{"timestamp":"2026-05-02T08:30:51.589800475+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"cat /etc/os-release 2>/dev/null | head -5 && echo \"---\" && which docker 2>/dev/n[...redacted 30 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"6577c1a3-a580-42a6-9d41-7cde8791ce6d","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T08:30:56.880892702+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo apt-get update -y && sudo apt-get install -y ca-certificates curl gnupg && [...redacted 536 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"ff4f5cea-efdf-49e7-ab4c-a3181a7eb6af","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T08:31:52.576580187+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo -n true 2>&1 || echo \"NEED_SUDO_PASS\"","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"3c485fa0-40f9-4389-a811-5b74d7071c66","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T08:32:02.003029924+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"# Check prerequisites for rootless docker\nid && echo \"---\" && cat /etc/subuid 2>[...redacted 88 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"5e4b8c78-b1f9-4bdd-837c-820e5c958d57","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T08:32:12.947556923+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"echo 'www' | sudo -S apt-get update -y 2>&1 | tail -3 && echo 'www' | sudo -S ap[...redacted 725 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a436e1c8-6e9f-4c4f-b620-3019edb82008","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T08:32:51.080899362+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"# Step 1: Add Docker's GPG key\ncurl -fsSL https://download.docker.com/linux/ubun[...redacted 197 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"0df81c6d-2002-4163-9ac8-4239b8063661","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T08:32:55.986090725+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /tmp/docker.gpg && ec[...redacted 174 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"5177a3a8-0770-466d-b915-0990175366f3","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T08:32:59.775353368+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"echo 'www' | sudo -S rm -f /etc/apt/keyrings/docker.gpg && file /tmp/docker.gpg [...redacted 30 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"c6e5046c-bfce-43d5-8dd9-c87ed223cff8","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T08:34:23.245225017+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"echo 'www' | sudo -S gpg --batch --yes --dearmor -o /etc/apt/keyrings/docker.gpg[...redacted 102 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"5c5e9a8d-fc2c-4c73-9848-ba033d3defd7","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T08:34:27.124798383+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"echo \"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.[...redacted 191 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"de9deb98-aa90-4bd1-b424-3c97b39e0bf6","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T08:34:43.713100439+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"echo 'www' | sudo -S cat /etc/apt/sources.list.d/docker.list && echo 'www' | sud[...redacted 44 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"31f354c7-f354-4ac3-9ad3-8a3f4e2bd75a","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T08:34:52.926847225+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"echo 'www' | sudo -S cp /tmp/docker.list /etc/apt/sources.list.d/docker.list && [...redacted 60 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"2def0ae2-f9a2-442d-9bf9-d39ba701cf03","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T08:35:18.954478552+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"echo 'www' | sudo -S apt-get install -y docker-ce docker-ce-cli containerd.io do[...redacted 56 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"1ec6cef4-94d3-40bc-a7dd-9501ee4941a6","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T08:35:48.100668983+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"docker --version && docker compose version && echo 'www' | sudo -S usermod -aG d[...redacted 153 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a5157f0d-b241-4c7c-a576-556a90788509","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T08:35:54.068506989+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"echo 'www' | sudo -S docker run --rm hello-world 2>&1 | head -10","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"9ec8ffe3-e81a-47d5-92fc-30dd6cc8411a","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T08:43:18.554651889+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Block","rule_ids":["pipe_to_interpreter"],"command_redacted":"echo 'www' | sudo -S usermod -aG sudo longshao && echo 'www' | sudo -S bash -c '[...redacted 118 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"c0c81b9b-614c-4b82-995f-4374ee043979","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["pipe_to_interpreter"]}
{"timestamp":"2026-05-02T08:57:09.820385079+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker pull gaofenglongshao/kingbasev8:0429","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"34b4276b-eb77-42cb-be45-8c782fa467de","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T08:57:45.756832172+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Warn","rule_ids":["lookalike_tld"],"command_redacted":"sudo mkdir -p /etc/docker && sudo tee /etc/docker/daemon.json <<'EOF'\n{\n  \"regis[...redacted 146 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"b49453f8-d878-47e9-9380-4777ebeda7e7","tier_reached":3,"entry_type":"verdict","raw_action":"Warn","raw_rule_ids":["lookalike_tld"]}
{"timestamp":"2026-05-02T08:58:14.653874959+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker pull gaofenglongshao/kingbasev8:0429","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"5c834ced-7ad3-46be-b4eb-56aa9a533202","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T08:58:51.713286985+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo tee /etc/docker/daemon.json <<'EOF'\n{\n  \"registry-mirrors\": [\n    \"https://[...redacted 192 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"ce6d36f4-a1cd-4e7b-bc60-52850c0d133a","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T08:59:55.977848151+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"curl -s --connect-timeout 10 https://registry-1.docker.io/v2/ && echo \"OK\" || ec[...redacted 127 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"2f062939-7dc8-42ff-9c97-dcb262822fa8","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:00:14.101331011+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo tee /etc/docker/daemon.json <<'EOF'\n{\n  \"registry-mirrors\": [\n    \"https://[...redacted 228 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"148e4522-8fc6-4e2d-b785-e81e22fbda22","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:00:20.616417114+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"# 查找 clash 代理端口\nps aux | grep -i clash | grep -v grep\necho \"---\"\n# [...redacted 64 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"5451e0bf-f7a7-4c28-be0a-47e4425d7306","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:00:25.656196455+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"# 先清理镜像源，直接走代理连官方\nsudo tee /etc/docker/daemon.json[...redacted 443 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"750052da-a996-43c2-9301-2b2cca19db2b","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:00:35.076715550+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker pull gaofenglongshao/kingbasev8:0429","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"0c17075a-b2ea-4fa6-b946-e4c8bbb12320","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:00:39.903166586+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"# 测试代理是否能访问 docker hub\ncurl -x http://127.0.0.1:7891 -s --conn[...redacted 253 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"65658258-96b3-420c-8f09-394de988cf89","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:00:46.787274190+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo tee /etc/systemd/system/docker.service.d/proxy.conf <<'EOF'\n[Service]\nEnvir[...redacted 290 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"309fb0fd-e98e-4283-b6ba-86a620431a2e","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:00:59.816310928+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"curl -x http://127.0.0.1:7890 -s \"https://hub.docker.com/v2/repositories/gaofeng[...redacted 51 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"61b4004f-2561-4ff5-ba53-287123967803","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:05:43.621807740+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker pull gaofenglongshao/kingbasev8:0429","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"bcf62788-4569-4b64-838f-d92c5295bbf4","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:15:48.071208295+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker images | grep kingbase; echo \"---\"; sudo docker pull gaofenglongshao[...redacted 31 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"c2f66595-4b5b-4947-8f0b-d8558d746ba8","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:17:18.270098019+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker run -d \\\n  --name kingbasev8 \\\n  -p 54321:54321 \\\n  -e KINGBASE_USER[...redacted 104 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"fb3dca5a-57fb-49d8-b99d-7c04dd6454f7","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:17:22.437315188+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sleep 5 && sudo docker ps | grep kingbase && echo \"---\" && sudo docker logs king[...redacted 22 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a92df8b7-dcaf-483c-a186-f39f3751f235","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:17:30.814271005+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sleep 10 && sudo docker logs kingbasev8 2>&1 | tail -10","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"fa68288d-34d0-4131-be15-e1102b802163","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:17:44.312928362+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker inspect gaofenglongshao/kingbasev8:0429 --format '{{json .Config.Cmd[...redacted 111 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"96cce737-7e95-4b1e-98ab-ce59a49997e0","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:17:48.626088788+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker rm -f kingbasev8 && sudo docker run -d \\\n  --name kingbasev8 \\\n  --u[...redacted 152 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"4575b85c-6588-4fc2-a5d2-b951c53d36b4","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:17:55.556621384+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sleep 15 && sudo docker ps | grep kingbase && echo \"---\" && sudo docker logs kin[...redacted 23 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"516fa771-0518-482a-89ab-1ee878bfb945","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:18:16.696315329+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker exec kingbasev8 cat /home/kingbase/docker-entrypoint.sh","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"92b15a5d-b925-484a-b03a-c6b665c7bb05","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:18:25.852785659+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker rm -f kingbasev8 && sudo docker run -d \\\n  --name kingbasev8 \\\n  --u[...redacted 126 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"eea9635e-31ac-4bc6-84c2-bca3ca721616","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:18:29.314082193+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sleep 15 && sudo docker logs kingbasev8 2>&1 | tail -20","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"62c4ea89-6886-45ad-ae9f-38948d0cd029","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:18:51.969731957+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker rm -f kingbasev8 && sudo docker run -d \\\n  --name kingbasev8 \\\n  --u[...redacted 134 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"77006f37-21c9-4fb9-b8b8-b1ec8a5b5343","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:18:58.060496002+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sleep 15 && sudo docker logs kingbasev8 2>&1 | tail -20","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"72623783-7caf-4616-9424-18c432e38f60","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:19:17.760385256+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker exec kingbasev8 bash -c 'source /etc/profile && /home/kingbase/insta[...redacted 63 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d636c334-3d02-4b83-8018-f4bcd2d65548","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:24:34.747078745+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker ps | grep kingbase && echo \"---\" && sudo docker exec kingbasev8 bash[...redacted 127 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d17959f4-7ddb-4373-908b-abc9b4615db4","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:24:51.210776764+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker exec kingbasev8 bash -c 'source /etc/profile && /home/kingbase/insta[...redacted 67 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"477ed187-d49d-4711-aea9-c00810f9b7f1","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:24:54.079415016+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker exec kingbasev8 bash -c 'source /etc/profile && /home/kingbase/insta[...redacted 68 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"c7a3d226-fbf4-4c39-ab4c-f0c4592adfc8","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:24:59.951268483+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker exec kingbasev8 bash -c 'source /etc/profile && /home/kingbase/insta[...redacted 49 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"7c473ff7-a86c-4436-8fc2-5b2b5ff0401f","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:33:58.862492877+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"file /home/longshao/.hermes/cache/documents/doc_86ab0c6dfbe6_DB_2026-04-28.dmp &[...redacted 110 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"73718a21-fd9e-44cb-b633-5890915981b4","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:34:03.682641496+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker cp /home/longshao/.hermes/cache/documents/doc_86ab0c6dfbe6_DB_2026-0[...redacted 59 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"29eb30e4-c88a-40d6-9c24-fe1ca9e6d652","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:34:07.622705152+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker exec kingbasev8 bash -c 'source /etc/profile && /home/kingbase/insta[...redacted 71 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"62a3f597-fe27-4621-a53d-a4495af1c6f3","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:35:11.314929171+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker exec kingbasev8 bash -c 'source /etc/profile && /home/kingbase/insta[...redacted 82 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"eacc6ff8-1f99-4009-b6f0-3eb781b0bc53","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:37:16.891228814+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker exec kingbasev8 bash -c 'source /etc/profile && /home/kingbase/insta[...redacted 157 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"833e49c4-34c1-4643-8fdf-eafb50991cfe","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:37:36.102106019+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker exec kingbasev8 bash -c 'source /etc/profile && /home/kingbase/insta[...redacted 339 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"ed8343cc-d351-4d85-9620-f4ae68ef7817","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:42:26.444318025+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker exec kingbasev8 bash -c 'source /etc/profile && /home/kingbase/insta[...redacted 161 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"6de8467b-2bc2-4896-afc9-81df0d585342","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:42:30.613454462+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker exec kingbasev8 bash -c 'source /etc/profile && /home/kingbase/insta[...redacted 66 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"297eb2e6-982d-4f0a-bcbc-b074fbc81694","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:42:47.391756381+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker exec kingbasev8 bash -c 'source /etc/profile && /home/kingbase/insta[...redacted 68 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"f479fb39-f3ba-49e5-865b-df129777963c","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:42:53.948077153+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker exec kingbasev8 bash -c 'source /etc/profile && /home/kingbase/insta[...redacted 98 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"7abde5cc-327f-4962-8d91-04a375a9de49","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:44:57.866625442+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker exec kingbasev8 bash -c 'source /etc/profile && /home/kingbase/insta[...redacted 50 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"8f96d03d-3799-4520-b5c5-370ed5d9f400","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T09:45:03.474805949+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"sudo docker exec kingbasev8 bash -c 'source /etc/profile && /home/kingbase/insta[...redacted 222 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"6a9dbeef-a1cc-4f3f-b33d-ed91825214e5","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T10:17:45.441426151+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"git --version && echo \"---\" && ssh -T [REDACTED:Email Address] 2>&1; echo \"---\" [...redacted 22 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"6e3202ad-1e17-4d1f-903e-4bb188870c79","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T10:17:50.511630736+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Block","rule_ids":["dotfile_overwrite"],"command_redacted":"# 添加 GitHub host key\nssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/nul[...redacted 106 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"8533d3c4-a178-49ae-8579-381c5e7703d9","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["dotfile_overwrite"]}
{"timestamp":"2026-05-02T10:18:11.398953214+00:00","session_id":"12e1fea4-19cf-4ca8-97be-2424dcc33575","action":"Allow","rule_ids":[],"command_redacted":"ssh-keygen -t ed25519 -C \"longshao@github\" -f ~/.ssh/id_ed25519 -N \"\" && echo \"k[...redacted 56 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"97410b65-a18d-42bb-aa1f-7b908e0b6ee6","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T12:18:44.243535046+00:00","session_id":"37bd67e5-523c-4510-af0d-a9790b37bf0c","action":"Allow","rule_ids":[],"command_redacted":"gh auth status 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"cf3110c6-cc43-45d7-b75e-ee6bfae487b5","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T12:18:47.508335249+00:00","session_id":"37bd67e5-523c-4510-af0d-a9790b37bf0c","action":"Allow","rule_ids":[],"command_redacted":"git --version 2>&1 && echo \"---\" && ssh -T [REDACTED:Email Address] 2>&1 && echo[...redacted 31 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"407e805f-51c2-4bbf-953b-4cea56fb2277","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T12:18:52.311091085+00:00","session_id":"37bd67e5-523c-4510-af0d-a9790b37bf0c","action":"Allow","rule_ids":[],"command_redacted":"ls ~/.ssh/ 2>&1 && echo \"---\" && git config --global --list 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"7d86cb3d-f533-468e-ace7-77752ff9c85e","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T12:19:17.366565836+00:00","session_id":"37bd67e5-523c-4510-af0d-a9790b37bf0c","action":"Allow","rule_ids":[],"command_redacted":"(type -p wget >/dev/null || (apt update && apt-get install wget -y)) && mkdir -p[...redacted 513 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d0063014-8c9d-46e7-bf15-1e9f19fd87f4","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T12:19:31.430150822+00:00","session_id":"37bd67e5-523c-4510-af0d-a9790b37bf0c","action":"Allow","rule_ids":[],"command_redacted":"sudo sh -c '\n(type -p wget >/dev/null || (apt update && apt-get install wget -y)[...redacted 492 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"3f59b348-0ab8-4702-9bcb-5abd12eb146d","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T12:19:58.086892027+00:00","session_id":"37bd67e5-523c-4510-af0d-a9790b37bf0c","action":"Allow","rule_ids":[],"command_redacted":"gh --version 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"98e8f519-43c9-4315-8632-96671c4fa226","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T12:21:40.230277143+00:00","session_id":"37bd67e5-523c-4510-af0d-a9790b37bf0c","action":"Block","rule_ids":["credential_in_text"],"command_redacted":"echo \"[REDACTED:GitHub PAT]\" | gh auth login --with-token 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"0ab4f64c-62c0-4bd1-9191-02cbc0519f13","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["credential_in_text"]}
{"timestamp":"2026-05-02T12:21:47.933137680+00:00","session_id":"37bd67e5-523c-4510-af0d-a9790b37bf0c","action":"Block","rule_ids":["credential_in_text"],"command_redacted":"echo \"[REDACTED:GitHub PAT]\" | gh auth login --with-token --hostname github.com [...redacted 4 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"77323214-b05e-4f9e-afb2-3e284c406705","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["credential_in_text"]}
{"timestamp":"2026-05-02T12:22:06.070465872+00:00","session_id":"37bd67e5-523c-4510-af0d-a9790b37bf0c","action":"Block","rule_ids":["dotfile_overwrite","credential_in_text","credential_in_text"],"command_redacted":"# 先配置 git 凭证\ngit config --global credential.helper store\necho \"https:/[...redacted 215 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"f62d6da1-178a-40db-9334-bd7e351cf2fa","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["dotfile_overwrite","credential_in_text","credential_in_text"]}
{"timestamp":"2026-05-02T12:22:12.329257550+00:00","session_id":"37bd67e5-523c-4510-af0d-a9790b37bf0c","action":"Block","rule_ids":["curl_pipe_shell","credential_in_text"],"command_redacted":"curl -s -H \"Authorization: token [REDACTED:GitHub PAT]\" \"https://api.github.com/[...redacted 268 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"3a27426d-ce13-43f3-9260-d896e1597316","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell","credential_in_text"]}
{"timestamp":"2026-05-02T12:22:35.224754097+00:00","session_id":"37bd67e5-523c-4510-af0d-a9790b37bf0c","action":"Block","rule_ids":["credential_in_text"],"command_redacted":"cd ~ && git clone https://gaofenglongshao:[REDACTED:GitHub PAT]@github.com/mifen[...redacted 21 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"156b91dd-8de1-4c1b-bddf-0fb7e0d93464","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["credential_in_text"]}
{"timestamp":"2026-05-02T12:22:49.023601345+00:00","session_id":"37bd67e5-523c-4510-af0d-a9790b37bf0c","action":"Allow","rule_ids":[],"command_redacted":"cd ~/yfjcgkzx && echo \"=== 仓库信息 ===\" && git remote -v && echo \"\" && echo[...redacted 86 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"484a252e-e946-4342-817a-0f6725fae214","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-02T23:23:56.105193689+00:00","session_id":"95ce6441-233d-40db-8212-9bf342641ef1","action":"Block","rule_ids":["credential_in_text"],"command_redacted":"echo \"[REDACTED:GitHub PAT]\" | gh auth login --with-token 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"ab3b3935-4dd7-4ddf-b7b3-3bad880cfd21","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["credential_in_text"]}
{"timestamp":"2026-05-02T23:24:24.966086379+00:00","session_id":"95ce6441-233d-40db-8212-9bf342641ef1","action":"Block","rule_ids":["dotfile_overwrite","credential_in_text"],"command_redacted":"git config --global credential.helper store && echo \"https://gaofenglongshao:[RE[...redacted 66 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"ddf36b03-7b86-465b-acff-6b725591d130","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["dotfile_overwrite","credential_in_text"]}
{"timestamp":"2026-05-02T23:35:38.713062189+00:00","session_id":"95ce6441-233d-40db-8212-9bf342641ef1","action":"Block","rule_ids":["credential_in_text"],"command_redacted":"curl -s -u gaofenglongshao:[REDACTED:GitHub PAT] \"https://api.github.com/user/re[...redacted 143 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"b3f60d85-8505-42a8-b76c-25a97ae36dcc","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["credential_in_text"]}
{"timestamp":"2026-05-02T23:36:41.897052907+00:00","session_id":"95ce6441-233d-40db-8212-9bf342641ef1","action":"Block","rule_ids":["curl_pipe_shell","credential_in_text"],"command_redacted":"curl -s -H \"Authorization: token [REDACTED:GitHub PAT]\" \"https://api.github.com/[...redacted 276 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"58dda079-e9f9-46ec-995e-9cfd3a046b21","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell","credential_in_text"]}
{"timestamp":"2026-05-03T02:43:03.068291242+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Block","rule_ids":["credential_in_text"],"command_redacted":"cd /home/longshao && git clone https://mifengac:[REDACTED:GitHub PAT]@github.com[...redacted 36 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"cea04ba7-6dd3-4e1f-b999-c5eb633d291d","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["credential_in_text"]}
{"timestamp":"2026-05-03T02:43:17.741000094+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/renwuguanli_zhian && ls -la && echo \"---\" && git log --oneline[...redacted 3 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"f05dca9d-293e-4559-a2ff-fde03bb1782a","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T02:44:52.285724385+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/renwuguanli_zhian && cat .env.example && echo \"===\" && cat pac[...redacted 62 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"56c0f576-1b17-4d75-b414-61619ea798c4","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T02:45:00.428215997+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"cat /home/longshao/renwuguanli_zhian/prisma/schema.prisma | head -30","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"cd6ce633-2d90-4b73-9a75-1a3fc80acf3b","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T02:45:15.283778746+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"# 启动 PostgreSQL\nsudo docker run -d \\\n  --name zhian-postgres \\\n  -e POSTGRES[...redacted 480 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"9d83499e-048b-488e-9849-c0ea41aec66b","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T02:47:19.125892955+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"sudo docker ps -a --format \"table {{.Names}}\\t{{.Status}}\\t{{.Ports}}\" | grep zh[...redacted 3 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"23dc74a5-5da1-47b2-b0d0-b9dae4099c63","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T02:47:23.029334706+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"sudo docker pull minio/minio 2>&1 | tail -5","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"7824c33e-feb8-4cdd-87f3-0834b71d0ff8","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T02:48:42.368629281+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"sudo docker run -d \\\n  --name zhian-minio \\\n  -e MINIO_ROOT_USER=minioadmin \\\n  [...redacted 175 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"310cb257-2e97-4d6d-948f-60491faf54f7","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T02:48:55.506820550+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"node --version && npm --version","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"c22c664c-91e5-4524-844f-7cc317353b61","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T02:49:02.087798288+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/renwuguanli_zhian && npm install 2>&1 | tail -10","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"5e14468b-6d45-4e23-84a4-ac1dcdf9fe43","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T02:49:56.357091978+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/renwuguanli_zhian && npx prisma db push 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"22603aa7-50b0-4d58-a294-70bdece41b1a","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T02:50:11.084105423+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/renwuguanli_zhian && npm run dev","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"fe14a4a1-d0b0-41d6-9083-8be2ecd91635","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T02:50:13.692852245+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"sleep 8 && curl -s -o /dev/null -w \"%{http_code}\" http://localhost:3000","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"64b7cd90-2f15-4f61-8107-9812cd38b4a0","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T02:50:30.598505658+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"sudo docker ps --format \"table {{.Names}}\\t{{.Status}}\\t{{.Ports}}\" | grep zhian","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"76819a10-bf15-4f20-9277-c0d074ee4598","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T03:09:46.580216595+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Warn","rule_ids":["schemeless_to_sink","schemeless_to_sink"],"command_redacted":"# 检查公网IP\ncurl -s --connect-timeout 5 ifconfig.me || curl -s --connect-ti[...redacted 196 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"9d804f4e-80de-4d00-b105-c9ca4554fad4","tier_reached":3,"entry_type":"verdict","raw_action":"Warn","raw_rule_ids":["schemeless_to_sink","schemeless_to_sink"]}
{"timestamp":"2026-05-03T03:11:05.081772134+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Warn","rule_ids":["schemeless_to_sink"],"command_redacted":"# 检查是否有公网IPv4\ncurl -4 -s --connect-timeout 5 ifconfig.me 2>/dev/nu[...redacted 50 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"3d4aaea0-76a5-4b97-ad83-6cce85164d3f","tier_reached":3,"entry_type":"verdict","raw_action":"Warn","raw_rule_ids":["schemeless_to_sink"]}
{"timestamp":"2026-05-03T03:14:25.669636272+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Block","rule_ids":["raw_ip_url","plain_http_to_sink"],"command_redacted":"# 从外部测试3000端口可达性\ncurl -4 -s --connect-timeout 5 -o /dev/null[...redacted 64 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"bc9b63be-2659-4552-b330-720f28c84c82","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["raw_ip_url","plain_http_to_sink"]}
{"timestamp":"2026-05-03T03:14:54.284523954+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Warn","rule_ids":["npm_url_install","archive_extract"],"command_redacted":"# 安装 ngrok\ncurl -sSL https://ngrok-agent.s3.amazonaws.com/ngrok-v3-stable-li[...redacted 59 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d39b5683-ce2d-4901-bd12-1ef917d5212e","tier_reached":3,"entry_type":"verdict","raw_action":"Warn","raw_rule_ids":["npm_url_install","archive_extract"]}
{"timestamp":"2026-05-03T03:15:32.952048090+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Warn","rule_ids":["npm_url_install"],"command_redacted":"# 用 snap 安装 ngrok\nsudo snap install ngrok 2>/dev/null || {\n  # 或者直[...redacted 213 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"ffc92c4b-df8d-4f77-bedb-ad7a2fca8942","tier_reached":3,"entry_type":"verdict","raw_action":"Warn","raw_rule_ids":["npm_url_install"]}
{"timestamp":"2026-05-03T03:16:24.601461339+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Warn","rule_ids":["npm_url_install"],"command_redacted":"# 试国内镜像下载 ngrok\ncurl -sSL --connect-timeout 10 https://static.ngro[...redacted 93 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"dd73bc7b-9668-4a47-b55f-b70be621d723","tier_reached":3,"entry_type":"verdict","raw_action":"Warn","raw_rule_ids":["npm_url_install"]}
{"timestamp":"2026-05-03T03:18:02.819903070+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"# 用 npm 安装 localtunnel，无需注册\nnpm install -g localtunnel 2>&1 | ta[...redacted 21 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"1fa1130d-64a8-48a3-856e-0aaabb7a4cb9","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T03:18:20.737565744+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"lt --port 3000","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"82fa5b0e-ed5d-4667-85bd-40a73a9f154d","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T03:19:03.583020665+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"lt --port 3000 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"754dfbb0-bc4b-4364-8026-85a84fc52e10","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T03:19:42.221460799+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 -R 80:localhost:3000 serveo[...redacted 9 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"69baafa0-19d7-4163-824c-a1d710aeeea3","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T03:47:18.092884471+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"# 测试代理连通性\ncurl -x http://127.0.0.1:7890 -s --connect-timeout 5 htt[...redacted 70 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"1eb1541f-b4d8-4111-ab37-2c996af48a7d","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T03:47:28.654980718+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Warn","rule_ids":["npm_url_install"],"command_redacted":"curl -x http://127.0.0.1:7890 -sSL https://bin.equinox.io/c/bNyj1mQVY4c/ngrok-v3[...redacted 64 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"8366aec8-0ca6-457c-b3e0-8db1c6e08882","tier_reached":3,"entry_type":"verdict","raw_action":"Warn","raw_rule_ids":["npm_url_install"]}
{"timestamp":"2026-05-03T03:48:06.712837155+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"sudo tar -xzf /tmp/ngrok.tgz -C /usr/local/bin/ && ngrok version && rm /tmp/ngro[...redacted 5 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"89b69f09-757b-4e94-bf28-e1ee1210fe81","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T03:48:52.983467735+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"# 通过代理安装 bore\ncurl -x http://127.0.0.1:7890 -sSL https://github.com/[...redacted 200 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d2e6b841-d822-4adf-8cd0-cf4825356ca5","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T03:49:38.415252389+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"export http_proxy=http://127.0.0.1:7890 && export https_proxy=http://127.0.0.1:7[...redacted 41 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"cfb6f57e-a443-4db8-aa5d-91142c6120a8","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T03:50:18.055262582+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"# 通过代理下载 cloudflared\ncurl -x http://127.0.0.1:7890 -sSL https://gith[...redacted 217 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"f5a45e87-1e2a-45d9-aebf-5741792e1666","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T03:52:40.178340234+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"# 试另一个下载源\ncurl -x http://127.0.0.1:7890 -L --connect-timeout 15 --[...redacted 174 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"fa64dda1-36cc-454f-ae10-fb9a96b41af1","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T03:53:29.490172412+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"sudo install -m 755 /tmp/cloudflared /usr/local/bin/cloudflared && cloudflared -[...redacted 8 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"b86bde68-c68c-467d-8a69-8d26bfc8e4a8","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T03:53:36.212423765+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"export http_proxy=http://127.0.0.1:7890 && export https_proxy=http://127.0.0.1:7[...redacted 58 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"3848e919-4c63-4822-9e9d-e10eb0ee0a81","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T03:54:28.778675651+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"cloudflared tunnel --url http://localhost:3000 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"4468a25e-2613-47a7-99b0-57f81939b68a","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T03:55:23.331067461+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"timeout 15 cloudflared tunnel --url http://localhost:3000 2>&1 || true","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"0708b009-b6d4-4648-a788-68c9d3601362","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T03:56:01.320365261+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"cloudflared tunnel --url http://localhost:3000 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"c73c49f3-5418-4fba-b8be-b16b9984aa9c","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T03:56:29.806122288+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"cloudflared tunnel --url http://localhost:3000 > /tmp/cloudflared.log 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d83ea093-5838-4aa0-8a2f-b4152f2b8791","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T03:56:34.647650799+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"sleep 8 && cat /tmp/cloudflared.log | grep -i \"trycloudflare.com\"","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"4aafbb11-43c9-438b-9b6e-e5b6f5b8bdc4","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T05:37:30.171421770+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/renwuguanli_zhian && npx next dev","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"15032417-2c10-4bcd-81a5-066b51e5eafd","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T05:37:33.487555985+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"sleep 8 && curl -s -o /dev/null -w \"%{http_code}\" http://localhost:3000","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"b862bd72-3a69-4130-9c74-03c0ce70ac34","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T05:38:01.968141069+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"ps aux | grep cloudflared | grep -v grep | awk '{print $2}' | head -1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"2f94966e-ed12-4c3c-ac3a-db8e28591753","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T05:38:09.357376751+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"cat /tmp/cloudflared.log | grep -i \"trycloudflare.com\" | tail -1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"059e7de7-6fa4-4c79-9ef5-5a53028163e0","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T06:07:21.382939861+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"curl -s -o /dev/null -w \"%{http_code}\" http://localhost:3000/login && echo \"\"","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"e914af4e-d4a2-4bbe-9167-29c463ed41d4","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T06:07:31.046024523+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"ls /home/longshao/renwuguanli_zhian/src/app/login/ 2>/dev/null && echo \"---\" && [...redacted 81 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a45bb810-374a-43a1-ab9f-da4059877f58","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T06:07:39.726279357+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Block","rule_ids":["pipe_to_interpreter"],"command_redacted":"cat /home/longshao/renwuguanli_zhian/.next/server/app-paths-manifest.json 2>/dev[...redacted 156 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"86777568-282d-4306-8ec3-371a1cbf2bca","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["pipe_to_interpreter"]}
{"timestamp":"2026-05-03T06:08:03.069833564+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"curl -v http://localhost:3000/login 2>&1 | head -30","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"b45233bd-1bce-454d-8c80-61758c5eb3d6","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T06:08:09.848872946+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/renwuguanli_zhian && npx next build 2>&1 | tail -30","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"eba1924c-b818-458c-bfb3-c2a6fa958165","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T06:09:03.159358909+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/renwuguanli_zhian && npx next dev","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"1fba0a74-ae69-4a1c-b6c7-1bbdfe80559f","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T06:09:07.379282928+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"sleep 10 && curl -s -o /dev/null -w \"%{http_code}\" http://localhost:3000/login","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"9ff4e138-2242-4c3c-bc5e-ae3973c18a76","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T06:09:40.171831840+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"cat /home/longshao/renwuguanli_zhian/src/middleware.ts","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"617f7e60-5d46-4adf-ae7e-211093f22da3","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T06:09:59.755020634+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/renwuguanli_zhian && rm -rf .next && echo \"cache cleared\"","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"50ba9895-6a61-4120-8bf2-d6851e2e54c2","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T06:10:39.786429959+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/renwuguanli_zhian && npx next dev","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"fa541513-3082-434e-bfd9-52fb6cb65770","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T06:10:48.947524688+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"sleep 12 && curl -s -o /dev/null -w \"%{http_code}\" http://localhost:3000/login","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"5260e835-8117-49c0-a682-de5c412c7864","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T06:11:21.861475641+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"ss -tlnp | grep 3000 && echo \"---\" && ps aux | grep next | grep -v grep","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"1f996fa2-b982-4413-88fb-409fc7cc12ff","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T06:11:29.046179650+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"kill 78080 78081 78093 2>/dev/null; sleep 2; ss -tlnp | grep -E \"3000|3001\"","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"878e1143-864f-48b0-8922-24d9e26cbec0","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T06:11:45.086408796+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"ps aux | grep next | grep -v grep | awk '{print $2}' | xargs -r kill -9 2>/dev/n[...redacted 34 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"7837ed72-c4ed-4c9d-bc5c-9a08ca96f615","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T06:11:53.895323983+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/renwuguanli_zhian && npx next dev -p 3000","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"736fd571-3c18-4326-8874-4ea22828431a","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T06:12:03.399032081+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"sleep 12 && curl -s -o /dev/null -w \"%{http_code}\" http://localhost:3000/login","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"1f42479e-c289-4b7c-aaf2-ad9610f9a4ba","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T06:12:28.906801677+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"ps aux | grep cloudflared | grep -v grep | awk '{print $2}' | xargs -r kill 2>/d[...redacted 31 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"af1ef741-7f4e-4db4-955b-e517ab6dab74","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T06:12:37.912081876+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"cloudflared tunnel --url http://localhost:3000 > /tmp/cloudflared2.log 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"72b30b8f-88e8-46bb-9be7-a2eb37b368f8","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T06:12:42.882361692+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"sleep 8 && cat /tmp/cloudflared2.log | grep \"trycloudflare.com\"","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"eddad864-50f4-4bf7-9aa0-3f3609e35a0c","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T06:37:42.682680731+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"curl -s -X POST http://localhost:3000/api/users/seed-super-admin \\\n  -H 'Content[...redacted 82 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"6e2ef69f-960b-4097-9381-be0e03246710","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-03T06:37:46.158057277+00:00","session_id":"bf26fae5-4750-4a29-b324-12adf869fe6a","action":"Allow","rule_ids":[],"command_redacted":"curl -s -X POST http://localhost:3000/api/auth/login \\\n  -H 'Content-Type: appli[...redacted 70 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d9537a93-c6dd-42a6-a5d0-9ad8612badc2","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-04T10:29:10.569033257+00:00","session_id":"7bedcd3f-29c2-43a4-9630-d6d3b7cceb25","action":"Allow","rule_ids":[],"command_redacted":"mkdir -p /home/longshao/jellyfin/{config,cache,media,movies,tvshows,live-tv}","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"794bbb7e-faa5-40aa-8ad9-a8b826cb283f","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-04T10:29:31.095504038+00:00","session_id":"7bedcd3f-29c2-43a4-9630-d6d3b7cceb25","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/jellyfin && docker compose up -d 2>&1; echo \"EXIT:$?\"","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"4c6a19af-d4da-4f39-a88c-48807d17b1f4","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-04T10:29:42.497210012+00:00","session_id":"7bedcd3f-29c2-43a4-9630-d6d3b7cceb25","action":"Allow","rule_ids":[],"command_redacted":"groups longshao && sudo usermod -aG docker longshao 2>/dev/null; sudo chmod 666 [...redacted 20 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d5dc534d-6fbd-4cbf-aa5e-eaa0f1b98a30","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-04T10:31:41.430959881+00:00","session_id":"7bedcd3f-29c2-43a4-9630-d6d3b7cceb25","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/jellyfin && sudo docker compose up -d","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"775d634f-d687-48d2-bc2a-a8ebbb07d2ca","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-04T10:43:28.608019813+00:00","session_id":"7bedcd3f-29c2-43a4-9630-d6d3b7cceb25","action":"Allow","rule_ids":[],"command_redacted":"docker ps | grep jellyfin && curl -s -o /dev/null -w \"%{http_code}\" http://local[...redacted 9 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"434eee9b-f513-44ef-abad-5ddb2442d54f","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-04T10:43:31.759541160+00:00","session_id":"7bedcd3f-29c2-43a4-9630-d6d3b7cceb25","action":"Allow","rule_ids":[],"command_redacted":"sleep 10 && curl -s -o /dev/null -w \"%{http_code}\" http://localhost:8096","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"e3643d65-fc07-4d0c-8e1e-522b659af3d9","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-04T10:43:45.724455212+00:00","session_id":"7bedcd3f-29c2-43a4-9630-d6d3b7cceb25","action":"Allow","rule_ids":[],"command_redacted":"docker ps --format \"table {{.Names}}\\t{{.Status}}\\t{{.Ports}}\" | grep -E \"NAME|j[...redacted 8 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"e2e464dc-fc59-4501-8b49-6f1e648240a8","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-04T11:13:00.894634585+00:00","session_id":"7bedcd3f-29c2-43a4-9630-d6d3b7cceb25","action":"Allow","rule_ids":[],"command_redacted":"curl -s \"https://raw.githubusercontent.com/iptv-org/iptv/master/streams/cn.m3u\" [...redacted 10 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"284fa095-7db9-4db2-87bb-f2df97a257d9","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-04T11:13:04.277939938+00:00","session_id":"7bedcd3f-29c2-43a4-9630-d6d3b7cceb25","action":"Allow","rule_ids":[],"command_redacted":"curl -s \"https://raw.githubusercontent.com/iptv-org/iptv/master/streams/cn.m3u\" [...redacted 105 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"db4d5360-f5a5-4e39-8d3d-807433fd51fe","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-04T11:13:10.244855362+00:00","session_id":"7bedcd3f-29c2-43a4-9630-d6d3b7cceb25","action":"Allow","rule_ids":[],"command_redacted":"grep -i \"CCTV\\|卫视\\|湖南\\|浙江\\|东方\\|江苏\\|北京\\|广东\\|深圳\" /[...redacted 56 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"89449d6d-2a9e-4b21-82fa-a4d7c7ed647a","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-04T11:13:16.336545532+00:00","session_id":"7bedcd3f-29c2-43a4-9630-d6d3b7cceb25","action":"Allow","rule_ids":[],"command_redacted":"curl -s \"https://raw.githubusercontent.com/iptv-org/iptv/master/streams/cn.m3u\" [...redacted 32 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"7b525f83-62ab-49ec-b81a-bc1325d879b5","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-04T11:13:27.163935734+00:00","session_id":"7bedcd3f-29c2-43a4-9630-d6d3b7cceb25","action":"Allow","rule_ids":[],"command_redacted":"cat > /home/longshao/jellyfin/live-tv/cctv.m3u << 'EOF'\n#EXTM3U\n#EXTINF:-1,CCTV-[...redacted 1211 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"38b4b973-b0b7-4c17-bb07-7fe35baca5f9","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-04T11:13:44.078053739+00:00","session_id":"7bedcd3f-29c2-43a4-9630-d6d3b7cceb25","action":"Warn","rule_ids":["raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url"],"command_redacted":"cat > /home/longshao/jellyfin/live-tv/weishi.m3u << 'EOF'\n#EXTM3U\n#EXTINF:-1,北[...redacted 2196 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"76bdcbaf-bc1c-43b1-9aad-10be000e2f0b","tier_reached":3,"entry_type":"verdict","raw_action":"Warn","raw_rule_ids":["raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url","raw_ip_url"]}
{"timestamp":"2026-05-04T11:16:29.214629703+00:00","session_id":"7bedcd3f-29c2-43a4-9630-d6d3b7cceb25","action":"Allow","rule_ids":[],"command_redacted":"ls -la /home/longshao/jellyfin/live-tv/ && echo \"---\" && head -10 /home/longshao[...redacted 26 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"43cb3a90-d1e8-4114-b48a-1c1b71bd824d","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-05T09:24:41.679423715+00:00","session_id":"0ef69477-ca05-40de-996a-18af1c263502","action":"Allow","rule_ids":[],"command_redacted":"curl -s \"https://api.github.com/repos/jellyfin/jellyfin-android/releases/latest\"[...redacted 79 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"b0082171-d90c-4f6e-96a2-5110c496c038","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-05T09:25:55.456436765+00:00","session_id":"0ef69477-ca05-40de-996a-18af1c263502","action":"Block","rule_ids":["curl_pipe_shell"],"command_redacted":"curl -s --connect-timeout 10 \"https://api.github.com/repos/jellyfin/jellyfin-and[...redacted 284 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"f6b859aa-370b-4f62-b2fa-2b488abdc0c3","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell"]}
{"timestamp":"2026-05-08T12:37:32.409974374+00:00","session_id":"a18e933c-ead5-44e0-90a6-3f01292bb22f","action":"Block","rule_ids":["curl_pipe_shell"],"command_redacted":"curl -sL https://api.github.com/repos/roboflow/supervision | python3 -c \"\nimport[...redacted 265 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"7c94f695-d368-44dc-88cf-21301ae6b08b","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell"]}
{"timestamp":"2026-05-08T12:40:44.403623268+00:00","session_id":"a18e933c-ead5-44e0-90a6-3f01292bb22f","action":"Allow","rule_ids":[],"command_redacted":"curl -sL https://raw.githubusercontent.com/roboflow/supervision/main/README.md |[...redacted 10 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"c4144965-92f5-4230-b2d3-e6442de29676","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T04:56:40.479531288+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"curl -sL https://raw.githubusercontent.com/heygen-com/hyperframes/main/README.md[...redacted 12 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a74fbf73-2891-4acb-9b78-7b3e83c903d4","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T04:59:03.807489307+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"node --version && npx --version && ffmpeg -version 2>/dev/null | head -1 || echo[...redacted 23 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"0ea13905-3778-4cd9-b076-c7da0d49bb87","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:04:11.903581263+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao && npx hyperframes init my-video 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"fc5a048e-4a98-4502-b4be-d3ee195207d2","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:05:28.351018153+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao && npx hyperframes init my-video 2>&1; echo \"EXIT: $?\"","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a086cb12-8fb8-4895-907d-06c51c1c9299","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:05:38.953738140+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao && npx --yes hyperframes@latest init my-video 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"c857ba47-2579-48b7-9288-da34158a10d4","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:05:51.968397657+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"npm install -g hyperframes 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"dcaeb7ed-9f0f-42c5-a85a-e0c934ad4d31","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:06:01.685343872+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"npm config get proxy && npm config get https-proxy","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d36e4e10-c092-4eb2-abb2-165a42741d32","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:06:05.284882989+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"npm config set proxy http://127.0.0.1:7890 && npm config set https-proxy http://[...redacted 49 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"0fa21871-b41e-4b35-a0f5-3cf5d015184d","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:06:15.745444609+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"export HTTP_PROXY=http://127.0.0.1:7890 && export HTTPS_PROXY=http://127.0.0.1:7[...redacted 38 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"eb5c4f81-0489-4b25-a0af-1020f617173a","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:06:27.676014988+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"export HTTP_PROXY=http://127.0.0.1:7890 && export HTTPS_PROXY=http://127.0.0.1:7[...redacted 55 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"2ef16dad-e085-4a44-8ec6-c79072a774bc","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:06:39.228679198+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"hyperframes --version 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"373a0614-b269-4ffc-a1bd-6af39f90dfce","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:06:44.174258830+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao && hyperframes init my-video 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"75da1e55-0114-4421-a7ae-80866d183fbb","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:06:58.820615873+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/my-video && cat package.json 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"3a1a80d2-b9d4-46e4-82f1-266a7a79410e","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:07:03.678633525+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/my-video && cat index.html 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a8d90238-fb05-4773-9ac1-d53c1b0f81ac","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:07:24.232787022+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/my-video && npm run dev","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"5084cd41-eb29-4938-9c6b-56c2b78dd921","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:07:46.243580528+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"ss -tlnp | grep -E 'node|hyper' 2>/dev/null; lsof -i -P -n 2>/dev/null | grep -E[...redacted 25 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"59723e4f-1088-48f9-adc5-2a66115b026a","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:08:59.413188334+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/my-video && timeout 20 hyperframes preview 2>&1 || true","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"dc1b7b3a-722e-404f-8876-2efee0d6e49a","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:09:25.707553086+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/my-video && hyperframes preview","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a37626d5-0a1e-482b-9b9c-ea40b1059c19","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:09:31.003546552+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/my-video && timeout 120 hyperframes render 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"6a0d0f39-8f44-4264-8602-49f8957696b1","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:09:34.960703300+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"which google-chrome chromium-browser chromium 2>/dev/null; dpkg -l | grep -i chr[...redacted 24 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"331e7810-5ca6-45cc-95cd-689f9df58054","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:09:37.602054787+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"hyperframes browser ensure 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"0f858ccf-5906-461a-941c-29ed75eb5ba9","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:09:41.154496032+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"npm config delete proxy && npm config delete https-proxy && unset HTTP_PROXY && [...redacted 52 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"5d8b7cf7-6220-49a7-a415-09ce842068a7","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:09:58.681076525+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"ls -la /home/longshao/.cache/hyperframes/chrome/ 2>/dev/null; find /home/longsha[...redacted 52 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"90d3a332-49e4-4c4a-b64e-ceb705108cfe","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:10:02.260157090+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"find /home/longshao/.cache/hyperframes/ -type f -o -type d 2>/dev/null","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"1b4e33a7-acad-442a-a175-ce499865351f","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:10:06.705457405+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"# Download chrome headless shell manually\nmkdir -p /home/longshao/.cache/hyperfr[...redacted 292 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"6e9b3e52-35fe-47c0-808c-cd922f5b3753","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:10:24.177410281+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/.cache/hyperframes/chrome/chrome-headless-shell\nls -la chrome-[...redacted 104 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a1bda9af-ea13-4843-93e6-b8a68efa979a","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:10:27.303628677+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/.cache/hyperframes/chrome/chrome-headless-shell\npython3 -c \"im[...redacted 150 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"32649665-9b2a-49de-af61-809ec82e0ff7","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:12:18.980860751+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"# Make the chrome-headless-shell executable\nchmod +x /home/longshao/.cache/hyper[...redacted 159 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"fed8b80d-4a89-41b6-8973-989c34bbd994","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:12:25.904395530+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"# Move chrome to the expected path\ncd /home/longshao/.cache/hyperframes/chrome/c[...redacted 338 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d01096fe-6b9a-4927-b1c7-87e89ef43c96","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:12:28.100774117+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/my-video && hyperframes render 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"03246352-5d03-4325-be84-f6b6c8bd7dcb","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-09T05:14:06.085638458+00:00","session_id":"6cf032c0-2edc-45bb-a68b-f58a11eff26f","action":"Allow","rule_ids":[],"command_redacted":"ls -la /home/longshao/my-video/renders/","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"ca33e480-570f-4a1d-b2a4-a7124369c53e","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-10T13:45:41.142075705+00:00","session_id":"3c6c23c5-30e4-4ef1-9148-d1bab154b2cc","action":"Allow","rule_ids":[],"command_redacted":"cat ~/.hermes/config.yaml | grep -A 20 \"mcp_servers\" || echo \"未找到mcp_serve[...redacted 9 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"e6671131-f2af-49ef-9bdb-ded6e7bd7a11","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-10T13:47:57.279588261+00:00","session_id":"3c6c23c5-30e4-4ef1-9148-d1bab154b2cc","action":"Allow","rule_ids":[],"command_redacted":"which hf || echo \"hf CLI 未安装\"","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"811c71ff-fbbf-4699-bb69-bd2de031ea86","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-10T13:48:00.619160188+00:00","session_id":"3c6c23c5-30e4-4ef1-9148-d1bab154b2cc","action":"Allow","rule_ids":[],"command_redacted":"hf models list --format json --limit 50 2>/dev/null | head -100","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"53c6e671-4223-4f6e-9619-2b7164c900b5","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-10T13:49:05.545460954+00:00","session_id":"3c6c23c5-30e4-4ef1-9148-d1bab154b2cc","action":"Allow","rule_ids":[],"command_redacted":"python3 << 'EOF'\nfrom huggingface_hub import HfApi\nimport json\n\napi = HfApi()\n\n#[...redacted 654 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"e1a7c7c2-4a1b-4ae5-a7af-14f91fcee180","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-10T13:49:24.758415672+00:00","session_id":"3c6c23c5-30e4-4ef1-9148-d1bab154b2cc","action":"Allow","rule_ids":[],"command_redacted":"python3 << 'EOF'\nfrom huggingface_hub import HfApi\nimport json\n\napi = HfApi()\n\n#[...redacted 654 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"30771da1-9896-4a9e-b7b9-fa708a9b2e38","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-10T13:49:51.209324435+00:00","session_id":"3c6c23c5-30e4-4ef1-9148-d1bab154b2cc","action":"Allow","rule_ids":[],"command_redacted":"python3 -c \"from huggingface_hub import HfApi; help(HfApi.list_models)\" 2>&1 | h[...redacted 7 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"af6e4c22-405a-4cc4-9e86-ba827184a045","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-10T13:50:18.476644098+00:00","session_id":"3c6c23c5-30e4-4ef1-9148-d1bab154b2cc","action":"Allow","rule_ids":[],"command_redacted":"python3 << 'EOF'\nfrom huggingface_hub import HfApi\nimport json\n\napi = HfApi()\n\n#[...redacted 735 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"5ce8a0a7-b331-4781-959f-9c3a2c76cb2f","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-10T13:51:34.459388202+00:00","session_id":"3c6c23c5-30e4-4ef1-9148-d1bab154b2cc","action":"Allow","rule_ids":[],"command_redacted":"python3 << 'EOF'\nfrom huggingface_hub import HfApi\nimport json\n\napi = HfApi()\n\n#[...redacted 501 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"6bdf1d23-2db8-4942-9651-73590fbbc603","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-10T13:53:20.211847068+00:00","session_id":"3c6c23c5-30e4-4ef1-9148-d1bab154b2cc","action":"Allow","rule_ids":[],"command_redacted":"curl -x http://127.0.0.1:7890 -s --connect-timeout 10 \"https://huggingface.co/ap[...redacted 45 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"90cef33e-ece8-4535-9757-9464a41e1e39","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-10T13:53:23.704752083+00:00","session_id":"3c6c23c5-30e4-4ef1-9148-d1bab154b2cc","action":"Allow","rule_ids":[],"command_redacted":"curl -s --connect-timeout 10 \"https://huggingface.co/api/models?sort=downloads&l[...redacted 25 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"56b2b495-74b1-45d8-88ad-fc8904afa4d5","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-10T13:53:39.154397055+00:00","session_id":"3c6c23c5-30e4-4ef1-9148-d1bab154b2cc","action":"Allow","rule_ids":[],"command_redacted":"export https_proxy=http://127.0.0.1:7890 http_proxy=http://127.0.0.1:7890 && pyt[...redacted 578 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"18819502-042f-4ea5-8a69-25b20c0424b3","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-10T13:54:17.130559187+00:00","session_id":"3c6c23c5-30e4-4ef1-9148-d1bab154b2cc","action":"Allow","rule_ids":[],"command_redacted":"curl -s --connect-timeout 5 \"https://huggingface.co\" > /dev/null && echo \"直连[...redacted 30 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"951a6004-36a3-4dce-91e9-147a27b9938e","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-10T14:19:53.915100142+00:00","session_id":"3c6c23c5-30e4-4ef1-9148-d1bab154b2cc","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao && python3 -m http.server 8080","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"ba88aaf1-df19-4014-9e8a-73f6dac96f78","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-10T14:19:56.602246970+00:00","session_id":"3c6c23c5-30e4-4ef1-9148-d1bab154b2cc","action":"Allow","rule_ids":[],"command_redacted":"curl -s -o /dev/null -w \"%{http_code}\" http://localhost:8080/huggingface-models.[...redacted 4 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"3b507ab9-52e7-4b1d-97fe-8730737744ac","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-16T23:47:38.099858412+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"gh search repos 9router --limit 10 --json name,fullName,description,url,stargaze[...redacted 17 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"e62867fe-68ad-42c1-82a2-2adc0b12b2f3","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-16T23:47:43.299331975+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Block","rule_ids":["curl_pipe_shell"],"command_redacted":"curl -s \"https://api.github.com/search/repositories?q=9router&sort=stars&order=d[...redacted 555 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"2d101100-3405-435c-b90e-e730fa768039","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell"]}
{"timestamp":"2026-05-16T23:47:59.033990640+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Block","rule_ids":["curl_pipe_shell"],"command_redacted":"curl -s \"https://api.github.com/repos/decolua/9router\" | python3 -c \"\nimport jso[...redacted 703 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"4918ecc0-1977-4b70-b90e-8c653a2e2175","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell"]}
{"timestamp":"2026-05-16T23:48:12.248878514+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"curl -s \"https://raw.githubusercontent.com/decolua/9router/master/README.md\" | h[...redacted 8 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"140de0b6-fc63-4de4-974d-d14248d3d7af","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-16T23:49:03.475362467+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"node --version && npm --version","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"fba69a04-e4fd-4899-abec-d48e8114b40b","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-16T23:49:07.304410759+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"npm install -g 9router","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"5e5f650a-65d1-422b-b96d-7ab22777f6e7","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-16T23:49:54.106895902+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"9router --port 20128","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"473d76cc-4a20-4ccb-87dc-4f71c711d457","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-16T23:49:57.331173214+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"sleep 3 && curl -s -o /dev/null -w \"%{http_code}\" http://localhost:20128","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"422df4f4-5205-42a9-94b5-af2a2b5ff621","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-16T23:50:04.944598643+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"9router --help","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"74dfa7c3-a729-47f8-a36e-0959d7115da3","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-16T23:50:12.354237246+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"which 9router && 9router --version 2>&1 || echo \"无法获取版本\"","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"15e45cc3-a3a4-4ae2-801e-4b5850b511cf","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-16T23:50:27.149795881+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"npx 9router --help 2>&1 | head -30","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"5a9cce29-6882-40ff-a738-31f23e615e84","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-16T23:50:45.707512149+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao && 9router --port 20128 --no-browser --log","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"6fb98fb8-4833-45c9-9fe2-7f4b37e15778","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-16T23:50:49.010792154+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"sleep 5 && curl -s -o /dev/null -w \"%{http_code}\" http://localhost:20128","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"0fae0858-c759-461f-8934-f5ee73424306","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-16T23:50:58.759811527+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"netstat -tlnp 2>/dev/null | grep 20128 || ss -tlnp | grep 20128 || echo \"端口2[...redacted 17 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"5b344bf4-6022-4cff-82a7-6d9c632370e9","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-16T23:51:04.604642922+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao && timeout 10 9router --port 20128 --no-browser --log 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"1a50b9b9-a6a2-4761-b39a-faa4ed6301fe","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-16T23:51:17.480133828+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"npm list -g 9router 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"c35720a9-06ec-4d52-a19c-a799f5ba580a","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-16T23:51:20.222545277+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"ls -la /home/longshao/.hermes/node/lib/node_modules/9router/ | head -20","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"b4559fca-77dc-4032-8bbd-54edcde334ad","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-16T23:51:39.963516497+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"ls -la /home/longshao/.hermes/node/lib/node_modules/9router/app/ | head -20","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"15d0a6af-2ad0-48ad-9536-eb42e83611d7","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-16T23:51:43.518593651+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/.hermes/node/lib/node_modules/9router/app && PORT=20128 HOSTNA[...redacted 41 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"51619d29-85f9-4ae6-9e4f-5b7d59aff3bf","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-16T23:51:56.420011667+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/.hermes/node/lib/node_modules/9router/app && PORT=20128 HOSTNA[...redacted 25 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"ccde7156-b1bb-498c-bf46-4f21e546eac0","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-16T23:51:59.256869200+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"sleep 3 && curl -s -o /dev/null -w \"%{http_code}\" http://localhost:20128","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"16708568-ea74-4c94-a0cd-cd04132d0d12","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-16T23:52:04.651272207+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"curl -s http://localhost:20128/dashboard | head -50","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a1fbb6a3-3c33-4127-ac88-665dc76e5158","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-16T23:52:10.399044750+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"curl -s http://localhost:20128/login | head -100","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"f6470750-81ce-4db5-937a-3bcd61c788fc","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:27:39.306767441+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"curl -x http://127.0.0.1:7890 -s --connect-timeout 10 \"https://httpbin.org/ip\" 2[...redacted 3 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"67a5a71d-af0a-4e73-bf7c-7ab05cdc88c6","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:27:41.769911864+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"ps aux | grep -E \"mihomo|clash\" | grep -v grep","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"11636104-95d8-44f8-a91a-5c423f2a68b7","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:27:44.897843885+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"which mihomo || which clash || echo \"未找到mihomo/clash\"","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"2606d60d-7ff5-45b2-afb7-4e99545e1df9","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:27:47.819290250+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"ls -la ~/.config/mihomo/ 2>/dev/null || ls -la ~/.config/clash/ 2>/dev/null || e[...redacted 27 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"84f4f996-7fd4-4864-99b0-ad769e72a326","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:27:50.458330997+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"grep -i \"taiwan\\|tw\\|台灣\\|台灣\" ~/.config/mihomo/config.yaml | head -20","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"31be5a21-1f7c-46b7-83d8-297a510c91f6","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:27:53.907846293+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"grep -E \"^  - name:|proxies:\" ~/.config/mihomo/config.yaml | head -50","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"6391d380-3b74-4f1c-8168-efb5c89789cb","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:28:00.101665747+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"cd ~/.config/mihomo && mihomo -d . &","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"b756780a-51ad-4c60-a3cc-54b62bbb6555","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:28:02.694295739+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"sleep 3 && curl -x http://127.0.0.1:7890 -s --connect-timeout 15 \"https://httpbi[...redacted 14 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"da28b7c5-e2ae-4eee-aa07-0a3e96907955","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:28:16.360009312+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"netstat -tlnp 2>/dev/null | grep -E \"7890|7891|7892|9090\" || ss -tlnp | grep -E [...redacted 21 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a4e44cc4-62a5-45b0-b222-c3df389b7d3f","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:28:19.989044060+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"curl -x http://127.0.0.1:7890 -s --connect-timeout 20 \"https://api.github.com\" 2[...redacted 14 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"cde75fe3-1167-4159-acb6-0e59490c3175","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:28:29.371707474+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Block","rule_ids":["curl_pipe_shell"],"command_redacted":"curl -s http://127.0.0.1:9090/proxies | python3 -c \"import json,sys; data=json.l[...redacted 106 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"ac18231d-1cc6-4f45-bad0-7e98acf00618","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell"]}
{"timestamp":"2026-05-17T00:30:26.755187325+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"curl -s -X PUT http://127.0.0.1:9090/proxies/Proxy -H \"Content-Type: application[...redacted 105 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"f843a48b-77a0-4568-b102-c0a459788184","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:30:30.086187840+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"curl -x http://127.0.0.1:7890 -s --connect-timeout 20 \"https://httpbin.org/ip\" 2[...redacted 3 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"48bc190f-e38a-4072-9c97-924f08cab305","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:30:39.862493495+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Block","rule_ids":["non_ascii_path","pipe_to_interpreter"],"command_redacted":"curl -s http://127.0.0.1:9090/proxies/cf加速|台湾动态家宽🇹🇼 | pyth[...redacted 106 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"04f58804-828b-4bef-ba18-bfeb0f934d09","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["non_ascii_path","pipe_to_interpreter"]}
{"timestamp":"2026-05-17T00:30:52.954583626+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Block","rule_ids":["curl_pipe_shell"],"command_redacted":"curl -s \"http://127.0.0.1:9090/proxies/cf%E5%8A%A0%E9%80%9F%7C%E5%8F%B0%E6%B9%BE[...redacted 174 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d877aa98-e7be-4ec4-affb-b8bd7aacee64","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell"]}
{"timestamp":"2026-05-17T00:33:48.664942502+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Block","rule_ids":["curl_pipe_shell"],"command_redacted":"curl -s \"http://127.0.0.1:9090/proxies/cf%E5%8A%A0%E9%80%9F%7C%E5%8F%B0%E6%B9%BE[...redacted 138 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"61d277d8-115d-420b-857c-fa646367722b","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell"]}
{"timestamp":"2026-05-17T00:36:47.444745213+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Block","rule_ids":["curl_pipe_shell"],"command_redacted":"curl -s http://127.0.0.1:9090/proxies/AUTO | python3 -c \"import json,sys; data=j[...redacted 75 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"bfc16827-061e-4dbc-8826-8459776350a3","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell"]}
{"timestamp":"2026-05-17T00:40:14.353615741+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"curl -s -X PUT http://127.0.0.1:9090/proxies/AUTO -H \"Content-Type: application/[...redacted 110 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"10b5d7b3-d05e-4a23-bf30-a7fdd90fd5dc","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:40:23.326501778+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"sleep 2 && curl -x http://127.0.0.1:7890 -s --connect-timeout 20 \"https://httpbi[...redacted 14 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"3fe106b7-3a22-4113-b7bb-879440e22512","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:40:33.382567034+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Block","rule_ids":["curl_pipe_shell"],"command_redacted":"curl -s \"http://127.0.0.1:9090/proxies/%E5%8F%B0%E6%B9%BEhinet%E5%8A%A8%E6%80%81[...redacted 161 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"2ac6298b-c621-4c45-8329-bdc2a33ab733","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell"]}
{"timestamp":"2026-05-17T00:40:48.546949677+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"curl -s -X PUT http://127.0.0.1:9090/proxies/AUTO -H \"Content-Type: application/[...redacted 104 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"28fa4240-6caf-43ae-858d-6fdee9f85dc5","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:40:54.773640692+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"sleep 2 && curl -x http://127.0.0.1:7890 -s --connect-timeout 20 \"https://httpbi[...redacted 14 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"79c0d7e6-689c-4575-942f-e315148780ee","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:41:05.293410294+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"tail -50 ~/.config/mihomo/mihomo.log 2>/dev/null | grep -i \"error\\|fail\\|timeout[...redacted 12 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"c7c9c7bf-8f36-407c-8e46-a7765875fca7","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:41:09.927647977+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"curl -v -x http://127.0.0.1:7890 --connect-timeout 10 \"https://www.google.com\" 2[...redacted 14 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"52e881ce-d5dd-476c-813b-8a7fa40a70bf","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:41:18.064554166+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Block","rule_ids":["plain_http_to_sink"],"command_redacted":"curl -x http://127.0.0.1:7890 -s --connect-timeout 10 \"http://httpbin.org/ip\" 2>[...redacted 2 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"ab03f928-d0f2-45e0-8caf-10baa02748df","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["plain_http_to_sink"]}
{"timestamp":"2026-05-17T00:43:04.538463518+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/.hermes/node/lib/node_modules/9router/app && PORT=20128 HOSTNA[...redacted 126 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"850f4376-3435-4a04-b89d-d064ee509361","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:43:09.150485267+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"sleep 3 && curl -s -o /dev/null -w \"%{http_code}\" http://localhost:20128","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"36a3c0f6-291a-49b5-823a-e3492e318003","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:43:18.584676530+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"ls -la ~/.9router/ 2>/dev/null || echo \"9router配置目录不存在\"","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a8143c3a-b356-44d5-822c-b9a0807afb61","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:43:21.082077507+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"find ~/.9router -name \"*.json\" -o -name \"*.yaml\" -o -name \"*.yml\" -o -name \"*.co[...redacted 26 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"95d433d1-c054-414c-9023-be32cd9101a9","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:43:23.417915261+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"ls -la ~/.9router/db/","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"929ad8c8-47c1-4649-9e6b-767d6b89c452","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:43:28.316400070+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"curl -s http://localhost:20128/api/settings 2>&1 | head -50","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"957016e4-a174-4e20-8fe9-4cafa7d49f78","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:43:34.549661275+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"cat ~/.9router/jwt-secret","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"c5adcc37-fe79-4ad7-968a-3d1f9e9e1614","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:43:42.569225624+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"curl -s http://localhost:20128/api/auth/status 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"0797adcf-92fb-4722-9297-072fc3c11cb5","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:43:46.116637583+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"curl -s -X POST http://localhost:20128/api/auth/login -H \"Content-Type: applicat[...redacted 40 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"cbf1ba76-584e-45bf-bfbd-65858a3af3e0","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:43:48.934700959+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"curl -s -X POST http://localhost:20128/api/auth/login -H \"Content-Type: applicat[...redacted 41 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"78eafd03-31ed-4661-9f1f-fca2ad30e99b","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:43:53.200547115+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"sqlite3 ~/.9router/db/data.sqlite \".tables\" 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"8ec4e6f7-3f68-4a73-b4bf-f6216f3a7784","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:43:59.358126870+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"python3 << 'EOF'\nimport sqlite3\nimport json\n\ndb_path = \"/home/longshao/.9router/[...redacted 547 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"8ea98369-982d-4b2a-be76-0d97b0f60aa9","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:44:48.834577319+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"python3 << 'EOF'\nimport sqlite3\nimport json\n\ndb_path = \"/home/longshao/.9router/[...redacted 635 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"c932cb2b-ef5c-4b95-839e-51fed63bbd22","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:45:01.855027279+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"python3 << 'EOF'\nimport sqlite3\nimport json\n\ndb_path = \"/home/longshao/.9router/[...redacted 273 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"b7c4f684-3544-48bf-a013-c489783092b9","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:45:15.897358718+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"python3 << 'EOF'\nimport sqlite3\nimport bcrypt\nimport json\n\ndb_path = \"/home/long[...redacted 474 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"3aceed7e-fdd2-4b4c-8130-e1612e71af2a","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:45:27.722795057+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"pip install bcrypt -q && python3 << 'EOF'\nimport sqlite3\nimport bcrypt\nimport js[...redacted 499 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"16108557-3adb-4021-bb17-51baadc8f2d7","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:45:39.451459607+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"pip3 install bcrypt -q && python3 << 'EOF'\nimport sqlite3\nimport bcrypt\nimport j[...redacted 500 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"93d62199-3bf8-4bde-aae1-37321a2f51bb","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:45:54.535841296+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"uv pip install bcrypt && python3 << 'EOF'\nimport sqlite3\nimport bcrypt\nimport js[...redacted 499 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"97ada846-cb86-4c06-ac06-9ea3adc53f27","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:46:06.102605282+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/.hermes/node/lib/node_modules/9router/app && PORT=20128 HOSTNA[...redacted 126 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"7d29c3cd-6e5c-49a5-b204-fd13a5862bfd","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:46:08.537772801+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"sleep 3 && curl -s -X POST http://localhost:20128/api/auth/login -H \"Content-Typ[...redacted 54 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a24debcc-3433-4ed4-9210-cf2ceda9b6bb","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:46:17.084980906+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Block","rule_ids":["curl_pipe_shell"],"command_redacted":"curl -s -X POST http://localhost:20128/api/auth/login -H \"Content-Type: applicat[...redacted 233 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"3039e4ca-e1d4-45a6-9bcb-22bb7f0de4fd","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell"]}
{"timestamp":"2026-05-17T00:46:31.281523610+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"curl -s -X POST http://localhost:20128/api/auth/login -H \"Content-Type: applicat[...redacted 241 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"14ef5c06-d3be-4d6c-82cc-9429d4f6b44f","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:46:37.675810057+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Block","rule_ids":["curl_pipe_shell"],"command_redacted":"curl -s -b cookies.txt http://localhost:20128/api/settings 2>&1 | python3 -c \"im[...redacted 165 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"2e681465-76f3-485d-a6b2-880b9e150910","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell"]}
{"timestamp":"2026-05-17T00:46:49.284542914+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"curl -s -X POST http://localhost:20128/api/auth/login -H \"Content-Type: applicat[...redacted 243 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"10ffce2f-73a9-4b39-ace9-218776abd526","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-17T00:46:54.299838721+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Block","rule_ids":["curl_pipe_shell"],"command_redacted":"curl -s -b cookies.txt http://localhost:20128/api/settings 2>&1 | python3 -c \"im[...redacted 181 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"ebc82871-10a6-46a2-81ca-57d3714090a3","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell"]}
{"timestamp":"2026-05-17T00:47:05.813179081+00:00","session_id":"58009176-9736-4c87-9776-84a0447b2e9d","action":"Allow","rule_ids":[],"command_redacted":"rm -f cookies.txt","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"ce1d92cc-8cbd-43d5-a999-71afe23fcdc8","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T04:40:45.523910973+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"cd ~ && find . -name \".git\" -type d 2>/dev/null | head -10","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"953de352-b45a-4192-a750-2afa21c0d6e2","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T04:40:53.377215281+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"gh repo list mifengac --limit 50 2>&1 | grep -i \"multi-rider\\|rider\" || echo \"[...redacted 27 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a1052a6c-a7d3-4716-83ec-f5ebdbfb0267","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T04:41:00.080605168+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Block","rule_ids":["curl_pipe_shell"],"command_redacted":"curl -s \"https://api.github.com/users/mifengac/repos?per_page=100\" | python3 -c [...redacted 530 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"f61e2f98-641c-4b6f-8250-0adb711856ee","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell"]}
{"timestamp":"2026-05-21T04:46:07.956159823+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Block","rule_ids":["curl_pipe_shell"],"command_redacted":"curl -x http://127.0.0.1:7890 -s --connect-timeout 20 \"https://api.github.com/us[...redacted 576 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"f27b5c17-fc24-4a74-bb7f-9b75ec2334e2","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell"]}
{"timestamp":"2026-05-21T04:47:13.395384666+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"cat ~/.git-credentials 2>/dev/null | head -1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"1c34c23f-5c9b-4765-ba5e-165832a3a691","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T04:47:18.620435249+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Block","rule_ids":["curl_pipe_shell","credential_in_text"],"command_redacted":"curl -s -H \"Authorization: token [REDACTED:GitHub PAT]\" \"https://api.github.com/[...redacted 366 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"66a7de1d-1749-419a-89fb-2e585b12b654","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell","credential_in_text"]}
{"timestamp":"2026-05-21T04:47:27.272646073+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Block","rule_ids":["curl_pipe_shell","credential_in_text"],"command_redacted":"curl -s -H \"Authorization: token [REDACTED:GitHub PAT]\" \"https://api.github.com/[...redacted 364 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"bbea6c38-5ff6-429b-adf3-e3f158518f21","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell","credential_in_text"]}
{"timestamp":"2026-05-21T04:47:41.405421064+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Block","rule_ids":["curl_pipe_shell","credential_in_text"],"command_redacted":"curl -s -H \"Authorization: token [REDACTED:GitHub PAT]\" \"https://api.github.com/[...redacted 610 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"e1894152-304e-470d-b6bb-6120124457ee","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell","credential_in_text"]}
{"timestamp":"2026-05-21T04:47:54.955440913+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Block","rule_ids":["curl_pipe_shell","credential_in_text"],"command_redacted":"curl -s -H \"Authorization: token [REDACTED:GitHub PAT]\" \"https://api.github.com/[...redacted 405 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"40475490-1260-4ed5-ba04-00b08bbcb7c2","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell","credential_in_text"]}
{"timestamp":"2026-05-21T04:48:12.254525869+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Block","rule_ids":["curl_pipe_shell","credential_in_text"],"command_redacted":"curl -s -H \"Authorization: token [REDACTED:GitHub PAT]\" \"https://api.github.com/[...redacted 787 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"86853b2d-3458-4b2d-8be7-787934020e76","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell","credential_in_text"]}
{"timestamp":"2026-05-21T04:49:29.918337367+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Block","rule_ids":["credential_in_text"],"command_redacted":"cd /home/longshao && git clone -b feature/ai-analyst-rag https://mifengac:[REDAC[...redacted 67 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"74fa5f5e-f870-47b9-9191-a7f799a2270b","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["credential_in_text"]}
{"timestamp":"2026-05-21T04:50:50.282399390+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Block","rule_ids":["credential_in_text"],"command_redacted":"cd /home/longshao && rm -rf multi-rider-rag 2>/dev/null; git -c http.proxy=http:[...redacted 176 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"600e1f4b-cb78-4d58-9c15-afb01a2e412c","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["credential_in_text"]}
{"timestamp":"2026-05-21T04:53:04.319725187+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Block","rule_ids":["credential_in_text"],"command_redacted":"cd /home/longshao && rm -rf multi-rider-rag 2>/dev/null; git -c http.proxy=socks[...redacted 180 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"5916f73a-ae86-4701-8a3d-780cfe8c8a09","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["credential_in_text"]}
{"timestamp":"2026-05-21T04:53:13.220888680+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao && rm -rf multi-rider-rag 2>/dev/null; curl -L -x http://127.0[...redacted 135 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"952930b6-f351-46dc-a93e-2b8106a930f1","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T04:53:20.084489490+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Block","rule_ids":["curl_pipe_shell"],"command_redacted":"curl -s http://127.0.0.1:9090/proxies/AUTO | python3 -c \"import json,sys; data=j[...redacted 61 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"015b19fd-0ee6-47ad-8059-7abe62ce3e20","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell"]}
{"timestamp":"2026-05-21T04:53:23.237354050+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"curl -s -X PUT http://127.0.0.1:9090/proxies/AUTO -H \"Content-Type: application/[...redacted 110 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"e07e48ca-8e4e-4153-b962-4cebc952a7ad","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T04:53:27.149060367+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao && rm -f multi-rider-rag.zip 2>/dev/null; curl -L -x http://12[...redacted 139 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"628f435d-bfdb-4703-9bc8-d22941aa0357","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T04:53:35.197840844+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao && rm -f multi-rider-rag.zip 2>/dev/null; wget -O multi-rider-[...redacted 111 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"f1976bdf-7b33-4dc2-bcef-12757ffe6045","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T04:55:09.279530213+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Block","rule_ids":["credential_in_text"],"command_redacted":"curl -s -H \"Authorization: token [REDACTED:GitHub PAT]\" \"https://api.github.com/[...redacted 109 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"b239ef52-cf57-4e18-a284-9d074564bd41","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["credential_in_text"]}
{"timestamp":"2026-05-21T04:55:13.432806864+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"ls -lh /tmp/multi-rider-rag.zip 2>/dev/null && file /tmp/multi-rider-rag.zip","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"27bed840-e82b-4dbe-bdc2-ab5d9ca7acdd","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T04:55:17.826097916+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Block","rule_ids":["credential_in_text"],"command_redacted":"curl -L -s -H \"Authorization: token [REDACTED:GitHub PAT]\" \"https://api.github.c[...redacted 112 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"8f8621e9-481b-4d59-9c28-c6387900df26","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["credential_in_text"]}
{"timestamp":"2026-05-21T04:55:30.104300791+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"ls -lh /tmp/multi-rider-rag.zip && file /tmp/multi-rider-rag.zip","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"67989a16-9086-42ed-9623-996a4f2d689b","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T04:55:33.145028137+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao && rm -rf multi-rider-rag 2>/dev/null; unzip -q /tmp/multi-rid[...redacted 73 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"e5fadac9-758f-4330-a659-8f2396ea198e","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T04:55:37.112546810+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao && rm -rf multi-rider-rag 2>/dev/null; python3 << 'EOF'\nimport[...redacted 527 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"85c8c914-8b35-4b9d-8fff-fae86a6a3af4","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T04:55:44.652579379+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao && rm -rf multi-rider-rag /tmp/multi-rider-extract 2>/dev/null[...redacted 394 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d4b0fa7d-8be5-4227-9908-d94cad20b915","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T04:56:23.714561019+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/multi-rider-rag && python3 -m venv .venv && source .venv/bin/a[...redacted 27 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"1fcc6cf9-375b-44fa-ab5b-5894f3699635","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T04:56:36.653969108+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"ls -la /home/longshao/multi-rider-rag/wheels/ 2>/dev/null | head -20","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d2d79449-020d-4c44-84b0-608a2c96fe8c","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T04:56:44.694768438+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/multi-rider-rag && source .venv/bin/activate && pip install Fl[...redacted 84 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"430dcd73-dba8-4982-8c30-231ce0173b11","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T04:57:11.042702392+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/multi-rider-rag && source .venv/bin/activate && pip install ul[...redacted 100 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"249e3fd3-d60f-4e62-9825-fbfd3b0dee8c","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T05:00:17.186107951+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/multi-rider-rag && source .venv/bin/activate && pip install -i[...redacted 144 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"e9260156-ff38-4349-8fcb-adc6bf66ba8e","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T05:03:05.791578480+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/multi-rider-rag && source .venv/bin/activate && pip install -i[...redacted 94 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"3fde8ec7-89b1-40cb-ba81-558c224d3f38","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T05:05:51.818952746+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"mkdir -p /home/longshao/multi-rider-rag/model/yolo/production /home/longshao/mul[...redacted 330 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"05cb730f-0f9b-4aa8-8cff-50c9102c2b2a","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T05:06:10.776196808+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/multi-rider-rag && source .venv/bin/activate && python app.py [...redacted 4 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"8e8ec125-d87c-4634-acaf-0f03810ae5b5","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T05:06:13.030885427+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"sleep 5 && curl -s http://localhost:5001/healthz 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d41ebfa6-095e-4908-93da-8175320c2de5","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T05:06:27.502601610+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"curl -s http://localhost:5001/ | head -20","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"34ce8afa-803d-40a0-82d4-12c483a32e3c","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T05:12:14.828622020+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/multi-rider-rag && source .venv/bin/activate && python scripts[...redacted 23 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"76c7ca45-ecf6-4aaf-81b3-4d8bb81c9e8c","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T05:12:21.056439652+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"docker ps | grep kingbase","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"3c4af278-d208-4501-a66c-845306be523e","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T05:12:33.723311799+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"docker ps -a | grep -i king","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d9b1fa0d-12d9-43ed-82a5-bd43283c98ba","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T05:12:47.931268343+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"docker start kingbasev8 && sleep 5 && docker ps | grep kingbase","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"cdbda705-285c-40dd-98e8-918e4d93566b","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T05:12:58.726073396+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/multi-rider-rag && source .venv/bin/activate && python scripts[...redacted 23 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d46ecd79-1c6f-46ac-b69d-a7289645653c","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T05:13:01.456697269+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"sleep 15 && cd /home/longshao/multi-rider-rag && source .venv/bin/activate && py[...redacted 35 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"832f3e9c-8894-4c02-aa27-b9537270f10b","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T05:13:24.395413795+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/multi-rider-rag && source .venv/bin/activate && python3 << 'EO[...redacted 1031 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"3e5ebd72-fce8-4876-8ad0-63711e1b5920","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T05:14:04.729649602+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/multi-rider-rag && source .venv/bin/activate && python3 << 'EO[...redacted 1317 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"fe943528-40ba-4d50-9707-44dda488f0d0","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T05:14:10.548595416+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Block","rule_ids":["curl_pipe_shell"],"command_redacted":"curl -s http://localhost:5001/healthz 2>&1 | python3 -c \"import json,sys; data=j[...redacted 75 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"03a036a7-85d7-43bd-a26c-1de957a88f69","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell"]}
{"timestamp":"2026-05-21T05:15:59.552762070+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/multi-rider-rag && source .venv/bin/activate && python3 << 'EO[...redacted 926 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"031f9561-c7d6-44fd-988d-8150aeafbd37","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T05:16:17.343291890+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Block","rule_ids":["variation_selector","curl_pipe_shell"],"command_redacted":"curl -s http://localhost:5001/healthz 2>&1 | python3 -c \"import json,sys; data=j[...redacted 241 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"48ad2c4d-c442-40e6-861d-df94665e5c88","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["variation_selector","curl_pipe_shell"]}
{"timestamp":"2026-05-21T05:16:51.232277243+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"ls -lh /home/longshao/multi-rider-rag/model/yolo/production/","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"6b551388-6d08-4475-b196-cbee6e270e0a","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T05:17:31.296197515+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/multi-rider-rag && source .venv/bin/activate && python app.py [...redacted 4 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d3b25b9c-15d6-4f28-bad9-963855893d16","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T05:17:38.290544347+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"sleep 5 && curl -s http://localhost:5001/livez 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"9b75689a-f107-4cbf-bdf7-db4aca4906d6","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T05:18:44.077214334+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/multi-rider-rag && source .venv/bin/activate && python3 << 'EO[...redacted 585 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"da5dea1e-c99f-4002-86ea-0a4c3d9094cf","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T05:19:02.277245353+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/multi-rider-rag && source .venv/bin/activate && python3 << 'EO[...redacted 1036 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"cb73f3f5-51cb-4195-a250-162b489cbf85","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T05:19:10.108594063+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/multi-rider-rag && source .venv/bin/activate && python app.py [...redacted 4 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"f30bb9d8-89c2-4adc-8952-777dc8934684","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-21T05:19:13.551615787+00:00","session_id":"75a7101f-538c-4ba1-a705-d40b95209300","action":"Allow","rule_ids":[],"command_redacted":"sleep 5 && curl -s http://localhost:5001/api/dashboard/summary 2>&1 | head -50","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"57074278-79d9-4f5b-a22d-9ef04196d8c9","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:01:56.647643217+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/multi-rider-rag && git stash 2>&1 && git pull origin feature/a[...redacted 18 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"b906b588-0c3e-415f-878d-87ce3fdd470c","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:02:01.907936987+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"ls -la /home/longshao/multi-rider-rag/.git 2>&1 || echo \"NO .git directory\"","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"abfb8657-fb93-4e39-bbd6-a1e5f83badc9","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:02:06.473588872+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 先备份当前的配置文件\ncp /home/longshao/multi-rider-rag/app.env /tmp/[...redacted 107 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"0e44705c-70de-42f6-ad04-2921a7f4e6c1","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:02:12.898423938+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 备份当前配置和模型文件\ncp /home/longshao/multi-rider-rag/app.env /t[...redacted 431 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"88dd2404-5450-4958-929e-d3f632fbf462","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:02:19.277261713+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 恢复旧目录\nmv /home/longshao/multi-rider-rag.bak /home/longshao/multi-rid[...redacted 346 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"dea9cce2-2acc-4348-98cc-0d9e21abfada","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:02:24.862807379+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 尝试关闭SSL验证\nGIT_SSL_NO_VERIFY=1 git clone -b feature/ai-analyst-rag [...redacted 71 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a147adb9-6a7a-43bf-b03e-65bdc020ede6","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:02:30.407573283+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 清除代理环境变量，直连\nunset http_proxy https_proxy HTTP_PROXY HTTP[...redacted 218 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"45ead58c-0107-48e5-99c9-10680ca13b56","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:04:37.154688098+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 检查SSH key和git配置\nls ~/.ssh/id_* 2>/dev/null\ncat ~/.gitconfig 2>/dev/n[...redacted 77 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"8237c239-9d1f-466b-a528-809655acf1dd","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:04:43.331522626+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Block","rule_ids":["dotfile_overwrite"],"command_redacted":"# 清理残留\nrm -rf /tmp/multi-rider-clone 2>/dev/null\n# 用SSH克隆\nssh-keys[...redacted 162 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"1644e1fc-711c-4588-a83e-dc6209ab4941","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["dotfile_overwrite"]}
{"timestamp":"2026-05-22T10:08:46.294074161+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Block","rule_ids":["credential_in_text"],"command_redacted":"# 用token方式克隆，加上代理\nrm -rf /tmp/multi-rider-clone 2>/dev/null\n[...redacted 267 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"0dd876a9-06a6-4b63-8eed-4d59f78fa612","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["credential_in_text"]}
{"timestamp":"2026-05-22T10:08:53.248556270+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 下载zip包\nrm -rf /tmp/multi-rider-clone /tmp/multi-rider.zip 2>/dev/null\ncu[...redacted 122 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"efae9304-5e13-40d4-a275-5e1d48872292","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:08:57.566647172+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 不走代理直连下载\nunset http_proxy https_proxy HTTP_PROXY HTTPS_PROXY\nc[...redacted 144 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"db4fdf0d-ff58-4588-a118-15cd6f2bee32","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:10:35.215208402+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 检查代理状态和类型\ncurl -x http://127.0.0.1:7890 -I https://github.co[...redacted 38 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"f707e329-c52b-4c5e-9fdd-2f4c84df9df2","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:10:41.538489790+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 检查是否有socks5端口\ncurl -x socks5://127.0.0.1:7890 -I https://github.[...redacted 40 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"ae114f1c-3b89-43fa-8a65-20f5aadfb4d2","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:10:51.230548664+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 尝试设置git的SSL后端和代理\ngit config --global http.proxy http://127[...redacted 338 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"574c6920-d1ac-4491-a29d-4cc41d3b5bc3","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:10:57.918797668+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Block","rule_ids":["credential_in_text"],"command_redacted":"# 用GitHub API下载tarball（用token认证）\nexport http_proxy=http://127.0.[...redacted 285 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"09ddc60e-71ef-4211-ae4e-6e67ddd2ea74","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["credential_in_text"]}
{"timestamp":"2026-05-22T10:11:06.620104548+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Block","rule_ids":["plain_http_to_sink"],"command_redacted":"# 检查代理是否正常工作（用HTTP而非HTTPS）\ncurl -x http://127.0.0.[...redacted 187 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"7f412ff6-4a4a-4cb0-82aa-c00715897226","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["plain_http_to_sink"]}
{"timestamp":"2026-05-22T10:11:53.606890601+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 用Python requests测试代理\npython3 -c \"\nimport requests\nproxies = {'http':[...redacted 288 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"de1adc09-1429-4c45-8e38-575b99f664a1","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:12:02.545819992+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 检查mihomo/Clash的配置和端口\nps aux | grep -i mihomo\nps aux | grep -i [...redacted 63 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"52c96314-ad9a-44d8-a0b8-ce60b7af37fb","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:12:05.807358408+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 检查mihomo监听的端口\nss -tlnp | grep mihomo\n# 查看mihomo配置\ncat ~/[...redacted 37 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"c527cd6a-dd72-42a8-b46d-ae8d6dc83e4d","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:12:10.598032740+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 尝试用socks5代理（端口7891）\ncurl -x socks5h://127.0.0.1:7891 -I http[...redacted 51 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"afd2c6cb-4ee7-41e7-94d7-368ac7164369","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:12:14.528569636+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 尝试用HTTP代理（端口7892）\ncurl -x http://127.0.0.1:7892 -I https://g[...redacted 46 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"957a27aa-a1a6-4cd1-8776-dbe4f87e2cb1","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:12:21.318575252+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 测试其他HTTPS网站\ncurl -x http://127.0.0.1:7890 -I https://www.baidu.com[...redacted 134 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"20ceae03-4104-4b24-af64-6e123778f958","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:12:26.565465370+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 测试不走代理直连baidu\ncurl -I https://www.baidu.com --connect-timeout [...redacted 18 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"addc7f90-47e6-4d55-9fea-c47b7840543b","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:12:33.146855552+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 检查系统代理设置\necho \"http_proxy: $http_proxy\"\necho \"https_proxy: $ht[...redacted 123 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"170f5caf-8160-43d5-9401-7394cf54be98","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:12:40.976252146+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 用Python下载，尝试不同的SSL设置\npython3 -c \"\nimport urllib.request\n[...redacted 621 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"ccf310b8-f4d4-455f-b318-22dcdff57413","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:12:47.470404304+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Block","rule_ids":["insecure_tls_flags"],"command_redacted":"# 检查gh CLI是否可用\nwhich gh 2>/dev/null && gh --version\n# 或者尝试[...redacted 131 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"49c7e9bc-b52f-49d5-a9d2-a3a510470216","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["insecure_tls_flags"]}
{"timestamp":"2026-05-22T10:13:20.389703866+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 用gh CLI克隆\nrm -rf /tmp/multi-rider-clone 2>/dev/null\nexport http_proxy=ht[...redacted 158 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"1e165fd4-29b3-43b4-b9b4-231ae5005420","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:13:25.313014281+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Block","rule_ids":["credential_in_text"],"command_redacted":"# 设置GH_TOKEN并用gh克隆\nexport GH_TOKEN=[REDACTED:GitHub PAT]\nexport http[...redacted 209 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"5637d4d5-2d09-4460-94c3-afe5ffc104fd","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["credential_in_text"]}
{"timestamp":"2026-05-22T10:13:31.795339256+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Block","rule_ids":["credential_in_text"],"command_redacted":"# 检查gh的配置\ngh config list 2>&1\n# 尝试设置gh的代理\ngh config set [...redacted 241 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"963eae4b-3f12-43c0-968b-df91fe3d1f97","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["credential_in_text"]}
{"timestamp":"2026-05-22T10:13:39.440646459+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 用openssl调试SSL连接\necho \"QUIT\" | openssl s_client -connect github.com:4[...redacted 63 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"63ccdac8-594d-4cb9-8f12-2606c291e610","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:13:48.458442121+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 尝试用不同的TLS版本\ncurl --tlsv1.2 -x http://127.0.0.1:7890 -I https:/[...redacted 158 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d0ee2162-04e5-4471-8ec1-7732b6a7ace1","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:13:57.188639823+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/multi-rider-rag && git init && git remote add origin https://g[...redacted 39 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"8105150b-05f9-4578-b641-5ec597071870","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:13:59.950926111+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/multi-rider-rag && git fetch origin feature/ai-analyst-rag 2>&[...redacted 1 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"12aa608a-3385-4b8b-97a5-94fe7d34b49a","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:14:05.482557631+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 清除git的sslBackend配置\ngit config --global --unset http.sslBackend 2>/de[...redacted 88 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"64d1ca2f-120b-4322-85d9-04ddbbcedc5b","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:24:09.120409902+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/multi-rider-rag && git config http.proxy http://127.0.0.1:7890[...redacted 96 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"4a42fbaa-fb0d-4431-b36d-c9d53a418c52","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:24:16.119104153+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Block","rule_ids":["credential_in_text"],"command_redacted":"# 用GitHub API下载tarball\nexport http_proxy=http://127.0.0.1:7890\nexport http[...redacted 196 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d4430ca4-35d6-46d0-b768-480746351bb8","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["credential_in_text"]}
{"timestamp":"2026-05-22T10:24:24.539796943+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 尝试用pip安装pyopenssl来改善SSL支持\npip install pyopenssl 2>&1 | tai[...redacted 4 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"b94fb93d-afe3-4a0b-82be-0c5de614271f","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:24:45.744387704+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Block","rule_ids":["credential_in_text"],"command_redacted":"# 用Python下载tarball\npython3 << 'EOF'\nimport requests\nimport os\n\nos.environ[[...redacted 767 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"266d3217-1712-42ec-928b-94d20a308b9f","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["credential_in_text"]}
{"timestamp":"2026-05-22T10:24:56.796787919+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Block","rule_ids":["curl_pipe_shell"],"command_redacted":"# 检查mihomo的代理组和节点状态\ncurl -s http://127.0.0.1:9090/proxies [...redacted 373 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"18d681e2-a177-49a8-bc1d-37c649e62f30","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell"]}
{"timestamp":"2026-05-22T10:25:03.246693883+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 检查mihomo API\ncurl -s http://127.0.0.1:9090/ 2>&1\necho \"---\"\ncurl -s http:/[...redacted 28 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"3e6388f5-b594-42ad-ab63-c3245f92210c","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:25:12.210594562+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 检查mihomo配置中的secret\ngrep -i secret ~/.config/mihomo/config.yaml 2>/[...redacted 190 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a10acc05-133d-4046-a3f7-d9e6e2f085ed","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:25:19.459748439+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Block","rule_ids":["curl_pipe_shell"],"command_redacted":"# 不走代理访问mihomo API\nunset http_proxy https_proxy HTTP_PROXY HTTPS_PRO[...redacted 395 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"b6d910a7-200c-4547-ab71-ca48f7729f99","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell"]}
{"timestamp":"2026-05-22T10:25:27.476003745+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Block","rule_ids":["curl_pipe_shell","curl_pipe_shell"],"command_redacted":"# 检查当前规则和GitHub的代理组\ncurl -s http://127.0.0.1:9090/rules 2>[...redacted 504 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"842d43df-ab7d-4ab7-adf6-d51229c41bba","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell","curl_pipe_shell"]}
{"timestamp":"2026-05-22T10:25:33.287243174+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Block","rule_ids":["curl_pipe_shell"],"command_redacted":"# 切换Proxy组到美国节点\ncurl -s -X PUT http://127.0.0.1:9090/proxies/Pro[...redacted 252 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"40dab6e1-f84c-4707-8e61-81bfee298deb","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell"]}
{"timestamp":"2026-05-22T10:25:38.990498284+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/multi-rider-rag && git fetch origin feature/ai-analyst-rag 2>&[...redacted 1 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a3f38771-7d9c-47cd-93bb-df1a8d2d4fc3","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:25:47.320938648+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 测试新节点的连通性\ncurl -x http://127.0.0.1:7890 -I https://github.co[...redacted 38 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"1712e814-6bfd-4f28-ab6b-5069c781e2cb","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:25:58.933821494+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 尝试用git的http.sslVerify=false\ncd /home/longshao/multi-rider-rag && git c[...redacted 74 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"9a1b3e5b-9bb3-4502-b837-2afaeb4ca38d","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:26:11.348798115+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Block","rule_ids":["credential_in_text"],"command_redacted":"# 尝试用curl下载tarball（使用新的美国节点）\nexport http_proxy=htt[...redacted 279 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"c2e97706-4b19-43af-9641-53febc41fc73","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["credential_in_text"]}
{"timestamp":"2026-05-22T10:26:28.452979390+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Block","rule_ids":["curl_pipe_shell","credential_in_text"],"command_redacted":"# 尝试切换到新加坡节点\ncurl -s -X PUT http://127.0.0.1:9090/proxies/Pr[...redacted 468 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"945cb420-0399-4775-9988-9e54be9bc5bf","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell","credential_in_text"]}
{"timestamp":"2026-05-22T10:26:56.991425477+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Block","rule_ids":["credential_in_text"],"command_redacted":"# 先清除代理环境变量，用gh auth配置token\nunset http_proxy https_pro[...redacted 236 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"7b943bc0-1cc8-41f3-870c-6658eacf4ad5","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["credential_in_text"]}
{"timestamp":"2026-05-22T10:27:05.298852119+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Block","rule_ids":["credential_in_text"],"command_redacted":"# 用gh下载tarball\nexport GH_TOKEN=[REDACTED:GitHub PAT]\ngh api repos/mifengac[...redacted 110 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"cfa8623a-d170-4340-beef-760e415cc902","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["credential_in_text"]}
{"timestamp":"2026-05-22T10:27:10.536381846+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 解压tarball\ncd /tmp && tar xzf multi-rider.tar.gz 2>&1\nls -d multi-rider-* 2[...redacted 3 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"4739c6e5-d30a-4e48-8595-f2f792680bc6","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:27:13.591539491+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 查看解压后的内容\nls /tmp/multi-rider-*/ 2>&1 | head -20\necho \"---\"\n# [...redacted 52 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"56ed7beb-088a-4007-a189-4bcc99e15672","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:27:16.766220508+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 检查tarball内容\ntar tzf /tmp/multi-rider.tar.gz 2>&1 | head -20\necho \"---\"[...redacted 29 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"5731f08a-6773-458b-8f94-12881e0bfea6","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:27:21.075177239+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 解压tarball到临时目录\ncd /tmp && rm -rf mifengac-multi-rider-fdf58f1 2>[...redacted 85 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"24de2b7b-028f-4f24-b339-8651259ace92","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:27:29.988221644+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 备份当前的配置文件\ncp /home/longshao/multi-rider-rag/app.env /tmp/app[...redacted 816 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"02f24466-538a-48b7-af65-52ad534b822e","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:27:46.364039105+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/multi-rider-rag && source .venv/bin/activate && pip install -r[...redacted 33 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"929cd056-bd2e-410e-bf5b-5a757784641b","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:27:59.188797600+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 检查wheels目录\nls /home/longshao/multi-rider-rag/wheels/ 2>&1\necho \"---\"\n#[...redacted 108 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"81192443-39d8-4ce6-a001-8c60692b8f1d","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:28:03.651461307+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 检查旧的备份中是否有wheels目录\nls /tmp/model.bak/ 2>&1 | head -10\n[...redacted 141 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"0a47aa3a-01a4-4ee7-aaff-87b694bc8c0b","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:28:08.559085382+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 安装依赖（跳过clip wheel）\ncd /home/longshao/multi-rider-rag && source[...redacted 181 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a9483619-9844-4f1c-9bea-b9f76934864c","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:28:28.057171695+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 查看scripts目录中的SQL文件\nls /home/longshao/multi-rider-rag/scripts/*[...redacted 164 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"b25aa3a9-b7b3-4b37-9b02-4698d88bfd05","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:28:32.498368356+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 检查数据库中现有的表\ndocker exec kingbasev8 psql -U ywkuser -d yfywk[...redacted 42 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"01169f12-e55a-4fdf-ac32-7d7918567d2a","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:28:36.972001862+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"# 检查kingbase容器中的数据库客户端\ndocker exec kingbasev8 ls /usr/lo[...redacted 150 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"5dcb3614-84a7-46ad-b496-76181c5adc9a","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:28:46.973447542+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"pkill -f \"python app.py\" 2>/dev/null || true","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"f0fd5bf5-9393-4564-82fc-abcee6266539","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:28:50.581295108+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/multi-rider-rag && source .venv/bin/activate && python app.py","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d0a60163-06ff-4790-a6d7-52f6f4c8629e","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:28:53.644878865+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"sleep 3 && curl -s http://localhost:5001/healthz 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"f298cf45-36a7-48f0-97fb-87d252244421","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-22T10:29:06.742459042+00:00","session_id":"84e56618-4320-41a2-b23f-2e654059b46c","action":"Allow","rule_ids":[],"command_redacted":"sleep 5 && curl -s http://localhost:5001/healthz 2>&1\necho \"---\"\n# 检查进程[...redacted 63 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"5eb7c657-c416-438d-a0b2-7cfef0f4c7e1","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-23T09:48:03.428474255+00:00","session_id":"5d1e73e0-9f4a-42bd-a8ac-e6e0e1261264","action":"Allow","rule_ids":[],"command_redacted":"mkdir -p ~/.hermes/skills/devops/docker/references && \\\ncp ~/.hermes/skills/devo[...redacted 397 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"ee4d29ba-1f0e-44b9-91b6-788eb6592249","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-23T09:48:08.166256780+00:00","session_id":"5d1e73e0-9f4a-42bd-a8ac-e6e0e1261264","action":"Allow","rule_ids":[],"command_redacted":"mkdir -p ~/.hermes/skills/devops/python-webapp-deploy/references && \\\ncp ~/.herm[...redacted 356 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"f943a510-b0db-4f40-95c7-e41c1e8bf4de","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-23T09:48:11.457762679+00:00","session_id":"5d1e73e0-9f4a-42bd-a8ac-e6e0e1261264","action":"Allow","rule_ids":[],"command_redacted":"mkdir -p ~/.hermes/skills/.archive && \\\nmv ~/.hermes/skills/devops/docker-instal[...redacted 165 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"e0d57338-ea29-43c2-a28d-858a548d89d5","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-23T09:49:03.248862889+00:00","session_id":"5d1e73e0-9f4a-42bd-a8ac-e6e0e1261264","action":"Allow","rule_ids":[],"command_redacted":"cp ~/.hermes/skills/devops/self-hosted-services/references/9router-deployment.md[...redacted 118 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"750c358d-a91c-485a-86a3-4d873ff3c1df","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-23T09:49:23.010531101+00:00","session_id":"5d1e73e0-9f4a-42bd-a8ac-e6e0e1261264","action":"Allow","rule_ids":[],"command_redacted":"mv ~/.hermes/skills/devops/self-hosted-services ~/.hermes/skills/.archive/ && \\\n[...redacted 36 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"085f8fa1-057f-4e97-9da5-0979b9e4e223","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-23T09:49:27.814257021+00:00","session_id":"5d1e73e0-9f4a-42bd-a8ac-e6e0e1261264","action":"Allow","rule_ids":[],"command_redacted":"ls -la ~/.hermes/skills/.archive/ && \\\necho \"---\" && \\\nls -la ~/.hermes/skills/d[...redacted 109 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"73ac8994-16ee-417d-bb5f-d4cb5f1f562a","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-25T06:37:09.923890710+00:00","session_id":"8c176a52-bc5c-4c39-a1e1-b6b30c80207f","action":"Allow","rule_ids":[],"command_redacted":"curl -sL --max-time 30 \"https://anthropic.skilljar.com/ai-capabilities-and-limit[...redacted 24 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"2c273967-feda-480e-96d3-42c57fd63de4","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-25T06:37:16.278631885+00:00","session_id":"8c176a52-bc5c-4c39-a1e1-b6b30c80207f","action":"Allow","rule_ids":[],"command_redacted":"curl -sL --max-time 30 \"https://anthropic.skilljar.com/ai-capabilities-and-limit[...redacted 167 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"ff06f908-5ec4-4e30-99a9-dea002443a17","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-25T06:37:23.641931372+00:00","session_id":"8c176a52-bc5c-4c39-a1e1-b6b30c80207f","action":"Allow","rule_ids":[],"command_redacted":"curl -sL --max-time 30 \"https://anthropic.skilljar.com/ai-capabilities-and-limit[...redacted 230 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"9d61da8f-8034-4bde-84ea-1b577194574e","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-25T06:37:36.055615632+00:00","session_id":"8c176a52-bc5c-4c39-a1e1-b6b30c80207f","action":"Allow","rule_ids":[],"command_redacted":"curl -sL --max-time 30 \"https://anthropic.skilljar.com/ai-capabilities-and-limit[...redacted 290 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"c26d4afc-fdf4-4391-beac-545def51049d","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-25T06:38:15.096168658+00:00","session_id":"8c176a52-bc5c-4c39-a1e1-b6b30c80207f","action":"Allow","rule_ids":[],"command_redacted":"curl -sL --max-time 30 \"https://anthropic.skilljar.com/ai-capabilities-and-limit[...redacted 232 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"0130f3da-80c5-48f7-b368-b73c6290aa06","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-25T06:38:52.156225060+00:00","session_id":"8c176a52-bc5c-4c39-a1e1-b6b30c80207f","action":"Allow","rule_ids":[],"command_redacted":"# 检查是否有浏览器可用\nwhich chromium-browser 2>/dev/null || which goo[...redacted 79 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"84b523d3-e848-4787-9448-4a17d27f23bd","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-25T06:39:00.317861517+00:00","session_id":"8c176a52-bc5c-4c39-a1e1-b6b30c80207f","action":"Allow","rule_ids":[],"command_redacted":"# 尝试用Skilljar的API获取课程信息\ncurl -sL --max-time 30 \"https://anth[...redacted 51 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"1dcc5b0b-6039-480e-bff1-84734fdd00af","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-25T06:39:22.656838270+00:00","session_id":"8c176a52-bc5c-4c39-a1e1-b6b30c80207f","action":"Allow","rule_ids":[],"command_redacted":"# 提取页面中的文本内容\ncurl -sL --max-time 30 \"https://anthropic.skill[...redacted 1457 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"fb9810c4-0cc4-4f84-9264-04dbc2d6ed85","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-25T06:39:32.224339746+00:00","session_id":"8c176a52-bc5c-4c39-a1e1-b6b30c80207f","action":"Allow","rule_ids":[],"command_redacted":"# 提取更多课程信息\ncurl -sL --max-time 30 \"https://anthropic.skilljar.co[...redacted 196 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"6abaa69a-775f-471e-9679-60a288399b96","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-25T06:39:46.179858272+00:00","session_id":"8c176a52-bc5c-4c39-a1e1-b6b30c80207f","action":"Allow","rule_ids":[],"command_redacted":"# 提取课程的具体内容\ncurl -sL --max-time 30 \"https://anthropic.skilljar[...redacted 94 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"9858b273-838c-4b19-9e87-636c8d3c05d9","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-25T06:40:08.608130441+00:00","session_id":"8c176a52-bc5c-4c39-a1e1-b6b30c80207f","action":"Allow","rule_ids":[],"command_redacted":"# 提取课程描述和结构\ncurl -sL --max-time 30 \"https://anthropic.skilljar[...redacted 265 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"8aff4391-c183-4bb5-8207-0c61bb936002","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-25T06:40:31.022747469+00:00","session_id":"8c176a52-bc5c-4c39-a1e1-b6b30c80207f","action":"Allow","rule_ids":[],"command_redacted":"# 提取完整的课程描述\ncurl -sL --max-time 30 \"https://anthropic.skilljar[...redacted 508 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"3a87fe05-91d2-45e3-a8d7-573c8163356b","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-05-25T06:41:02.027197781+00:00","session_id":"8c176a52-bc5c-4c39-a1e1-b6b30c80207f","action":"Allow","rule_ids":[],"command_redacted":"# 提取课程结构信息\ncurl -sL --max-time 30 \"https://anthropic.skilljar.co[...redacted 264 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d88b0f6f-3780-4350-9e51-503bad96fd20","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:45:29.457156693+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"systemctl is-active mihomo 2>/dev/null || echo \"not-running\"; curl -s -o /dev/nu[...redacted 96 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d1e02a5d-69c5-4309-b9d3-6117c2808f86","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:45:33.280935098+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"ss -tlnp | grep 7890","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"80f32392-63e5-4044-b7cb-34463e80e0d5","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:46:02.606232892+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Block","rule_ids":["plain_http_to_sink"],"command_redacted":"curl -s --connect-timeout 5 http://ip-api.com/json 2>/dev/null","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d0f8f05c-ec8e-4fd4-b4db-f61c1645c853","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["plain_http_to_sink"]}
{"timestamp":"2026-06-10T04:46:06.537071415+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Block","rule_ids":["plain_http_to_sink"],"command_redacted":"curl -s --connect-timeout 5 -x http://127.0.0.1:7890 http://ip-api.com/json 2>/d[...redacted 7 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"f8479404-ff9c-4118-850c-19a6db3ec3d3","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["plain_http_to_sink"]}
{"timestamp":"2026-06-10T04:46:12.223004337+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"curl -s --connect-timeout 5 -x http://127.0.0.1:7890 https://api.ipify.org?forma[...redacted 18 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"476b7cd8-0f55-4f7c-a955-7754d2f3e3bd","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:46:18.546716886+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"curl -s --connect-timeout 5 -x http://127.0.0.1:7890 https://ifconfig.me 2>/dev/[...redacted 106 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"147c83c6-068e-4f5c-a5cd-d90ef8614369","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:46:26.882964591+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"curl -s http://127.0.0.1:9090/configs 2>/dev/null | head -c 2000","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"fbb70897-0f3b-44ea-ba6c-b4129961e051","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:46:28.161401641+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"cat /etc/mihomo/config.yaml 2>/dev/null | head -50 || cat ~/.config/mihomo/confi[...redacted 29 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a6129b25-dca7-4fd0-a662-83a3570d6e63","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:46:33.901360650+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Block","rule_ids":["curl_pipe_shell"],"command_redacted":"curl -s http://127.0.0.1:9090/proxies 2>/dev/null | python3 -c \"\nimport json,sys[...redacted 277 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"31a05ecf-8320-42c4-a709-e57bfc78dbdd","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell"]}
{"timestamp":"2026-06-10T04:47:38.421486298+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Block","rule_ids":["curl_pipe_shell"],"command_redacted":"curl -s http://127.0.0.1:9090/proxies 2>/dev/null | python3 -c \"\nimport json,sys[...redacted 255 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"97d3600c-0c34-4d1b-942f-8a6d92eb35a1","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell"]}
{"timestamp":"2026-06-10T04:48:42.643110461+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Block","rule_ids":["schemeless_to_sink","curl_pipe_shell"],"command_redacted":"curl -s http://127.0.0.1:9090/proxies | python3 -m json.tool | head -80","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"f041ffa4-619a-45eb-b557-4b481a06248a","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["schemeless_to_sink","curl_pipe_shell"]}
{"timestamp":"2026-06-10T04:50:36.195254373+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"find /etc/mihomo /home/longshao/.config/mihomo /home/longshao/.mihomo /opt/mihom[...redacted 56 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"f2c23a87-627d-4817-9025-58b832db229d","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:50:37.508309337+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"ps aux | grep mihomo | grep -v grep","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d78a1b1b-3493-4afe-9e89-13ba24a83f72","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:50:41.018326504+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"grep -i \"subscribe\\|sub-url\\|proxy-providers\\|url:\" /home/longshao/.config/mihom[...redacted 24 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"5ed07a79-1db1-4d79-a65d-81039305cd02","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:50:45.856023112+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"grep -E \"proxy-providers|subscribe|sub-\" /home/longshao/.config/mihomo/config.ya[...redacted 2 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"8e396585-8e21-412c-8bd3-bdb1c8ccfe7c","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:50:47.138830443+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"head -100 /home/longshao/.config/mihomo/config.yaml","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"c79c6e5d-7d4c-4a30-9b09-b1cc6b8a71ff","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:50:51.114574837+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"grep -c \"name:\" /home/longshao/.config/mihomo/config.yaml","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"e785ea87-85ea-42c8-8734-c0d83e2b6dc4","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:50:52.444803018+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"grep \"proxy-providers\\|subscribe\\|sub-url\\|subscription\" /home/longshao/.config/[...redacted 18 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"75005cb6-437a-4c7c-b598-0fa43d124255","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:52:23.476373585+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"cp /home/longshao/.config/mihomo/config.yaml /home/longshao/.config/mihomo/confi[...redacted 33 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"499a37e8-cb66-4cf3-a72a-aab9cce4f41a","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:52:47.146317594+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"kill 458100 458099 2>/dev/null; sleep 1; ss -tlnp | grep 7890","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"7a251ef4-63fe-4231-80db-6054885063f5","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:52:52.012241996+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"cd ~/.config/mihomo && mihomo -d . &","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"8c4ff1f7-541f-481c-be37-9408923cde1b","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:52:55.497721640+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"sleep 3 && ss -tlnp | grep 7890","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"0dbd5e2e-3916-44a3-b8f0-7b45c6288533","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:53:05.589351430+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Block","rule_ids":["curl_pipe_shell"],"command_redacted":"sleep 5 && curl -s http://127.0.0.1:9090/proxies/Proxy 2>/dev/null | python3 -c [...redacted 239 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"551aa5fc-398e-448a-9c6f-b03b7a97866c","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell"]}
{"timestamp":"2026-06-10T04:53:21.220533922+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"curl -s --connect-timeout 10 -x http://127.0.0.1:7890 https://api.ipify.org 2>/d[...redacted 96 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"1c23fd3a-6c3d-41ad-8363-a94dfba6a73d","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:53:24.721595561+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Block","rule_ids":["plain_http_to_sink"],"command_redacted":"curl -s \"http://ip-api.com/json/45.207.35.146\" 2>/dev/null","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"c8dcfcfb-abd1-4a6d-9887-ef2f888596cd","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["plain_http_to_sink"]}
{"timestamp":"2026-06-10T04:55:05.021593870+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Block","rule_ids":["curl_pipe_shell"],"command_redacted":"curl -s http://127.0.0.1:9090/proxies/Proxy 2>/dev/null | python3 -c \"\nimport js[...redacted 102 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"ca33eb8b-a1ec-4c66-9c4b-7e563e70befa","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell"]}
{"timestamp":"2026-06-10T04:55:10.341115526+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"curl -s -X PUT http://127.0.0.1:9090/proxies/Proxy -H \"Content-Type: application[...redacted 88 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"df9b984f-a9a8-4826-8932-caf38ea053f6","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:55:13.411653467+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"curl -s --connect-timeout 10 -x http://127.0.0.1:7890 https://api.ipify.org 2>/d[...redacted 7 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"53e20b57-ac1d-4bf9-8afe-7aecebed4837","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:55:17.937202845+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Block","rule_ids":["plain_http_to_sink"],"command_redacted":"curl -s \"http://ip-api.com/json/1.162.168.169\" 2>/dev/null","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"38ceef28-a8d4-494f-a950-d2dbdfc5949b","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["plain_http_to_sink"]}
{"timestamp":"2026-06-10T04:58:04.546240079+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"pkill -f \"mihomo -d\" 2>/dev/null; sleep 1; ss -tlnp | grep 7890","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"409fecef-7c17-4ab8-8163-08bf68ca9e67","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:58:08.131832407+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"sudo -n bash -c 'cd /home/longshao/.config/mihomo && mihomo -d .'","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"6ee1c83a-f65d-467f-baf3-d9a761a6bc00","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:58:19.661082953+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"sleep 3 && ss -tlnp | grep 7890 && echo \"---\" && ip link show | grep -i \"tun\\|mi[...redacted 115 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"b93a28ec-0791-4a51-ac10-87e48431dac3","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:58:25.315803297+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"sleep 2 && ss -tlnp | grep mihomo","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"ca5ad522-be18-4524-9dce-0e26db9d7721","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:58:33.388154126+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"which mihomo || find / -name \"mihomo\" -type f 2>/dev/null | head -5","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"765819ec-d722-47cc-85d6-29b30a234374","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:58:36.030269974+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"sudo /home/longshao/.local/bin/mihomo -d /home/longshao/.config/mihomo","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"033e507c-8a5e-4bdc-adcd-643182ad450d","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:58:40.527408526+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"sleep 3 && ss -tlnp | grep 7890 && echo \"=== TUN ===\" && ip link show | grep -i [...redacted 133 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"fe87ca4d-5fa0-4174-a796-18a2e984582a","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T04:58:53.892821160+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"ip addr show | grep -A2 \"Meta\\|tun\\|mihomo\" && echo \"=== IP 测试 ===\" && curl [...redacted 44 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"9f9c885a-75be-4ede-8650-9ee08dac0100","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T05:05:06.264050824+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"curl -s -o /dev/null -w \"%{http_code}\" --connect-timeout 3 http://127.0.0.1:7890[...redacted 73 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"6d1fad85-53d8-428e-b023-5f665fdb1e5c","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T05:05:11.646581908+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"systemctl status mihomo 2>/dev/null; echo \"---\"; ps aux | grep -iE 'mihomo|clash[...redacted 60 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d6ee56fb-77f9-4116-bf79-8d7384ac160f","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T05:05:15.190764074+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"which mihomo 2>/dev/null; find /usr/local/bin /usr/bin /opt -name 'mihomo*' 2>/d[...redacted 41 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"9fc4dd07-c399-42f6-8f49-eac7e6949d3b","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T05:06:45.298919582+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"/home/longshao/.local/bin/mihomo -d /home/longshao/.config/mihomo","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"094a6a30-4b12-489d-816d-d13052d75cc8","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T05:06:47.832299503+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Allow","rule_ids":[],"command_redacted":"sleep 1; ps aux | grep mihomo | grep -v grep; ss -tlnp | grep 7890","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"8b4a6381-95e4-4bae-b2cd-797b03bca7a3","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-10T05:06:52.731937033+00:00","session_id":"fc434744-4226-4846-b1e5-5c1908266dd7","action":"Block","rule_ids":["plain_http_to_sink"],"command_redacted":"curl -s --connect-timeout 5 -x http://127.0.0.1:7890 http://httpbin.org/ip 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"5f10384d-fc21-4fda-b0e8-c1222ac5fd42","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["plain_http_to_sink"]}
{"timestamp":"2026-06-17T12:51:11.345363996+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"which frpc frps ngrok zerotier-cli tailscale cloudflared bore rathole 2>/dev/nul[...redacted 371 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"ef904087-4c61-4292-89e5-d5adc588b3ac","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T12:51:23.450178316+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"echo \"=== ngrok ===\" && ngrok version 2>&1 && echo \"=== tailscale ===\" && tailsc[...redacted 122 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"cd5a764c-8a36-4dfa-a01c-f1c4a4deb43d","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T12:51:25.337057502+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"# Check for frp binaries or configs\nfind / -name \"frpc\" -o -name \"frps\" -o -name[...redacted 96 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"b8f190b8-ec98-4f4e-a99a-a265161889f0","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T12:51:31.429073431+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"# Check for zerotier\nwhich zerotier-cli 2>/dev/null; dpkg -l | grep zerotier 2>/[...redacted 61 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"e25be5cc-fdc5-406d-94f8-6c140198e542","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T13:09:36.295589489+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"echo \"=== ngrok config ===\" && cat ~/.config/ngrok/ngrok.yml 2>/dev/null || echo[...redacted 239 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"c85b615a-b646-45e1-b0d1-1930c90aa469","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T13:09:49.850548884+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"echo \"=== Tailscale 登录信息 ===\" && tailscale whois 100.81.18.50 2>&1 | hea[...redacted 150 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"e7039f09-034e-4041-9fd5-3c406dc080f8","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T13:49:49.201899824+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"which himalaya 2>/dev/null && himalaya --version 2>&1 || echo \"NOT_INSTALLED\"","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"fa3e99a1-23ee-4330-986b-db5a673e014a","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T13:50:02.451761574+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Block","rule_ids":["curl_pipe_shell"],"command_redacted":"curl -sSL https://raw.githubusercontent.com/pimalaya/himalaya/master/install.sh [...redacted 25 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"2424dd7e-f797-45cf-a4c5-12473a66742f","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["curl_pipe_shell"]}
{"timestamp":"2026-06-17T13:53:14.461320965+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"mkdir -p ~/.config/himalaya","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"cce5b8d8-50eb-40d6-96bc-e6dd23e97681","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T13:53:37.560528099+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"himalaya folder list 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"5e6cd257-a94f-493f-acd8-2bf835228b91","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T13:53:43.706642446+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"himalaya envelope list --page-size 5 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"e1ca2a19-394e-468d-9f59-d97435859d09","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T13:55:27.396034437+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"himalaya envelope list --page-size 50 subject \"0617\" 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"eb7e8c70-ec84-4c3d-bc34-87a1dce6b098","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T13:55:34.890582608+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"himalaya message read 3916 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"bd248b90-b688-4487-b0e2-70c81d586e36","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T13:55:46.269802297+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"mkdir -p ~/mail-attachments && himalaya attachment download 3916 --dir ~/mail-at[...redacted 14 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"93c5f270-58bb-4fed-a7ad-4f44adb1fe55","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T13:55:50.456824962+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"himalaya attachment download --help 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"1209fd1b-b798-4beb-8bde-54ef331a8ed8","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T13:55:57.347542353+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"himalaya attachment download 3916 -d ~/mail-attachments 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a4ffeeb0-e59f-4db8-a5e2-3ef3cd6ceeca","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T13:56:05.801738162+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"ls -lh ~/mail-attachments/","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"05e2cf5a-6d73-4881-b462-43eba758a17e","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T13:57:17.610415108+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"unzip -l ~/mail-attachments/wcnr_sql.zip 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d6d4eb2b-1ba7-437f-97b6-c67c68e5bfa7","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T13:57:18.890502561+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"file ~/mail-attachments/DB_2026-06-17.dmp && head -c 500 ~/mail-attachments/DB_2[...redacted 38 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"920e4a04-30ea-4f8f-890b-b5d0ad8a60d5","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T13:57:25.950289034+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"sudo apt install -y unzip 2>&1 | tail -3","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"8e879552-ec0d-464d-99e4-95b4a2eed555","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T13:57:40.189566529+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"unzip -l ~/mail-attachments/wcnr_sql.zip 2>&1 && unzip -p ~/mail-attachments/wcn[...redacted 25 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"640974f3-f5da-4678-8ee1-ef472a3d8241","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T13:57:57.334063217+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"docker ps --filter name=kingbase --format '{{.Names}} {{.Status}} {{.Ports}}' 2>[...redacted 2 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"6390c8a5-4af9-4e10-baeb-f6a8b0f32b62","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T13:57:58.635803993+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 which sys_restore 2>&1 && docker exec kingbasev8 sys_rest[...redacted 18 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"c91ad2fd-c177-4e22-9e60-2516b4c265d4","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T13:58:10.045082906+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"docker cp ~/mail-attachments/DB_2026-06-17.dmp kingbasev8:/tmp/DB_2026-06-17.dmp[...redacted 5 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"bb68c65c-ba68-4d82-b960-ee47d559f133","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T13:58:17.130052005+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 sys_restore -l /tmp/DB_2026-06-17.dmp 2>&1 | head -60","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"90ca4dca-3f4f-488d-b634-f14aa385802f","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T13:58:27.854000468+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"SELECT schema_name FROM info[...redacted 41 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"0fb19aed-b724-4ccc-a760-7e634a3043eb","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T13:58:36.300517434+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\nSELECT schemaname, count(*)[...redacted 131 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"46ecc690-8046-4b4a-a84f-3ce96f5bfff2","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T14:00:26.708434473+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 sys_restore -U ywkuser -d yfywk --schema-only --no-owner [...redacted 57 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"ca0f6291-dd06-4435-a48a-12f1bede4288","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T14:02:06.972152205+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\nSELECT schemaname, \n       [...redacted 347 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d349b08c-317d-4a97-903a-897fe6b4fffb","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T14:02:16.168211565+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\nSELECT n.nspname as scheman[...redacted 364 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"800acc86-b49e-4a7e-8fbc-d9416b893464","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T14:12:21.895499668+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"hermes config 2>&1 | grep -A 20 -E 'model:|provider:|delegation:' | head -60","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"e4f56a15-eb4a-424d-bb58-3fead09e9fa1","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T14:12:29.804032383+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"hermes config 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"98d1f14b-b203-468a-bb8b-f4c7e730b8a0","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T14:12:40.897755285+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"hermes config 2>&1 | grep -A 10 -i delegat","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"eb4768a5-daff-4edf-90ea-810211f24761","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T14:12:42.589322739+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"which opencode claude codex 2>/dev/null; opencode --version 2>/dev/null; claude [...redacted 50 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"0fe510c4-ed46-420f-b66f-873b40bbaa8a","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T14:15:41.368010167+00:00","session_id":"a5ccb29b-0582-46b1-b1f9-50b0e0714e14","action":"Allow","rule_ids":[],"command_redacted":"hermes model 2>&1 <<< \"\" | head -80","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"0973a626-53ac-4180-a5a7-61253d0c4eb3","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T22:06:19.058055059+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/github-trending && python3 fetch_trending.py 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a84771f1-f219-4644-a112-991cc97ea7ef","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T22:06:46.552283839+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"cd /home/longshao/github-trending && python3 -m http.server 8080","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"8e5b684f-0acc-4ed9-94c6-31f08fab012e","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T22:06:51.004955105+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"sleep 2 && curl -s -o /dev/null -w \"%{http_code}\" http://localhost:8080/ 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"3f22ac1c-04b5-482d-a533-667175231049","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T22:07:04.115681407+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"systemctl --user daemon-reload && systemctl --user enable github-trending.servic[...redacted 6 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"e05eb34b-a5c0-4e60-bf9f-500db15fc1d5","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T22:17:13.105714528+00:00","session_id":"651f9e14-061f-4d96-9ee3-3b28343e7c82","action":"Allow","rule_ids":[],"command_redacted":"systemctl is-active tailscaled 2>&1 && tailscale status 2>&1 | head -5","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"f3b5ecd2-e356-4e0f-b2f0-d4ba79db8e44","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T22:19:10.907875035+00:00","session_id":"651f9e14-061f-4d96-9ee3-3b28343e7c82","action":"Allow","rule_ids":[],"command_redacted":"ss -tlnp | grep 8080 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"8d4417a4-64b4-4110-9941-b46806941398","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T22:20:53.722332396+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"which tailscale 2>/dev/null && tailscale status 2>&1 | head -10 || echo \"Tailsca[...redacted 13 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"e3d670e8-f13d-4f43-bcca-241733b604ac","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T22:20:59.626232344+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"ss -tlnp | grep 8080","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d8ab4e62-d045-451a-be71-931ee15dcad5","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T22:23:49.221809226+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"tailscale serve --help 2>&1 | head -20","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"4db3e911-a56b-4873-a019-661b106a366a","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T22:23:55.432040001+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Block","rule_ids":["pipe_to_interpreter"],"command_redacted":"# 先检查 HTTPS 证书和 funnel 是否可用\ntailscale status --json 2>&1 | p[...redacted 158 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a20c84d0-5fb6-4141-8310-37b28fe585d2","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["pipe_to_interpreter"]}
{"timestamp":"2026-06-17T22:24:12.230790513+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"tailscale funnel 8080 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"649c5c6d-c9d9-4870-ba90-334b63b44b97","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T22:27:16.643949818+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Block","rule_ids":["pipe_to_interpreter"],"command_redacted":"tailscale status --json 2>&1 | python3 -c \"\nimport sys, json\nd = json.load(sys.s[...redacted 257 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"c951316e-798c-4053-b431-ff68cf8642c1","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["pipe_to_interpreter"]}
{"timestamp":"2026-06-17T22:28:11.330052222+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Block","rule_ids":["pipe_to_interpreter"],"command_redacted":"tailscale status --json 2>&1 | python3 -c \"\nimport sys, json\nd = json.load(sys.s[...redacted 136 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"2575f89c-9c51-42a0-af0a-b7640a2cff5b","tier_reached":3,"entry_type":"verdict","raw_action":"Block","raw_rule_ids":["pipe_to_interpreter"]}
{"timestamp":"2026-06-17T22:31:14.408448326+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"tailscale funnel 8080 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"9a45fdfc-dd06-4834-8010-76e3e1eceb36","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T22:31:19.093222230+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"sudo tailscale set --operator=longshao 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"bc5c5192-c50a-4eeb-ba44-584ab057ab43","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T22:31:23.495673212+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"tailscale funnel 8080 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"2d9eb105-1840-4904-825d-4d41664e9391","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T22:34:38.751150837+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"# 检查 funnel 状态\ntailscale serve status 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"72439e34-2974-4044-a35a-a675670ea912","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T22:34:44.877678106+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"tailscale funnel 8080","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"f4545522-25b1-465c-adef-57fdb755e214","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T22:34:49.870751754+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"sleep 3 && tailscale serve status 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"84e4025d-a540-491f-8b91-ef2e8e3df281","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T22:35:01.780724752+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"sleep 5 && tailscale serve status 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"ea8f9e87-e618-4f78-a1c5-877526f2af36","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T22:35:13.731061693+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"# 先设置 serve，再开启 funnel\ntailscale serve --bg 8080 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"4122dcda-14cd-41de-97d8-b300180c01ce","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T22:35:19.311721785+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"# 重置 serve 配置\ntailscale serve reset 2>&1\necho \"---\"\n# 杀掉之前的 fu[...redacted 128 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"96784330-cc31-4dd1-b946-036cbbb83ef6","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T22:35:26.401067308+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"# 先杀掉所有 tailscale serve/funnel 进程\npkill -f \"tailscale serve\" 2>/de[...redacted 183 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"869d67a7-fd0c-438e-8da8-c6161dd9eeec","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T22:35:35.033217342+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"# 检查 443 端口\nss -tlnp | grep 443 2>&1\necho \"---\"\n# 列出所有 tailscale[...redacted 52 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"f7c15964-c900-4b8b-8d86-c6ad319fb2d6","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T22:35:42.331676851+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"# 先清理之前的 serve 配置\ntailscale serve reset 2>&1\nsleep 1\n# 用 --bg [...redacted 67 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"7316b2cb-e5fa-445e-8fbc-095b988ae398","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T22:35:48.770014827+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"tailscale funnel --bg 8080 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"bf9ace75-cbd9-4176-ab1e-38ba6e3ebd50","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T22:35:54.618605478+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"# 本地验证\ncurl -s -o /dev/null -w \"%{http_code}\" https://root.tail1cca4e.ts[...redacted 10 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"42512f33-060a-4ddb-aaea-37969c82cb3a","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T22:36:15.706857382+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"# 本地测试 funnel 是否正常工作\ncurl -s -o /dev/null -w \"%{http_code}\" [...redacted 66 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"df4b3f9e-7fa3-46a8-9e33-8cc62776fbae","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-17T22:36:22.350457672+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"unset http_proxy https_proxy HTTP_PROXY HTTPS_PROXY\ncurl -s -o /dev/null -w \"%{h[...redacted 68 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a886f1eb-e562-40f2-8aa7-7b40d0ebeaa6","tier_reached":3,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T00:46:40.829110652+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\\d ywdata.zq_zfba_xyrxx\" 2>&[...redacted 1 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"001b95c7-f3d7-437e-8638-1889b54db15f","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T00:57:06.746309106+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\\d ywdata.zq_zfba_ajxx\" 2>&1","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"15823107-3ba5-42f8-ab07-aec6dbfaa5f8","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T00:57:41.035548979+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\nCREATE OR REPLACE VIEW ywda[...redacted 2390 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"62c8af49-5971-43c7-95f7-671048f5a169","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T00:57:49.417309998+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\nCREATE OR REPLACE VIEW ywda[...redacted 2099 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"1c63877c-2910-44e9-ae45-a8274a8487c8","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T00:57:56.814572953+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\nCREATE OR REPLACE VIEW ywda[...redacted 2097 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"e81a0ddc-25bd-4bbf-973a-c022ff8528fd","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T00:57:59.482244401+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\nSELECT count(*) AS 未成[...redacted 62 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a1ef6779-3598-462c-b413-f54a3d3c96f6","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T00:58:03.227380799+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\nSELECT \n    count(*) AS 总[...redacted 431 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d62efb6e-5ff2-4b36-9844-39774fd0ee69","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T00:59:03.114346686+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\nDROP VIEW IF EXISTS ywdata.[...redacted 2109 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"880bd186-ea95-492a-9879-80622ab4c4d6","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T00:59:06.325044914+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"SELECT count(*) AS minor_cou[...redacted 41 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"a5eb97e7-b20c-4de2-9f54-2a9b6e96c27a","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T01:00:02.604601567+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\nCREATE OR REPLACE VIEW ywda[...redacted 2099 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"475c4507-98f8-4742-b110-97d360c5bf54","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T01:00:50.325798049+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\nCREATE OR REPLACE VIEW ywda[...redacted 1953 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"9eb85b5c-5dbc-4c92-b464-8bc45ad7baaf","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T01:01:46.857621128+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\nSELECT view_definition \nFRO[...redacted 102 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d3d5ba53-dea3-401a-b493-b6c72d9c4754","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T01:02:07.874359998+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\nSELECT table_schema, table_[...redacted 141 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"de5c7a81-57f9-4429-b993-35667c6e4bbf","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T01:02:12.417608764+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\nSELECT view_definition \nFRO[...redacted 193 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"39399ec0-d0a6-4ce5-a74b-96e54f3ecfad","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T01:02:16.634633441+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\nSELECT view_definition \nFRO[...redacted 239 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"011f14c4-2bbb-4155-a56f-c9179f1525d3","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T01:02:20.025288725+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"grep -n \"table_name\\|^  WITH\\|^  SELECT\\|^CREATE\\|^--\" /tmp/view_defs.txt | head[...redacted 4 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"ce3233e6-1324-4ef2-992b-70cc6e341b8e","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T01:02:23.643177622+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"# 分别获取每个视图的定义\nfor view in v_wcnr_wfry_jbxx v_wcnr_wfry_jbx[...redacted 317 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"778ced49-7bf1-44ba-af68-dbb496274339","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T01:14:41.768765031+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\nSELECT column_name, data_ty[...redacted 139 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"dacfcbc7-5eeb-457b-af9a-331f4177b447","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T01:14:52.183729833+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\n-- byxzcfjds 表字段\nSELE[...redacted 148 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"da18ab8f-89e3-4209-8cd5-1a6fa45c524a","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T01:14:55.460624263+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\n-- xzcfjds 表字段\nSELECT[...redacted 144 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"66aa7db5-0c7a-41d3-91bd-ab15e2098c1c","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T01:15:10.515323688+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\n-- 查一下 byxzcfjds 和 [...redacted 525 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"0b13c788-9137-4575-b217-caa6cb908d94","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T01:15:24.371702410+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\nSELECT column_name FROM inf[...redacted 153 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"678aff54-b4a8-4932-934d-abee2122f669","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T01:17:46.665030196+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\nSELECT column_name FROM inf[...redacted 122 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"5ef85af1-1787-4c46-90b3-c2b65b1f9c82","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T01:17:53.765476602+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\nSELECT view_definition FROM[...redacted 179 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"b2a4bd7c-ba9b-4999-9805-c59d65457279","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T01:18:02.948105122+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\nSELECT \n  tc.table_schema, [...redacted 181 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"f76fb349-6e3d-433c-a6fe-bf65f900f629","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T01:18:05.876577693+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\nSELECT \n  tc.table_schema, [...redacted 228 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"bdc0b3ba-1429-43ee-8a81-e3b3c137c91f","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T01:18:14.159915358+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\n-- 1. 删除旧视图\nDROP [...redacted 2188 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"d7f322ba-c4c0-44bd-8f21-630a5fc192ad","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T01:18:22.526543914+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\n-- 3. 新建第二个视图[...redacted 1800 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"0ebb4118-1b88-4f11-85c4-5d42deac5c8e","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T01:18:25.375483895+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\n-- 验证两个视图字段[...redacted 179 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"b3b0bbd7-7748-4eef-95ed-00e9f2c51ff2","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T01:18:29.082683892+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\n-- 看源表有多少行\nSE[...redacted 234 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"f9454aec-640d-4512-b7cd-cb192a9e85db","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}
{"timestamp":"2026-06-18T01:18:33.364871497+00:00","session_id":"e42d909f-2c82-4ebe-b81f-a05b14dc15e3","action":"Allow","rule_ids":[],"command_redacted":"docker exec kingbasev8 ksql -U ywkuser -d yfywk -c \"\n-- 验证第二个视图的[...redacted 219 bytes]","bypass_requested":false,"bypass_honored":false,"interactive":false,"policy_path":null,"event_id":"c40aa98a-9b96-4987-9de6-72383209521e","tier_reached":1,"entry_type":"verdict","raw_action":"Allow","raw_rule_ids":[]}