atris 3.82.5 → 3.82.8

package/bin/atris.js

@@ -144,7 +144,8 @@ const jsonRequested = process.argv.slice(2).includes('--json');
 const dryRunRequested = updateArgs.includes('--dry-run');
 const skipUpdateCheck = Boolean(process.env.ATRIS_SKIP_UPDATE_CHECK || process.env.NO_UPDATE_NOTIFIER || helpRequested || jsonRequested);
 // Local-only commands make no registry call and start no background install.
-if (!skipUpdateCheck && (!updateCommand || (updateCommand && !['version', 'update', 'mcp', 'recap', '99'].includes(updateCommand)))) {
+// sentinel prints its own one-line notice at the end of the run instead.
+if (!skipUpdateCheck && (!updateCommand || (updateCommand && !['version', 'update', 'mcp', 'recap', '99', 'sentinel'].includes(updateCommand)))) {
   updateCheckPromise = checkForUpdates()
     .then((updateInfo) => {
       if (updateInfo) {
@@ -634,6 +635,8 @@ function showHelpAll() {
   console.log('  slop       - Deterministic slop detector: frontend/prose tells, dead code (slop dead --exports)');
   console.log('  sentinel   - Security audit: engines hunt for holes, a different model verifies each one');
   console.log('               free checks: sentinel agents, sentinel watch, sentinel guard install');
+  console.log('               exam and self-improvement: sentinel bench, sentinel improve');
+  console.log('               fix a confirmed finding on its own branch: sentinel fix <id>');
   console.log('               re-check old findings against today\'s code: sentinel recheck');
   console.log('  voice      - Scan binary voice tells or judge reply shape and plainness');
   console.log('  recover    - Explain stopped missions; --apply performs safe recovery only');
@@ -3376,8 +3379,10 @@ if (command === 'guide') {
     .catch((err) => { console.error(`\n✗ Error: ${err.message || err}`); process.exit(1); });
 } else if (command === 'sentinel') {
   // Sentinel: the full security audit (engines hunt, another model verifies). Same as `security-review audit`.
+  // A stale install gets one plain upgrade line at the end of every sentinel command.
+  const sentinelNotice = require('../commands/sentinel-powers').startUpdateNotice(process.argv.slice(3));
   Promise.resolve().then(() => require('../commands/security-review').securityReviewCommand(['audit', ...process.argv.slice(3)]))
-    .then((code) => exitAfterStdoutDrain(typeof code === 'number' ? code : 0))
+    .then(async (code) => { try { await sentinelNotice.print(); } catch {} exitAfterStdoutDrain(typeof code === 'number' ? code : 0); })
     .catch((err) => { console.error(`\n✗ Error: ${err.message || err}`); process.exit(1); });
 } else if (command === 'security-review' || command === 'secure') {
   // Security review: deterministic secrets/PII/code-risk scan (no LLM). Exit 1 = HIGH finding,

package/commands/security-review.js

@@ -747,6 +747,11 @@ async function auditCommand(argv, deps = {}) {
     const run = { agents: powers.agentsCommand, guard: powers.guardCommand, watch: powers.watchCommand, flush: powers.flushCommand }[argv[0]];
     return run(argv.slice(1), deps);
   }
+  if (argv[0] === 'bench' || argv[0] === 'improve') {
+    const sb = require('./sentinel-bench');
+    return (argv[0] === 'bench' ? sb.benchCommand : sb.improveCommand)(argv.slice(1), deps);
+  }
+  if (argv[0] === 'fix') return require('./sentinel-fix').fixCommand(argv.slice(1), deps);
   if (argv[0] === 'upload') return auditUploadCommand(argv.slice(1), deps);
   if (argv[0] === 'recheck') return auditRecheckCommand(argv.slice(1), deps);
   if (argv[0] === 'schedule') return auditScheduleCommand(argv.slice(1), deps);
@@ -854,12 +859,25 @@ function printAuditHelp() {
     atris sentinel agents --home                also check ~/.claude and ~/.codex
     atris sentinel watch [path]                 known attacks in your dependencies (osv database)
     atris sentinel watch --fix                  update affected packages on a new branch, never pushed
+    atris sentinel watch --fix --allow-major    also take fixes that jump to a new major version
     atris sentinel guard install [--global]     stop risky agent commands before they run
     atris sentinel guard test                   see which sample commands the guard stops
 
   results go to your atris dashboard when you are logged in. add --no-upload
   to keep them on this machine. secret values and file contents never leave.
 
+  the exam and the loop that improves the sentinel (in an atris checkout):
+
+    atris sentinel bench [--summary]            score the guard and agent check on a seen and a held-out half
+    atris sentinel improve [--engine claude]    one engine proposes a change, the exam decides if it stays
+    atris sentinel improve --schedule           run the improve loop nightly
+
+  turning a confirmed finding into a fix:
+
+    atris sentinel fix                          list confirmed findings you can fix
+    atris sentinel fix <id> [path]              smallest fix plus a regression test on a new branch
+    atris sentinel fix help                     how a fix is proved before it is committed
+
   reviews on a timer:
 
     atris sentinel schedule --every day [path]  quick review once a day, saved to your account

package/commands/sentinel-bench.js

@@ -0,0 +1,172 @@
+'use strict';
+
+// atris sentinel bench and atris sentinel improve.
+//
+//   atris sentinel bench [--summary] [--json] [--review] [--sets guard,agents]
+//   atris sentinel bench --split <file> --set guard|agents|review
+//   atris sentinel improve [--engine claude] [--offline] [--json]
+//   atris sentinel improve --schedule [--every 24] [--engine claude] | --unschedule
+
+const path = require('path');
+
+function readFlag(argv, name) {
+  const i = argv.indexOf(name);
+  if (i !== -1 && argv[i + 1] !== undefined && !String(argv[i + 1]).startsWith('--')) return argv[i + 1];
+  const inline = argv.find((a) => String(a).startsWith(`${name}=`));
+  return inline ? inline.slice(name.length + 1) : null;
+}
+
+function checkFlags(argv, flags, values) {
+  for (let i = 0; i < argv.length; i++) {
+    const a = String(argv[i]);
+    const name = a.split('=')[0];
+    if (values.includes(name)) { if (!a.includes('=')) i += 1; continue; }
+    if (flags.includes(a)) continue;
+    throw new Error(`unknown option: ${a}`);
+  }
+}
+
+function benchHelp() {
+  console.log(`
+  atris sentinel bench, a fixed exam for the sentinel
+
+    atris sentinel bench                 score the guard and the agent check
+    atris sentinel bench --summary       totals only, no item lines
+    atris sentinel bench --review        also run the review set on engines (costs engine time)
+    atris sentinel bench --json          raw numbers for scripts
+    atris sentinel bench --split <file> --set guard|agents|review
+                                         split new items into the seen half (in the repo)
+                                         and the sealed held-out half (on this machine).
+                                         the plaintext input is replaced with an encrypted copy
+
+  the seen half lives in atris/sentinel-bench. the held-out half lives in
+  ~/.atris/sentinel-holdout, encrypted with a key in your keychain. its
+  items are never printed. only lib/sentinel-rules.json of the checkout is
+  judged, always with this atris's own code. every number
+  is raw: attacks blocked, everyday commands wrongly blocked, problems
+  found, false alarms. there is no blended score.
+`);
+  return 0;
+}
+
+async function benchCommand(argv, deps = {}) {
+  if (argv.includes('--help') || argv.includes('-h') || argv[0] === 'help') return benchHelp();
+  try { checkFlags(argv, ['--summary', '--json', '--review'], ['--split', '--set', '--sets', '--target', '--seen', '--hunter', '--verifier', '--budget']); } catch (e) { console.error(`  ${e.message}`); return 2; }
+  const bench = require('../lib/sentinel-bench');
+  const env = deps.env || process.env;
+  const root = path.resolve(readFlag(argv, '--target') || deps.root || process.cwd());
+  const seenDir = path.resolve(readFlag(argv, '--seen') || bench.seenDirOf(root));
+  const holdoutDir = bench.defaultHoldoutDir(env);
+  const split = readFlag(argv, '--split');
+  if (split) {
+    const set = readFlag(argv, '--set');
+    if (!set) { console.error('  --split needs --set guard, agents or review'); return 2; }
+    let res;
+    try { res = bench.splitCorpus(path.resolve(split), set, { seenDir, holdoutDir, env }); } catch (e) { console.error(`  could not split: ${e.message}`); return 1; }
+    if (argv.includes('--json')) { console.log(JSON.stringify({ ok: true, ...res }, null, 2)); return 0; }
+    console.log(`\n  ${res.seen} items went to the seen half: ${path.relative(process.cwd(), res.seen_file) || res.seen_file}`);
+    console.log(`  ${res.holdout} items went to the held-out half on this machine`);
+    if (res.skipped) console.log(`  ${res.skipped} items were already in a half and were skipped`);
+    if (res.invalid) console.log(`  ${res.invalid} lines were not valid items and were skipped`);
+    console.log(`  the plaintext input was replaced with an encrypted copy at ${res.sealed_source}. no readable held-out item is left behind\n`);
+    return 0;
+  }
+  const review = argv.includes('--review');
+  const setsRaw = readFlag(argv, '--sets');
+  const sets = setsRaw ? setsRaw.split(',').map((s) => s.trim()).filter(Boolean) : ['guard', 'agents', ...(review ? ['review'] : [])];
+  const bad = sets.filter((s) => !bench.SETS.includes(s));
+  if (bad.length) { console.error(`  unknown set: ${bad.join(', ')}. use guard, agents or review`); return 2; }
+  const budget = readFlag(argv, '--budget');
+  const reviewOpts = review ? {
+    hunter: readFlag(argv, '--hunter') || 'codex',
+    verifier: readFlag(argv, '--verifier') || 'claude',
+    ...(budget ? { budget: Number(budget) } : {}),
+    log: argv.includes('--json') ? () => {} : (m) => console.error(`  ${m}`),
+    ...(deps.runJobs ? { runJobs: deps.runJobs } : {}),
+  } : null;
+  let report;
+  try { report = await bench.runBench({ target: root, seenDir, sets, review: reviewOpts, env }); } catch (e) { console.error(`  the exam did not run: ${e.message}`); return 1; }
+  const pub = bench.publicReport(report, { summary: argv.includes('--summary') });
+  if (argv.includes('--json')) console.log(JSON.stringify({ ok: true, ...pub }, null, 2));
+  else console.log(bench.renderReport(pub, { holdoutDir: holdoutDir.replace(require('os').homedir(), '~') }));
+  return 0;
+}
+
+function improveHelp() {
+  console.log(`
+  atris sentinel improve, one exam-checked change to the sentinel
+
+    atris sentinel improve [--engine claude]   propose one change and judge it
+    atris sentinel improve --offline           skip the published advisory lookup
+    atris sentinel improve --schedule [--every 24] [--engine claude]
+                                               run it on a timer, nightly by default
+    atris sentinel improve --unschedule        turn the timer off
+
+  claude proposes one change to lib/sentinel-rules.json on a new branch,
+  sealed off from the held-out exam. the sentinel bench, fixed code with no
+  model, scores it before and after. it is kept only when
+  held-out attack catch holds or rises, wrong blocks and false alarms do
+  not rise and no seen item that passed now fails. a kept change waits on
+  its branch for you. nothing is merged, pushed or released.
+`);
+  return 0;
+}
+
+async function improveCommand(argv, deps = {}) {
+  if (argv.includes('--help') || argv.includes('-h') || argv[0] === 'help') return improveHelp();
+  try { checkFlags(argv, ['--json', '--offline', '--schedule', '--unschedule'], ['--engine', '--every']); } catch (e) { console.error(`  ${e.message}`); return 2; }
+  const improve = require('../lib/sentinel-improve');
+  const env = deps.env || process.env;
+  const engine = readFlag(argv, '--engine') || 'claude';
+  if (!/^[a-z][a-z0-9:_-]{0,30}$/.test(engine)) { console.error(`  unknown engine: ${engine}`); return 2; }
+  const refused = require('../lib/sentinel-improve').refusedEngine(engine);
+  if (refused && !argv.includes('--unschedule')) { console.error(`  ${refused}`); return 2; }
+  const root = deps.root || process.cwd();
+  if (argv.includes('--schedule') || argv.includes('--unschedule')) {
+    const { installKeep, removeKeep } = require('../lib/campaign-keep');
+    const everyHours = Number(readFlag(argv, '--every') || 24);
+    if (!Number.isFinite(everyHours) || everyHours <= 0) { console.error('  --every needs a number of hours'); return 2; }
+    let top;
+    try { top = require('child_process').execFileSync('git', ['rev-parse', '--show-toplevel'], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim(); } catch { console.error('  run this inside the atris checkout the loop should improve'); return 2; }
+    const plan = improve.schedulePlan({ root: top, engine, everyHours, env, atrisBin: deps.atrisBin });
+    if (argv.includes('--unschedule')) {
+      const removed = (deps.removeKeep || removeKeep)(plan);
+      if (!removed.ok) { console.error(`  could not turn the timer off: ${removed.error}`); return 1; }
+      console.log(`  sentinel improve timer: ${removed.removed === false ? 'was not on' : 'off'} for ${top}`);
+      return 0;
+    }
+    const space = require('../lib/worktree-space');
+    const bin = deps.atrisBin || path.join(__dirname, '..', 'bin', 'atris.js');
+    if (!deps.atrisBin && (space.isAgentCopyPath(bin) || space.isScratchPath(bin) || space.isAgentCopyPath(top))) {
+      console.error('  refusing: this atris or this checkout lives in a folder that gets removed. install the timer from a lasting checkout');
+      return 2;
+    }
+    const installed = (deps.installKeep || installKeep)(plan);
+    if (!installed.ok) { console.error(`  could not turn the timer on: ${installed.error}`); return 1; }
+    console.log(`  sentinel improve timer: on for ${top}, every ${everyHours} ${everyHours === 1 ? 'hour' : 'hours'} with ${engine}`);
+    console.log(`  log: ${plan.log_path}`);
+    console.log('  each run leaves a receipt in ~/.atris/sentinel-improve/receipts. kept changes wait on their branch for you');
+    return 0;
+  }
+  let res;
+  try {
+    res = await improve.improve({ root, engine, env, offline: argv.includes('--offline'), log: argv.includes('--json') ? () => {} : (m) => console.log(`  ${m}`), ...(deps.improveOpts || {}) });
+  } catch (e) { console.error(`  improve did not run: ${e.message}`); return 1; }
+  if (argv.includes('--json')) {
+    console.log(JSON.stringify({ ok: !res.error, kept: res.kept, branch: res.branch, error: res.error || null, decision: res.decision, receipt: res.receipt }, null, 2));
+    return res.error ? 1 : 0;
+  }
+  console.log('');
+  if (res.error) console.log(`  stopped: ${res.error}`);
+  else if (res.kept) console.log(`  kept. the change waits on branch ${res.branch} for your review`);
+  else console.log('  rejected. the branch was removed');
+  if (res.decision) {
+    for (const g of res.decision.gains) console.log(`  gain: ${g}`);
+    for (const n of res.decision.notes || []) console.log(`  note: ${n}`);
+    for (const r of res.decision.reasons) console.log(`  stop: ${r}`);
+  }
+  console.log(`  receipt: ${res.receipt.replace(require('os').homedir(), '~')}\n`);
+  return res.error ? 1 : 0;
+}
+
+module.exports = { benchCommand, improveCommand };

package/commands/sentinel-fix.js

@@ -0,0 +1,243 @@
+'use strict';
+
+// atris sentinel fix [finding-id|--all-open] [path]
+//
+// Turns a confirmed sentinel finding into a reviewed fix on its own branch.
+// The work lives in lib/sentinel-fix.js; this file reads flags, prices atris
+// model calls before any spend, prints the landing and sends one event.
+
+const fs = require('fs');
+const path = require('path');
+
+function tildePath(p, home = require('os').homedir()) {
+  return p && p.startsWith(home) ? `~${p.slice(home.length)}` : p;
+}
+
+function parseFixArgs(argv) {
+  const opts = { positionals: [], allOpen: false, verify: null, builder: null, verifier: null, engine: null, yes: false, pr: false, upload: true, timeoutMs: null };
+  const takes = (i, flag) => {
+    if (argv[i + 1] === undefined || argv[i + 1].startsWith('--')) throw new Error(`${flag} needs a value`);
+    return argv[i + 1];
+  };
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    const [flag, inline] = arg.startsWith('--') && arg.includes('=') ? [arg.slice(0, arg.indexOf('=')), arg.slice(arg.indexOf('=') + 1)] : [arg, null];
+    const value = () => (inline !== null ? inline : takes(i++, flag));
+    if (flag === '--all-open') opts.allOpen = true;
+    else if (flag === '--verify') opts.verify = value();
+    else if (flag === '--builder') opts.builder = value();
+    else if (flag === '--verifier') opts.verifier = value();
+    else if (flag === '--engine') opts.engine = value();
+    else if (flag === '--yes' || flag === '-y') opts.yes = true;
+    else if (flag === '--pr') opts.pr = true;
+    else if (flag === '--no-upload') opts.upload = false;
+    else if (flag === '--timeout') opts.timeoutMs = Number(value()) * 1000;
+    else if (arg.startsWith('-')) throw new Error(`unknown flag: ${arg}`);
+    else opts.positionals.push(arg);
+  }
+  if (opts.engine !== null && !['atris', 'local'].includes(opts.engine)) throw new Error('--engine must be atris or local');
+  if (opts.timeoutMs !== null && (!Number.isFinite(opts.timeoutMs) || opts.timeoutMs < 10000)) throw new Error('--timeout is in seconds, at least 10');
+  if (opts.verify !== null && !opts.verify.trim()) throw new Error('--verify needs a command');
+  // fix <id> <path>, fix <path>, fix <id>, fix --all-open <path>
+  const [a, b] = opts.positionals;
+  if (opts.positionals.length > 2) throw new Error('give at most a finding id and a path');
+  if (opts.allOpen) {
+    if (opts.positionals.length > 1) throw new Error('--all-open takes only a path');
+    opts.path = a || null;
+  } else if (opts.positionals.length === 2) {
+    opts.id = a;
+    opts.path = b;
+  } else if (a !== undefined) {
+    let isDir = false;
+    try { isDir = fs.statSync(a).isDirectory(); } catch {}
+    if (isDir) opts.path = a; else opts.id = a;
+  }
+  return opts;
+}
+
+function printFixHelp() {
+  console.log(`
+  atris sentinel fix, a reviewed fix for a confirmed finding
+
+    atris sentinel fix                       list confirmed findings you can fix
+    atris sentinel fix <id> [path]           fix one finding on its own branch
+    atris sentinel fix --all-open [path]     fix every finding with no fix branch yet
+    atris sentinel fix <id> --verify "make test"
+                                             run this test command (default: npm test,
+                                             pytest or go test, whichever the repo uses)
+    atris sentinel fix <id> --builder claude --verifier codex
+                                             which engine writes the fix and which checks it
+    atris sentinel fix <id> --engine atris   atris models write and check, after a price
+    atris sentinel fix <id> --pr             push the branch and open a pull request
+
+  it needs a clean working tree. the fix is built in a temp copy on a new
+  branch named sentinel/fix-<id> made from the branch you are on. your own
+  checkout and branch are never changed. nothing is merged. nothing is
+  pushed unless you add --pr.
+
+  builder and checker may be codex, claude or an atris model. atris models
+  always show a price and wait for a yes.
+
+  a fix is committed only when all three hold:
+    the new test fails on the old code
+    the full test suite passes with the fix
+    a second engine reads the fixed source and finds the attack no longer works
+
+  the new test must fail on a real failed check. a missing module, a syntax
+  error or a timeout does not count. otherwise nothing is committed and the
+  attempt is saved as a patch under ~/.atris/sentinel/fixes.
+
+  the new tests run with a temp home, no tokens or keys in the environment
+  and push turned off for the temp copy. they still run as you and are not a
+  sandbox. read the new test before you run it on code you do not trust.
+`);
+  return 0;
+}
+
+function askYesNo(question, { input = process.stdin, output = process.stdout } = {}) {
+  return new Promise((resolve) => {
+    const rl = require('readline').createInterface({ input, output });
+    rl.question(question, (answer) => { rl.close(); resolve(/^\s*y(es)?\s*$/i.test(String(answer || ''))); });
+  });
+}
+
+function sevOf(r) {
+  return (r.severity && r.severity.overall) || 'unrated';
+}
+
+async function fixCommand(argv, deps = {}) {
+  if (argv[0] === 'help' || argv.includes('--help') || argv.includes('-h')) return printFixHelp();
+  const fix = deps.fixLib || require('../lib/sentinel-fix');
+  const env = deps.env || process.env;
+  let opts;
+  try { opts = parseFixArgs(argv); } catch (e) { console.error(`  ${e.message}`); return 2; }
+
+  const start = path.resolve(opts.path || deps.root || process.cwd());
+  const top = fix.git(start, ['rev-parse', '--show-toplevel'], { allowFail: true });
+  if (!top) { console.error(`  ${tildePath(start)} is not a git repository. a fix needs a branch to go on`); return 2; }
+  const root = top;
+
+  const { records } = fix.confirmedFindings(root);
+  if (!records.length) { console.log('\n  no confirmed findings for this repository. run atris sentinel first\n'); return 0; }
+
+  if (!opts.id && !opts.allOpen) {
+    console.log('\n  confirmed findings you can fix\n');
+    for (const r of records) {
+      const has = fix.branchExists(root, fix.branchFor(r));
+      console.log(`  ${fix.shortId(r.fingerprint)}  ${sevOf(r).padEnd(8)}  ${r.title}${has ? '  (fix branch exists)' : ''}`);
+    }
+    console.log(`\n  fix one with: atris sentinel fix ${fix.shortId(records[0].fingerprint)}\n`);
+    return 0;
+  }
+
+  let targets;
+  if (opts.allOpen) {
+    targets = records.filter((r) => !fix.branchExists(root, fix.branchFor(r)));
+    if (!targets.length) { console.log('\n  every confirmed finding already has a fix branch\n'); return 0; }
+  } else {
+    const r = fix.matchFinding(records, opts.id);
+    if (!r) { console.error(`  no confirmed finding matches ${opts.id}. run atris sentinel fix to list them`); return 2; }
+    targets = [r];
+  }
+
+  if (fix.changedPaths(root).length) { console.error('  this repository has uncommitted changes. commit or stash them first so the fix branch holds only the fix'); return 2; }
+  const from = fix.git(root, ['rev-parse', '--abbrev-ref', 'HEAD'], { allowFail: true });
+  if (!from || from === 'HEAD') { console.error('  check out a branch first. a fix branch is made from the branch you are on'); return 2; }
+
+  const testCommand = opts.verify || fix.detectTestCommand(root);
+  if (!testCommand) { console.error('  no test command found. name one with --verify "<command>"'); return 2; }
+
+  let engines;
+  try { engines = fix.resolveFixEngines({ engine: opts.engine, builder: opts.builder, verifier: opts.verifier, env, available: deps.available }); } catch (e) { console.error(`  ${e.message}`); return 2; }
+
+  const cloud = deps.cloud || require('../lib/sentinel-cloud');
+  const hosted = fix.isHosted(engines.builder) || fix.isHosted(engines.verifier);
+  const token = deps.token !== undefined ? deps.token : cloud.authToken();
+  let hostedRun = deps.hostedRun || null;
+  let allowed = new Set();
+  if (hosted) {
+    if (!token) { console.error('  fixes on atris models need a login. run atris login first'); return 2; }
+    allowed = require('../lib/security-audit').hostedAllowedFiles(root, []);
+    const rows = [];
+    if (fix.isHosted(engines.builder)) {
+      const sizes = targets.map((r) => Buffer.byteLength(fix.builderPrompt(r, { testCommand, hosted: true, fileList: [...allowed].slice(0, 400), source: fix.hostedSourceBlock(root, fix.citedFiles(r), allowed, 64 * 1024) })));
+      const max = Math.max(4096, ...sizes) + 1024;
+      rows.push({ role: 'builder', model: engines.builder, calls: targets.length, input_tokens: max, output_tokens: fix.HOSTED_OUTPUT_TOKENS.builder, max_input_bytes: max });
+    }
+    if (fix.isHosted(engines.verifier)) rows.push({ role: 'verifier', model: engines.verifier, calls: targets.length, input_tokens: fix.HOSTED_CHECK_MAX_BYTES, output_tokens: fix.HOSTED_OUTPUT_TOKENS.verifier, max_input_bytes: fix.HOSTED_CHECK_MAX_BYTES });
+    let quote;
+    try { quote = await cloud.quoteEstimate({ calls: rows }, { token }); } catch (e) { console.error(`  nothing was spent. ${e.message}`); return 2; }
+    console.log(`\n  ${cloud.describeQuote(quote).replace(/^this review/, 'this fix')}\n`);
+    let yes = opts.yes;
+    if (!yes) {
+      const input = deps.input || process.stdin;
+      if (!input.isTTY && !deps.input) { console.error('  nothing was spent. add --yes to run without this question'); return 1; }
+      yes = await (deps.ask || askYesNo)('  spend these credits? (y/N) ', { input, output: process.stdout });
+      if (!yes) { console.log('  nothing was spent'); return 1; }
+    }
+    if (!hostedRun) {
+      const spend = cloud.spendGuard({ quoteCall: deps.quoteCall });
+      spend.max = quote.credits;
+      spend.limits = quote.limits;
+      const runner = cloud.atrisJobRunner({ token, spend });
+      hostedRun = (jobs) => runner(jobs, { root, concurrency: 1, timeoutMs: opts.timeoutMs || 20 * 60 * 1000 });
+    }
+  }
+
+  const log = deps.log || ((m) => console.log(`  · ${m}`));
+  const ctx = {
+    from,
+    testCommand,
+    engines,
+    env,
+    allowed,
+    hostedRun,
+    runBuilder: deps.runBuilder || fix.defaultRunBuilder,
+    runChecker: deps.runChecker || fix.defaultRunChecker,
+    timeouts: { build: opts.timeoutMs || 20 * 60 * 1000, check: opts.timeoutMs || 10 * 60 * 1000, test: 20 * 60 * 1000 },
+    log,
+  };
+
+  console.log(`\n  ◉ sentinel fix · ${engines.builder} writes the fix · ${engines.verifier} checks it · tests: ${testCommand}`);
+  const results = [];
+  for (const record of targets) {
+    console.log(`\n  ${fix.shortId(record.fingerprint)} · ${record.title}`);
+    const res = await fix.fixOne(root, record, ctx);
+    results.push({ record, res });
+    if (res.ok) {
+      console.log(`  prepared a fix on a new branch: ${res.branch}`);
+      console.log(`  the new test failed on the old code and passes with the fix. the full test suite passes. ${engines.verifier} checked from source that the attack no longer works`);
+      console.log(`  review it with: git diff ${from}...${res.branch}`);
+      if (opts.pr) {
+        const pr = fix.openPr(root, res, record, { run: deps.run, verifier: engines.verifier });
+        res.pr = pr;
+        if (pr.ok) console.log(`  opened a pull request${pr.url ? `: ${pr.url}` : ''}. nothing was merged`);
+        else console.log(`  no pull request was opened: ${pr.reason}${pr.pushed ? '' : '. nothing was pushed'}`);
+      } else {
+        console.log('  nothing was pushed');
+      }
+    } else {
+      console.log(`  no fix was committed: ${res.reason}`);
+      if (res.branch === null || res.branch === undefined) console.log(`  you are on ${from}${res.patch ? `. the attempt is saved at ${tildePath(res.patch, env.HOME || undefined)}` : ''}`);
+    }
+  }
+
+  const done = results.filter((x) => x.res.ok);
+  if (done.length) {
+    const events = require('../lib/sentinel-events');
+    let upload;
+    if (!opts.upload) upload = { skipped: 'no-upload' };
+    else if (!token) upload = { skipped: 'not-logged-in' };
+    else {
+      try { upload = await events.postEvents(done.map((x) => fix.fixEvent(root, x.record, x.res)), { token, base: deps.base }); } catch (e) { upload = { ok: false, reason: e.message }; }
+    }
+    if (upload.skipped === 'no-upload') console.log('\n  kept on this machine. nothing was sent (--no-upload)');
+    else if (upload.skipped === 'not-logged-in') console.log('\n  not logged in. nothing was sent to your dashboard');
+    else if (!upload.ok) console.log(`\n  warning: could not tell your atris dashboard: ${upload.reason}. the fix itself is done`);
+    else console.log('\n  told your atris dashboard. no code was sent');
+  }
+  console.log('');
+  return results.every((x) => x.res.ok) ? 0 : 1;
+}
+
+module.exports = { fixCommand, parseFixArgs };

package/commands/sentinel-powers.js

@@ -5,7 +5,7 @@
 //
 //   atris sentinel agents [path] [--home]        check an agent setup
 //   atris sentinel guard install|uninstall|status|test [--global]
-//   atris sentinel watch [path] [--fix]          known attacks in dependencies
+//   atris sentinel watch [path] [--fix] [--allow-major]  known attacks in dependencies
 //   atris sentinel flush                         send queued guard events
 //
 // An upload problem is a warning line. It never changes the exit code.
@@ -50,6 +50,34 @@ function uploadLine(res, what) {
   return `  sent ${res.sent - (res.resolved || 0)} ${what} to your atris dashboard${resolved}. no file contents or secret values were sent`;
 }
 
+// ---------------------------------------------------------------- update
+
+// A stale global install misses sentinel fixes. Every sentinel command
+// ends with one line when npm has a newer atris. The check starts with the
+// command and gets a short wait at the end. It never blocks or fails a run.
+function startUpdateNotice(argv = [], { env = process.env, check, timeoutMs = 1500, packageRoot = path.join(__dirname, '..') } = {}) {
+  const off = env.ATRIS_SKIP_UPDATE_CHECK || env.NO_UPDATE_NOTIFIER
+    || argv.some((a) => ['--json', '--help', '-h', 'help', '--quiet'].includes(a));
+  if (off) return { print: async () => null };
+  const updates = require('../utils/update-check');
+  let pending;
+  try { pending = Promise.resolve((check || updates.checkForUpdates)()).catch(() => null); } catch { pending = Promise.resolve(null); }
+  return {
+    async print(log = console.log) {
+      let timer;
+      const late = new Promise((r) => { timer = setTimeout(() => r(null), timeoutMs); if (timer.unref) timer.unref(); });
+      const info = await Promise.race([pending, late]);
+      clearTimeout(timer);
+      if (!info || !info.needsUpdate) return null;
+      let how = 'npm install -g atris@latest';
+      try { if (updates.isGitCheckout(packageRoot)) how = 'atris upgrade'; } catch {}
+      const line = `  a newer atris is out: ${info.latest}. this one is ${info.installed}. update with: ${how}`;
+      log(line);
+      return line;
+    },
+  };
+}
+
 // ---------------------------------------------------------------- agents
 
 async function runAgents(root, { home = false, upload = true, deps = {} } = {}) {
@@ -83,37 +111,92 @@ async function agentsCommand(argv, deps = {}) {
 
 // ---------------------------------------------------------------- watch
 
+// A threat that is gone here counts as fixed only on the repo's default
+// branch, or when the default branch no longer holds the affected version.
+// On a side branch it stays open on the dashboard.
+function holdForBranch(branch) {
+  if (!branch || branch.onDefault) return null;
+  const live = branch.liveFingerprints;
+  if (!live) return () => true;
+  return (fp) => live.has(fp);
+}
+
 async function runWatchCheck(root, { upload = true, deps = {} } = {}) {
   const watch = require('../lib/sentinel-watch');
   const events = require('../lib/sentinel-events');
-  const result = await watch.runWatch(root, { base: deps.osvBase || process.env.ATRIS_OSV_BASE || watch.OSV_BASE, ...(deps.request ? { request: deps.request } : {}) });
+  const result = await watch.runWatch(root, { base: deps.osvBase || process.env.ATRIS_OSV_BASE || watch.OSV_BASE, ...(deps.request ? { request: deps.request } : {}), ...(deps.maxLockfileBytes ? { maxBytes: deps.maxLockfileBytes } : {}) });
   const evs = watch.toEvents(result, { repo: deps.repo });
+  let branch = null;
+  try { branch = watch.branchState(root, { run: deps.run }); } catch { branch = { git: true, onDefault: false, liveFingerprints: null }; }
   let res;
   if (result.offline) res = { ok: true, skipped: 'offline', sent: 0 };
   else {
     try {
-      res = await events.reportFindings(root, 'threat', evs, { token: upload ? tokenFor(deps) : '', base: deps.base, env: deps.env || process.env, upload });
+      // Per lockfile: an earlier threat is fixed only when every lockfile it
+      // was found in was read this time and none of them holds it now. One
+      // whose lockfile was not read (depth, cap, size, error, moved or
+      // deleted) stays open. An old record with no lockfile list needs a
+      // complete scan.
+      const read = new Set(result.lockfiles.map((l) => l.file));
+      const branchHold = holdForBranch(branch);
+      const why = { unread: 0, branch: 0 };
+      // Locations not read this run are kept by reportFindings itself. Here:
+      // an old record with no lockfile list plus the branch rule.
+      const hold = (fp, prev) => {
+        const lfs = prev && Array.isArray(prev.lockfiles) && prev.lockfiles.length ? prev.lockfiles : null;
+        if (!lfs && result.incomplete) { why.unread += 1; return true; }
+        if (branchHold && branchHold(fp)) { why.branch += 1; return true; }
+        return false;
+      };
+      res = await events.reportFindings(root, 'threat', evs, { token: upload ? tokenFor(deps) : '', base: deps.base, env: deps.env || process.env, upload, hold, meta: watch.lockfilesByFingerprint(result), read });
+      res.heldUnread = why.unread + (res.heldLocations || 0);
+      res.heldBranch = why.branch;
     } catch (e) { res = { ok: false, reason: e.message }; }
   }
-  return { result, events: evs, upload: res };
+  return { result, events: evs, upload: res, branch };
+}
+
+function heldLines(upload, branch) {
+  const L = [];
+  const u = (upload && upload.heldUnread) || 0;
+  const b = (upload && upload.heldBranch) || 0;
+  if (u) L.push(`  ${u} earlier threat${u === 1 ? ' was' : 's were'} in a lockfile this check did not read. ${u === 1 ? 'it stays' : 'they stay'} open on your dashboard`);
+  if (b) {
+    const target = (branch && branch.defaultBranch) || 'the default branch';
+    L.push(`  fixed on this branch, not yet live: ${b} threat${b === 1 ? '' : 's'}. ${b === 1 ? 'it stays' : 'they stay'} open on your dashboard until the fix is merged into ${target}`);
+  }
+  return L;
+}
+
+// One or two lines per package left for a person. Never cut short.
+function manualLines(manual) {
+  const L = [];
+  if (!manual || !manual.length) return L;
+  L.push(`  left for you to update (${manual.length}):`);
+  for (const a of manual) {
+    const to = a.fixed ? ` to ${a.fixed}` : '';
+    L.push(`    ${a.name} ${a.version}${to} in ${a.lockfile || a.ecosystem}: ${a.why || 'not updated'}`);
+  }
+  return L;
 }
 
 async function watchCommand(argv, deps = {}) {
   let opts;
-  try { opts = parseFlags(argv, ['fix', 'json', 'no-upload']); } catch (e) { console.error(`  ${e.message}`); return 2; }
+  try { opts = parseFlags(argv, ['fix', 'json', 'no-upload', 'allow-major']); } catch (e) { console.error(`  ${e.message}`); return 2; }
   let root;
   try { root = resolveRoot(opts, deps); } catch (e) { console.error(`  ${e.message}`); return 2; }
   const watch = require('../lib/sentinel-watch');
-  const { result, upload } = await runWatchCheck(root, { upload: !opts.noUpload, deps });
+  const { result, upload, branch } = await runWatchCheck(root, { upload: !opts.noUpload, deps });
   let fix = null;
   if (opts.fix && !result.offline && result.affected.length) {
-    try { fix = watch.applyFix(root, result, { log: (m) => console.error(`  ${m}`) }); } catch (e) { fix = { ok: false, reason: String(e.message || e).split('\n')[0] }; }
+    try { fix = watch.applyFix(root, result, { run: deps.run, allowMajor: Boolean(opts.allowMajor) }); } catch (e) { fix = { ok: false, reason: String(e.message || e).split('\n')[0] }; }
   }
   if (opts.json) {
-    console.log(JSON.stringify({ ok: !result.affected.some((a) => a.severity === 'critical' || a.severity === 'high'), ...result, upload, fix }, null, 2));
+    console.log(JSON.stringify({ ok: !result.affected.some((a) => a.severity === 'critical' || a.severity === 'high'), ...result, upload, branch: branch ? { ...branch, liveFingerprints: undefined } : null, fix }, null, 2));
   } else {
     console.log(watch.renderReport(result));
     if (upload.skipped !== 'offline') console.log(uploadLine(upload, 'the threats'));
+    for (const l of heldLines(upload, branch)) console.log(l);
     if (fix) {
       console.log('');
       if (!fix.ok) console.log(`  the fix did not run: ${fix.reason}`);
@@ -124,9 +207,12 @@ async function watchCommand(argv, deps = {}) {
         console.log(`  go back with: git checkout ${fix.from || 'main'}`);
         console.log('  nothing was pushed');
       }
-      if (fix.manual && fix.manual.length) {
-        console.log(`  update these yourself: ${fix.manual.map((a) => `${a.name} to ${a.fixed}`).join(', ')}`);
+      for (const te of fix.toolErrors || []) {
+        console.log(`  ${te.tool} could not update ${te.lockfile}. it said:`);
+        for (const l of te.lines) console.log(`    ${l}`);
+        if (te.hint) console.log(`  ${te.hint}`);
       }
+      for (const l of manualLines(fix.manual)) console.log(l);
     }
     console.log('');
   }
@@ -281,4 +367,4 @@ async function runScheduledFreeChecks(root, deps = {}) {
   return out;
 }
 
-module.exports = { agentsCommand, guardCommand, watchCommand, flushCommand, runScheduledFreeChecks, runAgents, runWatchCheck };
+module.exports = { agentsCommand, guardCommand, watchCommand, flushCommand, runScheduledFreeChecks, runAgents, runWatchCheck, startUpdateNotice };