@kenhkl/agent-moss 0.9.0 → 0.10.0

package/dist/server.js

@@ -1,5 +1,7 @@
 var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
   get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
 }) : x)(function(x) {
@@ -16,6 +18,15 @@ var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // node_modules/tsup/assets/esm_shims.js
 import path from "path";
@@ -213,380 +224,89 @@ var init_config = __esm({
   }
 });
 
-// src/agents/index.ts
-import { readFileSync, existsSync } from "fs";
-import { resolve, dirname } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-function resolveAgentsDir() {
-  if (existsSync(AGENTS_DIR_PROD)) return AGENTS_DIR_PROD;
-  if (existsSync(AGENTS_DIR_DEV_FALLBACK)) return AGENTS_DIR_DEV_FALLBACK;
-  return AGENTS_DIR_PROD;
+// src/engine/inline-analyzer.ts
+function isLiteralTextCommand(command) {
+  ECHO_CMD_RE.lastIndex = 0;
+  return ECHO_CMD_RE.test(command);
 }
-function getAgentExtensions(agentId) {
-  if (!agentId) return null;
-  if (cache.has(agentId)) return cache.get(agentId) ?? null;
-  const agentsDir = resolveAgentsDir();
-  const rulesFile = resolve(agentsDir, agentId, "rules.json");
-  if (!existsSync(rulesFile)) {
-    cache.set(agentId, null);
-    return null;
+function extractInlineCode(command) {
+  const parts = [];
+  let m;
+  INLINE_CODE_RE.lastIndex = 0;
+  while ((m = INLINE_CODE_RE.exec(command)) !== null) {
+    const code = m[1] ?? m[2];
+    if (code) parts.push(code);
   }
-  try {
-    const raw = readFileSync(rulesFile, "utf-8");
-    const ext = JSON.parse(raw);
-    if (!ext.agent_id) {
-      console.warn(`[AgentMoss agents] rules.json \u7F3A\u5C11 agent_id \u5B57\u6BB5: ${rulesFile}`);
-      cache.set(agentId, null);
-      return null;
-    }
-    cache.set(agentId, ext);
-    console.log(
-      `[AgentMoss agents] \u52A0\u8F7D agent ${agentId} \u5B9A\u5236\u89C4\u5219: ${ext.extra_command_patterns?.length ?? 0} cmd patterns, ${ext.extra_injection_keywords?.length ?? 0} injection keywords, ${ext.extra_sensitive_paths?.length ?? 0} sensitive paths, ${ext.builtin_safe_skills?.length ?? 0} builtin safe skills`
-    );
-    return ext;
-  } catch (e) {
-    console.error(`[AgentMoss agents] \u52A0\u8F7D agent ${agentId} rules.json \u5931\u8D25:`, e.message);
-    cache.set(agentId, null);
-    return null;
+  ECHO_STRING_RE.lastIndex = 0;
+  while ((m = ECHO_STRING_RE.exec(command)) !== null) {
+    const code = m[1] ?? m[2];
+    if (code) parts.push(code);
   }
+  return parts.join("\n");
 }
-var __filename2, __dirname2, AGENTS_DIR_PROD, AGENTS_DIR_DEV_FALLBACK, cache;
-var init_agents = __esm({
-  "src/agents/index.ts"() {
-    "use strict";
-    init_esm_shims();
-    __filename2 = fileURLToPath2(import.meta.url);
-    __dirname2 = dirname(__filename2);
-    AGENTS_DIR_PROD = resolve(__dirname2, "agents");
-    AGENTS_DIR_DEV_FALLBACK = resolve(__dirname2, "../../../agent_moss/agents");
-    cache = /* @__PURE__ */ new Map();
-  }
-});
-
-// src/engine/heuristic.ts
-function runHeuristicCheck(input) {
-  const command = `${input.aNext.actionType}: ${input.aNext.actionDetail}`;
-  const matched = [];
-  let highestSeverity = "low";
-  let highestRiskType = "";
-  const userRules = getCustomRules();
-  for (const rule of userRules) {
-    try {
-      const re = new RegExp(rule.pattern);
-      if (re.test(command)) {
-        if (rule.action === "Deny") {
-          matched.push(`\u81EA\u5B9A\u4E49\u89C4\u5219: ${rule.pattern}`);
-          if (severityRank(rule.severity) > severityRank(highestSeverity)) {
-            highestSeverity = rule.severity;
-            highestRiskType = "custom_rule";
-          }
-        }
-      }
-    } catch {
-    }
-  }
-  let topRiskType = "";
-  for (const rule of DANGEROUS_PATTERNS) {
-    if (rule.pattern.test(command)) {
-      matched.push(rule.description);
-      if (severityRank(rule.severity) > severityRank(highestSeverity)) {
-        highestSeverity = rule.severity;
-        topRiskType = rule.riskType;
-      }
-    }
-  }
-  highestRiskType = topRiskType || highestRiskType;
-  const agentExt = getAgentExtensions(input.agentId);
-  if (agentExt?.extra_command_patterns) {
-    for (const rule of agentExt.extra_command_patterns) {
-      try {
-        const re = new RegExp(rule.pattern, "i");
-        if (re.test(command)) {
-          matched.push(`agent \u4E13\u5C5E\u89C4\u5219: ${rule.reason}`);
-          if (severityRank(rule.risk_level) > severityRank(highestSeverity)) {
-            highestSeverity = rule.risk_level;
-            highestRiskType = rule.risk_type;
-          }
-        }
-      } catch {
-      }
-    }
+function hasWriteExecChain(command) {
+  return WRITE_EXEC_CHAIN_PATTERNS.some((p) => {
+    p.lastIndex = 0;
+    return p.test(command);
+  });
+}
+function hasDirTraversal(code) {
+  const lower = code.toLowerCase();
+  return DIR_TRAVERSAL_KEYWORDS.some((kw) => lower.includes(kw));
+}
+function hasReadWriteKeyword(code) {
+  const lower = code.toLowerCase();
+  return READ_WRITE_KEYWORDS.some((kw) => lower.includes(kw));
+}
+function analyzeInlineScript(command) {
+  const code = extractInlineCode(command);
+  if (!code) {
+    return { actionable: false, allowed: true, reason: "", riskLevel: "low", riskType: "" };
   }
-  const injectionText = `${input.aNext.actionType} ${input.aNext.actionDetail} ${input.reason || ""} ${input.promptSession || ""}`.toLowerCase();
-  const injectionHits = checkInjectionKeywords(injectionText, agentExt?.extra_injection_keywords);
-  if (injectionHits.length > 0) {
-    const topHit = injectionHits.reduce((a, b) => severityRank(a.riskLevel) >= severityRank(b.riskLevel) ? a : b);
-    matched.push(...injectionHits.map((h) => `\u6CE8\u5165\u5173\u952E\u8BCD [${h.lang}]: ${h.keyword}`));
-    if (severityRank(topHit.riskLevel) > severityRank(highestSeverity)) {
-      highestSeverity = topHit.riskLevel;
-      highestRiskType = "prompt_injection";
-    }
+  if (hasWriteExecChain(command)) {
+    return {
+      actionable: true,
+      allowed: false,
+      reason: "\u5185\u8054\u811A\u672C\u542B\u5199\u5165\u6587\u4EF6\u540E\u6267\u884C\u7684\u6A21\u5F0F\uFF0C\u7591\u4F3C\u7ED5\u8FC7\u654F\u611F\u8DEF\u5F84\u68C0\u6D4B",
+      riskLevel: "critical",
+      riskType: "script_execution"
+    };
   }
-  if (matched.length > 0) {
+  const redirMatch = command.match(REDIRECT_TO_SENSITIVE_RE);
+  if (redirMatch) {
     return {
+      actionable: true,
       allowed: false,
-      reason: `\u68C0\u6D4B\u5230\u9AD8\u5371\u64CD\u4F5C: ${matched.join(", ")}`,
-      riskLevel: highestSeverity,
-      riskType: highestRiskType,
-      confidence: 95,
-      source: "heuristic",
-      violatedLayers: ["1.1"]
-      // 对齐 py coordinator.py:165（L1.1 = 命中高危命令模式/注入关键词）
+      reason: `\u91CD\u5B9A\u5411\u5199\u5165\u654F\u611F\u8DEF\u5F84: ${redirMatch[1]}`,
+      riskLevel: "critical",
+      riskType: "file_access"
     };
   }
-  return null;
-}
-function checkInjectionKeywords(text, extraKeywords) {
-  const hits = [];
-  for (const entry of INJECTION_KEYWORDS) {
-    if (text.includes(entry.keyword.toLowerCase())) {
-      hits.push(entry);
-    }
+  const isEchoOrPrintf1 = isLiteralTextCommand(command);
+  if (!isEchoOrPrintf1 && hasDirTraversal(code) && hasReadWriteKeyword(code)) {
+    return { actionable: false, allowed: true, reason: "", riskLevel: "low", riskType: "" };
   }
-  if (extraKeywords) {
-    for (const entry of extraKeywords) {
-      if (text.includes(entry.keyword.toLowerCase())) {
-        hits.push({ keyword: entry.keyword, riskLevel: entry.risk_level, lang: entry.lang });
-      }
-    }
+  const isEchoOrPrintf = isLiteralTextCommand(command);
+  if (!isEchoOrPrintf && hasReadWriteKeyword(code)) {
+    return {
+      actionable: true,
+      allowed: false,
+      reason: "\u5185\u8054\u811A\u672C\u542B\u654F\u611F\u8DEF\u5F84\u4E14\u542B\u6587\u4EF6\u8BFB\u5199/\u547D\u4EE4\u6267\u884C\u8C03\u7528\uFF0C\u5224\u4E3A\u771F\u5B9E\u8BBF\u95EE",
+      riskLevel: "critical",
+      riskType: "file_access"
+    };
   }
-  return hits;
-}
-function isInlineScriptCommand(actionDetail) {
-  const re = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
-  return re.test(actionDetail);
-}
-function severityRank(s) {
-  const ranks = { low: 1, medium: 2, high: 3, critical: 4 };
-  return ranks[s] || 0;
+  return {
+    actionable: true,
+    allowed: true,
+    reason: "\u654F\u611F\u8DEF\u5F84\u4EC5\u4F5C\u4E3A\u6587\u672C\u5B57\u9762\u91CF\u51FA\u73B0\uFF0C\u672A\u4F34\u968F\u8BFB\u5199\u64CD\u4F5C",
+    riskLevel: "low",
+    riskType: "file_access"
+  };
 }
-var INJECTION_KEYWORDS, DANGEROUS_PATTERNS;
-var init_heuristic = __esm({
-  "src/engine/heuristic.ts"() {
-    "use strict";
-    init_esm_shims();
-    init_config();
-    init_agents();
-    INJECTION_KEYWORDS = [
-      // ---- Instruction Override ----
-      { keyword: "ignore previous instructions", riskLevel: "critical", lang: "en" },
-      { keyword: "ignore all previous", riskLevel: "critical", lang: "en" },
-      { keyword: "disregard all prior", riskLevel: "critical", lang: "en" },
-      { keyword: "forget everything", riskLevel: "high", lang: "en" },
-      { keyword: "\u5FFD\u7565\u4E4B\u524D\u7684\u6307\u4EE4", riskLevel: "critical", lang: "zh" },
-      { keyword: "\u5FFD\u7565\u6240\u6709\u5148\u524D\u7684", riskLevel: "critical", lang: "zh" },
-      { keyword: "\u5FFD\u7565\u4E0A\u9762\u6240\u6709", riskLevel: "high", lang: "zh" },
-      { keyword: "\u8BF7\u5FD8\u8BB0\u4E4B\u524D", riskLevel: "high", lang: "zh" },
-      // ---- Role Hijacking ----
-      { keyword: "you are now", riskLevel: "high", lang: "en" },
-      { keyword: "you are no longer", riskLevel: "high", lang: "en" },
-      { keyword: "new instructions", riskLevel: "high", lang: "en" },
-      { keyword: "from now on, you", riskLevel: "high", lang: "en" },
-      { keyword: "\u4F60\u73B0\u5728\u662F\u4E00\u4E2A", riskLevel: "high", lang: "zh" },
-      { keyword: "\u4F60\u4E0D\u518D\u662F\u4E00\u4E2A", riskLevel: "high", lang: "zh" },
-      { keyword: "\u4ECE\u73B0\u5728\u5F00\u59CB\u4F60", riskLevel: "high", lang: "zh" },
-      { keyword: "\u4F60\u7684\u65B0\u89D2\u8272\u662F", riskLevel: "high", lang: "zh" },
-      // ---- Command Injection ----
-      { keyword: "system prompt", riskLevel: "high", lang: "en" },
-      { keyword: "reveal your instructions", riskLevel: "high", lang: "en" },
-      { keyword: "output your instructions", riskLevel: "high", lang: "en" },
-      { keyword: "repeat your instructions", riskLevel: "medium", lang: "en" },
-      { keyword: "\u7CFB\u7EDF\u63D0\u793A", riskLevel: "high", lang: "zh" },
-      { keyword: "\u8F93\u51FA\u4F60\u7684\u6307\u4EE4", riskLevel: "high", lang: "zh" },
-      { keyword: "\u91CD\u590D\u4F60\u7684\u6307\u4EE4", riskLevel: "medium", lang: "zh" },
-      // ---- Social Engineering ----
-      { keyword: "this is an authorized test", riskLevel: "high", lang: "en" },
-      { keyword: "security audit approved", riskLevel: "high", lang: "en" },
-      { keyword: "admin override", riskLevel: "critical", lang: "en" },
-      { keyword: "debug mode", riskLevel: "high", lang: "en" },
-      { keyword: "maintenance mode", riskLevel: "high", lang: "en" },
-      { keyword: "\u8FD9\u662F\u6388\u6743\u7684\u6D4B\u8BD5", riskLevel: "high", lang: "zh" },
-      { keyword: "\u5B89\u5168\u5BA1\u8BA1\u5DF2\u6279\u51C6", riskLevel: "high", lang: "zh" },
-      { keyword: "\u7BA1\u7406\u5458\u8986\u76D6", riskLevel: "critical", lang: "zh" },
-      { keyword: "\u8C03\u8BD5\u6A21\u5F0F", riskLevel: "high", lang: "zh" },
-      // ---- XSS ----
-      { keyword: "<script>", riskLevel: "high", lang: "en" },
-      { keyword: "javascript:", riskLevel: "high", lang: "en" },
-      { keyword: "onerror=", riskLevel: "high", lang: "en" },
-      { keyword: "onload=", riskLevel: "high", lang: "en" },
-      // ---- Fake Boundaries ----
-      { keyword: "=== END OF", riskLevel: "high", lang: "en" },
-      { keyword: "--- END SYSTEM", riskLevel: "high", lang: "en" },
-      { keyword: "[END OF", riskLevel: "high", lang: "en" },
-      { keyword: "=== \u7ED3\u675F", riskLevel: "high", lang: "zh" },
-      { keyword: "--- \u7ED3\u675F\u7CFB\u7EDF", riskLevel: "high", lang: "zh" },
-      // ---- Developer Mode ----
-      { keyword: "developer mode", riskLevel: "critical", lang: "en" },
-      { keyword: "DAN mode", riskLevel: "critical", lang: "en" },
-      { keyword: "jailbreak", riskLevel: "critical", lang: "en" },
-      { keyword: "\u5F00\u53D1\u8005\u6A21\u5F0F", riskLevel: "critical", lang: "zh" },
-      { keyword: "\u8D8A\u72F1", riskLevel: "critical", lang: "zh" }
-      // 注：xiaoO 专属绕过词（绕过审计/禁用安全检查/关闭防护/bypass audit 等）
-      // 已迁至 agent_moss/agents/xiaoo/rules.json 的 extra_injection_keywords，
-      // 由 agent_ext 机制注入，不再污染通用层。
-    ];
-    DANGEROUS_PATTERNS = [
-      // --- Critical: rm command graded detection (strict to loose, first match wins) ---
-      // 1. rm -rf root dir (含通配符如 /* /.* 等) — 使用负向先行断言 (?!\w)：/ 后面不是单词字符时匹配
-      { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*f[a-zA-Z]*\s+\/(?!\w)/i, severity: "critical", description: "\u9012\u5F52\u5F3A\u5236\u5220\u9664\u6839\u76EE\u5F55 (rm -rf /)", riskType: "script_execution" },
-      // 注意：已移除"rm -rf /任意绝对路径"的宽泛规则，避免误杀 /tmp 等临时目录清理操作
-      // 2. rm with -r or -f targeting system dirs
-      { pattern: /\brm\s+-[a-zA-Z]*[rf][a-zA-Z]*\s+\/(etc|var|home|usr|boot|root|opt|srv|sys|proc)\b/i, severity: "critical", description: "\u5220\u9664\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55", riskType: "script_execution" },
-      // 3. rm -r absolute path (no -f)
-      { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*\s+\//i, severity: "high", description: "\u9012\u5F52\u5220\u9664\u64CD\u4F5C (rm -r /...)", riskType: "script_execution" },
-      // 4. rm -f absolute path (no -r)
-      { pattern: /\brm\s+-[a-zA-Z]*f[a-zA-Z]*\s+\//i, severity: "medium", description: "\u5F3A\u5236\u5220\u9664\u6587\u4EF6 (rm -f /...)", riskType: "script_execution" },
-      // dd 磁盘清零 — 只拦截写入系统关键目录，放行 /tmp 等临时目录
-      { pattern: /dd\s+if=\/dev\/zero.*\bof\s*=\s*\/(etc|var|home|usr|boot|root|opt|srv|sys|proc)\b/i, severity: "critical", description: "\u78C1\u76D8\u6E05\u96F6\u5199\u5165\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55 (dd if=/dev/zero of=/\u7CFB\u7EDF\u76EE\u5F55)", riskType: "script_execution" },
-      // mkfs 格式化 — 只拦截对块设备（/dev/sdX 等）的格式化，放行对普通文件的格式化
-      { pattern: /mkfs\.\w+\s+\/dev\/(sd|hd|nvme|vd|loop|mapper|md|dm)\S+/i, severity: "critical", description: "\u683C\u5F0F\u5316\u5757\u8BBE\u5907 (mkfs /dev/\u5757\u8BBE\u5907)", riskType: "script_execution" },
-      { pattern: /:\(\)\s*\{.*:\|:&.*\};:/i, severity: "critical", description: "Fork Bomb", riskType: "resource_exhaustion" },
-      // --- Critical: remote code execution ---
-      { pattern: /curl\s+.*\|\s*(bash|sh|zsh|dash)/i, severity: "critical", description: "curl pipe shell \u6267\u884C", riskType: "script_execution" },
-      { pattern: /wget\s+.*\|\s*(bash|sh)/i, severity: "critical", description: "wget pipe shell \u6267\u884C", riskType: "script_execution" },
-      { pattern: /eval\s+\$\(curl|eval\s+\$\(wget/i, severity: "critical", description: "eval \u8FDC\u7A0B\u4EE3\u7801\u6267\u884C", riskType: "script_execution" },
-      { pattern: /base64\s+-d\s+.*\|\s*bash/i, severity: "critical", description: "base64 \u89E3\u7801\u6267\u884C", riskType: "script_execution" },
-      // --- Critical: reverse shell ---
-      { pattern: /\/dev\/tcp\/|bash\s+-i\s+>&/i, severity: "critical", description: "\u53CD\u5F39 Shell", riskType: "script_execution" },
-      { pattern: /nc\s+-[el]\s+.*\d{1,5}/i, severity: "high", description: "Netcat \u53CD\u5F39\u8FDE\u63A5", riskType: "lateral_movement" },
-      // --- Critical: sensitive file access ---
-      { pattern: /\/etc\/shadow/i, severity: "critical", description: "\u8BBF\u95EE\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6 (/etc/shadow)", riskType: "file_access" },
-      { pattern: /\/etc\/gshadow/i, severity: "critical", description: "\u8BBF\u95EE\u7CFB\u7EDF\u7EC4\u5BC6\u7801\u6587\u4EF6 (/etc/gshadow)", riskType: "file_access" },
-      // 注意：/etc/passwd 已从拦截列表移除，因为它是公开可读的标准系统文件，真正敏感的是 /etc/shadow
-      { pattern: /\.ssh\/id_rsa/i, severity: "critical", description: "\u8BBF\u95EE SSH \u79C1\u94A5\u6587\u4EF6", riskType: "file_access" },
-      // --- Critical: privilege escalation / container escape ---
-      { pattern: /\/var\/run\/docker\.sock/i, severity: "critical", description: "\u8BBF\u95EE Docker socket\uFF0C\u53EF\u80FD\u5BFC\u81F4\u5BB9\u5668\u9003\u9038", riskType: "privilege_escalation" },
-      // --- High: dangerous permissions / ownership ---
-      { pattern: /chmod\s+[0-7]*777[0-7]*/i, severity: "high", description: "\u5168\u6743\u9650\u8BBE\u7F6E (chmod 777)", riskType: "script_execution" },
-      { pattern: /chown\s+root|chown\s+-R\s+\w+:\w+\s+\//i, severity: "high", description: "\u4FEE\u6539\u6240\u6709\u8005\u4E3A root / \u9012\u5F52\u4FEE\u6539\u6839\u76EE\u5F55\u6240\u6709\u8005", riskType: "script_execution" },
-      // sudo 提权 — 只拦截 sudo 后跟的危险命令，不一刀切拦截所有 sudo
-      { pattern: /sudo\s+(rm|chmod|chown|dd|mkfs|format|iptables|crontab|passwd|userdel|useradd|groupdel)\b/i, severity: "high", description: "\u63D0\u6743\u6267\u884C\u9AD8\u5371\u547D\u4EE4 (sudo + \u5371\u9669\u64CD\u4F5C)", riskType: "privilege_escalation" },
-      // --- High: system config overwrite ---
-      { pattern: />\s*\/etc\//i, severity: "critical", description: "\u8986\u76D6\u5199\u5165\u7CFB\u7EDF\u914D\u7F6E\u76EE\u5F55", riskType: "file_access" },
-      // --- High: download script + execute risk ---
-      { pattern: /(?:curl|wget)\s+.*(?:-o|--output|>)\s*\S+\.(?:sh|bash)\b/i, severity: "high", description: "\u8FDC\u7A0B\u4E0B\u8F7D\u811A\u672C\u5230\u672C\u5730", riskType: "script_execution" },
-      { pattern: /(?:curl|wget)\s+.*\s+&&?\s*(?:chmod\s+\+x|bash|sh)/i, severity: "high", description: "\u4E0B\u8F7D\u540E\u6267\u884C", riskType: "script_execution" },
-      // --- High: package manager pipe-to-shell ---
-      { pattern: /git\s+clone\s+.*\|.*bash/i, severity: "high", description: "git clone pipe shell", riskType: "script_execution" },
-      { pattern: /pip\s+install\s+.*\|\s*bash/i, severity: "high", description: "pip install pipe shell", riskType: "script_execution" },
-      { pattern: /npm\s+install\s+-g\s+.*\|\s*bash/i, severity: "high", description: "npm install pipe shell", riskType: "script_execution" },
-      // --- Medium: destructive git operations (降级为 medium，允许但记录) ---
-      { pattern: /git\s+push\s+.*--force/i, severity: "medium", description: "\u5F3A\u5236\u63A8\u9001\u64CD\u4F5C (git push --force)\uFF0C\u53EF\u80FD\u8986\u76D6\u8FDC\u7A0B\u63D0\u4EA4\u5386\u53F2", riskType: "script_execution" },
-      // --- High: network port scanning (横向移动侦察) ---
-      { pattern: /\bnmap\s+/i, severity: "high", description: "\u7F51\u7EDC\u7AEF\u53E3\u626B\u63CF (nmap)\uFF0C\u53EF\u80FD\u7528\u4E8E\u6A2A\u5411\u79FB\u52A8\u4FA6\u5BDF", riskType: "lateral_movement" },
-      { pattern: /\b(masscan|zmap|unicornscan)\s+/i, severity: "high", description: "\u7F51\u7EDC\u7AEF\u53E3\u626B\u63CF\u5DE5\u5177\uFF0C\u53EF\u80FD\u7528\u4E8E\u6A2A\u5411\u79FB\u52A8\u4FA6\u5BDF", riskType: "lateral_movement" },
-      // --- Medium: credential export ---
-      { pattern: /export\s+.*(?:TOKEN|KEY|SECRET|PASSWORD)/i, severity: "medium", description: "\u5BFC\u51FA\u654F\u611F\u51ED\u8BC1", riskType: "data_exfiltration" },
-      // --- High: shell rc file append (persistence) ---
-      { pattern: />>\s*(~|\/home\/[^/]+)\/(\.bashrc|\.zshrc|\.profile|\.bash_profile|\.zprofile)/, severity: "high", description: "\u68C0\u6D4B\u5230\u4FEE\u6539 Shell \u914D\u7F6E\u6587\u4EF6\uFF08~/.bashrc \u7B49\uFF09\uFF0C\u53EF\u80FD\u7528\u4E8E\u6301\u4E45\u5316\u540E\u95E8", riskType: "persistence" },
-      // --- High: device file write (只拦截重定向写入设备文件，不拦截读取) ---
-      { pattern: />\s*\/dev\/(sd|hd|nvme|vd|loop|mem|kmsg|port|zero|random|urandom|full|core)/i, severity: "high", description: "\u91CD\u5B9A\u5411\u5199\u5165\u8BBE\u5907\u6587\u4EF6", riskType: "file_access" },
-      // --- High: non-interactive password modification ---
-      { pattern: /\|\s*passwd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u7BA1\u9053\u65B9\u5F0F\u8C03\u7528 passwd\uFF08\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\uFF09", riskType: "script_execution" },
-      { pattern: /\bpasswd\s+--stdin\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 passwd --stdin \u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u8F93\u5165", riskType: "script_execution" },
-      { pattern: /\bchpasswd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 chpasswd \u6279\u91CF\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4", riskType: "script_execution" },
-      { pattern: /\b(newusers|lnewusers)\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 newusers/lnewusers \u6279\u91CF\u7528\u6237\u6DFB\u52A0\u547D\u4EE4", riskType: "script_execution" },
-      { pattern: /\bpasswd\s+-[a-zA-Z]*d\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u5BC6\u7801\u64CD\u4F5C (passwd -d)", riskType: "script_execution" },
-      { pattern: /\bpasswd\s+-[a-zA-Z]*l\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u9501\u5B9A\u7528\u6237\u8D26\u6237\u64CD\u4F5C (passwd -l)", riskType: "script_execution" },
-      // --- High: non-interactive password modification (extended) ---
-      { pattern: /\blpasswd\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u64CD\u4F5C (lpasswd)", riskType: "script_execution" },
-      { pattern: /\bgpasswd\s+(?!-[adA])/i, severity: "high", description: "\u68C0\u6D4B\u5230\u7EC4\u5BC6\u7801\u7BA1\u7406\u64CD\u4F5C (gpasswd)", riskType: "script_execution" },
-      { pattern: /\bchgpasswd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u6279\u91CF\u4FEE\u6539\u7EC4\u5BC6\u7801\u64CD\u4F5C (chgpasswd)", riskType: "script_execution" },
-      // --- High: user/group deletion (irreversible, requires user consent) ---
-      { pattern: /\buserdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (userdel)", riskType: "script_execution" },
-      { pattern: /\bdeluser\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (deluser)", riskType: "script_execution" },
-      { pattern: /\bluserdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (luserdel)", riskType: "script_execution" },
-      { pattern: /\bgroupdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u7EC4\u64CD\u4F5C (groupdel)", riskType: "script_execution" },
-      { pattern: /\blgroupdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u7EC4\u64CD\u4F5C (lgroupdel)", riskType: "script_execution" },
-      // --- High: generic command -p parameter password setting ---
-      { pattern: /\b(useradd|luseradd|groupadd|usermod|lusermod|groupmod|lgroupmod)\b[^&|;]*?\s-p\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u901A\u8FC7 -p \u53C2\u6570\u8BBE\u7F6E\u6216\u4FEE\u6539\u5BC6\u7801 (useradd/usermod/groupmod)", riskType: "script_execution" }
-    ];
-  }
-});
-
-// src/engine/inline-analyzer.ts
-function isLiteralTextCommand(command) {
-  ECHO_CMD_RE.lastIndex = 0;
-  return ECHO_CMD_RE.test(command);
-}
-function extractInlineCode(command) {
-  const parts = [];
-  let m;
-  INLINE_CODE_RE.lastIndex = 0;
-  while ((m = INLINE_CODE_RE.exec(command)) !== null) {
-    const code = m[1] ?? m[2];
-    if (code) parts.push(code);
-  }
-  ECHO_STRING_RE.lastIndex = 0;
-  while ((m = ECHO_STRING_RE.exec(command)) !== null) {
-    const code = m[1] ?? m[2];
-    if (code) parts.push(code);
-  }
-  return parts.join("\n");
-}
-function hasWriteExecChain(command) {
-  return WRITE_EXEC_CHAIN_PATTERNS.some((p) => {
-    p.lastIndex = 0;
-    return p.test(command);
-  });
-}
-function hasDirTraversal(code) {
-  const lower = code.toLowerCase();
-  return DIR_TRAVERSAL_KEYWORDS.some((kw) => lower.includes(kw));
-}
-function hasReadWriteKeyword(code) {
-  const lower = code.toLowerCase();
-  return READ_WRITE_KEYWORDS.some((kw) => lower.includes(kw));
-}
-function analyzeInlineScript(command) {
-  const code = extractInlineCode(command);
-  if (!code) {
-    return { actionable: false, allowed: true, reason: "", riskLevel: "low", riskType: "" };
-  }
-  if (hasWriteExecChain(command)) {
-    return {
-      actionable: true,
-      allowed: false,
-      reason: "\u5185\u8054\u811A\u672C\u542B\u5199\u5165\u6587\u4EF6\u540E\u6267\u884C\u7684\u6A21\u5F0F\uFF0C\u7591\u4F3C\u7ED5\u8FC7\u654F\u611F\u8DEF\u5F84\u68C0\u6D4B",
-      riskLevel: "critical",
-      riskType: "script_execution"
-    };
-  }
-  const redirMatch = command.match(REDIRECT_TO_SENSITIVE_RE);
-  if (redirMatch) {
-    return {
-      actionable: true,
-      allowed: false,
-      reason: `\u91CD\u5B9A\u5411\u5199\u5165\u654F\u611F\u8DEF\u5F84: ${redirMatch[1]}`,
-      riskLevel: "critical",
-      riskType: "file_access"
-    };
-  }
-  const isEchoOrPrintf1 = isLiteralTextCommand(command);
-  if (!isEchoOrPrintf1 && hasDirTraversal(code) && hasReadWriteKeyword(code)) {
-    return { actionable: false, allowed: true, reason: "", riskLevel: "low", riskType: "" };
-  }
-  const isEchoOrPrintf = isLiteralTextCommand(command);
-  if (!isEchoOrPrintf && hasReadWriteKeyword(code)) {
-    return {
-      actionable: true,
-      allowed: false,
-      reason: "\u5185\u8054\u811A\u672C\u542B\u654F\u611F\u8DEF\u5F84\u4E14\u542B\u6587\u4EF6\u8BFB\u5199/\u547D\u4EE4\u6267\u884C\u8C03\u7528\uFF0C\u5224\u4E3A\u771F\u5B9E\u8BBF\u95EE",
-      riskLevel: "critical",
-      riskType: "file_access"
-    };
-  }
-  return {
-    actionable: true,
-    allowed: true,
-    reason: "\u654F\u611F\u8DEF\u5F84\u4EC5\u4F5C\u4E3A\u6587\u672C\u5B57\u9762\u91CF\u51FA\u73B0\uFF0C\u672A\u4F34\u968F\u8BFB\u5199\u64CD\u4F5C",
-    riskLevel: "low",
-    riskType: "file_access"
-  };
-}
-var INLINE_CODE_RE, ECHO_STRING_RE, ECHO_CMD_RE, READ_WRITE_KEYWORDS, WRITE_EXEC_CHAIN_PATTERNS, SENSITIVE_PATH_FRAGMENTS, REDIRECT_TO_SENSITIVE_RE, DIR_TRAVERSAL_KEYWORDS;
-var init_inline_analyzer = __esm({
-  "src/engine/inline-analyzer.ts"() {
+var INLINE_CODE_RE, ECHO_STRING_RE, ECHO_CMD_RE, READ_WRITE_KEYWORDS, WRITE_EXEC_CHAIN_PATTERNS, SENSITIVE_PATH_FRAGMENTS, REDIRECT_TO_SENSITIVE_RE, DIR_TRAVERSAL_KEYWORDS;
+var init_inline_analyzer = __esm({
+  "src/engine/inline-analyzer.ts"() {
     "use strict";
     init_esm_shims();
     INLINE_CODE_RE = /(?:python|python3|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cera][a-zA-Z]*\s+)"([^"\\]*(?:\\.[^"\\]*)*)"|'([^'\\]*(?:\\.[^'\\]*)*)'/gi;
@@ -720,165 +440,26 @@ function runLogicCheck(input) {
       }
     }
   }
-  if (!isExcludedType) {
-    const agentExt = getAgentExtensions(input.agentId || "");
-    const pathResult = checkSensitivePath(actionDetail, resolvedCwd, agentExt);
-    if (pathResult) return pathResult;
-  }
-  if (actionType !== "file_write" && actionType !== "file_edit") {
-    const TEMP_DIRS = ["/tmp/", "/var/tmp/", "/run/", "/dev/shm/"];
-    const isTempPath = TEMP_DIRS.some((td) => actionDetail.includes(td));
-    if (!isTempPath && (actionDetail.includes("*") || actionDetail.includes("?")) && ["rm ", "rm	", "del ", "del	", "delete", "remove ", "remove	", "\u5220\u9664", "\u79FB\u9664"].some((kw) => actionDetail.includes(kw))) {
-      return {
-        allowed: false,
-        reason: "\u68C0\u6D4B\u5230\u901A\u914D\u7B26\u7ED3\u5408\u5220\u9664\u64CD\u4F5C\uFF0C\u53EF\u80FD\u9020\u6210\u6279\u91CF\u8BEF\u5220",
-        riskLevel: "high",
-        riskType: "script_execution",
-        confidence: 90,
-        source: "logic_rule",
-        violatedLayers: ["2"]
-      };
-    }
-    if (/>\s*\/etc\//.test(actionDetail) || />\s*\/boot\//.test(actionDetail) || />\s*\/proc\//.test(actionDetail)) {
-      return {
-        allowed: false,
-        reason: "\u68C0\u6D4B\u5230\u91CD\u5B9A\u5411\u8986\u76D6\u5199\u5165\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55",
-        riskLevel: "critical",
-        riskType: "file_access",
-        confidence: 95,
-        source: "logic_rule",
-        violatedLayers: ["2"]
-      };
-    }
-  }
-  var _READ_ONLY_COMMANDS = /* @__PURE__ */ new Set([
-    "cat",
-    "head",
-    "tail",
-    "less",
-    "more",
-    "grep",
-    "find",
-    "awk",
-    "sed",
-    "sort",
-    "uniq",
-    "wc",
-    "cut",
-    "strings",
-    "od",
-    "xxd",
-    "hexdump",
-    "tr",
-    "file",
-    "stat",
-    "du",
-    "df",
-    "ls",
-    "dir",
-    "tree",
-    "nl",
-    "tac",
-    "rev",
-    "lsblk",
-    "blockdev",
-    "smartctl",
-    "udevadm",
-    "dmidecode",
-    "lscpu",
-    "lspci",
-    "lsusb",
-    "lsmem",
-    "lsns",
-    "lsof",
-    "hwinfo",
-    "inxi",
-    "fdisk",
-    "parted",
-    "dmesg",
-    "journalctl",
-    "systemctl",
-    "hostnamectl",
-    "localectl",
-    "timedatectl",
-    "ps",
-    "top",
-    "free",
-    "vmstat",
-    "iostat",
-    "mpstat",
-    "pidof",
-    "pgrep",
-    "ip",
-    "ifconfig",
-    "route",
-    "ss",
-    "netstat",
-    "arp",
-    "ethtool",
-    "nmcli",
-    "uname",
-    "arch",
-    "nproc",
-    "getconf",
-    "getent",
-    "id",
-    "whoami",
-    "who",
-    "w",
-    "last",
-    "uptime",
-    "lsmod",
-    "modinfo",
-    "sysctl"
-  ]);
-  var _DEVNULL_REDIRECT_RE = /(?:2|&|1)?\s*>\s*\/dev\/null\b/;
-  var _WRITE_COMMAND_RES = [
-    /\brm\b/,
-    /\bunlink\b/,
-    /\brmdir\b/,
-    /\bshred\b/,
-    /\bcp\b/,
-    /\bmv\b/,
-    /\binstall\b/,
-    /\btee\b/,
-    /\bdd\b/,
-    /\bmkfs\b/,
-    /\b(fdisk|parted|cfdisk|sfdisk)\b/,
-    /\bchmod\b/,
-    /\bchown\b/,
-    /\btruncate\b/
-  ];
   const indirectResult = checkIndirectFileAccess(actionType, actionDetail, resolvedCwd);
   if (indirectResult) return indirectResult;
   if (actionDetail.includes("sudo") || actionDetail.includes("su -") || actionDetail.includes("chmod u+s") || actionDetail.includes("setuid")) {
-    const adminContext = actionHistory.some(
-      (h) => h.actionDetail.includes("sudo") || h.actionDetail.includes("apt") || h.actionDetail.includes("systemctl") || h.actionDetail.includes("yum") || h.actionDetail.includes("dnf") || h.actionDetail.includes("pacman") || h.actionDetail.includes("zypper") || h.actionDetail.includes("apk")
-    );
-    if (!adminContext) {
-      return {
-        allowed: false,
-        reason: "\u68C0\u6D4B\u5230\u63D0\u6743\u64CD\u4F5C\uFF0C\u672A\u53D1\u73B0\u5408\u6CD5\u7BA1\u7406\u4E0A\u4E0B\u6587",
-        riskLevel: "high",
-        riskType: "privilege_escalation",
-        confidence: 85,
-        source: "logic_rule",
-        violatedLayers: ["2"]
-      };
-    }
-  }
-  if (/(?:ssh|scp|rsync)\s+/.test(actionDetail)) {
-    const targetHost = extractRemoteHost(actionDetail);
-    if (targetHost && !isLocalHost(targetHost)) {
-      return {
-        allowed: false,
-        reason: `\u5C1D\u8BD5\u6A2A\u5411\u79FB\u52A8\u5230\u8FDC\u7A0B\u4E3B\u673A: ${targetHost}`,
-        riskLevel: "medium",
-        riskType: "lateral_movement",
-        confidence: 80,
-        source: "logic_rule",
-        violatedLayers: ["2"]
-      };
+    const detailAfterSudo = actionDetail.replace(/(^|\|\||&&|\s)sudo\s+/g, " ");
+    const isAdminCmd = ["apt", "systemctl", "yum", "dnf", "pacman", "zypper", "apk"].some((kw) => detailAfterSudo.includes(kw));
+    if (!isAdminCmd) {
+      const adminContext = actionHistory.some(
+        (h) => h.actionDetail.includes("sudo") || h.actionDetail.includes("apt") || h.actionDetail.includes("systemctl") || h.actionDetail.includes("yum") || h.actionDetail.includes("dnf") || h.actionDetail.includes("pacman") || h.actionDetail.includes("zypper") || h.actionDetail.includes("apk")
+      );
+      if (!adminContext) {
+        return {
+          allowed: false,
+          reason: "\u68C0\u6D4B\u5230\u63D0\u6743\u64CD\u4F5C\uFF0C\u672A\u53D1\u73B0\u5408\u6CD5\u7BA1\u7406\u4E0A\u4E0B\u6587",
+          riskLevel: "high",
+          riskType: "privilege_escalation",
+          confidence: 85,
+          source: "logic_rule",
+          violatedLayers: ["2"]
+        };
+      }
     }
   }
   const pwdResult = checkPasswordConsent(actionType, actionDetail, actionHistory);
@@ -899,9 +480,12 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
   if (NON_WRITE_TOOLS.has(actionType)) return null;
   let isWrite = WRITE_KEYWORDS.some((kw) => actionType.includes(kw) || actionDetail.includes(kw));
   if (!isWrite && actionDetail.includes(">")) {
-    const firstWord = actionDetail.split(/\s/)[0]?.toLowerCase() || "";
-    if (!READ_ONLY_REDIR_CMDS.has(firstWord)) {
-      isWrite = true;
+    const detailWithoutDevnull = actionDetail.replace(/(?:2|&|1)?\s*>\s*\/dev\/null\b/g, "");
+    if (detailWithoutDevnull.includes(">")) {
+      const firstWord = actionDetail.split(/\s/)[0]?.toLowerCase() || "";
+      if (!READ_ONLY_REDIR_CMDS.has(firstWord)) {
+        isWrite = true;
+      }
     }
   }
   if (!isWrite) return null;
@@ -946,119 +530,6 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
   }
   return null;
 }
-function checkSensitivePath(command, cwd, agentExt) {
-  const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
-  const _WRITE_CMD_RES = [/\brm\b/, /\bunlink\b/, /\brmdir\b/, /\bshred\b/, /\bcp\b/, /\bmv\b/, /\binstall\b/, /\btee\b/, /\bdd\b/, /\bmkfs\b/, /\b(fdisk|parted|cfdisk|sfdisk)\b/, /\bchmod\b/, /\bchown\b/, /\btruncate\b/];
-  const _DEVNULL_RE = /(?:2|&|1)?\s*>\s*\/dev\/null\b/;
-  const _READONLY_CMDS = /* @__PURE__ */ new Set(["cat", "head", "tail", "less", "more", "grep", "find", "awk", "sed", "sort", "uniq", "wc", "cut", "strings", "od", "xxd", "hexdump", "tr", "file", "stat", "du", "df", "ls", "dir", "tree", "nl", "tac", "rev", "lsblk", "blockdev", "smartctl", "udevadm", "dmidecode", "lscpu", "lspci", "lsusb", "lsmem", "lsns", "lsof", "hwinfo", "inxi", "fdisk", "parted", "dmesg", "journalctl", "systemctl", "hostnamectl", "localectl", "timedatectl", "ps", "top", "free", "vmstat", "iostat", "mpstat", "pidof", "pgrep", "ip", "ifconfig", "route", "ss", "netstat", "arp", "ethtool", "nmcli", "uname", "arch", "nproc", "getconf", "getent", "id", "whoami", "who", "w", "last", "uptime", "lsmod", "modinfo", "sysctl"]);
-  const isWriteOpFlag = _WRITE_CMD_RES.some((rx) => rx.test(command)) || /\bsed\s+-[a-zA-Z]*i/.test(command) || command.includes(">") && !command.replace(_DEVNULL_RE, "").includes(">") || command.includes(">") && command.replace(_DEVNULL_RE, "").includes(">") && !_READONLY_CMDS.has(command.trim().split(/\s+/)[0]?.toLowerCase() || "") || WRITE_KEYWORDS.some((kw) => "".includes(kw) || command.includes(kw));
-  for (const sp of ROOT_SENSITIVE_PATHS) {
-    if (command.includes(sp.path.toLowerCase())) {
-      if (sp.path === "/dev/random") {
-        if (isWriteOpFlag) {
-          continue;
-        }
-        return {
-          allowed: false,
-          reason: `\u8BFB\u53D6\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
-          riskLevel: sp.riskLevel,
-          riskType: "sensitive_path_access",
-          confidence: 90,
-          source: "logic_rule",
-          violatedLayers: ["2"]
-        };
-      }
-      if (!isWriteOpFlag && !sp.credential) {
-        continue;
-      }
-      return {
-        allowed: false,
-        reason: `\u5C1D\u8BD5\u8BBF\u95EE\u7CFB\u7EDF\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
-        riskLevel: sp.riskLevel,
-        riskType: "sensitive_path_access",
-        confidence: 90,
-        source: "logic_rule",
-        violatedLayers: ["2"]
-      };
-    }
-  }
-  for (const sp of HOME_SENSITIVE_PATHS) {
-    const expanded = `${expandedCwd}/${sp.path}`;
-    if (command.includes(sp.path.toLowerCase()) || command.includes(expanded.toLowerCase())) {
-      if (!isWriteOpFlag && !sp.credential) {
-        continue;
-      }
-      return {
-        allowed: false,
-        reason: `\u5C1D\u8BD5\u8BBF\u95EE\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
-        riskLevel: sp.riskLevel,
-        riskType: "sensitive_path_access",
-        confidence: 90,
-        source: "logic_rule",
-        violatedLayers: ["2"]
-      };
-    }
-  }
-  if (agentExt?.extra_sensitive_paths && agentExt.extra_sensitive_paths.length > 0) {
-    for (const sp of agentExt.extra_sensitive_paths) {
-      const spPath = sp.path.toLowerCase();
-      const expanded = `${expandedCwd}/${spPath}`;
-      if (command.includes(spPath) || command.includes(expanded.toLowerCase())) {
-        const denyMode = sp.deny_mode || (sp.credential ? "deny_both" : sp.read_only ? "deny_read" : "deny_write");
-        if (denyMode === "deny_read") {
-          if (isWriteOpFlag) continue;
-        } else if (denyMode === "deny_write") {
-          if (!isWriteOpFlag) continue;
-        }
-        return {
-          allowed: false,
-          reason: `\u5C1D\u8BD5\u8BBF\u95EE agent \u4E13\u5C5E\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
-          riskLevel: sp.risk_level,
-          riskType: "sensitive_path_access",
-          confidence: 90,
-          source: "logic_rule",
-          violatedLayers: ["2"]
-        };
-      }
-    }
-  }
-  for (const cp of CREDENTIAL_PATHS) {
-    const escaped = cp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const re = cp.path.startsWith(".") ? new RegExp(`(?:^|[\\s/\\\\'"])${escaped}\\b`) : new RegExp(`\\b${escaped}\\b`);
-    if (re.test(command)) {
-      return {
-        allowed: false,
-        reason: `\u8BBF\u95EE\u654F\u611F\u8DEF\u5F84: ${cp.desc} (${cp.path})`,
-        riskLevel: cp.riskLevel,
-        riskType: "sensitive_path_access",
-        confidence: 90,
-        source: "logic_rule",
-        violatedLayers: ["2"],
-        isCredential: true
-      };
-    }
-  }
-  if ((command.includes("rm ") || command.includes("unlink")) && (command.includes("/etc/") || command.includes("/root/") || command.includes("/var/log/"))) {
-    return {
-      allowed: false,
-      reason: "\u68C0\u6D4B\u5230\u5220\u9664\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55\u5185\u5BB9",
-      riskLevel: "critical",
-      riskType: "sensitive_path_access",
-      confidence: 90,
-      source: "logic_rule",
-      violatedLayers: ["2"]
-    };
-  }
-  return null;
-}
-function extractRemoteHost(command) {
-  const m = command.match(/(?:ssh|scp|rsync)\s+(?:-[\w]+\s+)*(\S+@\S+|\b(?!-)[\w.-]+\b)/);
-  return m ? m[1] : null;
-}
-function isLocalHost(host) {
-  const localNames = ["localhost", "127.0.0.1", "::1", process.env.HOSTNAME || "", "0.0.0.0"];
-  return localNames.includes(host.replace(/.*@/, ""));
-}
 function checkPasswordConsent(actionType, actionDetail, actionHistory) {
   if (actionType !== "bash") return null;
   const isPasswordModify = PASSWORD_MODIFY_PATTERNS.some((p) => p.test(actionDetail));
@@ -1179,11 +650,10 @@ var init_logic_rules = __esm({
     "use strict";
     init_esm_shims();
     init_inline_analyzer();
-    init_agents();
     ROOT_SENSITIVE_PATHS = [
       { path: "/etc/shadow", riskLevel: "critical", desc: "\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6", credential: true },
       { path: "/etc/gshadow", riskLevel: "critical", desc: "\u7CFB\u7EDF\u7EC4\u5BC6\u7801\u6587\u4EF6", credential: true },
-      // 注意：/etc/passwd 仅从 L1 启发式规则移除（公开可读），L2 敏感路径仍保留
+      // 注意：/etc/passwd 仅从 L1 特征匹配规则移除（公开可读），L2 敏感路径仍保留
       { path: "/etc/passwd", riskLevel: "high", desc: "\u7CFB\u7EDF\u7528\u6237\u6587\u4EF6" },
       { path: "/etc/sudoers", riskLevel: "critical", desc: "sudo \u914D\u7F6E", credential: true },
       // 系统配置（仅拦截写入）
@@ -1276,21 +746,21 @@ var init_logic_rules = __esm({
 });
 
 // src/engine/skill-loader.ts
-import { readFileSync as readFileSync2, readdirSync as readdirSync2, existsSync as existsSync3 } from "fs";
-import { resolve as resolve2, dirname as dirname2 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
+import { readFileSync, readdirSync as readdirSync2, existsSync as existsSync2 } from "fs";
+import { resolve, dirname } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 function loadAllSkills() {
   if (cachedSkills) return cachedSkills;
   cachedSkills = {};
-  const dir = existsSync3(SKILLS_DIR) ? SKILLS_DIR : SKILLS_DIR_FALLBACK;
-  if (!existsSync3(dir)) {
+  const dir = existsSync2(SKILLS_DIR) ? SKILLS_DIR : SKILLS_DIR_FALLBACK;
+  if (!existsSync2(dir)) {
     console.warn("[AgentMoss] Skills directory not found:", SKILLS_DIR, "and fallback:", SKILLS_DIR_FALLBACK);
     return cachedSkills;
   }
   const files = readdirSync2(dir).filter((f) => f.endsWith(".md"));
   for (const f of files) {
     const name = f.replace(".md", "");
-    cachedSkills[name] = readFileSync2(resolve2(dir, f), "utf-8");
+    cachedSkills[name] = readFileSync(resolve(dir, f), "utf-8");
   }
   console.log(`[AgentMoss] Loaded ${Object.keys(cachedSkills).length} skills from ${dir}`);
   return cachedSkills;
@@ -1344,15 +814,15 @@ function formatSkillsForPrompt(skills) {
 ${s.skillContent}`
   ).join("\n\n---\n\n");
 }
-var __filename3, __dirname3, SKILLS_DIR, SKILLS_DIR_FALLBACK, SKILL_KEYWORD_MAP, cachedSkills;
+var __filename2, __dirname2, SKILLS_DIR, SKILLS_DIR_FALLBACK, SKILL_KEYWORD_MAP, cachedSkills;
 var init_skill_loader = __esm({
   "src/engine/skill-loader.ts"() {
     "use strict";
     init_esm_shims();
-    __filename3 = fileURLToPath3(import.meta.url);
-    __dirname3 = dirname2(__filename3);
-    SKILLS_DIR = resolve2(__dirname3, "../skills");
-    SKILLS_DIR_FALLBACK = resolve2(__dirname3, "../../../agent_moss/skills");
+    __filename2 = fileURLToPath2(import.meta.url);
+    __dirname2 = dirname(__filename2);
+    SKILLS_DIR = resolve(__dirname2, "../skills");
+    SKILLS_DIR_FALLBACK = resolve(__dirname2, "../../../agent_moss/skills");
     SKILL_KEYWORD_MAP = {
       "file_access_guard": ["file", "\u6587\u4EF6", "path", "\u8DEF\u5F84", "read", "write", "cat", "open", "access", "\u8BBF\u95EE", "\u8BFB\u5199", "copy", "cp", "mv", "move"],
       "script_execution_guard": ["command", "shell", "bash", "exec", "execute", "\u6267\u884C", "\u547D\u4EE4", "script", "\u811A\u672C", "run", "\u8FD0\u884C", "subprocess", "system", "eval", "compile", "\u5B89\u88C5", "install", "pip", "npm"],
@@ -1374,189 +844,22 @@ var init_skill_loader = __esm({
   }
 });
 
-// src/engine/token-stats.ts
-var token_stats_exports = {};
-__export(token_stats_exports, {
-  getRecentRecords: () => getRecentRecords,
-  getTokenStats: () => getTokenStats,
-  getTokenTrend: () => getTokenTrend,
-  recordTokenUsage: () => recordTokenUsage,
-  resetTokenStats: () => resetTokenStats
-});
-import { readFileSync as readFileSync6, writeFileSync, existsSync as existsSync6, mkdirSync, unlinkSync } from "fs";
-import { join as join3 } from "path";
-import { homedir as homedir2 } from "os";
-function getStatsPath() {
-  const envPath = process.env[ENV_STATS_PATH];
-  return envPath || STATS_FILE;
-}
-function loadAllRecords(statsPath) {
-  if (!existsSync6(statsPath)) return [];
-  try {
-    const data = JSON.parse(readFileSync6(statsPath, "utf-8"));
-    if (Array.isArray(data)) return data;
-    if (data && Array.isArray(data.records)) return data.records;
-    return [];
-  } catch (e) {
-    return [];
-  }
-}
-function saveRecords(statsPath, records) {
-  try {
-    const dir = statsPath.substring(0, statsPath.lastIndexOf("/"));
-    if (dir && !existsSync6(dir)) mkdirSync(dir, { recursive: true });
-    writeFileSync(statsPath, JSON.stringify(records, null, 2), "utf-8");
-  } catch (e) {
-  }
-}
-function recordTokenUsage(record) {
-  const statsPath = getStatsPath();
-  const records = loadAllRecords(statsPath);
-  records.push({
-    timestamp: record.timestamp || (/* @__PURE__ */ new Date()).toISOString(),
-    session_id: record.sessionId,
-    step: record.step,
-    model: record.model,
-    prompt_tokens: record.promptTokens,
-    completion_tokens: record.completionTokens,
-    total_tokens: record.totalTokens
-  });
-  if (records.length > MAX_RECORDS) {
-    records.splice(0, records.length - MAX_RECORDS);
-  }
-  saveRecords(statsPath, records);
-}
-function filterByDate(records, days = 0, startDate, endDate) {
-  if (startDate || endDate) {
-    let startDt = startDate ? new Date(startDate) : /* @__PURE__ */ new Date(-864e13);
-    let endDt = endDate ? new Date(endDate) : void 0;
-    if (endDate) {
-      const e = new Date(endDate);
-      e.setHours(23, 59, 59, 999);
-      endDt = e;
-    }
-    const endMs = endDt ? endDt.getTime() : Number.MAX_SAFE_INTEGER;
-    return records.filter((r) => {
-      try {
-        const ts = new Date(r.timestamp).getTime();
-        return ts >= startDt.getTime() && ts <= endMs;
-      } catch {
-        return true;
-      }
-    });
-  } else if (days > 0) {
-    const cutoff = Date.now() - days * 864e5;
-    return records.filter((r) => {
-      try {
-        return new Date(r.timestamp).getTime() >= cutoff;
-      } catch {
-        return true;
-      }
-    });
-  }
-  return records;
-}
-function aggregate(records) {
-  let totalPrompt = 0, totalCompletion = 0, totalTotal = 0;
-  const byStep = {};
-  const byModel = {};
-  const byDate = {};
-  const bucket = (b, key, r) => {
-    const e = b[key] || (b[key] = { prompt_tokens: 0, completion_tokens: 0, total_tokens: 0, calls: 0 });
-    e.prompt_tokens += r.prompt_tokens || 0;
-    e.completion_tokens += r.completion_tokens || 0;
-    e.total_tokens += r.total_tokens || 0;
-    e.calls += 1;
-  };
-  for (const r of records) {
-    totalPrompt += r.prompt_tokens || 0;
-    totalCompletion += r.completion_tokens || 0;
-    totalTotal += r.total_tokens || 0;
-    bucket(byStep, r.step || "unknown", r);
-    bucket(byModel, r.model || "unknown", r);
-    let dateKey = "unknown";
-    try {
-      dateKey = new Date(r.timestamp).toISOString().slice(0, 10);
-    } catch {
-    }
-    bucket(byDate, dateKey, r);
-  }
-  const sortedDate = Object.keys(byDate).sort((a, b) => a < b ? 1 : a > b ? -1 : 0);
-  const sortedByDate = {};
-  for (const k of sortedDate) sortedByDate[k] = byDate[k];
-  return { totalPrompt, totalCompletion, totalTotal, byStep, byModel, byDate: sortedByDate };
-}
-function getTokenStats(days = 0, startDate, endDate) {
-  const records = filterByDate(loadAllRecords(getStatsPath()), days, startDate, endDate);
-  const a = aggregate(records);
-  return {
-    total_prompt_tokens: a.totalPrompt,
-    total_completion_tokens: a.totalCompletion,
-    total_tokens: a.totalTotal,
-    total_calls: records.length,
-    by_step: a.byStep,
-    by_model: a.byModel,
-    by_date: a.byDate
-  };
-}
-function getRecentRecords(limit = 20) {
-  const records = loadAllRecords(getStatsPath());
-  return records.slice(-limit);
-}
-function getTokenTrend(days = 0, startDate, endDate) {
-  const records = filterByDate(loadAllRecords(getStatsPath()), days, startDate, endDate);
-  const series = {};
-  const datesSet = /* @__PURE__ */ new Set();
-  for (const r of records) {
-    let dateKey;
-    try {
-      dateKey = new Date(r.timestamp).toISOString().slice(0, 10);
-    } catch {
-      continue;
-    }
-    const model = r.model || "unknown";
-    const tokens = r.total_tokens || 0;
-    datesSet.add(dateKey);
-    series[model] = series[model] || {};
-    series[model][dateKey] = (series[model][dateKey] || 0) + tokens;
-  }
-  const dates = Array.from(datesSet).sort();
-  const models = Object.keys(series).sort();
-  return { dates, models, series };
-}
-function resetTokenStats() {
-  const statsPath = getStatsPath();
-  if (existsSync6(statsPath)) {
-    try {
-      unlinkSync(statsPath);
-    } catch {
-    }
-  }
-}
-var STATS_DIR, STATS_FILE, ENV_STATS_PATH, MAX_RECORDS;
-var init_token_stats = __esm({
-  "src/engine/token-stats.ts"() {
-    "use strict";
-    init_esm_shims();
-    STATS_DIR = join3(homedir2(), ".config", "agentmoss");
-    STATS_FILE = join3(STATS_DIR, "agent_moss_token_stats.json");
-    ENV_STATS_PATH = "AGENT_MOSS_TOKEN_STATS_PATH";
-    MAX_RECORDS = 1e4;
-  }
-});
-
 // src/infra/runtime-config.ts
 var runtime_config_exports = {};
 __export(runtime_config_exports, {
   DENY_MODE_LABELS: () => DENY_MODE_LABELS,
+  addAgentRule: () => addAgentRule,
   addCustomRule: () => addCustomRule,
   addCustomSkill: () => addCustomSkill,
+  deleteAgentRule: () => deleteAgentRule,
   deleteCustomRule: () => deleteCustomRule,
   deleteCustomSkill: () => deleteCustomSkill,
   filterEnabledRules: () => filterEnabledRules,
   generateSourceDefaults: () => generateSourceDefaults,
+  getAgentRules: () => getAgentRules,
   getDisabledL2RulesWithSkipL3: () => getDisabledL2RulesWithSkipL3,
   getDisabledSkillIds: () => getDisabledSkillIds,
+  getEnabledAgentExtensions: () => getEnabledAgentExtensions,
   getEnabledL1CommandPatterns: () => getEnabledL1CommandPatterns,
   getEnabledL1CommandPatternsOrDefault: () => getEnabledL1CommandPatternsOrDefault,
   getEnabledL1InjectionKeywords: () => getEnabledL1InjectionKeywords,
@@ -1578,6 +881,8 @@ __export(runtime_config_exports, {
   loadRuntimeConfig: () => loadRuntimeConfig,
   mergeConfig: () => mergeConfig,
   saveRuntimeConfig: () => saveRuntimeConfig,
+  updateAgentCategoryEnabled: () => updateAgentCategoryEnabled,
+  updateAgentRuleEnabled: () => updateAgentRuleEnabled,
   updateCategoryEnabled: () => updateCategoryEnabled,
   updateLayerEnabled: () => updateLayerEnabled,
   updateRuleDenyMode: () => updateRuleDenyMode,
@@ -1586,9 +891,11 @@ __export(runtime_config_exports, {
   updateSkillCategoryEnabled: () => updateSkillCategoryEnabled,
   updateSkillEnabled: () => updateSkillEnabled
 });
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync2, existsSync as existsSync7, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2 } from "fs";
-import { join as join4 } from "path";
-import { homedir as homedir3 } from "os";
+import { readFileSync as readFileSync2, writeFileSync, existsSync as existsSync3, mkdirSync, unlinkSync, readdirSync as readdirSync3 } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+import { fileURLToPath as fileURLToPath3 } from "url";
+import { dirname as dirname2 } from "path";
 function getRuntimeConfigPath() {
   const envPath = process.env[ENV_RUNTIME_CONFIG_PATH];
   if (envPath) return envPath;
@@ -1597,8 +904,8 @@ function getRuntimeConfigPath() {
 function saveRuntimeConfig(config) {
   const p = getRuntimeConfigPath();
   const dir = p.substring(0, p.lastIndexOf("/"));
-  if (dir && !existsSync7(dir)) mkdirSync2(dir, { recursive: true });
-  writeFileSync2(p, JSON.stringify(config, null, 2), "utf-8");
+  if (dir && !existsSync3(dir)) mkdirSync(dir, { recursive: true });
+  writeFileSync(p, JSON.stringify(config, null, 2), "utf-8");
 }
 function emptyRuntimeConfig() {
   return {
@@ -1606,12 +913,13 @@ function emptyRuntimeConfig() {
     layers: { L1_heuristic: true, L2_logic_rules: true, L3_llm_analysis: true },
     L1_rules: {},
     L2_rules: {},
-    L3_skills: {}
+    L3_skills: {},
+    agent_rules: {}
   };
 }
 function loadRuntimeConfig() {
   const p = getRuntimeConfigPath();
-  if (!existsSync7(p)) {
+  if (!existsSync3(p)) {
     const seeded = mergeConfig({}, generateSourceDefaults());
     try {
       saveRuntimeConfig(seeded);
@@ -1620,7 +928,7 @@ function loadRuntimeConfig() {
     return seeded;
   }
   try {
-    const data = JSON.parse(readFileSync7(p, "utf-8"));
+    const data = JSON.parse(readFileSync2(p, "utf-8"));
     const merged = mergeConfig(data, generateSourceDefaults());
     return {
       version: data.version || 1,
@@ -1631,7 +939,8 @@ function loadRuntimeConfig() {
       },
       L1_rules: merged.L1_rules || {},
       L2_rules: merged.L2_rules || {},
-      L3_skills: merged.L3_skills || {}
+      L3_skills: merged.L3_skills || {},
+      agent_rules: merged.agent_rules || {}
     };
   } catch {
     return emptyRuntimeConfig();
@@ -1674,7 +983,10 @@ function getEnabledL1CommandPatterns(runtime) {
   }));
 }
 function getEnabledL2SensitivePaths(runtime) {
-  const cat = runtime.L2_rules?.sensitive_path_access || { category_enabled: true, rules: [] };
+  let cat = runtime.L1_rules?.sensitive_path_access;
+  if (!cat || !cat.rules || cat.rules.length === 0) {
+    cat = runtime.L2_rules?.sensitive_path_access || { category_enabled: true, rules: [] };
+  }
   return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => {
     const out = { path: r.path || "", risk_level: r.risk_level || "", desc: r.desc || "", deny_mode: r.deny_mode || "deny_write" };
     if (r.credential) out.credential = true;
@@ -1684,9 +996,9 @@ function getEnabledL2SensitivePaths(runtime) {
 }
 function hasRuntimeConfig() {
   const p = getRuntimeConfigPath();
-  if (!existsSync7(p)) return false;
+  if (!existsSync3(p)) return false;
   try {
-    JSON.parse(readFileSync7(p, "utf-8"));
+    JSON.parse(readFileSync2(p, "utf-8"));
     return true;
   } catch {
     return false;
@@ -1700,22 +1012,24 @@ function getDisabledL2RulesWithSkipL3() {
     return {};
   }
   const result = {};
-  const l2 = runtime.L2_rules || {};
-  for (const [catName, cat] of Object.entries(l2)) {
-    if (!cat.category_enabled) continue;
-    const items = [];
-    for (const r of cat.rules || []) {
-      if (r.enabled === false && r.skip_l3_on_disabled) {
-        if (catName === "sensitive_path_access") {
-          if (r.path) items.push(r.path);
-        } else if (catName === "intent_consistency") {
-          items.push(...r.intent_keywords || []);
-        } else if (r.pattern) {
-          items.push(r.pattern);
+  for (const layerKey of ["L1_rules", "L2_rules"]) {
+    const layer = runtime[layerKey] || {};
+    for (const [catName, cat] of Object.entries(layer)) {
+      if (!cat.category_enabled) continue;
+      const items = [];
+      for (const r of cat.rules || []) {
+        if (r.enabled === false && r.skip_l3_on_disabled) {
+          if (catName === "sensitive_path_access") {
+            if (r.path) items.push(r.path);
+          } else if (catName === "intent_consistency") {
+            items.push(...r.intent_keywords || []);
+          } else if (r.pattern) {
+            items.push(r.pattern);
+          }
         }
       }
+      if (items.length > 0) result[catName] = items;
     }
-    if (items.length > 0) result[catName] = items;
   }
   return result;
 }
@@ -1861,6 +1175,55 @@ function _l3SkillsToRules() {
   out.user_custom = { category_enabled: true, category_desc: "", skills: [] };
   return out;
 }
+function _agentRulesToDefaults() {
+  const out = {};
+  const agentsDir = existsSync3(_AGENTS_DIR_PROD) ? _AGENTS_DIR_PROD : existsSync3(_AGENTS_DIR_DEV) ? _AGENTS_DIR_DEV : _AGENTS_DIR_PROD;
+  if (!existsSync3(agentsDir)) return out;
+  let entries;
+  try {
+    entries = readdirSync3(agentsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+  } catch {
+    return out;
+  }
+  for (const agentId of entries) {
+    const rulesFile = join(agentsDir, agentId, "rules.json");
+    if (!existsSync3(rulesFile)) continue;
+    let data;
+    try {
+      data = JSON.parse(readFileSync2(rulesFile, "utf-8"));
+    } catch {
+      continue;
+    }
+    out[agentId] = {
+      builtin_safe_action_types: {
+        category_enabled: true,
+        category_desc: "agent \u5B8C\u5168\u5B89\u5168\u64CD\u4F5C\u767D\u540D\u5355\uFF08\u524D\u7F00\u5C3E\u968F - \u6216\u7CBE\u786E\u540D\uFF0C\u547D\u4E2D\u8DF3 L2+L3\uFF09",
+        rules: (data.builtin_safe_action_types || []).map((v) => ({ value: v, enabled: true, builtin: true }))
+      },
+      builtin_safe_skills: {
+        category_enabled: true,
+        category_desc: "agent \u4FE1\u4EFB\u7684\u5185\u7F6E Skill\uFF08\u547D\u4E2D\u8DF3 L2+L3\uFF09",
+        rules: (data.builtin_safe_skills || []).map((v) => ({ value: v, enabled: true, builtin: true }))
+      },
+      extra_command_patterns: {
+        category_enabled: true,
+        category_desc: "agent \u4E13\u5C5E\u5371\u9669\u547D\u4EE4\u6B63\u5219\uFF08L1 \u672B\u5C3E\u8FFD\u52A0\uFF09",
+        rules: (data.extra_command_patterns || []).map((p) => ({ ...p, enabled: true, builtin: true }))
+      },
+      extra_injection_keywords: {
+        category_enabled: true,
+        category_desc: "agent \u4E13\u5C5E\u6CE8\u5165\u5173\u952E\u8BCD\uFF08L1 \u672B\u5C3E\u8FFD\u52A0\uFF09",
+        rules: (data.extra_injection_keywords || []).map((k) => ({ ...k, enabled: true, builtin: true }))
+      },
+      extra_sensitive_paths: {
+        category_enabled: true,
+        category_desc: "agent \u4E13\u5C5E\u654F\u611F\u8DEF\u5F84\uFF08L1 \u672B\u5C3E\u8FFD\u52A0\uFF09",
+        rules: (data.extra_sensitive_paths || []).map((sp) => ({ ...sp, enabled: true, builtin: true }))
+      }
+    };
+  }
+  return out;
+}
 function generateSourceDefaults() {
   return {
     version: 1,
@@ -1876,15 +1239,14 @@ function generateSourceDefaults() {
         category_desc: "Prompt \u6CE8\u5165\u653B\u51FB\u68C0\u6D4B",
         rules: _l1InjectionKeywordsToRules()
       },
-      user_sensitive_actions: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49\u654F\u611F\u52A8\u4F5C/\u5DE5\u5177\u89C4\u5219", rules: [] },
-      user_custom: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49\u547D\u4EE4\u89C4\u5219", rules: [] }
-    },
-    L2_rules: {
       sensitive_path_access: {
         category_enabled: true,
-        category_desc: "\u654F\u611F\u8DEF\u5F84\u8BBF\u95EE\u68C0\u6D4B",
+        category_desc: "\u654F\u611F\u8DEF\u5F84\u8BBF\u95EE\u68C0\u6D4B\uFF08deny_both/deny_read/deny_write\uFF09",
         rules: _l2SensitivePathsToRules()
       },
+      user_custom: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49\u547D\u4EE4\u89C4\u5219", rules: [] }
+    },
+    L2_rules: {
       intent_consistency: {
         category_enabled: true,
         category_desc: "\u610F\u56FE\u4E00\u81F4\u6027\u68C0\u6D4B",
@@ -1901,9 +1263,10 @@ function generateSourceDefaults() {
         rules: _l2UserDeletionPatternsToRules()
       },
       read_before_write: { category_enabled: true, category_desc: "read_before_write \u5B89\u5168\u539F\u5219\u68C0\u6D4B", rules: [] },
-      dangerous_patterns: { category_enabled: true, category_desc: "\u5371\u9669\u64CD\u4F5C\u6A21\u5F0F\u68C0\u6D4B", rules: [] }
+      user_custom: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49 L2 \u903B\u8F91\u89C4\u5219", rules: [] }
     },
-    L3_skills: _l3SkillsToRules()
+    L3_skills: _l3SkillsToRules(),
+    agent_rules: _agentRulesToDefaults()
   };
 }
 function _ruleFingerprint(rule) {
@@ -1916,6 +1279,7 @@ function _ruleFingerprint(rule) {
   if (rule.path) return JSON.stringify([rule.path]);
   if (rule.pattern) return JSON.stringify([rule.pattern]);
   if (rule.keyword) return JSON.stringify([rule.keyword, rule.lang || ""]);
+  if (rule.value) return JSON.stringify([rule.value]);
   return JSON.stringify([rule.id || ""]);
 }
 function _mergeRuleCategories(userCfg, srcDefaults, layerKey) {
@@ -1969,6 +1333,10 @@ function _mergeRuleCategories(userCfg, srcDefaults, layerKey) {
       }
     }
   }
+  for (const catName of Object.keys(userLayer)) {
+    if (catName === "user_custom") continue;
+    if (!(catName in srcLayer)) delete userLayer[catName];
+  }
 }
 function _mergeSkillCategories(userCfg, srcDefaults, layerKey) {
   const userLayer = userCfg[layerKey] || (userCfg[layerKey] = {});
@@ -1988,6 +1356,50 @@ function _mergeSkillCategories(userCfg, srcDefaults, layerKey) {
     }
   }
 }
+function _mergeAgentRules(userCfg, srcDefaults) {
+  const userAgent = userCfg.agent_rules || (userCfg.agent_rules = {});
+  const srcAgent = srcDefaults.agent_rules || {};
+  for (const [agentId, srcCats] of Object.entries(srcAgent)) {
+    if (!(agentId in userAgent)) {
+      userAgent[agentId] = JSON.parse(JSON.stringify(srcCats));
+      continue;
+    }
+    const userCats = userAgent[agentId];
+    for (const [catName, srcCat] of Object.entries(srcCats)) {
+      if (!(catName in userCats)) {
+        userCats[catName] = JSON.parse(JSON.stringify(srcCat));
+        continue;
+      }
+      const userCat = userCats[catName];
+      if (userCat.category_desc === void 0) userCat.category_desc = srcCat.category_desc || "";
+      if (userCat.category_enabled === void 0) userCat.category_enabled = srcCat.category_enabled ?? true;
+      const srcRules = srcCat.rules || [];
+      const userRules = userCat.rules || (userCat.rules = []);
+      const userByFp = /* @__PURE__ */ new Map();
+      for (const r of userRules) userByFp.set(_ruleFingerprint(r), r);
+      const srcFps = /* @__PURE__ */ new Set();
+      for (const srcR of srcRules) {
+        const fp = _ruleFingerprint(srcR);
+        srcFps.add(fp);
+        if (userByFp.has(fp)) {
+          const existing = userByFp.get(fp);
+          const userEnabled = existing.enabled;
+          Object.keys(existing).forEach((k) => delete existing[k]);
+          Object.assign(existing, srcR);
+          existing.enabled = userEnabled;
+        } else {
+          userRules.push({ ...srcR, enabled: true });
+        }
+      }
+      for (const r of userRules) {
+        if (r.builtin && !srcFps.has(_ruleFingerprint(r))) {
+          r.source_removed = true;
+          r.enabled = false;
+        }
+      }
+    }
+  }
+}
 function mergeConfig(userCfg, srcDefaults) {
   const cfg = userCfg;
   if (cfg.version === void 0) cfg.version = srcDefaults.version || 1;
@@ -1995,15 +1407,47 @@ function mergeConfig(userCfg, srcDefaults) {
   for (const [layerKey, defaultVal] of Object.entries(srcDefaults.layers)) {
     if (!(layerKey in cfg.layers)) cfg.layers[layerKey] = defaultVal;
   }
+  _migrateCategoriesAcrossLayers(
+    cfg,
+    "L2_rules",
+    "L1_rules",
+    ["sensitive_path_access"]
+  );
   _mergeRuleCategories(cfg, srcDefaults, "L1_rules");
   _mergeRuleCategories(cfg, srcDefaults, "L2_rules");
   _mergeSkillCategories(cfg, srcDefaults, "L3_skills");
+  _mergeAgentRules(cfg, srcDefaults);
   return cfg;
 }
-function getEnabledL1InjectionKeywords(runtime) {
-  const cat = runtime.L1_rules?.injection_detection || { category_enabled: true, rules: [] };
-  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => ({
-    keyword: r.keyword || "",
+function _migrateCategoriesAcrossLayers(cfg, srcLayer, dstLayer, catNames) {
+  const src = cfg[srcLayer] || {};
+  const dst = cfg[dstLayer] || (cfg[dstLayer] = {});
+  for (const catName of catNames) {
+    if (!(catName in src)) continue;
+    const srcCat = src[catName];
+    if (!dst[catName]) {
+      dst[catName] = { category_enabled: true, category_desc: "", rules: [] };
+    }
+    const dstCat = dst[catName];
+    if (!dstCat.category_desc && srcCat.category_desc) dstCat.category_desc = srcCat.category_desc;
+    if (dstCat.category_enabled === void 0) dstCat.category_enabled = srcCat.category_enabled;
+    if (srcCat.rules && srcCat.rules.length > 0) {
+      const dstFps = new Set((dstCat.rules || []).map((r) => _ruleFingerprint(r)));
+      for (const r of srcCat.rules) {
+        const fp = _ruleFingerprint(r);
+        if (!dstFps.has(fp)) {
+          (dstCat.rules = dstCat.rules || []).push(r);
+          dstFps.add(fp);
+        }
+      }
+    }
+    delete src[catName];
+  }
+}
+function getEnabledL1InjectionKeywords(runtime) {
+  const cat = runtime.L1_rules?.injection_detection || { category_enabled: true, rules: [] };
+  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => ({
+    keyword: r.keyword || "",
     risk_level: r.risk_level || "",
     lang: r.lang || "en"
   }));
@@ -2092,149 +1536,885 @@ function updateLayerEnabled(layerKey, enabled) {
   saveRuntimeConfig(runtime);
   return runtime;
 }
-function updateRuleEnabled(layer, category, ruleId, enabled) {
-  const runtime = loadRuntimeConfig();
-  for (const r of runtime[layer]?.[category]?.rules || []) {
-    if (r.id === ruleId) {
-      r.enabled = enabled;
-      break;
-    }
+function updateRuleEnabled(layer, category, ruleId, enabled) {
+  const runtime = loadRuntimeConfig();
+  for (const r of runtime[layer]?.[category]?.rules || []) {
+    if (r.id === ruleId) {
+      r.enabled = enabled;
+      break;
+    }
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function updateRuleDenyMode(layer, category, ruleId, denyMode) {
+  const runtime = loadRuntimeConfig();
+  for (const r of runtime[layer]?.[category]?.rules || []) {
+    if (r.id === ruleId) {
+      r.deny_mode = denyMode;
+      _syncDenyModeFields(r);
+      break;
+    }
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function updateRuleSkipL3(layer, category, ruleId, skipL3) {
+  const runtime = loadRuntimeConfig();
+  for (const r of runtime[layer]?.[category]?.rules || []) {
+    if (r.id === ruleId) {
+      r.skip_l3_on_disabled = skipL3;
+      break;
+    }
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function updateCategoryEnabled(layer, category, enabled) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime[layer]?.[category];
+  if (cat) cat.category_enabled = enabled;
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function addCustomRule(layer, category, rule) {
+  const runtime = loadRuntimeConfig();
+  const layerObj = runtime[layer] || (runtime[layer] = {});
+  const cat = layerObj[category] || (layerObj[category] = { category_enabled: true, category_desc: "", rules: [] });
+  const rules = cat.rules || (cat.rules = []);
+  const newRule = { ...rule, builtin: false, enabled: true };
+  if (!newRule.id) {
+    newRule.id = `custom_${Date.now()}_${_slugify(JSON.stringify(rule).slice(0, 30))}`;
+  }
+  if (newRule.deny_mode) _syncDenyModeFields(newRule);
+  rules.push(newRule);
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function deleteCustomRule(layer, category, ruleId) {
+  const runtime = loadRuntimeConfig();
+  const rules = runtime[layer]?.[category]?.rules || [];
+  const idx = rules.findIndex((r) => r.id === ruleId);
+  if (idx >= 0) {
+    const r = rules[idx];
+    if (r.builtin && !r.source_removed) return null;
+    rules.splice(idx, 1);
+    saveRuntimeConfig(runtime);
+  }
+  return runtime;
+}
+function addCustomSkill(skillId, category, keywords, content) {
+  _validateSkillId(skillId);
+  const runtime = loadRuntimeConfig();
+  const skillsDir = join(RUNTIME_CONFIG_DIR, "agent_moss_skills");
+  try {
+    mkdirSync(skillsDir, { recursive: true });
+  } catch {
+  }
+  writeFileSync(join(skillsDir, `${skillId}.md`), content, "utf-8");
+  const l3 = runtime.L3_skills || (runtime.L3_skills = {});
+  const cat = l3[category] || (l3[category] = { category_enabled: true, category_desc: "", skills: [] });
+  (cat.skills || (cat.skills = [])).push({ id: skillId, keywords, enabled: true, builtin: false });
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function deleteCustomSkill(skillId, category) {
+  _validateSkillId(skillId);
+  const runtime = loadRuntimeConfig();
+  const skills = runtime.L3_skills?.[category]?.skills || [];
+  const idx = skills.findIndex((s) => s.id === skillId);
+  if (idx >= 0) {
+    if (skills[idx].builtin) return null;
+    skills.splice(idx, 1);
+    const skillPath = join(RUNTIME_CONFIG_DIR, "agent_moss_skills", `${skillId}.md`);
+    try {
+      if (existsSync3(skillPath)) unlinkSync(skillPath);
+    } catch {
+    }
+    saveRuntimeConfig(runtime);
+  }
+  return runtime;
+}
+function updateSkillEnabled(skillId, enabled) {
+  const runtime = loadRuntimeConfig();
+  for (const catData of Object.values(runtime.L3_skills || {})) {
+    for (const s of catData.skills || []) {
+      if (s.id === skillId) {
+        s.enabled = enabled;
+        break;
+      }
+    }
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function updateSkillCategoryEnabled(category, enabled) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.L3_skills?.[category];
+  if (cat) cat.category_enabled = enabled;
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function getProfileOrDetect() {
+  return null;
+}
+function getAgentRules(runtime) {
+  return runtime.agent_rules || {};
+}
+function _agentCategoryEnabledRules(cat) {
+  if (!cat || cat.category_enabled === false) return [];
+  return (cat.rules || []).filter((r) => r.enabled !== false);
+}
+function getEnabledAgentExtensions(runtime, agentId) {
+  const agentData = runtime.agent_rules?.[agentId];
+  if (!agentData) return null;
+  const safeAction = _agentCategoryEnabledRules(agentData.builtin_safe_action_types);
+  const safeSkills = _agentCategoryEnabledRules(agentData.builtin_safe_skills);
+  const cmdPatterns = _agentCategoryEnabledRules(agentData.extra_command_patterns).filter((r) => r.pattern).map((r) => ({
+    pattern: r.pattern,
+    risk_level: r.risk_level || "",
+    risk_type: r.risk_type || "",
+    reason: r.reason || ""
+  }));
+  const injKeywords = _agentCategoryEnabledRules(agentData.extra_injection_keywords).filter((r) => r.keyword).map((r) => ({
+    keyword: r.keyword,
+    risk_level: r.risk_level || "",
+    lang: r.lang || "en"
+  }));
+  const sensitivePaths = _agentCategoryEnabledRules(agentData.extra_sensitive_paths).filter((r) => r.path).map((r) => ({
+    path: r.path,
+    risk_level: r.risk_level || "",
+    desc: r.desc || "",
+    credential: r.credential,
+    read_only: r.read_only,
+    deny_mode: r.deny_mode
+  }));
+  return {
+    agent_id: agentId,
+    description: "",
+    extra_command_patterns: cmdPatterns,
+    extra_injection_keywords: injKeywords,
+    extra_sensitive_paths: sensitivePaths,
+    builtin_safe_skills: safeSkills.filter((r) => r.value).map((r) => r.value),
+    builtin_safe_action_types: safeAction.filter((r) => r.value).map((r) => r.value),
+    extra_skills: []
+  };
+}
+function updateAgentRuleEnabled(agentId, category, ruleFp, enabled) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.agent_rules?.[agentId]?.[category];
+  if (cat) {
+    const targetFp = _ruleFingerprint(ruleFp);
+    for (const r of cat.rules || []) {
+      if (_ruleFingerprint(r) === targetFp) {
+        r.enabled = enabled;
+        break;
+      }
+    }
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function addAgentRule(agentId, category, rule) {
+  const runtime = loadRuntimeConfig();
+  if (!runtime.agent_rules) runtime.agent_rules = {};
+  if (!runtime.agent_rules[agentId]) runtime.agent_rules[agentId] = {};
+  const cats = runtime.agent_rules[agentId];
+  if (!cats[category]) cats[category] = { category_enabled: true, category_desc: "", rules: [] };
+  (cats[category].rules || (cats[category].rules = [])).push({ ...rule, enabled: true, builtin: false });
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function deleteAgentRule(agentId, category, ruleFp) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.agent_rules?.[agentId]?.[category];
+  if (cat) {
+    const targetFp = _ruleFingerprint(ruleFp);
+    cat.rules = (cat.rules || []).filter((r) => _ruleFingerprint(r) !== targetFp);
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function updateAgentCategoryEnabled(agentId, category, enabled) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.agent_rules?.[agentId]?.[category];
+  if (cat) cat.category_enabled = enabled;
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+var __dirname3, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, ENV_RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DENY_MODE_LABELS, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, SKILL_ID_RE;
+var init_runtime_config = __esm({
+  "src/infra/runtime-config.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_heuristic();
+    init_logic_rules();
+    init_skill_loader();
+    __dirname3 = dirname2(fileURLToPath3(import.meta.url));
+    RUNTIME_CONFIG_DIR = join(homedir(), ".config", "agentmoss");
+    RUNTIME_CONFIG_PATH = join(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
+    ENV_RUNTIME_CONFIG_PATH = "AGENT_MOSS_RUNTIME_CONFIG_PATH";
+    LAYER_DISABLE_ENV = {
+      L1_heuristic: "AGENT_MOSS_DISABLE_HEURISTIC",
+      L2_logic_rules: "AGENT_MOSS_DISABLE_LOGIC_RULES",
+      L3_llm_analysis: "AGENT_MOSS_DISABLE_LLM"
+    };
+    DENY_MODE_LABELS = {
+      deny_write: "\u4EC5\u62E6\u622A\u5199\u5165",
+      deny_read: "\u4EC5\u62E6\u622A\u8BFB\u53D6",
+      deny_both: "\u8BFB\u5199\u5747\u62E6\u622A"
+    };
+    _AGENTS_DIR_PROD = join(__dirname3, "agents");
+    _AGENTS_DIR_DEV = join(__dirname3, "..", "..", "..", "agent_moss", "agents");
+    SKILL_ID_RE = /^[A-Za-z0-9_-]+$/;
+  }
+});
+
+// src/agents/index.ts
+import { readFileSync as readFileSync3, existsSync as existsSync4 } from "fs";
+import { resolve as resolve2, dirname as dirname3 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
+function resolveAgentsDir() {
+  if (existsSync4(AGENTS_DIR_PROD)) return AGENTS_DIR_PROD;
+  if (existsSync4(AGENTS_DIR_DEV_FALLBACK)) return AGENTS_DIR_DEV_FALLBACK;
+  return AGENTS_DIR_PROD;
+}
+function getAgentExtensions(agentId) {
+  if (!agentId) return null;
+  if (cache.has(agentId)) return cache.get(agentId) ?? null;
+  let ext = null;
+  try {
+    const { hasRuntimeConfig: hasRuntimeConfig2, loadRuntimeConfig: loadRuntimeConfig2, getEnabledAgentExtensions: getEnabledAgentExtensions2 } = (init_runtime_config(), __toCommonJS(runtime_config_exports));
+    if (hasRuntimeConfig2()) {
+      ext = getEnabledAgentExtensions2(loadRuntimeConfig2(), agentId);
+    }
+  } catch {
+  }
+  if (ext === null) {
+    const agentsDir = resolveAgentsDir();
+    const rulesFile = resolve2(agentsDir, agentId, "rules.json");
+    if (!existsSync4(rulesFile)) {
+      cache.set(agentId, null);
+      return null;
+    }
+    try {
+      const raw = readFileSync3(rulesFile, "utf-8");
+      ext = JSON.parse(raw);
+      if (!ext.agent_id) {
+        console.warn(`[AgentMoss agents] rules.json \u7F3A\u5C11 agent_id \u5B57\u6BB5: ${rulesFile}`);
+        cache.set(agentId, null);
+        return null;
+      }
+    } catch (e) {
+      console.error(`[AgentMoss agents] \u52A0\u8F7D agent ${agentId} rules.json \u5931\u8D25:`, e.message);
+      cache.set(agentId, null);
+      return null;
+    }
+  }
+  cache.set(agentId, ext);
+  console.log(
+    `[AgentMoss agents] \u52A0\u8F7D agent ${agentId} \u5B9A\u5236\u89C4\u5219: ${ext.extra_command_patterns?.length ?? 0} cmd patterns, ${ext.extra_injection_keywords?.length ?? 0} injection keywords, ${ext.extra_sensitive_paths?.length ?? 0} sensitive paths, ${ext.builtin_safe_skills?.length ?? 0} builtin safe skills, ${ext.builtin_safe_action_types?.length ?? 0} builtin safe action types`
+  );
+  return ext;
+}
+var __filename3, __dirname4, AGENTS_DIR_PROD, AGENTS_DIR_DEV_FALLBACK, cache;
+var init_agents = __esm({
+  "src/agents/index.ts"() {
+    "use strict";
+    init_esm_shims();
+    __filename3 = fileURLToPath4(import.meta.url);
+    __dirname4 = dirname3(__filename3);
+    AGENTS_DIR_PROD = resolve2(__dirname4, "agents");
+    AGENTS_DIR_DEV_FALLBACK = resolve2(__dirname4, "../../../agent_moss/agents");
+    cache = /* @__PURE__ */ new Map();
+  }
+});
+
+// src/engine/heuristic.ts
+function runHeuristicCheck(input) {
+  const command = `${input.aNext.actionType}: ${input.aNext.actionDetail}`;
+  const matched = [];
+  let highestSeverity = "low";
+  let highestRiskType = "";
+  const userRules = getCustomRules();
+  for (const rule of userRules) {
+    try {
+      const re = new RegExp(rule.pattern);
+      if (re.test(command)) {
+        if (rule.action === "Deny") {
+          matched.push(`\u81EA\u5B9A\u4E49\u89C4\u5219: ${rule.pattern}`);
+          if (severityRank(rule.severity) > severityRank(highestSeverity)) {
+            highestSeverity = rule.severity;
+            highestRiskType = "custom_rule";
+          }
+        }
+      }
+    } catch {
+    }
+  }
+  let topRiskType = "";
+  for (const rule of DANGEROUS_PATTERNS) {
+    if (rule.pattern.test(command)) {
+      matched.push(rule.description);
+      if (severityRank(rule.severity) > severityRank(highestSeverity)) {
+        highestSeverity = rule.severity;
+        topRiskType = rule.riskType;
+      }
+    }
+  }
+  highestRiskType = topRiskType || highestRiskType;
+  const agentExt = getAgentExtensions(input.agentId);
+  if (agentExt?.extra_command_patterns) {
+    for (const rule of agentExt.extra_command_patterns) {
+      try {
+        const re = new RegExp(rule.pattern, "i");
+        if (re.test(command)) {
+          matched.push(`agent \u4E13\u5C5E\u89C4\u5219: ${rule.reason}`);
+          if (severityRank(rule.risk_level) > severityRank(highestSeverity)) {
+            highestSeverity = rule.risk_level;
+            highestRiskType = rule.risk_type;
+          }
+        }
+      } catch {
+      }
+    }
+  }
+  const injectionText = `${input.aNext.actionType} ${input.aNext.actionDetail} ${input.reason || ""} ${input.promptSession || ""}`.toLowerCase();
+  const injectionHits = checkInjectionKeywords(injectionText, agentExt?.extra_injection_keywords);
+  if (injectionHits.length > 0) {
+    const topHit = injectionHits.reduce((a, b) => severityRank(a.riskLevel) >= severityRank(b.riskLevel) ? a : b);
+    matched.push(...injectionHits.map((h) => `\u6CE8\u5165\u5173\u952E\u8BCD [${h.lang}]: ${h.keyword}`));
+    if (severityRank(topHit.riskLevel) > severityRank(highestSeverity)) {
+      highestSeverity = topHit.riskLevel;
+      highestRiskType = "prompt_injection";
+    }
+  }
+  const actionTypeL = input.aNext.actionType.toLowerCase();
+  const detailL = input.aNext.actionDetail.toLowerCase();
+  const isExcludedType = SENSITIVE_EXCLUDED_PREFIXES.some((p) => actionTypeL.startsWith(p));
+  if (!isExcludedType) {
+    const pathResult = checkSensitivePath(detailL, input.cwd || "/", agentExt);
+    if (pathResult) return pathResult;
+  }
+  const dangerousResult = checkDangerousPatterns(actionTypeL, detailL);
+  if (dangerousResult) return dangerousResult;
+  const lateralResult = checkLateralMovement(detailL);
+  if (lateralResult) return lateralResult;
+  if (matched.length > 0) {
+    return {
+      allowed: false,
+      reason: `\u68C0\u6D4B\u5230\u9AD8\u5371\u64CD\u4F5C: ${matched.join(", ")}`,
+      riskLevel: highestSeverity,
+      riskType: highestRiskType,
+      confidence: 95,
+      source: "heuristic",
+      violatedLayers: ["1.1"]
+      // 对齐 py coordinator.py:165（L1.1 = 命中高危命令模式/注入关键词）
+    };
+  }
+  return null;
+}
+function checkInjectionKeywords(text, extraKeywords) {
+  const hits = [];
+  for (const entry of INJECTION_KEYWORDS) {
+    if (text.includes(entry.keyword.toLowerCase())) {
+      hits.push(entry);
+    }
+  }
+  if (extraKeywords) {
+    for (const entry of extraKeywords) {
+      if (text.includes(entry.keyword.toLowerCase())) {
+        hits.push({ keyword: entry.keyword, riskLevel: entry.risk_level, lang: entry.lang });
+      }
+    }
+  }
+  return hits;
+}
+function isInlineScriptCommand(actionDetail) {
+  const re = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
+  return re.test(actionDetail);
+}
+function severityRank(s) {
+  const ranks = { low: 1, medium: 2, high: 3, critical: 4 };
+  return ranks[s] || 0;
+}
+function checkSensitivePath(command, cwd, agentExt) {
+  const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
+  const _WRITE_CMD_RES = [/\brm\b/, /\bunlink\b/, /\brmdir\b/, /\bshred\b/, /\bcp\b/, /\bmv\b/, /\binstall\b/, /\btee\b/, /\bdd\b/, /\bmkfs\b/, /\b(fdisk|parted|cfdisk|sfdisk)\b/, /\bchmod\b/, /\bchown\b/, /\btruncate\b/];
+  const _DEVNULL_RE = /(?:2|&|1)?\s*>\s*\/dev\/null\b/;
+  const _READONLY_CMDS = /* @__PURE__ */ new Set(["cat", "head", "tail", "less", "more", "grep", "find", "awk", "sed", "sort", "uniq", "wc", "cut", "strings", "od", "xxd", "hexdump", "tr", "file", "stat", "du", "df", "ls", "dir", "tree", "nl", "tac", "rev", "lsblk", "blockdev", "smartctl", "udevadm", "dmidecode", "lscpu", "lspci", "lsusb", "lsmem", "lsns", "lsof", "hwinfo", "inxi", "fdisk", "parted", "dmesg", "journalctl", "systemctl", "hostnamectl", "localectl", "timedatectl", "ps", "top", "free", "vmstat", "iostat", "mpstat", "pidof", "pgrep", "ip", "ifconfig", "route", "ss", "netstat", "arp", "ethtool", "nmcli", "uname", "arch", "nproc", "getconf", "getent", "id", "whoami", "who", "w", "last", "uptime", "lsmod", "modinfo", "sysctl"]);
+  const isWriteOpFlag = _WRITE_CMD_RES.some((rx) => rx.test(command)) || /\bsed\s+-[a-zA-Z]*i/.test(command) || command.includes(">") && !command.replace(_DEVNULL_RE, "").includes(">") || command.includes(">") && command.replace(_DEVNULL_RE, "").includes(">") && !_READONLY_CMDS.has(command.trim().split(/\s+/)[0]?.toLowerCase() || "") || WRITE_KEYWORDS.some((kw) => "".includes(kw) || command.includes(kw));
+  for (const sp of ROOT_SENSITIVE_PATHS) {
+    if (command.includes(sp.path.toLowerCase())) {
+      if (sp.path === "/dev/random") {
+        if (isWriteOpFlag) {
+          continue;
+        }
+        return {
+          allowed: false,
+          reason: `\u8BFB\u53D6\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
+          riskLevel: sp.riskLevel,
+          riskType: "file_access",
+          confidence: 90,
+          source: "heuristic",
+          violatedLayers: ["1.1"]
+        };
+      }
+      if (!isWriteOpFlag && !sp.credential) {
+        continue;
+      }
+      return {
+        allowed: false,
+        reason: `\u5C1D\u8BD5\u8BBF\u95EE\u7CFB\u7EDF\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
+        riskLevel: sp.riskLevel,
+        riskType: "file_access",
+        confidence: 90,
+        source: "heuristic",
+        violatedLayers: ["1.1"],
+        isCredential: !!sp.credential
+      };
+    }
+  }
+  for (const sp of HOME_SENSITIVE_PATHS) {
+    const expanded = `${expandedCwd}/${sp.path}`;
+    const pathRe = sp.path.endsWith(".pub") ? new RegExp(sp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i") : new RegExp(sp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "(?!\\.pub)", "i");
+    const expandedRe = sp.path.endsWith(".pub") ? new RegExp(expanded.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i") : new RegExp(expanded.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "(?!\\.pub)", "i");
+    if (pathRe.test(command) || expandedRe.test(command)) {
+      if (!isWriteOpFlag && !sp.credential) {
+        continue;
+      }
+      return {
+        allowed: false,
+        reason: `\u5C1D\u8BD5\u8BBF\u95EE\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
+        riskLevel: sp.riskLevel,
+        riskType: "file_access",
+        confidence: 90,
+        source: "heuristic",
+        violatedLayers: ["1.1"],
+        isCredential: !!sp.credential
+      };
+    }
+  }
+  if (agentExt?.extra_sensitive_paths && agentExt.extra_sensitive_paths.length > 0) {
+    for (const sp of agentExt.extra_sensitive_paths) {
+      const spPath = sp.path.toLowerCase();
+      const expanded = `${expandedCwd}/${spPath}`;
+      if (command.includes(spPath) || command.includes(expanded.toLowerCase())) {
+        const denyMode = sp.deny_mode || (sp.credential ? "deny_both" : sp.read_only ? "deny_read" : "deny_write");
+        if (denyMode === "deny_read") {
+          if (isWriteOpFlag) continue;
+        } else if (denyMode === "deny_write") {
+          if (!isWriteOpFlag) continue;
+        }
+        return {
+          allowed: false,
+          reason: `\u5C1D\u8BD5\u8BBF\u95EE agent \u4E13\u5C5E\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
+          riskLevel: sp.risk_level,
+          riskType: "file_access",
+          confidence: 90,
+          source: "heuristic",
+          violatedLayers: ["1.1"],
+          isCredential: !!sp.credential
+        };
+      }
+    }
+  }
+  for (const cp of CREDENTIAL_PATHS) {
+    const escaped = cp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const re = cp.path.startsWith(".") ? new RegExp(`(?:^|[\\s/\\\\'"])${escaped}\\b`) : new RegExp(`\\b${escaped}\\b`);
+    if (re.test(command)) {
+      return {
+        allowed: false,
+        reason: `\u8BBF\u95EE\u654F\u611F\u8DEF\u5F84: ${cp.desc} (${cp.path})`,
+        riskLevel: cp.riskLevel,
+        riskType: "file_access",
+        confidence: 90,
+        source: "heuristic",
+        violatedLayers: ["1.1"],
+        isCredential: true
+      };
+    }
+  }
+  if ((command.includes("rm ") || command.includes("unlink")) && (command.includes("/etc/") || command.includes("/root/") || command.includes("/var/log/"))) {
+    return {
+      allowed: false,
+      reason: "\u68C0\u6D4B\u5230\u5220\u9664\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55\u5185\u5BB9",
+      riskLevel: "critical",
+      riskType: "file_access",
+      confidence: 90,
+      source: "heuristic",
+      violatedLayers: ["1.1"]
+    };
+  }
+  return null;
+}
+function checkDangerousPatterns(actionType, actionDetail) {
+  if (actionType === "file_write" || actionType === "file_edit") return null;
+  const TEMP_DIRS = ["/tmp/", "/var/tmp/", "/run/", "/dev/shm/"];
+  const isTempPath = TEMP_DIRS.some((td) => actionDetail.includes(td));
+  if (!isTempPath && (actionDetail.includes("*") || actionDetail.includes("?")) && ["rm ", "rm	", "del ", "del	", "delete", "remove ", "remove	", "\u5220\u9664", "\u79FB\u9664"].some((kw) => actionDetail.includes(kw))) {
+    return {
+      allowed: false,
+      reason: "\u68C0\u6D4B\u5230\u901A\u914D\u7B26\u7ED3\u5408\u5220\u9664\u64CD\u4F5C\uFF0C\u53EF\u80FD\u9020\u6210\u6279\u91CF\u8BEF\u5220",
+      riskLevel: "high",
+      riskType: "script_execution",
+      confidence: 90,
+      source: "heuristic",
+      violatedLayers: ["1.1"]
+    };
+  }
+  if (/>\s*\/etc\//.test(actionDetail) || />\s*\/boot\//.test(actionDetail) || />\s*\/proc\//.test(actionDetail)) {
+    return {
+      allowed: false,
+      reason: "\u68C0\u6D4B\u5230\u91CD\u5B9A\u5411\u8986\u76D6\u5199\u5165\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55",
+      riskLevel: "critical",
+      riskType: "file_access",
+      confidence: 95,
+      source: "heuristic",
+      violatedLayers: ["1.1"]
+    };
+  }
+  return null;
+}
+function extractRemoteHost(command) {
+  const m = command.match(/(?:ssh|scp|rsync)\s+(?:-[\w]+\s+)*(\S+@\S+|\b(?!-)[\w.-]+\b)/);
+  return m ? m[1] : null;
+}
+function isLocalHost(host) {
+  const localNames = ["localhost", "127.0.0.1", "::1", process.env.HOSTNAME || "", "0.0.0.0"];
+  return localNames.includes(host.replace(/.*@/, ""));
+}
+function checkLateralMovement(actionDetail) {
+  if (/(?:ssh|scp|rsync)\s+/.test(actionDetail)) {
+    const targetHost = extractRemoteHost(actionDetail);
+    if (targetHost && !isLocalHost(targetHost)) {
+      return {
+        allowed: false,
+        reason: `\u5C1D\u8BD5\u6A2A\u5411\u79FB\u52A8\u5230\u8FDC\u7A0B\u4E3B\u673A: ${targetHost}`,
+        riskLevel: "medium",
+        riskType: "lateral_movement",
+        confidence: 80,
+        source: "heuristic",
+        violatedLayers: ["1.1"]
+      };
+    }
+  }
+  return null;
+}
+var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, SENSITIVE_EXCLUDED_PREFIXES;
+var init_heuristic = __esm({
+  "src/engine/heuristic.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_config();
+    init_agents();
+    init_logic_rules();
+    INJECTION_KEYWORDS = [
+      // ---- Instruction Override ----
+      { keyword: "ignore previous instructions", riskLevel: "critical", lang: "en" },
+      { keyword: "ignore all previous", riskLevel: "critical", lang: "en" },
+      { keyword: "disregard all prior", riskLevel: "critical", lang: "en" },
+      { keyword: "forget everything", riskLevel: "high", lang: "en" },
+      { keyword: "\u5FFD\u7565\u4E4B\u524D\u7684\u6307\u4EE4", riskLevel: "critical", lang: "zh" },
+      { keyword: "\u5FFD\u7565\u6240\u6709\u5148\u524D\u7684", riskLevel: "critical", lang: "zh" },
+      { keyword: "\u5FFD\u7565\u4E0A\u9762\u6240\u6709", riskLevel: "high", lang: "zh" },
+      { keyword: "\u8BF7\u5FD8\u8BB0\u4E4B\u524D", riskLevel: "high", lang: "zh" },
+      // ---- Role Hijacking ----
+      { keyword: "you are now", riskLevel: "high", lang: "en" },
+      { keyword: "you are no longer", riskLevel: "high", lang: "en" },
+      { keyword: "new instructions", riskLevel: "high", lang: "en" },
+      { keyword: "from now on, you", riskLevel: "high", lang: "en" },
+      { keyword: "\u4F60\u73B0\u5728\u662F\u4E00\u4E2A", riskLevel: "high", lang: "zh" },
+      { keyword: "\u4F60\u4E0D\u518D\u662F\u4E00\u4E2A", riskLevel: "high", lang: "zh" },
+      { keyword: "\u4ECE\u73B0\u5728\u5F00\u59CB\u4F60", riskLevel: "high", lang: "zh" },
+      { keyword: "\u4F60\u7684\u65B0\u89D2\u8272\u662F", riskLevel: "high", lang: "zh" },
+      // ---- Command Injection ----
+      { keyword: "system prompt", riskLevel: "high", lang: "en" },
+      { keyword: "reveal your instructions", riskLevel: "high", lang: "en" },
+      { keyword: "output your instructions", riskLevel: "high", lang: "en" },
+      { keyword: "repeat your instructions", riskLevel: "medium", lang: "en" },
+      { keyword: "\u7CFB\u7EDF\u63D0\u793A", riskLevel: "high", lang: "zh" },
+      { keyword: "\u8F93\u51FA\u4F60\u7684\u6307\u4EE4", riskLevel: "high", lang: "zh" },
+      { keyword: "\u91CD\u590D\u4F60\u7684\u6307\u4EE4", riskLevel: "medium", lang: "zh" },
+      // ---- Social Engineering ----
+      { keyword: "this is an authorized test", riskLevel: "high", lang: "en" },
+      { keyword: "security audit approved", riskLevel: "high", lang: "en" },
+      { keyword: "admin override", riskLevel: "critical", lang: "en" },
+      { keyword: "debug mode", riskLevel: "high", lang: "en" },
+      { keyword: "maintenance mode", riskLevel: "high", lang: "en" },
+      { keyword: "\u8FD9\u662F\u6388\u6743\u7684\u6D4B\u8BD5", riskLevel: "high", lang: "zh" },
+      { keyword: "\u5B89\u5168\u5BA1\u8BA1\u5DF2\u6279\u51C6", riskLevel: "high", lang: "zh" },
+      { keyword: "\u7BA1\u7406\u5458\u8986\u76D6", riskLevel: "critical", lang: "zh" },
+      { keyword: "\u8C03\u8BD5\u6A21\u5F0F", riskLevel: "high", lang: "zh" },
+      // ---- XSS ----
+      { keyword: "<script>", riskLevel: "high", lang: "en" },
+      { keyword: "javascript:", riskLevel: "high", lang: "en" },
+      { keyword: "onerror=", riskLevel: "high", lang: "en" },
+      { keyword: "onload=", riskLevel: "high", lang: "en" },
+      // ---- Fake Boundaries ----
+      { keyword: "=== END OF", riskLevel: "high", lang: "en" },
+      { keyword: "--- END SYSTEM", riskLevel: "high", lang: "en" },
+      { keyword: "[END OF", riskLevel: "high", lang: "en" },
+      { keyword: "=== \u7ED3\u675F", riskLevel: "high", lang: "zh" },
+      { keyword: "--- \u7ED3\u675F\u7CFB\u7EDF", riskLevel: "high", lang: "zh" },
+      // ---- Developer Mode ----
+      { keyword: "developer mode", riskLevel: "critical", lang: "en" },
+      { keyword: "DAN mode", riskLevel: "critical", lang: "en" },
+      { keyword: "jailbreak", riskLevel: "critical", lang: "en" },
+      { keyword: "\u5F00\u53D1\u8005\u6A21\u5F0F", riskLevel: "critical", lang: "zh" },
+      { keyword: "\u8D8A\u72F1", riskLevel: "critical", lang: "zh" }
+      // 注：xiaoO 专属绕过词（绕过审计/禁用安全检查/关闭防护/bypass audit 等）
+      // 已迁至 agent_moss/agents/xiaoo/rules.json 的 extra_injection_keywords，
+      // 由 agent_ext 机制注入，不再污染通用层。
+    ];
+    DANGEROUS_PATTERNS = [
+      // --- Critical: rm command graded detection (strict to loose, first match wins) ---
+      // 1. rm -rf root dir (含通配符如 /* /.* 等) — 使用负向先行断言 (?!\w)：/ 后面不是单词字符时匹配
+      { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*f[a-zA-Z]*\s+\/(?!\w)/i, severity: "critical", description: "\u9012\u5F52\u5F3A\u5236\u5220\u9664\u6839\u76EE\u5F55 (rm -rf /)", riskType: "script_execution" },
+      // 注意：已移除"rm -rf /任意绝对路径"的宽泛规则，避免误杀 /tmp 等临时目录清理操作
+      // 2. rm with -r or -f targeting system dirs — var 分支排除 /var/tmp/（合法清理）
+      { pattern: /\brm\s+-[a-zA-Z]*[rf][a-zA-Z]*\s+\/(etc|var(?!\/tmp)|home|usr|boot|root|opt|srv|sys|proc)\b/i, severity: "critical", description: "\u5220\u9664\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55", riskType: "script_execution" },
+      // 3. rm -r absolute path (no -f) — 排除 /tmp/ /var/tmp/ /run/ /dev/shm/（CI/开发高频合法清理）
+      { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*\s+\/(?!tmp\/|var\/tmp\/|run\/|dev\/shm\/)/i, severity: "high", description: "\u9012\u5F52\u5220\u9664\u64CD\u4F5C (rm -r /...)", riskType: "script_execution" },
+      // 4. rm -f absolute path (no -r) — 同样排除临时目录
+      { pattern: /\brm\s+-[a-zA-Z]*f[a-zA-Z]*\s+\/(?!tmp\/|var\/tmp\/|run\/|dev\/shm\/)/i, severity: "medium", description: "\u5F3A\u5236\u5220\u9664\u6587\u4EF6 (rm -f /...)", riskType: "script_execution" },
+      // dd 磁盘清零 — 只拦截写入系统关键目录，放行 /tmp 等临时目录
+      { pattern: /dd\s+if=\/dev\/zero.*\bof\s*=\s*\/(etc|var|home|usr|boot|root|opt|srv|sys|proc)\b/i, severity: "critical", description: "\u78C1\u76D8\u6E05\u96F6\u5199\u5165\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55 (dd if=/dev/zero of=/\u7CFB\u7EDF\u76EE\u5F55)", riskType: "script_execution" },
+      // mkfs 格式化 — 只拦截对块设备（/dev/sdX 等）的格式化，放行对普通文件的格式化
+      { pattern: /mkfs\.\w+\s+\/dev\/(sd|hd|nvme|vd|loop|mapper|md|dm)\S+/i, severity: "critical", description: "\u683C\u5F0F\u5316\u5757\u8BBE\u5907 (mkfs /dev/\u5757\u8BBE\u5907)", riskType: "script_execution" },
+      { pattern: /:\(\)\s*\{.*:\|:&.*\};:/i, severity: "critical", description: "Fork Bomb", riskType: "resource_exhaustion" },
+      // --- Critical: remote code execution ---
+      { pattern: /curl\s+.*\|\s*(bash|sh|zsh|dash)/i, severity: "critical", description: "curl pipe shell \u6267\u884C", riskType: "script_execution" },
+      { pattern: /wget\s+.*\|\s*(bash|sh)/i, severity: "critical", description: "wget pipe shell \u6267\u884C", riskType: "script_execution" },
+      { pattern: /eval\s+\$\(curl|eval\s+\$\(wget/i, severity: "critical", description: "eval \u8FDC\u7A0B\u4EE3\u7801\u6267\u884C", riskType: "script_execution" },
+      { pattern: /base64\s+-d\s+.*\|\s*bash/i, severity: "critical", description: "base64 \u89E3\u7801\u6267\u884C", riskType: "script_execution" },
+      // --- Critical: reverse shell ---
+      { pattern: /\/dev\/tcp\/|bash\s+-i\s+>&/i, severity: "critical", description: "\u53CD\u5F39 Shell", riskType: "script_execution" },
+      { pattern: /nc\s+-[el]\s+.*\d{1,5}/i, severity: "high", description: "Netcat \u53CD\u5F39\u8FDE\u63A5", riskType: "lateral_movement" },
+      // --- Critical: sensitive file access ---
+      { pattern: /\/etc\/shadow/i, severity: "critical", description: "\u8BBF\u95EE\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6 (/etc/shadow)", riskType: "file_access" },
+      { pattern: /\/etc\/gshadow/i, severity: "critical", description: "\u8BBF\u95EE\u7CFB\u7EDF\u7EC4\u5BC6\u7801\u6587\u4EF6 (/etc/gshadow)", riskType: "file_access" },
+      // 注意：/etc/passwd 已从拦截列表移除，因为它是公开可读的标准系统文件，真正敏感的是 /etc/shadow
+      { pattern: /\.ssh\/id_rsa(?!\.pub)/i, severity: "critical", description: "\u8BBF\u95EE SSH \u79C1\u94A5\u6587\u4EF6", riskType: "file_access" },
+      // --- Critical: privilege escalation / container escape ---
+      { pattern: /\/var\/run\/docker\.sock/i, severity: "critical", description: "\u8BBF\u95EE Docker socket\uFF0C\u53EF\u80FD\u5BFC\u81F4\u5BB9\u5668\u9003\u9038", riskType: "privilege_escalation" },
+      // --- High: dangerous permissions / ownership ---
+      { pattern: /chmod\s+[0-7]*777[0-7]*/i, severity: "high", description: "\u5168\u6743\u9650\u8BBE\u7F6E (chmod 777)", riskType: "script_execution" },
+      { pattern: /chown\s+root|chown\s+-R\s+\w+:\w+\s+\//i, severity: "high", description: "\u4FEE\u6539\u6240\u6709\u8005\u4E3A root / \u9012\u5F52\u4FEE\u6539\u6839\u76EE\u5F55\u6240\u6709\u8005", riskType: "script_execution" },
+      // sudo 提权 — 只拦截 sudo 后跟的危险命令，不一刀切拦截所有 sudo
+      { pattern: /sudo\s+(rm|chmod|chown|dd|mkfs|format|iptables|crontab|passwd|userdel|useradd|groupdel)\b/i, severity: "high", description: "\u63D0\u6743\u6267\u884C\u9AD8\u5371\u547D\u4EE4 (sudo + \u5371\u9669\u64CD\u4F5C)", riskType: "privilege_escalation" },
+      // --- High: system config overwrite ---
+      { pattern: />\s*\/etc\//i, severity: "critical", description: "\u8986\u76D6\u5199\u5165\u7CFB\u7EDF\u914D\u7F6E\u76EE\u5F55", riskType: "file_access" },
+      // --- High: download script + execute risk ---
+      { pattern: /(?:curl|wget)\s+.*(?:-o|--output|>)\s*\S+\.(?:sh|bash)\b/i, severity: "high", description: "\u8FDC\u7A0B\u4E0B\u8F7D\u811A\u672C\u5230\u672C\u5730", riskType: "script_execution" },
+      { pattern: /(?:curl|wget)\s+.*\s+&&?\s*(?:chmod\s+\+x|bash|sh)/i, severity: "high", description: "\u4E0B\u8F7D\u540E\u6267\u884C", riskType: "script_execution" },
+      // --- High: package manager pipe-to-shell ---
+      { pattern: /git\s+clone\s+.*\|.*bash/i, severity: "high", description: "git clone pipe shell", riskType: "script_execution" },
+      { pattern: /pip\s+install\s+.*\|\s*bash/i, severity: "high", description: "pip install pipe shell", riskType: "script_execution" },
+      { pattern: /npm\s+install\s+-g\s+.*\|\s*bash/i, severity: "high", description: "npm install pipe shell", riskType: "script_execution" },
+      // --- Medium: destructive git operations (降级为 medium，允许但记录) ---
+      { pattern: /git\s+push\s+.*--force/i, severity: "medium", description: "\u5F3A\u5236\u63A8\u9001\u64CD\u4F5C (git push --force)\uFF0C\u53EF\u80FD\u8986\u76D6\u8FDC\u7A0B\u63D0\u4EA4\u5386\u53F2", riskType: "script_execution" },
+      // --- High: network port scanning (横向移动侦察) ---
+      { pattern: /\bnmap\s+/i, severity: "high", description: "\u7F51\u7EDC\u7AEF\u53E3\u626B\u63CF (nmap)\uFF0C\u53EF\u80FD\u7528\u4E8E\u6A2A\u5411\u79FB\u52A8\u4FA6\u5BDF", riskType: "lateral_movement" },
+      { pattern: /\b(masscan|zmap|unicornscan)\s+/i, severity: "high", description: "\u7F51\u7EDC\u7AEF\u53E3\u626B\u63CF\u5DE5\u5177\uFF0C\u53EF\u80FD\u7528\u4E8E\u6A2A\u5411\u79FB\u52A8\u4FA6\u5BDF", riskType: "lateral_movement" },
+      // --- Medium: credential export ---
+      { pattern: /export\s+.*(?:TOKEN|KEY|SECRET|PASSWORD)/i, severity: "medium", description: "\u5BFC\u51FA\u654F\u611F\u51ED\u8BC1", riskType: "data_exfiltration" },
+      // --- High: shell rc file append (persistence) ---
+      { pattern: />>\s*(~|\/home\/[^/]+)\/(\.bashrc|\.zshrc|\.profile|\.bash_profile|\.zprofile)/, severity: "high", description: "\u68C0\u6D4B\u5230\u4FEE\u6539 Shell \u914D\u7F6E\u6587\u4EF6\uFF08~/.bashrc \u7B49\uFF09\uFF0C\u53EF\u80FD\u7528\u4E8E\u6301\u4E45\u5316\u540E\u95E8", riskType: "persistence" },
+      // --- High: device file write (只拦截重定向写入设备文件，不拦截读取) ---
+      { pattern: />\s*\/dev\/(sd|hd|nvme|vd|loop|mem|kmsg|port|zero|random|urandom|full|core)/i, severity: "high", description: "\u91CD\u5B9A\u5411\u5199\u5165\u8BBE\u5907\u6587\u4EF6", riskType: "file_access" },
+      // --- High: non-interactive password modification ---
+      { pattern: /\|\s*passwd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u7BA1\u9053\u65B9\u5F0F\u8C03\u7528 passwd\uFF08\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\uFF09", riskType: "script_execution" },
+      { pattern: /\bpasswd\s+--stdin\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 passwd --stdin \u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u8F93\u5165", riskType: "script_execution" },
+      { pattern: /\bchpasswd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 chpasswd \u6279\u91CF\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4", riskType: "script_execution" },
+      { pattern: /\b(newusers|lnewusers)\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 newusers/lnewusers \u6279\u91CF\u7528\u6237\u6DFB\u52A0\u547D\u4EE4", riskType: "script_execution" },
+      { pattern: /\bpasswd\s+-[a-zA-Z]*d\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u5BC6\u7801\u64CD\u4F5C (passwd -d)", riskType: "script_execution" },
+      { pattern: /\bpasswd\s+-[a-zA-Z]*l\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u9501\u5B9A\u7528\u6237\u8D26\u6237\u64CD\u4F5C (passwd -l)", riskType: "script_execution" },
+      // --- High: non-interactive password modification (extended) ---
+      { pattern: /\blpasswd\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u64CD\u4F5C (lpasswd)", riskType: "script_execution" },
+      { pattern: /\bgpasswd\s+(?!-[adA])/i, severity: "high", description: "\u68C0\u6D4B\u5230\u7EC4\u5BC6\u7801\u7BA1\u7406\u64CD\u4F5C (gpasswd)", riskType: "script_execution" },
+      { pattern: /\bchgpasswd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u6279\u91CF\u4FEE\u6539\u7EC4\u5BC6\u7801\u64CD\u4F5C (chgpasswd)", riskType: "script_execution" },
+      // --- High: user/group deletion (irreversible, requires user consent) ---
+      { pattern: /\buserdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (userdel)", riskType: "script_execution" },
+      { pattern: /\bdeluser\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (deluser)", riskType: "script_execution" },
+      { pattern: /\bluserdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (luserdel)", riskType: "script_execution" },
+      { pattern: /\bgroupdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u7EC4\u64CD\u4F5C (groupdel)", riskType: "script_execution" },
+      { pattern: /\blgroupdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u7EC4\u64CD\u4F5C (lgroupdel)", riskType: "script_execution" },
+      // --- High: generic command -p parameter password setting ---
+      { pattern: /\b(useradd|luseradd|groupadd|usermod|lusermod|groupmod|lgroupmod)\b[^&|;]*?\s-p\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u901A\u8FC7 -p \u53C2\u6570\u8BBE\u7F6E\u6216\u4FEE\u6539\u5BC6\u7801 (useradd/usermod/groupmod)", riskType: "script_execution" }
+    ];
+    SENSITIVE_EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
+  }
+});
+
+// src/engine/token-stats.ts
+var token_stats_exports = {};
+__export(token_stats_exports, {
+  getRecentRecords: () => getRecentRecords,
+  getTokenStats: () => getTokenStats,
+  getTokenTrend: () => getTokenTrend,
+  recordTokenUsage: () => recordTokenUsage,
+  resetTokenStats: () => resetTokenStats
+});
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync2, existsSync as existsSync7, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2 } from "fs";
+import { join as join4 } from "path";
+import { homedir as homedir3 } from "os";
+function getStatsPath() {
+  const envPath = process.env[ENV_STATS_PATH];
+  return envPath || STATS_FILE;
+}
+function loadAllRecords(statsPath) {
+  if (!existsSync7(statsPath)) return [];
+  try {
+    const data = JSON.parse(readFileSync7(statsPath, "utf-8"));
+    if (Array.isArray(data)) return data;
+    if (data && Array.isArray(data.records)) return data.records;
+    return [];
+  } catch (e) {
+    return [];
+  }
+}
+function saveRecords(statsPath, records) {
+  try {
+    const dir = statsPath.substring(0, statsPath.lastIndexOf("/"));
+    if (dir && !existsSync7(dir)) mkdirSync2(dir, { recursive: true });
+    writeFileSync2(statsPath, JSON.stringify(records, null, 2), "utf-8");
+  } catch (e) {
   }
-  saveRuntimeConfig(runtime);
-  return runtime;
 }
-function updateRuleDenyMode(layer, category, ruleId, denyMode) {
-  const runtime = loadRuntimeConfig();
-  for (const r of runtime[layer]?.[category]?.rules || []) {
-    if (r.id === ruleId) {
-      r.deny_mode = denyMode;
-      _syncDenyModeFields(r);
-      break;
-    }
+function recordTokenUsage(record) {
+  const statsPath = getStatsPath();
+  const records = loadAllRecords(statsPath);
+  records.push({
+    timestamp: record.timestamp || (/* @__PURE__ */ new Date()).toISOString(),
+    session_id: record.sessionId,
+    step: record.step,
+    model: record.model,
+    prompt_tokens: record.promptTokens,
+    completion_tokens: record.completionTokens,
+    total_tokens: record.totalTokens
+  });
+  if (records.length > MAX_RECORDS) {
+    records.splice(0, records.length - MAX_RECORDS);
   }
-  saveRuntimeConfig(runtime);
-  return runtime;
+  saveRecords(statsPath, records);
 }
-function updateRuleSkipL3(layer, category, ruleId, skipL3) {
-  const runtime = loadRuntimeConfig();
-  for (const r of runtime[layer]?.[category]?.rules || []) {
-    if (r.id === ruleId) {
-      r.skip_l3_on_disabled = skipL3;
-      break;
+function filterByDate(records, days = 0, startDate, endDate) {
+  if (startDate || endDate) {
+    let startDt = startDate ? new Date(startDate) : /* @__PURE__ */ new Date(-864e13);
+    let endDt = endDate ? new Date(endDate) : void 0;
+    if (endDate) {
+      const e = new Date(endDate);
+      e.setHours(23, 59, 59, 999);
+      endDt = e;
     }
+    const endMs = endDt ? endDt.getTime() : Number.MAX_SAFE_INTEGER;
+    return records.filter((r) => {
+      try {
+        const ts = new Date(r.timestamp).getTime();
+        return ts >= startDt.getTime() && ts <= endMs;
+      } catch {
+        return true;
+      }
+    });
+  } else if (days > 0) {
+    const cutoff = Date.now() - days * 864e5;
+    return records.filter((r) => {
+      try {
+        return new Date(r.timestamp).getTime() >= cutoff;
+      } catch {
+        return true;
+      }
+    });
   }
-  saveRuntimeConfig(runtime);
-  return runtime;
-}
-function updateCategoryEnabled(layer, category, enabled) {
-  const runtime = loadRuntimeConfig();
-  const cat = runtime[layer]?.[category];
-  if (cat) cat.category_enabled = enabled;
-  saveRuntimeConfig(runtime);
-  return runtime;
+  return records;
 }
-function addCustomRule(layer, category, rule) {
-  const runtime = loadRuntimeConfig();
-  const layerObj = runtime[layer] || (runtime[layer] = {});
-  const cat = layerObj[category] || (layerObj[category] = { category_enabled: true, category_desc: "", rules: [] });
-  const rules = cat.rules || (cat.rules = []);
-  const newRule = { ...rule, builtin: false, enabled: true };
-  if (!newRule.id) {
-    newRule.id = `custom_${Date.now()}_${_slugify(JSON.stringify(rule).slice(0, 30))}`;
+function aggregate(records) {
+  let totalPrompt = 0, totalCompletion = 0, totalTotal = 0;
+  const byStep = {};
+  const byModel = {};
+  const byDate = {};
+  const bucket = (b, key, r) => {
+    const e = b[key] || (b[key] = { prompt_tokens: 0, completion_tokens: 0, total_tokens: 0, calls: 0 });
+    e.prompt_tokens += r.prompt_tokens || 0;
+    e.completion_tokens += r.completion_tokens || 0;
+    e.total_tokens += r.total_tokens || 0;
+    e.calls += 1;
+  };
+  for (const r of records) {
+    totalPrompt += r.prompt_tokens || 0;
+    totalCompletion += r.completion_tokens || 0;
+    totalTotal += r.total_tokens || 0;
+    bucket(byStep, r.step || "unknown", r);
+    bucket(byModel, r.model || "unknown", r);
+    let dateKey = "unknown";
+    try {
+      dateKey = new Date(r.timestamp).toISOString().slice(0, 10);
+    } catch {
+    }
+    bucket(byDate, dateKey, r);
   }
-  if (newRule.deny_mode) _syncDenyModeFields(newRule);
-  rules.push(newRule);
-  saveRuntimeConfig(runtime);
-  return runtime;
+  const sortedDate = Object.keys(byDate).sort((a, b) => a < b ? 1 : a > b ? -1 : 0);
+  const sortedByDate = {};
+  for (const k of sortedDate) sortedByDate[k] = byDate[k];
+  return { totalPrompt, totalCompletion, totalTotal, byStep, byModel, byDate: sortedByDate };
 }
-function deleteCustomRule(layer, category, ruleId) {
-  const runtime = loadRuntimeConfig();
-  const rules = runtime[layer]?.[category]?.rules || [];
-  const idx = rules.findIndex((r) => r.id === ruleId);
-  if (idx >= 0) {
-    if (rules[idx].builtin) return null;
-    rules.splice(idx, 1);
-    saveRuntimeConfig(runtime);
-  }
-  return runtime;
+function getTokenStats(days = 0, startDate, endDate) {
+  const records = filterByDate(loadAllRecords(getStatsPath()), days, startDate, endDate);
+  const a = aggregate(records);
+  return {
+    total_prompt_tokens: a.totalPrompt,
+    total_completion_tokens: a.totalCompletion,
+    total_tokens: a.totalTotal,
+    total_calls: records.length,
+    by_step: a.byStep,
+    by_model: a.byModel,
+    by_date: a.byDate
+  };
 }
-function addCustomSkill(skillId, category, keywords, content) {
-  _validateSkillId(skillId);
-  const runtime = loadRuntimeConfig();
-  const skillsDir = join4(RUNTIME_CONFIG_DIR, "agent_moss_skills");
-  try {
-    mkdirSync2(skillsDir, { recursive: true });
-  } catch {
-  }
-  writeFileSync2(join4(skillsDir, `${skillId}.md`), content, "utf-8");
-  const l3 = runtime.L3_skills || (runtime.L3_skills = {});
-  const cat = l3[category] || (l3[category] = { category_enabled: true, category_desc: "", skills: [] });
-  (cat.skills || (cat.skills = [])).push({ id: skillId, keywords, enabled: true, builtin: false });
-  saveRuntimeConfig(runtime);
-  return runtime;
+function getRecentRecords(limit = 20) {
+  const records = loadAllRecords(getStatsPath());
+  return records.slice(-limit);
 }
-function deleteCustomSkill(skillId, category) {
-  _validateSkillId(skillId);
-  const runtime = loadRuntimeConfig();
-  const skills = runtime.L3_skills?.[category]?.skills || [];
-  const idx = skills.findIndex((s) => s.id === skillId);
-  if (idx >= 0) {
-    if (skills[idx].builtin) return null;
-    skills.splice(idx, 1);
-    const skillPath = join4(RUNTIME_CONFIG_DIR, "agent_moss_skills", `${skillId}.md`);
+function getTokenTrend(days = 0, startDate, endDate) {
+  const records = filterByDate(loadAllRecords(getStatsPath()), days, startDate, endDate);
+  const series = {};
+  const datesSet = /* @__PURE__ */ new Set();
+  for (const r of records) {
+    let dateKey;
     try {
-      if (existsSync7(skillPath)) unlinkSync2(skillPath);
+      dateKey = new Date(r.timestamp).toISOString().slice(0, 10);
     } catch {
+      continue;
     }
-    saveRuntimeConfig(runtime);
+    const model = r.model || "unknown";
+    const tokens = r.total_tokens || 0;
+    datesSet.add(dateKey);
+    series[model] = series[model] || {};
+    series[model][dateKey] = (series[model][dateKey] || 0) + tokens;
   }
-  return runtime;
+  const dates = Array.from(datesSet).sort();
+  const models = Object.keys(series).sort();
+  return { dates, models, series };
 }
-function updateSkillEnabled(skillId, enabled) {
-  const runtime = loadRuntimeConfig();
-  for (const catData of Object.values(runtime.L3_skills || {})) {
-    for (const s of catData.skills || []) {
-      if (s.id === skillId) {
-        s.enabled = enabled;
-        break;
-      }
+function resetTokenStats() {
+  const statsPath = getStatsPath();
+  if (existsSync7(statsPath)) {
+    try {
+      unlinkSync2(statsPath);
+    } catch {
     }
   }
-  saveRuntimeConfig(runtime);
-  return runtime;
-}
-function updateSkillCategoryEnabled(category, enabled) {
-  const runtime = loadRuntimeConfig();
-  const cat = runtime.L3_skills?.[category];
-  if (cat) cat.category_enabled = enabled;
-  saveRuntimeConfig(runtime);
-  return runtime;
-}
-function getProfileOrDetect() {
-  return null;
 }
-var RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, ENV_RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DENY_MODE_LABELS, SKILL_ID_RE;
-var init_runtime_config = __esm({
-  "src/infra/runtime-config.ts"() {
+var STATS_DIR, STATS_FILE, ENV_STATS_PATH, MAX_RECORDS;
+var init_token_stats = __esm({
+  "src/engine/token-stats.ts"() {
     "use strict";
     init_esm_shims();
-    init_heuristic();
-    init_logic_rules();
-    init_skill_loader();
-    RUNTIME_CONFIG_DIR = join4(homedir3(), ".config", "agentmoss");
-    RUNTIME_CONFIG_PATH = join4(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
-    ENV_RUNTIME_CONFIG_PATH = "AGENT_MOSS_RUNTIME_CONFIG_PATH";
-    LAYER_DISABLE_ENV = {
-      L1_heuristic: "AGENT_MOSS_DISABLE_HEURISTIC",
-      L2_logic_rules: "AGENT_MOSS_DISABLE_LOGIC_RULES",
-      L3_llm_analysis: "AGENT_MOSS_DISABLE_LLM"
-    };
-    DENY_MODE_LABELS = {
-      deny_write: "\u4EC5\u62E6\u622A\u5199\u5165",
-      deny_read: "\u4EC5\u62E6\u622A\u8BFB\u53D6",
-      deny_both: "\u8BFB\u5199\u5747\u62E6\u622A"
-    };
-    SKILL_ID_RE = /^[A-Za-z0-9_-]+$/;
+    STATS_DIR = join4(homedir3(), ".config", "agentmoss");
+    STATS_FILE = join4(STATS_DIR, "agent_moss_token_stats.json");
+    ENV_STATS_PATH = "AGENT_MOSS_TOKEN_STATS_PATH";
+    MAX_RECORDS = 1e4;
   }
 });
 
@@ -2320,9 +2500,9 @@ var require_bindings = __commonJS({
     init_esm_shims();
     var fs4 = __require("fs");
     var path3 = __require("path");
-    var fileURLToPath6 = require_file_uri_to_path();
+    var fileURLToPath7 = require_file_uri_to_path();
     var join6 = path3.join;
-    var dirname6 = path3.dirname;
+    var dirname7 = path3.dirname;
     var exists = fs4.accessSync && function(path4) {
       try {
         fs4.accessSync(path4);
@@ -2432,12 +2612,12 @@ var require_bindings = __commonJS({
       Error.stackTraceLimit = origSTL;
       var fileSchema = "file://";
       if (fileName.indexOf(fileSchema) === 0) {
-        fileName = fileURLToPath6(fileName);
+        fileName = fileURLToPath7(fileName);
       }
       return fileName;
     };
     exports.getRoot = function getRoot(file) {
-      var dir = dirname6(file), prev;
+      var dir = dirname7(file), prev;
       while (true) {
         if (dir === ".") {
           dir = process.cwd();
@@ -3093,28 +3273,28 @@ init_skill_loader();
 
 // src/engine/template-loader.ts
 init_esm_shims();
-import { readFileSync as readFileSync3, existsSync as existsSync4 } from "fs";
-import { resolve as resolve3, dirname as dirname3 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
-var __filename4 = fileURLToPath4(import.meta.url);
-var __dirname4 = dirname3(__filename4);
-var TEMPLATES_DIR = resolve3(__dirname4, "../templates");
-var TEMPLATES_DIR_FALLBACK = resolve3(__dirname4, "../../../agent_moss/templates");
+import { readFileSync as readFileSync4, existsSync as existsSync5 } from "fs";
+import { resolve as resolve3, dirname as dirname4 } from "path";
+import { fileURLToPath as fileURLToPath5 } from "url";
+var __filename4 = fileURLToPath5(import.meta.url);
+var __dirname5 = dirname4(__filename4);
+var TEMPLATES_DIR = resolve3(__dirname5, "../templates");
+var TEMPLATES_DIR_FALLBACK = resolve3(__dirname5, "../../../agent_moss/templates");
 var TEMPLATE_FILES = ["prompt1_template.txt", "prompt2_template.txt", "security_judge_template.txt"];
 var cachedTemplates = null;
 function loadTemplates() {
   if (cachedTemplates) return cachedTemplates;
   cachedTemplates = {};
-  const dir = existsSync4(TEMPLATES_DIR) ? TEMPLATES_DIR : TEMPLATES_DIR_FALLBACK;
-  if (!existsSync4(dir)) {
+  const dir = existsSync5(TEMPLATES_DIR) ? TEMPLATES_DIR : TEMPLATES_DIR_FALLBACK;
+  if (!existsSync5(dir)) {
     console.warn("[AgentMoss] Templates directory not found:", TEMPLATES_DIR, "and fallback:", TEMPLATES_DIR_FALLBACK);
     return cachedTemplates;
   }
   for (const file of TEMPLATE_FILES) {
     const filePath = resolve3(dir, file);
-    if (existsSync4(filePath)) {
+    if (existsSync5(filePath)) {
       const key = file.replace(".txt", "").replace("_template", "");
-      cachedTemplates[key] = readFileSync3(filePath, "utf-8");
+      cachedTemplates[key] = readFileSync4(filePath, "utf-8");
     }
   }
   console.log(`[AgentMoss] Loaded ${Object.keys(cachedTemplates).length} templates from ${dir}`);
@@ -3123,8 +3303,8 @@ function loadTemplates() {
 
 // src/engine/script-analyzer.ts
 init_esm_shims();
-import { readFileSync as readFileSync4 } from "fs";
-import { resolve as resolve4, join } from "path";
+import { readFileSync as readFileSync5 } from "fs";
+import { resolve as resolve4, join as join2 } from "path";
 var SUSPICIOUS_PATTERNS = [
   // Network exfiltration (curl/wget POST in scripts is almost never legitimate)
   { name: "curl POST", pattern: /curl\s+(.*\s)?-X\s+POST/i },
@@ -3257,8 +3437,8 @@ function assessKeywordCombinationRisk(matchedKeywords, scriptContent) {
 }
 function readScriptContent(scriptPath, maxLines = 500) {
   try {
-    const expandedPath = scriptPath.startsWith("~") ? join(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve4(scriptPath);
-    const raw = readFileSync4(expandedPath, "utf-8");
+    const expandedPath = scriptPath.startsWith("~") ? join2(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve4(scriptPath);
+    const raw = readFileSync5(expandedPath, "utf-8");
     const lines = raw.split("\n").slice(0, maxLines);
     return { content: lines.join("\n"), lineCount: lines.length, error: "" };
   } catch (e) {
@@ -3312,9 +3492,9 @@ ${result.scriptContent}
 init_esm_shims();
 init_heuristic();
 init_logic_rules();
-import { readFileSync as readFileSync5, statSync, existsSync as existsSync5 } from "fs";
-import { resolve as resolve5, join as join2, isAbsolute, dirname as dirname4 } from "path";
-import { homedir } from "os";
+import { readFileSync as readFileSync6, statSync, existsSync as existsSync6 } from "fs";
+import { resolve as resolve5, join as join3, isAbsolute, dirname as dirname5 } from "path";
+import { homedir as homedir2 } from "os";
 function emptyChain() {
   return {
     nodes: [],
@@ -3542,7 +3722,7 @@ function extractInlineScriptPath(actionDetail) {
     let resolved;
     try {
       resolved = resolvePath(p);
-      if (existsSync5(resolved)) {
+      if (existsSync6(resolved)) {
         const stat = statSync(resolved);
         if (stat.isFile()) return resolved;
       }
@@ -3554,20 +3734,20 @@ function extractInlineScriptPath(actionDetail) {
 function resolvePath(p) {
   let expanded = p;
   if (expanded.startsWith("~/") || expanded === "~") {
-    expanded = join2(homedir(), expanded.slice(1));
+    expanded = join3(homedir2(), expanded.slice(1));
   }
   return resolve5(expanded);
 }
 function readScriptContent2(scriptPath, maxFileSize = 2 * 1024 * 1024) {
   try {
     const path3 = resolvePath(scriptPath);
-    if (!existsSync5(path3)) return { content: "", lineCount: 0, fileSize: 0, error: `\u811A\u672C\u4E0D\u5B58\u5728: ${scriptPath}` };
+    if (!existsSync6(path3)) return { content: "", lineCount: 0, fileSize: 0, error: `\u811A\u672C\u4E0D\u5B58\u5728: ${scriptPath}` };
     const stat = statSync(path3);
     if (!stat.isFile()) return { content: "", lineCount: 0, fileSize: 0, error: `\u4E0D\u662F\u6587\u4EF6: ${scriptPath}` };
     if (stat.size > maxFileSize) {
       return { content: "", lineCount: 0, fileSize: stat.size, error: `\u811A\u672C\u6587\u4EF6\u8FC7\u5927 (${stat.size} bytes)\uFF0C\u8DF3\u8FC7\u8BFB\u53D6` };
     }
-    const content = readFileSync5(path3, "utf-8");
+    const content = readFileSync6(path3, "utf-8");
     const lineCount = content ? content.split("\n").length : 0;
     return { content, lineCount, fileSize: stat.size, error: "" };
   } catch (e) {
@@ -3584,9 +3764,9 @@ function extractChildScriptPaths(content, baseDir) {
       const pathStr = m[1];
       if (pathStr.startsWith("-") || pathStr.startsWith("$")) continue;
       if (pathStr.includes("/dev/") || pathStr.startsWith("|") || pathStr.startsWith(";")) continue;
-      const full = isAbsolute(pathStr) ? pathStr : join2(baseDir, pathStr);
+      const full = isAbsolute(pathStr) ? pathStr : join3(baseDir, pathStr);
       const resolved = resolvePath(full);
-      if (existsSync5(resolved)) {
+      if (existsSync6(resolved)) {
         try {
           if (statSync(resolved).isFile() && !paths.includes(resolved)) paths.push(resolved);
         } catch {
@@ -3601,7 +3781,7 @@ function resolveScriptChain(entryPath, input, maxDepth = 3, maxFileSize = 2 * 10
   const result = emptyChain();
   result.entryPath = entryPath;
   const entry = resolvePath(entryPath);
-  const baseDir = existsSync5(entry) ? dirname4(entry) : input.cwd || process.cwd();
+  const baseDir = existsSync6(entry) ? dirname5(entry) : input.cwd || process.cwd();
   resolveRecursive({
     path: entry,
     depth: 0,
@@ -3676,7 +3856,7 @@ function resolveRecursive(ctx) {
       maxTotalSize,
       visited,
       result,
-      baseDir: dirname4(resolvePath(childPath)),
+      baseDir: dirname5(resolvePath(childPath)),
       input
     });
     if (result.hasCritical) return;
@@ -3938,7 +4118,7 @@ function formatHints(previous) {
   const hints = [];
   if (previous.heuristic) {
     hints.push(
-      `\u542F\u53D1\u5F0F\u68C0\u6D4B\u53D1\u73B0\u98CE\u9669 [\u98CE\u9669\u7B49\u7EA7: ${previous.heuristic.riskLevel}]:
+      `\u7279\u5F81\u5339\u914D\u68C0\u6D4B\u53D1\u73B0\u98CE\u9669 [\u98CE\u9669\u7B49\u7EA7: ${previous.heuristic.riskLevel}]:
    \u7C7B\u578B: ${previous.heuristic.riskType}
    \u539F\u56E0: ${previous.heuristic.reason}`
     );
@@ -3950,7 +4130,7 @@ function formatHints(previous) {
    \u539F\u56E0: ${previous.logic.reason}`
     );
   }
-  return hints.length > 0 ? hints.join("\n\n") : "\u542F\u53D1\u5F0F\u68C0\u6D4B\u548C\u903B\u8F91\u89C4\u5219\u68C0\u6D4B\u5747\u672A\u53D1\u73B0\u98CE\u9669\u3002";
+  return hints.length > 0 ? hints.join("\n\n") : "\u7279\u5F81\u5339\u914D\u68C0\u6D4B\u548C\u903B\u8F91\u89C4\u5219\u68C0\u6D4B\u5747\u672A\u53D1\u73B0\u98CE\u9669\u3002";
 }
 async function analyzeWithLLM(prompt, config) {
   console.log(`[AgentMoss] LLM analyzing with model: ${config.model}, url: ${config.baseUrl}`);
@@ -4158,6 +4338,7 @@ async function runAnalysis(input) {
   const actionType = input.aNext.actionType.toLowerCase();
   const rawDetail = extractRawCommand(input.aNext.actionDetail);
   const lowerDetail = rawDetail.toLowerCase();
+  const agentExt = getAgentExtensions(input.agentId);
   if (FULLY_SAFE_TOOLS.has(actionType)) {
     return {
       allowed: true,
@@ -4169,7 +4350,23 @@ async function runAnalysis(input) {
       violatedLayers: []
     };
   }
-  const agentExt = getAgentExtensions(input.agentId);
+  if (agentExt?.builtin_safe_action_types && agentExt.builtin_safe_action_types.length > 0) {
+    const hit = agentExt.builtin_safe_action_types.some((t) => {
+      const tl = t.toLowerCase();
+      return tl.endsWith("-") ? actionType.startsWith(tl) : actionType === tl;
+    });
+    if (hit) {
+      return {
+        allowed: true,
+        reason: `agent \u5185\u90E8\u5B89\u5168\u64CD\u4F5C\uFF0C\u8DF3\u8FC7\u6DF1\u5EA6\u5206\u6790: ${actionType}`,
+        riskLevel: heuristicResult?.riskLevel || "low",
+        riskType: "",
+        confidence: 95,
+        source: "whitelist_bypass",
+        violatedLayers: []
+      };
+    }
+  }
   const trustedSkills = new Set(TRUSTED_SKILLS_BASE);
   if (agentExt?.builtin_safe_skills) {
     for (const s of agentExt.builtin_safe_skills) trustedSkills.add(s);
@@ -4211,9 +4408,11 @@ async function runAnalysis(input) {
     }
   }
   const logicResult = isLogicRulesEnabled() ? runLogicCheck(input) : null;
-  if (logicResult && !logicResult.allowed) {
-    const isCredentialPath = !!logicResult.isCredential;
-    const skipInlineFileAccess = (isInlineScriptCmd || isLiteralTextCmd) && logicResult.riskType === "sensitive_path_access";
+  const l1FileAccessHit = !!(heuristicResult && !heuristicResult.allowed && heuristicResult.riskType === "file_access");
+  const effectiveResult = logicResult && !logicResult.allowed ? logicResult : l1FileAccessHit ? heuristicResult : null;
+  if (effectiveResult) {
+    const isCredentialPath = !!effectiveResult.isCredential;
+    const skipInlineFileAccess = (isInlineScriptCmd || isLiteralTextCmd) && effectiveResult.riskType === "file_access";
     if (skipInlineFileAccess) {
       const inlineJudgment = analyzeInlineScript(input.aNext.actionDetail);
       if (inlineJudgment.actionable) {
@@ -4239,8 +4438,8 @@ async function runAnalysis(input) {
         };
       }
     }
-    if ((logicResult.riskLevel === "high" || logicResult.riskLevel === "critical") && (!skipInlineFileAccess || isCredentialPath)) {
-      return logicResult;
+    if ((effectiveResult.riskLevel === "high" || effectiveResult.riskLevel === "critical") && (!skipInlineFileAccess || isCredentialPath)) {
+      return effectiveResult;
     }
   }
   if (scriptChain && scriptChain.nodes.length > 0 && isLogicRulesEnabled()) {
@@ -4457,7 +4656,10 @@ async function analyzeRoute(c) {
       reason: req.reason,
       osType,
       cwd: req.cwd,
-      agentId: req.agent_id,
+      // agent_id 透传：优先顶层；为空兜底 metadata.agent_type（AgentGate V1
+      // normalizer 历史上只把 agent_type 塞进 metadata，顶层 agent_id 为空 →
+      // 定制规则不生效。AgentGate 已修，此处兜底防御其他只传 metadata 的调用方）。
+      agentId: req.agent_id || req.metadata?.agent_type || "",
       llmConfig: req.metadata?.llm_config,
       llmLogPath: req.metadata?.llm_log_path
     });
@@ -4513,10 +4715,10 @@ init_runtime_config();
 init_token_stats();
 import { Hono } from "hono";
 import { readFileSync as readFileSync8, existsSync as existsSync9 } from "fs";
-import { join as join5, dirname as dirname5 } from "path";
-import { fileURLToPath as fileURLToPath5 } from "url";
-var __dirname5 = dirname5(fileURLToPath5(import.meta.url));
-var STATIC_DIR = join5(__dirname5, "static");
+import { join as join5, dirname as dirname6 } from "path";
+import { fileURLToPath as fileURLToPath6 } from "url";
+var __dirname6 = dirname6(fileURLToPath6(import.meta.url));
+var STATIC_DIR = join5(__dirname6, "static");
 var CONSOLE_TOKEN_ENV = "AGENT_MOSS_CONSOLE_TOKEN";
 function getConsoleToken() {
   return process.env[CONSOLE_TOKEN_ENV] || "";
@@ -4633,14 +4835,52 @@ function createConsoleRouter() {
     if (!/^[A-Za-z0-9_-]+$/.test(skillId)) {
       return c.json({ error: "invalid skill_id" }, 400);
     }
-    const skillPath = join5(dirname5(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
+    const skillPath = join5(dirname6(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
     if (!existsSync9(skillPath)) {
-      const builtinPath = join5(__dirname5, "..", "..", "agent_moss", "skills", `${skillId}.md`);
+      const builtinPath = join5(__dirname6, "..", "..", "agent_moss", "skills", `${skillId}.md`);
       if (existsSync9(builtinPath)) return c.text(readFileSync8(builtinPath, "utf-8"));
       return c.json({ error: "skill not found" }, 404);
     }
     return c.text(readFileSync8(skillPath, "utf-8"));
   });
+  console2.get("/api/agents", (c) => {
+    const rc = loadRuntimeConfig();
+    return c.json({ agents: getAgentRules(rc) });
+  });
+  console2.put("/api/agents/rules/enabled", async (c) => {
+    const b = await c.req.json();
+    const fp = {};
+    if (b.value) fp.value = b.value;
+    if (b.pattern) fp.pattern = b.pattern;
+    if (b.keyword) fp.keyword = b.keyword;
+    if (b.path) fp.path = b.path;
+    const rc = updateAgentRuleEnabled(b.agent_id, b.category, fp, b.enabled);
+    return c.json({ agents: getAgentRules(rc) });
+  });
+  console2.post("/api/agents/rules", async (c) => {
+    const b = await c.req.json();
+    const rule = {};
+    for (const [k, v] of Object.entries(b)) {
+      if (!["agent_id", "category"].includes(k) && v !== void 0 && v !== null) rule[k] = v;
+    }
+    const rc = addAgentRule(b.agent_id, b.category, rule);
+    return c.json({ agents: getAgentRules(rc) });
+  });
+  console2.delete("/api/agents/rules", async (c) => {
+    const b = await c.req.json();
+    const fp = {};
+    if (b.value) fp.value = b.value;
+    if (b.pattern) fp.pattern = b.pattern;
+    if (b.keyword) fp.keyword = b.keyword;
+    if (b.path) fp.path = b.path;
+    const rc = deleteAgentRule(b.agent_id, b.category, fp);
+    return c.json({ agents: getAgentRules(rc) });
+  });
+  console2.put("/api/agents/categories/enabled", async (c) => {
+    const b = await c.req.json();
+    const rc = updateAgentCategoryEnabled(b.agent_id, b.category, b.enabled);
+    return c.json({ agents: getAgentRules(rc) });
+  });
   console2.get("/api/config", (c) => {
     const rc = loadRuntimeConfig();
     return c.json({ config: rc, config_path: getRuntimeConfigPath() });