+        } else if (denyMode === "deny_write") {
+          if (!isWriteOpFlag) continue;
+        }
+        return {
+          allowed: false,
+          reason: `\u5C1D\u8BD5\u8BBF\u95EE agent \u4E13\u5C5E\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
+          riskLevel: sp.risk_level,
+          riskType: "file_access",
+          confidence: 90,
+          source: "heuristic",
+          violatedLayers: ["1.1"],
+          isCredential: !!sp.credential
+        };
+      }
+    }
+  }
+  for (const cp of CREDENTIAL_PATHS) {
+    const escaped = cp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const re = cp.path.startsWith(".") ? new RegExp(`(?:^|[\\s/\\\\'"])${escaped}\\b`) : new RegExp(`\\b${escaped}\\b`);
+    if (re.test(command)) {
+      return {
+        allowed: false,
+        reason: `\u8BBF\u95EE\u654F\u611F\u8DEF\u5F84: ${cp.desc} (${cp.path})`,
+        riskLevel: cp.riskLevel,
+        riskType: "file_access",
+        confidence: 90,
+        source: "heuristic",
+        violatedLayers: ["1.1"],
+        isCredential: true
+      };
+    }
+  }
+  if ((command.includes("rm ") || command.includes("unlink")) && (command.includes("/etc/") || command.includes("/root/") || command.includes("/var/log/"))) {
+    return {
+      allowed: false,
+      reason: "\u68C0\u6D4B\u5230\u5220\u9664\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55\u5185\u5BB9",
+      riskLevel: "critical",
+      riskType: "file_access",
+      confidence: 90,
+      source: "heuristic",
+      violatedLayers: ["1.1"]
+    };
+  }
+  return null;
+}
+function checkDangerousPatterns(actionType, actionDetail) {
+  if (actionType === "file_write" || actionType === "file_edit") return null;
+  const TEMP_DIRS = ["/tmp/", "/var/tmp/", "/run/", "/dev/shm/"];
+  const isTempPath = TEMP_DIRS.some((td) => actionDetail.includes(td));
+  if (!isTempPath && (actionDetail.includes("*") || actionDetail.includes("?")) && ["rm ", "rm	", "del ", "del	", "delete", "remove ", "remove	", "\u5220\u9664", "\u79FB\u9664"].some((kw) => actionDetail.includes(kw))) {
+    return {
+      allowed: false,
+      reason: "\u68C0\u6D4B\u5230\u901A\u914D\u7B26\u7ED3\u5408\u5220\u9664\u64CD\u4F5C\uFF0C\u53EF\u80FD\u9020\u6210\u6279\u91CF\u8BEF\u5220",
+      riskLevel: "high",
+      riskType: "script_execution",
+      confidence: 90,
+      source: "heuristic",
+      violatedLayers: ["1.1"]
+    };
+  }
+  if (/>\s*\/etc\//.test(actionDetail) || />\s*\/boot\//.test(actionDetail) || />\s*\/proc\//.test(actionDetail)) {
+    return {
+      allowed: false,
+      reason: "\u68C0\u6D4B\u5230\u91CD\u5B9A\u5411\u8986\u76D6\u5199\u5165\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55",
+      riskLevel: "critical",
+      riskType: "file_access",
+      confidence: 95,
+      source: "heuristic",
+      violatedLayers: ["1.1"]
+    };
+  }
+  return null;
+}
+function extractRemoteHost(command) {
+  const m = command.match(/(?:ssh|scp|rsync)\s+(?:-[\w]+\s+)*(\S+@\S+|\b(?!-)[\w.-]+\b)/);
+  return m ? m[1] : null;
+}
+function isLocalHost(host) {
+  const localNames = ["localhost", "127.0.0.1", "::1", process.env.HOSTNAME || "", "0.0.0.0"];
+  return localNames.includes(host.replace(/.*@/, ""));
+}
+function checkLateralMovement(actionDetail) {
+  if (/(?:ssh|scp|rsync)\s+/.test(actionDetail)) {
+    const targetHost = extractRemoteHost(actionDetail);
+    if (targetHost && !isLocalHost(targetHost)) {
+      return {
+        allowed: false,
+        reason: `\u5C1D\u8BD5\u6A2A\u5411\u79FB\u52A8\u5230\u8FDC\u7A0B\u4E3B\u673A: ${targetHost}`,
+        riskLevel: "medium",
+        riskType: "lateral_movement",
+        confidence: 80,
+        source: "heuristic",
+        violatedLayers: ["1.1"]
+      };
+    }
+  }
+  return null;
+}
+var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, SENSITIVE_EXCLUDED_PREFIXES;
+var init_heuristic = __esm({
+  "src/engine/heuristic.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_config();
+    init_agents();
+    init_logic_rules();
+    INJECTION_KEYWORDS = [
+      // ---- Instruction Override ----
+      { keyword: "ignore previous instructions", riskLevel: "critical", lang: "en" },
+      { keyword: "ignore all previous", riskLevel: "critical", lang: "en" },
+      { keyword: "disregard all prior", riskLevel: "critical", lang: "en" },
+      { keyword: "forget everything", riskLevel: "high", lang: "en" },
+      { keyword: "\u5FFD\u7565\u4E4B\u524D\u7684\u6307\u4EE4", riskLevel: "critical", lang: "zh" },
+      { keyword: "\u5FFD\u7565\u6240\u6709\u5148\u524D\u7684", riskLevel: "critical", lang: "zh" },
+      { keyword: "\u5FFD\u7565\u4E0A\u9762\u6240\u6709", riskLevel: "high", lang: "zh" },
+      { keyword: "\u8BF7\u5FD8\u8BB0\u4E4B\u524D", riskLevel: "high", lang: "zh" },
+      // ---- Role Hijacking ----
+      { keyword: "you are now", riskLevel: "high", lang: "en" },
+      { keyword: "you are no longer", riskLevel: "high", lang: "en" },
+      { keyword: "new instructions", riskLevel: "high", lang: "en" },
+      { keyword: "from now on, you", riskLevel: "high", lang: "en" },
+      { keyword: "\u4F60\u73B0\u5728\u662F\u4E00\u4E2A", riskLevel: "high", lang: "zh" },
+      { keyword: "\u4F60\u4E0D\u518D\u662F\u4E00\u4E2A", riskLevel: "high", lang: "zh" },
+      { keyword: "\u4ECE\u73B0\u5728\u5F00\u59CB\u4F60", riskLevel: "high", lang: "zh" },
+      { keyword: "\u4F60\u7684\u65B0\u89D2\u8272\u662F", riskLevel: "high", lang: "zh" },
+      // ---- Command Injection ----
+      { keyword: "system prompt", riskLevel: "high", lang: "en" },
+      { keyword: "reveal your instructions", riskLevel: "high", lang: "en" },
+      { keyword: "output your instructions", riskLevel: "high", lang: "en" },
+      { keyword: "repeat your instructions", riskLevel: "medium", lang: "en" },
+      { keyword: "\u7CFB\u7EDF\u63D0\u793A", riskLevel: "high", lang: "zh" },
+      { keyword: "\u8F93\u51FA\u4F60\u7684\u6307\u4EE4", riskLevel: "high", lang: "zh" },
+      { keyword: "\u91CD\u590D\u4F60\u7684\u6307\u4EE4", riskLevel: "medium", lang: "zh" },
+      // ---- Social Engineering ----
+      { keyword: "this is an authorized test", riskLevel: "high", lang: "en" },
+      { keyword: "security audit approved", riskLevel: "high", lang: "en" },
+      { keyword: "admin override", riskLevel: "critical", lang: "en" },
+      { keyword: "debug mode", riskLevel: "high", lang: "en" },
+      { keyword: "maintenance mode", riskLevel: "high", lang: "en" },
+      { keyword: "\u8FD9\u662F\u6388\u6743\u7684\u6D4B\u8BD5", riskLevel: "high", lang: "zh" },
+      { keyword: "\u5B89\u5168\u5BA1\u8BA1\u5DF2\u6279\u51C6", riskLevel: "high", lang: "zh" },
+      { keyword: "\u7BA1\u7406\u5458\u8986\u76D6", riskLevel: "critical", lang: "zh" },
+      { keyword: "\u8C03\u8BD5\u6A21\u5F0F", riskLevel: "high", lang: "zh" },
+      // ---- XSS ----
+      { keyword: "<script>", riskLevel: "high", lang: "en" },
+      { keyword: "javascript:", riskLevel: "high", lang: "en" },
+      { keyword: "onerror=", riskLevel: "high", lang: "en" },
+      { keyword: "onload=", riskLevel: "high", lang: "en" },
+      // ---- Fake Boundaries ----
+      { keyword: "=== END OF", riskLevel: "high", lang: "en" },
+      { keyword: "--- END SYSTEM", riskLevel: "high", lang: "en" },
+      { keyword: "[END OF", riskLevel: "high", lang: "en" },
+      { keyword: "=== \u7ED3\u675F", riskLevel: "high", lang: "zh" },
+      { keyword: "--- \u7ED3\u675F\u7CFB\u7EDF", riskLevel: "high", lang: "zh" },
+      // ---- Developer Mode ----
+      { keyword: "developer mode", riskLevel: "critical", lang: "en" },
+      { keyword: "DAN mode", riskLevel: "critical", lang: "en" },
+      { keyword: "jailbreak", riskLevel: "critical", lang: "en" },
+      { keyword: "\u5F00\u53D1\u8005\u6A21\u5F0F", riskLevel: "critical", lang: "zh" },
+      { keyword: "\u8D8A\u72F1", riskLevel: "critical", lang: "zh" }
+      // 注：xiaoO 专属绕过词（绕过审计/禁用安全检查/关闭防护/bypass audit 等）
+      // 已迁至 agent_moss/agents/xiaoo/rules.json 的 extra_injection_keywords，
+      // 由 agent_ext 机制注入，不再污染通用层。
+    ];
+    DANGEROUS_PATTERNS = [
+      // --- Critical: rm command graded detection (strict to loose, first match wins) ---
+      // 1. rm -rf root dir (含通配符如 /* /.* 等) — 使用负向先行断言 (?!\w)：/ 后面不是单词字符时匹配
+      { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*f[a-zA-Z]*\s+\/(?!\w)/i, severity: "critical", description: "\u9012\u5F52\u5F3A\u5236\u5220\u9664\u6839\u76EE\u5F55 (rm -rf /)", riskType: "script_execution" },
+      // 注意：已移除"rm -rf /任意绝对路径"的宽泛规则，避免误杀 /tmp 等临时目录清理操作
+      // 2. rm with -r or -f targeting system dirs — var 分支排除 /var/tmp/（合法清理）
+      { pattern: /\brm\s+-[a-zA-Z]*[rf][a-zA-Z]*\s+\/(etc|var(?!\/tmp)|home|usr|boot|root|opt|srv|sys|proc)\b/i, severity: "critical", description: "\u5220\u9664\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55", riskType: "script_execution" },
+      // 3. rm -r absolute path (no -f) — 排除 /tmp/ /var/tmp/ /run/ /dev/shm/（CI/开发高频合法清理）
+      { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*\s+\/(?!tmp\/|var\/tmp\/|run\/|dev\/shm\/)/i, severity: "high", description: "\u9012\u5F52\u5220\u9664\u64CD\u4F5C (rm -r /...)", riskType: "script_execution" },
+      // 4. rm -f absolute path (no -r) — 同样排除临时目录
+      { pattern: /\brm\s+-[a-zA-Z]*f[a-zA-Z]*\s+\/(?!tmp\/|var\/tmp\/|run\/|dev\/shm\/)/i, severity: "medium", description: "\u5F3A\u5236\u5220\u9664\u6587\u4EF6 (rm -f /...)", riskType: "script_execution" },
+      // dd 磁盘清零 — 只拦截写入系统关键目录，放行 /tmp 等临时目录
+      { pattern: /dd\s+if=\/dev\/zero.*\bof\s*=\s*\/(etc|var|home|usr|boot|root|opt|srv|sys|proc)\b/i, severity: "critical", description: "\u78C1\u76D8\u6E05\u96F6\u5199\u5165\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55 (dd if=/dev/zero of=/\u7CFB\u7EDF\u76EE\u5F55)", riskType: "script_execution" },
+      // mkfs 格式化 — 只拦截对块设备（/dev/sdX 等）的格式化，放行对普通文件的格式化
+      { pattern: /mkfs\.\w+\s+\/dev\/(sd|hd|nvme|vd|loop|mapper|md|dm)\S+/i, severity: "critical", description: "\u683C\u5F0F\u5316\u5757\u8BBE\u5907 (mkfs /dev/\u5757\u8BBE\u5907)", riskType: "script_execution" },
+      { pattern: /:\(\)\s*\{.*:\|:&.*\};:/i, severity: "critical", description: "Fork Bomb", riskType: "resource_exhaustion" },
+      // --- Critical: remote code execution ---
+      { pattern: /curl\s+.*\|\s*(bash|sh|zsh|dash)/i, severity: "critical", description: "curl pipe shell \u6267\u884C", riskType: "script_execution" },
+      { pattern: /wget\s+.*\|\s*(bash|sh)/i, severity: "critical", description: "wget pipe shell \u6267\u884C", riskType: "script_execution" },
+      { pattern: /eval\s+\$\(curl|eval\s+\$\(wget/i, severity: "critical", description: "eval \u8FDC\u7A0B\u4EE3\u7801\u6267\u884C", riskType: "script_execution" },
+      { pattern: /base64\s+-d\s+.*\|\s*bash/i, severity: "critical", description: "base64 \u89E3\u7801\u6267\u884C", riskType: "script_execution" },
+      // --- Critical: reverse shell ---
+      { pattern: /\/dev\/tcp\/|bash\s+-i\s+>&/i, severity: "critical", description: "\u53CD\u5F39 Shell", riskType: "script_execution" },
+      { pattern: /nc\s+-[el]\s+.*\d{1,5}/i, severity: "high", description: "Netcat \u53CD\u5F39\u8FDE\u63A5", riskType: "lateral_movement" },
+      // --- Critical: sensitive file access ---
+      { pattern: /\/etc\/shadow/i, severity: "critical", description: "\u8BBF\u95EE\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6 (/etc/shadow)", riskType: "file_access" },
+      { pattern: /\/etc\/gshadow/i, severity: "critical", description: "\u8BBF\u95EE\u7CFB\u7EDF\u7EC4\u5BC6\u7801\u6587\u4EF6 (/etc/gshadow)", riskType: "file_access" },
+      // 注意：/etc/passwd 已从拦截列表移除，因为它是公开可读的标准系统文件，真正敏感的是 /etc/shadow
+      { pattern: /\.ssh\/id_rsa(?!\.pub)/i, severity: "critical", description: "\u8BBF\u95EE SSH \u79C1\u94A5\u6587\u4EF6", riskType: "file_access" },
+      // --- Critical: privilege escalation / container escape ---
+      { pattern: /\/var\/run\/docker\.sock/i, severity: "critical", description: "\u8BBF\u95EE Docker socket\uFF0C\u53EF\u80FD\u5BFC\u81F4\u5BB9\u5668\u9003\u9038", riskType: "privilege_escalation" },
+      // --- High: dangerous permissions / ownership ---
+      { pattern: /chmod\s+[0-7]*777[0-7]*/i, severity: "high", description: "\u5168\u6743\u9650\u8BBE\u7F6E (chmod 777)", riskType: "script_execution" },
+      { pattern: /chown\s+root|chown\s+-R\s+\w+:\w+\s+\//i, severity: "high", description: "\u4FEE\u6539\u6240\u6709\u8005\u4E3A root / \u9012\u5F52\u4FEE\u6539\u6839\u76EE\u5F55\u6240\u6709\u8005", riskType: "script_execution" },
+      // sudo 提权 — 只拦截 sudo 后跟的危险命令，不一刀切拦截所有 sudo
+      { pattern: /sudo\s+(rm|chmod|chown|dd|mkfs|format|iptables|crontab|passwd|userdel|useradd|groupdel)\b/i, severity: "high", description: "\u63D0\u6743\u6267\u884C\u9AD8\u5371\u547D\u4EE4 (sudo + \u5371\u9669\u64CD\u4F5C)", riskType: "privilege_escalation" },
+      // --- High: system config overwrite ---
+      { pattern: />\s*\/etc\//i, severity: "critical", description: "\u8986\u76D6\u5199\u5165\u7CFB\u7EDF\u914D\u7F6E\u76EE\u5F55", riskType: "file_access" },
+      // --- High: download script + execute risk ---
+      { pattern: /(?:curl|wget)\s+.*(?:-o|--output|>)\s*\S+\.(?:sh|bash)\b/i, severity: "high", description: "\u8FDC\u7A0B\u4E0B\u8F7D\u811A\u672C\u5230\u672C\u5730", riskType: "script_execution" },
+      { pattern: /(?:curl|wget)\s+.*\s+&&?\s*(?:chmod\s+\+x|bash|sh)/i, severity: "high", description: "\u4E0B\u8F7D\u540E\u6267\u884C", riskType: "script_execution" },
+      // --- High: package manager pipe-to-shell ---
+      { pattern: /git\s+clone\s+.*\|.*bash/i, severity: "high", description: "git clone pipe shell", riskType: "script_execution" },
+      { pattern: /pip\s+install\s+.*\|\s*bash/i, severity: "high", description: "pip install pipe shell", riskType: "script_execution" },
+      { pattern: /npm\s+install\s+-g\s+.*\|\s*bash/i, severity: "high", description: "npm install pipe shell", riskType: "script_execution" },
+      // --- Medium: destructive git operations (降级为 medium，允许但记录) ---
+      { pattern: /git\s+push\s+.*--force/i, severity: "medium", description: "\u5F3A\u5236\u63A8\u9001\u64CD\u4F5C (git push --force)\uFF0C\u53EF\u80FD\u8986\u76D6\u8FDC\u7A0B\u63D0\u4EA4\u5386\u53F2", riskType: "script_execution" },
+      // --- High: network port scanning (横向移动侦察) ---
+      { pattern: /\bnmap\s+/i, severity: "high", description: "\u7F51\u7EDC\u7AEF\u53E3\u626B\u63CF (nmap)\uFF0C\u53EF\u80FD\u7528\u4E8E\u6A2A\u5411\u79FB\u52A8\u4FA6\u5BDF", riskType: "lateral_movement" },
+      { pattern: /\b(masscan|zmap|unicornscan)\s+/i, severity: "high", description: "\u7F51\u7EDC\u7AEF\u53E3\u626B\u63CF\u5DE5\u5177\uFF0C\u53EF\u80FD\u7528\u4E8E\u6A2A\u5411\u79FB\u52A8\u4FA6\u5BDF", riskType: "lateral_movement" },
+      // --- Medium: credential export ---
+      { pattern: /export\s+.*(?:TOKEN|KEY|SECRET|PASSWORD)/i, severity: "medium", description: "\u5BFC\u51FA\u654F\u611F\u51ED\u8BC1", riskType: "data_exfiltration" },
+      // --- High: shell rc file append (persistence) ---
+      { pattern: />>\s*(~|\/home\/[^/]+)\/(\.bashrc|\.zshrc|\.profile|\.bash_profile|\.zprofile)/, severity: "high", description: "\u68C0\u6D4B\u5230\u4FEE\u6539 Shell \u914D\u7F6E\u6587\u4EF6\uFF08~/.bashrc \u7B49\uFF09\uFF0C\u53EF\u80FD\u7528\u4E8E\u6301\u4E45\u5316\u540E\u95E8", riskType: "persistence" },
+      // --- High: device file write (只拦截重定向写入设备文件，不拦截读取) ---
+      { pattern: />\s*\/dev\/(sd|hd|nvme|vd|loop|mem|kmsg|port|zero|random|urandom|full|core)/i, severity: "high", description: "\u91CD\u5B9A\u5411\u5199\u5165\u8BBE\u5907\u6587\u4EF6", riskType: "file_access" },
+      // --- High: non-interactive password modification ---
+      { pattern: /\|\s*passwd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u7BA1\u9053\u65B9\u5F0F\u8C03\u7528 passwd\uFF08\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\uFF09", riskType: "script_execution" },
+      { pattern: /\bpasswd\s+--stdin\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 passwd --stdin \u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u8F93\u5165", riskType: "script_execution" },
+      { pattern: /\bchpasswd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 chpasswd \u6279\u91CF\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4", riskType: "script_execution" },
+      { pattern: /\b(newusers|lnewusers)\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 newusers/lnewusers \u6279\u91CF\u7528\u6237\u6DFB\u52A0\u547D\u4EE4", riskType: "script_execution" },
+      { pattern: /\bpasswd\s+-[a-zA-Z]*d\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u5BC6\u7801\u64CD\u4F5C (passwd -d)", riskType: "script_execution" },
+      { pattern: /\bpasswd\s+-[a-zA-Z]*l\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u9501\u5B9A\u7528\u6237\u8D26\u6237\u64CD\u4F5C (passwd -l)", riskType: "script_execution" },
+      // --- High: non-interactive password modification (extended) ---
+      { pattern: /\blpasswd\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u64CD\u4F5C (lpasswd)", riskType: "script_execution" },
+      { pattern: /\bgpasswd\s+(?!-[adA])/i, severity: "high", description: "\u68C0\u6D4B\u5230\u7EC4\u5BC6\u7801\u7BA1\u7406\u64CD\u4F5C (gpasswd)", riskType: "script_execution" },
+      { pattern: /\bchgpasswd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u6279\u91CF\u4FEE\u6539\u7EC4\u5BC6\u7801\u64CD\u4F5C (chgpasswd)", riskType: "script_execution" },
+      // --- High: user/group deletion (irreversible, requires user consent) ---
+      { pattern: /\buserdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (userdel)", riskType: "script_execution" },
+      { pattern: /\bdeluser\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (deluser)", riskType: "script_execution" },
+      { pattern: /\bluserdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (luserdel)", riskType: "script_execution" },
+      { pattern: /\bgroupdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u7EC4\u64CD\u4F5C (groupdel)", riskType: "script_execution" },
+      { pattern: /\blgroupdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u7EC4\u64CD\u4F5C (lgroupdel)", riskType: "script_execution" },
+      // --- High: generic command -p parameter password setting ---
+      { pattern: /\b(useradd|luseradd|groupadd|usermod|lusermod|groupmod|lgroupmod)\b[^&|;]*?\s-p\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u901A\u8FC7 -p \u53C2\u6570\u8BBE\u7F6E\u6216\u4FEE\u6539\u5BC6\u7801 (useradd/usermod/groupmod)", riskType: "script_execution" }
+    ];
+    SENSITIVE_EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
+  }
+});
+
+// src/engine/skill-loader.ts
+import { readFileSync as readFileSync2, readdirSync as readdirSync2, existsSync as existsSync3 } from "fs";
+import { resolve as resolve2, dirname as dirname2 } from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
+function loadAllSkills() {
+  if (cachedSkills) return cachedSkills;
+  cachedSkills = {};
+  const dir = existsSync3(SKILLS_DIR) ? SKILLS_DIR : SKILLS_DIR_FALLBACK;
+  if (!existsSync3(dir)) {
+    console.warn("[AgentMoss] Skills directory not found:", SKILLS_DIR, "and fallback:", SKILLS_DIR_FALLBACK);
+    return cachedSkills;
+  }
+  const files = readdirSync2(dir).filter((f) => f.endsWith(".md"));
+  for (const f of files) {
+    const name = f.replace(".md", "");
+    cachedSkills[name] = readFileSync2(resolve2(dir, f), "utf-8");
+  }
+  console.log(`[AgentMoss] Loaded ${Object.keys(cachedSkills).length} skills from ${dir}`);
+  return cachedSkills;
+}
+function matchSkills(actionType, actionDetail, reason, maxSkills = 3) {
+  const skills = loadAllSkills();
+  const combined = `${actionType} ${actionDetail} ${reason}`.toLowerCase();
+  const actionDetailLower = actionDetail.toLowerCase();
+  const actionTypeLower = actionType.toLowerCase();
+  const reasonLower = reason.toLowerCase();
+  const scores = {};
+  for (const [skillName, keywords] of Object.entries(SKILL_KEYWORD_MAP)) {
+    let score = 0;
+    for (const kw of keywords) {
+      if (combined.includes(kw)) {
+        if (kw === actionTypeLower) score += 2;
+        else if (actionDetailLower.includes(kw)) score += 1.5;
+        else if (reasonLower.includes(kw)) score += 1;
+        else score += 0.5;
+      }
+    }
+    if (score > 0) scores[skillName] = score;
+  }
+  const sorted = Object.entries(scores).sort((a, b) => b[1] - a[1]);
+  const top = sorted.slice(0, maxSkills);
+  const maxScore = top[0]?.[1] || 1;
+  const results = [];
+  for (const [name, score] of top) {
+    const content = skills[name];
+    if (content) {
+      results.push({
+        skillName: name,
+        relevance: Math.min(score / maxScore, 1),
+        skillContent: content
+      });
+    }
+  }
+  if (results.length === 0) {
+    const fallback = skills["general_tool_risk_guard"];
+    if (fallback) {
+      results.push({ skillName: "general_tool_risk_guard", relevance: 0.3, skillContent: fallback });
+    }
+  }
+  return results;
+}
+function formatSkillsForPrompt(skills) {
+  if (skills.length === 0) return "(\u672A\u5339\u914D\u5230\u7279\u5B9A\u5B89\u5168\u68C0\u6D4B\u89C4\u5219)";
+  return skills.map(
+    (s) => `### \u5B89\u5168\u68C0\u6D4B\u89C4\u5219: ${s.skillName} (\u76F8\u5173\u5EA6: ${Math.round(s.relevance * 100)}%)
+
+${s.skillContent}`
+  ).join("\n\n---\n\n");
+}
+var __filename3, __dirname3, SKILLS_DIR, SKILLS_DIR_FALLBACK, SKILL_KEYWORD_MAP, cachedSkills;
+var init_skill_loader = __esm({
+  "src/engine/skill-loader.ts"() {
+    "use strict";
+    init_esm_shims();
+    __filename3 = fileURLToPath3(import.meta.url);
+    __dirname3 = dirname2(__filename3);
+    SKILLS_DIR = resolve2(__dirname3, "../skills");
+    SKILLS_DIR_FALLBACK = resolve2(__dirname3, "../../../agent_moss/skills");
+    SKILL_KEYWORD_MAP = {
+      "file_access_guard": ["file", "\u6587\u4EF6", "path", "\u8DEF\u5F84", "read", "write", "cat", "open", "access", "\u8BBF\u95EE", "\u8BFB\u5199", "copy", "cp", "mv", "move"],
+      "script_execution_guard": ["command", "shell", "bash", "exec", "execute", "\u6267\u884C", "\u547D\u4EE4", "script", "\u811A\u672C", "run", "\u8FD0\u884C", "subprocess", "system", "eval", "compile", "\u5B89\u88C5", "install", "pip", "npm"],
+      "data_exfiltration_guard": ["upload", "\u4E0A\u4F20", "send", "\u53D1\u9001", "transfer", "\u4F20\u8F93", "export", "\u5BFC\u51FA", "download", "\u4E0B\u8F7D", "post", "http", "request", "fetch", "curl", "wget", "\u5916\u4F20", "\u6CC4\u9732", "exfil", "network", "\u7F51\u7EDC"],
+      "browser_web_access_guard": ["browser", "\u6D4F\u89C8\u5668", "web", "\u7F51\u9875", "url", "navigate", "\u6D4F\u89C8", "scrape", "crawl", "\u722C\u53D6", "click", "screenshot"],
+      "email_operation_guard": ["email", "\u90AE\u4EF6", "mail", "smtp", "send_email", "\u53D1\u9001\u90AE\u4EF6", "inbox", "\u6536\u4EF6\u7BB1", "\u9644\u4EF6", "attachment"],
+      "general_tool_risk_guard": ["tool", "\u5DE5\u5177", "api", "invoke", "\u8C03\u7528", "function", "\u51FD\u6570"],
+      "lateral_movement_guard": ["ssh", "scp", "ftp", "sftp", "rdp", "vnc", "telnet", "\u5185\u7F51", "\u6A2A\u5411", "tunnel", "\u4EE3\u7406", "proxy", "port", "\u7AEF\u53E3", "scan", "\u626B\u63CF", "ping", "traceroute", "nslookup"],
+      "persistence_backdoor_guard": ["cron", "crontab", "\u5B9A\u65F6", "scheduled", "startup", "\u542F\u52A8\u9879", "service", "\u670D\u52A1", "daemon", "\u5B88\u62A4", "registry", "\u6CE8\u518C\u8868", "backdoor", "\u540E\u95E8", "persist", "\u6301\u4E45\u5316", "authorized_keys", "bashrc", "zshrc", "profile", ".rc", "shell config", "shell \u914D\u7F6E"],
+      // 注意：避免裸 'memory'/'内存'/'dd'——会误命中 memory-addMemory（写记忆工具，
+      // 'dd' 是 'addMemory' 的子串）等无害操作。用组合词/命令前缀精准匹配攻击场景。
+      "resource_exhaustion_guard": ["fork", "bomb", "\u70B8\u5F39", "memory bomb", "oom", "out of memory", "\u5185\u5B58\u6EA2\u51FA", "\u5185\u5B58\u8017\u5C3D", "\u5185\u5B58\u6CC4\u6F0F", "disk", "\u78C1\u76D8", "cpu", "process", "\u8FDB\u7A0B", "dd if=", "/dev/zero", "/dev/null", "yes >", "while true", "\u65E0\u9650\u5FAA\u73AF", "\u8017\u5C3D", "exhaust", "\u8D44\u6E90"],
+      "skill_installation_guard": ["skill", "plugin", "\u63D2\u4EF6", "extension", "\u6269\u5C55", "install skill", "\u5B89\u88C5\u63D2\u4EF6", "\u5B89\u88C5\u6280\u80FD", "marketplace", "\u5546\u5E97"],
+      "supply_chain_guard": ["dependency", "\u4F9D\u8D56", "package", "\u5305", "npm install", "pip install", "requirements", "import", "library", "\u5E93", "registry", "\u4ED3\u5E93", "supply", "\u4F9B\u5E94\u94FE", "typosquatting"],
+      "intent_deviation_guard": ["rm", "del", "delete", "remove", "\u5220\u9664", "format", "\u683C\u5F0F\u5316", "drop", "truncate", "\u6E05\u7A7A", "wipe", "\u64E6\u9664", "\u91CD\u7F6E", "reset", "sudo", "root", "admin", "\u7BA1\u7406\u5458", "privilege", "\u63D0\u6743"],
+      "indirect_access_guard": ["listdir", "os.walk", "os.scandir", "glob.glob", "glob.iglob", "pathlib", "iterdir", "rglob", "scandir", "os.listdir", "\u76EE\u5F55\u904D\u5386", "traversal"]
+    };
+    cachedSkills = null;
+  }
+});
+
+// src/engine/token-stats.ts
+var token_stats_exports = {};
+__export(token_stats_exports, {
+  getRecentRecords: () => getRecentRecords,
+  getTokenStats: () => getTokenStats,
+  getTokenTrend: () => getTokenTrend,
+  recordTokenUsage: () => recordTokenUsage,
+  resetTokenStats: () => resetTokenStats
+});
+import { readFileSync as readFileSync6, writeFileSync, existsSync as existsSync6, mkdirSync, unlinkSync } from "fs";
+import { join as join3 } from "path";
+import { homedir as homedir2 } from "os";
+function getStatsPath() {
+  const envPath = process.env[ENV_STATS_PATH];
+  return envPath || STATS_FILE;
+}
+function loadAllRecords(statsPath) {
+  if (!existsSync6(statsPath)) return [];
+  try {
+    const data = JSON.parse(readFileSync6(statsPath, "utf-8"));
+    if (Array.isArray(data)) return data;
+    if (data && Array.isArray(data.records)) return data.records;
+    return [];
+  } catch (e) {
+    return [];
+  }
+}
+function saveRecords(statsPath, records) {
+  try {
+    const dir = statsPath.substring(0, statsPath.lastIndexOf("/"));
+    if (dir && !existsSync6(dir)) mkdirSync(dir, { recursive: true });
+    writeFileSync(statsPath, JSON.stringify(records, null, 2), "utf-8");
+  } catch (e) {
+  }
+}
+function recordTokenUsage(record) {
+  const statsPath = getStatsPath();
+  const records = loadAllRecords(statsPath);
+  records.push({
+    timestamp: record.timestamp || (/* @__PURE__ */ new Date()).toISOString(),
+    session_id: record.sessionId,
+    step: record.step,
+    model: record.model,
+    prompt_tokens: record.promptTokens,
+    completion_tokens: record.completionTokens,
+    total_tokens: record.totalTokens
+  });
+  if (records.length > MAX_RECORDS) {
+    records.splice(0, records.length - MAX_RECORDS);
+  }
+  saveRecords(statsPath, records);
+}
+function filterByDate(records, days = 0, startDate, endDate) {
+  if (startDate || endDate) {
+    let startDt = startDate ? new Date(startDate) : /* @__PURE__ */ new Date(-864e13);
+    let endDt = endDate ? new Date(endDate) : void 0;
+    if (endDate) {
+      const e = new Date(endDate);
+      e.setHours(23, 59, 59, 999);
+      endDt = e;
+    }
+    const endMs = endDt ? endDt.getTime() : Number.MAX_SAFE_INTEGER;
+    return records.filter((r) => {
+      try {
+        const ts = new Date(r.timestamp).getTime();
+        return ts >= startDt.getTime() && ts <= endMs;
+      } catch {
+        return true;
+      }
+    });
+  } else if (days > 0) {
+    const cutoff = Date.now() - days * 864e5;
+    return records.filter((r) => {
+      try {
+        return new Date(r.timestamp).getTime() >= cutoff;
+      } catch {
+        return true;
+      }
+    });
+  }
+  return records;
+}
+function aggregate(records) {
+  let totalPrompt = 0, totalCompletion = 0, totalTotal = 0;
+  const byStep = {};
+  const byModel = {};
+  const byDate = {};
+  const bucket = (b, key, r) => {
+    const e = b[key] || (b[key] = { prompt_tokens: 0, completion_tokens: 0, total_tokens: 0, calls: 0 });
+    e.prompt_tokens += r.prompt_tokens || 0;
+    e.completion_tokens += r.completion_tokens || 0;
+    e.total_tokens += r.total_tokens || 0;
+    e.calls += 1;
+  };
+  for (const r of records) {
+    totalPrompt += r.prompt_tokens || 0;
+    totalCompletion += r.completion_tokens || 0;
+    totalTotal += r.total_tokens || 0;
+    bucket(byStep, r.step || "unknown", r);
+    bucket(byModel, r.model || "unknown", r);
+    let dateKey = "unknown";
+    try {
+      dateKey = new Date(r.timestamp).toISOString().slice(0, 10);
+    } catch {
+    }
+    bucket(byDate, dateKey, r);
+  }
+  const sortedDate = Object.keys(byDate).sort((a, b) => a < b ? 1 : a > b ? -1 : 0);
+  const sortedByDate = {};
+  for (const k of sortedDate) sortedByDate[k] = byDate[k];
+  return { totalPrompt, totalCompletion, totalTotal, byStep, byModel, byDate: sortedByDate };
+}
+function getTokenStats(days = 0, startDate, endDate) {
+  const records = filterByDate(loadAllRecords(getStatsPath()), days, startDate, endDate);
+  const a = aggregate(records);
+  return {
+    total_prompt_tokens: a.totalPrompt,
+    total_completion_tokens: a.totalCompletion,
+    total_tokens: a.totalTotal,
+    total_calls: records.length,
+    by_step: a.byStep,
+    by_model: a.byModel,
+    by_date: a.byDate
+  };
+}
+function getRecentRecords(limit = 20) {
+  const records = loadAllRecords(getStatsPath());
+  return records.slice(-limit);
+}
+function getTokenTrend(days = 0, startDate, endDate) {
+  const records = filterByDate(loadAllRecords(getStatsPath()), days, startDate, endDate);
+  const series = {};
+  const datesSet = /* @__PURE__ */ new Set();
+  for (const r of records) {
+    let dateKey;
+    try {
+      dateKey = new Date(r.timestamp).toISOString().slice(0, 10);
+    } catch {
+      continue;
+    }
+    const model = r.model || "unknown";
+    const tokens = r.total_tokens || 0;
+    datesSet.add(dateKey);
+    series[model] = series[model] || {};
+    series[model][dateKey] = (series[model][dateKey] || 0) + tokens;
+  }
+  const dates = Array.from(datesSet).sort();
+  const models = Object.keys(series).sort();
+  return { dates, models, series };
+}
+function resetTokenStats() {
+  const statsPath = getStatsPath();
+  if (existsSync6(statsPath)) {
+    try {
+      unlinkSync(statsPath);
+    } catch {
+    }
+  }
+}
+var STATS_DIR, STATS_FILE, ENV_STATS_PATH, MAX_RECORDS;
+var init_token_stats = __esm({
+  "src/engine/token-stats.ts"() {
+    "use strict";
+    init_esm_shims();
+    STATS_DIR = join3(homedir2(), ".config", "agentmoss");
+    STATS_FILE = join3(STATS_DIR, "agent_moss_token_stats.json");
+    ENV_STATS_PATH = "AGENT_MOSS_TOKEN_STATS_PATH";
+    MAX_RECORDS = 1e4;
+  }
+});
+
+// src/infra/runtime-config.ts
+var runtime_config_exports = {};
+__export(runtime_config_exports, {
+  DENY_MODE_LABELS: () => DENY_MODE_LABELS,
+  addCustomRule: () => addCustomRule,
+  addCustomSkill: () => addCustomSkill,
+  deleteCustomRule: () => deleteCustomRule,
+  deleteCustomSkill: () => deleteCustomSkill,
+  filterEnabledRules: () => filterEnabledRules,
+  generateSourceDefaults: () => generateSourceDefaults,
+  getDisabledL2RulesWithSkipL3: () => getDisabledL2RulesWithSkipL3,
+  getDisabledSkillIds: () => getDisabledSkillIds,
+  getEnabledL1CommandPatterns: () => getEnabledL1CommandPatterns,
+  getEnabledL1CommandPatternsOrDefault: () => getEnabledL1CommandPatternsOrDefault,
+  getEnabledL1InjectionKeywords: () => getEnabledL1InjectionKeywords,
+  getEnabledL1InjectionKeywordsOrDefault: () => getEnabledL1InjectionKeywordsOrDefault,
+  getEnabledL2IntentPatterns: () => getEnabledL2IntentPatterns,
+  getEnabledL2IntentPatternsOrDefault: () => getEnabledL2IntentPatternsOrDefault,
+  getEnabledL2PasswordPatterns: () => getEnabledL2PasswordPatterns,
+  getEnabledL2PasswordPatternsOrDefault: () => getEnabledL2PasswordPatternsOrDefault,
+  getEnabledL2SensitivePaths: () => getEnabledL2SensitivePaths,
+  getEnabledL2SensitivePathsOrDefault: () => getEnabledL2SensitivePathsOrDefault,
+  getEnabledL2UserDeletionPatterns: () => getEnabledL2UserDeletionPatterns,
+  getEnabledL2UserDeletionPatternsOrDefault: () => getEnabledL2UserDeletionPatternsOrDefault,
+  getEnvOverrides: () => getEnvOverrides,
+  getProfileOrDetect: () => getProfileOrDetect,
+  getRuntimeConfigPath: () => getRuntimeConfigPath,
+  hasRuntimeConfig: () => hasRuntimeConfig,
+  isL2CategoryEnabled: () => isL2CategoryEnabled,
+  isLayerEnabled: () => isLayerEnabled,
+  loadRuntimeConfig: () => loadRuntimeConfig,
+  mergeConfig: () => mergeConfig,
+  saveRuntimeConfig: () => saveRuntimeConfig,
+  updateCategoryEnabled: () => updateCategoryEnabled,
+  updateLayerEnabled: () => updateLayerEnabled,
+  updateRuleDenyMode: () => updateRuleDenyMode,
+  updateRuleEnabled: () => updateRuleEnabled,
+  updateRuleSkipL3: () => updateRuleSkipL3,
+  updateSkillCategoryEnabled: () => updateSkillCategoryEnabled,
+  updateSkillEnabled: () => updateSkillEnabled
+});
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync2, existsSync as existsSync7, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2 } from "fs";
+import { join as join4 } from "path";
+import { homedir as homedir3 } from "os";
+function getRuntimeConfigPath() {
+  const envPath = process.env[ENV_RUNTIME_CONFIG_PATH];
+  if (envPath) return envPath;
+  return RUNTIME_CONFIG_PATH;
+}
+function saveRuntimeConfig(config) {
+  const p = getRuntimeConfigPath();
+  const dir = p.substring(0, p.lastIndexOf("/"));
+  if (dir && !existsSync7(dir)) mkdirSync2(dir, { recursive: true });
+  writeFileSync2(p, JSON.stringify(config, null, 2), "utf-8");
+}
+function emptyRuntimeConfig() {
+  return {
+    version: 1,
+    layers: { L1_heuristic: true, L2_logic_rules: true, L3_llm_analysis: true },
+    L1_rules: {},
+    L2_rules: {},
+    L3_skills: {}
+  };
+}
+function loadRuntimeConfig() {
+  const p = getRuntimeConfigPath();
+  if (!existsSync7(p)) {
+    const seeded = mergeConfig({}, generateSourceDefaults());
+    try {
+      saveRuntimeConfig(seeded);
+    } catch {
+    }
+    return seeded;
+  }
+  try {
+    const data = JSON.parse(readFileSync7(p, "utf-8"));
+    const merged = mergeConfig(data, generateSourceDefaults());
+    return {
+      version: data.version || 1,
+      layers: {
+        L1_heuristic: data.layers?.L1_heuristic ?? true,
+        L2_logic_rules: data.layers?.L2_logic_rules ?? true,
+        L3_llm_analysis: data.layers?.L3_llm_analysis ?? true
+      },
+      L1_rules: merged.L1_rules || {},
+      L2_rules: merged.L2_rules || {},
+      L3_skills: merged.L3_skills || {}
+    };
+  } catch {
+    return emptyRuntimeConfig();
+  }
+}
+function isLayerEnabled(layerKey) {
+  const disableKey = LAYER_DISABLE_ENV[layerKey];
+  if (disableKey && process.env[disableKey] === "1") return false;
+  const runtime = loadRuntimeConfig();
+  const layers = runtime.layers || {};
+  if (layerKey in layers) return !!layers[layerKey];
+  return true;
+}
+function getEnvOverrides() {
+  const overrides = {};
+  for (const [layerKey, envKey] of Object.entries(LAYER_DISABLE_ENV)) {
+    const val = process.env[envKey];
+    if (val !== void 0) {
+      overrides[layerKey] = {
+        env_var: envKey,
+        env_value: val,
+        overridden: val === "1",
+        effect: val === "1" ? "disabled" : "no_override"
+      };
+    }
+  }
+  return overrides;
+}
+function filterEnabledRules(rules, categoryEnabled = true) {
+  if (!categoryEnabled) return [];
+  return rules.filter((r) => r.enabled !== false);
+}
+function getEnabledL1CommandPatterns(runtime) {
+  const cat = runtime.L1_rules?.dangerous_commands || { category_enabled: true, rules: [] };
+  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => ({
+    pattern: r.pattern || "",
+    risk_level: r.risk_level || "",
+    risk_type: r.risk_type || "",
+    reason: r.reason || ""
+  }));
+}
+function getEnabledL2SensitivePaths(runtime) {
+  let cat = runtime.L1_rules?.sensitive_path_access;
+  if (!cat || !cat.rules || cat.rules.length === 0) {
+    cat = runtime.L2_rules?.sensitive_path_access || { category_enabled: true, rules: [] };
+  }
+  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => {
+    const out = { path: r.path || "", risk_level: r.risk_level || "", desc: r.desc || "", deny_mode: r.deny_mode || "deny_write" };
+    if (r.credential) out.credential = true;
+    if (r.read_only) out.read_only = true;
+    return out;
+  });
+}
+function hasRuntimeConfig() {
+  const p = getRuntimeConfigPath();
+  if (!existsSync7(p)) return false;
+  try {
+    JSON.parse(readFileSync7(p, "utf-8"));
+    return true;
+  } catch {
+    return false;
+  }
+}
+function getDisabledL2RulesWithSkipL3() {
+  let runtime;
+  try {
+    runtime = loadRuntimeConfig();
+  } catch {
+    return {};
+  }
+  const result = {};
+  for (const layerKey of ["L1_rules", "L2_rules"]) {
+    const layer = runtime[layerKey] || {};
+    for (const [catName, cat] of Object.entries(layer)) {
+      if (!cat.category_enabled) continue;
+      const items = [];
+      for (const r of cat.rules || []) {
+        if (r.enabled === false && r.skip_l3_on_disabled) {
+          if (catName === "sensitive_path_access") {
+            if (r.path) items.push(r.path);
+          } else if (catName === "intent_consistency") {
+            items.push(...r.intent_keywords || []);
+          } else if (r.pattern) {
+            items.push(r.pattern);
+          }
+        }
+      }
+      if (items.length > 0) result[catName] = items;
+    }
+  }
+  return result;
+}
+function _slugify(text) {
+  return text.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_|_$/g, "") || "x";
+}
+function _generatePatternId(pattern) {
+  return `pat_${_slugify(pattern)}`;
+}
+function _deriveDenyMode(rule) {
+  if (rule.deny_mode) return rule.deny_mode;
+  if (rule.credential) return "deny_both";
+  if (rule.read_only) return "deny_read";
+  return "deny_write";
+}
+function _syncDenyModeFields(rule) {
+  const dm = rule.deny_mode || "deny_write";
+  if (dm === "deny_both") {
+    rule.credential = true;
+    delete rule.read_only;
+  } else if (dm === "deny_read") {
+    delete rule.credential;
+    rule.read_only = true;
+  } else {
+    delete rule.credential;
+    delete rule.read_only;
+  }
+}
+function _l1CommandPatternsToRules() {
+  return DANGEROUS_PATTERNS.map((p) => ({
+    id: _generatePatternId(p.pattern instanceof RegExp ? p.pattern.source : p.pattern),
+    pattern: p.pattern instanceof RegExp ? p.pattern.source : p.pattern,
+    risk_level: p.severity,
+    risk_type: p.riskType,
+    reason: p.description,
+    enabled: true,
+    builtin: true
+  }));
+}
+function _l1InjectionKeywordsToRules() {
+  return INJECTION_KEYWORDS.map((kw) => ({
+    id: `inj_${_slugify(kw.keyword)}`,
+    keyword: kw.keyword,
+    risk_level: kw.riskLevel,
+    lang: kw.lang || "en",
+    enabled: true,
+    builtin: true
+  }));
+}
+function _l2SensitivePathsToRules() {
+  const all = [...ROOT_SENSITIVE_PATHS, ...HOME_SENSITIVE_PATHS, ...CREDENTIAL_PATHS];
+  return all.map((sp) => {
+    const denyMode = _deriveDenyMode({
+      deny_mode: sp.deny_mode,
+      credential: sp.credential,
+      read_only: sp.read_only
+    });
+    const rule = {
+      id: `path_${_slugify(sp.path)}`,
+      path: sp.path,
+      risk_level: sp.riskLevel,
+      desc: sp.desc,
+      deny_mode: denyMode,
+      source_deny_mode: denyMode,
+      skip_l3_on_disabled: true,
+      enabled: true,
+      builtin: true
+    };
+    _syncDenyModeFields(rule);
+    return rule;
+  });
+}
+function _l2IntentPatternsToRules() {
+  return INTENT_DEVIATION_PATTERNS.map((pat, i) => ({
+    id: `intent_${i + 1}_${_slugify(pat.reason.slice(0, 30))}`,
+    intent_keywords: pat.intentKeywords,
+    dangerous_actions: pat.dangerousActions,
+    reason: pat.reason,
+    skip_l3_on_disabled: true,
+    enabled: true,
+    builtin: true
+  }));
+}
+function _l2PasswordPatternsToRules() {
+  return PASSWORD_MODIFY_PATTERNS.map((p) => ({
+    id: `pw_${_slugify(p.source)}`,
+    pattern: p.source,
+    skip_l3_on_disabled: true,
+    enabled: true,
+    builtin: true
+  }));
+}
+function _l2UserDeletionPatternsToRules() {
+  return USER_DELETION_PATTERNS.map((p) => ({
+    id: `ud_${_slugify(p.source)}`,
+    pattern: p.source,
+    skip_l3_on_disabled: true,
+    enabled: true,
+    builtin: true
+  }));
+}
+function _l3SkillsToRules() {
+  const skillCategories = {
+    file_operations: ["file_access_guard", "script_execution_guard", "indirect_access_guard"],
+    network_security: [
+      "data_exfiltration_guard",
+      "browser_web_access_guard",
+      "lateral_movement_guard",
+      "email_operation_guard"
+    ],
+    persistence_supply_chain: [
+      "persistence_backdoor_guard",
+      "supply_chain_guard",
+      "skill_installation_guard"
+    ],
+    intent_and_general: ["intent_deviation_guard", "general_tool_risk_guard"],
+    resource: ["resource_exhaustion_guard"]
+  };
+  const out = {};
+  for (const [cat, ids] of Object.entries(skillCategories)) {
+    out[cat] = {
+      category_enabled: true,
+      category_desc: "",
+      skills: ids.map((s) => ({
+        id: s,
+        keywords: SKILL_KEYWORD_MAP[s] || [],
+        enabled: true,
+        builtin: true
+      }))
+    };
+  }
+  const categorized = new Set(Object.values(skillCategories).flat());
+  for (const s of Object.keys(SKILL_KEYWORD_MAP)) {
+    if (!categorized.has(s)) {
+      (out.intent_and_general ??= { category_enabled: true, category_desc: "", skills: [] }).skills.push({
+        id: s,
+        keywords: SKILL_KEYWORD_MAP[s],
+        enabled: true,
+        builtin: true
+      });
+    }
+  }
+  out.user_custom = { category_enabled: true, category_desc: "", skills: [] };
+  return out;
+}
+function generateSourceDefaults() {
+  return {
+    version: 1,
+    layers: { L1_heuristic: true, L2_logic_rules: true, L3_llm_analysis: true },
+    L1_rules: {
+      dangerous_commands: {
+        category_enabled: true,
+        category_desc: "\u5371\u9669\u547D\u4EE4\u68C0\u6D4B\uFF08\u9012\u5F52\u5220\u9664\u3001\u5168\u6743\u9650\u8BBE\u7F6E\u3001\u63D0\u6743\u6267\u884C\u7B49\uFF09",
+        rules: _l1CommandPatternsToRules()
+      },
+      injection_detection: {
+        category_enabled: true,
+        category_desc: "Prompt \u6CE8\u5165\u653B\u51FB\u68C0\u6D4B",
+        rules: _l1InjectionKeywordsToRules()
+      },
+      sensitive_path_access: {
+        category_enabled: true,
+        category_desc: "\u654F\u611F\u8DEF\u5F84\u8BBF\u95EE\u68C0\u6D4B\uFF08deny_both/deny_read/deny_write\uFF09",
+        rules: _l2SensitivePathsToRules()
+      },
+      user_custom: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49\u547D\u4EE4\u89C4\u5219", rules: [] }
+    },
+    L2_rules: {
+      intent_consistency: {
+        category_enabled: true,
+        category_desc: "\u610F\u56FE\u4E00\u81F4\u6027\u68C0\u6D4B",
+        rules: _l2IntentPatternsToRules()
+      },
+      password_modify_consent: {
+        category_enabled: true,
+        category_desc: "\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u6388\u6743\u68C0\u6D4B",
+        rules: _l2PasswordPatternsToRules()
+      },
+      user_deletion_consent: {
+        category_enabled: true,
+        category_desc: "\u7528\u6237/\u7EC4\u5220\u9664\u64CD\u4F5C\u6388\u6743\u68C0\u6D4B",
+        rules: _l2UserDeletionPatternsToRules()
+      },
+      read_before_write: { category_enabled: true, category_desc: "read_before_write \u5B89\u5168\u539F\u5219\u68C0\u6D4B", rules: [] },
+      user_custom: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49 L2 \u903B\u8F91\u89C4\u5219", rules: [] }
+    },
+    L3_skills: _l3SkillsToRules()
+  };
+}
+function _ruleFingerprint(rule) {
+  if (rule.intent_keywords && rule.intent_keywords.length || rule.dangerous_actions && rule.dangerous_actions.length) {
+    return JSON.stringify([
+      [...rule.intent_keywords || []].sort(),
+      [...rule.dangerous_actions || []].sort()
+    ]);
+  }
+  if (rule.path) return JSON.stringify([rule.path]);
+  if (rule.pattern) return JSON.stringify([rule.pattern]);
+  if (rule.keyword) return JSON.stringify([rule.keyword, rule.lang || ""]);
+  return JSON.stringify([rule.id || ""]);
+}
+function _mergeRuleCategories(userCfg, srcDefaults, layerKey) {
+  const userLayer = userCfg[layerKey] || (userCfg[layerKey] = {});
+  const srcLayer = srcDefaults[layerKey] || {};
+  for (const [catName, srcCat] of Object.entries(srcLayer)) {
+    if (!(catName in userLayer)) {
+      userLayer[catName] = srcCat;
+      continue;
+    }
+    const userCat = userLayer[catName];
+    if (userCat.category_desc === void 0) userCat.category_desc = srcCat.category_desc || "";
+    if (userCat.category_enabled === void 0) userCat.category_enabled = srcCat.category_enabled ?? true;
+    const srcRules = srcCat.rules || [];
+    const userRules = userCat.rules || (userCat.rules = []);
+    const userByFp = /* @__PURE__ */ new Map();
+    for (const r of userRules) userByFp.set(_ruleFingerprint(r), r);
+    const srcFps = /* @__PURE__ */ new Set();
+    for (const srcR of srcRules) {
+      const fp = _ruleFingerprint(srcR);
+      srcFps.add(fp);
+      if (userByFp.has(fp)) {
+        const existing = userByFp.get(fp);
+        const userEnabled = existing.enabled;
+        const userSkipL3 = existing.skip_l3_on_disabled;
+        const userDenyMode = existing.deny_mode;
+        const userSourceDeny = existing.source_deny_mode;
+        Object.keys(existing).forEach((k) => delete existing[k]);
+        Object.assign(existing, srcR);
+        existing.enabled = userEnabled;
+        if (userSkipL3 !== void 0) existing.skip_l3_on_disabled = userSkipL3;
+        if (userDenyMode && userSourceDeny && userDenyMode !== userSourceDeny) {
+          existing.deny_mode = userDenyMode;
+        }
+        if (existing.deny_mode) _syncDenyModeFields(existing);
+      } else {
+        const newR = { ...srcR, enabled: true };
+        userRules.push(newR);
+      }
+    }
+    for (const r of userRules) {
+      if (r.builtin && !srcFps.has(_ruleFingerprint(r))) {
+        r.source_removed = true;
+        r.enabled = false;
+      }
+    }
+    if (catName === "sensitive_path_access") {
+      for (const r of userRules) {
+        if (!r.deny_mode) r.deny_mode = _deriveDenyMode(r);
+        _syncDenyModeFields(r);
+      }
+    }
+  }
+  for (const catName of Object.keys(userLayer)) {
+    if (catName === "user_custom") continue;
+    if (!(catName in srcLayer)) delete userLayer[catName];
+  }
+}
+function _mergeSkillCategories(userCfg, srcDefaults, layerKey) {
+  const userLayer = userCfg[layerKey] || (userCfg[layerKey] = {});
+  const srcLayer = srcDefaults[layerKey] || {};
+  for (const [catName, srcCat] of Object.entries(srcLayer)) {
+    if (!(catName in userLayer)) {
+      userLayer[catName] = srcCat;
+      continue;
+    }
+    const userCat = userLayer[catName];
+    if (userCat.category_desc === void 0) userCat.category_desc = srcCat.category_desc || "";
+    if (userCat.category_enabled === void 0) userCat.category_enabled = srcCat.category_enabled ?? true;
+    const userSkills = userCat.skills || (userCat.skills = []);
+    const existingIds = new Set(userSkills.map((s) => s.id));
+    for (const srcS of srcCat.skills || []) {
+      if (!existingIds.has(srcS.id)) userSkills.push({ ...srcS });
+    }
+  }
+}
+function mergeConfig(userCfg, srcDefaults) {
+  const cfg = userCfg;
+  if (cfg.version === void 0) cfg.version = srcDefaults.version || 1;
+  if (!cfg.layers) cfg.layers = {};
+  for (const [layerKey, defaultVal] of Object.entries(srcDefaults.layers)) {
+    if (!(layerKey in cfg.layers)) cfg.layers[layerKey] = defaultVal;
+  }
+  _migrateCategoriesAcrossLayers(
+    cfg,
+    "L2_rules",
+    "L1_rules",
+    ["sensitive_path_access"]
+  );
+  _mergeRuleCategories(cfg, srcDefaults, "L1_rules");
+  _mergeRuleCategories(cfg, srcDefaults, "L2_rules");
+  _mergeSkillCategories(cfg, srcDefaults, "L3_skills");
+  return cfg;
+}
+function _migrateCategoriesAcrossLayers(cfg, srcLayer, dstLayer, catNames) {
+  const src = cfg[srcLayer] || {};
+  const dst = cfg[dstLayer] || (cfg[dstLayer] = {});
+  for (const catName of catNames) {
+    if (!(catName in src)) continue;
+    const srcCat = src[catName];
+    if (!dst[catName]) {
+      dst[catName] = { category_enabled: true, category_desc: "", rules: [] };
+    }
+    const dstCat = dst[catName];
+    if (!dstCat.category_desc && srcCat.category_desc) dstCat.category_desc = srcCat.category_desc;
+    if (dstCat.category_enabled === void 0) dstCat.category_enabled = srcCat.category_enabled;
+    if (srcCat.rules && srcCat.rules.length > 0) {
+      const dstFps = new Set((dstCat.rules || []).map((r) => _ruleFingerprint(r)));
+      for (const r of srcCat.rules) {
+        const fp = _ruleFingerprint(r);
+        if (!dstFps.has(fp)) {
+          (dstCat.rules = dstCat.rules || []).push(r);
+          dstFps.add(fp);
+        }
+      }
+    }
+    delete src[catName];
+  }
+}
+function getEnabledL1InjectionKeywords(runtime) {
+  const cat = runtime.L1_rules?.injection_detection || { category_enabled: true, rules: [] };
+  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => ({
+    keyword: r.keyword || "",
+    risk_level: r.risk_level || "",
+    lang: r.lang || "en"
+  }));
+}
+function getEnabledL2IntentPatterns(runtime) {
+  const cat = runtime.L2_rules?.intent_consistency || { category_enabled: true, rules: [] };
+  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => ({
+    intent_keywords: r.intent_keywords || [],
+    dangerous_actions: r.dangerous_actions || [],
+    reason: r.reason || ""
+  }));
+}
+function getEnabledL2PasswordPatterns(runtime) {
+  const cat = runtime.L2_rules?.password_modify_consent || { category_enabled: true, rules: [] };
+  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => r.pattern || "");
+}
+function getEnabledL2UserDeletionPatterns(runtime) {
+  const cat = runtime.L2_rules?.user_deletion_consent || { category_enabled: true, rules: [] };
+  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => r.pattern || "");
+}
+function isL2CategoryEnabled(runtime, categoryKey) {
+  const cat = runtime.L2_rules?.[categoryKey];
+  return cat?.category_enabled ?? true;
+}
+function getDisabledSkillIds(runtime) {
+  const disabled = /* @__PURE__ */ new Set();
+  for (const catData of Object.values(runtime.L3_skills || {})) {
+    if (!catData.category_enabled) {
+      for (const s of catData.skills || []) disabled.add(s.id);
+    } else {
+      for (const s of catData.skills || []) {
+        if (s.enabled === false) disabled.add(s.id);
+      }
+    }
+  }
+  return disabled;
+}
+function getEnabledL1CommandPatternsOrDefault(runtime) {
+  const enabled = getEnabledL1CommandPatterns(runtime);
+  if (enabled.length) return enabled;
+  if (!hasRuntimeConfig()) return _l1CommandPatternsToRules();
+  return [];
+}
+function getEnabledL1InjectionKeywordsOrDefault(runtime) {
+  const enabled = getEnabledL1InjectionKeywords(runtime);
+  if (enabled.length) return enabled;
+  if (!hasRuntimeConfig()) return _l1InjectionKeywordsToRules();
+  return [];
+}
+function getEnabledL2SensitivePathsOrDefault(runtime) {
+  const enabled = getEnabledL2SensitivePaths(runtime);
+  if (enabled.length) return enabled;
+  if (!hasRuntimeConfig()) return _l2SensitivePathsToRules();
+  return [];
+}
+function getEnabledL2IntentPatternsOrDefault(runtime) {
+  const enabled = getEnabledL2IntentPatterns(runtime);
+  if (enabled.length) return enabled;
+  if (!hasRuntimeConfig()) return _l2IntentPatternsToRules();
+  return [];
+}
+function getEnabledL2PasswordPatternsOrDefault(runtime) {
+  const enabled = getEnabledL2PasswordPatterns(runtime);
+  if (enabled.length) return enabled;
+  if (!hasRuntimeConfig()) {
+    return PASSWORD_MODIFY_PATTERNS.map((p) => p.source);
+  }
+  return [];
+}
+function getEnabledL2UserDeletionPatternsOrDefault(runtime) {
+  const enabled = getEnabledL2UserDeletionPatterns(runtime);
+  if (enabled.length) return enabled;
+  if (!hasRuntimeConfig()) {
+    return USER_DELETION_PATTERNS.map((p) => p.source);
+  }
+  return [];
+}
+function _validateSkillId(skillId) {
+  if (!skillId || !SKILL_ID_RE.test(skillId)) {
+    throw new Error(`skill_id '${skillId}' \u4E0D\u5408\u6CD5\uFF1A\u53EA\u5141\u8BB8\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u4E0B\u5212\u7EBF\u548C\u8FDE\u5B57\u7B26`);
+  }
+}
+function updateLayerEnabled(layerKey, enabled) {
+  const runtime = loadRuntimeConfig();
+  runtime.layers[layerKey] = enabled;
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function updateRuleEnabled(layer, category, ruleId, enabled) {
+  const runtime = loadRuntimeConfig();
+  for (const r of runtime[layer]?.[category]?.rules || []) {
+    if (r.id === ruleId) {
+      r.enabled = enabled;
+      break;
+    }
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function updateRuleDenyMode(layer, category, ruleId, denyMode) {
+  const runtime = loadRuntimeConfig();
+  for (const r of runtime[layer]?.[category]?.rules || []) {
+    if (r.id === ruleId) {
+      r.deny_mode = denyMode;
+      _syncDenyModeFields(r);
+      break;
+    }
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function updateRuleSkipL3(layer, category, ruleId, skipL3) {
+  const runtime = loadRuntimeConfig();
+  for (const r of runtime[layer]?.[category]?.rules || []) {
+    if (r.id === ruleId) {
+      r.skip_l3_on_disabled = skipL3;
+      break;
+    }
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function updateCategoryEnabled(layer, category, enabled) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime[layer]?.[category];
+  if (cat) cat.category_enabled = enabled;
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function addCustomRule(layer, category, rule) {
+  const runtime = loadRuntimeConfig();
+  const layerObj = runtime[layer] || (runtime[layer] = {});
+  const cat = layerObj[category] || (layerObj[category] = { category_enabled: true, category_desc: "", rules: [] });
+  const rules = cat.rules || (cat.rules = []);
+  const newRule = { ...rule, builtin: false, enabled: true };
+  if (!newRule.id) {
+    newRule.id = `custom_${Date.now()}_${_slugify(JSON.stringify(rule).slice(0, 30))}`;
+  }
+  if (newRule.deny_mode) _syncDenyModeFields(newRule);
+  rules.push(newRule);
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function deleteCustomRule(layer, category, ruleId) {
+  const runtime = loadRuntimeConfig();
+  const rules = runtime[layer]?.[category]?.rules || [];
+  const idx = rules.findIndex((r) => r.id === ruleId);
+  if (idx >= 0) {
+    const r = rules[idx];
+    if (r.builtin && !r.source_removed) return null;
+    rules.splice(idx, 1);
+    saveRuntimeConfig(runtime);
+  }
+  return runtime;
+}
+function addCustomSkill(skillId, category, keywords, content) {
+  _validateSkillId(skillId);
+  const runtime = loadRuntimeConfig();
+  const skillsDir = join4(RUNTIME_CONFIG_DIR, "agent_moss_skills");
+  try {
+    mkdirSync2(skillsDir, { recursive: true });
+  } catch {
+  }
+  writeFileSync2(join4(skillsDir, `${skillId}.md`), content, "utf-8");
+  const l3 = runtime.L3_skills || (runtime.L3_skills = {});
+  const cat = l3[category] || (l3[category] = { category_enabled: true, category_desc: "", skills: [] });
+  (cat.skills || (cat.skills = [])).push({ id: skillId, keywords, enabled: true, builtin: false });
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function deleteCustomSkill(skillId, category) {
+  _validateSkillId(skillId);
+  const runtime = loadRuntimeConfig();
+  const skills = runtime.L3_skills?.[category]?.skills || [];
+  const idx = skills.findIndex((s) => s.id === skillId);
+  if (idx >= 0) {
+    if (skills[idx].builtin) return null;
+    skills.splice(idx, 1);
+    const skillPath = join4(RUNTIME_CONFIG_DIR, "agent_moss_skills", `${skillId}.md`);
+    try {
+      if (existsSync7(skillPath)) unlinkSync2(skillPath);
+    } catch {
+    }
+    saveRuntimeConfig(runtime);
+  }
+  return runtime;
+}
+function updateSkillEnabled(skillId, enabled) {
+  const runtime = loadRuntimeConfig();
+  for (const catData of Object.values(runtime.L3_skills || {})) {
+    for (const s of catData.skills || []) {
+      if (s.id === skillId) {
+        s.enabled = enabled;
+        break;
+      }
+    }
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function updateSkillCategoryEnabled(category, enabled) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.L3_skills?.[category];
+  if (cat) cat.category_enabled = enabled;
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function getProfileOrDetect() {
+  return null;
+}
+var RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, ENV_RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DENY_MODE_LABELS, SKILL_ID_RE;
+var init_runtime_config = __esm({
+  "src/infra/runtime-config.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_heuristic();
+    init_logic_rules();
+    init_skill_loader();
+    RUNTIME_CONFIG_DIR = join4(homedir3(), ".config", "agentmoss");
+    RUNTIME_CONFIG_PATH = join4(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
+    ENV_RUNTIME_CONFIG_PATH = "AGENT_MOSS_RUNTIME_CONFIG_PATH";
+    LAYER_DISABLE_ENV = {
+      L1_heuristic: "AGENT_MOSS_DISABLE_HEURISTIC",
+      L2_logic_rules: "AGENT_MOSS_DISABLE_LOGIC_RULES",
+      L3_llm_analysis: "AGENT_MOSS_DISABLE_LLM"
+    };
+    DENY_MODE_LABELS = {
+      deny_write: "\u4EC5\u62E6\u622A\u5199\u5165",
+      deny_read: "\u4EC5\u62E6\u622A\u8BFB\u53D6",
+      deny_both: "\u8BFB\u5199\u5747\u62E6\u622A"
+    };
+    SKILL_ID_RE = /^[A-Za-z0-9_-]+$/;
+  }
+});
+
+// src/engine/coordinator.ts
+init_esm_shims();
+init_heuristic();
+init_logic_rules();
+init_inline_analyzer();
+
+// src/engine/llm-analyzer.ts
+init_esm_shims();
+init_config();
+init_skill_loader();
+
+// src/engine/template-loader.ts
+init_esm_shims();
+import { readFileSync as readFileSync3, existsSync as existsSync4 } from "fs";
+import { resolve as resolve3, dirname as dirname3 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
+var __filename4 = fileURLToPath4(import.meta.url);
+var __dirname4 = dirname3(__filename4);
+var TEMPLATES_DIR = resolve3(__dirname4, "../templates");
+var TEMPLATES_DIR_FALLBACK = resolve3(__dirname4, "../../../agent_moss/templates");
+var TEMPLATE_FILES = ["prompt1_template.txt", "prompt2_template.txt", "security_judge_template.txt"];
+var cachedTemplates = null;
+function loadTemplates() {
+  if (cachedTemplates) return cachedTemplates;
+  cachedTemplates = {};
+  const dir = existsSync4(TEMPLATES_DIR) ? TEMPLATES_DIR : TEMPLATES_DIR_FALLBACK;
+  if (!existsSync4(dir)) {
+    console.warn("[AgentMoss] Templates directory not found:", TEMPLATES_DIR, "and fallback:", TEMPLATES_DIR_FALLBACK);
+    return cachedTemplates;
+  }
+  for (const file of TEMPLATE_FILES) {
+    const filePath = resolve3(dir, file);
+    if (existsSync4(filePath)) {
+      const key = file.replace(".txt", "").replace("_template", "");
+      cachedTemplates[key] = readFileSync3(filePath, "utf-8");
+    }
+  }
+  console.log(`[AgentMoss] Loaded ${Object.keys(cachedTemplates).length} templates from ${dir}`);
+  return cachedTemplates;
+}
+
+// src/engine/script-analyzer.ts
+init_esm_shims();
+import { readFileSync as readFileSync4 } from "fs";
+import { resolve as resolve4, join } from "path";
+var SUSPICIOUS_PATTERNS = [
+  // Network exfiltration (curl/wget POST in scripts is almost never legitimate)
+  { name: "curl POST", pattern: /curl\s+(.*\s)?-X\s+POST/i },
+  { name: "curl --data", pattern: /curl\s+(.*\s)?--data/i },
+  { name: "curl -d", pattern: /curl\s+(.*\s)?-d\s/i },
+  { name: "wget --post-data", pattern: /wget\s+(.*\s)?--post-data/i },
+  { name: "wget --post-file", pattern: /wget\s+(.*\s)?--post-file/i },
+  // Reverse shell
+  { name: "nc -e", pattern: /\bnc\s+.*-e\b/ },
+  { name: "ncat -e", pattern: /\bncat\s+.*-e\b/ },
+  { name: "/dev/tcp", pattern: /\/dev\/tcp\// },
+  { name: "/dev/udp", pattern: /\/dev\/udp\// },
+  // Base64 obfuscation
+  { name: "$(base64", pattern: /\$\(\s*base64/ },
+  { name: "`base64", pattern: /`\s*base64/ },
+  { name: "base64 decode pipe", pattern: /base64\s+(-d|--decode)\s*\|/ },
+  // Sensitive file access
+  { name: "/etc/shadow", pattern: /\/etc\/shadow/ },
+  { name: "id_rsa", pattern: /\bid_rsa\b/ },
+  { name: "id_ed25519", pattern: /\bid_ed25519\b/ },
+  // Persistence backdoor
+  { name: "crontab install", pattern: /crontab\s+-/ },
+  { name: "authorized_keys", pattern: /authorized_keys/ },
+  { name: "ssh no host key check", pattern: /ssh\s+.*StrictHostKeyChecking\s*=\s*no/ }
+];
+var SCRIPT_EXEC_PATTERNS = [
+  /bash\s+(\S+\.sh)/,
+  /sh\s+(\S+\.sh)/,
+  /\.\/(\S+\.sh)/,
+  /source\s+(\S+\.sh)/,
+  /\.\s+(\S+\.sh)/,
+  /zsh\s+(\S+\.sh)/
+];
+var KEYWORD_COMBINATION_RISKS = [
+  {
+    group1: /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]),
+    group2: /* @__PURE__ */ new Set(["$(base64", "`base64", "base64 decode pipe"]),
+    level: "critical",
+    reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + Base64\u7F16\u7801\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u6570\u636E\u5916\u4F20\u98CE\u9669\u3002\u653B\u51FB\u8005\u53EF\u80FD\u5C06\u654F\u611F\u6570\u636E\u7F16\u7801\u540E\u5916\u4F20\u3002"
+  },
+  {
+    group1: /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]),
+    group2: /* @__PURE__ */ new Set(["/etc/shadow", "id_rsa", "id_ed25519"]),
+    level: "critical",
+    reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + \u654F\u611F\u6587\u4EF6\u8BBF\u95EE\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u51ED\u8BC1\u5916\u4F20\u98CE\u9669\u3002"
+  },
+  {
+    group1: /* @__PURE__ */ new Set(["nc -e", "ncat -e", "/dev/tcp", "/dev/udp"]),
+    group2: /* @__PURE__ */ new Set(),
+    level: "high",
+    reason: "\u68C0\u6D4B\u5230\u53CD\u5F39 Shell \u7279\u5F81\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5EFA\u7ACB\u8FDC\u7A0B\u63A7\u5236\u901A\u9053\u3002"
+  },
+  {
+    group1: /* @__PURE__ */ new Set(["crontab install", "authorized_keys", "ssh no host key check"]),
+    group2: /* @__PURE__ */ new Set(),
+    level: "high",
+    reason: "\u68C0\u6D4B\u5230\u6301\u4E45\u5316\u540E\u95E8\u7279\u5F81\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5728\u7CFB\u7EDF\u4E2D\u690D\u5165\u540E\u95E8\u3002"
+  }
+];
+var SINGLE_KEYWORD_RISKS = {
+  "curl POST": { level: "high", reason: "\u68C0\u6D4B\u5230 curl POST \u8BF7\u6C42\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+  "curl --data": { level: "high", reason: "\u68C0\u6D4B\u5230 curl --data \u53C2\u6570\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+  "curl -d": { level: "high", reason: "\u68C0\u6D4B\u5230 curl -d \u53C2\u6570\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+  "wget --post-data": { level: "high", reason: "\u68C0\u6D4B\u5230 wget POST \u8BF7\u6C42\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+  "wget --post-file": { level: "high", reason: "\u68C0\u6D4B\u5230 wget \u6587\u4EF6\u4E0A\u4F20\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6587\u4EF6\u3002" },
+  "nc -e": { level: "critical", reason: "\u68C0\u6D4B\u5230 nc -e \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+  "ncat -e": { level: "critical", reason: "\u68C0\u6D4B\u5230 ncat -e \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+  "/dev/tcp": { level: "critical", reason: "\u68C0\u6D4B\u5230 /dev/tcp \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+  "/dev/udp": { level: "critical", reason: "\u68C0\u6D4B\u5230 /dev/udp \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+  "$(base64": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u7F16\u7801\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
+  "`base64": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u7F16\u7801\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
+  "base64 decode pipe": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u89E3\u7801\u540E\u7BA1\u9053\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
+  "/etc/shadow": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6\u3002" },
+  "id_rsa": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE SSH \u79C1\u94A5\u3002" },
+  "id_ed25519": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE SSH \u79C1\u94A5\u3002" },
+  "crontab install": { level: "high", reason: "\u68C0\u6D4B\u5230\u4FEE\u6539\u5B9A\u65F6\u4EFB\u52A1\uFF0C\u53EF\u80FD\u662F\u6301\u4E45\u5316\u540E\u95E8\u3002" },
+  "authorized_keys": { level: "high", reason: "\u68C0\u6D4B\u5230\u4FEE\u6539 SSH \u6388\u6743\u5BC6\u94A5\uFF0C\u53EF\u80FD\u662F\u6301\u4E45\u5316\u540E\u95E8\u3002" },
+  "ssh no host key check": { level: "high", reason: "\u68C0\u6D4B\u5230 SSH \u8DF3\u8FC7\u4E3B\u673A\u5BC6\u94A5\u9A8C\u8BC1\uFF0C\u53EF\u80FD\u662F\u6A2A\u5411\u79FB\u52A8\u3002" }
+};
+var LEVEL_ORDER = { low: 1, medium: 2, high: 3, critical: 4 };
+function emptyResult() {
+  return { scriptPath: "", scriptContent: "", matchedKeywords: [], lineCount: 0, isSuspicious: false, error: "", riskLevel: "", riskReason: "" };
+}
+function extractScriptPath(command) {
+  for (const pattern of SCRIPT_EXEC_PATTERNS) {
+    const m = command.match(pattern);
+    if (m) return m[1];
+  }
+  return null;
+}
+function scanScriptForKeywords(content) {
+  const matched = [];
+  for (const { name, pattern } of SUSPICIOUS_PATTERNS) {
+    if (pattern.test(content)) matched.push(name);
+  }
+  return matched;
+}
+function assessKeywordCombinationRisk(matchedKeywords, scriptContent) {
+  if (matchedKeywords.length === 0) return { level: "", reason: "" };
+  const keywordSet = new Set(matchedKeywords);
+  for (const rule of KEYWORD_COMBINATION_RISKS) {
+    const hitGroup1 = [...rule.group1].some((k) => keywordSet.has(k));
+    const hitGroup2 = rule.group2.size === 0 ? true : [...rule.group2].some((k) => keywordSet.has(k));
+    if (hitGroup1 && hitGroup2) return { level: rule.level, reason: rule.reason };
+  }
+  const networkPostKeywords = /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]);
+  const hasNetworkPost = [...networkPostKeywords].some((k) => keywordSet.has(k));
+  if (hasNetworkPost) {
+    const envPatterns = ["$env", "$(env)", "$USER", "$(hostname)", "$(pwd)", "$HOME"];
+    const contentLower = scriptContent.toLowerCase();
+    for (const p of envPatterns) {
+      if (contentLower.includes(p.toLowerCase())) {
+        return {
+          level: "critical",
+          reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + \u7CFB\u7EDF\u73AF\u5883\u53D8\u91CF\u6536\u96C6\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u6570\u636E\u5916\u4F20\u98CE\u9669\u3002\u811A\u672C\u53EF\u80FD\u5C06\u7528\u6237\u73AF\u5883\u53D8\u91CF\uFF08\u53EF\u80FD\u5305\u542B API Key\u3001\u5BC6\u94A5\u7B49\u654F\u611F\u4FE1\u606F\uFF09\u53D1\u9001\u5230\u8FDC\u7A0B\u670D\u52A1\u5668\u3002"
+        };
+      }
+    }
+  }
+  let bestLevel = "";
+  let bestReason = "";
+  for (const kw of matchedKeywords) {
+    const risk = SINGLE_KEYWORD_RISKS[kw];
+    if (risk && (LEVEL_ORDER[risk.level] || 0) > (LEVEL_ORDER[bestLevel] || 0)) {
+      bestLevel = risk.level;
+      bestReason = risk.reason;
+    }
+  }
+  return { level: bestLevel, reason: bestReason };
+}
+function readScriptContent(scriptPath, maxLines = 500) {
+  try {
+    const expandedPath = scriptPath.startsWith("~") ? join(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve4(scriptPath);
+    const raw = readFileSync4(expandedPath, "utf-8");
+    const lines = raw.split("\n").slice(0, maxLines);
+    return { content: lines.join("\n"), lineCount: lines.length, error: "" };
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    return { content: "", lineCount: 0, error: `\u8BFB\u53D6\u811A\u672C\u5931\u8D25: ${msg}` };
+  }
+}
+function analyzeScriptContent(actionType, actionDetail, maxLines = 500) {
+  if (actionType.toLowerCase() !== "bash") return emptyResult();
+  const scriptPath = extractScriptPath(actionDetail);
+  if (!scriptPath) return emptyResult();
+  const { content, lineCount, error } = readScriptContent(scriptPath, maxLines);
+  if (error) return { ...emptyResult(), scriptPath, error };
+  const matchedKeywords = scanScriptForKeywords(content);
+  const isSuspicious = matchedKeywords.length > 0;
+  let riskLevel = "";
+  let riskReason = "";
+  if (isSuspicious) {
+    const risk = assessKeywordCombinationRisk(matchedKeywords, content);
+    riskLevel = risk.level;
+    riskReason = risk.reason;
+  }
+  return { scriptPath, scriptContent: content, matchedKeywords, lineCount, isSuspicious, error: "", riskLevel, riskReason };
+}
+function formatScriptAnalysisForPrompt(result) {
+  if (!result.scriptPath) return "";
+  if (result.error) return `\u811A\u672C\u5185\u5BB9\u5206\u6790\u5931\u8D25: ${result.error}`;
+  if (!result.isSuspicious) return "";
+  const keywordsStr = result.matchedKeywords.join(", ");
+  let riskHint = "";
+  if (result.riskLevel && result.riskReason) {
+    riskHint = `
+
+\u98CE\u9669\u8BC4\u4F30: ${result.riskLevel.toUpperCase()} \u7EA7\u522B
+\u98CE\u9669\u539F\u56E0: ${result.riskReason}
+\u5EFA\u8BAE: \u6B64\u811A\u672C\u5E94\u88AB\u62D2\u7EDD\uFF08Deny\uFF09\uFF0C\u9664\u975E\u6709\u660E\u786E\u7684\u4E1A\u52A1\u9700\u6C42\u4E14\u5DF2\u786E\u8BA4\u76EE\u6807\u670D\u52A1\u5668\u53EF\u4FE1\u3002`;
+  }
+  return `\u68C0\u6D4B\u5230\u811A\u672C\u6267\u884C\uFF0C\u4E14\u811A\u672C\u5185\u5BB9\u5305\u542B\u53EF\u7591\u5173\u952E\u8BCD:
+   \u811A\u672C\u8DEF\u5F84: ${result.scriptPath}
+   \u53EF\u7591\u5173\u952E\u8BCD: ${keywordsStr}
+   \u811A\u672C\u884C\u6570: ${result.lineCount}${riskHint}
+
+### \u811A\u672C\u5185\u5BB9 ###
+\`\`\`
+${result.scriptContent}
+\`\`\`
+`;
+}
+
+// src/engine/script-content-analyzer.ts
+init_esm_shims();
+init_heuristic();
+init_logic_rules();
+import { readFileSync as readFileSync5, statSync, existsSync as existsSync5 } from "fs";
+import { resolve as resolve5, join as join2, isAbsolute, dirname as dirname4 } from "path";
+import { homedir } from "os";
+function emptyChain() {
+  return {
+    nodes: [],
+    entryPath: "",
+    maxDepthReached: false,
+    maxSizeReached: false,
+    totalSize: 0,
+    totalLines: 0,
+    hasCritical: false,
+    hasHigh: false,
+    firstHitNode: null,
+    error: ""
+  };
+}
+function newNode(path3, depth) {
+  return {
+    scriptPath: path3,
+    rawContent: "",
+    preprocessedContent: "",
+    lineCount: 0,
+    fileSize: 0,
+    depth,
+    childPaths: [],
+    error: "",
+    l1Hit: false,
+    l1RiskLevel: "",
+    l1RiskType: "",
+    l1Reason: "",
+    l1MatchedPatterns: [],
+    l2Hit: false,
+    l2ViolatedRule: "",
+    l2RiskLevel: "",
+    l2RiskType: "",
+    l2Reason: "",
+    matchedKeywords: [],
+    isSuspicious: false,
+    keywordRiskLevel: "",
+    keywordRiskReason: ""
+  };
+}
+function stripComments(content) {
+  return content.split("\n").filter((line) => !line.trimStart().startsWith("#")).join("\n");
+}
+function stripOutputText(content) {
+  let result = content.replace(/echo\s+".*?"/gs, 'echo ""');
+  result = result.replace(/echo\s+'.*?'/gs, "echo ''");
+  result = result.replace(/printf\s+".*?"[^\n]*/gs, 'printf ""');
+  result = result.replace(/printf\s+'.*?'[^\n]*/gs, "printf ''");
+  return result;
+}
+function expandSimpleVariables(content) {
+  const varMap = {};
+  const assignmentRe = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.+)$/;
+  const collectAssignments = (text) => {
+    for (const line of text.split("\n")) {
+      const m = line.match(assignmentRe);
+      if (m) {
+        const varName = m[1];
+        let varVal = m[2].trim();
+        if (varVal && !varVal.includes("$") && !varVal.includes("`")) {
+          if (varVal.startsWith('"') && varVal.endsWith('"') || varVal.startsWith("'") && varVal.endsWith("'")) {
+            varVal = varVal.slice(1, -1);
+          }
+          varMap[varName] = varVal;
+        }
+      }
+    }
+  };
+  collectAssignments(content);
+  let expanded = content;
+  for (let round = 0; round < 3; round++) {
+    const sortedVars = Object.keys(varMap).sort((a, b) => b.length - a.length);
+    let newExpanded = expanded;
+    for (const v of sortedVars) {
+      const val = varMap[v];
+      newExpanded = newExpanded.split("${" + v + "}").join(val);
+      newExpanded = newExpanded.split("$" + v).join(val);
+    }
+    if (newExpanded === expanded) break;
+    expanded = newExpanded;
+    collectAssignments(expanded);
+  }
+  return expanded;
+}
+function preprocessScriptContent(content) {
+  let result = stripComments(content);
+  result = stripOutputText(result);
+  result = expandSimpleVariables(result);
+  return result;
+}
+var SUSPICIOUS_PATTERNS2 = [
+  { name: "curl POST", pattern: /curl\s+(.*\s)?-X\s+POST/i },
+  { name: "curl --data", pattern: /curl\s+(.*\s)?--data/i },
+  { name: "curl -d", pattern: /curl\s+(.*\s)?-d\s/i },
+  { name: "wget --post-data", pattern: /wget\s+(.*\s)?--post-data/i },
+  { name: "wget --post-file", pattern: /wget\s+(.*\s)?--post-file/i },
+  { name: "nc -e", pattern: /\bnc\s+.*-e\b/ },
+  { name: "ncat -e", pattern: /\bncat\s+.*-e\b/ },
+  { name: "/dev/tcp", pattern: /\/dev\/tcp\// },
+  { name: "/dev/udp", pattern: /\/dev\/udp\// },
+  { name: "$(base64", pattern: /\$\(\s*base64/ },
+  { name: "`base64", pattern: /`\s*base64/ },
+  { name: "base64 decode pipe", pattern: /base64\s+(-d|--decode)\s*\|/ },
+  { name: "/etc/shadow", pattern: /\/etc\/shadow/ },
+  { name: "id_rsa", pattern: /\bid_rsa\b/ },
+  { name: "id_ed25519", pattern: /\bid_ed25519\b/ },
+  { name: "crontab install", pattern: /crontab\s+-/ },
+  { name: "authorized_keys", pattern: /authorized_keys/ },
+  { name: "ssh no host key check", pattern: /ssh\s+.*StrictHostKeyChecking\s*=\s*no/ }
+];
+var SCRIPT_EXEC_PATTERNS2 = [
+  /(?:^|\s|&&|\|\|)\s*bash\s+(\S+)/i,
+  /(?:^|\s|&&|\|\|)\s*\/bin\/bash\s+(\S+)/i,
+  /(?:^|\s|&&|\|\|)\s*sh\s+(\S+)/i,
+  /(?:^|\s|&&|\|\|)\s*zsh\s+(\S+)/i,
+  /\.\/(\S+)/,
+  /(?:^|\s|&&|\|\|)\s*source\s+(\S+)/i,
+  /(?:^|\s|&&|\|\|)\s*\.\s+(\S+)/,
+  /(?:^|\s|&&|\|\|)\s*python3?\s+(\S+\.py)/i,
+  /(?:^|\s|&&|\|\|)\s*node\s+(\S+\.js)/i,
+  /(?:^|\s|&&|\|\|)\s*ruby\s+(\S+\.rb)/i,
+  /(?:^|\s|&&|\|\|)\s*perl\s+(\S+\.pl)/i,
+  /(?:^|\s|&&|\|\|)\s*php\s+(\S+\.php)/i,
+  /(?:^|\s|&&|\|\|)\s*lua\s+(\S+\.lua)/i
+];
+var KEYWORD_COMBINATION_RISKS2 = [
+  {
+    group1: /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]),
+    group2: /* @__PURE__ */ new Set(["$(base64", "`base64", "base64 decode pipe"]),
+    level: "critical",
+    reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + Base64\u7F16\u7801\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u6570\u636E\u5916\u4F20\u98CE\u9669\u3002\u653B\u51FB\u8005\u53EF\u80FD\u5C06\u654F\u611F\u6570\u636E\u7F16\u7801\u540E\u5916\u4F20\u3002"
+  },
+  {
+    group1: /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]),
+    group2: /* @__PURE__ */ new Set(["/etc/shadow", "id_rsa", "id_ed25519"]),
+    level: "critical",
+    reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + \u654F\u611F\u6587\u4EF6\u8BBF\u95EE\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u51ED\u8BC1\u5916\u4F20\u98CE\u9669\u3002"
+  },
+  {
+    group1: /* @__PURE__ */ new Set(["nc -e", "ncat -e", "/dev/tcp", "/dev/udp"]),
+    group2: /* @__PURE__ */ new Set(),
+    level: "high",
+    reason: "\u68C0\u6D4B\u5230\u53CD\u5F39 Shell \u7279\u5F81\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5EFA\u7ACB\u8FDC\u7A0B\u63A7\u5236\u901A\u9053\u3002"
+  },
+  {
+    group1: /* @__PURE__ */ new Set(["crontab install", "authorized_keys", "ssh no host key check"]),
+    group2: /* @__PURE__ */ new Set(),
+    level: "high",
+    reason: "\u68C0\u6D4B\u5230\u6301\u4E45\u5316\u540E\u95E8\u7279\u5F81\uFF0C\u653B\u51FB\u8005\u53EF\u80FD\u5728\u7CFB\u7EDF\u4E2D\u690D\u5165\u540E\u95E8\u3002"
+  }
+];
+var SINGLE_KEYWORD_RISKS2 = {
+  "curl POST": { level: "high", reason: "\u68C0\u6D4B\u5230 curl POST \u8BF7\u6C42\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+  "curl --data": { level: "high", reason: "\u68C0\u6D4B\u5230 curl --data \u53C2\u6570\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+  "curl -d": { level: "high", reason: "\u68C0\u6D4B\u5230 curl -d \u53C2\u6570\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+  "wget --post-data": { level: "high", reason: "\u68C0\u6D4B\u5230 wget POST \u8BF7\u6C42\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6570\u636E\u3002" },
+  "wget --post-file": { level: "high", reason: "\u68C0\u6D4B\u5230 wget \u6587\u4EF6\u4E0A\u4F20\uFF0C\u53EF\u80FD\u5411\u5916\u90E8\u670D\u52A1\u5668\u53D1\u9001\u6587\u4EF6\u3002" },
+  "nc -e": { level: "critical", reason: "\u68C0\u6D4B\u5230 nc -e \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+  "ncat -e": { level: "critical", reason: "\u68C0\u6D4B\u5230 ncat -e \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+  "/dev/tcp": { level: "critical", reason: "\u68C0\u6D4B\u5230 /dev/tcp \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+  "/dev/udp": { level: "critical", reason: "\u68C0\u6D4B\u5230 /dev/udp \u53CD\u5F39 Shell \u7279\u5F81\u3002" },
+  "$(base64": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u7F16\u7801\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
+  "`base64": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u7F16\u7801\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
+  "base64 decode pipe": { level: "high", reason: "\u68C0\u6D4B\u5230 Base64 \u89E3\u7801\u540E\u7BA1\u9053\u6267\u884C\uFF0C\u53EF\u80FD\u662F\u6DF7\u6DC6\u9003\u9038\u3002" },
+  "/etc/shadow": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6\u3002" },
+  "id_rsa": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE SSH \u79C1\u94A5\u3002" },
+  "id_ed25519": { level: "critical", reason: "\u68C0\u6D4B\u5230\u8BBF\u95EE SSH \u79C1\u94A5\u3002" },
+  "crontab install": { level: "high", reason: "\u68C0\u6D4B\u5230\u4FEE\u6539\u5B9A\u65F6\u4EFB\u52A1\uFF0C\u53EF\u80FD\u662F\u6301\u4E45\u5316\u540E\u95E8\u3002" },
+  "authorized_keys": { level: "high", reason: "\u68C0\u6D4B\u5230\u4FEE\u6539 SSH \u6388\u6743\u5BC6\u94A5\uFF0C\u53EF\u80FD\u662F\u6301\u4E45\u5316\u540E\u95E8\u3002" },
+  "ssh no host key check": { level: "high", reason: "\u68C0\u6D4B\u5230 SSH \u8DF3\u8FC7\u4E3B\u673A\u5BC6\u94A5\u9A8C\u8BC1\uFF0C\u53EF\u80FD\u662F\u6A2A\u5411\u79FB\u52A8\u3002" }
+};
+var LEVEL_ORDER2 = { low: 1, medium: 2, high: 3, critical: 4 };
+function scanScriptForKeywords2(content) {
+  const matched = [];
+  for (const { name, pattern } of SUSPICIOUS_PATTERNS2) {
+    if (pattern.test(content)) matched.push(name);
+  }
+  return matched;
+}
+function assessKeywordCombinationRisk2(matchedKeywords, scriptContent) {
+  if (matchedKeywords.length === 0) return { level: "", reason: "" };
+  const keywordSet = new Set(matchedKeywords);
+  for (const rule of KEYWORD_COMBINATION_RISKS2) {
+    const hitGroup1 = [...rule.group1].some((k) => keywordSet.has(k));
+    const hitGroup2 = rule.group2.size === 0 ? true : [...rule.group2].some((k) => keywordSet.has(k));
+    if (hitGroup1 && hitGroup2) return { level: rule.level, reason: rule.reason };
+  }
+  const networkPostKeywords = /* @__PURE__ */ new Set(["curl POST", "curl --data", "curl -d", "wget --post-data", "wget --post-file"]);
+  const hasNetworkPost = [...networkPostKeywords].some((k) => keywordSet.has(k));
+  if (hasNetworkPost) {
+    const envPatterns = ["$env", "$(env)", "$USER", "$(hostname)", "$(pwd)", "$HOME"];
+    const contentLower = scriptContent.toLowerCase();
+    for (const p of envPatterns) {
+      if (contentLower.includes(p.toLowerCase())) {
+        return {
+          level: "critical",
+          reason: "\u68C0\u6D4B\u5230\u7F51\u7EDC\u6570\u636E\u53D1\u9001 + \u7CFB\u7EDF\u73AF\u5883\u53D8\u91CF\u6536\u96C6\u7EC4\u5408\uFF0C\u6784\u6210 Critical \u7EA7\u522B\u6570\u636E\u5916\u4F20\u98CE\u9669\u3002\u811A\u672C\u53EF\u80FD\u5C06\u7528\u6237\u73AF\u5883\u53D8\u91CF\uFF08\u53EF\u80FD\u5305\u542B API Key\u3001\u5BC6\u94A5\u7B49\u654F\u611F\u4FE1\u606F\uFF09\u53D1\u9001\u5230\u8FDC\u7A0B\u670D\u52A1\u5668\u3002"
+        };
+      }
+    }
+  }
+  let bestLevel = "";
+  let bestReason = "";
+  for (const kw of matchedKeywords) {
+    const risk = SINGLE_KEYWORD_RISKS2[kw];
+    if (risk && (LEVEL_ORDER2[risk.level] || 0) > (LEVEL_ORDER2[bestLevel] || 0)) {
+      bestLevel = risk.level;
+      bestReason = risk.reason;
+    }
+  }
+  return { level: bestLevel, reason: bestReason };
+}
+function extractScriptPath2(command) {
+  for (const pattern of SCRIPT_EXEC_PATTERNS2) {
+    const m = command.match(pattern);
+    if (m) return m[1];
+  }
+  return null;
+}
+function extractInlineScriptPath(actionDetail) {
+  const re = /open\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+  let m;
+  while ((m = re.exec(actionDetail)) !== null) {
+    const p = m[1];
+    let resolved;
+    try {
+      resolved = resolvePath(p);
+      if (existsSync5(resolved)) {
+        const stat = statSync(resolved);
+        if (stat.isFile()) return resolved;
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function resolvePath(p) {
+  let expanded = p;
+  if (expanded.startsWith("~/") || expanded === "~") {
+    expanded = join2(homedir(), expanded.slice(1));
+  }
+  return resolve5(expanded);
+}
+function readScriptContent2(scriptPath, maxFileSize = 2 * 1024 * 1024) {
+  try {
+    const path3 = resolvePath(scriptPath);
+    if (!existsSync5(path3)) return { content: "", lineCount: 0, fileSize: 0, error: `\u811A\u672C\u4E0D\u5B58\u5728: ${scriptPath}` };
+    const stat = statSync(path3);
+    if (!stat.isFile()) return { content: "", lineCount: 0, fileSize: 0, error: `\u4E0D\u662F\u6587\u4EF6: ${scriptPath}` };
+    if (stat.size > maxFileSize) {
+      return { content: "", lineCount: 0, fileSize: stat.size, error: `\u811A\u672C\u6587\u4EF6\u8FC7\u5927 (${stat.size} bytes)\uFF0C\u8DF3\u8FC7\u8BFB\u53D6` };
+    }
+    const content = readFileSync5(path3, "utf-8");
+    const lineCount = content ? content.split("\n").length : 0;
+    return { content, lineCount, fileSize: stat.size, error: "" };
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    return { content: "", lineCount: 0, fileSize: 0, error: `\u8BFB\u53D6\u811A\u672C\u5931\u8D25: ${msg}` };
+  }
+}
+function extractChildScriptPaths(content, baseDir) {
+  const paths = [];
+  for (const pattern of CHILD_SCRIPT_PATTERNS) {
+    pattern.lastIndex = 0;
+    let m;
+    while ((m = pattern.exec(content)) !== null) {
+      const pathStr = m[1];
+      if (pathStr.startsWith("-") || pathStr.startsWith("$")) continue;
+      if (pathStr.includes("/dev/") || pathStr.startsWith("|") || pathStr.startsWith(";")) continue;
+      const full = isAbsolute(pathStr) ? pathStr : join2(baseDir, pathStr);
+      const resolved = resolvePath(full);
+      if (existsSync5(resolved)) {
+        try {
+          if (statSync(resolved).isFile() && !paths.includes(resolved)) paths.push(resolved);
+        } catch {
+        }
+      }
+    }
+  }
+  return paths;
+}
+function resolveScriptChain(entryPath, input, maxDepth = 3, maxFileSize = 2 * 1024 * 1024, maxTotalSize = 6 * 1024 * 1024) {
+  const visited = /* @__PURE__ */ new Set();
+  const result = emptyChain();
+  result.entryPath = entryPath;
+  const entry = resolvePath(entryPath);
+  const baseDir = existsSync5(entry) ? dirname4(entry) : input.cwd || process.cwd();
+  resolveRecursive({
+    path: entry,
+    depth: 0,
+    maxDepth,
+    maxFileSize,
+    maxTotalSize,
+    visited,
+    result,
+    baseDir,
+    input
+  });
+  result.hasCritical = result.nodes.some((n) => n.l1RiskLevel === "critical" || n.l2RiskLevel === "critical" || n.keywordRiskLevel === "critical");
+  result.hasHigh = result.nodes.some((n) => ["high", "critical"].includes(n.l1RiskLevel) || ["high", "critical"].includes(n.l2RiskLevel) || ["high", "critical"].includes(n.keywordRiskLevel));
+  result.firstHitNode = result.nodes.find((n) => n.l1Hit || n.l2Hit || n.isSuspicious) || null;
+  return result;
+}
+function resolveRecursive(ctx) {
+  const { path: path3, depth, maxDepth, maxFileSize, maxTotalSize, visited, result, baseDir, input } = ctx;
+  if (visited.has(path3)) return;
+  if (depth > maxDepth) {
+    result.maxDepthReached = true;
+    return;
+  }
+  if (result.totalSize >= maxTotalSize) {
+    result.maxSizeReached = true;
+    return;
+  }
+  visited.add(path3);
+  const { content, lineCount, fileSize, error } = readScriptContent2(path3, maxFileSize);
+  if (error) {
+    const node2 = newNode(path3, depth);
+    node2.error = error;
+    node2.fileSize = fileSize;
+    node2.lineCount = lineCount;
+    result.nodes.push(node2);
+    return;
+  }
+  result.totalSize += fileSize;
+  result.totalLines += lineCount;
+  const preprocessed = preprocessScriptContent(content);
+  const node = newNode(path3, depth);
+  node.rawContent = content;
+  node.preprocessedContent = preprocessed;
+  node.lineCount = lineCount;
+  node.fileSize = fileSize;
+  result.nodes.push(node);
+  const virtualInput = {
+    ...input,
+    aNext: { actionType: "bash", actionDetail: preprocessed }
+  };
+  const l1 = runHeuristicCheck(virtualInput);
+  if (l1 && !l1.allowed) {
+    node.l1Hit = true;
+    node.l1RiskLevel = l1.riskLevel;
+    node.l1RiskType = l1.riskType;
+    node.l1Reason = l1.reason;
+    node.l1MatchedPatterns = [];
+    if (l1.riskLevel === "critical") {
+      result.hasCritical = true;
+      result.firstHitNode = node;
+      return;
+    }
+  }
+  const childPaths = extractChildScriptPaths(preprocessed, baseDir);
+  node.childPaths = childPaths;
+  for (const childPath of childPaths) {
+    resolveRecursive({
+      path: resolvePath(childPath),
+      depth: depth + 1,
+      maxDepth,
+      maxFileSize,
+      maxTotalSize,
+      visited,
+      result,
+      baseDir: dirname4(resolvePath(childPath)),
+      input
+    });
+    if (result.hasCritical) return;
+  }
+}
+function scanScriptChainWithL1(chain, input) {
+  for (const node of chain.nodes) {
+    if (node.error || !node.preprocessedContent || node.l1Hit) continue;
+    const virtualInput = {
+      ...input,
+      aNext: { actionType: "bash", actionDetail: node.preprocessedContent }
+    };
+    const l1 = runHeuristicCheck(virtualInput);
+    if (l1 && !l1.allowed) {
+      node.l1Hit = true;
+      node.l1RiskLevel = l1.riskLevel;
+      node.l1RiskType = l1.riskType;
+      node.l1Reason = l1.reason;
+      if (l1.riskLevel === "critical") {
+        chain.hasCritical = true;
+        chain.firstHitNode = node;
+        break;
+      }
+    }
+  }
+  return chain;
+}
+function scanScriptChainWithL2(chain, input) {
+  for (const node of chain.nodes) {
+    if (node.error || !node.preprocessedContent) continue;
+    if (node.l1RiskLevel === "critical") break;
+    const virtualInput = {
+      ...input,
+      aNext: { actionType: "bash", actionDetail: node.preprocessedContent }
+    };
+    const l2 = runLogicCheck(virtualInput);
+    if (l2 && !l2.allowed) {
+      node.l2Hit = true;
+      node.l2ViolatedRule = `script_logic:${node.scriptPath}`;
+      node.l2RiskLevel = l2.riskLevel;
+      node.l2RiskType = l2.riskType;
+      node.l2Reason = `\u811A\u672C ${node.scriptPath} (\u6DF1\u5EA6 ${node.depth}) \u4E2D: ${l2.reason}`;
+      if (l2.riskLevel === "critical") {
+        chain.hasCritical = true;
+        chain.firstHitNode = node;
+        break;
+      }
+    }
+  }
+  if (!chain.hasHigh) {
+    chain.hasHigh = chain.nodes.some((n) => ["high", "critical"].includes(n.l2RiskLevel));
+  }
+  return chain;
+}
+function scanScriptChainKeywords(chain) {
+  for (const node of chain.nodes) {
+    if (node.error || !node.preprocessedContent) continue;
+    if (node.l1Hit || node.l2Hit) continue;
+    const matched = scanScriptForKeywords2(node.preprocessedContent);
+    node.matchedKeywords = matched;
+    node.isSuspicious = matched.length > 0;
+    if (matched.length > 0) {
+      const risk = assessKeywordCombinationRisk2(matched, node.preprocessedContent);
+      node.keywordRiskLevel = risk.level;
+      node.keywordRiskReason = risk.reason;
+    }
+  }
+  return chain;
+}
+function analyzeScriptContent2(input) {
+  const actionType = input.aNext.actionType.toLowerCase();
+  if (actionType !== "bash") return emptyChain();
+  const scriptPath = extractScriptPath2(input.aNext.actionDetail);
+  let resolvedPath = scriptPath;
+  if (!resolvedPath) {
+    const inline = extractInlineScriptPath(input.aNext.actionDetail);
+    if (!inline) return emptyChain();
+    resolvedPath = inline;
+  }
+  const chain = resolveScriptChain(resolvedPath, input);
+  if (chain.nodes.length === 0) return chain;
+  scanScriptChainWithL1(chain, input);
+  scanScriptChainWithL2(chain, input);
+  scanScriptChainKeywords(chain);
+  return chain;
+}
+function formatScriptChainForPrompt(chain) {
+  if (chain.nodes.length === 0) return "";
+  const errorNodes = chain.nodes.filter((n) => n.error);
+  if (errorNodes.length > 0 && chain.nodes.length === 1) {
+    return `\u26A0\uFE0F \u811A\u672C\u5185\u5BB9\u5206\u6790\u5931\u8D25: ${errorNodes[0].error}`;
+  }
+  const suspiciousNodes = chain.nodes.filter((n) => n.isSuspicious && !n.l1Hit && !n.l2Hit);
+  if (suspiciousNodes.length === 0) {
+    const safeNodes = chain.nodes.filter((n) => !n.error);
+    if (safeNodes.length === 0) return "";
+    const parts2 = ["\u2713 \u811A\u672C\u5185\u5BB9\u5DF2\u5206\u6790\uFF0C\u672A\u53D1\u73B0\u5371\u9669/\u53EF\u7591\u64CD\u4F5C\uFF08L1/L2/\u5173\u952E\u8BCD\u626B\u63CF\u5747\u672A\u547D\u4E2D\uFF09\uFF1A"];
+    for (const node of safeNodes) {
+      const pre = node.preprocessedContent || "";
+      let preview = pre.slice(0, 600);
+      if (pre.length > 600) preview += `
+... (\u622A\u65AD\uFF0C\u5B8C\u6574\u5185\u5BB9 ${pre.length} \u5B57\u7B26)`;
+      parts2.push(
+        `   \u811A\u672C\u8DEF\u5F84: ${node.scriptPath}\uFF08\u9012\u5F52\u6DF1\u5EA6 ${node.depth}\uFF0C${node.lineCount} \u884C\uFF09
+   \u5185\u5BB9\uFF08\u9884\u5904\u7406\u540E\uFF09:
+\`\`\`
+${preview}
+\`\`\``
+      );
+    }
+    return parts2.join("\n");
+  }
+  const parts = [];
+  for (const node of suspiciousNodes) {
+    const keywordsStr = node.matchedKeywords.join(", ");
+    let riskHint = "";
+    if (node.keywordRiskLevel && node.keywordRiskReason) {
+      riskHint = `
+
+\u{1F534} **\u98CE\u9669\u8BC4\u4F30**: ${node.keywordRiskLevel.toUpperCase()} \u7EA7\u522B
+**\u98CE\u9669\u539F\u56E0**: ${node.keywordRiskReason}
+**\u5EFA\u8BAE**: \u6B64\u811A\u672C\u5E94\u88AB\u62D2\u7EDD\uFF08Deny\uFF09\uFF0C\u9664\u975E\u6709\u660E\u786E\u7684\u4E1A\u52A1\u9700\u6C42\u4E14\u5DF2\u786E\u8BA4\u76EE\u6807\u670D\u52A1\u5668\u53EF\u4FE1\u3002`;
+    }
+    const pre = node.preprocessedContent;
+    let contentPreview = pre.slice(0, 2e3);
+    if (pre.length > 2e3) contentPreview += `
+... (\u622A\u65AD\uFF0C\u5B8C\u6574\u5185\u5BB9 ${pre.length} \u5B57\u7B26)`;
+    parts.push(
+      `\u26A0\uFE0F \u811A\u672C\u5185\u5BB9\u5305\u542B\u53EF\u7591\u5173\u952E\u8BCD:
+   \u811A\u672C\u8DEF\u5F84: ${node.scriptPath}
+   \u9012\u5F52\u6DF1\u5EA6: ${node.depth}
+   \u53EF\u7591\u5173\u952E\u8BCD: ${keywordsStr}
+   \u811A\u672C\u884C\u6570: ${node.lineCount}${riskHint}
+
+### \u811A\u672C\u5185\u5BB9\uFF08\u9884\u5904\u7406\u540E\uFF09###
+\`\`\`
+${contentPreview}
+\`\`\`
+`
+    );
+  }
+  let header = `\u26A0\uFE0F \u68C0\u6D4B\u5230\u811A\u672C\u6267\u884C\u94FE\uFF08\u5171 ${chain.nodes.length} \u4E2A\u811A\u672C\uFF09\uFF0C\u5176\u4E2D ${suspiciousNodes.length} \u4E2A\u5305\u542B\u53EF\u7591\u5173\u952E\u8BCD:
+`;
+  if (chain.maxDepthReached) header += "\u26A0\uFE0F \u6CE8\u610F\uFF1A\u9012\u5F52\u8FFD\u8E2A\u89E6\u8FBE\u6DF1\u5EA6\u4E0A\u9650\uFF0C\u53EF\u80FD\u5B58\u5728\u66F4\u6DF1\u5C42\u7684\u811A\u672C\u8C03\u7528\u672A\u88AB\u626B\u63CF\u3002\n";
+  if (chain.maxSizeReached) header += "\u26A0\uFE0F \u6CE8\u610F\uFF1A\u7D2F\u8BA1\u6587\u4EF6\u5927\u5C0F\u89E6\u8FBE\u4E0A\u9650\uFF0C\u90E8\u5206\u811A\u672C\u53EF\u80FD\u672A\u88AB\u5B8C\u6574\u8BFB\u53D6\u3002\n";
+  return header + parts.join("\n---\n\n");
+}
+var CHILD_SCRIPT_PATTERNS = [
+  /(?:^|\s|&&|\|\|)\s*bash\s+(\S+)/i,
+  /(?:^|\s|&&|\|\|)\s*sh\s+(\S+)/i,
+  /(?:^|\s|&&|\|\|)\s*source\s+(\S+)/i,
+  /(?:^|\s|&&|\|\|)\s*\.\s+(\S+)/,
+  /(?:^|\s|&&|\|\|)\s*python3?\s+(\S+\.py)/i,
+  /(?:^|\s|&&|\|\|)\s*node\s+(\S+\.js)/i,
+  /(?:^|\s|&&|\|\|)\s*ruby\s+(\S+\.rb)/i,
+  /(?:^|\s|&&|\|\|)\s*perl\s+(\S+\.pl)/i,
+  /(?:^|\s|&&|\|\|)\s*php\s+(\S+\.php)/i,
+  /(?:^|\s|&&|\|\|)\s*lua\s+(\S+\.lua)/i
+];
+
+// src/engine/llm-analyzer.ts
+import { appendFileSync } from "fs";
+import OpenAI from "openai";
+var llmCache = /* @__PURE__ */ new Map();
+var LLM_CACHE_MAX = 200;
+async function runLLMAnalysis(input, previous) {
+  if (!isLLMAvailable()) {
+    console.log("[AgentMoss] LLM not configured, skipping deep analysis");
+    return {
+      allowed: true,
+      reason: "LLM \u672A\u914D\u7F6E\uFF0C\u8DF3\u8FC7\u6DF1\u5C42\u5206\u6790",
+      riskLevel: "low",
+      riskType: "",
+      confidence: 50,
+      source: "llm",
+      violatedLayers: []
+    };
+  }
+  const globalConfig = getLLMConfig();
+  const config = input.llmConfig?.apiKey ? { ...globalConfig, ...input.llmConfig } : globalConfig;
+  const rawDetail = input.aNext.actionDetail.replace(/^terminal-\w+:\s*command=([^,]+).*/, "$1").trim();
+  const cacheKey = `${input.aNext.actionType}:${rawDetail || input.aNext.actionDetail}`;
+  const cached = llmCache.get(cacheKey);
+  if (cached) {
+    console.log("[AgentMoss] LLM cache hit");
+    return cached;
+  }
+  const matchedSkills = matchSkills(input.aNext.actionType, input.aNext.actionDetail, input.reason);
+  const templates = loadTemplates();
+  let scriptAnalysis;
+  let scriptChainText = "";
+  if (previous.scriptChain) {
+    scriptChainText = formatScriptChainForPrompt(previous.scriptChain);
+  } else {
+    scriptAnalysis = analyzeScriptContent(input.aNext.actionType, input.aNext.actionDetail);
+  }
+  const prompt = buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis, previous.skipL3Hints ?? "", scriptChainText);
+  logPrompt(prompt, input.aNext, previous.llmLogPath);
+  const result = await analyzeWithLLM(prompt, config);
+  if (llmCache.size >= LLM_CACHE_MAX) {
+    const firstKey = llmCache.keys().next().value;
+    if (firstKey) llmCache.delete(firstKey);
+  }
+  llmCache.set(cacheKey, result);
+  return result;
+}
+function logPrompt(prompt, aNext, logPath) {
+  if (!logPath) return;
+  try {
+    const actionType = aNext.actionType || "unknown";
+    const actionDetail = (aNext.actionDetail || "").slice(0, 100);
+    const line = `[${(/* @__PURE__ */ new Date()).toISOString()}] [LLM_PROMPT] action_type=${actionType}, action_detail=${actionDetail}... prompt_length=${prompt.length}
+${prompt}
+--- END PROMPT ---
+`;
+    appendFileSync(logPath, line, "utf-8");
+  } catch (e) {
+    console.warn("[AgentMoss] Failed to write LLM prompt to log:", e);
+  }
+}
+function buildPrompt(input, previous, matchedSkills, templates, scriptAnalysis, skipL3Hints = "", scriptChainText = "") {
+  const skillsText = formatSkillsForPrompt(matchedSkills);
+  const historyStr = input.actionHistory.map((h, i) => `${i + 1}. ${h.actionType}: ${h.actionDetail}`).join("\n") || "(\u65E0\u5386\u53F2\u64CD\u4F5C)";
+  const scriptAnalysisText = scriptChainText ? scriptChainText : scriptAnalysis ? formatScriptAnalysisForPrompt(scriptAnalysis) : "";
+  const hintsText = formatHints(previous);
+  const securityJudgeTemplate = templates["security_judge"];
+  if (securityJudgeTemplate) {
+    return securityJudgeTemplate.replaceAll("{prompt_session}", input.promptSession || "\uFF08\u672A\u63D0\u4F9B\uFF09").replaceAll("{action_history}", historyStr).replaceAll("{action_type}", input.aNext.actionType).replaceAll("{action_detail}", input.aNext.actionDetail).replaceAll("{reason}", input.reason || "\u672A\u8BF4\u660E").replaceAll("{skills_text}", skillsText).replaceAll("{hints_text}", hintsText).replaceAll("{script_analysis_text}", scriptAnalysisText).replaceAll("{skip_l3_hints}", skipL3Hints).replaceAll("{{", "{").replaceAll("}}", "}");
+  }
+  console.warn("[AgentMoss] security_judge template missing, using sparse fallback prompt");
+  return `## \u5F53\u524D\u64CD\u4F5C\u4E0A\u4E0B\u6587
+- \u4F1A\u8BDD ID: ${input.sessionId}
+- \u7528\u6237\u4EFB\u52A1: ${input.promptSession || "\u672A\u6307\u5B9A"}
+- \u64CD\u4F5C\u7CFB\u7EDF: ${input.osType}
+- \u5DE5\u4F5C\u76EE\u5F55: ${input.cwd || "/"}
+- \u64CD\u4F5C\u539F\u56E0: ${input.reason || "\u672A\u8BF4\u660E"}
+- \u5386\u53F2\u64CD\u4F5C\u5E8F\u5217:
+${historyStr}
+
+- \u5373\u5C06\u6267\u884C\u7684\u64CD\u4F5C:
+  \u7C7B\u578B: ${input.aNext.actionType}
+  \u8BE6\u60C5: ${input.aNext.actionDetail}
+
+## \u53EF\u7528\u5B89\u5168 Skill
+${skillsText}
+
+## \u524D\u7F6E\u68C0\u6D4B\u7ED3\u679C
+${hintsText}
+${scriptAnalysisText ? `
+## \u811A\u672C\u5185\u5BB9\u5206\u6790
+${scriptAnalysisText}` : ""}
+
+\u8BF7\u6839\u636E\u4EE5\u4E0A\u4FE1\u606F\uFF0C\u5BF9\u5373\u5C06\u6267\u884C\u7684\u64CD\u4F5C\u8FDB\u884C\u5B89\u5168\u5224\u65AD\u3002\u524D\u7F6E\u68C0\u6D4B\u4E3A low/medium \u4E14\u6709\u5408\u7406\u6267\u884C\u7406\u7531\u65F6\u5E94\u5F53\u5141\u8BB8\u3002\u4F60\u5FC5\u987B\u8F93\u51FA\u4E25\u683C\u7684 JSON \u683C\u5F0F\uFF0C\u4E0D\u8981\u5305\u542B\u4EFB\u4F55\u5176\u4ED6\u6587\u5B57\u3001\u6CE8\u91CA\u6216 markdown \u6807\u8BB0\u3002
+
+\u8F93\u51FA\u683C\u5F0F:
+{"allowed": true/false, "reason": "\u5224\u65AD\u7406\u7531", "riskLevel": "low|medium|high|critical", "riskType": "\u98CE\u9669\u7C7B\u578B", "confidence": 0-100}`;
+}
+function formatHints(previous) {
+  const hints = [];
+  if (previous.heuristic) {
+    hints.push(
+      `\u542F\u53D1\u5F0F\u68C0\u6D4B\u53D1\u73B0\u98CE\u9669 [\u98CE\u9669\u7B49\u7EA7: ${previous.heuristic.riskLevel}]:
+   \u7C7B\u578B: ${previous.heuristic.riskType}
+   \u539F\u56E0: ${previous.heuristic.reason}`
+    );
+  }
+  if (previous.logic) {
+    hints.push(
+      `\u903B\u8F91\u89C4\u5219\u68C0\u6D4B\u53D1\u73B0\u98CE\u9669 [\u98CE\u9669\u7B49\u7EA7: ${previous.logic.riskLevel}]:
+   \u7C7B\u578B: ${previous.logic.riskType}
+   \u539F\u56E0: ${previous.logic.reason}`
+    );
+  }
+  return hints.length > 0 ? hints.join("\n\n") : "\u542F\u53D1\u5F0F\u68C0\u6D4B\u548C\u903B\u8F91\u89C4\u5219\u68C0\u6D4B\u5747\u672A\u53D1\u73B0\u98CE\u9669\u3002";
+}
+async function analyzeWithLLM(prompt, config) {
+  console.log(`[AgentMoss] LLM analyzing with model: ${config.model}, url: ${config.baseUrl}`);
+  const provider = detectProvider(config.baseUrl, config.provider);
+  const extraHeaders = getProviderHeaders(provider);
+  if (Object.keys(extraHeaders).length > 0) {
+    console.log(`[AgentMoss] Provider detected: ${provider}, injecting headers: ${Object.keys(extraHeaders).join(", ")}`);
+  }
+  const timeoutCfg = getTimeoutConfig();
+  const retryCfg = getRetryConfig();
+  const client = new OpenAI({
+    baseURL: config.baseUrl,
+    apiKey: config.apiKey,
+    // 单次 LLM 调用超时用 prompt1Timeout（对齐 py）；env 覆盖的 config.timeout 仍向后兼容
+    timeout: (config.timeout || timeoutCfg.prompt1Timeout) * 1e3,
+    defaultHeaders: Object.keys(extraHeaders).length > 0 ? extraHeaders : void 0
+  });
+  const maxRetries = parseInt(process.env.AGENT_MOSS_LLM_RETRIES || String(retryCfg.maxRetries), 10);
+  const totalTimeoutMs = timeoutCfg.totalTimeout * 1e3;
+  const abortController = new AbortController();
+  const totalTimeoutTimer = setTimeout(() => {
+    console.error(`[AgentMoss] totalTimeout (${timeoutCfg.totalTimeout}s) exceeded, aborting all LLM calls`);
+    abortController.abort();
+  }, totalTimeoutMs);
+  for (let attempt = 0; attempt <= maxRetries; attempt++) {
+    if (abortController.signal.aborted) {
+      break;
+    }
+    try {
+      const response = await client.chat.completions.create({
+        model: config.model,
+        temperature: config.temperature || 0.1,
+        max_tokens: config.maxTokens || 1024,
+        messages: [
+          { role: "system", content: "\u53EA\u8F93\u51FA\u7EAF JSON\uFF0C\u4E0D\u8981\u5305\u542B markdown \u6807\u8BB0\u3001\u4EE3\u7801\u5757\u6216\u4EFB\u4F55\u5176\u4ED6\u6587\u5B57\u3002" },
+          { role: "user", content: prompt }
+        ],
+        signal: abortController.signal
+      });
+      const content = response.choices[0]?.message?.content || "{}";
+      console.log(`[AgentMoss] LLM raw response (attempt ${attempt + 1}/${maxRetries + 1}): ${content.substring(0, 300)}`);
+      let jsonStr = content.trim();
+      if (jsonStr.startsWith("```")) {
+        jsonStr = jsonStr.replace(/^```[\w]*\n?/, "").replace(/\n?```$/, "");
+      }
+      const parsed = JSON.parse(jsonStr);
+      try {
+        const usage = response.usage;
+        const { recordTokenUsage: recordTokenUsage2 } = await Promise.resolve().then(() => (init_token_stats(), token_stats_exports));
+        recordTokenUsage2({
+          sessionId: "audit",
+          step: "L3_security_judge",
+          model: response.model || config.model,
+          promptTokens: usage?.prompt_tokens || 0,
+          completionTokens: usage?.completion_tokens || 0,
+          totalTokens: usage?.total_tokens || 0
+        });
+      } catch {
+      }
+      clearTimeout(totalTimeoutTimer);
+      return {
+        allowed: parsed.allowed !== false,
+        reason: parsed.reason || "LLM \u5206\u6790\u5B8C\u6210",
+        riskLevel: ["low", "medium", "high", "critical"].includes(parsed.riskLevel) ? parsed.riskLevel : "low",
+        riskType: parsed.riskType || "",
+        confidence: typeof parsed.confidence === "number" ? Math.min(100, Math.max(0, parsed.confidence)) : 70,
+        source: "llm",
+        violatedLayers: ["3"]
+      };
+    } catch (err) {
+      if (abortController.signal.aborted) {
+        console.error(`[AgentMoss] LLM analysis aborted by totalTimeout (${timeoutCfg.totalTimeout}s)`);
+        break;
+      }
+      if (attempt < maxRetries) {
+        console.error(`[AgentMoss] LLM call failed (attempt ${attempt + 1}/${maxRetries + 1}), retrying in ${retryCfg.retryInterval}s:`, err.message);
+        await new Promise((resolve6) => setTimeout(resolve6, retryCfg.retryInterval * 1e3));
+      } else {
+        clearTimeout(totalTimeoutTimer);
+        console.error("[AgentMoss] LLM call failed after all retries:", err.message);
+        throw new Error(`LLM \u5206\u6790\u5931\u8D25 (${maxRetries + 1} \u6B21\u5C1D\u8BD5): ${err.message}`);
+      }
+    }
+  }
+  clearTimeout(totalTimeoutTimer);
+  throw new Error(`LLM \u5206\u6790\u8D85\u65F6\uFF08totalTimeout ${timeoutCfg.totalTimeout}s\uFF09`);
+}
+
+// src/engine/coordinator.ts
+init_config();
+init_agents();
+var FULLY_SAFE_TOOLS = /* @__PURE__ */ new Set([
+  "ask_user_question",
+  "glob",
+  "list_dir",
+  "ls",
+  "count_text_length",
+  "filemgr-globfiles"
+]);
+var TRUSTED_SKILLS_BASE = /* @__PURE__ */ new Set([]);
+var READONLY_SENSITIVE_TOOLS = /* @__PURE__ */ new Set([
+  "read",
+  "file_read",
+  "read_file",
+  "head",
+  "tail",
+  "grep",
+  "filemgr-readfile",
+  "filemgr-grepfiles"
+]);
+var FULLY_SAFE_BASH_PATTERNS = [
+  /^ls(?:\s|$)/i,
+  /^dir(?:\s|$)/i,
+  /^pwd(?:\s|$)/i,
+  /^which\s+/i,
+  /^whereis\s+/i,
+  /^realpath\s+/i,
+  /^basename\s+/i,
+  /^dirname\s+/i,
+  /^file\s+/i,
+  /^stat\s+/i,
+  /^du(?:\s|$)/i,
+  /^echo\s+/i,
+  /^printf\s+/i,
+  /^type\s+/i,
+  /^command\s+/i,
+  // 系统信息查询（只读，不涉及文件/网络/权限）
+  /^whoami(?:\s|$)/i,
+  /^id(?:\s|$)/i,
+  /^hostname(?:\s|$)/i,
+  /^uname(?:\s|$)/i,
+  /^date(?:\s|$)/i,
+  /^env(?:\s|$)/i,
+  /^printenv(?:\s|$)/i,
+  /^tty(?:\s|$)/i,
+  /^arch(?:\s|$)/i,
+  /^uptime(?:\s|$)/i,
+  /^groups(?:\s|$)/i,
+  /^logname(?:\s|$)/i
+];
+var READONLY_SENSITIVE_BASH_PATTERNS = [
+  /^cat\s+/i,
+  /^head(?:\s|$)/i,
+  /^tail(?:\s|$)/i,
+  /^less(?:\s|$)/i,
+  /^more(?:\s|$)/i,
+  /^wc(?:\s|$)/i,
+  /^grep(?:\s|$)/i,
+  /^find\s+/i,
+  /^ag(?:\s|$)/i,
+  /^rg(?:\s|$)/i,
+  /^awk\s+/i,
+  /^sed\s+/i,
+  /^cut\s+/i,
+  /^sort(?:\s|$)/i,
+  /^uniq(?:\s|$)/i
+];
+function extractFirstCommand(command) {
+  let main = command.split("|")[0].trim();
+  for (const sep of ["&&", "||"]) {
+    const idx = main.indexOf(sep);
+    if (idx !== -1) {
+      main = main.substring(0, idx).trim();
+      break;
+    }
+  }
+  return main;
+}
+function extractRawCommand(detail) {
+  const m = detail.match(/command=([^,]+)/);
+  return m ? m[1].trim() : detail;
+}
+function matchesAny(cmd, patterns) {
+  return patterns.some((p) => p.test(cmd));
+}
+async function runAnalysis(input) {
+  const heuristicResult = isHeuristicEnabled() ? runHeuristicCheck(input) : null;
+  const isInlineScriptCmd = isInlineScriptCommand(input.aNext.actionDetail.toLowerCase());
+  const isLiteralTextCmd = isLiteralTextCommand(input.aNext.actionDetail.toLowerCase());
+  if (heuristicResult && !heuristicResult.allowed) {
+    const skipInlineFileAccess = (isInlineScriptCmd || isLiteralTextCmd) && heuristicResult.riskType === "file_access";
+    if (!skipInlineFileAccess) {
+      return heuristicResult;
+    }
+  }
+  let scriptChain = null;
+  if (input.aNext.actionType.toLowerCase() === "bash") {
+    scriptChain = analyzeScriptContent2(input);
+    if (scriptChain.nodes.length > 0) {
+      for (const node of scriptChain.nodes) {
+        if (node.l1Hit && (node.l1RiskLevel === "high" || node.l1RiskLevel === "critical")) {
+          return {
+            allowed: false,
+            reason: `\u811A\u672C\u5185\u5BB9\u5305\u542B\u5371\u9669\u64CD\u4F5C: ${node.l1Reason} (\u6587\u4EF6: ${node.scriptPath}, \u6DF1\u5EA6: ${node.depth})`,
+            riskLevel: node.l1RiskLevel,
+            riskType: node.l1RiskType,
+            confidence: 90,
+            source: "heuristic_script_scan",
+            violatedLayers: ["1.1-script"]
+          };
+        }
+      }
+    }
+  }
+  const actionType = input.aNext.actionType.toLowerCase();
+  const rawDetail = extractRawCommand(input.aNext.actionDetail);
+  const lowerDetail = rawDetail.toLowerCase();
+  if (FULLY_SAFE_TOOLS.has(actionType)) {
+    return {
+      allowed: true,
+      reason: `\u5B8C\u5168\u5B89\u5168\u5DE5\u5177\uFF0C\u8DF3\u8FC7\u6DF1\u5EA6\u5206\u6790: ${actionType}`,
+      riskLevel: heuristicResult?.riskLevel || "low",
+      riskType: "",
+      confidence: 95,
+      source: "whitelist_bypass",
+      violatedLayers: []
+    };
+  }
+  const agentExt = getAgentExtensions(input.agentId);
+  const trustedSkills = new Set(TRUSTED_SKILLS_BASE);
+  if (agentExt?.builtin_safe_skills) {
+    for (const s of agentExt.builtin_safe_skills) trustedSkills.add(s);
+  }
+  if (actionType === "skill" && trustedSkills.has(lowerDetail)) {
+    return {
+      allowed: true,
+      reason: `\u5185\u7F6E\u5B89\u5168 Skill\uFF0C\u8DF3\u8FC7\u6DF1\u5EA6\u5206\u6790: ${lowerDetail}`,
+      riskLevel: heuristicResult?.riskLevel || "low",
+      riskType: "",
+      confidence: 95,
+      source: "whitelist_bypass",
+      violatedLayers: []
+    };
+  }
+  let skipLLM = READONLY_SENSITIVE_TOOLS.has(actionType);
+  if (actionType === "bash" || actionType === "executebash" || actionType === "terminal-executebash") {
+    const firstCmd = extractFirstCommand(lowerDetail);
+    if (matchesAny(firstCmd, FULLY_SAFE_BASH_PATTERNS)) {
+      const fullCmdHit = DANGEROUS_PATTERNS.some(
+        (p) => p.severity === "critical" || p.severity === "high"
+      ) && DANGEROUS_PATTERNS.some(
+        (p) => (p.severity === "critical" || p.severity === "high") && p.pattern.test(lowerDetail)
+      );
+      if (!fullCmdHit) {
+        return {
+          allowed: true,
+          reason: `\u5B89\u5168\u7684\u53EA\u8BFB bash \u547D\u4EE4: ${firstCmd}`,
+          riskLevel: "low",
+          riskType: "",
+          confidence: 95,
+          source: "whitelist_bypass",
+          violatedLayers: []
+        };
+      }
+    }
+    if (matchesAny(firstCmd, READONLY_SENSITIVE_BASH_PATTERNS)) {
+      skipLLM = true;
+    }
+  }
+  const logicResult = isLogicRulesEnabled() ? runLogicCheck(input) : null;
+  const l1FileAccessHit = !!(heuristicResult && !heuristicResult.allowed && heuristicResult.riskType === "file_access");
+  const effectiveResult = logicResult && !logicResult.allowed ? logicResult : l1FileAccessHit ? heuristicResult : null;
+  if (effectiveResult) {
+    const isCredentialPath = !!effectiveResult.isCredential;
+    const skipInlineFileAccess = (isInlineScriptCmd || isLiteralTextCmd) && effectiveResult.riskType === "file_access";
+    if (skipInlineFileAccess) {
+      const inlineJudgment = analyzeInlineScript(input.aNext.actionDetail);
+      if (inlineJudgment.actionable) {
+        if (!inlineJudgment.allowed) {
+          return {
+            allowed: false,
+            reason: inlineJudgment.reason,
+            riskLevel: inlineJudgment.riskLevel,
+            riskType: inlineJudgment.riskType,
+            confidence: 90,
+            source: "logic_rule",
+            violatedLayers: ["1.2"]
+          };
+        }
+        return {
+          allowed: true,
+          reason: inlineJudgment.reason,
+          riskLevel: inlineJudgment.riskLevel,
+          riskType: inlineJudgment.riskType,
+          confidence: 90,
+          source: "logic_rule",
+          violatedLayers: []
+        };
+      }
+    }
+    if ((effectiveResult.riskLevel === "high" || effectiveResult.riskLevel === "critical") && (!skipInlineFileAccess || isCredentialPath)) {
+      return effectiveResult;
+    }
+  }
+  if (scriptChain && scriptChain.nodes.length > 0 && isLogicRulesEnabled()) {
+    for (const node of scriptChain.nodes) {
+      if (node.error || !node.preprocessedContent) continue;
+      if (node.l1RiskLevel === "critical") break;
+      if (node.l2Hit && (node.l2RiskLevel === "high" || node.l2RiskLevel === "critical")) {
+        return {
+          allowed: false,
+          reason: node.l2Reason,
+          riskLevel: node.l2RiskLevel,
+          riskType: node.l2RiskType,
+          confidence: 85,
+          source: "logic_rule_script_scan",
+          violatedLayers: ["1.2-script"]
+        };
+      }
+    }
+  }
+  if (skipLLM || !isLLMAvailable()) {
+    return {
+      allowed: true,
+      reason: "\u53EA\u8BFB\u64CD\u4F5C\u4E14\u65E0\u903B\u8F91\u89C4\u5219\u8FDD\u89C4\uFF0C\u8DF3\u8FC7 LLM \u5206\u6790",
+      riskLevel: logicResult?.riskLevel || "low",
+      riskType: "",
+      confidence: 85,
+      source: "heuristic_and_logic_only",
+      violatedLayers: []
+    };
+  }
+  let skipL3Hints = "\u65E0\uFF08\u5F53\u524D\u65E0\u7981\u7528\u89C4\u5219\u547D\u4E2D\uFF09";
+  try {
+    const { getDisabledL2RulesWithSkipL3: getDisabledL2RulesWithSkipL32 } = await Promise.resolve().then(() => (init_runtime_config(), runtime_config_exports));
+    const disabledL2 = getDisabledL2RulesWithSkipL32();
+    if (disabledL2 && Object.keys(disabledL2).length > 0) {
+      const actionLower = input.aNext.actionDetail.toLowerCase();
+      const matched = [];
+      for (const items of Object.values(disabledL2)) {
+        for (const item of items) {
+          if (item.toLowerCase().includes(actionLower) || actionLower.includes(item.toLowerCase())) {
+            matched.push(item);
+          }
+        }
+      }
+      if (matched.length > 0) {
+        skipL3Hints = `\u26A0\uFE0F \u91CD\u8981\u7EA6\u675F\uFF1A\u7528\u6237\u5DF2\u4E3B\u52A8\u7981\u7528\u9488\u5BF9\u4EE5\u4E0B\u5185\u5BB9\u7684\u5B89\u5168\u62E6\u622A\u89C4\u5219\uFF0C\u8FD9\u662F\u7528\u6237\u7684\u660E\u786E\u51B3\u7B56\uFF1A
+  ${matched.join(", ")}
+\u5BF9\u8FD9\u4E9B\u8DEF\u5F84/\u5173\u952E\u8BCD\u7684\u76F8\u5173\u64CD\u4F5C\uFF0C\u5FC5\u987B\u89C6\u4E3A\u5141\u8BB8\u7684\uFF0C\u4E0D\u5141\u8BB8\u4EC5\u56E0\u6D89\u53CA\u8FD9\u4E9B\u5185\u5BB9\u5C31\u62D2\u7EDD\u3002\u4F46\u4F60\u4ECD\u9700\u68C0\u67E5\u547D\u4EE4\u7684\u5176\u4ED6\u90E8\u5206\u662F\u5426\u6709\u72EC\u7ACB\u4E8E\u8FD9\u4E9B\u5185\u5BB9\u7684\u5B89\u5168\u98CE\u9669\uFF08\u5982\u7F51\u7EDC\u5916\u4F20\u3001\u63D0\u6743\u7B49\uFF09\u3002`;
+      }
+    }
+  } catch {
+  }
+  let llmResult;
+  try {
+    llmResult = await runLLMAnalysis(input, {
+      heuristic: heuristicResult,
+      logic: logicResult,
+      skipL3Hints,
+      scriptChain: scriptChain ?? void 0,
+      llmLogPath: input.llmLogPath
+    });
+  } catch (e) {
+    const { getLLMFailMode: getLLMFailMode2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+    if (getLLMFailMode2() === "fail_open") {
+      console.warn(`[AgentMoss] LLM \u5206\u6790\u5931\u8D25\uFF0Cfail_open \u6A21\u5F0F\uFF1A\u5141\u8BB8\u6267\u884C\uFF08\u524D\u4E24\u5C42\u672A\u62E6\u622A\uFF09: ${e.message}`);
+      return {
+        allowed: true,
+        reason: `LLM \u5206\u6790\u5931\u8D25\uFF08warn-allow\uFF0Cfail_open\uFF09: ${e.message}`,
+        riskLevel: "low",
+        riskType: "",
+        confidence: 50,
+        source: "llm_failure_fallback",
+        violatedLayers: []
+      };
+    }
+    return {
+      allowed: false,
+      reason: `LLM \u5206\u6790\u5931\u8D25\uFF0C\u56E0\u65E0\u6CD5\u5B8C\u6210\u6DF1\u5EA6\u8BED\u4E49\u5206\u6790\uFF0C\u6309 fail-closed \u539F\u5219\u62D2\u7EDD: ${e.message}`,
+      riskLevel: "medium",
+      riskType: "",
+      confidence: 60,
+      source: "llm_failure_fallback",
+      violatedLayers: ["3"]
+    };
+  }
+  return llmResult;
+}
+export {
+  TRUSTED_SKILLS_BASE,
+  runAnalysis
+};
+//# sourceMappingURL=coordinator.js.map