atris 3.82.8 → 3.82.10

package/commands/sentinel-bench.js

@@ -4,7 +4,8 @@
 //
 //   atris sentinel bench [--summary] [--json] [--review] [--sets guard,agents]
 //   atris sentinel bench --split <file> --set guard|agents|review
-//   atris sentinel improve [--engine claude] [--offline] [--json]
+//   atris sentinel improve [--engine claude] [--focus exfil|destroy|disarm|agents] [--offline] [--json]
+//   atris sentinel improve --rounds N --parallel K --review codex [--max-minutes 120] [--max-calls N] [--push]
 //   atris sentinel improve --schedule [--every 24] [--engine claude] | --unschedule
 
 const path = require('path');
@@ -51,12 +52,21 @@ function benchHelp() {
 
 async function benchCommand(argv, deps = {}) {
   if (argv.includes('--help') || argv.includes('-h') || argv[0] === 'help') return benchHelp();
-  try { checkFlags(argv, ['--summary', '--json', '--review'], ['--split', '--set', '--sets', '--target', '--seen', '--hunter', '--verifier', '--budget']); } catch (e) { console.error(`  ${e.message}`); return 2; }
+  try { checkFlags(argv, ['--summary', '--json', '--review'], ['--split', '--set', '--sets', '--target', '--seen', '--hunter', '--verifier', '--budget', '--screen']); } catch (e) { console.error(`  ${e.message}`); return 2; }
   const bench = require('../lib/sentinel-bench');
   const env = deps.env || process.env;
   const root = path.resolve(readFlag(argv, '--target') || deps.root || process.cwd());
   const seenDir = path.resolve(readFlag(argv, '--seen') || bench.seenDirOf(root));
   const holdoutDir = bench.defaultHoldoutDir(env);
+  const screen = readFlag(argv, '--screen');
+  if (screen) {
+    // Internal to the night run: refused ids only, as json.
+    let candidates;
+    try { candidates = JSON.parse(require('fs').readFileSync(path.resolve(screen), 'utf8')); } catch (e) { console.error(`  could not read the items to screen: ${e.message}`); return 1; }
+    if (!Array.isArray(candidates)) { console.error('  the items to screen must be a json list'); return 1; }
+    console.log(JSON.stringify({ ok: true, ...bench.screenItems(candidates, { holdoutDir, env }) }));
+    return 0;
+  }
   const split = readFlag(argv, '--split');
   if (split) {
     const set = readFlag(argv, '--set');
@@ -97,26 +107,49 @@ function improveHelp() {
   atris sentinel improve, one exam-checked change to the sentinel
 
     atris sentinel improve [--engine claude]   propose one change and judge it
+    atris sentinel improve --focus exfil       point the proposer at one area:
+                                               exfil, destroy, disarm or agents
     atris sentinel improve --offline           skip the published advisory lookup
     atris sentinel improve --schedule [--every 24] [--engine claude]
                                                run it on a timer, nightly by default
     atris sentinel improve --unschedule        turn the timer off
 
+  a night run, many changes in one sitting:
+
+    atris sentinel improve --rounds 4 --parallel 3 --review codex
+        --rounds N        up to N rounds. each starts from what shipped before
+        --parallel K      K proposers at once, each on its own area (up to 4)
+        --review codex    codex reviews every change the exam keeps. SHIP keeps
+                          it. FIX rejects it and its examples join the exam
+        --max-minutes M   stop after M minutes (120 by default)
+        --max-calls C     stop after C proposer and reviewer calls
+        --push            push the two night branches by name when done
+    atris sentinel improve --break-lock    clear a night run lock whose run is gone
+
+  shipped rules land on sentinel-improve/night-<date>. new exam items land
+  apart on sentinel-exam/<date>. you can review them on their own. the
+  run stops early after two rounds with nothing shipped or no held-out gain.
+
   claude proposes one change to lib/sentinel-rules.json on a new branch,
   sealed off from the held-out exam. the sentinel bench, fixed code with no
   model, scores it before and after. it is kept only when
   held-out attack catch holds or rises, wrong blocks and false alarms do
   not rise and no seen item that passed now fails. a kept change waits on
-  its branch for you. nothing is merged, pushed or released.
+  its branch for you. nothing is merged or released. nothing is pushed without --push.
 `);
   return 0;
 }
 
 async function improveCommand(argv, deps = {}) {
   if (argv.includes('--help') || argv.includes('-h') || argv[0] === 'help') return improveHelp();
-  try { checkFlags(argv, ['--json', '--offline', '--schedule', '--unschedule'], ['--engine', '--every']); } catch (e) { console.error(`  ${e.message}`); return 2; }
+  try { checkFlags(argv, ['--json', '--offline', '--schedule', '--unschedule', '--push', '--break-lock'], ['--engine', '--every', '--focus', '--rounds', '--parallel', '--review', '--max-minutes', '--max-calls']); } catch (e) { console.error(`  ${e.message}`); return 2; }
   const improve = require('../lib/sentinel-improve');
   const env = deps.env || process.env;
+  if (argv.includes('--break-lock')) {
+    const res = require('../lib/sentinel-night').breakLock(env);
+    (res.refused ? console.error : console.log)(`  ${res.message}`);
+    return res.refused ? 1 : 0;
+  }
   const engine = readFlag(argv, '--engine') || 'claude';
   if (!/^[a-z][a-z0-9:_-]{0,30}$/.test(engine)) { console.error(`  unknown engine: ${engine}`); return 2; }
   const refused = require('../lib/sentinel-improve').refusedEngine(engine);
@@ -148,9 +181,14 @@ async function improveCommand(argv, deps = {}) {
     console.log('  each run leaves a receipt in ~/.atris/sentinel-improve/receipts. kept changes wait on their branch for you');
     return 0;
   }
+  const focus = readFlag(argv, '--focus');
+  if (argv.includes('--focus') && !focus) { console.error('  --focus needs exfil, destroy, disarm or agents'); return 2; }
+  if (focus && !improve.FOCI.includes(focus)) { console.error(`  unknown focus: ${focus}. use exfil, destroy, disarm or agents`); return 2; }
+  const nightFlags = ['--rounds', '--parallel', '--review', '--max-minutes', '--max-calls', '--push'];
+  if (argv.some((a) => nightFlags.includes(String(a).split('=')[0]))) return nightCommand(argv, { root, engine, env, focus, deps });
   let res;
   try {
-    res = await improve.improve({ root, engine, env, offline: argv.includes('--offline'), log: argv.includes('--json') ? () => {} : (m) => console.log(`  ${m}`), ...(deps.improveOpts || {}) });
+    res = await improve.improve({ root, engine, env, focus, offline: argv.includes('--offline'), log: argv.includes('--json') ? () => {} : (m) => console.log(`  ${m}`), ...(deps.improveOpts || {}) });
   } catch (e) { console.error(`  improve did not run: ${e.message}`); return 1; }
   if (argv.includes('--json')) {
     console.log(JSON.stringify({ ok: !res.error, kept: res.kept, branch: res.branch, error: res.error || null, decision: res.decision, receipt: res.receipt }, null, 2));
@@ -169,4 +207,44 @@ async function improveCommand(argv, deps = {}) {
   return res.error ? 1 : 0;
 }
 
+function numFlag(argv, name) {
+  const v = readFlag(argv, name);
+  if (v === null) return argv.includes(name) ? NaN : undefined;
+  return Number(v);
+}
+
+async function nightCommand(argv, { root, engine, env, focus, deps }) {
+  const improve = require('../lib/sentinel-improve');
+  const review = readFlag(argv, '--review');
+  if (argv.includes('--review') && !review) { console.error('  --review needs codex'); return 2; }
+  if (review && review !== 'codex') { console.error('  --review takes codex only'); return 2; }
+  const opts = { root, engine, env, focus, review, push: argv.includes('--push'), offline: argv.includes('--offline') };
+  for (const [flag, key] of [['--rounds', 'rounds'], ['--parallel', 'parallel'], ['--max-minutes', 'maxMinutes'], ['--max-calls', 'maxCalls']]) {
+    const n = numFlag(argv, flag);
+    if (n === undefined) continue;
+    if (!Number.isFinite(n) || n <= 0) { console.error(`  ${flag} needs a number above 0`); return 2; }
+    if (key !== 'maxMinutes' && !Number.isInteger(n)) { console.error(`  ${flag} needs a whole number`); return 2; }
+    if (key === 'parallel' && n > improve.FOCI.length) { console.error(`  --parallel goes up to ${improve.FOCI.length}, one proposer per focus area`); return 2; }
+    opts[key] = n;
+  }
+  const json = argv.includes('--json');
+  let res;
+  try {
+    res = await require('../lib/sentinel-night').night({ ...opts, log: json ? () => {} : (m) => console.log(`  ${m}`), ...(deps.nightOpts || {}) });
+  } catch (e) { console.error(`  improve did not run: ${e.message}`); return 1; }
+  if (json) {
+    console.log(JSON.stringify({ ok: !res.error, shipped: res.landed, stop: res.stop, night_branch: res.night_branch, exam_branch: res.exam_branch, exam_added: res.exam_added, calls: res.calls, minutes: res.minutes, pushed: res.pushed, error: res.error || null, receipt: res.receipt }, null, 2));
+    return res.error ? 1 : 0;
+  }
+  const home = require('os').homedir();
+  console.log('');
+  console.log(`  ${res.landed} ${res.landed === 1 ? 'change' : 'changes'} shipped in ${res.rounds.length} ${res.rounds.length === 1 ? 'round' : 'rounds'}. stopped because ${res.stop}`);
+  if (res.night_branch) console.log(`  rules wait on ${res.night_branch}`);
+  if (res.exam_branch) console.log(`  ${res.exam_added} new exam items wait on ${res.exam_branch}`);
+  if (res.pushed.length) console.log(`  pushed: ${res.pushed.join(', ')}`);
+  console.log(`  used ${res.calls} engine calls in ${res.minutes} minutes`);
+  console.log(`  receipt: ${res.receipt.replace(home, '~')}\n`);
+  return res.error ? 1 : 0;
+}
+
 module.exports = { benchCommand, improveCommand };

package/lib/sentinel-bench.js

@@ -158,12 +158,18 @@ function keyFromKeychain() {
   return add.status === 0 ? read() : null;
 }
 
+// Where the last key came from: 'keychain' or 'file'. The night run asks
+// for this in the report and refuses a file key: a reviewer that can read
+// files could read a key file too.
+let lastKeySource = null;
+
 function holdoutKey(env = process.env) {
-  if (env.ATRIS_SENTINEL_KEY_FILE) return keyFromFile(env.ATRIS_SENTINEL_KEY_FILE);
+  if (env.ATRIS_SENTINEL_KEY_FILE) { lastKeySource = 'file'; return keyFromFile(env.ATRIS_SENTINEL_KEY_FILE); }
   if (process.platform === 'darwin' && env.ATRIS_SENTINEL_KEYCHAIN !== '0') {
     const k = keyFromKeychain();
-    if (k) return k;
+    if (k) { lastKeySource = 'keychain'; return k; }
   }
+  lastKeySource = 'file';
   return keyFromFile(path.join(homeDir(env), '.atris', 'sentinel-judge', 'holdout.key'));
 }
 
@@ -416,9 +422,47 @@ async function runBench({ target, seenDir, holdoutDir, sets = ['guard', 'agents'
       report[half][set] = score;
     }
   }
+  report.key_source = lastKeySource;
   return report;
 }
 
+// ---------------------------------------------------------------- screen
+
+// Lowercase with whitespace collapsed, for overlap checks.
+function normalizeText(v) {
+  return String(v || '').toLowerCase().replace(/\s+/g, ' ').trim();
+}
+
+function itemTexts(set, item) {
+  if (set === 'guard') return [item.command !== undefined ? item.command : JSON.stringify(item.input || '')];
+  return Object.entries(item.files || {}).map(([f, c]) => `${f} ${typeof c === 'string' ? c : JSON.stringify(c)}`).concat(Object.values(item.files || {}).map((c) => (typeof c === 'string' ? c : JSON.stringify(c))));
+}
+
+// New seen items proposed from outside (the night reviewer) checked against
+// the held-out half. This runs in the judge, the one process that holds it. An item
+// whose normalized text equals, contains or sits inside any held-out item's
+// text is refused. Only the refused ids leave this function, never a
+// held-out item. A held-out set that cannot be read refuses everything.
+function screenItems(candidates, { holdoutDir, env = process.env } = {}) {
+  const held = path.resolve(holdoutDir || defaultHoldoutDir(env));
+  const texts = [];
+  let unreadable = false;
+  for (const set of ['guard', 'agents']) {
+    try {
+      const loaded = loadSet(held, set, { held: true, env });
+      for (const item of loaded.items) for (const t of itemTexts(set, item)) { const n = normalizeText(t); if (n) texts.push(n); }
+    } catch { unreadable = true; }
+  }
+  const refused = [];
+  for (const c of candidates) {
+    if (!c || typeof c.id !== 'string' || (c.set !== 'guard' && c.set !== 'agents')) continue;
+    if (unreadable) { refused.push(c.id); continue; }
+    const mine = itemTexts(c.set, c.item || {}).map(normalizeText).filter(Boolean);
+    if (!mine.length || mine.some((m) => texts.some((h) => h === m || h.includes(m) || m.includes(h)))) refused.push(c.id);
+  }
+  return { refused, key_source: lastKeySource, unreadable };
+}
+
 // What may leave this module: held-out totals only, never an item. With
 // summary, seen items are dropped too.
 function publicReport(report, { summary = false } = {}) {
@@ -437,6 +481,8 @@ function publicReport(report, { summary = false } = {}) {
     holdout_dir: report.holdout_dir,
     // Sealed split sources, paths only. The improver uses them to deny reads.
     sealed_sources: report.sealed_sources || [],
+    // How the judge got the held-out key: 'keychain' or 'file'. Never the key.
+    key_source: report.key_source || null,
   };
 }
 
@@ -541,6 +587,8 @@ module.exports = {
   SETS,
   readHeldText,
   readSealedSources,
+  normalizeText,
+  screenItems,
   FAKE,
   defaultHoldoutDir,
   expand,

package/lib/sentinel-guard.js

@@ -36,8 +36,9 @@
 //
 // Accepted limits: a determined program that hides its intent can still get
 // past fixed rules. Encoded payloads, a script written to disk and then run,
-// and interpreters like python -c or node -e are not read unless they name
-// a protected path. The guard is a seatbelt, not a sandbox. Pair it with
+// and code piped into an interpreter are not read. Inline code like python -c
+// or node -e is read only by command blocks in the rules file that ask for
+// it (inline, needs_secret, needs_remote), and by the protected path check. The guard is a seatbelt, not a sandbox. Pair it with
 // approval prompts for anything risky.
 //
 // The guard fails open: if it crashes or reads bad input it allows the call
@@ -135,8 +136,11 @@ function compileRules(raw) {
     commandBlocks: (Array.isArray(g.command_blocks) ? g.command_blocks : []).map((b, i) => {
       if (!b || !RULE_CATEGORIES.includes(b.category)) throw new Error(`rules: guard.command_blocks[${i}].category must be exfil, destroy or disarm`);
       const all = list(b.all, `command_blocks[${i}].all`);
-      if (!all.length) throw new Error(`rules: guard.command_blocks[${i}].all needs at least one substring`);
-      return { id: String(b.id || i), category: b.category, programs: Array.isArray(b.programs) ? new Set(b.programs.map(String)) : null, all };
+      const needsSecret = b.needs_secret === true;
+      const needsRemote = b.needs_remote === true;
+      if (!all.length && !needsSecret && !needsRemote) throw new Error(`rules: guard.command_blocks[${i}].all needs at least one substring`);
+      const unless = b.unless === undefined ? [] : list(b.unless, `command_blocks[${i}].unless`);
+      return { id: String(b.id || i), category: b.category, programs: Array.isArray(b.programs) ? new Set(b.programs.map(String)) : null, all, inline: b.inline === true, needsSecret, needsRemote, unless };
     }),
   };
 }
@@ -704,13 +708,197 @@ const BLOCK_REASON = {
   disarm: ['blocked: this command matches a known way to turn off a protection.', 'An agent ran a command that matches a known way to turn off a protection. Nothing changed.'],
 };
 
-// Literal command blocks from the rules file. Each block reads the whole
-// command with plain substring checks, limited to commands that run one of
-// its programs when it lists any. Linear time, no regular expression.
-function checkBlocks(command, cmds) {
+// Literal command blocks from the rules file, matched with plain substring
+// checks in linear time, never a regular expression. A block that lists
+// programs reads only the words of each piece of the command that runs one of
+// them, so harmless pieces chained with && or ; never add up to a match. A
+// block with no programs reads the whole command. Fail closed: when a piece can
+// receive code from elsewhere (a pipe, any redirect or file write, a heredoc or
+// here-string, a command substitution, a shell variable, eval, source or a shell
+// string), every block reads the whole command. Per-piece matching is only for
+// plain chains that pass nothing between pieces.
+// Accepted limit: the guard judges one command at a time, so a script written by
+// one command and run by a later, separate command is not connected by any rule.
+//
+// Four optional conditions narrow a block. All are fixed code here, plain
+// string scans and URL parsing in linear time. Nothing from the rules file is
+// ever compiled.
+//   inline        the piece must run a program with inline code (python -c,
+//                 node -e, --eval or -p, perl -e, ruby -e, php -r) and the
+//                 block reads only that code. When the code itself expands a
+//                 shell value ($ or a command substitution), the code could be
+//                 anything, so the block reads the whole command instead.
+//   needs_secret  the text must name a secret: a secret-looking variable
+//                 ($GITHUB_TOKEN, os.environ['OPENAI_API_KEY'], os.getenv,
+//                 process.env.X, ENV['X'], $ENV{X}), the whole environment
+//                 (dict(os.environ), JSON.stringify(process.env)), a secrets
+//                 file or a key-shaped string. For inline code, what is piped
+//                 or redirected into that piece counts too.
+//   needs_remote  the text must hold an http(s) address or a host:port whose
+//                 host is not this machine and not on the trusted host list.
+//                 For inline code it must also make a network call (urlopen,
+//                 requests, fetch, Net::HTTP, LWP, socket and the like).
+//   unless        literal substrings. If any is in the text, the block does
+//                 not fire on it.
+// A block with none of them behaves exactly as before.
+// Accepted limit: PHP $_ENV['X'] access is not read as a secret name.
+// Accepted limit: a connection to a bare host with no URL or host:port, like
+// socket.connect(('badhost.net', 443)), is not read as a remote address.
+const FEEDS_CODE = ['|', '<', '>', '`', '$', 'tee ', 'eval', 'source ', 'sh -c', 'bash -c', 'zsh -c'];
+
+// Interpreter families and the options that carry inline code.
+const INLINE_SPEC = {
+  python: { long: [], short: 'c', takesValue: ['-W', '-X', '-Q'] },
+  node: { long: ['--eval', '--print'], short: 'ep', takesValue: ['-r', '--require', '--import', '--loader', '--experimental-loader', '--input-type', '--title', '--env-file'] },
+  perl: { long: [], short: 'eE', takesValue: ['-I', '-M', '-m'] },
+  ruby: { long: [], short: 'e', takesValue: ['-I', '-r'] },
+  php: { long: [], short: 'r', takesValue: ['-d', '-c'] },
+  other: { long: ['--eval'], short: 'ce', takesValue: [] },
+};
+function inlineFamily(name) {
+  const n = String(name || '').toLowerCase();
+  if (/^(?:python|pypy)(?:\d+(?:\.\d+)?)?$/.test(n)) return 'python';
+  if (n === 'node' || n === 'nodejs' || n === 'bun') return 'node';
+  if (n === 'perl' || n === 'ruby' || n === 'php') return n;
+  return null;
+}
+
+// The inline code arguments of one piece, or [] when it carries none. Stops
+// at the first plain argument: that is a script file, and what follows it
+// belongs to the script.
+function inlineCode(c) {
+  const spec = INLINE_SPEC[inlineFamily(c.name) || 'other'];
+  const args = (c.args || []).map(String);
+  const out = [];
+  for (let k = 0; k < args.length; k++) {
+    const a = args[k];
+    if (a === '--' || a === '-' || !a.startsWith('-')) break;
+    if (a.startsWith('--')) {
+      const eq = a.indexOf('=');
+      const name = eq === -1 ? a : a.slice(0, eq);
+      if (spec.long.includes(name)) { if (eq !== -1) out.push(a.slice(eq + 1)); else if (k + 1 < args.length) out.push(args[++k]); continue; }
+      if (spec.takesValue.includes(name) && eq === -1) k += 1;
+      continue;
+    }
+    if (spec.takesValue.includes(a)) { k += 1; continue; }
+    const letters = a.slice(1);
+    // node -pe CODE: print and eval together, the code is the next word.
+    if (inlineFamily(c.name) === 'node' && (letters === 'pe' || letters === 'ep')) { if (k + 1 < args.length) out.push(args[++k]); continue; }
+    // Read like getopt: the first code letter takes the rest of the word as
+    // its code (python3 -c"CODE", perl -e'CODE', perl -ne'CODE'), or the next
+    // word when nothing follows it (-c CODE, perl -ne CODE).
+    const at = [...letters].findIndex((ch) => spec.short.includes(ch));
+    if (at === -1) continue;
+    if (at + 1 < letters.length) out.push(letters.slice(at + 1));
+    else if (k + 1 < args.length) out.push(args[++k]);
+  }
+  return out;
+}
+
+// Environment lookups by name in inline code. Hand-written, linear: one
+// character class per run, no nesting.
+const ENV_NAME_SHAPES = [
+  /(?:\benviron|\bENV|\$ENV|\benv)\s*[[{]\s*['"`]?([A-Za-z_][A-Za-z0-9_]*)/g,
+  /\b(?:getenv|environ\.get|environ\.pop|environ\.setdefault|ENV\.fetch|env\.get)\s*\(\s*['"`]([A-Za-z_][A-Za-z0-9_]*)/g,
+  /\b(?:process|Bun|meta)\.env\.([A-Za-z_][A-Za-z0-9_]*)/g,
+];
+// The whole environment at once.
+const WHOLE_ENV = [
+  /\bos\.environ\b(?!\s*(?:\[|\.get\b|\.pop\b|\.setdefault\b))/,
+  /\bprocess\.env\b(?!\s*[.[])/,
+  /%ENV\b/,
+  /\bENV\.(?:to_h|to_a|each|map|inspect|keys|values)\b/,
+  /\bgetenv\(\s*\)/,
+];
+function namesSecret(text) {
+  const t = String(text || '');
+  if (hasSecretVar(t)) return true;
+  for (const re of ENV_NAME_SHAPES) {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(t))) if (secretVarName(m[1])) return true;
+  }
+  if (WHOLE_ENV.some((re) => re.test(t))) return true;
+  if (R().secretFiles.some((re) => re.test(t))) return true;
+  return R().keyShapes.some((re) => { re.lastIndex = 0; return re.test(t); });
+}
+
+// What flows into a piece from elsewhere: files redirected in and the
+// earlier stages of its pipeline.
+// earlier stages of its pipeline. Each pipeline is scanned once per command:
+// `seen` keeps, per pipeline, whether a secret enters before each stage.
+function inputNamesSecret(c, seen) {
+  if ((c.reads || []).some((f) => namesSecret(f))) return true;
+  const pipe = c.pipe || [];
+  let before = seen.get(pipe);
+  if (!before) {
+    before = [false];
+    for (const st of pipe) before.push(before[before.length - 1] || isEnvDump(st) || namesSecret((st.words || [st.name, ...(st.args || [])]).join(' ')));
+    seen.set(pipe, before);
+  }
+  return before[c.index || 0];
+}
+
+// A network call in inline code. needs_remote on inline code wants one of
+// these next to the address, so printing a docs link is not a send.
+const NET_CALLS = ['urlopen', 'requests', 'http.client', 'urllib', 'fetch', 'https.request', 'http.request', 'https.get', 'http.get', 'axios', 'net.connect', 'curl_exec', 'file_get_contents', 'Net::HTTP', 'LWP', 'socket'];
+const callsNet = (text) => NET_CALLS.some((w) => text.includes(w));
+
+const LOCAL_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '0.0.0.0']);
+const URL_SHAPE = /\bhttps?:\/\/[^\s'"`<>(){}\\,;|]+/gi;
+const HOST_PORT = /^([A-Za-z0-9][A-Za-z0-9.-]*|\[[0-9A-Fa-f:.]+\]):(\d{1,5})(?:\/\S*)?$/;
+function isRemote(host, allowHosts) {
+  const h = String(host || '').replace(/^\[|\]$/g, '').toLowerCase();
+  if (!h || LOCAL_HOSTS.has(h)) return false;
+  return !hostAllowed(h, allowHosts);
+}
+function namesRemote(text, allowHosts) {
+  const t = String(text || '');
+  URL_SHAPE.lastIndex = 0;
+  let m;
+  while ((m = URL_SHAPE.exec(t))) {
+    let u;
+    try { u = new URL(m[0]); } catch { continue; }
+    if (isRemote(u.hostname, allowHosts)) return true;
+  }
+  for (const tok of t.split(/[\s'"`(),;{}<>=+\\|&]+/)) {
+    if (!tok || tok.length > 300 || tok.includes('://')) continue;
+    const hp = HOST_PORT.exec(tok);
+    if (!hp) continue;
+    const host = hp[1];
+    if (!host.startsWith('[') && !host.includes('.')) continue;
+    if (Number(hp[2]) > 65535) continue;
+    if (isRemote(host, allowHosts)) return true;
+  }
+  return false;
+}
+
+function checkBlocks(command, cmds, { allowHosts = R().allowHosts } = {}) {
+  const whole = FEEDS_CODE.some((t) => command.includes(t));
+  const seen = new Map();
   for (const b of R().commandBlocks) {
     if (b.programs && !cmds.some((c) => b.programs.has(c.name))) continue;
-    if (!b.all.every((sub) => command.includes(sub))) continue;
+    // Each entry: the text the block reads, and the piece it came from.
+    let texts;
+    if (b.inline) {
+      texts = [];
+      let wholeAdded = false;
+      for (const c of cmds) {
+        if (b.programs ? !b.programs.has(c.name) : !inlineFamily(c.name)) continue;
+        const code = inlineCode(c);
+        if (!code.length) continue;
+        const expands = code.some((x) => x.includes('$') || x.includes('`'));
+        // The whole command is read at most once, however many pieces expand.
+        if (expands) { if (!wholeAdded) texts.push({ text: command, piece: c }); wholeAdded = true; } else texts.push({ text: code.join('\n'), piece: c });
+      }
+    } else if (b.programs && !whole) {
+      texts = cmds.filter((c) => b.programs.has(c.name)).map((c) => ({ text: (c.words || [c.name, ...(c.args || [])]).join(' '), piece: null }));
+    } else texts = [{ text: command, piece: null }];
+    const fires = texts.some(({ text, piece }) => b.all.every((sub) => text.includes(sub))
+      && !b.unless.some((sub) => text.includes(sub))
+      && (!b.needsSecret || namesSecret(text) || (piece && inputNamesSecret(piece, seen)))
+      && (!b.needsRemote || ((!b.inline || callsNet(text)) && namesRemote(text, allowHosts))));
+    if (!fires) continue;
     const [reason, detail] = BLOCK_REASON[b.category];
     return block(`${b.category}-block`, b.category === 'disarm' ? 'high' : 'critical', reason, detail);
   }
@@ -737,7 +925,7 @@ function decideWith(event, { env, gitBranch }) {
     return checkExfil(command, cmds, { allowHosts })
       || checkDestroy(command, cmds, { cwd, homeDirPath: homeDir(env), gitBranch })
       || checkDisarm(command, cmds, { env, cwd })
-      || checkBlocks(command, cmds)
+      || checkBlocks(command, cmds, { allowHosts })
       || { allow: true };
   }
   if (tool === 'Edit' || tool === 'Write' || tool === 'MultiEdit' || tool === 'NotebookEdit') return checkEdit(tool, input, { env, cwd }) || { allow: true };