atris 3.82.7 → 3.82.8

package/bin/atris.js

@@ -144,7 +144,8 @@ const jsonRequested = process.argv.slice(2).includes('--json');
 const dryRunRequested = updateArgs.includes('--dry-run');
 const skipUpdateCheck = Boolean(process.env.ATRIS_SKIP_UPDATE_CHECK || process.env.NO_UPDATE_NOTIFIER || helpRequested || jsonRequested);
 // Local-only commands make no registry call and start no background install.
-if (!skipUpdateCheck && (!updateCommand || (updateCommand && !['version', 'update', 'mcp', 'recap', '99'].includes(updateCommand)))) {
+// sentinel prints its own one-line notice at the end of the run instead.
+if (!skipUpdateCheck && (!updateCommand || (updateCommand && !['version', 'update', 'mcp', 'recap', '99', 'sentinel'].includes(updateCommand)))) {
   updateCheckPromise = checkForUpdates()
     .then((updateInfo) => {
       if (updateInfo) {
@@ -3378,8 +3379,10 @@ if (command === 'guide') {
     .catch((err) => { console.error(`\n✗ Error: ${err.message || err}`); process.exit(1); });
 } else if (command === 'sentinel') {
   // Sentinel: the full security audit (engines hunt, another model verifies). Same as `security-review audit`.
+  // A stale install gets one plain upgrade line at the end of every sentinel command.
+  const sentinelNotice = require('../commands/sentinel-powers').startUpdateNotice(process.argv.slice(3));
   Promise.resolve().then(() => require('../commands/security-review').securityReviewCommand(['audit', ...process.argv.slice(3)]))
-    .then((code) => exitAfterStdoutDrain(typeof code === 'number' ? code : 0))
+    .then(async (code) => { try { await sentinelNotice.print(); } catch {} exitAfterStdoutDrain(typeof code === 'number' ? code : 0); })
     .catch((err) => { console.error(`\n✗ Error: ${err.message || err}`); process.exit(1); });
 } else if (command === 'security-review' || command === 'secure') {
   // Security review: deterministic secrets/PII/code-risk scan (no LLM). Exit 1 = HIGH finding,

package/commands/security-review.js

@@ -859,6 +859,7 @@ function printAuditHelp() {
     atris sentinel agents --home                also check ~/.claude and ~/.codex
     atris sentinel watch [path]                 known attacks in your dependencies (osv database)
     atris sentinel watch --fix                  update affected packages on a new branch, never pushed
+    atris sentinel watch --fix --allow-major    also take fixes that jump to a new major version
     atris sentinel guard install [--global]     stop risky agent commands before they run
     atris sentinel guard test                   see which sample commands the guard stops
 

package/commands/sentinel-powers.js

@@ -5,7 +5,7 @@
 //
 //   atris sentinel agents [path] [--home]        check an agent setup
 //   atris sentinel guard install|uninstall|status|test [--global]
-//   atris sentinel watch [path] [--fix]          known attacks in dependencies
+//   atris sentinel watch [path] [--fix] [--allow-major]  known attacks in dependencies
 //   atris sentinel flush                         send queued guard events
 //
 // An upload problem is a warning line. It never changes the exit code.
@@ -50,6 +50,34 @@ function uploadLine(res, what) {
   return `  sent ${res.sent - (res.resolved || 0)} ${what} to your atris dashboard${resolved}. no file contents or secret values were sent`;
 }
 
+// ---------------------------------------------------------------- update
+
+// A stale global install misses sentinel fixes. Every sentinel command
+// ends with one line when npm has a newer atris. The check starts with the
+// command and gets a short wait at the end. It never blocks or fails a run.
+function startUpdateNotice(argv = [], { env = process.env, check, timeoutMs = 1500, packageRoot = path.join(__dirname, '..') } = {}) {
+  const off = env.ATRIS_SKIP_UPDATE_CHECK || env.NO_UPDATE_NOTIFIER
+    || argv.some((a) => ['--json', '--help', '-h', 'help', '--quiet'].includes(a));
+  if (off) return { print: async () => null };
+  const updates = require('../utils/update-check');
+  let pending;
+  try { pending = Promise.resolve((check || updates.checkForUpdates)()).catch(() => null); } catch { pending = Promise.resolve(null); }
+  return {
+    async print(log = console.log) {
+      let timer;
+      const late = new Promise((r) => { timer = setTimeout(() => r(null), timeoutMs); if (timer.unref) timer.unref(); });
+      const info = await Promise.race([pending, late]);
+      clearTimeout(timer);
+      if (!info || !info.needsUpdate) return null;
+      let how = 'npm install -g atris@latest';
+      try { if (updates.isGitCheckout(packageRoot)) how = 'atris upgrade'; } catch {}
+      const line = `  a newer atris is out: ${info.latest}. this one is ${info.installed}. update with: ${how}`;
+      log(line);
+      return line;
+    },
+  };
+}
+
 // ---------------------------------------------------------------- agents
 
 async function runAgents(root, { home = false, upload = true, deps = {} } = {}) {
@@ -83,37 +111,92 @@ async function agentsCommand(argv, deps = {}) {
 
 // ---------------------------------------------------------------- watch
 
+// A threat that is gone here counts as fixed only on the repo's default
+// branch, or when the default branch no longer holds the affected version.
+// On a side branch it stays open on the dashboard.
+function holdForBranch(branch) {
+  if (!branch || branch.onDefault) return null;
+  const live = branch.liveFingerprints;
+  if (!live) return () => true;
+  return (fp) => live.has(fp);
+}
+
 async function runWatchCheck(root, { upload = true, deps = {} } = {}) {
   const watch = require('../lib/sentinel-watch');
   const events = require('../lib/sentinel-events');
-  const result = await watch.runWatch(root, { base: deps.osvBase || process.env.ATRIS_OSV_BASE || watch.OSV_BASE, ...(deps.request ? { request: deps.request } : {}) });
+  const result = await watch.runWatch(root, { base: deps.osvBase || process.env.ATRIS_OSV_BASE || watch.OSV_BASE, ...(deps.request ? { request: deps.request } : {}), ...(deps.maxLockfileBytes ? { maxBytes: deps.maxLockfileBytes } : {}) });
   const evs = watch.toEvents(result, { repo: deps.repo });
+  let branch = null;
+  try { branch = watch.branchState(root, { run: deps.run }); } catch { branch = { git: true, onDefault: false, liveFingerprints: null }; }
   let res;
   if (result.offline) res = { ok: true, skipped: 'offline', sent: 0 };
   else {
     try {
-      res = await events.reportFindings(root, 'threat', evs, { token: upload ? tokenFor(deps) : '', base: deps.base, env: deps.env || process.env, upload });
+      // Per lockfile: an earlier threat is fixed only when every lockfile it
+      // was found in was read this time and none of them holds it now. One
+      // whose lockfile was not read (depth, cap, size, error, moved or
+      // deleted) stays open. An old record with no lockfile list needs a
+      // complete scan.
+      const read = new Set(result.lockfiles.map((l) => l.file));
+      const branchHold = holdForBranch(branch);
+      const why = { unread: 0, branch: 0 };
+      // Locations not read this run are kept by reportFindings itself. Here:
+      // an old record with no lockfile list plus the branch rule.
+      const hold = (fp, prev) => {
+        const lfs = prev && Array.isArray(prev.lockfiles) && prev.lockfiles.length ? prev.lockfiles : null;
+        if (!lfs && result.incomplete) { why.unread += 1; return true; }
+        if (branchHold && branchHold(fp)) { why.branch += 1; return true; }
+        return false;
+      };
+      res = await events.reportFindings(root, 'threat', evs, { token: upload ? tokenFor(deps) : '', base: deps.base, env: deps.env || process.env, upload, hold, meta: watch.lockfilesByFingerprint(result), read });
+      res.heldUnread = why.unread + (res.heldLocations || 0);
+      res.heldBranch = why.branch;
     } catch (e) { res = { ok: false, reason: e.message }; }
   }
-  return { result, events: evs, upload: res };
+  return { result, events: evs, upload: res, branch };
+}
+
+function heldLines(upload, branch) {
+  const L = [];
+  const u = (upload && upload.heldUnread) || 0;
+  const b = (upload && upload.heldBranch) || 0;
+  if (u) L.push(`  ${u} earlier threat${u === 1 ? ' was' : 's were'} in a lockfile this check did not read. ${u === 1 ? 'it stays' : 'they stay'} open on your dashboard`);
+  if (b) {
+    const target = (branch && branch.defaultBranch) || 'the default branch';
+    L.push(`  fixed on this branch, not yet live: ${b} threat${b === 1 ? '' : 's'}. ${b === 1 ? 'it stays' : 'they stay'} open on your dashboard until the fix is merged into ${target}`);
+  }
+  return L;
+}
+
+// One or two lines per package left for a person. Never cut short.
+function manualLines(manual) {
+  const L = [];
+  if (!manual || !manual.length) return L;
+  L.push(`  left for you to update (${manual.length}):`);
+  for (const a of manual) {
+    const to = a.fixed ? ` to ${a.fixed}` : '';
+    L.push(`    ${a.name} ${a.version}${to} in ${a.lockfile || a.ecosystem}: ${a.why || 'not updated'}`);
+  }
+  return L;
 }
 
 async function watchCommand(argv, deps = {}) {
   let opts;
-  try { opts = parseFlags(argv, ['fix', 'json', 'no-upload']); } catch (e) { console.error(`  ${e.message}`); return 2; }
+  try { opts = parseFlags(argv, ['fix', 'json', 'no-upload', 'allow-major']); } catch (e) { console.error(`  ${e.message}`); return 2; }
   let root;
   try { root = resolveRoot(opts, deps); } catch (e) { console.error(`  ${e.message}`); return 2; }
   const watch = require('../lib/sentinel-watch');
-  const { result, upload } = await runWatchCheck(root, { upload: !opts.noUpload, deps });
+  const { result, upload, branch } = await runWatchCheck(root, { upload: !opts.noUpload, deps });
   let fix = null;
   if (opts.fix && !result.offline && result.affected.length) {
-    try { fix = watch.applyFix(root, result, { log: (m) => console.error(`  ${m}`) }); } catch (e) { fix = { ok: false, reason: String(e.message || e).split('\n')[0] }; }
+    try { fix = watch.applyFix(root, result, { run: deps.run, allowMajor: Boolean(opts.allowMajor) }); } catch (e) { fix = { ok: false, reason: String(e.message || e).split('\n')[0] }; }
   }
   if (opts.json) {
-    console.log(JSON.stringify({ ok: !result.affected.some((a) => a.severity === 'critical' || a.severity === 'high'), ...result, upload, fix }, null, 2));
+    console.log(JSON.stringify({ ok: !result.affected.some((a) => a.severity === 'critical' || a.severity === 'high'), ...result, upload, branch: branch ? { ...branch, liveFingerprints: undefined } : null, fix }, null, 2));
   } else {
     console.log(watch.renderReport(result));
     if (upload.skipped !== 'offline') console.log(uploadLine(upload, 'the threats'));
+    for (const l of heldLines(upload, branch)) console.log(l);
     if (fix) {
       console.log('');
       if (!fix.ok) console.log(`  the fix did not run: ${fix.reason}`);
@@ -124,9 +207,12 @@ async function watchCommand(argv, deps = {}) {
         console.log(`  go back with: git checkout ${fix.from || 'main'}`);
         console.log('  nothing was pushed');
       }
-      if (fix.manual && fix.manual.length) {
-        console.log(`  update these yourself: ${fix.manual.map((a) => `${a.name} to ${a.fixed}`).join(', ')}`);
+      for (const te of fix.toolErrors || []) {
+        console.log(`  ${te.tool} could not update ${te.lockfile}. it said:`);
+        for (const l of te.lines) console.log(`    ${l}`);
+        if (te.hint) console.log(`  ${te.hint}`);
       }
+      for (const l of manualLines(fix.manual)) console.log(l);
     }
     console.log('');
   }
@@ -281,4 +367,4 @@ async function runScheduledFreeChecks(root, deps = {}) {
   return out;
 }
 
-module.exports = { agentsCommand, guardCommand, watchCommand, flushCommand, runScheduledFreeChecks, runAgents, runWatchCheck };
+module.exports = { agentsCommand, guardCommand, watchCommand, flushCommand, runScheduledFreeChecks, runAgents, runWatchCheck, startUpdateNotice };

package/lib/sentinel-events.js

@@ -225,31 +225,53 @@ function writeState(root, kind, open, env) {
 }
 
 // The open events of this run, plus a resolved copy of each finding the
-// last upload reported open that is gone now.
-function withResolved(root, kind, openEvents, { env = process.env, now = new Date() } = {}) {
+// last upload reported open that is gone now. hold(fp) true keeps a gone
+// finding open: it is not sent as resolved and stays in the state. A
+// later run can resolve it (a fix that is only on a side branch).
+//
+// read: the locations (lockfiles) this run read. A finding's recorded
+// locations are merged, never replaced: one leaves the set only when this
+// run read it and it no longer holds the finding. A finding resolves only
+// when its set is empty.
+function withResolved(root, kind, openEvents, { env = process.env, now = new Date(), hold = null, meta = null, read = null } = {}) {
   const before = readState(root, kind, env);
   const current = new Set(openEvents.map((e) => e.fingerprint));
   const resolved = [];
+  const held = [];
+  const heldLocations = [];
+  const next = {};
+  const unreadOf = (prev) => (read && prev && Array.isArray(prev.lockfiles) ? prev.lockfiles.filter((l) => !read.has(l)) : []);
   for (const [fp, prev] of Object.entries(before)) {
     if (current.has(fp)) continue;
+    const left = unreadOf(prev);
+    if (left.length) { held.push(fp); heldLocations.push(fp); next[fp] = { ...prev, lockfiles: left }; continue; }
+    if (hold && hold(fp, prev)) { held.push(fp); next[fp] = prev; continue; }
     resolved.push(makeEvent({ kind, repo: prev.repo, severity: prev.severity, title: prev.title, detail: prev.detail, status: 'resolved', fingerprint: fp, occurredAt: now }));
   }
-  const next = {};
-  for (const e of openEvents) next[e.fingerprint] = { repo: e.repo, severity: e.severity, title: e.title, detail: e.detail || '' };
-  return { events: [...openEvents, ...resolved], resolved, commit: () => writeState(root, kind, next, env) };
+  // meta: local-only facts kept beside a finding (never uploaded), like
+  // which lockfiles held it.
+  for (const e of openEvents) {
+    const m = (meta && meta.get(e.fingerprint)) || {};
+    const entry = { repo: e.repo, severity: e.severity, title: e.title, detail: e.detail || '', ...m };
+    if (Array.isArray(m.lockfiles)) entry.lockfiles = [...new Set([...m.lockfiles, ...unreadOf(before[e.fingerprint])])];
+    next[e.fingerprint] = entry;
+  }
+  return { events: [...openEvents, ...resolved], resolved, held, heldLocations, commit: () => writeState(root, kind, next, env) };
 }
 
 // Upload one run's findings of one kind and move the state on success.
-async function reportFindings(root, kind, openEvents, { token, base, env = process.env, upload = true, extra = [] } = {}) {
-  const plan = withResolved(root, kind, openEvents, { env });
-  if (!upload) return { ok: true, skipped: 'no-upload', sent: 0, resolved: plan.resolved.length };
-  if (!token) return { ok: false, skipped: 'not-logged-in', reason: 'not logged in', sent: 0, resolved: plan.resolved.length };
+async function reportFindings(root, kind, openEvents, { token, base, env = process.env, upload = true, extra = [], hold = null, meta = null, read = null } = {}) {
+  const plan = withResolved(root, kind, openEvents, { env, hold, meta, read });
+  const held = plan.held.length;
+  const heldLocations = plan.heldLocations.length;
+  if (!upload) return { ok: true, skipped: 'no-upload', sent: 0, resolved: plan.resolved.length, held, heldLocations };
+  if (!token) return { ok: false, skipped: 'not-logged-in', reason: 'not logged in', sent: 0, resolved: plan.resolved.length, held, heldLocations };
   const res = await postEvents([...extra, ...plan.events], { token, base });
   if (res.ok) {
     try { plan.commit(); } catch {}
     try { await flushQueue({ token, base, env }); } catch {}
   }
-  return { ...res, sent: res.ok ? plan.events.length + extra.length : 0, resolved: plan.resolved.length };
+  return { ...res, sent: res.ok ? plan.events.length + extra.length : 0, resolved: plan.resolved.length, held, heldLocations };
 }
 
 // ---------------------------------------------------------------- review fixes

package/lib/sentinel-improve.js

@@ -317,6 +317,9 @@ function buildPrompt({ report, signals, seenDirRel }) {
     'The new items you add are scored and reported but never count toward keeping this change.',
     'So fix a general weakness, not one string. A rule that only matches the seen item will not move the hidden half.',
     '',
+    'Known limits a literal rule cannot fix, so do not try: one-liners run through an interpreter (python -c, node -e and similar) that read a secret and send it. Literal words cannot tell reading a secret and sending it apart from printing a variable next to a web address, and reviewers rejected three such rules tonight for blocking everyday commands. Pick a different miss.',
+    'Before proposing a command_block, picture five everyday developer commands that contain the same literal substrings. If any of them would be blocked, the rule is too broad.',
+    '',
     'Seen items the current code gets wrong:',
     ...(missesForPrompt(report).map((l) => `  ${l}`)),
     '',
@@ -615,8 +618,9 @@ function foreignFiles(tree) {
 }
 
 // Files the run itself may leave in a copy besides tracked, committed ones.
-// Today nothing: the candidate and the receipt draft live outside the copy.
-const KNOWN_OUTPUT = new Set();
+// The candidate and the receipt draft live outside the copy. Running the exam
+// records the engine choice in the copy's own state file, which is ours.
+const KNOWN_OUTPUT = new Set(['.atris/state/engines.json']);
 
 // Live processes this run started. A run is alive by definition. For its
 // own copy the check is that every child it spawned has exited. Fail-closed: