atris 3.82.5 → 3.82.7

package/bin/atris.js

@@ -634,6 +634,8 @@ function showHelpAll() {
   console.log('  slop       - Deterministic slop detector: frontend/prose tells, dead code (slop dead --exports)');
   console.log('  sentinel   - Security audit: engines hunt for holes, a different model verifies each one');
   console.log('               free checks: sentinel agents, sentinel watch, sentinel guard install');
+  console.log('               exam and self-improvement: sentinel bench, sentinel improve');
+  console.log('               fix a confirmed finding on its own branch: sentinel fix <id>');
   console.log('               re-check old findings against today\'s code: sentinel recheck');
   console.log('  voice      - Scan binary voice tells or judge reply shape and plainness');
   console.log('  recover    - Explain stopped missions; --apply performs safe recovery only');

package/commands/security-review.js

@@ -747,6 +747,11 @@ async function auditCommand(argv, deps = {}) {
     const run = { agents: powers.agentsCommand, guard: powers.guardCommand, watch: powers.watchCommand, flush: powers.flushCommand }[argv[0]];
     return run(argv.slice(1), deps);
   }
+  if (argv[0] === 'bench' || argv[0] === 'improve') {
+    const sb = require('./sentinel-bench');
+    return (argv[0] === 'bench' ? sb.benchCommand : sb.improveCommand)(argv.slice(1), deps);
+  }
+  if (argv[0] === 'fix') return require('./sentinel-fix').fixCommand(argv.slice(1), deps);
   if (argv[0] === 'upload') return auditUploadCommand(argv.slice(1), deps);
   if (argv[0] === 'recheck') return auditRecheckCommand(argv.slice(1), deps);
   if (argv[0] === 'schedule') return auditScheduleCommand(argv.slice(1), deps);
@@ -860,6 +865,18 @@ function printAuditHelp() {
   results go to your atris dashboard when you are logged in. add --no-upload
   to keep them on this machine. secret values and file contents never leave.
 
+  the exam and the loop that improves the sentinel (in an atris checkout):
+
+    atris sentinel bench [--summary]            score the guard and agent check on a seen and a held-out half
+    atris sentinel improve [--engine claude]    one engine proposes a change, the exam decides if it stays
+    atris sentinel improve --schedule           run the improve loop nightly
+
+  turning a confirmed finding into a fix:
+
+    atris sentinel fix                          list confirmed findings you can fix
+    atris sentinel fix <id> [path]              smallest fix plus a regression test on a new branch
+    atris sentinel fix help                     how a fix is proved before it is committed
+
   reviews on a timer:
 
     atris sentinel schedule --every day [path]  quick review once a day, saved to your account

package/commands/sentinel-bench.js

@@ -0,0 +1,172 @@
+'use strict';
+
+// atris sentinel bench and atris sentinel improve.
+//
+//   atris sentinel bench [--summary] [--json] [--review] [--sets guard,agents]
+//   atris sentinel bench --split <file> --set guard|agents|review
+//   atris sentinel improve [--engine claude] [--offline] [--json]
+//   atris sentinel improve --schedule [--every 24] [--engine claude] | --unschedule
+
+const path = require('path');
+
+function readFlag(argv, name) {
+  const i = argv.indexOf(name);
+  if (i !== -1 && argv[i + 1] !== undefined && !String(argv[i + 1]).startsWith('--')) return argv[i + 1];
+  const inline = argv.find((a) => String(a).startsWith(`${name}=`));
+  return inline ? inline.slice(name.length + 1) : null;
+}
+
+function checkFlags(argv, flags, values) {
+  for (let i = 0; i < argv.length; i++) {
+    const a = String(argv[i]);
+    const name = a.split('=')[0];
+    if (values.includes(name)) { if (!a.includes('=')) i += 1; continue; }
+    if (flags.includes(a)) continue;
+    throw new Error(`unknown option: ${a}`);
+  }
+}
+
+function benchHelp() {
+  console.log(`
+  atris sentinel bench, a fixed exam for the sentinel
+
+    atris sentinel bench                 score the guard and the agent check
+    atris sentinel bench --summary       totals only, no item lines
+    atris sentinel bench --review        also run the review set on engines (costs engine time)
+    atris sentinel bench --json          raw numbers for scripts
+    atris sentinel bench --split <file> --set guard|agents|review
+                                         split new items into the seen half (in the repo)
+                                         and the sealed held-out half (on this machine).
+                                         the plaintext input is replaced with an encrypted copy
+
+  the seen half lives in atris/sentinel-bench. the held-out half lives in
+  ~/.atris/sentinel-holdout, encrypted with a key in your keychain. its
+  items are never printed. only lib/sentinel-rules.json of the checkout is
+  judged, always with this atris's own code. every number
+  is raw: attacks blocked, everyday commands wrongly blocked, problems
+  found, false alarms. there is no blended score.
+`);
+  return 0;
+}
+
+async function benchCommand(argv, deps = {}) {
+  if (argv.includes('--help') || argv.includes('-h') || argv[0] === 'help') return benchHelp();
+  try { checkFlags(argv, ['--summary', '--json', '--review'], ['--split', '--set', '--sets', '--target', '--seen', '--hunter', '--verifier', '--budget']); } catch (e) { console.error(`  ${e.message}`); return 2; }
+  const bench = require('../lib/sentinel-bench');
+  const env = deps.env || process.env;
+  const root = path.resolve(readFlag(argv, '--target') || deps.root || process.cwd());
+  const seenDir = path.resolve(readFlag(argv, '--seen') || bench.seenDirOf(root));
+  const holdoutDir = bench.defaultHoldoutDir(env);
+  const split = readFlag(argv, '--split');
+  if (split) {
+    const set = readFlag(argv, '--set');
+    if (!set) { console.error('  --split needs --set guard, agents or review'); return 2; }
+    let res;
+    try { res = bench.splitCorpus(path.resolve(split), set, { seenDir, holdoutDir, env }); } catch (e) { console.error(`  could not split: ${e.message}`); return 1; }
+    if (argv.includes('--json')) { console.log(JSON.stringify({ ok: true, ...res }, null, 2)); return 0; }
+    console.log(`\n  ${res.seen} items went to the seen half: ${path.relative(process.cwd(), res.seen_file) || res.seen_file}`);
+    console.log(`  ${res.holdout} items went to the held-out half on this machine`);
+    if (res.skipped) console.log(`  ${res.skipped} items were already in a half and were skipped`);
+    if (res.invalid) console.log(`  ${res.invalid} lines were not valid items and were skipped`);
+    console.log(`  the plaintext input was replaced with an encrypted copy at ${res.sealed_source}. no readable held-out item is left behind\n`);
+    return 0;
+  }
+  const review = argv.includes('--review');
+  const setsRaw = readFlag(argv, '--sets');
+  const sets = setsRaw ? setsRaw.split(',').map((s) => s.trim()).filter(Boolean) : ['guard', 'agents', ...(review ? ['review'] : [])];
+  const bad = sets.filter((s) => !bench.SETS.includes(s));
+  if (bad.length) { console.error(`  unknown set: ${bad.join(', ')}. use guard, agents or review`); return 2; }
+  const budget = readFlag(argv, '--budget');
+  const reviewOpts = review ? {
+    hunter: readFlag(argv, '--hunter') || 'codex',
+    verifier: readFlag(argv, '--verifier') || 'claude',
+    ...(budget ? { budget: Number(budget) } : {}),
+    log: argv.includes('--json') ? () => {} : (m) => console.error(`  ${m}`),
+    ...(deps.runJobs ? { runJobs: deps.runJobs } : {}),
+  } : null;
+  let report;
+  try { report = await bench.runBench({ target: root, seenDir, sets, review: reviewOpts, env }); } catch (e) { console.error(`  the exam did not run: ${e.message}`); return 1; }
+  const pub = bench.publicReport(report, { summary: argv.includes('--summary') });
+  if (argv.includes('--json')) console.log(JSON.stringify({ ok: true, ...pub }, null, 2));
+  else console.log(bench.renderReport(pub, { holdoutDir: holdoutDir.replace(require('os').homedir(), '~') }));
+  return 0;
+}
+
+function improveHelp() {
+  console.log(`
+  atris sentinel improve, one exam-checked change to the sentinel
+
+    atris sentinel improve [--engine claude]   propose one change and judge it
+    atris sentinel improve --offline           skip the published advisory lookup
+    atris sentinel improve --schedule [--every 24] [--engine claude]
+                                               run it on a timer, nightly by default
+    atris sentinel improve --unschedule        turn the timer off
+
+  claude proposes one change to lib/sentinel-rules.json on a new branch,
+  sealed off from the held-out exam. the sentinel bench, fixed code with no
+  model, scores it before and after. it is kept only when
+  held-out attack catch holds or rises, wrong blocks and false alarms do
+  not rise and no seen item that passed now fails. a kept change waits on
+  its branch for you. nothing is merged, pushed or released.
+`);
+  return 0;
+}
+
+async function improveCommand(argv, deps = {}) {
+  if (argv.includes('--help') || argv.includes('-h') || argv[0] === 'help') return improveHelp();
+  try { checkFlags(argv, ['--json', '--offline', '--schedule', '--unschedule'], ['--engine', '--every']); } catch (e) { console.error(`  ${e.message}`); return 2; }
+  const improve = require('../lib/sentinel-improve');
+  const env = deps.env || process.env;
+  const engine = readFlag(argv, '--engine') || 'claude';
+  if (!/^[a-z][a-z0-9:_-]{0,30}$/.test(engine)) { console.error(`  unknown engine: ${engine}`); return 2; }
+  const refused = require('../lib/sentinel-improve').refusedEngine(engine);
+  if (refused && !argv.includes('--unschedule')) { console.error(`  ${refused}`); return 2; }
+  const root = deps.root || process.cwd();
+  if (argv.includes('--schedule') || argv.includes('--unschedule')) {
+    const { installKeep, removeKeep } = require('../lib/campaign-keep');
+    const everyHours = Number(readFlag(argv, '--every') || 24);
+    if (!Number.isFinite(everyHours) || everyHours <= 0) { console.error('  --every needs a number of hours'); return 2; }
+    let top;
+    try { top = require('child_process').execFileSync('git', ['rev-parse', '--show-toplevel'], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim(); } catch { console.error('  run this inside the atris checkout the loop should improve'); return 2; }
+    const plan = improve.schedulePlan({ root: top, engine, everyHours, env, atrisBin: deps.atrisBin });
+    if (argv.includes('--unschedule')) {
+      const removed = (deps.removeKeep || removeKeep)(plan);
+      if (!removed.ok) { console.error(`  could not turn the timer off: ${removed.error}`); return 1; }
+      console.log(`  sentinel improve timer: ${removed.removed === false ? 'was not on' : 'off'} for ${top}`);
+      return 0;
+    }
+    const space = require('../lib/worktree-space');
+    const bin = deps.atrisBin || path.join(__dirname, '..', 'bin', 'atris.js');
+    if (!deps.atrisBin && (space.isAgentCopyPath(bin) || space.isScratchPath(bin) || space.isAgentCopyPath(top))) {
+      console.error('  refusing: this atris or this checkout lives in a folder that gets removed. install the timer from a lasting checkout');
+      return 2;
+    }
+    const installed = (deps.installKeep || installKeep)(plan);
+    if (!installed.ok) { console.error(`  could not turn the timer on: ${installed.error}`); return 1; }
+    console.log(`  sentinel improve timer: on for ${top}, every ${everyHours} ${everyHours === 1 ? 'hour' : 'hours'} with ${engine}`);
+    console.log(`  log: ${plan.log_path}`);
+    console.log('  each run leaves a receipt in ~/.atris/sentinel-improve/receipts. kept changes wait on their branch for you');
+    return 0;
+  }
+  let res;
+  try {
+    res = await improve.improve({ root, engine, env, offline: argv.includes('--offline'), log: argv.includes('--json') ? () => {} : (m) => console.log(`  ${m}`), ...(deps.improveOpts || {}) });
+  } catch (e) { console.error(`  improve did not run: ${e.message}`); return 1; }
+  if (argv.includes('--json')) {
+    console.log(JSON.stringify({ ok: !res.error, kept: res.kept, branch: res.branch, error: res.error || null, decision: res.decision, receipt: res.receipt }, null, 2));
+    return res.error ? 1 : 0;
+  }
+  console.log('');
+  if (res.error) console.log(`  stopped: ${res.error}`);
+  else if (res.kept) console.log(`  kept. the change waits on branch ${res.branch} for your review`);
+  else console.log('  rejected. the branch was removed');
+  if (res.decision) {
+    for (const g of res.decision.gains) console.log(`  gain: ${g}`);
+    for (const n of res.decision.notes || []) console.log(`  note: ${n}`);
+    for (const r of res.decision.reasons) console.log(`  stop: ${r}`);
+  }
+  console.log(`  receipt: ${res.receipt.replace(require('os').homedir(), '~')}\n`);
+  return res.error ? 1 : 0;
+}
+
+module.exports = { benchCommand, improveCommand };

package/commands/sentinel-fix.js

@@ -0,0 +1,243 @@
+'use strict';
+
+// atris sentinel fix [finding-id|--all-open] [path]
+//
+// Turns a confirmed sentinel finding into a reviewed fix on its own branch.
+// The work lives in lib/sentinel-fix.js; this file reads flags, prices atris
+// model calls before any spend, prints the landing and sends one event.
+
+const fs = require('fs');
+const path = require('path');
+
+function tildePath(p, home = require('os').homedir()) {
+  return p && p.startsWith(home) ? `~${p.slice(home.length)}` : p;
+}
+
+function parseFixArgs(argv) {
+  const opts = { positionals: [], allOpen: false, verify: null, builder: null, verifier: null, engine: null, yes: false, pr: false, upload: true, timeoutMs: null };
+  const takes = (i, flag) => {
+    if (argv[i + 1] === undefined || argv[i + 1].startsWith('--')) throw new Error(`${flag} needs a value`);
+    return argv[i + 1];
+  };
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    const [flag, inline] = arg.startsWith('--') && arg.includes('=') ? [arg.slice(0, arg.indexOf('=')), arg.slice(arg.indexOf('=') + 1)] : [arg, null];
+    const value = () => (inline !== null ? inline : takes(i++, flag));
+    if (flag === '--all-open') opts.allOpen = true;
+    else if (flag === '--verify') opts.verify = value();
+    else if (flag === '--builder') opts.builder = value();
+    else if (flag === '--verifier') opts.verifier = value();
+    else if (flag === '--engine') opts.engine = value();
+    else if (flag === '--yes' || flag === '-y') opts.yes = true;
+    else if (flag === '--pr') opts.pr = true;
+    else if (flag === '--no-upload') opts.upload = false;
+    else if (flag === '--timeout') opts.timeoutMs = Number(value()) * 1000;
+    else if (arg.startsWith('-')) throw new Error(`unknown flag: ${arg}`);
+    else opts.positionals.push(arg);
+  }
+  if (opts.engine !== null && !['atris', 'local'].includes(opts.engine)) throw new Error('--engine must be atris or local');
+  if (opts.timeoutMs !== null && (!Number.isFinite(opts.timeoutMs) || opts.timeoutMs < 10000)) throw new Error('--timeout is in seconds, at least 10');
+  if (opts.verify !== null && !opts.verify.trim()) throw new Error('--verify needs a command');
+  // fix <id> <path>, fix <path>, fix <id>, fix --all-open <path>
+  const [a, b] = opts.positionals;
+  if (opts.positionals.length > 2) throw new Error('give at most a finding id and a path');
+  if (opts.allOpen) {
+    if (opts.positionals.length > 1) throw new Error('--all-open takes only a path');
+    opts.path = a || null;
+  } else if (opts.positionals.length === 2) {
+    opts.id = a;
+    opts.path = b;
+  } else if (a !== undefined) {
+    let isDir = false;
+    try { isDir = fs.statSync(a).isDirectory(); } catch {}
+    if (isDir) opts.path = a; else opts.id = a;
+  }
+  return opts;
+}
+
+function printFixHelp() {
+  console.log(`
+  atris sentinel fix, a reviewed fix for a confirmed finding
+
+    atris sentinel fix                       list confirmed findings you can fix
+    atris sentinel fix <id> [path]           fix one finding on its own branch
+    atris sentinel fix --all-open [path]     fix every finding with no fix branch yet
+    atris sentinel fix <id> --verify "make test"
+                                             run this test command (default: npm test,
+                                             pytest or go test, whichever the repo uses)
+    atris sentinel fix <id> --builder claude --verifier codex
+                                             which engine writes the fix and which checks it
+    atris sentinel fix <id> --engine atris   atris models write and check, after a price
+    atris sentinel fix <id> --pr             push the branch and open a pull request
+
+  it needs a clean working tree. the fix is built in a temp copy on a new
+  branch named sentinel/fix-<id> made from the branch you are on. your own
+  checkout and branch are never changed. nothing is merged. nothing is
+  pushed unless you add --pr.
+
+  builder and checker may be codex, claude or an atris model. atris models
+  always show a price and wait for a yes.
+
+  a fix is committed only when all three hold:
+    the new test fails on the old code
+    the full test suite passes with the fix
+    a second engine reads the fixed source and finds the attack no longer works
+
+  the new test must fail on a real failed check. a missing module, a syntax
+  error or a timeout does not count. otherwise nothing is committed and the
+  attempt is saved as a patch under ~/.atris/sentinel/fixes.
+
+  the new tests run with a temp home, no tokens or keys in the environment
+  and push turned off for the temp copy. they still run as you and are not a
+  sandbox. read the new test before you run it on code you do not trust.
+`);
+  return 0;
+}
+
+function askYesNo(question, { input = process.stdin, output = process.stdout } = {}) {
+  return new Promise((resolve) => {
+    const rl = require('readline').createInterface({ input, output });
+    rl.question(question, (answer) => { rl.close(); resolve(/^\s*y(es)?\s*$/i.test(String(answer || ''))); });
+  });
+}
+
+function sevOf(r) {
+  return (r.severity && r.severity.overall) || 'unrated';
+}
+
+async function fixCommand(argv, deps = {}) {
+  if (argv[0] === 'help' || argv.includes('--help') || argv.includes('-h')) return printFixHelp();
+  const fix = deps.fixLib || require('../lib/sentinel-fix');
+  const env = deps.env || process.env;
+  let opts;
+  try { opts = parseFixArgs(argv); } catch (e) { console.error(`  ${e.message}`); return 2; }
+
+  const start = path.resolve(opts.path || deps.root || process.cwd());
+  const top = fix.git(start, ['rev-parse', '--show-toplevel'], { allowFail: true });
+  if (!top) { console.error(`  ${tildePath(start)} is not a git repository. a fix needs a branch to go on`); return 2; }
+  const root = top;
+
+  const { records } = fix.confirmedFindings(root);
+  if (!records.length) { console.log('\n  no confirmed findings for this repository. run atris sentinel first\n'); return 0; }
+
+  if (!opts.id && !opts.allOpen) {
+    console.log('\n  confirmed findings you can fix\n');
+    for (const r of records) {
+      const has = fix.branchExists(root, fix.branchFor(r));
+      console.log(`  ${fix.shortId(r.fingerprint)}  ${sevOf(r).padEnd(8)}  ${r.title}${has ? '  (fix branch exists)' : ''}`);
+    }
+    console.log(`\n  fix one with: atris sentinel fix ${fix.shortId(records[0].fingerprint)}\n`);
+    return 0;
+  }
+
+  let targets;
+  if (opts.allOpen) {
+    targets = records.filter((r) => !fix.branchExists(root, fix.branchFor(r)));
+    if (!targets.length) { console.log('\n  every confirmed finding already has a fix branch\n'); return 0; }
+  } else {
+    const r = fix.matchFinding(records, opts.id);
+    if (!r) { console.error(`  no confirmed finding matches ${opts.id}. run atris sentinel fix to list them`); return 2; }
+    targets = [r];
+  }
+
+  if (fix.changedPaths(root).length) { console.error('  this repository has uncommitted changes. commit or stash them first so the fix branch holds only the fix'); return 2; }
+  const from = fix.git(root, ['rev-parse', '--abbrev-ref', 'HEAD'], { allowFail: true });
+  if (!from || from === 'HEAD') { console.error('  check out a branch first. a fix branch is made from the branch you are on'); return 2; }
+
+  const testCommand = opts.verify || fix.detectTestCommand(root);
+  if (!testCommand) { console.error('  no test command found. name one with --verify "<command>"'); return 2; }
+
+  let engines;
+  try { engines = fix.resolveFixEngines({ engine: opts.engine, builder: opts.builder, verifier: opts.verifier, env, available: deps.available }); } catch (e) { console.error(`  ${e.message}`); return 2; }
+
+  const cloud = deps.cloud || require('../lib/sentinel-cloud');
+  const hosted = fix.isHosted(engines.builder) || fix.isHosted(engines.verifier);
+  const token = deps.token !== undefined ? deps.token : cloud.authToken();
+  let hostedRun = deps.hostedRun || null;
+  let allowed = new Set();
+  if (hosted) {
+    if (!token) { console.error('  fixes on atris models need a login. run atris login first'); return 2; }
+    allowed = require('../lib/security-audit').hostedAllowedFiles(root, []);
+    const rows = [];
+    if (fix.isHosted(engines.builder)) {
+      const sizes = targets.map((r) => Buffer.byteLength(fix.builderPrompt(r, { testCommand, hosted: true, fileList: [...allowed].slice(0, 400), source: fix.hostedSourceBlock(root, fix.citedFiles(r), allowed, 64 * 1024) })));
+      const max = Math.max(4096, ...sizes) + 1024;
+      rows.push({ role: 'builder', model: engines.builder, calls: targets.length, input_tokens: max, output_tokens: fix.HOSTED_OUTPUT_TOKENS.builder, max_input_bytes: max });
+    }
+    if (fix.isHosted(engines.verifier)) rows.push({ role: 'verifier', model: engines.verifier, calls: targets.length, input_tokens: fix.HOSTED_CHECK_MAX_BYTES, output_tokens: fix.HOSTED_OUTPUT_TOKENS.verifier, max_input_bytes: fix.HOSTED_CHECK_MAX_BYTES });
+    let quote;
+    try { quote = await cloud.quoteEstimate({ calls: rows }, { token }); } catch (e) { console.error(`  nothing was spent. ${e.message}`); return 2; }
+    console.log(`\n  ${cloud.describeQuote(quote).replace(/^this review/, 'this fix')}\n`);
+    let yes = opts.yes;
+    if (!yes) {
+      const input = deps.input || process.stdin;
+      if (!input.isTTY && !deps.input) { console.error('  nothing was spent. add --yes to run without this question'); return 1; }
+      yes = await (deps.ask || askYesNo)('  spend these credits? (y/N) ', { input, output: process.stdout });
+      if (!yes) { console.log('  nothing was spent'); return 1; }
+    }
+    if (!hostedRun) {
+      const spend = cloud.spendGuard({ quoteCall: deps.quoteCall });
+      spend.max = quote.credits;
+      spend.limits = quote.limits;
+      const runner = cloud.atrisJobRunner({ token, spend });
+      hostedRun = (jobs) => runner(jobs, { root, concurrency: 1, timeoutMs: opts.timeoutMs || 20 * 60 * 1000 });
+    }
+  }
+
+  const log = deps.log || ((m) => console.log(`  · ${m}`));
+  const ctx = {
+    from,
+    testCommand,
+    engines,
+    env,
+    allowed,
+    hostedRun,
+    runBuilder: deps.runBuilder || fix.defaultRunBuilder,
+    runChecker: deps.runChecker || fix.defaultRunChecker,
+    timeouts: { build: opts.timeoutMs || 20 * 60 * 1000, check: opts.timeoutMs || 10 * 60 * 1000, test: 20 * 60 * 1000 },
+    log,
+  };
+
+  console.log(`\n  ◉ sentinel fix · ${engines.builder} writes the fix · ${engines.verifier} checks it · tests: ${testCommand}`);
+  const results = [];
+  for (const record of targets) {
+    console.log(`\n  ${fix.shortId(record.fingerprint)} · ${record.title}`);
+    const res = await fix.fixOne(root, record, ctx);
+    results.push({ record, res });
+    if (res.ok) {
+      console.log(`  prepared a fix on a new branch: ${res.branch}`);
+      console.log(`  the new test failed on the old code and passes with the fix. the full test suite passes. ${engines.verifier} checked from source that the attack no longer works`);
+      console.log(`  review it with: git diff ${from}...${res.branch}`);
+      if (opts.pr) {
+        const pr = fix.openPr(root, res, record, { run: deps.run, verifier: engines.verifier });
+        res.pr = pr;
+        if (pr.ok) console.log(`  opened a pull request${pr.url ? `: ${pr.url}` : ''}. nothing was merged`);
+        else console.log(`  no pull request was opened: ${pr.reason}${pr.pushed ? '' : '. nothing was pushed'}`);
+      } else {
+        console.log('  nothing was pushed');
+      }
+    } else {
+      console.log(`  no fix was committed: ${res.reason}`);
+      if (res.branch === null || res.branch === undefined) console.log(`  you are on ${from}${res.patch ? `. the attempt is saved at ${tildePath(res.patch, env.HOME || undefined)}` : ''}`);
+    }
+  }
+
+  const done = results.filter((x) => x.res.ok);
+  if (done.length) {
+    const events = require('../lib/sentinel-events');
+    let upload;
+    if (!opts.upload) upload = { skipped: 'no-upload' };
+    else if (!token) upload = { skipped: 'not-logged-in' };
+    else {
+      try { upload = await events.postEvents(done.map((x) => fix.fixEvent(root, x.record, x.res)), { token, base: deps.base }); } catch (e) { upload = { ok: false, reason: e.message }; }
+    }
+    if (upload.skipped === 'no-upload') console.log('\n  kept on this machine. nothing was sent (--no-upload)');
+    else if (upload.skipped === 'not-logged-in') console.log('\n  not logged in. nothing was sent to your dashboard');
+    else if (!upload.ok) console.log(`\n  warning: could not tell your atris dashboard: ${upload.reason}. the fix itself is done`);
+    else console.log('\n  told your atris dashboard. no code was sent');
+  }
+  console.log('');
+  return results.every((x) => x.res.ok) ? 0 : 1;
+}
+
+module.exports = { fixCommand, parseFixArgs };

package/lib/security-audit.js

@@ -2233,6 +2233,9 @@ module.exports = {
   runRecheck,
   isHostedEngine,
   hostedAllowedFiles,
+  sensitiveFile,
+  isRepoRel,
+  TEST_PATH,
   latestRun,
   repoName,
   shouldFailAudit,

package/lib/sentinel-agents.js

@@ -27,6 +27,60 @@ const AREA_LABEL = {
   mcp: 'mcp servers',
   hidden: 'hidden instructions',
 };
+// The hand-written regular expressions below stay in code, out of the
+// proposer's reach. The rules file (the agents part) holds only literal
+// supplements the proposer may extend: extra override substrings (matched
+// lowercase with plain includes) and extra secret environment names. They
+// are data, never code. They are matched with string operations.
+const RULES_FILE = path.join(__dirname, 'sentinel-rules.json');
+
+const SECRET_KEY_NAME = /(?:^|_|-)(?:api[_-]?key|key|token|secret|password|passwd|pat|credential|credentials|auth)(?:$|_|-)/i;
+const DOWNLOAD = '(?:curl|wget|fetch|iwr|Invoke-WebRequest|irm|Invoke-RestMethod)\\b';
+const DOWNLOAD_RUN = [
+  new RegExp(`${DOWNLOAD}[^\\n|;&]*\\|\\s*(?:sudo\\s+)?(?:env\\s+)?(?:ba|z|da|k|fi)?sh\\b`, 'i'),
+  new RegExp(`${DOWNLOAD}[^\\n|;&]*\\|\\s*(?:sudo\\s+)?(?:python[0-9.]*|node|perl|ruby|php|iex|Invoke-Expression)\\b`, 'i'),
+  new RegExp(`(?:ba|z|k)?sh\\s+<\\(\\s*${DOWNLOAD}`, 'i'),
+  new RegExp(`(?:ba|z|k)?sh\\s+-c\\s+["']?\\$\\(\\s*${DOWNLOAD}`, 'i'),
+  new RegExp(`source\\s+<\\(\\s*${DOWNLOAD}`, 'i'),
+];
+const EVAL_FETCHED = [
+  new RegExp(`\\beval\\s+["']?\\$\\(\\s*${DOWNLOAD}`, 'i'),
+  new RegExp(`\\beval\\s+["']?\`\\s*${DOWNLOAD}`, 'i'),
+  /\beval\s*\(\s*(?:await\s+)?\(?\s*(?:await\s+)?fetch\s*\(/i,
+  /\bexec\s*\(\s*(?:urllib\.request\.)?urlopen\s*\(/i,
+  /\bexec\s*\(\s*requests\.get\s*\(/i,
+];
+const SKIP_FLAGS = /(?:^|\s)(?:--dangerously-skip-permissions|--dangerously-bypass-approvals-and-sandbox|--yolo|--permission-mode[ =]bypassPermissions|--approval-mode[ =]yolo|--allow-dangerously-skip-permissions)(?=\s|$|["'])/;
+const OVERRIDE = [
+  /\b(?:ignore|disregard|forget|override|bypass)\s+(?:all\s+|any\s+|every\s+)?(?:of\s+)?(?:the\s+|your\s+|my\s+)?(?:previous|prior|above|earlier|preceding|original|system|other)\s+(?:instructions?|prompts?|rules|directions|guidelines|messages)\b/i,
+  /\byou\s+are\s+now\s+(?:in\s+)?(?:developer|dan|jailbreak|god)\s+mode\b/i,
+  /\b(?:do\s+not|don't|never)\s+(?:tell|inform|show)\s+the\s+user\s+(?:about|that|what|anything|this|you\b|we\b)/i,
+  /\b(?:do\s+not|don't|never)\s+mention\s+(?:this|it)\s+to\s+the\s+user\b/i,
+  /\bwithout\s+(?:telling|informing|alerting)\s+the\s+user\b/i,
+  /\bhide\s+this\s+from\s+the\s+user\b/i,
+  /\bnew\s+system\s+prompt\s*:/i,
+];
+const COMMENT_DIRECTIVE = /\b(?:ignore\s+(?:the|all|any|previous|prior|above)|disregard|secretly|silently|do\s+not\s+tell|don't\s+tell|without\s+telling|curl|wget|exfiltrate|send\s+(?:the|all|any|your)\s+\w+\s+to|system\s+prompt|you\s+are\s+(?:now|an?|the)|you\s+must|always\s+run|run\s+the\s+following|execute\s+(?:the|this))\b/i;
+
+// The literal supplements from the rules file. A proposer may add plain
+// phrases and names here; the checks below match them with string ops.
+function compileRules(raw) {
+  const a = (raw && raw.agents) || {};
+  const list = (v, name) => { if (v === undefined) return []; if (!Array.isArray(v) || v.some((x) => typeof x !== 'string')) throw new Error(`rules: agents.${name} must be a list of strings`); return v; };
+  return {
+    overrideSubstrings: list(a.override_substrings, 'override_substrings').map((x) => x.toLowerCase()),
+    secretEnvNames: new Set(list(a.secret_env_names, 'secret_env_names')),
+  };
+}
+
+let DEFAULT_RULES = null;
+let ACTIVE_RULES = null;
+function R() {
+  if (ACTIVE_RULES) return ACTIVE_RULES;
+  if (!DEFAULT_RULES) DEFAULT_RULES = compileRules(JSON.parse(fs.readFileSync(RULES_FILE, 'utf8')));
+  return DEFAULT_RULES;
+}
+
 const MAX_FILE_BYTES = 512 * 1024;
 const MAX_FILES = 4000;
 const SKIP_DIRS = new Set(['node_modules', '.git', '__pycache__', '.venv', 'venv', 'dist', 'build', '.trash', '.Trash']);
@@ -158,7 +212,6 @@ function secretHits(text) {
 // "API_KEY": "abc..." in JSON, and API_KEY = "abc..." in TOML. Only keys
 // whose name says secret, and only values that look real (not $VAR, not a
 // placeholder, not short).
-const SECRET_KEY_NAME = /(?:^|_|-)(?:api[_-]?key|key|token|secret|password|passwd|pat|credential|credentials|auth)(?:$|_|-)/i;
 function envBlockHits(text) {
   let scan;
   try { scan = require('./security-scan'); } catch { return []; }
@@ -167,7 +220,7 @@ function envBlockHits(text) {
   let m;
   while ((m = re.exec(text))) {
     const [, key, value] = m;
-    if (!SECRET_KEY_NAME.test(key)) continue;
+    if (!SECRET_KEY_NAME.test(key) && !R().secretEnvNames.has(key)) continue;
     if (/^\$|\$\{|^<|^\{\{|^env:|^op:\/\/|^\/|^~|^https?:\/\//i.test(value)) continue;
     if (/\s/.test(value)) continue;
     const q = scan.secretQuality(value, {}, m[0]);
@@ -179,21 +232,6 @@ function envBlockHits(text) {
 
 // Download piped into a shell or interpreter, process substitution of a
 // download, and eval of fetched content.
-const DOWNLOAD = '(?:curl|wget|fetch|iwr|Invoke-WebRequest|irm|Invoke-RestMethod)\\b';
-const DOWNLOAD_RUN = [
-  new RegExp(`${DOWNLOAD}[^\\n|;&]*\\|\\s*(?:sudo\\s+)?(?:env\\s+)?(?:ba|z|da|k|fi)?sh\\b`, 'i'),
-  new RegExp(`${DOWNLOAD}[^\\n|;&]*\\|\\s*(?:sudo\\s+)?(?:python[0-9.]*|node|perl|ruby|php|iex|Invoke-Expression)\\b`, 'i'),
-  new RegExp(`(?:ba|z|k)?sh\\s+<\\(\\s*${DOWNLOAD}`, 'i'),
-  new RegExp(`(?:ba|z|k)?sh\\s+-c\\s+["']?\\$\\(\\s*${DOWNLOAD}`, 'i'),
-  new RegExp(`source\\s+<\\(\\s*${DOWNLOAD}`, 'i'),
-];
-const EVAL_FETCHED = [
-  new RegExp(`\\beval\\s+["']?\\$\\(\\s*${DOWNLOAD}`, 'i'),
-  new RegExp(`\\beval\\s+["']?\`\\s*${DOWNLOAD}`, 'i'),
-  /\beval\s*\(\s*(?:await\s+)?\(?\s*(?:await\s+)?fetch\s*\(/i,
-  /\bexec\s*\(\s*(?:urllib\.request\.)?urlopen\s*\(/i,
-  /\bexec\s*\(\s*requests\.get\s*\(/i,
-];
 
 function downloadRunHits(text) {
   const out = [];
@@ -205,7 +243,6 @@ function downloadRunHits(text) {
   return out;
 }
 
-const SKIP_FLAGS = /(?:^|\s)(?:--dangerously-skip-permissions|--dangerously-bypass-approvals-and-sandbox|--yolo|--permission-mode[ =]bypassPermissions|--approval-mode[ =]yolo|--allow-dangerously-skip-permissions)(?=\s|$|["'])/;
 
 function flagHits(text) {
   const out = [];
@@ -239,36 +276,23 @@ function invisibleHits(text) {
   return out;
 }
 
-const OVERRIDE = [
-  /\b(?:ignore|disregard|forget|override|bypass)\s+(?:all\s+|any\s+|every\s+)?(?:of\s+)?(?:the\s+|your\s+|my\s+)?(?:previous|prior|above|earlier|preceding|original|system|other)\s+(?:instructions?|prompts?|rules|directions|guidelines|messages)\b/i,
-  /\byou\s+are\s+now\s+(?:in\s+)?(?:developer|dan|jailbreak|god)\s+mode\b/i,
-  // Secrecy, not ordinary guidance: "do not tell the user about this", but
-  // not "do not tell the user to restart".
-  /\b(?:do\s+not|don't|never)\s+(?:tell|inform|show)\s+the\s+user\s+(?:about|that|what|anything|this|you\b|we\b)/i,
-  /\b(?:do\s+not|don't|never)\s+mention\s+(?:this|it)\s+to\s+the\s+user\b/i,
-  /\bwithout\s+(?:telling|informing|alerting)\s+the\s+user\b/i,
-  /\bhide\s+this\s+from\s+the\s+user\b/i,
-  /\bnew\s+system\s+prompt\s*:/i,
-];
 
 function overrideHits(text) {
   const out = [];
+  const extra = R().overrideSubstrings;
   text.split('\n').forEach((line, i) => {
-    for (const re of OVERRIDE) {
-      const m = line.match(re);
-      if (!m) continue;
-      // Quoted or in code: a doc about prompt attacks, most likely.
-      const at = m.index;
-      const before = line.slice(0, at);
-      const quoted = /["'`“‘]\s*$/.test(before) || (before.split('`').length % 2 === 0) || /^\s*>/.test(line);
-      out.push({ line: i + 1, rule: quoted ? 'override-phrase-quoted' : 'override-phrase' });
-      break;
-    }
+    let at = -1;
+    for (const re of OVERRIDE) { const m = line.match(re); if (m) { at = m.index; break; } }
+    if (at === -1 && extra.length) { const low = line.toLowerCase(); for (const sub of extra) { const k = low.indexOf(sub); if (k !== -1) { at = k; break; } } }
+    if (at === -1) return;
+    // Quoted or in code: a doc about prompt attacks, most likely.
+    const before = line.slice(0, at);
+    const quoted = /["'`“‘]\s*$/.test(before) || (before.split('`').length % 2 === 0) || /^\s*>/.test(line);
+    out.push({ line: i + 1, rule: quoted ? 'override-phrase-quoted' : 'override-phrase' });
   });
   return out;
 }
 
-const COMMENT_DIRECTIVE = /\b(?:ignore\s+(?:the|all|any|previous|prior|above)|disregard|secretly|silently|do\s+not\s+tell|don't\s+tell|without\s+telling|curl|wget|exfiltrate|send\s+(?:the|all|any|your)\s+\w+\s+to|system\s+prompt|you\s+are\s+(?:now|an?|the)|you\s+must|always\s+run|run\s+the\s+following|execute\s+(?:the|this))\b/i;
 function hiddenCommentHits(text) {
   const out = [];
   // Comments inside fenced code blocks are examples, not hidden text.
@@ -500,7 +524,15 @@ function grade(findings) {
   return 'pass';
 }
 
-function runAgentCheck(root, { home = false, homeDir = os.homedir() } = {}) {
+// rules: a rules object to judge instead of the file beside this one.
+function runAgentCheck(root, { home = false, homeDir = os.homedir(), rules = null } = {}) {
+  if (!rules) return runAgentCheckWith(root, { home, homeDir });
+  const prev = ACTIVE_RULES;
+  ACTIVE_RULES = compileRules(rules);
+  try { return runAgentCheckWith(root, { home, homeDir }); } finally { ACTIVE_RULES = prev; }
+}
+
+function runAgentCheckWith(root, { home, homeDir }) {
   const targets = collectTargets(root, { home, homeDir });
   const findings = [];
   for (const t of targets) {
@@ -576,6 +608,8 @@ function renderReport(result, { color = false } = {}) {
 }
 
 module.exports = {
+  compileRules,
+  RULES_FILE,
   RULES,
   checkFile,
   runAgentCheck,