atris 3.82.2 → 3.82.4

package/README.md

@@ -28,7 +28,7 @@ Mem0, Zep and Letta remember the users of a chat app. Atris remembers the projec
 npx -y atris aeo scan yoursite.com --vs competitor.com
 ```
 
-You get a score out of 100, each gap with its fix, a side-by-side score against a competitor, and a draft `llms.txt` you can publish. To see what ChatGPT actually says when buyers ask about your business, run the free check at https://atris.ai/aeo/check.
+You get a score out of 100, each gap with its fix, a side-by-side score against a competitor, and a draft `llms.txt` you can publish. To see what ChatGPT actually says when buyers ask about your business, run the free check at https://atris.ai/aeo/check. Guide to both checks and the tools that run them: [docs/answer-engine-checks.md](docs/answer-engine-checks.md).
 
 ## Quick Start
 

package/atris/atris.md

@@ -149,6 +149,12 @@ The Mission anchors, goals point, a mission run commits, tasks prove, accepts la
 
 ## task source of truth
 
+For the next agent step, use `atris next --agent <functional-member> --json`.
+Known worker shells choose this view automatically; `--human` shows the
+person's view without changing acceptance permission. An unchecked task
+requires a goal, exit, first move and runnable check through `atris task plan`.
+The recommendation itself never claims, executes, accepts or awards XP.
+
 Use `atris task` as the source of truth for active work. It stores durable local
 SQLite state plus append-only task events, and refreshes
 `.atris/state/tasks.projection.json` for desktop/web UIs. `atris/TODO.md` is a

package/bin/atris.js

@@ -633,6 +633,7 @@ function showHelpAll() {
   console.log('  verify     - Validate work is done (tests, MAP.md, changes)');
   console.log('  slop       - Deterministic slop detector: frontend/prose tells, dead code (slop dead --exports)');
   console.log('  sentinel   - Security audit: engines hunt for holes, a different model verifies each one');
+  console.log('               free checks: sentinel agents, sentinel watch, sentinel guard install');
   console.log('  voice      - Scan binary voice tells or judge reply shape and plainness');
   console.log('  recover    - Explain stopped missions; --apply performs safe recovery only');
   console.log('  task       - Local agent task plane (atomic claims, TODO import)');

package/commands/aeo.js

@@ -217,10 +217,23 @@ async function aeoScan(args) {
     console.log('\n  Gaps:');
     for (const g of gaps) console.log(`   ✗ ${g.title || g.key}: ${g.fix || ''}`);
   }
+  // What an agent actually gets from live requests: plain text on request,
+  // crawler access, words without scripts, structured data, sitemap.
+  const access = data.agent_access;
+  if (access && Array.isArray(access.checks)) {
+    console.log(`\n  Agent access: ${access.score}/${access.max_score ?? 100}`);
+    for (const c of access.checks) {
+      console.log(`   ${c.passed ? '✓' : '✗'} ${c.title}${c.passed ? '' : `: ${c.fix || c.detail || ''}`}`);
+    }
+  }
   const comp = data.competitors || [];
   if (comp.length) {
-    console.log('\n  Head-to-head:');
-    for (const c of comp) console.log(`   ${pad(String(c.score ?? '?'), 4)} ${c.url || c.name}`);
+    const withAccess = comp.some((c) => c.agent_access_score != null);
+    console.log(withAccess ? '\n  Head-to-head (score, agent access):' : '\n  Head-to-head:');
+    for (const c of comp) {
+      const extra = withAccess ? `${pad(String(c.agent_access_score ?? '?'), 4)} ` : '';
+      console.log(`   ${pad(String(c.score ?? '?'), 4)} ${extra}${c.url || c.name}`);
+    }
   }
   if (data.draft_llms_txt) {
     console.log('\n  Draft llms.txt included, save it with:');

package/commands/next.js

@@ -19,7 +19,7 @@ const {
 } = require('../lib/next-moves');
 
 function showHelp(log = console.log) {
-  log('Usage: atris next [--json]');
+  log('Usage: atris next [--agent <member>|--human] [--json]');
   return 0;
 }
 
@@ -179,12 +179,17 @@ function executeCard(card, root, log = console.log) {
 
 function actionToken(args = []) {
   const list = Array.isArray(args) ? args : [];
-  const token = list.find((arg) => {
+  for (let i = 0; i < list.length; i += 1) {
+    const arg = list[i];
     const text = String(arg || '').trim();
-    if (!text || text.startsWith('-')) return false;
-    return true;
-  });
-  return String(token || '').trim().toLowerCase();
+    if (['--agent', '--as', '--task', '--goal-id', '--goal_id', '--tag', '--status', '--review-state', '--review_state'].includes(text)) {
+      if (list[i + 1] && !String(list[i + 1]).startsWith('-')) i += 1;
+      continue;
+    }
+    if (!text || text.startsWith('-')) continue;
+    return text.toLowerCase();
+  }
+  return '';
 }
 
 function nextCommand(args = [], root = process.cwd(), { log = console.log } = {}) {
@@ -193,6 +198,11 @@ function nextCommand(args = [], root = process.cwd(), { log = console.log } = {}
 
   const asJson = wantsJson(list);
   const action = actionToken(list);
+  if (!['skip', 'no', 'yes'].includes(action)) {
+    const { buildAgentNext, printAgentNext } = require('../lib/agent-next');
+    const agent = buildAgentNext({ root, args: list });
+    if (agent) return printAgentNext(agent, { asJson, log });
+  }
 
   if (!action || action === 'json') return speakNext(root, { asJson, log });
 

package/commands/now.js

@@ -612,7 +612,7 @@ function nowJsonPayload(root = process.cwd()) {
 function nowAtris(args = process.argv.slice(3), root = process.cwd()) {
   const help = args.includes('--help') || args.includes('-h') || args[0] === 'help';
   if (help) {
-    console.log('Usage: atris now [--init|--refresh|--all|--path] [--json]');
+    console.log('Usage: atris now [--init|--refresh|--all|--path] [--agent <member>|--human] [--json]');
     console.log('');
     console.log('Show the current operating truth for this workspace.');
     console.log('');
@@ -632,6 +632,11 @@ function nowAtris(args = process.argv.slice(3), root = process.cwd()) {
   const asJson = args.includes('--json');
 
   try {
+    if (!init && !refresh && !all && !pathOnly) {
+      const { buildAgentNext, printAgentNext } = require('../lib/agent-next');
+      const agent = buildAgentNext({ root, args });
+      if (agent) return printAgentNext(agent, { asJson, alias: 'next' });
+    }
     if (asJson && !init && !refresh && !all && !pathOnly) {
       const payload = nowJsonPayload(root);
       printNowJson(payload);

package/commands/security-review.js

@@ -123,10 +123,10 @@ function applyBaselineOptions(root, rawFindings, opts) {
 
 function securityReviewCommand(argv = []) {
   const sub = argv[0];
+  if (sub === 'audit') return auditCommand(argv.slice(1));
   if (sub === 'help' || argv.includes('-h') || argv.includes('--help')) return printHelp();
   if (sub === 'rules') return printRules();
   if (sub === 'hook' || sub === 'install-hook') return installHook();
-  if (sub === 'audit') return auditCommand(argv.slice(1));
 
   const root = process.cwd();
   let opts;
@@ -402,7 +402,7 @@ function installHook() {
 }
 
 function parseAuditArgs(argv) {
-  const opts = { profile: 'standard', scope: [], json: false, planOnly: false, budget: null, out: null, hunter: null, verifier: null, timeoutMs: null };
+  const opts = { profile: 'standard', scope: [], json: false, planOnly: false, budget: null, out: null, hunter: null, verifier: null, timeoutMs: null, engine: null, yes: false, upload: true, scheduled: false };
   const takes = (i, flag) => {
     if (!argv[i + 1] || argv[i + 1].startsWith('--')) throw new Error(`${flag} needs a value`);
     return argv[i + 1];
@@ -420,6 +420,10 @@ function parseAuditArgs(argv) {
     else if (flag === '--hunter') opts.hunter = value();
     else if (flag === '--verifier') opts.verifier = value();
     else if (flag === '--timeout') opts.timeoutMs = Number(value()) * 1000;
+    else if (flag === '--engine') opts.engine = value();
+    else if (flag === '--yes' || flag === '-y') opts.yes = true;
+    else if (flag === '--no-upload') opts.upload = false;
+    else if (flag === '--scheduled') opts.scheduled = true;
     else if (arg.startsWith('-')) throw new Error(`unknown flag: ${arg}`);
     else opts.scope.push(arg);
   }
@@ -427,6 +431,7 @@ function parseAuditArgs(argv) {
   if (!PROFILES.includes(opts.profile)) throw new Error(`--profile must be one of ${PROFILES.join(', ')}`);
   if (opts.budget !== null && (!Number.isInteger(opts.budget) || opts.budget < 1 || opts.budget > 500)) throw new Error('--budget must be a whole number from 1 to 500');
   if (opts.timeoutMs !== null && (!Number.isFinite(opts.timeoutMs) || opts.timeoutMs < 10000)) throw new Error('--timeout is in seconds, at least 10');
+  if (opts.engine !== null && !['atris', 'local'].includes(opts.engine)) throw new Error('--engine must be atris or local');
   return opts;
 }
 
@@ -454,7 +459,7 @@ function renderAuditLanding({ dir, meta, records }) {
   } else {
     L.push(`  ${confirmed.length} confirmed${sevText ? ` (${sevText})` : ''} · ${needs.length} need a fact from you · ${rejected.length} disproved`);
     L.push(`  read ${cov.fresh} areas this run, ${cov.carried} carried unchanged, ${cov.deferred || 0} left for the next run`);
-    L.push(`  found by ${meta.engines.hunter}, checked by ${meta.engines.verifier}${meta.engines.hunter === meta.engines.verifier ? ' (same engine)' : ''} · ${meta.invocations.used} engine calls of ${meta.budget}`);
+    L.push(`  found by ${meta.engines.hunter}, checked by ${meta.engines.verifier}${meta.engines.hunter === meta.engines.verifier ? ' (same engine)' : ''} · ${meta.invocations.used} engine calls of ${meta.budget}${meta.credits_used ? ` · ${meta.credits_used} credits used` : ''}`);
     for (const r of confirmed.slice(0, 6)) {
       const sink = r.trace[r.trace.length - 1];
       L.push(`    ${r.severity.overall.padEnd(8)} ${r.title} (${sink.file}:${sink.line})`);
@@ -465,33 +470,215 @@ function renderAuditLanding({ dir, meta, records }) {
   return L.join('\n');
 }
 
-async function auditCommand(argv) {
+// Ask once on a terminal. Anything but y or yes is a no.
+function askYesNo(question, { input = process.stdin, output = process.stdout } = {}) {
+  return new Promise((resolve) => {
+    const rl = require('readline').createInterface({ input, output });
+    rl.question(question, (answer) => { rl.close(); resolve(/^\s*y(es)?\s*$/i.test(String(answer || ''))); });
+  });
+}
+
+async function uploadAfterRun(dir, { token, quiet, cloud }) {
+  const res = await cloud.uploadRun(dir, { token });
+  const say = quiet ? (m) => console.error(m) : (m) => console.log(m);
+  if (res.ok) say('  saved the summary to your atris account (no source code was sent)');
+  else say(`  warning: could not save the summary to your atris account: ${res.reason}. the review itself is done`);
+  return res;
+}
+
+async function auditUploadCommand(argv, deps) {
+  const audit = require('../lib/security-audit');
+  const cloud = deps.cloud || require('../lib/sentinel-cloud');
+  const token = deps.token !== undefined ? deps.token : cloud.authToken();
+  if (!token) { console.error('  log in first with atris login. then run atris sentinel upload again'); return 2; }
+  const arg = argv.find((a) => !a.startsWith('-'));
+  let dir = arg ? path.resolve(arg) : null;
+  if (!dir) {
+    const last = audit.latestRun(deps.root || process.cwd());
+    if (!last) { console.error('  no sentinel review has run for this repo yet'); return 2; }
+    dir = last.dir;
+  }
+  if (!fs.existsSync(path.join(dir, 'run-metadata.json'))) { console.error(`  ${tildePath(dir)} is not a sentinel run folder`); return 2; }
+  const res = await cloud.uploadRun(dir, { token });
+  if (!res.ok) { console.error(`  could not save ${path.basename(dir)}: ${res.reason}`); return 1; }
+  console.log(`  saved ${path.basename(dir)} to your atris account (no source code was sent)`);
+  return 0;
+}
+
+// Price one quick run on atris models for a folder without calling any
+// model: the audit plans, the estimate is quoted, and the plan is dropped.
+async function quoteQuickRun(target, { hunter, verifier, token, cloud }) {
+  const audit = require('../lib/security-audit');
+  let estimate = null;
+  await audit.runAudit({
+    root: target, profile: 'quick', hunter, verifier,
+    runJobs: async () => { throw new Error('no model call while pricing a schedule'); },
+    confirmSpend: async (est) => { estimate = est; return false; },
+  });
+  if (!estimate) throw new Error('could not plan a review for this folder');
+  return cloud.quoteEstimate(estimate, { token });
+}
+
+async function auditScheduleCommand(argv, deps) {
+  const cloud = deps.cloud || require('../lib/sentinel-cloud');
+  const { installKeep, removeKeep } = require('../lib/campaign-keep');
+  const uninstall = argv.includes('--uninstall');
+  let every = 'day';
+  let target = null;
+  let engine = null;
+  let maxCredits = null;
+  let yes = false;
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    const [flag, inline] = a.startsWith('--') && a.includes('=') ? [a.slice(0, a.indexOf('=')), a.slice(a.indexOf('=') + 1)] : [a, null];
+    const value = () => (inline !== null ? inline : argv[++i]);
+    if (flag === '--every') every = value();
+    else if (flag === '--engine') engine = value();
+    else if (flag === '--max-credits') maxCredits = Number(value());
+    else if (flag === '--yes' || flag === '-y') yes = true;
+    else if (flag === '--uninstall' || flag === '--install') continue;
+    else if (a.startsWith('-')) { console.error(`  unknown flag: ${a}`); return 2; }
+    else target = a;
+  }
+  if (!cloud.SCHEDULE_EVERY[every]) { console.error('  use --every day or --every week'); return 2; }
+  if (engine !== null && engine !== 'atris' && engine !== 'local') { console.error('  --engine must be atris or local'); return 2; }
+  if (maxCredits !== null && (!Number.isInteger(maxCredits) || maxCredits < 1)) { console.error('  --max-credits must be a whole number of credits, at least 1'); return 2; }
+  target = path.resolve(target || deps.root || process.cwd());
+  if (!fs.existsSync(target) || !fs.statSync(target).isDirectory()) { console.error(`  ${target} is not a folder`); return 2; }
+  const atrisBin = deps.atrisBin || path.resolve(__dirname, '..', 'bin', 'atris.js');
+  const plan = cloud.schedulePlan({ target, every, homeDir: deps.homeDir, platform: deps.platform, atrisBin, envPath: deps.envPath });
+  const keepDeps = deps.spawn ? { spawn: deps.spawn } : {};
+  if (uninstall) {
+    // Same folder makes the same timer name, so --every does not matter here.
+    const removed = removeKeep(plan, keepDeps);
+    if (!removed.ok) { console.error(`  could not remove the timer: ${removed.error}`); return 1; }
+    cloud.removeApproval(target, deps.homeDir);
+    console.log(`  scheduled reviews ${removed.removed === false ? 'were not on' : 'are off'} for ${tildePath(target)}`);
+    return 0;
+  }
+  const space = require('../lib/worktree-space');
+  if (!deps.atrisBin && (space.isAgentCopyPath(atrisBin) || space.isScratchPath(atrisBin))) {
+    console.error(`  refusing: this atris runs from ${path.dirname(path.dirname(atrisBin))}, a folder that gets removed. install the timer from a lasting atris install`);
+    return 2;
+  }
+
+  // The engine is decided now, with the owner here, and written down. A
+  // scheduled run never picks again.
+  const token = deps.token !== undefined ? deps.token : cloud.authToken();
+  let engines;
+  try { engines = cloud.resolveEngines({ engine, token, env: deps.env || process.env }); } catch (e) { console.error(`  ${e.message}`); return 2; }
+  let approval;
+  if (engines.mode === 'atris') {
+    let quote;
+    try { quote = await quoteQuickRun(target, { hunter: engines.hunter, verifier: engines.verifier, token, cloud }); } catch (e) { console.error(`  no timer was set. ${e.message}`); return 2; }
+    const cap = maxCredits || quote.credits;
+    console.log(`\n  each scheduled review runs on atris models (no codex or claude needed)`);
+    console.log(`  ${cloud.describeQuote(quote)}`);
+    console.log(`  each run may spend at most ${cap} credits, once a ${every}. a run that reaches that stops\n`);
+    if (!yes) {
+      const input = deps.input || process.stdin;
+      if (!input.isTTY && !deps.input) { console.error('  no timer was set. add --yes to approve this spend without the question'); return 1; }
+      const ok = await (deps.ask || askYesNo)(`  approve up to ${cap} credits per scheduled run? (y/N) `, { input, output: process.stdout });
+      if (!ok) { console.log('  no timer was set'); return 1; }
+    }
+    approval = { engine: 'atris', hunter: engines.hunter, verifier: engines.verifier, max_credits: cap, quoted_credits: quote.credits, every, approved_at: new Date().toISOString() };
+  } else {
+    approval = { engine: 'local', every, approved_at: new Date().toISOString() };
+  }
+  cloud.writeApproval(target, approval, deps.homeDir);
+  const installed = installKeep(plan, keepDeps);
+  if (!installed.ok) { cloud.removeApproval(target, deps.homeDir); console.error(`  could not install the timer: ${installed.error}`); return 1; }
+  console.log(`  scheduled reviews are on for ${tildePath(target)}, once a ${every}`);
+  console.log('  each run uses the quick profile and saves its summary to your atris account');
+  console.log('  each run also checks your agent setup and dependencies for free');
+  if (approval.engine === 'local') console.log('  runs use only codex and claude on this machine. they never switch to atris models');
+  else console.log(`  runs use atris models and stop at ${approval.max_credits} credits`);
+  console.log(`  log: ${tildePath(plan.log_path)}`);
+  console.log(`  stop with: atris sentinel schedule --uninstall ${tildePath(target)}`);
+  return 0;
+}
+
+async function auditCommand(argv, deps = {}) {
   if (argv[0] === 'help' || argv.includes('-h') || argv.includes('--help')) return printAuditHelp();
   const audit = require('../lib/security-audit');
+  const root = deps.root || process.cwd();
   if (argv[0] === 'status' || argv[0] === 'last') {
-    const last = audit.latestRun(process.cwd());
+    const last = audit.latestRun(root);
     if (!last || !last.meta) { console.log('\n  no sentinel audit has run for this repo yet\n'); return 0; }
     if (argv.includes('--json')) { console.log(JSON.stringify({ dir: last.dir, meta: last.meta, findings: last.records }, null, 2)); return 0; }
     console.log(renderAuditLanding({ dir: last.dir, meta: last.meta, records: last.records }));
     return 0;
   }
+  if (['agents', 'guard', 'watch', 'flush'].includes(argv[0])) {
+    const powers = require('./sentinel-powers');
+    const run = { agents: powers.agentsCommand, guard: powers.guardCommand, watch: powers.watchCommand, flush: powers.flushCommand }[argv[0]];
+    return run(argv.slice(1), deps);
+  }
+  if (argv[0] === 'upload') return auditUploadCommand(argv.slice(1), deps);
+  if (argv[0] === 'schedule') return auditScheduleCommand(argv.slice(1), deps);
   let opts;
   try { opts = parseAuditArgs(argv); } catch (e) { console.error(`security-review audit: ${e.message}`); return 2; }
+  const cloud = deps.cloud || require('../lib/sentinel-cloud');
+  // A timer run does only what the owner approved at install.
+  let capOverride = null;
+  if (opts.scheduled) {
+    const approval = cloud.readApproval(root, deps.homeDir);
+    if (!approval) { console.error('security-review audit: this folder has no approved schedule. nothing ran. run atris sentinel schedule again'); return 2; }
+    // The free checks run first, so a review that stops at its credit limit
+    // still leaves today's agent and dependency results.
+    try {
+      await require('./sentinel-powers').runScheduledFreeChecks(root, { ...deps, upload: opts.upload, log: opts.json ? (m) => console.error(m) : (m) => console.log(m) });
+    } catch (e) { console.error(`  warning: the free checks did not finish: ${e.message}`); }
+    opts.hunter = null;
+    opts.verifier = null;
+    opts.engine = approval.engine;
+    if (approval.engine === 'atris') { opts.yes = true; capOverride = Number(approval.max_credits); }
+  }
+  const token = deps.token !== undefined ? deps.token : cloud.authToken();
+  let engines;
+  try { engines = cloud.resolveEngines({ engine: opts.engine, hunter: opts.hunter, verifier: opts.verifier, token, env: deps.env || process.env }); } catch (e) { console.error(`security-review audit: ${e.message}`); return 2; }
+  const hunter = engines.hunter || undefined;
+  const verifier = engines.verifier || undefined;
+  const hosted = audit.isHostedEngine(hunter) || audit.isHostedEngine(verifier);
+  if (hosted && !token) { console.error('security-review audit: reviews on atris models need a login; run atris login first'); return 2; }
   const log = opts.json ? () => {} : (msg) => console.log(`  · ${msg}`);
+  const tell = opts.json ? (m) => console.error(m) : (m) => console.log(m);
+  if (hosted && engines.chosen === 'no_local_engine' && !opts.planOnly) tell('  no codex or claude found on this machine. this review runs on atris models');
+  let runJobs = deps.runJobs;
+  const spend = hosted ? cloud.spendGuard({ quoteCall: deps.quoteCall }) : null;
+  if (!runJobs && hosted) runJobs = cloud.atrisJobRunner({ token, spend });
+  const confirmSpend = async (estimate) => {
+    const quote = await cloud.quoteEstimate(estimate, { token });
+    spend.max = capOverride || quote.credits;
+    spend.limits = quote.limits;
+    tell(`\n  ${cloud.describeQuote(quote)}\n`);
+    if (capOverride) tell(`  this scheduled run may spend at most ${capOverride} credits, as approved`);
+    if (opts.yes) return true;
+    const input = deps.input || process.stdin;
+    if (!input.isTTY && !deps.input) { console.error('  nothing was spent. add --yes to run without this question'); return false; }
+    const yes = await (deps.ask || askYesNo)('  spend these credits? (y/N) ', { input, output: opts.json ? process.stderr : process.stdout });
+    if (!yes) tell('  nothing was spent');
+    return yes;
+  };
   let result;
   try {
     result = await audit.runAudit({
-      root: process.cwd(), profile: opts.profile, scope: opts.scope, budget: opts.budget ?? undefined, out: opts.out,
-      hunter: opts.hunter || undefined, verifier: opts.verifier || undefined, planOnly: opts.planOnly,
+      root, profile: opts.profile, scope: opts.scope, budget: opts.budget ?? undefined, out: opts.out,
+      hunter, verifier, planOnly: opts.planOnly, runJobs, confirmSpend,
       timeoutMs: opts.timeoutMs || undefined, log,
     });
   } catch (e) {
     console.error(`security-review audit: ${e.message}`);
     return 2;
   }
+  if (result.declined) return 1;
   const fail = audit.shouldFailAudit(result.records);
   if (opts.json) console.log(JSON.stringify({ ok: !fail, dir: result.dir, meta: result.meta, findings: result.records }, null, 2));
   else console.log(renderAuditLanding(result));
+  if (spend && spend.blocked) tell(`  stopped at the approved limit of ${spend.max} credits. ${spend.blocked} model call${spend.blocked === 1 ? '' : 's'} did not run and wait for the next run`);
+  if (opts.upload && token && !opts.planOnly) {
+    try { await uploadAfterRun(result.dir, { token, quiet: opts.json, cloud }); } catch (e) { tell(`  warning: could not save the summary to your atris account: ${e.message}. the review itself is done`); }
+  }
   return fail ? 1 : 0;
 }
 
@@ -510,6 +697,50 @@ function printAuditHelp() {
     atris security-review audit --out DIR       write the run here (outside the repo)
     atris security-review audit status          the last run's landing
 
+  on atris models (no other AI subscription needed, paid in atris credits):
+
+    atris sentinel --engine atris               atris:fast searches, atris:pro checks
+    atris sentinel --engine atris --yes         skip the price question
+    atris sentinel --engine local               only codex and claude on this machine
+
+  with no --engine, local engines run when codex or claude is installed.
+  atris models run only when neither is installed and you are logged in.
+  every run on atris models shows the most it can cost first and stops
+  before it could pass that. lines that look like secrets are hidden and
+  only tracked files inside the review are ever sent.
+
+  saving results to your atris account (on when you are logged in):
+
+    atris sentinel --no-upload                  keep this run on this machine only
+    atris sentinel upload [run-folder]          save a past run (default: the last one)
+
+  only the summary is saved: plain sentences, file:line locations and counts.
+  source code and code lines never leave in an upload.
+
+  free checks, no model and no credits:
+
+    atris sentinel agents [path]                check agent instructions, settings, hooks, mcp and skills
+    atris sentinel agents --home                also check ~/.claude and ~/.codex
+    atris sentinel watch [path]                 known attacks in your dependencies (osv database)
+    atris sentinel watch --fix                  update affected packages on a new branch, never pushed
+    atris sentinel guard install [--global]     stop risky agent commands before they run
+    atris sentinel guard test                   see which sample commands the guard stops
+
+  results go to your atris dashboard when you are logged in. add --no-upload
+  to keep them on this machine. secret values and file contents never leave.
+
+  reviews on a timer:
+
+    atris sentinel schedule --every day [path]  quick review once a day, saved to your account
+    atris sentinel schedule --every week [path] once a week
+    atris sentinel schedule --engine atris --max-credits 20
+                                                timed runs on atris models, at most 20 credits each
+    atris sentinel schedule --uninstall [path]  stop the timer
+
+  every timed run also runs the free agents and watch checks.
+  the engine is picked when the timer goes on. on atris models you see the
+  price and say yes then. a timed run never switches to atris models later.
+
   How it works: every source file x attack class with a reason to be read
   becomes an area in a coverage ledger. Read-only engine hunters each own a
   few areas. A coverage critic names gaps. Every candidate goes to a different
@@ -553,4 +784,4 @@ function printHelp() {
   return 0;
 }
 
-module.exports = { securityReviewCommand };
+module.exports = { securityReviewCommand, auditCommand };