@kenhkl/agent-moss 0.9.1 → 0.10.1

package/dist/server.js

@@ -1,5 +1,7 @@
 var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
   get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
 }) : x)(function(x) {
@@ -16,6 +18,15 @@ var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // node_modules/tsup/assets/esm_shims.js
 import path from "path";
@@ -213,56 +224,6 @@ var init_config = __esm({
   }
 });
 
-// src/agents/index.ts
-import { readFileSync, existsSync } from "fs";
-import { resolve, dirname } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-function resolveAgentsDir() {
-  if (existsSync(AGENTS_DIR_PROD)) return AGENTS_DIR_PROD;
-  if (existsSync(AGENTS_DIR_DEV_FALLBACK)) return AGENTS_DIR_DEV_FALLBACK;
-  return AGENTS_DIR_PROD;
-}
-function getAgentExtensions(agentId) {
-  if (!agentId) return null;
-  if (cache.has(agentId)) return cache.get(agentId) ?? null;
-  const agentsDir = resolveAgentsDir();
-  const rulesFile = resolve(agentsDir, agentId, "rules.json");
-  if (!existsSync(rulesFile)) {
-    cache.set(agentId, null);
-    return null;
-  }
-  try {
-    const raw = readFileSync(rulesFile, "utf-8");
-    const ext = JSON.parse(raw);
-    if (!ext.agent_id) {
-      console.warn(`[AgentMoss agents] rules.json \u7F3A\u5C11 agent_id \u5B57\u6BB5: ${rulesFile}`);
-      cache.set(agentId, null);
-      return null;
-    }
-    cache.set(agentId, ext);
-    console.log(
-      `[AgentMoss agents] \u52A0\u8F7D agent ${agentId} \u5B9A\u5236\u89C4\u5219: ${ext.extra_command_patterns?.length ?? 0} cmd patterns, ${ext.extra_injection_keywords?.length ?? 0} injection keywords, ${ext.extra_sensitive_paths?.length ?? 0} sensitive paths, ${ext.builtin_safe_skills?.length ?? 0} builtin safe skills`
-    );
-    return ext;
-  } catch (e) {
-    console.error(`[AgentMoss agents] \u52A0\u8F7D agent ${agentId} rules.json \u5931\u8D25:`, e.message);
-    cache.set(agentId, null);
-    return null;
-  }
-}
-var __filename2, __dirname2, AGENTS_DIR_PROD, AGENTS_DIR_DEV_FALLBACK, cache;
-var init_agents = __esm({
-  "src/agents/index.ts"() {
-    "use strict";
-    init_esm_shims();
-    __filename2 = fileURLToPath2(import.meta.url);
-    __dirname2 = dirname(__filename2);
-    AGENTS_DIR_PROD = resolve(__dirname2, "agents");
-    AGENTS_DIR_DEV_FALLBACK = resolve(__dirname2, "../../../agent_moss/agents");
-    cache = /* @__PURE__ */ new Map();
-  }
-});
-
 // src/engine/inline-analyzer.ts
 function isLiteralTextCommand(command) {
   ECHO_CMD_RE.lastIndex = 0;
@@ -519,9 +480,12 @@ function checkReadBeforeWrite(actionType, actionDetail, actionHistory, reason, c
   if (NON_WRITE_TOOLS.has(actionType)) return null;
   let isWrite = WRITE_KEYWORDS.some((kw) => actionType.includes(kw) || actionDetail.includes(kw));
   if (!isWrite && actionDetail.includes(">")) {
-    const firstWord = actionDetail.split(/\s/)[0]?.toLowerCase() || "";
-    if (!READ_ONLY_REDIR_CMDS.has(firstWord)) {
-      isWrite = true;
+    const detailWithoutDevnull = actionDetail.replace(/(?:2|&|1)?\s*>\s*\/dev\/null\b/g, "");
+    if (detailWithoutDevnull.includes(">")) {
+      const firstWord = actionDetail.split(/\s/)[0]?.toLowerCase() || "";
+      if (!READ_ONLY_REDIR_CMDS.has(firstWord)) {
+        isWrite = true;
+      }
     }
   }
   if (!isWrite) return null;
@@ -689,7 +653,7 @@ var init_logic_rules = __esm({
     ROOT_SENSITIVE_PATHS = [
       { path: "/etc/shadow", riskLevel: "critical", desc: "\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6", credential: true },
       { path: "/etc/gshadow", riskLevel: "critical", desc: "\u7CFB\u7EDF\u7EC4\u5BC6\u7801\u6587\u4EF6", credential: true },
-      // 注意：/etc/passwd 仅从 L1 启发式规则移除（公开可读），L2 敏感路径仍保留
+      // 注意：/etc/passwd 仅从 L1 特征匹配规则移除（公开可读），L2 敏感路径仍保留
       { path: "/etc/passwd", riskLevel: "high", desc: "\u7CFB\u7EDF\u7528\u6237\u6587\u4EF6" },
       { path: "/etc/sudoers", riskLevel: "critical", desc: "sudo \u914D\u7F6E", credential: true },
       // 系统配置（仅拦截写入）
@@ -781,1423 +745,1676 @@ var init_logic_rules = __esm({
   }
 });
 
-// src/engine/heuristic.ts
-function runHeuristicCheck(input) {
-  const command = `${input.aNext.actionType}: ${input.aNext.actionDetail}`;
-  const matched = [];
-  let highestSeverity = "low";
-  let highestRiskType = "";
-  const userRules = getCustomRules();
-  for (const rule of userRules) {
-    try {
-      const re = new RegExp(rule.pattern);
-      if (re.test(command)) {
-        if (rule.action === "Deny") {
-          matched.push(`\u81EA\u5B9A\u4E49\u89C4\u5219: ${rule.pattern}`);
-          if (severityRank(rule.severity) > severityRank(highestSeverity)) {
-            highestSeverity = rule.severity;
-            highestRiskType = "custom_rule";
-          }
-        }
-      }
-    } catch {
-    }
+// src/engine/skill-loader.ts
+import { readFileSync, readdirSync as readdirSync2, existsSync as existsSync2 } from "fs";
+import { resolve, dirname } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+function loadAllSkills() {
+  if (cachedSkills) return cachedSkills;
+  cachedSkills = {};
+  const dir = existsSync2(SKILLS_DIR) ? SKILLS_DIR : SKILLS_DIR_FALLBACK;
+  if (!existsSync2(dir)) {
+    console.warn("[AgentMoss] Skills directory not found:", SKILLS_DIR, "and fallback:", SKILLS_DIR_FALLBACK);
+    return cachedSkills;
   }
-  let topRiskType = "";
-  for (const rule of DANGEROUS_PATTERNS) {
-    if (rule.pattern.test(command)) {
-      matched.push(rule.description);
-      if (severityRank(rule.severity) > severityRank(highestSeverity)) {
-        highestSeverity = rule.severity;
-        topRiskType = rule.riskType;
-      }
-    }
+  const files = readdirSync2(dir).filter((f) => f.endsWith(".md"));
+  for (const f of files) {
+    const name = f.replace(".md", "");
+    cachedSkills[name] = readFileSync(resolve(dir, f), "utf-8");
   }
-  highestRiskType = topRiskType || highestRiskType;
-  const agentExt = getAgentExtensions(input.agentId);
-  if (agentExt?.extra_command_patterns) {
-    for (const rule of agentExt.extra_command_patterns) {
-      try {
-        const re = new RegExp(rule.pattern, "i");
-        if (re.test(command)) {
-          matched.push(`agent \u4E13\u5C5E\u89C4\u5219: ${rule.reason}`);
-          if (severityRank(rule.risk_level) > severityRank(highestSeverity)) {
-            highestSeverity = rule.risk_level;
-            highestRiskType = rule.risk_type;
-          }
-        }
-      } catch {
+  console.log(`[AgentMoss] Loaded ${Object.keys(cachedSkills).length} skills from ${dir}`);
+  return cachedSkills;
+}
+function matchSkills(actionType, actionDetail, reason, maxSkills = 3) {
+  const skills = loadAllSkills();
+  const combined = `${actionType} ${actionDetail} ${reason}`.toLowerCase();
+  const actionDetailLower = actionDetail.toLowerCase();
+  const actionTypeLower = actionType.toLowerCase();
+  const reasonLower = reason.toLowerCase();
+  const scores = {};
+  for (const [skillName, keywords] of Object.entries(SKILL_KEYWORD_MAP)) {
+    let score = 0;
+    for (const kw of keywords) {
+      if (combined.includes(kw)) {
+        if (kw === actionTypeLower) score += 2;
+        else if (actionDetailLower.includes(kw)) score += 1.5;
+        else if (reasonLower.includes(kw)) score += 1;
+        else score += 0.5;
       }
     }
+    if (score > 0) scores[skillName] = score;
   }
-  const injectionText = `${input.aNext.actionType} ${input.aNext.actionDetail} ${input.reason || ""} ${input.promptSession || ""}`.toLowerCase();
-  const injectionHits = checkInjectionKeywords(injectionText, agentExt?.extra_injection_keywords);
-  if (injectionHits.length > 0) {
-    const topHit = injectionHits.reduce((a, b) => severityRank(a.riskLevel) >= severityRank(b.riskLevel) ? a : b);
-    matched.push(...injectionHits.map((h) => `\u6CE8\u5165\u5173\u952E\u8BCD [${h.lang}]: ${h.keyword}`));
-    if (severityRank(topHit.riskLevel) > severityRank(highestSeverity)) {
-      highestSeverity = topHit.riskLevel;
-      highestRiskType = "prompt_injection";
-    }
-  }
-  const actionTypeL = input.aNext.actionType.toLowerCase();
-  const detailL = input.aNext.actionDetail.toLowerCase();
-  const isExcludedType = SENSITIVE_EXCLUDED_PREFIXES.some((p) => actionTypeL.startsWith(p));
-  if (!isExcludedType) {
-    const pathResult = checkSensitivePath(detailL, input.cwd || "/", agentExt);
-    if (pathResult) return pathResult;
-  }
-  const dangerousResult = checkDangerousPatterns(actionTypeL, detailL);
-  if (dangerousResult) return dangerousResult;
-  const lateralResult = checkLateralMovement(detailL);
-  if (lateralResult) return lateralResult;
-  if (matched.length > 0) {
-    return {
-      allowed: false,
-      reason: `\u68C0\u6D4B\u5230\u9AD8\u5371\u64CD\u4F5C: ${matched.join(", ")}`,
-      riskLevel: highestSeverity,
-      riskType: highestRiskType,
-      confidence: 95,
-      source: "heuristic",
-      violatedLayers: ["1.1"]
-      // 对齐 py coordinator.py:165（L1.1 = 命中高危命令模式/注入关键词）
-    };
-  }
-  return null;
-}
-function checkInjectionKeywords(text, extraKeywords) {
-  const hits = [];
-  for (const entry of INJECTION_KEYWORDS) {
-    if (text.includes(entry.keyword.toLowerCase())) {
-      hits.push(entry);
+  const sorted = Object.entries(scores).sort((a, b) => b[1] - a[1]);
+  const top = sorted.slice(0, maxSkills);
+  const maxScore = top[0]?.[1] || 1;
+  const results = [];
+  for (const [name, score] of top) {
+    const content = skills[name];
+    if (content) {
+      results.push({
+        skillName: name,
+        relevance: Math.min(score / maxScore, 1),
+        skillContent: content
+      });
     }
   }
-  if (extraKeywords) {
-    for (const entry of extraKeywords) {
-      if (text.includes(entry.keyword.toLowerCase())) {
-        hits.push({ keyword: entry.keyword, riskLevel: entry.risk_level, lang: entry.lang });
-      }
+  if (results.length === 0) {
+    const fallback = skills["general_tool_risk_guard"];
+    if (fallback) {
+      results.push({ skillName: "general_tool_risk_guard", relevance: 0.3, skillContent: fallback });
     }
   }
-  return hits;
-}
-function isInlineScriptCommand(actionDetail) {
-  const re = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
-  return re.test(actionDetail);
+  return results;
 }
-function severityRank(s) {
-  const ranks = { low: 1, medium: 2, high: 3, critical: 4 };
-  return ranks[s] || 0;
+function formatSkillsForPrompt(skills) {
+  if (skills.length === 0) return "(\u672A\u5339\u914D\u5230\u7279\u5B9A\u5B89\u5168\u68C0\u6D4B\u89C4\u5219)";
+  return skills.map(
+    (s) => `### \u5B89\u5168\u68C0\u6D4B\u89C4\u5219: ${s.skillName} (\u76F8\u5173\u5EA6: ${Math.round(s.relevance * 100)}%)
+
+${s.skillContent}`
+  ).join("\n\n---\n\n");
 }
-function checkSensitivePath(command, cwd, agentExt) {
-  const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
-  const _WRITE_CMD_RES = [/\brm\b/, /\bunlink\b/, /\brmdir\b/, /\bshred\b/, /\bcp\b/, /\bmv\b/, /\binstall\b/, /\btee\b/, /\bdd\b/, /\bmkfs\b/, /\b(fdisk|parted|cfdisk|sfdisk)\b/, /\bchmod\b/, /\bchown\b/, /\btruncate\b/];
-  const _DEVNULL_RE = /(?:2|&|1)?\s*>\s*\/dev\/null\b/;
-  const _READONLY_CMDS = /* @__PURE__ */ new Set(["cat", "head", "tail", "less", "more", "grep", "find", "awk", "sed", "sort", "uniq", "wc", "cut", "strings", "od", "xxd", "hexdump", "tr", "file", "stat", "du", "df", "ls", "dir", "tree", "nl", "tac", "rev", "lsblk", "blockdev", "smartctl", "udevadm", "dmidecode", "lscpu", "lspci", "lsusb", "lsmem", "lsns", "lsof", "hwinfo", "inxi", "fdisk", "parted", "dmesg", "journalctl", "systemctl", "hostnamectl", "localectl", "timedatectl", "ps", "top", "free", "vmstat", "iostat", "mpstat", "pidof", "pgrep", "ip", "ifconfig", "route", "ss", "netstat", "arp", "ethtool", "nmcli", "uname", "arch", "nproc", "getconf", "getent", "id", "whoami", "who", "w", "last", "uptime", "lsmod", "modinfo", "sysctl"]);
-  const isWriteOpFlag = _WRITE_CMD_RES.some((rx) => rx.test(command)) || /\bsed\s+-[a-zA-Z]*i/.test(command) || command.includes(">") && !command.replace(_DEVNULL_RE, "").includes(">") || command.includes(">") && command.replace(_DEVNULL_RE, "").includes(">") && !_READONLY_CMDS.has(command.trim().split(/\s+/)[0]?.toLowerCase() || "") || WRITE_KEYWORDS.some((kw) => "".includes(kw) || command.includes(kw));
-  for (const sp of ROOT_SENSITIVE_PATHS) {
-    if (command.includes(sp.path.toLowerCase())) {
-      if (sp.path === "/dev/random") {
-        if (isWriteOpFlag) {
-          continue;
-        }
-        return {
-          allowed: false,
-          reason: `\u8BFB\u53D6\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
-          riskLevel: sp.riskLevel,
-          riskType: "file_access",
-          confidence: 90,
-          source: "heuristic",
-          violatedLayers: ["1.1"]
-        };
-      }
-      if (!isWriteOpFlag && !sp.credential) {
-        continue;
-      }
-      return {
-        allowed: false,
-        reason: `\u5C1D\u8BD5\u8BBF\u95EE\u7CFB\u7EDF\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
-        riskLevel: sp.riskLevel,
-        riskType: "file_access",
-        confidence: 90,
-        source: "heuristic",
-        violatedLayers: ["1.1"],
-        isCredential: !!sp.credential
-      };
-    }
+var __filename2, __dirname2, SKILLS_DIR, SKILLS_DIR_FALLBACK, SKILL_KEYWORD_MAP, cachedSkills;
+var init_skill_loader = __esm({
+  "src/engine/skill-loader.ts"() {
+    "use strict";
+    init_esm_shims();
+    __filename2 = fileURLToPath2(import.meta.url);
+    __dirname2 = dirname(__filename2);
+    SKILLS_DIR = resolve(__dirname2, "../skills");
+    SKILLS_DIR_FALLBACK = resolve(__dirname2, "../../../agent_moss/skills");
+    SKILL_KEYWORD_MAP = {
+      "file_access_guard": ["file", "\u6587\u4EF6", "path", "\u8DEF\u5F84", "read", "write", "cat", "open", "access", "\u8BBF\u95EE", "\u8BFB\u5199", "copy", "cp", "mv", "move"],
+      "script_execution_guard": ["command", "shell", "bash", "exec", "execute", "\u6267\u884C", "\u547D\u4EE4", "script", "\u811A\u672C", "run", "\u8FD0\u884C", "subprocess", "system", "eval", "compile", "\u5B89\u88C5", "install", "pip", "npm"],
+      "data_exfiltration_guard": ["upload", "\u4E0A\u4F20", "send", "\u53D1\u9001", "transfer", "\u4F20\u8F93", "export", "\u5BFC\u51FA", "download", "\u4E0B\u8F7D", "post", "http", "request", "fetch", "curl", "wget", "\u5916\u4F20", "\u6CC4\u9732", "exfil", "network", "\u7F51\u7EDC"],
+      "browser_web_access_guard": ["browser", "\u6D4F\u89C8\u5668", "web", "\u7F51\u9875", "url", "navigate", "\u6D4F\u89C8", "scrape", "crawl", "\u722C\u53D6", "click", "screenshot"],
+      "email_operation_guard": ["email", "\u90AE\u4EF6", "mail", "smtp", "send_email", "\u53D1\u9001\u90AE\u4EF6", "inbox", "\u6536\u4EF6\u7BB1", "\u9644\u4EF6", "attachment"],
+      "general_tool_risk_guard": ["tool", "\u5DE5\u5177", "api", "invoke", "\u8C03\u7528", "function", "\u51FD\u6570"],
+      "lateral_movement_guard": ["ssh", "scp", "ftp", "sftp", "rdp", "vnc", "telnet", "\u5185\u7F51", "\u6A2A\u5411", "tunnel", "\u4EE3\u7406", "proxy", "port", "\u7AEF\u53E3", "scan", "\u626B\u63CF", "ping", "traceroute", "nslookup"],
+      "persistence_backdoor_guard": ["cron", "crontab", "\u5B9A\u65F6", "scheduled", "startup", "\u542F\u52A8\u9879", "service", "\u670D\u52A1", "daemon", "\u5B88\u62A4", "registry", "\u6CE8\u518C\u8868", "backdoor", "\u540E\u95E8", "persist", "\u6301\u4E45\u5316", "authorized_keys", "bashrc", "zshrc", "profile", ".rc", "shell config", "shell \u914D\u7F6E"],
+      // 注意：避免裸 'memory'/'内存'/'dd'——会误命中 memory-addMemory（写记忆工具，
+      // 'dd' 是 'addMemory' 的子串）等无害操作。用组合词/命令前缀精准匹配攻击场景。
+      "resource_exhaustion_guard": ["fork", "bomb", "\u70B8\u5F39", "memory bomb", "oom", "out of memory", "\u5185\u5B58\u6EA2\u51FA", "\u5185\u5B58\u8017\u5C3D", "\u5185\u5B58\u6CC4\u6F0F", "disk", "\u78C1\u76D8", "cpu", "process", "\u8FDB\u7A0B", "dd if=", "/dev/zero", "/dev/null", "yes >", "while true", "\u65E0\u9650\u5FAA\u73AF", "\u8017\u5C3D", "exhaust", "\u8D44\u6E90"],
+      "skill_installation_guard": ["skill", "plugin", "\u63D2\u4EF6", "extension", "\u6269\u5C55", "install skill", "\u5B89\u88C5\u63D2\u4EF6", "\u5B89\u88C5\u6280\u80FD", "marketplace", "\u5546\u5E97"],
+      "supply_chain_guard": ["dependency", "\u4F9D\u8D56", "package", "\u5305", "npm install", "pip install", "requirements", "import", "library", "\u5E93", "registry", "\u4ED3\u5E93", "supply", "\u4F9B\u5E94\u94FE", "typosquatting"],
+      "intent_deviation_guard": ["rm", "del", "delete", "remove", "\u5220\u9664", "format", "\u683C\u5F0F\u5316", "drop", "truncate", "\u6E05\u7A7A", "wipe", "\u64E6\u9664", "\u91CD\u7F6E", "reset", "sudo", "root", "admin", "\u7BA1\u7406\u5458", "privilege", "\u63D0\u6743"],
+      "indirect_access_guard": ["listdir", "os.walk", "os.scandir", "glob.glob", "glob.iglob", "pathlib", "iterdir", "rglob", "scandir", "os.listdir", "\u76EE\u5F55\u904D\u5386", "traversal"]
+    };
+    cachedSkills = null;
   }
-  for (const sp of HOME_SENSITIVE_PATHS) {
-    const expanded = `${expandedCwd}/${sp.path}`;
-    const pathRe = sp.path.endsWith(".pub") ? new RegExp(sp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i") : new RegExp(sp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "(?!\\.pub)", "i");
-    const expandedRe = sp.path.endsWith(".pub") ? new RegExp(expanded.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i") : new RegExp(expanded.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "(?!\\.pub)", "i");
-    if (pathRe.test(command) || expandedRe.test(command)) {
-      if (!isWriteOpFlag && !sp.credential) {
-        continue;
-      }
-      return {
-        allowed: false,
-        reason: `\u5C1D\u8BD5\u8BBF\u95EE\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
-        riskLevel: sp.riskLevel,
-        riskType: "file_access",
-        confidence: 90,
-        source: "heuristic",
-        violatedLayers: ["1.1"],
-        isCredential: !!sp.credential
-      };
+});
+
+// src/infra/runtime-config.ts
+var runtime_config_exports = {};
+__export(runtime_config_exports, {
+  DENY_MODE_LABELS: () => DENY_MODE_LABELS,
+  addAgentRule: () => addAgentRule,
+  addCustomRule: () => addCustomRule,
+  addCustomSkill: () => addCustomSkill,
+  deleteAgentRule: () => deleteAgentRule,
+  deleteCustomRule: () => deleteCustomRule,
+  deleteCustomSkill: () => deleteCustomSkill,
+  filterEnabledRules: () => filterEnabledRules,
+  generateSourceDefaults: () => generateSourceDefaults,
+  getAgentRules: () => getAgentRules,
+  getDisabledL2RulesWithSkipL3: () => getDisabledL2RulesWithSkipL3,
+  getDisabledSkillIds: () => getDisabledSkillIds,
+  getEnabledAgentExtensions: () => getEnabledAgentExtensions,
+  getEnabledL1CommandPatterns: () => getEnabledL1CommandPatterns,
+  getEnabledL1CommandPatternsOrDefault: () => getEnabledL1CommandPatternsOrDefault,
+  getEnabledL1InjectionKeywords: () => getEnabledL1InjectionKeywords,
+  getEnabledL1InjectionKeywordsOrDefault: () => getEnabledL1InjectionKeywordsOrDefault,
+  getEnabledL2IntentPatterns: () => getEnabledL2IntentPatterns,
+  getEnabledL2IntentPatternsOrDefault: () => getEnabledL2IntentPatternsOrDefault,
+  getEnabledL2PasswordPatterns: () => getEnabledL2PasswordPatterns,
+  getEnabledL2PasswordPatternsOrDefault: () => getEnabledL2PasswordPatternsOrDefault,
+  getEnabledL2SensitivePaths: () => getEnabledL2SensitivePaths,
+  getEnabledL2SensitivePathsOrDefault: () => getEnabledL2SensitivePathsOrDefault,
+  getEnabledL2UserDeletionPatterns: () => getEnabledL2UserDeletionPatterns,
+  getEnabledL2UserDeletionPatternsOrDefault: () => getEnabledL2UserDeletionPatternsOrDefault,
+  getEnvOverrides: () => getEnvOverrides,
+  getProfileOrDetect: () => getProfileOrDetect,
+  getRuntimeConfigPath: () => getRuntimeConfigPath,
+  hasRuntimeConfig: () => hasRuntimeConfig,
+  isL2CategoryEnabled: () => isL2CategoryEnabled,
+  isLayerEnabled: () => isLayerEnabled,
+  loadRuntimeConfig: () => loadRuntimeConfig,
+  mergeConfig: () => mergeConfig,
+  saveRuntimeConfig: () => saveRuntimeConfig,
+  updateAgentCategoryEnabled: () => updateAgentCategoryEnabled,
+  updateAgentRuleEnabled: () => updateAgentRuleEnabled,
+  updateCategoryEnabled: () => updateCategoryEnabled,
+  updateLayerEnabled: () => updateLayerEnabled,
+  updateRuleDenyMode: () => updateRuleDenyMode,
+  updateRuleEnabled: () => updateRuleEnabled,
+  updateRuleSkipL3: () => updateRuleSkipL3,
+  updateSkillCategoryEnabled: () => updateSkillCategoryEnabled,
+  updateSkillEnabled: () => updateSkillEnabled
+});
+import { readFileSync as readFileSync2, writeFileSync, existsSync as existsSync3, mkdirSync, unlinkSync, readdirSync as readdirSync3 } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+import { fileURLToPath as fileURLToPath3 } from "url";
+import { dirname as dirname2 } from "path";
+function getRuntimeConfigPath() {
+  const envPath = process.env[ENV_RUNTIME_CONFIG_PATH];
+  if (envPath) return envPath;
+  return RUNTIME_CONFIG_PATH;
+}
+function saveRuntimeConfig(config) {
+  const p = getRuntimeConfigPath();
+  const dir = p.substring(0, p.lastIndexOf("/"));
+  if (dir && !existsSync3(dir)) mkdirSync(dir, { recursive: true });
+  writeFileSync(p, JSON.stringify(config, null, 2), "utf-8");
+}
+function emptyRuntimeConfig() {
+  return {
+    version: 1,
+    layers: { L1_heuristic: true, L2_logic_rules: true, L3_llm_analysis: true },
+    L1_rules: {},
+    L2_rules: {},
+    L3_skills: {},
+    agent_rules: {}
+  };
+}
+function loadRuntimeConfig() {
+  const p = getRuntimeConfigPath();
+  if (!existsSync3(p)) {
+    const seeded = mergeConfig({}, generateSourceDefaults());
+    try {
+      saveRuntimeConfig(seeded);
+    } catch {
     }
+    return seeded;
   }
-  if (agentExt?.extra_sensitive_paths && agentExt.extra_sensitive_paths.length > 0) {
-    for (const sp of agentExt.extra_sensitive_paths) {
-      const spPath = sp.path.toLowerCase();
-      const expanded = `${expandedCwd}/${spPath}`;
-      if (command.includes(spPath) || command.includes(expanded.toLowerCase())) {
-        const denyMode = sp.deny_mode || (sp.credential ? "deny_both" : sp.read_only ? "deny_read" : "deny_write");
-        if (denyMode === "deny_read") {
-          if (isWriteOpFlag) continue;
-        } else if (denyMode === "deny_write") {
-          if (!isWriteOpFlag) continue;
-        }
-        return {
-          allowed: false,
-          reason: `\u5C1D\u8BD5\u8BBF\u95EE agent \u4E13\u5C5E\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
-          riskLevel: sp.risk_level,
-          riskType: "file_access",
-          confidence: 90,
-          source: "heuristic",
-          violatedLayers: ["1.1"],
-          isCredential: !!sp.credential
-        };
-      }
-    }
+  try {
+    const data = JSON.parse(readFileSync2(p, "utf-8"));
+    const merged = mergeConfig(data, generateSourceDefaults());
+    return {
+      version: data.version || 1,
+      layers: {
+        L1_heuristic: data.layers?.L1_heuristic ?? true,
+        L2_logic_rules: data.layers?.L2_logic_rules ?? true,
+        L3_llm_analysis: data.layers?.L3_llm_analysis ?? true
+      },
+      L1_rules: merged.L1_rules || {},
+      L2_rules: merged.L2_rules || {},
+      L3_skills: merged.L3_skills || {},
+      agent_rules: merged.agent_rules || {}
+    };
+  } catch {
+    return emptyRuntimeConfig();
   }
-  for (const cp of CREDENTIAL_PATHS) {
-    const escaped = cp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const re = cp.path.startsWith(".") ? new RegExp(`(?:^|[\\s/\\\\'"])${escaped}\\b`) : new RegExp(`\\b${escaped}\\b`);
-    if (re.test(command)) {
-      return {
-        allowed: false,
-        reason: `\u8BBF\u95EE\u654F\u611F\u8DEF\u5F84: ${cp.desc} (${cp.path})`,
-        riskLevel: cp.riskLevel,
-        riskType: "file_access",
-        confidence: 90,
-        source: "heuristic",
-        violatedLayers: ["1.1"],
-        isCredential: true
+}
+function isLayerEnabled(layerKey) {
+  const disableKey = LAYER_DISABLE_ENV[layerKey];
+  if (disableKey && process.env[disableKey] === "1") return false;
+  const runtime = loadRuntimeConfig();
+  const layers = runtime.layers || {};
+  if (layerKey in layers) return !!layers[layerKey];
+  return true;
+}
+function getEnvOverrides() {
+  const overrides = {};
+  for (const [layerKey, envKey] of Object.entries(LAYER_DISABLE_ENV)) {
+    const val = process.env[envKey];
+    if (val !== void 0) {
+      overrides[layerKey] = {
+        env_var: envKey,
+        env_value: val,
+        overridden: val === "1",
+        effect: val === "1" ? "disabled" : "no_override"
       };
     }
   }
-  if ((command.includes("rm ") || command.includes("unlink")) && (command.includes("/etc/") || command.includes("/root/") || command.includes("/var/log/"))) {
-    return {
-      allowed: false,
-      reason: "\u68C0\u6D4B\u5230\u5220\u9664\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55\u5185\u5BB9",
-      riskLevel: "critical",
-      riskType: "file_access",
-      confidence: 90,
-      source: "heuristic",
-      violatedLayers: ["1.1"]
-    };
+  return overrides;
+}
+function filterEnabledRules(rules, categoryEnabled = true) {
+  if (!categoryEnabled) return [];
+  return rules.filter((r) => r.enabled !== false);
+}
+function getEnabledL1CommandPatterns(runtime) {
+  const cat = runtime.L1_rules?.dangerous_commands || { category_enabled: true, rules: [] };
+  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => ({
+    pattern: r.pattern || "",
+    risk_level: r.risk_level || "",
+    risk_type: r.risk_type || "",
+    reason: r.reason || ""
+  }));
+}
+function getEnabledL2SensitivePaths(runtime) {
+  let cat = runtime.L1_rules?.sensitive_path_access;
+  if (!cat || !cat.rules || cat.rules.length === 0) {
+    cat = runtime.L2_rules?.sensitive_path_access || { category_enabled: true, rules: [] };
   }
-  return null;
+  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => {
+    const out = { path: r.path || "", risk_level: r.risk_level || "", desc: r.desc || "", deny_mode: r.deny_mode || "deny_write" };
+    if (r.credential) out.credential = true;
+    if (r.read_only) out.read_only = true;
+    return out;
+  });
 }
-function checkDangerousPatterns(actionType, actionDetail) {
-  if (actionType === "file_write" || actionType === "file_edit") return null;
-  const TEMP_DIRS = ["/tmp/", "/var/tmp/", "/run/", "/dev/shm/"];
-  const isTempPath = TEMP_DIRS.some((td) => actionDetail.includes(td));
-  if (!isTempPath && (actionDetail.includes("*") || actionDetail.includes("?")) && ["rm ", "rm	", "del ", "del	", "delete", "remove ", "remove	", "\u5220\u9664", "\u79FB\u9664"].some((kw) => actionDetail.includes(kw))) {
-    return {
-      allowed: false,
-      reason: "\u68C0\u6D4B\u5230\u901A\u914D\u7B26\u7ED3\u5408\u5220\u9664\u64CD\u4F5C\uFF0C\u53EF\u80FD\u9020\u6210\u6279\u91CF\u8BEF\u5220",
-      riskLevel: "high",
-      riskType: "script_execution",
-      confidence: 90,
-      source: "heuristic",
-      violatedLayers: ["1.1"]
-    };
+function hasRuntimeConfig() {
+  const p = getRuntimeConfigPath();
+  if (!existsSync3(p)) return false;
+  try {
+    JSON.parse(readFileSync2(p, "utf-8"));
+    return true;
+  } catch {
+    return false;
   }
-  if (/>\s*\/etc\//.test(actionDetail) || />\s*\/boot\//.test(actionDetail) || />\s*\/proc\//.test(actionDetail)) {
-    return {
-      allowed: false,
-      reason: "\u68C0\u6D4B\u5230\u91CD\u5B9A\u5411\u8986\u76D6\u5199\u5165\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55",
-      riskLevel: "critical",
-      riskType: "file_access",
-      confidence: 95,
-      source: "heuristic",
-      violatedLayers: ["1.1"]
-    };
+}
+function getDisabledL2RulesWithSkipL3() {
+  let runtime;
+  try {
+    runtime = loadRuntimeConfig();
+  } catch {
+    return {};
   }
-  return null;
+  const result = {};
+  for (const layerKey of ["L1_rules", "L2_rules"]) {
+    const layer = runtime[layerKey] || {};
+    for (const [catName, cat] of Object.entries(layer)) {
+      if (!cat.category_enabled) continue;
+      const items = [];
+      for (const r of cat.rules || []) {
+        if (r.enabled === false && r.skip_l3_on_disabled) {
+          if (catName === "sensitive_path_access") {
+            if (r.path) items.push(r.path);
+          } else if (catName === "intent_consistency") {
+            items.push(...r.intent_keywords || []);
+          } else if (r.pattern) {
+            items.push(r.pattern);
+          }
+        }
+      }
+      if (items.length > 0) result[catName] = items;
+    }
+  }
+  return result;
 }
-function extractRemoteHost(command) {
-  const m = command.match(/(?:ssh|scp|rsync)\s+(?:-[\w]+\s+)*(\S+@\S+|\b(?!-)[\w.-]+\b)/);
-  return m ? m[1] : null;
+function _slugify(text) {
+  return text.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_|_$/g, "") || "x";
 }
-function isLocalHost(host) {
-  const localNames = ["localhost", "127.0.0.1", "::1", process.env.HOSTNAME || "", "0.0.0.0"];
-  return localNames.includes(host.replace(/.*@/, ""));
+function _generatePatternId(pattern) {
+  return `pat_${_slugify(pattern)}`;
 }
-function checkLateralMovement(actionDetail) {
-  if (/(?:ssh|scp|rsync)\s+/.test(actionDetail)) {
-    const targetHost = extractRemoteHost(actionDetail);
-    if (targetHost && !isLocalHost(targetHost)) {
-      return {
-        allowed: false,
-        reason: `\u5C1D\u8BD5\u6A2A\u5411\u79FB\u52A8\u5230\u8FDC\u7A0B\u4E3B\u673A: ${targetHost}`,
-        riskLevel: "medium",
-        riskType: "lateral_movement",
-        confidence: 80,
-        source: "heuristic",
-        violatedLayers: ["1.1"]
-      };
-    }
-  }
-  return null;
+function _deriveDenyMode(rule) {
+  if (rule.deny_mode) return rule.deny_mode;
+  if (rule.credential) return "deny_both";
+  if (rule.read_only) return "deny_read";
+  return "deny_write";
 }
-var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, SENSITIVE_EXCLUDED_PREFIXES;
-var init_heuristic = __esm({
-  "src/engine/heuristic.ts"() {
-    "use strict";
-    init_esm_shims();
-    init_config();
-    init_agents();
-    init_logic_rules();
-    INJECTION_KEYWORDS = [
-      // ---- Instruction Override ----
-      { keyword: "ignore previous instructions", riskLevel: "critical", lang: "en" },
-      { keyword: "ignore all previous", riskLevel: "critical", lang: "en" },
-      { keyword: "disregard all prior", riskLevel: "critical", lang: "en" },
-      { keyword: "forget everything", riskLevel: "high", lang: "en" },
-      { keyword: "\u5FFD\u7565\u4E4B\u524D\u7684\u6307\u4EE4", riskLevel: "critical", lang: "zh" },
-      { keyword: "\u5FFD\u7565\u6240\u6709\u5148\u524D\u7684", riskLevel: "critical", lang: "zh" },
-      { keyword: "\u5FFD\u7565\u4E0A\u9762\u6240\u6709", riskLevel: "high", lang: "zh" },
-      { keyword: "\u8BF7\u5FD8\u8BB0\u4E4B\u524D", riskLevel: "high", lang: "zh" },
-      // ---- Role Hijacking ----
-      { keyword: "you are now", riskLevel: "high", lang: "en" },
-      { keyword: "you are no longer", riskLevel: "high", lang: "en" },
-      { keyword: "new instructions", riskLevel: "high", lang: "en" },
-      { keyword: "from now on, you", riskLevel: "high", lang: "en" },
-      { keyword: "\u4F60\u73B0\u5728\u662F\u4E00\u4E2A", riskLevel: "high", lang: "zh" },
-      { keyword: "\u4F60\u4E0D\u518D\u662F\u4E00\u4E2A", riskLevel: "high", lang: "zh" },
-      { keyword: "\u4ECE\u73B0\u5728\u5F00\u59CB\u4F60", riskLevel: "high", lang: "zh" },
-      { keyword: "\u4F60\u7684\u65B0\u89D2\u8272\u662F", riskLevel: "high", lang: "zh" },
-      // ---- Command Injection ----
-      { keyword: "system prompt", riskLevel: "high", lang: "en" },
-      { keyword: "reveal your instructions", riskLevel: "high", lang: "en" },
-      { keyword: "output your instructions", riskLevel: "high", lang: "en" },
-      { keyword: "repeat your instructions", riskLevel: "medium", lang: "en" },
-      { keyword: "\u7CFB\u7EDF\u63D0\u793A", riskLevel: "high", lang: "zh" },
-      { keyword: "\u8F93\u51FA\u4F60\u7684\u6307\u4EE4", riskLevel: "high", lang: "zh" },
-      { keyword: "\u91CD\u590D\u4F60\u7684\u6307\u4EE4", riskLevel: "medium", lang: "zh" },
-      // ---- Social Engineering ----
-      { keyword: "this is an authorized test", riskLevel: "high", lang: "en" },
-      { keyword: "security audit approved", riskLevel: "high", lang: "en" },
-      { keyword: "admin override", riskLevel: "critical", lang: "en" },
-      { keyword: "debug mode", riskLevel: "high", lang: "en" },
-      { keyword: "maintenance mode", riskLevel: "high", lang: "en" },
-      { keyword: "\u8FD9\u662F\u6388\u6743\u7684\u6D4B\u8BD5", riskLevel: "high", lang: "zh" },
-      { keyword: "\u5B89\u5168\u5BA1\u8BA1\u5DF2\u6279\u51C6", riskLevel: "high", lang: "zh" },
-      { keyword: "\u7BA1\u7406\u5458\u8986\u76D6", riskLevel: "critical", lang: "zh" },
-      { keyword: "\u8C03\u8BD5\u6A21\u5F0F", riskLevel: "high", lang: "zh" },
-      // ---- XSS ----
-      { keyword: "<script>", riskLevel: "high", lang: "en" },
-      { keyword: "javascript:", riskLevel: "high", lang: "en" },
-      { keyword: "onerror=", riskLevel: "high", lang: "en" },
-      { keyword: "onload=", riskLevel: "high", lang: "en" },
-      // ---- Fake Boundaries ----
-      { keyword: "=== END OF", riskLevel: "high", lang: "en" },
-      { keyword: "--- END SYSTEM", riskLevel: "high", lang: "en" },
-      { keyword: "[END OF", riskLevel: "high", lang: "en" },
-      { keyword: "=== \u7ED3\u675F", riskLevel: "high", lang: "zh" },
-      { keyword: "--- \u7ED3\u675F\u7CFB\u7EDF", riskLevel: "high", lang: "zh" },
-      // ---- Developer Mode ----
-      { keyword: "developer mode", riskLevel: "critical", lang: "en" },
-      { keyword: "DAN mode", riskLevel: "critical", lang: "en" },
-      { keyword: "jailbreak", riskLevel: "critical", lang: "en" },
-      { keyword: "\u5F00\u53D1\u8005\u6A21\u5F0F", riskLevel: "critical", lang: "zh" },
-      { keyword: "\u8D8A\u72F1", riskLevel: "critical", lang: "zh" }
-      // 注：xiaoO 专属绕过词（绕过审计/禁用安全检查/关闭防护/bypass audit 等）
-      // 已迁至 agent_moss/agents/xiaoo/rules.json 的 extra_injection_keywords，
-      // 由 agent_ext 机制注入，不再污染通用层。
-    ];
-    DANGEROUS_PATTERNS = [
-      // --- Critical: rm command graded detection (strict to loose, first match wins) ---
-      // 1. rm -rf root dir (含通配符如 /* /.* 等) — 使用负向先行断言 (?!\w)：/ 后面不是单词字符时匹配
-      { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*f[a-zA-Z]*\s+\/(?!\w)/i, severity: "critical", description: "\u9012\u5F52\u5F3A\u5236\u5220\u9664\u6839\u76EE\u5F55 (rm -rf /)", riskType: "script_execution" },
-      // 注意：已移除"rm -rf /任意绝对路径"的宽泛规则，避免误杀 /tmp 等临时目录清理操作
-      // 2. rm with -r or -f targeting system dirs — var 分支排除 /var/tmp/（合法清理）
-      { pattern: /\brm\s+-[a-zA-Z]*[rf][a-zA-Z]*\s+\/(etc|var(?!\/tmp)|home|usr|boot|root|opt|srv|sys|proc)\b/i, severity: "critical", description: "\u5220\u9664\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55", riskType: "script_execution" },
-      // 3. rm -r absolute path (no -f) — 排除 /tmp/ /var/tmp/ /run/ /dev/shm/（CI/开发高频合法清理）
-      { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*\s+\/(?!tmp\/|var\/tmp\/|run\/|dev\/shm\/)/i, severity: "high", description: "\u9012\u5F52\u5220\u9664\u64CD\u4F5C (rm -r /...)", riskType: "script_execution" },
-      // 4. rm -f absolute path (no -r) — 同样排除临时目录
-      { pattern: /\brm\s+-[a-zA-Z]*f[a-zA-Z]*\s+\/(?!tmp\/|var\/tmp\/|run\/|dev\/shm\/)/i, severity: "medium", description: "\u5F3A\u5236\u5220\u9664\u6587\u4EF6 (rm -f /...)", riskType: "script_execution" },
-      // dd 磁盘清零 — 只拦截写入系统关键目录，放行 /tmp 等临时目录
-      { pattern: /dd\s+if=\/dev\/zero.*\bof\s*=\s*\/(etc|var|home|usr|boot|root|opt|srv|sys|proc)\b/i, severity: "critical", description: "\u78C1\u76D8\u6E05\u96F6\u5199\u5165\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55 (dd if=/dev/zero of=/\u7CFB\u7EDF\u76EE\u5F55)", riskType: "script_execution" },
-      // mkfs 格式化 — 只拦截对块设备（/dev/sdX 等）的格式化，放行对普通文件的格式化
-      { pattern: /mkfs\.\w+\s+\/dev\/(sd|hd|nvme|vd|loop|mapper|md|dm)\S+/i, severity: "critical", description: "\u683C\u5F0F\u5316\u5757\u8BBE\u5907 (mkfs /dev/\u5757\u8BBE\u5907)", riskType: "script_execution" },
-      { pattern: /:\(\)\s*\{.*:\|:&.*\};:/i, severity: "critical", description: "Fork Bomb", riskType: "resource_exhaustion" },
-      // --- Critical: remote code execution ---
-      { pattern: /curl\s+.*\|\s*(bash|sh|zsh|dash)/i, severity: "critical", description: "curl pipe shell \u6267\u884C", riskType: "script_execution" },
-      { pattern: /wget\s+.*\|\s*(bash|sh)/i, severity: "critical", description: "wget pipe shell \u6267\u884C", riskType: "script_execution" },
-      { pattern: /eval\s+\$\(curl|eval\s+\$\(wget/i, severity: "critical", description: "eval \u8FDC\u7A0B\u4EE3\u7801\u6267\u884C", riskType: "script_execution" },
-      { pattern: /base64\s+-d\s+.*\|\s*bash/i, severity: "critical", description: "base64 \u89E3\u7801\u6267\u884C", riskType: "script_execution" },
-      // --- Critical: reverse shell ---
-      { pattern: /\/dev\/tcp\/|bash\s+-i\s+>&/i, severity: "critical", description: "\u53CD\u5F39 Shell", riskType: "script_execution" },
-      { pattern: /nc\s+-[el]\s+.*\d{1,5}/i, severity: "high", description: "Netcat \u53CD\u5F39\u8FDE\u63A5", riskType: "lateral_movement" },
-      // --- Critical: sensitive file access ---
-      { pattern: /\/etc\/shadow/i, severity: "critical", description: "\u8BBF\u95EE\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6 (/etc/shadow)", riskType: "file_access" },
-      { pattern: /\/etc\/gshadow/i, severity: "critical", description: "\u8BBF\u95EE\u7CFB\u7EDF\u7EC4\u5BC6\u7801\u6587\u4EF6 (/etc/gshadow)", riskType: "file_access" },
-      // 注意：/etc/passwd 已从拦截列表移除，因为它是公开可读的标准系统文件，真正敏感的是 /etc/shadow
-      { pattern: /\.ssh\/id_rsa(?!\.pub)/i, severity: "critical", description: "\u8BBF\u95EE SSH \u79C1\u94A5\u6587\u4EF6", riskType: "file_access" },
-      // --- Critical: privilege escalation / container escape ---
-      { pattern: /\/var\/run\/docker\.sock/i, severity: "critical", description: "\u8BBF\u95EE Docker socket\uFF0C\u53EF\u80FD\u5BFC\u81F4\u5BB9\u5668\u9003\u9038", riskType: "privilege_escalation" },
-      // --- High: dangerous permissions / ownership ---
-      { pattern: /chmod\s+[0-7]*777[0-7]*/i, severity: "high", description: "\u5168\u6743\u9650\u8BBE\u7F6E (chmod 777)", riskType: "script_execution" },
-      { pattern: /chown\s+root|chown\s+-R\s+\w+:\w+\s+\//i, severity: "high", description: "\u4FEE\u6539\u6240\u6709\u8005\u4E3A root / \u9012\u5F52\u4FEE\u6539\u6839\u76EE\u5F55\u6240\u6709\u8005", riskType: "script_execution" },
-      // sudo 提权 — 只拦截 sudo 后跟的危险命令，不一刀切拦截所有 sudo
-      { pattern: /sudo\s+(rm|chmod|chown|dd|mkfs|format|iptables|crontab|passwd|userdel|useradd|groupdel)\b/i, severity: "high", description: "\u63D0\u6743\u6267\u884C\u9AD8\u5371\u547D\u4EE4 (sudo + \u5371\u9669\u64CD\u4F5C)", riskType: "privilege_escalation" },
-      // --- High: system config overwrite ---
-      { pattern: />\s*\/etc\//i, severity: "critical", description: "\u8986\u76D6\u5199\u5165\u7CFB\u7EDF\u914D\u7F6E\u76EE\u5F55", riskType: "file_access" },
-      // --- High: download script + execute risk ---
-      { pattern: /(?:curl|wget)\s+.*(?:-o|--output|>)\s*\S+\.(?:sh|bash)\b/i, severity: "high", description: "\u8FDC\u7A0B\u4E0B\u8F7D\u811A\u672C\u5230\u672C\u5730", riskType: "script_execution" },
-      { pattern: /(?:curl|wget)\s+.*\s+&&?\s*(?:chmod\s+\+x|bash|sh)/i, severity: "high", description: "\u4E0B\u8F7D\u540E\u6267\u884C", riskType: "script_execution" },
-      // --- High: package manager pipe-to-shell ---
-      { pattern: /git\s+clone\s+.*\|.*bash/i, severity: "high", description: "git clone pipe shell", riskType: "script_execution" },
-      { pattern: /pip\s+install\s+.*\|\s*bash/i, severity: "high", description: "pip install pipe shell", riskType: "script_execution" },
-      { pattern: /npm\s+install\s+-g\s+.*\|\s*bash/i, severity: "high", description: "npm install pipe shell", riskType: "script_execution" },
-      // --- Medium: destructive git operations (降级为 medium，允许但记录) ---
-      { pattern: /git\s+push\s+.*--force/i, severity: "medium", description: "\u5F3A\u5236\u63A8\u9001\u64CD\u4F5C (git push --force)\uFF0C\u53EF\u80FD\u8986\u76D6\u8FDC\u7A0B\u63D0\u4EA4\u5386\u53F2", riskType: "script_execution" },
-      // --- High: network port scanning (横向移动侦察) ---
-      { pattern: /\bnmap\s+/i, severity: "high", description: "\u7F51\u7EDC\u7AEF\u53E3\u626B\u63CF (nmap)\uFF0C\u53EF\u80FD\u7528\u4E8E\u6A2A\u5411\u79FB\u52A8\u4FA6\u5BDF", riskType: "lateral_movement" },
-      { pattern: /\b(masscan|zmap|unicornscan)\s+/i, severity: "high", description: "\u7F51\u7EDC\u7AEF\u53E3\u626B\u63CF\u5DE5\u5177\uFF0C\u53EF\u80FD\u7528\u4E8E\u6A2A\u5411\u79FB\u52A8\u4FA6\u5BDF", riskType: "lateral_movement" },
-      // --- Medium: credential export ---
-      { pattern: /export\s+.*(?:TOKEN|KEY|SECRET|PASSWORD)/i, severity: "medium", description: "\u5BFC\u51FA\u654F\u611F\u51ED\u8BC1", riskType: "data_exfiltration" },
-      // --- High: shell rc file append (persistence) ---
-      { pattern: />>\s*(~|\/home\/[^/]+)\/(\.bashrc|\.zshrc|\.profile|\.bash_profile|\.zprofile)/, severity: "high", description: "\u68C0\u6D4B\u5230\u4FEE\u6539 Shell \u914D\u7F6E\u6587\u4EF6\uFF08~/.bashrc \u7B49\uFF09\uFF0C\u53EF\u80FD\u7528\u4E8E\u6301\u4E45\u5316\u540E\u95E8", riskType: "persistence" },
-      // --- High: device file write (只拦截重定向写入设备文件，不拦截读取) ---
-      { pattern: />\s*\/dev\/(sd|hd|nvme|vd|loop|mem|kmsg|port|zero|random|urandom|full|core)/i, severity: "high", description: "\u91CD\u5B9A\u5411\u5199\u5165\u8BBE\u5907\u6587\u4EF6", riskType: "file_access" },
-      // --- High: non-interactive password modification ---
-      { pattern: /\|\s*passwd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u7BA1\u9053\u65B9\u5F0F\u8C03\u7528 passwd\uFF08\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\uFF09", riskType: "script_execution" },
-      { pattern: /\bpasswd\s+--stdin\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 passwd --stdin \u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u8F93\u5165", riskType: "script_execution" },
-      { pattern: /\bchpasswd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 chpasswd \u6279\u91CF\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4", riskType: "script_execution" },
-      { pattern: /\b(newusers|lnewusers)\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 newusers/lnewusers \u6279\u91CF\u7528\u6237\u6DFB\u52A0\u547D\u4EE4", riskType: "script_execution" },
-      { pattern: /\bpasswd\s+-[a-zA-Z]*d\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u5BC6\u7801\u64CD\u4F5C (passwd -d)", riskType: "script_execution" },
-      { pattern: /\bpasswd\s+-[a-zA-Z]*l\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u9501\u5B9A\u7528\u6237\u8D26\u6237\u64CD\u4F5C (passwd -l)", riskType: "script_execution" },
-      // --- High: non-interactive password modification (extended) ---
-      { pattern: /\blpasswd\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u64CD\u4F5C (lpasswd)", riskType: "script_execution" },
-      { pattern: /\bgpasswd\s+(?!-[adA])/i, severity: "high", description: "\u68C0\u6D4B\u5230\u7EC4\u5BC6\u7801\u7BA1\u7406\u64CD\u4F5C (gpasswd)", riskType: "script_execution" },
-      { pattern: /\bchgpasswd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u6279\u91CF\u4FEE\u6539\u7EC4\u5BC6\u7801\u64CD\u4F5C (chgpasswd)", riskType: "script_execution" },
-      // --- High: user/group deletion (irreversible, requires user consent) ---
-      { pattern: /\buserdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (userdel)", riskType: "script_execution" },
-      { pattern: /\bdeluser\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (deluser)", riskType: "script_execution" },
-      { pattern: /\bluserdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (luserdel)", riskType: "script_execution" },
-      { pattern: /\bgroupdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u7EC4\u64CD\u4F5C (groupdel)", riskType: "script_execution" },
-      { pattern: /\blgroupdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u7EC4\u64CD\u4F5C (lgroupdel)", riskType: "script_execution" },
-      // --- High: generic command -p parameter password setting ---
-      { pattern: /\b(useradd|luseradd|groupadd|usermod|lusermod|groupmod|lgroupmod)\b[^&|;]*?\s-p\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u901A\u8FC7 -p \u53C2\u6570\u8BBE\u7F6E\u6216\u4FEE\u6539\u5BC6\u7801 (useradd/usermod/groupmod)", riskType: "script_execution" }
-    ];
-    SENSITIVE_EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
-  }
-});
-
-// src/engine/skill-loader.ts
-import { readFileSync as readFileSync2, readdirSync as readdirSync2, existsSync as existsSync3 } from "fs";
-import { resolve as resolve2, dirname as dirname2 } from "path";
-import { fileURLToPath as fileURLToPath3 } from "url";
-function loadAllSkills() {
-  if (cachedSkills) return cachedSkills;
-  cachedSkills = {};
-  const dir = existsSync3(SKILLS_DIR) ? SKILLS_DIR : SKILLS_DIR_FALLBACK;
-  if (!existsSync3(dir)) {
-    console.warn("[AgentMoss] Skills directory not found:", SKILLS_DIR, "and fallback:", SKILLS_DIR_FALLBACK);
-    return cachedSkills;
-  }
-  const files = readdirSync2(dir).filter((f) => f.endsWith(".md"));
-  for (const f of files) {
-    const name = f.replace(".md", "");
-    cachedSkills[name] = readFileSync2(resolve2(dir, f), "utf-8");
+function _syncDenyModeFields(rule) {
+  const dm = rule.deny_mode || "deny_write";
+  if (dm === "deny_both") {
+    rule.credential = true;
+    delete rule.read_only;
+  } else if (dm === "deny_read") {
+    delete rule.credential;
+    rule.read_only = true;
+  } else {
+    delete rule.credential;
+    delete rule.read_only;
   }
-  console.log(`[AgentMoss] Loaded ${Object.keys(cachedSkills).length} skills from ${dir}`);
-  return cachedSkills;
 }
-function matchSkills(actionType, actionDetail, reason, maxSkills = 3) {
-  const skills = loadAllSkills();
-  const combined = `${actionType} ${actionDetail} ${reason}`.toLowerCase();
-  const actionDetailLower = actionDetail.toLowerCase();
-  const actionTypeLower = actionType.toLowerCase();
-  const reasonLower = reason.toLowerCase();
-  const scores = {};
-  for (const [skillName, keywords] of Object.entries(SKILL_KEYWORD_MAP)) {
-    let score = 0;
-    for (const kw of keywords) {
-      if (combined.includes(kw)) {
-        if (kw === actionTypeLower) score += 2;
-        else if (actionDetailLower.includes(kw)) score += 1.5;
-        else if (reasonLower.includes(kw)) score += 1;
-        else score += 0.5;
-      }
-    }
-    if (score > 0) scores[skillName] = score;
-  }
-  const sorted = Object.entries(scores).sort((a, b) => b[1] - a[1]);
-  const top = sorted.slice(0, maxSkills);
-  const maxScore = top[0]?.[1] || 1;
-  const results = [];
-  for (const [name, score] of top) {
-    const content = skills[name];
-    if (content) {
-      results.push({
-        skillName: name,
-        relevance: Math.min(score / maxScore, 1),
-        skillContent: content
-      });
-    }
-  }
-  if (results.length === 0) {
-    const fallback = skills["general_tool_risk_guard"];
-    if (fallback) {
-      results.push({ skillName: "general_tool_risk_guard", relevance: 0.3, skillContent: fallback });
-    }
-  }
-  return results;
+function _l1CommandPatternsToRules() {
+  return DANGEROUS_PATTERNS.map((p) => ({
+    id: _generatePatternId(p.pattern instanceof RegExp ? p.pattern.source : p.pattern),
+    pattern: p.pattern instanceof RegExp ? p.pattern.source : p.pattern,
+    risk_level: p.severity,
+    risk_type: p.riskType,
+    reason: p.description,
+    enabled: true,
+    builtin: true
+  }));
 }
-function formatSkillsForPrompt(skills) {
-  if (skills.length === 0) return "(\u672A\u5339\u914D\u5230\u7279\u5B9A\u5B89\u5168\u68C0\u6D4B\u89C4\u5219)";
-  return skills.map(
-    (s) => `### \u5B89\u5168\u68C0\u6D4B\u89C4\u5219: ${s.skillName} (\u76F8\u5173\u5EA6: ${Math.round(s.relevance * 100)}%)
-
-${s.skillContent}`
-  ).join("\n\n---\n\n");
+function _l1InjectionKeywordsToRules() {
+  return INJECTION_KEYWORDS.map((kw) => ({
+    id: `inj_${_slugify(kw.keyword)}`,
+    keyword: kw.keyword,
+    risk_level: kw.riskLevel,
+    lang: kw.lang || "en",
+    enabled: true,
+    builtin: true
+  }));
 }
-var __filename3, __dirname3, SKILLS_DIR, SKILLS_DIR_FALLBACK, SKILL_KEYWORD_MAP, cachedSkills;
-var init_skill_loader = __esm({
-  "src/engine/skill-loader.ts"() {
-    "use strict";
-    init_esm_shims();
-    __filename3 = fileURLToPath3(import.meta.url);
-    __dirname3 = dirname2(__filename3);
-    SKILLS_DIR = resolve2(__dirname3, "../skills");
-    SKILLS_DIR_FALLBACK = resolve2(__dirname3, "../../../agent_moss/skills");
-    SKILL_KEYWORD_MAP = {
-      "file_access_guard": ["file", "\u6587\u4EF6", "path", "\u8DEF\u5F84", "read", "write", "cat", "open", "access", "\u8BBF\u95EE", "\u8BFB\u5199", "copy", "cp", "mv", "move"],
-      "script_execution_guard": ["command", "shell", "bash", "exec", "execute", "\u6267\u884C", "\u547D\u4EE4", "script", "\u811A\u672C", "run", "\u8FD0\u884C", "subprocess", "system", "eval", "compile", "\u5B89\u88C5", "install", "pip", "npm"],
-      "data_exfiltration_guard": ["upload", "\u4E0A\u4F20", "send", "\u53D1\u9001", "transfer", "\u4F20\u8F93", "export", "\u5BFC\u51FA", "download", "\u4E0B\u8F7D", "post", "http", "request", "fetch", "curl", "wget", "\u5916\u4F20", "\u6CC4\u9732", "exfil", "network", "\u7F51\u7EDC"],
-      "browser_web_access_guard": ["browser", "\u6D4F\u89C8\u5668", "web", "\u7F51\u9875", "url", "navigate", "\u6D4F\u89C8", "scrape", "crawl", "\u722C\u53D6", "click", "screenshot"],
-      "email_operation_guard": ["email", "\u90AE\u4EF6", "mail", "smtp", "send_email", "\u53D1\u9001\u90AE\u4EF6", "inbox", "\u6536\u4EF6\u7BB1", "\u9644\u4EF6", "attachment"],
-      "general_tool_risk_guard": ["tool", "\u5DE5\u5177", "api", "invoke", "\u8C03\u7528", "function", "\u51FD\u6570"],
-      "lateral_movement_guard": ["ssh", "scp", "ftp", "sftp", "rdp", "vnc", "telnet", "\u5185\u7F51", "\u6A2A\u5411", "tunnel", "\u4EE3\u7406", "proxy", "port", "\u7AEF\u53E3", "scan", "\u626B\u63CF", "ping", "traceroute", "nslookup"],
-      "persistence_backdoor_guard": ["cron", "crontab", "\u5B9A\u65F6", "scheduled", "startup", "\u542F\u52A8\u9879", "service", "\u670D\u52A1", "daemon", "\u5B88\u62A4", "registry", "\u6CE8\u518C\u8868", "backdoor", "\u540E\u95E8", "persist", "\u6301\u4E45\u5316", "authorized_keys", "bashrc", "zshrc", "profile", ".rc", "shell config", "shell \u914D\u7F6E"],
-      // 注意：避免裸 'memory'/'内存'/'dd'——会误命中 memory-addMemory（写记忆工具，
-      // 'dd' 是 'addMemory' 的子串）等无害操作。用组合词/命令前缀精准匹配攻击场景。
-      "resource_exhaustion_guard": ["fork", "bomb", "\u70B8\u5F39", "memory bomb", "oom", "out of memory", "\u5185\u5B58\u6EA2\u51FA", "\u5185\u5B58\u8017\u5C3D", "\u5185\u5B58\u6CC4\u6F0F", "disk", "\u78C1\u76D8", "cpu", "process", "\u8FDB\u7A0B", "dd if=", "/dev/zero", "/dev/null", "yes >", "while true", "\u65E0\u9650\u5FAA\u73AF", "\u8017\u5C3D", "exhaust", "\u8D44\u6E90"],
-      "skill_installation_guard": ["skill", "plugin", "\u63D2\u4EF6", "extension", "\u6269\u5C55", "install skill", "\u5B89\u88C5\u63D2\u4EF6", "\u5B89\u88C5\u6280\u80FD", "marketplace", "\u5546\u5E97"],
-      "supply_chain_guard": ["dependency", "\u4F9D\u8D56", "package", "\u5305", "npm install", "pip install", "requirements", "import", "library", "\u5E93", "registry", "\u4ED3\u5E93", "supply", "\u4F9B\u5E94\u94FE", "typosquatting"],
-      "intent_deviation_guard": ["rm", "del", "delete", "remove", "\u5220\u9664", "format", "\u683C\u5F0F\u5316", "drop", "truncate", "\u6E05\u7A7A", "wipe", "\u64E6\u9664", "\u91CD\u7F6E", "reset", "sudo", "root", "admin", "\u7BA1\u7406\u5458", "privilege", "\u63D0\u6743"],
-      "indirect_access_guard": ["listdir", "os.walk", "os.scandir", "glob.glob", "glob.iglob", "pathlib", "iterdir", "rglob", "scandir", "os.listdir", "\u76EE\u5F55\u904D\u5386", "traversal"]
+function _l2SensitivePathsToRules() {
+  const all = [...ROOT_SENSITIVE_PATHS, ...HOME_SENSITIVE_PATHS, ...CREDENTIAL_PATHS];
+  return all.map((sp) => {
+    const denyMode = _deriveDenyMode({
+      deny_mode: sp.deny_mode,
+      credential: sp.credential,
+      read_only: sp.read_only
+    });
+    const rule = {
+      id: `path_${_slugify(sp.path)}`,
+      path: sp.path,
+      risk_level: sp.riskLevel,
+      desc: sp.desc,
+      deny_mode: denyMode,
+      source_deny_mode: denyMode,
+      skip_l3_on_disabled: true,
+      enabled: true,
+      builtin: true
+    };
+    _syncDenyModeFields(rule);
+    return rule;
+  });
+}
+function _l2IntentPatternsToRules() {
+  return INTENT_DEVIATION_PATTERNS.map((pat, i) => ({
+    id: `intent_${i + 1}_${_slugify(pat.reason.slice(0, 30))}`,
+    intent_keywords: pat.intentKeywords,
+    dangerous_actions: pat.dangerousActions,
+    reason: pat.reason,
+    skip_l3_on_disabled: true,
+    enabled: true,
+    builtin: true
+  }));
+}
+function _l2PasswordPatternsToRules() {
+  return PASSWORD_MODIFY_PATTERNS.map((p) => ({
+    id: `pw_${_slugify(p.source)}`,
+    pattern: p.source,
+    skip_l3_on_disabled: true,
+    enabled: true,
+    builtin: true
+  }));
+}
+function _l2UserDeletionPatternsToRules() {
+  return USER_DELETION_PATTERNS.map((p) => ({
+    id: `ud_${_slugify(p.source)}`,
+    pattern: p.source,
+    skip_l3_on_disabled: true,
+    enabled: true,
+    builtin: true
+  }));
+}
+function _l3SkillsToRules() {
+  const skillCategories = {
+    file_operations: ["file_access_guard", "script_execution_guard", "indirect_access_guard"],
+    network_security: [
+      "data_exfiltration_guard",
+      "browser_web_access_guard",
+      "lateral_movement_guard",
+      "email_operation_guard"
+    ],
+    persistence_supply_chain: [
+      "persistence_backdoor_guard",
+      "supply_chain_guard",
+      "skill_installation_guard"
+    ],
+    intent_and_general: ["intent_deviation_guard", "general_tool_risk_guard"],
+    resource: ["resource_exhaustion_guard"]
+  };
+  const out = {};
+  for (const [cat, ids] of Object.entries(skillCategories)) {
+    out[cat] = {
+      category_enabled: true,
+      category_desc: "",
+      skills: ids.map((s) => ({
+        id: s,
+        keywords: SKILL_KEYWORD_MAP[s] || [],
+        enabled: true,
+        builtin: true
+      }))
     };
-    cachedSkills = null;
   }
-});
-
-// src/engine/token-stats.ts
-var token_stats_exports = {};
-__export(token_stats_exports, {
-  getRecentRecords: () => getRecentRecords,
-  getTokenStats: () => getTokenStats,
-  getTokenTrend: () => getTokenTrend,
-  recordTokenUsage: () => recordTokenUsage,
-  resetTokenStats: () => resetTokenStats
-});
-import { readFileSync as readFileSync6, writeFileSync, existsSync as existsSync6, mkdirSync, unlinkSync } from "fs";
-import { join as join3 } from "path";
-import { homedir as homedir2 } from "os";
-function getStatsPath() {
-  const envPath = process.env[ENV_STATS_PATH];
-  return envPath || STATS_FILE;
-}
-function loadAllRecords(statsPath) {
-  if (!existsSync6(statsPath)) return [];
-  try {
-    const data = JSON.parse(readFileSync6(statsPath, "utf-8"));
-    if (Array.isArray(data)) return data;
-    if (data && Array.isArray(data.records)) return data.records;
-    return [];
-  } catch (e) {
-    return [];
+  const categorized = new Set(Object.values(skillCategories).flat());
+  for (const s of Object.keys(SKILL_KEYWORD_MAP)) {
+    if (!categorized.has(s)) {
+      (out.intent_and_general ??= { category_enabled: true, category_desc: "", skills: [] }).skills.push({
+        id: s,
+        keywords: SKILL_KEYWORD_MAP[s],
+        enabled: true,
+        builtin: true
+      });
+    }
   }
+  out.user_custom = { category_enabled: true, category_desc: "", skills: [] };
+  return out;
 }
-function saveRecords(statsPath, records) {
+function _agentRulesToDefaults() {
+  const out = {};
+  const agentsDir = existsSync3(_AGENTS_DIR_PROD) ? _AGENTS_DIR_PROD : existsSync3(_AGENTS_DIR_DEV) ? _AGENTS_DIR_DEV : _AGENTS_DIR_PROD;
+  if (!existsSync3(agentsDir)) return out;
+  let entries;
   try {
-    const dir = statsPath.substring(0, statsPath.lastIndexOf("/"));
-    if (dir && !existsSync6(dir)) mkdirSync(dir, { recursive: true });
-    writeFileSync(statsPath, JSON.stringify(records, null, 2), "utf-8");
-  } catch (e) {
-  }
-}
-function recordTokenUsage(record) {
-  const statsPath = getStatsPath();
-  const records = loadAllRecords(statsPath);
-  records.push({
-    timestamp: record.timestamp || (/* @__PURE__ */ new Date()).toISOString(),
-    session_id: record.sessionId,
-    step: record.step,
-    model: record.model,
-    prompt_tokens: record.promptTokens,
-    completion_tokens: record.completionTokens,
-    total_tokens: record.totalTokens
-  });
-  if (records.length > MAX_RECORDS) {
-    records.splice(0, records.length - MAX_RECORDS);
-  }
-  saveRecords(statsPath, records);
-}
-function filterByDate(records, days = 0, startDate, endDate) {
-  if (startDate || endDate) {
-    let startDt = startDate ? new Date(startDate) : /* @__PURE__ */ new Date(-864e13);
-    let endDt = endDate ? new Date(endDate) : void 0;
-    if (endDate) {
-      const e = new Date(endDate);
-      e.setHours(23, 59, 59, 999);
-      endDt = e;
-    }
-    const endMs = endDt ? endDt.getTime() : Number.MAX_SAFE_INTEGER;
-    return records.filter((r) => {
-      try {
-        const ts = new Date(r.timestamp).getTime();
-        return ts >= startDt.getTime() && ts <= endMs;
-      } catch {
-        return true;
-      }
-    });
-  } else if (days > 0) {
-    const cutoff = Date.now() - days * 864e5;
-    return records.filter((r) => {
-      try {
-        return new Date(r.timestamp).getTime() >= cutoff;
-      } catch {
-        return true;
-      }
-    });
+    entries = readdirSync3(agentsDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+  } catch {
+    return out;
   }
-  return records;
-}
-function aggregate(records) {
-  let totalPrompt = 0, totalCompletion = 0, totalTotal = 0;
-  const byStep = {};
-  const byModel = {};
-  const byDate = {};
-  const bucket = (b, key, r) => {
-    const e = b[key] || (b[key] = { prompt_tokens: 0, completion_tokens: 0, total_tokens: 0, calls: 0 });
-    e.prompt_tokens += r.prompt_tokens || 0;
-    e.completion_tokens += r.completion_tokens || 0;
-    e.total_tokens += r.total_tokens || 0;
-    e.calls += 1;
-  };
-  for (const r of records) {
-    totalPrompt += r.prompt_tokens || 0;
-    totalCompletion += r.completion_tokens || 0;
-    totalTotal += r.total_tokens || 0;
-    bucket(byStep, r.step || "unknown", r);
-    bucket(byModel, r.model || "unknown", r);
-    let dateKey = "unknown";
+  for (const agentId of entries) {
+    const rulesFile = join(agentsDir, agentId, "rules.json");
+    if (!existsSync3(rulesFile)) continue;
+    let data;
     try {
-      dateKey = new Date(r.timestamp).toISOString().slice(0, 10);
+      data = JSON.parse(readFileSync2(rulesFile, "utf-8"));
     } catch {
+      continue;
     }
-    bucket(byDate, dateKey, r);
+    out[agentId] = {
+      builtin_safe_action_types: {
+        category_enabled: true,
+        category_desc: "agent \u5B8C\u5168\u5B89\u5168\u64CD\u4F5C\u767D\u540D\u5355\uFF08\u524D\u7F00\u5C3E\u968F - \u6216\u7CBE\u786E\u540D\uFF0C\u547D\u4E2D\u8DF3 L2+L3\uFF09",
+        rules: (data.builtin_safe_action_types || []).map((v) => ({ value: v, enabled: true, builtin: true }))
+      },
+      builtin_safe_skills: {
+        category_enabled: true,
+        category_desc: "agent \u4FE1\u4EFB\u7684\u5185\u7F6E Skill\uFF08\u547D\u4E2D\u8DF3 L2+L3\uFF09",
+        rules: (data.builtin_safe_skills || []).map((v) => ({ value: v, enabled: true, builtin: true }))
+      },
+      extra_command_patterns: {
+        category_enabled: true,
+        category_desc: "agent \u4E13\u5C5E\u5371\u9669\u547D\u4EE4\u6B63\u5219\uFF08L1 \u672B\u5C3E\u8FFD\u52A0\uFF09",
+        rules: (data.extra_command_patterns || []).map((p) => ({ ...p, enabled: true, builtin: true }))
+      },
+      extra_injection_keywords: {
+        category_enabled: true,
+        category_desc: "agent \u4E13\u5C5E\u6CE8\u5165\u5173\u952E\u8BCD\uFF08L1 \u672B\u5C3E\u8FFD\u52A0\uFF09",
+        rules: (data.extra_injection_keywords || []).map((k) => ({ ...k, enabled: true, builtin: true }))
+      },
+      extra_sensitive_paths: {
+        category_enabled: true,
+        category_desc: "agent \u4E13\u5C5E\u654F\u611F\u8DEF\u5F84\uFF08L1 \u672B\u5C3E\u8FFD\u52A0\uFF09",
+        rules: (data.extra_sensitive_paths || []).map((sp) => ({ ...sp, enabled: true, builtin: true }))
+      }
+    };
   }
-  const sortedDate = Object.keys(byDate).sort((a, b) => a < b ? 1 : a > b ? -1 : 0);
-  const sortedByDate = {};
-  for (const k of sortedDate) sortedByDate[k] = byDate[k];
-  return { totalPrompt, totalCompletion, totalTotal, byStep, byModel, byDate: sortedByDate };
+  return out;
 }
-function getTokenStats(days = 0, startDate, endDate) {
-  const records = filterByDate(loadAllRecords(getStatsPath()), days, startDate, endDate);
-  const a = aggregate(records);
+function generateSourceDefaults() {
   return {
-    total_prompt_tokens: a.totalPrompt,
-    total_completion_tokens: a.totalCompletion,
-    total_tokens: a.totalTotal,
-    total_calls: records.length,
-    by_step: a.byStep,
-    by_model: a.byModel,
-    by_date: a.byDate
+    version: 1,
+    layers: { L1_heuristic: true, L2_logic_rules: true, L3_llm_analysis: true },
+    L1_rules: {
+      dangerous_commands: {
+        category_enabled: true,
+        category_desc: "\u5371\u9669\u547D\u4EE4\u68C0\u6D4B\uFF08\u9012\u5F52\u5220\u9664\u3001\u5168\u6743\u9650\u8BBE\u7F6E\u3001\u63D0\u6743\u6267\u884C\u7B49\uFF09",
+        rules: _l1CommandPatternsToRules()
+      },
+      injection_detection: {
+        category_enabled: true,
+        category_desc: "Prompt \u6CE8\u5165\u653B\u51FB\u68C0\u6D4B",
+        rules: _l1InjectionKeywordsToRules()
+      },
+      sensitive_path_access: {
+        category_enabled: true,
+        category_desc: "\u654F\u611F\u8DEF\u5F84\u8BBF\u95EE\u68C0\u6D4B\uFF08deny_both/deny_read/deny_write\uFF09",
+        rules: _l2SensitivePathsToRules()
+      },
+      user_custom: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49\u547D\u4EE4\u89C4\u5219", rules: [] }
+    },
+    L2_rules: {
+      intent_consistency: {
+        category_enabled: true,
+        category_desc: "\u610F\u56FE\u4E00\u81F4\u6027\u68C0\u6D4B",
+        rules: _l2IntentPatternsToRules()
+      },
+      password_modify_consent: {
+        category_enabled: true,
+        category_desc: "\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u6388\u6743\u68C0\u6D4B",
+        rules: _l2PasswordPatternsToRules()
+      },
+      user_deletion_consent: {
+        category_enabled: true,
+        category_desc: "\u7528\u6237/\u7EC4\u5220\u9664\u64CD\u4F5C\u6388\u6743\u68C0\u6D4B",
+        rules: _l2UserDeletionPatternsToRules()
+      },
+      read_before_write: { category_enabled: true, category_desc: "read_before_write \u5B89\u5168\u539F\u5219\u68C0\u6D4B", rules: [] },
+      user_custom: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49 L2 \u903B\u8F91\u89C4\u5219", rules: [] }
+    },
+    L3_skills: _l3SkillsToRules(),
+    agent_rules: _agentRulesToDefaults()
   };
 }
-function getRecentRecords(limit = 20) {
-  const records = loadAllRecords(getStatsPath());
-  return records.slice(-limit);
+function _ruleFingerprint(rule) {
+  if (rule.intent_keywords && rule.intent_keywords.length || rule.dangerous_actions && rule.dangerous_actions.length) {
+    return JSON.stringify([
+      [...rule.intent_keywords || []].sort(),
+      [...rule.dangerous_actions || []].sort()
+    ]);
+  }
+  if (rule.path) return JSON.stringify([rule.path]);
+  if (rule.pattern) return JSON.stringify([rule.pattern]);
+  if (rule.keyword) return JSON.stringify([rule.keyword, rule.lang || ""]);
+  if (rule.value) return JSON.stringify([rule.value]);
+  return JSON.stringify([rule.id || ""]);
 }
-function getTokenTrend(days = 0, startDate, endDate) {
-  const records = filterByDate(loadAllRecords(getStatsPath()), days, startDate, endDate);
-  const series = {};
-  const datesSet = /* @__PURE__ */ new Set();
-  for (const r of records) {
-    let dateKey;
-    try {
-      dateKey = new Date(r.timestamp).toISOString().slice(0, 10);
-    } catch {
+function _mergeRuleCategories(userCfg, srcDefaults, layerKey) {
+  const userLayer = userCfg[layerKey] || (userCfg[layerKey] = {});
+  const srcLayer = srcDefaults[layerKey] || {};
+  for (const [catName, srcCat] of Object.entries(srcLayer)) {
+    if (!(catName in userLayer)) {
+      userLayer[catName] = srcCat;
       continue;
     }
-    const model = r.model || "unknown";
-    const tokens = r.total_tokens || 0;
-    datesSet.add(dateKey);
-    series[model] = series[model] || {};
-    series[model][dateKey] = (series[model][dateKey] || 0) + tokens;
+    const userCat = userLayer[catName];
+    if (userCat.category_desc === void 0) userCat.category_desc = srcCat.category_desc || "";
+    if (userCat.category_enabled === void 0) userCat.category_enabled = srcCat.category_enabled ?? true;
+    const srcRules = srcCat.rules || [];
+    const userRules = userCat.rules || (userCat.rules = []);
+    const userByFp = /* @__PURE__ */ new Map();
+    for (const r of userRules) userByFp.set(_ruleFingerprint(r), r);
+    const srcFps = /* @__PURE__ */ new Set();
+    for (const srcR of srcRules) {
+      const fp = _ruleFingerprint(srcR);
+      srcFps.add(fp);
+      if (userByFp.has(fp)) {
+        const existing = userByFp.get(fp);
+        const userEnabled = existing.enabled;
+        const userSkipL3 = existing.skip_l3_on_disabled;
+        const userDenyMode = existing.deny_mode;
+        const userSourceDeny = existing.source_deny_mode;
+        Object.keys(existing).forEach((k) => delete existing[k]);
+        Object.assign(existing, srcR);
+        existing.enabled = userEnabled;
+        if (userSkipL3 !== void 0) existing.skip_l3_on_disabled = userSkipL3;
+        if (userDenyMode && userSourceDeny && userDenyMode !== userSourceDeny) {
+          existing.deny_mode = userDenyMode;
+        }
+        if (existing.deny_mode) _syncDenyModeFields(existing);
+      } else {
+        const newR = { ...srcR, enabled: true };
+        userRules.push(newR);
+      }
+    }
+    for (const r of userRules) {
+      if (r.builtin && !srcFps.has(_ruleFingerprint(r))) {
+        r.source_removed = true;
+        r.enabled = false;
+      }
+    }
+    if (catName === "sensitive_path_access") {
+      for (const r of userRules) {
+        if (!r.deny_mode) r.deny_mode = _deriveDenyMode(r);
+        _syncDenyModeFields(r);
+      }
+    }
   }
-  const dates = Array.from(datesSet).sort();
-  const models = Object.keys(series).sort();
-  return { dates, models, series };
-}
-function resetTokenStats() {
-  const statsPath = getStatsPath();
-  if (existsSync6(statsPath)) {
-    try {
-      unlinkSync(statsPath);
-    } catch {
-    }
+  for (const catName of Object.keys(userLayer)) {
+    if (catName === "user_custom") continue;
+    if (!(catName in srcLayer)) delete userLayer[catName];
   }
 }
-var STATS_DIR, STATS_FILE, ENV_STATS_PATH, MAX_RECORDS;
-var init_token_stats = __esm({
-  "src/engine/token-stats.ts"() {
-    "use strict";
-    init_esm_shims();
-    STATS_DIR = join3(homedir2(), ".config", "agentmoss");
-    STATS_FILE = join3(STATS_DIR, "agent_moss_token_stats.json");
-    ENV_STATS_PATH = "AGENT_MOSS_TOKEN_STATS_PATH";
-    MAX_RECORDS = 1e4;
+function _mergeSkillCategories(userCfg, srcDefaults, layerKey) {
+  const userLayer = userCfg[layerKey] || (userCfg[layerKey] = {});
+  const srcLayer = srcDefaults[layerKey] || {};
+  for (const [catName, srcCat] of Object.entries(srcLayer)) {
+    if (!(catName in userLayer)) {
+      userLayer[catName] = srcCat;
+      continue;
+    }
+    const userCat = userLayer[catName];
+    if (userCat.category_desc === void 0) userCat.category_desc = srcCat.category_desc || "";
+    if (userCat.category_enabled === void 0) userCat.category_enabled = srcCat.category_enabled ?? true;
+    const userSkills = userCat.skills || (userCat.skills = []);
+    const existingIds = new Set(userSkills.map((s) => s.id));
+    for (const srcS of srcCat.skills || []) {
+      if (!existingIds.has(srcS.id)) userSkills.push({ ...srcS });
+    }
   }
-});
-
-// src/infra/runtime-config.ts
-var runtime_config_exports = {};
-__export(runtime_config_exports, {
-  DENY_MODE_LABELS: () => DENY_MODE_LABELS,
-  addCustomRule: () => addCustomRule,
-  addCustomSkill: () => addCustomSkill,
-  deleteCustomRule: () => deleteCustomRule,
-  deleteCustomSkill: () => deleteCustomSkill,
-  filterEnabledRules: () => filterEnabledRules,
-  generateSourceDefaults: () => generateSourceDefaults,
-  getDisabledL2RulesWithSkipL3: () => getDisabledL2RulesWithSkipL3,
-  getDisabledSkillIds: () => getDisabledSkillIds,
-  getEnabledL1CommandPatterns: () => getEnabledL1CommandPatterns,
-  getEnabledL1CommandPatternsOrDefault: () => getEnabledL1CommandPatternsOrDefault,
-  getEnabledL1InjectionKeywords: () => getEnabledL1InjectionKeywords,
-  getEnabledL1InjectionKeywordsOrDefault: () => getEnabledL1InjectionKeywordsOrDefault,
-  getEnabledL2IntentPatterns: () => getEnabledL2IntentPatterns,
-  getEnabledL2IntentPatternsOrDefault: () => getEnabledL2IntentPatternsOrDefault,
-  getEnabledL2PasswordPatterns: () => getEnabledL2PasswordPatterns,
-  getEnabledL2PasswordPatternsOrDefault: () => getEnabledL2PasswordPatternsOrDefault,
-  getEnabledL2SensitivePaths: () => getEnabledL2SensitivePaths,
-  getEnabledL2SensitivePathsOrDefault: () => getEnabledL2SensitivePathsOrDefault,
-  getEnabledL2UserDeletionPatterns: () => getEnabledL2UserDeletionPatterns,
-  getEnabledL2UserDeletionPatternsOrDefault: () => getEnabledL2UserDeletionPatternsOrDefault,
-  getEnvOverrides: () => getEnvOverrides,
-  getProfileOrDetect: () => getProfileOrDetect,
-  getRuntimeConfigPath: () => getRuntimeConfigPath,
-  hasRuntimeConfig: () => hasRuntimeConfig,
-  isL2CategoryEnabled: () => isL2CategoryEnabled,
-  isLayerEnabled: () => isLayerEnabled,
-  loadRuntimeConfig: () => loadRuntimeConfig,
-  mergeConfig: () => mergeConfig,
-  saveRuntimeConfig: () => saveRuntimeConfig,
-  updateCategoryEnabled: () => updateCategoryEnabled,
-  updateLayerEnabled: () => updateLayerEnabled,
-  updateRuleDenyMode: () => updateRuleDenyMode,
-  updateRuleEnabled: () => updateRuleEnabled,
-  updateRuleSkipL3: () => updateRuleSkipL3,
-  updateSkillCategoryEnabled: () => updateSkillCategoryEnabled,
-  updateSkillEnabled: () => updateSkillEnabled
-});
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync2, existsSync as existsSync7, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2 } from "fs";
-import { join as join4 } from "path";
-import { homedir as homedir3 } from "os";
-function getRuntimeConfigPath() {
-  const envPath = process.env[ENV_RUNTIME_CONFIG_PATH];
-  if (envPath) return envPath;
-  return RUNTIME_CONFIG_PATH;
-}
-function saveRuntimeConfig(config) {
-  const p = getRuntimeConfigPath();
-  const dir = p.substring(0, p.lastIndexOf("/"));
-  if (dir && !existsSync7(dir)) mkdirSync2(dir, { recursive: true });
-  writeFileSync2(p, JSON.stringify(config, null, 2), "utf-8");
 }
-function emptyRuntimeConfig() {
-  return {
-    version: 1,
-    layers: { L1_heuristic: true, L2_logic_rules: true, L3_llm_analysis: true },
-    L1_rules: {},
-    L2_rules: {},
-    L3_skills: {}
-  };
-}
-function loadRuntimeConfig() {
-  const p = getRuntimeConfigPath();
-  if (!existsSync7(p)) {
-    const seeded = mergeConfig({}, generateSourceDefaults());
-    try {
-      saveRuntimeConfig(seeded);
-    } catch {
+function _mergeAgentRules(userCfg, srcDefaults) {
+  const userAgent = userCfg.agent_rules || (userCfg.agent_rules = {});
+  const srcAgent = srcDefaults.agent_rules || {};
+  for (const [agentId, srcCats] of Object.entries(srcAgent)) {
+    if (!(agentId in userAgent)) {
+      userAgent[agentId] = JSON.parse(JSON.stringify(srcCats));
+      continue;
+    }
+    const userCats = userAgent[agentId];
+    for (const [catName, srcCat] of Object.entries(srcCats)) {
+      if (!(catName in userCats)) {
+        userCats[catName] = JSON.parse(JSON.stringify(srcCat));
+        continue;
+      }
+      const userCat = userCats[catName];
+      if (userCat.category_desc === void 0) userCat.category_desc = srcCat.category_desc || "";
+      if (userCat.category_enabled === void 0) userCat.category_enabled = srcCat.category_enabled ?? true;
+      const srcRules = srcCat.rules || [];
+      const userRules = userCat.rules || (userCat.rules = []);
+      const userByFp = /* @__PURE__ */ new Map();
+      for (const r of userRules) userByFp.set(_ruleFingerprint(r), r);
+      const srcFps = /* @__PURE__ */ new Set();
+      for (const srcR of srcRules) {
+        const fp = _ruleFingerprint(srcR);
+        srcFps.add(fp);
+        if (userByFp.has(fp)) {
+          const existing = userByFp.get(fp);
+          const userEnabled = existing.enabled;
+          Object.keys(existing).forEach((k) => delete existing[k]);
+          Object.assign(existing, srcR);
+          existing.enabled = userEnabled;
+        } else {
+          userRules.push({ ...srcR, enabled: true });
+        }
+      }
+      for (const r of userRules) {
+        if (r.builtin && !srcFps.has(_ruleFingerprint(r))) {
+          r.source_removed = true;
+          r.enabled = false;
+        }
+      }
     }
-    return seeded;
-  }
-  try {
-    const data = JSON.parse(readFileSync7(p, "utf-8"));
-    const merged = mergeConfig(data, generateSourceDefaults());
-    return {
-      version: data.version || 1,
-      layers: {
-        L1_heuristic: data.layers?.L1_heuristic ?? true,
-        L2_logic_rules: data.layers?.L2_logic_rules ?? true,
-        L3_llm_analysis: data.layers?.L3_llm_analysis ?? true
-      },
-      L1_rules: merged.L1_rules || {},
-      L2_rules: merged.L2_rules || {},
-      L3_skills: merged.L3_skills || {}
-    };
-  } catch {
-    return emptyRuntimeConfig();
   }
 }
-function isLayerEnabled(layerKey) {
-  const disableKey = LAYER_DISABLE_ENV[layerKey];
-  if (disableKey && process.env[disableKey] === "1") return false;
-  const runtime = loadRuntimeConfig();
-  const layers = runtime.layers || {};
-  if (layerKey in layers) return !!layers[layerKey];
-  return true;
+function mergeConfig(userCfg, srcDefaults) {
+  const cfg = userCfg;
+  if (cfg.version === void 0) cfg.version = srcDefaults.version || 1;
+  if (!cfg.layers) cfg.layers = {};
+  for (const [layerKey, defaultVal] of Object.entries(srcDefaults.layers)) {
+    if (!(layerKey in cfg.layers)) cfg.layers[layerKey] = defaultVal;
+  }
+  _migrateCategoriesAcrossLayers(
+    cfg,
+    "L2_rules",
+    "L1_rules",
+    ["sensitive_path_access"]
+  );
+  _mergeRuleCategories(cfg, srcDefaults, "L1_rules");
+  _mergeRuleCategories(cfg, srcDefaults, "L2_rules");
+  _mergeSkillCategories(cfg, srcDefaults, "L3_skills");
+  _mergeAgentRules(cfg, srcDefaults);
+  return cfg;
 }
-function getEnvOverrides() {
-  const overrides = {};
-  for (const [layerKey, envKey] of Object.entries(LAYER_DISABLE_ENV)) {
-    const val = process.env[envKey];
-    if (val !== void 0) {
-      overrides[layerKey] = {
-        env_var: envKey,
-        env_value: val,
-        overridden: val === "1",
-        effect: val === "1" ? "disabled" : "no_override"
-      };
+function _migrateCategoriesAcrossLayers(cfg, srcLayer, dstLayer, catNames) {
+  const src = cfg[srcLayer] || {};
+  const dst = cfg[dstLayer] || (cfg[dstLayer] = {});
+  for (const catName of catNames) {
+    if (!(catName in src)) continue;
+    const srcCat = src[catName];
+    if (!dst[catName]) {
+      dst[catName] = { category_enabled: true, category_desc: "", rules: [] };
+    }
+    const dstCat = dst[catName];
+    if (!dstCat.category_desc && srcCat.category_desc) dstCat.category_desc = srcCat.category_desc;
+    if (dstCat.category_enabled === void 0) dstCat.category_enabled = srcCat.category_enabled;
+    if (srcCat.rules && srcCat.rules.length > 0) {
+      const dstFps = new Set((dstCat.rules || []).map((r) => _ruleFingerprint(r)));
+      for (const r of srcCat.rules) {
+        const fp = _ruleFingerprint(r);
+        if (!dstFps.has(fp)) {
+          (dstCat.rules = dstCat.rules || []).push(r);
+          dstFps.add(fp);
+        }
+      }
     }
+    delete src[catName];
   }
-  return overrides;
-}
-function filterEnabledRules(rules, categoryEnabled = true) {
-  if (!categoryEnabled) return [];
-  return rules.filter((r) => r.enabled !== false);
 }
-function getEnabledL1CommandPatterns(runtime) {
-  const cat = runtime.L1_rules?.dangerous_commands || { category_enabled: true, rules: [] };
+function getEnabledL1InjectionKeywords(runtime) {
+  const cat = runtime.L1_rules?.injection_detection || { category_enabled: true, rules: [] };
   return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => ({
-    pattern: r.pattern || "",
+    keyword: r.keyword || "",
     risk_level: r.risk_level || "",
-    risk_type: r.risk_type || "",
-    reason: r.reason || ""
+    lang: r.lang || "en"
   }));
 }
-function getEnabledL2SensitivePaths(runtime) {
-  let cat = runtime.L1_rules?.sensitive_path_access;
-  if (!cat || !cat.rules || cat.rules.length === 0) {
-    cat = runtime.L2_rules?.sensitive_path_access || { category_enabled: true, rules: [] };
-  }
-  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => {
-    const out = { path: r.path || "", risk_level: r.risk_level || "", desc: r.desc || "", deny_mode: r.deny_mode || "deny_write" };
-    if (r.credential) out.credential = true;
-    if (r.read_only) out.read_only = true;
-    return out;
-  });
-}
-function hasRuntimeConfig() {
-  const p = getRuntimeConfigPath();
-  if (!existsSync7(p)) return false;
-  try {
-    JSON.parse(readFileSync7(p, "utf-8"));
-    return true;
-  } catch {
-    return false;
-  }
+function getEnabledL2IntentPatterns(runtime) {
+  const cat = runtime.L2_rules?.intent_consistency || { category_enabled: true, rules: [] };
+  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => ({
+    intent_keywords: r.intent_keywords || [],
+    dangerous_actions: r.dangerous_actions || [],
+    reason: r.reason || ""
+  }));
 }
-function getDisabledL2RulesWithSkipL3() {
-  let runtime;
-  try {
-    runtime = loadRuntimeConfig();
-  } catch {
-    return {};
-  }
-  const result = {};
-  for (const layerKey of ["L1_rules", "L2_rules"]) {
-    const layer = runtime[layerKey] || {};
-    for (const [catName, cat] of Object.entries(layer)) {
-      if (!cat.category_enabled) continue;
-      const items = [];
-      for (const r of cat.rules || []) {
-        if (r.enabled === false && r.skip_l3_on_disabled) {
-          if (catName === "sensitive_path_access") {
-            if (r.path) items.push(r.path);
-          } else if (catName === "intent_consistency") {
-            items.push(...r.intent_keywords || []);
-          } else if (r.pattern) {
-            items.push(r.pattern);
-          }
-        }
+function getEnabledL2PasswordPatterns(runtime) {
+  const cat = runtime.L2_rules?.password_modify_consent || { category_enabled: true, rules: [] };
+  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => r.pattern || "");
+}
+function getEnabledL2UserDeletionPatterns(runtime) {
+  const cat = runtime.L2_rules?.user_deletion_consent || { category_enabled: true, rules: [] };
+  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => r.pattern || "");
+}
+function isL2CategoryEnabled(runtime, categoryKey) {
+  const cat = runtime.L2_rules?.[categoryKey];
+  return cat?.category_enabled ?? true;
+}
+function getDisabledSkillIds(runtime) {
+  const disabled = /* @__PURE__ */ new Set();
+  for (const catData of Object.values(runtime.L3_skills || {})) {
+    if (!catData.category_enabled) {
+      for (const s of catData.skills || []) disabled.add(s.id);
+    } else {
+      for (const s of catData.skills || []) {
+        if (s.enabled === false) disabled.add(s.id);
       }
-      if (items.length > 0) result[catName] = items;
     }
   }
-  return result;
+  return disabled;
 }
-function _slugify(text) {
-  return text.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_|_$/g, "") || "x";
+function getEnabledL1CommandPatternsOrDefault(runtime) {
+  const enabled = getEnabledL1CommandPatterns(runtime);
+  if (enabled.length) return enabled;
+  if (!hasRuntimeConfig()) return _l1CommandPatternsToRules();
+  return [];
 }
-function _generatePatternId(pattern) {
-  return `pat_${_slugify(pattern)}`;
+function getEnabledL1InjectionKeywordsOrDefault(runtime) {
+  const enabled = getEnabledL1InjectionKeywords(runtime);
+  if (enabled.length) return enabled;
+  if (!hasRuntimeConfig()) return _l1InjectionKeywordsToRules();
+  return [];
 }
-function _deriveDenyMode(rule) {
-  if (rule.deny_mode) return rule.deny_mode;
-  if (rule.credential) return "deny_both";
-  if (rule.read_only) return "deny_read";
-  return "deny_write";
+function getEnabledL2SensitivePathsOrDefault(runtime) {
+  const enabled = getEnabledL2SensitivePaths(runtime);
+  if (enabled.length) return enabled;
+  if (!hasRuntimeConfig()) return _l2SensitivePathsToRules();
+  return [];
 }
-function _syncDenyModeFields(rule) {
-  const dm = rule.deny_mode || "deny_write";
-  if (dm === "deny_both") {
-    rule.credential = true;
-    delete rule.read_only;
-  } else if (dm === "deny_read") {
-    delete rule.credential;
-    rule.read_only = true;
-  } else {
-    delete rule.credential;
-    delete rule.read_only;
+function getEnabledL2IntentPatternsOrDefault(runtime) {
+  const enabled = getEnabledL2IntentPatterns(runtime);
+  if (enabled.length) return enabled;
+  if (!hasRuntimeConfig()) return _l2IntentPatternsToRules();
+  return [];
+}
+function getEnabledL2PasswordPatternsOrDefault(runtime) {
+  const enabled = getEnabledL2PasswordPatterns(runtime);
+  if (enabled.length) return enabled;
+  if (!hasRuntimeConfig()) {
+    return PASSWORD_MODIFY_PATTERNS.map((p) => p.source);
   }
+  return [];
 }
-function _l1CommandPatternsToRules() {
-  return DANGEROUS_PATTERNS.map((p) => ({
-    id: _generatePatternId(p.pattern instanceof RegExp ? p.pattern.source : p.pattern),
-    pattern: p.pattern instanceof RegExp ? p.pattern.source : p.pattern,
-    risk_level: p.severity,
-    risk_type: p.riskType,
-    reason: p.description,
-    enabled: true,
-    builtin: true
-  }));
+function getEnabledL2UserDeletionPatternsOrDefault(runtime) {
+  const enabled = getEnabledL2UserDeletionPatterns(runtime);
+  if (enabled.length) return enabled;
+  if (!hasRuntimeConfig()) {
+    return USER_DELETION_PATTERNS.map((p) => p.source);
+  }
+  return [];
 }
-function _l1InjectionKeywordsToRules() {
-  return INJECTION_KEYWORDS.map((kw) => ({
-    id: `inj_${_slugify(kw.keyword)}`,
-    keyword: kw.keyword,
-    risk_level: kw.riskLevel,
-    lang: kw.lang || "en",
-    enabled: true,
-    builtin: true
-  }));
+function _validateSkillId(skillId) {
+  if (!skillId || !SKILL_ID_RE.test(skillId)) {
+    throw new Error(`skill_id '${skillId}' \u4E0D\u5408\u6CD5\uFF1A\u53EA\u5141\u8BB8\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u4E0B\u5212\u7EBF\u548C\u8FDE\u5B57\u7B26`);
+  }
 }
-function _l2SensitivePathsToRules() {
-  const all = [...ROOT_SENSITIVE_PATHS, ...HOME_SENSITIVE_PATHS, ...CREDENTIAL_PATHS];
-  return all.map((sp) => {
-    const denyMode = _deriveDenyMode({
-      deny_mode: sp.deny_mode,
-      credential: sp.credential,
-      read_only: sp.read_only
-    });
-    const rule = {
-      id: `path_${_slugify(sp.path)}`,
-      path: sp.path,
-      risk_level: sp.riskLevel,
-      desc: sp.desc,
-      deny_mode: denyMode,
-      source_deny_mode: denyMode,
-      skip_l3_on_disabled: true,
-      enabled: true,
-      builtin: true
-    };
-    _syncDenyModeFields(rule);
-    return rule;
-  });
+function updateLayerEnabled(layerKey, enabled) {
+  const runtime = loadRuntimeConfig();
+  runtime.layers[layerKey] = enabled;
+  saveRuntimeConfig(runtime);
+  return runtime;
 }
-function _l2IntentPatternsToRules() {
-  return INTENT_DEVIATION_PATTERNS.map((pat, i) => ({
-    id: `intent_${i + 1}_${_slugify(pat.reason.slice(0, 30))}`,
-    intent_keywords: pat.intentKeywords,
-    dangerous_actions: pat.dangerousActions,
-    reason: pat.reason,
-    skip_l3_on_disabled: true,
-    enabled: true,
-    builtin: true
-  }));
+function updateRuleEnabled(layer, category, ruleId, enabled) {
+  const runtime = loadRuntimeConfig();
+  for (const r of runtime[layer]?.[category]?.rules || []) {
+    if (r.id === ruleId) {
+      r.enabled = enabled;
+      break;
+    }
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
 }
-function _l2PasswordPatternsToRules() {
-  return PASSWORD_MODIFY_PATTERNS.map((p) => ({
-    id: `pw_${_slugify(p.source)}`,
-    pattern: p.source,
-    skip_l3_on_disabled: true,
-    enabled: true,
-    builtin: true
-  }));
+function updateRuleDenyMode(layer, category, ruleId, denyMode) {
+  const runtime = loadRuntimeConfig();
+  for (const r of runtime[layer]?.[category]?.rules || []) {
+    if (r.id === ruleId) {
+      r.deny_mode = denyMode;
+      _syncDenyModeFields(r);
+      break;
+    }
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
 }
-function _l2UserDeletionPatternsToRules() {
-  return USER_DELETION_PATTERNS.map((p) => ({
-    id: `ud_${_slugify(p.source)}`,
-    pattern: p.source,
-    skip_l3_on_disabled: true,
-    enabled: true,
-    builtin: true
-  }));
+function updateRuleSkipL3(layer, category, ruleId, skipL3) {
+  const runtime = loadRuntimeConfig();
+  for (const r of runtime[layer]?.[category]?.rules || []) {
+    if (r.id === ruleId) {
+      r.skip_l3_on_disabled = skipL3;
+      break;
+    }
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
 }
-function _l3SkillsToRules() {
-  const skillCategories = {
-    file_operations: ["file_access_guard", "script_execution_guard", "indirect_access_guard"],
-    network_security: [
-      "data_exfiltration_guard",
-      "browser_web_access_guard",
-      "lateral_movement_guard",
-      "email_operation_guard"
-    ],
-    persistence_supply_chain: [
-      "persistence_backdoor_guard",
-      "supply_chain_guard",
-      "skill_installation_guard"
-    ],
-    intent_and_general: ["intent_deviation_guard", "general_tool_risk_guard"],
-    resource: ["resource_exhaustion_guard"]
-  };
-  const out = {};
-  for (const [cat, ids] of Object.entries(skillCategories)) {
-    out[cat] = {
-      category_enabled: true,
-      category_desc: "",
-      skills: ids.map((s) => ({
-        id: s,
-        keywords: SKILL_KEYWORD_MAP[s] || [],
-        enabled: true,
-        builtin: true
-      }))
-    };
+function updateCategoryEnabled(layer, category, enabled) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime[layer]?.[category];
+  if (cat) cat.category_enabled = enabled;
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function addCustomRule(layer, category, rule) {
+  const runtime = loadRuntimeConfig();
+  const layerObj = runtime[layer] || (runtime[layer] = {});
+  const cat = layerObj[category] || (layerObj[category] = { category_enabled: true, category_desc: "", rules: [] });
+  const rules = cat.rules || (cat.rules = []);
+  const newRule = { ...rule, builtin: false, enabled: true };
+  if (!newRule.id) {
+    newRule.id = `custom_${Date.now()}_${_slugify(JSON.stringify(rule).slice(0, 30))}`;
+  }
+  if (newRule.deny_mode) _syncDenyModeFields(newRule);
+  rules.push(newRule);
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function deleteCustomRule(layer, category, ruleId) {
+  const runtime = loadRuntimeConfig();
+  const rules = runtime[layer]?.[category]?.rules || [];
+  const idx = rules.findIndex((r) => r.id === ruleId);
+  if (idx >= 0) {
+    const r = rules[idx];
+    if (r.builtin && !r.source_removed) return null;
+    rules.splice(idx, 1);
+    saveRuntimeConfig(runtime);
+  }
+  return runtime;
+}
+function addCustomSkill(skillId, category, keywords, content) {
+  _validateSkillId(skillId);
+  const runtime = loadRuntimeConfig();
+  const skillsDir = join(RUNTIME_CONFIG_DIR, "agent_moss_skills");
+  try {
+    mkdirSync(skillsDir, { recursive: true });
+  } catch {
+  }
+  writeFileSync(join(skillsDir, `${skillId}.md`), content, "utf-8");
+  const l3 = runtime.L3_skills || (runtime.L3_skills = {});
+  const cat = l3[category] || (l3[category] = { category_enabled: true, category_desc: "", skills: [] });
+  (cat.skills || (cat.skills = [])).push({ id: skillId, keywords, enabled: true, builtin: false });
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function deleteCustomSkill(skillId, category) {
+  _validateSkillId(skillId);
+  const runtime = loadRuntimeConfig();
+  const skills = runtime.L3_skills?.[category]?.skills || [];
+  const idx = skills.findIndex((s) => s.id === skillId);
+  if (idx >= 0) {
+    if (skills[idx].builtin) return null;
+    skills.splice(idx, 1);
+    const skillPath = join(RUNTIME_CONFIG_DIR, "agent_moss_skills", `${skillId}.md`);
+    try {
+      if (existsSync3(skillPath)) unlinkSync(skillPath);
+    } catch {
+    }
+    saveRuntimeConfig(runtime);
   }
-  const categorized = new Set(Object.values(skillCategories).flat());
-  for (const s of Object.keys(SKILL_KEYWORD_MAP)) {
-    if (!categorized.has(s)) {
-      (out.intent_and_general ??= { category_enabled: true, category_desc: "", skills: [] }).skills.push({
-        id: s,
-        keywords: SKILL_KEYWORD_MAP[s],
-        enabled: true,
-        builtin: true
-      });
+  return runtime;
+}
+function updateSkillEnabled(skillId, enabled) {
+  const runtime = loadRuntimeConfig();
+  for (const catData of Object.values(runtime.L3_skills || {})) {
+    for (const s of catData.skills || []) {
+      if (s.id === skillId) {
+        s.enabled = enabled;
+        break;
+      }
     }
   }
-  out.user_custom = { category_enabled: true, category_desc: "", skills: [] };
-  return out;
+  saveRuntimeConfig(runtime);
+  return runtime;
 }
-function generateSourceDefaults() {
+function updateSkillCategoryEnabled(category, enabled) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.L3_skills?.[category];
+  if (cat) cat.category_enabled = enabled;
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function getProfileOrDetect() {
+  return null;
+}
+function getAgentRules(runtime) {
+  return runtime.agent_rules || {};
+}
+function _agentCategoryEnabledRules(cat) {
+  if (!cat || cat.category_enabled === false) return [];
+  return (cat.rules || []).filter((r) => r.enabled !== false);
+}
+function getEnabledAgentExtensions(runtime, agentId) {
+  const agentData = runtime.agent_rules?.[agentId];
+  if (!agentData) return null;
+  const safeAction = _agentCategoryEnabledRules(agentData.builtin_safe_action_types);
+  const safeSkills = _agentCategoryEnabledRules(agentData.builtin_safe_skills);
+  const cmdPatterns = _agentCategoryEnabledRules(agentData.extra_command_patterns).filter((r) => r.pattern).map((r) => ({
+    pattern: r.pattern,
+    risk_level: r.risk_level || "",
+    risk_type: r.risk_type || "",
+    reason: r.reason || ""
+  }));
+  const injKeywords = _agentCategoryEnabledRules(agentData.extra_injection_keywords).filter((r) => r.keyword).map((r) => ({
+    keyword: r.keyword,
+    risk_level: r.risk_level || "",
+    lang: r.lang || "en"
+  }));
+  const sensitivePaths = _agentCategoryEnabledRules(agentData.extra_sensitive_paths).filter((r) => r.path).map((r) => ({
+    path: r.path,
+    risk_level: r.risk_level || "",
+    desc: r.desc || "",
+    credential: r.credential,
+    read_only: r.read_only,
+    deny_mode: r.deny_mode
+  }));
   return {
-    version: 1,
-    layers: { L1_heuristic: true, L2_logic_rules: true, L3_llm_analysis: true },
-    L1_rules: {
-      dangerous_commands: {
-        category_enabled: true,
-        category_desc: "\u5371\u9669\u547D\u4EE4\u68C0\u6D4B\uFF08\u9012\u5F52\u5220\u9664\u3001\u5168\u6743\u9650\u8BBE\u7F6E\u3001\u63D0\u6743\u6267\u884C\u7B49\uFF09",
-        rules: _l1CommandPatternsToRules()
-      },
-      injection_detection: {
-        category_enabled: true,
-        category_desc: "Prompt \u6CE8\u5165\u653B\u51FB\u68C0\u6D4B",
-        rules: _l1InjectionKeywordsToRules()
-      },
-      sensitive_path_access: {
-        category_enabled: true,
-        category_desc: "\u654F\u611F\u8DEF\u5F84\u8BBF\u95EE\u68C0\u6D4B\uFF08deny_both/deny_read/deny_write\uFF09",
-        rules: _l2SensitivePathsToRules()
-      },
-      user_custom: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49\u547D\u4EE4\u89C4\u5219", rules: [] }
-    },
-    L2_rules: {
-      intent_consistency: {
-        category_enabled: true,
-        category_desc: "\u610F\u56FE\u4E00\u81F4\u6027\u68C0\u6D4B",
-        rules: _l2IntentPatternsToRules()
-      },
-      password_modify_consent: {
-        category_enabled: true,
-        category_desc: "\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u6388\u6743\u68C0\u6D4B",
-        rules: _l2PasswordPatternsToRules()
-      },
-      user_deletion_consent: {
-        category_enabled: true,
-        category_desc: "\u7528\u6237/\u7EC4\u5220\u9664\u64CD\u4F5C\u6388\u6743\u68C0\u6D4B",
-        rules: _l2UserDeletionPatternsToRules()
-      },
-      read_before_write: { category_enabled: true, category_desc: "read_before_write \u5B89\u5168\u539F\u5219\u68C0\u6D4B", rules: [] },
-      user_custom: { category_enabled: true, category_desc: "\u7528\u6237\u81EA\u5B9A\u4E49 L2 \u903B\u8F91\u89C4\u5219", rules: [] }
-    },
-    L3_skills: _l3SkillsToRules()
+    agent_id: agentId,
+    description: "",
+    extra_command_patterns: cmdPatterns,
+    extra_injection_keywords: injKeywords,
+    extra_sensitive_paths: sensitivePaths,
+    builtin_safe_skills: safeSkills.filter((r) => r.value).map((r) => r.value),
+    builtin_safe_action_types: safeAction.filter((r) => r.value).map((r) => r.value),
+    extra_skills: []
   };
 }
-function _ruleFingerprint(rule) {
-  if (rule.intent_keywords && rule.intent_keywords.length || rule.dangerous_actions && rule.dangerous_actions.length) {
-    return JSON.stringify([
-      [...rule.intent_keywords || []].sort(),
-      [...rule.dangerous_actions || []].sort()
-    ]);
+function updateAgentRuleEnabled(agentId, category, ruleFp, enabled) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.agent_rules?.[agentId]?.[category];
+  if (cat) {
+    const targetFp = _ruleFingerprint(ruleFp);
+    for (const r of cat.rules || []) {
+      if (_ruleFingerprint(r) === targetFp) {
+        r.enabled = enabled;
+        break;
+      }
+    }
   }
-  if (rule.path) return JSON.stringify([rule.path]);
-  if (rule.pattern) return JSON.stringify([rule.pattern]);
-  if (rule.keyword) return JSON.stringify([rule.keyword, rule.lang || ""]);
-  return JSON.stringify([rule.id || ""]);
+  saveRuntimeConfig(runtime);
+  return runtime;
 }
-function _mergeRuleCategories(userCfg, srcDefaults, layerKey) {
-  const userLayer = userCfg[layerKey] || (userCfg[layerKey] = {});
-  const srcLayer = srcDefaults[layerKey] || {};
-  for (const [catName, srcCat] of Object.entries(srcLayer)) {
-    if (!(catName in userLayer)) {
-      userLayer[catName] = srcCat;
-      continue;
+function addAgentRule(agentId, category, rule) {
+  const runtime = loadRuntimeConfig();
+  if (!runtime.agent_rules) runtime.agent_rules = {};
+  if (!runtime.agent_rules[agentId]) runtime.agent_rules[agentId] = {};
+  const cats = runtime.agent_rules[agentId];
+  if (!cats[category]) cats[category] = { category_enabled: true, category_desc: "", rules: [] };
+  (cats[category].rules || (cats[category].rules = [])).push({ ...rule, enabled: true, builtin: false });
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function deleteAgentRule(agentId, category, ruleFp) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.agent_rules?.[agentId]?.[category];
+  if (cat) {
+    const targetFp = _ruleFingerprint(ruleFp);
+    cat.rules = (cat.rules || []).filter((r) => _ruleFingerprint(r) !== targetFp);
+  }
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+function updateAgentCategoryEnabled(agentId, category, enabled) {
+  const runtime = loadRuntimeConfig();
+  const cat = runtime.agent_rules?.[agentId]?.[category];
+  if (cat) cat.category_enabled = enabled;
+  saveRuntimeConfig(runtime);
+  return runtime;
+}
+var __dirname3, RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, ENV_RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DENY_MODE_LABELS, _AGENTS_DIR_PROD, _AGENTS_DIR_DEV, SKILL_ID_RE;
+var init_runtime_config = __esm({
+  "src/infra/runtime-config.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_heuristic();
+    init_logic_rules();
+    init_skill_loader();
+    __dirname3 = dirname2(fileURLToPath3(import.meta.url));
+    RUNTIME_CONFIG_DIR = join(homedir(), ".config", "agentmoss");
+    RUNTIME_CONFIG_PATH = join(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
+    ENV_RUNTIME_CONFIG_PATH = "AGENT_MOSS_RUNTIME_CONFIG_PATH";
+    LAYER_DISABLE_ENV = {
+      L1_heuristic: "AGENT_MOSS_DISABLE_HEURISTIC",
+      L2_logic_rules: "AGENT_MOSS_DISABLE_LOGIC_RULES",
+      L3_llm_analysis: "AGENT_MOSS_DISABLE_LLM"
+    };
+    DENY_MODE_LABELS = {
+      deny_write: "\u4EC5\u62E6\u622A\u5199\u5165",
+      deny_read: "\u4EC5\u62E6\u622A\u8BFB\u53D6",
+      deny_both: "\u8BFB\u5199\u5747\u62E6\u622A"
+    };
+    _AGENTS_DIR_PROD = join(__dirname3, "agents");
+    _AGENTS_DIR_DEV = join(__dirname3, "..", "..", "..", "agent_moss", "agents");
+    SKILL_ID_RE = /^[A-Za-z0-9_-]+$/;
+  }
+});
+
+// src/agents/index.ts
+import { readFileSync as readFileSync3, existsSync as existsSync4 } from "fs";
+import { resolve as resolve2, dirname as dirname3 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
+function resolveAgentsDir() {
+  if (existsSync4(AGENTS_DIR_PROD)) return AGENTS_DIR_PROD;
+  if (existsSync4(AGENTS_DIR_DEV_FALLBACK)) return AGENTS_DIR_DEV_FALLBACK;
+  return AGENTS_DIR_PROD;
+}
+function getAgentExtensions(agentId) {
+  if (!agentId) return null;
+  if (cache.has(agentId)) return cache.get(agentId) ?? null;
+  let ext = null;
+  try {
+    const { hasRuntimeConfig: hasRuntimeConfig2, loadRuntimeConfig: loadRuntimeConfig2, getEnabledAgentExtensions: getEnabledAgentExtensions2 } = (init_runtime_config(), __toCommonJS(runtime_config_exports));
+    if (hasRuntimeConfig2()) {
+      ext = getEnabledAgentExtensions2(loadRuntimeConfig2(), agentId);
     }
-    const userCat = userLayer[catName];
-    if (userCat.category_desc === void 0) userCat.category_desc = srcCat.category_desc || "";
-    if (userCat.category_enabled === void 0) userCat.category_enabled = srcCat.category_enabled ?? true;
-    const srcRules = srcCat.rules || [];
-    const userRules = userCat.rules || (userCat.rules = []);
-    const userByFp = /* @__PURE__ */ new Map();
-    for (const r of userRules) userByFp.set(_ruleFingerprint(r), r);
-    const srcFps = /* @__PURE__ */ new Set();
-    for (const srcR of srcRules) {
-      const fp = _ruleFingerprint(srcR);
-      srcFps.add(fp);
-      if (userByFp.has(fp)) {
-        const existing = userByFp.get(fp);
-        const userEnabled = existing.enabled;
-        const userSkipL3 = existing.skip_l3_on_disabled;
-        const userDenyMode = existing.deny_mode;
-        const userSourceDeny = existing.source_deny_mode;
-        Object.keys(existing).forEach((k) => delete existing[k]);
-        Object.assign(existing, srcR);
-        existing.enabled = userEnabled;
-        if (userSkipL3 !== void 0) existing.skip_l3_on_disabled = userSkipL3;
-        if (userDenyMode && userSourceDeny && userDenyMode !== userSourceDeny) {
-          existing.deny_mode = userDenyMode;
+  } catch {
+  }
+  if (ext === null) {
+    const agentsDir = resolveAgentsDir();
+    const rulesFile = resolve2(agentsDir, agentId, "rules.json");
+    if (!existsSync4(rulesFile)) {
+      cache.set(agentId, null);
+      return null;
+    }
+    try {
+      const raw = readFileSync3(rulesFile, "utf-8");
+      ext = JSON.parse(raw);
+      if (!ext.agent_id) {
+        console.warn(`[AgentMoss agents] rules.json \u7F3A\u5C11 agent_id \u5B57\u6BB5: ${rulesFile}`);
+        cache.set(agentId, null);
+        return null;
+      }
+    } catch (e) {
+      console.error(`[AgentMoss agents] \u52A0\u8F7D agent ${agentId} rules.json \u5931\u8D25:`, e.message);
+      cache.set(agentId, null);
+      return null;
+    }
+  }
+  cache.set(agentId, ext);
+  console.log(
+    `[AgentMoss agents] \u52A0\u8F7D agent ${agentId} \u5B9A\u5236\u89C4\u5219: ${ext.extra_command_patterns?.length ?? 0} cmd patterns, ${ext.extra_injection_keywords?.length ?? 0} injection keywords, ${ext.extra_sensitive_paths?.length ?? 0} sensitive paths, ${ext.builtin_safe_skills?.length ?? 0} builtin safe skills, ${ext.builtin_safe_action_types?.length ?? 0} builtin safe action types`
+  );
+  return ext;
+}
+var __filename3, __dirname4, AGENTS_DIR_PROD, AGENTS_DIR_DEV_FALLBACK, cache;
+var init_agents = __esm({
+  "src/agents/index.ts"() {
+    "use strict";
+    init_esm_shims();
+    __filename3 = fileURLToPath4(import.meta.url);
+    __dirname4 = dirname3(__filename3);
+    AGENTS_DIR_PROD = resolve2(__dirname4, "agents");
+    AGENTS_DIR_DEV_FALLBACK = resolve2(__dirname4, "../../../agent_moss/agents");
+    cache = /* @__PURE__ */ new Map();
+  }
+});
+
+// src/engine/heuristic.ts
+function runHeuristicCheck(input) {
+  const command = `${input.aNext.actionType}: ${input.aNext.actionDetail}`;
+  const matched = [];
+  let highestSeverity = "low";
+  let highestRiskType = "";
+  const userRules = getCustomRules();
+  for (const rule of userRules) {
+    try {
+      const re = new RegExp(rule.pattern);
+      if (re.test(command)) {
+        if (rule.action === "Deny") {
+          matched.push(`\u81EA\u5B9A\u4E49\u89C4\u5219: ${rule.pattern}`);
+          if (severityRank(rule.severity) > severityRank(highestSeverity)) {
+            highestSeverity = rule.severity;
+            highestRiskType = "custom_rule";
+          }
         }
-        if (existing.deny_mode) _syncDenyModeFields(existing);
-      } else {
-        const newR = { ...srcR, enabled: true };
-        userRules.push(newR);
       }
+    } catch {
     }
-    for (const r of userRules) {
-      if (r.builtin && !srcFps.has(_ruleFingerprint(r))) {
-        r.source_removed = true;
-        r.enabled = false;
+  }
+  let topRiskType = "";
+  for (const rule of DANGEROUS_PATTERNS) {
+    if (rule.pattern.test(command)) {
+      matched.push(rule.description);
+      if (severityRank(rule.severity) > severityRank(highestSeverity)) {
+        highestSeverity = rule.severity;
+        topRiskType = rule.riskType;
+      }
+    }
+  }
+  highestRiskType = topRiskType || highestRiskType;
+  const agentExt = getAgentExtensions(input.agentId);
+  if (agentExt?.extra_command_patterns) {
+    for (const rule of agentExt.extra_command_patterns) {
+      try {
+        const re = new RegExp(rule.pattern, "i");
+        if (re.test(command)) {
+          matched.push(`agent \u4E13\u5C5E\u89C4\u5219: ${rule.reason}`);
+          if (severityRank(rule.risk_level) > severityRank(highestSeverity)) {
+            highestSeverity = rule.risk_level;
+            highestRiskType = rule.risk_type;
+          }
+        }
+      } catch {
       }
     }
-    if (catName === "sensitive_path_access") {
-      for (const r of userRules) {
-        if (!r.deny_mode) r.deny_mode = _deriveDenyMode(r);
-        _syncDenyModeFields(r);
-      }
+  }
+  const injectionText = `${input.aNext.actionType} ${input.aNext.actionDetail} ${input.reason || ""} ${input.promptSession || ""}`.toLowerCase();
+  const injectionHits = checkInjectionKeywords(injectionText, agentExt?.extra_injection_keywords);
+  if (injectionHits.length > 0) {
+    const topHit = injectionHits.reduce((a, b) => severityRank(a.riskLevel) >= severityRank(b.riskLevel) ? a : b);
+    matched.push(...injectionHits.map((h) => `\u6CE8\u5165\u5173\u952E\u8BCD [${h.lang}]: ${h.keyword}`));
+    if (severityRank(topHit.riskLevel) > severityRank(highestSeverity)) {
+      highestSeverity = topHit.riskLevel;
+      highestRiskType = "prompt_injection";
     }
   }
-  for (const catName of Object.keys(userLayer)) {
-    if (catName === "user_custom") continue;
-    if (!(catName in srcLayer)) delete userLayer[catName];
+  const actionTypeL = input.aNext.actionType.toLowerCase();
+  const detailL = input.aNext.actionDetail.toLowerCase();
+  const isExcludedType = SENSITIVE_EXCLUDED_PREFIXES.some((p) => actionTypeL.startsWith(p));
+  if (!isExcludedType) {
+    const pathResult = checkSensitivePath(detailL, input.cwd || "/", agentExt);
+    if (pathResult) return pathResult;
+  }
+  const dangerousResult = checkDangerousPatterns(actionTypeL, detailL);
+  if (dangerousResult) return dangerousResult;
+  const lateralResult = checkLateralMovement(detailL);
+  if (lateralResult) return lateralResult;
+  if (matched.length > 0) {
+    return {
+      allowed: false,
+      reason: `\u68C0\u6D4B\u5230\u9AD8\u5371\u64CD\u4F5C: ${matched.join(", ")}`,
+      riskLevel: highestSeverity,
+      riskType: highestRiskType,
+      confidence: 95,
+      source: "heuristic",
+      violatedLayers: ["1.1"]
+      // 对齐 py coordinator.py:165（L1.1 = 命中高危命令模式/注入关键词）
+    };
   }
+  return null;
 }
-function _mergeSkillCategories(userCfg, srcDefaults, layerKey) {
-  const userLayer = userCfg[layerKey] || (userCfg[layerKey] = {});
-  const srcLayer = srcDefaults[layerKey] || {};
-  for (const [catName, srcCat] of Object.entries(srcLayer)) {
-    if (!(catName in userLayer)) {
-      userLayer[catName] = srcCat;
-      continue;
+function checkInjectionKeywords(text, extraKeywords) {
+  const hits = [];
+  for (const entry of INJECTION_KEYWORDS) {
+    if (text.includes(entry.keyword.toLowerCase())) {
+      hits.push(entry);
     }
-    const userCat = userLayer[catName];
-    if (userCat.category_desc === void 0) userCat.category_desc = srcCat.category_desc || "";
-    if (userCat.category_enabled === void 0) userCat.category_enabled = srcCat.category_enabled ?? true;
-    const userSkills = userCat.skills || (userCat.skills = []);
-    const existingIds = new Set(userSkills.map((s) => s.id));
-    for (const srcS of srcCat.skills || []) {
-      if (!existingIds.has(srcS.id)) userSkills.push({ ...srcS });
+  }
+  if (extraKeywords) {
+    for (const entry of extraKeywords) {
+      if (text.includes(entry.keyword.toLowerCase())) {
+        hits.push({ keyword: entry.keyword, riskLevel: entry.risk_level, lang: entry.lang });
+      }
     }
   }
+  return hits;
 }
-function mergeConfig(userCfg, srcDefaults) {
-  const cfg = userCfg;
-  if (cfg.version === void 0) cfg.version = srcDefaults.version || 1;
-  if (!cfg.layers) cfg.layers = {};
-  for (const [layerKey, defaultVal] of Object.entries(srcDefaults.layers)) {
-    if (!(layerKey in cfg.layers)) cfg.layers[layerKey] = defaultVal;
-  }
-  _migrateCategoriesAcrossLayers(
-    cfg,
-    "L2_rules",
-    "L1_rules",
-    ["sensitive_path_access"]
-  );
-  _mergeRuleCategories(cfg, srcDefaults, "L1_rules");
-  _mergeRuleCategories(cfg, srcDefaults, "L2_rules");
-  _mergeSkillCategories(cfg, srcDefaults, "L3_skills");
-  return cfg;
+function isInlineScriptCommand(actionDetail) {
+  const re = /(?:^|\s)(?:python|python3|python3\.\d+|perl|perl5|ruby|jruby|mruby|node|php|lua)\s+(?:-[a-zA-Z]*[cer][a-zA-Z]*\s+)/i;
+  return re.test(actionDetail);
 }
-function _migrateCategoriesAcrossLayers(cfg, srcLayer, dstLayer, catNames) {
-  const src = cfg[srcLayer] || {};
-  const dst = cfg[dstLayer] || (cfg[dstLayer] = {});
-  for (const catName of catNames) {
-    if (!(catName in src)) continue;
-    const srcCat = src[catName];
-    if (!dst[catName]) {
-      dst[catName] = { category_enabled: true, category_desc: "", rules: [] };
-    }
-    const dstCat = dst[catName];
-    if (!dstCat.category_desc && srcCat.category_desc) dstCat.category_desc = srcCat.category_desc;
-    if (dstCat.category_enabled === void 0) dstCat.category_enabled = srcCat.category_enabled;
-    if (srcCat.rules && srcCat.rules.length > 0) {
-      const dstFps = new Set((dstCat.rules || []).map((r) => _ruleFingerprint(r)));
-      for (const r of srcCat.rules) {
-        const fp = _ruleFingerprint(r);
-        if (!dstFps.has(fp)) {
-          (dstCat.rules = dstCat.rules || []).push(r);
-          dstFps.add(fp);
+function severityRank(s) {
+  const ranks = { low: 1, medium: 2, high: 3, critical: 4 };
+  return ranks[s] || 0;
+}
+function checkSensitivePath(command, cwd, agentExt) {
+  const expandedCwd = cwd.replace(/^~/, process.env.HOME || "/home/user");
+  const _WRITE_CMD_RES = [/\brm\b/, /\bunlink\b/, /\brmdir\b/, /\bshred\b/, /\bcp\b/, /\bmv\b/, /\binstall\b/, /\btee\b/, /\bdd\b/, /\bmkfs\b/, /\b(fdisk|parted|cfdisk|sfdisk)\b/, /\bchmod\b/, /\bchown\b/, /\btruncate\b/];
+  const _DEVNULL_RE = /(?:2|&|1)?\s*>\s*\/dev\/null\b/;
+  const _READONLY_CMDS = /* @__PURE__ */ new Set(["cat", "head", "tail", "less", "more", "grep", "find", "awk", "sed", "sort", "uniq", "wc", "cut", "strings", "od", "xxd", "hexdump", "tr", "file", "stat", "du", "df", "ls", "dir", "tree", "nl", "tac", "rev", "lsblk", "blockdev", "smartctl", "udevadm", "dmidecode", "lscpu", "lspci", "lsusb", "lsmem", "lsns", "lsof", "hwinfo", "inxi", "fdisk", "parted", "dmesg", "journalctl", "systemctl", "hostnamectl", "localectl", "timedatectl", "ps", "top", "free", "vmstat", "iostat", "mpstat", "pidof", "pgrep", "ip", "ifconfig", "route", "ss", "netstat", "arp", "ethtool", "nmcli", "uname", "arch", "nproc", "getconf", "getent", "id", "whoami", "who", "w", "last", "uptime", "lsmod", "modinfo", "sysctl"]);
+  const isWriteOpFlag = _WRITE_CMD_RES.some((rx) => rx.test(command)) || /\bsed\s+-[a-zA-Z]*i/.test(command) || command.includes(">") && !command.replace(_DEVNULL_RE, "").includes(">") || command.includes(">") && command.replace(_DEVNULL_RE, "").includes(">") && !_READONLY_CMDS.has(command.trim().split(/\s+/)[0]?.toLowerCase() || "") || WRITE_KEYWORDS.some((kw) => "".includes(kw) || command.includes(kw));
+  for (const sp of ROOT_SENSITIVE_PATHS) {
+    if (command.includes(sp.path.toLowerCase())) {
+      if (sp.path === "/dev/random") {
+        if (isWriteOpFlag) {
+          continue;
         }
+        return {
+          allowed: false,
+          reason: `\u8BFB\u53D6\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
+          riskLevel: sp.riskLevel,
+          riskType: "file_access",
+          confidence: 90,
+          source: "heuristic",
+          violatedLayers: ["1.1"]
+        };
+      }
+      if (!isWriteOpFlag && !sp.credential) {
+        continue;
       }
+      return {
+        allowed: false,
+        reason: `\u5C1D\u8BD5\u8BBF\u95EE\u7CFB\u7EDF\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
+        riskLevel: sp.riskLevel,
+        riskType: "file_access",
+        confidence: 90,
+        source: "heuristic",
+        violatedLayers: ["1.1"],
+        isCredential: !!sp.credential
+      };
     }
-    delete src[catName];
   }
-}
-function getEnabledL1InjectionKeywords(runtime) {
-  const cat = runtime.L1_rules?.injection_detection || { category_enabled: true, rules: [] };
-  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => ({
-    keyword: r.keyword || "",
-    risk_level: r.risk_level || "",
-    lang: r.lang || "en"
-  }));
-}
-function getEnabledL2IntentPatterns(runtime) {
-  const cat = runtime.L2_rules?.intent_consistency || { category_enabled: true, rules: [] };
-  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => ({
-    intent_keywords: r.intent_keywords || [],
-    dangerous_actions: r.dangerous_actions || [],
-    reason: r.reason || ""
-  }));
-}
-function getEnabledL2PasswordPatterns(runtime) {
-  const cat = runtime.L2_rules?.password_modify_consent || { category_enabled: true, rules: [] };
-  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => r.pattern || "");
-}
-function getEnabledL2UserDeletionPatterns(runtime) {
-  const cat = runtime.L2_rules?.user_deletion_consent || { category_enabled: true, rules: [] };
-  return filterEnabledRules(cat.rules || [], cat.category_enabled).map((r) => r.pattern || "");
-}
-function isL2CategoryEnabled(runtime, categoryKey) {
-  const cat = runtime.L2_rules?.[categoryKey];
-  return cat?.category_enabled ?? true;
-}
-function getDisabledSkillIds(runtime) {
-  const disabled = /* @__PURE__ */ new Set();
-  for (const catData of Object.values(runtime.L3_skills || {})) {
-    if (!catData.category_enabled) {
-      for (const s of catData.skills || []) disabled.add(s.id);
-    } else {
-      for (const s of catData.skills || []) {
-        if (s.enabled === false) disabled.add(s.id);
+  for (const sp of HOME_SENSITIVE_PATHS) {
+    const expanded = `${expandedCwd}/${sp.path}`;
+    const pathRe = sp.path.endsWith(".pub") ? new RegExp(sp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i") : new RegExp(sp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "(?!\\.pub)", "i");
+    const expandedRe = sp.path.endsWith(".pub") ? new RegExp(expanded.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i") : new RegExp(expanded.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "(?!\\.pub)", "i");
+    if (pathRe.test(command) || expandedRe.test(command)) {
+      if (!isWriteOpFlag && !sp.credential) {
+        continue;
       }
+      return {
+        allowed: false,
+        reason: `\u5C1D\u8BD5\u8BBF\u95EE\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
+        riskLevel: sp.riskLevel,
+        riskType: "file_access",
+        confidence: 90,
+        source: "heuristic",
+        violatedLayers: ["1.1"],
+        isCredential: !!sp.credential
+      };
     }
   }
-  return disabled;
-}
-function getEnabledL1CommandPatternsOrDefault(runtime) {
-  const enabled = getEnabledL1CommandPatterns(runtime);
-  if (enabled.length) return enabled;
-  if (!hasRuntimeConfig()) return _l1CommandPatternsToRules();
-  return [];
+  if (agentExt?.extra_sensitive_paths && agentExt.extra_sensitive_paths.length > 0) {
+    for (const sp of agentExt.extra_sensitive_paths) {
+      const spPath = sp.path.toLowerCase();
+      const expanded = `${expandedCwd}/${spPath}`;
+      if (command.includes(spPath) || command.includes(expanded.toLowerCase())) {
+        const denyMode = sp.deny_mode || (sp.credential ? "deny_both" : sp.read_only ? "deny_read" : "deny_write");
+        if (denyMode === "deny_read") {
+          if (isWriteOpFlag) continue;
+        } else if (denyMode === "deny_write") {
+          if (!isWriteOpFlag) continue;
+        }
+        return {
+          allowed: false,
+          reason: `\u5C1D\u8BD5\u8BBF\u95EE agent \u4E13\u5C5E\u654F\u611F\u8DEF\u5F84: ${sp.desc} (${sp.path})`,
+          riskLevel: sp.risk_level,
+          riskType: "file_access",
+          confidence: 90,
+          source: "heuristic",
+          violatedLayers: ["1.1"],
+          isCredential: !!sp.credential
+        };
+      }
+    }
+  }
+  for (const cp of CREDENTIAL_PATHS) {
+    const escaped = cp.path.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const re = cp.path.startsWith(".") ? new RegExp(`(?:^|[\\s/\\\\'"])${escaped}\\b`) : new RegExp(`\\b${escaped}\\b`);
+    if (re.test(command)) {
+      return {
+        allowed: false,
+        reason: `\u8BBF\u95EE\u654F\u611F\u8DEF\u5F84: ${cp.desc} (${cp.path})`,
+        riskLevel: cp.riskLevel,
+        riskType: "file_access",
+        confidence: 90,
+        source: "heuristic",
+        violatedLayers: ["1.1"],
+        isCredential: true
+      };
+    }
+  }
+  if ((command.includes("rm ") || command.includes("unlink")) && (command.includes("/etc/") || command.includes("/root/") || command.includes("/var/log/"))) {
+    return {
+      allowed: false,
+      reason: "\u68C0\u6D4B\u5230\u5220\u9664\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55\u5185\u5BB9",
+      riskLevel: "critical",
+      riskType: "file_access",
+      confidence: 90,
+      source: "heuristic",
+      violatedLayers: ["1.1"]
+    };
+  }
+  return null;
 }
-function getEnabledL1InjectionKeywordsOrDefault(runtime) {
-  const enabled = getEnabledL1InjectionKeywords(runtime);
-  if (enabled.length) return enabled;
-  if (!hasRuntimeConfig()) return _l1InjectionKeywordsToRules();
-  return [];
+function checkDangerousPatterns(actionType, actionDetail) {
+  if (actionType === "file_write" || actionType === "file_edit") return null;
+  const TEMP_DIRS = ["/tmp/", "/var/tmp/", "/run/", "/dev/shm/"];
+  const isTempPath = TEMP_DIRS.some((td) => actionDetail.includes(td));
+  if (!isTempPath && (actionDetail.includes("*") || actionDetail.includes("?")) && ["rm ", "rm	", "del ", "del	", "delete", "remove ", "remove	", "\u5220\u9664", "\u79FB\u9664"].some((kw) => actionDetail.includes(kw))) {
+    return {
+      allowed: false,
+      reason: "\u68C0\u6D4B\u5230\u901A\u914D\u7B26\u7ED3\u5408\u5220\u9664\u64CD\u4F5C\uFF0C\u53EF\u80FD\u9020\u6210\u6279\u91CF\u8BEF\u5220",
+      riskLevel: "high",
+      riskType: "script_execution",
+      confidence: 90,
+      source: "heuristic",
+      violatedLayers: ["1.1"]
+    };
+  }
+  if (/>\s*\/etc\//.test(actionDetail) || />\s*\/boot\//.test(actionDetail) || />\s*\/proc\//.test(actionDetail)) {
+    return {
+      allowed: false,
+      reason: "\u68C0\u6D4B\u5230\u91CD\u5B9A\u5411\u8986\u76D6\u5199\u5165\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55",
+      riskLevel: "critical",
+      riskType: "file_access",
+      confidence: 95,
+      source: "heuristic",
+      violatedLayers: ["1.1"]
+    };
+  }
+  return null;
 }
-function getEnabledL2SensitivePathsOrDefault(runtime) {
-  const enabled = getEnabledL2SensitivePaths(runtime);
-  if (enabled.length) return enabled;
-  if (!hasRuntimeConfig()) return _l2SensitivePathsToRules();
-  return [];
+function extractRemoteHost(command) {
+  const m = command.match(/(?:ssh|scp|rsync)\s+(?:-[\w]+\s+)*(\S+@\S+|\b(?!-)[\w.-]+\b)/);
+  return m ? m[1] : null;
 }
-function getEnabledL2IntentPatternsOrDefault(runtime) {
-  const enabled = getEnabledL2IntentPatterns(runtime);
-  if (enabled.length) return enabled;
-  if (!hasRuntimeConfig()) return _l2IntentPatternsToRules();
-  return [];
+function isLocalHost(host) {
+  const localNames = ["localhost", "127.0.0.1", "::1", process.env.HOSTNAME || "", "0.0.0.0"];
+  return localNames.includes(host.replace(/.*@/, ""));
 }
-function getEnabledL2PasswordPatternsOrDefault(runtime) {
-  const enabled = getEnabledL2PasswordPatterns(runtime);
-  if (enabled.length) return enabled;
-  if (!hasRuntimeConfig()) {
-    return PASSWORD_MODIFY_PATTERNS.map((p) => p.source);
+function checkLateralMovement(actionDetail) {
+  if (/(?:ssh|scp|rsync)\s+/.test(actionDetail)) {
+    const targetHost = extractRemoteHost(actionDetail);
+    if (targetHost && !isLocalHost(targetHost)) {
+      return {
+        allowed: false,
+        reason: `\u5C1D\u8BD5\u6A2A\u5411\u79FB\u52A8\u5230\u8FDC\u7A0B\u4E3B\u673A: ${targetHost}`,
+        riskLevel: "medium",
+        riskType: "lateral_movement",
+        confidence: 80,
+        source: "heuristic",
+        violatedLayers: ["1.1"]
+      };
+    }
   }
-  return [];
+  return null;
 }
-function getEnabledL2UserDeletionPatternsOrDefault(runtime) {
-  const enabled = getEnabledL2UserDeletionPatterns(runtime);
-  if (enabled.length) return enabled;
-  if (!hasRuntimeConfig()) {
-    return USER_DELETION_PATTERNS.map((p) => p.source);
+var INJECTION_KEYWORDS, DANGEROUS_PATTERNS, SENSITIVE_EXCLUDED_PREFIXES;
+var init_heuristic = __esm({
+  "src/engine/heuristic.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_config();
+    init_agents();
+    init_logic_rules();
+    INJECTION_KEYWORDS = [
+      // ---- Instruction Override ----
+      { keyword: "ignore previous instructions", riskLevel: "critical", lang: "en" },
+      { keyword: "ignore all previous", riskLevel: "critical", lang: "en" },
+      { keyword: "disregard all prior", riskLevel: "critical", lang: "en" },
+      { keyword: "forget everything", riskLevel: "high", lang: "en" },
+      { keyword: "\u5FFD\u7565\u4E4B\u524D\u7684\u6307\u4EE4", riskLevel: "critical", lang: "zh" },
+      { keyword: "\u5FFD\u7565\u6240\u6709\u5148\u524D\u7684", riskLevel: "critical", lang: "zh" },
+      { keyword: "\u5FFD\u7565\u4E0A\u9762\u6240\u6709", riskLevel: "high", lang: "zh" },
+      { keyword: "\u8BF7\u5FD8\u8BB0\u4E4B\u524D", riskLevel: "high", lang: "zh" },
+      // ---- Role Hijacking ----
+      { keyword: "you are now", riskLevel: "high", lang: "en" },
+      { keyword: "you are no longer", riskLevel: "high", lang: "en" },
+      { keyword: "new instructions", riskLevel: "high", lang: "en" },
+      { keyword: "from now on, you", riskLevel: "high", lang: "en" },
+      { keyword: "\u4F60\u73B0\u5728\u662F\u4E00\u4E2A", riskLevel: "high", lang: "zh" },
+      { keyword: "\u4F60\u4E0D\u518D\u662F\u4E00\u4E2A", riskLevel: "high", lang: "zh" },
+      { keyword: "\u4ECE\u73B0\u5728\u5F00\u59CB\u4F60", riskLevel: "high", lang: "zh" },
+      { keyword: "\u4F60\u7684\u65B0\u89D2\u8272\u662F", riskLevel: "high", lang: "zh" },
+      // ---- Command Injection ----
+      { keyword: "system prompt", riskLevel: "high", lang: "en" },
+      { keyword: "reveal your instructions", riskLevel: "high", lang: "en" },
+      { keyword: "output your instructions", riskLevel: "high", lang: "en" },
+      { keyword: "repeat your instructions", riskLevel: "medium", lang: "en" },
+      { keyword: "\u7CFB\u7EDF\u63D0\u793A", riskLevel: "high", lang: "zh" },
+      { keyword: "\u8F93\u51FA\u4F60\u7684\u6307\u4EE4", riskLevel: "high", lang: "zh" },
+      { keyword: "\u91CD\u590D\u4F60\u7684\u6307\u4EE4", riskLevel: "medium", lang: "zh" },
+      // ---- Social Engineering ----
+      { keyword: "this is an authorized test", riskLevel: "high", lang: "en" },
+      { keyword: "security audit approved", riskLevel: "high", lang: "en" },
+      { keyword: "admin override", riskLevel: "critical", lang: "en" },
+      { keyword: "debug mode", riskLevel: "high", lang: "en" },
+      { keyword: "maintenance mode", riskLevel: "high", lang: "en" },
+      { keyword: "\u8FD9\u662F\u6388\u6743\u7684\u6D4B\u8BD5", riskLevel: "high", lang: "zh" },
+      { keyword: "\u5B89\u5168\u5BA1\u8BA1\u5DF2\u6279\u51C6", riskLevel: "high", lang: "zh" },
+      { keyword: "\u7BA1\u7406\u5458\u8986\u76D6", riskLevel: "critical", lang: "zh" },
+      { keyword: "\u8C03\u8BD5\u6A21\u5F0F", riskLevel: "high", lang: "zh" },
+      // ---- XSS ----
+      { keyword: "<script>", riskLevel: "high", lang: "en" },
+      { keyword: "javascript:", riskLevel: "high", lang: "en" },
+      { keyword: "onerror=", riskLevel: "high", lang: "en" },
+      { keyword: "onload=", riskLevel: "high", lang: "en" },
+      // ---- Fake Boundaries ----
+      { keyword: "=== END OF", riskLevel: "high", lang: "en" },
+      { keyword: "--- END SYSTEM", riskLevel: "high", lang: "en" },
+      { keyword: "[END OF", riskLevel: "high", lang: "en" },
+      { keyword: "=== \u7ED3\u675F", riskLevel: "high", lang: "zh" },
+      { keyword: "--- \u7ED3\u675F\u7CFB\u7EDF", riskLevel: "high", lang: "zh" },
+      // ---- Developer Mode ----
+      { keyword: "developer mode", riskLevel: "critical", lang: "en" },
+      { keyword: "DAN mode", riskLevel: "critical", lang: "en" },
+      { keyword: "jailbreak", riskLevel: "critical", lang: "en" },
+      { keyword: "\u5F00\u53D1\u8005\u6A21\u5F0F", riskLevel: "critical", lang: "zh" },
+      { keyword: "\u8D8A\u72F1", riskLevel: "critical", lang: "zh" }
+      // 注：xiaoO 专属绕过词（绕过审计/禁用安全检查/关闭防护/bypass audit 等）
+      // 已迁至 agent_moss/agents/xiaoo/rules.json 的 extra_injection_keywords，
+      // 由 agent_ext 机制注入，不再污染通用层。
+    ];
+    DANGEROUS_PATTERNS = [
+      // --- Critical: rm command graded detection (strict to loose, first match wins) ---
+      // 1. rm -rf root dir (含通配符如 /* /.* 等) — 使用负向先行断言 (?!\w)：/ 后面不是单词字符时匹配
+      { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*f[a-zA-Z]*\s+\/(?!\w)/i, severity: "critical", description: "\u9012\u5F52\u5F3A\u5236\u5220\u9664\u6839\u76EE\u5F55 (rm -rf /)", riskType: "script_execution" },
+      // 注意：已移除"rm -rf /任意绝对路径"的宽泛规则，避免误杀 /tmp 等临时目录清理操作
+      // 2. rm with -r or -f targeting system dirs — var 分支排除 /var/tmp/（合法清理）
+      { pattern: /\brm\s+-[a-zA-Z]*[rf][a-zA-Z]*\s+\/(etc|var(?!\/tmp)|home|usr|boot|root|opt|srv|sys|proc)\b/i, severity: "critical", description: "\u5220\u9664\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55", riskType: "script_execution" },
+      // 3. rm -r absolute path (no -f) — 排除 /tmp/ /var/tmp/ /run/ /dev/shm/（CI/开发高频合法清理）
+      { pattern: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*\s+\/(?!tmp\/|var\/tmp\/|run\/|dev\/shm\/)/i, severity: "high", description: "\u9012\u5F52\u5220\u9664\u64CD\u4F5C (rm -r /...)", riskType: "script_execution" },
+      // 4. rm -f absolute path (no -r) — 同样排除临时目录
+      { pattern: /\brm\s+-[a-zA-Z]*f[a-zA-Z]*\s+\/(?!tmp\/|var\/tmp\/|run\/|dev\/shm\/)/i, severity: "medium", description: "\u5F3A\u5236\u5220\u9664\u6587\u4EF6 (rm -f /...)", riskType: "script_execution" },
+      // dd 磁盘清零 — 只拦截写入系统关键目录，放行 /tmp 等临时目录
+      { pattern: /dd\s+if=\/dev\/zero.*\bof\s*=\s*\/(etc|var|home|usr|boot|root|opt|srv|sys|proc)\b/i, severity: "critical", description: "\u78C1\u76D8\u6E05\u96F6\u5199\u5165\u5173\u952E\u7CFB\u7EDF\u76EE\u5F55 (dd if=/dev/zero of=/\u7CFB\u7EDF\u76EE\u5F55)", riskType: "script_execution" },
+      // mkfs 格式化 — 只拦截对块设备（/dev/sdX 等）的格式化，放行对普通文件的格式化
+      { pattern: /mkfs\.\w+\s+\/dev\/(sd|hd|nvme|vd|loop|mapper|md|dm)\S+/i, severity: "critical", description: "\u683C\u5F0F\u5316\u5757\u8BBE\u5907 (mkfs /dev/\u5757\u8BBE\u5907)", riskType: "script_execution" },
+      { pattern: /:\(\)\s*\{.*:\|:&.*\};:/i, severity: "critical", description: "Fork Bomb", riskType: "resource_exhaustion" },
+      // --- Critical: remote code execution ---
+      { pattern: /curl\s+.*\|\s*(bash|sh|zsh|dash)/i, severity: "critical", description: "curl pipe shell \u6267\u884C", riskType: "script_execution" },
+      { pattern: /wget\s+.*\|\s*(bash|sh)/i, severity: "critical", description: "wget pipe shell \u6267\u884C", riskType: "script_execution" },
+      { pattern: /eval\s+\$\(curl|eval\s+\$\(wget/i, severity: "critical", description: "eval \u8FDC\u7A0B\u4EE3\u7801\u6267\u884C", riskType: "script_execution" },
+      { pattern: /base64\s+-d\s+.*\|\s*bash/i, severity: "critical", description: "base64 \u89E3\u7801\u6267\u884C", riskType: "script_execution" },
+      // --- Critical: reverse shell ---
+      { pattern: /\/dev\/tcp\/|bash\s+-i\s+>&/i, severity: "critical", description: "\u53CD\u5F39 Shell", riskType: "script_execution" },
+      { pattern: /nc\s+-[el]\s+.*\d{1,5}/i, severity: "high", description: "Netcat \u53CD\u5F39\u8FDE\u63A5", riskType: "lateral_movement" },
+      // --- Critical: sensitive file access ---
+      { pattern: /\/etc\/shadow/i, severity: "critical", description: "\u8BBF\u95EE\u7CFB\u7EDF\u5BC6\u7801\u6587\u4EF6 (/etc/shadow)", riskType: "file_access" },
+      { pattern: /\/etc\/gshadow/i, severity: "critical", description: "\u8BBF\u95EE\u7CFB\u7EDF\u7EC4\u5BC6\u7801\u6587\u4EF6 (/etc/gshadow)", riskType: "file_access" },
+      // 注意：/etc/passwd 已从拦截列表移除，因为它是公开可读的标准系统文件，真正敏感的是 /etc/shadow
+      { pattern: /\.ssh\/id_rsa(?!\.pub)/i, severity: "critical", description: "\u8BBF\u95EE SSH \u79C1\u94A5\u6587\u4EF6", riskType: "file_access" },
+      // --- Critical: privilege escalation / container escape ---
+      { pattern: /\/var\/run\/docker\.sock/i, severity: "critical", description: "\u8BBF\u95EE Docker socket\uFF0C\u53EF\u80FD\u5BFC\u81F4\u5BB9\u5668\u9003\u9038", riskType: "privilege_escalation" },
+      // --- High: dangerous permissions / ownership ---
+      { pattern: /chmod\s+[0-7]*777[0-7]*/i, severity: "high", description: "\u5168\u6743\u9650\u8BBE\u7F6E (chmod 777)", riskType: "script_execution" },
+      { pattern: /chown\s+root|chown\s+-R\s+\w+:\w+\s+\//i, severity: "high", description: "\u4FEE\u6539\u6240\u6709\u8005\u4E3A root / \u9012\u5F52\u4FEE\u6539\u6839\u76EE\u5F55\u6240\u6709\u8005", riskType: "script_execution" },
+      // sudo 提权 — 只拦截 sudo 后跟的危险命令，不一刀切拦截所有 sudo
+      { pattern: /sudo\s+(rm|chmod|chown|dd|mkfs|format|iptables|crontab|passwd|userdel|useradd|groupdel)\b/i, severity: "high", description: "\u63D0\u6743\u6267\u884C\u9AD8\u5371\u547D\u4EE4 (sudo + \u5371\u9669\u64CD\u4F5C)", riskType: "privilege_escalation" },
+      // --- High: system config overwrite ---
+      { pattern: />\s*\/etc\//i, severity: "critical", description: "\u8986\u76D6\u5199\u5165\u7CFB\u7EDF\u914D\u7F6E\u76EE\u5F55", riskType: "file_access" },
+      // --- High: download script + execute risk ---
+      { pattern: /(?:curl|wget)\s+.*(?:-o|--output|>)\s*\S+\.(?:sh|bash)\b/i, severity: "high", description: "\u8FDC\u7A0B\u4E0B\u8F7D\u811A\u672C\u5230\u672C\u5730", riskType: "script_execution" },
+      { pattern: /(?:curl|wget)\s+.*\s+&&?\s*(?:chmod\s+\+x|bash|sh)/i, severity: "high", description: "\u4E0B\u8F7D\u540E\u6267\u884C", riskType: "script_execution" },
+      // --- High: package manager pipe-to-shell ---
+      { pattern: /git\s+clone\s+.*\|.*bash/i, severity: "high", description: "git clone pipe shell", riskType: "script_execution" },
+      { pattern: /pip\s+install\s+.*\|\s*bash/i, severity: "high", description: "pip install pipe shell", riskType: "script_execution" },
+      { pattern: /npm\s+install\s+-g\s+.*\|\s*bash/i, severity: "high", description: "npm install pipe shell", riskType: "script_execution" },
+      // --- Medium: destructive git operations (降级为 medium，允许但记录) ---
+      { pattern: /git\s+push\s+.*--force/i, severity: "medium", description: "\u5F3A\u5236\u63A8\u9001\u64CD\u4F5C (git push --force)\uFF0C\u53EF\u80FD\u8986\u76D6\u8FDC\u7A0B\u63D0\u4EA4\u5386\u53F2", riskType: "script_execution" },
+      // --- High: network port scanning (横向移动侦察) ---
+      { pattern: /\bnmap\s+/i, severity: "high", description: "\u7F51\u7EDC\u7AEF\u53E3\u626B\u63CF (nmap)\uFF0C\u53EF\u80FD\u7528\u4E8E\u6A2A\u5411\u79FB\u52A8\u4FA6\u5BDF", riskType: "lateral_movement" },
+      { pattern: /\b(masscan|zmap|unicornscan)\s+/i, severity: "high", description: "\u7F51\u7EDC\u7AEF\u53E3\u626B\u63CF\u5DE5\u5177\uFF0C\u53EF\u80FD\u7528\u4E8E\u6A2A\u5411\u79FB\u52A8\u4FA6\u5BDF", riskType: "lateral_movement" },
+      // --- Medium: credential export ---
+      { pattern: /export\s+.*(?:TOKEN|KEY|SECRET|PASSWORD)/i, severity: "medium", description: "\u5BFC\u51FA\u654F\u611F\u51ED\u8BC1", riskType: "data_exfiltration" },
+      // --- High: shell rc file append (persistence) ---
+      { pattern: />>\s*(~|\/home\/[^/]+)\/(\.bashrc|\.zshrc|\.profile|\.bash_profile|\.zprofile)/, severity: "high", description: "\u68C0\u6D4B\u5230\u4FEE\u6539 Shell \u914D\u7F6E\u6587\u4EF6\uFF08~/.bashrc \u7B49\uFF09\uFF0C\u53EF\u80FD\u7528\u4E8E\u6301\u4E45\u5316\u540E\u95E8", riskType: "persistence" },
+      // --- High: device file write (只拦截重定向写入设备文件，不拦截读取) ---
+      { pattern: />\s*\/dev\/(sd|hd|nvme|vd|loop|mem|kmsg|port|zero|random|urandom|full|core)/i, severity: "high", description: "\u91CD\u5B9A\u5411\u5199\u5165\u8BBE\u5907\u6587\u4EF6", riskType: "file_access" },
+      // --- High: non-interactive password modification ---
+      { pattern: /\|\s*passwd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u7BA1\u9053\u65B9\u5F0F\u8C03\u7528 passwd\uFF08\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\uFF09", riskType: "script_execution" },
+      { pattern: /\bpasswd\s+--stdin\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 passwd --stdin \u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u8F93\u5165", riskType: "script_execution" },
+      { pattern: /\bchpasswd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 chpasswd \u6279\u91CF\u5BC6\u7801\u4FEE\u6539\u547D\u4EE4", riskType: "script_execution" },
+      { pattern: /\b(newusers|lnewusers)\b/i, severity: "high", description: "\u68C0\u6D4B\u5230 newusers/lnewusers \u6279\u91CF\u7528\u6237\u6DFB\u52A0\u547D\u4EE4", riskType: "script_execution" },
+      { pattern: /\bpasswd\s+-[a-zA-Z]*d\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u5BC6\u7801\u64CD\u4F5C (passwd -d)", riskType: "script_execution" },
+      { pattern: /\bpasswd\s+-[a-zA-Z]*l\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u9501\u5B9A\u7528\u6237\u8D26\u6237\u64CD\u4F5C (passwd -l)", riskType: "script_execution" },
+      // --- High: non-interactive password modification (extended) ---
+      { pattern: /\blpasswd\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u975E\u4EA4\u4E92\u5F0F\u5BC6\u7801\u4FEE\u6539\u64CD\u4F5C (lpasswd)", riskType: "script_execution" },
+      { pattern: /\bgpasswd\s+(?!-[adA])/i, severity: "high", description: "\u68C0\u6D4B\u5230\u7EC4\u5BC6\u7801\u7BA1\u7406\u64CD\u4F5C (gpasswd)", riskType: "script_execution" },
+      { pattern: /\bchgpasswd\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u6279\u91CF\u4FEE\u6539\u7EC4\u5BC6\u7801\u64CD\u4F5C (chgpasswd)", riskType: "script_execution" },
+      // --- High: user/group deletion (irreversible, requires user consent) ---
+      { pattern: /\buserdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (userdel)", riskType: "script_execution" },
+      { pattern: /\bdeluser\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (deluser)", riskType: "script_execution" },
+      { pattern: /\bluserdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7CFB\u7EDF\u7528\u6237\u64CD\u4F5C (luserdel)", riskType: "script_execution" },
+      { pattern: /\bgroupdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u7EC4\u64CD\u4F5C (groupdel)", riskType: "script_execution" },
+      { pattern: /\blgroupdel\s/i, severity: "high", description: "\u68C0\u6D4B\u5230\u5220\u9664\u7528\u6237\u7EC4\u64CD\u4F5C (lgroupdel)", riskType: "script_execution" },
+      // --- High: generic command -p parameter password setting ---
+      { pattern: /\b(useradd|luseradd|groupadd|usermod|lusermod|groupmod|lgroupmod)\b[^&|;]*?\s-p\b/i, severity: "high", description: "\u68C0\u6D4B\u5230\u901A\u8FC7 -p \u53C2\u6570\u8BBE\u7F6E\u6216\u4FEE\u6539\u5BC6\u7801 (useradd/usermod/groupmod)", riskType: "script_execution" }
+    ];
+    SENSITIVE_EXCLUDED_PREFIXES = ["memory-", "skill-", "skill-manager-", "mailbox-", "app-"];
   }
-  return [];
+});
+
+// src/engine/token-stats.ts
+var token_stats_exports = {};
+__export(token_stats_exports, {
+  getRecentRecords: () => getRecentRecords,
+  getTokenStats: () => getTokenStats,
+  getTokenTrend: () => getTokenTrend,
+  recordTokenUsage: () => recordTokenUsage,
+  resetTokenStats: () => resetTokenStats
+});
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync2, existsSync as existsSync7, mkdirSync as mkdirSync2, unlinkSync as unlinkSync2 } from "fs";
+import { join as join4 } from "path";
+import { homedir as homedir3 } from "os";
+function getStatsPath() {
+  const envPath = process.env[ENV_STATS_PATH];
+  return envPath || STATS_FILE;
 }
-function _validateSkillId(skillId) {
-  if (!skillId || !SKILL_ID_RE.test(skillId)) {
-    throw new Error(`skill_id '${skillId}' \u4E0D\u5408\u6CD5\uFF1A\u53EA\u5141\u8BB8\u5B57\u6BCD\u3001\u6570\u5B57\u3001\u4E0B\u5212\u7EBF\u548C\u8FDE\u5B57\u7B26`);
+function loadAllRecords(statsPath) {
+  if (!existsSync7(statsPath)) return [];
+  try {
+    const data = JSON.parse(readFileSync7(statsPath, "utf-8"));
+    if (Array.isArray(data)) return data;
+    if (data && Array.isArray(data.records)) return data.records;
+    return [];
+  } catch (e) {
+    return [];
   }
 }
-function updateLayerEnabled(layerKey, enabled) {
-  const runtime = loadRuntimeConfig();
-  runtime.layers[layerKey] = enabled;
-  saveRuntimeConfig(runtime);
-  return runtime;
-}
-function updateRuleEnabled(layer, category, ruleId, enabled) {
-  const runtime = loadRuntimeConfig();
-  for (const r of runtime[layer]?.[category]?.rules || []) {
-    if (r.id === ruleId) {
-      r.enabled = enabled;
-      break;
-    }
+function saveRecords(statsPath, records) {
+  try {
+    const dir = statsPath.substring(0, statsPath.lastIndexOf("/"));
+    if (dir && !existsSync7(dir)) mkdirSync2(dir, { recursive: true });
+    writeFileSync2(statsPath, JSON.stringify(records, null, 2), "utf-8");
+  } catch (e) {
   }
-  saveRuntimeConfig(runtime);
-  return runtime;
 }
-function updateRuleDenyMode(layer, category, ruleId, denyMode) {
-  const runtime = loadRuntimeConfig();
-  for (const r of runtime[layer]?.[category]?.rules || []) {
-    if (r.id === ruleId) {
-      r.deny_mode = denyMode;
-      _syncDenyModeFields(r);
-      break;
-    }
+function recordTokenUsage(record) {
+  const statsPath = getStatsPath();
+  const records = loadAllRecords(statsPath);
+  records.push({
+    timestamp: record.timestamp || (/* @__PURE__ */ new Date()).toISOString(),
+    session_id: record.sessionId,
+    step: record.step,
+    model: record.model,
+    prompt_tokens: record.promptTokens,
+    completion_tokens: record.completionTokens,
+    total_tokens: record.totalTokens
+  });
+  if (records.length > MAX_RECORDS) {
+    records.splice(0, records.length - MAX_RECORDS);
   }
-  saveRuntimeConfig(runtime);
-  return runtime;
+  saveRecords(statsPath, records);
 }
-function updateRuleSkipL3(layer, category, ruleId, skipL3) {
-  const runtime = loadRuntimeConfig();
-  for (const r of runtime[layer]?.[category]?.rules || []) {
-    if (r.id === ruleId) {
-      r.skip_l3_on_disabled = skipL3;
-      break;
+function filterByDate(records, days = 0, startDate, endDate) {
+  if (startDate || endDate) {
+    let startDt = startDate ? new Date(startDate) : /* @__PURE__ */ new Date(-864e13);
+    let endDt = endDate ? new Date(endDate) : void 0;
+    if (endDate) {
+      const e = new Date(endDate);
+      e.setHours(23, 59, 59, 999);
+      endDt = e;
     }
+    const endMs = endDt ? endDt.getTime() : Number.MAX_SAFE_INTEGER;
+    return records.filter((r) => {
+      try {
+        const ts = new Date(r.timestamp).getTime();
+        return ts >= startDt.getTime() && ts <= endMs;
+      } catch {
+        return true;
+      }
+    });
+  } else if (days > 0) {
+    const cutoff = Date.now() - days * 864e5;
+    return records.filter((r) => {
+      try {
+        return new Date(r.timestamp).getTime() >= cutoff;
+      } catch {
+        return true;
+      }
+    });
   }
-  saveRuntimeConfig(runtime);
-  return runtime;
-}
-function updateCategoryEnabled(layer, category, enabled) {
-  const runtime = loadRuntimeConfig();
-  const cat = runtime[layer]?.[category];
-  if (cat) cat.category_enabled = enabled;
-  saveRuntimeConfig(runtime);
-  return runtime;
+  return records;
 }
-function addCustomRule(layer, category, rule) {
-  const runtime = loadRuntimeConfig();
-  const layerObj = runtime[layer] || (runtime[layer] = {});
-  const cat = layerObj[category] || (layerObj[category] = { category_enabled: true, category_desc: "", rules: [] });
-  const rules = cat.rules || (cat.rules = []);
-  const newRule = { ...rule, builtin: false, enabled: true };
-  if (!newRule.id) {
-    newRule.id = `custom_${Date.now()}_${_slugify(JSON.stringify(rule).slice(0, 30))}`;
+function aggregate(records) {
+  let totalPrompt = 0, totalCompletion = 0, totalTotal = 0;
+  const byStep = {};
+  const byModel = {};
+  const byDate = {};
+  const bucket = (b, key, r) => {
+    const e = b[key] || (b[key] = { prompt_tokens: 0, completion_tokens: 0, total_tokens: 0, calls: 0 });
+    e.prompt_tokens += r.prompt_tokens || 0;
+    e.completion_tokens += r.completion_tokens || 0;
+    e.total_tokens += r.total_tokens || 0;
+    e.calls += 1;
+  };
+  for (const r of records) {
+    totalPrompt += r.prompt_tokens || 0;
+    totalCompletion += r.completion_tokens || 0;
+    totalTotal += r.total_tokens || 0;
+    bucket(byStep, r.step || "unknown", r);
+    bucket(byModel, r.model || "unknown", r);
+    let dateKey = "unknown";
+    try {
+      dateKey = new Date(r.timestamp).toISOString().slice(0, 10);
+    } catch {
+    }
+    bucket(byDate, dateKey, r);
   }
-  if (newRule.deny_mode) _syncDenyModeFields(newRule);
-  rules.push(newRule);
-  saveRuntimeConfig(runtime);
-  return runtime;
+  const sortedDate = Object.keys(byDate).sort((a, b) => a < b ? 1 : a > b ? -1 : 0);
+  const sortedByDate = {};
+  for (const k of sortedDate) sortedByDate[k] = byDate[k];
+  return { totalPrompt, totalCompletion, totalTotal, byStep, byModel, byDate: sortedByDate };
 }
-function deleteCustomRule(layer, category, ruleId) {
-  const runtime = loadRuntimeConfig();
-  const rules = runtime[layer]?.[category]?.rules || [];
-  const idx = rules.findIndex((r) => r.id === ruleId);
-  if (idx >= 0) {
-    const r = rules[idx];
-    if (r.builtin && !r.source_removed) return null;
-    rules.splice(idx, 1);
-    saveRuntimeConfig(runtime);
-  }
-  return runtime;
+function getTokenStats(days = 0, startDate, endDate) {
+  const records = filterByDate(loadAllRecords(getStatsPath()), days, startDate, endDate);
+  const a = aggregate(records);
+  return {
+    total_prompt_tokens: a.totalPrompt,
+    total_completion_tokens: a.totalCompletion,
+    total_tokens: a.totalTotal,
+    total_calls: records.length,
+    by_step: a.byStep,
+    by_model: a.byModel,
+    by_date: a.byDate
+  };
 }
-function addCustomSkill(skillId, category, keywords, content) {
-  _validateSkillId(skillId);
-  const runtime = loadRuntimeConfig();
-  const skillsDir = join4(RUNTIME_CONFIG_DIR, "agent_moss_skills");
-  try {
-    mkdirSync2(skillsDir, { recursive: true });
-  } catch {
-  }
-  writeFileSync2(join4(skillsDir, `${skillId}.md`), content, "utf-8");
-  const l3 = runtime.L3_skills || (runtime.L3_skills = {});
-  const cat = l3[category] || (l3[category] = { category_enabled: true, category_desc: "", skills: [] });
-  (cat.skills || (cat.skills = [])).push({ id: skillId, keywords, enabled: true, builtin: false });
-  saveRuntimeConfig(runtime);
-  return runtime;
+function getRecentRecords(limit = 20) {
+  const records = loadAllRecords(getStatsPath());
+  return records.slice(-limit);
 }
-function deleteCustomSkill(skillId, category) {
-  _validateSkillId(skillId);
-  const runtime = loadRuntimeConfig();
-  const skills = runtime.L3_skills?.[category]?.skills || [];
-  const idx = skills.findIndex((s) => s.id === skillId);
-  if (idx >= 0) {
-    if (skills[idx].builtin) return null;
-    skills.splice(idx, 1);
-    const skillPath = join4(RUNTIME_CONFIG_DIR, "agent_moss_skills", `${skillId}.md`);
+function getTokenTrend(days = 0, startDate, endDate) {
+  const records = filterByDate(loadAllRecords(getStatsPath()), days, startDate, endDate);
+  const series = {};
+  const datesSet = /* @__PURE__ */ new Set();
+  for (const r of records) {
+    let dateKey;
     try {
-      if (existsSync7(skillPath)) unlinkSync2(skillPath);
+      dateKey = new Date(r.timestamp).toISOString().slice(0, 10);
     } catch {
+      continue;
     }
-    saveRuntimeConfig(runtime);
+    const model = r.model || "unknown";
+    const tokens = r.total_tokens || 0;
+    datesSet.add(dateKey);
+    series[model] = series[model] || {};
+    series[model][dateKey] = (series[model][dateKey] || 0) + tokens;
   }
-  return runtime;
+  const dates = Array.from(datesSet).sort();
+  const models = Object.keys(series).sort();
+  return { dates, models, series };
 }
-function updateSkillEnabled(skillId, enabled) {
-  const runtime = loadRuntimeConfig();
-  for (const catData of Object.values(runtime.L3_skills || {})) {
-    for (const s of catData.skills || []) {
-      if (s.id === skillId) {
-        s.enabled = enabled;
-        break;
-      }
+function resetTokenStats() {
+  const statsPath = getStatsPath();
+  if (existsSync7(statsPath)) {
+    try {
+      unlinkSync2(statsPath);
+    } catch {
     }
   }
-  saveRuntimeConfig(runtime);
-  return runtime;
-}
-function updateSkillCategoryEnabled(category, enabled) {
-  const runtime = loadRuntimeConfig();
-  const cat = runtime.L3_skills?.[category];
-  if (cat) cat.category_enabled = enabled;
-  saveRuntimeConfig(runtime);
-  return runtime;
 }
-function getProfileOrDetect() {
-  return null;
-}
-var RUNTIME_CONFIG_DIR, RUNTIME_CONFIG_PATH, ENV_RUNTIME_CONFIG_PATH, LAYER_DISABLE_ENV, DENY_MODE_LABELS, SKILL_ID_RE;
-var init_runtime_config = __esm({
-  "src/infra/runtime-config.ts"() {
+var STATS_DIR, STATS_FILE, ENV_STATS_PATH, MAX_RECORDS;
+var init_token_stats = __esm({
+  "src/engine/token-stats.ts"() {
     "use strict";
     init_esm_shims();
-    init_heuristic();
-    init_logic_rules();
-    init_skill_loader();
-    RUNTIME_CONFIG_DIR = join4(homedir3(), ".config", "agentmoss");
-    RUNTIME_CONFIG_PATH = join4(RUNTIME_CONFIG_DIR, "agent_moss_runtime.json");
-    ENV_RUNTIME_CONFIG_PATH = "AGENT_MOSS_RUNTIME_CONFIG_PATH";
-    LAYER_DISABLE_ENV = {
-      L1_heuristic: "AGENT_MOSS_DISABLE_HEURISTIC",
-      L2_logic_rules: "AGENT_MOSS_DISABLE_LOGIC_RULES",
-      L3_llm_analysis: "AGENT_MOSS_DISABLE_LLM"
-    };
-    DENY_MODE_LABELS = {
-      deny_write: "\u4EC5\u62E6\u622A\u5199\u5165",
-      deny_read: "\u4EC5\u62E6\u622A\u8BFB\u53D6",
-      deny_both: "\u8BFB\u5199\u5747\u62E6\u622A"
-    };
-    SKILL_ID_RE = /^[A-Za-z0-9_-]+$/;
+    STATS_DIR = join4(homedir3(), ".config", "agentmoss");
+    STATS_FILE = join4(STATS_DIR, "agent_moss_token_stats.json");
+    ENV_STATS_PATH = "AGENT_MOSS_TOKEN_STATS_PATH";
+    MAX_RECORDS = 1e4;
   }
 });
 
@@ -2283,9 +2500,9 @@ var require_bindings = __commonJS({
     init_esm_shims();
     var fs4 = __require("fs");
     var path3 = __require("path");
-    var fileURLToPath6 = require_file_uri_to_path();
+    var fileURLToPath7 = require_file_uri_to_path();
     var join6 = path3.join;
-    var dirname6 = path3.dirname;
+    var dirname7 = path3.dirname;
     var exists = fs4.accessSync && function(path4) {
       try {
         fs4.accessSync(path4);
@@ -2395,12 +2612,12 @@ var require_bindings = __commonJS({
       Error.stackTraceLimit = origSTL;
       var fileSchema = "file://";
       if (fileName.indexOf(fileSchema) === 0) {
-        fileName = fileURLToPath6(fileName);
+        fileName = fileURLToPath7(fileName);
       }
       return fileName;
     };
     exports.getRoot = function getRoot(file) {
-      var dir = dirname6(file), prev;
+      var dir = dirname7(file), prev;
       while (true) {
         if (dir === ".") {
           dir = process.cwd();
@@ -3056,28 +3273,28 @@ init_skill_loader();
 
 // src/engine/template-loader.ts
 init_esm_shims();
-import { readFileSync as readFileSync3, existsSync as existsSync4 } from "fs";
-import { resolve as resolve3, dirname as dirname3 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
-var __filename4 = fileURLToPath4(import.meta.url);
-var __dirname4 = dirname3(__filename4);
-var TEMPLATES_DIR = resolve3(__dirname4, "../templates");
-var TEMPLATES_DIR_FALLBACK = resolve3(__dirname4, "../../../agent_moss/templates");
+import { readFileSync as readFileSync4, existsSync as existsSync5 } from "fs";
+import { resolve as resolve3, dirname as dirname4 } from "path";
+import { fileURLToPath as fileURLToPath5 } from "url";
+var __filename4 = fileURLToPath5(import.meta.url);
+var __dirname5 = dirname4(__filename4);
+var TEMPLATES_DIR = resolve3(__dirname5, "../templates");
+var TEMPLATES_DIR_FALLBACK = resolve3(__dirname5, "../../../agent_moss/templates");
 var TEMPLATE_FILES = ["prompt1_template.txt", "prompt2_template.txt", "security_judge_template.txt"];
 var cachedTemplates = null;
 function loadTemplates() {
   if (cachedTemplates) return cachedTemplates;
   cachedTemplates = {};
-  const dir = existsSync4(TEMPLATES_DIR) ? TEMPLATES_DIR : TEMPLATES_DIR_FALLBACK;
-  if (!existsSync4(dir)) {
+  const dir = existsSync5(TEMPLATES_DIR) ? TEMPLATES_DIR : TEMPLATES_DIR_FALLBACK;
+  if (!existsSync5(dir)) {
     console.warn("[AgentMoss] Templates directory not found:", TEMPLATES_DIR, "and fallback:", TEMPLATES_DIR_FALLBACK);
     return cachedTemplates;
   }
   for (const file of TEMPLATE_FILES) {
     const filePath = resolve3(dir, file);
-    if (existsSync4(filePath)) {
+    if (existsSync5(filePath)) {
       const key = file.replace(".txt", "").replace("_template", "");
-      cachedTemplates[key] = readFileSync3(filePath, "utf-8");
+      cachedTemplates[key] = readFileSync4(filePath, "utf-8");
     }
   }
   console.log(`[AgentMoss] Loaded ${Object.keys(cachedTemplates).length} templates from ${dir}`);
@@ -3086,8 +3303,8 @@ function loadTemplates() {
 
 // src/engine/script-analyzer.ts
 init_esm_shims();
-import { readFileSync as readFileSync4 } from "fs";
-import { resolve as resolve4, join } from "path";
+import { readFileSync as readFileSync5 } from "fs";
+import { resolve as resolve4, join as join2 } from "path";
 var SUSPICIOUS_PATTERNS = [
   // Network exfiltration (curl/wget POST in scripts is almost never legitimate)
   { name: "curl POST", pattern: /curl\s+(.*\s)?-X\s+POST/i },
@@ -3220,8 +3437,8 @@ function assessKeywordCombinationRisk(matchedKeywords, scriptContent) {
 }
 function readScriptContent(scriptPath, maxLines = 500) {
   try {
-    const expandedPath = scriptPath.startsWith("~") ? join(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve4(scriptPath);
-    const raw = readFileSync4(expandedPath, "utf-8");
+    const expandedPath = scriptPath.startsWith("~") ? join2(process.env.HOME || "/home/user", scriptPath.slice(2)) : resolve4(scriptPath);
+    const raw = readFileSync5(expandedPath, "utf-8");
     const lines = raw.split("\n").slice(0, maxLines);
     return { content: lines.join("\n"), lineCount: lines.length, error: "" };
   } catch (e) {
@@ -3275,9 +3492,9 @@ ${result.scriptContent}
 init_esm_shims();
 init_heuristic();
 init_logic_rules();
-import { readFileSync as readFileSync5, statSync, existsSync as existsSync5 } from "fs";
-import { resolve as resolve5, join as join2, isAbsolute, dirname as dirname4 } from "path";
-import { homedir } from "os";
+import { readFileSync as readFileSync6, statSync, existsSync as existsSync6 } from "fs";
+import { resolve as resolve5, join as join3, isAbsolute, dirname as dirname5 } from "path";
+import { homedir as homedir2 } from "os";
 function emptyChain() {
   return {
     nodes: [],
@@ -3505,7 +3722,7 @@ function extractInlineScriptPath(actionDetail) {
     let resolved;
     try {
       resolved = resolvePath(p);
-      if (existsSync5(resolved)) {
+      if (existsSync6(resolved)) {
         const stat = statSync(resolved);
         if (stat.isFile()) return resolved;
       }
@@ -3517,20 +3734,20 @@ function extractInlineScriptPath(actionDetail) {
 function resolvePath(p) {
   let expanded = p;
   if (expanded.startsWith("~/") || expanded === "~") {
-    expanded = join2(homedir(), expanded.slice(1));
+    expanded = join3(homedir2(), expanded.slice(1));
   }
   return resolve5(expanded);
 }
 function readScriptContent2(scriptPath, maxFileSize = 2 * 1024 * 1024) {
   try {
     const path3 = resolvePath(scriptPath);
-    if (!existsSync5(path3)) return { content: "", lineCount: 0, fileSize: 0, error: `\u811A\u672C\u4E0D\u5B58\u5728: ${scriptPath}` };
+    if (!existsSync6(path3)) return { content: "", lineCount: 0, fileSize: 0, error: `\u811A\u672C\u4E0D\u5B58\u5728: ${scriptPath}` };
     const stat = statSync(path3);
     if (!stat.isFile()) return { content: "", lineCount: 0, fileSize: 0, error: `\u4E0D\u662F\u6587\u4EF6: ${scriptPath}` };
     if (stat.size > maxFileSize) {
       return { content: "", lineCount: 0, fileSize: stat.size, error: `\u811A\u672C\u6587\u4EF6\u8FC7\u5927 (${stat.size} bytes)\uFF0C\u8DF3\u8FC7\u8BFB\u53D6` };
     }
-    const content = readFileSync5(path3, "utf-8");
+    const content = readFileSync6(path3, "utf-8");
     const lineCount = content ? content.split("\n").length : 0;
     return { content, lineCount, fileSize: stat.size, error: "" };
   } catch (e) {
@@ -3547,9 +3764,9 @@ function extractChildScriptPaths(content, baseDir) {
       const pathStr = m[1];
       if (pathStr.startsWith("-") || pathStr.startsWith("$")) continue;
       if (pathStr.includes("/dev/") || pathStr.startsWith("|") || pathStr.startsWith(";")) continue;
-      const full = isAbsolute(pathStr) ? pathStr : join2(baseDir, pathStr);
+      const full = isAbsolute(pathStr) ? pathStr : join3(baseDir, pathStr);
       const resolved = resolvePath(full);
-      if (existsSync5(resolved)) {
+      if (existsSync6(resolved)) {
         try {
           if (statSync(resolved).isFile() && !paths.includes(resolved)) paths.push(resolved);
         } catch {
@@ -3564,7 +3781,7 @@ function resolveScriptChain(entryPath, input, maxDepth = 3, maxFileSize = 2 * 10
   const result = emptyChain();
   result.entryPath = entryPath;
   const entry = resolvePath(entryPath);
-  const baseDir = existsSync5(entry) ? dirname4(entry) : input.cwd || process.cwd();
+  const baseDir = existsSync6(entry) ? dirname5(entry) : input.cwd || process.cwd();
   resolveRecursive({
     path: entry,
     depth: 0,
@@ -3639,7 +3856,7 @@ function resolveRecursive(ctx) {
       maxTotalSize,
       visited,
       result,
-      baseDir: dirname4(resolvePath(childPath)),
+      baseDir: dirname5(resolvePath(childPath)),
       input
     });
     if (result.hasCritical) return;
@@ -3901,7 +4118,7 @@ function formatHints(previous) {
   const hints = [];
   if (previous.heuristic) {
     hints.push(
-      `\u542F\u53D1\u5F0F\u68C0\u6D4B\u53D1\u73B0\u98CE\u9669 [\u98CE\u9669\u7B49\u7EA7: ${previous.heuristic.riskLevel}]:
+      `\u7279\u5F81\u5339\u914D\u68C0\u6D4B\u53D1\u73B0\u98CE\u9669 [\u98CE\u9669\u7B49\u7EA7: ${previous.heuristic.riskLevel}]:
    \u7C7B\u578B: ${previous.heuristic.riskType}
    \u539F\u56E0: ${previous.heuristic.reason}`
     );
@@ -3913,7 +4130,7 @@ function formatHints(previous) {
    \u539F\u56E0: ${previous.logic.reason}`
     );
   }
-  return hints.length > 0 ? hints.join("\n\n") : "\u542F\u53D1\u5F0F\u68C0\u6D4B\u548C\u903B\u8F91\u89C4\u5219\u68C0\u6D4B\u5747\u672A\u53D1\u73B0\u98CE\u9669\u3002";
+  return hints.length > 0 ? hints.join("\n\n") : "\u7279\u5F81\u5339\u914D\u68C0\u6D4B\u548C\u903B\u8F91\u89C4\u5219\u68C0\u6D4B\u5747\u672A\u53D1\u73B0\u98CE\u9669\u3002";
 }
 async function analyzeWithLLM(prompt, config) {
   console.log(`[AgentMoss] LLM analyzing with model: ${config.model}, url: ${config.baseUrl}`);
@@ -4121,6 +4338,7 @@ async function runAnalysis(input) {
   const actionType = input.aNext.actionType.toLowerCase();
   const rawDetail = extractRawCommand(input.aNext.actionDetail);
   const lowerDetail = rawDetail.toLowerCase();
+  const agentExt = getAgentExtensions(input.agentId);
   if (FULLY_SAFE_TOOLS.has(actionType)) {
     return {
       allowed: true,
@@ -4132,7 +4350,23 @@ async function runAnalysis(input) {
       violatedLayers: []
     };
   }
-  const agentExt = getAgentExtensions(input.agentId);
+  if (agentExt?.builtin_safe_action_types && agentExt.builtin_safe_action_types.length > 0) {
+    const hit = agentExt.builtin_safe_action_types.some((t) => {
+      const tl = t.toLowerCase();
+      return tl.endsWith("-") ? actionType.startsWith(tl) : actionType === tl;
+    });
+    if (hit) {
+      return {
+        allowed: true,
+        reason: `agent \u5185\u90E8\u5B89\u5168\u64CD\u4F5C\uFF0C\u8DF3\u8FC7\u6DF1\u5EA6\u5206\u6790: ${actionType}`,
+        riskLevel: heuristicResult?.riskLevel || "low",
+        riskType: "",
+        confidence: 95,
+        source: "whitelist_bypass",
+        violatedLayers: []
+      };
+    }
+  }
   const trustedSkills = new Set(TRUSTED_SKILLS_BASE);
   if (agentExt?.builtin_safe_skills) {
     for (const s of agentExt.builtin_safe_skills) trustedSkills.add(s);
@@ -4422,7 +4656,10 @@ async function analyzeRoute(c) {
       reason: req.reason,
       osType,
       cwd: req.cwd,
-      agentId: req.agent_id,
+      // agent_id 透传：优先顶层；为空兜底 metadata.agent_type（AgentGate V1
+      // normalizer 历史上只把 agent_type 塞进 metadata，顶层 agent_id 为空 →
+      // 定制规则不生效。AgentGate 已修，此处兜底防御其他只传 metadata 的调用方）。
+      agentId: req.agent_id || req.metadata?.agent_type || "",
       llmConfig: req.metadata?.llm_config,
       llmLogPath: req.metadata?.llm_log_path
     });
@@ -4478,10 +4715,10 @@ init_runtime_config();
 init_token_stats();
 import { Hono } from "hono";
 import { readFileSync as readFileSync8, existsSync as existsSync9 } from "fs";
-import { join as join5, dirname as dirname5 } from "path";
-import { fileURLToPath as fileURLToPath5 } from "url";
-var __dirname5 = dirname5(fileURLToPath5(import.meta.url));
-var STATIC_DIR = join5(__dirname5, "static");
+import { join as join5, dirname as dirname6 } from "path";
+import { fileURLToPath as fileURLToPath6 } from "url";
+var __dirname6 = dirname6(fileURLToPath6(import.meta.url));
+var STATIC_DIR = join5(__dirname6, "static");
 var CONSOLE_TOKEN_ENV = "AGENT_MOSS_CONSOLE_TOKEN";
 function getConsoleToken() {
   return process.env[CONSOLE_TOKEN_ENV] || "";
@@ -4598,14 +4835,52 @@ function createConsoleRouter() {
     if (!/^[A-Za-z0-9_-]+$/.test(skillId)) {
       return c.json({ error: "invalid skill_id" }, 400);
     }
-    const skillPath = join5(dirname5(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
+    const skillPath = join5(dirname6(getRuntimeConfigPath()), "agent_moss_skills", `${skillId}.md`);
     if (!existsSync9(skillPath)) {
-      const builtinPath = join5(__dirname5, "..", "..", "agent_moss", "skills", `${skillId}.md`);
+      const builtinPath = join5(__dirname6, "..", "..", "agent_moss", "skills", `${skillId}.md`);
       if (existsSync9(builtinPath)) return c.text(readFileSync8(builtinPath, "utf-8"));
       return c.json({ error: "skill not found" }, 404);
     }
     return c.text(readFileSync8(skillPath, "utf-8"));
   });
+  console2.get("/api/agents", (c) => {
+    const rc = loadRuntimeConfig();
+    return c.json({ agents: getAgentRules(rc) });
+  });
+  console2.put("/api/agents/rules/enabled", async (c) => {
+    const b = await c.req.json();
+    const fp = {};
+    if (b.value) fp.value = b.value;
+    if (b.pattern) fp.pattern = b.pattern;
+    if (b.keyword) fp.keyword = b.keyword;
+    if (b.path) fp.path = b.path;
+    const rc = updateAgentRuleEnabled(b.agent_id, b.category, fp, b.enabled);
+    return c.json({ agents: getAgentRules(rc) });
+  });
+  console2.post("/api/agents/rules", async (c) => {
+    const b = await c.req.json();
+    const rule = {};
+    for (const [k, v] of Object.entries(b)) {
+      if (!["agent_id", "category"].includes(k) && v !== void 0 && v !== null) rule[k] = v;
+    }
+    const rc = addAgentRule(b.agent_id, b.category, rule);
+    return c.json({ agents: getAgentRules(rc) });
+  });
+  console2.delete("/api/agents/rules", async (c) => {
+    const b = await c.req.json();
+    const fp = {};
+    if (b.value) fp.value = b.value;
+    if (b.pattern) fp.pattern = b.pattern;
+    if (b.keyword) fp.keyword = b.keyword;
+    if (b.path) fp.path = b.path;
+    const rc = deleteAgentRule(b.agent_id, b.category, fp);
+    return c.json({ agents: getAgentRules(rc) });
+  });
+  console2.put("/api/agents/categories/enabled", async (c) => {
+    const b = await c.req.json();
+    const rc = updateAgentCategoryEnabled(b.agent_id, b.category, b.enabled);
+    return c.json({ agents: getAgentRules(rc) });
+  });
   console2.get("/api/config", (c) => {
     const rc = loadRuntimeConfig();
     return c.json({ config: rc, config_path: getRuntimeConfigPath() });